
    tf                     n   U d Z ddlmZ ddlmZ ddlmZ ddlmZm	Z	 ddl
mZ ddlmZmZmZ ddlmZ dd	lmZmZ dd
lmZmZ ddlmZ ddlmZ ddlmZ dZee         ed<    ed          rddl m!Z! ddl"mZm#Z#m$Z$ ddl%m&Z& ddl'm(Z( n G d d          Z# G d d          Z$ G d de$j)                  Z* G d de$j)                  Z+ G d de$j)                  Z, G d d e#j-                  Z. ee           G d! d"                      Z/ ee           G d# d$                      Z0 ee           G d% d&                      Z1 ee           G d' d(                      Z2 G d) d*ej3                  Z4 G d+ d,ej3                  Z5 G d- d.ej3                  Z6 G d/ d0ej3                  Z7dS )1zT
Tests for the implementation of the ssh-userauth service.

Maintainer: Paul Swartz
    )
ModuleType)Optional)implementer)
ConchErrorValidPublicKey)ICredentialsChecker)
IAnonymousISSHPrivateKeyIUsernamePassword)UnauthorizedLogin)IRealmPortal)defertask)loopback)requireModule)unittestNkeyscryptography)SSHProtocolChecker)r   	transportuserauth)NS)keydatac                   (    e Zd Z G d d          ZdS )r   c                       e Zd ZdZdS )transport.SSHTransportBaseQ
            A stub class so that later class definitions won't die.
            N__name__
__module____qualname____doc__     _/var/www/surfInsights/venv3-11/lib/python3.11/site-packages/twisted/conch/test/test_userauth.pySSHTransportBaser   "              r%   r'   N)r    r!   r"   r'   r$   r%   r&   r   r   !   <        	 	 	 	 	 	 	 	 	 	r%   r   c                   (    e Zd Z G d d          ZdS )r   c                       e Zd ZdZdS )userauth.SSHUserAuthClientr   Nr   r$   r%   r&   SSHUserAuthClientr,   (   r(   r%   r-   N)r    r!   r"   r-   r$   r%   r&   r   r   '   r)   r%   r   c                   ,    e Zd ZdZd Zd ZddZd ZdS )ClientUserAuthz"
    A mock user auth client.
    c                     | j         r)t          j                            t          j                  S t          j        t          j                            t          j                            S )z
        If this is the first time we've been called, return a blob for
        the DSA key.  Otherwise, return a blob
        for the RSA key.
        )	lastPublicKeyr   Key
fromStringr   publicRSA_opensshr   succeedpublicDSA_opensshselfs    r&   getPublicKeyzClientUserAuth.getPublicKey3   sL      	Q8&&w'@AAA=!4!4W5N!O!OPPPr%   c                 x    t          j        t          j                            t
          j                            S )z@
        Return the private key object for the RSA key.
        )r   r5   r   r2   r3   r   privateRSA_opensshr7   s    r&   getPrivateKeyzClientUserAuth.getPrivateKey>   s'     }TX001KLLMMMr%   Nc                 *    t          j        d          S )z/
        Return 'foo' as the password.
           foor   r5   )r8   prompts     r&   getPasswordzClientUserAuth.getPasswordD   s     }V$$$r%   c                 *    t          j        d          S )z>
        Return 'foo' as the answer to two questions.
        )foorC   r?   )r8   nameinformationanswerss       r&   getGenericAnswersz ClientUserAuth.getGenericAnswersJ   s     }^,,,r%   N)r    r!   r"   r#   r9   r<   rA   rG   r$   r%   r&   r/   r/   .   se         	Q 	Q 	QN N N% % % %- - - - -r%   r/   c                       e Zd ZdZd Zd ZdS )OldClientAuthz~
    The old SSHUserAuthClient returned a cryptography key object from
    getPrivateKey() and a string from getPublicKey
    c                     t          j        t          j                            t
          j                  j                  S rH   )r   r5   r   r2   r3   r   r;   	keyObjectr7   s    r&   r<   zOldClientAuth.getPrivateKeyW   s(    }TX001KLLVWWWr%   c                 x    t           j                            t          j                                                  S rH   )r   r2   r3   r   r4   blobr7   s    r&   r9   zOldClientAuth.getPublicKeyZ   s'    x""7#<==BBDDDr%   Nr    r!   r"   r#   r<   r9   r$   r%   r&   rJ   rJ   Q   sD         
X X XE E E E Er%   rJ   c                       e Zd ZdZd Zd ZdS )ClientAuthWithoutPrivateKeyzP
    This client doesn't have a private key, but it does have a public key.
    c                     d S rH   r$   r7   s    r&   r<   z)ClientAuthWithoutPrivateKey.getPrivateKeyc   s    r%   c                 T    t           j                            t          j                  S rH   )r   r2   r3   r   r4   r7   s    r&   r9   z(ClientAuthWithoutPrivateKey.getPublicKeyf   s    x""7#<===r%   NrO   r$   r%   r&   rQ   rQ   ^   s<           > > > > >r%   rQ   c                   ^    e Zd ZdZ G d d          Z G d d          Zd Zd Zd Zd	 Z	d
S )FakeTransporta_  
    L{userauth.SSHUserAuthServer} expects an SSH transport which has a factory
    attribute which has a portal attribute. Because the portal is important for
    testing authentication, we need to be able to provide an interesting portal
    object to the L{SSHUserAuthServer}.

    In addition, we want to be able to capture any packets sent over the
    transport.

