文件操作 - test_transport.cpython-310.pyc
返回文件管理
返回主菜单
删除本文件
文件: /usr/lib/python3/dist-packages/twisted/conch/test/__pycache__/test_transport.cpython-310.pyc
编辑文件内容
o pj� � @ sv U d Z ddlZddlZddlZddlZddlZddlmZmZm Z m Z m Z ddl m Z mZ ddlmZ ddlmZ ddlmZmZmZ ddlmZ dd lmZ dd l m Z dd l m Z dd l m!Z! dd l"m#Z# ddl$m%Z% ddl&m'Z' e#d�Z(e#d�Z)e e* e+d< e(r�e)r�dZ,ddl-m.Z. ddl/m0Z0 ddl1m2Z2 ddl3m4Z4m5Z5 ddlm6Z6m7Z7m8Z8m9Z9 ddl:m;Z; e0� �<� Z=n e(s�dZ,ne)s�dZ,dZ=G d d � d �Z9G d d � d �Z7G d d!� d!�Z6d"d#� Z>d$d%� Z?G d&d'� d'e9j@�ZAG d(d)� d)�ZBG d*d+� d+�ZCG d,d-� d-ejD�ZEG d.d/� d/e7jF�ZGG d0d1� d1eG�ZHG d2d3� d3eG�ZId4d5� ZJG d6d7� d7e'�ZKG d8d9� d9�ZLG d:d;� d;�ZMG d<d=� d=�ZNG d>d?� d?�ZOG d@dA� dA�ZPG dBdC� dCePeK�ZQG dDdE� dEeP�ZRG dFdG� dGeReLeK�ZSG dHdI� dIeReMeK�ZTG dJdK� dKeReNeK�ZUe>G dLdM� dMeReOeK��ZVG dNdO� dO�ZWG dPdQ� dQeW�ZXG dRdS� dSeXeK�ZYG dTdU� dUeX�ZZG dVdW� dWeZeLeK�Z[G dXdY� dYeZeMeK�Z\G dZd[� d[eX�Z]G d\d]� d]e]eNeK�Z^e>G d^d_� d_e]eOeK��Z_G d`da� daeW�Z`G dbdc� dce`eK�ZaG ddde� dee`�ZbG dfdg� dgebeLeK�ZcG dhdi� diebeMeK�ZdG djdk� dke`�ZeG dldm� dmeeeNeK�Zfe>G dndo� doeeeOeK��ZgG dpdq� dqe'�ZhG drds� dse'�ZiG dtdu� due'�ZjdS )vz5 Tests for ssh/transport.py and the classes therein. � N)�md5�sha1�sha256�sha384�sha512)�Optional�Type)� __version__)� ConchError)�_kex�address�service)�defer)�loopback)� randbytes)� iterbytes��insecureRandom)� requireModule)� proto_helpers)�TestCase�pyasn1� cryptography�dependencySkip)�UnsupportedAlgorithm)�default_backend)� serialization)�dh�ec)�common�factory�keys� transport)�keydatazCannot run without PyASN1z can't run without cryptographyFc @ s6 e Zd ZG dd� d�ZG dd� d�ZG dd� d�ZdS )r" c @ � e Zd ZdS )ztransport.SSHTransportBaseN��__name__� __module__� __qualname__� r) r) �C/usr/lib/python3/dist-packages/twisted/conch/test/test_transport.py�SSHTransportBase5 � r+ c @ r$ )z transport.SSHServerTransportNr% r) r) r) r* �SSHServerTransport8 r, r- c @ r$ )z transport.SSHClientTransportNr% r) r) r) r* �SSHClientTransport; r, r. N)r& r' r( r+ r- r. r) r) r) r* r" 4 s r" c @ s e Zd ZG dd� d�ZdS )r c @ r$ )zfactory.SSHFactoryNr% r) r) r) r* � SSHFactory? r, r/ N)r& r' r( r/ r) r) r) r* r > s r c @ s e Zd Zedd� �ZdS )r c C � dS )N� r) )�self�argr) r) r* �NSC s z common.NSN)r& r' r( � classmethodr4 r) r) r) r* r B s r c C s t sd| _| S )Nz#x25519 not supported on this system)�X25519_SUPPORTED�skip��fr) r) r* �skipWithoutX25519H s r: c C s t �t| ||��S )z3 Return the MP version of C{(x ** y) % z}. )r �MP�pow)�x�y�zr) r) r* �_MPpowN � r@ c @ s@ e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dS )�MockTransportBasean A base class for the client and server protocols. Stores the messages it receives instead of ignoring them. @ivar errors: a list of tuples: (reasonCode, description) @ivar unimplementeds: a list of integers: sequence number @ivar debugs: a list of tuples: (alwaysDisplay, message, lang) @ivar ignoreds: a list of strings: ignored data c C s. t j�| � g | _g | _g | _g | _d| _dS )z, Set up instance variables. N)r" r+ �connectionMade�errors�unimplementeds�debugs�ignoreds�gotUnsupportedVersion�r2 r) r) r* rC ` s z MockTransportBase.connectionMadec C s || _ tj�| |�S )zZ Intercept unsupported version call. @type remoteVersion: L{str} )rH r" r+ �_unsupportedVersionReceived)r2 � remoteVersionr) r) r* rJ k s �z-MockTransportBase._unsupportedVersionReceivedc C s | j �||f� dS )zp Store any errors received. @type reasonCode: L{int} @type description: L{str} N�rD �append)r2 � reasonCode� descriptionr) r) r* � receiveErrorv � z MockTransportBase.receiveErrorc C � | j �|� dS )zX Store any unimplemented packet messages. @type seqnum: L{int} N)rE rM )r2 �seqnumr) r) r* �receiveUnimplemented � z&MockTransportBase.receiveUnimplementedc C s | j �|||f� dS )z� Store any debug messages. @type alwaysDisplay: L{bool} @type message: L{str} @type lang: L{str} N)rF rM )r2 � alwaysDisplay�message�langr) r) r* � receiveDebug� s z MockTransportBase.receiveDebugc C rR )zG Store any ignored data. @type packet: L{str} N)rG rM �r2 �packetr) r) r* � ssh_IGNORE� rU z MockTransportBase.ssh_IGNOREN) r& r' r( �__doc__rC rJ rP rT rY r\ r) r) r) r* rB U s rB c @ sh e Zd ZdZdZdZdZdZdZdZ dZ dZ dZ dZ dZdZdd � Zd d � Zd d � Zdd� Zdd� ZdS )� MockCipherzH A mocked-up version of twisted.conch.ssh.transport.SSHCiphers. � test� � F)Nr1 r1 ra r) c C s> d| _ t|�| j dkr tdt|�| jt|�| j f ��|S )z~ Called to encrypt the