
    Ϫf                     ,   U d Z ddlmZ ddlmZ ddlmZ ddlmZm	Z	 ddl
mZ ddlmZmZmZ ddlmZ dd	lmZmZ dd
lmZmZ ddlmZ ddlmZ ddlmZ dZee   ed<    ed      rddl m!Z! ddl"mZm#Z#m$Z$ ddl%m&Z& ddl'm(Z( n G d d      Z# G d d      Z$ G d de$jR                        Z* G d de$jR                        Z+ G d de$jR                        Z, G d d e#jZ                        Z. ee       G d! d"             Z/ ee       G d# d$             Z0 ee       G d% d&             Z1 ee       G d' d(             Z2 G d) d*ejf                        Z4 G d+ d,ejf                        Z5 G d- d.ejf                        Z6 G d/ d0ejf                        Z7y)1zT
Tests for the implementation of the ssh-userauth service.

Maintainer: Paul Swartz
    )
ModuleType)Optional)implementer)
ConchErrorValidPublicKey)ICredentialsChecker)
IAnonymousISSHPrivateKeyIUsernamePassword)UnauthorizedLogin)IRealmPortal)defertask)loopback)requireModule)unittestNkeyscryptography)SSHProtocolChecker)r   	transportuserauth)NS)keydatac                        e Zd Z G d d      Zy)r   c                       e Zd ZdZy)transport.SSHTransportBaseQ
            A stub class so that later class definitions won't die.
            N__name__
__module____qualname____doc__     B/usr/lib/python3/dist-packages/twisted/conch/test/test_userauth.pySSHTransportBaser   "       r%   r'   N)r    r!   r"   r'   r$   r%   r&   r   r   !       	 	r%   r   c                        e Zd Z G d d      Zy)r   c                       e Zd ZdZy)userauth.SSHUserAuthClientr   Nr   r$   r%   r&   SSHUserAuthClientr,   (   r(   r%   r-   N)r    r!   r"   r-   r$   r%   r&   r   r   '   r)   r%   r   c                   *    e Zd ZdZd Zd ZddZd Zy)ClientUserAuthz"
    A mock user auth client.
    c                     | j                   r-t        j                  j                  t        j
                        S t        j                  t        j                  j                  t        j                              S )z
        If this is the first time we've been called, return a blob for
        the DSA key.  Otherwise, return a blob
        for the RSA key.
        )	lastPublicKeyr   Key
fromStringr   publicRSA_opensshr   succeedpublicDSA_opensshselfs    r&   getPublicKeyzClientUserAuth.getPublicKey3   sL     88&&w'@'@AA==!4!4W5N5N!OPPr%   c                     t        j                  t        j                  j	                  t
        j                              S )z@
        Return the private key object for the RSA key.
        )r   r5   r   r2   r3   r   privateRSA_opensshr7   s    r&   getPrivateKeyzClientUserAuth.getPrivateKey>   s(     }}TXX001K1KLMMr%   Nc                 ,    t        j                  d      S )z/
        Return 'foo' as the password.
           foor   r5   )r8   prompts     r&   getPasswordzClientUserAuth.getPasswordD   s     }}V$$r%   c                 ,    t        j                  d      S )z>
        Return 'foo' as the answer to two questions.
        )foorC   r?   )r8   nameinformationanswerss       r&   getGenericAnswersz ClientUserAuth.getGenericAnswersJ   s     }}^,,r%   N)r    r!   r"   r#   r9   r<   rA   rG   r$   r%   r&   r/   r/   .   s    	QN%-r%   r/   c                       e Zd ZdZd Zd Zy)OldClientAuthz~
    The old SSHUserAuthClient returned a cryptography key object from
    getPrivateKey() and a string from getPublicKey
    c                     t        j                  t        j                  j	                  t
        j                        j                        S rH   )r   r5   r   r2   r3   r   r;   	keyObjectr7   s    r&   r<   zOldClientAuth.getPrivateKeyW   s,    }}TXX001K1KLVVWWr%   c                 x    t         j                  j                  t        j                        j                         S rH   )r   r2   r3   r   r4   blobr7   s    r&   r9   zOldClientAuth.getPublicKeyZ   s&    xx""7#<#<=BBDDr%   Nr    r!   r"   r#   r<   r9   r$   r%   r&   rJ   rJ   Q   s    
XEr%   rJ   c                       e Zd ZdZd Zd Zy)ClientAuthWithoutPrivateKeyzP
    This client doesn't have a private key, but it does have a public key.
    c                      y rH   r$   r7   s    r&   r<   z)ClientAuthWithoutPrivateKey.getPrivateKeyc   s    r%   c                 \    t         j                  j                  t        j                        S rH   )r   r2   r3   r   r4   r7   s    r&   r9   z(ClientAuthWithoutPrivateKey.getPublicKeyf   s    xx""7#<#<==r%   NrO   r$   r%   r&   rQ   rQ   ^   s    >r%   rQ   c                   P    e Zd ZdZ G d d      Z G d d      Zd Zd Zd Zd	 Z	y
)FakeTransporta_  
    L{userauth.SSHUserAuthServer} expects an SSH transport which has a factory
    attribute which has a portal attribute. Because the portal is important for
    testing authentication, we need to be able to provide an interesting portal
    object to the L{SSHUserAuthServer}.

    In addition, we want to be able to capture any packets sent over the
    transport.

