+
    Dfj                     H  a  R0 t:0 t R t^ RIHt ^ RIHt ^ RIHt ^ RIH	t	H
t
 ^ RIHt ^ RIHtHtHt ^ RIHt ^ RIHtHt ^ R	IHtHt ^ R
IHt ^ RIHt ^ RIHt ^ RIH t  Rt!] ^ k ]! R4      '       d   ^ RI"H#t# ^ RI$H!t!H%t%H&t& ^ RI'H(t( ^ RI)H*t* M ! R R4      t% ! R R4      t& ! R R]&PV                  4      t, ! R R]&PV                  4      t- ! R R]&PV                  4      t. ! R R]%P^                  4      t0]! ]4       ! R  R!4      4       t1]! ]4       ! R" R#4      4       t2]! ]4       ! R$ R%4      4       t3]! ]4       ! R& R'4      4       t4 ! R( R)] Pj                  4      t6 ! R* R+] Pj                  4      t7 ! R, R-] Pj                  4      t8 ! R. R/] Pj                  4      t9R# )1zT
Tests for the implementation of the ssh-userauth service.

Maintainer: Paul Swartz
)
ModuleType)Optional)implementer)
ConchErrorValidPublicKey)ICredentialsChecker)
IAnonymousISSHPrivateKeyIUsernamePassword)UnauthorizedLogin)IRealmPortal)defertaskDeferred)loopback)requireModule)unittestNcryptography)SSHProtocolChecker)keys	transportuserauth)NS)keydatac                   *    ] tR t^"t ! R R4      tRtR# )r   c                       ] tR t^#tRtRtR# )transport.SSHTransportBase9
A stub class so that later class definitions won't die.
 N__name__
__module____qualname____firstlineno____doc____static_attributes__r        B/usr/lib/python3/dist-packages/twisted/conch/test/test_userauth.pySSHTransportBaser   #       r(   r*   r    N)r"   r#   r$   r%   r*   r'   r    r(   r)   r   r   "       	 	r(   r   c                   *    ] tR t^(t ! R R4      tRtR# )r   c                       ] tR t^)tRtRtR# )userauth.SSHUserAuthClientr   r    Nr!   r    r(   r)   SSHUserAuthClientr/   )   r+   r(   r0   r    N)r"   r#   r$   r%   r0   r'   r    r(   r)   r   r   (   r,   r(   r   c                   @   a  ] tR t^/t o RtR tR tRR ltR tRt	V t
R# )	ClientUserAuthz
A mock user auth client.
c                   V P                   '       d.   \        P                  P                  \        P
                  4      # \        P                  ! \        P                  P                  \        P                  4      4      # )zx
If this is the first time we've been called, return a blob for
the DSA key.  Otherwise, return a blob
for the RSA key.
)	lastPublicKeyr   Key
fromStringr   publicRSA_opensshr   succeedpublicDSA_opensshselfs   &r)   getPublicKeyClientUserAuth.getPublicKey4   sO     88&&w'@'@AA==!4!4W5N5N!OPPr(   c                    \         P                  ! \        P                  P	                  \
        P                  4      4      # )z0
Return the private key object for the RSA key.
)r   r8   r   r5   r6   r   privateRSA_opensshr:   s   &r)   getPrivateKeyClientUserAuth.getPrivateKey?   s(     }}TXX001K1KLMMr(   Nc                .    \         P                  ! R4      # )z
Return 'foo' as the password.
   foor   r8   )r;   prompts   &&r)   getPasswordClientUserAuth.getPasswordE   s     }}V$$r(   c                .    \         P                  ! R4      # )z.
Return 'foo' as the answer to two questions.
)foorI   rD   )r;   nameinformationanswerss   &&&&r)   getGenericAnswers ClientUserAuth.getGenericAnswersK   s     }}^,,r(   r    N)r"   r#   r$   r%   r&   r<   r@   rF   rM   r'   __classdictcell____classdict__s   @r)   r2   r2   /   s%     	QN%- -r(   r2   c                   0   a  ] tR t^Rt o RtR tR tRtV tR# )OldClientAuthzr
The old SSHUserAuthClient returned a cryptography key object from
getPrivateKey() and a string from getPublicKey
c                    \         P                  ! \        P                  P	                  \
        P                  4      P                  4      # rO   )r   r8   r   r5   r6   r   r?   	keyObjectr:   s   &r)   r@   OldClientAuth.getPrivateKeyX   s,    }}TXX001K1KLVVWWr(   c                x    \         P                  P                  \        P                  4      P                  4       # rO   )r   r5   r6   r   r7   blobr:   s   &r)   r<   OldClientAuth.getPublicKey[   s&    xx""7#<#<=BBDDr(   r    N	r"   r#   r$   r%   r&   r@   r<   r'   rP   rQ   s   @r)   rT   rT   R   s     
XE Er(   rT   c                   0   a  ] tR t^_t o RtR tR tRtV tR# )ClientAuthWithoutPrivateKeyzH
This client doesn't have a private key, but it does have a public key.
c                    R # rO   r    r:   s   &r)   r@   )ClientAuthWithoutPrivateKey.getPrivateKeyd   s    r(   c                \    \         P                  P                  \        P                  4      # rO   )r   r5   r6   r   r7   r:   s   &r)   r<   (ClientAuthWithoutPrivateKey.getPublicKeyg   s    xx""7#<#<==r(   r    Nr[   rQ   s   @r)   r]   r]   _   s     > >r(   r]   c                   d   a  ] tR t^kt o Rt ! R R4      t ! R R4      tR tR tR t	R	 t
R
tV tR# )FakeTransporta/  
L{userauth.SSHUserAuthServer} expects an SSH transport which has a factory
attribute which has a portal attribute. Because the portal is important for
testing authentication, we need to be able to provide an interesting portal
object to the L{SSHUserAuthServer}.

