o
    9Bi4y                     @   s
  U d Z ddlZddlmZ ddlmZ ddlmZ ddlm	Z	 e	e
 ed< zddlZW n ey6   dZY nw dZdd	lmZ dd
lmZ ddlmZmZmZmZ ddlmZmZ ddlmZ ddlmZ ddlm Z m!Z! ddl"m#Z# ddl$m%Z% ddl&m'Z' ddl(m)Z) e%drdZ*ddl+m,Z, ddl-m.Z.m/Z/ ddl0m1Z1 ddl2m3Z3 ndZ*e4edddurdZ5ndZ5G dd de)Z6G dd de)Z7G d d! d!e)Z8G d"d# d#e)Z9G d$d% d%e)Z:G d&d' d'e)Z;G d(d) d)e)Z<ed*d+gZ=G d,d- d-e>Z?G d.d/ d/e)Z@dS )0z&
Tests for L{twisted.conch.checkers}.
    N)encodebytes)
namedtuple)BytesIO)Optional	cryptSkipzcannot run without crypt module)verifyObject)'InMemoryUsernamePasswordDatabaseDontUse)ISSHPrivateKeyIUsernamePasswordSSHPrivateKeyUsernamePassword)UnauthorizedLoginUnhandledCredentials)Deferred)util)ShadowDatabaseUserDatabase)FilePath)requireModule)MockOS)TestCasecryptography)checkers)NotEnoughAuthenticationValidPublicKey)keys)keydatazcan't run without cryptographygeteuidz0Cannot run without effective UIDs (questionable)c                   @   sX   e Zd ZdZep	eZdd Zdd Zdd Z	dd	 Z
d
d Zdd Zdd Zdd ZdS )HelperTestszl
    Tests for helper functions L{verifyCryptedPassword}, L{_pwdGetByName} and
    L{_shadowGetByName}.
    c                 C   s   t  | _d S N)r   mockosself r#   `/var/www/html/Trade-python/venv/lib/python3.10/site-packages/twisted/conch/test/test_checkers.pysetUp@   s   zHelperTests.setUpc                 C   4   d}d}t  ||}| t||d|| dS )z
        L{verifyCryptedPassword} returns C{True} if the plaintext password
        passed to it matches the encrypted password passed to it.
        secret stringsaltyz5{!r} supposed to be valid encrypted password for {!r}Ncrypt
assertTruer   verifyCryptedPasswordformatr"   passwordsaltcryptedr#   r#   r$   test_verifyCryptedPasswordC      
z&HelperTests.test_verifyCryptedPasswordc                 C   r&   )z
        L{verifyCryptedPassword} returns True if the provided cleartext password
        matches the provided MD5 password hash.
        r/   z$1$saltz3{!r} supposed to be valid encrypted password for {}Nr)   r.   r#   r#   r$   test_verifyCryptedPasswordMD5R   r3   z)HelperTests.test_verifyCryptedPasswordMD5c                 C   s8   d}d}d}t  ||}| t||d|| dS )z
        L{verifyCryptedPassword} returns C{False} if the plaintext password
        passed to it does not match the encrypted password passed to it.
        zstring secretsomesaltr'   z7{!r} not supposed to be valid encrypted password for {}N)r*   assertFalser   r,   r-   )r"   r/   r0   wrongr1   r#   r#   r$   test_refuteCryptedPassworda   s   
z&HelperTests.test_refuteCryptedPasswordc              	   C   sF   t  }|ddddddd | td| | td|d d	S )
z
        L{_pwdGetByName} returns a tuple of items from the UNIX /etc/passwd
        database if the L{pwd} module is present.
        alicesecrit      
first last/foo/bin/shpwdN)r   addUserpatchr   assertEqual_pwdGetByNamegetpwnamr"   userdbr#   r#   r$   test_pwdGetByNameq   s   zHelperTests.test_pwdGetByNamec                 C   s"   |  tdd | td dS )zW
        If the C{pwd} module isn't present, L{_pwdGetByName} returns L{None}.
        r@   Nr9   )rB   r   assertIsNonerD   r!   r#   r#   r$   test_pwdGetByNameWithoutPwd{   s   z'HelperTests.test_pwdGetByNameWithoutPwdc                 C   s   t  }|ddddddddd		 | td
| d| j_d| j_| td| j | t	d|
d | | jjddg | | jjddg dS )z
        L{_shadowGetByName} returns a tuple of items from the UNIX /etc/shadow
        database if the L{spwd} is present.
