o i@sUdZddlmZddlmZddlmZddlmZm Z ddl m Z ddl m Z mZmZddlmZdd lmZmZdd lmZmZdd lmZdd lmZdd lmZddlmZdZ eee!d<edrddl"m#Z#ddl$m Z m%Z%m&Z&ddl'm(Z(ddl)m*Z*nGdddZ%GdddZ&Gddde&j+Z,Gddde&j+Z-Gddde&j+Z.Gd d!d!e%j/Z0eeGd"d#d#Z1ee Gd$d%d%Z2ee Gd&d'd'Z3ee Gd(d)d)Z4Gd*d+d+ej5Z6Gd,d-d-ej5Z7Gd.d/d/ej5Z8Gd0d1d1ej5Z9dS)2zT Tests for the implementation of the ssh-userauth service. Maintainer: Paul Swartz ) ModuleType)Optional) implementer) ConchErrorValidPublicKey)ICredentialsChecker) IAnonymousISSHPrivateKeyIUsernamePassword)UnauthorizedLogin)IRealmPortal)defertask)Deferred)loopback) requireModule)unittestNkeysZ cryptography)SSHProtocolChecker)r transportuserauth)NS)keydatac@eZdZGdddZdS)rc@eZdZdZdS)ztransport.SSHTransportBaseQ A stub class so that later class definitions won't die. N__name__ __module__ __qualname____doc__r"r"fC:\Users\psant\Downloads\PAF backend\school\venv\Lib\site-packages\twisted/conch/test/test_userauth.pySSHTransportBase#r$N)rrr r$r"r"r"r#r"rc@r)rc@r)zuserauth.SSHUserAuthClientrNrr"r"r"r#SSHUserAuthClient)r%r'N)rrr r'r"r"r"r#r(r&rc@s2eZdZdZddZddZd ddZd d ZdS) ClientUserAuthz" A mock user auth client. cCs(|jr tjtjSttjtjS)z If this is the first time we've been called, return a blob for the DSA key. Otherwise, return a blob for the RSA key. N) Z lastPublicKeyrKey fromStringrpublicRSA_opensshrsucceedpublicDSA_opensshselfr"r"r# getPublicKey4szClientUserAuth.getPublicKeycCsttjtjS)z@ Return the private key object for the RSA key. N)rr,rr)r*rprivateRSA_opensshr.r"r"r# getPrivateKey?zClientUserAuth.getPrivateKeyNcC tdS)z/ Return 'foo' as the password. fooNrr,)r/promptr"r"r# getPasswordE zClientUserAuth.getPasswordcCr4)z> Return 'foo' as the answer to two questions. )foor:Nr6)r/name informationZanswersr"r"r#getGenericAnswersKr9z ClientUserAuth.getGenericAnswersN)rrr r!r0r2r8r=r"r"r"r#r(/s   r(c@ eZdZdZddZddZdS) OldClientAuthz~ The old SSHUserAuthClient returned a cryptography key object from getPrivateKey() and a string from getPublicKey cCsttjtjjSr>)rr,rr)r*rr1Z keyObjectr.r"r"r#r2XzOldClientAuth.getPrivateKeycCstjtjSr>)rr)r*rr+blobr.r"r"r#r0[szOldClientAuth.getPublicKeyNrrr r!r2r0r"r"r"r#r@Rs r@c@r?)ClientAuthWithoutPrivateKeyzP This client doesn't have a private key, but it does have a public key. cCdSr>r"r.r"r"r#r2dz)ClientAuthWithoutPrivateKey.getPrivateKeycCstjtjSr>)rr)r*rr+r.r"r"r#r0gz(ClientAuthWithoutPrivateKey.getPublicKeyNrCr"r"r"r#rD_s rDc@sLeZdZdZGdddZGdddZddZdd Zd d Zd d Z dS) FakeTransporta_ L{userauth.SSHUserAuthServer} expects an SSH transport which has a factory attribute which has a portal attribute. Because the portal is important for testing authentication, we need to be able to provide an interesting portal object to the L{SSHUserAuthServer}. In addition, we want to be able to capture any packets sent over the transport. @ivar packets: a list of 2-tuples: (messageType, data). Each 2-tuple is a sent packet. @type packets: C{list} @param lostConnecion: True if loseConnection has been called