
    Vh                     8   U d Z ddlmZ ddlmZ ddlmZ ddlmZm	Z	 ddl
mZ ddlmZmZmZ ddlmZ dd	lmZmZ dd
lmZmZ ddlmZ ddlmZ ddlmZ ddlmZ dZ ee   e!d<    ed      rddl"m#Z# ddl$m Z m%Z%m&Z& ddl'm(Z( ddl)m*Z* n G d d      Z% G d d      Z& G d de&jV                        Z, G d de&jV                        Z- G d de&jV                        Z. G d  d!e%j^                        Z0 ee       G d" d#             Z1 ee       G d$ d%             Z2 ee       G d& d'             Z3 ee       G d( d)             Z4 G d* d+ejj                        Z6 G d, d-ejj                        Z7 G d. d/ejj                        Z8 G d0 d1ejj                        Z9y)2zT
Tests for the implementation of the ssh-userauth service.

Maintainer: Paul Swartz
    )
ModuleType)Optional)implementer)
ConchErrorValidPublicKey)ICredentialsChecker)
IAnonymousISSHPrivateKeyIUsernamePassword)UnauthorizedLogin)IRealmPortal)defertask)Deferred)loopback)requireModule)unittestNkeyscryptography)SSHProtocolChecker)r   	transportuserauth)NS)keydatac                        e Zd Z G d d      Zy)r   c                       e Zd ZdZy)transport.SSHTransportBaseQ
            A stub class so that later class definitions won't die.
            N__name__
__module____qualname____doc__     P/home/dcms/DCMS/lib/python3.12/site-packages/twisted/conch/test/test_userauth.pySSHTransportBaser   #       r&   r(   N)r!   r"   r#   r(   r%   r&   r'   r   r   "       	 	r&   r   c                        e Zd Z G d d      Zy)r   c                       e Zd ZdZy)userauth.SSHUserAuthClientr   Nr    r%   r&   r'   SSHUserAuthClientr-   )   r)   r&   r.   N)r!   r"   r#   r.   r%   r&   r'   r   r   (   r*   r&   r   c                   *    e Zd ZdZd Zd ZddZd Zy)ClientUserAuthz"
    A mock user auth client.
    c                     | j                   r-t        j                  j                  t        j
                        S t        j                  t        j                  j                  t        j                              S )z
        If this is the first time we've been called, return a blob for
        the DSA key.  Otherwise, return a blob
        for the RSA key.
        )	lastPublicKeyr   Key
fromStringr   publicRSA_opensshr   succeedpublicDSA_opensshselfs    r'   getPublicKeyzClientUserAuth.getPublicKey4   sL     88&&w'@'@AA==!4!4W5N5N!OPPr&   c                     t        j                  t        j                  j	                  t
        j                              S )z@
        Return the private key object for the RSA key.
        )r   r6   r   r3   r4   r   privateRSA_opensshr8   s    r'   getPrivateKeyzClientUserAuth.getPrivateKey?   s(     }}TXX001K1KLMMr&   Nc                 ,    t        j                  d      S )z/
        Return 'foo' as the password.
           foor   r6   )r9   prompts     r'   getPasswordzClientUserAuth.getPasswordE   s     }}V$$r&   c                 ,    t        j                  d      S )z>
        Return 'foo' as the answer to two questions.
        )foorD   r@   )r9   nameinformationanswerss       r'   getGenericAnswersz ClientUserAuth.getGenericAnswersK   s     }}^,,r&   N)r!   r"   r#   r$   r:   r=   rB   rH   r%   r&   r'   r0   r0   /   s    	QN%-r&   r0   c                       e Zd ZdZd Zd Zy)OldClientAuthz~
    The old SSHUserAuthClient returned a cryptography key object from
    getPrivateKey() and a string from getPublicKey
    c                     t        j                  t        j                  j	                  t
        j                        j                        S rI   )r   r6   r   r3   r4   r   r<   	keyObjectr8   s    r'   r=   zOldClientAuth.getPrivateKeyX   s,    }}TXX001K1KLVVWWr&   c                 x    t         j                  j                  t        j                        j                         S rI   )r   r3   r4   r   r5   blobr8   s    r'   r:   zOldClientAuth.getPublicKey[   s&    xx""7#<#<=BBDDr&   Nr!   r"   r#   r$   r=   r:   r%   r&   r'   rK   rK   R   s    
XEr&   rK   c                       e Zd ZdZd Zd Zy)ClientAuthWithoutPrivateKeyzP
    This client doesn't have a private key, but it does have a public key.
    c                      y rI   r%   r8   s    r'   r=   z)ClientAuthWithoutPrivateKey.getPrivateKeyd   s    r&   c                 \    t         j                  j                  t        j                        S rI   )r   r3   r4   r   r5   r8   s    r'   r:   z(ClientAuthWithoutPrivateKey.getPublicKeyg   s    xx""7#<#<==r&   NrP   r%   r&   r'   rR   rR   _   s    >r&   rR   c                   P    e Zd ZdZ G d d      Z G d d      Zd Zd Zd Zd	 Z	y
)FakeTransporta_  
    L{userauth.SSHUserAuthServer} expects an SSH transport which has a factory
    attribute which has a portal attribute. Because the portal is important for
    testing authentication, we need to be able to provide an interesting portal
    object to the L{SSHUserAuthServer}.

    In addition, we want to be able to capture any packets sent over the
    transport.