        bob
passphraser;   r<                  spwd)	    osr   N)r   rA   rB   r   r    euidegidr   rC   _shadowGetByNamegetspnamseteuidCallssetegidCallsrF   r#   r#   r$   test_shadowGetByName   s   z HelperTests.test_shadowGetByNamec                 C   sB   |  tdd | td | | jjg  | | jjg  dS )zP
        L{_shadowGetByName} returns L{None} if C{spwd} is not present.
        rR   NrK   )rB   r   rI   rX   rC   r    rZ   r[   r!   r#   r#   r$   test_shadowGetByNameWithoutSpwd   s   z+HelperTests.test_shadowGetByNameWithoutSpwdN)__name__
__module____qualname____doc__r   dependencySkipskipr%   r2   r4   r8   rH   rJ   r\   r]   r#   r#   r#   r$   r   8   s    
r   c                   @   sr   e Zd ZdZep	eZdddZdd Zdd	 Z	d
d Z
dd Zdd Zdd Zdd Zdd Zdd Zdd ZdS )SSHPublicKeyDatabaseTestsz,
    Tests for L{SSHPublicKeyDatabase}.
    returnNc              	   C   s   t  | _td| _td| _d| j d | j d | _t | _| 	t
d| j t|  | _t| jjts8J | jd| _| j  t }|dd	d
dd| jjd || j_d S )N   foobar   eggspams   t1 s    foo
t2 s    egg
rU   .sshuserr/   r;   r<   r=   
/bin/shell)r   SSHPublicKeyDatabasecheckerr   key1key2contentr   r    rB   r   r   mktemppath
isinstancestrchildsshDirmakedirsr   rA   _userdbrF   r#   r#   r$   r%      s*   



	zSSHPublicKeyDatabaseTests.setUpc                 C   sL   | j | jgd}| |d d t | |d d d | t|d dS )zJ
        L{SSHPublicKeyDatabase} is deprecated as of version 15.0
        )offendingFunctionsr   categorymessageztwisted.conch.checkers.SSHPublicKeyDatabase was deprecated in Twisted 15.0.0: Please use twisted.conch.checkers.SSHPublicKeyChecker, initialized with an instance of twisted.conch.checkers.UNIXAuthorizedKeysFiles instead.r;   N)flushWarningsr%   rC   DeprecationWarninglen)r"   warningsShownr#   r#   r$   test_deprecated   s   
z)SSHPublicKeyDatabaseTests.test_deprecatedc                 C   sj   | j || j tdd}d|_| | j| d|_| | j| d|_| 	| j| d S )N   user   passwordrf   rg   s
   notallowed)
ru   rt   
setContentro   r   blobr+   rl   checkKeyr6   )r"   filenameri   r#   r#   r$   _testCheckKey   s   
z'SSHPublicKeyDatabaseTests._testCheckKeyc                 C   .   |  d | | jjg  | | jjg  dS )z
        L{SSHPublicKeyDatabase.checkKey} should retrieve the content of the
        authorized_keys file and check the keys against that file.
        authorized_keysNr   rC   r    rZ   r[   r!   r#   r#   r$   test_checkKey      
z'SSHPublicKeyDatabaseTests.test_checkKeyc                 C   r   )z
        L{SSHPublicKeyDatabase.checkKey} should retrieve the content of the
        authorized_keys2 file and check the keys against that file.
        authorized_keys2Nr   r!   r#   r#   r$   test_checkKey2   r   z(SSHPublicKeyDatabaseTests.test_checkKey2c                    s   | j d  | j  d |  jd | jj fdd}d| j_d| j_	| 
| jd| | 
td	| j td
d}d|_| | j| | | jjg d | | jjddg dS )z
        If the key file is readable, L{SSHPublicKeyDatabase.checkKey} should
        switch its uid/gid to the ones of the authenticated user.
        r   r     c                    s     d | S )Nr   )chmod)rV   keyFilesavedSeteuidr#   r$   seteuid   s   
z>SSHPublicKeyDatabaseTests.test_checkKeyAsRoot.<locals>.seteuidrS   rT   r   rU   r   r   rf   )r   r;   r   rS   r<   N)ru   rt   r   ro   r   
addCleanupr    r   rV   rW   rB   r   r   r   r+   rl   r   rC   rZ   r[   )r"   r   ri   r#   r   r$   test_checkKeyAsRoot   s   

z-SSHPublicKeyDatabaseTests.test_checkKeyAsRootc                    s\   dd }   jd| tddtjdtjtj	d} j
|} fdd}||S )	z
        L{SSHPublicKeyDatabase.requestAvatarId} should return the avatar id
        passed in if its C{_checkKey} method returns True.