packet. Simply record that encryption was used and return the data unchanged. Tr �*length %i modulo blocksize %i is not 0: %i)� usedEncrypt�len� encBlockSize� RuntimeError�r2 r= r) r) r* �encrypt� � ��zMockCipher.encryptc C s> d| _ t|�| j dkr tdt|�| jt|�| j f ��|S )z~ Called to decrypt the packet. Simply record that decryption was used and return the data unchanged. Tr rb )� usedDecryptrd re rf � decBlockSizerg r) r) r* �decrypt� ri zMockCipher.decryptc C s t |f�S )zs Make a Message Authentication Code by sending the character value of the outgoing packet. ��bytes)r2 �outgoingPacketSequence�payloadr) r) r* �makeMAC� s zMockCipher.makeMACc C s t |f�|kS )zy Verify the Message Authentication Code by checking that the packet sequence number is the same. rm )r2 �incomingPacketSequencer[ �macDatar) r) r* �verify� s zMockCipher.verifyc C s ||||||f| _ dS )z" Record the keys. N)r! )r2 �ivOut�keyOut�ivIn�keyIn�macIn�macOutr) r) r* �setKeys� s zMockCipher.setKeysN)r& r' r( r] � outCipTypere � inCipTyperk � inMACType� outMACType�verifyDigestSizerc rj �outMAC�inMACr! rh rl rq rt r{ r) r) r) r* r^ � s& r^ c @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) �MockCompressionz� A mocked-up compression, based on the zlib interface. Instead of compressing, it reverses the data and adds a 0x66 byte to the end. c C s |d d d� S �N���r) �r2 rp r) r) r* �compress� � zMockCompression.compressc C s |d d� d d d� S r� r) r� r) r) r* � decompress� � zMockCompression.decompressc C r0 )N� fr) �r2 �kindr) r) r* �flush� � zMockCompression.flushN)r& r' r( r] r� r� r� r) r) r) r* r� � s r� c @ sF e Zd ZdZdZdZdZddd�Zdd� Zd d � Z d d � Z d d� Z dS )� MockServicez� A mocked-up service, based on twisted.conch.ssh.service.SSHService. @ivar started: True if this service has been started. @ivar stopped: True if this service has been stopped. � MockServiceF�MSG_TEST� MSG_fiction)� �G c C r0 )Nr� r) rI r) r) r* � logPrefix� r� zMockService.logPrefixc C � d| _ dS )z6 Record that the service was started. TN)�startedrI r) r) r* �serviceStarted� � zMockService.serviceStartedc C r� )z6 Record that the service was stopped. TN)�stoppedrI r) r) r* �serviceStopped r� zMockService.serviceStoppedc C s | j �d|� dS )z: A message that this service responds to. r� N)r" � sendPacketrZ r) r) r* �ssh_TEST rA zMockService.ssh_TESTN) r& r' r( r] �namer� r� �protocolMessagesr� r� r� r� r) r) r) r* r� � s r� c @ s0 e Zd ZdZdeiZdd� Zdd� Zdd� Zd S ) � MockFactoryzL A mocked-up factory based on twisted.conch.ssh.factory.SSHFactory. � ssh-userauthc C � t j�tj�t j�tj�d�S )zG Return the public keys that authenticate this server. �� ssh-rsas ssh-dsa)r! �Key� fromStringr# �publicRSA_openssh�publicDSA_opensshrI r) r) r* � getPublicKeys � �zMockFactory.getPublicKeysc C r� )zH Return the private keys that authenticate this server. r� )r! r� r� r# �privateRSA_openssh�privateDSA_opensshrI r) r) r* �getPrivateKeys r� zMockFactory.getPrivateKeysc C s t �d�}|fdd�S )a/ Diffie-Hellman primes that can be used for key exchange algorithms that use group exchange to establish a prime / generator group. @return: The primes and generators. @rtype: L{dict} mapping the key size to a C{list} of C{(generator, prime)} tuple. � diffie-hellman-group14-sha1))� � )� i )r �getDHGeneratorAndPrime)r2 �group14r) r) r* � getPrimes' s zMockFactory.getPrimesN) r& r' r( r] r� �servicesr� r� r� r) r) r) r* r� s r� c @ � e Zd ZdZdd� ZdS )�MockOldFactoryPublicKeysz� The old SSHFactory returned mappings from key names to strings from getPublicKeys(). We return those here for testing. c C s4 t �| �}|�� dd� D ] \}}|�� ||< q |S )zJ We used to map key types to public key blobs as strings. N)r� r� �items�blob�r2 r! r� �keyr) r) r* r� ? s z&MockOldFactoryPublicKeys.getPublicKeysN)r& r' r( r] r� r) r) r) r* r� 9 � r� c @ r� )�MockOldFactoryPrivateKeysz� The old SSHFactory returned mappings from key names to cryptography key objects from getPrivateKeys(). We return those here for testing. c C s2 t �| �}|�� dd� D ] \}}|j||< q |S )zG We used to map key types to cryptography key objects. N)r� r� r� � keyObjectr� r) r) r* r� O s z(MockOldFactoryPrivateKeys.getPrivateKeysN)r& r' r( r] r� r) r) r) r* r� I r� r� c C s� | j }| j}|�� }tdd� td|d d�D ��}t|||�}zt�|t�|t� ||���� t � �| _ W n t yJ td|� d|� d|� d �� � w t�| j �� �� j�| _d S ) Nc s s � | ]}d |> V qdS )� Nr) ��.0r= r) r) r* � <genexpr>] s � z)generatePredictableKey.<locals>.