Your IP : 172.28.240.42

Current Path : /usr/lib/python2.7/dist-packages/twisted/cred/
Upload File :
Current File : //usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyc


[XMc@sddlmZmZddlZddlZddlZddlmZddlm	Z	ddl
mZmZm
Z
ddlmZdefdYZd	efd
YZdefdYZd
efdYZdefdYZdefdYZdefdYZdd%dYZdd&dYZdd'dYZdd(dYZdefdYZdd)d YZd!efd"YZd#d*d$YZdS(+i(t
implementst	InterfaceN(tmd5(tsecureRandom(tcalcResponsetcalcHA1tcalcHA2(terrortICredentialscBseZdZRS(s
    I check credentials.

    Implementors _must_ specify which sub-interfaces of ICredentials
    to which it conforms, using zope.interface.implements().
    (t__name__t
__module__t__doc__(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRstIUsernameDigestHashcBseZdZdZRS(s
    This credential is used when a CredentialChecker has access to the hash
    of the username:realm:password as in an Apache .htdigest file.
    cCsdS(s-
        @param digestHash: The hashed username:realm:password to check against.

        @return: C{True} if the credentials represented by this object match
            the given hash, C{False} if they do not, or a L{Deferred} which
            will be called back with one of these values.
        N((t
digestHash((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyt	checkHashs(R	R
RR(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRstIUsernameHashedPasswordcBseZdZdZRS(s
    I encapsulate a username and a hashed password.

    This credential is used when a hashed password is received from the
    party requesting authentication.  CredentialCheckers which check this
    kind of credential must store the passwords in plaintext (or as
    password-equivalent hashes) form so that they can be hashed in a manner
    appropriate for the particular credentials class.

    @type username: C{str}
    @ivar username: The username associated with these credentials.
    cCsdS(s
        Validate these credentials against the correct password.

        @type password: C{str}
        @param password: The correct, plaintext password against which to
        check.

        @rtype: C{bool} or L{Deferred}
        @return: C{True} if the credentials represented by this object match the
            given password, C{False} if they do not, or a L{Deferred} which will
            be called back with one of these values.
        N((tpassword((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyt
checkPassword7s(R	R
RR(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyR)stIUsernamePasswordcBseZdZdZRS(sG
    I encapsulate a username and a plaintext password.

    This encapsulates the case where the password received over the network
    has been hashed with the identity function (That is, not at all).  The
    CredentialsChecker may store the password in whatever format it desires,
    it need only transform the stored password in a similar way before
    performing the comparison.

    @type username: C{str}
    @ivar username: The username associated with these credentials.

    @type password: C{str}
    @ivar password: The password associated with these credentials.
    cCsdS(s
        Validate these credentials against the correct password.

        @type password: C{str}
        @param password: The correct, plaintext password against which to
        check.

        @rtype: C{bool} or L{Deferred}
        @return: C{True} if the credentials represented by this object match the
            given password, C{False} if they do not, or a L{Deferred} which will
            be called back with one of these values.
        N((R((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRXs(R	R
RR(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRGst
IAnonymouscBseZdZRS(s:
    I am an explicitly anonymous request for access.
    (R	R
R(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRhstDigestedCredentialscBs6eZdZeeedZdZdZRS(s?
    Yet Another Simple HTTP Digest authentication scheme.
    cCs(||_||_||_||_dS(N(tusernametmethodtrealmtfields(tselfRRRR((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyt__init__us			c
Cs|jjd}|jjd}|jjd}|jjd}|jjd}|jjddj}|jjdd	}tt||j|j|||t||j||d
|||||}	|	|kS(s
        Verify that the credentials represented by this object agree with the
        given plaintext C{password} by hashing C{password} in the same way the
        response hash represented by this object was generated and comparing
        the results.
        tresponseturitnoncetcnoncetnct	algorithmRtqoptauthN(
RtgettlowerRRRRRRtNone(
RRRRRRRtalgoR!texpected((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyR|sc

Cs|jjd}|jjd}|jjd}|jjd}|jjd}|jjddj}|jjdd	}tt|ddd||d
|t||j||d|||||}	|	|kS(s4
        Verify that the credentials represented by this object agree with the
        credentials represented by the I{H(A1)} given in C{digestHash}.

