
    Vh4y                     X   U d Z ddlZddlmZ ddlmZ ddlmZ ddlm	Z	 e	e
   ed<   	 ddlZdZdd	lmZ dd
lmZ ddlmZmZmZmZ ddlmZmZ ddlmZ ddlmZ ddlm Z m!Z! ddl"m#Z# ddl$m%Z% ddl&m'Z' ddl(m)Z)  e%d      rdZ*ddl+m,Z, ddl-m.Z.m/Z/ ddl0m1Z1 ddl2m3Z3 ndZ* e4edd      dZ5ndZ5 G d de)      Z6 G d de)      Z7 G d  d!e)      Z8 G d" d#e)      Z9 G d$ d%e)      Z: G d& d'e)      Z; G d( d)e)      Z< ed*d+g      Z= G d, d-e>      Z? G d. d/e)      Z@y# e$ r dZY w xY w)0z&
Tests for L{twisted.conch.checkers}.
    N)encodebytes)
namedtuple)BytesIO)Optional	cryptSkipzcannot run without crypt module)verifyObject)'InMemoryUsernamePasswordDatabaseDontUse)ISSHPrivateKeyIUsernamePasswordSSHPrivateKeyUsernamePassword)UnauthorizedLoginUnhandledCredentials)Deferred)util)ShadowDatabaseUserDatabase)FilePath)requireModule)MockOS)TestCasecryptography)checkers)NotEnoughAuthenticationValidPublicKey)keys)keydatazcan't run without cryptographygeteuidz0Cannot run without effective UIDs (questionable)c                   L    e Zd ZdZexs eZd Zd Zd Z	d Z
d Zd Zd Zd	 Zy
)HelperTestszl
    Tests for helper functions L{verifyCryptedPassword}, L{_pwdGetByName} and
    L{_shadowGetByName}.
    c                 "    t               | _        y N)r   mockosselfs    P/home/dcms/DCMS/lib/python3.12/site-packages/twisted/conch/test/test_checkers.pysetUpzHelperTests.setUp@   s    h    c                     d}d}t        j                   ||      }| j                  t        j                  ||      dj	                  ||             y)z
        L{verifyCryptedPassword} returns C{True} if the plaintext password
        passed to it matches the encrypted password passed to it.
        secret stringsaltyz5{!r} supposed to be valid encrypted password for {!r}Ncrypt
assertTruer   verifyCryptedPasswordformatr%   passwordsaltcrypteds       r&   test_verifyCryptedPasswordz&HelperTests.test_verifyCryptedPasswordC   sM    
 #++h-**7H=CJJ	
r(   c                     d}d}t        j                   ||      }| j                  t        j                  ||      dj	                  ||             y)z
        L{verifyCryptedPassword} returns True if the provided cleartext password
        matches the provided MD5 password hash.
        r2   z$1$saltz3{!r} supposed to be valid encrypted password for {}Nr,   r1   s       r&   test_verifyCryptedPasswordMD5z)HelperTests.test_verifyCryptedPasswordMD5R   sM    
 ++h-**7H=AHH	
r(   c                     d}d}d}t        j                   ||      }| j                  t        j                  ||      dj	                  ||             y)z
        L{verifyCryptedPassword} returns C{False} if the plaintext password
        passed to it does not match the encrypted password passed to it.
        zstring secretsomesaltr*   z7{!r} not supposed to be valid encrypted password for {}N)r-   assertFalser   r/   r0   )r%   r2   r3   wrongr4   s        r&   test_refuteCryptedPasswordz&HelperTests.test_refuteCryptedPassworda   sT    
 #++h-**7E:ELL	
r(   c           	          t               }|j                  ddddddd       | j                  t        d|       | j	                  t        j
                  d      |j                  d             y	)
z
        L{_pwdGetByName} returns a tuple of items from the UNIX /etc/passwd
        database if the L{pwd} module is present.
        alicesecrit      
first last/foo/bin/shpwdN)r   addUserpatchr   assertEqual_pwdGetByNamegetpwnamr%   userdbs     r&   test_pwdGetByNamezHelperTests.test_pwdGetByNameq   sW    
 w!QfiP

8UF+//8&//':RSr(   c                 z    | j                  t        dd       | j                  t        j                  d             y)zW
        If the C{pwd} module isn't present, L{_pwdGetByName} returns L{None}.
        rE   Nr>   )rG   r   assertIsNonerI   r$   s    r&   test_pwdGetByNameWithoutPwdz'HelperTests.test_pwdGetByNameWithoutPwd{   s-     	

8UD)(009:r(   c                    t               }|j                  ddddddddd		       | j                  t        d
|       d| j                  _        d| j                  _        | j                  t        d| j                         | j                  t        j                  d      |j                  d             | j                  | j                  j                  ddg       | j                  | j                  j                  ddg       y)z
        L{_shadowGetByName} returns a tuple of items from the UNIX /etc/shadow
        database if the L{spwd} is present.
        bob
passphraser@   rA                  spwd)	    osr   N)r   rF   rG   r   r#   euidegidr   rH   _shadowGetByNamegetspnamseteuidCallssetegidCallsrK   s     r&   test_shadowGetByNamez HelperTests.test_shadowGetByName   s    
  !ulAq!Q1a@

