U n5{i@sUdZddlmZddlmZddlmZddlmZm Z ddl m Z ddl m Z mZmZddlmZdd lmZmZdd lmZmZdd lmZdd lmZdd lmZddlmZdZ eee!d<edr ddl"m#Z#ddl$m Z m%Z%m&Z&ddl'm(Z(ddl)m*Z*nGdddZ%GdddZ&Gddde&j+Z,Gddde&j+Z-Gddde&j+Z.Gd d!d!e%j/Z0eeGd"d#d#Z1ee Gd$d%d%Z2ee Gd&d'd'Z3ee Gd(d)d)Z4Gd*d+d+ej5Z6Gd,d-d-ej5Z7Gd.d/d/ej5Z8Gd0d1d1ej5Z9dS)2zT Tests for the implementation of the ssh-userauth service. Maintainer: Paul Swartz ) ModuleType)Optional) implementer) ConchErrorValidPublicKey)ICredentialsChecker) IAnonymousISSHPrivateKeyIUsernamePassword)UnauthorizedLogin)IRealmPortal)defertask)Deferred)loopback) requireModule)unittestNkeysZ cryptography)SSHProtocolChecker)r transportuserauth)NS)keydatac@seZdZGdddZdS)rc@seZdZdZdS)ztransport.SSHTransportBaseQ A stub class so that later class definitions won't die. N__name__ __module__ __qualname____doc__r r D/tmp/pip-unpacked-wheel-mnhg7r0q/twisted/conch/test/test_userauth.pySSHTransportBase#sr"N)rrrr"r r r r!r"src@seZdZGdddZdS)rc@seZdZdZdS)zuserauth.SSHUserAuthClientrNrr r r r!SSHUserAuthClient)sr#N)rrrr#r r r r!r(src@s2eZdZdZddZddZd ddZd d ZdS) ClientUserAuthz" A mock user auth client. cCs,|jrtjtjSttjtjSdS)z If this is the first time we've been called, return a blob for the DSA key. Otherwise, return a blob for the RSA key. N) Z lastPublicKeyrKey fromStringrpublicRSA_opensshrsucceedpublicDSA_opensshselfr r r! getPublicKey4szClientUserAuth.getPublicKeycCsttjtjS)z@ Return the private key object for the RSA key. )rr(rr%r&rprivateRSA_opensshr*r r r! getPrivateKey?szClientUserAuth.getPrivateKeyNcCs tdS)z/ Return 'foo' as the password. foorr()r+promptr r r! getPasswordEszClientUserAuth.getPasswordcCs tdS)z> Return 'foo' as the answer to two questions. )foor3r0)r+nameZ informationZanswersr r r!getGenericAnswersKsz ClientUserAuth.getGenericAnswers)N)rrrrr,r.r2r5r r r r!r$/s   r$c@s eZdZdZddZddZdS) OldClientAuthz~ The old SSHUserAuthClient returned a cryptography key object from getPrivateKey() and a string from getPublicKey cCsttjtjjSN)rr(rr%r&rr-Z keyObjectr*r r r!r.XszOldClientAuth.getPrivateKeycCstjtjSr7)rr%r&rr'blobr*r r r!r,[szOldClientAuth.getPublicKeyNrrrrr.r,r r r r!r6Rsr6c@s eZdZdZddZddZdS)ClientAuthWithoutPrivateKeyzP This client doesn't have a private key, but it does have a public key. cCsdSr7r r*r r r!r.dsz)ClientAuthWithoutPrivateKey.getPrivateKeycCstjtjSr7)rr%r&rr'r*r r r!r,gsz(ClientAuthWithoutPrivateKey.getPublicKeyNr9r r r r!r:_sr:c@sLeZdZdZGdddZGdddZddZdd Zd d Zd d Z dS) FakeTransporta_ L{userauth.SSHUserAuthServer} expects an SSH transport which has a factory attribute which has a portal attribute. Because the portal is important for testing authentication, we need to be able to provide an interesting portal object to the L{SSHUserAuthServer}. In addition, we want to be able to capture any packets sent over the transport. @ivar packets: a list of 2-tuples: (messageType, data). Each 2-tuple is a sent packet. @type packets: C{list} @param lostConnecion: True if loseConnection has been called on us. @type lostConnection: L{bool} c@seZdZdZdZddZdS)zFakeTransport.ServicezW A mock service, representing the other service offered by the server. nancycCsdSr7r r*r r r!serviceStartedsz$FakeTransport.Service.serviceStartedN)rrrrr4r=r r r r!Service|sr>c@seZdZdZddZdS)zFakeTransport.Factoryzg A mock factory, representing the factory that spawned this user auth service. cCs|dkrtjSdS)z2 Return our fake service. noneN)r;r>)r+rservicer r r! getServicesz FakeTransport.Factory.getServiceN)rrrrrAr r r r!FactorysrBcCs(||_||j_d|_||_g|_dSNF)rBfactoryportallostConnectionrpackets)r+rEr r r!__init__s  zFakeTransport.__init__cCs|j||fdS)z8 Record the packet sent by the service. N)rGappend)r+Z messageTypemessager r r! sendPacketszFakeTransport.sendPacketcCsdS)z Pretend that this transport encrypts traffic in both directions. The SSHUserAuthServer disables password authentication if the transport isn't encrypted. Tr )r+ directionr r r! isEncryptedszFakeTransport.isEncryptedcCs d|_dSNT)rFr*r r r!loseConnectionszFakeTransport.loseConnectionN) rrrrr>rBrHrKrMrOr r r r!r;ks  r;c@seZdZdZddZdS)Realmz A mock realm for testing L{userauth.SSHUserAuthServer}. This realm is not actually used in the course of testing, so it returns the simplest thing that could possibly work. cGst|ddddfS)NrcSsdSr7r r r r r!z%Realm.requestAvatar..r0)r+ZavatarIdZmindZ interfacesr r r! requestAvatarszRealm.requestAvatarN)rrrrrSr r r r!rPsrPc@seZdZdZefZddZdS)PasswordCheckerz A very simple username/password checker which authenticates anyone whose password matches their username and rejects all others. cCs&|j|jkrt|jSttdS)NzInvalid username/password pair)usernamepasswordrr(failr )r+credsr r r!requestAvatarIds  zPasswordChecker.requestAvatarIdN)rrrrr credentialInterfacesrYr r r r!rTsrTc@seZdZdZefZddZdS)PrivateKeyCheckerz A very simple public key checker which authenticates anyone whose public/private keypair is the same keydata.public/privateRSA_openssh. cCsX|jtjtjkrN|jdk rHtj|j}||j|jrN|j Snt t dSr7) r8rr%r&rr' signatureverifysigDatarUrr )r+rXobjr r r!rYs z!PrivateKeyChecker.requestAvatarIdN)rrrrr rZrYr r r r!r[sr[c@seZdZdZefZddZdS)AnonymousCheckerzI A simple checker which isn't supported by L{SSHUserAuthServer}. cCsdSr7r )r+ credentialsr r r!rYsz AnonymousChecker.requestAvatarIdN)rrrrrrZrYr r r r!r`sr`c@seZdZdZedkrdZddddZddZedd d d Z d d Z ddZ ddZ ddZ ddZddZddZddZddZddZd d!Zd"d#Zd$d%Zd&d'Zd(d)Zeddd*d+Zd,d-ZdS).SSHUserAuthServerTestsz& Tests for SSHUserAuthServer. Ncannot run without cryptography)returncCsbt|_t|j|_|jt|jtt|_ t |j|j _ |j |j j dSr7)rPrealmr rEregisterCheckerrTr[rSSHUserAuthServer authServerr;rr=supportedAuthenticationssortr*r r r!setUps   zSSHUserAuthServerTests.setUpcCs|jd|_dSr7)rhserviceStoppedr*r r r!tearDowns zSSHUserAuthServerTests.tearDown)ignoredrdcCs>t|jjtst|jjjd}||tjt ddfdS)z; Check that the authentication has failed. spassword,publickeyN) isinstancerhrr;AssertionErrorrG assertEqualrZMSG_USERAUTH_FAILUREr)r+rnZ lastPacketr r r! _checkFaileds z#SSHUserAuthServerTests._checkFailedcCs,|jtdtdtd}||jS)z A client may request a list of authentication 'method name' values that may continue by using the "none" authentication 'method name'. See RFC 4252 Section 5.2. r/sservicer?)rhssh_USERAUTH_REQUESTr addCallbackrt)r+dr r r!test_noneAuthentication sz.SSHUserAuthServerTests.test_noneAuthenticationcsFdtdtdtddtdg}j|}fdd}||S)z When provided with correct password authentication information, the server should respond by sending a MSG_USERAUTH_SUCCESS message with no other data. See RFC 4252, Section 5.1. rRr/r?passwordrpcsjjjtjdfgdSNrRrsrhrrGrZMSG_USERAUTH_SUCCESSrnr*r r!check"s zKSSHUserAuthServerTests.test_successfulPasswordAuthentication..check)joinrrhrurvr+packetrwr}r r*r!%test_successfulPasswordAuthentications$  z.check)rr%r&rr'r8r-rZsshTyperhr sessionIDsignbytesrMSG_USERAUTH_REQUESTrurv)r+r8r_rr\rwr}r r*r!'test_successfulPrivateKeyAuthentication;s,     z>SSHUserAuthServerTests.test_successfulPrivateKeyAuthenticationcstdd}dd}fdd}||jd|||jd|||jd |td td td td }|j||tS)z ssh_USERAUTH_REQUEST should raise a ConchError if tryAuth returns None. Added to catch a bug noticed by pyflakes. cSs|ddS)Nz&request should have raised ConochError)rW)r+rnr r r!mockCbFinishedAuth_szOSSHUserAuthServerTests.test_requestRaisesConchError..mockCbFinishedAuthcSsdSr7r )kinduserdatar r r! mockTryAuthbszHSSHUserAuthServerTests.test_requestRaisesConchError..mockTryAuthcs|jdSr7)Zerrbackvalue)reasonrwr r! mockEbBadAutheszJSSHUserAuthServerTests.test_requestRaisesConchError..mockEbBadAuthtryAuthZ_cbFinishedAuthZ _ebBadAuthsuserr?s public-keysdata)rrpatchrhrru assertFailurer)r+rrrrr rr!test_requestRaisesConchErrorXs   z3SSHUserAuthServerTests.test_requestRaisesConchErrorcsbtjtjtdtdtddtdt}j|}fdd}| |S)z@ Test that verifying a valid private key works. r/r?rrpssh-rsacs*jjjtjtdtfgdS)Nr)rsrhrrGrMSG_USERAUTH_PK_OKrr|r8r+r r!r}sz@SSHUserAuthServerTests.test_verifyValidPrivateKey..check) rr%r&rr'r8rrhrurvrr rr!test_verifyValidPrivateKeyrs  z1SSHUserAuthServerTests.test_verifyValidPrivateKeycCsVtjtj}tdtdtddtdt|}|j|}| |j S)d Test that private key authentication fails when the public key is invalid. r/r?rrpsssh-dsa rr%r&rr)r8rrhrurvrtr+r8rrwr r r!3test_failedPrivateKeyAuthenticationWithoutSignatures zJSSHUserAuthServerTests.test_failedPrivateKeyAuthenticationWithoutSignaturecCs|tjtj}tjtj}tdtdtddtdt|t||}d|j j _ |j |}| |jS)rr/r?rrrr)rr%r&rr'r8r-rrrhrrrurvrt)r+r8r_rrwr r r!0test_failedPrivateKeyAuthenticationWithSignatures&   zGSSHUserAuthServerTests.test_failedPrivateKeyAuthenticationWithSignaturecCsjtjtj}td|dd}tdtdtddtdt|}|j|}| |j S) z Private key authentication fails when the public key type is unsupported or the public key is corrupt. s ssh-bad-type Nr/r?rrprrrr r r!test_unsupported_publickeys  z1SSHUserAuthServerTests.test_unsupported_publickeycCsRt}t|j|_|jt|||j | |j ddgdS)ah L{SSHUserAuthServer} sets up C{SSHUserAuthServer.supportedAuthentications} by checking the portal's credentials interfaces and mapping them to SSH authentication method strings. If the Portal advertises an interface that L{SSHUserAuthServer} can't map, it should be ignored. This is a white box test. ryrN) rrgr;rErrfr`r=rlrirjrsr+serverr r r! test_ignoreUnknownCredInterfacess   z7SSHUserAuthServerTests.test_ignoreUnknownCredInterfacescCs|d|jjt}t|j|_dd|j_| | | d|jt}t|j|_dd|j_| | |d|jdS)z Test that the userauth service does not advertise password authentication if the password would be send in cleartext. rycSsdSrCr xr r r!rQrRzISSHUserAuthServerTests.test_removePasswordIfUnencrypted..cSs|dkSNinr rr r r!rQrRN) ZassertInrhrirrgr;rErrMr=rlZ assertNotIn)r+clearAuthServerhalfAuthServerr r r! test_removePasswordIfUnencrypteds    z7SSHUserAuthServerTests.test_removePasswordIfUnencryptedcCst|j}|tt}t||_dd|j_| | | |j dgt}t||_dd|j_| | | |j dgdS)z If the L{SSHUserAuthServer} is not advertising passwords, then an unencrypted connection should not cause any warnings or exceptions. This is a white box test. cSsdSrCr rr r r!rQrRzSSSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswords..rcSs|dkSrr rr r r!rQrRN) r rerfr[rrgr;rrMr=rlrsri)r+rErrr r r!*test_unencryptedConnectionWithoutPasswordss      zASSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswordscCst}t|_t|j|_||j d| | |jj tj dttjftdtdfg||jjdS)z0 Test that the login times out. 鰚syou took too longrRN)rrgrrrr;rErr=rrlrsrGMSG_DISCONNECTr)DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLEr assertTruerFr+ZtimeoutAuthServerr r r!test_loginTimeouts(     z(SSHUserAuthServerTests.test_loginTimeoutcCs\t}t|_t|j|_|| |j d| |jj g| |jjdS)zN Test that stopping the service also stops the login timeout. rN)rrgrrrr;rErr=rlrrsrG assertFalserFrr r r!test_cancelLoginTimeouts   z.SSHUserAuthServerTests.test_cancelLoginTimeoutcsndtdtdtddtdg}tj_tdD]}j|}jjdq8fd d }| |S) zm Test that the server disconnects if the client fails authentication too many times. rRr/r?ryrprrcs<jjjdtjdttjftdtdfdS)Nrorstoo many bad authsrR)rsrhrrGrrrrr|r*r r!r}4s  z:SSHUserAuthServerTests.test_tooManyAttempts..check) r~rrrrhrrangerurrv)r+rirwr}r r*r!test_tooManyAttempts)s$    z+SSHUserAuthServerTests.test_tooManyAttemptscCsTtdtdtddtd}t|j_|j|}|dk sHt||jS)zo If the user requests a service that we don't support, the authentication should fail. r/rRryrpN) rrrrhrrurrrvrtrr r r!test_failIfUnknownServiceBs $   z0SSHUserAuthServerTests.test_failIfUnknownServicecsVdd}jd|jddfdd}jddd}|t|S) aZ tryAuth() has two edge cases that are difficult to reach. 1) an authentication method auth_* returns None instead of a Deferred. 