a
f�Wc�2 � @ sX d Z ddlmZmZ ddlmZmZmZmZ ddl Z e �
e �Z ddl
Z
ddlmZ ddlmZmZ ddlmZmZmZ ddlmZ ddlm mZ g d �Z G d
d � d e j �Z G d d
� d
e j e j!e j"�Z#G dd� de �Z$G dd� de �Z%G dd� de#�Z&G dd� de#�Z'G dd� de#�Z(G dd� de#�Z)G dd� de�Z*d d � eD �Z+d d � Z,e,� dS ) z.passlib.handlers.digests - plain hash digests
� )� b64encode� b64decode)�md5�sha1�sha256�sha512N)� plaintext)�unix_crypt_schemes�
to_unicode)�
uascii_to_str�unicode�u)�
classproperty)�ldap_plaintext�ldap_md5� ldap_sha1�ldap_salted_md5�ldap_salted_sha1�ldap_salted_sha256�ldap_salted_sha512Zldap_des_cryptZldap_bsdi_cryptZldap_md5_cryptZldap_sha1_cryptZ ldap_bcryptZldap_sha256_cryptZldap_sha512_cryptc @ s6 e Zd ZdZdZdZdZejZ e
dd� �Z dd� Z dS )�_Base64DigestHelperz helper for ldap_md5 / ldap_sha1Nc C s | j S )z/tell StaticHandler to strip ident from checksum)�ident��cls� r �A/usr/lib/python3.9/site-packages/passlib/handlers/ldap_digests.py� _hash_prefix2 s z _Base64DigestHelper._hash_prefixc C s0 t |t�r|�d�}| �|��� }t|��d�S )N�utf-8�ascii)�
isinstancer �encode�
_hash_func�digestr �decode)�self�secretZchkr r r �_calc_checksum7 s
z"_Base64DigestHelper._calc_checksum)
�__name__�
__module__� __qualname__�__doc__r r! � _hash_regex�uh�PADDED_BASE64_CHARS�checksum_charsr r r& r r r r r ) s
r c @ sV e Zd ZdZdZejZdZdZ dZ
d Z Z dZ dZ
dZ edd� �Zdd � Zd
d � ZdS ) �_SaltedBase64DigestHelperz-helper for ldap_salted_md5 / ldap_salted_sha1)�saltZ salt_sizeN� � c C s� t |dd�}| j�|�}|s(tj�| ��zt|�d��d��}W n t y^ tj�
| ��Y n0 | j }|snJ �| |d |� ||d � d�S )Nr �hash�tmp)�checksumr0 ) r
r+ �matchr, �excZInvalidHashErrorr �groupr � TypeErrorZMalformedHashError�
checksum_size)r r3 �m�data�csr r r � from_stringN s z%_SaltedBase64DigestHelper.from_stringc C s( | j | j }| jt|��d� }t|�S )Nr )r5 r0 r r r# r )r$ r< r3 r r r � to_string\ s z#_SaltedBase64DigestHelper.to_stringc C s( t |t�r|�d�}| �|| j ��� S )Nr )r r r r! r0 r" )r$ r% r r r r& a s
z(_SaltedBase64DigestHelper._calc_checksum)r' r( r) r* Z setting_kwdsr, r- r. r r! r+ Z
min_salt_sizeZ
max_salt_size�default_salt_size� classmethodr> r? r& r r r r r/ = s
r/ c @ s. e Zd ZdZd Zed�ZeZe �
ed��Z dS )r z�This class stores passwords using LDAP's plain MD5 format, and follows the :ref:`password-hash-api`.
The :meth:`~passlib.ifc.PasswordHash.hash` and :meth:`~passlib.ifc.PasswordHash.genconfig` methods have no optional keywords.
z{MD5}z%^\{MD5\}(?P<chk>[+/a-zA-Z0-9]{22}==)$N) r' r( r) r* �namer
r r r! �re�compiler+ r r r r r i s
r c @ s. e Zd ZdZd Zed�ZeZe �
ed��Z dS )r z�This class stores passwords using LDAP's plain SHA1 format, and follows the :ref:`password-hash-api`.
