| Current File : //usr/lib/python2.7/site-packages/passlib/handlers/scram.pyc |
�
�
5Xc @ s� d Z d d l Z e j e � Z d d l m Z m Z m Z m Z d d l
m Z m Z d d l
m Z m Z m Z m Z d d l m Z m Z d d l j j Z d g Z d e j e j e j e j f d � � YZ d S( s: passlib.handlers.scram - hash for SCRAM credential storagei����N( t consteqt saslprept
to_native_strt
splitcomma( t ab64_decodet ab64_encode( t
bascii_to_strt iteritemst ut native_string_types( t pbkdf2_hmact norm_hash_namet scramc B s e Z d Z d Z d Z e d � Z d Z d Z d Z d
Z
d" Z d
Z d d d g Z
d d d d d g Z d# Z e d � � Z e d d � � Z e d � � Z e d � � Z d � Z e d# d# d � � Z d# d � Z e d � Z e d � � Z d � Z d# d � Z e e d � � Z RS($ sZ This class provides a format for storing SCRAM passwords, and follows
the :ref:`password-hash-api`.
It supports a variable-length salt, and a variable number of rounds.
The :meth:`~passlib.ifc.PasswordHash.using` method accepts the following optional keywords:
:type salt: bytes
:param salt:
Optional salt bytes.
If specified, the length must be between 0-1024 bytes.
If not specified, a 12 byte salt will be autogenerated
(this is recommended).
:type salt_size: int
:param salt_size:
Optional number of bytes to use when autogenerating new salts.
Defaults to 12 bytes, but can be any value between 0 and 1024.
:type rounds: int
:param rounds:
Optional number of rounds to use.
Defaults to 100000, but must be within ``range(1,1<<32)``.
:type algs: list of strings
:param algs:
Specify list of digest algorithms to use.
By default each scram hash will contain digests for SHA-1,
SHA-256, and SHA-512. This can be overridden by specify either be a
list such as ``["sha-1", "sha-256"]``, or a comma-separated string
such as ``"sha-1, sha-256"``. Names are case insensitive, and may
use :mod:`!hashlib` or `IANA <http://www.iana.org/assignments/hash-function-text-names>`_
hash names.
:type relaxed: bool
:param relaxed:
By default, providing an invalid value for one of the other
keywords will result in a :exc:`ValueError`. If ``relaxed=True``,
and the error can be corrected, a :exc:`~passlib.exc.PasslibHashWarning`
will be issued instead. Correctable errors include ``rounds``
that are too small or too large, and ``salt`` strings that are too long.
.. versionadded:: 1.6
In addition to the standard :ref:`password-hash-api` methods,
this class also provides the following methods for manipulating Passlib
scram hashes in ways useful for pluging into a SCRAM protocol stack:
.. automethod:: extract_digest_info
.. automethod:: extract_digest_algs
.. automethod:: derive_digest
R t saltt salt_sizet roundst algss $scram$i i i�� i i i t linears sha-1s sha-256s sha-512s sha-224s sha-384c C sS t | d � } | j | � } | j } | s< t d � � n | j | j | | f S( s� return (salt, rounds, digest) for specific hash algorithm.
:type hash: str
:arg hash:
:class:`!scram` hash stored for desired user
:type alg: str
:arg alg:
Name of digest algorithm (e.g. ``"sha-1"``) requested by client.
This value is run through :func:`~passlib.crypto.digest.norm_hash_name`,
so it is case-insensitive, and can be the raw SCRAM
mechanism name (e.g. ``"SCRAM-SHA-1"``), the IANA name,
or the hashlib name.
:raises KeyError:
If the hash does not contain an entry for the requested digest
algorithm.
:returns:
A tuple containing ``(salt, rounds, digest)``,
where *digest* matches the raw bytes returned by
SCRAM's :func:`Hi` function for the stored password,
the provided *salt*, and the iteration count (*rounds*).
*salt* and *digest* are both raw (unencoded) bytes.
t ianas scram hash contains no digests( R t from_stringt checksumt
ValueErrorR
R ( t clst hasht algt selft chkmap( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt extract_digest_info| s R c C sF | j | � j } | d k r" | Sg | D] } t | | � ^ q) Sd S( s� Return names of all algorithms stored in a given hash.
:type hash: str
:arg hash:
The :class:`!scram` hash to parse
:type format: str
:param format:
This changes the naming convention used by the
returned algorithm names. By default the names
are IANA-compatible; possible values are ``"iana"`` or ``"hashlib"``.
:returns:
Returns a list of digest algorithms; e.g. ``["sha-1"]``
R N( R R R ( R R t formatR R ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt extract_digest_algs� s c C s: t | t � r! | j d � } n t | t | � | | � S( s; helper to create SaltedPassword digest for SCRAM.
This performs the step in the SCRAM protocol described as::
SaltedPassword := Hi(Normalize(password), salt, i)
:type password: unicode or utf-8 bytes
:arg password: password to run through digest
:type salt: bytes
:arg salt: raw salt data
:type rounds: int
:arg rounds: number of iterations.