    @ivar packets: a list of 2-tuples: (messageType, data).  Each 2-tuple is
        a sent packet.
    @type packets: C{list}
    @param lostConnecion: True if loseConnection has been called on us.
    @type lostConnection: L{bool}
    c                       e Zd ZdZdZd Zy)FakeTransport.ServicezW
        A mock service, representing the other service offered by the server.
           nancyc                      y rI   r%   r8   s    r'   serviceStartedz$FakeTransport.Service.serviceStarted   s    r&   N)r!   r"   r#   r$   rE   r[   r%   r&   r'   ServicerX   |   s    	 	r&   r\   c                       e Zd ZdZd Zy)FakeTransport.Factoryzg
        A mock factory, representing the factory that spawned this user auth
        service.
        c                 .    |dk(  rt         j                  S y)z2
            Return our fake service.
               noneN)rV   r\   )r9   r   services      r'   
getServicez FakeTransport.Factory.getService   s     '!$,,, "r&   N)r!   r"   r#   r$   rb   r%   r&   r'   Factoryr^      s    	
	-r&   rc   c                 z    | j                         | _        || j                  _        d| _        | | _        g | _        y NF)rc   factoryportallostConnectionr   packets)r9   rg   s     r'   __init__zFakeTransport.__init__   s1    ||~$#r&   c                 >    | j                   j                  ||f       y)z8
        Record the packet sent by the service.
        N)ri   append)r9   messageTypemessages      r'   
sendPacketzFakeTransport.sendPacket   s     	['23r&   c                      y)z
        Pretend that this transport encrypts traffic in both directions. The
        SSHUserAuthServer disables password authentication if the transport
        isn't encrypted.
        Tr%   )r9   	directions     r'   isEncryptedzFakeTransport.isEncrypted   s     r&   c                     d| _         y NT)rh   r8   s    r'   loseConnectionzFakeTransport.loseConnection   s
    "r&   N)
r!   r"   r#   r$   r\   rc   rj   ro   rr   ru   r%   r&   r'   rV   rV   k   s/      - -4#r&   rV   c                       e Zd ZdZd Zy)Realmz
    A mock realm for testing L{userauth.SSHUserAuthServer}.

    This realm is not actually used in the course of testing, so it returns the
    simplest thing that could possibly work.
    c                 :    t        j                  |d   d d f      S )Nr   c                       y rI   r%   r%   r&   r'   <lambda>z%Realm.requestAvatar.<locals>.<lambda>       r&   r@   )r9   avatarIdmind
interfacess       r'   requestAvatarzRealm.requestAvatar   s    }}jmT<@AAr&   N)r!   r"   r#   r$   r   r%   r&   r'   rw   rw      s    Br&   rw   c                       e Zd ZdZefZd Zy)PasswordCheckerz
    A very simple username/password checker which authenticates anyone whose
    password matches their username and rejects all others.
    c                     |j                   |j                  k(  rt        j                  |j                         S t        j                  t        d            S )NzInvalid username/password pair)usernamepasswordr   r6   failr   )r9   credss     r'   requestAvatarIdzPasswordChecker.requestAvatarId   s;    >>U^^+==00zz+,LMNNr&   N)r!   r"   r#   r$   r   credentialInterfacesr   r%   r&   r'   r   r      s    
 ./Or&   r   c                       e Zd ZdZefZd Zy)PrivateKeyCheckerz
    A very simple public key checker which authenticates anyone whose
    public/private keypair is the same keydata.public/privateRSA_openssh.
    c                    |j                   t        j                  j                  t        j
                        j                         k(  r{|j                  et        j                  j                  |j                         }|j                  |j                  |j                        r|j                  S t               t               t               rI   )rO   r   r3   r4   r   r5   	signatureverifysigDatar   r   r   )r9   r   objs      r'   r   z!PrivateKeyChecker.requestAvatarId   s    ::,,W-F-FGLLNN*hh))%**5::eoou}}= >>)  !! %&&!!r&   N)r!   r"   r#   r$   r
   r   r   r%   r&   r'   r   r      s    
 +,"r&   r   c                       e Zd ZdZefZd Zy)AnonymousCheckerzI
    A simple checker which isn't supported by L{SSHUserAuthServer}.
    c                      y rI   r%   )r9   credentialss     r'   r   z AnonymousChecker.requestAvatarId   s    r&   N)r!   r"   r#   r$   r	   r   r   r%   r&   r'   r   r      s     '=r&   r   c                       e Zd ZdZedZddZd ZdeddfdZ	d	 Z
d
 Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zded   fdZd Zy)SSHUserAuthServerTestsz&
    Tests for SSHUserAuthServer.
    Ncannot run without cryptographyreturnc                    t               | _        t        | j                        | _        | j                  j	                  t                      | j                  j	                  t                      t        j                         | _	        t        | j                        | j                  _        | j                  j                          | j                  j                  j                          y rI   )rw   realmr   rg   registerCheckerr   r   r   SSHUserAuthServer
authServerrV   r   r[   supportedAuthenticationssortr8   s    r'   setUpzSSHUserAuthServerTests.setUp   s    W
TZZ(##O$56##$5$78"446$1$++$>!&&(00557r&   c                 F    | j                   j                          d | _         y rI   )r   serviceStoppedr8   s    r'   tearDownzSSHUserAuthServerTests.tearDown       &&(r&   ignoredc                     t        | j                  j                  t              sJ | j                  j                  j                  d   }| j                  |t        j                  t        d      dz   f       y)z;
        Check that the authentication has failed.
        s   password,publickey    N)	
isinstancer   r   rV   ri   assertEqualr   MSG_USERAUTH_FAILUREr   )r9   r   
lastPackets      r'   _checkFailedz#SSHUserAuthServerTests._checkFailed   sb     $//33]CCC__..66r:
**B/D,E,OP	
r&   c                     | j                   j                  t        d      t        d      z   t        d      z         }|j                  | j                        S )z
        A client may request a list of authentication 'method name' values
        that may continue by using the "none" authentication 'method name'.

