U “j4y@sUdZddlZddlmZddlmZddlmZddlm Z e e e d<z ddl Z Wne k rndZYnXdZdd lmZdd lmZdd lmZmZmZmZdd lmZmZdd lmZddlmZddlm Z m!Z!ddl"m#Z#ddl$m%Z%ddl&m'Z'ddl(m)Z)e%drPdZ*ddl+m,Z,ddl-m.Z.m/Z/ddl0m1Z1ddl2m3Z3ndZ*e4edddk rldZ5ndZ5Gddde)Z6Gddde)Z7Gd d!d!e)Z8Gd"d#d#e)Z9Gd$d%d%e)Z:Gd&d'd'e)Z;Gd(d)d)e)ZZ?Gd.d/d/e)Z@dS)0z& Tests for L{twisted.conch.checkers}. N) encodebytes) namedtuple)BytesIO)Optional cryptSkipzcannot run without crypt module) verifyObject)'InMemoryUsernamePasswordDatabaseDontUse)ISSHPrivateKeyIUsernamePassword SSHPrivateKeyUsernamePassword)UnauthorizedLoginUnhandledCredentials)Deferred)util)ShadowDatabase UserDatabase)FilePath) requireModule)MockOS)TestCaseZ cryptography)checkers)NotEnoughAuthenticationValidPublicKey)keys)keydatazcan't run without cryptographygeteuidz0Cannot run without effective UIDs (questionable)c@sXeZdZdZepeZddZddZddZ dd Z d d Z d d Z ddZ ddZdS) HelperTestszl Tests for helper functions L{verifyCryptedPassword}, L{_pwdGetByName} and L{_shadowGetByName}. cCs t|_dSN)rmockosselfr"D/tmp/pip-unpacked-wheel-59kc99xd/twisted/conch/test/test_checkers.pysetUp@szHelperTests.setUpcCs4d}d}t||}|t||d||dS)z L{verifyCryptedPassword} returns C{True} if the plaintext password passed to it matches the encrypted password passed to it. secret stringZsaltyz5{!r} supposed to be valid encrypted password for {!r}Ncrypt assertTruerverifyCryptedPasswordformatr!passwordsaltcryptedr"r"r#test_verifyCryptedPasswordCs  z&HelperTests.test_verifyCryptedPasswordcCs4d}d}t||}|t||d||dS)z L{verifyCryptedPassword} returns True if the provided cleartext password matches the provided MD5 password hash. r,z$1$saltz3{!r} supposed to be valid encrypted password for {}Nr&r+r"r"r#test_verifyCryptedPasswordMD5Rs  z)HelperTests.test_verifyCryptedPasswordMD5cCs8d}d}d}t||}|t||d||dS)z L{verifyCryptedPassword} returns C{False} if the plaintext password passed to it does not match the encrypted password passed to it. z string secretZsomesaltr%z7{!r} not supposed to be valid encrypted password for {}N)r' assertFalserr)r*)r!r,r-wrongr.r"r"r#test_refuteCryptedPasswordas  z&HelperTests.test_refuteCryptedPasswordc CsFt}|ddddddd|td||td|dd S) z L{_pwdGetByName} returns a tuple of items from the UNIX /etc/passwd database if the L{pwd} module is present. aliceZsecrit first last/foo/bin/shpwdN)raddUserpatchr assertEqual _pwdGetByNamegetpwnamr!userdbr"r"r#test_pwdGetByNameqszHelperTests.test_pwdGetByNamecCs"|tdd|tddS)zW If the C{pwd} module isn't present, L{_pwdGetByName} returns L{None}. r:Nr4)r<r assertIsNoner>r r"r"r#test_pwdGetByNameWithoutPwd{sz'HelperTests.test_pwdGetByNameWithoutPwdc Cst}|ddddddddd |td |d |j_d |j_|td |j|t d| d||jj dd g||jj dd gdS)z L{_shadowGetByName} returns a tuple of items from the UNIX /etc/shadow database if the L{spwd} is present. bobZ passphraser5r6spwd) osrN) rr;r<rreuidegidrr=_shadowGetByNameZgetspnam seteuidCalls setegidCallsr@r"r"r#test_shadowGetByNamesz HelperTests.test_shadowGetByNamecCsB|tdd|td||jjg||jjgdS)zP