    @ivar packets: a list of 2-tuples: (messageType, data).  Each 2-tuple is
        a sent packet.
    @type packets: C{list}
    @param lostConnecion: True if loseConnection has been called on us.
    @type lostConnection: L{bool}
    c                       e Zd ZdZdZd ZdS )FakeTransport.ServicezW
        A mock service, representing the other service offered by the server.
           nancyc                     d S rH   r$   r7   s    r&   serviceStartedz$FakeTransport.Service.serviceStarted   s    Dr%   N)r    r!   r"   r#   rD   rZ   r$   r%   r&   ServicerW   {   s4        	 	 	 	 	 	 	r%   r[   c                       e Zd ZdZd ZdS )FakeTransport.Factoryzg
        A mock factory, representing the factory that spawned this user auth
        service.
        c                 *    |dk    rt           j        S dS )z2
            Return our fake service.
               noneN)rU   r[   )r8   r   services      r&   
getServicez FakeTransport.Factory.getService   s      '!!$,, "!r%   N)r    r!   r"   r#   ra   r$   r%   r&   Factoryr]      s-        	 	
	- 	- 	- 	- 	-r%   rb   c                 z    |                                  | _        || j        _        d| _        | | _        g | _        d S NF)rb   factoryportallostConnectionr   packets)r8   rf   s     r&   __init__zFakeTransport.__init__   s5    ||~~$#r%   c                 >    | j                             ||f           dS )z8
        Record the packet sent by the service.
        N)rh   append)r8   messageTypemessages      r&   
sendPacketzFakeTransport.sendPacket   s%     	['233333r%   c                     dS )z
        Pretend that this transport encrypts traffic in both directions. The
        SSHUserAuthServer disables password authentication if the transport
        isn't encrypted.
        Tr$   )r8   	directions     r&   isEncryptedzFakeTransport.isEncrypted   s	     tr%   c                     d| _         d S NT)rg   r7   s    r&   loseConnectionzFakeTransport.loseConnection   s    "r%   N)
r    r!   r"   r#   r[   rb   ri   rn   rq   rt   r$   r%   r&   rU   rU   j   s                 - - - - - - - -  4 4 4  # # # # #r%   rU   c                       e Zd ZdZd ZdS )Realmz
    A mock realm for testing L{userauth.SSHUserAuthServer}.

    This realm is not actually used in the course of testing, so it returns the
    simplest thing that could possibly work.
    c                 >    t          j        |d         d d f          S )Nr   c                      d S rH   r$   r$   r%   r&   <lambda>z%Realm.requestAvatar.<locals>.<lambda>   s    4 r%   r?   )r8   avatarIdmind
interfacess       r&   requestAvatarzRealm.requestAvatar   s    }jmT<<@AAAr%   N)r    r!   r"   r#   r}   r$   r%   r&   rv   rv      s2         B B B B Br%   rv   c                       e Zd ZdZefZd ZdS )PasswordCheckerz
    A very simple username/password checker which authenticates anyone whose
    password matches their username and rejects all others.
    c                     |j         |j        k    rt          j        |j                   S t          j        t          d                    S )NzInvalid username/password pair)usernamepasswordr   r5   failr   )r8   credss     r&   requestAvatarIdzPasswordChecker.requestAvatarId   s=    >U^++=000z+,LMMNNNr%   N)r    r!   r"   r#   r   credentialInterfacesr   r$   r%   r&   r   r      s=         
 ./O O O O Or%   r   c                       e Zd ZdZefZd ZdS )PrivateKeyCheckerz
    A very simple public key checker which authenticates anyone whose
    public/private keypair is the same keydata.public/privateRSA_openssh.
    c                 h   |j         t          j                            t          j                                                   k    ra|j        Lt          j                            |j                   }|                    |j        |j                  r|j	        S nt                      t                      rH   )rN   r   r2   r3   r   r4   	signatureverifysigDatar   r   r   )r8   r   objs      r&   r   z!PrivateKeyChecker.requestAvatarId   s    :,,W-FGGLLNNNN*h))%*55::eou}== * >)* %&&&!!!r%   N)r    r!   r"   r#   r
   r   r   r$   r%   r&   r   r      s8         
 +," " " " "r%   r   c                       e Zd ZdZefZd ZdS )AnonymousCheckerzI
    A simple checker which isn't supported by L{SSHUserAuthServer}.
    c                     d S rH   r$   )r8   credentialss     r&   r   z AnonymousChecker.requestAvatarId   s    r%   N)r    r!   r"   r#   r	   r   r   r$   r%   r&   r   r      s7          '=    r%   r   c                       e Zd ZdZedZd Zd Zd Zd Z	d Z
d	 Zd
 Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd ZdS )SSHUserAuthServerTestsz&
    Tests for SSHUserAuthServer.
    Ncannot run without cryptographyc                    t                      | _        t          | j                  | _        | j                            t                                 | j                            t                                 t          j                    | _	        t          | j                  | j	        _        | j	                                         | j	        j                                         d S rH   )rv   realmr   rf   registerCheckerr   r   r   SSHUserAuthServer
authServerrU   r   rZ   supportedAuthenticationssortr7   s    r&   setUpzSSHUserAuthServerTests.setUp   s    WW
TZ((##O$5$5666##$5$7$7888"466$1$+$>$>!&&(((05577777r%   c                 F    | j                                          d | _         d S rH   )r   serviceStoppedr7   s    r&   tearDownzSSHUserAuthServerTests.tearDown   !    &&(((r%   c                     |                      | j        j        j        d         t          j        t          d          dz   f           dS )z;
        Check that the authentication has failed.
        s   password,publickey    N)assertEqualr   r   rh   r   MSG_USERAUTH_FAILUREr   r8   ignoreds     r&   _checkFailedz#SSHUserAuthServerTests._checkFailed   sO     	O%-b1*B/D,E,E,OP	
 	
 	
 	
 	
r%   c                     | j                             t          d          t          d          z   t          d          z             }|                    | j                  S )z
        A client may request a list of authentication 'method name' values
        that may continue by using the "none" authentication 'method name'.

