U Acjd @s"ddlmZddlZddlZddlZddlZddlmZddlm Z ddl m Z ddl m Z ddlmZmZddlmZdd lmZdd lmZmZdd lmZmZmZdd lmZdd lmZddl m!Z!ddl"m#Z#m$Z$m%Z%ddl&m'Z'ddl(m)Z)ddl*m+Z+ddl,m-Z-m.Z.ddl/m0Z0m1Z1zddlm2Z2m3Z3Wne4k rNYnXe+dZ5e5rddl6m7Z7ddl8m9Z9m:Z:m;Z;nddlWn2e4k rZ?zdZ@eAe?ZB[?W5dZ?[?XYnXe>Z@GdddZCGdd d e1ZDGd!d"d"ejEZFGd#d$d$ejGZHGd%d&d&ejIZJGd'd(d(ejIZKGd)d*d*ejEZLdFd,d-d.d/d0d1ZMGd2d3d3ZNGd4d5d5eNZOe e9Gd6d7d7e7ZPGd8d9d9ZQGd:d;d;eNZRGdd?d?eNeSe1ZTGd@dAdAeOeSe1ZUGdBdCdCeReSe1ZVGdDdEdEeOe1ZWdS)G) annotationsN)count)Any) implementer) ConchError)privateRSA_opensshpublicRSA_opensshConchTestRealm)portal)protocolreactor)Deferred gatherResults maybeDeferred)ProcessExitedAlready)IReactorProcess) LoopingCall)filepathlogruntime)FilePath)which) requireModule)HAS_IPV6skipWithoutIPv6)SkipTestTestCase)ConchTestServerFactoryconchTestPublicKeyChecker cryptography) ConchUser)ISession SSHSession wrapProtocol)r"c@s eZdZdS)r!N)__name__ __module__ __qualname__r(r(A/tmp/pip-unpacked-wheel-nrvc_22y/twisted/conch/test/test_conch.pyr!/sr!)r#c@seZdZdZdZddZdS) FakeStdioz A fake for testing L{twisted.conch.scripts.conch.SSHSession.eofReceived} and L{twisted.conch.scripts.cftp.SSHSession.eofReceived}. @ivar writeConnLost: A flag which records whether L{loserWriteConnection} has been called. FcCs d|_dS)z9 Record the call to loseWriteConnection. TN) writeConnLostselfr(r(r)loseWriteConnectionHszFakeStdio.loseWriteConnectionN)r%r&r'__doc__r+r.r(r(r(r)r*=sr*c@s$eZdZdZedkreZddZdS)StdioInteractingSessionTestsz> Tests for L{twisted.conch.scripts.conch.SSHSession}. NcCs*t}t}||_|||jdS)z} L{twisted.conch.scripts.conch.SSHSession.eofReceived} loses the write half of its stdio connection. N)r*StdioInteractingSessionstdio eofReceived assertTruer+)r-r2Zchannelr(r(r)test_eofReceivedWs z-StdioInteractingSessionTests.test_eofReceived)r%r&r'r/r1_reasonskipr5r(r(r(r)r0Osr0c@s$eZdZddZddZddZdS)EchocCstddS)NzECHO CONNECTION MADErmsgr,r(r(r)connectionMadedszEcho.connectionMadecCstddS)NzECHO CONNECTION DONEr9r-reasonr(r(r)connectionLostgszEcho.connectionLostcCs"|j|d|kr|jdS)N ) transportwriteloseConnectionr-datar(r(r) dataReceivedjs zEcho.dataReceivedN)r%r&r'r;r>rEr(r(r(r)r8csr8c@seZdZeZdS) EchoFactoryN)r%r&r'r8r r(r(r(r)rFpsrFc@sReZdZUdZdZded<dZdZdZded<d d Z d d Z d dZ ddZ dS)ConchTestOpenSSHProcessa Test protocol for launching an OpenSSH client process. @ivar deferred: Set by whatever uses this object. Accessed using L{_getDeferred}, which destroys the value so the Deferred is not fired twice. Fires when the process is terminated. @ivar expectedExitCode: If the process exit code is not C{expectedExitCode} the set C{deferred} will by triggerd with a failure. NzDeferred[None] | NonedeferredrintexpectedExitCodecCs|jd}|_|SNrHr-dr(r(r) _getDeferredsz$ConchTestOpenSSHProcess._getDeferredcCs|j|7_dSrL)bufrCr(r(r) outReceivedsz#ConchTestOpenSSHProcess.outReceivedcCs|j|7_dSrL)problemsrCr(r(r) errReceivedsz#ConchTestOpenSSHProcess.errReceivedc CsZ|jj|jkr:|td|j|jj|jdn|j dd}| |dS)z~ Called when the process has ended. @param reason: a Failure giving the reason for the process' end. zexit code was not {}: {} ({})charmaps r?N) valueZexitCoderKrPZerrbackrformatrSdecoderQreplacecallback)r-r=rQr(r(r) processEndeds  z$ConchTestOpenSSHProcess.processEnded) r%r&r'r/rH__annotations__rQrSrKrPrRrTr[r(r(r(r)rGts   