8VV,

4t{{+22596??5;QR11At9=11At9=r(   c                    | j                  t        dd       | j                  t        j                  d             | j	                  | j
                  j                  g        | j	                  | j
                  j                  g        y)zP
        L{_shadowGetByName} returns L{None} if C{spwd} is not present.
        rY   NrR   )rG   r   rO   r_   rH   r#   ra   rb   r$   s    r&   test_shadowGetByNameWithoutSpwdz+HelperTests.test_shadowGetByNameWithoutSpwd   sa     	

8VT*(33E:;11261126r(   N)__name__
__module____qualname____doc__r   dependencySkipskipr'   r5   r7   r<   rM   rP   rc   re    r(   r&   r    r    8   s<    
 &D


 T;>"7r(   r    c                   `    e Zd ZdZexs eZddZd Zd Z	d Z
d Zd Zd	 Zd
 Zd Zd Zd Zy)SSHPublicKeyDatabaseTestsz,
    Tests for L{SSHPublicKeyDatabase}.
    Nc           	         t        j                         | _        t        d      | _        t        d      | _        d| j                  z   dz   | j
                  z   dz   | _        t               | _        | j                  t        d| j                         t        | j                               | _        t        | j                  j                  t              sJ | j                  j!                  d      | _        | j"                  j%                          t'               }|j)                  dd	d
dd| j                  j                  d       || j                  _        y )N   foobar   eggspams   t1 s    foo
t2 s    egg
r\   .sshuserr2   r@   rA   rB   
/bin/shell)r   SSHPublicKeyDatabasecheckerr   key1key2contentr   r#   rG   r   r   mktemppath
isinstancestrchildsshDirmakedirsr   rF   _userdbrK   s     r&   r'   zSSHPublicKeyDatabaseTests.setUp   s    446	*	
+			)L8499DyPh

4t{{+T[[]+	$))..#...iioof-IINN	
  &r(   c                     | j                  | j                  g      }| j                  |d   d   t               | j                  |d   d   d       | j                  t	        |      d       y)zJ
        L{SSHPublicKeyDatabase} is deprecated as of version 15.0
        )offendingFunctionsr   categorymessageztwisted.conch.checkers.SSHPublicKeyDatabase was deprecated in Twisted 15.0.0: Please use twisted.conch.checkers.SSHPublicKeyChecker, initialized with an instance of twisted.conch.checkers.UNIXAuthorizedKeysFiles instead.r@   N)flushWarningsr'   rH   DeprecationWarninglen)r%   warningsShowns     r&   test_deprecatedz)SSHPublicKeyDatabaseTests.test_deprecated   sp     **tzzl*Kq)*57IJ!Y'F	
 	]+Q/r(   c                    | j                   j                  |      j                  | j                         t	        dd      }d|_        | j                  | j                  j                  |             d|_        | j                  | j                  j                  |             d|_        | j                  | j                  j                  |             y )N   user   passwordrp   rq   s
   notallowed)
r   r~   
setContentry   r   blobr.   rv   checkKeyr:   )r%   filenamers   s      r&   _testCheckKeyz'SSHPublicKeyDatabaseTests._testCheckKey   s    (#..t||<5	--d34	--d34!	..t45r(   c                     | j                  d       | j                  | j                  j                  g        | j                  | j                  j                  g        y)z
        L{SSHPublicKeyDatabase.checkKey} should retrieve the content of the
        authorized_keys file and check the keys against that file.
        authorized_keysNr   rH   r#   ra   rb   r$   s    r&   test_checkKeyz'SSHPublicKeyDatabaseTests.test_checkKey   sG    
 	,-11261126r(   c                     | j                  d       | j                  | j                  j                  g        | j                  | j                  j                  g        y)z
        L{SSHPublicKeyDatabase.checkKey} should retrieve the content of the
        authorized_keys2 file and check the keys against that file.
        authorized_keys2Nr   r$   s    r&   test_checkKey2z(SSHPublicKeyDatabaseTests.test_checkKey2   sG    
 	-.11261126r(   c                    | j                   j                  d      j                  | j                         j	                  d       | j                  j                  d       | j                  j                  fd}d| j                  _        d| j                  _	        | j                  | j                  d|       | j                  t        d| j                         t        d	d
      }d|_        | j                  | j                  j!                  |             | j#                  | j                  j$                  g d       | j#                  | j                  j&                  ddg       y)z
        If the key file is readable, L{SSHPublicKeyDatabase.checkKey} should
        switch its uid/gid to the ones of the authenticated user.
        r   r     c                 6    j                  d        |       S )Nr   )chmod)r]   keyFilesavedSeteuids    r&   seteuidz>SSHPublicKeyDatabaseTests.test_checkKeyAsRoot.<locals>.seteuid   s    MM% %%r(   rZ   r[   r   r\   r   r   rp   )r   r@   r   rZ   rA   N)r   r~   r   ry   r   
addCleanupr#   r   r]   r^   rG   r   r   r   r.   rv   r   rH   ra   rb   )r%   r   rs   r   r   s      @@r&   test_checkKeyAsRootz-SSHPublicKeyDatabaseTests.test_checkKeyAsRoot   s   
 ++##$564<<(eu-{{**	&  