        See RFC 4252 Section 5.2.
        r>   s   servicer_   )r   ssh_USERAUTH_REQUESTr   addCallbackr   )r8   ds     r&   test_noneAuthenticationz.SSHUserAuthServerTests.test_noneAuthentication  sQ     O00vJJJ'"W++5
 
 }}T.///r%   c           	          d                     t          d          t          d          t          d          dt          d          g          } j                            |          } fd}|                    |          S )z
        When provided with correct password authentication information, the
        server should respond by sending a MSG_USERAUTH_SUCCESS message with
        no other data.

        See RFC 4252, Section 5.1.
        r%   r>   r_      passwordr   c                 l                         j        j        j        t          j        dfg           d S Nr%   r   r   r   rh   r   MSG_USERAUTH_SUCCESSr   r8   s    r&   checkzKSSHUserAuthServerTests.test_successfulPasswordAuthentication.<locals>.check  >    )1/56    r%   )joinr   r   r   r   )r8   packetr   r   s   `   r&   %test_successfulPasswordAuthenticationz<SSHUserAuthServerTests.test_successfulPasswordAuthentication  s{     2f::r'{{B{OOUBvJJWXXO0088	 	 	 	 	 }}U###r%   c           	         d                     t          d          t          d          t          d          dt          d          g          }t          j                    | j        _        | j                            |          }|                     | j        j        j	        g            | j        j        
                    d           |                    | j                  S )a;  
        When provided with invalid authentication details, the server should
        respond by sending a MSG_USERAUTH_FAILURE message which states whether
        the authentication was partially successful, and provides other, open
        options for authentication.

        See RFC 4252, Section 5.1.
        r%   r>   r_   r   r      bar   )r   r   r   Clockr   clockr   r   r   rh   advancer   r   r8   r   r   s      r&   !test_failedPasswordAuthenticationz8SSHUserAuthServerTests.test_failedPasswordAuthentication'  s     2f::r'{{B{OOUBvJJWXX $
O00882:B???%%a(((}}T.///r%   c                     t           j                            t          j                                                  }t           j                            t          j                  }t          d          t          d          z   t          d          z   dz   t          |                                          z   t          |          z   }d j	        j
        _        |                    t          d          t          t          j        f          z   |z             }|t          |          z  } j	                            |          } fd}|                    |          S )zN
        Test that private key authentication completes successfully,
        r>   r_   	   publickey      testc                 l                         j        j        j        t          j        dfg           d S r   r   r   s    r&   r   zMSSHUserAuthServerTests.test_successfulPrivateKeyAuthentication.<locals>.checkM  r   r%   )r   r2   r3   r   r4   rN   r;   r   sshTyper   r   	sessionIDsignbytesr   MSG_USERAUTH_REQUESTr   r   )r8   rN   r   r   r   r   r   s   `      r&   'test_successfulPrivateKeyAuthenticationz>SSHUserAuthServerTests.test_successfulPrivateKeyAuthentication8  s8    x""7#<==BBDDh!!'"<==vJJkk  	 
 hh 	 /6!+HHwKK%!> @AAAFJ
 
	 	"Y--O0088	 	 	 	 	 }}U###r%   c                    t          j                    d }d }fd}|                     | j        d|           |                     | j        d|           |                     | j        d|           t	          d          t	          d          z   t	          d	          z   t	          d
          z   }| j                            |           |                     t                    S )z
        ssh_USERAUTH_REQUEST should raise a ConchError if tryAuth returns
        None. Added to catch a bug noticed by pyflakes.
        c                 0    |                      d           d S )Nz&request should have raised ConochError)r   r   s     r&   mockCbFinishedAuthzOSSHUserAuthServerTests.test_requestRaisesConchError.<locals>.mockCbFinishedAuth\  s    II>?????r%   c                     d S rH   r$   )kinduserdatas      r&   mockTryAuthzHSSHUserAuthServerTests.test_requestRaisesConchError.<locals>.mockTryAuth_      4r%   c                 <                         | j                   d S rH   )errbackvalue)reasonr   s    r&   mockEbBadAuthzJSSHUserAuthServerTests.test_requestRaisesConchError.<locals>.mockEbBadAuthb  s    IIfl#####r%   tryAuth_cbFinishedAuth
_ebBadAuths   userr_   s
   public-keys   data)r   Deferredpatchr   r   r   assertFailurer   )r8   r   r   r   r   r   s        @r&   test_requestRaisesConchErrorz3SSHUserAuthServerTests.test_requestRaisesConchErrorU  s    
 N	@ 	@ 	@	 	 		$ 	$ 	$ 	$ 	$ 	

4?I{;;;