In addition, we want to be able to capture any packets sent over the
transport.

@ivar packets: a list of 2-tuples: (messageType, data).  Each 2-tuple is
    a sent packet.
@type packets: C{list}
@param lostConnecion: True if loseConnection has been called on us.
@type lostConnection: L{bool}
c                   .   a  ] tR t^|t o RtRtR tRtV tR# )FakeTransport.ServicezG
A mock service, representing the other service offered by the server.
   nancyc                    R # rO   r    r:   s   &r)   serviceStarted$FakeTransport.Service.serviceStarted   s    r(   r    N)	r"   r#   r$   r%   r&   rJ   rh   r'   rP   rQ   s   @r)   Servicere   |   s     	 	 	r(   rj   c                   *   a  ] tR t^t o RtR tRtV tR# )FakeTransport.FactoryzO
A mock factory, representing the factory that spawned this user auth
service.
c                4    VR8X  d   \         P                  # R# )z
Return our fake service.
   noneN)rc   rj   )r;   r   services   &&&r)   
getService FakeTransport.Factory.getService   s     '!$,,, "r(   r    N)r"   r#   r$   r%   r&   rp   r'   rP   rQ   s   @r)   Factoryrl      s     	
	- 	-r(   rr   c                x    V P                  4       V n        WP                  n        R V n        W n        . V n        R# )FN)rr   factoryportallostConnectionr   packets)r;   ru   s   &&r)   __init__FakeTransport.__init__   s-    ||~$#r(   c                >    V P                   P                  W34       R# )z(
Record the packet sent by the service.
N)rw   append)r;   messageTypemessages   &&&r)   
sendPacketFakeTransport.sendPacket   s     	[23r(   c                    R# )z
Pretend that this transport encrypts traffic in both directions. The
SSHUserAuthServer disables password authentication if the transport
isn't encrypted.
Tr    )r;   	directions   &&r)   isEncryptedFakeTransport.isEncrypted   s     r(   c                    R V n         R# )TN)rv   r:   s   &r)   loseConnectionFakeTransport.loseConnection   s
    "r(   )rt   rv   rw   r   N)r"   r#   r$   r%   r&   rj   rr   rx   r~   r   r   r'   rP   rQ   s   @r)   rc   rc   k   s7       - -4# #r(   rc   c                   *   a  ] tR t^t o RtR tRtV tR# )Realmz
A mock realm for testing L{userauth.SSHUserAuthServer}.

This realm is not actually used in the course of testing, so it returns the
simplest thing that could possibly work.
c                D    \         P                  ! V^ ,          RR 34      # )    Nc                      R # rO   r    r    r(   r)   <lambda>%Realm.requestAvatar.<locals>.<lambda>   s    4r(   rD   )r;   avatarIdmind
interfacess   &&&*r)   requestAvatarRealm.requestAvatar   s    }}jmT<@AAr(   r    N)r"   r#   r$   r%   r&   r   r'   rP   rQ   s   @r)   r   r      s     B Br(   r   c                   0   a  ] tR t^t o Rt]3tR tRtV t	R# )PasswordCheckerz
A very simple username/password checker which authenticates anyone whose
password matches their username and rejects all others.
c                    VP                   VP                  8X  d!   \        P                  ! VP                   4      # \        P                  ! \        R 4      4      # )zInvalid username/password pair)usernamepasswordr   r8   failr   )r;   credss   &&r)   requestAvatarIdPasswordChecker.requestAvatarId   s;    >>U^^+==00zz+,LMNNr(   r    N)
r"   r#   r$   r%   r&   r
   credentialInterfacesr   r'   rP   rQ   s   @r)   r   r      s!     
 ./O Or(   r   c                   0   a  ] tR t^t o Rt]3tR tRtV t	R# )PrivateKeyCheckerz
A very simple public key checker which authenticates anyone whose
public/private keypair is the same keydata.public/privateRSA_openssh.
c                   VP                   \        P                  P                  \        P
                  4      P                  4       8X  d   VP                  em   \        P                  P                  VP                   4      pVP                  VP                  VP                  4      '       d   VP                  #  \        4       h\        4       h\        4       hrO   )rY   r   r5   r6   r   r7   	signatureverifysigDatar   r   r   )r;   r   objs   && r)   r   !PrivateKeyChecker.requestAvatarId   s    ::,,W-F-FGLLNN*hh))%**5::eoou}}== >>) >  !! %&&!!r(   r    N)
r"   r#   r$   r%   r&   r	   r   r   r'   rP   rQ   s   @r)   r   r      s     
 +," "r(   r   c                   0   a  ] tR t^t o Rt]3tR tRtV t	R# )AnonymousCheckerzA
A simple checker which isn't supported by L{SSHUserAuthServer}.
c                    R # rO   r    )r;   credentialss   &&r)   r    AnonymousChecker.requestAvatarId   s    r(   r    N)
r"   r#   r$   r%   r&   r   r   r   r'   rP   rQ   s   @r)   r   r      s      '= r(   r   c                      a  ] tR t^t o Rt]f   RtV 3R lR ltR tV 3R lR lt	R	 t
R
 tR tR tR tR tR tR tR tR tR tR tR tR tR tV 3R lR ltR tRtV tR# )SSHUserAuthServerTestsz
Tests for SSHUserAuthServer.
Ncannot run without cryptographyc                   < V ^8  d   QhRR/#    returnNr    )formatrR   s   "r)   __annotate__#SSHUserAuthServerTests.__annotate__   s     8 8t 8r(   c                   \        4       V n        \        V P                  4      V n        V P                  P	                  \        4       4       V P                  P	                  \        4       4       \        P                  ! 4       V n	        \        V P                  4      V P                  n        V P                  P                  4        V P                  P                  P                  4        R # rO   )r   realmr   ru   registerCheckerr   r   r   SSHUserAuthServer
authServerrc   r   rh   supportedAuthenticationssortr:   s   &r)   setUpSSHUserAuthServerTests.setUp   s    W
TZZ(##O$56##$5$78"446$1$++$>!&&(00557r(   c                H    V P                   P                  4        R V n         R # rO   )r   serviceStoppedr:   s   &r)   tearDownSSHUserAuthServerTests.tearDown       &&(r(   c                $   < V ^8  d   QhRS[ RR/# )r   ignoredr   N)object)r   rR   s   "r)   r   r      s     	
 	
