o
    >hy                     @   s
  U d Z ddlZddlmZ ddlmZ ddlmZ ddlm	Z	 e	e
 ed< zddlZW n ey6   dZY nw dZdd	lmZ dd
lmZ ddlmZmZmZmZ ddlmZmZ ddlmZ ddlmZ ddlm Z m!Z! ddl"m#Z# ddl$m%Z% ddl&m'Z' ddl(m)Z) e%drdZ*ddl+m,Z, ddl-m.Z.m/Z/ ddl0m1Z1 ddl2m3Z3 ndZ*e4edddurdZ5ndZ5G dd de)Z6G dd de)Z7G d d! d!e)Z8G d"d# d#e)Z9G d$d% d%e)Z:G d&d' d'e)Z;G d(d) d)e)Z<ed*d+gZ=G d,d- d-e>Z?G d.d/ d/e)Z@dS )0z&
Tests for L{twisted.conch.checkers}.
    N)encodebytes)
namedtuple)BytesIO)Optional	cryptSkipzcannot run without crypt module)verifyObject)'InMemoryUsernamePasswordDatabaseDontUse)ISSHPrivateKeyIUsernamePasswordSSHPrivateKeyUsernamePassword)UnauthorizedLoginUnhandledCredentials)Deferred)util)ShadowDatabaseUserDatabase)FilePath)requireModule)MockOS)TestCasecryptography)checkers)NotEnoughAuthenticationValidPublicKey)keys)keydatazcan't run without cryptographygeteuidz0Cannot run without effective UIDs (questionable)c                   @   sX   e Zd ZdZep	eZdd Zdd Zdd Z	dd	 Z
d
d Zdd Zdd Zdd ZdS )HelperTestszl
    Tests for helper functions L{verifyCryptedPassword}, L{_pwdGetByName} and
    L{_shadowGetByName}.
    c                 C   s   t  | _d S N)r   mockosself r#   /var/www/vedio/testing/chatpythonscript.ninositsolution.com/env/lib/python3.10/site-packages/twisted/conch/test/test_checkers.pysetUp@   s   zHelperTests.setUpc                 C   4   d}d}t  ||}| t||d|| dS )z
        L{verifyCryptedPassword} returns C{True} if the plaintext password
        passed to it matches the encrypted password passed to it.
        secret stringsaltyz5{!r} supposed to be valid encrypted password for {!r}Ncrypt
assertTruer   verifyCryptedPasswordformatr"   passwordsaltcryptedr#   r#   r$   test_verifyCryptedPasswordC      
z&HelperTests.test_verifyCryptedPasswordc                 C   r&   )z
        L{verifyCryptedPassword} returns True if the provided cleartext password
        matches the provided MD5 password hash.
        r/   z$1$saltz3{!r} supposed to be valid encrypted password for {}Nr)   r.   r#   r#   r$   test_verifyCryptedPasswordMD5R   r3   z)HelperTests.test_verifyCryptedPasswordMD5c                 C   s4   d}d}t  ||}| t||d|| dS )z
        L{verifyCryptedPassword} returns C{False} if the plaintext password
        passed to it does not match the encrypted password passed to it.
        zstring secretr'   z7{!r} not supposed to be valid encrypted password for {}N)r*   assertFalser   r,   r-   )r"   r/   wrongr1   r#   r#   r$   test_refuteCryptedPassworda   r3   z&HelperTests.test_refuteCryptedPasswordc              	   C   sF   t  }|ddddddd | td| | td|d d	S )
z
        L{_pwdGetByName} returns a tuple of items from the UNIX /etc/passwd
        database if the L{pwd} module is present.
        alicesecrit      
first last/foo/bin/shpwdN)r   addUserpatchr   assertEqual_pwdGetByNamegetpwnamr"   userdbr#   r#   r$   test_pwdGetByNamep   s   zHelperTests.test_pwdGetByNamec                 C   s"   |  tdd | td dS )zW
        If the C{pwd} module isn't present, L{_pwdGetByName} returns L{None}.
        r?   Nr8   )rA   r   assertIsNonerC   r!   r#   r#   r$   test_pwdGetByNameWithoutPwdz   s   z'HelperTests.test_pwdGetByNameWithoutPwdc                 C   s   t  }|ddddddddd		 | td
| d| j_d| j_| td| j | t	d|
d | | jjddg | | jjddg dS )z
        L{_shadowGetByName} returns a tuple of items from the UNIX /etc/shadow
        database if the L{spwd} is present.