        c                 S      dS NTr#   ignoredr#   r#   r$   	_checkKey     zASSHPublicKeyDatabaseTests.test_requestAvatarId.<locals>._checkKeyr      test   ssh-rsa   fooc                         | d d S Nr   rC   avatarIdr!   r#   r$   _verify     z?SSHPublicKeyDatabaseTests.test_requestAvatarId.<locals>._verify)rB   rl   r   r   publicRSA_opensshr   Key
fromStringprivateRSA_opensshsignrequestAvatarIdaddCallback)r"   r   credentialsdr   r#   r!   r$   test_requestAvatarId  s   
z.SSHPublicKeyDatabaseTests.test_requestAvatarIdc                 C   sB   dd }|  | jd| tddtjdd}| j|}| |tS )a(  
        L{SSHPublicKeyDatabase.requestAvatarId} should raise L{ValidPublicKey}
        if the credentials represent a valid key without a signature.  This
        tells the user that the key is valid for login, but does not actually
        allow that user to do so without a signature.
        c                 S   r   r   r#   r   r#   r#   r$   r   &  r   zQSSHPublicKeyDatabaseTests.test_requestAvatarIdWithoutSignature.<locals>._checkKeyr   r   r   N)rB   rl   r   r   r   r   assertFailurer   r"   r   r   r   r#   r#   r$   $test_requestAvatarIdWithoutSignature  s   z>SSHPublicKeyDatabaseTests.test_requestAvatarIdWithoutSignaturec                 C   s0   dd }|  | jd| | jd}| |tS )z
        If L{SSHPublicKeyDatabase.checkKey} returns False,
        C{_cbRequestAvatarId} should raise L{UnauthorizedLogin}.
        c                 S   r   NFr#   r   r#   r#   r$   r   6  r   zKSSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidKey.<locals>._checkKeyr   N)rB   rl   r   r   r   )r"   r   r   r#   r#   r$   test_requestAvatarIdInvalidKey0  s   z8SSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidKeyc                 C   sR   dd }|  | jd| tddtjdtjtj	d}| j
|}| |tS )z
        Valid keys with invalid signatures should cause
        L{SSHPublicKeyDatabase.requestAvatarId} to return a {UnauthorizedLogin}
        failure
        c                 S   r   r   r#   r   r#   r#   r$   r   D  r   zQSSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidSignature.<locals>._checkKeyr   r   r   r   )rB   rl   r   r   r   r   r   r   privateDSA_opensshr   r   r   r   r   r#   r#   r$   $test_requestAvatarIdInvalidSignature=  s   z>SSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidSignaturec                    sV   dd }   jd| tddddd} j|} fd	d
}||  |tS )z~
        Exceptions raised while verifying the key should be normalized into an
        C{UnauthorizedLogin} failure.
        c                 S   r   r   r#   r   r#   r#   r$   r   X  r   zSSSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeException.<locals>._checkKeyr   r   Ns   blobs   sigDatas   sigc                    s      tj} t|d | S )Nr;   )flushLoggedErrorsr   BadKeyErrorrC   r}   )failureerrorsr!   r#   r$   _verifyLoggedException_     z`SSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeException.<locals>._verifyLoggedException)rB   rl   r   r   
addErrbackr   r   )r"   r   r   r   r   r#   r!   r$   &test_requestAvatarIdNormalizeExceptionR  s   
z@SSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeExceptionre   N)r^   r_   r`   ra   euidSkiprb   rc   r%   r   r   r   r   r   r   r   r   r   r   r#   r#   r#   r$   rd      s    

		rd   c                   @   sD   e Zd ZdZeZdd Zdd Zdd Zdd	 Z	d
d Z
dd ZdS )SSHProtocolCheckerTestsz*
    Tests for L{SSHProtocolChecker}.
    c                 C   sL   t  }| |jg  |t   | |jtg | |j t t j dS )z
        L{SSHProcotolChecker.registerChecker} should add the given checker to
        the list of registered checkers.
