o be@s6dZddlZddlmZddlmZmZddlmZddl m Z ddl m Z ddl mZmZmZmZdd lmZmZmZdd lmZdd lmZdd lmZdd lmZddlmZedZ edZ!edZ"ddZ#GdddeZ$GdddeZ%GdddeZ&GdddeZ'ee! dee dee" dGdd d eZ(ee d!Gd"d#d#eZ)Gd$d%d%eZ*eed& d'eed( d)Gd*d+d+eZ+Gd,d-d-ej,ej-Z.Gd.d/d/eZ/Gd0d1d1ej,ej-Z0Gd2d3d3ej,ej-Z1Gd4d5d5ej,ej-Z2Gd6d7d7ej,ej-Z3Gd8d9d9eZ4dS):z L{twisted.cred.strcred}. N)StringIO)SequenceType)skipIf) Interface)plugin)checkers credentialserrorstrcred)cred_anonymous cred_file cred_unix)usage) UserDatabase)FilePath) requireModule)TestCasecryptpwdspwdcCs<d}|ddtDvr|d7}|ddtDvs |S)zC Helper method to produce an auth type that doesn't exist. ThisPluginDoesNotExistcSsg|]}|jqS)authType).0factoryrr@/usr/lib/python3/dist-packages/twisted/cred/test/test_strcred.py #sz&getInvalidAuthType.._)r findCheckerFactories)invalidAuthTyperrrgetInvalidAuthTypesr!c@eZdZddZddZdS)PublicAPITestscC.t}|tjtj||tjtj|dS)z9 The description string cannot be empty. Nr! assertRaisesr InvalidAuthType makeCheckerfindCheckerFactoryselfiatrrrtest_emptyDescription+z$PublicAPITests.test_emptyDescriptioncCr$)z@ An unrecognized auth type raises an exception. Nr%r*rrrtest_invalidAuthType3r.z#PublicAPITests.test_invalidAuthTypeN)__name__ __module__ __qualname__r-r/rrrrr#* r#c@r")StrcredFunctionsTestscCs.tt}ttjD]}|||q dS)zP L{strcred.findCheckerFactories} returns all available plugins. N)listr rr getPluginsICheckerFactoryassertIn)r+availablePluginsplgrrrtest_findCheckerFactories=s z/StrcredFunctionsTests.test_findCheckerFactoriescCs|tdtjdS)z{ L{strcred.findCheckerFactory} returns the first plugin available for a given authentication type. fileN)assertIdenticalr r)r theFileCheckerFactoryr+rrrtest_findCheckerFactoryEs z-StrcredFunctionsTests.test_findCheckerFactoryN)r0r1r2r;r@rrrrr4<r3r4c@s<eZdZddZddZddZddZd d Zd d Zd S)MemoryCheckerTestscCsHtdd|_tdd|_tdd|_tdd|_td|_dS) Nadminasdfalicefoofoobarxyzzmemory:admin:asdf:alice:foo) r UsernamePasswordrBrDbadPassbadUserr r(checkerr?rrrsetUpPs zMemoryCheckerTests.setUpcC*|tj|j|tj|jjdSz Verifies that strcred.makeChecker('memory') returns an object that implements the L{ICredentialsChecker} interface. N assertTruerICredentialsChecker providedByrLr8r IUsernamePasswordcredentialInterfacesr?rrrtest_isCheckerWz!MemoryCheckerTests.test_isCheckercCs|tjtjddS)z An argument string which does not contain user:pass pairs (i.e., an odd number of ':' characters) raises an exception. z memory:a:b:cN)r&r InvalidAuthArgumentStringr(r?rrrtest_badFormatArgString_s z*MemoryCheckerTests.test_badFormatArgStringc fdd}jj|S); The checker works with valid credentials. c|jjdSN assertEqualrBusernamer`r?rr _gotAvatarmzAMemoryCheckerTests.test_memoryCheckerSucceeds.._gotAvatarrLrequestAvatarIdrB addCallbackr+rbrr?rtest_memoryCheckerSucceedsh z-MemoryCheckerTests.test_memoryCheckerSucceedscC||j|jtjSz= The checker fails with an invalid username.  