    @ivar packets: a list of 2-tuples: (messageType, data).  Each 2-tuple is
        a sent packet.
    @type packets: C{list}
    @param lostConnecion: True if loseConnection has been called on us.
    @type lostConnection: L{bool}
    c                       e Zd ZdZdZd Zy)FakeTransport.ServicezW
        A mock service, representing the other service offered by the server.
           nancyc                      y rH   r$   r7   s    r&   serviceStartedz$FakeTransport.Service.serviceStarted   s    r%   N)r    r!   r"   r#   rD   rZ   r$   r%   r&   ServicerW   {   s    	 	r%   r[   c                       e Zd ZdZd Zy)FakeTransport.Factoryzg
        A mock factory, representing the factory that spawned this user auth
        service.
        c                 .    |dk(  rt         j                  S y)z2
            Return our fake service.
               noneN)rU   r[   )r8   r   services      r&   
getServicez FakeTransport.Factory.getService   s     '!$,,, "r%   N)r    r!   r"   r#   ra   r$   r%   r&   Factoryr]      s    	
	-r%   rb   c                 z    | j                         | _        || j                  _        d| _        | | _        g | _        y NF)rb   factoryportallostConnectionr   packets)r8   rf   s     r&   __init__zFakeTransport.__init__   s1    ||~$#r%   c                 >    | j                   j                  ||f       y)z8
        Record the packet sent by the service.
        N)rh   append)r8   messageTypemessages      r&   
sendPacketzFakeTransport.sendPacket   s     	['23r%   c                      y)z
        Pretend that this transport encrypts traffic in both directions. The
        SSHUserAuthServer disables password authentication if the transport
        isn't encrypted.
        Tr$   )r8   	directions     r&   isEncryptedzFakeTransport.isEncrypted   s     r%   c                     d| _         y NT)rg   r7   s    r&   loseConnectionzFakeTransport.loseConnection   s
    "r%   N)
r    r!   r"   r#   r[   rb   ri   rn   rq   rt   r$   r%   r&   rU   rU   j   s/      - -4#r%   rU   c                       e Zd ZdZd Zy)Realmz
    A mock realm for testing L{userauth.SSHUserAuthServer}.

    This realm is not actually used in the course of testing, so it returns the
    simplest thing that could possibly work.
    c                 :    t        j                  |d   d d f      S )Nr   c                       y rH   r$   r$   r%   r&   <lambda>z%Realm.requestAvatar.<locals>.<lambda>       r%   r?   )r8   avatarIdmind
interfacess       r&   requestAvatarzRealm.requestAvatar   s    }}jmT<@AAr%   N)r    r!   r"   r#   r~   r$   r%   r&   rv   rv      s    Br%   rv   c                       e Zd ZdZefZd Zy)PasswordCheckerz
    A very simple username/password checker which authenticates anyone whose
    password matches their username and rejects all others.
    c                     |j                   |j                  k(  rt        j                  |j                         S t        j                  t        d            S )NzInvalid username/password pair)usernamepasswordr   r5   failr   )r8   credss     r&   requestAvatarIdzPasswordChecker.requestAvatarId   s;    >>U^^+==00zz+,LMNNr%   N)r    r!   r"   r#   r   credentialInterfacesr   r$   r%   r&   r   r      s    
 ./Or%   r   c                       e Zd ZdZefZd Zy)PrivateKeyCheckerz
    A very simple public key checker which authenticates anyone whose
    public/private keypair is the same keydata.public/privateRSA_openssh.
    c                    |j                   t        j                  j                  t        j
                        j                         k(  r{|j                  et        j                  j                  |j                         }|j                  |j                  |j                        r|j                  S t               t               t               rH   )rN   r   r2   r3   r   r4   	signatureverifysigDatar   r   r   )r8   r   objs      r&   r   z!PrivateKeyChecker.requestAvatarId   s    ::,,W-F-FGLLNN*hh))%**5::eoou}}= >>)  !! %&&!!r%   N)r    r!   r"   r#   r
   r   r   r$   r%   r&   r   r      s    
 +,"r%   r   c                       e Zd ZdZefZd Zy)AnonymousCheckerzI
    A simple checker which isn't supported by L{SSHUserAuthServer}.
    c                      y rH   r$   )r8   credentialss     r&   r   z AnonymousChecker.requestAvatarId   s    r%   N)r    r!   r"   r#   r	   r   r   r$   r%   r&   r   r      s     '=r%   r   c                       e Zd ZdZedZd Zd Zd Zd Z	d Z
d	 Zd
 Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zy)SSHUserAuthServerTestsz&
    Tests for SSHUserAuthServer.
    Ncannot run without cryptographyc                    t               | _        t        | j                        | _        | j                  j	                  t                      | j                  j	                  t                      t        j                         | _	        t        | j                        | j                  _        | j                  j                          | j                  j                  j                          y rH   )rv   realmr   rf   registerCheckerr   r   r   SSHUserAuthServer
authServerrU   r   rZ   supportedAuthenticationssortr7   s    r&   setUpzSSHUserAuthServerTests.setUp   s    W
TZZ(##O$56##$5$78"446$1$++$>!&&(00557r%   c                 F    | j                   j                          d | _         y rH   )r   serviceStoppedr7   s    r&   tearDownzSSHUserAuthServerTests.tearDown       &&(r%   c                     | j                  | j                  j                  j                  d   t        j
                  t        d      dz   f       y)z;
        Check that the authentication has failed.
        s   password,publickey    N)assertEqualr   r   rh   r   MSG_USERAUTH_FAILUREr   r8   ignoreds     r&   _checkFailedz#SSHUserAuthServerTests._checkFailed   sC     	OO%%--b1**B/D,E,OP	
r%   c                     | j                   j                  t        d      t        d      z   t        d      z         }|j                  | j                        S )z
        A client may request a list of authentication 'method name' values
        that may continue by using the "none" authentication 'method name'.

