a
    kÄ#dž:  ã                   @   s^  d Z ddlZddlZddlmZmZ ddlmZmZm	Z	 ddlm
Z
 ddlmZmZmZ ddlmZ ddlmZmZ dd	lmZ d
Zdd„ ZddddœZdddœZddddœZdddœZddddœZdd d!d"d#d$d%œZd&dd'd(d"d)d*d+d,d-d.œ
Zd/d0d1d2d3d4d5d6d7œZd8d9iZd8d:iZ G d;d<„ d<eƒZ!G d=d>„ d>eƒZ"G d?d@„ d@eƒZ#dAd&dBdCd'dDddEdFdGd*dHœZ$dIdJdKdLdMdNœZ%G dOdP„ dPeƒZ&G dQdR„ dReƒZ'dSdTdUdVœZ(dWdLdMdXœZ)G dYdZ„ dZeƒZ*G d[d\„ d\eƒZ+G d]d^„ d^eƒZ,G d_d`„ d`eƒZ-G dadb„ dbe-ƒZ.eee.dcdd� eee.dcde� ee.e!d8dcdf� ee.e"d8dcdg� e/dhk�rZddil0m1Z1 e1e2ƒ djdk� dS )lz[
TACACS

Based on tacacs+ v6 draft
https://tools.ietf.org/html/draft-ietf-opsawg-tacacs-06
é    N)ÚPacketÚbind_layers)ÚByteEnumFieldÚ	ByteFieldÚIntField)ÚFieldListField)ÚFieldLenFieldÚConditionalFieldÚStrLenField)ÚTCP©ÚchbÚorb)ÚconfÚtestc                    s’   d‰ d}t ˆ ƒt ˆƒk rpt ¡ }| t d|¡¡ | | ¡ ¡ | t d||¡¡ | |¡ | ¡ }ˆ |7 ‰ qd ‡ ‡fdd„t	t ˆƒƒD ƒ¡S )z|

    Obfuscation methodology from section 3.7
    https://tools.ietf.org/html/draft-ietf-opsawg-tacacs-06#section-3.7

    ó    ú!Iz!BBc                 3   s*   | ]"}t tˆ | ƒtˆ| ƒA ƒV  qd S ©Nr   )Ú.0Úi©ÚpadÚpay© úK/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/contrib/tacacs.pyÚ	<genexpr>8   r   zobfuscate.<locals>.<genexpr>)
ÚlenÚhashlibÚmd5ÚupdateÚstructÚpackÚencodeÚdigestÚjoinÚrange)r   ÚsecretÚ
session_idÚversionÚseqZcurr_padÚmsgr   r   r   Ú	obfuscate   s    

r+   ZRootZUserZMinimum)é   é   r   ZTacacszTacacs+)r-   éÀ   ZAuthenticationÚAuthorizationZ
Accounting)r-   é   é   ZUnencryptedzSingle Connection)r-   é   ZLoginzChange PasszSend Authentication)r-   r0   r2   ÚASCIIZPAPZCHAPZARAPZMSCHAPZMSCHAPv2)r-   r0   r1   r2   é   é   ÚNoneZEnableZPPPZPTZRCMDZX25ZNASIZFwProxy)
r   r-   r0   r1   r2   r4   r5   é   é   é	   ZPASSÚFAILZGETDATAZGETUSERZGETPASSZRESTARTÚERRORZFOLLOW)r-   r0   r1   r2   r4   r5   r7   é   r-   ZNOECHOZABORTc                   @   sÂ   e Zd ZdZdZeddeƒeddeƒeddeƒedde	ƒe
dd	d
dd�e
dd	d
dd�e
dd	d
dd�e
dd	d
dd�eedddd„ d�dd„ ƒedddd„ d�edddd„ d�edddd„ d�gZd	S )ÚTacacsAuthenticationStartz…

