+
    Dfj4y                     r  a  R. t@0 t R t^ RIt^ RIHt ^ RIHt ^ RIHt ^ RI	H
t
 ] ^ k  ^ RItRt^ RIHt ^ RIHt ^ R	IHtHtHtHt ^ R
IHtHt ^ RIHt ^ RIHt ^ RIHtH t  ^ RI!H"t" ^ RI#H$t$ ^ RI%H&t& ^ RI'H(t( ]$! R4      '       d   Rt)^ RI*H+t+ ^ RI,H-t-H.t. ^ RI/H0t0 ^ RI1H2t2 MRt)]3! ]RR4      e   Rt4MRt4 ! R R](4      t5 ! R R](4      t6 ! R R](4      t7 ! R  R!](4      t8 ! R" R#](4      t9 ! R$ R%](4      t: ! R& R'](4      t;]! R(R).4      t< ! R* R+]=4      t> ! R, R-](4      t?R#   ] d    Rt ELi ; i)/z&
Tests for L{twisted.conch.checkers}.
N)encodebytes)
namedtuple)BytesIO)Optionalzcannot run without crypt module)verifyObject)'InMemoryUsernamePasswordDatabaseDontUse)ISSHPrivateKeyIUsernamePasswordSSHPrivateKeyUsernamePassword)UnauthorizedLoginUnhandledCredentials)Deferred)util)ShadowDatabaseUserDatabase)FilePath)requireModule)MockOS)TestCasecryptography)checkers)NotEnoughAuthenticationValidPublicKey)keys)keydatazcan't run without cryptographygeteuidz0Cannot run without effective UIDs (questionable)c                   l   a  ] tR t^8t o Rt];'       g    ]tR tR t	R t
R tR tR tR tR	 tR
tV tR# )HelperTestsz`
Tests for helper functions L{verifyCryptedPassword}, L{_pwdGetByName} and
L{_shadowGetByName}.
c                $    \        4       V n        R # N)r   mockosselfs   &B/usr/lib/python3/dist-packages/twisted/conch/test/test_checkers.pysetUpHelperTests.setUp@   s    h    c                    RpRp\         P                   ! W4      pV P                  \        P                  ! W14      RP	                  W14      4       R# )z~
L{verifyCryptedPassword} returns C{True} if the plaintext password
passed to it matches the encrypted password passed to it.
secret stringsaltyz5{!r} supposed to be valid encrypted password for {!r}Ncrypt
assertTruer   verifyCryptedPasswordformatr#   passwordsaltcrypteds   &   r$   test_verifyCryptedPassword&HelperTests.test_verifyCryptedPasswordC   sG    
 #++h-**7=CJJ	
r'   c                    RpRp\         P                   ! W4      pV P                  \        P                  ! W14      RP	                  W14      4       R# )zr
L{verifyCryptedPassword} returns True if the provided cleartext password
matches the provided MD5 password hash.
r1   z$1$saltz3{!r} supposed to be valid encrypted password for {}Nr+   r0   s   &   r$   test_verifyCryptedPasswordMD5)HelperTests.test_verifyCryptedPasswordMD5R   sG    
 ++h-**7=AHH	
r'   c                    RpRpRp\         P                   ! W4      pV P                  \        P                  ! WC4      RP	                  WC4      4       R# )z
L{verifyCryptedPassword} returns C{False} if the plaintext password
passed to it does not match the encrypted password passed to it.
zstring secretsomesaltr)   z7{!r} not supposed to be valid encrypted password for {}N)r,   assertFalser   r.   r/   )r#   r1   r2   wrongr3   s   &    r$   test_refuteCryptedPassword&HelperTests.test_refuteCryptedPassworda   sN    
 #++h-**7:ELL	
r'   c           	         \        4       pVP                  RR^^RRR4       V P                  \        RV4       V P	                  \        P
                  ! R4      VP                  R4      4       R# )zo
L{_pwdGetByName} returns a tuple of items from the UNIX /etc/passwd
database if the L{pwd} module is present.
alicesecrit
first last/foo/bin/shpwdN)r   addUserpatchr   assertEqual_pwdGetByNamegetpwnamr#   userdbs   & r$   test_pwdGetByNameHelperTests.test_pwdGetByNameq   sW    
 w!QfiP

8UF+//8&//':RSr'   c                ~    V P                  \        RR4       V P                  \        P                  ! R4      4       R# )zG
If the C{pwd} module isn't present, L{_pwdGetByName} returns L{None}.
rE   Nr@   )rG   r   assertIsNonerI   r"   s   &r$   test_pwdGetByNameWithoutPwd'HelperTests.test_pwdGetByNameWithoutPwd{   s-     	

8UD)(009:r'   c                
   \        4       pVP                  RR^^^^^^^4	       V P                  \        RV4       RV P                  n        RV P                  n        V P                  \        RV P                  4       V P                  \        P                  ! R4      VP                  R4      4       V P                  V P                  P                  ^ R.4       V P                  V P                  P                  ^ R.4       R# )zl
L{_shadowGetByName} returns a tuple of items from the UNIX /etc/shadow
database if the L{spwd} is present.
bob
passphrasespwd)	    osN)r   rF   rG   r   r!   euidegidr   rH   _shadowGetByNamegetspnamseteuidCallssetegidCallsrK   s   & r$   test_shadowGetByName HelperTests.test_shadowGetByName   s    
  !ulAq!Q1a@