L{_shadowGetByName} returns L{None} if C{spwd} is not present. rKNrE)r<rrCrQr=rrRrSr r"r"r#test_shadowGetByNameWithoutSpwdsz+HelperTests.test_shadowGetByNameWithoutSpwdN)__name__ __module__ __qualname____doc__rdependencySkipskipr$r/r0r3rBrDrTrUr"r"r"r#r8s rc@sveZdZdZepeZddddZddZdd Z d d Z d d Z ddZ ddZ ddZddZddZddZdS)SSHPublicKeyDatabaseTestsz, Tests for L{SSHPublicKeyDatabase}. Nreturnc Cst|_td|_td|_d|jd|jd|_t|_| t d|jt | |_ t|j j tspt|j d|_|jt}|dd d d d |j j d ||j_dS)Nfoobareggspamst1 s foo t2 s egg rN.sshuserr,r5r6r7 /bin/shell)rSSHPublicKeyDatabasecheckerrkey1key2contentrrr<rrmktemppath isinstancestrAssertionErrorchildsshDirmakedirsrr;Z_userdbr@r"r"r#r$s*     zSSHPublicKeyDatabaseTests.setUpcCsL|j|jgd}||ddt||ddd|t|ddS)zJ L{SSHPublicKeyDatabase} is deprecated as of version 15.0 )ZoffendingFunctionsrcategorymessageztwisted.conch.checkers.SSHPublicKeyDatabase was deprecated in Twisted 15.0.0: Please use twisted.conch.checkers.SSHPublicKeyChecker, initialized with an instance of twisted.conch.checkers.UNIXAuthorizedKeysFiles instead.r5N)Z flushWarningsr$r=DeprecationWarninglen)r!Z warningsShownr"r"r#test_deprecateds z)SSHPublicKeyDatabaseTests.test_deprecatedcCsj|j||jtdd}d|_||j|d|_||j|d|_| |j|dS)Nuserpasswordr_r`s notallowed) rorn setContentrhr blobr(recheckKeyr1)r!filenamerbr"r"r# _testCheckKeys z'SSHPublicKeyDatabaseTests._testCheckKeycCs.|d||jjg||jjgdS)z L{SSHPublicKeyDatabase.checkKey} should retrieve the content of the authorized_keys file and check the keys against that file. authorized_keysNr|r=rrRrSr r"r"r# test_checkKeys z'SSHPublicKeyDatabaseTests.test_checkKeycCs.|d||jjg||jjgdS)z L{SSHPublicKeyDatabase.checkKey} should retrieve the content of the authorized_keys2 file and check the keys against that file. authorized_keys2Nr~r r"r"r#test_checkKey2s z(SSHPublicKeyDatabaseTests.test_checkKey2cs|jd|jd|jd|jjfdd}d|j_d|j_ | |jd|| t d |jt d d }d |_ ||j|||jjdd ddg||jjddgdS)z If the key file is readable, L{SSHPublicKeyDatabase.checkKey} should switch its uid/gid to the ones of the authenticated user. r}rcsd|S)Nr)chmod)rOZkeyFileZ savedSeteuidr"r#seteuids z>SSHPublicKeyDatabaseTests.test_checkKeyAsRoot..seteuidrLrMrrNrvrwr_r5r6N)rornrxrhrZ addCleanuprrrOrPr<rr ryr(rerzr=rRrS)r!rrbr"rr#test_checkKeyAsRoots    z-SSHPublicKeyDatabaseTests.test_checkKeyAsRootcs\dd}jd|tddtjdtjtj d}j |}fdd}| |S) z L{SSHPublicKeyDatabase.requestAvatarId} should return the avatar id passed in if its C{_checkKey} method returns True. cSsdSNTr"Zignoredr"r"r# _checkKey szASSHPublicKeyDatabaseTests.test_requestAvatarId.._checkKeyrztestssh-rsafoocs|ddSNrr=ZavatarIdr r"r#_verifysz?SSHPublicKeyDatabaseTests.test_requestAvatarId.._verify) r<rer rpublicRSA_opensshrKey fromStringprivateRSA_opensshsignrequestAvatarId addCallback)r!r credentialsdrr"r r#test_requestAvatarIds  z.SSHPublicKeyDatabaseTests.test_requestAvatarIdcCsBdd}||jd|tddtjdd}|j|}||tS)a( L{SSHPublicKeyDatabase.requestAvatarId} should raise L{ValidPublicKey} if the credentials represent a valid key