    Tacacs authentication start body from section 4.1
    https://tools.ietf.org/html/draft-ietf-opsawg-tacacs-06#section-4.1

    z Tacacs Authentication Start BodyÚactionr-   Úpriv_lvlÚauthen_typeÚauthen_serviceÚuser_lenNú!BÚuser©ÚfmtZ	length_ofÚport_lenÚportÚrem_addr_lenÚrem_addrÚdata_lenÚdataÚ c                 C   s   | j S r   ©rB   ©Úxr   r   r   Ú<lambda>ƒ   r   z"TacacsAuthenticationStart.<lambda>©Zlength_fromc                 C   s   | dkS )NrM   r   rO   r   r   r   rQ   „   r   c                 C   s   | j S r   ©rG   rO   r   r   r   rQ   …   r   c                 C   s   | j S r   ©rI   rO   r   r   r   rQ   †   r   c                 C   s   | j S r   ©rK   rO   r   r   r   rQ   ‡   r   )Ú__name__Ú
__module__Ú__qualname__Ú__doc__Únamer   ÚTACACSAUTHENACTIONÚTACACSPRIVLEVELÚTACACSAUTHENTYPEÚTACACSAUTHENSERVICEr   r	   r
   Úfields_descr   r   r   r   r=   q   s"   



ÿôr=   c                
   @   sh   e Zd ZdZdZeddeƒeddeƒeddd	d
d�eddd	dd�e	d
ddd„ d�e	dddd„ d�gZ
dS )ÚTacacsAuthenticationReplyz…

    Tacacs authentication reply body from section 4.2
    https://tools.ietf.org/html/draft-ietf-opsawg-tacacs-06#section-4.2

    z Tacacs Authentication Reply BodyÚstatusr-   Úflagsr   Úserver_msg_lenNú!HÚ
server_msgrE   rK   rL   rM   c                 C   s   | j S r   ©rc   rO   r   r   r   rQ   ˜   r   z"TacacsAuthenticationReply.<lambda>rR   c                 C   s   | j S r   rU   rO   r   r   r   rQ   ™   r   )rV   rW   rX   rY   rZ   r   ÚTACACSREPLYPASSÚTACACSREPLYFLAGSr   r
   r_   r   r   r   r   r`   Š   s   

ûr`   c                	   @   s^   e Zd ZdZdZeddddd�edddd	d�ed
deƒedddd„ d�ed	ddd„ d�gZ	dS )ÚTacacsAuthenticationContinuezˆ

    Tacacs authentication continue body from section 4.3
    https://tools.ietf.org/html/draft-ietf-opsawg-tacacs-06#section-4.3

    z#Tacacs Authentication Continue BodyÚuser_msg_lenNrd   Zuser_msgrE   rK   rL   rb   r-   rM   c                 C   s   | j S r   )rj   rO   r   r   r   rQ   ©   r   z%TacacsAuthenticationContinue.<lambda>rR   c                 C   s   | j S r   rU   rO   r   r   r   rQ   ª   r   )
rV   rW   rX   rY   rZ   r   r   ÚTACACSCONTINUEFLAGSr
   r_   r   r   r   r   ri   œ   s   
üri   zNot Setz
Kerberos 5ZLineZLocalZGuestZRadiusz
Kerberos 4)r   r-   r0   r1   r2   r4   r5   r8   é   é   é    zPass Addz	Pass replZFailÚErrorZFollow)r-   r0   rl   rm   é!   c                   @   sÈ   e Zd ZdZdZeddeƒeddeƒeddeƒedde	ƒe
d	d
ddd�e
dd
ddd�e
dd
ddd�e
dd
ddd�edg eddƒdd„ d�edddd„ d�edddd„ d�edddd„ d�gZdd„ Zd
S )ÚTacacsAuthorizationRequestz†

    Tacacs authorization request body from section 5.1
    https://tools.ietf.org/html/draft-ietf-opsawg-tacacs-06#section-5.1

    z!Tacacs Authorization Request BodyÚauthen_methodr   r?   r-   r@   rA   rB   NrC   rD   rE   rG   rH   rI   rJ   Úarg_cntÚarg_len_list©rF   Zcount_ofrM   c                 C   s   | j S r   ©rs   ©Zpktr   r   r   rQ   ×   r   z#TacacsAuthorizationRequest.<lambda>rR   c                 C   s   | j S r   rN   rO   r   r   r   rQ   Ø   r   c                 C   s   | j S r   rS   rO   r   r   r   rQ   Ù   r   c                 C   s   | j S r   rT   rO   r   r   r   rQ   Ú   r   c                 C   s   | j dkrtS tjS ©Nr   ©rs   ÚTacacsPacketArgumentsr   Úpadding_layer©Úselfr   r   r   r   Úguess_payload_classÜ   s    
z.TacacsAuthorizationRequest.guess_payload_class)rV   rW   rX   rY   rZ   r   ÚTACACSAUTHORTYPEr\   r]   r^   r   r   r   r
   r_   r~   r   r   r   r   rq   Ä   s$   