        See RFC 4252 Section 5.2.
        r?   s   servicer`   )r   ssh_USERAUTH_REQUESTr   addCallbackr   )r9   ds     r'   test_noneAuthenticationz.SSHUserAuthServerTests.test_noneAuthentication  sH     OO00vJJ'"W+5
 }}T..//r&   c           	           dj                  t        d      t        d      t        d      dt        d      g      } j                  j                  |      } fd}|j	                  |      S )z
        When provided with correct password authentication information, the
        server should respond by sending a MSG_USERAUTH_SUCCESS message with
        no other data.

        See RFC 4252, Section 5.1.
        r&   r?   r`      passwordr   c                     j                  j                  j                  j                  t        j
                  dfg       y Nr&   r   r   r   ri   r   MSG_USERAUTH_SUCCESSr   r9   s    r'   checkzKSSHUserAuthServerTests.test_successfulPasswordAuthentication.<locals>.check"  5    ))11//56r&   )joinr   r   r   r   )r9   packetr   r   s   `   r'   %test_successfulPasswordAuthenticationz<SSHUserAuthServerTests.test_successfulPasswordAuthentication  sX     2f:r'{B{OUBvJWXOO008	 }}U##r&   c           	         dj                  t        d      t        d      t        d      dt        d      g      }t        j                         | j                  _        | j                  j                  |      }| j                  | j                  j                  j                  g        | j                  j
                  j                  d       |j                  | j                        S )a;  
        When provided with invalid authentication details, the server should
        respond by sending a MSG_USERAUTH_FAILURE message which states whether
        the authentication was partially successful, and provides other, open
        options for authentication.

        See RFC 4252, Section 5.1.
        r&   r?   r`   r   r      bar   )r   r   r   Clockr   clockr   r   r   ri   advancer   r   r9   r   r   s      r'   !test_failedPasswordAuthenticationz8SSHUserAuthServerTests.test_failedPasswordAuthentication*  s     2f:r'{B{OUBvJWX $

OO00822::B?%%a(}}T..//r&   c                     t         j                  j                  t        j                        j                         }t         j                  j                  t        j                        }t        d      t        d      z   t        d      z   dz   t        |j                               z   t        |      z   }d j                  j                  _        |j                  t        d      t        t        j                  f      z   |z         }|t        |      z  } j                  j!                  |      } fd}|j#                  |      S )zN
        Test that private key authentication completes successfully,
        r?   r`   	   publickey      testc                     j                  j                  j                  j                  t        j
                  dfg       y r   r   r   s    r'   r   zMSSHUserAuthServerTests.test_successfulPrivateKeyAuthentication.<locals>.checkP  r   r&   )r   r3   r4   r   r5   rO   r<   r   sshTyper   r   	sessionIDsignbytesr   MSG_USERAUTH_REQUESTr   r   )r9   rO   r   r   r   r   r   s   `      r'   'test_successfulPrivateKeyAuthenticationz>SSHUserAuthServerTests.test_successfulPrivateKeyAuthentication;  s    xx""7#<#<=BBDhh!!'"<"<=vJk  	 
 h 	 /6!!+HHwK%!>!> @AAFJ
	 	"Y-OO008	 }}U##r&   c                    t        j                         d }d }fd}| j                  | j                  d|       | j                  | j                  d|       | j                  | j                  d|       t	        d      t	        d      z   t	        d	      z   t	        d
      z   }| j                  j                  |       | j                  t              S )z
        ssh_USERAUTH_REQUEST should raise a ConchError if tryAuth returns
        None. Added to catch a bug noticed by pyflakes.
        c                 &    | j                  d       y )Nz&request should have raised ConochError)r   )r9   r   s     r'   mockCbFinishedAuthzOSSHUserAuthServerTests.test_requestRaisesConchError.<locals>.mockCbFinishedAuth_  s    II>?r&   c                      y rI   r%   )kinduserdatas      r'   mockTryAuthzHSSHUserAuthServerTests.test_requestRaisesConchError.<locals>.mockTryAuthb      r&   c                 <    j                  | j                         y rI   )errbackvalue)reasonr   s    r'   mockEbBadAuthzJSSHUserAuthServerTests.test_requestRaisesConchError.<locals>.mockEbBadAuthe  s    IIfll#r&   tryAuth_cbFinishedAuth
_ebBadAuths   userr`   s
   public-keys   data)r   r   patchr   r   r   assertFailurer   )r9   r   r   r   r   r   s        @r'   test_requestRaisesConchErrorz3SSHUserAuthServerTests.test_requestRaisesConchErrorX  s    
 NN	@		$ 	

4??I{;