<genexpr>r � � z p=z g=z x=� )�p�g� bit_length�sum�ranger< r �DHPrivateNumbers�DHPublicNumbers�DHParameterNumbers� private_keyr � dhSecretKey� ValueError�printr r; � public_key�public_numbersr> �dhSecretKeyPublicMP)r" r� r� �bitsr= r> r) r) r* �generatePredictableKeyY s$ �� � �r� c @ sH e Zd ZU dZdZeeej e d< e re Z dd� Z dd� Z dd � ZdS ) �TransportTestCasez. Base class for transport test cases. N�klassc sh t �� � _� �� � _g � _dd� }� �td|� t� t � j�� j_ � fdd�}� j� � j� |� j_ d S )Nc S s d| S )z; Return a consistent entropy value � �r) )rd r) r) r* � secureRandom| s z-TransportTestCase.setUp.<locals>.secureRandomr� c s � j �| |f� d S �N)�packetsrM )� messageTyperp rI r) r* �stubSendPacket� s z/TransportTestCase.setUp.<locals>.stubSendPacket)r �StringTransportr" r� �protor� �patchr �types� MethodTyper� �_startEphemeralDH�makeConnectionr� )r2 r� r� r) rI r* �setUpw s � zTransportTestCase.setUpc C s2 |� d� |�tj| j� |�dd� |j|_dS )z� Deliver enough additional messages to C{proto} so that the key exchange which is started in L{SSHTransportBase.connectionMade} completes and non-key exchange messages can be sent and received. s SSH-2.0-BogoClient-1.2i � foos barN)� dataReceived�dispatchMessager" � MSG_KEXINIT�_A_KEXINIT_MESSAGE� _keySetup�_KEY_EXCHANGE_NONE�_keyExchangeState�r2 r� r) r) r* �finishKeyExchange� s z#TransportTestCase.finishKeyExchangec C s& | j j| j _g | j _| j �||� dS )z� Finish a key exchange by calling C{_keySetup} with the given arguments. Also do extra whitebox stuff to satisfy that method's assumption that some kind of key exchange has actually taken place. N)r� �_KEY_EXCHANGE_REQUESTEDr� �_blockedByKeyExchanger� )r2 � sharedSecret� exchangeHashr) r) r* �simulateKeyExchange� s z%TransportTestCase.simulateKeyExchange)r& r' r( r] r� r r r" r+ �__annotations__r r7 r� r� r� r) r) r) r* r� m s r� c @ � e Zd ZdZdZeZdS )�DHGroupExchangeSHA1Mixinz= Mixin for diffie-hellman-group-exchange-sha1 tests. �" diffie-hellman-group-exchange-sha1N)r& r' r( r] � kexAlgorithmr � hashProcessorr) r) r) r* r� � � r� c @ r� )�DHGroupExchangeSHA256Mixinz? Mixin for diffie-hellman-group-exchange-sha256 tests. �$ diffie-hellman-group-exchange-sha256N�r& r' r( r] r� r r� r) r) r) r* r� � r� r� c @ r� )� ECDHMixinz8 Mixin for elliptic curve diffie-hellman tests. � ecdh-sha2-nistp256Nr r) r) r) r* r � r� r c @ r� )�Curve25519SHA256Mixinz, Mixin for curve25519-sha256 tests. s curve25519-sha256Nr r) r) r) r* r � r� r c @ s( e Zd ZU dZeZeeej e d< dS )�BaseSSHTransportBaseCasez, Base case for TransportBase tests. r� N) r& r' r( r] rB r� r r r" r+ r� r) r) r) r* r � s r c @ s� e Zd ZdZer eZde�d� e�d� e�d� e�d� e�d� e�d� e�d� e�d� e�d� e�d� d d Zd d � Z d d� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Z d3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z!d=d>� Z"d?d@� Z#dAdB� Z$dCdD� Z%dEdF� Z&dGdH� Z'dIdJ� Z(dKdL� Z)dMdN� Z*dOdP� Z+dQdR� Z,dSdT� Z-dUdV� Z.dWdX� Z/dYdZ� Z0d[d\� Z1d]d^� Z2d_d`� Z3daS )b�BaseSSHTransportTestszs Test TransportBase. It implements the non-server/client specific parts of the SSH transport protocol. � ����������������r� r� � aes256-ctr� hmac-sha1� noner1 � � c C sp | j �� �dd�d }| �|dt�d� � |�d�td�d� }dd �d d � t j D �� d }| � ||� dS ) a Test that the first thing sent over the connection is the version string. The 'softwareversion' part must consist of printable US-ASCII characters, with the exception of whitespace characters and the minus sign. RFC 4253, section 4.2. � ra r s SSH-2.0-Twisted_�asciizSSH-2.0-Nz^(�|c s s* � | ]}|d kr|� � st�|�V qdS )�-N)�isspace�re�escape�r� �cr) r) r* r� � s � �z9BaseSSHTransportTests.test_sendVersion.<locals>.<genexpr>z)*$) r" �value�split� assertEqual�twisted_version�encode�decoderd �join�string� printable� assertRegex)r2 �version�softwareVersion�softwareVersionRegexr) r) r* �test_sendVersion� s ����z&BaseSSHTransportTests.test_sendVersionc C sl t � }|�| j� |�d� |�d� |�d� | �| jj� |�d� | �| jj� | �d| j�� � dS )z� When the peer is not sending its SSH version but keeps sending data, the connection is disconnected after 4KB to prevent buffering too much and running our of memory. s SSH-2-Server-Identifiers� 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890s 1235678s 1234567s% Preventing a denial of service attackN) rB r� r" r� � assertFalse� disconnecting� assertTrue�assertInr �r2 �sutr) r) r* �'test_dataReceiveVersionNotSentMemoryDOS s