2) an authentication type that is defined does not have a matching auth_* method. Both these cases should return a Deferred which fails with a ConchError. cSsdSr7r )rr r r!mockAuthYsz>SSHUserAuthServerTests.test_tryAuthEdgeCases..mockAuthZauth_publickeyZ auth_passwordNcsjddd}|tS)Nry)rhrrr)rnZd2r*r r! secondTest_sz@SSHUserAuthServerTests.test_tryAuthEdgeCases..secondTestr)rrhrrrrv)r+rrd1r r*r!test_tryAuthEdgeCasesMs  z,SSHUserAuthServerTests.test_tryAuthEdgeCases)rrrrrskiprkrmobjectrtrxrrrrrrrrrrrrrrrrrr r r r!rbs.     rbc@seZdZdZedkrdZddZddZdd Zd d Z d d Z ddZ ddZ ddZ ddZddZddZddZddZddZd d!ZdS)"SSHUserAuthClientTestsz& Tests for SSHUserAuthClient. NrccCs4tdt|_td|j_d|jj_|jdS)Nr/r)r$r;r> authClientrrr=r*r r r!rkos  zSSHUserAuthClientTests.setUpcCs|jd|_dSr7)rrlr*r r r!rmus zSSHUserAuthClientTests.tearDowncCsT||jjd||jjjd||jjjtjt dt dt dfgdS)z; Test that client is initialized properly. r/r<r?N) rsrrinstancer4rrGrrrr*r r r! test_initys z SSHUserAuthClientTests.test_initcs@dgfdd}||jj_|jd|d|jjdS)z9 Test that the client succeeds properly. Ncs |d<dS)Nrr )r@rr r!stubSetServiceszDSSHUserAuthClientTests.test_USERAUTH_SUCCESS..stubSetServicerRr)rrZ setServiceZssh_USERAUTH_SUCCESSrsr)r+rr rr!test_USERAUTH_SUCCESSs    z,SSHUserAuthClientTests.test_USERAUTH_SUCCESSc Cs|jtdd||jjjdtjtdtdtddtdttj t j  f|jtddttj t j }||jjjdtjtdtdtddtd|f|jtdttj t j t|jjjttjftdtdtddtd|}tj t j}||jjjdtjtdtdtddtd|t||fd S) zJ Test that the client can authenticate with a public key. rrpror/r<sssh-dssrN)rssh_USERAUTH_FAILURErrsrrGrrrr%r&rr)r8r'ssh_USERAUTH_PK_OKrrr-r)r+r8r^r_r r r!test_publickeys        z%SSHUserAuthClientTests.test_publickeycCsztdt}td|_d|j_||dg|j_|| d| |jjt j t dt dt dfgdS)z If the SSHUserAuthClient doesn't return anything from signData, the client should start the authentication over again by requesting 'none' authentication. r/NrrrRr<r?)r:r;r>rrr=rrG assertIsNonerrsrrr)r+rr r r!!test_publickey_without_privatekeys  z8SSHUserAuthClientTests.test_publickey_without_privatekeycs.ddj_jd}fdd}||S)z{ If there's no public key, auth_publickey should return a Deferred called back with a False value. cSsdSr7r rr r r!rQrRz:SSHUserAuthClientTests.test_no_publickey..rcs|dSr7)rresultr*r r!r}sz7SSHUserAuthClientTests.test_no_publickey..check)rr,rrv)r+rwr}r r*r!test_no_publickeys   z(SSHUserAuthClientTests.test_no_publickeycCs|jtdd||jjjdtjtdtdtddtdf|jtdtd||jjjdtjtdtdtddtddfd S) zx Test that the client can authentication with a password. This includes changing the password. ryrpror/r<rRrrN) rrrrsrrGrrrr*r r r! test_passwords " &z$SSHUserAuthClientTests.test_passwordcCs"dd|j_||jddS)zK If getPassword returns None, tryAuth should return False. cSsdSr7r r r r r!rQ rRz9SSHUserAuthClientTests.test_no_password..ryN)rr2rrr*r r r!test_no_passwords z'SSHUserAuthClientTests.test_no_passwordcCs`|jtdtdtddtdd||jjjdtjdtdtdfdS) zj Make sure that the client can authenticate with the keyboard interactive method. rRss Password: rprosr/N)rZ'ssh_USERAUTH_PK_OK_keyboard_interactiverrsrrGrZMSG_USERAUTH_INFO_RESPONSEr*r r r!test_keyboardInteractive s& z/SSHUserAuthClientTests.test_keyboardInteractivecCsPd|j_g|jj_|jd||jjjtjtdtdtdfgdS)z If C{SSHUserAuthClient} gets a MSG_USERAUTH_PK_OK packet when it's not expecting it, it should fail the current authentication and move on to the next type. sunknownrRr/r<r?N) rZlastAuthrrGrrsrrrr*r r r!"test_USERAUTH_PK_OK_unknown_method!s  