a oe @sdZddlZddlZddlZddlZddlZddlZddlZddl Z dZ ddZ ddZ ddZ Gd d d ejZd d Zd dZedkrejdedZejddddddejdddddejddddddejdddd de\Z Zzee je _Wn"eefy$ed!Yn0zzFes6dgZedd"krLen edd#krben ed$Wn8eyYn&eyYneYn0We j re!d%ne j re!d%0dS)&a#A sample socket server and client using SSPI authentication and encryption. You must run with either 'client' or 'server' as arguments. A server must be running before a client can connect. To use with Kerberos you should include in the client options --target-spn=username, where 'username' is the user under which the server is being run. Running either the client or server as a different user can be informative. A command-line such as the following may be useful: `runas /user:{user} {fqp}\python.exe {fqp}\socket_server.py --wait client|server` {fqp} should specify the relevant fully-qualified path names. To use 'runas' with Kerberos, the client program will need to specify --target-spn with the username under which the *server* is running. See the SSPI documentation for more details. Nc CsFz tWStjy@}ztttjWYd}~Sd}~00dSN)win32api GetUserNameerrorreprZ GetUserNameExZNameSamCompatible)detailsrHC:\Program Files\Certbot\pkgs\win32\Demos\security\sspi\socket_server.pyr$s rcCs$|tdt|||dS)Ni)sendstructpacklen)smrrr _send_msg2srcCs2|td}|sdStd|d}||S)Nr r)Zrecvr calcsizeunpack)rZ size_datacbrrr _get_msg7s rc@s$eZdZddZddZddZdS)SSPISocketServercOs,tjj|g|Ri|ttj|_dSr) socketserver TCPServer__init__sspiZ ServerAuthoptionspackagesa)selfargskwrrr r@szSSPISocketServer.__init__c Cs|jt|}|durdSz|j|\}}Wn2tjyd}ztd|WYd}~dSd}~00|dkrpqt||djq dS)NFzFAILED to authorize client:rT) rresetr authorizerrprintrBuffer)rsockcadataerrZ sec_bufferrrrr verify_requestDs  zSSPISocketServer.verify_requestcCstdt|jjz\tdtt|}t|}|dusf|durHqf|j||}tdt|q&W|jjn|jj0| |tdtdS)NzThe server is running as userz'Having conversation with client as userz Client sent:zThe server is back to user) r#rrZctxtZImpersonateSecurityContextrZdecryptrZRevertSecurityContextZ close_request)rZrequestZclient_addressr'keyrrr process_requestVs    z SSPISocketServer.process_requestN)__name__ __module__ __qualname__rr)r+rrrr r?srcCs$tdtjfd}td|dS)N localhostzRunning test server...)rrportr#Z serve_forever)rrrr serveksr1cCstjdtj}|tjtjtj d}d}| |\}}t |j |dj |dkrXqdt|j }q.tddD]*}||\}}t |j |t |j |qt|j tddS)Nr/)Z targetspnrz5Auth dance complete - sending a few encryted messageszHello from the clientzClient completed.)httpclientZHTTPConnectionrr0ZconnectrZ ClientAuthrZ target_spnr"rr%r$rr#splitZencryptclose)cr&r'r(Zout_bufZblobr*rrr sspi_clientqs     r7__main__z%prog [options] client|server) descriptionz --packagestoreZNTLMz8The SSPI package to use (eg, Kerberos) - default is NTLM)actiondefaulthelpz --target-spnaLThe target security provider name to use. The string contents are security-package specific. For example, 'Kerberos' or 'Negotiate' require the server principal name (SPN) (ie, the username) of the remote process. For NTLM this must be blank.)r<r>z--portZ8181z%The port number to use (default=8181)z--wait store_truezCause the program to wait for input just before terminating. Useful when using via runas to see any error messages before termination. z--port must be an integerr3Zserverz=You must supply 'client' or 'server' - use --help for detailszPress enter to continue)"__doc__Z http.clientr2Zoptparserr tracebackrrZ win32securityrrrrrrr1r7r,Z OptionParserparserZ add_option parse_argsrintr0 ValueError TypeErrorrKeyboardInterrupt SystemExit print_excwaitinputrrrr s,