rGc@sTeZdZdZdZddZddZddZd d Zd d Z d dZ ddZ ddZ dS)ConchTestForwardingProcessa Manages a third-party process which launches a server. Uses L{ConchTestForwardingPort} to connect to the third-party server. Once L{ConchTestForwardingPort} has disconnected, kill the process and fire a Deferred with the data received by the L{ConchTestForwardingPort}. @ivar deferred: Set by whatever uses this object. Accessed using L{_getDeferred}, which destroys the value so the Deferred is not fired twice. Fires when the process is terminated. NcCs||_d|_||_dS)aF @type port: L{int} @param port: The port on which the third-party server is listening. (it is assumed that the server is running on localhost). @type data: L{str} @param data: This is sent to the third-party server. Must end with ' ' in order to trigger a disconnect. N)portbufferrD)r-r^rDr(r(r)__init__s z#ConchTestForwardingProcess.__init__cCs|jd}|_|SrLrMrNr(r(r)rPsz'ConchTestForwardingProcess._getDeferredcCs |dSrL)_connectr,r(r(r)r;sz)ConchTestForwardingProcess.connectionMadecCs0ttt||j}|d|j}||j|S)a Connect to the server, which is often a third-party process. Tries to reconnect if it fails because we have no way of determining exactly when the port becomes available for listening -- we can only know when the process starts. 127.0.0.1) r Z ClientCreatorr ConchTestForwardingPortrDZ connectTCPr^Z addErrback _ebConnect)r-ccrOr(r(r)ras z#ConchTestForwardingProcess._connectcCstd|jdS)Ng?)r callLaterra)r-fr(r(r)rdsz%ConchTestForwardingProcess._ebConnectcCs.||_|jd|jtd|jdS)z The network connection has died; save the buffer of output from the network and attempt to quit the process gracefully, and then (after the reactor has spun) send it a KILL signal. rN)r_r@rArBr rf _reallyDie)r-r_r(r(r)forwardingPortDisconnecteds  z5ConchTestForwardingProcess.forwardingPortDisconnectedcCs*z|jdWntk r$YnXdS)NZKILL)r@Z signalProcessrr,r(r(r)risz%ConchTestForwardingProcess._reallyDiecCs||jdS)z Fire the Deferred at self.deferred with the data collected from the L{ConchTestForwardingPort} connection, if any. N)rPrZr_r<r(r(r)r[sz'ConchTestForwardingProcess.processEnded) r%r&r'r/rHr`rPr;rardrjrir[r(r(r(r)r]s   r]c@s0eZdZdZddZddZddZdd Zd S) rcz Connects to server launched by a third-party process (managed by L{ConchTestForwardingProcess}) sends data, then reports whatever it received back to the L{ConchTestForwardingProcess} once the connection is ended. cCs||_||_dS)z @type protocol: L{ConchTestForwardingProcess} @param protocol: The L{ProcessProtocol} which made this connection. @type data: str @param data: The data to be sent to the third-party server. N)r rD)r-r rDr(r(r)r`sz ConchTestForwardingPort.__init__cCsd|_|j|jdS)NrI)r_r@rArDr,r(r(r)r;sz&ConchTestForwardingPort.connectionMadecCs|j|7_dSrL)r_rCr(r(r)rEsz$ConchTestForwardingPort.dataReceivedcCs|j|jdSrL)r rjr_r<r(r(r)r> sz&ConchTestForwardingPort.connectionLostN)r%r&r'r/r`r;rEr>r(r(r(r)rcs  rcconchz list[str]strz list[bytes])argsmodreturncCs tjd|g}dd||DS)Na$-c ### Twisted Preamble import sys, os path = os.path.abspath(sys.argv[0]) while os.path.dirname(path) != path: if os.path.basename(path).startswith('Twisted'): sys.path.insert(0, path) break path = os.path.dirname(path) from twisted.conch.scripts.