4??$57IJ

4??L-@Gr'{*R->>GL 	,,V4!!!Z00r&   c                 \    t         j                  j                  t        j                        j                         t        d      t        d      z   t        d      z   dz   t        d      z   t              z   } j                  j                  |      } fd}|j                  |      S )z@
        Test that verifying a valid private key works.
        r?   r`   r   r      ssh-rsac                     j                  j                  j                  j                  t        j
                  t        d      t              z   fg       y )Nr   )r   r   r   ri   r   MSG_USERAUTH_PK_OKr   )r   rO   r9   s    r'   r   z@SSHUserAuthServerTests.test_verifyValidPrivateKey.<locals>.check  sB    ))11--r*~4/HIJr&   )
r   r3   r4   r   r5   rO   r   r   r   r   )r9   r   r   r   rO   s   `   @r'   test_verifyValidPrivateKeyz1SSHUserAuthServerTests.test_verifyValidPrivateKeyr  s     xx""7#<#<=BBDvJk  n	
 h 	 OO008	 }}U##r&   c                 `   t         j                  j                  t        j                        j                         }t        d      t        d      z   t        d      z   dz   t        d      z   t        |      z   }| j                  j                  |      }|j                  | j                        S )d
        Test that private key authentication fails when the public key
        is invalid.
        r?   r`   r   r   s   ssh-dsar   r3   r4   r   r7   rO   r   r   r   r   r   r9   rO   r   r   s       r'   3test_failedPrivateKeyAuthenticationWithoutSignaturezJSSHUserAuthServerTests.test_failedPrivateKeyAuthenticationWithoutSignature  s    
 xx""7#<#<=BBDvJk  n	
 h 	 OO008}}T..//r&   c                 &   t         j                  j                  t        j                        j                         }t         j                  j                  t        j                        }t        d      t        d      z   t        d      z   dz   t        d      z   t        |      z   t        |j                  |            z   }d| j                  j                  _        | j                  j                  |      }|j                  | j                        S )r   r?   r`   r   r   r   r   )r   r3   r4   r   r5   rO   r<   r   r   r   r   r   r   r   r   )r9   rO   r   r   r   s        r'   0test_failedPrivateKeyAuthenticationWithSignaturezGSSHUserAuthServerTests.test_failedPrivateKeyAuthenticationWithSignature  s    
 xx""7#<#<=BBDhh!!'"<"<=vJk  n	
 h $ ! 	 /6!!+OO008}}T..//r&   c                    t         j                  j                  t        j                        j                         }t        d      |dd z   }t        d      t        d      z   t        d      z   dz   t        d      z   t        |      z   }| j                  j                  |      }|j                  | j                        S )	z
        Private key authentication fails when the public key type is
        unsupported or the public key is corrupt.
        s   ssh-bad-type   Nr?   r`   r   r   r   r   r   s       r'   test_unsupported_publickeyz1SSHUserAuthServerTests.test_unsupported_publickey  s    
 xx""7#<#<=BBD /"T"#Y. vJk  n	
 h 	 OO008}}T..//r&   c                 V   t        j                         }t        | j                        |_        | j                  j                  t                      |j                          |j                          |j                  j                          | j                  |j                  ddg       y)ah  
        L{SSHUserAuthServer} sets up
        C{SSHUserAuthServer.supportedAuthentications} by checking the portal's
        credentials interfaces and mapping them to SSH authentication method
        strings.  If the Portal advertises an interface that
        L{SSHUserAuthServer} can't map, it should be ignored.  This is a white
        box test.
        r   r   N)r   r   rV   rg   r   r   r   r[   r   r   r   r   )r9   servers     r'    test_ignoreUnknownCredInterfacesz7SSHUserAuthServerTests.test_ignoreUnknownCredInterfaces  s~     ++-(5##$4$67'',,.88;:UVr&   c                 @   | j                  d| j                  j                         t        j                         }t        | j                        |_        d |j                  _        |j                          |j                          | j                  d|j                         t        j                         }t        | j                        |_        d |j                  _        |j                          |j                          | j                  d|j                         y)z
        Test that the userauth service does not advertise password
        authentication if the password would be send in cleartext.
        r   c                      yre   r%   xs    r'   rz   zISSHUserAuthServerTests.test_removePasswordIfUnencrypted.<locals>.<lambda>  r{   r&   c                     | dk(  S Ninr%   r   s    r'   rz   zISSHUserAuthServerTests.test_removePasswordIfUnencrypted.<locals>.<lambda>  
    d r&   N)assertInr   r   r   r   rV   rg   r   rr   r[   r   assertNotIn)r9   clearAuthServerhalfAuthServers      r'    test_removePasswordIfUnencryptedz7SSHUserAuthServerTests.test_removePasswordIfUnencrypted  s    
 	k4??#K#KL"446$1$++$>!0?!!-&&(&&(o&N&NO!335#0#= /B  ,%%'%%'k>#J#JKr&   c                 ,   t        | j                        }|j                  t                      t	        j
                         }t        |      |_        d |j                  _        |j                          |j                          | j                  |j                  dg       t	        j
                         }t        |      |_        d |j                  _        |j                          |j                          | j                  |j                  dg       y)z
        If the L{SSHUserAuthServer} is not advertising passwords, then an
        unencrypted connection should not cause any warnings or exceptions.
        This is a white box test.
        c                      yre   r%   r   s    r'   rz   zSSSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswords.<locals>.<lambda>  r{   r&   r   c                     | dk(  S r   r%   r   s    r'   rz   zSSSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswords.<locals>.<lambda>  r   r&   N)r   r   r   r   r   r   rV   r   rr   r[   r   r   r   )r9   rg   r  r  s       r'   *test_unencryptedConnectionWithoutPasswordszASSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswords  s     