4;;	73

4t{{+5	--d3411?C11At9=r(   c           	      T    d } j                   j                  d|       t        ddt        j                  dt
        j                  j                  t        j                        j                  d            } j                  j                  |      } fd}|j                  |      S )z
        L{SSHPublicKeyDatabase.requestAvatarId} should return the avatar id
        passed in if its C{_checkKey} method returns True.
        c                      yNTrl   ignoreds    r&   	_checkKeyzASSHPublicKeyDatabaseTests.test_requestAvatarId.<locals>._checkKey      r(   r      test   ssh-rsa   fooc                 *    j                  | d       y Nr   rH   avatarIdr%   s    r&   _verifyz?SSHPublicKeyDatabaseTests.test_requestAvatarId.<locals>._verify      Xw/r(   )rG   rv   r   r   publicRSA_opensshr   Key
fromStringprivateRSA_opensshsignrequestAvatarIdaddCallback)r%   r   credentialsdr   s   `    r&   test_requestAvatarIdz.SSHPublicKeyDatabaseTests.test_requestAvatarId  s    	 	

4<<Y7#%%HH : :;@@H
 LL((5	0 }}W%%r(   c                     d }| j                  | j                  d|       t        ddt        j                  dd      }| j                  j                  |      }| j                  |t              S )a(  
        L{SSHPublicKeyDatabase.requestAvatarId} should raise L{ValidPublicKey}
        if the credentials represent a valid key without a signature.  This
        tells the user that the key is valid for login, but does not actually
        allow that user to do so without a signature.
        c                      yr   rl   r   s    r&   r   zQSSHPublicKeyDatabaseTests.test_requestAvatarIdWithoutSignature.<locals>._checkKey&  r   r(   r   r   r   N)rG   rv   r   r   r   r   assertFailurer   r%   r   r   r   s       r&   $test_requestAvatarIdWithoutSignaturez>SSHPublicKeyDatabaseTests.test_requestAvatarIdWithoutSignature  sa    	 	

4<<Y7#Z!:!:D$
 LL((5!!!^44r(   c                     d }| j                  | j                  d|       | j                  j                  d      }| j                  |t              S )z
        If L{SSHPublicKeyDatabase.checkKey} returns False,
        C{_cbRequestAvatarId} should raise L{UnauthorizedLogin}.
        c                      yNFrl   r   s    r&   r   zKSSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidKey.<locals>._checkKey6      r(   r   N)rG   rv   r   r   r   )r%   r   r   s      r&   test_requestAvatarIdInvalidKeyz8SSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidKey0  sE    	 	

4<<Y7LL((.!!!%677r(   c           	      R   d }| j                  | j                  d|       t        ddt        j                  dt
        j                  j                  t        j                        j                  d            }| j                  j                  |      }| j                  |t              S )z
        Valid keys with invalid signatures should cause
        L{SSHPublicKeyDatabase.requestAvatarId} to return a {UnauthorizedLogin}
        failure
        c                      yr   rl   r   s    r&   r   zQSSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidSignature.<locals>._checkKeyD  r   r(   r   r   r   r   )rG   rv   r   r   r   r   r   r   privateDSA_opensshr   r   r   r   r   s       r&   $test_requestAvatarIdInvalidSignaturez>SSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidSignature=  s    	 	

4<<Y7#%%HH : :;@@H
 LL((5!!!%677r(   c                      d } j                   j                  d|       t        ddddd      } j                  j                  |      } fd}|j	                  |        j                  |t              S )	z~
        Exceptions raised while verifying the key should be normalized into an
        C{UnauthorizedLogin} failure.
        c                      yr   rl   r   s    r&   r   zSSSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeException.<locals>._checkKeyX  r   r(   r   r   Ns   blobs   sigDatas   sigc                 |    j                  t        j                        }j                  t	        |      d       | S )Nr@   )flushLoggedErrorsr   BadKeyErrorrH   r   )failureerrorsr%   s     r&   _verifyLoggedExceptionz`SSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeException.<locals>._verifyLoggedException_  s2    ++D,<,<=FS[!,Nr(   )rG   rv   r   r   
addErrbackr   r   )r%   r   r   r   r   s   `    r&   &test_requestAvatarIdNormalizeExceptionz@SSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeExceptionR  sl    	 	