%s import run run()cSsg|]}|dqS)utf-8)encode).0Zeachr(r(r) sz_makeArgs..)sys executable)rmrnstartr(r(r) _makeArgss  rwc@sNeZdZesdZeddZddZddZdd Z d d Z d d ddZ dS)ConchServerSetupMixinzcan't run without cryptographycCstdS)Nstestuserr r(r(r(r) realmFactory'sz"ConchServerSetupMixin.realmFactoryc CsdD]}tj|rt|qtdd}|tW5QRXtdd}|tW5QRXtddt d }|j j s|j j rtdtdd}|dtW5QRXdS) N)rsa_test rsa_test.pubkh_testrzwbr{izgprivate key readable by others despite chmod; possible windows permission issue? see https://tm.tl/9767r|s 127.0.0.1 )ospathexistsremoveopenrArrchmodrZgetPermissionsgroupreadotherr)r-rg permissionsr(r(r) _createFiles+s       z"ConchServerSetupMixin._createFilescCs*t}|d|d}||S)N)r)socketbind getsocknameclose)r-sr^r(r(r) _getFreePort>s   z"ConchServerSetupMixin._getFreePortcCs.|}t|}|tt}||_|S)z Make a L{ConchTestServerFactory}, which allows us to start a L{ConchTestServer} -- i.e. an actually listening conch. )ryr ZPortalZregisterCheckerrr)r-realmpfactoryr(r(r)_makeConchFactoryEs   z'ConchServerSetupMixin._makeConchFactorycCsv|||_d|j_tjd|jdd|_tdt|_|j j |_ t rrtjdtdd|_ |j j |_dS)Nrrrb)Z interfacez::1)rr conchFactoryZexpectedLoseConnectionr Z listenTCP conchServerrF echoServergetHostr^echoPortr echoServerV6 echoPortV6r,r(r(r)setUpQs zConchServerSetupMixin.setUprrocCshzd|jj_Wntk r"YnX|jjjt|jjt|j jg}t r`| t|j jt |S)Nr)rprotodoneAttributeErrorr@rBrr stopListeningrrappendrr)r-Z deferredsr(r(r)tearDown^s  zConchServerSetupMixin.tearDownN) r%r&r'r r7 staticmethodryrrrrrr(r(r(r)rx#s   rxc@s(eZdZdZddZddZddZdS) ForwardingMixina Template class for tests of the Conch server's ability to forward arbitrary protocols over SSH. These tests are integration tests, not unit tests. They launch a Conch server, a custom TCP server (just an L{EchoProtocol}) and then call L{execute}. L{execute} is implemented by subclasses of L{ForwardingMixin}. It should cause an SSH client to connect to the Conch server, asking it to forward data to the custom TCP server. cCs|dt}||jdS)z Test that we can use whatever client to send the command "echo goodbye" to the Conch server. Make sure we receive "goodbye" back from the server. echo goodbyegoodbye executerG addCallback assertEqualrNr(r(r) test_exec}szForwardingMixin.test_execcCs>|}t|d}|jd|d||jfd}||jd|S)zy Test that we can use whatever client to forward a local port to a specified port on the server. test rz-N -L%i:127.0.0.1:%isshArgsrr]rrrrr-Z localPortprocessrOr(r(r)test_localToRemoteForwardings  z,ForwardingMixin.test_localToRemoteForwardingcCs>|}t|d}|jd|d||jfd}||jd|S)zs Test that we can use whatever client to forward a port from the server to a port locally. rrz-N -R %i:127.0.0.1:%irrrr(r(r)test_remoteToLocalForwardings  z,ForwardingMixin.test_remoteToLocalForwardingN)r%r&r'r/rrrr(r(r(r)ros   rc@sHeZdZdZddZddZddZdd Zd d Zd d Z ddZ dS) RekeyAvatara# This avatar implements a shell which sends 60 numbered lines to whatever connects to it, then closes the session with a 0 exit status. 60 lines is selected as being enough to send more than 2kB of traffic, the amount the client is configured to initiate a rekey after. cCst|t|jd<dS)Nssession)r!r`r#Z channelLookupr,r(r(r)r`s zRekeyAvatar.