File: //lib/python3.9/site-packages/yubico/__pycache__/yubikey_config.cpython-39.pyc
a
O�bW] � @ s� d Z g d�ZddlmZ ddlZddlZddlZddlmZ ddlm Z ddlm
Z
dd lm Z dd
lm Z dd l
mZmZmZmZ dd l mZ d
d� ZejZejZejZejZej Z eddddd�eddddd�eddddd�eddddd�ed d dd d�ed d dd!d�ed"d#d$d%d�ed&d#d'd(d�ed)d*d+d,d�g Z ed-ddd.d�ed/ddd0d1d2�ed3ddd4d�ed5ddd6d�ed7d dd8d�ed9dd+d:d�ed;d d+d<d�ed=d#d+d>d�ed?d*d+d@d�edAdd$dBdCdD�edEd d$dBdFdD�edGd#d$dBdHdD�edIdJd$dBdKdD�edLdJd$dBdMdD�edNd d'dOdPdD�edQdRd'dOdSdD�edTdd'dOdUdD�edVdd'dOdWdD�gZ edXdd'dYd�edZdd'd[d�ed\dd'd]d�ed^dd_d`d�edad d_dbd�edcd d_ddd�eded#d_dfd�gZ G dgdh� dhe j!�Z"G didj� dje#�Z$dkdl� Z%dS )mz!
module for configuring YubiKeys
)� TicketFlags� ConfigFlags�
ExtendedFlags�YubiKeyConfigError�
YubiKeyConfig� )� __version__� N)� yubico_util)� yubikey_defs)�
yubikey_frame)�yubico_exception)� yubikey_base)�YubiKeyConfigBits�YubiKeyConfigFlag�YubiKeyExtendedFlag�YubiKeyTicketFlag)�SLOTc C sH t j�� D ]4}|�d�s
||�� kr
tt |�| kr
d| S q
d| S )z Turn command number into name �_zSLOT_%sz0x%02x)r �__dict__�keys�
startswith�upper�getattr)Znum�attr� r �9/usr/lib/python3.9/site-packages/yubico/yubikey_config.py� command2str s
r Z TAB_FIRST)r r zSend TAB before first part)� min_ykver�docZ APPEND_TAB1� zSend TAB after first partZ APPEND_TAB2� zSend TAB after second partZ
APPEND_DELAY1� z Add 0.5s delay after first partZ
APPEND_DELAY2� z Add 0.5s delay after second partZ APPEND_CR� z Append CR as final character� OATH_HOTP�@ )r r zChoose OATH-HOTP mode� CHAL_RESP)r r z Choose Challenge-Response modeZ PROTECT_CFG2� )r r z Protect configuration in slot 2�SEND_REFz(Send reference string (0..F) before dataZ TICKET_FIRSTz)Send ticket first (default is fixed part))r � )r r Z max_ykverZ PACING_10MSzAdd 10ms intra-key pacingZ PACING_20MSzAdd 20ms intra-key pacing�
STATIC_TICKETzStatic ticket generation� SHORT_TICKETz#Send truncated ticket (half length)Z
STRONG_PW1z+Strong password policy flag #1 (mixed case)�
STRONG_PW2z9Strong password policy flag #2 (subtitute 0..7 to digits)Z
MAN_UPDATEz)Allow manual (local) update of static OTP�
OATH_HOTP8ZOATHz+Generate 8 digits HOTP rather than 6 digits)r �moder ZOATH_FIXED_MODHEX1z'First byte in fixed part sent as modhexZOATH_FIXED_MODHEX2z,First two bytes in fixed part sent as modhexZOATH_FIXED_MODHEX�P zFixed part sent as modhexZOATH_FIXED_MASKzMask to get out fixed flags� CHAL_YUBICOZCHALz,Challenge-response enabled - Yubico OTP mode� CHAL_HMAC�" z&Challenge-response enabled - HMAC-SHA1� HMAC_LT64z+Set when HMAC message is less than 64 bytes�
CHAL_BTN_TRIGz3Challenge-respoonse operation requires button pressZSERIAL_BTN_VISIBLEz/Serial number visible at startup (button press)ZSERIAL_USB_VISIBLEz*Serial number visible in USB iSerial fieldZSERIAL_API_VISIBLEz"Serial number visible via API callZUSE_NUMERIC_KEYPAD)r � z Use numeric keypad for digitsZ FAST_TRIGz Use fast trig if only cfg1 setZ ALLOW_UPDATEzEAllow update of existing configuration (selected flags + access code)ZDORMANTzODormant configuration (can be woken up and flag removed = requires update flag)c @ s e Zd ZdZdS )r z<
Exception raised for YubiKey configuration errors.