on us. @type lostConnection: L{bool} c@seZdZdZdZddZdS)zFakeTransport.ServicezW A mock service, representing the other service offered by the server. nancycCrEr>r"r.r"r"r#serviceStartedrFz$FakeTransport.Service.serviceStartedN)rrr r!r;rJr"r"r"r#Service|s rKc@eZdZdZddZdS)zFakeTransport.Factoryzg A mock factory, representing the factory that spawned this user auth service. cCs|dkrtjSdS)z2 Return our fake service. noneN)rHrK)r/rservicer"r"r# getServicesz FakeTransport.Factory.getServiceN)rrr r!rOr"r"r"r#Factorys rPcCs(||_||j_d|_||_g|_dSNF)rPfactoryportallostConnectionrpackets)r/rSr"r"r#__init__s  zFakeTransport.__init__cCs|j||fdS)z8 Record the packet sent by the service. N)rUappend)r/Z messageTypemessager"r"r# sendPacketr3zFakeTransport.sendPacketcCdS)z Pretend that this transport encrypts traffic in both directions. The SSHUserAuthServer disables password authentication if the transport isn't encrypted. TNr")r/ directionr"r"r# isEncryptedszFakeTransport.isEncryptedcCs d|_dSNT)rTr.r"r"r#loseConnections zFakeTransport.loseConnectionN) rrr r!rKrPrVrYr\r^r"r"r"r#rHks   rHc@rL)Realmz A mock realm for testing L{userauth.SSHUserAuthServer}. This realm is not actually used in the course of testing, so it returns the simplest thing that could possibly work. cGst|ddddfS)NrcSrEr>r"r"r"r"r#z%Realm.requestAvatar..r6)r/ZavatarIdZmindZ interfacesr"r"r# requestAvatarszRealm.requestAvatarN)rrr r!rbr"r"r"r#r_s r_c@eZdZdZefZddZdS)PasswordCheckerz A very simple username/password checker which authenticates anyone whose password matches their username and rejects all others. cCs&|j|jkr t|jSttdS)NzInvalid username/password pair)usernamepasswordrr,failr )r/credsr"r"r#requestAvatarIds  zPasswordChecker.requestAvatarIdN)rrr r!r credentialInterfacesrir"r"r"r#rd rdc@rc)PrivateKeyCheckerz A very simple public key checker which authenticates anyone whose public/private keypair is the same keydata.public/privateRSA_openssh. cCsX|jtjtjkr)|jdur&tj|j}||j|jr#|j St t t r>) rBrr)r*rr+ signatureverifysigDatarerr )r/rhobjr"r"r#ris z!PrivateKeyChecker.requestAvatarIdN)rrr r!r rjrir"r"r"r#rlrkrlc@rc)AnonymousCheckerzI A simple checker which isn't supported by L{SSHUserAuthServer}. cCrEr>r")r/ credentialsr"r"r#risz AnonymousChecker.requestAvatarIdN)rrr r!rrjrir"r"r"r#rqs rqc@seZdZdZedur dZd.ddZddZd eddfd d Z d d Z ddZ ddZ ddZ ddZddZddZddZddZddZd d!Zd"d#Zd$d%Zd&d'Zd(d)Zdedfd*d+Zd,d-ZdS)/SSHUserAuthServerTestsz& Tests for SSHUserAuthServer. Ncannot run without cryptographyreturncCsbt|_t|j|_|jt|jtt|_ t |j|j _ |j |j j dSr>)r_realmr rSregisterCheckerrdrlrSSHUserAuthServer authServerrHrrJsupportedAuthenticationssortr.r"r"r#setUps   zSSHUserAuthServerTests.setUpcC|jd|_dSr>)ryserviceStoppedr.r"r"r#tearDown  zSSHUserAuthServerTests.tearDownignoredcCs>t|jjts J|jjjd}||tjtddfdS)z; Check that the authentication has failed. spassword,publickeyN) isinstanceryrrHrU assertEqualrZMSG_USERAUTH_FAILUREr)r/rZ lastPacketr"r"r# _checkFaileds