F 	
t 	
r(   c                   \        V P                  P                  \        4      '       g   Q hV P                  P                  P                  R,          pV P                  V\        P                  \        R4      R,           34       R# )z+
Check that the authentication has failed.
s   password,publickey    N)	
isinstancer   r   rc   rw   assertEqualr   MSG_USERAUTH_FAILUREr   )r;   r   
lastPackets   && r)   _checkFailed#SSHUserAuthServerTests._checkFailed   se     $//33]CCCC__..66r:
**B/D,E,OP	
r(   c                    V P                   P                  \        R4      \        R4      ,           \        R4      ,           4      pVP                  V P                  4      # )z
A client may request a list of authentication 'method name' values
that may continue by using the "none" authentication 'method name'.

See RFC 4252 Section 5.2.
rC   s   servicern   )r   ssh_USERAUTH_REQUESTr   addCallbackr   )r;   ds   & r)   test_noneAuthentication.SSHUserAuthServerTests.test_noneAuthentication  sH     OO00vJJ'"W+5
 }}T..//r(   c           	        a  RP                  \        R4      \        R4      \        R4      R\        R4      .4      pS P                  P                  V4      pV 3R lpVP	                  V4      # )z
When provided with correct password authentication information, the
server should respond by sending a MSG_USERAUTH_SUCCESS message with
no other data.

See RFC 4252, Section 5.1.
r(   rC   rn      passwordr   c                    < SP                  SP                  P                  P                  \        P
                  R 3.4       R# r(   Nr   r   r   rw   r   MSG_USERAUTH_SUCCESSr   r;   s   &r)   checkKSSHUserAuthServerTests.test_successfulPasswordAuthentication.<locals>.check"  5    ))11//56r(   )joinr   r   r   r   )r;   packetr   r   s   f   r)   %test_successfulPasswordAuthentication<SSHUserAuthServerTests.test_successfulPasswordAuthentication  sX     2f:r'{B{OUBvJWXOO008	 }}U##r(   c           	        RP                  \        R4      \        R4      \        R4      R\        R4      .4      p\        P                  ! 4       V P                  n        V P                  P                  V4      pV P                  V P                  P                  P                  . 4       V P                  P
                  P                  ^4       VP                  V P                  4      # )a  
When provided with invalid authentication details, the server should
respond by sending a MSG_USERAUTH_FAILURE message which states whether
the authentication was partially successful, and provides other, open
options for authentication.

See RFC 4252, Section 5.1.
r(   rC   rn   r   r      bar)r   r   r   Clockr   clockr   r   r   rw   advancer   r   r;   r   r   s   &  r)   !test_failedPasswordAuthentication8SSHUserAuthServerTests.test_failedPasswordAuthentication*  s     2f:r'{B{OUBvJWX $

OO00822::B?%%a(}}T..//r(   c                  a  \         P                  P                  \        P                  4      P                  4       p\         P                  P                  \        P                  4      p\        R4      \        R4      ,           \        R4      ,           R,           \        VP                  4       4      ,           \        V4      ,           pRS P                  P                  n        VP                  \        R4      \        \        P                  34      ,           V,           4      pV\        V4      ,          pS P                  P!                  V4      pV 3R lpVP#                  V4      # )z>
Test that private key authentication completes successfully,
rC   rn   	   publickey      testc                    < SP                  SP                  P                  P                  \        P
                  R 3.4       R# r   r   r   s   &r)   r   MSSHUserAuthServerTests.test_successfulPrivateKeyAuthentication.<locals>.checkP  r   r(   )r   r5   r6   r   r7   rY   r?   r   sshTyper   r   	sessionIDsignbytesr   MSG_USERAUTH_REQUESTr   r   )r;   rY   r   r   r   r   r   s   f      r)   'test_successfulPrivateKeyAuthentication>SSHUserAuthServerTests.test_successfulPrivateKeyAuthentication;  s    xx""7#<#<=BBDhh!!'"<"<=vJk  	 
 h 	 /6!!+HHwK%!>!> @AAFJ
	 	"Y-OO008	 }}U##r(   c                  a \         P                  ! 4       oR pR pV3R lpV P                  V P                  RV4       V P                  V P                  RV4       V P                  V P                  RV4       \	        R4      \	        R4      ,           \	        R	4      ,           \	        R
4      ,           pV P                  P                  V4       V P                  S\        4      # )zs
ssh_USERAUTH_REQUEST should raise a ConchError if tryAuth returns
None. Added to catch a bug noticed by pyflakes.
c                 (    V P                  R 4       R# )z&request should have raised ConochErrorN)r   )r;   r   s   &&r)   mockCbFinishedAuthOSSHUserAuthServerTests.test_requestRaisesConchError.<locals>.mockCbFinishedAuth_  s    II>?r(   c                     R # rO   r    )kinduserdatas   &&&r)   mockTryAuthHSSHUserAuthServerTests.test_requestRaisesConchError.<locals>.mockTryAuthb      r(   c                 >   < SP                  V P                  4       R # rO   )errbackvalue)reasonr   s   &r)   mockEbBadAuthJSSHUserAuthServerTests.test_requestRaisesConchError.<locals>.mockEbBadAuthe  s    IIfll#r(   tryAuth_cbFinishedAuth
_ebBadAuths   userrn   s
   public-keys   data)r   r   patchr   r   r   assertFailurer   )r;   r   r   r  r   r   s   &    @r)   test_requestRaisesConchError3SSHUserAuthServerTests.test_requestRaisesConchErrorX  s    
 NN	@		$ 	