__init__csHt}|t|fdd}t|tddS)zE Write 60 lines of data to the transport, then exit. csXt|}|dkr6jjjddnd|f}|d}|dS)N<s exit-statussz line #%02d rp)nextstopsessionconnZ sendRequestrBrqrA)counterilinecallr@r(r)rAs   z$RekeyAvatar.openShell..writeg{Gz?N)r ProtocolZmakeConnectionr$rrrv)r-r@rrAr(rr) openShells   zRekeyAvatar.openShellcCsdS)z2 Ignore the close of the session. Nr(r,r(r(r)closedszRekeyAvatar.closedcCsdSrLr(r,r(r(r)r3szRekeyAvatar.eofReceivedcCsdSrLr()r-rcommandr(r(r) execCommandszRekeyAvatar.execCommandcCsdSrLr()r-ZtermZ windowSizemodesr(r(r)getPtyszRekeyAvatar.getPtycCsdSrLr()r-Z newWindowSizer(r(r) windowChangedszRekeyAvatar.windowChangedN) r%r&r'r/r`rrr3rrrr(r(r(r)rs!rc@seZdZdZddZdS) RekeyRealmzS This realm gives out new L{RekeyAvatar} instances for any avatar request. cGs|dtddfS)NrcSsdSrLr(r(r(r(r)rIz*RekeyRealm.requestAvatar..)r)r-ZavatarIDZmindZ interfacesr(r(r) requestAvatarszRekeyRealm.requestAvatarN)r%r&r'r/rr(r(r(r)rsrc@seZdZdZeZddZdS)RekeyTestsMixinzp TestCase mixin which defines tests exercising L{SSHTransportBase}'s handling of rekeying messages. cs.t}d|d}fdd}|||S)z After a client-initiated rekey is completed, application data continues to be passed over the SSH connection. rz-o RekeyLimit=2Kcs6dddtdDd}|d}||dS)N cSsg|]}d|fqS)z line #%02dr()rrrr(r(r)rsszFRekeyTestsMixin.test_clientRekey..finished..rrp)joinrangerqr)resultZexpectedResultr,r(r)finisheds z2RekeyTestsMixin.test_clientRekey..finished)rGrr)r-rrOrr(r,r)test_clientRekeys   z RekeyTestsMixin.test_clientRekeyN)r%r&r'r/rryrr(r(r(r)rsrc@s.eZdZedsdZd ddddddd Zd S) OpenSSHClientMixinsshz$no ssh command-line client availablerrlrGDeferred[None]) remoteCommandrrroc Cspt}|_d|d|}|jj}||}g}|D]} || dqtjtddddgtjd}t|ts8|d}|}Wntk rVYnX||krnt |d| dt d |}| |j d S) aI Call execute() method of L{OpenSSHClientMixin} with an ssh option that forces the exclusive use of the key exchange algorithm specified by keyExchangeAlgo @type keyExchangeAlgo: L{str} @param keyExchangeAlgo: The key exchange algorithm to use @return: L{defer.Deferred} rrz-QZkex)stderrrpz not supported by ssh clientz echo helloz-oKexAlgorithms=shello ) subprocess check_outputrSTDOUT isinstancerlrXr BaseExceptionrrrGrr)r-ZkeyExchangeAlgoZ kexAlgorithmsoutputrOr(r(r)assertExecuteWithKexAlgorithmFs&    z5OpenSSHKeyExchangeTests.assertExecuteWithKexAlgorithmcCs |dS)zb The ecdh-sha2-nistp256 key exchange algorithm is compatible with OpenSSH zecdh-sha2-nistp256rr,r(r(r)test_ECDHSHA256fsz'OpenSSHKeyExchangeTests.test_ECDHSHA256cCs |dS)zb The ecdh-sha2-nistp384 key exchange algorithm is compatible with OpenSSH zecdh-sha2-nistp384rr,r(r(r)test_ECDHSHA384msz'OpenSSHKeyExchangeTests.test_ECDHSHA384cCs |dS)zb The ecdh-sha2-nistp521 key exchange algorithm is compatible with OpenSSH zecdh-sha2-nistp521rr,r(r(r)test_ECDHSHA521tsz'OpenSSHKeyExchangeTests.test_ECDHSHA521cCs |dS)zl The diffie-hellman-group14-sha1 key exchange algorithm is compatible with OpenSSH. zdiffie-hellman-group14-sha1rr,r(r(r)test_DH_GROUP14{sz'OpenSSHKeyExchangeTests.test_DH_GROUP14cCs |dS)zs The diffie-hellman-group-exchange-sha1 key exchange algorithm is compatible with OpenSSH. z"diffie-hellman-group-exchange-sha1rr,r(r(r)test_DH_GROUP_EXCHANGE_SHA1sz3OpenSSHKeyExchangeTests.test_DH_GROUP_EXCHANGE_SHA1cCs |dS)zu The diffie-hellman-group-exchange-sha256 key exchange algorithm is compatible with OpenSSH. z$diffie-hellman-group-exchange-sha256rr,r(r(r)test_DH_GROUP_EXCHANGE_SHA256sz5OpenSSHKeyExchangeTests.test_DH_GROUP_EXCHANGE_SHA256cCs|t|jddS)zy