z#SSHUserAuthServerTests._checkFailedcCs,|jtdtdtd}||jS)z A client may request a list of authentication 'method name' values that may continue by using the "none" authentication 'method name'. See RFC 4252 Section 5.2. r5sservicerMN)ryssh_USERAUTH_REQUESTr addCallbackr)r/dr"r"r#test_noneAuthentication s z.SSHUserAuthServerTests.test_noneAuthenticationcsFdtdtdtddtdg}j|}fdd}||S) z When provided with correct password authentication information, the server should respond by sending a MSG_USERAUTH_SUCCESS message with no other data. See RFC 4252, Section 5.1. r5rMpasswordrcjjjtjdfgdSNrrryrrUrZMSG_USERAUTH_SUCCESSrr.r"r#check" zKSSHUserAuthServerTests.test_successfulPasswordAuthentication..checkN)joinrryrrr/packetrrr"r.r#%test_successfulPasswordAuthentications$   z.checkN)rr)r*rr+rBr1rZsshTyperyr sessionIDsignbytesrMSG_USERAUTH_REQUESTrr)r/rBrprrmrrr"r.r#'test_successfulPrivateKeyAuthentication;s,      z>SSHUserAuthServerTests.test_successfulPrivateKeyAuthenticationcstdd}dd}fdd}||jd|||jd|||jd |td td td td }|j||tS)z ssh_USERAUTH_REQUEST should raise a ConchError if tryAuth returns None. Added to catch a bug noticed by pyflakes. cSs|ddS)Nz&request should have raised ConochError)rg)r/rr"r"r#mockCbFinishedAuth_rGzOSSHUserAuthServerTests.test_requestRaisesConchError..mockCbFinishedAuthcSrEr>r")kinduserdatar"r"r# mockTryAuthbrFzHSSHUserAuthServerTests.test_requestRaisesConchError..mockTryAuthcs|jdSr>)Zerrbackvalue)reasonrr"r# mockEbBadAutheszJSSHUserAuthServerTests.test_requestRaisesConchError..mockEbBadAuthtryAuthZ_cbFinishedAuthZ _ebBadAuthsuserrMs public-keysdataN)rrpatchryrr assertFailurer)r/rrrrr"rr#test_requestRaisesConchErrorXs    z3SSHUserAuthServerTests.test_requestRaisesConchErrorcsbtjtjtdtdtddtdt}j|}fdd}| |S) z@ Test that verifying a valid private key works. r5rMrrssh-rsacs*jjjtjtdtfgdS)Nr)rryrrUrMSG_USERAUTH_PK_OKrrrBr/r"r#rsz@SSHUserAuthServerTests.test_verifyValidPrivateKey..checkN) rr)r*rr+rBrryrrrr"rr#test_verifyValidPrivateKeyrs   z1SSHUserAuthServerTests.test_verifyValidPrivateKeycCsVtjtj}tdtdtddtdt|}|j|}| |j S)d Test that private key authentication fails when the public key is invalid. r5rMrrsssh-dsaN rr)r*rr-rBrryrrrr/rBrrr"r"r#3test_failedPrivateKeyAuthenticationWithoutSignatures  zJSSHUserAuthServerTests.test_failedPrivateKeyAuthenticationWithoutSignaturecCs|tjtj}tjtj}tdtdtddtdt|t||}d|j j _ |j |}| |jS)rr5rMrrrrN)rr)r*rr+rBr1rrryrrrrr)r/rBrprrr"r"r#0test_failedPrivateKeyAuthenticationWithSignatures&   zGSSHUserAuthServerTests.test_failedPrivateKeyAuthenticationWithSignaturecCsjtjtj}td|dd}tdtdtddtdt|}|j|}| |j S) z Private key authentication fails when the public key type is unsupported or the public key is corrupt. s ssh-bad-type Nr5rMrrrrrr"r"r#test_unsupported_publickeys   z1SSHUserAuthServerTests.test_unsupported_publickeycCsRt}t|j|_|jt|||j | |j ddgdS)ah L{SSHUserAuthServer} sets up C{SSHUserAuthServer.supportedAuthentications} by checking the portal's credentials interfaces and mapping them to SSH authentication method