The :meth:`~passlib.ifc.PasswordHash.hash` and :meth:`~passlib.ifc.PasswordHash.genconfig` methods have no optional keywords.
z{SHA}z$^\{SHA\}(?P<chk>[+/a-zA-Z0-9]{27}=)$N) r' r( r) r* rB r
r r r! rC rD r+ r r r r r s s
r c @ s2 e Zd ZdZd Zed�ZdZeZ e
� ed��Z dS )r a� This class stores passwords using LDAP's salted MD5 format, and follows the :ref:`password-hash-api`.
It supports a 4-16 byte salt.
The :meth:`~passlib.ifc.PasswordHash.using` method accepts the following optional keywords:
:type salt: bytes
:param salt:
Optional salt string.
If not specified, one will be autogenerated (this is recommended).
If specified, it may be any 4-16 byte string.
:type salt_size: int
:param salt_size:
Optional number of bytes to use when autogenerating new salts.
Defaults to 4 bytes for compatibility with the LDAP spec,
but some systems use larger salts, and Passlib supports
any value between 4-16.
:type relaxed: bool
:param relaxed:
By default, providing an invalid value for one of the other
keywords will result in a :exc:`ValueError`. If ``relaxed=True``,
and the error can be corrected, a :exc:`~passlib.exc.PasslibHashWarning`
will be issued instead. Correctable errors include
``salt`` strings that are too long.
.. versionadded:: 1.6
.. versionchanged:: 1.6
This format now supports variable length salts, instead of a fix 4 bytes.
z{SMD5}r2 z+^\{SMD5\}(?P<tmp>[+/a-zA-Z0-9]{27,}={0,2})$N)
r' r( r) r* rB r
r r: r r! rC rD r+ r r r r r } s r c @ s2 e Zd ZdZd Zed�ZdZeZ e
� ed��Z dS )r a�
This class stores passwords using LDAP's "Salted SHA1" format,
and follows the :ref:`password-hash-api`.
It supports a 4-16 byte salt.
The :meth:`~passlib.ifc.PasswordHash.using` method accepts the following optional keywords:
:type salt: bytes
:param salt:
Optional salt string.
If not specified, one will be autogenerated (this is recommended).
If specified, it may be any 4-16 byte string.
:type salt_size: int
:param salt_size:
Optional number of bytes to use when autogenerating new salts.
Defaults to 4 bytes for compatibility with the LDAP spec,
but some systems use larger salts, and Passlib supports
any value between 4-16.
:type relaxed: bool
:param relaxed:
By default, providing an invalid value for one of the other
keywords will result in a :exc:`ValueError`. If ``relaxed=True``,
and the error can be corrected, a :exc:`~passlib.exc.PasslibHashWarning`
will be issued instead. Correctable errors include
``salt`` strings that are too long.
.. versionadded:: 1.6
.. versionchanged:: 1.6
This format now supports variable length salts, instead of a fix 4 bytes.
z{SSHA}� z+^\{SSHA\}(?P<tmp>[+/a-zA-Z0-9]{32,}={0,2})$N)
r' r( r) r* rB r
r r: r r! rC rD r+ r r r r r � s "r c @ s6 e Zd ZdZd Zed�ZdZdZe Z
e � ed��Z
dS )r aC
This class stores passwords using LDAP's "Salted SHA2-256" format,
and follows the :ref:`password-hash-api`.
It supports a 4-16 byte salt.
The :meth:`~passlib.ifc.PasswordHash.using` method accepts the following optional keywords:
:type salt: bytes
:param salt:
Optional salt string.
If not specified, one will be autogenerated (this is recommended).
If specified, it may be any 4-16 byte string.
:type salt_size: int
:param salt_size:
Optional number of bytes to use when autogenerating new salts.
Defaults to 8 bytes for compatibility with the LDAP spec,
but Passlib supports any value between 4-16.
