def credssp_generator(self):
        """
        [MS-CSSP] 3.1.5 Processing Events and Sequencing Rules
        https://msdn.microsoft.com/en-us/library/cc226791.aspx

        Generator function that yields each CredSSP token to sent to the
        server. CredSSP has multiple steps that must be run for the client to
        successfully authenticate with the server and delegate the credentials.
        """
        log.debug("Starting TLS handshake process")
        self.tls_connection = SSL.Connection(self.tls_context)
        self.tls_connection.set_connect_state()

        while True:
            try:
                self.tls_connection.do_handshake()
            except SSL.WantReadError:
                out_token = self.tls_connection.bio_read(self.BIO_BUFFER_SIZE)
                log.debug("Step 1. TLS Handshake, returning token: %s"
                          % binascii.hexlify(out_token))
                in_token = yield out_token, "Step 1. TLS Handshake"
                log.debug("Step 1. TLS Handshake, received token: %s"
                          % binascii.hexlify(in_token))
                self.tls_connection.bio_write(in_token)
            else:
                break
        log.debug("TLS Handshake complete. Protocol: %s, Cipher: %s"
                  % (self.tls_connection.get_protocol_version_name(),
                     self.tls_connection.get_cipher_name()))

        server_certificate = self.tls_connection.get_peer_certificate()
        server_public_key = self._get_subject_public_key(server_certificate)

        log.debug("Starting Authentication process")
        version = 6
        context, auth_step, out_token = get_auth_context(self.hostname,
                                                         self.username,
                                                         self.password,
                                                         self.auth_mechanism)
        while not context.complete:
            nego_token = NegoToken()
            nego_token['negoToken'] = out_token

            ts_request = TSRequest()
            ts_request['negoTokens'].append(nego_token)

            ts_request_token = encoder.encode(ts_request)
            log.debug("Step 2. Authenticate, returning token: %s"
                      % binascii.hexlify(ts_request_token))
            in_token = yield self.wrap(ts_request_token), \
                "Step 2. Authenticate"
            in_token = self.unwrap(in_token)
            log.debug("Step 3. Authenticate, received token: %s"
                      % binascii.hexlify(in_token))

            ts_request = decoder.decode(in_token, asn1Spec=TSRequest())[0]
            ts_request.check_error_code()
            version = int(ts_request['version'])
            out_token = \
                auth_step.send(bytes(ts_request['negoTokens'][0]['negoToken']))

        version = min(version, TSRequest.CLIENT_VERSION)
        log.debug("Starting public key verification process at version %d"
                  % version)
        if version < self.minimum_version:
            raise AuthenticationException("The reported server version was %d "
                                          "and did not meet the minimum "
                                          "requirements of %d"
                                          % (version, self.minimum_version))
        if version > 4:
            nonce = os.urandom(32)
        else:
            log.warning("Reported server version was %d, susceptible to MitM "
                        "attacks and should be patched - CVE 2018-0886"
                        % version)
            nonce = None

        pub_key_auth = self._build_pub_key_auth(context, nonce,
                                                out_token,
                                                server_public_key)
        log.debug("Step 3. Server Authentication, returning token: %s"
                  % binascii.hexlify(pub_key_auth))
        in_token = yield (self.wrap(pub_key_auth),
                          "Step 3. Server Authentication")
        in_token = self.unwrap(in_token)
        log.debug("Step 3. Server Authentication, received token: %s"
                  % binascii.hexlify(in_token))

        log.debug("Starting server public key response verification")
        ts_request = decoder.decode(in_token, asn1Spec=TSRequest())[0]
        ts_request.check_error_code()
        if not ts_request['pubKeyAuth'].isValue:
            raise AuthenticationException("The server did not response with "
                                          "pubKeyAuth info, authentication "
                                          "was rejected")
        if len(ts_request['negoTokens']) > 0:
            # SPNEGO auth returned the mechListMIC for us to verify
            auth_step.send(bytes(ts_request['negoTokens'][0]['negoToken']))

        response_key = context.unwrap(bytes(ts_request['pubKeyAuth']))
        self._verify_public_keys(nonce, response_key, server_public_key)

        log.debug("Sending encrypted credentials")
        enc_credentials = self._get_encrypted_credentials(context)