4?$57IJJJ

4?L-@@@Gr'{{*R->->>GL 	,,V444!!!Z000r%   c                     t           j                            t          j                                                  t          d          t          d          z   t          d          z   dz   t          d          z   t                    z   } j                            |          } fd}|	                    |          S )z@
        Test that verifying a valid private key works.
        r>   r_   r   r      ssh-rsac                                          j        j        j        t          j        t          d          t                    z   fg           d S )Nr   )r   r   r   rh   r   MSG_USERAUTH_PK_OKr   )r   rN   r8   s    r&   r   z@SSHUserAuthServerTests.test_verifyValidPrivateKey.<locals>.check~  sO    )1-r*~~4/HIJ    r%   )
r   r2   r3   r   r4   rN   r   r   r   r   )r8   r   r   r   rN   s   `   @r&   test_verifyValidPrivateKeyz1SSHUserAuthServerTests.test_verifyValidPrivateKeyo  s     x""7#<==BBDDvJJkk  nn	
 hh 	 O0088	 	 	 	 	 	 }}U###r%   c                    t           j                            t          j                                                  }t          d          t          d          z   t          d          z   dz   t          d          z   t          |          z   }| j                            |          }|	                    | j
                  S )d
        Test that private key authentication fails when the public key
        is invalid.
        r>   r_   r   r   s   ssh-dsar   r2   r3   r   r6   rN   r   r   r   r   r   r8   rN   r   r   s       r&   3test_failedPrivateKeyAuthenticationWithoutSignaturezJSSHUserAuthServerTests.test_failedPrivateKeyAuthenticationWithoutSignature  s    
 x""7#<==BBDDvJJkk  nn	
 hh 	 O0088}}T.///r%   c                 >   t           j                            t          j                                                  }t           j                            t          j                  }t          d          t          d          z   t          d          z   dz   t          d          z   t          |          z   t          |                    |                    z   }d| j	        j
        _        | j	                            |          }|                    | j                  S )r   r>   r_   r   r   r   r   )r   r2   r3   r   r4   rN   r;   r   r   r   r   r   r   r   r   )r8   rN   r   r   r   s        r&   0test_failedPrivateKeyAuthenticationWithSignaturezGSSHUserAuthServerTests.test_failedPrivateKeyAuthenticationWithSignature  s    
 x""7#<==BBDDh!!'"<==vJJkk  nn	
 hh $  ! 	 /6!+O0088}}T.///r%   c                    t           j                            t          j                                                  }t          d          |dd         z   }t          d          t          d          z   t          d          z   dz   t          d          z   t          |          z   }| j                            |          }|	                    | j
                  S )	z
        Private key authentication fails when the public key type is
        unsupported or the public key is corrupt.
        s   ssh-bad-type   Nr>   r_   r   r   r   r   r   s       r&   test_unsupported_publickeyz1SSHUserAuthServerTests.test_unsupported_publickey  s    
 x""7#<==BBDD /""T"##Y. vJJkk  nn	
 hh 	 O0088}}T.///r%   c                 f   t          j                    }t          | j                  |_        | j                            t                                 |                                 |                                 |j	        
                                 |                     |j	        ddg           dS )ah  
        L{SSHUserAuthServer} sets up
        C{SSHUserAuthServer.supportedAuthentications} by checking the portal's
        credentials interfaces and mapping them to SSH authentication method
        strings.  If the Portal advertises an interface that
        L{SSHUserAuthServer} can't map, it should be ignored.  This is a white
        box test.
        r   r   N)r   r   rU   rf   r   r   r   rZ   r   r   r   r   )r8   servers     r&    test_ignoreUnknownCredInterfacesz7SSHUserAuthServerTests.test_ignoreUnknownCredInterfaces  s     +--(55##$4$6$6777',,...8;:UVVVVVr%   c                 6   |                      d| j        j                   t          j                    }t          | j                  |_        d |j        _        |	                                 |
                                 |                     d|j                   t          j                    }t          | j                  |_        d |j        _        |	                                 |
                                 |                      d|j                   dS )z
        Test that the userauth service does not advertise password
        authentication if the password would be send in cleartext.
        r   c                     dS rd   r$   xs    r&   ry   zISSHUserAuthServerTests.test_removePasswordIfUnencrypted.<locals>.<lambda>      % r%   c                     | dk    S Ninr$   r   s    r&   ry   zISSHUserAuthServerTests.test_removePasswordIfUnencrypted.<locals>.<lambda>  
    d r%   N)assertInr   r   r   r   rU   rf   r   rq   rZ   r   assertNotIn)r8   clearAuthServerhalfAuthServers      r&    test_removePasswordIfUnencryptedz7SSHUserAuthServerTests.test_removePasswordIfUnencrypted  s    
 	k4?#KLLL"466$1$+$>$>!0?!-&&(((&&(((o&NOOO!355#0#=#= /B/B ,%%'''%%'''k>#JKKKKKr%   c                 P   t          | j                  }|                    t                                 t	          j                    }t          |          |_        d |j        _        |	                                 |
                                 |                     |j        dg           t	          j                    }t          |          |_        d |j        _        |	                                 |
                                 |                     |j        dg           dS )z
        If the L{SSHUserAuthServer} is not advertising passwords, then an
        unencrypted connection should not cause any warnings or exceptions.
        This is a white box test.
        c                     dS rd   r$   r   s    r&   ry   zSSSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswords.<locals>.<lambda>  r   r%   r   c                     | dk    S r   r$   r   s    r&   ry   zSSSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswords.<locals>.<lambda>  r   r%   N)r   r   r   r   r   r   rU   r   rq   rZ   r   r   r   )r8   rf   r   r   s       r&   *test_unencryptedConnectionWithoutPasswordszASSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswords  s    
##022333 #466$1&$9$9!0?!-&&(((&&(((AL>RRR "355#0#8#8 /B/B ,%%'''%%'''AL>RRRRRr%   c                     t          j                    }t          j                    |_        t          | j                  |_        |                                 |j        	                    d           |
                                 |                     |j        j        t          j        dt          t          j        f          z   t!          d          z   t!          d          z   fg           |                     |j        j                   dS )z0
        Test that the login times out.
        鰚        s   you took too longr%   N)r   r   r   r   r   rU   rf   r   rZ   r   r   r   rh   MSG_DISCONNECTr   )DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLEr   
assertTruerg   r8   timeoutAuthServers     r&   test_loginTimeoutz(SSHUserAuthServerTests.test_loginTimeout  s     %688"&*,,&3DK&@&@#((***''555((***'/ ,YPRSST-../ gg	
 	