z=BaseSSHTransportTests.test_dataReceiveVersionNotSentMemoryDOSc C sX t � }|�| j� | �|� | j�� td�}d}|�||� | j�� }| �|d� dS )a@ Test that plain (unencrypted, uncompressed) packets are sent correctly. The format is:: uint32 length (including type and padding length) byte padding length byte type bytes[length-padding length-2] data bytes[padding length] padding �A� BCDEFGs ABCDEFG����N) rB r� r" r� �clear�ordr� r r )r2 r� rW rp r r) r) r* �test_sendPacketPlain s z*BaseSSHTransportTests.test_sendPacketPlainc C sp t � }|�| j� | �|� t� |_}td�}d}| j�� |�||� | � |j � | j� � }| � |d� dS )z� Test that packets sent while encryption is enabled are sent correctly. The whole packet should be encrypted. r* � BCs ABC����N) rB r� r" r� r^ �currentEncryptionsr- r, r� r% rc r r �r2 r� � testCipherrW rp r r) r) r* �test_sendPacketEncrypted0 s �z.BaseSSHTransportTests.test_sendPacketEncryptedc C sX t � }|�| j� | �|� t� |_| j�� |�td�d� | j� � }| � |d� dS )z� Test that packets sent while compression is enabled are sent correctly. The packet type and data should be encrypted. r* � Bs BAf��������N) rB r� r" r� r� �outgoingCompressionr, r� r- r r )r2 r� r r) r) r* �test_sendPacketCompressedM s �z/BaseSSHTransportTests.test_sendPacketCompressedc C sx t � }|�| j� | �|� t� |_}t� |_td�}d}| j� � |� ||� | � |j � | j� � }| �|d� dS )z� Test that packets sent while compression and encryption are enabled are sent correctly. The packet type and data should be compressed and then the whole packet should be encrypted. r* r/ s CBAf���������N)rB r� r" r� r^ r0 r� r5 r- r, r� r% rc r r r1 r) r) r* �test_sendPacketBoth] s �z)BaseSSHTransportTests.test_sendPacketBothc C sh t � }|�| j� | �|� | j�� |�td�d� | j�� d |_| � |� � d� | � |jd� dS )zt Test that packets are retrieved correctly out of the buffer when no encryption is enabled. r* r/ s extras ABCN) rB r� r" r� r, r� r- r �bufr � getPacketr� r) r) r* �test_getPacketPlain| s z)BaseSSHTransportTests.test_getPacketPlainc C s� t � }dd� |_|�| j� | j�� t� |_}|�td�d� | j� � }|dtj � |_ | � |� � � | �|j� | �|jd� | j |tj d� 7 _ | �|� � d� | �|j d� dS ) zl Test that encrypted packets are retrieved correctly. See test_sendPacketEncrypted. c S � d S r� r) r) r) r) r* �<lambda>� � z?BaseSSHTransportTests.test_getPacketEncrypted.<locals>.<lambda>r* � BCDNs A� ABCDr1 )rB � sendKexInitr� r" r, r^ r0 r� r- r rk r8 � assertIsNoner9 r% rj r �first)r2 r� r2 r r) r) r* �test_getPacketEncrypted� s z-BaseSSHTransportTests.test_getPacketEncryptedc C sf t � }|�| j� | �|� | j�� t� |_|j|_|�t d�d� | j� � |_ | � |� � d� dS )zo Test that compressed packets are retrieved correctly. See test_sendPacketCompressed. r* r> r? N)rB r� r" r� r, r� r5 �incomingCompressionr� r- r r8 r r9 r� r) r) r* �test_getPacketCompressed� s z.BaseSSHTransportTests.test_getPacketCompressedc C sn t � }dd� |_|�| j� | j�� t� |_t� |_|j|_ |� t d�d� | j� � |_ | �|�� d� dS )zv Test that compressed and encrypted packets are retrieved correctly. See test_sendPacketBoth. c S r; r� r) r) r) r) r* r< � r= z:BaseSSHTransportTests.test_getPacketBoth.<locals>.<lambda>r* r+ s ABCDEFGN)rB r@ r� r" r, r^ r0 r� r5 rD r� r- r r8 r r9 r� r) r) r* �test_getPacketBoth� s z(BaseSSHTransportTests.test_getPacketBothc C s> t �dddd�}d }}| jjD ] }| �|�|||�� qdS )z? Test that all the supportedCiphers are valid. � Ar4 � C� D� N)r" � SSHCiphersr� �supportedCiphersr% � _getCipher)r2 �ciphers�ivr� �cipNamer) r) r* �test_ciphersAreValid� s �z*BaseSSHTransportTests.test_ciphersAreValidc C st | j �� �dd�d }|| j_| j�� }| �|dd� tt jf�� | �|dd� d� t � |dd� d�\ }}}}}}} } } } } | �|d� | jj d g �� | �|d� | jj �� | �|d� | jj�� | �|d� | jj�� | �|d� | jj�� | �|d� | jj�� | �| d� | jj�� | �| d� | jj�� | �| d� | jj�� | �| d� | jj�� | �| d � dS ) a� Test that the KEXINIT (key exchange initiation) message is sent correctly. Payload:: bytes[16] cookie string key exchange algorithms string public key algorithms string outgoing ciphers string incoming ciphers string outgoing MACs string incoming MACs string outgoing compressions string incoming compressions bool first packet follows uint32 0 r ra r � s ����������������N� � ,s ext-info-ss )r" r r r� r8 r9 r rn r� r �getNSr �supportedKeyExchanges�supportedPublicKeysrL � supportedMACs�supportedCompressions�supportedLanguages)r2 r r[ � keyExchanges�pubkeys�ciphers1�ciphers2�macs1�macs2� compressions1� compressions2� languages1� languages2r8 r) r) r* �test_sendKexInit� s> ��z&BaseSSHTransportTests.test_sendKexInitc