gssapi/ctx.py
def verify_mic(self, message, mic, supplementary=False):
        """
        Takes a message integrity code (MIC) that has been generated by the peer application for a
        given message, and verifies it against a message, using this security context's
        cryptographic keys.

        The `supplementary` parameter determines how this method deals with replayed, unsequential,
        too-old or missing tokens, as follows:

        If the `supplementary` parameter is False (the default), and if a replayed or otherwise
        out-of-sequence token is detected, this method raises a :exc:`~gssapi.error.GSSCException`.
        If no replay or out-of-sequence token is detected, this method does not raise an exception
        and returns the ``qop_state`` only.

        If `supplementary` is True, instead of raising an exception when a replayed or
        out-of-sequence token is detected, this method returns a tuple
        ``(qop_state, supplementary_info)`` where ``supplementary_info`` is a tuple containing zero
        or more of the constants :const:`~gssapi.S_DUPLICATE_TOKEN`, :const:`~gssapi.S_OLD_TOKEN`,
        :const:`~gssapi.S_UNSEQ_TOKEN` and :const:`~gssapi.S_GAP_TOKEN`. The supplementary info
        tells the caller whether a replayed or out-of-sequence message was detected. The caller
        must check this and decide how to handle the message if any of the flags are set. For a
        reference to the meaning of the flags, check
        `RFC 2744 Section 3.9.1 <http://tools.ietf.org/html/rfc2744#section-3.9.1>` for the
        corresponding GSS_S_OLD_TOKEN, etc, constants.

        :param message: The message the MIC was calculated for
        :type message: bytes
        :param mic: The MIC calculated by the peer
        :type mic: bytes
        :param supplementary: Whether to also return supplementary info.
        :type supplementary: bool
        :returns: ``qop_state`` if `supplementary` is False, or ``(qop_state,
            supplementary_info)`` if `supplementary` is True.
        :raises: :exc:`~gssapi.error.GSSException` if :attr:`integrity_negotiated` is false, or
            :exc:`~gssapi.error.GSSCException` if the verification fails indicating the message was
            modified, replayed or out-of-sequence.
        """
        if not (self.flags & C.GSS_C_INTEG_FLAG):
            raise GSSException("No integrity protection negotiated.")
        if not (self.established or (self.flags & C.GSS_C_PROT_READY_FLAG)):
            raise GSSException("Protection not yet ready.")

        minor_status = ffi.new('OM_uint32[1]')
        message_buffer = ffi.new('gss_buffer_desc[1]')
        message_buffer[0].length = len(message)
        c_str_message = ffi.new('char[]', message)
        message_buffer[0].value = c_str_message
        mic_buffer = ffi.new('gss_buffer_desc[1]')
        mic_buffer[0].length = len(mic)
        c_str_mic = ffi.new('char[]', mic)
        mic_buffer[0].value = c_str_mic
        qop_state = ffi.new('gss_qop_t[1]')

        retval = C.gss_verify_mic(
            minor_status,
            self._ctx[0],
            message_buffer,
            mic_buffer,
            qop_state
        )
        if GSS_ERROR(retval):
            if minor_status[0] and self.mech_type:
                raise _exception_for_status(retval, minor_status[0], self.mech_type)
            else:
                raise _exception_for_status(retval, minor_status[0])
        supp_bits = _status_bits(retval)
        if supplementary:
            return qop_state[0], supp_bits
        elif len(supp_bits) > 0:
            # Raise if unseq/replayed token detected
            raise _exception_for_status(retval, minor_status[0])
        else:
            return qop_state[0]
def verify_mic(self, message, mic, supplementary=False):
        """
        Takes a message integrity code (MIC) that has been generated by the peer application for a
        given message, and verifies it against a message, using this security context's
        cryptographic keys.

        The `supplementary` parameter determines how this method deals with replayed, unsequential,
        too-old or missing tokens, as follows:

        If the `supplementary` parameter is False (the default), and if a replayed or otherwise
        out-of-sequence token is detected, this method raises a :exc:`~gssapi.error.GSSCException`.
        If no replay or out-of-sequence token is detected, this method does not raise an exception
        and returns the ``qop_state`` only.