#023 #446$1&$9!0?!!-&&(&&(AAL>R "335#0#8 /B  ,%%'%%'AAL>Rr&   c                 &   t        j                         }t        j                         |_        t        | j                        |_        |j                          |j                  j                  d       |j                          | j                  |j                  j                  t        j                  dt        t        j                  f      z   t!        d      z   t!        d      z   fg       | j#                  |j                  j$                         y)z0
        Test that the login times out.
        鰚        s   you took too longr&   N)r   r   r   r   r   rV   rg   r   r[   r   r   r   ri   MSG_DISCONNECTr   )DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLEr   
assertTruerh   r9   timeoutAuthServers     r'   test_loginTimeoutz(SSHUserAuthServerTests.test_loginTimeout  s     %668"&**,&3DKK&@#((*''5((*''// ,,YPPRST-./ g	
 	)33BBCr&   c                    t        j                         }t        j                         |_        t        | j                        |_        |j                          |j                          |j                  j                  d       | j                  |j                  j                  g        | j                  |j                  j                         y)zN
        Test that stopping the service also stops the login timeout.
        r	  N)r   r   r   r   r   rV   rg   r   r[   r   r   r   ri   assertFalserh   r  s     r'   test_cancelLoginTimeoutz.SSHUserAuthServerTests.test_cancelLoginTimeout  s     %668"&**,&3DKK&@#((*((*''5*44<<bA*44CCDr&   c           	          dj                  t        d      t        d      t        d      dt        d      g      }t        j                          j                  _        t        d      D ]B  } j                  j                  |      } j                  j
                  j                  d       D  fd	}j                  |      S )
zm
        Test that the server disconnects if the client fails authentication
        too many times.
        r&   r?   r`   r   r   r      r   c                     j                  j                  j                  j                  d   t        j                  dt        t        j                  f      z   t        d      z   t        d      z   f       y )Nr   r
  s   too many bad authsr&   )r   r   r   ri   r  r   r  r   r   s    r'   r   z:SSHUserAuthServerTests.test_tooManyAttempts.<locals>.check4  sm    ))11"5,,YPPRST./0 g	r&   )
r   r   r   r   r   r   ranger   r   r   )r9   r   ir   r   s   `    r'   test_tooManyAttemptsz+SSHUserAuthServerTests.test_tooManyAttempts)  s    
 2f:r'{B{OUBvJWX $

r 	-A44V<AOO!!))!,	-
	 }}U##r&   c                     t        d      t        d      z   t        d      z   dz   t        d      z   }t        j                         | j                  _        | j                  j                  |      }|J |j                  | j                        S )zo
        If the user requests a service that we don't support, the
        authentication should fail.
        r?   r&   r   r   )r   r   r   r   r   r   r   r   r   s      r'   test_failIfUnknownServicez0SSHUserAuthServerTests.test_failIfUnknownServiceB  sr    
 Fbg%;7%?"V*L $

OO008}}}}T..//r&   c                     d } j                   j                  d|        j                   j                  dd        fd} j                  j                  ddd      } j                  |t              j                  |      S )aZ  
        tryAuth() has two edge cases that are difficult to reach.

        1) an authentication method auth_* returns None instead of a Deferred.
        2) an authentication type that is defined does not have a matching
           auth_* method.

        Both these cases should return a Deferred which fails with a
        ConchError.
        c                      y rI   r%   )r   s    r'   mockAuthz>SSHUserAuthServerTests.test_tryAuthEdgeCases.<locals>.mockAuthY  r   r&   auth_publickeyauth_passwordNc                 j    j                   j                  dd d       }j                  |t              S )Nr   )r   r   r   r   )r   d2r9   s     r'   
secondTestz@SSHUserAuthServerTests.test_tryAuthEdgeCases.<locals>.secondTest_  s.    ((dDAB%%b*55r&   r   )r   r   r   r   r   r   )r9   r  r#  d1s   `   r'   test_tryAuthEdgeCasesz,SSHUserAuthServerTests.test_tryAuthEdgeCasesM  sp    	 	

4??$4h?

4??OT:	6 __$$\4>!!"j1==jIIr&   )r   N)r!   r"   r#   r$   r   skipr   r   objectr   r   r   r   r   r   r   r   r   r   r   r  r  r  r  r  r   r  r%  r%   r&   r'   r   r      s     |08	
F 	
t 	