8VV,

4t{{+22596??5;QR11At9=11At9=r'   c                   V P                  \        RR4       V P                  \        P                  ! R4      4       V P	                  V P
                  P                  . 4       V P	                  V P
                  P                  . 4       R# )z@
L{_shadowGetByName} returns L{None} if C{spwd} is not present.
rV   NrT   )rG   r   rP   r\   rH   r!   r^   r_   r"   s   &r$   test_shadowGetByNameWithoutSpwd+HelperTests.test_shadowGetByNameWithoutSpwd   sa     	

8VT*(33E:;11261126r'   )r!   N)__name__
__module____qualname____firstlineno____doc__	cryptSkipdependencySkipskipr%   r4   r7   r=   rM   rQ   r`   rc   __static_attributes____classdictcell____classdict__s   @r$   r   r   8   sG     
 &&D


 T;>"7 7r'   r   c                      a  ] tR t^t o Rt];'       g    ]tV 3R lR ltR t	R t
R tR tR tR	 tR
 tR tR tR tRtV tR# )SSHPublicKeyDatabaseTestsz$
Tests for L{SSHPublicKeyDatabase}.
c                   < V ^8  d   QhRR/#    returnN )r/   rp   s   "r$   __annotate__&SSHPublicKeyDatabaseTests.__annotate__   s     & &t &r'   c           	        \         P                  ! 4       V n        \        R 4      V n        \        R4      V n        RV P                  ,           R,           V P
                  ,           R,           V n        \        4       V n        V P                  \        RV P                  4       \        V P                  4       4      V n        \        V P                  P                  \        4      '       g   Q hV P                  P!                  R4      V n        V P"                  P%                  4        \'        4       pVP)                  RR^^R	V P                  P                  R
4       WP                  n        R# )   foobar   eggspams   t1 s    foo
t2 s    egg
rY   .sshuserr1   rB   
/bin/shellN)r   SSHPublicKeyDatabasecheckerr   key1key2contentr   r!   rG   r   r   mktemppath
isinstancestrchildsshDirmakedirsr   rF   _userdbrK   s   & r$   r%   SSHPublicKeyDatabaseTests.setUp   s    446	*	
+			)L8499DyPh

4t{{+T[[]+	$))..#....iioof-IINN	
  &r'   c                    V P                  V P                  .R7      pV P                  V^ ,          R,          \        4       V P                  V^ ,          R,          R4       V P                  \	        V4      ^4       R# )z:
L{SSHPublicKeyDatabase} is deprecated as of version 15.0
)offendingFunctionscategorymessageztwisted.conch.checkers.SSHPublicKeyDatabase was deprecated in Twisted 15.0.0: Please use twisted.conch.checkers.SSHPublicKeyChecker, initialized with an instance of twisted.conch.checkers.UNIXAuthorizedKeysFiles instead.N)flushWarningsr%   rH   DeprecationWarninglen)r#   warningsShowns   & r$   test_deprecated)SSHPublicKeyDatabaseTests.test_deprecated   sp     **tzzl*Kq)*57IJ!Y'F	
 	]+Q/r'   c                   V P                   P                  V4      P                  V P                  4       \	        R R4      pRVn        V P                  V P                  P                  V4      4       RVn        V P                  V P                  P                  V4      4       RVn        V P                  V P                  P                  V4      4       R# )   user   passwordr{   r|   s
   notallowedN)
r   r   
setContentr   r   blobr-   r   checkKeyr;   )r#   filenamer~   s   && r$   _testCheckKey'SSHPublicKeyDatabaseTests._testCheckKey   s    (#..t||<5	--d34	--d34!	..t45r'   c                    V P                  R4       V P                  V P                  P                  . 4       V P                  V P                  P                  . 4       R# )z
L{SSHPublicKeyDatabase.checkKey} should retrieve the content of the
authorized_keys file and check the keys against that file.
authorized_keysNr   rH   r!   r^   r_   r"   s   &r$   test_checkKey'SSHPublicKeyDatabaseTests.test_checkKey   sG    
 	,-11261126r'   c                    V P                  R4       V P                  V P                  P                  . 4       V P                  V P                  P                  . 4       R# )z
L{SSHPublicKeyDatabase.checkKey} should retrieve the content of the
authorized_keys2 file and check the keys against that file.
authorized_keys2Nr   r"   s   &r$   test_checkKey2(SSHPublicKeyDatabaseTests.test_checkKey2   sG    
 	-.11261126r'   c                  aa V P                   P                  R4      oSP                  V P                  4       SP	                  ^ 4       V P                  SP                  R4       V P                  P                  oVV3R lpRV P                  n        RV P                  n	        V P                  V P                  RV4       V P                  \        RV P                  4       \        RR	4      pR
Vn        V P                  V P                  P!                  V4      4       V P#                  V P                  P$                  . RO4       V P#                  V P                  P&                  ^R.4       R# )z
If the key file is readable, L{SSHPublicKeyDatabase.checkKey} should
switch its uid/gid to the ones of the authenticated user.
r     c                 6   < SP                  R 4       S! V 4      # )r   )chmod)rZ   keyFilesavedSeteuids   &r$   seteuid>SSHPublicKeyDatabaseTests.test_checkKeyAsRoot.<locals>.seteuid   s    MM% %%r'   rW   rX   r   rY   r   r   r{   N)       r   rW   )r   r   r   r   r   
addCleanupr!   r   rZ   r[   rG   r   r   r   r-   r   r   rH   r^   r_   )r#   r   r~   r   r   s   &  @@r$   test_checkKeyAsRoot-SSHPublicKeyDatabaseTests.test_checkKeyAsRoot   s   
 ++##$564<<(eu-{{**	&  

