ó
ö
5Xc @ sÛ d Z d d l Z e j e ƒ Z d d l m Z m Z m Z m Z d d l
m Z m Z d d l
m Z m Z m Z m Z d d l m Z m Z d d l j j Z d g Z d e j e j e j e j f d „ ƒ YZ d S( s: passlib.handlers.scram - hash for SCRAM credential storageiÿÿÿÿN( t consteqt saslprept
to_native_strt
splitcomma( t ab64_decodet ab64_encode( t
bascii_to_strt iteritemst ut native_string_types( t pbkdf2_hmact norm_hash_namet scramc B s e Z d Z d Z d Z e d ƒ Z d Z d Z d Z d
Z
d" Z d
Z d d d g Z
d d d d d g Z d# Z e d „ ƒ Z e d d „ ƒ Z e d „ ƒ Z e d „ ƒ Z d „ Z e d# d# d „ ƒ Z d# d „ Z e d „ Z e d „ ƒ Z d „ Z d# d „ Z e e d „ ƒ Z RS($ sZ This class provides a format for storing SCRAM passwords, and follows
the :ref:`password-hash-api`.
It supports a variable-length salt, and a variable number of rounds.
The :meth:`~passlib.ifc.PasswordHash.using` method accepts the following optional keywords:
:type salt: bytes
:param salt:
Optional salt bytes.
If specified, the length must be between 0-1024 bytes.
If not specified, a 12 byte salt will be autogenerated
(this is recommended).
:type salt_size: int
:param salt_size:
Optional number of bytes to use when autogenerating new salts.
Defaults to 12 bytes, but can be any value between 0 and 1024.
:type rounds: int
:param rounds:
Optional number of rounds to use.
Defaults to 100000, but must be within ``range(1,1<<32)``.
:type algs: list of strings
:param algs:
Specify list of digest algorithms to use.
By default each scram hash will contain digests for SHA-1,
SHA-256, and SHA-512. This can be overridden by specify either be a
list such as ``["sha-1", "sha-256"]``, or a comma-separated string
such as ``"sha-1, sha-256"``. Names are case insensitive, and may
use :mod:`!hashlib` or `IANA <http://www.iana.org/assignments/hash-function-text-names>`_
hash names.
:type relaxed: bool
:param relaxed:
By default, providing an invalid value for one of the other
keywords will result in a :exc:`ValueError`. If ``relaxed=True``,
and the error can be corrected, a :exc:`~passlib.exc.PasslibHashWarning`
will be issued instead. Correctable errors include ``rounds``
that are too small or too large, and ``salt`` strings that are too long.
.. versionadded:: 1.6
In addition to the standard :ref:`password-hash-api` methods,
this class also provides the following methods for manipulating Passlib
scram hashes in ways useful for pluging into a SCRAM protocol stack:
.. automethod:: extract_digest_info
.. automethod:: extract_digest_algs
.. automethod:: derive_digest
R t saltt salt_sizet roundst algss $scram$i i i † i i i t linears sha-1s sha-256s sha-512s sha-224s sha-384c C sS t | d ƒ } | j | ƒ } | j } | s< t d ƒ ‚ n | j | j | | f S( sè return (salt, rounds, digest) for specific hash algorithm.
:type hash: str
:arg hash:
:class:`!scram` hash stored for desired user
:type alg: str
:arg alg:
Name of digest algorithm (e.g. ``"sha-1"``) requested by client.
This value is run through :func:`~passlib.crypto.digest.norm_hash_name`,
so it is case-insensitive, and can be the raw SCRAM
mechanism name (e.g. ``"SCRAM-SHA-1"``), the IANA name,
or the hashlib name.
:raises KeyError:
If the hash does not contain an entry for the requested digest
algorithm.
:returns:
A tuple containing ``(salt, rounds, digest)``,
where *digest* matches the raw bytes returned by
SCRAM's :func:`Hi` function for the stored password,
the provided *salt*, and the iteration count (*rounds*).
*salt* and *digest* are both raw (unencoded) bytes.
t ianas scram hash contains no digests( R t from_stringt checksumt
ValueErrorR
R ( t clst hasht algt selft chkmap( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt extract_digest_info| s R c C sF | j | ƒ j } | d k r" | Sg | D] } t | | ƒ ^ q) Sd S( sê Return names of all algorithms stored in a given hash.
:type hash: str
:arg hash:
The :class:`!scram` hash to parse
:type format: str
:param format:
This changes the naming convention used by the
returned algorithm names. By default the names
are IANA-compatible; possible values are ``"iana"`` or ``"hashlib"``.
:returns:
Returns a list of digest algorithms; e.g. ``["sha-1"]``
R N( R R R ( R R t formatR R ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt extract_digest_algs¢ s c C s: t | t ƒ r! | j d ƒ } n t | t | ƒ | | ƒ S( s; helper to create SaltedPassword digest for SCRAM.
This performs the step in the SCRAM protocol described as::
SaltedPassword := Hi(Normalize(password), salt, i)
:type password: unicode or utf-8 bytes
:arg password: password to run through digest
:type salt: bytes
:arg salt: raw salt data
:type rounds: int
:arg rounds: number of iterations.
:type alg: str
:arg alg: name of digest to use (e.g. ``"sha-1"``).