        N)r   SSHProtocolCheckerrC   credentialInterfacesregisterCheckerrk   r	   assertIsInstancer"   rl   r#   r#   r$   test_registerCheckero  s   z,SSHProtocolCheckerTests.test_registerCheckerc                 C   sN   t  }| |jg  |t  t | |jtg | |j t t j dS )z
        If a specific interface is passed into
        L{SSHProtocolChecker.registerChecker}, that interface should be
        registered instead of what the checker specifies in
        credentialIntefaces.
        N)r   r   rC   r   r   rk   r
   r   r   r#   r#   r$   !test_registerCheckerWithInterface~  s   z9SSHProtocolCheckerTests.test_registerCheckerWithInterfacec                    sJ   t  }t }|dd || |tdd} fdd}||S )z
        L{SSHProtocolChecker.requestAvatarId} should defer to one if its
        registered checkers to authenticate a user.
        r   c                    r   r   r   r   r!   r#   r$   	_callback  r   z?SSHProtocolCheckerTests.test_requestAvatarId.<locals>._callback)r   r   r   rA   r   r   r   r   )r"   rl   passwordDatabaser   r   r#   r!   r$   r     s   

z,SSHProtocolCheckerTests.test_requestAvatarIdc                 C   sV   t  }dd }| |d| t }|dd || |tdd}| |t	S )z
        If the client indicates that it is never satisfied, by always returning
        False from _areDone, then L{SSHProtocolChecker} should raise
        L{NotEnoughAuthentication}.
        c                 S   r   r   r#   r   r#   r#   r$   _areDone  r   zYSSHProtocolCheckerTests.test_requestAvatarIdWithNotEnoughAuthentication.<locals>._areDoneareDoner   )
r   r   rB   r   rA   r   r   r   r   r   )r"   rl   r   r   r   r#   r#   r$   /test_requestAvatarIdWithNotEnoughAuthentication  s   
zGSSHProtocolCheckerTests.test_requestAvatarIdWithNotEnoughAuthenticationc                 C   s$   t  }|tdd}| |tS )z
        If the passed credentials aren't handled by any registered checker,
        L{SSHProtocolChecker} should raise L{UnhandledCredentials}.
        r   )r   r   r   r   r   r   )r"   rl   r   r#   r#   r$   %test_requestAvatarIdInvalidCredential  s   z=SSHProtocolCheckerTests.test_requestAvatarIdInvalidCredentialc                 C   s   |  t d dS )zV
        The default L{SSHProcotolChecker.areDone} should simply return True.
        N)r+   r   r   r   r!   r#   r#   r$   test_areDone  s   z$SSHProtocolCheckerTests.test_areDoneN)r^   r_   r`   ra   rb   rc   r   r   r   r   r   r   r#   r#   r#   r$   r   h  s    	r   c                   @   sr   e Zd ZdZep	eZdee deddfddZ	dd	 Z
d
d Zdd Zdd Zdd Zdd Zdd Zdd ZdS )UNIXPasswordDatabaseTestsz,
    Tests for L{UNIXPasswordDatabase}.
    r   usernamere   Nc                 C   s   |  | || dS )z
        Assert that the L{Deferred} passed in is called back with the value
        'username'.  This represents a valid login for this TestCase.

        @param d: a L{Deferred} from an L{IChecker.requestAvatarId} method.
        N)rC   successResultOf)r"   r   r   r#   r#   r$   assertLoggedIn  s   z(UNIXPasswordDatabaseTests.assertLoggedInc                 C   s<  t  }dd }t }|d|ddddddd	 |d
dddddd	 t }|ddddddddd	 |d
|d
dddddddd	 | t d| | t d| t }| td| d|_d|_	t
d d!}| ||d  | |jg  | |jg  d"|_| ||d" | |jd#dg | |jd#dg d$S )%z
        L{UNIXPasswordDatabase} with no arguments has checks the C{pwd} database
        and then the C{spwd} database.
        c                 S   s    t  || }t  |d| }|S )Nz$1$)r*   )r   r/   r0   r1   r#   r#   r$   r1     r   z?UNIXPasswordDatabaseTests.test_defaultCheckers.<locals>.cryptedr9   r/   r;   r<   foor>   r?   rK   xbar/barr7   rM   rN   rO   rP   rQ      	   
               r@   rR   rU   rS   rT      alicer      bobr   N)r   UNIXPasswordDatabaser   rA   r   rB   r   r   rV   rW   r   r   r   rC   rZ   r[   r   )r"   rl   r1   r@   rR   r    credr#   r#   r$   test_defaultCheckers  s0    
z.UNIXPasswordDatabaseTests.test_defaultCheckersc                 C   s   |  |tj dS )a  
        Asserts that the L{Deferred} passed in is erred back with an
        L{UnauthorizedLogin} L{Failure}.  This reprsents an invalid login for
        this TestCase.