ÿôrq   c                   @   sŒ   e Zd ZdZdZeddeƒeddddd	�ed
dddd�eddddd�edg e	ddƒdd„ d�e
dddd„ d�e
dddd„ d�gZdd„ ZdS )ÚTacacsAuthorizationReplyz„

    Tacacs authorization reply body from section 5.2
    https://tools.ietf.org/html/draft-ietf-opsawg-tacacs-06#section-5.2

    zTacacs Authorization Reply Bodyra   r   rs   NrC   rt   ru   rc   rd   re   rE   rK   rL   rM   c                 C   s   | j S r   rv   rw   r   r   r   rQ   ñ   r   z!TacacsAuthorizationReply.<lambda>rR   c                 C   s   | j S r   rf   rO   r   r   r   rQ   ò   r   c                 C   s   | j S r   rU   rO   r   r   r   rQ   ó   r   c                 C   s   | j dkrtS tjS rx   ry   r|   r   r   r   r~   õ   s    
z,TacacsAuthorizationReply.guess_payload_class)rV   rW   rX   rY   rZ   r   ÚTACACSAUTHORSTATUSr   r   r   r
   r_   r~   r   r   r   r   r€   â   s   
ÿù	r€   ZStartZStopZWatchdog)r0   r2   r8   ZSuccess)r-   r0   rp   c                   @   sÒ   e Zd ZdZdZeddeƒeddeƒeddeƒedde	ƒed	de
ƒed
dddd�eddddd�eddddd�eddddd�edg eddƒdd„ d�edddd„ d�edddd„ d�edddd„ d�gZdd„ ZdS )ÚTacacsAccountingRequestzƒ

    Tacacs accounting request body from section 6.1
    https://tools.ietf.org/html/draft-ietf-opsawg-tacacs-06#section-6.1

    zTacacs Accounting Request Bodyrb   r   rr   r?   r-   r@   rA   rB   NrC   rD   rE   rG   rH   rI   rJ   rs   rt   ru   rM   c                 C   s   | j S r   rv   rw   r   r   r   rQ     r   z TacacsAccountingRequest.<lambda>rR   c                 C   s   | j S r   rN   rO   r   r   r   rQ     r   c                 C   s   | j S r   rS   rO   r   r   r   rQ     r   c                 C   s   | j S r   rT   rO   r   r   r   rQ     r   c                 C   s   | j dkrtS tjS rx   ry   r|   r   r   r   r~   !  s    
z+TacacsAccountingRequest.guess_payload_class)rV   rW   rX   rY   rZ   r   ÚTACACSACNTFLAGSr   r\   r]   r^   r   r   r   r
   r_   r~   r   r   r   r   r‚     s&   




ÿór‚   c                	   @   s^   e Zd ZdZdZeddddd�edddd	d�ed
deƒedddd„ d�ed	ddd„ d�gZ	dS )ÚTacacsAccountingReplyz�

    Tacacs accounting reply body from section 6.2
    https://tools.ietf.org/html/draft-ietf-opsawg-tacacs-06#section-6.2

    zTacacs Accounting Reply Bodyrc   Nrd   re   rE   rK   rL   ra   rM   c                 C   s   | j S r   rf   rO   r   r   r   rQ   4  r   zTacacsAccountingReply.<lambda>rR   c                 C   s   | j S r   rU   rO   r   r   r   rQ   5  r   )
rV   rW   rX   rY   rZ   r   r   ÚTACACSACNTSTATUSr
   r_   r   r   r   r   r„   '  s   
ür„   c                   @   s>   e Zd ZdZdgZdZedddd„ d�gZd	d
„ Zdd„ Z	dS )rz   zx

    Class defined to handle the arguments listed at the end of tacacs+
    Authorization and Accounting packets.