N)�__name__�
__module__� __qualname__�__doc__r r r r r h s r c @ s� e Zd ZdZd4dd�Zdd� Zdd � Zd5d
d �Zd d
� Zdd� Z dd� Z
dd� Z dd� Z dd� Z
d6dd �Zd7d d �Zd8d!d"�Zd9d#d$�Zd:d%d&�Zd'd(� Zd;d*d+�Zd<d,d-�Zd.d/� Zd0d1� Zd2d3� ZdS )=r zH
Base class for configuration of all current types of YubiKeys.
NFc C s� |du rt jdd�| _n|| _d| _|| _d| _d| _d| _d| _t d�| _
t d�| _ t d�| _ d| _
d| _|st|r�| jdd d
� || _|| _|| _dS ) a�
`ykver' is a tuple (major, minor) with the version number of the key
you are planning to apply this configuration to. Not mandated, but
will get you an exception when trying to set flags for example, rather
than the YubiKey just not operating as expected after programming.
YubiKey >= 2.3 supports updating certain parts of a configuration
(for example turning on/off APPEND_CR) without overwriting others
(most notably the stored secret). Set `update' to True if this is
what you want. The current programming must have flag 'ALLOW_UPDATE'
set to allow configuration update instead of requiring complete
reprogramming.
YubiKey >= 2.3 also supports swapping the configurations, making
slot 1 be slot 2 and vice versa. Set swap=True for this.
YubiKeys support deleting a configuration, setting it in an
unprogrammed state. Set zap=True for this.
NT)Zdefault_answer)r r � r � r r5 ��major�minor)r
ZYubiKeyCapabilities� capabilities�yk_req_version�ykver�fixed�uid�key� access_coder � ticket_flags� config_flags�extended_flags� unlock_code�_mode�_require_version�_update_config� _swap_slots�_zap)�selfrA r? �updateZswapZzapr r r �__init__r s(
zYubiKeyConfig.__init__c C sp d| j jtt| ��| j| j| jt| j�t| j �t| j
�t| j �| j �
� | j�
� | j�
� t| j�| j| j| jf S )Nzr<%s instance at %s: mode %s, v=%s/%s, lf=%i, lu=%i, lk=%i, lac=%i, tf=%x, cf=%x, ef=%x, lu=%i, up=%s, sw=%s, z=%s>)� __class__r6 �hex�idrJ r@ rA �lenrB rC rD rE rF �
to_integerrG rH rI rL rM rN �rO r r r �__repr__� s"
�zYubiKeyConfig.__repr__c C s | j S )z`
Return the (major, minor) versions of YubiKey required for this configuration.
)r@ rW r r r �version_required� s z YubiKeyConfig.version_requiredc C s: | j }|dkr6| �|�}t|�dkr,|| _ n
t�d��|S )aC
The fixed string is used to identify a particular Yubikey device.
The fixed string is referred to as the 'Token Identifier' in OATH-HOTP mode.
The length of the fixed string can be set between 0 and 16 bytes.
Tip: This can also be used to extend the length of a static password.
Nr" z&The "fixed" string must be 0..16 bytes)rB �_decode_input_stringrU r �
InputError�rO �data�old�newr r r � fixed_string� s
zYubiKeyConfig.fixed_stringc C s4 | j �� s � | jdd� | �dd� | �dd� dS )a�
Extended scan code mode means the Yubikey will output the bytes in
the 'fixed string' as scan codes, without modhex encoding the data.
Because of the way this is stored in the config flags, it is not
possible to disable this option once it is enabled (of course, you
can abort config update or reprogram the YubiKey again).
Requires YubiKey 2.x.
r �r= r+ Tr* FN)r? Z have_extended_scan_code_moderK � config_flagrW r r r � enable_extended_scan_code_mode� s
z,YubiKeyConfig.enable_extended_scan_code_modec C s( | j dd� | �dd� | �dd� dS )a�
This will cause a shifted character 1 (typically '!') to be sent before
anything else. This can be used to make the YubiKey output qualify as a
password with 'special characters', if such is required.
Because of the way this is stored in the config flags, it is not
possible to disable this option once it is enabled (of course, you
can abort config update or reprogram the YubiKey again).
Requires YubiKey 2.x.
r ra r, Tr( N)rK rb rW r r r �enable_shifted_1� s z YubiKeyConfig.enable_shifted_1c C s6 | j }|r2| �|�}t|�dkr(|| _ n
t�d��|S )z�
AES128 key to program into YubiKey.
Supply data as either a raw string, or a hexlified string prefixed by 'h:'.