4<<Y7#GT7JOLL((5	
 	
+,!!!%677r(   returnN)rf   rg   rh   ri   euidSkiprj   rk   r'   r   r   r   r   r   r   r   r   r   r   rl   r(   r&   rn   rn      sJ     %~D&40 677>6&05$88*8r(   rn   c                   8    e Zd ZdZeZd Zd Zd Zd Z	d Z
d Zy)	SSHProtocolCheckerTestsz*
    Tests for L{SSHProtocolChecker}.
    c                 N   t        j                         }| j                  |j                  g        |j	                  t        j
                                | j                  |j                  t        g       | j                  |j                   t           t         j
                         y)z
        L{SSHProcotolChecker.registerChecker} should add the given checker to
        the list of registered checkers.
        N)r   SSHProtocolCheckerrH   credentialInterfacesregisterCheckerru   r
   assertIsInstancer%   rv   s     r&   test_registerCheckerz,SSHProtocolCheckerTests.test_registerCheckero  s    
 --/55r:))+	
 	557GH^,h.K.K	
r(   c                 X   t        j                         }| j                  |j                  g        |j	                  t        j
                         t               | j                  |j                  t        g       | j                  |j                   t           t         j
                         y)z
        If a specific interface is passed into
        L{SSHProtocolChecker.registerChecker}, that interface should be
        registered instead of what the checker specifies in
        credentialIntefaces.
        N)r   r   rH   r   r   ru   r   r   r   s     r&   !test_registerCheckerWithInterfacez9SSHProtocolCheckerTests.test_registerCheckerWithInterface~  s     --/55r: = = ?ARS558I7JK./1N1N	
r(   c                      t        j                         }t               }|j                  dd       |j	                  |       |j                  t        dd            } fd}|j                  |      S )z
        L{SSHProtocolChecker.requestAvatarId} should defer to one if its
        registered checkers to authenticate a user.
        r   c                 *    j                  | d       y r   r   r   s    r&   	_callbackz?SSHProtocolCheckerTests.test_requestAvatarId.<locals>._callback  r   r(   )r   r   r	   rF   r   r   r   r   )r%   rv   passwordDatabaser   r   s   `    r&   r   z,SSHProtocolCheckerTests.test_requestAvatarId  si    
 --/BD  '2 01##$4Wg$FG	0 }}Y''r(   c                    t        j                         }d }| j                  |d|       t               }|j	                  dd       |j                  |       |j                  t        dd            }| j                  |t              S )z
        If the client indicates that it is never satisfied, by always returning
        False from _areDone, then L{SSHProtocolChecker} should raise
        L{NotEnoughAuthentication}.
        c                      yr   rl   )r   s    r&   _areDonezYSSHProtocolCheckerTests.test_requestAvatarIdWithNotEnoughAuthentication.<locals>._areDone  r   r(   areDoner   )
r   r   rG   r	   rF   r   r   r   r   r   )r%   rv   r   r   r   s        r&   /test_requestAvatarIdWithNotEnoughAuthenticationzGSSHProtocolCheckerTests.test_requestAvatarIdWithNotEnoughAuthentication  s}     --/	 	

7Ix0BD  '2 01##$4Wg$FG!!!%<==r(   c                     t        j                         }|j                  t        dd            }| j	                  |t
              S )z
        If the passed credentials aren't handled by any registered checker,
        L{SSHProtocolChecker} should raise L{UnhandledCredentials}.
        r   )r   r   r   r   r   r   )r%   rv   r   s      r&   %test_requestAvatarIdInvalidCredentialz=SSHProtocolCheckerTests.test_requestAvatarIdInvalidCredential  s>    
 --/##$4Wg$FG!!!%9::r(   c                 h    | j                  t        j                         j                  d             y)zV
        The default L{SSHProcotolChecker.areDone} should simply return True.
        N)r.   r   r   r   r$   s    r&   test_areDonez$SSHProtocolCheckerTests.test_areDone  s$     	335==dCDr(   N)rf   rg   rh   ri   rj   rk   r   r   r   r   r   r   rl   r(   r&   r   r   h  s-     D

( >&;Er(   r   c                   f    e Zd ZdZexs eZdee   deddfdZ	d Z
d Zd	 Zd
 Zd Zd Zd Zd Zy)UNIXPasswordDatabaseTestsz,
    Tests for L{UNIXPasswordDatabase}.
    r   usernamer   Nc                 F    | j                  | j                  |      |       y)z
        Assert that the L{Deferred} passed in is called back with the value
        'username'.  This represents a valid login for this TestCase.

        @param d: a L{Deferred} from an L{IChecker.requestAvatarId} method.
        N)rH   successResultOf)r%   r   r   s      r&   assertLoggedInz(UNIXPasswordDatabaseTests.assertLoggedIn  s     	--a0(;r(   c                    t        j                         }d }t               }|j                  d |dd      ddddd       |j                  d	d
ddddd       t	               }|j                  ddddddddd	       |j                  d	 |d	d      ddddddd	       | j                  t         d|       | j                  t         d|       t               }| j                  t        d|       d|_        d|_	        t        dd       }| j                  |j                  |      d       | j                  |j                  g        | j                  |j                  g        d!|_        | j                  |j                  |      d!       | j                  |j                  d"dg       | j                  |j                  d"dg       y#)$z
        L{UNIXPasswordDatabase} with no arguments has checks the C{pwd} database
        and then the C{spwd} database.
        c                 d    t        j                   ||       }t        j                   |d|z         }|S )Nz$1$)r-   )r   r2   r3   r4   s       r&   r4   z?UNIXPasswordDatabaseTests.test_defaultCheckers.<locals>.crypted  s+    ;;x2Dkk(EDL9GNr(   r>   r2   r@   rA   foorC   rD   rR   xbar/barr;   rT   rU   rV   rW   rX      	   
               rE   rY   r\   rZ   r[      alicer      bobr   N)r   UNIXPasswordDatabaser   rF   r   rG   r   r   r]   r^   r   r   r   rH   ra   rb   r   )r%   rv   r4   rE   rY   r#   creds          r&   test_defaultCheckersz.UNIXPasswordDatabaseTests.test_defaultCheckers  s   
 //1	
 nWWj11a		
 	E31eVY?Wgq!Q1a;UGE:61b"b"bQ

8UC(

8VT*

4v&+6G33D98D,,b1,,b1G33D96B,,q$i8,,q$i8r(   c                 D    | j                  |t        j                         y)a  
        Asserts that the L{Deferred} passed in is erred back with an
        L{UnauthorizedLogin} L{Failure}.  This reprsents an invalid login for
        this TestCase.