        bob
passphraser:   r;                  spwd)	    osr   N)r   r@   rA   r   r    euidegidr   rB   _shadowGetByNamegetspnamseteuidCallssetegidCallsrE   r#   r#   r$   test_shadowGetByName   s   z HelperTests.test_shadowGetByNamec                 C   sB   |  tdd | td | | jjg  | | jjg  dS )zP
        L{_shadowGetByName} returns L{None} if C{spwd} is not present.
        rQ   NrJ   )rA   r   rH   rW   rB   r    rY   rZ   r!   r#   r#   r$   test_shadowGetByNameWithoutSpwd   s   z+HelperTests.test_shadowGetByNameWithoutSpwdN)__name__
__module____qualname____doc__r   dependencySkipskipr%   r2   r4   r7   rG   rI   r[   r\   r#   r#   r#   r$   r   8   s    
r   c                   @   sr   e Zd ZdZep	eZdddZdd Zdd	 Z	d
d Z
dd Zdd Zdd Zdd Zdd Zdd Zdd ZdS )SSHPublicKeyDatabaseTestsz,
    Tests for L{SSHPublicKeyDatabase}.
    returnNc              	   C   s   t  | _td| _td| _d| j d | j d | _t | _| 	t
d| j t|  | _t| jjts8J | jd| _| j  t }|dd	d
dd| jjd || j_d S )N   foobar   eggspams   t1 s    foo
t2 s    egg
rT   .sshuserr/   r:   r;   r<   
/bin/shell)r   SSHPublicKeyDatabasecheckerr   key1key2contentr   r    rA   r   r   mktemppath
isinstancestrchildsshDirmakedirsr   r@   _userdbrE   r#   r#   r$   r%      s*   



	zSSHPublicKeyDatabaseTests.setUpc                 C   sL   | j | jgd}| |d d t | |d d d | t|d dS )zJ
        L{SSHPublicKeyDatabase} is deprecated as of version 15.0
        )offendingFunctionsr   categorymessageztwisted.conch.checkers.SSHPublicKeyDatabase was deprecated in Twisted 15.0.0: Please use twisted.conch.checkers.SSHPublicKeyChecker, initialized with an instance of twisted.conch.checkers.UNIXAuthorizedKeysFiles instead.r:   N)flushWarningsr%   rB   DeprecationWarninglen)r"   warningsShownr#   r#   r$   test_deprecated   s   
z)SSHPublicKeyDatabaseTests.test_deprecatedc                 C   sj   | j || j tdd}d|_| | j| d|_| | j| d|_| 	| j| d S )N   user   passwordre   rf   s
   notallowed)
rt   rs   
setContentrn   r   blobr+   rk   checkKeyr5   )r"   filenamerh   r#   r#   r$   _testCheckKey   s   
z'SSHPublicKeyDatabaseTests._testCheckKeyc                 C   .   |  d | | jjg  | | jjg  dS )z
        L{SSHPublicKeyDatabase.checkKey} should retrieve the content of the
        authorized_keys file and check the keys against that file.
        authorized_keysNr   rB   r    rY   rZ   r!   r#   r#   r$   test_checkKey      
z'SSHPublicKeyDatabaseTests.test_checkKeyc                 C   r   )z
        L{SSHPublicKeyDatabase.checkKey} should retrieve the content of the
        authorized_keys2 file and check the keys against that file.
        authorized_keys2Nr   r!   r#   r#   r$   test_checkKey2   r   z(SSHPublicKeyDatabaseTests.test_checkKey2c                    s   | j d  | j  d |  jd | jj fdd}d| j_d| j_	| 
| jd| | 
td	| j td
d}d|_| | j| | | jjg d | | jjddg dS )z
        If the key file is readable, L{SSHPublicKeyDatabase.checkKey} should
        switch its uid/gid to the ones of the authenticated user.
        r   r     c                    s     d | S )Nr   )chmod)rU   keyFilesavedSeteuidr#   r$   seteuid   s   
z>SSHPublicKeyDatabaseTests.test_checkKeyAsRoot.<locals>.seteuidrR   rS   r   rT   r   r   re   )r   r:   r   rR   r;   N)rt   rs   r   rn   r   
addCleanupr    r   rU   rV   rA   r   r   r   r+   rk   r   rB   rY   rZ   )r"   r   rh   r#   r   r$   test_checkKeyAsRoot   s   

z-SSHPublicKeyDatabaseTests.test_checkKeyAsRootc                    s\   dd }   jd| tddtjdtjtj	d} j
|} fdd}||S )	z
        L{SSHPublicKeyDatabase.requestAvatarId} should return the avatar id
        passed in if its C{_checkKey} method returns True.