4;;	73

4t{{+5	--d3411?C11At9=r'   c           	     V  a  R pS P                  S P                  RV4       \        RR\        P                  R\
        P                  P                  \        P                  4      P                  R4      4      pS P                  P                  V4      pV 3R lpVP                  V4      # )zx
L{SSHPublicKeyDatabase.requestAvatarId} should return the avatar id
passed in if its C{_checkKey} method returns True.
c                     R # Trw   ignoreds   &r$   	_checkKeyASSHPublicKeyDatabaseTests.test_requestAvatarId.<locals>._checkKey      r'   r      test   ssh-rsa   fooc                 ,   < SP                  V R 4       R# r   NrH   avatarIdr#   s   &r$   _verify?SSHPublicKeyDatabaseTests.test_requestAvatarId.<locals>._verify      Xw/r'   )rG   r   r
   r   publicRSA_opensshr   Key
fromStringprivateRSA_opensshsignrequestAvatarIdaddCallback)r#   r   credentialsdr   s   f    r$   test_requestAvatarId.SSHPublicKeyDatabaseTests.test_requestAvatarId  s    	 	

4<<Y7#%%HH : :;@@H
 LL((5	0 }}W%%r'   c                    R pV P                  V P                  RV4       \        RR\        P                  RR4      pV P                  P                  V4      pV P                  V\        4      # )a   
L{SSHPublicKeyDatabase.requestAvatarId} should raise L{ValidPublicKey}
if the credentials represent a valid key without a signature.  This
tells the user that the key is valid for login, but does not actually
allow that user to do so without a signature.
c                     R # r   rw   r   s   &r$   r   QSSHPublicKeyDatabaseTests.test_requestAvatarIdWithoutSignature.<locals>._checkKey&  r   r'   r   r   r   N)rG   r   r
   r   r   r   assertFailurer   r#   r   r   r   s   &   r$   $test_requestAvatarIdWithoutSignature>SSHPublicKeyDatabaseTests.test_requestAvatarIdWithoutSignature  sa    	 	

4<<Y7#Z!:!:D$
 LL((5!!!^44r'   c                    R pV P                  V P                  RV4       V P                  P                  R4      pV P                  V\        4      # )zm
If L{SSHPublicKeyDatabase.checkKey} returns False,
C{_cbRequestAvatarId} should raise L{UnauthorizedLogin}.
c                     R # Frw   r   s   &r$   r   KSSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidKey.<locals>._checkKey6      r'   r   N)rG   r   r   r   r   )r#   r   r   s   &  r$   test_requestAvatarIdInvalidKey8SSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidKey0  sE    	 	

4<<Y7LL((.!!!%677r'   c           	     R   R pV P                  V P                  RV4       \        RR\        P                  R\
        P                  P                  \        P                  4      P                  R4      4      pV P                  P                  V4      pV P                  V\        4      # )z
Valid keys with invalid signatures should cause
L{SSHPublicKeyDatabase.requestAvatarId} to return a {UnauthorizedLogin}
failure
c                     R # r   rw   r   s   &r$   r   QSSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidSignature.<locals>._checkKeyD  r   r'   r   r   r   r   )rG   r   r
   r   r   r   r   r   privateDSA_opensshr   r   r   r   r   s   &   r$   $test_requestAvatarIdInvalidSignature>SSHPublicKeyDatabaseTests.test_requestAvatarIdInvalidSignature=  s    	 	

4<<Y7#%%HH : :;@@H
 LL((5!!!%677r'   c                   a  R pS P                  S P                  RV4       \        RRRRR4      pS P                  P                  V4      pV 3R lpVP	                  V4       S P                  V\        4      # )	zf
Exceptions raised while verifying the key should be normalized into an
C{UnauthorizedLogin} failure.
c                     R # r   rw   r   s   &r$   r   SSSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeException.<locals>._checkKeyX  r   r'   r   r   Ns   blobs   sigDatas   sigc                 |   < SP                  \        P                  4      pSP                  \	        V4      ^4       V # )r   )flushLoggedErrorsr   BadKeyErrorrH   r   )failureerrorsr#   s   & r$   _verifyLoggedException`SSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeException.<locals>._verifyLoggedException_  s2    ++D,<,<=FS[!,Nr'   )rG   r   r
   r   
addErrbackr   r   )r#   r   r   r   r   s   f    r$   &test_requestAvatarIdNormalizeException@SSHPublicKeyDatabaseTests.test_requestAvatarIdNormalizeExceptionR  sl    	 	

