U j#7@sdZddlmZddlZddlmZmZmZmZddl m Z m Z m Z ddl m Z ddlmZmZdd lmZmZmZmZmZmZmZmZdd lmZerdd lmZGd d d ZdS)z5Implementing support for MySQL Authentication Plugins) annotationsN) TYPE_CHECKINGAnyDictOptional)InterfaceErrorNotSupportedError get_exception)logger)MySQLAuthPluginget_auth_plugin)AUTH_SWITCH_STATUSDEFAULT_CHARSET_IDDEFAULT_MAX_ALLOWED_PACKET ERR_STATUSEXCHANGE_FURTHER_STATUS MFA_STATUS OK_STATUS MySQLProtocol) HandShakeType) MySQLSocketc@seZdZdZddddZeddddZed dd d Zed e fd dddddddddZ d)ddddddddZ d dddddZ d ddddd Z d!d!d!d!ded e dddd"f d d#ddddddddddd$dd%dd&d'd(ZdS)*MySQLAuthenticatorz$Implements the authentication phase.None)returncCs(d|_i|_i|_d|_d|_d|_dS)z Constructor.FN) _username _passwords_plugin_config _ssl_enabled_auth_strategy_auth_plugin_classselfr$B/tmp/pip-unpacked-wheel-d6bt0v6z/mysql/connector/authentication.py__init__:s zMySQLAuthenticator.__init__boolcCs|jS)z&Signals whether or not SSL is enabled.)rr"r$r$r% ssl_enabledCszMySQLAuthenticator.ssl_enabledzDict[str, Any]cCs|jS)aCustom arguments that are being provided to the authentication plugin when called. The parameters defined here will override the ones defined in the auth plugin itself. The plugin config is a read-only property - the plugin configuration provided when invoking `authenticate()` is recorded and can be queried by accessing this property. Returns: dict: The latest plugin configuration provided when invoking `authenticate()`. )rr"r$r$r% plugin_configHsz MySQLAuthenticator.plugin_configrrstrzOptional[Dict[str, Any]]intbytes)sockhost ssl_optionscharset client_flagsmax_allowed_packetrc Cs|dkr i}tj|||d}||td|j|d|d|d|dd|d d|d |d d }td |||tdd|_|S)aSets up an SSL communication channel. Args: sock: Pointer to the socket connection. host: Server host name. ssl_options: SSL and TLS connection options (see `network.MySQLSocket.build_ssl_context`). charset: Client charset (see [1]), only the lower 8-bits. client_flags: Integer representing client capabilities flags. max_allowed_packet: Maximum packet size. Returns: ssl_request_payload: Payload used to carry out SSL authentication. References: [1]: https://dev.mysql.com/doc/dev/mysql-server/latest/ page_protocol_basic_character_set.html#a_protocol_character_set N)r0r1r2zBuilding SSL contextcacertkeyZ verify_certFZverify_identity tls_versionsZtls_ciphersuites)Zssl_caZssl_certZssl_keyZssl_verify_certZssl_verify_identityr6Ztls_cipher_suiteszSwitching to SSLzSSL has been enabledT) rZ make_auth_sslsendr debugZbuild_ssl_contextgetZ switch_to_sslr) r#r-r.r/r0r1r2Zssl_request_payload ssl_contextr$r$r% setup_sslYs.       zMySQLAuthenticator.setup_sslNrz Optional[str])new_strategy_namestrategy_classusernamepassword_factorrcCsP|dkr|j}|dkr|j}td|t||d||j|d|jd|_dS)aSwitches the authorization plugin. Args: new_strategy_name: New authorization plugin name to switch to. strategy_class: New authorization plugin class to switch to (has higher precedence than the authorization plugin name). username: Username to be used - if not defined, the username provided when `authentication()` was invoked is used. password_factor: Up to three levels of authentication (MFA) are allowed, hence you can choose the password corresponding to the 1st, 2nd, or 3rd factor - 1st is the default. NzSwitching to strategy %s)Z plugin_nameauth_plugin_classr)r() rr!r r8r rr9r(r )r#r<r=r>r?r$r$r%_switch_auth_strategys  z(MySQLAuthenticator._switch_auth_strategyzOptional[bytes])r-pktrcCsd}|dtkr||jkr"tdt|\}}|j||dtd||jj |jj ||f|j }|dt krt |}|jj||f|j }|dtkrtd|S|dtkrt||d7}qtdd S) a Handles