C s. | j �� | j�t j| j� | �| jg � dS )zy Immediately after connecting, the transport expects a KEXINIT message and does not reply to it. N)r" r, r� r� r� r� r r� rI r) r) r* �test_receiveKEXINITReply� s z.BaseSSHTransportTests.test_receiveKEXINITReplyc C sX | � | j� | jdd�= | j�tj| j� | �t| j�d� | �| jd d tj� dS )z� When a KEXINIT message is received which is not a reply to an earlier KEXINIT message which was sent, a KEXINIT reply is sent. Nra r ) r� r� r� r� r" r� r� r rd rI r) r) r* �test_sendKEXINITReply s z+BaseSSHTransportTests.test_sendKEXINITReplyc C s | � t| jj� dS )a( A new key exchange cannot be started while a key exchange is already in progress. If an attempt is made to send a I{KEXINIT} message using L{SSHTransportBase.sendKexInit} while a key exchange is in progress causes that method to raise a L{RuntimeError}. N)� assertRaisesrf r� r@ rI r) r) r* �test_sendKexInitTwiceFails rQ z0BaseSSHTransportTests.test_sendKexInitTwiceFailsc C s� t jt jg}| j �� | j`|D ]}| j�|d� | �| j �� d� q| �| j� t � | j_ | j� � | �| j �� � d�d� dS )z� After L{SSHTransportBase.sendKexInit} has been called, messages types other than the following are queued and not sent until after I{NEWKEYS} is sent by L{SSHTransportBase._keySetup}. RFC 4253, section 7.1. r� r1 � N) r" �MSG_SERVICE_REQUESTr� r, r� r� r r r� r^ �nextEncryptions�_newKeys�count)r2 �disallowedMessageTypesr� r) r) r* � test_sendKexInitBlocksOthers s � z2BaseSSHTransportTests.test_sendKexInitBlocksOthersc C sZ d| j _| j �ddg� | �| jtjdt�d� t�d� t�d� t�d� fg� d S ) ze Test that EXT_INFO messages are sent correctly. See RFC 8308, section 2.3. T�� server-sig-algs� ssh-rsa,rsa-sha2-256)� elevation� d� rr rs rt ru N) r� �_peerSupportsExtensions� sendExtInfor r� r" � MSG_EXT_INFOr r4 rI r) r) r* �test_sendExtInfo9 s* ���������z&BaseSSHTransportTests.test_sendExtInfoc C s | j �dg� | �| jg � dS )z� If the peer has not advertised support for extension negotiation, no EXT_INFO message is sent, since RFC 8308 only guarantees that the peer will be prepared to accept it if it has advertised support. rq N)r� rx r r� rI r) r) r* �test_sendExtInfoUnsupportedS s z1BaseSSHTransportTests.test_sendExtInfoUnsupportedc C sR | j �tjdt�d� t�d� t�d� t�d� � | �| j jddd�� dS )z� When an EXT_INFO message is received, the transport stores a mapping of the peer's advertised extensions. See RFC 8308, section 2.3. rv rr �! ssh-rsa,rsa-sha2-256,rsa-sha2-512� no-flow-control� s)rr r} N)r� r� r" ry r r4 r �peerExtensionsrI r) r) r* � test_EXT_INFO\ s$ �������z#BaseSSHTransportTests.test_EXT_INFOc C s* | j �ddd� | �| jtjdfg� dS )z� Test that debug messages are sent correctly. Payload:: bool always display string debug message string language r_ T� en� test enN)r� � sendDebugr r� r" � MSG_DEBUGrI r) r) r* �test_sendDebugq s �z$BaseSSHTransportTests.test_sendDebugc C s8 | j �tjd� | j �tjd� | �| j jddg� dS )zW Test that debug messages are received correctly. See test_sendDebug. r� s silent en)Tr_ r� )Fs silentr� N)r� r� r" r� r rF rI r) r) r* �test_receiveDebug~ s �� �z'BaseSSHTransportTests.test_receiveDebugc C s& | j �d� | �| jtjdfg� dS )zk Test that ignored messages are sent correctly. Payload:: string ignored data r_ s testN)r� � sendIgnorer r� r" � MSG_IGNORErI r) r) r* �test_sendIgnore� s �z%BaseSSHTransportTests.test_sendIgnorec C s& | j �tjd� | �| j jdg� dS )zb Test that ignored messages are received correctly. See test_sendIgnore. r_ N)r� r� r" r� r rG rI r) r) r* �test_receiveIgnore� � z(BaseSSHTransportTests.test_receiveIgnorec C s$ | j �� | �| jtjdfg� dS )zt Test that unimplemented messages are sent correctly. Payload:: uint32 sequence number r N)r� �sendUnimplementedr r� r" �MSG_UNIMPLEMENTEDrI r) r) r* �test_sendUnimplemented� s �z,BaseSSHTransportTests.test_sendUnimplementedc C s& | j �tjd� | �| j jdg� dS )zo Test that unimplemented messages are received correctly. See test_sendUnimplemented. s �r� N)r� r� r" r� r rE rI r) r) r* �test_receiveUnimplemented� r� z/BaseSSHTransportTests.test_receiveUnimplementedc sP dg� � fdd�}|| j _| j�dd� | �| jt jdfg� | �� d � dS ) z� Test that disconnection messages are sent correctly. Payload:: uint32 reason code string reason description string language Fc � d� d< d S �NTr r) r) �� disconnectedr) r* �stubLoseConnection� � zEBaseSSHTransportTests.test_sendDisconnect.