4<<Y7#GT7JOLL((5	
 	
+,!!!%677r'   )r   r   r   r   r!   r   r   N)re   rf   rg   rh   ri   euidSkiprk   rl   r%   r   r   r   r   r   r   r   r   r   r   rm   rn   ro   s   @r$   rr   rr      sZ      %%~D& &40 677>6&05$88*8 8r'   rr   c                   L   a  ] tR tRt o Rt]tR tR tR t	R t
R tR tR	tV tR
# )SSHProtocolCheckerTestsih  z"
Tests for L{SSHProtocolChecker}.
c                \   \         P                  ! 4       pV P                  VP                  . 4       VP	                  \         P
                  ! 4       4       V P                  VP                  \        .4       V P                  VP                   \        ,          \         P
                  4       R# )zh
L{SSHProcotolChecker.registerChecker} should add the given checker to
the list of registered checkers.
N)r   SSHProtocolCheckerrH   credentialInterfacesregisterCheckerr   r   assertIsInstancer#   r   s   & r$   test_registerChecker,SSHProtocolCheckerTests.test_registerCheckero  s    
 --/55r:))+	
 	557GH^,h.K.K	
r'   c                f   \         P                  ! 4       pV P                  VP                  . 4       VP	                  \         P
                  ! 4       \        4       V P                  VP                  \        .4       V P                  VP                   \        ,          \         P
                  4       R# )z
If a specific interface is passed into
L{SSHProtocolChecker.registerChecker}, that interface should be
registered instead of what the checker specifies in
credentialIntefaces.
N)r   r   rH   r   r   r   r	   r   r   s   & r$   !test_registerCheckerWithInterface9SSHProtocolCheckerTests.test_registerCheckerWithInterface~  s     --/55r: = = ?ARS558I7JK./1N1N	
r'   c                   a  \         P                  ! 4       p\        4       pVP                  RR4       VP	                  V4       VP                  \        RR4      4      pV 3R lpVP                  V4      # )zn
L{SSHProtocolChecker.requestAvatarId} should defer to one if its
registered checkers to authenticate a user.
r   c                 ,   < SP                  V R 4       R# r   r   r   s   &r$   	_callback?SSHProtocolCheckerTests.test_requestAvatarId.<locals>._callback  r   r'   )r   r   r   rF   r   r   r   r   )r#   r   passwordDatabaser   r  s   f    r$   r   ,SSHProtocolCheckerTests.test_requestAvatarId  si    
 --/BD  '2 01##$4Wg$FG	0 }}Y''r'   c                   \         P                  ! 4       pR pV P                  VRV4       \        4       pVP	                  RR4       VP                  V4       VP                  \        RR4      4      pV P                  V\        4      # )z
If the client indicates that it is never satisfied, by always returning
False from _areDone, then L{SSHProtocolChecker} should raise
L{NotEnoughAuthentication}.
c                     R # r   rw   )r   s   &r$   _areDoneYSSHProtocolCheckerTests.test_requestAvatarIdWithNotEnoughAuthentication.<locals>._areDone  r   r'   areDoner   )
r   r   rG   r   rF   r   r   r   r   r   )r#   r   r  r  r   s   &    r$   /test_requestAvatarIdWithNotEnoughAuthenticationGSSHProtocolCheckerTests.test_requestAvatarIdWithNotEnoughAuthentication  s}     --/	 	

7Ix0BD  '2 01##$4Wg$FG!!!%<==r'   c                    \         P                  ! 4       pVP                  \        RR4      4      pV P	                  V\
        4      # )z
If the passed credentials aren't handled by any registered checker,
L{SSHProtocolChecker} should raise L{UnhandledCredentials}.
r   )r   r   r   r   r   r   )r#   r   r   s   &  r$   %test_requestAvatarIdInvalidCredential=SSHProtocolCheckerTests.test_requestAvatarIdInvalidCredential  s>    
 --/##$4Wg$FG!!!%9::r'   c                l    V P                  \        P                  ! 4       P                  R4      4       R# )zF
The default L{SSHProcotolChecker.areDone} should simply return True.
N)r-   r   r   r  r"   s   &r$   test_areDone$SSHProtocolCheckerTests.test_areDone  s$     	335==dCDr'   rw   N)re   rf   rg   rh   ri   rk   rl   r   r  r   r  r  r  rm   rn   ro   s   @r$   r   r   h  s6      D

( >&;E Er'   r   c                   ~   a  ] tR tRt o Rt];'       g    ]tV 3R lR ltR t	R t
R tR tR	 tR
 tR tR tRtV tR# )UNIXPasswordDatabaseTestsi  z$
Tests for L{UNIXPasswordDatabase}.
c                :   < V ^8  d   QhRS[ S[,          RS[RR/# )ru   r   usernamerv   N)r   bytes)r/   rp   s   "r$   rx   &UNIXPasswordDatabaseTests.__annotate__  s&     < < <5 <T <r'   c                H    V P                  V P                  V4      V4       R# )z
Assert that the L{Deferred} passed in is called back with the value
'username'.  This represents a valid login for this TestCase.

@param d: a L{Deferred} from an L{IChecker.requestAvatarId} method.
N)rH   successResultOf)r#   r   r  s   &&&r$   assertLoggedIn(UNIXPasswordDatabaseTests.assertLoggedIn  s     	--a0(;r'   c                   \         P                  ! 4       pR p\        4       pVP                  RV! RR4      ^^RRR4       VP                  RR^^R	R
R4       \	        4       pVP                  RR^^^^^^^4	       VP                  RV! RR4      ^^	^
^^^^4	       V P                  \         RV4       V P                  \         RV4       \        4       pV P                  \        RV4       RVn        RVn	        \        RR4      pV P                  VP                  V4      R4       V P                  VP                  . 4       V P                  VP                  . 4       RVn        V P                  VP                  V4      R4       V P                  VP                  ^ R.4       V P                  VP                  ^ R.4       R# )zi
L{UNIXPasswordDatabase} with no arguments has checks the C{pwd} database
and then the C{spwd} database.
c                 n    \         P                   ! W4      p\         P                   ! VR V,           4      pV# )z$1$)r,   )r  r1   r2   r3   s   &&  r$   r3   ?UNIXPasswordDatabaseTests.test_defaultCheckers.<locals>.crypted  s)    ;;x2Dkk(EDL9GNr'   r@   r1   foorC   rD   rT   xbar/barr<   rE   rV   rY   rW   rX      alicer      bobN)r   UNIXPasswordDatabaser   rF   r   rG   r   r   rZ   r[   r   r  r   rH   r^   r_   r  )r#   r   r3   rE   rV   r!   creds   &      r$   test_defaultCheckers.UNIXPasswordDatabaseTests.test_defaultCheckers  s   
 //1	
 nWWj11a		
 	E31eVY?Wgq!Q1a;UGE:61b"b"bQ

8UC(

8VT*

4v&+6G33D98D,,b1,,b1G33D96B,,q$i8,,q$i8r'   c                F    V P                  V\        P                  4       R# )a}  
Asserts that the L{Deferred} passed in is erred back with an
L{UnauthorizedLogin} L{Failure}.  This reprsents an invalid login for
this TestCase.

