gssapi/ctx.py
def wrap(self, message, conf_req=True, qop_req=C.GSS_C_QOP_DEFAULT):
        """
        Wraps a message with a message integrity code, and if `conf_req` is True, encrypts the
        message. The message can be decrypted and the MIC verified by the peer by passing the
        token returned from this method to :meth:`unwrap` on the peer's side.

        :param message: The message to wrap
        :type message: bytes
        :param conf_req: Whether to require confidentiality (encryption)
        :type conf_req: bool
        :param qop_req: The quality of protection required. It is recommended to not change this
            from the default as most GSSAPI implementations do not support it.
        :returns: the wrapped message in a token suitable for passing to :meth:`unwrap`
        :rtype: bytes
        :raises: GSSException if integrity protection is not available
            (:attr:`integrity_negotiated` is False), or if the `conf_req` parameter is True and
            confidentiality protection is not available
            (:attr:`confidentiality_negotiated` is False)
        """
        if not (self.flags & C.GSS_C_INTEG_FLAG):
            raise GSSException("No integrity protection negotiated.")
        if (conf_req and not (self.flags & C.GSS_C_CONF_FLAG)):
            raise GSSException("No confidentiality protection negotiated.")
        if not (self.established or (self.flags & C.GSS_C_PROT_READY_FLAG)):
            raise GSSException("Protection not yet ready.")

        minor_status = ffi.new('OM_uint32[1]')
        output_token_buffer = ffi.new('gss_buffer_desc[1]')
        message_buffer = ffi.new('gss_buffer_desc[1]')
        message_buffer[0].length = len(message)
        c_str_message = ffi.new('char[]', message)
        message_buffer[0].value = c_str_message
        conf_state = ffi.new('int[1]')

        retval = C.gss_wrap(
            minor_status,
            self._ctx[0],
            ffi.cast('int', conf_req),
            ffi.cast('gss_qop_t', qop_req),
            message_buffer,
            conf_state,
            output_token_buffer
        )
        try:
            if GSS_ERROR(retval):
                if minor_status[0] and self.mech_type:
                    raise _exception_for_status(retval, minor_status[0], self.mech_type)
                else:
                    raise _exception_for_status(retval, minor_status[0])

            output_token = _buf_to_str(output_token_buffer[0])
            if conf_req and not conf_state[0]:
                raise GSSException("No confidentiality protection.")
            return output_token
        finally:
            if output_token_buffer[0].length != 0:
                C.gss_release_buffer(minor_status, output_token_buffer)
def wrap(self, message, conf_req=True, qop_req=C.GSS_C_QOP_DEFAULT):
        """
        Wraps a message with a message integrity code, and if `conf_req` is True, encrypts the
        message. The message can be decrypted and the MIC verified by the peer by passing the
        token returned from this method to :meth:`unwrap` on the peer's side.

        :param message: The message to wrap
        :type message: bytes
        :param conf_req: Whether to require confidentiality (encryption)
        :type conf_req: bool
        :param qop_req: The quality of protection required. It is recommended to not change this
            from the default as most GSSAPI implementations do not support it.
        :returns: the wrapped message in a token suitable for passing to :meth:`unwrap`
        :rtype: bytes
        :raises: GSSException if integrity protection is not available
            (:attr:`integrity_negotiated` is False), or if the `conf_req` parameter is True and
            confidentiality protection is not available
            (:attr:`confidentiality_negotiated` is False)
        """
        if not (self.flags & C.GSS_C_INTEG_FLAG):
            raise GSSException("No integrity protection negotiated.")
        if (conf_req and not (self.flags & C.GSS_C_CONF_FLAG)):
            raise GSSException("No confidentiality protection negotiated.")
        if not (self.established or (self.flags & C.GSS_C_PROT_READY_FLAG)):
            raise GSSException("Protection not yet ready.")

        minor_status = ffi.new('OM_uint32[1]')
        output_token_buffer = ffi.new('gss_buffer_desc[1]')
        message_buffer = ffi.new('gss_buffer_desc[1]')
        message_buffer[0].length = len(message)
        c_str_message = ffi.new('char[]', message)
        message_buffer[0].value = c_str_message
        conf_state = ffi.new('int[1]')

        retval = C.gss_wrap(
            minor_status,
            self._ctx[0],
            ffi.cast('int', conf_req),
            ffi.cast('gss_qop_t', qop_req),
            message_buffer,
            conf_state,
            output_token_buffer
        )
        try:
            if GSS_ERROR(retval):
                if minor_status[0] and self.mech_type:
                    raise _exception_for_status(retval, minor_status[0], self.mech_type)
                else:
                    raise _exception_for_status(retval, minor_status[0])

            output_token = _buf_to_str(output_token_buffer[0])
            if conf_req and not conf_state[0]:
                raise GSSException("No confidentiality protection.")
            return output_token
        finally:
            if output_token_buffer[0].length != 0:
                C.gss_release_buffer(minor_status, output_token_buffer)
Wraps a message with a message integrity code, and if `conf_req` is True, encrypts the
        message. The message can be decrypted and the MIC verified by the peer by passing the
        token returned from this method to :meth:`unwrap` on the peer's side.

        :param message: The message to wrap
        :type message: bytes
        :param conf_req: Whether to require confidentiality (encryption)
        :type conf_req: bool
        :param qop_req: The quality of protection required. It is recommended to not change this
            from the default as most GSSAPI implementations do not support it.
        :returns: the wrapped message in a token suitable for passing to :meth:`unwrap`
        :rtype: bytes
        :raises: GSSException if integrity protection is not available
            (:attr:`integrity_negotiated` is False), or if the `conf_req` parameter is True and
            confidentiality protection is not available
            (:attr:`confidentiality_negotiated` is False)