<locals>.stubLoseConnectionr� r_ s � test r N)r" �loseConnectionr� �sendDisconnectr r� �MSG_DISCONNECTr% �r2 r� r) r� r* �test_sendDisconnect� s ��� z)BaseSSHTransportTests.test_sendDisconnectc sN dg� � fdd�}|| j _| j�t jd� | �| jjdg� | �� d � dS )zl Test that disconnection messages are received correctly. See test_sendDisconnect. Fc r� r� r) r) r� r) r* r� � r� zHBaseSSHTransportTests.test_receiveDisconnect.<locals>.stubLoseConnections � test�r� r_ r N)r" r� r� r� r� r rD r% r� r) r� r* �test_receiveDisconnect� s �z,BaseSSHTransportTests.test_receiveDisconnectc s` dg� � fdd�}|| j _| j �| j�� � | �| j j� | �| j j| j j � | �� d � dS )ze Test that dataReceived parses packets and dispatches them to ssh_* methods. Fc r� r� r) )r[ ��kexInitr) r* � stubKEXINIT� r� z<BaseSSHTransportTests.test_dataReceived.<locals>.stubKEXINITr N) r� � ssh_KEXINITr� r" r r% � gotVersionr �ourVersionString�otherVersionString)r2 r� r) r� r* �test_dataReceived� s z'BaseSSHTransportTests.test_dataReceivedc C s� t � }| j�|� | �| jj|� | �|j� | j�dd� | �| jdg� t � }| j�|� | �|j� | �|j � | j� d� | �|j � dS )z� Test that the transport can set the running service and dispatches packets to the service's packetReceived method. r� r_ r� N) r� r� � setServicer r r% r� r� r� r� �connectionLost)r2 r �service2r) r) r* � test_service� s z"BaseSSHTransportTests.test_servicec s@ dg� � fdd�}|| j _d| j _| j �d� | �� d � dS )zP Test that the transport notifies the avatar of disconnections. Fc r� r� r) r) r� r) r* �logout r� z1BaseSSHTransportTests.test_avatar.<locals>.logoutTNr )r� �logoutFunction�avatarr� r% )r2 r� r) r� r* � test_avatar� s z!BaseSSHTransportTests.test_avatarc C �� | � | j�d�� | � | j�d�� | � | j�d�� t� | j_| �| j�d�� | �| j�d�� | �| j�d�� t�dddd�| j_| � | j�d�� | � | j�d�� | � | j�d�� | �t | jjd� dS )zS Test that the transport accurately reflects its encrypted status. �in�out�bothr �badN) r# r� � isEncryptedr^ r0 r% r" rK rh � TypeErrorrI r) r) r* �test_isEncrypted � �z&BaseSSHTransportTests.test_isEncryptedc C r� )zR Test that the transport accurately reflects its verified status. r� r� r� r r� N) r# r� � isVerifiedr^ r0 r% r" rK rh r� rI r) r) r* �test_isVerified! r� z%BaseSSHTransportTests.test_isVerifiedc sf dg� � fdd�}|| j _| j�� | �| jd d t j� | �| jd d dd� tt jf�� dS ) zh Test that loseConnection sends a disconnect message and closes the connection. Fc r� r� r) r) r� r) r* r� < r� zEBaseSSHTransportTests.test_loseConnection.<locals>.stubLoseConnectionr ra r� r� N)r" r� r� r r� r� rn �DISCONNECT_CONNECTION_LOSTr� r) r� r* �test_loseConnection5 s �z)BaseSSHTransportTests.test_loseConnectionc s( � fdd�}|d� |d� |d� dS )zU Test that the transport disconnects when it receives a bad version. c s� g �_ d�j_dg� � fdd�}|�j_t| d �D ]}�j�|� q��� d � ���j d d tj � ���j d d dd� t tj f�� d S ) NFc r� r� r) r) r� r) r* r� P r� zRBaseSSHTransportTests.test_badVersion.<locals>.testBad.<locals>.stubLoseConnectionr r ra r� r� ) r� r� r� r" r� r r� r% r r� rn �)DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED)r r� r rI r� r* �testBadK s �z6BaseSSHTransportTests.test_badVersion.<locals>.testBads SSH-1.5-OpenSSHs SSH-3.0-Twisteds GET / HTTP/1.1Nr) )r2 r� r) rI r* �test_badVersionF s z%BaseSSHTransportTests.test_badVersionc sX t � � � �t�� � d� j d }� fdd�t|�D � | �� j� | �� j � j� dS )zV Test that the transport ignores data sent before the version string. s5 here's some stuff beforehand here's some other stuff r c s g | ]}� � |��qS r) )r� r �r� r) r* � <listcomp>n s z@BaseSSHTransportTests.test_dataBeforeVersion.<locals>.<listcomp>N) rB r� r r� r� r r% r� r r� �r2 �datar) r� r* �test_dataBeforeVersiona s ��� z,BaseSSHTransportTests.test_dataBeforeVersionc C �< t � }|�t�� � |�d� | �|j� | �|jd� dS )zw Test that the transport treats the compatibility version (1.99) as equivalent to version 2.0. s SSH-1.99-OpenSSH s SSH-1.99-OpenSSHN� rB r� r r� r� r% r� r r� r� r) r) r* �test_compatabilityVersionr s z/BaseSSHTransportTests.test_compatabilityVersionc C r� )z� It can parse the SSH version string even when it ends only in Unix newlines (CR) and does not follows the RFC 4253 to use network newlines (CR LF). s, SSH-2.0-PoorSSHD Some-comment here more-datas" SSH-2.0-PoorSSHD Some-comment hereNr� r' r) r) r* �&test_dataReceivedSSHVersionUnixNewline} s z<BaseSSHTransportTests.test_dataReceivedSSHVersionUnixNewlinec C r� )a9 The trailing spaces from SSH version comment are not removed. The SSH version string needs to