The result, after any hex decoding, must be 16 bytes.
r" z#AES128 key must be exactly 16 bytes)rD rZ rU r r[ r\ r r r �aes_key� s
zYubiKeyConfig.aes_keyc C sP |� d�r t�|dd� �}n|}t|�dkrB|| _| jsL|| _n
t�d��dS )z�
Access code to allow re-programming of your YubiKey.
Supply data as either a raw bytestring, or a hexlified bytestring prefixed by 'h:'.
The result, after any hex decoding, must be 6 bytes.
� h:r N� z"Unlock key must be exactly 6 bytes)r �binascii� unhexlifyrU rI rE r r[ �rO r] r_ r r r �
unlock_key s
zYubiKeyConfig.unlock_keyc C sD |� d�r t�|dd� �}n|}t|�dkr6|| _n
t�d��dS )z�
Set a new access code which will be required for future re-programmings of your YubiKey.
Supply data as either a raw string, or a hexlified string prefixed by 'h:'.
The result, after any hex decoding, must be 6 bytes.
rf r Nrg z"Access key must be exactly 6 bytes)r rh ri rU rE r r[ rj r r r �
access_key s
zYubiKeyConfig.access_keyc C s� | j �� s.t�d| j j| jd | jd f ��|�d�rJt�|dd� �}t |�t
j krht �
dt
j ��| jddd d
� || _| �|� dS ) zA
Set the YubiKey up for standard OTP validation.
z,Yubico OTP not available in %s version %d.%dr r rf r Nz Private UID must be %i bytes� YUBIKEY_OTPr) r< )r? Zhave_yubico_OTPr
�YubiKeyVersionError�modelrA r rh ri rU r
ZUID_SIZEr r[ � _change_moderC re )rO Z private_uidre r r r �mode_yubikey_otp% s
�
z YubiKeyConfig.mode_yubikey_otprg r r; c C s� | j �d�s0t�d| j j| jd | jd f ��|dkrJ|dkrJt�d��| jdd dd
� | � |� |dkrx| �
d d � |s�|s�|r�| � |�}t �
|�t �
|� | }| �|� |r�| jt�d
|� | _dS )z\
Set the YubiKey up for OATH-HOTP operation.
Requires YubiKey 2.1.
ZHOTPz+OATH HOTP not available in %s version %d.%dr r rg r! z OATH-HOTP digits must be 6 or 8r$ r r< r- T�<HN)r? Z have_OATHr
rn ro rA r r[ rp �_set_20_bytes_keyrb rZ r �chr_byter` rC �struct�pack) rO �secret�digitsZ factor_seedZomp�ttZmuiZ decoded_muirB r r r �mode_oath_hotp5 s �
z YubiKeyConfig.mode_oath_hotp�HMACTc C s� |� � dvrt�d| ��| j�|� � �sTt�d|� � | jj| jd | jd f ��| j dddd� |� � d kr�| �
d
d � | �
d |� | � |� n| �
d
d � | � |� | �
d|� dS )aR
Set the YubiKey up for challenge-response operation.
`type' can be 'HMAC' or 'OTP'.
`variable' is only applicable to type 'HMAC'.
For type HMAC, `secret' is expected to be 20 bytes (160 bits).
For type OTP, `secret' is expected to be 16 bytes (128 bits).
Requires YubiKey 2.2.
)r{ ZOTPzInvalid 'type' (%s)z7%s Challenge-Response not available in %s version %d.%dr r r& r r< r{ r1 Tr3 r0 r4 N)
r r r[ r? Zhave_challenge_responser
rn ro rA rp rb rs re )rO rw �type�variableZrequire_buttonr r r �mode_challenge_responseL s
��
z%YubiKeyConfig.mode_challenge_responsec C s� t |t�}|rp| j�|�sLt�d||�| jj�| jj| jd | jd f ��|� � \}}| j
||d� |� � }n t |�t
ur�t�d| ��|}| j�||�S )z�
Get or set a ticket flag.
'which' can be either a string ('APPEND_CR' etc.), or an integer.
You should ALWAYS use a string, unless you really know what you are doing.
z0Ticket flag %s requires %s, and this is %s %d.%dr r r< z#Unknown non-integer TicketFlag (%s))� _get_flagr r? Zhave_ticket_flagr
rn �
req_stringro rA � req_versionrK rV r| �intr r[ rF �get_set�rO �whichr_ �flagZ req_majorZ req_minor�valuer r r � ticket_flagj s
��
zYubiKeyConfig.ticket_flagc C s� t |t�}|rp| j�|�sLt�d||�| jj�| jj| jd | jd f ��|� � \}}| j
||d� |� � }n t |�t
ur�t�d| ��|}| j�||�S )z�
Get or set a config flag.
'which' can be either a string ('PACING_20MS' etc.), or an integer.