        c                 S      dS NTr#   ignoredr#   r#   r$   	_checkKey     zASSHPublicKeyDatabaseTests.test_requestAvatarId.<locals>._checkKeyr      test   ssh-rsa   fooc                         | d d S Nr   rB   avatarIdr!   r#   r$   _verify     z?SSHPublicKeyDatabaseTests.test_requestAvatarId.<locals>._verify)rA   rk   r   r   publicRSA_opensshr   Key
fromStringprivateRSA_opensshsignrequestAvatarIdaddCallback)r"   r   credentialsdr   r#   r!   r$   test_requestAvatarId  s   
z.SSHPublicKeyDatabaseTests.test_requestAvatarIdc                 C   sB   dd }|  | jd| tddtjdd}| j|}| |tS )a(  
        L{SSHPublicKeyDatabase.requestAvatarId} should raise L{ValidPublicKey}
        if the credentials represent a valid key without a signature.  This
        tells the user that the key is valid for login, but does not actually
        allow that user to do so without a signature.
        c                 S   r   r   r#   r   r#   r#   r$   r   %  r   zQSSHPublicKeyDatabaseTests.test_requestAvatarIdWithoutSignature.<locals>._checkKeyr   r   r   N)rA   rk   r   r   r   r   assertFailurer   r"   r   r   r   r#   r#   r$   $test_requestAvatarIdWithoutSignature  s   z>SSHPublicKeyDatabaseTests.test_requestAvatarIdWithoutSignaturec                 C   s0   dd }|  | jd| | jd}| |tS )z
        If L{SSHPublicKeyDatabase.checkKey} returns False,
        C{_cbRequestAvatarId} should raise L{UnauthorizedLogin}.
        c                 S   r   NFr#   r   r#   r#   r$   r   5  r   zKSSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidKey.<locals>._checkKeyr   N)rA   rk   r   r   r   )r"   r   r   r#   r#   r$   test_requestAvatarIdInvalidKey/  s   z8SSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidKeyc                 C   sR   dd }|  | jd| tddtjdtjtj	d}| j
|}| |tS )z
        Valid keys with invalid signatures should cause
        L{SSHPublicKeyDatabase.requestAvatarId} to return a {UnauthorizedLogin}
        failure
        c                 S   r   r   r#   r   r#   r#   r$   r   C  r   zQSSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidSignature.<locals>._checkKeyr   r   r   r   )rA   rk   r   r   r   r   r   r   privateDSA_opensshr   r   r   r   r   r#   r#   r$   $test_requestAvatarIdInvalidSignature<  s   z>SSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidSignaturec                    sV   dd }   jd| tddddd} j|} fd	d
}||  |tS )z~
        Exceptions raised while verifying the key should be normalized into an
        C{UnauthorizedLogin} failure.
        c                 S   r   r   r#   r   r#   r#   r$   r   W  r   zSSSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeException.<locals>._checkKeyr   r   Ns   blobs   sigDatas   sigc                    s      tj} t|d | S )Nr:   )flushLoggedErrorsr   BadKeyErrorrB   r|   )failureerrorsr!   r#   r$   _verifyLoggedException^     z`SSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeException.<locals>._verifyLoggedException)rA   rk   r   r   
addErrbackr   r   )r"   r   r   r   r   r#   r!   r$   &test_requestAvatarIdNormalizeExceptionQ  s   
z@SSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeExceptionrd   N)r]   r^   r_   r`   euidSkipra   rb   r%   r~   r   r   r   r   r   r   r   r   r   r#   r#   r#   r$   rc      s    

		rc   c                   @   sD   e Zd ZdZeZdd Zdd Zdd Zdd	 Z	d
d Z
dd ZdS )SSHProtocolCheckerTestsz*
    Tests for L{SSHProtocolChecker}.
    c                 C   sL   t  }| |jg  |t   | |jtg | |j t t j dS )z
        L{SSHProcotolChecker.registerChecker} should add the given checker to
        the list of registered checkers.