NOTE: To work, this method's return value must be returned from the
test method, or otherwise hooked up to the test machinery.

@param d: a L{Deferred} from an L{IChecker.requestAvatarId} method.
@type d: L{Deferred}
@rtype: L{None}
N)failureResultOfr   r   r#   r   s   &&r$   assertUnauthorizedLogin1UNIXPasswordDatabaseTests.assertUnauthorizedLogin  s     	Q : :;r'   c           	        \         P                   ! RR4      p\        4       pVP                  RV^^RRR4       \        P                  ! VP
                  .4      pV P                  VP                  \        RR4      4      R4       R# )	zW
L{UNIXPasswordDatabase} takes a list of functions to check for UNIX
user information.
secretanybodyr$  r'  rD   s   anybodys   secretN)	r,   r   rF   r   r*  rJ   r  r   r   )r#   r1   rL   r   s   &   r$   test_passInCheckers-UNIXPasswordDatabaseTests.test_passInCheckers  sp    
 ;;x2y(Aq%K//0AB##$4Z$KLj	
r'   c                    R pR pV P                  \        RV4       \        P                  ! V.4      p\        RR4      pV P	                  VP                  V4      R4       R# )z
If the encrypted password provided by the getpwnam function is valid
(verified by the L{verifyCryptedPassword} function), we callback the
C{requestAvatarId} L{Deferred} with the username.
c                 
    W8H  # r    rw   r3   pws   &&r$   r.   LUNIXPasswordDatabaseTests.test_verifyPassword.<locals>.verifyCryptedPassword  
    = r'   c                     W .# r    rw   r  s   &r$   rJ   ?UNIXPasswordDatabaseTests.test_verifyPassword.<locals>.getpwnam  s    ''r'   r.      usernameNrG   r   r*  r   r  r   r#   r.   rJ   r   
credentials   &    r$   test_verifyPassword-UNIXPasswordDatabaseTests.test_verifyPassword  sY    	!	( 	

846KL//
;%k;?
G33J?Mr'   c                    R p\         P                  ! V.4      p\        RR4      pV P                  VP	                  V4      4       R# )ze
If the getpwnam function raises a KeyError, the login fails with an
L{UnauthorizedLogin} exception.
c                     \        V 4      hr    )KeyErrorr?  s   &r$   rJ   ?UNIXPasswordDatabaseTests.test_failOnKeyError.<locals>.getpwnam,  s    8$$r'   rA  r   N)r   r*  r   r1  r   )r#   rJ   r   rD  s   &   r$   test_failOnKeyError-UNIXPasswordDatabaseTests.test_failOnKeyError&  s@    	% //
;%k;?
$$W%<%<Z%HIr'   c                    R pR pV P                  \        RV4       \        P                  ! V.4      p\        RR4      pV P	                  VP                  V4      4       R# )z|
If the verifyCryptedPassword function doesn't verify the password, the
login fails with an L{UnauthorizedLogin} exception.
c                     R # r   rw   r:  s   &&r$   r.   OUNIXPasswordDatabaseTests.test_failOnBadPassword.<locals>.verifyCryptedPassword9  r   r'   c                 
    V R .# )r   rw   r?  s   &r$   rJ   BUNIXPasswordDatabaseTests.test_failOnBadPassword.<locals>.getpwnam<  s    k**r'   r.   rA  r   N)rG   r   r*  r   r1  r   rC  s   &    r$   test_failOnBadPassword0UNIXPasswordDatabaseTests.test_failOnBadPassword3  sW    		+ 	

846KL//
;%k;?
$$W%<%<Z%HIr'   c                    R pR pR pV P                  \        RV4       \        P                  ! W#.4      p\        RR4      pV P	                  VP                  V4      R4       R# )z
UNIXPasswordDatabase.requestAvatarId loops through each getpwnam
function associated with it and returns a L{Deferred} which fires with
the result of the first one which returns a value other than None.
ones do not verify the password.
c                 
    W8H  # r    rw   r:  s   &&r$   r.   RUNIXPasswordDatabaseTests.test_loopThroughFunctions.<locals>.verifyCryptedPasswordL  r=  r'   c                 
    V R .# )znot the passwordrw   r?  s   &r$   	getpwnam1FUNIXPasswordDatabaseTests.test_loopThroughFunctions.<locals>.getpwnam1O  s    011r'   c                 
    V R .# )r1   rw   r?  s   &r$   	getpwnam2FUNIXPasswordDatabaseTests.test_loopThroughFunctions.<locals>.getpwnam2R  s    j))r'   r.   rA  r   NrB  )r#   r.   rX  r[  r   rD  s   &     r$   test_loopThroughFunctions3UNIXPasswordDatabaseTests.test_loopThroughFunctionsD  s_    	!	2	* 	