 	
 	)3BCCCCCr%   c                    t          j                    }t          j                    |_        t          | j                  |_        |                                 |	                                 |j        
                    d           |                     |j        j        g            |                     |j        j                   dS )zN
        Test that stopping the service also stops the login timeout.
        r  N)r   r   r   r   r   rU   rf   r   rZ   r   r   r   rh   assertFalserg   r  s     r&   test_cancelLoginTimeoutz.SSHUserAuthServerTests.test_cancelLoginTimeout  s     %688"&*,,&3DK&@&@#((***((***''555*4<bAAA*4CDDDDDr%   c           	          d                     t          d          t          d          t          d          dt          d          g          }t          j                     j        _        t          d          D ];} j                            |          } j        j                            d           < fd	}|	                    |          S )
zm
        Test that the server disconnects if the client fails authentication
        too many times.
        r%   r>   r_   r   r   r      r   c                                          j        j        j        d         t          j        dt          t          j        f          z   t          d          z   t          d          z   f           d S )Nr   r  s   too many bad authsr%   )r   r   r   rh   r	  r   r
  r   r   s    r&   r   z:SSHUserAuthServerTests.test_tooManyAttempts.<locals>.check1  s{    )1"5,YPRSST.//0 gg	 	 	 	 	r%   )
r   r   r   r   r   r   ranger   r   r   )r8   r   ir   r   s   `    r&   test_tooManyAttemptsz+SSHUserAuthServerTests.test_tooManyAttempts&  s    
 2f::r'{{B{OOUBvJJWXX $
r 	- 	-A44V<<AO!))!,,,,
	 
	 
	 
	 
	 }}U###r%   c                 (   t          d          t          d          z   t          d          z   dz   t          d          z   }t          j                    | j        _        | j                            |          }|                    | j                  S )zo
        If the user requests a service that we don't support, the
        authentication should fail.
        r>   r%   r   r   )r   r   r   r   r   r   r   r   r   s      r&   test_failIfUnknownServicez0SSHUserAuthServerTests.test_failIfUnknownService?  so    
 Fbgg%;7%?"V**L $
O0088}}T.///r%   c                     d }                       j        d|                                  j        dd            fd} j                            ddd          }                     |t                                        |          S )aZ  
        tryAuth() has two edge cases that are difficult to reach.

        1) an authentication method auth_* returns None instead of a Deferred.
        2) an authentication type that is defined does not have a matching
           auth_* method.

        Both these cases should return a Deferred which fails with a
        ConchError.
        c                     d S rH   r$   )r   s    r&   mockAuthz>SSHUserAuthServerTests.test_tryAuthEdgeCases.<locals>.mockAuthU  r   r%   auth_publickeyauth_passwordNc                 r    j                             dd d           }                    |t                    S )Nr   )r   r   r   r   )r   d2r8   s     r&   
secondTestz@SSHUserAuthServerTests.test_tryAuthEdgeCases.<locals>.secondTest[  s2    ((dDAAB%%b*555r%   r   )r   r   r   r   r   r   )r8   r  r!  d1s   `   r&   test_tryAuthEdgeCasesz,SSHUserAuthServerTests.test_tryAuthEdgeCasesI  s    	 	 	 	

4?$4h???

4?OT:::	6 	6 	6 	6 	6 _$$\4>>!!"j11==jIIIr%   )r    r!   r"   r#   r   skipr   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r  r  r  r#  r$   r%   r&   r   r      sj         |08 8 8  
 
 

0 
0 
0$ $ $&0 0 0"$ $ $:1 1 14$ $ $.0 0 0"0 0 0(0 0 0,W W W"L L L*S S S4D D D0E E E$ $ $20 0 0J J J J Jr%   r   c                   t    e Zd ZdZedZd Zd Zd Zd Z	d Z
d	 Zd
 Zd Zd Zd Zd Zd Zd Zd Zd ZdS )SSHUserAuthClientTestsz&
    Tests for SSHUserAuthClient.
    Nr   c                     t          dt                                                    | _        t          d           | j        _        d| j        j        _        | j                                         d S )Nr>   r   )r/   rU   r[   
authClientr   r   rZ   r7   s    r&   r   zSSHUserAuthClientTests.setUpk  sX    (1F1F1H1HII$1$$7$7!.5!+&&(((((r%   c                 F    | j                                          d | _         d S rH   )r(  r   r7   s    r&   r   zSSHUserAuthClientTests.tearDownq  r   r%   c                 N   |                      | j        j        d           |                      | j        j        j        d           |                      | j        j        j        t          j        t          d          t          d          z   t          d          z   fg           dS )z;
        Test that client is initialized properly.
        r>   rX   r_   N)
r   r(  r   instancerD   r   rh   r   r   r   r7   s    r&   	test_initz SSHUserAuthClientTests.test_initu  s     	-v66616AAAO%-+RZZ"X,,-FG-TUV	
 	