MFA (Multi-Factor Authentication) response. Up to three levels of authentication (MFA) are allowed. Args: sock: Pointer to the socket connection. pkt: MFA response. Returns: ok_packet: If last server's response is an OK packet. None: If last server's response isn't an OK packet and no ERROR was raised. Raises: InterfaceError: If got an invalid N factor. errors.ErrorTypes: If got an ERROR response. z5Failed Multi Factor Authentication (invalid N factor))r?zMFA %i factor %szMFA completed succesfullyrz"MFA terminated with a no ok packetN)rrrrZparse_auth_next_factorrAr r8r nameauth_switch_responserrparse_auth_more_dataauth_more_responserrr warning)r#r-rBZn_factorr< auth_datar$r$r% _mfa_n_factors>         z MySQLAuthenticator._mfa_n_factorcCs|dtkr t|dkr td|dtkrbtdt|\}}|||jj ||f|j }|dt krtdt |}|jj ||f|j }|dtkrtd|jj|S|dtkrtdtd|jj|||S|dtkrt|d S) aHandles server's response. Args: sock: Pointer to the socket connection. pkt: Server's response after completing the `HandShakeResponse`. Returns: ok_packet: If last server's response is an OK packet. None: If last server's response isn't an OK packet and no ERROR was raised. Raises: errors.ErrorTypes: If got an ERROR response. NotSupportedError: If got Authentication with old (insecure) passwords. rDzAuthentication with old (insecure) passwords is not supported. For more information, lookup Password Hashing in the latest MySQL manualz+Server's response is an auth switch requestzExchanging further packetsz%s completed succesfullyz$Starting multi-factor authenticationzMFA 1 factor %sN)rlenr r r8rZparse_auth_switch_requestrAr rFrrrGrHrrErrKrr )r#r-rBr<rJr$r$r%_handle_server_responsesB           z*MySQLAuthenticator._handle_server_responserFrzOptional[Dict[str, str]]r)r- handshaker> password1 password2 password3databaser0r1r2 auth_pluginr@ conn_attrsis_change_user_requestr)rcKs||_|||d|_t||_| |_tj|||||| | | | | ||j|j d \}|_ |r\dnd}|j |f|t | }|||}|dkrtdd|S)aPerforms the authentication phase. During re-authentication you must set `is_change_user_request` to True. Args: sock: Pointer to the socket connection. handshake: Initial handshake. username: Account's username. password1: Account's password factor 1. password2: Account's password factor 2. password3: Account's password factor 3. database: Initial database name for the connection. charset: Client charset (see [1]), only the lower 8-bits. client_flags: Integer representing client capabilities flags. max_allowed_packet: Maximum packet size. auth_plugin: Authorization plugin name. auth_plugin_class: Authorization plugin class (has higher precedence than the authorization plugin name). conn_attrs: Connection attributes. is_change_user_request: Whether is a `change user request` operation or not. plugin_config: Custom configuration to be passed to the auth plugin when invoked. The parameters defined here will override the ones defined in the auth plugin itself. Returns: ok_packet: OK packet. Raises: InterfaceError: If OK packet is NULL. References: [1]: https://dev.mysql.com/doc/dev/mysql-server/latest/ page_protocol_basic_character_set.html#a_protocol_character_set )rrC) rOr>passwordrSr0r1r2rTr@rUrVr(r))rr)NNNzGot a NULL ok_pkt)rrcopydeepcopyrr!rZ make_authr(r)r r7r,recvrNr)r#r-rOr>rPrQrRrSr0r1r2rTr@rUrVr)Zresponse_payloadZ send_argsrBZok_pktr$r$r% authenticate!s45      zMySQLAuthenticator.authenticate)NNr)__name__ __module__ __qualname____doc__r&propertyr(r)rrr;rArKrNr\r$r$r$r%r7s: <"6;r)r` __future__rrYtypingrrrrerrorsrr r r Zpluginsr r protocolrrrrrrrrtypesrnetworkrrr$r$r$r%s  (