    Ú_lenzArguments in Tacacs+ packetrL   rM   c                 C   s   | j S r   )r†   rw   r   r   r   rQ   C  r   zTacacsPacketArguments.<lambda>rR   c                 C   s4   | j }d}t|tƒr$|j }|d7 }q
|j| | _|S ©Nr   r-   )Ú
underlayerÚ
isinstancerz   rt   r†   )r}   ÚsÚcurr   r   r   r   Úpre_dissectE  s    

z!TacacsPacketArguments.pre_dissectc                 C   s<   | j }d}t|tƒr$|j }|d7 }q
|d |jk r6tS tjS r‡   )rˆ   r‰   rz   rs   r   r{   )r}   r   r‹   r   r   r   r   r~   Q  s    

z)TacacsPacketArguments.guess_payload_classN)
rV   rW   rX   rY   Ú	__slots__rZ   r
   r_   rŒ   r~   r   r   r   r   rz   8  s   rz   c                   @   s   e Zd ZdZdd„ ZdS )ÚTacacsClientPacketz¿

    Super class for tacacs packet in order to get them unencrypted
    Obfuscation methodology from section 3.7
    https://tools.ietf.org/html/draft-ietf-opsawg-tacacs-06#section-3.7

    c                 C   s(   | j dkr$t|t| j| j| jƒ}|S d S rx   )rb   r+   ÚSECRETr'   r(   r)   r|   r   r   r   Úpost_dissecti  s    
zTacacsClientPacket.post_dissectN)rV   rW   rX   rY   r�   r   r   r   r   rŽ   _  s   rŽ   c                   @   sn   e Zd ZdZdZeddeƒeddeƒeddƒedd	e	ƒe
d
d	ƒe
ddƒgZdd„ Zdd„ Zdd„ Zdd„ ZdS )ÚTacacsHeaderzy

    Tacacs Header packet from section 3.8
    https://tools.ietf.org/html/draft-ietf-opsawg-tacacs-06#section-3.8

    zTacacs Headerr(   r.   Útyper-   r)   rb   r   r'   ÚlengthNc                 C   sº   | j dkrt| jd dkrtS tt d|dd… ¡ƒt|dd … ƒkrHtS tt d|d d… ¡ƒt|dd … ƒkrttS | j dkr”| jd dkr�t	S t
S | j d	kr´| jd dkr°tS tS tjS )
Nr-   r0   r   Zbbbbr2   r8   z!hhr4   r1   )r’   r)   r`   Úsumr    Úunpackr   r=   ri   r€   rq   r„   r‚   r   Z	raw_layer)r}   Úpayloadr   r   r   r~   �  s     
((

z TacacsHeader.guess_payload_classc                 C   sV   | j d u r*|r*|d d… t dt|ƒ¡ }| jdkrRt|t| j| j| j	ƒ}|| S |S )Néüÿÿÿr   r   )
r“   r    r!   r   rb   r+   r�   r'   r(   r)   )r}   Úpr   r   r   r   Ú
post_buildŸ  s    
zTacacsHeader.post_buildc                 C   s   t  d| j¡S )NÚI)r    r!   r'   )r}   r   r   r   Úhashret­  s    zTacacsHeader.hashretc                 C   s2   t |tƒo0| j|jd ko0| j|jko0| j|jkS )Nr-   )r‰   r‘   r)   r’   r'   )r}   Úotherr   r   r   Úanswers°  s    
ÿ
þ
ýzTacacsHeader.answers)rV   rW   rX   rY   rZ   r   ÚTACACSVERSIONÚ
TACACSTYPEr   ÚTACACSFLAGSr   r_   r~   r™   r›   r�   r   r   r   r   r‘   p  s   


ûr‘   é1   )Údport)Úsport)r’   r¢   )r’   r£   Ú__main__)Úinteractztacacs+)ZmydictZmybanner)3rY   r    r   Zscapy.packetr   r   Zscapy.fieldsr   r   r   r   r   r	   r
   Zscapy.layers.inetr   Zscapy.compatr   r   Zscapy.configr   r�   r+   r\   rž   rŸ   r    r[   r]   r^   rg   rh   rk   r=   r`   ri   r   r�   rq   r€   rƒ   r…   r‚   r„   rz   rŽ   r‘   rV   Z
scapy.mainr¥   Úglobalsr   r   r   r   Ú<module>   sÊ   
þÿþÿþû÷ù	öüþþ'G