The list of key exchange algorithms supported by OpenSSH client is obtained with C{ssh -Q kex}. zunsupported-algorithmN) assertRaisesrrr,r(r(r)test_unsupported_algorithms z2OpenSSHKeyExchangeTests.test_unsupported_algorithmN) r%r&r'r/rrrrrrrrr(r(r(r)r@s  rc@seZdZdZeddZdS)OpenSSHClientForwardingTestszR Connection forwarding tests run against the OpenSSL command line client. cCs>|}t|d}|jd|d||jfd}||jd|S)zG Forwarding of arbitrary IPv6 TCP connections via SSH. rrz-N -L%i:[::1]:%ir)rr]rrrrrr(r(r)test_localToRemoteForwardingV6s  z;OpenSSHClientForwardingTests.test_localToRemoteForwardingV6N)r%r&r'r/rrr(r(r(r)rsrc@seZdZdZdS)OpenSSHClientRekeyTestszE Rekeying tests run against the OpenSSL command line client. N)r%r&r'r/r(r(r(r)rsrc@sreZdZdZejdkrdZddddd dd d d d ZddZddZ d dddZ d dddZ d dddZ dS)CmdLineClientTestszP Connection forwarding tests run against the Conch command line client. win32z!can't run cmdline client on win32rNrbrlrGzlist[str] | Noner)rrr conchArgs remoteHostroc Cs|dkr g}t|_|jj}d||d|d|}t|}tj } tj t j| d<ttj|t jt||| d|jS)z{ As for L{OpenSSHClientTestCase.execute}, except it runs the 'conch' command line tool, not 'ssh'. Nz[-p {} -l testuser --known-hosts kh_test --user-authentications publickey -a -i rsa_test -v  PYTHONPATH)env)rrHrrr^rWlistrr~environcopypathseprrtrrr rrurw) r-rrrrrr^Z cmdtemplaterrr(r(r)rs0      zCmdLineClientTests.executecsVfdd}tjdtddjddgd}|jd |||S) z4 It can store logs to a local file. cs}d|dS)Ns Log opened.)Z getContentZassertIn)rZ logContentZlogPathr-r(r) cb_check_logsz.cb_check_logrz--logz --logfilez--host-key-algorithmszssh-rsarrrr)rrmktemprrGrrr)r-rrOr(rr)test_runWithLogFiles  z&CmdLineClientTests.test_runWithLogFilecCs"|jdtd}||jd|S)zH Do not use --host-key-algorithms flag on command line. r)rrrrrNr(r(r)%test_runWithNoHostAlgorithmsSpecifieds z8CmdLineClientTests.test_runWithNoHostAlgorithmsSpecifiedrcCs|jdtdgd|jdS)zS Simple smoke test for '--compress' flag to ensure we can connect. zecho compressedz --compressrs compressed rr,r(r(r) test_runWithCompressionSpecifiedsz3CmdLineClientTests.test_runWithCompressionSpecifiedcCst}d|_|jd|ddS)z< Connecting to an invalid host should fail. rzecho nonfunctionalnowhere.invalidrrr)rGrKrr-Z expectErrorr(r(r)test_connectToInvalidHostsz,CmdLineClientTests.test_connectToInvalidHostcCst}||jd|ddtS)zm L{ConchTestOpenSSHProcess} fails with a L{ConchError} if an expectation is not met. zecho checkfailurerr)rGZ assertFailurerrrr(r(r)test_testFailuresz#CmdLineClientTests.test_testFailure)rNrb) r%r&r'r/rZ platformTyper7rrrrrrr(r(r(r)rs !   r)rk)X __future__rr~rrrt itertoolsrtypingrZzope.interfacerZtwisted.conch.errorrZtwisted.conch.test.keydatarrZtwisted.conch.test.test_sshr Z twisted.credr Ztwisted.internetr r Ztwisted.internet.deferrrrZtwisted.internet.errorrZtwisted.internet.interfacesrZtwisted.internet.taskrZtwisted.pythonrrrZtwisted.python.filepathrZtwisted.python.procutilsrZtwisted.python.reflectrZtwisted.test.testutilsrrZtwisted.trial.unittestrrrr ImportErrorr Ztwisted.conch.avatarr!Ztwisted.conch.ssh.sessionr"r#r$Ztwisted.conch.interfacesZtwisted.conch.scripts.conchZ_StdioInteractingSessioner1rlr6r*r0rr8ZFactoryrFZProcessProtocolrGr]rcrwrxrrrrrrrrrr(r(r(r)st                0LL6D 4\