without a signature. This tells the user that the key is valid for login, but does not actually allow that user to do so without a signature. cSsdSrr"rr"r"r#r&szQSSHPublicKeyDatabaseTests.test_requestAvatarIdWithoutSignature.._checkKeyrzrrN)r<rer rrr assertFailurerr!rrrr"r"r#$test_requestAvatarIdWithoutSignatures z>SSHPublicKeyDatabaseTests.test_requestAvatarIdWithoutSignaturecCs0dd}||jd||jd}||tS)z If L{SSHPublicKeyDatabase.checkKey} returns False, C{_cbRequestAvatarId} should raise L{UnauthorizedLogin}. cSsdSNFr"rr"r"r#r6szKSSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidKey.._checkKeyrzN)r<rerrr )r!rrr"r"r#test_requestAvatarIdInvalidKey0s z8SSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidKeycCsRdd}||jd|tddtjdtjtj d}|j |}| |t S)z Valid keys with invalid signatures should cause L{SSHPublicKeyDatabase.requestAvatarId} to return a {UnauthorizedLogin} failure cSsdSrr"rr"r"r#rDszQSSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidSignature.._checkKeyrzrrr) r<rer rrrrrprivateDSA_opensshrrrr rr"r"r#$test_requestAvatarIdInvalidSignature=s z>SSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidSignaturecsVdd}jd|tddddd}j|}fd d }|||tS) z~ Exceptions raised while verifying the key should be normalized into an C{UnauthorizedLogin} failure. cSsdSrr"rr"r"r#rXszSSSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeException.._checkKeyrzrNsblobssigDatassigcs tj}t|d|S)Nr5)flushLoggedErrorsr BadKeyErrorr=rt)Zfailureerrorsr r"r#_verifyLoggedException_s z`SSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeException.._verifyLoggedException)r<rer rZ addErrbackrr )r!rrrrr"r r#&test_requestAvatarIdNormalizeExceptionRs   z@SSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeException)rVrWrXrYeuidSkiprZr[r$rur|rrrrrrrrr"r"r"r#r\s    r\c@sDeZdZdZeZddZddZddZdd Z d d Z d d Z dS)SSHProtocolCheckerTestsz* Tests for L{SSHProtocolChecker}. cCsLt}||jg|t||jtg||jttjdS)z L{SSHProcotolChecker.registerChecker} should add the given checker to the list of registered checkers. N)rSSHProtocolCheckerr=credentialInterfacesregisterCheckerrdr assertIsInstancer!rer"r"r#test_registerCheckerosz,SSHProtocolCheckerTests.test_registerCheckercCsNt}||jg|tt||jtg||jttjdS)z If a specific interface is passed into L{SSHProtocolChecker.registerChecker}, that interface should be registered instead of what the checker specifies in credentialIntefaces. N)rrr=rrrdr rrr"r"r#!test_registerCheckerWithInterface~sz9SSHProtocolCheckerTests.test_registerCheckerWithInterfacecsJt}t}|dd|||tdd}fdd}||S)z L{SSHProtocolChecker.requestAvatarId} should defer to one if its registered checkers to authenticate a user. rcs|ddSrrrr r"r# _callbacksz?SSHProtocolCheckerTests.test_requestAvatarId.._callback)rrrr;rrr r)r!repasswordDatabaserrr"r r#rs   z,SSHProtocolCheckerTests.test_requestAvatarIdcCsVt}dd}||d|t}|dd|||tdd}||t S)z If the client indicates that it is never satisfied, by always returning False from _areDone, then L{SSHProtocolChecker} should raise