a

�,�h#7�@
s�dZd
dl
mZ
d
dlZd
dlmZmZmZmZ
ddl	m
Z
mZmZ
ddl
m
Z

ddlmZmZ
dd	lmZmZmZmZmZmZmZmZ
dd
lmZ
er�ddlmZ
Gdd
�d
�ZdS)z5Implementing support for MySQL Authentication Plugins�)
�annotationsN)�
TYPE_CHECKING�Any�Dict�Optional�
)�InterfaceError�NotSupportedError�
get_exception)
�logger)�MySQLAuthPlugin�get_auth_plugin)�AUTH_SWITCH_STATUS�DEFAULT_CHARSET_ID�DEFAULT_MAX_ALLOWED_PACKET�
ERR_STATUS�EXCHANGE_FURTHER_STATUS�
MFA_STATUS�	OK_STATUS�
MySQLProtocol)
�
HandShakeType)
�MySQLSocketc@
s�eZ
dZd
Zdd�
dd�Zedd�
dd��
Zed	d�
d
d��
Zede	fd
ddddddd�dd�Z
d)dddddd�dd�Zd
ddd�dd�Zd
ddd�dd �Z
d!d!d!d!dede	dddd"fd
d#ddddddddddd$dd%dd&�d'd(�ZdS)*�MySQLAuthenticatorz$Implements the authentication phase.�None)
�returnc

C
s(d
|_i|_
i|_d|_d|_d|_dS)zConstructor.�FN)�	_username�
_passwords�_plugin_config�_ssl_enabled�_auth_strategy�_auth_plugin_class�
�self�r$�Q/opt/nydus/tmp/pip-target-wkfpz8uv/lib64/python/mysql/connector/authentication.py�__init__:s




zMySQLAuthenticator.__init__�boolc


C
s|jS)
z&Signals whether or not SSL is enabled.)
rr"r$r$r%�ssl_enabledCszMySQLAuthenticator.ssl_enabledzDict[str, Any]c


C
s|jS)
aCustom arguments that are being provided to the authentication plugin when called.

        The parameters defined here will override the ones defined in the
        auth plugin itself.

        The plugin config is a read-only property - the plugin configuration
        provided when invoking `authenticate()` is recorded and can be queried
        by accessing this property.

        Returns:
            dict: The latest plugin configuration provided when invoking
                  `authenticate()`.
        )
rr"r$r$r%�
plugin_configHsz MySQLAuthenticator.plugin_configr
r�strzOptional[Dict[str, Any]]�int�bytes)�sock�host�ssl_options�charset�client_flags�max_allowed_packetrc	
C
s�|d
uri}tj
|||d�}|
�|�

t�d�

|
j|�d�
|�d�
|�d�
|�dd�|�d	d�|�d
�
|�d�
d�}t�d
�

|
�||�
t�d�

d|_|S)a�Sets up an SSL communication channel.

        Args:
            sock: Pointer to the socket connection.
            host: Server host name.
            ssl_options: SSL and TLS connection options (see
                         `network.MySQLSocket.build_ssl_context`).
            charset: Client charset (see [1]), only the lower 8-bits.
            client_flags: Integer representing client capabilities flags.
            max_allowed_packet: Maximum packet size.

        Returns:
            ssl_request_payload: Payload used to carry out SSL authentication.

        References:
            [1]: https://dev.mysql.com/doc/dev/mysql-server/latest/                page_protocol_basic_character_set.html#a_protocol_character_set
        N)r0r1r2zBuilding SSL context�ca�cert�keyZverify_certFZverify_identity�tls_versionsZtls_ciphersuites)Zssl_caZssl_certZssl_keyZssl_verify_certZssl_verify_identityr6Ztls_cipher_suiteszSwitching to SSLzSSL has been enabledT)	rZ
make_auth_ssl�sendr�debugZbuild_ssl_context�getZ
switch_to_sslr)	r#r-r.r/r0r1r2Zssl_request_payload�ssl_contextr$r$r%�	setup_sslYs.



�











�




zMySQLAuthenticator.setup_sslNrz
Optional[str])�new_strategy_name�strategy_class�username�password_factorrcC
sP|d
ur|j}|d
ur|j
}t�d|
�
t|
|d�||j�|d�|jd�|_d
S)a�Switches the authorization plugin.

        Args:
            new_strategy_name: New authorization plugin name to switch to.
            strategy_class: New authorization plugin class to switch to
                            (has higher precedence than the authorization plugin name).
            username: Username to be used - if not defined, the username
                      provided when `authentication()` was invoked is used.
            password_factor: Up to three levels of authentication (MFA) are allowed,
                             hence you can choose the password corresponding to the 1st,
                             2nd, or 3rd factor - 1st is the default.
        NzSwitching to strategy %s)Zplugin_name�auth_plugin_classr)
r()	rr!rr8r
rr9r(r )r#r<r=r>r?r$r$r%�_switch_auth_strategy�s



�

�z(MySQLAuthenticator._switch_auth_strategyzOptional[bytes])r-�pktrcC
s�d
}|dtkr�||j
v
r"td�
�
t�|�
\}}|j||d�
t�d||jj	�
|jj
|
|fi|j�
�
}|dtkr�t�
|�
}|jj|
|fi|j�
�
}|dtkr�t�d�

|S|dtkr�t|�
�
|d7}qt�d�

d	S)
a
Handles MFA (Multi-Factor Authentication) response.