 	
 	
 	
r%   c                     dgfd}|| j         j        _        | j                             d           |                     d         | j         j                   dS )z9
        Test that the client succeeds properly.
        Nc                     | d<   d S )Nr   r$   )r`   r+  s    r&   stubSetServicezDSSHUserAuthClientTests.test_USERAUTH_SUCCESS.<locals>.stubSetService  s    !HQKKKr%   r%   r   )r(  r   
setServicessh_USERAUTH_SUCCESSr   r+  )r8   r/  r+  s     @r&   test_USERAUTH_SUCCESSz,SSHUserAuthClientTests.test_USERAUTH_SUCCESS  so     6	" 	" 	" 	" 	" 0>!,,,S111!do&>?????r%   c           
         | j                             t          d          dz              |                     | j         j        j        d         t          j        t          d          t          d          z   t          d          z   dz   t          d          z   t          t          j	        
                    t          j                                                            z   f           | j                             t          d          dz              t          t          j	        
                    t          j                                                            }|                     | j         j        j        d         t          j        t          d          t          d          z   t          d          z   dz   t          d          z   |z   f           | j                             t          d          t          t          j	        
                    t          j                                                            z              t          | j         j        j                  t#          t          j        f          z   t          d          z   t          d          z   t          d          z   dz   t          d          z   |z   }t          j	        
                    t          j                  }|                     | j         j        j        d         t          j        t          d          t          d          z   t          d          z   dz   t          d          z   |z   t          |                    |                    z   f           d	S )
zJ
        Test that the client can authenticate with a public key.
        r   r   r   r>   rX   s   ssh-dssr      N)r(  ssh_USERAUTH_FAILUREr   r   r   rh   r   r   r   r2   r3   r   r6   rN   r4   ssh_USERAUTH_PK_OKr   r   r;   r   )r8   rN   r   r   s       r&   test_publickeyz%SSHUserAuthClientTests.test_publickey  s1    	,,R-=-=-GHHHO%-b1-6

X,,\""#  Z..	!
 TX(()BCCHHJJKKL	
 	
 	
 	,,R-=-=-GHHH$(%%g&?@@EEGGHHO%-b1-vJJll#&&'  nn	%
 
	
 	
 	
 	**zNNR 3 3G4M N N S S U UVVV	
 	
 	
 t(233X24556jj ll 	
  nn  	 h!!'"<==O%-b1-6

X,,\""#  Z..	!
  SXXg&&''(		
 	
 	
 	
 	
r%   c                    t          dt                                                    }t          d          |_        d|j        _        |                                 |                    d           g |j        _        |                     |	                    d                     | 
                    |j        j        t          j        t          d          t          d          z   t          d          z   fg           dS )z
        If the SSHUserAuthClient doesn't return anything from signData,
        the client should start the authentication over again by requesting
        'none' authentication.
        r>   Nr   r   r%   rX   r_   )rQ   rU   r[   r   r   rZ   r   rh   assertIsNoner6  r   r   r   r   )r8   r(  s     r&   !test_publickey_without_privatekeyz8SSHUserAuthClientTests.test_publickey_without_privatekey  s     19N9N9P9PQQ
,T22
)0
&!!###<(((')
$*77<<=== (+RZZ"X,,-FG-TUV	
 	
 	
 	
 	
r%   c                      d  j         _         j                             d          } fd}|                    |          S )z{
        If there's no public key, auth_publickey should return a Deferred
        called back with a False value.
        c                     d S rH   r$   r   s    r&   ry   z:SSHUserAuthClientTests.test_no_publickey.<locals>.<lambda>       r%   r   c                 2                         |            d S rH   )r  )resultr8   s    r&   r   z7SSHUserAuthClientTests.test_no_publickey.<locals>.check  s    V$$$$$r%   )r(  r9   r   r   )r8   r   r   s   `  r&   test_no_publickeyz(SSHUserAuthClientTests.test_no_publickey  sS    
 (6~$O##L11	% 	% 	% 	% 	% }}U###r%   c                    | j                             t          d          dz              |                     | j         j        j        d         t          j        t          d          t          d          z   t          d          z   dz   t          d          z   f           | j                             t          d          t          d          z              |                     | j         j        j        d         t          j        t          d          t          d          z   t          d          z   dz   t          d          dz  z   f           d	S )
zx
        Test that the client can authentication with a password.  This
        includes changing the password.
        r   r   r   r>   rX   r%   r   r   N)	r(  r5  r   r   r   rh   r   r   r6  r7   s    r&   test_passwordz$SSHUserAuthClientTests.test_password  s!   
 	,,R__w-FGGGO%-b1-6

R\\)B{OO;gE6

R	
 	
 	
 	**2c77RWW+<===O%-b1-6

R\\)B{OO;gE6

UVV	
 	
 	
 	
 	
r%   c                 z    d | j         _        |                     | j                             d                     dS )zK
        If getPassword returns None, tryAuth should return False.
        c                      d S rH   r$   r$   r%   r&   ry   z9SSHUserAuthClientTests.test_no_password.<locals>.<lambda>  s    d r%   r   N)r(  rA   r  r   r7   s    r&   test_no_passwordz'SSHUserAuthClientTests.test_no_password  s:     '3l#00==>>>>>r%   c                 n   | j                             t          d          t          d          z   t          d          z   dz   t          d          z   dz              |                     | j         j        j        d         t          j        dt          d          z   t          d          z   f           dS )	zj
        Make sure that the client can authenticate with the keyboard
        interactive method.
        r%   s      s
   Password: r   r   s      r>   N)r(  'ssh_USERAUTH_PK_OK_keyboard_interactiver   r   r   rh   r   MSG_USERAUTH_INFO_RESPONSEr7   s    r&   test_keyboardInteractivez/SSHUserAuthClientTests.test_keyboardInteractive  s    
 	??sGGgggg "" 	 
 	