        N)r   SSHProtocolCheckerrB   credentialInterfacesregisterCheckerrj   r	   assertIsInstancer"   rk   r#   r#   r$   test_registerCheckern  s   z,SSHProtocolCheckerTests.test_registerCheckerc                 C   sN   t  }| |jg  |t  t | |jtg | |j t t j dS )z
        If a specific interface is passed into
        L{SSHProtocolChecker.registerChecker}, that interface should be
        registered instead of what the checker specifies in
        credentialIntefaces.
        N)r   r   rB   r   r   rj   r
   r   r   r#   r#   r$   !test_registerCheckerWithInterface}  s   z9SSHProtocolCheckerTests.test_registerCheckerWithInterfacec                    sJ   t  }t }|dd || |tdd} fdd}||S )z
        L{SSHProtocolChecker.requestAvatarId} should defer to one if its
        registered checkers to authenticate a user.
        r   c                    r   r   r   r   r!   r#   r$   	_callback  r   z?SSHProtocolCheckerTests.test_requestAvatarId.<locals>._callback)r   r   r   r@   r   r   r   r   )r"   rk   passwordDatabaser   r   r#   r!   r$   r     s   

z,SSHProtocolCheckerTests.test_requestAvatarIdc                 C   sV   t  }dd }| |d| t }|dd || |tdd}| |t	S )z
        If the client indicates that it is never satisfied, by always returning
        False from _areDone, then L{SSHProtocolChecker} should raise
        L{NotEnoughAuthentication}.
        c                 S   r   r   r#   r   r#   r#   r$   _areDone  r   zYSSHProtocolCheckerTests.test_requestAvatarIdWithNotEnoughAuthentication.<locals>._areDoneareDoner   )
r   r   rA   r   r@   r   r   r   r   r   )r"   rk   r   r   r   r#   r#   r$   /test_requestAvatarIdWithNotEnoughAuthentication  s   
zGSSHProtocolCheckerTests.test_requestAvatarIdWithNotEnoughAuthenticationc                 C   s$   t  }|tdd}| |tS )z
        If the passed credentials aren't handled by any registered checker,
        L{SSHProtocolChecker} should raise L{UnhandledCredentials}.
        r   )r   r   r   r   r   r   )r"   rk   r   r#   r#   r$   %test_requestAvatarIdInvalidCredential  s   z=SSHProtocolCheckerTests.test_requestAvatarIdInvalidCredentialc                 C   s   |  t d dS )zV
        The default L{SSHProcotolChecker.areDone} should simply return True.
        N)r+   r   r   r   r!   r#   r#   r$   test_areDone  s   z$SSHProtocolCheckerTests.test_areDoneN)r]   r^   r_   r`   ra   rb   r   r   r   r   r   r   r#   r#   r#   r$   r   g  s    	r   c                   @   sr   e Zd ZdZep	eZdee deddfddZ	dd	 Z
d
d Zdd Zdd Zdd Zdd Zdd Zdd ZdS )UNIXPasswordDatabaseTestsz,
    Tests for L{UNIXPasswordDatabase}.
    r   usernamerd   Nc                 C   s   |  | || dS )z
        Assert that the L{Deferred} passed in is called back with the value
        'username'.  This represents a valid login for this TestCase.

        @param d: a L{Deferred} from an L{IChecker.requestAvatarId} method.
        N)rB   successResultOf)r"   r   r   r#   r#   r$   assertLoggedIn  s   z(UNIXPasswordDatabaseTests.assertLoggedInc                 C   s<  t  }dd }t }|d|ddddddd	 |d
dddddd	 t }|ddddddddd	 |d
|d
dddddddd	 | t d| | t d| t }| td| d|_d|_	t
d d!}| ||d  | |jg  | |jg  d"|_| ||d" | |jd#dg | |jd#dg d$S )%z
        L{UNIXPasswordDatabase} with no arguments has checks the C{pwd} database
        and then the C{spwd} database.
        c                 S   s    t  || }t  |d| }|S )Nz$1$)r*   )r   r/   r0   r1   r#   r#   r$   r1     r   z?UNIXPasswordDatabaseTests.test_defaultCheckers.<locals>.cryptedr8   r/   r:   r;   foor=   r>   rJ   xbar/barr6   rL   rM   rN   rO   rP      	   
               r?   rQ   rT   rR   rS      alicer      bobr   N)r   UNIXPasswordDatabaser   r@   r   rA   r   r   rU   rV   r   r   r   rB   rY   rZ   r   )r"   rk   r1   r?   rQ   r    credr#   r#   r$   test_defaultCheckers  s0    
z.UNIXPasswordDatabaseTests.test_defaultCheckersc                 C   s   |  |tj dS )a  
        Asserts that the L{Deferred} passed in is erred back with an
        L{UnauthorizedLogin} L{Failure}.  This reprsents an invalid login for
        this TestCase.