        NOTE: To work, this method's return value must be returned from the
        test method, or otherwise hooked up to the test machinery.

        @param d: a L{Deferred} from an L{IChecker.requestAvatarId} method.
        @type d: L{Deferred}
        @rtype: L{None}
        N)failureResultOfr   r   r"   r   r#   r#   r$   assertUnauthorizedLogin  s   z1UNIXPasswordDatabaseTests.assertUnauthorizedLoginc              	   C   sR   t  dd}t }|d|ddddd t|jg}| |tdd	d d
S )zo
        L{UNIXPasswordDatabase} takes a list of functions to check for UNIX
        user information.
        secretanybodyr;   r<   r   r   r?   s   anybodys   secretN)	r*   r   rA   r   r   rE   r   r   r   )r"   r/   rG   rl   r#   r#   r$   test_passInCheckers  s   z-UNIXPasswordDatabaseTests.test_passInCheckersc                 C   sJ   dd }dd }|  td| t|g}tdd}| ||d dS )z
        If the encrypted password provided by the getpwnam function is valid
        (verified by the L{verifyCryptedPassword} function), we callback the
        C{requestAvatarId} L{Deferred} with the username.
        c                 S      | |kS r   r#   r1   pwr#   r#   r$   r,        zLUNIXPasswordDatabaseTests.test_verifyPassword.<locals>.verifyCryptedPasswordc                 S   s   | | gS r   r#   r   r#   r#   r$   rE     r   z?UNIXPasswordDatabaseTests.test_verifyPassword.<locals>.getpwnamr,      usernameNrB   r   r   r   r   r   r"   r,   rE   rl   
credentialr#   r#   r$   test_verifyPassword  s   
z-UNIXPasswordDatabaseTests.test_verifyPasswordc                 C   s2   dd }t |g}tdd}| || dS )z}
        If the getpwnam function raises a KeyError, the login fails with an
        L{UnauthorizedLogin} exception.
        c                 S   s   t | r   )KeyErrorr   r#   r#   r$   rE   ,  r   z?UNIXPasswordDatabaseTests.test_failOnKeyError.<locals>.getpwnamr   r   N)r   r   r   r   r   )r"   rE   rl   r   r#   r#   r$   test_failOnKeyError&  s   
z-UNIXPasswordDatabaseTests.test_failOnKeyErrorc                 C   sH   dd }dd }|  td| t|g}tdd}| || dS )	z
        If the verifyCryptedPassword function doesn't verify the password, the
        login fails with an L{UnauthorizedLogin} exception.
        c                 S   r   r   r#   r   r#   r#   r$   r,   9  r   zOUNIXPasswordDatabaseTests.test_failOnBadPassword.<locals>.verifyCryptedPasswordc                 S      | dgS )Nr   r#   r   r#   r#   r$   rE   <  r   zBUNIXPasswordDatabaseTests.test_failOnBadPassword.<locals>.getpwnamr,   r   r   N)rB   r   r   r   r   r   r   r#   r#   r$   test_failOnBadPassword3  s   
z0UNIXPasswordDatabaseTests.test_failOnBadPasswordc                 C   sT   dd }dd }dd }|  td| t||g}tdd	}| ||d d
S )a  
        UNIXPasswordDatabase.requestAvatarId loops through each getpwnam
        function associated with it and returns a L{Deferred} which fires with
        the result of the first one which returns a value other than None.
        ones do not verify the password.
        c                 S   r   r   r#   r   r#   r#   r$   r,   L  r   zRUNIXPasswordDatabaseTests.test_loopThroughFunctions.<locals>.verifyCryptedPasswordc                 S   r   )Nznot the passwordr#   r   r#   r#   r$   	getpwnam1O  r   zFUNIXPasswordDatabaseTests.test_loopThroughFunctions.<locals>.getpwnam1c                 S   r   )Nr/   r#   r   r#   r#   r$   	getpwnam2R  r   zFUNIXPasswordDatabaseTests.test_loopThroughFunctions.<locals>.getpwnam2r,   r   r   Nr   )r"   r,   r   r   rl   r   r#   r#   r$   test_loopThroughFunctionsD  s   
z3UNIXPasswordDatabaseTests.test_loopThroughFunctionsc              	   C   s   t  }|ddddddd |ddddddd |d	d
ddddd | td| ttjg}tdd}| || tdd}| || tdd}| || dS )z
        If the password returned by any function is C{""}, C{"x"}, or C{"*"} it
        is not compared against the supplied password.  Instead it is skipped.
