o g9@sdZddlmZddlmZmZmZmZddlm Z m Z m Z ddl m Z ddl mZmZddlmZmZmZmZmZmZmZmZdd lmZerNdd lmZGd d d Zd S)z5Implementing support for MySQL Authentication Plugins) annotations) TYPE_CHECKINGAnyDictOptional)InterfaceErrorNotSupportedError get_exception)logger)MySQLAuthPluginget_auth_plugin)AUTH_SWITCH_STATUSDEFAULT_CHARSET_IDDEFAULT_MAX_ALLOWED_PACKET ERR_STATUSEXCHANGE_FURTHER_STATUS MFA_STATUS OK_STATUS MySQLProtocol) HandShakeType) MySQLSocketc@seZdZdZd>ddZed?ddZed@d d ZdAd dZe de fdBddZ   dCdDd$d%Z dEd(d)Z dEd*d+Zd,d,d,d,de de dddd-ddfdFdtls_cipher_suiteszSwitching to SSLzSSL has been enabledT) r make_auth_sslsendr debugbuild_ssl_contextget switch_to_sslr) r#r/r0r2r4r6r7ssl_request_payload ssl_contextr$r$r% setup_ssl[s.      zMySQLAuthenticator.setup_sslNrnew_strategy_namestrategy_class Optional[str]usernamepassword_factorcCsP|dur|j}|dur|j}td|t||d||j|d|jd|_dS)aSwitches the authorization plugin. Args: new_strategy_name: New authorization plugin name to switch to. strategy_class: New authorization plugin class to switch to (has higher precedence than the authorization plugin name). username: Username to be used - if not defined, the username provided when `authentication()` was invoked is used. password_factor: Up to three levels of authentication (MFA) are allowed, hence you can choose the password corresponding to the 1st, 2nd, or 3rd factor - 1st is the default. NzSwitching to strategy %s) plugin_nameauth_plugin_classr)r)) rr!r rHr rrJr)r )r#rOrPrRrSr$r$r%_switch_auth_strategys   z(MySQLAuthenticator._switch_auth_strategypktOptional[bytes]cCsd}|dtkrl||jvrtdt|\}}|j||dtd||jj |jj ||fi|j }|dt krKt |}|jj||fi|j }|dtkrXtd|S|dtkrbt||d7}|dtkstdd S) a Handles MFA (Multi-Factor Authentication) response. Up to three levels of authentication (MFA) are allowed. Args: sock: Pointer to the socket connection. pkt: MFA response. Returns: ok_packet: If last server's response is an OK packet. None: If last server's response isn't an OK packet and no ERROR was raised. Raises: InterfaceError: If got an invalid N factor. errors.ErrorTypes: If got an ERROR response. z5Failed Multi Factor Authentication (invalid N factor))rSzMFA %i factor %szMFA completed succesfullyrz"MFA terminated with a no ok packetN)rrrrparse_auth_next_factorrVr rHr nameauth_switch_responserrparse_auth_more_dataauth_more_responserrr warning)r#r/rWn_factorrO auth_datar$r$r% _mfa_n_factors<        z MySQLAuthenticator._mfa_n_factorcCs|dtkrt|dkrtd|dtkr3tdt|\}}|||jj ||fi|j }|dt krOtdt |}|jj ||fi|j }|dtkr_td|jj|S|dtkrxtdtd|jj|||S|dtkrt|d S) aHandles server's response. Args: sock: Pointer to the socket connection. pkt: Server's response after completing the `HandShakeResponse`. Returns: ok_packet: If last server's response is an OK packet. None: If last server's response isn't an OK packet and no ERROR was raised. Raises: errors.ErrorTypes: If got an ERROR response. NotSupportedError: If got Authentication with old (insecure) passwords. rZzAuthentication with old (insecure) passwords is not supported. For more information, lookup Password Hashing in the latest MySQL manualz+Server's response is an auth switch requestzExchanging further packetsz%s completed succesfullyz$Starting multi-factor authenticationzMFA 1 factor %sN)rlenr r rHrparse_auth_switch_requestrVr r]rrr^r_rr\rrcrr )r#r/rWrOrbr$r$r%_handle_server_responses>           z*MySQLAuthenticator._handle_server_responserF handshaker password1 password2 password3database auth_pluginrU conn_attrsOptional[Dict[str, str]]is_change_user_request read_timeout Optional[int] write_timeoutcCs||_|||d|_| |_tj|||||| | | | | ||j|jd \}|_|r+dd|fndd|f}|j|g|Rt | |}| ||}|durOt dd|S)aPerforms the authentication phase. During re-authentication you must set `is_change_user_request` to True. Args: sock: Pointer to the socket connection. handshake: Initial handshake. username: Account's username. password1: Account's password factor 1. password2: Account's password factor 2. password3: Account's password factor 3. database: Initial database name for the connection. charset: Client charset (see [1]), only the lower 8-bits. client_flags: Integer representing client capabilities flags. max_allowed_packet: Maximum packet size. auth_plugin: Authorization plugin name. auth_plugin_class: Authorization plugin class (has higher precedence than the authorization plugin name). conn_attrs: Connection attributes. is_change_user_request: Whether is a `change user request` operation or not. read_timeout: Timeout in seconds upto which the connector should wait for the server to reply back before raising an ReadTimeoutError. write_timeout: Timeout in seconds upto which the connector should spend to send data to the server before raising an WriteTimeoutError. Returns: ok_packet: OK packet. Raises: InterfaceError: If OK packet is NULL. ReadTimeoutError: If the time taken for the server to reply back exceeds 'read_timeout' (if set). WriteTimeoutError: If the time taken to send data packets to the server exceeds 'write_timeout' (if set). References: [1]: https://dev.mysql.com/doc/dev/mysql-server/latest/ page_protocol_basic_character_set.html#a_protocol_character_set )rrY) rhrRpasswordrlr4r6r7rmrUrnrpr)r+rNzGot a NULL ok_pkt) rrr!r make_authr)r+r rGr8recvrgr)r#r/rhrRrirjrkrlr4r6r7rmrUrnrprqrsresponse_payload send_argsrWok_pktr$r$r% authenticate#s8:    zMySQLAuthenticator.authenticate)rr)rr')rr*)r,r*rr)r/rr0r1r2r3r4r5r6r5r7r5rr8)NNr) rOr1rPrQrRrQrSr5rr)r/rrWr8rrX)"r/rrhrrRr1rir1rjr1rkr1rlrQr4r5r6r5r7r5rmrQrUrQrnrorpr'rqrrrsrrrr8)__name__ __module__ __qualname____doc__r&propertyr)r+r.rrrNrVrcrgr{r$r$r$r%r5sB      < " 6;rN)r __future__rtypingrrrrerrorsrr r r pluginsr r protocolrrrrrrrrtypesrnetworkrrr$r$r$r%s  (