File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/aiohttp/__pycache__/client_middleware_digest_auth.cpython-310.pyc
Back
o ;jbJ � @ s� U d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z m Z m Z ddl m Z ddlmZ ddlmZ dd lmZ dd lmZmZ dd lmZ G d d � d e dd�Zejejejejej ej ej ej ej ej ej ej d� Z e e ee!gdf f e"d< e�#ej$dk r�dnd�Z%dZ&e e'e d df e"d< e'e(e �)� ��Z*e e'e df e"d< e+h d��Z,e e+e e"d< d e d e fd d �Z-d e d e fd d!�Z.d"e d e e e f fd#d$�Z/G d%d&� d&�Z0dS )'av Digest authentication middleware for aiohttp client. This middleware implements HTTP Digest Authentication according to RFC 7616, providing a more secure alternative to Basic Authentication. It supports all standard hash algorithms including MD5, SHA, SHA-256, SHA-512 and their session variants, as well as both 'auth' and 'auth-int' quality of protection (qop) options. � N)�Callable)�Final�Literal� TypedDict)�URL� )�hdrs)� ClientError)�ClientHandlerType)� ClientRequest�ClientResponse)�Payloadc @ sF e Zd ZU eed< eed< eed< eed< eed< eed< eed< dS ) �DigestAuthChallenge�realm�nonce�qop� algorithm�opaque�domain�staleN)�__name__� __module__� __qualname__�str�__annotations__� r r �Y/opt/saltstack/salt/lib/python3.10/site-packages/aiohttp/client_middleware_digest_auth.pyr s r F)�total) �MD5zMD5-SESSZSHAzSHA-SESS�SHA256z SHA256-SESSzSHA-256z SHA-256-SESS�SHA512z SHA512-SESSzSHA-512z SHA-512-SESSz hashlib._Hash�DigestFunctions)� � z:(?:^|\s|,\s*)(\w+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+))z>(?:^|\s|,\s*)((?>\w+))\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+)))r r r r r r r .�CHALLENGE_FIELDS�SUPPORTED_ALGORITHMS> �response�usernamer r �uri�cnoncer �QUOTED_AUTH_FIELDS�value�returnc C � | � dd�S )z,Escape double quotes for HTTP header values.�"�\"��replace�r+ r r r � escape_quotesl � r3 c C r- )z-Unescape double quotes in HTTP header values.r/ r. r0 r2 r r r �unescape_quotesq r4 r5 �headerc s � fdd�t �| �D �S )a� Parse key-value pairs from WWW-Authenticate or similar HTTP headers. This function handles the complex format of WWW-Authenticate header values, supporting both quoted and unquoted values, proper handling of commas in quoted values, and whitespace variations per RFC 7616. Examples of supported formats: - key1="value1", key2=value2 - key1 = "value1" , key2="value, with, commas" - key1=value1,key2="value2" - realm="example.com", nonce="12345", qop="auth" Args: header: The header value string to parse Returns: Dictionary mapping parameter names to their values c s0 i | ]\}}}|� � � r� |rt|�n|�qS r )�stripr5 )�.0�keyZ quoted_valZ unquoted_val�Z stripped_keyr r � <dictcomp>� s ��z&parse_header_pairs.<locals>.<dictcomp>)�_HEADER_PAIRS_PATTERN�findall)r6 r r: r �parse_header_pairsv s �r> c @ s� e Zd ZdZ ddedededdfdd �Zd ed ed ee d B defdd�Z d edefdd�Z de defdd�Z dedede fdd�ZdS )�DigestAuthMiddlewarea1 HTTP digest authentication middleware for aiohttp client. This middleware intercepts 401 Unauthorized responses containing a Digest authentication challenge, calculates the appropriate digest credentials, and automatically retries the request with the proper Authorization header. Features: - Handles all aspects of Digest authentication handshake automatically - Supports all standard hash algorithms: - MD5, MD5-SESS - SHA, SHA-SESS - SHA256, SHA256-SESS, SHA-256, SHA-256-SESS - SHA512, SHA512-SESS, SHA-512, SHA-512-SESS - Supports 'auth' and 'auth-int' quality of protection modes - Properly handles quoted strings and parameter parsing - Includes replay attack protection with client nonce count tracking - Supports preemptive authentication per RFC 7616 Section 3.6 Origin scoping: The credentials are scoped to the origin of the first request the middleware handles. A request to a different origin is passed through untouched, so it never receives a digest response computed from those credentials, unless that origin falls within a protection space the anchor origin advertised through the RFC 7616 ``domain`` directive. Make the first request through the middleware against the intended origin, as the anchor is pinned to it and not reset for the life of the instance. Standards compliance: - RFC 7616: HTTP Digest Access Authentication (primary reference) - RFC 2617: HTTP Authentication (deprecated by RFC 7616) - RFC 1945: Section 11.1 (username restrictions) Implementation notes: The core digest calculation is inspired by the implementation in https://github.com/requests/requests/blob/v2.18.4/requests/auth.py with added support for modern digest auth features and error handling. T�login�password� preemptiver, Nc C sv |d u rt d��|d u rt d��d|v rt d��|| _|�d�| _|�d�| _d| _d| _i | _|| _g | _ d | _ d S )Nz"None is not allowed as login valuez%None is not allowed as password value�:z8A ":" is not allowed in username (RFC 1945#section-11.1)�utf-8� r ) � ValueError� _login_str�encode� _login_bytes�_password_bytes�_last_nonce_bytes� _nonce_count� _challenge� _preemptive�_protection_space�_origin)�selfr@ rA rB r r r �__init__� s z DigestAuthMiddleware.