        r9    r;   r<   r   r   rK   r   carol*r@   r       r      xs   carol   *N)	r   rA   rB   r   r   rD   r   r   r   )r"   r@   rl   r   r#   r#   r$   test_failOnSpecialZ  s   


z,UNIXPasswordDatabaseTests.test_failOnSpecial)r^   r_   r`   ra   r   rb   rc   r   bytesr   r   r   r   r   r   r   r   r  r#   r#   r#   r$   r     s    	(r   c                   @   ,   e Zd ZdZeZdd Zdd Zdd ZdS )	AuthorizedKeyFileReaderTestsz5
    Tests for L{checkers.readAuthorizedKeyFile}
    c                 C   s0   t d}t|dd }| ddgt| dS )zg
        L{checkers.readAuthorizedKeyFile} does not attempt to turn comments
        into keys
        sE   # this comment is ignored
this is not
# this is again
and this is notc                 S      | S r   r#   r   r#   r#   r$   <lambda>      zCAuthorizedKeyFileReaderTests.test_ignoresComments.<locals>.<lambda>s   this is nots   and this is notNr   r   readAuthorizedKeyFilerC   listr"   fileobjresultr#   r#   r$   test_ignoresCommentsw  s
   z1AuthorizedKeyFileReaderTests.test_ignoresCommentsc                 C   s0   t d}tj|dd d}| dgt| dS )zw
        L{checkers.readAuthorizedKeyFile} ignores leading whitespace in
        lines, as well as empty lines
        sg   
                           # ignore
                           not ignored
                           c                 S   r  r   r#   r  r#   r#   r$   r    r  zYAuthorizedKeyFileReaderTests.test_ignoresLeadingWhitespaceAndEmptyLines.<locals>.<lambda>parseKeys   not ignoredNr	  r  r#   r#   r$   *test_ignoresLeadingWhitespaceAndEmptyLines  s
   zGAuthorizedKeyFileReaderTests.test_ignoresLeadingWhitespaceAndEmptyLinesc                 C   s4   dd }t d}tj||d}| dgt| dS )z
        L{checkers.readAuthorizedKeyFile} does not raise an exception
        when a key fails to parse (raises a
        L{twisted.conch.ssh.keys.BadKeyError}), but rather just keeps going
        c                 S   s   |  dr
td| S )N   fzfailed to parse)
startswithr   r   )liner#   r#   r$   
failOnSome  s   

zKAuthorizedKeyFileReaderTests.test_ignoresUnparsableKeys.<locals>.failOnSomes   failed key
good keyr  s   good keyNr	  )r"   r  r  r  r#   r#   r$   test_ignoresUnparsableKeys  s   z7AuthorizedKeyFileReaderTests.test_ignoresUnparsableKeysN)	r^   r_   r`   ra   rb   rc   r  r  r  r#   r#   r#   r$   r  p  s    r  c                   @   r  )	InMemorySSHKeyDBTestsz0
    Tests for L{checkers.InMemorySSHKeyDB}
    c                 C   s    t ddgi}tt j| dS )z_
        L{checkers.InMemorySSHKeyDB} implements
        L{checkers.IAuthorizedKeysDB}
        r   s   keyN)r   InMemorySSHKeyDBr   IAuthorizedKeysDBr"   keydbr#   r#   r$   test_implementsInterface  s   z.InMemorySSHKeyDBTests.test_implementsInterfacec                 C   s*   t ddgi}| g t|d dS )z
        If the user is not in the mapping provided to
        L{checkers.InMemorySSHKeyDB}, an empty iterator is returned
        by L{checkers.InMemorySSHKeyDB.getAuthorizedKeys}
        r   s   keysr   Nr   r  rC   r  getAuthorizedKeysr  r#   r#   r$   test_noKeysForUnauthorizedUser  s   z4InMemorySSHKeyDBTests.test_noKeysForUnauthorizedUserc                 C   s0   t dddgi}| ddgt|d dS )z
        If the user is in the mapping provided to
        L{checkers.InMemorySSHKeyDB}, an iterator with all the keys
        is returned by L{checkers.InMemorySSHKeyDB.getAuthorizedKeys}
        r      a   bNr  r  r#   r#   r$   test_allKeysForAuthorizedUser  s   z3InMemorySSHKeyDBTests.test_allKeysForAuthorizedUserN)	r^   r_   r`   ra   rb   rc   r  r   r#  r#   r#   r#   r$   r    s    	r  c                   @   sF   e Zd ZdZeZdddZdd Zdd	 Zd
d Z	dd Z
dd ZdS )UNIXAuthorizedKeysFilesTestsz8
    Tests for L{checkers.UNIXAuthorizedKeysFiles}.