        NOTE: To work, this method's return value must be returned from the
        test method, or otherwise hooked up to the test machinery.

        @param d: a L{Deferred} from an L{IChecker.requestAvatarId} method.
        @type d: L{Deferred}
        @rtype: L{None}
        N)failureResultOfr   r   r"   r   r#   r#   r$   assertUnauthorizedLogin  s   z1UNIXPasswordDatabaseTests.assertUnauthorizedLoginc              	   C   sR   t  dd}t }|d|ddddd t|jg}| |tdd	d d
S )zo
        L{UNIXPasswordDatabase} takes a list of functions to check for UNIX
        user information.
        secretanybodyr:   r;   r   r   r>   s   anybodys   secretN)	r*   r   r@   r   r   rD   r   r   r   )r"   r/   rF   rk   r#   r#   r$   test_passInCheckers  s   z-UNIXPasswordDatabaseTests.test_passInCheckersc                 C   sJ   dd }dd }|  td| t|g}tdd}| ||d dS )z
        If the encrypted password provided by the getpwnam function is valid
        (verified by the L{verifyCryptedPassword} function), we callback the
        C{requestAvatarId} L{Deferred} with the username.
        c                 S      | |kS r   r#   r1   pwr#   r#   r$   r,        zLUNIXPasswordDatabaseTests.test_verifyPassword.<locals>.verifyCryptedPasswordc                 S   s   | | gS r   r#   r   r#   r#   r$   rD     r   z?UNIXPasswordDatabaseTests.test_verifyPassword.<locals>.getpwnamr,      usernameNrA   r   r   r   r   r   r"   r,   rD   rk   
credentialr#   r#   r$   test_verifyPassword  s   
z-UNIXPasswordDatabaseTests.test_verifyPasswordc                 C   s2   dd }t |g}tdd}| || dS )z}
        If the getpwnam function raises a KeyError, the login fails with an
        L{UnauthorizedLogin} exception.
        c                 S   s   t | r   )KeyErrorr   r#   r#   r$   rD   +  r   z?UNIXPasswordDatabaseTests.test_failOnKeyError.<locals>.getpwnamr   r   N)r   r   r   r   r   )r"   rD   rk   r   r#   r#   r$   test_failOnKeyError%  s   
z-UNIXPasswordDatabaseTests.test_failOnKeyErrorc                 C   sH   dd }dd }|  td| t|g}tdd}| || dS )	z
        If the verifyCryptedPassword function doesn't verify the password, the
        login fails with an L{UnauthorizedLogin} exception.
        c                 S   r   r   r#   r   r#   r#   r$   r,   8  r   zOUNIXPasswordDatabaseTests.test_failOnBadPassword.<locals>.verifyCryptedPasswordc                 S      | dgS )Nr   r#   r   r#   r#   r$   rD   ;  r   zBUNIXPasswordDatabaseTests.test_failOnBadPassword.<locals>.getpwnamr,   r   r   N)rA   r   r   r   r   r   r   r#   r#   r$   test_failOnBadPassword2  s   
z0UNIXPasswordDatabaseTests.test_failOnBadPasswordc                 C   sT   dd }dd }dd }|  td| t||g}tdd	}| ||d d
S )a  
        UNIXPasswordDatabase.requestAvatarId loops through each getpwnam
        function associated with it and returns a L{Deferred} which fires with
        the result of the first one which returns a value other than None.
        ones do not verify the password.
        c                 S   r   r   r#   r   r#   r#   r$   r,   K  r   zRUNIXPasswordDatabaseTests.test_loopThroughFunctions.<locals>.verifyCryptedPasswordc                 S   r   )Nznot the passwordr#   r   r#   r#   r$   	getpwnam1N  r   zFUNIXPasswordDatabaseTests.test_loopThroughFunctions.<locals>.getpwnam1c                 S   r   )Nr/   r#   r   r#   r#   r$   	getpwnam2Q  r   zFUNIXPasswordDatabaseTests.test_loopThroughFunctions.<locals>.getpwnam2r,   r   r   Nr   )r"   r,   r   r   rk   r   r#   r#   r$   test_loopThroughFunctionsC  s   
z3UNIXPasswordDatabaseTests.test_loopThroughFunctionsc              	   C   s   t  }|ddddddd |ddddddd |d	d
ddddd | td| ttjg}tdd}| || tdd}| || tdd}| || dS )z
        If the password returned by any function is C{""}, C{"x"}, or C{"*"} it
        is not compared against the supplied password.  Instead it is skipped.