L{NotEnoughAuthentication}. cSsdSrr"rr"r"r#_areDoneszYSSHProtocolCheckerTests.test_requestAvatarIdWithNotEnoughAuthentication.._areDoneareDoner) rrr<rr;rrr rr)r!rerrrr"r"r#/test_requestAvatarIdWithNotEnoughAuthentications  zGSSHProtocolCheckerTests.test_requestAvatarIdWithNotEnoughAuthenticationcCs$t}|tdd}||tS)z If the passed credentials aren't handled by any registered checker, L{SSHProtocolChecker} should raise L{UnhandledCredentials}. r)rrrr rr)r!rerr"r"r#%test_requestAvatarIdInvalidCredentialsz=SSHProtocolCheckerTests.test_requestAvatarIdInvalidCredentialcCs|tddS)zV The default L{SSHProcotolChecker.areDone} should simply return True. N)r(rrrr r"r"r# test_areDonesz$SSHProtocolCheckerTests.test_areDoneN) rVrWrXrYrZr[rrrrrrr"r"r"r#rhs rc@sneZdZdZepeZeeeddddZ ddZ dd Z d d Z d d Z ddZddZddZddZdS)UNIXPasswordDatabaseTestsz, Tests for L{UNIXPasswordDatabase}. N)rusernamer^cCs||||dS)z Assert that the L{Deferred} passed in is called back with the value 'username'. This represents a valid login for this TestCase. @param d: a L{Deferred} from an L{IChecker.requestAvatarId} method. N)r=successResultOf)r!rrr"r"r#assertLoggedInsz(UNIXPasswordDatabaseTests.assertLoggedInc Cs<t}dd}t}|d|ddddddd |d d ddd d d t}|ddddddddd |d |d dddddddd |td||td|t}|td|d|_d|_ t d d!}| | |d | |jg| |jgd"|_| | |d"| |jd#dg| |jd#dgd$S)%z L{UNIXPasswordDatabase} with no arguments has checks the C{pwd} database and then the C{spwd} database. cSs t||}t|d|}|S)Nz$1$)r')rr,r-r.r"r"r#r.s z?UNIXPasswordDatabaseTests.test_defaultCheckers..cryptedr4r,r5r6foor8r9rExbar/barr2rFrGrHrIrJ r:rKrNrLrMalicerwbobrN)rUNIXPasswordDatabaserr;rr<rrrOrPr rrr=rRrSr)r!rer.r:rKrcredr"r"r#test_defaultCheckerss<  z.UNIXPasswordDatabaseTests.test_defaultCheckerscCs||tjdS)a Asserts that the L{Deferred} passed in is erred back with an L{UnauthorizedLogin} L{Failure}. This reprsents an invalid login for this TestCase. NOTE: To work, this method's return value must be returned from the test method, or otherwise hooked up to the test machinery. @param d: a L{Deferred} from an L{IChecker.requestAvatarId} method. @type d: L{Deferred} @rtype: L{None} N)failureResultOfrr r!rr"r"r#assertUnauthorizedLogins z1UNIXPasswordDatabaseTests.assertUnauthorizedLoginc CsRtdd}t}|d|dddddt|jg}||tdd dd S) zo L{UNIXPasswordDatabase} takes a list of functions to check for UNIX user information. secretZanybodyr5r6rrr9sanybodyssecretN) r'rr;rrr?rrr )r!r,rArer"r"r#test_passInCheckerss z-UNIXPasswordDatabaseTests.test_passInCheckerscCsJdd}dd}|td|t|g}tdd}|||ddS)z If the encrypted password provided by the getpwnam function is valid (verified by the L{verifyCryptedPassword} function), we callback the C{requestAvatarId} L{Deferred} with the username. cSs||kSrr"r.pwr"r"r#r)szLUNIXPasswordDatabaseTests.test_verifyPassword..verifyCryptedPasswordcSs||gSrr"rr"r"r#r?sz?UNIXPasswordDatabaseTests.test_verifyPassword..getpwnamr)usernameNr<rrr rrr!r)r?re credentialr"r"r#test_verifyPasswords   z-UNIXPasswordDatabaseTests.test_verifyPasswordcCs2dd}t|g}tdd}|||dS)z} If