be kept as received (without CR LF end of line) as they are used in the host authentication process. This can happen with a Bitvise SSH server which hides its version. s> SSH-2.0-9.99 FlowSsh: Bitvise SSH Server (WinSSHD) more-datas3 SSH-2.0-9.99 FlowSsh: Bitvise SSH Server (WinSSHD) Nr� r' r) r) r* �)test_dataReceivedSSHVersionTrailingSpaces� s � �z?BaseSSHTransportTests.test_dataReceivedSSHVersionTrailingSpacesc C s4 t � }d|_|�t�� � |�d� | �|j� dS )z� If an unusual SSH version is received and is included in C{supportedVersions}, an unsupported version error is not emitted. )� 9.99� SSH-9.99-OpenSSH N)rB �supportedVersionsr� r r� r� r# rH r� r) r) r* � test_supportedVersionsAreAllowed� s z6BaseSSHTransportTests.test_supportedVersionsAreAllowedc C s6 t � }d|_|�t�� � |�d� | �d|j� dS )z� If an unusual SSH version is received and is not included in C{supportedVersions}, an unsupported version error is emitted. )s 2.0r� r� N)rB r� r� r r� r� r rH r� r) r) r* �6test_unsupportedVersionsCallUnsupportedVersionReceived� s zLBaseSSHTransportTests.test_unsupportedVersionsCallUnsupportedVersionReceivedc s� t jf� fdd� }|d� |d� � jj}t� � j_|dt j� dd� � jj_|d� |� j_t� � j_d d � }|� jj_ |d t j � � � � d S ) zi Test that the transport disconnects with an error when it receives bad packets. c sp g � _ | � j_� �� j�� � � �t� j �d� � �� j d d tj� � �� j d d dd� t |f�� d S )Nra r r� r� ) r� r� r8 rA r9 r rd r" r� rn )r[ �errorrI r) r* r� � s (z6BaseSSHTransportTests.test_badPackets.<locals>.testBads ��������s BCDEs AB123456c S s | d d� S r� r) )r= r) r) r* r< � � z7BaseSSHTransportTests.test_badPackets.<locals>.<lambda>s BCDEFGHIJKc S s t d��)Nzbad compression)� Exception)rp r) r) r* �stubDecompress� s z=BaseSSHTransportTests.test_badPackets.<locals>.stubDecompresss BCDEN) r" �DISCONNECT_PROTOCOL_ERRORr� r0 r^ �DISCONNECT_MAC_ERRORrl r� rD r� � DISCONNECT_COMPRESSION_ERROR�flushLoggedErrors)r2 r� �oldEncryptionsr� r) rI r* �test_badPackets� s& � � z%BaseSSHTransportTests.test_badPacketsc s� � j j}|f� fdd� }� j �dd� |� dtjd< � j �dd� |� � j �dd� |� � j �t� � � j �dd� |� � j �d d� |� d S ) zj Test that unimplemented packet types cause MSG_UNIMPLEMENTED packets to be sent. c sP � � � jd d tj� � � � jd d dd� t| f�� g � j_| d7 } d S )Nr ra r� r� )r r� r" r� rn r� )rS rI r) r* �checkUnimplemented� s $ zKBaseSSHTransportTests.test_unimplementedPackets.<locals>.checkUnimplemented�( r1 s MSG_fiction�) �< �F r� N)r� rr r� r" �messagesr� r� )r2 rS r� r) rI r* �test_unimplementedPackets� s z/BaseSSHTransportTests.test_unimplementedPacketsc C s� | j }|�| j�� � t� |_t� |_t� |_|� t � � t � }|� t �� � |�d� | �|j|j� | �|j|j� | �|j|j� | �|j|j� | �|j|j� | �|j|j� dS )zD Test that multiple instances have distinct states. r1 N)r� r� r" r r^ r0 r� r5 rD r� r� rB r� r r� r� �assertNotEqualr� ro rr r )r2 r� �proto2r) r) r* �test_multipleClasses� s z*BaseSSHTransportTests.test_multipleClassesN)4r& r' r( r] r r7 r r4 r� r" r) r. r3 r6 r7 r: rC rE rF rQ re rf rg ri rp rz r{ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r) r) r) r* r � s� �������� � � � �� 1 $ $ r c @ r� )�'BaseSSHTransportDHGroupExchangeBaseCasez@ Diffie-Hellman group exchange tests for TransportBase. c C s� | j | j_d| j_| �d| jj ��� }| �d| ��� }| �d| | ��� }| �d| | | ��� }| �| j�ddd�|| | | � dS )z? Test that _getKey generates the correct keys. � EFs ABCDKr? � K� AB� CDN)r� r� �kexAlg� sessionIDr� �digestr �_getKey)r2 �k1�k2�k3�k4r) r) r* � test_getKey s (z3BaseSSHTransportDHGroupExchangeBaseCase.test_getKeyN)r& r' r( r] r� r) r) r) r* r� � r� c @ � e Zd ZdZdS )�(BaseSSHTransportDHGroupExchangeSHA1TestszE diffie-hellman-group-exchange-sha1 tests for TransportBase. N�r& r' r( r] r) r) r) r* r� � r� c @ r� )�*BaseSSHTransportDHGroupExchangeSHA256TestszG diffie-hellman-group-exchange-sha256 tests for TransportBase. Nr� r) r) r) r* r� & � r� c @ r� )�"BaseSSHTransportEllipticCurveTestsz4 ecdh-sha2-nistp256 tests for TransportBase Nr� r) r) r) r* r� 0 r� r� c @ r� )�%BaseSSHTransportCurve25519SHA256Testsz3 curve25519-sha256 tests for TransportBase Nr� r) r) r) r* r� 8 � r� c @ s\ e Zd ZdZddd�Zddd�Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dS )�#ServerAndClientSSHTransportBaseCasezF Tests that need to be run on both the server and the client. Nc C sN |du rt j}| �| jd d t j� | �| jd d dd� t|f�� dS )zI Helper function to check if the transport disconnected. Nr� r ra r� r� )r" r� r