0$&0"$:14$.0"0(0,W"L*S4D0E$2	08D> 	0Jr&   r   c                   r    e Zd ZdZedZd Zd Zd Zd Z	d Z
d	 Zd
 Zd Zd Zd Zd Zd Zd Zd Zd Zy)SSHUserAuthClientTestsz&
    Tests for SSHUserAuthClient.
    Nr   c                     t        dt        j                               | _        t        d       | j                  _        d| j                  j                  _        | j                  j                          y )Nr?   r   )r0   rV   r\   
authClientr   r   r[   r8   s    r'   r   zSSHUserAuthClientTests.setUpo  sL    (1F1F1HI$1$$7!.5!!+&&(r&   c                 F    | j                   j                          d | _         y rI   )r+  r   r8   s    r'   r   zSSHUserAuthClientTests.tearDownu  r   r&   c                 t   | j                  | j                  j                  d       | j                  | j                  j                  j                  d       | j                  | j                  j
                  j                  t        j                  t        d      t        d      z   t        d      z   fg       y)z;
        Test that client is initialized properly.
        r?   rY   r`   N)
r   r+  r   instancerE   r   ri   r   r   r   r8   s    r'   	test_initz SSHUserAuthClientTests.test_inity  s     	--v61166AOO%%--++RZ"X,-FG-TUV	
r&   c                     dgfd}|| j                   j                  _        | j                   j                  d       | j	                  d   | j                   j
                         y)z9
        Test that the client succeeds properly.
        Nc                     | d<   y )Nr   r%   )ra   r.  s    r'   stubSetServicezDSSHUserAuthClientTests.test_USERAUTH_SUCCESS.<locals>.stubSetService  s    !HQKr&   r&   r   )r+  r   
setServicessh_USERAUTH_SUCCESSr   r.  )r9   r2  r.  s     @r'   test_USERAUTH_SUCCESSz,SSHUserAuthClientTests.test_USERAUTH_SUCCESS  sU     6	" 0>!!,,,S1!doo&>&>?r&   c           
         | j                   j                  t        d      dz          | j                  | j                   j                  j
                  d   t        j                  t        d      t        d      z   t        d      z   dz   t        d      z   t        t        j                  j                  t        j                        j                               z   f       | j                   j                  t        d      dz          t        t        j                  j                  t        j                        j                               }| j                  | j                   j                  j
                  d   t        j                  t        d      t        d      z   t        d      z   dz   t        d      z   |z   f       | j                   j                  t        d      t        t        j                  j                  t        j                        j                               z          t        | j                   j                  j                         t#        t        j                  f      z   t        d      z   t        d      z   t        d      z   dz   t        d      z   |z   }t        j                  j                  t        j$                        }| j                  | j                   j                  j
                  d   t        j                  t        d      t        d      z   t        d      z   dz   t        d      z   |z   t        |j'                  |            z   f       y	)
zJ
        Test that the client can authenticate with a public key.
        r   r   r   r?   rY   s   ssh-dssr      N)r+  ssh_USERAUTH_FAILUREr   r   r   ri   r   r   r   r3   r4   r   r7   rO   r5   ssh_USERAUTH_PK_OKr   r   r<   r   )r9   rO   r   r   s       r'   test_publickeyz%SSHUserAuthClientTests.test_publickey  s    	,,R-=-GHOO%%--b1--6
X,\"#  Z.	!
 TXX(()B)BCHHJKL	
 	,,R-=-GH$((%%g&?&?@EEGHOO%%--b1--vJl#&'  n	%
 
	
 	**zNR 3 3G4M4M N S S UVV	
 t((223X22456j l 	
  n  	 hh!!'"<"<=OO%%--b1--6
X,\"#  Z.	!
  SXXg&'(		
r&   c                    t        dt        j                               }t        d      |_        d|j                  _        |j                          |j                  d       g |j                  _        | j                  |j                  d             | j                  |j                  j                  t        j                  t        d      t        d      z   t        d      z   fg       y)z
        If the SSHUserAuthClient doesn't return anything from signData,
        the client should start the authentication over again by requesting
        'none' authentication.
        r?   Nr   r   r&   rY   r`   )rR   rV   r\   r   r   r[   r   ri   assertIsNoner9  r   r   r   r   )r9   r+  s     r'   !test_publickey_without_privatekeyz8SSHUserAuthClientTests.test_publickey_without_privatekey  s     19N9N9PQ
,T2
)0
&!!#<(')
$*77<=  ((++RZ"X,-FG-TUV	
r&   c                      d  j                   _         j                   j                  d      } fd}|j                  |      S )z{
        If there's no public key, auth_publickey should return a Deferred
        called back with a False value.
        c                      y rI   r%   r   s    r'   rz   z:SSHUserAuthClientTests.test_no_publickey.<locals>.<lambda>  r{   r&   r   c                 (    j                  |        y rI   )r  )resultr9   s    r'   r   z7SSHUserAuthClientTests.test_no_publickey.<locals>.check  s    V$r&   )r+  r:   r   r   )r9   r   r   s   `  r'   test_no_publickeyz(SSHUserAuthClientTests.test_no_publickey  s;    
 (6$OO##L1	% }}U##r&   c                    | j                   j                  t        d      dz          | j                  | j                   j                  j
                  d   t        j                  t        d      t        d      z   t        d      z   dz   t        d      z   f       | j                   j                  t        d      t        d      z          | j                  | j                   j                  j
                  d   t        j                  t        d      t        d      z   t        d      z   dz   t        d      dz  z   f       y	)
zx
        Test that the client can authentication with a password.  This
        includes changing the password.
        r   r   r   r?   rY   r&   r   r   N)	r+  r8  r   r   r   ri   r   r   r9  r8   s    r'   test_passwordz$SSHUserAuthClientTests.test_password  s    
 	,,R_w-FGOO%%--b1--6
R\)B{O;gE6
R	
 	**2c7RW+<=OO%%--b1--6
R\)B{O;gE6
UVV	
r&   c                 |    d | j                   _        | j                  | j                   j                  d             y)zK
        If getPassword returns None, tryAuth should return False.
        c                       y rI   r%   r%   r&   r'   rz   z9SSHUserAuthClientTests.test_no_password.<locals>.<lambda>	  r{   r&   r   N)r+  rB   r  r   r8   s    r'   test_no_passwordz'SSHUserAuthClientTests.test_no_password  s-     '3#00=>r&   c                 V   | j                   j                  t        d      t        d      z   t        d      z   dz   t        d      z   dz          | j                  | j                   j                  j
                  d   t        j                  dt        d      z   t        d      z   f       y)	zj
        Make sure that the client can authenticate with the keyboard
        interactive method.
        r&   s      s
   Password: r   r   s      r?   N)r+  'ssh_USERAUTH_PK_OK_keyboard_interactiver   r   r   ri   r   MSG_USERAUTH_INFO_RESPONSEr8   s    r'   test_keyboardInteractivez/SSHUserAuthClientTests.test_keyboardInteractive  s    
 	??sGgg "" 	 
 	