4??I{;

4??$57IJ

4??L-@Gr'{*R->>GL 	,,V4!!!Z00r(   c                  a a \         P                  P                  \        P                  4      P                  4       o\        R4      \        R4      ,           \        R4      ,           R,           \        R4      ,           \        S4      ,           pS P                  P                  V4      pVV 3R lpVP                  V4      # )z0
Test that verifying a valid private key works.
rC   rn   r   r      ssh-rsac                    < SP                  SP                  P                  P                  \        P
                  \        R 4      \        S4      ,           3.4       R# )r  N)r   r   r   rw   r   MSG_USERAUTH_PK_OKr   )r   rY   r;   s   &r)   r   @SSHUserAuthServerTests.test_verifyValidPrivateKey.<locals>.check  sB    ))11--r*~4/HIJr(   )
r   r5   r6   r   r7   rY   r   r   r   r   )r;   r   r   r   rY   s   f   @r)   test_verifyValidPrivateKey1SSHUserAuthServerTests.test_verifyValidPrivateKeyr  s     xx""7#<#<=BBDvJk  n	
 h 	 OO008	 }}U##r(   c                   \         P                  P                  \        P                  4      P                  4       p\        R4      \        R4      ,           \        R4      ,           R,           \        R4      ,           \        V4      ,           pV P                  P                  V4      pVP                  V P                  4      # )L
Test that private key authentication fails when the public key
is invalid.
rC   rn   r   r   s   ssh-dsar   r5   r6   r   r9   rY   r   r   r   r   r   r;   rY   r   r   s   &   r)   3test_failedPrivateKeyAuthenticationWithoutSignatureJSSHUserAuthServerTests.test_failedPrivateKeyAuthenticationWithoutSignature  s    
 xx""7#<#<=BBDvJk  n	
 h 	 OO008}}T..//r(   c                V   \         P                  P                  \        P                  4      P                  4       p\         P                  P                  \        P                  4      p\        R4      \        R4      ,           \        R4      ,           R,           \        R4      ,           \        V4      ,           \        VP                  V4      4      ,           pRV P                  P                  n        V P                  P                  V4      pVP                  V P                  4      # )r  rC   rn   r   r   r  r   )r   r5   r6   r   r7   rY   r?   r   r   r   r   r   r   r   r   )r;   rY   r   r   r   s   &    r)   0test_failedPrivateKeyAuthenticationWithSignatureGSSHUserAuthServerTests.test_failedPrivateKeyAuthenticationWithSignature  s    
 xx""7#<#<=BBDhh!!'"<"<=vJk  n	
 h $ ! 	 /6!!+OO008}}T..//r(   c                   \         P                  P                  \        P                  4      P                  4       p\        R4      VR,          ,           p\        R4      \        R4      ,           \        R4      ,           R,           \        R4      ,           \        V4      ,           pV P                  P                  V4      pVP                  V P                  4      # )zh
Private key authentication fails when the public key type is
unsupported or the public key is corrupt.
s   ssh-bad-type:   NNrC   rn   r   r   r  r  r  s   &   r)   test_unsupported_publickey1SSHUserAuthServerTests.test_unsupported_publickey  s    
 xx""7#<#<=BBD /"T#Y. vJk  n	
 h 	 OO008}}T..//r(   c                Z   \         P                  ! 4       p\        V P                  4      Vn        V P                  P                  \        4       4       VP                  4        VP                  4        VP                  P                  4        V P                  VP                  RR.4       R# )a0  
L{SSHUserAuthServer} sets up
C{SSHUserAuthServer.supportedAuthentications} by checking the portal's
credentials interfaces and mapping them to SSH authentication method
strings.  If the Portal advertises an interface that
L{SSHUserAuthServer} can't map, it should be ignored.  This is a white
box test.
r   r   N)r   r   rc   ru   r   r   r   rh   r   r   r   r   )r;   servers   & r)    test_ignoreUnknownCredInterfaces7SSHUserAuthServerTests.test_ignoreUnknownCredInterfaces  s~     ++-(5##$4$67'',,.88;:UVr(   c                F   V P                  RV P                  P                  4       \        P                  ! 4       p\        V P                  4      Vn        R VP                  n        VP                  4        VP                  4        V P                  RVP                  4       \        P                  ! 4       p\        V P                  4      Vn        R VP                  n        VP                  4        VP                  4        V P                  RVP                  4       R# )zw
Test that the userauth service does not advertise password
authentication if the password would be send in cleartext.
r   c                     R # Fr    xs   &r)   r   ISSHUserAuthServerTests.test_removePasswordIfUnencrypted.<locals>.<lambda>      %r(   c                     V R 8H  # inr    r*  s   &r)   r   r,        dr(   N)assertInr   r   r   r   rc   ru   r   r   rh   r   assertNotIn)r;   clearAuthServerhalfAuthServers   &  r)    test_removePasswordIfUnencrypted7SSHUserAuthServerTests.test_removePasswordIfUnencrypted  s    
 	k4??#K#KL"446$1$++$>!0?!!-&&(&&(o&N&NO!335#0#= /B  ,%%'%%'k>#J#JKr(   c                2   \        V P                  4      pVP                  \        4       4       \        P
                  ! 4       p\        V4      Vn        R VP                  n        VP                  4        VP                  4        V P                  VP                  R.4       \        P
                  ! 4       p\        V4      Vn        R VP                  n        VP                  4        VP                  4        V P                  VP                  R.4       R# )z
If the L{SSHUserAuthServer} is not advertising passwords, then an
unencrypted connection should not cause any warnings or exceptions.
This is a white box test.
c                     R # r)  r    r*  s   &r)   r   SSSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswords.<locals>.<lambda>  r-  r(   r   c                     V R 8H  # r/  r    r*  s   &r)   r   r:    r1  r(   N)r   r   r   r   r   r   rc   r   r   rh   r   r   r   )r;   ru   r4  r5  s   &   r)   *test_unencryptedConnectionWithoutPasswordsASSHUserAuthServerTests.test_unencryptedConnectionWithoutPasswords  s     