__init__�method�url�bodyrE c " � sJ �| j }d|vr td��d|vrtd��|d }|d }|s"td��|�dd�}|�dd �}|�� } |�d d�} |�d �} |�d �} t|�j} d}d }|rrd dh�dd� |�d�D ��}|setd|� ���d|v rkdnd }|�d �}| t vr�td| � dd� t �� ���t | �dt dt f�fdd� � dt dt dt f� fd d � }d � | j | | jf�}|�� � d | � ��� }|dkr�t|t�r�|�� I d H }n|}� |�}d � ||f�}� |�}� |�}| | jkr�| jd!7 _nd!| _| | _| jd"�}|�d �}t�d � t| j��d �| t�� �d �t�d#�g���� d d$� }|�d �}| �� � d%��r.� d � || |f��}|�rAd � | ||||f�} ||| �} n ||d � | |f��} t | j �t |�t |�| | � � |d&�} | �rft | �| d < |�ru|| d< || d'< || d(< g } | � � D ]!\} }!| t!v �r�| �"| � d)|!� d*�� �q{| �"| � d+|!� �� �q{d,d� | �� �S )-a� Build digest authorization header for the current challenge. Args: method: The HTTP method (GET, POST, etc.) url: The request URL body: The request body (used for qop=auth-int) Returns: A fully formatted Digest authorization header string Raises: ClientError: If the challenge is missing required parameters or contains unsupported values r z:Malformed Digest auth challenge: Missing 'realm' parameterr z:Malformed Digest auth challenge: Missing 'nonce' parameterzBSecurity issue: Digest auth challenge contains empty 'nonce' valuer � r r r rD rE Zauthzauth-intc S s h | ] }|� � r|� � �qS r )r7 )r8 �qr r r � <setcomp> s z/DigestAuthMiddleware._encode.<locals>.<setcomp>�,zEDigest auth error: Unsupported Quality of Protection (qop) value(s): z/Digest auth error: Unsupported hash algorithm: z. Supported algorithms: z, �xr, c s � | �� � �� S )z<RFC 7616 Section 3: Hash function H(data) = hex(hash(data)).)� hexdigestrH )rZ )�hash_fnr r �H s z'DigestAuthMiddleware._encode.<locals>.H�s�dc s � d� | |f��S )zDRFC 7616 Section 3: KD(secret, data) = H(concat(secret, ":", data)).� :)�join)r^ r_ )r] r r �KD$ s z(DigestAuthMiddleware._encode.<locals>.KDr` rC Nr Z08x� � z-SESS)r' r r r( r& r Zncr) z="r. �=zDigest )#rM r �get�upperrH r Z raw_path_qs� intersection�splitr! ra r% �bytesrI rJ � isinstancer �as_bytesrK rL �hashlib�sha1r �time�ctime�os�urandomr[ �endswithr3 rG �decode�itemsr* �append)"rQ rS rT rU Z challenger r Zqop_rawZalgorithm_originalr r Z nonce_bytesZ realm_bytes�pathr Z qop_bytesZ valid_qopsrb ZA1ZA2Z entity_bytesZ entity_hashZHA1ZHA2ZncvalueZ ncvalue_bytesr) Z cnonce_bytesZnoncebitZresponse_digestZ header_fields�pairs�fieldr+ r )r] r\ r �_encode� s� ���� �� �� ��� � � � z DigestAuthMiddleware._encodec C s\ t |�}| jD ]$}|�|�sqt|�t|�ks |d dkr dS |t|� dkr+ dS qdS )z� Check if the given URL is within the current protection space. According to RFC 7616, a URI is in the protection space if any URI in the protection space is a prefix of it (after both have been made absolute). ����/TF)r rO � startswith�len)rQ rT Z request_strZ space_strr r r �_in_protection_spacez s �z)DigestAuthMiddleware._in_protection_spacer& c C s |j dkrdS |j�dd�}|sdS |�d�\}}}|s dS |�� dkr&dS |s*dS t|� }s2dS i | _tD ]}|�|� }durG|| j|< q7|j� � } | j�d� } r�g | _ | � � D ]$} | � d �} | � d �rv| j �t| �t| ���� q\| j �tt| ��� q\nt| �g| _ t| j�S ) z� Takes the given response and tries digest-auth, if needed. Returns true if the original request must be resent. i� Fzwww-authenticaterV � �digestNr r. r| )�status�headersrf � partition�lowerr> rM r$ rT �originrO ri r7 r} rv r ra r �bool) rQ r& Z auth_headerrS �sepr� Z header_pairsry r+ r� r r( r r r � _authenticate� s< � � z"DigestAuthMiddleware._authenticate�request�handlerc � s� �|j �� }| jdu r|| _n|| jkr!| �|j �s!||�I dH S d}td�D ]1}|dks9| jrJ| jrJ| �|j �rJ| �|j|j |j �I dH |j t j < ||�I dH }| � |�sX nq'|dus_J �|S )z Run the digest auth middleware.N� r )rT r� rP r �rangerN rM rz rS rU r� r Z AUTHORIZATIONr� )rQ r� r� r� r& Z retry_countr r r �__call__� s0 � �� � � � z DigestAuthMiddleware.__call__)T)r r r �__doc__r r� rR r r r rz r r r� r r r� r r r r r? � s. +���� �" &;���r? )1r� rm rq �re�sysro �collections.abcr �typingr r r Zyarlr rV r Zclient_exceptionsr Zclient_middlewaresr Z client_reqrepr r �payloadr r �md5rn �sha256�sha512r! �dictr rj r �compile� version_infor< r$ �tuple�sorted�keysr% � frozensetr* r3 r5 r> r? r r r r �<module> s^ � �� � ��$�
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings