U T‚gèZã@sdZddlZddlZddlmZmZmZmZddlm Z ddl m Z ddl m Z ddlmZddlmZdd lmZdd lmZz0dd lmamZdd lmadd lmZmZWn"ek rÒdd„ZeƒYnXddlm Z Gdd„de j!ƒZ"Gdd„de j!ƒZ#Gdd„dej$ƒZ%Gdd„dej$ƒZ&e ej'ƒGdd„dej$ƒƒZ(dd„Z)dd„Z*Gdd „d ƒZ+tdk r~Gd!d"„d"tj,ƒZ-Gd#d$„d$eeƒZ.Gd%d&„d&eƒZ/Gd'd(„d(e/ƒZ0Gd)d*„d*eƒZ1Gd+d,„d,ee+ƒZ2Gd-d.„d.ƒZ3Gd/d0„d0eƒZ4Gd1d2„d2eƒZ5dS)3z Tests for twisted SSL support. éN)ÚdeferÚ interfacesÚprotocolÚreactor)ÚConnectionDone)ÚwaitUntilAllDisconnected)Úbasic)ÚFilePath)Úplatform)ÚProperlyCloseFilesMixin)ÚTestCase)ÚSSLÚcrypto)Ússl)ÚClientTLSContextÚcertPathcCs daadS©N)r r©rrú9/tmp/pip-unpacked-wheel-1_7di8ic/twisted/test/test_ssl.pyÚ_noSSLsr)Ú implementerc@sBeZdZdZdddgZddgZdd„Zd d „Zd d „Zd d„Z dS)ÚUnintelligentProtocola @ivar deferred: a deferred that will fire at connection lost. @type deferred: L{defer.Deferred} @cvar pretext: text sent before TLS is set up. @type pretext: C{bytes} @cvar posttext: text sent after TLS is set up. @type posttext: C{bytes} s first lineslast thing before tls startsóSTARTTLSsfirst thing after tls startedslast thing evercCst ¡|_dSr©rÚDeferredÚdeferred©ÚselfrrrÚ__init__7szUnintelligentProtocol.__init__cCs|jD]}| |¡qdSr)ÚpretextÚsendLine)rÚlrrrÚconnectionMade:s z$UnintelligentProtocol.connectionMadecCs@|dkr<|j tƒ|jj¡|jD]}| |¡q"|j ¡dS)NóREADY)Ú transportÚstartTLSrÚfactoryÚclientÚposttextr ÚloseConnection)rÚliner!rrrÚ lineReceived>s   z"UnintelligentProtocol.lineReceivedcCs|j d¡dSr©rÚcallback©rÚreasonrrrÚconnectionLostEsz$UnintelligentProtocol.connectionLostN) Ú__name__Ú __module__Ú __qualname__Ú__doc__rr(rr"r+r0rrrrr's rc@s:eZdZdZddd„Zdd„Zdd„Zd d „Zd d „Zd S)Ú LineCollectoraJ @ivar deferred: a deferred that will fire at connection lost. @type deferred: L{defer.Deferred} @ivar doTLS: whether the protocol is initiate TLS or not. @type doTLS: C{bool} @ivar fillBuffer: if set to True, it will send lots of data once C{STARTTLS} is received. @type fillBuffer: C{bool} FcCs||_||_t ¡|_dSr)ÚdoTLSÚ fillBufferrrr)rr6r7rrrrVszLineCollector.__init__cCsd|j_g|j_dS)Nó)r&ÚrawdataÚlinesrrrrr"[szLineCollector.connectionMadecCsp|jj |¡|dkrl|jr4tdƒD]}| d¡q$| d¡|jrdtttd}|j   ||jj ¡n|  ¡dS)NriôsèXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXr#)ZprivateKeyFileNameZcertificateFileName) r&r:Úappendr7Úranger r6ÚServerTLSContextrr$r%ÚserverZ setRawMode)rr*ÚxÚctxrrrr+_s   þzLineCollector.lineReceivedcCs|jj|7_|j ¡dSr)r&r9r$r)©rÚdatarrrÚrawDataReceivedoszLineCollector.rawDataReceivedcCs|j d¡dSrr,r.rrrr0sszLineCollector.connectionLostN)F) r1r2r3r4rr"r+rCr0rrrrr5Is  r5c@seZdZdZdd„ZdS)ÚSingleLineServerProtocolzK A protocol that sends a single line of data at C{connectionMade}. cCs|j d¡|j ¡dS)Nó+OK )r$ÚwriteÚgetPeerCertificaterrrrr"|s z'SingleLineServerProtocol.connectionMadeN)r1r2r3r4r"rrrrrDwsrDc@s(eZdZdZdd„Zdd„Zdd„ZdS) ÚRecordingClientProtocolzv @ivar deferred: a deferred that will fire with first received content. @type deferred: L{defer.Deferred} cCst ¡|_dSrrrrrrr‡sz RecordingClientProtocol.__init__cCs|j ¡dSr)r$rGrrrrr"Šsz&RecordingClientProtocol.connectionMadecCs|j |¡dSrr,rArrrÚ dataReceivedsz$RecordingClientProtocol.dataReceivedN)r1r2r3r4rr"rIrrrrrHsrHc@s eZdZdZdd„Zdd„ZdS)Ú ImmediatelyDisconnectingProtocolz• A protocol that disconnect immediately on connection. It fires the C{connectionDisconnected} deferred of its factory on connetion lost. cCs|j ¡dSr©r$r)rrrrÚhandshakeCompleted˜sz3ImmediatelyDisconnectingProtocol.handshakeCompletedcCs|jj d¡dSr)r&ÚconnectionDisconnectedr-r.rrrr0›sz/ImmediatelyDisconnectingProtocol.connectionLostN)r1r2r3r4rLr0rrrrrJ‘srJcCs®t ¡}| tjd¡t ¡}| ¡}||_||_| |¡|  |d¡t  ¡}|  d¡|  d¡|  d¡| | ¡¡| | ¡¡| | ¡¡|  |d¡|||fS)z‘ Create a certificate for given C{organization} and C{organizationalUnit}. @return: a tuple of (key, request, certificate) objects. iÚmd5éré<)rZPKeyZ generate_keyZTYPE_RSAZX509ReqZ get_subjectÚOZOUZ set_pubkeyÚsignZX509Zset_serial_numberZgmtime_adj_notBeforeZgmtime_adj_notAfterZ set_issuerZ set_subjectZ get_pubkey)Ú organizationÚorganizationalUnitÚpkeyÚreqÚsubjectÚcertrrrÚgenerateCertificateObjectsŸs"      rYc Csnt||ƒ\}}}d|tjfd|tjfd|tjffD]6\}}}tj ||f¡ d¡} t | ƒ  |tj |ƒ¡q2dS)z… Create certificate files key, req and cert prefixed by C{basename} for given C{organization} and C{organizationalUnit}. ÚkeyrVrXzutf-8N) rYrZdump_privatekeyZdump_certificate_requestZdump_certificateÚosÚextsepÚjoinÚencoder Z setContentZ FILETYPE_PEM) ÚbasenamerSrTrUrVrXÚextÚobjZdumpFuncZfNamerrrÚgenerateCertificateFiles»s   ýrbc@s eZdZdZdd„Zdd„ZdS)ÚContextGeneratingMixinah Offer methods to create L{ssl.DefaultOpenSSLContextFactory} for both client and server. @ivar clientBase: prefix of client certificate files. @type clientBase: C{str} @ivar serverBase: prefix of server certificate files. @type serverBase: C{str} @ivar clientCtxFactory: a generated context factory to be used in L{IReactorSSL.connectSSL}. @type clientCtxFactory: L{ssl.DefaultOpenSSLContextFactory} @ivar serverCtxFactory: a generated context factory to be used in L{IReactorSSL.listenSSL}. @type serverCtxFactory: L{ssl.DefaultOpenSSLContextFactory} cOsH| ¡}t|||ƒtjtj |df¡tj |df¡f|ž|Ž}||fS)NrZrX)ÚmktemprbrÚDefaultOpenSSLContextFactoryr[r\r])rÚorgZorgUnitÚargsZkwArgsÚbaseÚserverCtxFactoryrrrÚmakeContextFactoryßs þýüz)ContextGeneratingMixin.makeContextFactorycCs,|j||Ž\|_|_|j||Ž\|_|_dSr)rjZ clientBaseÚclientCtxFactoryZ serverBaseri)rZ clientArgsZ clientKwArgsZ serverArgsZ serverKwArgsrrrÚsetupServerAndClientësÿ ÿz+ContextGeneratingMixin.setupServerAndClientN)r1r2r3r4rjrlrrrrrcËs rcc@seZdZdZdZdd„ZdS)r=zf A context factory with a default method set to L{OpenSSL.SSL.SSLv23_METHOD}. FcOs"tj|d<tjj|f|ž|ŽdS)NZ sslmethod)r Z SSLv23_METHODrrer)rrgÚkwrrrrþs zServerTLSContext.