 	OO%%--b133#bj02f:=	
r&   c                 V   d| j                   _        g | j                   j                  _        | j                   j	                  d       | j                  | j                   j                  j                  t        j                  t        d      t        d      z   t        d      z   fg       y)z
        If C{SSHUserAuthClient} gets a MSG_USERAUTH_PK_OK packet when it's not
        expecting it, it should fail the current authentication and move on to
        the next type.
        s   unknownr&   r?   rY   r`   N)	r+  lastAuthr   ri   r9  r   r   r   r   r8   s    r'   "test_USERAUTH_PK_OK_unknown_methodz9SSHUserAuthClientTests.test_USERAUTH_PK_OK_unknown_method!  s|     $. ,.!!)**3/OO%%--++RZ"X,-FG-TUV	
r&   c                 J     fd} fd}| j                   _        | j                   _         j                   j                  t	        d      dz           j                   j                   j                  j                  d   t        j                  t	        d      t	        d      z   t	        d      z   dz   t	        d      z   f        j                   j                  t	        d	      d
z           j                   j                   j                  j                  dd ddg       y)z
        ssh_USERAUTH_FAILURE should sort the methods by their position
        in SSHUserAuthClient.preferredOrder.  Methods that are not in
        preferredOrder should be sorted at the end of that list.
        c                  R     j                   j                  j                  dd       y )N      here is datar+  r   ro   r8   s   r'   auth_firstmethodzNSSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting.<locals>.auth_firstmethod6  s    OO%%00oFr&   c                  R     j                   j                  j                  dd       y)N   
   other dataTrS  r8   s   r'   auth_anothermethodzPSSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting.<locals>.auth_anothermethod9  s     OO%%00mDr&   s   anothermethod,passwordr   r   r?   rY   r   s"   firstmethod,anothermethod,passwordr   N)rQ  rR  )rV  rW  )
r+  rT  rX  r8  r   r   r   ri   r   r   )r9   rT  rX  s   `  r'   test_USERAUTH_FAILURE_sortingz4SSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting/  s    	G	 ,<(-?* 	,,R0I-JW-TUOO%%--b1--6
R\)B{O;gE6
R	
 	,,45?	
 	OO%%--bc2#%9:	
r&   c                 D   | j                   j                  t        d      dz          | j                   j                  t        d      dz          | j                  | j                   j                  j
                  d   t        j                  dt        d      z   dz   f       y)	z
        If there are no more available user authentication messages,
        the SSHUserAuthClient should disconnect with code
        DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE.
        r   r   r   r   s      s(   no more authentication methods availables       N)r+  r8  r   r   r   ri   r  r8   s    r'   %test_disconnectIfNoMoreAuthenticationz<SSHUserAuthClientTests.test_disconnectIfNoMoreAuthenticationS  s     	,,R_w-FG,,R_w-FGOO%%--b1((#@AB%&	
r&   c                 4   g | j                   j                  _        | j                   j                  d       | j	                  | j                   j                  j                  t
        j                  t        d      t        d      z   t        d      z   fg       y)z
        _ebAuth (the generic authentication error handler) should send
        a request for the 'none' authentication method.
        Nr?   rY   r`   )r+  r   ri   _ebAuthr   r   r   r   r8   s    r'   test_ebAuthz"SSHUserAuthClientTests.test_ebAuthe  sp    
 -/!!)%OO%%--++RZ"X,-FG-TUV	
r&   c                 .    t        j                  dt        j                                j	                  j                                 fd} fdd j                         }|j                   j                        j                  |      S )z
        getPublicKey() should return None.  getPrivateKey() should return a
        failed Deferred.  getPassword() should return a failed Deferred.
        getGenericAnswers() should return a failed Deferred.
        r?   c                     | j                  t               j                         }|j                  j                        j                        S rI   )trapNotImplementedErrorrB   r   r   
addErrback)rA  r   r+  check2r9   s     r'   r   z3SSHUserAuthClientTests.test_defaults.<locals>.checkz  s<    KK+,&&(A==+66v>>r&   c                     | j                  t               j                  d d d       }|j                  j                        j                        S rI   )rb  rc  rH   r   r   rd  )rA  r   r+  check3r9   s     r'   re  z4SSHUserAuthClientTests.test_defaults.<locals>.check2  sB    KK+,,,T4>A==+66v>>r&   c                 .    | j                  t               y rI   )rb  rc  )rA  s    r'   rg  z4SSHUserAuthClientTests.test_defaults.<locals>.check3  s    KK+,r&   )
r   r.   rV   r\   r<  r:   r=   r   r   rd  )r9   r   r   r+  re  rg  s   `  @@@r'   test_defaultsz$SSHUserAuthClientTests.test_defaultsq  st     //8M8M8OP
*1134	?
	?
	- $$&}}TYY'22599r&   )r!   r"   r#   r$   r   r&  r   r   r/  r5  r:  r=  rB  rD  rG  rK  rN  rZ  r\  r_  ri  r%   r&   r'   r)  r)  g  sa     |0)	
@<
|
&$
,?
*
"
H
$