        @param digestHash: A precomputed H(A1) value based on the username,
            realm, and password associate with this credentials object.
        RRRRRR RR!R"tpreHA1N(RR#R$RRR%RR(
RR
RRRRRR&R!R'((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRs(	R	R
RRRRRRR(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRos

		tDigestCredentialFactorycBsYeZdZdZdZdZdZdZdZdZ	d	Z
d
ZRS(sl
    Support for RFC2617 HTTP Digest Authentication

    @cvar CHALLENGE_LIFETIME_SECS: The number of seconds for which an
        opaque should be valid.

    @type privateKey: C{str}
    @ivar privateKey: A random string used for generating the secure opaque.

    @type algorithm: C{str}
    @param algorithm: Case insensitive string specifying the hash algorithm to
        use.  Must be either C{'md5'} or C{'sha'}.  C{'md5-sess'} is B{not}
        supported.

    @type authenticationRealm: C{str}
    @param authenticationRealm: case sensitive string that specifies the realm
        portion of the challenge
    ii<tdigestcCs%||_||_td|_dS(Ni(R tauthenticationRealmRt
privateKey(RR R+((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRs		cCsK|j}|j||}i|d6|d6dd6|jd6|jd6S(s

        Generate the challenge for use in the WWW-Authenticate header.

        @param address: The client address to which this challenge is being
        sent.

        @return: The C{dict} that can be used to generate a WWW-Authenticate
            header.
        RtopaqueR"R!R R(t_generateNoncet_generateOpaqueR R+(Rtaddresstcto((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pytgetChallenges


cCstdjdS(s
        Create a random value suitable for use as the nonce parameter of a
        WWW-Authenticate challenge.

        @rtype: C{str}
        ithex(Rtencode(R((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyR.scCs
tjS(s
        Parameterize the time based seed used in C{_generateOpaque}
        so we can deterministically unittest it's behavior.
        (ttime(R((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyt_getTimescCstt|j}|dkr-d}nd|||f}t||jj}|jd}d||jddfS(s
        Generate an opaque to be returned to the client.  This is a unique
        string that can be returned to us and verified.
        ts%s,%s,%stbase64s%s-%ss
N(	tstrtintR7R%RR,t	hexdigestR5treplace(RRtclientiptnowtkeyR*tekey((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyR/s	c	Csy|jd}t|dkr3tjdn|dkrHd}n|djd}|jd}t|dkrtjdn|d	|krtjd
n|d|krtjdnyt|d}Wn tk
rtjdnXt|j|t	j
kr:tjd
nt||jj
}||d	krutjdntS(s
        Given the opaque and nonce from the request, as well as the client IP
        that made the request, verify that the opaque was generated by us.
        And that it's not too old.

        @param opaque: The opaque value from the Digest response
        @param nonce: The nonce value from the Digest response
        @param clientip: The remote IP address of the client making the request
            or C{None} if the request was submitted over a channel where this
            does not make sense.

        @return: C{True} if the opaque was successfully verified.

        @raise error.LoginFailed: if C{opaque} could not be parsed or
            contained the wrong values.
        t-is&Invalid response, invalid opaque valueR8iR9t,iis2Invalid response, incompatible opaque/nonce valuess3Invalid response, incompatible opaque/client valuess,Invalid response, invalid opaque/time valuess3Invalid response, incompatible opaque/nonce too oldN(tsplittlenRtLoginFailedR%tdecodeR;t
ValueErrorR7R)tCHALLENGE_LIFETIME_SECSRR,R<tTrue(	RR-RR>topaquePartsR@tkeyPartstwhenR*((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyt
_verifyOpaques8	

cCs)d}dj|j}|jd}i}xOg|D]}|jdd^q=D](\}}	||	j||j<qYW|jd}
|
stjdnd|krtjd	nd
|krtjdn|j|jd|jd
|r%t|
||j	|SdS(
sy
        Decode the given response and attempt to generate a
        L{DigestedCredentials} from it.