    re   Nc              	   C   s   t |  | _t| jjtsJ | j  t | _| jddddd| jjd | j	d| _
| j
  | j
	d}|d	 d
dg| _d S )Nr9   r/   r;   r<   zalice lastnamerj   rh   r   s   key 1
key 2s   key 1s   key 2)r   rp   rq   rr   rs   rv   r   rG   rA   rt   ru   r   expectedKeys)r"   authorizedKeysr#   r#   r$   r%     s$   



z"UNIXAuthorizedKeysFilesTests.setUpc                 C   s   t | j}tt j| dS )zg
        L{checkers.UNIXAuthorizedKeysFiles} implements
        L{checkers.IAuthorizedKeysDB}.
        N)r   UNIXAuthorizedKeysFilesrG   r   r  r  r#   r#   r$   r    s   z5UNIXAuthorizedKeysFilesTests.test_implementsInterfacec                 C   s.   t j| jdd d}| g t|d dS )z
        If the user is not in the user database provided to
        L{checkers.UNIXAuthorizedKeysFiles}, an empty iterator is returned
        by L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys}.
        c                 S   r  r   r#   r  r#   r#   r$   r    r  zMUNIXAuthorizedKeysFilesTests.test_noKeysForUnauthorizedUser.<locals>.<lambda>r  r   N)r   r'  rG   rC   r  r  r  r#   r#   r$   r     s   z;UNIXAuthorizedKeysFilesTests.test_noKeysForUnauthorizedUserc                 C   sH   | j dd tj| jdd d}| | jdg t|	d dS )a  
        If the user is in the user database provided to
        L{checkers.UNIXAuthorizedKeysFiles}, an iterator with all the keys in
        C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2} is returned
        by L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys}.
        r   s   key 3c                 S   r  r   r#   r  r#   r#   r$   r    r  z`UNIXAuthorizedKeysFilesTests.test_allKeysInAllAuthorizedFilesForAuthorizedUser.<locals>.<lambda>r  r   N)
ru   rt   r   r   r'  rG   rC   r%  r  r  r  r#   r#   r$   1test_allKeysInAllAuthorizedFilesForAuthorizedUser  s
   zNUNIXAuthorizedKeysFilesTests.test_allKeysInAllAuthorizedFilesForAuthorizedUserc                 C   s0   t j| jdd d}| | jt|d dS )z
        L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys} returns only
        the keys in C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2}
        if they exist.
        c                 S   r  r   r#   r  r#   r#   r$   r    r  zJUNIXAuthorizedKeysFilesTests.test_ignoresNonexistantFile.<locals>.<lambda>r  r   N)r   r'  rG   rC   r%  r  r  r  r#   r#   r$   test_ignoresNonexistantFile  s   z8UNIXAuthorizedKeysFilesTests.test_ignoresNonexistantFilec                 C   s@   | j d  tj| jdd d}| | jt|	d dS )z
        L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys} returns only
        the keys in C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2}
        if they are readable.
        r   c                 S   r  r   r#   r  r#   r#   r$   r    r  zIUNIXAuthorizedKeysFilesTests.test_ignoresUnreadableFile.<locals>.<lambda>r  r   N)
ru   rt   rv   r   r'  rG   rC   r%  r  r  r  r#   r#   r$   test_ignoresUnreadableFile  s   z7UNIXAuthorizedKeysFilesTests.test_ignoresUnreadableFiler   )r^   r_   r`   ra   rb   rc   r%   r  r   r(  r)  r*  r#   r#   r#   r$   r$    s    
		r$  _KeyDBr  c                   @   s   e Zd ZdZdS )_DummyExceptionz0
    Fake exception to be used for testing.