strings. If the Portal advertises an interface that L{SSHUserAuthServer} can't map, it should be ignored. This is a white box test. rrN) rrxrHrSrrwrqrJr~rzr{rr/serverr"r"r# test_ignoreUnknownCredInterfacess  z7SSHUserAuthServerTests.test_ignoreUnknownCredInterfacescCs|d|jjt}t|j|_dd|j_| | | d|jt}t|j|_dd|j_| | |d|jdS)z Test that the userauth service does not advertise password authentication if the password would be send in cleartext. rcSrZrQr"xr"r"r#r`razISSHUserAuthServerTests.test_removePasswordIfUnencrypted..cS|dkSNinr"rr"r"r#r`N) ZassertInryrzrrxrHrSrr\rJr~Z assertNotIn)r/clearAuthServerhalfAuthServerr"r"r# test_removePasswordIfUnencrypteds    z7SSHUserAuthServerTests.test_removePasswordIfUnencryptedcCst|j}|tt}t||_dd|j_| | | |j dgt}t||_dd|j_| | | |j dgdS)z If the L{SSHUserAuthServer} is not advertising passwords, then an unencrypted connection should not cause any warnings or exceptions. This is a white box test. cSrZrQr"rr"r"r#r`razSSSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswords..rcSrrr"rr"r"r#r`rN) r rvrwrlrrxrHrr\rJr~rrz)r/rSrrr"r"r#*test_unencryptedConnectionWithoutPasswordss      zASSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswordscCst}t|_t|j|_||j d| | |jj tj dttjftdtdfg||jjdS)z0 Test that the login times out. 鰚syou took too longrN)rrxrrrrHrSrrJrr~rrUMSG_DISCONNECTr)DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLEr assertTruerTr/ZtimeoutAuthServerr"r"r#test_loginTimeouts(     z(SSHUserAuthServerTests.test_loginTimeoutcCs\t}t|_t|j|_|| |j d| |jj g| |jjdS)zN Test that stopping the service also stops the login timeout. rN)rrxrrrrHrSrrJr~rrrU assertFalserTrr"r"r#test_cancelLoginTimeouts   z.SSHUserAuthServerTests.test_cancelLoginTimeoutcsndtdtdtddtdg}tj_tdD]}j|}jjdqfd d }| |S) zm Test that the server disconnects if the client fails authentication too many times. rr5rMrrrrcs<jjjdtjdttjftdtdfdS)Nrrstoo many bad authsr)rryrrUrrrrrr.r"r#r4s  z:SSHUserAuthServerTests.test_tooManyAttempts..checkN) rrrrryrrangerrr)r/rirrr"r.r#test_tooManyAttempts)s$     z+SSHUserAuthServerTests.test_tooManyAttemptscCsTtdtdtddtd}t|j_|j|}|dus$J||jS)zo If the user requests a service that we don't support, the authentication should fail. r5rrrN)rrrryrrrrrr"r"r#test_failIfUnknownServiceBs $    z0SSHUserAuthServerTests.test_failIfUnknownServicecsVdd}jd|jddfdd}jddd}|t|S) aZ tryAuth() has two edge cases that are difficult to reach. 1) an authentication method auth_* returns None instead of a Deferred. 2) an authentication type that is defined does not have a matching auth_* method. Both these cases should return a Deferred which fails with a ConchError. cSrEr>r")rr"r"r#mockAuthYrFz>SSHUserAuthServerTests.test_tryAuthEdgeCases..mockAuthZauth_publickeyZ auth_passwordNcsjddd}|tS)Nr)ryrrr)rZd2r.r"r# secondTest_s z@SSHUserAuthServerTests.test_tryAuthEdgeCases..secondTestr)rryrrrr)r/rrZd1r"r.r#test_tryAuthEdgeCasesMs   z,SSHUserAuthServerTests.test_tryAuthEdgeCases)ruN)rrr r!rskipr|robjectrrrrrrrrrrrrrrrrrrrr"r"r"r#rss0      