#023 #446$1&$9!0?!!-&&(&&(AAL>R "335#0#8 /B  ,%%'%%'AAL>Rr(   c                D   \         P                  ! 4       p\        P                  ! 4       Vn        \        V P                  4      Vn        VP                  4        VP                  P                  R4       VP                  4        V P                  VP                  P                  \        P                  R\        \        P                  34      ,           \!        R4      ,           \!        R4      ,           3.4       V P#                  VP                  P$                  4       R# )z 
Test that the login times out.
s   you took too longr(   N鰚        )r   r   r   r   r   rc   ru   r   rh   r   r   r   rw   MSG_DISCONNECTr   )DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLEr   
assertTruerv   r;   timeoutAuthServers   & r)   test_loginTimeout(SSHUserAuthServerTests.test_loginTimeout  s     %668"&**,&3DKK&@#((*''5((*''// ,,YPPRST-./ g	
 	)33BBCr(   c                   \         P                  ! 4       p\        P                  ! 4       Vn        \        V P                  4      Vn        VP                  4        VP                  4        VP                  P                  R4       V P                  VP                  P                  . 4       V P                  VP                  P                  4       R# )z>
Test that stopping the service also stops the login timeout.
Nr?  )r   r   r   r   r   rc   ru   r   rh   r   r   r   rw   assertFalserv   rD  s   & r)   test_cancelLoginTimeout.SSHUserAuthServerTests.test_cancelLoginTimeout  s     %668"&**,&3DKK&@#((*((*''5*44<<bA*44CCDr(   c           	       a  RP                  \        R4      \        R4      \        R4      R\        R4      .4      p\        P                  ! 4       S P                  n        \        ^4       FC  pS P                  P                  V4      pS P                  P
                  P                  ^4       KE  	  V 3R lpXP                  V4      # )zU
Test that the server disconnects if the client fails authentication
too many times.
r(   rC   rn   r   r   r   c                   < SP                  SP                  P                  P                  R,          \        P                  R\        \        P                  34      ,           \        R4      ,           \        R4      ,           34       R# )   s   too many bad authsr(   Nr   r@  )r   r   r   rw   rA  r   rB  r   r   s   &r)   r   :SSHUserAuthServerTests.test_tooManyAttempts.<locals>.check4  sm    ))11"5,,YPPRST./0 g	r(   )
r   r   r   r   r   r   ranger   r   r   )r;   r   ir   r   s   f    r)   test_tooManyAttempts+SSHUserAuthServerTests.test_tooManyAttempts)  s    
 2f:r'{B{OUBvJWX $

rA44V<AOO!!))!, 
	 }}U##r(   c                .   < V ^8  d   QhRS[ R,          /# r   r   )r   rR   s   "r)   r   r   B  s     	0 	08D> 	0r(   c                F   \        R4      \        R4      ,           \        R4      ,           R,           \        R4      ,           p\        P                  ! 4       V P                  n        V P                  P                  V4      pVf   Q hVP                  V P                  4      # )zW
If the user requests a service that we don't support, the
authentication should fail.
rC   r(   r   r   )r   r   r   r   r   r   r   r   r   s   &  r)   test_failIfUnknownService0SSHUserAuthServerTests.test_failIfUnknownServiceB  sr    
 Fbg%;7%?"V*L $

OO008}}}}T..//r(   c                  a  R pS P                  S P                  RV4       S P                  S P                  RR4       V 3R lpS P                  P                  RRR4      pS P                  V\        4      P                  V4      # )a"  
tryAuth() has two edge cases that are difficult to reach.

1) an authentication method auth_* returns None instead of a Deferred.
2) an authentication type that is defined does not have a matching
   auth_* method.

Both these cases should return a Deferred which fails with a
ConchError.
c                     R # rO   r    )r   s   &r)   mockAuth>SSHUserAuthServerTests.test_tryAuthEdgeCases.<locals>.mockAuthY  r  r(   auth_publickeyauth_passwordNc                 j   < SP                   P                  R RR4      pSP                  V\        4      # )r   N)r   r  r  r   )r   d2r;   s   & r)   
secondTest@SSHUserAuthServerTests.test_tryAuthEdgeCases.<locals>.secondTest_  s.    ((dDAB%%b*55r(   r   )r  r   r  r  r   r   )r;   rZ  r`  d1s   f   r)   test_tryAuthEdgeCases,SSHUserAuthServerTests.test_tryAuthEdgeCasesM  sp    	 	

4??$4h?