        NOTE: To work, this method's return value must be returned from the
        test method, or otherwise hooked up to the test machinery.

        @param d: a L{Deferred} from an L{IChecker.requestAvatarId} method.
        @type d: L{Deferred}
        @rtype: L{None}
        N)failureResultOfr   r   r%   r   s     r&   assertUnauthorizedLoginz1UNIXPasswordDatabaseTests.assertUnauthorizedLogin  s     	Q : :;r(   c           	         t        j                   dd      }t               }|j                  d|ddddd       t        j                  |j
                  g      }| j                  |j                  t        dd	            d       y
)zo
        L{UNIXPasswordDatabase} takes a list of functions to check for UNIX
        user information.
        secretanybodyr@   rA   r   r   rD   s   anybodys   secretN)	r-   r   rF   r   r  rJ   r   r   r   )r%   r2   rL   rv   s       r&   test_passInCheckersz-UNIXPasswordDatabaseTests.test_passInCheckers  sp    
 ;;x2y(Aq%K//0AB##$4Z$KLj	
r(   c                     d }d }| j                  t        d|       t        j                  |g      }t        dd      }| j	                  |j                  |      d       y)z
        If the encrypted password provided by the getpwnam function is valid
        (verified by the L{verifyCryptedPassword} function), we callback the
        C{requestAvatarId} L{Deferred} with the username.
        c                     | |k(  S r"   rl   r4   pws     r&   r/   zLUNIXPasswordDatabaseTests.test_verifyPassword.<locals>.verifyCryptedPassword      b= r(   c                 
    | | gS r"   rl   r   s    r&   rJ   z?UNIXPasswordDatabaseTests.test_verifyPassword.<locals>.getpwnam  s    h''r(   r/      usernameNrG   r   r  r   r   r   r%   r/   rJ   rv   
credentials        r&   test_verifyPasswordz-UNIXPasswordDatabaseTests.test_verifyPassword  sY    	!	( 	

846KL//
;%k;?
G33J?Mr(   c                     d }t        j                  |g      }t        dd      }| j                  |j	                  |             y)z}
        If the getpwnam function raises a KeyError, the login fails with an
        L{UnauthorizedLogin} exception.
        c                     t        |       r"   )KeyErrorr  s    r&   rJ   z?UNIXPasswordDatabaseTests.test_failOnKeyError.<locals>.getpwnam,  s    8$$r(   r  r   N)r   r  r   r  r   )r%   rJ   rv   r  s       r&   test_failOnKeyErrorz-UNIXPasswordDatabaseTests.test_failOnKeyError&  s@    	% //
;%k;?
$$W%<%<Z%HIr(   c                     d }d }| j                  t        d|       t        j                  |g      }t        dd      }| j	                  |j                  |             y)z
        If the verifyCryptedPassword function doesn't verify the password, the
        login fails with an L{UnauthorizedLogin} exception.
        c                      yr   rl   r  s     r&   r/   zOUNIXPasswordDatabaseTests.test_failOnBadPassword.<locals>.verifyCryptedPassword9  r   r(   c                 
    | dgS )Nr   rl   r  s    r&   rJ   zBUNIXPasswordDatabaseTests.test_failOnBadPassword.<locals>.getpwnam<  s    k**r(   r/   r  r   N)rG   r   r  r   r  r   r  s        r&   test_failOnBadPasswordz0UNIXPasswordDatabaseTests.test_failOnBadPassword3  sW    		+ 	

846KL//
;%k;?
$$W%<%<Z%HIr(   c                     d }d }d }| j                  t        d|       t        j                  ||g      }t        dd      }| j	                  |j                  |      d       y)a  
        UNIXPasswordDatabase.requestAvatarId loops through each getpwnam
        function associated with it and returns a L{Deferred} which fires with
        the result of the first one which returns a value other than None.
        ones do not verify the password.
        c                     | |k(  S r"   rl   r  s     r&   r/   zRUNIXPasswordDatabaseTests.test_loopThroughFunctions.<locals>.verifyCryptedPasswordL  r  r(   c                 
    | dgS )Nznot the passwordrl   r  s    r&   	getpwnam1zFUNIXPasswordDatabaseTests.test_loopThroughFunctions.<locals>.getpwnam1O  s    011r(   c                 
    | dgS )Nr2   rl   r  s    r&   	getpwnam2zFUNIXPasswordDatabaseTests.test_loopThroughFunctions.<locals>.getpwnam2R  s    j))r(   r/   r  r   Nr  )r%   r/   r(  r*  rv   r  s         r&   test_loopThroughFunctionsz3UNIXPasswordDatabaseTests.test_loopThroughFunctionsD  sa    	!	2	* 	