846KL//0FG%k;?
G33J?Mr'   c           	     $   \        4       pVP                  RR^^RRR4       VP                  RR^^RRR4       VP                  RR^^RRR4       V P                  \        R	V4       \        P                  ! \        P
                  .4      p\        R
R4      pV P                  VP                  V4      4       \        RR4      pV P                  VP                  V4      4       \        RR4      pV P                  VP                  V4      4       R# )z
If the password returned by any function is C{""}, C{"x"}, or C{"*"} it
is not compared against the supplied password.  Instead it is skipped.
r@    r$  r&  rT   r%  carol*rE   r(  r'   r)     xs   carol   *N)	r   rF   rG   r   r*  rI   r   r1  r   )r#   rE   r   r+  s   &   r$   test_failOnSpecial,UNIXPasswordDatabaseTests.test_failOnSpecialZ  s    
 nGRAr5%8E31b%7GS!QE59

8UC(//1G1G0HI#.$$W%<%<T%BC-$$W%<%<T%BC$/$$W%<%<T%BCr'   rw   N)re   rf   rg   rh   ri   rj   rk   rl   r  r,  r1  r6  rE  rK  rR  r]  re  rm   rn   ro   s   @r$   r  r    sW      &&D< <&9P<
N$JJ"N,D Dr'   r  c                   :   a  ] tR tRt o Rt]tR tR tR t	Rt
V tR# )AuthorizedKeyFileReaderTestsip  z-
Tests for L{checkers.readAuthorizedKeyFile}
c                    \        R4      p\        P                  ! VR 4      pV P                  RR.\	        V4      4       R# )zO
L{checkers.readAuthorizedKeyFile} does not attempt to turn comments
into keys
sE   # this comment is ignored
this is not
# this is again
and this is notc                     V # r    rw   r%  s   &r$   <lambda>CAuthorizedKeyFileReaderTests.test_ignoresComments.<locals>.<lambda>  s    1r'   s   this is nots   and this is notNr   r   readAuthorizedKeyFilerH   listr#   fileobjresults   &  r$   test_ignoresComments1AuthorizedKeyFileReaderTests.test_ignoresCommentsw  sA    
 
 //E.*<=tF|Lr'   c                    \        R4      p\        P                  ! VR R7      pV P                  R.\	        V4      4       R# )z_
L{checkers.readAuthorizedKeyFile} ignores leading whitespace in
lines, as well as empty lines
sg   
                           # ignore
                           not ignored
                           c                     V # r    rw   rk  s   &r$   rl  YAuthorizedKeyFileReaderTests.test_ignoresLeadingWhitespaceAndEmptyLines.<locals>.<lambda>  s    Ar'   parseKeys   not ignoredNrn  rq  s   &  r$   *test_ignoresLeadingWhitespaceAndEmptyLinesGAuthorizedKeyFileReaderTests.test_ignoresLeadingWhitespaceAndEmptyLines  s>    
 