 	
 	
 	O%-b13#bjj02f::=	
 	
 	
 	
 	
r%   c                 2   d| j         _        g | j         j        _        | j                             d           |                     | j         j        j        t          j        t          d          t          d          z   t          d          z   fg           dS )z
        If C{SSHUserAuthClient} gets a MSG_USERAUTH_PK_OK packet when it's not
        expecting it, it should fail the current authentication and move on to
        the next type.
        s   unknownr%   r>   rX   r_   N)	r(  lastAuthr   rh   r6  r   r   r   r   r7   s    r&   "test_USERAUTH_PK_OK_unknown_methodz9SSHUserAuthClientTests.test_USERAUTH_PK_OK_unknown_method  s     $. ,.!)**3///O%-+RZZ"X,,-FG-TUV	
 	
 	
 	
 	
r%   c                 @     fd} fd}| j         _        | j         _         j                             t	          d          dz                                    j         j        j        d         t          j	        t	          d          t	          d          z   t	          d          z   dz   t	          d          z   f            j                             t	          d	          d
z                                    j         j        j        dd         ddg           dS )z
        ssh_USERAUTH_FAILURE should sort the methods by their position
        in SSHUserAuthClient.preferredOrder.  Methods that are not in
        preferredOrder should be sorted at the end of that list.
        c                  H     j         j                            dd           d S )N      here is datar(  r   rn   r7   s   r&   auth_firstmethodzNSSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting.<locals>.auth_firstmethod2  s$    O%00oFFFFFr%   c                  H     j         j                            dd           dS )N   
   other dataTrQ  r7   s   r&   auth_anothermethodzPSSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting.<locals>.auth_anothermethod5  s#    O%00mDDD4r%   s   anothermethod,passwordr   r   r>   rX   r   s"   firstmethod,anothermethod,passwordr   N)rO  rP  )rT  rU  )
r(  rR  rV  r5  r   r   r   rh   r   r   )r8   rR  rV  s   `  r&   test_USERAUTH_FAILURE_sortingz4SSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting+  sF   	G 	G 	G 	G 	G	 	 	 	 	 ,<(-?* 	,,R0I-J-JW-TUUUO%-b1-6

R\\)B{OO;gE6

R	
 	
 	
 	,,455?	
 	
 	
 	O%-bcc2#%9:	
 	
 	
 	
 	
r%   c                 B   | j                             t          d          dz              | j                             t          d          dz              |                     | j         j        j        d         t          j        dt          d          z   dz   f           dS )	z
        If there are no more available user authentication messages,
        the SSHUserAuthClient should disconnect with code
        DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE.
        r   r   r   r   s      s(   no more authentication methods availables       N)r(  r5  r   r   r   rh   r	  r7   s    r&   %test_disconnectIfNoMoreAuthenticationz<SSHUserAuthClientTests.test_disconnectIfNoMoreAuthenticationO  s     	,,R__w-FGGG,,R__w-FGGGO%-b1(#@AAB%&	
 	
 	
 	
 	
r%   c                    g | j         j        _        | j                             d           |                     | j         j        j        t
          j        t          d          t          d          z   t          d          z   fg           dS )z
        _ebAuth (the generic authentication error handler) should send
        a request for the 'none' authentication method.
        Nr>   rX   r_   )r(  r   rh   _ebAuthr   r   r   r   r7   s    r&   test_ebAuthz"SSHUserAuthClientTests.test_ebAutha  s~    
 -/!)%%%O%-+RZZ"X,,-FG-TUV	
 	
 	
 	
 	
r%   c                 T    t          j        dt                                                                                                                     fd} fdd                                 }|                     j                  	                    |          S )z
        getPublicKey() should return None.  getPrivateKey() should return a
        failed Deferred.  getPassword() should return a failed Deferred.
        getGenericAnswers() should return a failed Deferred.
        r>   c                     |                      t                                                     }|                    j                                                S rH   )trapNotImplementedErrorrA   r   r   
addErrback)r?  r   r(  check2r8   s     r&   r   z3SSHUserAuthClientTests.test_defaults.<locals>.checkv  sI    KK+,,,&&((A==++66v>>>r%   c                     |                      t                                         d d d           }|                    j                                                S rH   )r`  ra  rG   r   r   rb  )r?  r   r(  check3r8   s     r&   rc  z4SSHUserAuthClientTests.test_defaults.<locals>.check2{  sO    KK+,,,,,T4>>A==++66v>>>r%   c                 :    |                      t                     d S rH   )r`  ra  )r?  s    r&   re  z4SSHUserAuthClientTests.test_defaults.<locals>.check3  s    KK+,,,,,r%   )
r   r-   rU   r[   r9  r9   r<   r   r   rb  )r8   r   r   r(  rc  re  s   `  @@@r&   test_defaultsz$SSHUserAuthClientTests.test_defaultsm  s     /8M8M8O8OPP
*1133444	? 	? 	? 	? 	? 	? 	?
	? 	? 	? 	? 	? 	? 	?
	- 	- 	- $$&&}}TY''225999r%   )r    r!   r"   r#   r   r$  r   r   r,  r2  r7  r:  r@  rB  rE  rI  rL  rX  rZ  r]  rg  r$   r%   r&   r&  r&  c  s         |0) ) )  	
 	
 	
@ @ @<
 <
 <
|
 
 
&$ $ $
 
 
,? ? ?
 