846KL//I0FG%k;?
G33J?Mr(   c           	          t               }|j                  ddddddd       |j                  ddddddd       |j                  d	d
ddddd       | j                  t        d|       t        j                  t        j
                  g      }t        dd      }| j                  |j                  |             t        dd      }| j                  |j                  |             t        dd      }| j                  |j                  |             y)z
        If the password returned by any function is C{""}, C{"x"}, or C{"*"} it
        is not compared against the supplied password.  Instead it is skipped.
        r>    r@   rA   r   r   rR   r   carol*rE   r  r(   r     xs   carol   *N)	r   rF   rG   r   r  rI   r   r  r   )r%   rE   rv   r  s       r&   test_failOnSpecialz,UNIXPasswordDatabaseTests.test_failOnSpecialZ  s    
 nGRAr5%8E31b%7GS!QE59

8UC(//1G1G0HI#.$$W%<%<T%BC-$$W%<%<T%BC$/$$W%<%<T%BCr(   )rf   rg   rh   ri   r   rj   rk   r   bytesr   r  r  r  r  r   r$  r+  r2  rl   r(   r&   r   r     s_     &D< <5 <T <&9P<
N$JJ"N,Dr(   r   c                   &    e Zd ZdZeZd Zd Zd Zy)AuthorizedKeyFileReaderTestsz5
    Tests for L{checkers.readAuthorizedKeyFile}
    c                     t        d      }t        j                  |d       }| j                  ddgt	        |             y)zg
        L{checkers.readAuthorizedKeyFile} does not attempt to turn comments
        into keys
        sE   # this comment is ignored
this is not
# this is again
and this is notc                     | S r"   rl   r   s    r&   <lambda>zCAuthorizedKeyFileReaderTests.test_ignoresComments.<locals>.<lambda>  s    1 r(   s   this is nots   and this is notNr   r   readAuthorizedKeyFilerH   listr%   fileobjresults      r&   test_ignoresCommentsz1AuthorizedKeyFileReaderTests.test_ignoresCommentsw  sA    
 
 //E.*<=tF|Lr(   c                     t        d      }t        j                  |d       }| j                  dgt	        |             y)zw
        L{checkers.readAuthorizedKeyFile} ignores leading whitespace in
        lines, as well as empty lines
        sg   
                           # ignore
                           not ignored
                           c                     | S r"   rl   r8  s    r&   r9  zYAuthorizedKeyFileReaderTests.test_ignoresLeadingWhitespaceAndEmptyLines.<locals>.<lambda>  s    A r(   parseKeys   not ignoredNr:  r=  s      r&   *test_ignoresLeadingWhitespaceAndEmptyLineszGAuthorizedKeyFileReaderTests.test_ignoresLeadingWhitespaceAndEmptyLines  s>    
 