assertFailurerLrerKr UnauthorizedLoginr?rrrtest_memoryCheckerFailsUsernamerz2MemoryCheckerTests.test_memoryCheckerFailsUsernamecCrjz= The checker fails with an invalid password. rmrLrerJr rnr?rrrtest_memoryCheckerFailsPasswordzrpz2MemoryCheckerTests.test_memoryCheckerFailsPasswordN) r0r1r2rMrVrYrhrorsrrrrrAOs  rAc@r")AnonymousCheckerTestscC0td}|tj||tj|j dS)z Verifies that strcred.makeChecker('anonymous') returns an object that implements the L{ICredentialsChecker} interface. anonymousN) r r(rQrrRrSr8r IAnonymousrU)r+rLrrrrV z$AnonymousCheckerTests.test_isCheckercs.td}|t}fdd}||S)z? We can log in anonymously using this checker. rvcstj|dSr])r=r ANONYMOUS)avatarr?rrrbszEAnonymousCheckerTests.testAnonymousAccessSucceeds.._gotAvatar)r r(rer Anonymousrf)r+rLrequestrbrr?rtestAnonymousAccessSucceedss   z1AnonymousCheckerTests.testAnonymousAccessSucceedsN)r0r1r2rVr}rrrrrts rtz"Required module not available: pwdz$Required module not available: cryptz#Required module not available: spwdc@s^eZdZdddZddZddZdd Zd d Zd d ZddZ ddZ ddZ ddZ dS)UnixCheckerTestsrCrE)rBrDc Cs*t|t|j|ddddddddf S)NF/ri)r struct_spwdrusers)r+r`rrr_spwd_getspnamszUnixCheckerTests._spwd_getspnamc Cstdd|_tdd|_tdd|_tdd|_td|_td d |_ td d |_ td d |_ tdd|_ td|_ trlt}|jD]\}}||t|ddd|d|dqN|td|jtrx|td|jdSdS)NrBrCrDrErFrGrHunixadminasdfalicefoofoobarxyzriz/home/z/bin/shgetpwnamgetspnam)r rIrBrDrJrKr r(rL adminBytes aliceBytes badPassBytes badUserBytes checkerBytesrrritemsaddUserrpatchrrr)r+databaser`passwordrrrrMs4    zUnixCheckerTests.setUpcCsP|tj|j|tj|jj|tj|j |tj|j jdS)z Verifies that strcred.makeChecker('unix') returns an object that implements the L{ICredentialsChecker} interface. N) rQrrRrSrLr8r rTrUrr?rrrrVs  zUnixCheckerTests.test_isCheckercrZ)r[cr\r]r^rar?rrrbrcz=UnixCheckerTests.test_unixCheckerSucceeds.._gotAvatarrdrgrr?rtest_unixCheckerSucceedsriz)UnixCheckerTests.test_unixCheckerSucceedscrZ)zD The checker works with valid L{bytes} credentials. cs|jjddS)Nutf-8)r_rr`decoderar?rrrbszBUnixCheckerTests.test_unixCheckerSucceedsBytes.._gotAvatar)rrerrfrgrr?rtest_unixCheckerSucceedsBytess z.UnixCheckerTests.test_unixCheckerSucceedsBytescCrjrkrlr?rrrtest_unixCheckerFailsUsernamerpz.UnixCheckerTests.test_unixCheckerFailsUsernamecCrj)zF The checker fails with an invalid L{bytes} username. )rmrrerr rnr?rrr"test_unixCheckerFailsUsernameBytes z3UnixCheckerTests.test_unixCheckerFailsUsernameBytescCrjrqrrr?rrrtest_unixCheckerFailsPasswordrpz.UnixCheckerTests.test_unixCheckerFailsPasswordcCrj)zF The checker fails with an invalid L{bytes} password. )rmrrerr rnr?rrr"test_unixCheckerFailsPasswordBytes rz3UnixCheckerTests.test_unixCheckerFailsPasswordBytesN) r0r1r2rrrMrVrrrrrrrrrrr~s    r~z%Required module is unavailable: cryptc@s eZdZdZddZddZdS) CryptTestsz9 L{crypt} has functions for encrypting password. c Cs*d}dD]2}zt||}t|tr|d}Wn ty!Yqwd}|t|||t||qdD]Y}t t|d}|sDq9d}t||}t|trV|d}|d}t||} || t| d| d} || t||} || t| d| d} || q9dS) z4 