:r&   r)  c                   .    e Zd ZedZ G d d      Zd Zy)LoopbackTestsNr   c                   &    e Zd Z G d d      Zd Zy)LoopbackTests.Factoryc                       e Zd ZdZd Zd Zy)LoopbackTests.Factory.Service   TestServicec                 8    | j                   j                          y rI   )r   ru   r8   s    r'   r[   z,LoopbackTests.Factory.Service.serviceStarted  s    --/r&   c                      y rI   r%   r8   s    r'   r   z,LoopbackTests.Factory.Service.serviceStopped  s    r&   N)r!   r"   r#   rE   r[   r   r%   r&   r'   r\   ro    s    !D0r&   r\   c                     | j                   S rI   )r\   )r9   avatarrE   s      r'   rb   z LoopbackTests.Factory.getService  s    <<r&   N)r!   r"   r#   r\   rb   r%   r&   r'   rc   rm    s    	 		 r&   rc   c                 Z    t        j                         t        d j                  j	                               }t        j                         _        j
                  _        d j
                  _        t        j                         |_        ||j
                  _        dxj
                  _	        |j
                  _	        d xj
                  _
        |j
                  _
         j                         j
                  _        d_        t               }t        |      }t               j!                  t#                      j!                  t%                      fd_        |j!                         |j
                  j                  _        t+        j,                  j
                  |j
                        }d j
                  j
                  _        d |j
                  j
                  _        j1                          |j1                           fd	}|j3                  |      S )
zW
        Test that the userauth server and client play nicely with each other.
        r?   c                      yrt   r%   r   s    r'   rz   z-LoopbackTests.test_loopback.<locals>.<lambda>  r{   r&   r&   c                       y rI   r%   r%   r&   r'   rz   z-LoopbackTests.test_loopback.<locals>.<lambda>  r{   r&   r   c                 :    t        j                  |          dk(  S )Nr   )lensuccessfulCredentials)aIdcheckers    r'   rz   z-LoopbackTests.test_loopback.<locals>.<lambda>  s    s7+H+H+M'NRS'S r&   c                       y)N_ServerLoopbackr%   r%   r&   r'   rz   z-LoopbackTests.test_loopback.<locals>.<lambda>  r{   r&   c                       y)N_ClientLoopbackr%   r%   r&   r'   rz   z-LoopbackTests.test_loopback.<locals>.<lambda>  r{   r&   c                 f    j                  j                  j                  j                  d       y )Nrp  )r   r   ra   rE   )r   r9   r   s    r'   r   z*LoopbackTests.test_loopback.<locals>.check  s%    V--55::NKr&   )r   r   r0   rc   r\   r   r(   ra   rr   r   sendKexInitrf   passwordDelayrw   r   r   r   r   r   areDonerg   r   loopbackAsync	logPrefixr[   r   )r9   clientr   rg   r   r   r|  r   s   `     @@r'   test_loopbackzLoopbackTests.test_loopback  s    ++-(<(<(>? %557#) '5$$557#) BEE"V%5%5%?FRR$v'7'7'C $(<<>  $& 12 1 34Tw'*0  '""6#3#3V5E5EF/H"",/H"",	L }}U##r&   )r!   r"   r#   r   r&  rc   r  r%   r&   r'   rk  rk    s    |0   '$r&   rk  c                       e Zd ZedZd Zy)ModuleInitializationTestsNr   c                     | j                  t        j                  j                  d   d       | j                  t        j                  j                  d   d       y )N<   r   )r   r   r   protocolMessagesr.   r8   s    r'   test_messagesz'ModuleInitializationTests.test_messages  sP     	&&77;=Q	
 	&&77;=Q	
r&   )r!   r"   r#   r   r&  r  r%   r&   r'   r  r    s    |0
r&   r  ):r$   typesr   typingr   zope.interfacer   twisted.conch.errorr   r   twisted.cred.checkersr   twisted.cred.credentialsr	   r
   r   twisted.cred.errorr   twisted.cred.portalr   r   twisted.internetr   r   twisted.internet.deferr   twisted.protocolsr   twisted.python.reflectr   twisted.trialr   r   __annotations__twisted.conch.checkersr   twisted.conch.sshr   r   twisted.conch.ssh.commonr   twisted.conch.testr   r.   r0   rK   rR   r(   rV   rw   r   r   r   TestCaser   r)  rk  r  r%   r&   r'   <module>r     s     & : 5 R R 0 . ( + & 0 "!hz ! 9;;+*   -X//  -F
EH.. 
E	>("<"< 	>>#I.. >#B V	B 	B 	B  !O O "O  !" " ""&  !	 	 "	{JX.. {J|a:X.. a:H	8$H%% 8$v
 1 1 
r&   