4??OT:	6 __$$\4>!!"j1==jIIr(   )r   ru   r   )r"   r#   r$   r%   r&   r   skipr   r   r   r   r   r   r   r  r  r  r  r!  r%  r6  r<  rF  rJ  rR  rV  rc  r'   rP   rQ   s   @r)   r   r      s      |08 8	
 	

0$&0"$:14$.0"0(0,W"L*S4D0E$2	0 	0J Jr(   r   c                      a  ] tR tRt o Rt]f   RtR tR tR t	R t
R	 tR
 tR tR tR tR tR tR tR tR tR tRtV tR# )SSHUserAuthClientTestsig  z
Tests for SSHUserAuthClient.
Nr   c                    \        R \        P                  4       4      V n        \        R4      V P                  n        RV P                  P                  n        V P                  P                  4        R# )rC   Nr   )r2   rc   rj   
authClientr   r   rh   r:   s   &r)   r   SSHUserAuthClientTests.setUpo  sL    (1F1F1HI$1$$7!.5!!+&&(r(   c                H    V P                   P                  4        R V n         R # rO   )ri  r   r:   s   &r)   r   SSHUserAuthClientTests.tearDownu  r   r(   c                   V P                  V P                  P                  R4       V P                  V P                  P                  P                  R4       V P                  V P                  P
                  P                  \        P                  \        R4      \        R4      ,           \        R4      ,           3.4       R# )z+
Test that client is initialized properly.
rC   rf   rn   N)
r   ri  r   instancerJ   r   rw   r   r   r   r:   s   &r)   	test_init SSHUserAuthClientTests.test_inity  s     	--v61166AOO%%--++RZ"X,-FG-TUV	
r(   c                   a R.oV3R lpWP                   P                  n        V P                   P                  R4       V P	                  S^ ,          V P                   P
                  4       R# )z)
Test that the client succeeds properly.
Nc                    < V S^ &   R# )r   Nr    )ro   rn  s   &r)   stubSetServiceDSSHUserAuthClientTests.test_USERAUTH_SUCCESS.<locals>.stubSetService  s    !HQKr(   r(   )ri  r   
setServicessh_USERAUTH_SUCCESSr   rn  )r;   rs  rn  s   & @r)   test_USERAUTH_SUCCESS,SSHUserAuthClientTests.test_USERAUTH_SUCCESS  sS     6	" 0>!!,,,S1!doo&>&>?r(   c           
        V P                   P                  \        R4      R,           4       V P                  V P                   P                  P
                  R	,          \        P                  \        R4      \        R4      ,           \        R4      ,           R,           \        R4      ,           \        \        P                  P                  \        P                  4      P                  4       4      ,           34       V P                   P                  \        R4      R,           4       \        \        P                  P                  \        P                  4      P                  4       4      pV P                  V P                   P                  P
                  R	,          \        P                  \        R4      \        R4      ,           \        R4      ,           R,           \        R4      ,           V,           34       V P                   P                  \        R4      \        \        P                  P                  \        P                  4      P                  4       4      ,           4       \        V P                   P                  P                   4      \#        \        P                  34      ,           \        R4      ,           \        R4      ,           \        R4      ,           R,           \        R4      ,           V,           p\        P                  P                  \        P$                  4      pV P                  V P                   P                  P
                  R	,          \        P                  \        R4      \        R4      ,           \        R4      ,           R,           \        R4      ,           V,           \        VP'                  V4      4      ,           34       R# )
z:
Test that the client can authenticate with a public key.
r   r   rC   rf   s   ssh-dssr     Nr   )ri  ssh_USERAUTH_FAILUREr   r   r   rw   r   r   r   r5   r6   r   r9   rY   r7   ssh_USERAUTH_PK_OKr   r   r?   r   )r;   rY   r   r   s   &   r)   test_publickey%SSHUserAuthClientTests.test_publickey  s    	,,R-=-GHOO%%--b1--6
X,\"#  Z.	!
 TXX(()B)BCHHJKL	
 	,,R-=-GH$((%%g&?&?@EEGHOO%%--b1--vJl#&'  n	%
 
	
 	**zNR 3 3G4M4M N S S UVV	
 t((223X22456j l 	
  n  	 hh!!'"<"<=OO%%--b1--6
X,\"#  Z.	!
  SXXg&'(		
r(   c                   \        R\        P                  4       4      p\        R4      Vn        RVP                  n        VP                  4        VP                  R4       . VP                  n        V P                  VP                  R4      4       V P                  VP                  P                  \        P                  \        R4      \        R4      ,           \        R4      ,           3.4       R# )z
If the SSHUserAuthClient doesn't return anything from signData,
the client should start the authentication over again by requesting
'none' authentication.
rC   Nr   r   r(   rf   rn   )r]   rc   rj   r   r   rh   r  rw   assertIsNoner|  r   r   r   r   )r;   ri  s   & r)   !test_publickey_without_privatekey8SSHUserAuthClientTests.test_publickey_without_privatekey  s     19N9N9PQ
,T2
)0
&!!#<(')
$*77<=  ((++RZ"X,-FG-TUV	
r(   c                   a  R S P                   n        S P                   P                  R4      pV 3R lpVP                  V4      # )zc
If there's no public key, auth_publickey should return a Deferred
called back with a False value.
c                     R # rO   r    r*  s   &r)   r   :SSHUserAuthClientTests.test_no_publickey.<locals>.<lambda>      r(   r   c                 *   < SP                  V 4       R # rO   )rI  )resultr;   s   &r)   r   7SSHUserAuthClientTests.test_no_publickey.<locals>.check  s    V$r(   )ri  r<   r  r   )r;   r   r   s   f  r)   test_no_publickey(SSHUserAuthClientTests.test_no_publickey  s;    
 (6$OO##L1	% }}U##r(   c                   V P                   P                  \        R4      R,           4       V P                  V P                   P                  P
                  R,          \        P                  \        R4      \        R4      ,           \        R4      ,           R,           \        R4      ,           34       V P                   P                  \        R4      \        R4      ,           4       V P                  V P                   P                  P
                  R,          \        P                  \        R4      \        R4      ,           \        R4      ,           R,           \        R4      ^,          ,           34       R# )	z`
Test that the client can authentication with a password.  This
includes changing the password.
r   r   rC   rf   r(   r   Nr   )	ri  r{  r   r   r   rw   r   r   r|  r:   s   &r)   test_password$SSHUserAuthClientTests.test_password  s    
 	,,R_w-FGOO%%--b1--6
R\)B{O;gE6
R	
 	**2c7RW+<=OO%%--b1--6
R\)B{O;gE6
UVV	
r(   c                ~    R V P                   n        V P                  V P                   P                  R4      4       R# )z;
If getPassword returns None, tryAuth should return False.
c                      R # rO   r    r    r(   r)   r   9SSHUserAuthClientTests.test_no_password.<locals>.<lambda>	  s    dr(   r   N)ri  rF   rI  r  r:   s   &r)   test_no_password'SSHUserAuthClientTests.test_no_password  s-     '3#00=>r(   c                   V P                   P                  \        R4      \        R4      ,           \        R4      ,           R,           \        R4      ,           R,           4       V P                  V P                   P                  P
                  R,          \        P                  R\        R4      ,           \        R4      ,           34       R# )	zR
Make sure that the client can authenticate with the keyboard
interactive method.
r(   s      s
   Password: r   s      rC   Nr   )ri  'ssh_USERAUTH_PK_OK_keyboard_interactiver   r   r   rw   r   MSG_USERAUTH_INFO_RESPONSEr:   s   &r)   test_keyboardInteractive/SSHUserAuthClientTests.test_keyboardInteractive  s    
 	??sGgg "" 	 
 	
