o 4jL @sUdZddlZddlZddlZddlZddlZddlmZddlm Z m Z m Z ddl m Z ddlmZddlmZdd lmZdd lmZmZdd lmZGd d d e ddZejejejejejejejejejejejejd Zee ee!gdffe"d<e#ej$dkrdndZ%dZ&e e'e ddfe"d<e'e(e)Z*e e'e dfe"d<e+hdZ,e e+e e"d<de de fddZ-de de fd d!Z.d"e dee e ffd#d$Z/Gd%d&d&Z0dS)'av Digest authentication middleware for aiohttp client. This middleware implements HTTP Digest Authentication according to RFC 7616, providing a more secure alternative to Basic Authentication. It supports all standard hash algorithms including MD5, SHA, SHA-256, SHA-512 and their session variants, as well as both 'auth' and 'auth-int' quality of protection (qop) options. N)Callable)FinalLiteral TypedDict)URL)hdrs) ClientError)ClientHandlerType) ClientRequestClientResponse)Payloadc@sFeZdZUeed<eed<eed<eed<eed<eed<eed<dS) DigestAuthChallengerealmnonceqop algorithmopaquedomainstaleN)__name__ __module__ __qualname__str__annotations__rrb/var/www/kodo/Anonymous/send/lib/python3.10/site-packages/aiohttp/client_middleware_digest_auth.pyrs  rF)total) MD5zMD5-SESSSHAzSHA-SESSSHA256z SHA256-SESSzSHA-256z SHA-256-SESSSHA512z SHA512-SESSzSHA-512z SHA-512-SESSz hashlib._HashDigestFunctions) z?(?:^|\s|,\s*)(\w+)(?:\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+)))?zC(?:^|\s|,\s*)((?>\w+))(?:\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+)))?)rrrrrrr.CHALLENGE_FIELDSSUPPORTED_ALGORITHMS>urirrcnoncerresponseusernameQUOTED_AUTH_FIELDSvaluereturncC|ddddS)z=Escape backslashes and double quotes for HTTP quoted-strings.\\\"\"replacer,rrr escape_quoteshr6cCr.)z>Unescape backslashes and double quotes in HTTP quoted-strings.r2r1r0r/r3r5rrrunescape_quotesmr7r8headercCsli}t|D],}|d}|d|d}}|dur'|dur'|r&|Sq|dur/t|n|||<q|S)a Parse key-value pairs from the first challenge of a WWW-Authenticate header. This function handles the complex format of WWW-Authenticate header values, supporting both quoted and unquoted values, proper handling of commas in quoted values, and whitespace variations per RFC 7616. A single header may carry several challenges (https://www.rfc-editor.org/rfc/rfc7235#section-4.1). Parsing stops at the next auth-scheme token so a later challenge's parameters cannot overwrite the first challenge's values; a leading scheme token is skipped. Examples of supported formats: - key1="value1", key2=value2 - key1 = "value1" , key2="value, with, commas" - key1=value1,key2="value2" - realm="example.com", nonce="12345", qop="auth" Args: header: The header value string to parse Returns: Dictionary mapping parameter names to their values rr#N)_HEADER_PAIRS_PATTERNfinditergroupr8)r9pairsmatchkey quoted_val unquoted_valrrrparse_header_pairsrs rCc @seZdZdZ ddedededdfdd Zd ed ed ee d BdefddZ d edefddZ de defddZ dedede fddZdS)DigestAuthMiddlewarea1 HTTP digest authentication middleware for aiohttp client. This middleware intercepts 401 Unauthorized responses containing a Digest authentication challenge, calculates the appropriate digest credentials, and automatically retries the request with the proper Authorization header. Features: - Handles all aspects of Digest authentication handshake automatically - Supports all standard hash algorithms: - MD5, MD5-SESS - SHA, SHA-SESS - SHA256, SHA256-SESS, SHA-256, SHA-256-SESS - SHA512, SHA512-SESS, SHA-512, SHA-512-SESS - Supports 'auth' and 'auth-int' quality of protection modes - Properly handles quoted strings and parameter parsing - Includes replay attack protection with client nonce count tracking - Supports preemptive authentication per RFC 7616 Section 3.6 Origin scoping: The credentials are scoped to the origin of the first request the middleware handles. A request to a different origin is passed through untouched, so it never receives a digest response computed from those credentials, unless that origin falls within a protection space the anchor origin advertised through the RFC 7616 ``domain`` directive. Make the first request through the middleware against the intended origin, as the anchor is pinned to it and not reset for the