:type relaxed: bool
:param relaxed:
By default, providing an invalid value for one of the other
keywords will result in a :exc:`ValueError`. If ``relaxed=True``,
and the error can be corrected, a :exc:`~passlib.exc.PasslibHashWarning`
will be issued instead. Correctable errors include
``salt`` strings that are too long.
.. versionadded:: 1.7.3
z {SSHA256}� � z.^\{SSHA256\}(?P<tmp>[+/a-zA-Z0-9]{48,}={0,2})$N)r' r( r) r* rB r
r r: r@ r r! rC rD r+ r r r r r � s r c @ s6 e Zd ZdZd Zed�ZdZdZe Z
e � ed��Z
dS )r aC
This class stores passwords using LDAP's "Salted SHA2-512" format,
and follows the :ref:`password-hash-api`.
It supports a 4-16 byte salt.
The :meth:`~passlib.ifc.PasswordHash.using` method accepts the following optional keywords:
:type salt: bytes
:param salt:
Optional salt string.
If not specified, one will be autogenerated (this is recommended).
If specified, it may be any 4-16 byte string.
:type salt_size: int
:param salt_size:
Optional number of bytes to use when autogenerating new salts.
Defaults to 8 bytes for compatibility with the LDAP spec,
but Passlib supports any value between 4-16.
:type relaxed: bool
:param relaxed:
By default, providing an invalid value for one of the other
keywords will result in a :exc:`ValueError`. If ``relaxed=True``,
and the error can be corrected, a :exc:`~passlib.exc.PasslibHashWarning`
will be issued instead. Correctable errors include
``salt`` strings that are too long.
.. versionadded:: 1.7.3
z {SSHA512}�@ rG z.^\{SSHA512\}(?P<tmp>[+/a-zA-Z0-9]{91,}={0,2})$N)r' r( r) r* rB r
r r: r@ r r! rC rD r+ r r r r r � s r c @ sH e Zd ZdZd Ze�ed��Ze j
ddd�e dd� ��Z e dd � �Z
d
S ) r aY This class stores passwords in plaintext, and follows the :ref:`password-hash-api`.
This class acts much like the generic :class:`!passlib.hash.plaintext` handler,
except that it will identify a hash only if it does NOT begin with the ``{XXX}`` identifier prefix
used by RFC2307 passwords.
The :meth:`~passlib.ifc.PasswordHash.hash`, :meth:`~passlib.ifc.PasswordHash.genhash`, and :meth:`~passlib.ifc.PasswordHash.verify` methods all require the
following additional contextual keyword:
:type encoding: str
:param encoding:
This controls the character encoding to use (defaults to ``utf-8``).
This encoding will be used to encode :class:`!unicode` passwords
under Python 2, and decode :class:`!bytes` hashes under Python 3.
.. versionchanged:: 1.6
The ``encoding`` keyword was added.
z ^\{\w+\}.*$z1.7z2.0)Z
deprecatedZremovedc C s dS )N�!r r r r r � genconfig: s zldap_plaintext.genconfigc C s" t �|�}t|�o | j�|�d u S )N)r, Zto_unicode_for_identify�bool� _2307_patr6 )r r3 r r r �identifyA s
zldap_plaintext.identifyN)r' r( r) r* rB rC rD r
rL r, Zdeprecated_methodrA rJ rM r r r r r s r c C s g | ] }d | �qS )�ldap_r )�.0rB r r r �
<listcomp>L � rP c C s8 t � } tD ]&}d| }tj||td�dd�| |< q
~ d S )NrN z{CRYPT}T)�prefixZlazy)�globalsr r, Z
PrefixWrapperr
)�gZwnamerB r r r �_init_ldap_crypt_handlersN s
rU )-r* �base64r r Zhashlibr r r r ZloggingZ getLoggerr' �logrC Zpasslib.handlers.miscr Z
passlib.utilsr r
Zpasslib.utils.compatr r r
Zpasslib.utils.decorr Zpasslib.utils.handlersZutils�handlersr, �__all__Z
StaticHandlerr Z
HasRawSaltZHasRawChecksumZGenericHandlerr/ r r r r r r r Zldap_crypt_schemesrU r r r r �<module> s, ,
',((,