        @type response: C{str}
        @param response: A string of comma seperated key=value pairs

        @type method: C{str}
        @param method: The action requested to which this response is addressed
        (GET, POST, INVITE, OPTIONS, etc).

        @type host: C{str}
        @param host: The address the request was sent from.

        @raise error.LoginFailed: If the response does not contain a username,
            a nonce, an opaque, or if the opaque is invalid.

        @return: L{DigestedCredentials}
        cSs3|d|dkodknr/|dd!S|S(Niit"i((ts((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pytunqPs$t RCt=iRs$Invalid response, no username given.R-s"Invalid response, no opaque given.Rs!Invalid response, no nonce given.N(
tjoint
splitlinesRDtstripR#RRFRNRR+(RRRthostRQtpartsR"tptktvR((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRG<s$	2 'i(R	R
RRItschemeRR3R.R7R/RNRG(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyR)s			
			<tCramMD5CredentialscBsNeZeedZdZddZdZdZ	dZ
dZRS(R8cCs
||_dS(N(RW(RRW((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRuscCsK|jr|jStjd}tj}d|||jf|_|jS(Nis
<%d.%d@%s>(t	challengetrandomt	randrangeR6RW(Rtrtt((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyR3xs	cCs"|jdd\|_|_dS(Ni(RDR%RR(RR((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pytsetResponsescCstS(N(tFalse(R((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pytmoreChallengesscCs(tj||jj}||jkS(N(thmactHMACR^R<R(RRtverify((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRsN(R	R
RRR^RR%RR3RcReR(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyR]os
			tUsernameHashedPasswordcBs$eZeedZdZRS(cCs||_||_dS(N(Rthashed(RRRj((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRs	cCs
|j|kS(N(Rj(RR((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRs(R	R
RRRR(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRis
	tUsernamePasswordcBs$eZeedZdZRS(cCs||_||_dS(N(RR(RRR((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRs	cCs
|j|kS(N(R(RR((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRs(R	R
RRRR(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRks
	t	AnonymouscBseZeeRS((R	R
RR(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRlstISSHPrivateKeycBseZdZRS(sd
    L{ISSHPrivateKey} credentials encapsulate an SSH public key to be checked
    against a user's private key.

    @ivar username: The username associated with these credentials.
    @type username: C{str}

    @ivar algName: The algorithm name for the blob.
    @type algName: C{str}

    @ivar blob: The public key blob as sent by the client.
    @type blob: C{str}

    @ivar sigData: The data the signature was made from.
    @type sigData: C{str}

    @ivar signature: The signed data.  This is checked to verify that the user
        owns the private key.
    @type signature: C{str} or C{NoneType}
    (R	R
R(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRmst
SSHPrivateKeycBseZeedZRS(cCs1||_||_||_||_||_dS(N(RtalgNametblobtsigDatat	signature(RRRoRpRqRr((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRs
				(R	R
RRmR(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRns
tIPluggableAuthenticationModulescBseZdZRS(sFI encapsulate the authentication of a user via PAM (Pluggable
    Authentication Modules.  I use PyPAM (available from
    http://www.tummy.com/Software/PyPam/index.html).

    @ivar username: The username for the user being logged in.

    @ivar pamConversion: A function that is called with a list of tuples
    (message, messageType).  See the PAM documentation
    for the meaning of messageType.  The function
    returns a Deferred which will fire with a list
    of (response, 0), one for each message.  The 0 is
    currently unused, but is required by the PAM library.
    (R	R
R(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRss
tPluggableAuthenticationModulescBseZeedZRS(cCs||_||_dS(N(Rt
pamConversion(RRRu((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRs	(R	R
RRsR(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyRts
((((((( tzope.interfaceRRRfR6R_ttwisted.python.hashlibRttwisted.python.randbytesRttwisted.cred._digestRRRttwisted.credRRRRRRtobjectRR)R]RiRkRlRmRnRsRt(((s</usr/lib/python2.7/dist-packages/twisted/cred/credentials.pyt<module>s($
!="