 	OO%%--b133#bj02f:=	
r(   c                h   RV P                   n        . V P                   P                  n        V P                   P	                  R4       V P                  V P                   P                  P                  \        P                  \        R4      \        R4      ,           \        R4      ,           3.4       R# )z
If C{SSHUserAuthClient} gets a MSG_USERAUTH_PK_OK packet when it's not
expecting it, it should fail the current authentication and move on to
the next type.
s   unknownr(   rC   rf   rn   N)	ri  lastAuthr   rw   r|  r   r   r   r   r:   s   &r)   "test_USERAUTH_PK_OK_unknown_method9SSHUserAuthClientTests.test_USERAUTH_PK_OK_unknown_method!  s|     $. ,.!!)**3/OO%%--++RZ"X,-FG-TUV	
r(   c                  a  V 3R lpV 3R lpVS P                   n        VS P                   n        S P                   P                  \	        R4      R,           4       S P                  S P                   P                  P                  R,          \        P                  \	        R4      \	        R4      ,           \	        R4      ,           R,           \	        R4      ,           34       S P                   P                  \	        R4      R	,           4       S P                  S P                   P                  P                  RR
 RR.4       R
# )z
ssh_USERAUTH_FAILURE should sort the methods by their position
in SSHUserAuthClient.preferredOrder.  Methods that are not in
preferredOrder should be sorted at the end of that list.
c                  T   < S P                   P                  P                  ^R4       R# )      here is dataNri  r   r~   r:   s   r)   auth_firstmethodNSSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting.<locals>.auth_firstmethod6  s    OO%%00oFr(   c                  T   < S P                   P                  P                  ^R4       R# )   
   other dataTr  r:   s   r)   auth_anothermethodPSSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting.<locals>.auth_anothermethod9  s     OO%%00mDr(   s   anothermethod,passwordr   rC   rf   r   s"   firstmethod,anothermethod,passwordr   Nr   )r  r  )r  r  )
ri  r  r  r{  r   r   r   rw   r   r   )r;   r  r  s   f  r)   test_USERAUTH_FAILURE_sorting4SSHUserAuthClientTests.test_USERAUTH_FAILURE_sorting/  s    	G	 ,<(-?* 	,,R0I-JW-TUOO%%--b1--6
R\)B{O;gE6
R	
 	,,45?	
 	OO%%--bc2#%9:	
r(   c                n   V P                   P                  \        R4      R,           4       V P                   P                  \        R4      R,           4       V P                  V P                   P                  P
                  R,          \        P                  R\        R4      ,           R,           34       R# )	z
If there are no more available user authentication messages,
the SSHUserAuthClient should disconnect with code
DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE.
r   r   r   s      s(   no more authentication methods availables       Nr   )ri  r{  r   r   r   rw   rA  r:   s   &r)   %test_disconnectIfNoMoreAuthentication<SSHUserAuthClientTests.test_disconnectIfNoMoreAuthenticationS  s     	,,R_w-FG,,R_w-FGOO%%--b1((#@AB%&	
r(   c                F   . V P                   P                  n        V P                   P                  R4       V P	                  V P                   P                  P                  \
        P                  \        R4      \        R4      ,           \        R4      ,           3.4       R# )zp
_ebAuth (the generic authentication error handler) should send
a request for the 'none' authentication method.
NrC   rf   rn   )ri  r   rw   _ebAuthr   r   r   r   r:   s   &r)   test_ebAuth"SSHUserAuthClientTests.test_ebAuthe  sp    
 -/!!)%OO%%--++RZ"X,-FG-TUV	
r(   c                4  a aaa \         P                  ! R\        P                  4       4      oS P	                  SP                  4       4       VVV 3R lpVVV 3R loR oSP                  4       pVP                  S P                  4      P                  V4      # )z
getPublicKey() should return None.  getPrivateKey() should return a
failed Deferred.  getPassword() should return a failed Deferred.
getGenericAnswers() should return a failed Deferred.
rC   c                    < V P                  \        4       SP                  4       pVP                  SP                  4      P                  S4      # rO   )trapNotImplementedErrorrF   r   r   
addErrback)r  r   ri  check2r;   s   & r)   r   3SSHUserAuthClientTests.test_defaults.<locals>.checkz  s<    KK+,&&(A==+66v>>r(   c                    < V P                  \        4       SP                  R R R 4      pVP                  SP                  4      P                  S4      # rO   )r  r  rM   r   r   r  )r  r   ri  check3r;   s   & r)   r  4SSHUserAuthClientTests.test_defaults.<locals>.check2  sB    KK+,,,T4>A==+66v>>r(   c                 0    V P                  \        4       R # rO   )r  r  )r  s   &r)   r  4SSHUserAuthClientTests.test_defaults.<locals>.check3  s    KK+,r(   )
r   r0   rc   rj   r  r<   r@   r   r   r  )r;   r   r   ri  r  r  s   f  @@@r)   test_defaults$SSHUserAuthClientTests.test_defaultsq  st     //8M8M8OP
*1134	?
	?
	- $$&}}TYY'22599r(   )ri  )r"   r#   r$   r%   r&   r   re  r   r   ro  rw  r}  r  r  r  r  r  r  r  r  r  r  r'   rP   rQ   s   @r)   rg  rg  g  si      |0)	
@<
|
&$
,?
*
"
H
$