the getpwnam function raises a KeyError, the login fails with an L{UnauthorizedLogin} exception. cSs t|dSr)KeyErrorrr"r"r#r?,sz?UNIXPasswordDatabaseTests.test_failOnKeyError..getpwnamrrwN)rrr rr)r!r?rerr"r"r#test_failOnKeyError&s  z-UNIXPasswordDatabaseTests.test_failOnKeyErrorcCsHdd}dd}|td|t|g}tdd}|||dS) z If the verifyCryptedPassword function doesn't verify the password, the login fails with an L{UnauthorizedLogin} exception. cSsdSrr"rr"r"r#r)9szOUNIXPasswordDatabaseTests.test_failOnBadPassword..verifyCryptedPasswordcSs|dgS)Nrwr"rr"r"r#r?<szBUNIXPasswordDatabaseTests.test_failOnBadPassword..getpwnamr)rrwN)r<rrr rrrr"r"r#test_failOnBadPassword3s   z0UNIXPasswordDatabaseTests.test_failOnBadPasswordcCsTdd}dd}dd}|td|t||g}tdd }|||dd S) a UNIXPasswordDatabase.requestAvatarId loops through each getpwnam function associated with it and returns a L{Deferred} which fires with the result of the first one which returns a value other than None. ones do not verify the password. cSs||kSrr"rr"r"r#r)LszRUNIXPasswordDatabaseTests.test_loopThroughFunctions..verifyCryptedPasswordcSs|dgS)Nznot the passwordr"rr"r"r# getpwnam1OszFUNIXPasswordDatabaseTests.test_loopThroughFunctions..getpwnam1cSs|dgS)Nr,r"rr"r"r# getpwnam2RszFUNIXPasswordDatabaseTests.test_loopThroughFunctions..getpwnam2r)rrwNr)r!r)rrrerr"r"r#test_loopThroughFunctionsDs z3UNIXPasswordDatabaseTests.test_loopThroughFunctionsc Cst}|ddddddd|ddddddd|d d ddddd|td |ttjg}td d }|||tdd}|||tdd}|||dS)z If the password returned by any function is C{""}, C{"x"}, or C{"*"} it is not compared against the supplied password. Instead it is skipped. r4r5r6rrrErZcarol*r:rrxscarol*N) rr;r<rrr>r rr)r!r:rerr"r"r#test_failOnSpecialZs   z,UNIXPasswordDatabaseTests.test_failOnSpecial)rVrWrXrYrrZr[rbytesrrrrrrrrrr"r"r"r#rs (  rc@s,eZdZdZeZddZddZddZdS) AuthorizedKeyFileReaderTestsz5 Tests for L{checkers.readAuthorizedKeyFile} cCs0td}t|dd}|ddgt|dS)zg L{checkers.readAuthorizedKeyFile} does not attempt to turn comments into keys sE# this comment is ignored this is not # this is again and this is notcSs|Srr"rr"r"r#rzCAuthorizedKeyFileReaderTests.test_ignoresComments..s this is notsand this is notNrrZreadAuthorizedKeyFiler=listr!fileobjresultr"r"r#test_ignoresCommentsws z1AuthorizedKeyFileReaderTests.test_ignoresCommentscCs0td}tj|ddd}|dgt|dS)zw L{checkers.readAuthorizedKeyFile} ignores leading whitespace in lines, as well as empty lines sg # ignore not ignored cSs|Srr"rr"r"r#rrzYAuthorizedKeyFileReaderTests.test_ignoresLeadingWhitespaceAndEmptyLines..ZparseKeys not ignoredNrrr"r"r#*test_ignoresLeadingWhitespaceAndEmptyLiness zGAuthorizedKeyFileReaderTests.test_ignoresLeadingWhitespaceAndEmptyLinescCs4dd}td}tj||d}|dgt|dS)z L{checkers.readAuthorizedKeyFile} does not raise an exception when a key fails to parse (raises a L{twisted.conch.ssh.keys.BadKeyError}), but rather just keeps going cSs|drtd|S)Nfzfailed to parse) startswithrr)liner"r"r# failOnSomes  