__init__N)r1r2r3r4ZisClientrrrrrr=ösr=c@sDeZdZdZe ed¡dkr dZdd„Zdd„Z dd „Z d d „Z dS) ÚStolenTCPTestszc For SSL transports, test many of the same things which are tested for TCP transports. Nú2Reactor does not support SSL, cannot run SSL testscCs.tj ttƒ ¡¡}| ¡}tj||||dS)zY Create an SSL server with a certificate using L{IReactorSSL.listenSSL}. ©Z interface) rZPrivateCertificateZloadPEMr rZ getContentÚoptionsrÚ listenSSL)rÚaddressÚ portNumberr&rXÚcontextFactoryrrrÚ createServer szStolenTCPTests.createServercCst ¡}| |||¡S)zG Create an SSL client using L{IReactorSSL.connectSSL}. )rZCertificateOptionsÚ connectSSL)rrsrtZ clientCreatorrurrrÚ connectClientszStolenTCPTests.connectClientcCstjS)zº Return L{OpenSSL.SSL.Error} as the expected error type which will be raised by a write to the L{OpenSSL.SSL.Connection} object after it has been closed. )r ÚErrorrrrrÚgetHandleExceptionTypesz%StolenTCPTests.getHandleExceptionTypec Cs<t t t d¡t t d¡t d¡t d¡¡t d¡¡¡S)a4 Return a L{hamcrest.core.matcher.Matcher} for the argument L{OpenSSL.SSL.Error} will be constructed with for this case. This is basically just a random OpenSSL implementation detail. It would be better if this test worked in a way which did not require this. z SSL routinesZ SSL_writeZssl_write_internalÚzprotocol is shutdown)ÚhamcrestÚcontainsZequal_toZany_ofrrrrÚgetHandleErrorCodeMatcher#s ýùÿz(StolenTCPTests.getHandleErrorCodeMatcher) r1r2r3r4rÚ IReactorSSLrÚskiprvrxrzr~rrrrrnsrnc@sZeZdZdZe ed¡dkr dZdZdZ dZ dd„Z ddd„Z d d „Z d d „Zd d„ZdS)ÚTLSTestszƒ Tests for startTLS support. @ivar fillBuffer: forwarded to L{LineCollector.fillBuffer} @type fillBuffer: C{bool} NroFcCs4|jjdk r|jj ¡|jjdk r0|jj ¡dSr)Ú clientProtor$r)Ú serverProtorrrrÚtearDownJs   zTLSTests.tearDowncsªˆ|_t ¡}|_‡fdd„|_|r.d|_nd|_ˆ|_t ¡}|_‡fdd„|_|rbd|_nd|_t j d|dd}|  |j ¡t   d| ¡j|¡t ˆjˆjg¡S) a½ Helper method to run TLS tests. @param clientProto: protocol instance attached to the client connection. @param serverProto: protocol instance attached to the server connection. @param clientIsServer: flag indicated if client should initiate startTLS instead of server. @return: a L{defer.Deferred} that will fire when both connections are lost. csˆSrrr©r‚rrÚ`r8z#TLSTests._runTest..FTcsˆSrrr©rƒrrr†hr8rú 127.0.0.1rp)r‚rÚ ClientFactoryÚ clientFactoryr>r'rƒÚ ServerFactoryÚ serverFactoryrZ listenTCPÚ addCleanupÚ stopListeningZ connectTCPÚgetHostÚportrÚ gatherResultsr)rr‚rƒZclientIsServerÚcfZsfrr©r‚rƒrÚ_runTestPs  zTLSTests._runTestcs,‡fdd„}ˆ tƒtdˆjƒ¡}| |¡S)z~ Test