        If `supplementary` is True, instead of raising an exception when a replayed or
        out-of-sequence token is detected, this method returns a tuple
        ``(qop_state, supplementary_info)`` where ``supplementary_info`` is a tuple containing zero
        or more of the constants :const:`~gssapi.S_DUPLICATE_TOKEN`, :const:`~gssapi.S_OLD_TOKEN`,
        :const:`~gssapi.S_UNSEQ_TOKEN` and :const:`~gssapi.S_GAP_TOKEN`. The supplementary info
        tells the caller whether a replayed or out-of-sequence message was detected. The caller
        must check this and decide how to handle the message if any of the flags are set. For a
        reference to the meaning of the flags, check
        `RFC 2744 Section 3.9.1 <http://tools.ietf.org/html/rfc2744#section-3.9.1>` for the
        corresponding GSS_S_OLD_TOKEN, etc, constants.

        :param message: The message the MIC was calculated for
        :type message: bytes
        :param mic: The MIC calculated by the peer
        :type mic: bytes
        :param supplementary: Whether to also return supplementary info.
        :type supplementary: bool
        :returns: ``qop_state`` if `supplementary` is False, or ``(qop_state,
            supplementary_info)`` if `supplementary` is True.
        :raises: :exc:`~gssapi.error.GSSException` if :attr:`integrity_negotiated` is false, or
            :exc:`~gssapi.error.GSSCException` if the verification fails indicating the message was
            modified, replayed or out-of-sequence.
        """
        if not (self.flags & C.GSS_C_INTEG_FLAG):
            raise GSSException("No integrity protection negotiated.")
        if not (self.established or (self.flags & C.GSS_C_PROT_READY_FLAG)):
            raise GSSException("Protection not yet ready.")

        minor_status = ffi.new('OM_uint32[1]')
        message_buffer = ffi.new('gss_buffer_desc[1]')
        message_buffer[0].length = len(message)
        c_str_message = ffi.new('char[]', message)
        message_buffer[0].value = c_str_message
        mic_buffer = ffi.new('gss_buffer_desc[1]')
        mic_buffer[0].length = len(mic)
        c_str_mic = ffi.new('char[]', mic)
        mic_buffer[0].value = c_str_mic
        qop_state = ffi.new('gss_qop_t[1]')

        retval = C.gss_verify_mic(
            minor_status,
            self._ctx[0],
            message_buffer,
            mic_buffer,
            qop_state
        )
        if GSS_ERROR(retval):
            if minor_status[0] and self.mech_type:
                raise _exception_for_status(retval, minor_status[0], self.mech_type)
            else:
                raise _exception_for_status(retval, minor_status[0])
        supp_bits = _status_bits(retval)
        if supplementary:
            return qop_state[0], supp_bits
        elif len(supp_bits) > 0:
            # Raise if unseq/replayed token detected
            raise _exception_for_status(retval, minor_status[0])
        else:
            return qop_state[0]
Takes a message integrity code (MIC) that has been generated by the peer application for a
        given message, and verifies it against a message, using this security context's
        cryptographic keys.

        The `supplementary` parameter determines how this method deals with replayed, unsequential,
        too-old or missing tokens, as follows:

        If the `supplementary` parameter is False (the default), and if a replayed or otherwise
        out-of-sequence token is detected, this method raises a :exc:`~gssapi.error.GSSCException`.
        If no replay or out-of-sequence token is detected, this method does not raise an exception
        and returns the ``qop_state`` only.

        If `supplementary` is True, instead of raising an exception when a replayed or
        out-of-sequence token is detected, this method returns a tuple
        ``(qop_state, supplementary_info)`` where ``supplementary_info`` is a tuple containing zero
        or more of the constants :const:`~gssapi.S_DUPLICATE_TOKEN`, :const:`~gssapi.S_OLD_TOKEN`,
        :const:`~gssapi.S_UNSEQ_TOKEN` and :const:`~gssapi.S_GAP_TOKEN`. The supplementary info
        tells the caller whether a replayed or out-of-sequence message was detected. The caller
        must check this and decide how to handle the message if any of the flags are set. For a
        reference to the meaning of the flags, check
        `RFC 2744 Section 3.9.1 <http://tools.ietf.org/html/rfc2744#section-3.9.1>` for the
        corresponding GSS_S_OLD_TOKEN, etc, constants.

        :param message: The message the MIC was calculated for
        :type message: bytes
        :param mic: The MIC calculated by the peer
        :type mic: bytes
        :param supplementary: Whether to also return supplementary info.
        :type supplementary: bool
        :returns: ``qop_state`` if `supplementary` is False, or ``(qop_state,
            supplementary_info)`` if `supplementary` is True.
        :raises: :exc:`~gssapi.error.GSSException` if :attr:`integrity_negotiated` is false, or
            :exc:`~gssapi.error.GSSCException` if the verification fails indicating the message was
            modified, replayed or out-of-sequence.