zKAuthorizedKeyFileReaderTests.test_ignoresUnparsableKeys..failOnSomesfailed key good keyrsgood keyNr)r!rrrr"r"r#test_ignoresUnparsableKeyssz7AuthorizedKeyFileReaderTests.test_ignoresUnparsableKeysN) rVrWrXrYrZr[rrrr"r"r"r#rps rc@s,eZdZdZeZddZddZddZdS) InMemorySSHKeyDBTestsz0 Tests for L{checkers.InMemorySSHKeyDB} cCs tddgi}ttj|dS)z_ L{checkers.InMemorySSHKeyDB} implements L{checkers.IAuthorizedKeysDB} rskeyN)rInMemorySSHKeyDBrIAuthorizedKeysDBr!keydbr"r"r#test_implementsInterfacesz.InMemorySSHKeyDBTests.test_implementsInterfacecCs*tddgi}|gt|ddS)z If the user is not in the mapping provided to L{checkers.InMemorySSHKeyDB}, an empty iterator is returned by L{checkers.InMemorySSHKeyDB.getAuthorizedKeys} rskeysrNrrr=rgetAuthorizedKeysrr"r"r#test_noKeysForUnauthorizedUsersz4InMemorySSHKeyDBTests.test_noKeysForUnauthorizedUsercCs0tdddgi}|ddgt|ddS)z If the user is in the mapping provided to L{checkers.InMemorySSHKeyDB}, an iterator with all the keys is returned by L{checkers.InMemorySSHKeyDB.getAuthorizedKeys} rabNrrr"r"r#test_allKeysForAuthorizedUsersz3InMemorySSHKeyDBTests.test_allKeysForAuthorizedUserN) rVrWrXrYrZr[rrrr"r"r"r#rs  rc@sJeZdZdZeZddddZddZdd Zd d Z d d Z ddZ dS)UNIXAuthorizedKeysFilesTestsz8 Tests for L{checkers.UNIXAuthorizedKeysFiles}. Nr]c Cst||_t|jjts t|jt|_|j ddddd|jjd|j d|_ |j |j d}| d d d g|_ dS) Nr4r,r5r6zalice lastnamercrar}s key 1 key 2skey 1skey 2)rrirjrkrlrmrprrAr;rnrorx expectedKeys)r!ZauthorizedKeysr"r"r#r$s$     z"UNIXAuthorizedKeysFilesTests.setUpcCst|j}ttj|dS)zg L{checkers.UNIXAuthorizedKeysFiles} implements L{checkers.IAuthorizedKeysDB}. N)rUNIXAuthorizedKeysFilesrArrrr"r"r#rs z5UNIXAuthorizedKeysFilesTests.test_implementsInterfacecCs.tj|jddd}|gt|ddS)z If the user is not in the user database provided to L{checkers.UNIXAuthorizedKeysFiles}, an empty iterator is returned by L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys}. cSs|Srr"rr"r"r#rrzMUNIXAuthorizedKeysFilesTests.test_noKeysForUnauthorizedUser..rrN)rrrAr=rrrr"r"r#rsz;UNIXAuthorizedKeysFilesTests.test_noKeysForUnauthorizedUsercCsH|jddtj|jddd}||jdgt| ddS)a If the user is in the user database provided to L{checkers.UNIXAuthorizedKeysFiles}, an iterator with all the keys in C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2} is returned by L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys}. rskey 3cSs|Srr"rr"r"r#rrz`UNIXAuthorizedKeysFilesTests.test_allKeysInAllAuthorizedFilesForAuthorizedUser..rrN) rornrxrrrAr=rrrrr"r"r#1test_allKeysInAllAuthorizedFilesForAuthorizedUsers  zNUNIXAuthorizedKeysFilesTests.test_allKeysInAllAuthorizedFilesForAuthorizedUsercCs0tj|jddd}||jt|ddS)z L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys} returns only the keys in C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2} if they exist. cSs|Srr"rr"r"r#rrzJUNIXAuthorizedKeysFilesTests.test_ignoresNonexistantFile..rrN)rrrAr=rrrrr"r"r#test_ignoresNonexistantFilesz8UNIXAuthorizedKeysFilesTests.test_ignoresNonexistantFilecCs@|jdtj|jddd}||jt| ddS)z