for server and client startTLS: client should received data both before and after the startTLS. csˆ ˆjjtjtj¡dSr)Ú assertEqualrŒr:rrr()ÚignorerrrÚcheck{s þz TLSTests.test_TLS..checkT©r”rr5r7Ú addCallback©rr—ÚdrrrÚtest_TLSus zTLSTests.test_TLScs,‡fdd„}ˆ tƒtdˆjƒ¡}| |¡S)z› Test for server startTLS not followed by a startTLS in client: the data received after server startTLS should be received as raw. cs&ˆ ˆjjtj¡ˆ ˆjjd¡dS)NzNo encrypted bytes received)r•rŒr:rrÚ assertTruer9©Zignoredrrrr—Šsz"TLSTests.test_unTLS..checkFr˜ršrrrÚ test_unTLS„s   ÿzTLSTests.test_unTLScs.‡fdd„}ˆ tdˆjƒtƒd¡}| |¡S)z: Test startTLS first initiated by client. csˆ ˆjjtjtj¡dSr)r•rŠr:rrr(ržrrrr—˜s þz)TLSTests.test_backwardsTLS..checkT)r”r5r7rr™ršrrrÚtest_backwardsTLS“s  ÿzTLSTests.test_backwardsTLS)F)r1r2r3r4rrrr€r7r‚rƒr„r”rœrŸr rrrrr:s %rc@s(eZdZdZe ed¡dkr dZdZdS)ÚSpammyTLSTestszA Test TLS features with bytes sitting in the out buffer. NroT) r1r2r3r4rrrr€r7rrrrr¡¤sr¡c@s8eZdZe ed¡dkrdZdZdZdd„Z dd„Z dS)ÚBufferingTestsNrocCsB|jjdk r|jj ¡|jjdk r0|jj ¡tt|j|jgƒSr)rƒr$r)r‚rrrrrrr„¶s     zBufferingTests.tearDowncs®tƒ‰|_tƒ‰|_t ¡}t ¡}|_‡fdd„|_‡fdd„|_t  t t ¡}t  ¡}t j d||dd}| |j¡t  d| ¡j||¡}| |j¡ˆj |jd¡S)NcsˆSrrrr‡rrr†År8z6BufferingTests.test_openSSLBuffering..csˆSrrrr…rrr†Ær8rrˆrprE)rDrƒrHr‚rr‹r‰r'rrerÚClientContextFactoryrrrrrŽrwrrZ disconnectrr™r•)rr>r'ZsCTXZcCTXrZclientConnectorrr“rÚtest_openSSLBuffering¾s*    ÿ ÿz$BufferingTests.test_openSSLBuffering) r1r2r3rrrr€rƒr‚r„r¤rrrrr¢¯s r¢c@sDeZdZdZe ed¡dkr dZdd„Zdd„Z dd „Z d d „Z dS) ÚConnectionLostTestsz' SSL connection closing tests. NrocsŽd}ˆ ||dfi||dfi¡t ¡}tj|_t d|ˆj¡ˆ_}t ¡}t |_t   ¡|_ t  d| ¡j|ˆj¡|j  ‡fdd„¡S)Nútwisted.test.test_sslú, clientú, serverrrˆcs ˆj ¡Sr)Ú serverPortrŽ)Z ignoredResultrrrr†ùr8z=ConnectionLostTests.testImmediateDisconnect..)rlrr‹ÚProtocolrrrrir©r‰rJrrrMrwrrrkr™)rrfÚserverProtocolFactoryr©ÚclientProtocolFactoryrrrÚtestImmediateDisconnectàs4  ÿÿ  ü ÿz+ConnectionLostTests.testImmediateDisconnectcsÒttjƒGdd„dtjƒƒ}d}| ||dfi||dfi¡|ƒ‰t ¡}‡fdd„|_t d||j ¡}|  |j ¡|ƒ‰t  ¡}‡fd d„|_t  d | ¡j||j¡d d „}t ˆj |¡ˆj |¡g¡S) zµ Both sides of SSL connection close connection; the connections should close cleanly, and only after the underlying TCP connection has disconnected. c@s(eZdZdZdd„Zdd„Zdd„ZdS) zMConnectionLostTests.test_bothSidesLoseConnection..CloseAfterHandshakeFcSst ¡|_dSr)rrÚdonerrrrrszVConnectionLostTests.test_bothSidesLoseConnection..CloseAfterHandshake.