        See RFC 4252 Section 5.2.
        r>   s   servicer_   )r   ssh_USERAUTH_REQUESTr   addCallbackr   )r8   ds     r&   test_noneAuthenticationz.SSHUserAuthServerTests.test_noneAuthentication  sH     OO00vJJ'"W+5
 }}T..//r%   c           	           dj                  t        d      t        d      t        d      dt        d      g      } j                  j                  |      } fd}|j	                  |      S )z
        When provided with correct password authentication information, the
        server should respond by sending a MSG_USERAUTH_SUCCESS message with
        no other data.

        See RFC 4252, Section 5.1.
        r%   r>   r_      passwordr   c                     j                  j                  j                  j                  t        j
                  dfg       y Nr%   r   r   r   rh   r   MSG_USERAUTH_SUCCESSr   r8   s    r&   checkzKSSHUserAuthServerTests.test_successfulPasswordAuthentication.<locals>.check  5    ))11//56r%   )joinr   r   r   r   )r8   packetr   r   s   `   r&   %test_successfulPasswordAuthenticationz<SSHUserAuthServerTests.test_successfulPasswordAuthentication  sX     2f:r'{B{OUBvJWXOO008	 }}U##r%   c           	         dj                  t        d      t        d      t        d      dt        d      g      }t        j                         | j                  _        | j                  j                  |      }| j                  | j                  j                  j                  g        | j                  j
                  j                  d       |j                  | j                        S )a;  
        When provided with invalid authentication details, the server should
        respond by sending a MSG_USERAUTH_FAILURE message which states whether
        the authentication was partially successful, and provides other, open
        options for authentication.

        See RFC 4252, Section 5.1.
        r%   r>   r_   r   r      bar   )r   r   r   Clockr   clockr   r   r   rh   advancer   r   r8   r   r   s      r&   !test_failedPasswordAuthenticationz8SSHUserAuthServerTests.test_failedPasswordAuthentication'  s     2f:r'{B{OUBvJWX $

OO00822::B?%%a(}}T..//r%   c                     t         j                  j                  t        j                        j                         }t         j                  j                  t        j                        }t        d      t        d      z   t        d      z   dz   t        |j                               z   t        |      z   }d j                  j                  _        |j                  t        d      t        t        j                  f      z   |z         }|t        |      z  } j                  j!                  |      } fd}|j#                  |      S )zN
        Test that private key authentication completes successfully,
        r>   r_   	   publickey      testc                     j                  j                  j                  j                  t        j
                  dfg       y r   r   r   s    r&   r   zMSSHUserAuthServerTests.test_successfulPrivateKeyAuthentication.<locals>.checkM  r   r%   )r   r2   r3   r   r4   rN   r;   r   sshTyper   r   	sessionIDsignbytesr   MSG_USERAUTH_REQUESTr   r   )r8   rN   r   r   r   r   r   s   `      r&   'test_successfulPrivateKeyAuthenticationz>SSHUserAuthServerTests.test_successfulPrivateKeyAuthentication8  s    xx""7#<#<=BBDhh!!'"<"<=vJk  	 
 h 	 /6!!+HHwK%!>!> @AAFJ
	 	"Y-OO008	 }}U##r%   c                    t        j                         d }d }fd}| j                  | j                  d|       | j                  | j                  d|       | j                  | j                  d|       t	        d      t	        d      z   t	        d	      z   t	        d
      z   }| j                  j                  |       | j                  t              S )z
        ssh_USERAUTH_REQUEST should raise a ConchError if tryAuth returns
        None. Added to catch a bug noticed by pyflakes.
        c                 &    | j                  d       y )Nz&request should have raised ConochError)r   r   s     r&   mockCbFinishedAuthzOSSHUserAuthServerTests.test_requestRaisesConchError.<locals>.mockCbFinishedAuth\  s    II>?r%   c                      y rH   r$   )kinduserdatas      r&   mockTryAuthzHSSHUserAuthServerTests.test_requestRaisesConchError.<locals>.mockTryAuth_      r%   c                 <    j                  | j                         y rH   )errbackvalue)reasonr   s    r&   mockEbBadAuthzJSSHUserAuthServerTests.test_requestRaisesConchError.<locals>.mockEbBadAuthb  s    IIfll#r%   tryAuth_cbFinishedAuth
_ebBadAuths   userr_   s
   public-keys   data)r   Deferredpatchr   r   r   assertFailurer   )r8   r   r   r   r   r   s        @r&   test_requestRaisesConchErrorz3SSHUserAuthServerTests.test_requestRaisesConchErrorU  s    
 NN	@		$ 	

4??I{;