        r8    r:   r;   r   r   rJ   r   carol*r?   r       r      xs   carol   *N)	r   r@   rA   r   r   rC   r   r   r   )r"   r?   rk   r   r#   r#   r$   test_failOnSpecialY  s   


z,UNIXPasswordDatabaseTests.test_failOnSpecial)r]   r^   r_   r`   r   ra   rb   r   bytesr   r   r   r   r   r   r   r   r   r#   r#   r#   r$   r     s    	(r   c                   @   ,   e Zd ZdZeZdd Zdd Zdd ZdS )	AuthorizedKeyFileReaderTestsz5
    Tests for L{checkers.readAuthorizedKeyFile}
    c                 C   s0   t d}t|dd }| ddgt| dS )zg
        L{checkers.readAuthorizedKeyFile} does not attempt to turn comments
        into keys
        sE   # this comment is ignored
this is not
# this is again
and this is notc                 S      | S r   r#   r   r#   r#   r$   <lambda>      zCAuthorizedKeyFileReaderTests.test_ignoresComments.<locals>.<lambda>s   this is nots   and this is notNr   r   readAuthorizedKeyFilerB   listr"   fileobjresultr#   r#   r$   test_ignoresCommentsv  s
   z1AuthorizedKeyFileReaderTests.test_ignoresCommentsc                 C   s0   t d}tj|dd d}| dgt| dS )zw
        L{checkers.readAuthorizedKeyFile} ignores leading whitespace in
        lines, as well as empty lines
        sg   
                           # ignore
                           not ignored
                           c                 S   r  r   r#   r  r#   r#   r$   r    r  zYAuthorizedKeyFileReaderTests.test_ignoresLeadingWhitespaceAndEmptyLines.<locals>.<lambda>parseKeys   not ignoredNr  r  r#   r#   r$   *test_ignoresLeadingWhitespaceAndEmptyLines  s
   zGAuthorizedKeyFileReaderTests.test_ignoresLeadingWhitespaceAndEmptyLinesc                 C   s4   dd }t d}tj||d}| dgt| dS )z
        L{checkers.readAuthorizedKeyFile} does not raise an exception
        when a key fails to parse (raises a
        L{twisted.conch.ssh.keys.BadKeyError}), but rather just keeps going
        c                 S   s   |  dr
td| S )N   fzfailed to parse)
startswithr   r   )liner#   r#   r$   
failOnSome  s   

zKAuthorizedKeyFileReaderTests.test_ignoresUnparsableKeys.<locals>.failOnSomes   failed key
good keyr  s   good keyNr  )r"   r  r  r  r#   r#   r$   test_ignoresUnparsableKeys  s   z7AuthorizedKeyFileReaderTests.test_ignoresUnparsableKeysN)	r]   r^   r_   r`   ra   rb   r  r  r  r#   r#   r#   r$   r  o  s    r  c                   @   r  )	InMemorySSHKeyDBTestsz0
    Tests for L{checkers.InMemorySSHKeyDB}
    c                 C   s    t ddgi}tt j| dS )z_
        L{checkers.InMemorySSHKeyDB} implements
        L{checkers.IAuthorizedKeysDB}
        r   s   keyN)r   InMemorySSHKeyDBr   IAuthorizedKeysDBr"   keydbr#   r#   r$   test_implementsInterface  s   z.InMemorySSHKeyDBTests.test_implementsInterfacec                 C   s*   t ddgi}| g t|d dS )z
        If the user is not in the mapping provided to
        L{checkers.InMemorySSHKeyDB}, an empty iterator is returned
        by L{checkers.InMemorySSHKeyDB.getAuthorizedKeys}
        r   s   keysr   Nr   r  rB   r
  getAuthorizedKeysr  r#   r#   r$   test_noKeysForUnauthorizedUser  s   z4InMemorySSHKeyDBTests.test_noKeysForUnauthorizedUserc                 C   s0   t dddgi}| ddgt|d dS )z
        If the user is in the mapping provided to
        L{checkers.InMemorySSHKeyDB}, an iterator with all the keys
        is returned by L{checkers.InMemorySSHKeyDB.getAuthorizedKeys}
        r      a   bNr  r  r#   r#   r$   test_allKeysForAuthorizedUser  s   z3InMemorySSHKeyDBTests.test_allKeysForAuthorizedUserN)	r]   r^   r_   r`   ra   rb   r  r  r"  r#   r#   r#   r$   r    s    	r  c                   @   sF   e Zd ZdZeZdddZdd Zdd	 Zd
d Z	dd Z
dd ZdS )UNIXAuthorizedKeysFilesTestsz8
    Tests for L{checkers.UNIXAuthorizedKeysFiles}.