L{cred_unix.verifyCryptedPassword} sample password ^%$)Nabrz$1x1234) METHOD_SHA512 METHOD_SHA256 METHOD_MD5 METHOD_CRYPTNzinteresting password xyzblahfooincorrect) r isinstancebytesr TypeErrorrQrverifyCryptedPassword assertFalsegetattrencode) r+rsaltcryptedCorrectcryptedIncorrectmethod cryptMethodcryptedincorrectCryptedresultrrrtest_verifyCryptedPasswordsJ               z%CryptTests.test_verifyCryptedPasswordcCs<dd}d}t|d}|td||t||dS)zK L{cred_unix.verifyCryptedPassword} when OSError is raised cSstd)N)OSError)rrrrr mockCryptQsz?CryptTests.test_verifyCryptedPasswordOSError..mockCryptrrrN)rrrrr)r+rrrrrr!test_verifyCryptedPasswordOSErrorLs  z,CryptTests.test_verifyCryptedPasswordOSErrorN)r0r1r2__doc__rrrrrrrs 0rc@sPeZdZdZddZddZddZdd Zd d Zd d Z ddZ ddZ dS)FileDBCheckerTestsz* C{--auth=file:...} file checker. cCshtdd|_tdd|_tdd|_tdd|_||_t|j dt d |j|_ dS) Nrrrrrrradmin:asdf alice:foo file:) r rIrBrDrJrKmktempfilenamer setContentr r(rLr?rrrrM_s zFileDBCheckerTests.setUpcCs(d}tj|r|d7}tj|s|S)Nz /DoesNotExistr)ospathexists)r+rrrr _fakeFilenamehs   z FileDBCheckerTests._fakeFilenamecCrNrOrPr?rrrrVnrWz!FileDBCheckerTests.test_isCheckercrZ)r[cr\r]r^rar?rrrb{rcz?FileDBCheckerTests.test_fileCheckerSucceeds.._gotAvatarrdrgrr?rtest_fileCheckerSucceedsvriz+FileDBCheckerTests.test_fileCheckerSucceedscCrjrkrlr?rrrtest_fileCheckerFailsUsernamerpz0FileDBCheckerTests.test_fileCheckerFailsUsernamecCrjrqrrr?rrrtest_fileCheckerFailsPasswordrpz0FileDBCheckerTests.test_fileCheckerFailsPasswordcCs$|ttjd|ttjddS)z4 An empty filename raises an error. r<rN)r& ValueErrorr r(r?rrrtest_failsWithEmptyFilenamesz.FileDBCheckerTests.test_failsWithEmptyFilenamecCsFtjj}t}|tj_td||tj_|tj| dS)zt When the file auth plugin is given a file that doesn't exist, it should produce a warning. rN) r r> errorOutputrr r(rr8invalidFileWarninggetvalue)r+ oldOutput newOutputrrrtest_warnWithBadFilenames z+FileDBCheckerTests.test_warnWithBadFilenameN) r0r1r2rrMrrVrrrrrrrrrrZs   r cryptographyzcryptography is not availablepyasn1zpyasn1 is not availablec@seZdZdZddZdS)SSHCheckerTestsz Tests for the C{--auth=sshkey:...} checker. The majority of the tests for the ssh public key database checker are in L{twisted.conch.test.test_checkers.SSHPublicKeyCheckerTestCase}. cCru)z Verifies that strcred.makeChecker('sshkey') returns an object that implements the L{ICredentialsChecker} interface. sshkeyN) r r(rQrrRrSr8r ISSHPrivateKeyrU)r+ sshCheckerrrrrVrxzSSHCheckerTests.test_isCheckerN)r0r1r2rrVrrrrrs rc@seZdZdZdS) DummyOptionsz@ Simple options for testing L{strcred.AuthOptionMixin}. N)r0r1r2rrrrrrrc@sLeZdZddZddZddZddZd d Zd d Zd dZ ddZ dS)CheckerOptionsTestscCsTt}|ddg|t|ddt}|gd|t|dddS)zu The C{--auth} command line creates a list in the Options instance and appends values to it. --authmemory credCheckers)rrrrN)r parseOptionsr_lenr+optionsrrrtest_createsLists