You should ALWAYS use a string, unless you really know what you are doing.
z0Config flag %s requires %s, and this is %s %d.%dr r r< z#Unknown non-integer ConfigFlag (%s))r r r? Zhave_config_flagr
rn r� ro rA r� rK rV r| r� r r[ rG r� r� r r r rb � s
��
zYubiKeyConfig.config_flagc C s� t |t�}|rp| j�|�sLt�d||�| jj�| jj| jd | jd f ��|� � \}}| j
||d� |� � }n t |�t
ur�t�d| ��|}| j�||�S )z�
Get or set a extended flag.
'which' can be either a string ('SERIAL_API_VISIBLE' etc.), or an integer.
You should ALWAYS use a string, unless you really know what you are doing.
z2Extended flag %s requires %s, and this is %s %d.%dr r r< z%Unknown non-integer ExtendedFlag (%s))r r r? Zhave_extended_flagr
rn r� ro rA r� rK rV r| r� r r[ rH r� r� r r r �
extended_flag� s
��
zYubiKeyConfig.extended_flagc C sh d}t �d| j| j| j| jt| j�| j�� | j �� | j
�� |�
}dt � |� }|t �d|� | j
}|S )zU
Return the current configuration as a bytestring (always 64 bytes).
r z<16s6s16s6sBBBBHi�� rr )ru rv rB rC rD rE rU rH rV rF rG r Zcrc16rI )rO Zt_rfu�first�crc�secondr r r � to_string� s � zYubiKeyConfig.to_stringr c C s� | � � }|�dt�d��}|dkr8| jr0tj}q^tj}n&|dkrV| jrNtj}q^tj }nds^J �| j
rjtj }| j rtd}t
j||d�S )zL
Return the current configuration as a YubiKeyFrame object.
r% r r r r r: )�command�payload)r� �ljustr rt rL r �UPDATE1�CONFIG�UPDATE2�CONFIG2rM �SWAPrN r Z YubiKeyFrame)rO Zslotr] r� r� r r r �to_frame� s zYubiKeyConfig.to_framec C sN ||f}| j r:|| j kr:t�d||| j d | j d f ��|| jkrJ|| _dS )zM Update the minimum version of YubiKey this configuration can be applied to. z7Configuration requires YubiKey %d.%d, and this is %d.%dr r N)rA r
rn r@ )rO r= r> Znew_verr r r rK � s �
z YubiKeyConfig._require_versionc C sb t jdkr t|t�r |�d�}|�d�r>dt�|dd � � }|�d�rZt� |dd � �S |S d S )N)r5 r �asciis m:rf r )
�sys� version_info�
isinstance�str�encoder r Z
modhex_decoderh ri )rO r] r r r rZ � s
z"YubiKeyConfig._decode_input_stringc C sl | j r"| j |kr"td| j |f ��| j||d� || _ td�| _td�| _td�| _|dkrh| �|d� dS )z4 Change mode of operation, with some sanity checks. z!Can't change mode (from %s to %s)r< r rm TN)rJ � RuntimeErrorrK r rF rG rH r� )rO r. r= r> r r r rp s
zYubiKeyConfig._change_modec C sZ |� d�r t�|dd� �}n|}t|�dkrL|dd� | _|dd� | _n
t�d��dS )z�
Set a 20 bytes key. This is used in CHAL_HMAC and OATH_HOTP mode.
Supply data as either a raw bytestring, or a hexlified bytestring prefixed by 'h:'.
The result, after any hex decoding, must be 20 bytes.
rf r N� r" z!HMAC key must be exactly 20 bytes)r rh ri rU rD rC r r[ rj r r r rs s
z YubiKeyConfig._set_20_bytes_key)NNFFF)N)rg Nr r r; )r{ TF)N)N)N)r )r )r6 r7 r8 r9 rQ rX rY r` rc rd re rk rl rq rz r~ r� rb r� r� r� rK rZ rp rs r r r r r n s0 �
1
)
r c sB � fdd�|D �}t |�dkr"dS t |�dkr6|d S ds>J �dS )z Find 'which' entry in 'flags'. c s g | ]}|� � �r|�qS r )Zis_equal)�.0�this�r� r r �
<listcomp>( r: z _get_flag.<locals>.<listcomp>r Nr r )rU )r� �flags�resr r� r r & s r )&r9 �__all__Zyubico_versionr r� ru rh r; r r
r r r
Zyubikey_config_utilr r r r r r r� Z SLOT_CONFIGr� Z SLOT_CONFIG2r� Z SLOT_UPDATE1r� Z SLOT_UPDATE2r� Z SLOT_SWAPr r r Z YubicoErrorr �objectr r r r r r �<module> sz �
� �
;