__init__cSs|j ¡dSrrKrrrrrL sz`ConnectionLostTests.test_bothSidesLoseConnection..CloseAfterHandshake.handshakeCompletedcSs|j |¡|`dSr)r®Zerrbackr.rrrr0 s z\ConnectionLostTests.test_bothSidesLoseConnection..CloseAfterHandshake.connectionLostN)r1r2r3ZgotDatarrLr0rrrrÚCloseAfterHandshakesr¯r¦r§r¨csˆSrrr©ÚserverProtocolrrr†r8zBConnectionLostTests.test_bothSidesLoseConnection..rcsˆSrrr©ÚclientProtocolrrr†r8rˆcSs| t¡dSr)Útrapr)ZfailurerrrÚ checkResult&szEConnectionLostTests.test_bothSidesLoseConnection..checkResult)rrÚIHandshakeListenerrrªrlr‹rrrrirrŽr‰rwrrrkrr‘r®Z addErrback)rr¯rfr«r©r¬rµr©r³r±rÚtest_bothSidesLoseConnectionüs:   ÿ ü  þÿz0ConnectionLostTests.test_bothSidesLoseConnectionc sèd}| ||dfi||dfi¡dd„}|j ¡ tj|¡t ¡}t  ¡‰|j ˆ_ t  ¡}‡fdd„|_t  d||j¡|_}t ¡}t  ¡‰|j ˆ_ t ¡}‡fd d„|_t  d | ¡j||j¡tj||gd d }| |j¡S) Nr¦r§r¨cWsdS)NFr)ÚarrrÚverify6sz4ConnectionLostTests.testFailedVerify..verifycsˆSrrrr°rrr†?r8z6ConnectionLostTests.testFailedVerify..rcsˆSrrrr²rrr†Hr8rˆT)Z consumeErrors)rlrkÚ getContextZ set_verifyr Z VERIFY_PEERrrrrªr-r0r‹rrrrir©r‰rwrrZ DeferredListr™Ú _cbLostConns) rrfrºZserverConnLostr«r©ZclientConnLostr¬Údlrr·rÚtestFailedVerify0s@  ÿÿ üz$ConnectionLostTests.testFailedVerifycCsh|\\}}\}}| |¡| |¡tjg}t ¡rJddlm}| |¡|j|Ž|j|Ž|j   ¡S)Nr)ÚConnectionLost) Ú assertFalser ryr Z isWindowsÚtwisted.internet.errorr¿r;r´r©rŽ)rÚresultsZsSuccessZsResultZcSuccessZcResultZacceptableErrorsr¿rrrr¼Ss       z ConnectionLostTests._cbLostConns) r1r2r3r4rrrr€r­r¸r¾r¼rrrrr¥Øs4#r¥c@s0eZdZdZdd„Zdd„Zdd„Zdd „Zd S) Ú FakeContextzK L{OpenSSL.SSL.Context} double which can more easily be inspected. cCs||_d|_dS)Nr)Ú_methodÚ_options)rÚmethodrrrrsszFakeContext.__init__cCs|j|O_dSr)rÅ)rrqrrrÚ set_optionswszFakeContext.set_optionscCsdSrr©rÚfileNamerrrÚuse_certificate_filezsz FakeContext.use_certificate_filecCsdSrrrÈrrrÚuse_privatekey_file}szFakeContext.use_privatekey_fileN)r1r2r3r4rrÇrÊrËrrrrrÃns rÃc@sDeZdZdZe ed¡dkr dZdd„Zdd„Z dd „Z d d „Z dS) Ú!DefaultOpenSSLContextFactoryTestsz8 Tests for L{ssl.DefaultOpenSSLContextFactory}. NrocCs"tjtttd|_|j ¡|_dS)N)Ú_contextFactory)rrerrÃrur»ÚcontextrrrrÚsetUp‰s ÿz'DefaultOpenSSLContextFactoryTests.setUpcCsB| |jjtj¡| |jjtj@tj¡| |jjtj@¡dS)z‹ L{ssl.DefaultOpenSSLContextFactory.getContext} returns an SSL context which can use SSLv3 or TLSv1 but not SSLv2. N) r•rÎrÄr Ú TLS_METHODrÅÚ OP_NO_SSLv2rÀÚ OP_NO_TLSv1_2rrrrÚ test_method‘sz-DefaultOpenSSLContextFactoryTests.test_methodcCs| tjtjt| ¡¡dS)zÑ Instantiating L{ssl.DefaultOpenSSLContextFactory} with a certificate filename which does not identify an existing file results in the initializer raising L{OpenSSL.SSL.Error}. N)Ú assertRaisesr ryrrerrdrrrrÚtest_missingCertificateFileŸs ÿz=DefaultOpenSSLContextFactoryTests.test_missingCertificateFilecCs| tjtj| ¡t¡dS)zÑ Instantiating L{ssl.DefaultOpenSSLContextFactory} with a private key filename which does not identify an existing file results in the initializer raising L{OpenSSL.SSL.Error}. N)rÔr ryrrerdrrrrrÚtest_missingPrivateKeyFile©s ÿzsL          ".  )  7j )3