4??$57IJ

4??L-@Gr'{*R->>GL 	,,V4!!!Z00r%   c                 \    t         j                  j                  t        j                        j                         t        d      t        d      z   t        d      z   dz   t        d      z   t              z   } j                  j                  |      } fd}|j                  |      S )z@
        Test that verifying a valid private key works.
        r>   r_   r   r      ssh-rsac                     j                  j                  j                  j                  t        j
                  t        d      t              z   fg       y )Nr   )r   r   r   rh   r   MSG_USERAUTH_PK_OKr   )r   rN   r8   s    r&   r   z@SSHUserAuthServerTests.test_verifyValidPrivateKey.<locals>.check~  sB    ))11--r*~4/HIJr%   )
r   r2   r3   r   r4   rN   r   r   r   r   )r8   r   r   r   rN   s   `   @r&   test_verifyValidPrivateKeyz1SSHUserAuthServerTests.test_verifyValidPrivateKeyo  s     xx""7#<#<=BBDvJk  n	
 h 	 OO008	 }}U##r%   c                 `   t         j                  j                  t        j                        j                         }t        d      t        d      z   t        d      z   dz   t        d      z   t        |      z   }| j                  j                  |      }|j                  | j                        S )d
        Test that private key authentication fails when the public key
        is invalid.
        r>   r_   r   r   s   ssh-dsar   r2   r3   r   r6   rN   r   r   r   r   r   r8   rN   r   r   s       r&   3test_failedPrivateKeyAuthenticationWithoutSignaturezJSSHUserAuthServerTests.test_failedPrivateKeyAuthenticationWithoutSignature  s    
 xx""7#<#<=BBDvJk  n	
 h 	 OO008}}T..//r%   c                 &   t         j                  j                  t        j                        j                         }t         j                  j                  t        j                        }t        d      t        d      z   t        d      z   dz   t        d      z   t        |      z   t        |j                  |            z   }d| j                  j                  _        | j                  j                  |      }|j                  | j                        S )r   r>   r_   r   r   r   r   )r   r2   r3   r   r4   rN   r;   r   r   r   r   r   r   r   r   )r8   rN   r   r   r   s        r&   0test_failedPrivateKeyAuthenticationWithSignaturezGSSHUserAuthServerTests.test_failedPrivateKeyAuthenticationWithSignature  s    
 xx""7#<#<=BBDhh!!'"<"<=vJk  n	
 h $ ! 	 /6!!+OO008}}T..//r%   c                    t         j                  j                  t        j                        j                         }t        d      |dd z   }t        d      t        d      z   t        d      z   dz   t        d      z   t        |      z   }| j                  j                  |      }|j                  | j                        S )	z
        Private key authentication fails when the public key type is
        unsupported or the public key is corrupt.
        s   ssh-bad-type   Nr>   r_   r   r   r   r   r   s       r&   test_unsupported_publickeyz1SSHUserAuthServerTests.test_unsupported_publickey  s    
 xx""7#<#<=BBD /"T"#Y. vJk  n	
 h 	 OO008}}T..//r%   c                 V   t        j                         }t        | j                        |_        | j                  j                  t                      |j                          |j                          |j                  j                          | j                  |j                  ddg       y)ah  
        L{SSHUserAuthServer} sets up
        C{SSHUserAuthServer.supportedAuthentications} by checking the portal's
        credentials interfaces and mapping them to SSH authentication method
        strings.  If the Portal advertises an interface that
        L{SSHUserAuthServer} can't map, it should be ignored.  This is a white
        box test.
        r   r   N)r   r   rU   rf   r   r   r   rZ   r   r   r   r   )r8   servers     r&    test_ignoreUnknownCredInterfacesz7SSHUserAuthServerTests.test_ignoreUnknownCredInterfaces  s~     ++-(5##$4$67'',,.88;:UVr%   c                 @   | j                  d| j                  j                         t        j                         }t        | j                        |_        d |j                  _        |j                          |j                          | j                  d|j                         t        j                         }t        | j                        |_        d |j                  _        |j                          |j                          | j                  d|j                         y)z
        Test that the userauth service does not advertise password
        authentication if the password would be send in cleartext.
        r   c                      yrd   r$   xs    r&   ry   zISSHUserAuthServerTests.test_removePasswordIfUnencrypted.<locals>.<lambda>  rz   r%   c                     | dk(  S Ninr$   r   s    r&   ry   zISSHUserAuthServerTests.test_removePasswordIfUnencrypted.<locals>.<lambda>  
    d r%   N)assertInr   r   r   r   rU   rf   r   rq   rZ   r   assertNotIn)r8   clearAuthServerhalfAuthServers      r&    test_removePasswordIfUnencryptedz7SSHUserAuthServerTests.test_removePasswordIfUnencrypted  s    
 	k4??#K#KL"446$1$++$>!0?!!-&&(&&(o&N&NO!335#0#= /B  ,%%'%%'k>#J#JKr%   c                 ,   t        | j                        }|j                  t                      t	        j
                         }t        |      |_        d |j                  _        |j                          |j                          | j                  |j                  dg       t	        j
                         }t        |      |_        d |j                  _        |j                          |j                          | j                  |j                  dg       y)z
        If the L{SSHUserAuthServer} is not advertising passwords, then an
        unencrypted connection should not cause any warnings or exceptions.
        This is a white box test.
        c                      yrd   r$   r   s    r&   ry   zSSSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswords.<locals>.<lambda>  rz   r%   r   c                     | dk(  S r   r$   r   s    r&   ry   zSSSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswords.<locals>.<lambda>  r   r%   N)r   r   r   r   r   r   rU   r   rq   rZ   r   r   r   )r8   rf   r   r   s       r&   *test_unencryptedConnectionWithoutPasswordszASSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswords  s     