z9SSHUserAuthClientTests.test_USERAUTH_PK_OK_unknown_methodcsfdd}fdd}|j_|j_jtddjjjdtj tdtd td dtdfjtd d jjjd dddgdS)z ssh_USERAUTH_FAILURE should sort the methods by their position in SSHUserAuthClient.preferredOrder. Methods that are not in preferredOrder should be sorted at the end of that list. csjjdddS)N here is datarrrKr r*r r!auth_firstmethod6szNSSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting..auth_firstmethodcsjjdddS)N other dataTrr r*r r!auth_anothermethod9szPSSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting..auth_anothermethodsanothermethod,passwordrpror/r<rys"firstmethod,anothermethod,passwordrN)rr)rr) rrrrrrsrrGrr)r+rrr r*r!test_USERAUTH_FAILURE_sorting/s$   " z4SSHUserAuthClientTests.test_USERAUTH_FAILURE_sortingcCsT|jtdd|jtdd||jjjdtjdtddfdS) z If there are no more available user authentication messages, the SSHUserAuthClient should disconnect with code DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE. ryrprross(no more authentication methods availablesN)rrrrsrrGrr*r r r!%test_disconnectIfNoMoreAuthenticationSs z.checkcs*|tddd}|jSr7)rrr5rvrWrr)rcheck3r+r r!rs z4SSHUserAuthClientTests.test_defaults..check2cSs|tdSr7)rrrr r r!rsz4SSHUserAuthClientTests.test_defaults..check3) rr#r;r>rr,r.rvrWr)r+r}rwr )rrrr+r! test_defaultsqsz$SSHUserAuthClientTests.test_defaults)rrrrrrrkrmrrrrrrrrrrrrrr r r r!rgs$  > $ rc@s.eZdZedkrdZGdddZddZdS) LoopbackTestsNrcc@s"eZdZGdddZddZdS)zLoopbackTests.Factoryc@s eZdZdZddZddZdS)zLoopbackTests.Factory.Service TestServicecCs|jdSr7)rrOr*r r r!r=sz,LoopbackTests.Factory.Service.serviceStartedcCsdSr7r r*r r r!rlsz,LoopbackTests.Factory.Service.serviceStoppedN)rrrr4r=rlr r r r!r>sr>cCs|jSr7)r>)r+Zavatarr4r r r!rAsz LoopbackTests.Factory.getServiceN)rrrr>rAr r r r!rBs rBcs ttdj}t_j_ddj_t|_||j_dj_ |j_ ddj_ |j_ j_ d_ t }t|}tttfdd_||jj _tj|j}ddjj_d d|jj_|fd d }||S) zW Test that the userauth server and client play nicely with each other. r/cSsdSrNr rr r r!rQrRz-LoopbackTests.test_loopback..rRcSsdSr7r r r r r!rQrRrcstj|dkS)Nr)lenZsuccessfulCredentials)ZaId)checkerr r!rQrRcSsdS)NZ_ServerLoopbackr r r r r!rQrRcSsdS)NZ_ClientLoopbackr r r r r!rQrRcsjjjddS)Nr)rsrr@r4r|rr r!r}sz*LoopbackTests.test_loopback..check)rrgr$rBr>rr"r@rMrZ sendKexInitrDZ passwordDelayrPr rrfrTr[ZareDonerErZ loopbackAsyncZ logPrefixr=rv)r+clientrerErwr}r )rr+rr! test_loopbacks4        zLoopbackTests.test_loopback)rrrrrrBrr r r r!rs rc@s eZdZedkrdZddZdS)ModuleInitializationTestsNrccCs,|tjjdd|tjjdddS)N<r)rsrrgZprotocolMessagesr#r*r r r! test_messagess  z'ModuleInitializationTests.test_messages)rrrrrrr r r r!rsr):rtypesrtypingrZzope.interfacerZtwisted.conch.errorrrZtwisted.cred.checkersrZtwisted.cred.credentialsrr r Ztwisted.cred.errorr Ztwisted.cred.portalr r Ztwisted.internetrrZtwisted.internet.deferrZtwisted.protocolsrZtwisted.python.reflectrZ twisted.trialrr__annotations__Ztwisted.conch.checkersrZtwisted.conch.sshrrZtwisted.conch.ssh.commonrZtwisted.conch.testrr#r$r6r:r"r;rPrTr[r`ZTestCaserbrrrr r r r!sT            #  A  &;