    rd   Nc              	   C   s   t |  | _t| jjtsJ | j  t | _| jddddd| jjd | j	d| _
| j
  | j
	d}|d	 d
dg| _d S )Nr8   r/   r:   r;   zalice lastnameri   rg   r   s   key 1
key 2s   key 1s   key 2)r   ro   rp   rq   rr   ru   r   rF   r@   rs   rt   r   expectedKeys)r"   authorizedKeysr#   r#   r$   r%     s$   



z"UNIXAuthorizedKeysFilesTests.setUpc                 C   s   t | j}tt j| dS )zg
        L{checkers.UNIXAuthorizedKeysFiles} implements
        L{checkers.IAuthorizedKeysDB}.
        N)r   UNIXAuthorizedKeysFilesrF   r   r  r  r#   r#   r$   r    s   z5UNIXAuthorizedKeysFilesTests.test_implementsInterfacec                 C   s.   t j| jdd d}| g t|d dS )z
        If the user is not in the user database provided to
        L{checkers.UNIXAuthorizedKeysFiles}, an empty iterator is returned
        by L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys}.
        c                 S   r  r   r#   r  r#   r#   r$   r    r  zMUNIXAuthorizedKeysFilesTests.test_noKeysForUnauthorizedUser.<locals>.<lambda>r  r   N)r   r&  rF   rB   r
  r  r  r#   r#   r$   r    s   z;UNIXAuthorizedKeysFilesTests.test_noKeysForUnauthorizedUserc                 C   sH   | j dd tj| jdd d}| | jdg t|	d dS )a  
        If the user is in the user database provided to
        L{checkers.UNIXAuthorizedKeysFiles}, an iterator with all the keys in
        C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2} is returned
        by L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys}.
        r   s   key 3c                 S   r  r   r#   r  r#   r#   r$   r    r  z`UNIXAuthorizedKeysFilesTests.test_allKeysInAllAuthorizedFilesForAuthorizedUser.<locals>.<lambda>r  r   N)
rt   rs   r   r   r&  rF   rB   r$  r
  r  r  r#   r#   r$   1test_allKeysInAllAuthorizedFilesForAuthorizedUser  s
   zNUNIXAuthorizedKeysFilesTests.test_allKeysInAllAuthorizedFilesForAuthorizedUserc                 C   s0   t j| jdd d}| | jt|d dS )z
        L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys} returns only
        the keys in C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2}
        if they exist.
        c                 S   r  r   r#   r  r#   r#   r$   r    r  zJUNIXAuthorizedKeysFilesTests.test_ignoresNonexistantFile.<locals>.<lambda>r  r   N)r   r&  rF   rB   r$  r
  r  r  r#   r#   r$   test_ignoresNonexistantFile  s   z8UNIXAuthorizedKeysFilesTests.test_ignoresNonexistantFilec                 C   s@   | j d  tj| jdd d}| | jt|	d dS )z
        L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys} returns only
        the keys in C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2}
        if they are readable.
        r   c                 S   r  r   r#   r  r#   r#   r$   r    r  zIUNIXAuthorizedKeysFilesTests.test_ignoresUnreadableFile.<locals>.<lambda>r  r   N)
rt   rs   ru   r   r&  rF   rB   r$  r
  r  r  r#   r#   r$   test_ignoresUnreadableFile
  s   z7UNIXAuthorizedKeysFilesTests.test_ignoresUnreadableFiler   )r]   r^   r_   r`   ra   rb   r%   r  r  r'  r(  r)  r#   r#   r#   r$   r#    s    
		r#  _KeyDBr  c                   @   s   e Zd ZdZdS )_DummyExceptionz0
    Fake exception to be used for testing.