#023 #446$1&$9!0?!!-&&(&&(AAL>R "335#0#8 /B  ,%%'%%'AAL>Rr%   c                 &   t        j                         }t        j                         |_        t        | j                        |_        |j                          |j                  j                  d       |j                          | j                  |j                  j                  t        j                  dt        t        j                  f      z   t!        d      z   t!        d      z   fg       | j#                  |j                  j$                         y)z0
        Test that the login times out.
        鰚        s   you took too longr%   N)r   r   r   r   r   rU   rf   r   rZ   r   r   r   rh   MSG_DISCONNECTr   )DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLEr   
assertTruerg   r8   timeoutAuthServers     r&   test_loginTimeoutz(SSHUserAuthServerTests.test_loginTimeout  s     %668"&**,&3DKK&@#((*''5((*''// ,,YPPRST-./ g	
 	)33BBCr%   c                    t        j                         }t        j                         |_        t        | j                        |_        |j                          |j                          |j                  j                  d       | j                  |j                  j                  g        | j                  |j                  j                         y)zN
        Test that stopping the service also stops the login timeout.
        r  N)r   r   r   r   r   rU   rf   r   rZ   r   r   r   rh   assertFalserg   r  s     r&   test_cancelLoginTimeoutz.SSHUserAuthServerTests.test_cancelLoginTimeout  s     %668"&**,&3DKK&@#((*((*''5*44<<bA*44CCDr%   c           	          dj                  t        d      t        d      t        d      dt        d      g      }t        j                          j                  _        t        d      D ]B  } j                  j                  |      } j                  j
                  j                  d       D  fd	}j                  |      S )
zm
        Test that the server disconnects if the client fails authentication
        too many times.
        r%   r>   r_   r   r   r      r   c                     j                  j                  j                  j                  d   t        j                  dt        t        j                  f      z   t        d      z   t        d      z   f       y )Nr   r  s   too many bad authsr%   )r   r   r   rh   r	  r   r
  r   r   s    r&   r   z:SSHUserAuthServerTests.test_tooManyAttempts.<locals>.check1  sm    ))11"5,,YPPRST./0 g	r%   )
r   r   r   r   r   r   ranger   r   r   )r8   r   ir   r   s   `    r&   test_tooManyAttemptsz+SSHUserAuthServerTests.test_tooManyAttempts&  s    
 2f:r'{B{OUBvJWX $

r 	-A44V<AOO!!))!,	-
	 }}U##r%   c                    t        d      t        d      z   t        d      z   dz   t        d      z   }t        j                         | j                  _        | j                  j                  |      }|j                  | j                        S )zo
        If the user requests a service that we don't support, the
        authentication should fail.
        r>   r%   r   r   )r   r   r   r   r   r   r   r   r   s      r&   test_failIfUnknownServicez0SSHUserAuthServerTests.test_failIfUnknownService?  sh    
 Fbg%;7%?"V*L $

OO008}}T..//r%   c                     d } j                   j                  d|        j                   j                  dd        fd} j                  j                  ddd      } j                  |t              j                  |      S )aZ  
        tryAuth() has two edge cases that are difficult to reach.

        1) an authentication method auth_* returns None instead of a Deferred.
        2) an authentication type that is defined does not have a matching
           auth_* method.

        Both these cases should return a Deferred which fails with a
        ConchError.
        c                      y rH   r$   )r   s    r&   mockAuthz>SSHUserAuthServerTests.test_tryAuthEdgeCases.<locals>.mockAuthU  r   r%   auth_publickeyauth_passwordNc                 j    j                   j                  dd d       }j                  |t              S )Nr   )r   r   r   r   )r   d2r8   s     r&   
secondTestz@SSHUserAuthServerTests.test_tryAuthEdgeCases.<locals>.secondTest[  s.    ((dDAB%%b*55r%   r   )r   r   r   r   r   r   )r8   r  r!  d1s   `   r&   test_tryAuthEdgeCasesz,SSHUserAuthServerTests.test_tryAuthEdgeCasesI  sp    	 	

4??$4h?

4??OT:	6 __$$\4>!!"j1==jIIr%   )r    r!   r"   r#   r   skipr   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r  r  r  r#  r$   r%   r&   r   r      s}     |08