 
*
 
 
"
 "
 "
H
 
 
$

 

 

: : : : :r%   r&  c                   6    e Zd ZedZ G d d          Zd ZdS )LoopbackTestsNr   c                   .    e Zd Z G d d          Zd ZdS )LoopbackTests.Factoryc                       e Zd ZdZd Zd ZdS )LoopbackTests.Factory.Service   TestServicec                 8    | j                                          d S rH   )r   rt   r7   s    r&   rZ   z,LoopbackTests.Factory.Service.serviceStarted  s    --/////r%   c                     d S rH   r$   r7   s    r&   r   z,LoopbackTests.Factory.Service.serviceStopped  s    r%   N)r    r!   r"   rD   rZ   r   r$   r%   r&   r[   rm    s7        !D0 0 0    r%   r[   c                     | j         S rH   )r[   )r8   avatarrD   s      r&   ra   z LoopbackTests.Factory.getService  s
    <r%   N)r    r!   r"   r[   ra   r$   r%   r&   rb   rk    sK        	 	 	 	 	 	 	 		  	  	  	  	 r%   rb   c                     t          j                    t          d j                                                  }t          j                    _        j        _        d j        _        t          j                    |_        ||j        _        dxj        _	        |j        _	        d xj        _
        |j        _
                                         j        _        d_        t                      }t          |          }t                                          t#                                                     t%                                 fd_        |                               |j        j        _        t+          j        j        |j                  }d j        j        _        d |j        j        _                                         |                                  fd	}|                    |          S )
zW
        Test that the userauth server and client play nicely with each other.
        r>   c                     dS rs   r$   r   s    r&   ry   z-LoopbackTests.test_loopback.<locals>.<lambda>  r=  r%   r%   c                      d S rH   r$   r$   r%   r&   ry   z-LoopbackTests.test_loopback.<locals>.<lambda>  s    d r%   r   c                 @    t          j        |                    dk    S )Nr   )lensuccessfulCredentials)aIdcheckers    r&   ry   z-LoopbackTests.test_loopback.<locals>.<lambda>  s    s7+H+M'N'NRS'S r%   c                      dS )N_ServerLoopbackr$   r$   r%   r&   ry   z-LoopbackTests.test_loopback.<locals>.<lambda>      7H r%   c                      dS )N_ClientLoopbackr$   r$   r%   r&   ry   z-LoopbackTests.test_loopback.<locals>.<lambda>  r}  r%   c                 R                         j        j        j        d           d S )Nrn  )r   r   r`   rD   )r   r8   r   s    r&   r   z*LoopbackTests.test_loopback.<locals>.check  s(    V-5:NKKKKKr%   )r   r   r/   rb   r[   r   r'   r`   rq   r   sendKexInitre   passwordDelayrv   r   r   r   r   r   areDonerf   r   loopbackAsync	logPrefixrZ   r   )r8   clientr   rf   r   r   rz  r   s   `     @@r&   test_loopbackzLoopbackTests.test_loopback  s    +--(<(<(>(>?? %577#) '5~$$577#) BEE"V%5%?FRlR$v'7'C $(<<>>  $&& 1 1222 1 3 3444TTTTw'''*0 '"6#3V5EFF/H/H",/H/H",	L 	L 	L 	L 	L 	L }}U###r%   )r    r!   r"   r   r$  rb   r  r$   r%   r&   ri  ri    sU        |0               '$ '$ '$ '$ '$r%   ri  c                       e Zd ZedZd ZdS )ModuleInitializationTestsNr   c                     |                      t          j        j        d         d           |                      t          j        j        d         d           d S )N<   r   )r   r   r   protocolMessagesr-   r7   s    r&   test_messagesz'ModuleInitializationTests.test_messages  sb     	&7;=Q	
 	
 	
 	&7;=Q	
 	
 	
 	
 	
r%   )r    r!   r"   r   r$  r  r$   r%   r&   r  r    s-        |0
 
 
 
 
r%   r  )8r#   typesr   typingr   zope.interfacer   twisted.conch.errorr   r   twisted.cred.checkersr   twisted.cred.credentialsr	   r
   r   twisted.cred.errorr   twisted.cred.portalr   r   twisted.internetr   r   twisted.protocolsr   twisted.python.reflectr   twisted.trialr   r   __annotations__twisted.conch.checkersr   twisted.conch.sshr   r   twisted.conch.ssh.commonr   twisted.conch.testr   r-   r/   rJ   rQ   r'   rU   rv   r   r   r   TestCaser   r&  ri  r  r$   r%   r&   <module>r     s                 & & & & & & : : : : : : : : 5 5 5 5 5 5 R R R R R R R R R R 0 0 0 0 0 0 . . . . . . . . ( ( ( ( ( ( ( ( & & & & & & 0 0 0 0 0 0 " " " " " "!hz ! ! !=   999999;;;;;;;;;;++++++*******               -  -  -  -  -X/  -  -  -F
E 
E 
E 
E 
EH. 
E 
E 
E	> 	> 	> 	> 	>("< 	> 	> 	>># ># ># ># >#I. ># ># >#B V	B 	B 	B 	B 	B 	B 	B 	B  !!O O O O O O O "!O  !!" " " " " " " "!"&  !!	 	 	 	 	 	 	 "!	xJ xJ xJ xJ xJX. xJ xJ xJva: a: a: a: a:X. a: a: a:H	8$ 8$ 8$ 8$ 8$H% 8$ 8$ 8$v
 
 
 
 
 1 
 
 
 
 
r%   