rsc@seZdZdZedur dZddZddZdd Zd d Z d d Z ddZ ddZ ddZ ddZddZddZddZddZddZd d!ZdS)"SSHUserAuthClientTestsz& Tests for SSHUserAuthClient. NrtcCs4tdt|_td|j_d|jj_|jdS)Nr5r)r(rHrK authClientrrrJr.r"r"r#r|os  zSSHUserAuthClientTests.setUpcCr}r>)rr~r.r"r"r#rurzSSHUserAuthClientTests.tearDowncCsT||jjd||jjjd||jjjtjt dt dt dfgdS)z; Test that client is initialized properly. r5rIrMN) rrrinstancer;rrUrrrr.r"r"r# test_initys z SSHUserAuthClientTests.test_initcs@dgfdd}||jj_|jd|d|jjdS)z9 Test that the client succeeds properly. Ncs |d<dS)Nrr")rNrr"r#stubSetServices zDSSHUserAuthClientTests.test_USERAUTH_SUCCESS..stubSetServicerr)rrZ setServiceZssh_USERAUTH_SUCCESSrr)r/rr"rr#test_USERAUTH_SUCCESSs    z,SSHUserAuthClientTests.test_USERAUTH_SUCCESSc Cs|jtdd||jjjdtjtdtdtddtdttj t j  f|jtddttj t j }||jjjdtjtdtdtddtd|f|jtdttj t j t|jjjttjftdtdtddtd|}tj t j}||jjjdtjtdtdtddtd|t||fd S) zJ Test that the client can authenticate with a public key. rrrr5rIsssh-dssrN)rssh_USERAUTH_FAILURErrrrUrrrr)r*rr-rBr+ssh_USERAUTH_PK_OKrrr1r)r/rBrorpr"r"r#test_publickeys        z%SSHUserAuthClientTests.test_publickeycCsztdt}td|_d|j_||dg|j_|| d| |jjt j t dt dt dfgdS)z If the SSHUserAuthClient doesn't return anything from signData, the client should start the authentication over again by requesting 'none' authentication. r5NrrrrIrM)rDrHrKrrrJrrU assertIsNonerrrrr)r/rr"r"r#!test_publickey_without_privatekeys  z8SSHUserAuthClientTests.test_publickey_without_privatekeycs.ddj_jd}fdd}||S)z{ If there's no public key, auth_publickey should return a Deferred called back with a False value. cSrEr>r"rr"r"r#r`raz:SSHUserAuthClientTests.test_no_publickey..rcs|dSr>)rresultr.r"r#rrGz7SSHUserAuthClientTests.test_no_publickey..checkN)rr0rr)r/rrr"r.r#test_no_publickeys    z(SSHUserAuthClientTests.test_no_publickeycCs|jtdd||jjjdtjtdtdtddtdf|jtdtd||jjjdtjtdtdtddtddfd S) zx Test that the client can authentication with a password. This includes changing the password. rrrr5rIrrrN) rrrrrrUrrrr.r"r"r# test_passwords " &z$SSHUserAuthClientTests.test_passwordcCs"dd|j_||jddS)zK If getPassword returns None, tryAuth should return False. cSrEr>r"r"r"r"r#r` raz9SSHUserAuthClientTests.test_no_password..rN)rr8rrr.r"r"r#test_no_passwords z'SSHUserAuthClientTests.test_no_passwordcCs`|jtdtdtddtdd||jjjdtjdtdtdfdS) zj Make sure that the client can authenticate with the keyboard interactive method. rss Password: rrsr5N)rZ'ssh_USERAUTH_PK_OK_keyboard_interactiverrrrUrZMSG_USERAUTH_INFO_RESPONSEr.r"r"r#test_keyboardInteractive s& z/SSHUserAuthClientTests.test_keyboardInteractivecCsPd|j_g|jj_|jd||jjjtjtdtdtdfgdS)z If C{SSHUserAuthClient} gets a MSG_USERAUTH_PK_OK packet when it's not expecting it, it should fail the current authentication and move on to the next type. sunknownrr5rIrMN) rZlastAuthrrUrrrrrr.r"r"r#"test_USERAUTH_PK_OK_unknown_method!s  z9SSHUserAuthClientTests.test_USERAUTH_PK_OK_unknown_methodcsfdd}fdd}|j_|j_jtddjjjdtj tdtd td dtdfjtd d jjjd dddgdS)z