 //+N.)4<8r'   c                    R p\        R4      p\        P                  ! W!R7      pV P                  R.\	        V4      4       R# )z
L{checkers.readAuthorizedKeyFile} does not raise an exception
when a key fails to parse (raises a
L{twisted.conch.ssh.keys.BadKeyError}), but rather just keeps going
c                 `    V P                  R 4      '       d   \        P                  ! R4      hV # )   fzfailed to parse)
startswithr   r   )lines   &r$   
failOnSomeKAuthorizedKeyFileReaderTests.test_ignoresUnparsableKeys.<locals>.failOnSome  s(    t$$&&'899Kr'   s   failed key
good keyry  s   good keyNrn  )r#   r  rr  rs  s   &   r$   test_ignoresUnparsableKeys7AuthorizedKeyFileReaderTests.test_ignoresUnparsableKeys  s:    	
 12//M+V5r'   rw   N)re   rf   rg   rh   ri   rk   rl   rt  r{  r  rm   rn   ro   s   @r$   rh  rh  p  s&      DM96 6r'   rh  c                   :   a  ] tR tRt o Rt]tR tR tR t	Rt
V tR# )InMemorySSHKeyDBTestsi  z(
Tests for L{checkers.InMemorySSHKeyDB}
c                l    \         P                  ! RR./4      p\        \         P                  V4       R# )zG
L{checkers.InMemorySSHKeyDB} implements
L{checkers.IAuthorizedKeysDB}
r(  s   keyN)r   InMemorySSHKeyDBr   IAuthorizedKeysDBr#   keydbs   & r$   test_implementsInterface.InMemorySSHKeyDBTests.test_implementsInterface  s+    
 ))8fX*>?X//7r'   c                    \         P                  ! RR./4      pV P                  . \        VP	                  R4      4      4       R# )z
If the user is not in the mapping provided to
L{checkers.InMemorySSHKeyDB}, an empty iterator is returned
by L{checkers.InMemorySSHKeyDB.getAuthorizedKeys}
r(  s   keysr)  Nr   r  rH   rp  getAuthorizedKeysr  s   & r$   test_noKeysForUnauthorizedUser4InMemorySSHKeyDBTests.test_noKeysForUnauthorizedUser  s;     ))8gY*?@T%"9"9&"ABCr'   c                    \         P                  ! RRR./4      pV P                  RR.\        VP	                  R4      4      4       R# )z
If the user is in the mapping provided to
L{checkers.InMemorySSHKeyDB}, an iterator with all the keys
is returned by L{checkers.InMemorySSHKeyDB.getAuthorizedKeys}
r(     a   bNr  r  s   & r$   test_allKeysForAuthorizedUser3InMemorySSHKeyDBTests.test_allKeysForAuthorizedUser  sA     ))8dD\*BC$tE,C,CH,M'NOr'   rw   N)re   rf   rg   rh   ri   rk   rl   r  r  r  rm   rn   ro   s   @r$   r  r    s(      D8DP Pr'   r  c                   X   a  ] tR tRt o Rt]tV 3R lR ltR tR t	R t
R tR	 tR
tV tR# )UNIXAuthorizedKeysFilesTestsi  z0
Tests for L{checkers.UNIXAuthorizedKeysFiles}.
c                   < V ^8  d   QhRR/# rt   rw   )r/   rp   s   "r$   rx   )UNIXAuthorizedKeysFilesTests.__annotate__  s     1 1t 1r'   c           	     4   \        V P                  4       4      V n        \        V P                  P                  \        4      '       g   Q hV P                  P                  4        \        4       V n        V P                  P                  R R^^RV P                  P                  R4       V P                  P                  R4      V n
        V P                  P                  4        V P                  P                  R4      pVP                  R4       RR.V n        R	# )
r@   r1   zalice lastnamer   r}   r   s   key 1
key 2s   key 1s   key 2N)r   r   r   r   r   r   r   rL   rF   r   r   r   expectedKeys)r#   authorizedKeyss   & r$   r%   "UNIXAuthorizedKeysFilesTests.setUp  s    T[[]+	$))..#....		"nIINN	
 iioof-**+<=!!/2%x0r'   c                z    \         P                  ! V P                  4      p\        \         P                  V4       R# )zO
L{checkers.UNIXAuthorizedKeysFiles} implements
L{checkers.IAuthorizedKeysDB}.
N)r   UNIXAuthorizedKeysFilesrL   r   r  r  s   & r$   r  5UNIXAuthorizedKeysFilesTests.test_implementsInterface  s(    
 00=X//7r'   c                    \         P                  ! V P                  R R7      pV P                  . \	        VP                  R4      4      4       R# )z
If the user is not in the user database provided to
L{checkers.UNIXAuthorizedKeysFiles}, an empty iterator is returned
by L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys}.
c                     V # r    rw   rk  s   &r$   rl  MUNIXAuthorizedKeysFilesTests.test_noKeysForUnauthorizedUser.<locals>.<lambda>      QRr'   ry  r)  N)r   r  rL   rH   rp  r  r  s   & r$   r  ;UNIXAuthorizedKeysFilesTests.test_noKeysForUnauthorizedUser  s:     00{ST%"9"9&"ABCr'   c                   V P                   P                  R4      P                  R4       \        P                  ! V P
                  R R7      pV P                  V P                  R.,           \        VP                  R4      4      4       R# )z
If the user is in the user database provided to
L{checkers.UNIXAuthorizedKeysFiles}, an iterator with all the keys in
C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2} is returned
by L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys}.
r   s   key 3c                     V # r    rw   rk  s   &r$   rl  `UNIXAuthorizedKeysFilesTests.test_allKeysInAllAuthorizedFilesForAuthorizedUser.<locals>.<lambda>  r  r'   ry  r(  N)
r   r   r   r   r  rL   rH   r  rp  r  r  s   & r$   1test_allKeysInAllAuthorizedFilesForAuthorizedUserNUNIXAuthorizedKeysFilesTests.test_allKeysInAllAuthorizedFilesForAuthorizedUser  sh     	,-88B00{S
*D1H1H1R,S	
r'   c                    \         P                  ! V P                  R R7      pV P                  V P                  \        VP                  R4      4      4       R# )z
L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys} returns only
the keys in C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2}
if they exist.
c                     V # r    rw   rk  s   &r$   rl  JUNIXAuthorizedKeysFilesTests.test_ignoresNonexistantFile.<locals>.<lambda>  r  r'   ry  r(  N)r   r  rL   rH   r  rp  r  r  s   & r$   test_ignoresNonexistantFile8UNIXAuthorizedKeysFilesTests.test_ignoresNonexistantFile  s@     00{S**D1H1H1R,STr'   c                   V P                   P                  R4      P                  4        \        P                  ! V P
                  R R7      pV P                  V P                  \        VP                  R4      4      4       R# )z
L{checkers.UNIXAuthorizedKeysFiles.getAuthorizedKeys} returns only
the keys in C{~/.ssh/authorized_keys} and C{~/.ssh/authorized_keys2}
if they are readable.
r   c                     V # r    rw   rk  s   &r$   rl  IUNIXAuthorizedKeysFilesTests.test_ignoresUnreadableFile.<locals>.<lambda>  r  r'   ry  r(  N)
r   r   r   r   r  rL   rH   r  rp  r  r  s   & r$   test_ignoresUnreadableFile7UNIXAuthorizedKeysFilesTests.test_ignoresUnreadableFile  s\     	,-66800{S**D1H1H1R,STr'   )r  r   r   rL   N)re   rf   rg   rh   ri   rk   rl   r%   r  r  r  r  r  rm   rn   ro   s   @r$   r  r    s=      D1 1.8D
UU Ur'   r  _KeyDBr  c                       ] tR tRtRtRtR# )_DummyExceptioni  z(
Fake exception to be used for testing.
rw   N)re   rf   rg   rh   ri   rm   rw   r'   r$   r  r    s     	r'   r  c                   R   a  ] tR tRt o Rt]tR tR tR t	R t
R tR tR	 tR
tV tR# )SSHPublicKeyCheckerTestsi!  z,
Tests for L{checkers.SSHPublicKeyChecker}.
c           	     *   \        R R\        P                  R\        P                  P                  \        P                  4      P                  R4      4      V n        \        R 4      V n
        \        P                  ! V P                  4      V n        R# )r(  r   r   c                 ^    \         P                  P                  \        P                  4      .# r    )r   r   r   r   r   )_s   &r$   rl  0SSHPublicKeyCheckerTests.setUp.<locals>.<lambda>0  s    txx':':7;T;T'U&Vr'   N)r
   r   r   r   r   r   r   r   r   r  r  r   SSHPublicKeyCheckerr   r"   s   &r$   r%   SSHPublicKeyCheckerTests.setUp(  si    (%%HH : :;@@H
 VW
33DJJ?r'   c                    RV P                   n        V P                  V P                  P	                  V P                   4      \
        4       R# )z
Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with
credentials that do not have a signature fails with L{ValidPublicKey}.
N)r   	signaturer/  r   r   r   r"   s   &r$    test_credentialsWithoutSignature9SSHPublicKeyCheckerTests.test_credentialsWithoutSignature3  s:    
 &*"LL(()9)9:N	
r'   c                    RV P                   n        V P                  V P                  P	                  V P                   4      \
        P                  4       R# )z~
Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with
credentials that have a bad key fails with L{keys.BadKeyError}.
r'   N)r   r   r/  r   r   r   r   r"   s   &r$   test_credentialsWithBadKey3SSHPublicKeyCheckerTests.test_credentialsWithBadKey=  s@    
 !$LL(()9)9:D<L<L	
r'   c                    \         P                  V P                  n        V P	                  V P
                  P                  V P                  4      \        4       R# )z
If L{checkers.IAuthorizedKeysDB.getAuthorizedKeys} returns no keys
that match the credentials,
L{checkers.SSHPublicKeyChecker.requestAvatarId} fails with
L{UnauthorizedLogin}.
N)r   publicDSA_opensshr   r   r/  r   r   r   r"   s   &r$   test_credentialsNoMatchingKey6SSHPublicKeyCheckerTests.test_credentialsNoMatchingKeyG  sA     !( 9 9LL(()9)9:<M	
r'   c                   \         P                  P                  \        P                  4      P                  R4      V P                  n        V P                  V P                  P                  V P                  4      \        4       R# )z
Calling L{checkers.SSHPublicKeyChecker.requestAvatarId} with
credentials that are incorrectly signed fails with
L{UnauthorizedLogin}.
r   N)r   r   r   r   r   r   r   r  r/  r   r   r   r"   s   &r$    test_credentialsInvalidSignature9SSHPublicKeyCheckerTests.test_credentialsInvalidSignatureS  sa     &*XX%8%8&&&