0$&0"$:14$.0"0(0,W"L*S4D0E$20Jr%   r   c                   r    e Zd ZdZedZd Zd Zd Zd Z	d Z
d	 Zd
 Zd Zd Zd Zd Zd Zd Zd Zd Zy)SSHUserAuthClientTestsz&
    Tests for SSHUserAuthClient.
    Nr   c                     t        dt        j                               | _        t        d       | j                  _        d| j                  j                  _        | j                  j                          y )Nr>   r   )r/   rU   r[   
authClientr   r   rZ   r7   s    r&   r   zSSHUserAuthClientTests.setUpk  sL    (1F1F1HI$1$$7!.5!!+&&(r%   c                 F    | j                   j                          d | _         y rH   )r(  r   r7   s    r&   r   zSSHUserAuthClientTests.tearDownq  r   r%   c                 t   | j                  | j                  j                  d       | j                  | j                  j                  j                  d       | j                  | j                  j
                  j                  t        j                  t        d      t        d      z   t        d      z   fg       y)z;
        Test that client is initialized properly.
        r>   rX   r_   N)
r   r(  r   instancerD   r   rh   r   r   r   r7   s    r&   	test_initz SSHUserAuthClientTests.test_initu  s     	--v61166AOO%%--++RZ"X,-FG-TUV	
r%   c                     dgfd}|| j                   j                  _        | j                   j                  d       | j	                  d   | j                   j
                         y)z9
        Test that the client succeeds properly.
        Nc                     | d<   y )Nr   r$   )r`   r+  s    r&   stubSetServicezDSSHUserAuthClientTests.test_USERAUTH_SUCCESS.<locals>.stubSetService  s    !HQKr%   r%   r   )r(  r   
setServicessh_USERAUTH_SUCCESSr   r+  )r8   r/  r+  s     @r&   test_USERAUTH_SUCCESSz,SSHUserAuthClientTests.test_USERAUTH_SUCCESS  sU     6	" 0>!!,,,S1!doo&>&>?r%   c           
         | j                   j                  t        d      dz          | j                  | j                   j                  j
                  d   t        j                  t        d      t        d      z   t        d      z   dz   t        d      z   t        t        j                  j                  t        j                        j                               z   f       | j                   j                  t        d      dz          t        t        j                  j                  t        j                        j                               }| j                  | j                   j                  j
                  d   t        j                  t        d      t        d      z   t        d      z   dz   t        d      z   |z   f       | j                   j                  t        d      t        t        j                  j                  t        j                        j                               z          t        | j                   j                  j                         t#        t        j                  f      z   t        d      z   t        d      z   t        d      z   dz   t        d      z   |z   }t        j                  j                  t        j$                        }| j                  | j                   j                  j
                  d   t        j                  t        d      t        d      z   t        d      z   dz   t        d      z   |z   t        |j'                  |            z   f       y	)
zJ
        Test that the client can authenticate with a public key.
        r   r   r   r>   rX   s   ssh-dssr      N)r(  ssh_USERAUTH_FAILUREr   r   r   rh   r   r   r   r2   r3   r   r6   rN   r4   ssh_USERAUTH_PK_OKr   r   r;   r   )r8   rN   r   r   s       r&   test_publickeyz%SSHUserAuthClientTests.test_publickey  s    	,,R-=-GHOO%%--b1--6
X,\"#  Z.	!
 TXX(()B)BCHHJKL	
 	,,R-=-GH$((%%g&?&?@EEGHOO%%--b1--vJl#&'  n	%
 
	
 	**zNR 3 3G4M4M N S S UVV	
 t((223X22456j l 	
  n  	 hh!!'"<"<=OO%%--b1--6
X,\"#  Z.	!
  SXXg&'(		
r%   c                    t        dt        j                               }t        d      |_        d|j                  _        |j                          |j                  d       g |j                  _        | j                  |j                  d             | j                  |j                  j                  t        j                  t        d      t        d      z   t        d      z   fg       y)z
        If the SSHUserAuthClient doesn't return anything from signData,
        the client should start the authentication over again by requesting
        'none' authentication.
        r>   Nr   r   r%   rX   r_   )rQ   rU   r[   r   r   rZ   r   rh   assertIsNoner6  r   r   r   r   )r8   r(  s     r&   !test_publickey_without_privatekeyz8SSHUserAuthClientTests.test_publickey_without_privatekey  s     19N9N9PQ
,T2
)0
&!!#<(')
$*77<=  ((++RZ"X,-FG-TUV	
r%   c                      d  j                   _         j                   j                  d      } fd}|j                  |      S )z{
        If there's no public key, auth_publickey should return a Deferred
        called back with a False value.
        c                      y rH   r$   r   s    r&   ry   z:SSHUserAuthClientTests.test_no_publickey.<locals>.<lambda>  rz   r%   r   c                 (    j                  |        y rH   )r  )resultr8   s    r&   r   z7SSHUserAuthClientTests.test_no_publickey.<locals>.check  s    V$r%   )r(  r9   r   r   )r8   r   r   s   `  r&   test_no_publickeyz(SSHUserAuthClientTests.test_no_publickey  s;    
 (6$OO##L1	% }}U##r%   c                    | j                   j                  t        d      dz          | j                  | j                   j                  j
                  d   t        j                  t        d      t        d      z   t        d      z   dz   t        d      z   f       | j                   j                  t        d      t        d      z          | j                  | j                   j                  j
                  d   t        j                  t        d      t        d      z   t        d      z   dz   t        d      dz  z   f       y	)
zx
        Test that the client can authentication with a password.  This
        includes changing the password.
        r   r   r   r>   rX   r%   r   r   N)	r(  r5  r   r   r   rh   r   r   r6  r7   s    r&   test_passwordz$SSHUserAuthClientTests.test_password  s    
 	,,R_w-FGOO%%--b1--6
R\)B{O;gE6
R	
 	**2c7RW+<=OO%%--b1--6
R\)B{O;gE6
UVV	
r%   c                 |    d | j                   _        | j                  | j                   j                  d             y)zK
        If getPassword returns None, tryAuth should return False.
        c                       y rH   r$   r$   r%   r&   ry   z9SSHUserAuthClientTests.test_no_password.<locals>.<lambda>  rz   r%   r   N)r(  rA   r  r   r7   s    r&   test_no_passwordz'SSHUserAuthClientTests.test_no_password  s-     '3#00=>r%   c                 V   | j                   j                  t        d      t        d      z   t        d      z   dz   t        d      z   dz          | j                  | j                   j                  j
                  d   t        j                  dt        d      z   t        d      z   f       y)	zj
        Make sure that the client can authenticate with the keyboard
        interactive method.
        r%   s      s
   Password: r   r   s      r>   N)r(  'ssh_USERAUTH_PK_OK_keyboard_interactiver   r   r   rh   r   MSG_USERAUTH_INFO_RESPONSEr7   s    r&   test_keyboardInteractivez/SSHUserAuthClientTests.test_keyboardInteractive  s    
 	??sGgg "" 	 
 	