:returns:
raw bytes of ``SaltedPassword``
s utf-8( t
isinstancet bytest decodeR
R ( R t passwordR
R R ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt
derive_digest¼ s c
C sÄ t | d d ƒ } | j d ƒ s6 t j j | ƒ ‚ n | d j d ƒ } t | ƒ d k rp t j j | ƒ ‚ n | \ } } } t | ƒ } | t | ƒ k r² t j j | ƒ ‚ n y t
| j d ƒ ƒ } Wn# t k
rð t j j | ƒ ‚ n X| s t j j | ƒ ‚ n™ d | k r™d } i } x~ | j d ƒ D]^ }
|
j d ƒ \ } } y t
| j d ƒ ƒ | | <Wq4t k
r‘t j j | ƒ ‚ q4Xq4Wn | } d } | d | d
| d | d | ƒ S(
Nt asciiR s $scram$i t $i t =t ,R R
R R ( R t
startswitht uht exct InvalidHashErrort splitt lent MalformedHashErrort intt strR t encodet TypeErrort None(
R R t partst
rounds_strt salt_strt chk_strR R
R R t pairR t digest( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyR Ý s@
c sT t t | j ƒ ƒ } | j ‰ d j ‡ f d † | j Dƒ ƒ } d | j | | f S( NR& c 3 s/ | ]% } d | t t ˆ | ƒ ƒ f Vq d S( s %s=%sN( R R ( t .0R ( R ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pys <genexpr> s s $scram$%d$%s$%s( R R R
R t joinR R ( R R
R6 ( ( R s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt to_string
s c K sd | d k r' | d k s t ‚ | } n t t | ƒ j | } | d k r` | j | ƒ | _ n | S( N( R2 t AssertionErrort superR t usingt
_norm_algst default_algs( R R@ R t kwdst subcls( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyR> s c K sØ t t | ƒ j | | j } | d k rX | d k rF t d ƒ ‚ n | j | ƒ } ns | d k r| | j | j ƒ ƒ } nO | j r¿ t | j
ƒ } | j | ƒ | k sË t d | f ƒ ‚ n t d ƒ ‚ | | _
d S( Ns+ checksum & algs kwds are mutually exclusives invalid default algs: %rs no algs list specified( R= R t __init__R R2 t RuntimeErrorR? t keyst use_defaultst listR@ R< R1 R ( R R RA t
digest_map( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyRC + s + c C sã t | t ƒ s* t j j | d d ƒ ‚ n x— t | ƒ D]‰ \ } } | t | d ƒ k rn t d | f ƒ ‚ n t | ƒ d k r– t d | f ƒ ‚ n t | t ƒ s7 t j j | d d ƒ ‚ q7 q7 Wd | k rß t d
ƒ ‚ n | S( Nt dictR R s* malformed algorithm name in scram hash: %ri s0 SCRAM limits algorithm names to 9 characters: %rs raw bytest digestss sha-1s- sha-1 must be in algorithm list of scram hash(
R RI R( R) t ExpectedTypeErrorR R R R, R ( R R t relaxedR R8 ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt _norm_checksum> s c C sx t | t ƒ r t | ƒ } n t d „ | Dƒ ƒ } t d „ | Dƒ ƒ rY t d ƒ ‚ n d | k rt t d ƒ ‚ n | S( s normalize algs parameterc s s | ] } t | d ƒ Vq d S( R N( R ( R9 R ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pys <genexpr>U s c s s! | ] } t | ƒ d k Vq d S( i N( R, ( R9 R ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pys <genexpr>V s s- SCRAM limits alg names to max of 9 characterss sha-1s- sha-1 must be in algorithm list of scram hash( R R R t sortedt anyR ( R R ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyR? P s c K s5 t | j ƒ j | j ƒ s t St t | ƒ j | S( N( t setR t
issupersetR@ t TrueR= R t _calc_needs_update( R RA ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyRS ` s c s^ | j ‰ | j ‰ | j ‰ | r4 ˆ ˆ ˆ ˆ | ƒ St ‡ ‡ ‡ ‡ f d † | j Dƒ ƒ Sd S( Nc 3 s* | ] } | ˆ ˆ ˆ ˆ | ƒ f Vq d S( N( ( R9 R ( R R R
t secret( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pys <genexpr>w s ( R R
R" RI R ( R RT R ( ( R R R
RT s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt _calc_checksumm s c C s\ t j | ƒ | j | ƒ } | j } | sJ t d | j | j f ƒ ‚ n | r t } } xŠ t | ƒ D]| \ } } | j | | ƒ }
t | ƒ t |
ƒ k rÅ t d | t | ƒ t |
ƒ f ƒ ‚ n t
|
| ƒ rÝ t } qg t } qg W| r| rt d ƒ ‚ qX| SnO x@ | j D]5 } | | k r| j | | ƒ }
t
|
| | ƒ SqWt
d ƒ ‚ d S( Ns. expected %s hash, got %s config string insteads+ mis-sized %s digest in scram hash: %r != %rs4 scram hash verified inconsistently, may be corrupteds sha-1 digest not found!( R( t validate_secretR R R t namet FalseR RU R, R RR t _verify_algsR< ( R RT R t fullR R t correctt failedR R8 t other( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt verify{ s0
"
( s saltR s roundss algsI Iÿÿÿÿ N( t __name__t
__module__t __doc__RW t setting_kwdsR t identt default_salt_sizet
max_salt_sizet default_roundst
min_roundst
max_roundst rounds_costR@ RY R2 R t classmethodR R R" R R; R> RC RX RM R? RS RU R^ ( ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyR s8 5
&!0
( Ra t loggingt getLoggerR_ t logt
passlib.utilsR R R R t passlib.utils.binaryR R t passlib.utils.compatR R R R t passlib.crypto.digestR
R t passlib.utils.handlerst utilst handlersR( t __all__t HasRoundst
HasRawSaltt HasRawChecksumt GenericHandlerR ( ( ( s: /usr/lib/python2.7/site-packages/passlib/handlers/scram.pyt <module> s ""