ssh_USERAUTH_FAILURE should sort the methods by their position in SSHUserAuthClient.preferredOrder. Methods that are not in preferredOrder should be sorted at the end of that list. csjjdddS)N here is datarrrYr"r.r"r#auth_firstmethod6szNSSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting..auth_firstmethodcsjjdddS)N other dataTrr"r.r"r#auth_anothermethod9szPSSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting..auth_anothermethodsanothermethod,passwordrrr5rIrs"firstmethod,anothermethod,passwordrN)rr)rr) rrrrrrrrUrr)r/rrr"r.r#test_USERAUTH_FAILURE_sorting/s$   " z4SSHUserAuthClientTests.test_USERAUTH_FAILURE_sortingcCsT|jtdd|jtdd||jjjdtjdtddfdS) z If there are no more available user authentication messages, the SSHUserAuthClient should disconnect with code DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE. rrrrss(no more authentication methods availablesN)rrrrrrUrr.r"r"r#%test_disconnectIfNoMoreAuthenticationSs z)trapNotImplementedErrorr8rrg addErrbackrr)rcheck2r/r"r#rzs z3SSHUserAuthClientTests.test_defaults..checkcs*|tddd}|jSr>)rrr=rrgrr)rcheck3r/r"r#rs z4SSHUserAuthClientTests.test_defaults..check2cSs|tdSr>)rrrr"r"r#rrGz4SSHUserAuthClientTests.test_defaults..check3N) rr'rHrKrr0r2rrgr)r/rrr")rrrr/r# test_defaultsqsz$SSHUserAuthClientTests.test_defaults)rrr r!rrr|rrrrrrrrrrrrrrr"r"r"r#rgs&  > $ rc@s.eZdZedur dZGdddZddZdS) LoopbackTestsNrtc@s"eZdZGdddZddZdS)zLoopbackTests.Factoryc@r?)zLoopbackTests.Factory.Service TestServicecCs|jdSr>)rr^r.r"r"r#rJrGz,LoopbackTests.Factory.Service.serviceStartedcCrEr>r"r.r"r"r#r~rFz,LoopbackTests.Factory.Service.serviceStoppedN)rrr r;rJr~r"r"r"r#rKs rKcCs|jSr>)rK)r/Zavatarr;r"r"r#rOsz LoopbackTests.Factory.getServiceN)rrr rKrOr"r"r"r#rPs rPcs ttdj}t_j_ddj_t|_||j_dj_ |j_ ddj_ |j_ j_ d_ t }t|}tttfdd_||jj _tj|j}ddjj_d d|jj_|fd d }||S) zW Test that the userauth server and client play nicely with each other. r5cSrZr]r"rr"r"r#r`raz-LoopbackTests.test_loopback..rcSrEr>r"r"r"r"r#r`rarcstj|dkS)Nr)lenZsuccessfulCredentials)ZaId)checkerr"r#r`scSrZ)NZ_ServerLoopbackr"r"r"r"r#r`racSrZ)NZ_ClientLoopbackr"r"r"r"r#r`racsjjjddS)Nr)rrrNr;rrr"r#rrAz*LoopbackTests.test_loopback..checkN)rrxr(rPrKrr$rNr\rZ sendKexInitrRZ passwordDelayr_r rrwrdrlZareDonerSrZ loopbackAsyncZ logPrefixrJr)r/clientrvrSrrr")rr/rr# test_loopbacks4         zLoopbackTests.test_loopback)rrr rrrPr r"r"r"r#rs  rc@s eZdZedur dZddZdS)ModuleInitializationTestsNrtcCs,|tjjdd|tjjdddS)N<r)rrrxZprotocolMessagesr'r.r"r"r# test_messagess   z'ModuleInitializationTests.test_messages)rrr rrr r"r"r"r#r s r ):r!typesrtypingrZzope.interfacerZtwisted.conch.errorrrZtwisted.cred.checkersrZtwisted.cred.credentialsrr r Ztwisted.cred.errorr Ztwisted.cred.portalr r Ztwisted.internetrrZtwisted.internet.deferrZtwisted.protocolsrZtwisted.python.reflectrZ twisted.trialrr__annotations__Ztwisted.conch.checkersrZtwisted.conch.sshrrZtwisted.conch.ssh.commonrZtwisted.conch.testrr'r(r@rDr$rHr_rdrlrqZTestCasersrrr r"r"r"r#sV           #  A  &;