 	OO%%--b133#bj02f:=	
r%   c                 V   d| j                   _        g | j                   j                  _        | j                   j	                  d       | j                  | j                   j                  j                  t        j                  t        d      t        d      z   t        d      z   fg       y)z
        If C{SSHUserAuthClient} gets a MSG_USERAUTH_PK_OK packet when it's not
        expecting it, it should fail the current authentication and move on to
        the next type.
        s   unknownr%   r>   rX   r_   N)	r(  lastAuthr   rh   r6  r   r   r   r   r7   s    r&   "test_USERAUTH_PK_OK_unknown_methodz9SSHUserAuthClientTests.test_USERAUTH_PK_OK_unknown_method  s|     $. ,.!!)**3/OO%%--++RZ"X,-FG-TUV	
r%   c                 J     fd} fd}| j                   _        | j                   _         j                   j                  t	        d      dz           j                   j                   j                  j                  d   t        j                  t	        d      t	        d      z   t	        d      z   dz   t	        d      z   f        j                   j                  t	        d	      d
z           j                   j                   j                  j                  dd ddg       y)z
        ssh_USERAUTH_FAILURE should sort the methods by their position
        in SSHUserAuthClient.preferredOrder.  Methods that are not in
        preferredOrder should be sorted at the end of that list.
        c                  R     j                   j                  j                  dd       y )N      here is datar(  r   rn   r7   s   r&   auth_firstmethodzNSSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting.<locals>.auth_firstmethod2  s    OO%%00oFr%   c                  R     j                   j                  j                  dd       y)N   
   other dataTrP  r7   s   r&   auth_anothermethodzPSSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting.<locals>.auth_anothermethod5  s     OO%%00mDr%   s   anothermethod,passwordr   r   r>   rX   r   s"   firstmethod,anothermethod,passwordr   N)rN  rO  )rS  rT  )
r(  rQ  rU  r5  r   r   r   rh   r   r   )r8   rQ  rU  s   `  r&   test_USERAUTH_FAILURE_sortingz4SSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting+  s    	G	 ,<(-?* 	,,R0I-JW-TUOO%%--b1--6
R\)B{O;gE6
R	
 	,,45?	
 	OO%%--bc2#%9:	
r%   c                 D   | j                   j                  t        d      dz          | j                   j                  t        d      dz          | j                  | j                   j                  j
                  d   t        j                  dt        d      z   dz   f       y)	z
        If there are no more available user authentication messages,
        the SSHUserAuthClient should disconnect with code
        DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE.
        r   r   r   r   s      s(   no more authentication methods availables       N)r(  r5  r   r   r   rh   r	  r7   s    r&   %test_disconnectIfNoMoreAuthenticationz<SSHUserAuthClientTests.test_disconnectIfNoMoreAuthenticationO  s     	,,R_w-FG,,R_w-FGOO%%--b1((#@AB%&	
r%   c                 4   g | j                   j                  _        | j                   j                  d       | j	                  | j                   j                  j                  t
        j                  t        d      t        d      z   t        d      z   fg       y)z
        _ebAuth (the generic authentication error handler) should send
        a request for the 'none' authentication method.
        Nr>   rX   r_   )r(  r   rh   _ebAuthr   r   r   r   r7   s    r&   test_ebAuthz"SSHUserAuthClientTests.test_ebAutha  sp    
 -/!!)%OO%%--++RZ"X,-FG-TUV	
r%   c                 .    t        j                  dt        j                                j	                  j                                 fd} fdd j                         }|j                   j                        j                  |      S )z
        getPublicKey() should return None.  getPrivateKey() should return a
        failed Deferred.  getPassword() should return a failed Deferred.
        getGenericAnswers() should return a failed Deferred.
        r>   c                     | j                  t               j                         }|j                  j                        j                        S rH   )trapNotImplementedErrorrA   r   r   
addErrback)r>  r   r(  check2r8   s     r&   r   z3SSHUserAuthClientTests.test_defaults.<locals>.checkv  s<    KK+,&&(A==+66v>>r%   c                     | j                  t               j                  d d d       }|j                  j                        j                        S rH   )r_  r`  rG   r   r   ra  )r>  r   r(  check3r8   s     r&   rb  z4SSHUserAuthClientTests.test_defaults.<locals>.check2{  sB    KK+,,,T4>A==+66v>>r%   c                 .    | j                  t               y rH   )r_  r`  )r>  s    r&   rd  z4SSHUserAuthClientTests.test_defaults.<locals>.check3  s    KK+,r%   )
r   r-   rU   r[   r9  r9   r<   r   r   ra  )r8   r   r   r(  rb  rd  s   `  @@@r&   test_defaultsz$SSHUserAuthClientTests.test_defaultsm  st     //8M8M8OP
*1134	?
	?
	- $$&}}TYY'22599r%   )r    r!   r"   r#   r   r$  r   r   r,  r2  r7  r:  r?  rA  rD  rH  rK  rW  rY  r\  rf  r$   r%   r&   r&  r&  c  sa     |0)	
@<
|
&$
,?
*
"
H
$