        yield self.wrap(enc_credentials), "Step 5. Delegate Credentials"
def credssp_generator ( self ) : log . debug ( "Starting TLS handshake process" ) self . tls_connection = SSL . Connection ( self . tls_context ) self . tls_connection . set_connect_state ( ) while True : try : self . tls_connection . do_handshake ( ) except SSL . WantReadError : out_token = self . tls_connection . bio_read ( self . BIO_BUFFER_SIZE ) log . debug ( "Step 1. TLS Handshake, returning token: %s" % binascii . hexlify ( out_token ) ) in_token = yield out_token , "Step 1. TLS Handshake" log . debug ( "Step 1. TLS Handshake, received token: %s" % binascii . hexlify ( in_token ) ) self . tls_connection . bio_write ( in_token ) else : break log . debug ( "TLS Handshake complete. Protocol: %s, Cipher: %s" % ( self . tls_connection . get_protocol_version_name ( ) , self . tls_connection . get_cipher_name ( ) ) ) server_certificate = self . tls_connection . get_peer_certificate ( ) server_public_key = self . _get_subject_public_key ( server_certificate ) log . debug ( "Starting Authentication process" ) version = 6 context , auth_step , out_token = get_auth_context ( self . hostname , self . username , self . password , self . auth_mechanism ) while not context . complete : nego_token = NegoToken ( ) nego_token [ 'negoToken' ] = out_token ts_request = TSRequest ( ) ts_request [ 'negoTokens' ] . append ( nego_token ) ts_request_token = encoder . encode ( ts_request ) log . debug ( "Step 2. Authenticate, returning token: %s" % binascii . hexlify ( ts_request_token ) ) in_token = yield self . wrap ( ts_request_token ) , "Step 2. Authenticate" in_token = self . unwrap ( in_token ) log . debug ( "Step 3. Authenticate, received token: %s" % binascii . hexlify ( in_token ) ) ts_request = decoder . decode ( in_token , asn1Spec = TSRequest ( ) ) [ 0 ] ts_request . check_error_code ( ) version = int ( ts_request [ 'version' ] ) out_token = auth_step . send ( bytes ( ts_request [ 'negoTokens' ] [ 0 ] [ 'negoToken' ] ) ) version = min ( version , TSRequest . CLIENT_VERSION ) log . debug ( "Starting public key verification process at version %d" % version ) if version < self . minimum_version : raise AuthenticationException ( "The reported server version was %d " "and did not meet the minimum " "requirements of %d" % ( version , self . minimum_version ) ) if version > 4 : nonce = os . urandom ( 32 ) else : log . warning ( "Reported server version was %d, susceptible to MitM " "attacks and should be patched - CVE 2018-0886" % version ) nonce = None pub_key_auth = self . _build_pub_key_auth ( context , nonce , out_token , server_public_key ) log . debug ( "Step 3. Server Authentication, returning token: %s" % binascii . hexlify ( pub_key_auth ) ) in_token = yield ( self . wrap ( pub_key_auth ) , "Step 3. Server Authentication" ) in_token = self . unwrap ( in_token ) log . debug ( "Step 3. Server Authentication, received token: %s" % binascii . hexlify ( in_token ) ) log . debug ( "Starting server public key response verification" ) ts_request = decoder . decode ( in_token , asn1Spec = TSRequest ( ) ) [ 0 ] ts_request . check_error_code ( ) if not ts_request [ 'pubKeyAuth' ] . isValue : raise AuthenticationException ( "The server did not response with " "pubKeyAuth info, authentication " "was rejected" ) if len ( ts_request [ 'negoTokens' ] ) > 0 : auth_step . send ( bytes ( ts_request [ 'negoTokens' ] [ 0 ] [ 'negoToken' ] ) ) response_key = context . unwrap ( bytes ( ts_request [ 'pubKeyAuth' ] ) ) self . _verify_public_keys ( nonce , response_key , server_public_key ) log . debug ( "Sending encrypted credentials" ) enc_credentials = self . _get_encrypted_credentials ( context ) yield self . wrap ( enc_credentials ) , "Step 5. Delegate Credentials"
[MS-CSSP] 3.1.5 Processing Events and Sequencing Rules
        https://msdn.microsoft.com/en-us/library/cc226791.aspx

        Generator function that yields each CredSSP token to sent to the
        server. CredSSP has multiple steps that must be run for the client to
        successfully authenticate with the server and delegate the credentials.