life of the instance. Standards compliance: - RFC 7616: HTTP Digest Access Authentication (primary reference) - RFC 2617: HTTP Authentication (deprecated by RFC 7616) - RFC 1945: Section 11.1 (username restrictions) Implementation notes: The core digest calculation is inspired by the implementation in https://github.com/requests/requests/blob/v2.18.4/requests/auth.py with added support for modern digest auth features and error handling. Tloginpassword preemptiver-NcCsv|durtd|durtdd|vrtd||_|d|_|d|_d|_d|_i|_||_g|_ d|_ dS)Nz"None is not allowed as login valuez%None is not allowed as password value:z8A ":" is not allowed in username (RFC 1945#section-11.1)utf-8r) ValueError _login_strencode _login_bytes_password_bytes_last_nonce_bytes _nonce_count _challenge _preemptive_protection_space_origin)selfrErFrGrrr__init__s   zDigestAuthMiddleware.__init__methodurlbodyrJc" sJ|j}d|vr tdd|vrtd|d}|d}|s"td|dd}|dd }|} |d d} |d } |d } t|j} d}d }|rrd dhdd|dD}|setd|d|vrkdnd }|d }| t vrtd| dd t t | dt dt ffdd dt dt dt ffdd }d |j | |jf}|d| }|dkrt|tr|Id H}n|}|}d ||f}|}|}| |jkr|jd!7_nd!|_| |_|jd"}|d }td t|jd | td td#gd d$}|d }| d%r.d || |f}|rAd | ||||f}|||}n ||d | |f}t|jt|t|| ||d&}| rft| |d <|ru||d<||d'<||d(<g}| D]!\} }!| t!vr|"| d)|!d*q{|"| d+|!q{d,d |S)-a Build digest authorization header for the current challenge. Args: method: The HTTP method (GET, POST, etc.) url: The request URL body: The request body (used for qop=auth-int) Returns: A fully formatted Digest authorization header string Raises: ClientError: If the challenge is missing required parameters or contains unsupported values rz:Malformed Digest auth challenge: Missing 'realm' parameterrz:Malformed Digest auth challenge: Missing 'nonce' parameterzBSecurity issue: Digest auth challenge contains empty 'nonce' valuerrrrrIrJauthzauth-intcSsh|] }|r|qSr)strip).0qrrr sz/DigestAuthMiddleware._encode..,zEDigest auth error: Unsupported Quality of Protection (qop) value(s): z/Digest auth error: Unsupported hash algorithm: z. Supported algorithms: z, xr-cs|S)z.Hsdcsd||fS)zDRFC 7616 Section 3: KD(secret, data) = H(concat(secret, ":", data)).:)join)rfrg)rerrKD/sz(DigestAuthMiddleware._encode..KDrhrHNr08xz-SESS)r*rrr'r)rncr(z="r1=zDigest )#rRr getupperrMr raw_path_qs intersectionsplitr"rir&bytesrNrO isinstancer as_bytesrPrQhashlibsha1rtimectimeosurandomrcendswithr6rLdecodeitemsr+append)"rVrXrYrZ challengerrqop_rawalgorithm_originalrr nonce_bytes realm_bytespathr qop_bytes valid_qopsrjA1A2 entity_bytes entity_hashHA1HA2ncvalue ncvalue_bytesr( cnonce_bytesnoncebitresponse_digest header_fieldsr>fieldr,r)rerdr_encodes                  zDigestAuthMiddleware._encodecCs\t|}|jD]$}||sqt|t|ks|ddkr dS|t|dkr+dSqdS)z Check if the given URL is within the current protection space. According to RFC 7616, a URI is in the protection space if any URI in the protection space is a prefix of it (after both have been made absolute). /TF)rrT startswithlen)rVrY request_str space_strrrr_in_protection_spaces  z)DigestAuthMiddleware._in_protection_spacer)c Cs$|jdkrdS|jdd}|sdS|d\}}}|sdS|dkr&dS|s*dSt|}s2dSi|_tD]}||}durG||j|<q7|j } g|_ |jd} r| D]'} | d } | sfq\| d ry|j t| t| q\|j tt| q\|j st| g|_ t|jS) z Takes the given response and tries digest-auth, if needed. Returns true if the original request must be resent. iFzwww-authenticater[ digestNrr1r)statusheadersrp partitionlowerrCrRr%rYoriginrTrtr]rrrrirbool) rVr) auth_headerrXsepr header_pairsrr,rrr'rrr _authenticates@          z"DigestAuthMiddleware._authenticaterequesthandlercs|j}|jdur||_n||jkr!||js!||IdHSd}tdD]1}|dks9|jrJ|jrJ||jrJ||j|j|j IdH|j t j <||IdH}| |sXnq'|dus_J|S)zRun the digest auth middleware.Nr:r)rYrrUrrangerSrRrrXrZrr AUTHORIZATIONr)rVrrrr) retry_countrrr__call__s0       zDigestAuthMiddleware.__call__)T)rrr__doc__rrrWrr rrrr rr r rrrrrrDs.+ "&=rD)1rrxr|resysrzcollections.abcrtypingrrryarlrr[rclient_exceptionsr client_middlewaresr client_reqrepr r payloadr rmd5rysha256sha512r"dictrrurcompile version_infor;r%tuplesortedkeysr& frozensetr+r6r8rCrDrrrrs^           $*