L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys} returns only the keys in C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2} if they are readable. rcSs|Srr"rr"r"r#rrzIUNIXAuthorizedKeysFilesTests.test_ignoresUnreadableFile..rrN) rornrprrrAr=rrrrr"r"r#test_ignoresUnreadableFile sz7UNIXAuthorizedKeysFilesTests.test_ignoresUnreadableFile) rVrWrXrYrZr[r$rrrrrr"r"r"r#rs   r_KeyDBrc@seZdZdZdS)_DummyExceptionz0 Fake exception to be used for testing. N)rVrWrXrYr"r"r"r#rsrc@sLeZdZdZeZddZddZddZdd Z d d Z d d Z ddZ dS)SSHPublicKeyCheckerTestsz4 Tests for L{checkers.SSHPublicKeyChecker}. cCsDtddtjdtjtjd|_t dd|_ t |j |_ dS)NrrrcSstjtjgSr)rrrrr)_r"r"r#r0rz0SSHPublicKeyCheckerTests.setUp..)r rrrrrrrrrrrZSSHPublicKeyCheckerrer r"r"r#r$(szSSHPublicKeyCheckerTests.setUpcCs"d|j_||j|jtdS)z Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with credentials that do not have a signature fails with L{ValidPublicKey}. N)r signaturerrerrr r"r"r# test_credentialsWithoutSignature3s  z9SSHPublicKeyCheckerTests.test_credentialsWithoutSignaturecCs$d|j_||j|jtjdS)z Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with credentials that have a bad key fails with L{keys.BadKeyError}. rN)rryrrerrrr r"r"r#test_credentialsWithBadKey=s  z3SSHPublicKeyCheckerTests.test_credentialsWithBadKeycCs$tj|j_||j|jtdS)z If L{checkers.IAuthorizedKeysDB.getAuthorizedKeys} returns no keys that match the credentials, L{checkers.SSHPublicKeyChecker.requestAvatarId} fails with L{UnauthorizedLogin}. N)rZpublicDSA_opensshrryrrerr r r"r"r#test_credentialsNoMatchingKeyGs   z6SSHPublicKeyCheckerTests.test_credentialsNoMatchingKeycCs2tjtjd|j_||j |jt dS)z Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with credentials that are incorrectly signed fails with L{UnauthorizedLogin}. rN) rrrrrrrr rrerr r r"r"r# test_credentialsInvalidSignatureSs z9SSHPublicKeyCheckerTests.test_credentialsInvalidSignaturecCs<dd}|tjd|||j|jt|t dS)z If L{keys.Key.verify} raises an exception, L{checkers.SSHPublicKeyChecker.requestAvatarId} fails with L{UnauthorizedLogin}. c_s tdSr)r)argskwargsr"r"r#failgsz?SSHPublicKeyCheckerTests.test_failureVerifyingKey..failverifyN) r<rrrrerrr rr)r!rr"r"r#test_failureVerifyingKey`s z1SSHPublicKeyCheckerTests.test_failureVerifyingKeycCs$|j|j}|d||dS)zu L{checker.SSHPublicKeyChecker.requestAvatarId}, if successful, callbacks with the username. rN)rerrr=rrr"r"r#test_usernameReturnedOnSuccessqsz7SSHPublicKeyCheckerTests.test_usernameReturnedOnSuccessN) rVrWrXrYrZr[r$r r rrrrr"r"r"r#r !s     r )ArYrNbase64r collectionsriortypingrrl__annotations__r' ImportErrorrZzope.interface.verifyrZtwisted.cred.checkersrZtwisted.cred.credentialsr r r r Ztwisted.cred.errorr rZtwisted.internet.deferrZtwisted.pythonrZtwisted.python.fakepwdrrZtwisted.python.filepathrZtwisted.python.reflectrZtwisted.test.test_processrZtwisted.trial.unittestrrZZ twisted.conchrZtwisted.conch.errorrrZtwisted.conch.sshrZtwisted.conch.testrgetattrrrr\rrrrrr Exceptionrr r"r"r"r#sX                  fKX14"P