:r%   r&  c                   .    e Zd ZedZ G d d      Zd Zy)LoopbackTestsNr   c                   &    e Zd Z G d d      Zd Zy)LoopbackTests.Factoryc                       e Zd ZdZd Zd Zy)LoopbackTests.Factory.Service   TestServicec                 8    | j                   j                          y rH   )r   rt   r7   s    r&   rZ   z,LoopbackTests.Factory.Service.serviceStarted  s    --/r%   c                      y rH   r$   r7   s    r&   r   z,LoopbackTests.Factory.Service.serviceStopped  s    r%   N)r    r!   r"   rD   rZ   r   r$   r%   r&   r[   rl    s    !D0r%   r[   c                     | j                   S rH   )r[   )r8   avatarrD   s      r&   ra   z LoopbackTests.Factory.getService  s    <<r%   N)r    r!   r"   r[   ra   r$   r%   r&   rb   rj    s    	 		 r%   rb   c                 Z    t        j                         t        d j                  j	                               }t        j                         _        j
                  _        d j
                  _        t        j                         |_        ||j
                  _        dxj
                  _	        |j
                  _	        d xj
                  _
        |j
                  _
         j                         j
                  _        d_        t               }t        |      }t               j!                  t#                      j!                  t%                      fd_        |j!                         |j
                  j                  _        t+        j,                  j
                  |j
                        }d j
                  j
                  _        d |j
                  j
                  _        j1                          |j1                           fd	}|j3                  |      S )
zW
        Test that the userauth server and client play nicely with each other.
        r>   c                      yrs   r$   r   s    r&   ry   z-LoopbackTests.test_loopback.<locals>.<lambda>  rz   r%   r%   c                       y rH   r$   r$   r%   r&   ry   z-LoopbackTests.test_loopback.<locals>.<lambda>  rz   r%   r   c                 :    t        j                  |          dk(  S )Nr   )lensuccessfulCredentials)aIdcheckers    r&   ry   z-LoopbackTests.test_loopback.<locals>.<lambda>  s    s7+H+H+M'NRS'S r%   c                       y)N_ServerLoopbackr$   r$   r%   r&   ry   z-LoopbackTests.test_loopback.<locals>.<lambda>  rz   r%   c                       y)N_ClientLoopbackr$   r$   r%   r&   ry   z-LoopbackTests.test_loopback.<locals>.<lambda>  rz   r%   c                 f    j                  j                  j                  j                  d       y )Nrm  )r   r   r`   rD   )r   r8   r   s    r&   r   z*LoopbackTests.test_loopback.<locals>.check  s%    V--55::NKr%   )r   r   r/   rb   r[   r   r'   r`   rq   r   sendKexInitre   passwordDelayrv   r   r   r   r   r   areDonerf   r   loopbackAsync	logPrefixrZ   r   )r8   clientr   rf   r   r   ry  r   s   `     @@r&   test_loopbackzLoopbackTests.test_loopback  s    ++-(<(<(>? %557#) '5$$557#) BEE"V%5%5%?FRR$v'7'7'C $(<<>  $& 12 1 34Tw'*0  '""6#3#3V5E5EF/H"",/H"",	L }}U##r%   )r    r!   r"   r   r$  rb   r  r$   r%   r&   rh  rh    s    |0   '$r%   rh  c                       e Zd ZedZd Zy)ModuleInitializationTestsNr   c                     | j                  t        j                  j                  d   d       | j                  t        j                  j                  d   d       y )N<   r   )r   r   r   protocolMessagesr-   r7   s    r&   test_messagesz'ModuleInitializationTests.test_messages  sP     	&&77;=Q	
 	&&77;=Q	
r%   )r    r!   r"   r   r$  r  r$   r%   r&   r  r    s    |0
r%   r  )8r#   typesr   typingr   zope.interfacer   twisted.conch.errorr   r   twisted.cred.checkersr   twisted.cred.credentialsr	   r
   r   twisted.cred.errorr   twisted.cred.portalr   r   twisted.internetr   r   twisted.protocolsr   twisted.python.reflectr   twisted.trialr   r   __annotations__twisted.conch.checkersr   twisted.conch.sshr   r   twisted.conch.ssh.commonr   twisted.conch.testr   r-   r/   rJ   rQ   r'   rU   rv   r   r   r   TestCaser   r&  rh  r  r$   r%   r&   <module>r     s     & : 5 R R 0 . ( & 0 "!hz ! 9;;+*   -X//  -F
EH.. 
E	>("<"< 	>>#I.. >#B V	B 	B 	B  !O O "O  !" " ""&  !	 	 "	xJX.. xJva:X.. a:H	8$H%% 8$v
 1 1 
r%   