3 ,sY4b,@sPddlZddlZddlZddlZddlmZddlmZddlm Z e dZ ddl m Z e r~ddl mZddlmZmZmZndd lmZGd d d Zdd lmZdd lmZmZmZddlmZddlmZddlmZddl m!Z!m"Z"m#Z#ddl$m%Z%ddl&m'Z'yddl(mZ)Wn2e*k rJZ+zdZ)e,e+Z-[+WYddZ+[+XnXddl.m/Z/ddl0m1Z1ddl2m3Z3m4Z4ddl2m5Z5m6Z6yddl.m7Z7m8Z8Wne*k rYnXy ddl Z Wne*k rdZ YnXy ddl9Z9Wne*k rdZ9YnXddZ:e:Z;Gddde<Z=Gddde'j>Z?Gd d!d!ej@ZAGd"d#d#ejBZCGd$d%d%ejDZEGd&d'd'ejDZFGd(d)d)ej@ZGdAd+d,ZHGd-d.d.ZIGd/d0d0eIZJeeGd1d2d2eZKGd3d4d4ZLGd5d6d6eIZMGd7d8d8ZNGd9d:d:eIeNe'j>ZOGd;d<dZPGd=d>d>eMeNe'j>ZQGd?d@d@eJe'j>ZRdS)BN)count) implementer) requireModule cryptography) ConchError) ConchUser)ISession SSHSession wrapProtocol)rc@s eZdZdS)rN)__name__ __module__ __qualname__rr?/usr/lib/python3/dist-packages/twisted/conch/test/test_conch.pyrsr)portal)reactordeferprotocol)ProcessExitedAlready) LoopingCall)getProcessValue)filepathlogruntime)unicode)unittest)r )ConchTestRealm)which)publicRSA_opensshprivateRSA_openssh)publicDSA_opensshprivateDSA_openssh)ConchTestServerFactoryconchTestPublicKeyCheckerc CsNd}d}ytjtj}|jdd}Wntjk r<YnX|rJ|j|S)z5 Returns True if the system can bind an IPv6 address.NF::1rT)r$r)socketZAF_INET6binderrorclose)ZsockZhas_ipv6rrr _has_ipv6<s  r)c@seZdZdZdZddZdS) FakeStdioz A fake for testing L{twisted.conch.scripts.conch.SSHSession.eofReceived} and L{twisted.conch.scripts.cftp.SSHSession.eofReceived}. @ivar writeConnLost: A flag which records whether L{loserWriteConnection} has been called. FcCs d|_dS)z9 Record the call to loseWriteConnection. TN) writeConnLost)selfrrrloseWriteConnectionZszFakeStdio.loseWriteConnectionN)r r r __doc__r+r-rrrrr*Psr*c@s$eZdZdZedkreZddZdS)StdioInteractingSessionTestsz> Tests for L{twisted.conch.scripts.conch.SSHSession}. NcCs*t}t}||_|j|j|jdS)z} L{twisted.conch.scripts.conch.SSHSession.eofReceived} loses the write half of its stdio connection. N)r*StdioInteractingSessionstdioZ eofReceivedZ assertTruer+)r,r1Zchannelrrrtest_eofReceivedjs z-StdioInteractingSessionTests.test_eofReceived)r r r r.r0_reasonskipr2rrrrr/bsr/c@s$eZdZddZddZddZdS)EchocCstjddS)NzECHO CONNECTION MADE)rmsg)r,rrrconnectionMadexszEcho.connectionMadecCstjddS)NzECHO CONNECTION DONE)rr6)r,reasonrrrconnectionLost|szEcho.connectionLostcCs"|jj|d|kr|jjdS)N ) transportwriteloseConnection)r,datarrr dataReceiveds zEcho.dataReceivedN)r r r r7r9r?rrrrr5wsr5c@seZdZeZdS) EchoFactoryN)r r r r5rrrrrr@sr@c@s0eZdZdZdZdZddZddZdd ZdS) ConchTestOpenSSHProcessa Test protocol for launching an OpenSSH client process. @ivar deferred: Set by whatever uses this object. Accessed using L{_getDeferred}, which destroys the value so the Deferred is not fired twice. Fires when the process is terminated. NcCs|jd}|_|S)N)deferred)r,drrr _getDeferredsz$ConchTestOpenSSHProcess._getDeferredcCs|j|7_dS)N)buf)r,r>rrr outReceivedsz#ConchTestOpenSSHProcess.outReceivedcCsJ|jjdkr*|jjtdj|jjn|jjdd}|jj|dS)z~ Called when the process has ended. @param reason: a Failure giving the reason for the process' end. rzexit code was not 0: {}s r:N) valueZexitCoderEZerrbackrformatrFreplacecallback)r,r8rFrrr processEndeds  z$ConchTestOpenSSHProcess.processEnded) r r r r.rCrFrErGrLrrrrrAs rAc@sTeZdZdZdZddZddZddZd d Zd d Z d dZ ddZ ddZ dS)ConchTestForwardingProcessa Manages a third-party process which launches a server. Uses L{ConchTestForwardingPort} to