    N)r]   r^   r_   r`   r#   r#   r#   r$   r+    s    r+  c                   @   sL   e Zd ZdZeZdd Zdd Zdd Zdd	 Z	d
d Z
dd Zdd ZdS )SSHPublicKeyCheckerTestsz4
    Tests for L{checkers.SSHPublicKeyChecker}.
    c                 C   sD   t ddtjdtjtjd| _t	dd | _
t| j
| _d S )Nr   r   r   c                 S   s   t jtjgS r   )r   r   r   r   r   )_r#   r#   r$   r  /  s    z0SSHPublicKeyCheckerTests.setUp.<locals>.<lambda>)r   r   r   r   r   r   r   r   r   r*  r  r   SSHPublicKeyCheckerrk   r!   r#   r#   r$   r%   '  s   zSSHPublicKeyCheckerTests.setUpc                 C   s"   d| j _| | j| j t dS )z
        Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with
        credentials that do not have a signature fails with L{ValidPublicKey}.
        N)r   	signaturer   rk   r   r   r!   r#   r#   r$    test_credentialsWithoutSignature2  s   z9SSHPublicKeyCheckerTests.test_credentialsWithoutSignaturec                 C   s$   d| j _| | j| j tj dS )z
        Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with
        credentials that have a bad key fails with L{keys.BadKeyError}.
        r   N)r   r   r   rk   r   r   r   r!   r#   r#   r$   test_credentialsWithBadKey<  s   z3SSHPublicKeyCheckerTests.test_credentialsWithBadKeyc                 C   s$   t j| j_| | j| jt dS )z
        If L{checkers.IAuthorizedKeysDB.getAuthorizedKeys} returns no keys
        that match the credentials,
        L{checkers.SSHPublicKeyChecker.requestAvatarId} fails with
        L{UnauthorizedLogin}.
        N)r   publicDSA_opensshr   r   r   rk   r   r   r!   r#   r#   r$   test_credentialsNoMatchingKeyF  s   
z6SSHPublicKeyCheckerTests.test_credentialsNoMatchingKeyc                 C   s2   t jtjd| j_| | j	
| jt dS )z
        Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with
        credentials that are incorrectly signed fails with
        L{UnauthorizedLogin}.
        r   N)r   r   r   r   r   r   r   r/  r   rk   r   r   r!   r#   r#   r$    test_credentialsInvalidSignatureR  s   z9SSHPublicKeyCheckerTests.test_credentialsInvalidSignaturec                 C   s<   dd }|  tjd| | | j| jt | t	 dS )z
        If L{keys.Key.verify} raises an exception,
        L{checkers.SSHPublicKeyChecker.requestAvatarId} fails with
        L{UnauthorizedLogin}.
        c                  _   s   t  r   )r+  )argskwargsr#   r#   r$   failf  s   z?SSHPublicKeyCheckerTests.test_failureVerifyingKey.<locals>.failverifyN)
rA   r   r   r   rk   r   r   r   r   r+  )r"   r7  r#   r#   r$   test_failureVerifyingKey_  s   z1SSHPublicKeyCheckerTests.test_failureVerifyingKeyc                 C   s$   | j | j}| d| | dS )zu
        L{checker.SSHPublicKeyChecker.requestAvatarId}, if successful,
        callbacks with the username.
        r   N)rk   r   r   rB   r   r   r#   r#   r$   test_usernameReturnedOnSuccessp  s   z7SSHPublicKeyCheckerTests.test_usernameReturnedOnSuccessN)r]   r^   r_   r`   ra   rb   r%   r0  r1  r3  r4  r9  r:  r#   r#   r#   r$   r,     s    

r,  )Ar`   rT   base64r   collectionsr   ior   typingr   rr   __annotations__r*   ImportErrorr   zope.interface.verifyr   twisted.cred.checkersr   twisted.cred.credentialsr	   r
   r   r   twisted.cred.errorr   r   twisted.internet.deferr   twisted.pythonr   twisted.python.fakepwdr   r   twisted.python.filepathr   twisted.python.reflectr   twisted.test.test_processr   twisted.trial.unittestr   ra   twisted.conchr   twisted.conch.errorr   r   twisted.conch.sshr   twisted.conch.testr   getattrr   r   rc   r   r   r  r  r#  r*  	Exceptionr+  r,  r#   r#   r#   r$   <module>   s\   e KX 14"P