1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
|
import typing as t
if t.TYPE_CHECKING:
from gssapi.raw.named_tuples import WrapResult, UnwrapResult
from gssapi.sec_contexts import SecurityContext
def get_mic(
context: "SecurityContext",
message: bytes,
qop: t.Optional[int] = None,
) -> bytes:
"""Generate a MIC for a message.
This method generates a Message Integrity Check token for the
given message. This can be separately trasmitted to the other
entity, unlike wrap, which bundles the MIC and the message
together.
Args:
context (~gssapi.raw.sec_contexts.SecurityContext): the current
security context
message (bytes): the message for which to generate the MIC
qop (int): the requested Quality of Protection
(or None to use the default)
Returns:
bytes: the generated MIC token
Raises:
~gssapi.exceptions.ExpiredContextError
~gssapi.exceptions.MissingContextError
~gssapi.exceptions.BadQoPError
"""
def verify_mic(
context: "SecurityContext",
message: bytes,
token: bytes,
) -> int:
"""Verify that a MIC matches a message.
This method verifies that the given MIC matches the given message.
If the MIC does not match the given message, an exception will
be raised.
Args:
context (~gssapi.raw.sec_contexts.SecurityContext): the current
security context
message (bytes): the message in question
token (bytes): the MIC token in question
Returns:
int: the QoP used.
Raises:
~gssapi.exceptions.InvalidTokenError
~gssapi.exceptions.BadMICError
~gssapi.exceptions.DuplicateTokenError
~gssapi.exceptions.ExpiredTokenError
~gssapi.exceptions.TokenTooLateError
~gssapi.exceptions.TokenTooEarlyError
~gssapi.exceptions.ExpiredContextError
~gssapi.exceptions.MissingContextError
"""
def wrap_size_limit(
context: "SecurityContext",
output_size: int,
confidential: bool = True,
qop: t.Optional[int] = None,
) -> int:
"""Calculate the max message size.
This method calculates the unwrapped/unencrypted message size for
the given maximum wrapped/encrypted message size.
Args:
context (~gssapi.raw.sec_contexts.SecurityContext): the current
security context
output_size (int): the maximum desired wrapped/encrypted message size
confidential (bool): whether or not confidentiality is being used
qop (int): the QoP that will be when you actually call wrap
(or None for the default QoP)
Returns:
int: the maximum unencrypted/unwrapped message size
Raises:
~gssapi.exceptions.MissingContextError
~gssapi.exceptions.ExpiredContextError
~gssapi.exceptions.BadQoPError
"""
def wrap(
context: "SecurityContext",
message: bytes,
confidential: bool = True,
qop: t.Optional[int] = None,
) -> "WrapResult":
"""Wrap/Encrypt a message.
This method wraps or encrypts a message (depending on the value
of confidential) with the given Quality of Protection.
Args:
context (~gssapi.raw.sec_contexts.SecurityContext): the current
security context
message (bytes): the message to wrap or encrypt
confidential (bool): whether or not to encrypt the message (True),
or just wrap it with a MIC (False)
qop (int): the desired Quality of Protection
(or None for the default QoP)
Returns:
WrapResult: the wrapped/encrypted message, and whether or not
encryption was actually used
Raises:
~gssapi.exceptions.ExpiredContextError
~gssapi.exceptions.MissingContextError
~gssapi.exceptions.BadQoPError
"""
def unwrap(
context: "SecurityContext",
message: bytes,
) -> "UnwrapResult":
"""Unwrap/Decrypt a message.
This method unwraps or decrypts a message, depending
on whether the sender used confidentiality.
Args:
context (~gssapi.raw.sec_contexts.SecurityContext): the current
security context
message (bytes): the message to unwrap/decrypt
Returns:
UnwrapResult: the unwrapped/decrypted message, whether or on
encryption was used, and the QoP used
Raises:
~gssapi.exceptions.InvalidTokenError
~gssapi.exceptions.BadMICError
~gssapi.exceptions.DuplicateTokenError
~gssapi.exceptions.ExpiredTokenError
~gssapi.exceptions.TokenTooLateError
~gssapi.exceptions.TokenTooEarlyError
~gssapi.exceptions.ExpiredContextError
~gssapi.exceptions.MissingContextError
"""
|