connect to the third-party server. Once L{ConchTestForwardingPort} has disconnected, kill the process and fire a Deferred with the data received by the L{ConchTestForwardingPort}. @ivar deferred: Set by whatever uses this object. Accessed using L{_getDeferred}, which destroys the value so the Deferred is not fired twice. Fires when the process is terminated. NcCs||_d|_||_dS)aF @type port: L{int} @param port: The port on which the third-party server is listening. (it is assumed that the server is running on localhost). @type data: L{str} @param data: This is sent to the third-party server. Must end with ' ' in order to trigger a disconnect. N)portbufferr>)r,rNr>rrr__init__s z#ConchTestForwardingProcess.__init__cCs|jd}|_|S)N)rC)r,rDrrrrEsz'ConchTestForwardingProcess._getDeferredcCs |jdS)N)_connect)r,rrrr7sz)ConchTestForwardingProcess.connectionMadecCs0tjtt||j}|jd|j}|j|j|S)a Connect to the server, which is often a third-party process. Tries to reconnect if it fails because we have no way of determining exactly when the port becomes available for listening -- we can only know when the process starts. z 127.0.0.1) rZ ClientCreatorrConchTestForwardingPortr>Z connectTCPrNZ addErrback _ebConnect)r,ZccrDrrrrQs   z#ConchTestForwardingProcess._connectcCstjd|jdS)Ng?)r callLaterrQ)r,frrrrSsz%ConchTestForwardingProcess._ebConnectcCs.||_|jjd|jjtjd|jdS)z The network connection has died; save the buffer of output from the network and attempt to quit the process gracefully, and then (after the reactor has spun) send it a KILL signal. rN)rOr;r<r=rrT _reallyDie)r,rOrrrforwardingPortDisconnecteds  z5ConchTestForwardingProcess.forwardingPortDisconnectedc Cs*y|jjdWntk r$YnXdS)NZKILL)r;Z signalProcessr)r,rrrrWsz%ConchTestForwardingProcess._reallyDiecCs|jj|jdS)z Fire the Deferred at self.deferred with the data collected from the L{ConchTestForwardingPort} connection, if any. N)rErKrO)r,r8rrrrLsz'ConchTestForwardingProcess.processEnded) r r r r.rCrPrEr7rQrSrXrWrLrrrrrMs  rMc@s0eZdZdZddZddZddZdd Zd S) rRz Connects to server launched by a third-party process (managed by L{ConchTestForwardingProcess}) sends data, then reports whatever it received back to the L{ConchTestForwardingProcess} once the connection is ended. cCs||_||_dS)z @type protocol: L{ConchTestForwardingProcess} @param protocol: The L{ProcessProtocol} which made this connection. @type data: str @param data: The data to be sent to the third-party server. N)rr>)r,rr>rrrrPsz ConchTestForwardingPort.__init__cCsd|_|jj|jdS)NrB)rOr;r<r>)r,rrrr7sz&ConchTestForwardingPort.connectionMadecCs|j|7_dS)N)rO)r,r>rrrr?sz$ConchTestForwardingPort.dataReceivedcCs|jj|jdS)N)rrXrO)r,r8rrrr9#sz&ConchTestForwardingPort.connectionLostN)r r r r.rPr7r?r9rrrrrRs  rRconchcCsJtjd|g}g}x2|t|D]"}t|tr8|jd}|j|q W|S)Na$-c ### Twisted Preamble import sys, os path = os.path.abspath(sys.argv[0]) while os.path.dirname(path) != path: if os.path.basename(path).startswith('Twisted'): sys.path.insert(0, path) break path = os.path.dirname(path) from twisted.conch.scripts.