$v, 	" 	LL(()9)9:<M	
r'   c                    R pV P                  \        P                  RV4       V P                  V P                  P                  V P                  4      \        4       V P                  \        4       R# )z}
If L{keys.Key.verify} raises an exception,
L{checkers.SSHPublicKeyChecker.requestAvatarId} fails with
L{UnauthorizedLogin}.
c                      \        4       hr    )r  )argskwargss   *,r$   fail?SSHPublicKeyCheckerTests.test_failureVerifyingKey.<locals>.failg  s    !##r'   verifyN)
rG   r   r   r/  r   r   r   r   r   r  )r#   r  s   & r$   test_failureVerifyingKey1SSHPublicKeyCheckerTests.test_failureVerifyingKey`  sV    	$ 	

488Xt,LL(()9)9:<M	
 	/r'   c                    V P                   P                  V P                  4      pV P                  RV P	                  V4      4       R# )z]
L{checker.SSHPublicKeyChecker.requestAvatarId}, if successful,
callbacks with the username.
r(  N)r   r   r   rH   r  r0  s   & r$   test_usernameReturnedOnSuccess7SSHPublicKeyCheckerTests.test_usernameReturnedOnSuccessq  s9    
 LL(()9)9:4#7#7#:;r'   )r   r   r  N)re   rf   rg   rh   ri   rk   rl   r%   r  r  r  r  r  r  rm   rn   ro   s   @r$   r  r  !  s:      D	@




0"< <r'   r  c                V    V ^8  d   Qh/ ^ \         9   d   \        \        ,          ;R&   # )ru   rj   )__conditional_annotations__r   r   )r/   s   "r$   rx   rx      s"        8C= r'   )Ar  ri   rY   base64r   collectionsr   ior   typingr   r,   rj   ImportErrorzope.interface.verifyr   twisted.cred.checkersr   twisted.cred.credentialsr   r	   r
   r   twisted.cred.errorr   r   twisted.internet.deferr   twisted.pythonr   twisted.python.fakepwdr   r   twisted.python.filepathr   twisted.python.reflectr   twisted.test.test_processr   twisted.trial.unittestr   rk   twisted.conchr   twisted.conch.errorr   r   twisted.conch.sshr   twisted.conch.testr   getattrr   r   rr   r   r  rh  r  r  r  	Exceptionr  r  rx   )r  s   @r$   <module>r     sC  
 
  "    I . I  G +  ? , 0 , +  N&K&*5N
2y$+HAHc7( c7LG8 G8TUEh UEpmD mD`168 16hPH PDMU8 MU` 
H23	4	i 	V<x V<_  21I2s   D) )	D65D6