    N)r^   r_   r`   ra   r#   r#   r#   r$   r,    s    r,  c                   @   sL   e Zd ZdZeZdd Zdd Zdd Zdd	 Z	d
d Z
dd Zdd ZdS )SSHPublicKeyCheckerTestsz4
    Tests for L{checkers.SSHPublicKeyChecker}.
    c                 C   sD   t ddtjdtjtjd| _t	dd | _
t| j
| _d S )Nr   r   r   c                 S   s   t jtjgS r   )r   r   r   r   r   )_r#   r#   r$   r  0  s    z0SSHPublicKeyCheckerTests.setUp.<locals>.<lambda>)r   r   r   r   r   r   r   r   r   r+  r  r   SSHPublicKeyCheckerrl   r!   r#   r#   r$   r%   (  s   zSSHPublicKeyCheckerTests.setUpc                 C   s"   d| j _| | j| j t dS )z
        Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with
        credentials that do not have a signature fails with L{ValidPublicKey}.
        N)r   	signaturer   rl   r   r   r!   r#   r#   r$    test_credentialsWithoutSignature3  s   z9SSHPublicKeyCheckerTests.test_credentialsWithoutSignaturec                 C   s$   d| j _| | j| j tj dS )z
        Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with
        credentials that have a bad key fails with L{keys.BadKeyError}.
        r   N)r   r   r   rl   r   r   r   r!   r#   r#   r$   test_credentialsWithBadKey=  s   z3SSHPublicKeyCheckerTests.test_credentialsWithBadKeyc                 C   s$   t j| j_| | j| jt dS )z
        If L{checkers.IAuthorizedKeysDB.getAuthorizedKeys} returns no keys
        that match the credentials,
        L{checkers.SSHPublicKeyChecker.requestAvatarId} fails with
        L{UnauthorizedLogin}.
        N)r   publicDSA_opensshr   r   r   rl   r   r   r!   r#   r#   r$   test_credentialsNoMatchingKeyG  s   
z6SSHPublicKeyCheckerTests.test_credentialsNoMatchingKeyc                 C   s2   t jtjd| j_| | j	
| jt dS )z
        Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with
        credentials that are incorrectly signed fails with
        L{UnauthorizedLogin}.
        r   N)r   r   r   r   r   r   r   r0  r   rl   r   r   r!   r#   r#   r$    test_credentialsInvalidSignatureS  s   z9SSHPublicKeyCheckerTests.test_credentialsInvalidSignaturec                 C   s<   dd }|  tjd| | | j| jt | t	 dS )z
        If L{keys.Key.verify} raises an exception,
        L{checkers.SSHPublicKeyChecker.requestAvatarId} fails with
        L{UnauthorizedLogin}.
        c                  _   s   t  r   )r,  )argskwargsr#   r#   r$   failg  s   z?SSHPublicKeyCheckerTests.test_failureVerifyingKey.<locals>.failverifyN)
rB   r   r   r   rl   r   r   r   r   r,  )r"   r8  r#   r#   r$   test_failureVerifyingKey`  s   z1SSHPublicKeyCheckerTests.test_failureVerifyingKeyc                 C   s$   | j | j}| d| | dS )zu
        L{checker.SSHPublicKeyChecker.requestAvatarId}, if successful,
        callbacks with the username.
        r   N)rl   r   r   rC   r   r   r#   r#   r$   test_usernameReturnedOnSuccessq  s   z7SSHPublicKeyCheckerTests.test_usernameReturnedOnSuccessN)r^   r_   r`   ra   rb   rc   r%   r1  r2  r4  r5  r:  r;  r#   r#   r#   r$   r-  !  s    

r-  )Ara   rU   base64r   collectionsr   ior   typingr   rs   __annotations__r*   ImportErrorr   zope.interface.verifyr   twisted.cred.checkersr   twisted.cred.credentialsr	   r
   r   r   twisted.cred.errorr   r   twisted.internet.deferr   twisted.pythonr   twisted.python.fakepwdr   r   twisted.python.filepathr   twisted.python.reflectr   twisted.test.test_processr   twisted.trial.unittestr   rb   twisted.conchr   twisted.conch.errorr   r   twisted.conch.sshr   twisted.conch.testr   getattrr   r   rd   r   r   r  r  r$  r+  	Exceptionr,  r-  r#   r#   r#   r$   <module>   s\   f KX 14"P