z$CheckerOptionsTests.test_createsListcCs<t}t}|tj|jd|g|tj|jd|gdS)zx The C{--auth} command line raises an exception when it gets a parameter it doesn't understand. r--help-auth-typeN)rr!r&r UsageErrorr)r+rinvalidParameterrrrtest_invalidAuthErrorsz)CheckerOptionsTests.test_invalidAuthErrorcCst}|gd|d}|t|tjd|t|tjd|tjd}|tjd}|tj ||tj || tj|j | tj|j dS)z The C{--auth} command line creates a dictionary mapping supported interfaces to the list of credentials checkers that support it. )rrrrvcredInterfacesrrN) rrr_rr rwrTrQrrRrSr8rU)r+rchd chdAnonymous chdUserPassrrrtest_createsDictionarysz*CheckerOptionsTests.test_createsDictionarycCs2t}|gd||d|dtjdS)z When two C{--auth} arguments are passed along which support the same interface, a list with both is created. )rrrrrrN)rrr_r rTrrrr test_credInterfacesProvidesListss  z4CheckerOptionsTests.test_credInterfacesProvidesListscCs6g}t}|D]}||j|||jq dS)zG The list for C{--help-auth} does not duplicate items. N)r_checkerFactoriesForOptHelpAuth assertNotInrappend)r+ authTypesrcfrrr!test_listDoesNotDisplayDuplicatess  z5CheckerOptionsTests.test_listDoesNotDisplayDuplicatescCsHt}t}||_|t|jdgtD] }||j | qdS)zz The C{--help-auth} argument correctly displays all available authentication plugins, then exits. z --help-authN) rr authOutputr& SystemExitrr rr8rr)r+ newStdoutrcheckerFactoryrrrtest_displaysListCorrectlys z.CheckerOptionsTests.test_displaysListCorrectlycCsTt}t}||_|t|jddgtjjD]}| r'| | | qdS)z The C{--help-auth-for} argument will correctly display the help file for a particular authentication plugin. rr<N) rrrr&rrr r>authHelpstripr8r)r+rrlinerrrtest_displaysHelpCorrectlys  z.CheckerOptionsTests.test_displaysHelpCorrectlycCs0t}|tj|jddg}|t|ddS)z When the checker specified by C{--auth} raises an unexpected error, it should be caught and re-raised within a L{usage.UsageError}. rr<z,Unexpected error: 'file' requires a filenameN)rr&rrrr_str)r+rerrrrrtest_unexpectedExceptions z,CheckerOptionsTests.test_unexpectedExceptionN) r0r1r2rrrrrrrrrrrrrs    rc@eZdZejfZdS)OptionsForUsernamePasswordN)r0r1r2r rTsupportedInterfacesrrrrr* rc@r) OptionsForUsernameHashedPasswordN)r0r1r2r IUsernameHashedPasswordrrrrrr.rrc@seZdZdZdS)OptionsSupportsAllInterfacesN)r0r1r2rrrrrr 2rr c@s"eZdZUgZeeeed<dS)OptionsSupportsNoInterfacesrN)r0r1r2rrrr__annotations__rrrrr 6s r c@s`eZdZdZddZddZddZdd Zd d Zd d Z ddZ ddZ ddZ ddZ dS)LimitingInterfacesTestsa Tests functionality that allows an application to limit the credential interfaces it can support. For the purposes of this test, we use IUsernameHashedPassword, although this will never really be used by the command line. (I have, to date, not thought of a half-decent way for a user to specify a hash algorithm via the command-line. Nor do I think it's very useful.) I should note that, at first, this test is counter-intuitive, because we're using the checker with a