%s import run run()zutf-8)sys executablelist isinstancerencodeappend)argsmodstartZmadeArgsargrrr _makeArgs(s   rdc@sPeZdZesdZesdZeddZddZddZ d d Z d d Z d dZ dS)ConchServerSetupMixinzcan't run without cryptographyzCannot run without PyASN1cCstdS)Nstestuser)rrrrrFszConchServerSetupMixin.c&Csx"d D]}tjj|rtj|qWtdd}|jtWdQRXtdd}|jtWdQRXtdd}|jtWdQRXtdd}|jt WdQRXtj ddtj ddtdd}|jdtWdQRXdS) Nrsa_test rsa_test.pubdsa_test dsa_test.pubkh_testwbis 127.0.0.1 )rgrhrirjrk) ospathexistsremoveopenr<rrr r!chmod)r,rUrrr _createFilesHs         z"ConchServerSetupMixin._createFilescCs*tj}|jd|jd}|j|S)Nr)rtr)r%r&Z getsocknamer()r,srNrrr _getFreePort[s   z"ConchServerSetupMixin._getFreePortcCs.|j}tj|}|jtt}||_|S)z Make a L{ConchTestServerFactory}, which allows us to start a L{ConchTestServer} -- i.e. an actually listening conch. ) realmFactoryrZPortalZregisterCheckerr#r")r,Zrealmpfactoryrrr_makeConchFactorycs   z'ConchServerSetupMixin._makeConchFactorycCsv|j|j|_d|j_tjd|jdd|_tjdt|_|jj j |_ t rrtjdtdd|_ |j j j |_dS)Nrurz 127.0.0.1)Z interfacez::1)rsr{ conchFactoryZexpectedLoseConnectionrZ listenTCP conchServerr@ echoServergetHostrNechoPortHAS_IPV6 echoServerV6 echoPortV6)r,rrrsetUpps   zConchServerSetupMixin.setUpc Cspyd|jj_Wntk r"YnX|jjjjtj|jj tj|j j g}t rf|j tj|j j tj|S)Nru)r|protodoneAttributeErrorr;r=rZ maybeDeferredr}Z stopListeningr~rr_rZ gatherResults)r,Z deferredsrrrtearDown}s zConchServerSetupMixin.tearDownN) r r r rr4pyasn1 staticmethodrxrsrwr{rrrrrrre?s   rec@s(eZdZdZddZddZddZdS) ForwardingMixina Template class for tests of the Conch server's ability to forward arbitrary protocols over SSH. These tests are integration tests, not unit tests. They launch a Conch server, a custom TCP server (just an L{EchoProtocol}) and then call L{execute}. L{execute} is implemented by subclasses of L{ForwardingMixin}. It should cause an SSH client to connect to the Conch server, asking it to forward data to the custom TCP server. cCs|jdt}|j|jdS)z Test that we can use whatever client to send the command "echo goodbye" to the Conch server. Make sure we receive "goodbye" back from the server. z echo goodbyesgoodbye )executerA addCallback assertEqual)r,rDrrr test_execszForwardingMixin.test_execcCs>|j}t|d}|jd|d||jfd}|j|jd|S)zy Test that we can use whatever client to forward a local port to a specified port on the server. stest rtz-N -L%i:127.0.0.1:%i)sshArgs)rwrMrrrr)r, localPortprocessrDrrrtest_localToRemoteForwardings z,ForwardingMixin.test_localToRemoteForwardingcCs>|j}t|d}|jd|d||jfd}|j|jd|S)zs Test that we can use whatever client to forward a port from the server to a port locally. stest rtz-N -R %i:127.0.0.1:%i)r)rwrMrrrr)r,rrrDrrrtest_remoteToLocalForwardings z,ForwardingMixin.test_remoteToLocalForwardingN)r r r r.rrrrrrrrs  rc@s(eZdZdZddZddZddZdS) RekeyAvatara# This avatar implements a shell which sends 60 numbered lines to whatever connects to it, then closes the session with a 0 exit status. 60 lines is selected as being enough to send more than 2kB of traffic, the amount the client is configured to initiate a rekey after. cCstj|t|jd<dS)Nssession)rrPr Z channelLookup)r,rrrrPs zRekeyAvatar.