:type alg: str
:arg alg: name of digest to use (e.g. ``"sha-1"``).
:returns:
raw bytes of ``SaltedPassword``
s utf-8( t
isinstancet bytest decodeR
R ( R t passwordR
R R ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt
derive_digest� s c
C s� t | d d � } | j d � s6 t j j | � � n | d j d � } t | � d k rp t j j | � � n | \ } } } t | � } | t | � k r� t j j | � � n y t
| j d � � } Wn# t k
r� t j j | � � n X| s t j j | � � n� d | k r�d } i } x~ | j d � D]^ }
|
j d � \ } } y t
| j d � � | | <Wq4t k
r�t j j | � � q4Xq4Wn | } d } | d | d
| d | d | � S(
Nt asciiR s $scram$i t $i t =t ,R R
R R ( R t
startswitht uht exct InvalidHashErrort splitt lent MalformedHashErrort intt strR t encodet TypeErrort None(
R R t partst
rounds_strt salt_strt chk_strR R
R R t pairR t digest( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyR � s@
c sT t t | j � � } | j � d j � f d � | j D� � } d | j | | f S( NR& c 3 s/ | ]% } d | t t � | � � f Vq d S( s %s=%sN( R R ( t .0R ( R ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pys <genexpr> s s $scram$%d$%s$%s( R R R
R t joinR R ( R R
R6 ( ( R s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt to_string
s c K sd | d k r' | d k s t � | } n t t | � j | � } | d k r` | j | � | _ n | S( N( R2 t AssertionErrort superR t usingt
_norm_algst default_algs( R R@ R t kwdst subcls( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyR> s c K s� t t | � j | � | j } | d k rX | d k rF t d � � n | j | � } ns | d k r| | j | j � � } nO | j r� t | j
� } | j | � | k s� t d | f � � n t d � � | | _
d S( Ns+ checksum & algs kwds are mutually exclusives invalid default algs: %rs no algs list specified( R= R t __init__R R2 t RuntimeErrorR? t keyst use_defaultst listR@ R< R1 R ( R R RA t
digest_map( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyRC + s + c C s� t | t � s* t j j | d d � � n x� t | � D]� \ } } | t | d � k rn t d | f � � n t | � d k r� t d | f � � n t | t � s7 t j j | d d � � q7 q7 Wd | k r� t d
� � n | S( Nt dictR R s* malformed algorithm name in scram hash: %ri s0 SCRAM limits algorithm names to 9 characters: %rs raw bytest digestss sha-1s- sha-1 must be in algorithm list of scram hash(
R RI R( R) t ExpectedTypeErrorR R R R, R ( R R t relaxedR R8 ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt _norm_checksum> s c C sx t | t � r t | � } n t d � | D� � } t d � | D� � rY t d � � n d | k rt t d � � n | S( s normalize algs parameterc s s | ] } t | d � Vq d S( R N( R ( R9 R ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pys <genexpr>U s c s s! | ] } t | � d k Vq d S( i N( R, ( R9 R ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pys <genexpr>V s s- SCRAM limits alg names to max of 9 characterss sha-1s- sha-1 must be in algorithm list of scram hash( R R R t sortedt anyR ( R R ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyR? P s c K s5 t | j � j | j � s t St t | � j | � S( N( t setR t
issupersetR@ t TrueR= R t _calc_needs_update( R RA ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyRS ` s c s^ | j � | j � | j � | r4 � � � � | � St � � � � f d � | j D� � Sd S( Nc 3 s* | ] } | � � � � | � f Vq d S( N( ( R9 R ( R R R
t secret( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pys <genexpr>w s ( R R
R" RI R ( R RT R ( ( R R R
RT s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt _calc_checksumm s c C s\ t j | � | j | � } | j } | sJ t d | j | j f � � n | r t } } x� t | � D]| \ } } | j | | � }
t | � t |
� k r� t d | t | � t |
� f � � n t
|
| � r� t } qg t } qg W| r| rt d � � qX| SnO x@ | j D]5 } | | k r| j | | � }
t
|
| | � SqWt
d � � d S( Ns. expected %s hash, got %s config string insteads+ mis-sized %s digest in scram hash: %r != %rs4 scram hash verified inconsistently, may be corrupteds sha-1 digest not found!( R( t validate_secretR R R t namet FalseR RU R, R RR t _verify_algsR< ( R RT R t fullR R t correctt failedR R8 t other( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt verify{ s0
"
( s saltR s roundss algsI I���� N( t __name__t
__module__t __doc__RW t setting_kwdsR t identt default_salt_sizet
max_salt_sizet default_roundst
min_roundst
max_roundst rounds_costR@ RY R2 R t classmethodR R R" R R; R> RC RX RM R? RS RU R^ ( ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyR s8 5
&!0
( Ra t loggingt getLoggerR_ t logt
passlib.utilsR R R R t passlib.utils.binaryR R t passlib.utils.compatR R R R t passlib.crypto.digestR
R t passlib.utils.handlerst utilst handlersR( t __all__t HasRoundst
HasRawSaltt HasRawChecksumt GenericHandlerR ( ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt <module> s ""