 //+N.)4<8r(   c                     d }t        d      }t        j                  ||      }| j                  dgt	        |             y)z
        L{checkers.readAuthorizedKeyFile} does not raise an exception
        when a key fails to parse (raises a
        L{twisted.conch.ssh.keys.BadKeyError}), but rather just keeps going
        c                 R    | j                  d      rt        j                  d      | S )N   fzfailed to parse)
startswithr   r   )lines    r&   
failOnSomezKAuthorizedKeyFileReaderTests.test_ignoresUnparsableKeys.<locals>.failOnSome  s%    t$&&'899Kr(   s   failed key
good keyrC  s   good keyNr:  )r%   rK  r>  r?  s       r&   test_ignoresUnparsableKeysz7AuthorizedKeyFileReaderTests.test_ignoresUnparsableKeys  s<    	
 12//*M+V5r(   N)	rf   rg   rh   ri   rj   rk   r@  rE  rL  rl   r(   r&   r5  r5  p  s     DM96r(   r5  c                   &    e Zd ZdZeZd Zd Zd Zy)InMemorySSHKeyDBTestsz0
    Tests for L{checkers.InMemorySSHKeyDB}
    c                 h    t        j                  ddgi      }t        t         j                  |       y)z_
        L{checkers.InMemorySSHKeyDB} implements
        L{checkers.IAuthorizedKeysDB}
        r  s   keyN)r   InMemorySSHKeyDBr   IAuthorizedKeysDBr%   keydbs     r&   test_implementsInterfacez.InMemorySSHKeyDBTests.test_implementsInterface  s+    
 ))8fX*>?X//7r(   c                     t        j                  ddgi      }| j                  g t        |j	                  d                   y)z
        If the user is not in the mapping provided to
        L{checkers.InMemorySSHKeyDB}, an empty iterator is returned
        by L{checkers.InMemorySSHKeyDB.getAuthorizedKeys}
        r  s   keysr  Nr   rP  rH   r<  getAuthorizedKeysrR  s     r&   test_noKeysForUnauthorizedUserz4InMemorySSHKeyDBTests.test_noKeysForUnauthorizedUser  s;     ))8gY*?@T%"9"9&"ABCr(   c                     t        j                  dddgi      }| j                  ddgt        |j	                  d                   y)z
        If the user is in the mapping provided to
        L{checkers.InMemorySSHKeyDB}, an iterator with all the keys
        is returned by L{checkers.InMemorySSHKeyDB.getAuthorizedKeys}
        r     a   bNrV  rR  s     r&   test_allKeysForAuthorizedUserz3InMemorySSHKeyDBTests.test_allKeysForAuthorizedUser  sA     ))8dD\*BC$tE,C,CH,M'NOr(   N)	rf   rg   rh   ri   rj   rk   rT  rX  r\  rl   r(   r&   rN  rN    s     D8DPr(   rN  c                   :    e Zd ZdZeZd	dZd Zd Zd Z	d Z
d Zy)
UNIXAuthorizedKeysFilesTestsz8
    Tests for L{checkers.UNIXAuthorizedKeysFiles}.
    Nc           	      &   t        | j                               | _        t        | j                  j                  t              sJ | j                  j                          t               | _        | j                  j                  ddddd| j                  j                  d       | j                  j                  d      | _
        | j                  j                          | j                  j                  d      }|j                  d	       d
dg| _        y )Nr>   r2   r@   rA   zalice lastnamert   rr   r   s   key 1
key 2s   key 1s   key 2)r   rz   r{   r|   r}   r   r   rL   rF   r~   r   r   expectedKeys)r%   authorizedKeyss     r&   r'   z"UNIXAuthorizedKeysFilesTests.setUp  s    T[[]+	$))..#...		"nIINN	
 iioof-**+<=!!/2%x0r(   c                 v    t        j                  | j                        }t        t         j                  |       y)zg
        L{checkers.UNIXAuthorizedKeysFiles} implements
        L{checkers.IAuthorizedKeysDB}.
        N)r   UNIXAuthorizedKeysFilesrL   r   rQ  rR  s     r&   rT  z5UNIXAuthorizedKeysFilesTests.test_implementsInterface  s(    
 00=X//7r(   c                     t        j                  | j                  d       }| j                  g t	        |j                  d                   y)z
        If the user is not in the user database provided to
        L{checkers.UNIXAuthorizedKeysFiles}, an empty iterator is returned
        by L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys}.
        c                     | S r"   rl   r8  s    r&   r9  zMUNIXAuthorizedKeysFilesTests.test_noKeysForUnauthorizedUser.<locals>.<lambda>      QR r(   rC  r  N)r   rc  rL   rH   r<  rW  rR  s     r&   rX  z;UNIXAuthorizedKeysFilesTests.test_noKeysForUnauthorizedUser  s:     00{ST%"9"9&"ABCr(   c                    | j                   j                  d      j                  d       t        j                  | j
                  d       }| j                  | j                  dgz   t        |j                  d                   y)a  
        If the user is in the user database provided to
        L{checkers.UNIXAuthorizedKeysFiles}, an iterator with all the keys in
        C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2} is returned
        by L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys}.
        r   s   key 3c                     | S r"   rl   r8  s    r&   r9  z`UNIXAuthorizedKeysFilesTests.test_allKeysInAllAuthorizedFilesForAuthorizedUser.<locals>.<lambda>  rf  r(   rC  r  N)
r   r~   r   r   rc  rL   rH   r`  r<  rW  rR  s     r&   1test_allKeysInAllAuthorizedFilesForAuthorizedUserzNUNIXAuthorizedKeysFilesTests.test_allKeysInAllAuthorizedFilesForAuthorizedUser  sh     	,-88B00{S
*D1H1H1R,S	
r(   c                     t        j                  | j                  d       }| j                  | j                  t        |j                  d                   y)z
        L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys} returns only
        the keys in C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2}
        if they exist.
        c                     | S r"   rl   r8  s    r&   r9  zJUNIXAuthorizedKeysFilesTests.test_ignoresNonexistantFile.<locals>.<lambda>  rf  r(   rC  r  N)r   rc  rL   rH   r`  r<  rW  rR  s     r&   test_ignoresNonexistantFilez8UNIXAuthorizedKeysFilesTests.test_ignoresNonexistantFile  s@     00{S**D1H1H1R,STr(   c                    | j                   j                  d      j                          t        j                  | j
                  d       }| j                  | j                  t        |j                  d                   y)z
        L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys} returns only
        the keys in C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2}
        if they are readable.
        r   c                     | S r"   rl   r8  s    r&   r9  zIUNIXAuthorizedKeysFilesTests.test_ignoresUnreadableFile.<locals>.<lambda>  rf  r(   rC  r  N)
r   r~   r   r   rc  rL   rH   r`  r<  rW  rR  s     r&   test_ignoresUnreadableFilez7UNIXAuthorizedKeysFilesTests.test_ignoresUnreadableFile  s\     	,-66800{S**D1H1H1R,STr(   r   )rf   rg   rh   ri   rj   rk   r'   rT  rX  ri  rl  ro  rl   r(   r&   r^  r^    s/     D1.8D
UUr(   r^  _KeyDBrW  c                       e Zd ZdZy)_DummyExceptionz0
    Fake exception to be used for testing.
    N)rf   rg   rh   ri   rl   r(   r&   rr  rr    s     	r(   rr  c                   >    e Zd ZdZeZd Zd Zd Zd Z	d Z
d Zd Zy	)
SSHPublicKeyCheckerTestsz4
    Tests for L{checkers.SSHPublicKeyChecker}.
    c           	      &   t        ddt        j                  dt        j                  j                  t        j                        j                  d            | _        t        d       | _
        t        j                  | j                        | _        y )Nr  r   r   c                 ^    t         j                  j                  t        j                        gS r"   )r   r   r   r   r   )_s    r&   r9  z0SSHPublicKeyCheckerTests.setUp.<locals>.<lambda>0  s    txx':':7;T;T'U&V r(   )r   r   r   r   r   r   r   r   r   rp  rS  r   SSHPublicKeyCheckerrv   r$   s    r&   r'   zSSHPublicKeyCheckerTests.setUp(  si    (%%HH : :;@@H
 VW
33DJJ?r(   c                     d| j                   _        | j                  | j                  j	                  | j                         t
               y)z
        Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with
        credentials that do not have a signature fails with L{ValidPublicKey}.
        N)r   	signaturer
  rv   r   r   r$   s    r&    test_credentialsWithoutSignaturez9SSHPublicKeyCheckerTests.test_credentialsWithoutSignature3  s:    
 &*"LL(()9)9:N	
r(   c                     d| j                   _        | j                  | j                  j	                  | j                         t
        j                         y)z
        Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with
        credentials that have a bad key fails with L{keys.BadKeyError}.
        r(   N)r   r   r
  rv   r   r   r   r$   s    r&   test_credentialsWithBadKeyz3SSHPublicKeyCheckerTests.test_credentialsWithBadKey=  s@    
 !$LL(()9)9:D<L<L	
r(   c                     t         j                  | j                  _        | j	                  | j
                  j                  | j                        t               y)z
        If L{checkers.IAuthorizedKeysDB.getAuthorizedKeys} returns no keys
        that match the credentials,
        L{checkers.SSHPublicKeyChecker.requestAvatarId} fails with
        L{UnauthorizedLogin}.
        N)r   publicDSA_opensshr   r   r
  rv   r   r   r$   s    r&   test_credentialsNoMatchingKeyz6SSHPublicKeyCheckerTests.test_credentialsNoMatchingKeyG  sA     !( 9 9LL(()9)9:<M	
r(   c                    t         j                  j                  t        j                        j                  d      | j                  _        | j                  | j                  j                  | j                        t               y)z
        Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with
        credentials that are incorrectly signed fails with
        L{UnauthorizedLogin}.
        r   N)r   r   r   r   r   r   r   rz  r
  rv   r   r   r$   s    r&    test_credentialsInvalidSignaturez9SSHPublicKeyCheckerTests.test_credentialsInvalidSignatureS  sa     &*XX%8%8&&&