__init__csHtj}|jjt|fdd}t|tjddS)zE Write 60 lines of data to the transport, then exit. csXt|}|dkr6jjjjjddjnd|f}|jd}j|dS)N<s exit-statussz line #%02d zutf-8)nextstopZsessionZconnZ sendRequestr=r^r<)Zcounteriline)callr;rrr<s    z$RekeyAvatar.openShell..writeg{Gz?N)rProtocolZmakeConnectionr rrrb)r,r;rr<r)rr;r openShells   zRekeyAvatar.openShellcCsdS)z2 Ignore the close of the session. Nr)r,rrrclosedszRekeyAvatar.closedN)r r r r.rPrrrrrrrs!rc@seZdZdZddZdS) RekeyRealmzS This realm gives out new L{RekeyAvatar} instances for any avatar request. cGs|dtddfS)NrcSsdS)Nrrrrrrfsz*RekeyRealm.requestAvatar..)r)r,ZavatarIDZmindZ interfacesrrr requestAvatarszRekeyRealm.requestAvatarN)r r r r.rrrrrrsrc@seZdZdZeZddZdS)RekeyTestsMixinzp TestCase mixin which defines tests exercising L{SSHTransportBase}'s handling of rekeying messages. cs.t}jd|d}fdd}|j||S)z After a client-initiated rekey is completed, application data continues to be passed over the SSH connection. rtz-o RekeyLimit=2Kcs6djddtdDd}|jd}j||dS)N cSsg|]}d|fqS)z line #%02dr).0rrrr szFRekeyTestsMixin.test_clientRekey..finished..rzutf-8)joinranger^r)resultZexpectedResult)r,rrfinisheds z2RekeyTestsMixin.test_clientRekey..finished)rArr)r,rrDrr)r,rtest_clientRekey s   z RekeyTestsMixin.test_clientRekeyN)r r r r.rrxrrrrrrsrc@s"eZdZedsdZdddZdS)OpenSSHClientMixinsshz$no ssh command-line client availablertcs.ttddd}fdd}|j|S) a Connects to the SSH server started in L{ConchServerSetupMixin.setUp} by running the 'ssh' command line tool. @type remoteCommand: str @param remoteCommand: The command (with arguments) to run on the remote end. @type process: L{ConchTestOpenSSHProcess} @type sshArgs: str @param sshArgs: Arguments to pass to the 'ssh' process. @return: L{defer.Deferred} rr-oPubkeyAcceptedKeyTypes=ssh-dss-Vcs|dkrd}nd}tj_d|d}jjj}||j}g}x*|D]"}t|trj|j d}|j |qRWt j t dd|jS)Nrz!-oPubkeyAcceptedKeyTypes=ssh-dss rtzssh -2 -l testuser -p %i -F /dev/null -oUserKnownHostsFile=kh_test -oPasswordAuthentication=no -oHostKeyAlgorithms=ssh-rsa -a -i dsa_test z 127.0.0.1 zutf-8r)rDeferredrCr}rrNsplitr]rr^r_r spawnProcessr)ZstatusZoptsZcmdlinerNcmds encodedCmdscmd)r remoteCommandr,rrrhasPAKT8s      z+OpenSSHClientMixin.execute..hasPAKT)rrr)rrr)r,rrrrDrr)rrr,rrr"szOpenSSHClientMixin.executeN)rt)r r r rr4rrrrrrsrc@sPeZdZdZddZddZddZdd Zd d Zd d Z ddZ ddZ dS)OpenSSHKeyExchangeTestsz\ Tests L{SSHTransportBase}'s key exchange algorithm compatibility with OpenSSH. c Csg}y>tjtddddgtjd}t|ts8|jd}|j}Wn YnX||krhtj dj ||j dt d |}|j |jd S) aI Call execute() method of L{OpenSSHClientMixin} with an ssh option that forces the exclusive use of the key exchange algorithm specified by keyExchangeAlgo @type keyExchangeAlgo: L{str} @param keyExchangeAlgo: The key exchange algorithm to use @return: L{defer.Deferred} rrz-QZkex)stderrzutf-8z{} not supported by ssh clientz echo helloz-oKexAlgorithms=shello ) subprocessZ check_outputrZSTDOUTr]strdecoderrSkipTestrIrrArr)r,ZkeyExchangeAlgoZ kexAlgorithmsoutputrDrrrassertExecuteWithKexAlgorithm_s       z5OpenSSHKeyExchangeTests.assertExecuteWithKexAlgorithmcCs |jdS)zb The ecdh-sha2-nistp256 key exchange algorithm is compatible with OpenSSH zecdh-sha2-nistp256)r)r,rrrtest_ECDHSHA256~sz'OpenSSHKeyExchangeTests.test_ECDHSHA256cCs |jdS)zb The ecdh-sha2-nistp384 key exchange algorithm is compatible with OpenSSH zecdh-sha2-nistp384)r)r,rrrtest_ECDHSHA384sz'OpenSSHKeyExchangeTests.test_ECDHSHA384cCs |jdS)zb The ecdh-sha2-nistp521 key exchange algorithm is compatible with OpenSSH zecdh-sha2-nistp521)r)r,rrrtest_ECDHSHA521sz'OpenSSHKeyExchangeTests.test_ECDHSHA521cCs |jdS)zl The diffie-hellman-group14-sha1 