: :r(   rg  c                   F   a  ] tR tRt o ]f   Rt ! R R4      tR tRtV t	R# )LoopbackTestsi  Nr   c                   :   a  ] tR tRt o  ! R R4      tR tRtV tR# )LoopbackTests.Factoryi  c                   0   a  ] tR tRt o RtR tR tRtV tR# )LoopbackTests.Factory.Servicei     TestServicec                :    V P                   P                  4        R # rO   )r   r   r:   s   &r)   rh   ,LoopbackTests.Factory.Service.serviceStarted  s    --/r(   c                    R # rO   r    r:   s   &r)   r   ,LoopbackTests.Factory.Service.serviceStopped  s    r(   r    N)	r"   r#   r$   r%   rJ   rh   r   r'   rP   rQ   s   @r)   rj   r    s     !D0 r(   rj   c                    V P                   # rO   )rj   )r;   avatarrJ   s   &&&r)   rp    LoopbackTests.Factory.getService  s    <<r(   r    N)r"   r#   r$   r%   rj   rp   r'   rP   rQ   s   @r)   rr   r    s     	 		  	 r(   rr   c                d  a aa \         P                  ! 4       o\        RS P                  P	                  4       4      p\
        P                  ! 4       Sn        SSP
                  n        R SP
                  n        \
        P                  ! 4       Vn        WP
                  n        R;SP
                  n	        VP
                  n	        R ;SP
                  n
        VP
                  n
        S P                  4       SP
                  n        ^ Sn        \        4       p\        V4      p\        4       oSP!                  \#        4       4       SP!                  \%        4       4       V3R lSn        VP!                  S4       VSP
                  P                  n        \*        P,                  ! SP
                  VP
                  4      pR SP
                  P
                  n        R VP
                  P
                  n        SP1                  4        VP1                  4        V V3R lpVP3                  V4      # )	zG
Test that the userauth server and client play nicely with each other.
rC   c                     R # )Tr    r*  s   &r)   r   -LoopbackTests.test_loopback.<locals>.<lambda>  r  r(   r(   c                      R # rO   r    r    r(   r)   r   r    s    dr(   c                 B   < \        SP                  V ,          4      ^8H  # )r   )lensuccessfulCredentials)aIdcheckers   &r)   r   r    s    s7+H+H+M'NRS'Sr(   c                      R # )_ServerLoopbackr    r    r(   r)   r   r        7Hr(   c                      R # )_ClientLoopbackr    r    r(   r)   r   r    r  r(   c                 h   < SP                  SP                  P                  P                  R 4       R# )r  N)r   r   ro   rJ   )r   r;   r$  s   &r)   r   *LoopbackTests.test_loopback.<locals>.check  s%    V--55::NKr(   )r   r   r2   rr   rj   r   r*   ro   r   r   sendKexInitrt   passwordDelayr   r   r   r   r   r   areDoneru   r   loopbackAsync	logPrefixrh   r   )r;   clientr   ru   r   r   r  r$  s   f     @@r)   test_loopbackLoopbackTests.test_loopback  s    ++-(<(<(>? %557#) '5$$557#) BEE"V%5%5%?FRR$v'7'7'C $(<<>  $& 12 1 34Tw'*0  '""6#3#3V5E5EF/H"",/H"",	L }}U##r(   r    )
r"   r#   r$   r%   r   re  rr   r  r'   rP   rQ   s   @r)   r  r    s#     |0   '$ '$r(   r  c                   2   a  ] tR tRt o ]f   RtR tRtV tR# )ModuleInitializationTestsi  Nr   c                    V P                  \        P                  P                  ^<,          R4       V P                  \        P                  P                  ^<,          R4       R# )<   r  N)r   r   r   protocolMessagesr0   r:   s   &r)   test_messages'ModuleInitializationTests.test_messages  sP     	&&77;=Q	
 	&&77;=Q	
r(   r    )	r"   r#   r$   r%   r   re  r  r'   rP   rQ   s   @r)   r  r    s     |0
 
r(   r  c                V    V ^8  d   Qh/ ^ \         9   d   \        \        ,          ;R&   # )r   r   )__conditional_annotations__r   r   )r   s   "r)   r   r      s#      , " !hz !-r(   );r  r&   typesr   typingr   zope.interfacer   twisted.conch.errorr   r   twisted.cred.checkersr   twisted.cred.credentialsr   r	   r
   twisted.cred.errorr   twisted.cred.portalr   r   twisted.internetr   r   twisted.internet.deferr   twisted.protocolsr   twisted.python.reflectr   twisted.trialr   r   twisted.conch.checkersr   twisted.conch.sshr   r   twisted.conch.ssh.commonr   twisted.conch.testr   r0   r2   rT   r]   r*   rc   r   r   r   r   TestCaser   rg  r  r  r   )r  s   @r)   <module>r     s     & : 5 R R 0 . ( + & 0 "! !  9;;+*   -X//  -F
EH.. 
E	>("<"< 	>>#I.. >#B V	B 	B 	B  !O O "O  !" " ""&  !	 	 "	{JX.. {J|a:X.. a:H	8$H%% 8$v
 1 1 
r(   