$v, 	" 	LL(()9)9:<M	
r(   c                     d }| j                  t        j                  d|       | j                  | j                  j                  | j                        t               | j                  t               y)z
        If L{keys.Key.verify} raises an exception,
        L{checkers.SSHPublicKeyChecker.requestAvatarId} fails with
        L{UnauthorizedLogin}.
        c                      t               r"   )rr  )argskwargss     r&   failz?SSHPublicKeyCheckerTests.test_failureVerifyingKey.<locals>.failg  s    !##r(   verifyN)
rG   r   r   r
  rv   r   r   r   r   rr  )r%   r  s     r&   test_failureVerifyingKeyz1SSHPublicKeyCheckerTests.test_failureVerifyingKey`  sV    	$ 	

488Xt,LL(()9)9:<M	
 	/r(   c                     | j                   j                  | j                        }| j                  d| j	                  |             y)zu
        L{checker.SSHPublicKeyChecker.requestAvatarId}, if successful,
        callbacks with the username.
        r  N)rv   r   r   rH   r   r  s     r&   test_usernameReturnedOnSuccessz7SSHPublicKeyCheckerTests.test_usernameReturnedOnSuccessq  s9    
 LL(()9)9:4#7#7#:;r(   N)rf   rg   rh   ri   rj   rk   r'   r{  r}  r  r  r  r  rl   r(   r&   rt  rt  !  s2     D	@




0"<r(   rt  )Ari   r\   base64r   collectionsr   ior   typingr   r}   __annotations__r-   r   ImportErrorzope.interface.verifyr   twisted.cred.checkersr	   twisted.cred.credentialsr
   r   r   r   twisted.cred.errorr   r   twisted.internet.deferr   twisted.pythonr   twisted.python.fakepwdr   r   twisted.python.filepathr   twisted.python.reflectr   twisted.test.test_processr   twisted.trial.unittestr   rj   twisted.conchr   twisted.conch.errorr   r   twisted.conch.sshr   twisted.conch.testr   getattrr   r    rn   r   r   r5  rN  r^  rp  	Exceptionrr  rt  rl   r(   r&   <module>r     sF  
 
  "  C=  I . I  G +  ? , 0 , + N&K&*5N
2y$+HAHc7( c7LG8 G8TUEh UEpmD mD`168 16hPH PDMU8 MU` 
H23	4	i 	V<x V<_  21I2s   D D)(D)