key exchange algorithm is compatible with OpenSSH. zdiffie-hellman-group14-sha1)r)r,rrrtest_DH_GROUP14sz'OpenSSHKeyExchangeTests.test_DH_GROUP14cCs |jdS)zs The diffie-hellman-group-exchange-sha1 key exchange algorithm is compatible with OpenSSH. z"diffie-hellman-group-exchange-sha1)r)r,rrrtest_DH_GROUP_EXCHANGE_SHA1sz3OpenSSHKeyExchangeTests.test_DH_GROUP_EXCHANGE_SHA1cCs |jdS)zu The diffie-hellman-group-exchange-sha256 key exchange algorithm is compatible with OpenSSH. z$diffie-hellman-group-exchange-sha256)r)r,rrrtest_DH_GROUP_EXCHANGE_SHA256sz5OpenSSHKeyExchangeTests.test_DH_GROUP_EXCHANGE_SHA256cCs|jtj|jddS)zy The list of key exchange algorithms supported by OpenSSH client is obtained with C{ssh -Q kex}. zunsupported-algorithmN)Z assertRaisesrrr)r,rrrtest_unsupported_algorithmsz2OpenSSHKeyExchangeTests.test_unsupported_algorithmN) r r r r.rrrrrrrrrrrrrXs      rc@s"eZdZdZddZesde_dS)OpenSSHClientForwardingTestszR Connection forwarding tests run against the OpenSSL command line client. cCs>|j}t|d}|jd|d||jfd}|j|jd|S)zG Forwarding of arbitrary IPv6 TCP connections via SSH. stest rtz-N -L%i:[::1]:%i)r)rwrMrrrr)r,rrrDrrrtest_localToRemoteForwardingV6s z;OpenSSHClientForwardingTests.test_localToRemoteForwardingV6zRequires IPv6 supportN)r r r r.rrr4rrrrrs rc@seZdZdZdS)OpenSSHClientRekeyTestszE Rekeying tests run against the OpenSSL command line client. N)r r r r.rrrrrsrc@s8eZdZdZejdkrdZd ddZdd Zd d Z dS) CmdLineClientTestszP Connection forwarding tests run against the Conch command line client. Zwin32z!can't run cmdline client on win32rtNc Cs|dkr g}tj|_|jjj}dj||d|}t||j}t j j }t j j tj|d<g} i} x*|D]"}t|tr|jd}| j|qrWxD|D]<} || } t| tr| jd} t| tr| jd} | | | <qWtj|tj| | d|jS)z{ As for L{OpenSSHClientTestCase.execute}, except it runs the 'conch' command line tool, not 'ssh'. Nz[-p {} -l testuser --known-hosts kh_test --user-authentications publickey -a -i dsa_test -v z 127.0.0.1 PYTHONPATHzutf-8)env)rrrCr}rrNrIrdrrmenvironcopypathseprrZrnr]rr^r_rrr[) r,rrr conchArgsrNrrrrZ encodedEnvvarvalrrrrs.            zCmdLineClientTests.executecsVfdd}tjjjdtddjddgd}|jjd |j||S) z4 It can store logs to a local file. csj}jd|dS)Ns Log opened.)Z getContentZassertIn)rZ logContent)logPathr,rr cb_check_log sz.cb_check_logz echo goodbyez--logz --logfilez--host-key-algorithmszssh-rsa)rrrsgoodbye )rZFilePathZmktemprrArnrr)r,rrDr)rr,rtest_runWithLogFile s  z&CmdLineClientTests.test_runWithLogFilecCs"|jdtd}|j|jd|S)zH Do not use --host-key-algorithms flag on command line. z echo goodbye)rrsgoodbye )rrArr)r,rDrrr%test_runWithNoHostAlgorithmsSpecifieds  z8CmdLineClientTests.test_runWithNoHostAlgorithmsSpecified)rtN) r r r r.rZ platformTyper4rrrrrrrrs   %r)rY)SrmrZr%r itertoolsrZzope.interfacerZtwisted.python.reflectrrZtwisted.conch.errorrZtwisted.conch.avatarrZtwisted.conch.ssh.sessionrr r Ztwisted.conch.interfacesZ twisted.credrZtwisted.internetrrrZtwisted.internet.errorrZtwisted.internet.taskrZtwisted.internet.utilsrZtwisted.pythonrrrZtwisted.python.compatrZ twisted.trialrZtwisted.conch.scripts.conchr0 ImportErrorerr3Ztwisted.conch.test.test_sshrZtwisted.python.procutilsrZtwisted.conch.test.keydatarrr r!r"r#rr)robjectr*ZTestCaser/rr5ZFactoryr@ZProcessProtocolrArMrRrdrerrrrrrrrrrrrrs                  %U" O95 ;f