pre-defined hash function as the 'bad' checker. See the documentation for L{twisted.cred.checkers.FilePasswordDB.hash} for more details. cCsp||_t|jd }|dWdn1swYt|j|_tj|j|jd|_t |_ dS)Nwbr)hash) rropenwriterFilePasswordDB goodChecker_hash badCheckerAllowAnonymousAccess anonChecker)r+frrrrMKs  zLimitingInterfacesTests.setUpcCs|S)z> A dumb hash that doesn't really do anything. r)r+networkUsernamenetworkPasswordstoredPasswordrrrrSszLimitingInterfacesTests._hashcCsBt}||tj||tj|tj |j |j dS)zE The supportsInterface method behaves appropriately. N) rrQsupportsInterfacer rTrrwr&r UnsupportedInterfaces addCheckerrrrrrtest_supportsInterfaceYs  z.LimitingInterfacesTests.test_supportsInterfacecCs.t}||tj||tjdS)z| The supportsInterface method behaves appropriately when the supportedInterfaces attribute is None. N)r rQrr rTrwrrrrtest_supportsAllInterfacesdsz2LimitingInterfacesTests.test_supportsAllInterfacescCs6t}tj}tj}||||||dS)zJ The supportsCheckerFactory method behaves appropriately. N)rr r>r theAnonymousCheckerFactoryrQsupportsCheckerFactoryr)r+rfileCFanonCFrrrtest_supportsCheckerFactoryms z3LimitingInterfacesTests.test_supportsCheckerFactorycCs|t}||j|jd}||d|d|j||dd|j|t|d|d|t|dddS)z When addChecker is called with a checker that implements at least one of the interfaces our application supports, it is successful. rrrrN)rrrrr=r_r)r+rifacerrrtest_canAddSupportedCheckerws  z3LimitingInterfacesTests.test_canAddSupportedCheckercCst}|tj|j|jdS)z~ When addChecker is called with a checker that does not implement any supported interfaces, it fails. N)rr&r rrrrrrr#test_failOnAddingUnsupportedCheckers z;LimitingInterfacesTests.test_failOnAddingUnsupportedCheckercCs(t}tjj}|tj|jd|gdS)zq The C{--auth} command line raises an exception when it gets a checker we don't support. rN)r r r rr&rrr)r+rrrrrtest_unsupportedInterfaceErrorsz6LimitingInterfacesTests.test_unsupportedInterfaceErrorcCsBt}|D]}d}|jD] }||rd}q|rtqdS)z C{--help-auth} will only list checkers that purport to supply at least one of the credential interfaces our application can use. TFN)rrrUrr r)r+rrinvalid interfacerrrtest_helpAuthLimitsOutputs   z1LimitingInterfacesTests.test_helpAuthLimitsOutputcCslt}d}tD] }||s|}nq ||dt}||_|t|j ddg| tj | dS)z C{--help-auth-type} will display a warning if you get help for an authType that does not supply at least one of the credential interfaces our application can use. Nrrv) rr rr!assertNotIdenticalrrr&rrr8notSupportedWarningr)r+rinvalidFactoryrrrrrtest_helpAuthTypeLimitsOutputs    z5LimitingInterfacesTests.test_helpAuthTypeLimitsOutputN)r0r1r2rrMrrrr$r&r'r(r+r/rrrrr :s     r )5rriortypingrrunittestrzope.interfacertwistedr twisted.credrr r r twisted.pluginsr r rtwisted.pythonrtwisted.python.fakepwdrtwisted.python.filepathrtwisted.python.reflectrtwisted.trial.unittestrrrrr!r#r4rArtr~rrrOptionsAuthOptionMixinrrrrr r r rrrrsN          4    yCJm