        Up to three levels of authentication (MFA) are allowed.

        Args:
            sock: Pointer to the socket connection.
            pkt: MFA response.

        Returns:
            ok_packet: If last server's response is an OK packet.
            None: If last server's response isn't an OK packet and no ERROR was raised.

        Raises:
            InterfaceError: If got an invalid N factor.
            errors.ErrorTypes: If got an ERROR response.
        ��z5Failed Multi Factor Authentication (invalid N factor))
r?zMFA %i factor %szMFA completed succesfullyrz"MFA terminated with a no ok packetN)rrrrZparse_auth_next_factorrArr8r �name�auth_switch_responserr�parse_auth_more_data�auth_more_responserrr
�warning)r#r-rBZn_factorr<�	auth_datar$r$r%�
_mfa_n_factor�s:




�


�
�



�
�






z MySQLAuthenticator._mfa_n_factorcC
s

|d
tkr t
|�
dkr td�
�
|d
tkrft�d�

t�|�
\}}|�|�

|jj	|
|fi|j
�
�
}|d
tkr�t�d�

t�|�
}|jj
|
|fi|j
�
�
}|d
tkr�t�d|jj�
|S|d
tkr�t�d�

t�d|jj�
|�|
|�S|d
tk�
rt|�
�
d	S)
a�
Handles server's response.

        Args:
            sock: Pointer to the socket connection.
            pkt: Server's response after completing the `HandShakeResponse`.

        Returns:
            ok_packet: If last server's response is an OK packet.
            None: If last server's response isn't an OK packet and no ERROR was raised.

        Raises:
            errors.ErrorTypes: If got an ERROR response.
            NotSupportedError: If got Authentication with old (insecure) passwords.
        rD�z�Authentication with old (insecure) passwords is not supported. For more information, lookup Password Hashing in the latest MySQL manualz+Server's response is an auth switch requestzExchanging further packetsz%s completed succesfullyz$Starting multi-factor authenticationzMFA 1 factor %sN)r�lenr	rr8rZparse_auth_switch_requestrAr rFrrrGrHrrErrKrr
)r#r-rBr<rJr$r$r%�_handle_server_response�s>

�






�
�





�
�






z*MySQLAuthenticator._handle_server_responserFrzOptional[Dict[str, str]]r)r-�	handshaker>�	password1�	password2�	password3�databaser0r1r2�auth_pluginr@�
conn_attrs�is_change_user_requestr)rcK
s�||_|||d
�|_
t�|�
|_||_tj||||||	|
|||
||j|j	d�
\}|_
|r\dnd}|
j|g
|�
R�
t|
�
��
}|�|
|�}|dur�td�
d�|S)aPerforms the authentication phase.

        During re-authentication you must set `is_change_user_request` to True.

        Args:
            sock: Pointer to the socket connection.
            handshake: Initial handshake.
            username: Account's username.
            password1: Account's password factor 1.
            password2: Account's password factor 2.
            password3: Account's password factor 3.
            database: Initial database name for the connection.
            charset: Client charset (see [1]), only the lower 8-bits.
            client_flags: Integer representing client capabilities flags.
            max_allowed_packet: Maximum packet size.
            auth_plugin: Authorization plugin name.
            auth_plugin_class: Authorization plugin class (has higher precedence
                               than the authorization plugin name).
            conn_attrs: Connection attributes.
            is_change_user_request: Whether is a `change user request` operation or not.
            plugin_config: Custom configuration to be passed to the auth plugin
                           when invoked. The parameters defined here will override the
                           ones defined in the auth plugin itself.

        Returns:
            ok_packet: OK packet.

        Raises:
            InterfaceError: If OK packet is NULL.

        References:
            [1]: https://dev.mysql.com/doc/dev/mysql-server/latest/                page_protocol_basic_character_set.html#a_protocol_character_set
        )rrC�)
rOr>�passwordrSr0r1r2rTr@rUrVr(r))r
r
)NNNzGot a NULL ok_pkt)rr�copy�deepcopyrr!rZ	make_authr(r)r r7r,�recvrNr)r#r-rOr>rPrQrRrSr0r1r2rTr@rUrVr)Zresponse_payloadZ	send_argsrBZok_pktr$r$r%�authenticate!
s45















�



zMySQLAuthenticator.authenticate)NNr)�__name__�
__module__�__qualname__�__doc__r&�propertyr(r)rrr;rArKrNr\r$r$r$r%r7s:
	



�<

�"6;










�r)r`�
__future__rrY�typingrrrr�errorsrr	r
rZpluginsrr
�protocolrrrrrrrr�typesr�networkrrr$r$r$r%�<module>s



(