r� r� rn r� r) r) r* �checkDisconnectedF s (z5ServerAndClientSSHTransportBaseCase.checkDisconnectedc C sP |du rt j}| �� }||� |�t�� � | j�|j �� � |r&| � |� |S )zy Helper function to connect a modified protocol to the test protocol and test for disconnection. N) r" � DISCONNECT_KEY_EXCHANGE_FAILEDr� r� r r� r� r� r r� )r2 �protoModificationr� r� r) r) r* �connectModifiedProtocolO s z;ServerAndClientSSHTransportBaseCase.connectModifiedProtocolc C � dd� }| � |� dS )z` Test that the transport disconnects if it can't match the key exchange c S � g | _ d S r� �rV �r� r) r) r* �blankKeyExchangesd � z\ServerAndClientSSHTransportBaseCase.test_disconnectIfCantMatchKex.<locals>.blankKeyExchangesN�r� )r2 r r) r) r* � test_disconnectIfCantMatchKex^ s zAServerAndClientSSHTransportBaseCase.test_disconnectIfCantMatchKexc C r� )zP Like test_disconnectIfCantMatchKex, but for the key algorithm. c S r� r� )rW r r) r) r* �blankPublicKeysn r z]ServerAndClientSSHTransportBaseCase.test_disconnectIfCantMatchKeyAlg.<locals>.blankPublicKeysNr )r2 r r) r) r* � test_disconnectIfCantMatchKeyAlgi � zDServerAndClientSSHTransportBaseCase.test_disconnectIfCantMatchKeyAlgc C r� )zN Like test_disconnectIfCantMatchKex, but for the compression. c S r� r� �rY r r) r) r* �blankCompressionsx r zdServerAndClientSSHTransportBaseCase.test_disconnectIfCantMatchCompression.<locals>.blankCompressionsNr )r2 r r) r) r* �%test_disconnectIfCantMatchCompressions r zIServerAndClientSSHTransportBaseCase.test_disconnectIfCantMatchCompressionc C r� )zM Like test_disconnectIfCantMatchKex, but for the encryption. c S r� r� �rL r r) r) r* � blankCiphers� r zZServerAndClientSSHTransportBaseCase.test_disconnectIfCantMatchCipher.<locals>.blankCiphersNr )r2 r r) r) r* � test_disconnectIfCantMatchCipher} r zDServerAndClientSSHTransportBaseCase.test_disconnectIfCantMatchCipherc C r� )zF Like test_disconnectIfCantMatchKex, but for the MAC. c S r� r� �rX r r) r) r* � blankMACs� r zTServerAndClientSSHTransportBaseCase.test_disconnectIfCantMatchMAC.<locals>.blankMACsNr )r2 r r) r) r* � test_disconnectIfCantMatchMAC� r zAServerAndClientSSHTransportBaseCase.test_disconnectIfCantMatchMACc C �$ | � | j�� t�| jj�� �� dS )z� Test that the transport's L{getPeer} method returns an L{SSHTransportAddress} with the L{IAddress} of the peer. N)r r� �getPeerr �SSHTransportAddressr" rI r) r) r* � test_getPeer� � �z0ServerAndClientSSHTransportBaseCase.test_getPeerc C r )z� Test that the transport's L{getHost} method returns an L{SSHTransportAddress} with the L{IAddress} of the host. N)r r� �getHostr r r" rI r) r) r* � test_getHost� r z0ServerAndClientSSHTransportBaseCase.test_getHostr� ) r& r' r( r] r� r� r r r r r r r r) r) r) r* r� A s r� c @ �: e Zd ZU dZejZeeej e d< dd� Z dd� Z dS )�ServerSSHTransportBaseCasez1 Base case for SSHServerTransport tests. r� c C s$ t �| � t� | j_| jj�� d S r� )r� r� r� r� r � startFactoryrI r) r) r* r� � s z ServerSSHTransportBaseCase.setUpc C s t �| � | jj�� | j`d S r� )r� �tearDownr� r � stopFactoryrI r) r) r* r � s z#ServerSSHTransportBaseCase.tearDownN) r& r' r( r] r" r- r� r r r+ r� r� r r) r) r) r* r � s r c @ s� e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd� Zd d � Zd d � Zd S )!�ServerSSHTransportTestsz' Tests for SSHServerTransport. c C s� | j �d� | �| j jd� | �| j jd� | �| j jd� | �| j jd� | �| j j� | j j }| �|j d� | �|j d� | �|j d� | �|j d� dS )z� Receiving a KEXINIT packet listing multiple supported algorithms will set up the first common algorithm found in the client's preference list. s SSH-2.0-Twisted ����������������� bdiffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256 ssh-dss,ssh-rsa �aes128-ctr,aes128-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc,cast128-ctr,cast128-cbc,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc �aes128-ctr,aes128-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc,cast128-ctr,cast128-cbc,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc hmac-md5,hmac-sha1 hmac-md5,hmac-sha1 none,zlib none,zlib ����r� s ssh-dssr s aes128-ctr� hmac-md5N)r� r� r r� �keyAlg�outgoingCompressionType�incomingCompressionTyper# rw rl r| r} r r~ �r2 �ner) r) r* � test_KEXINITMultipleAlgorithms� s �z6ServerSSHTransportTests.test_KEXINITMultipleAlgorithmsc C s� dt �d� t �d� t �d� t �d� t �d� t �d� t �d� t �d� t �d� t �d� d d }| j�|� | �| jjd � | �| jj� d S ) z� If the client sends "ext-info-c" in its key exchange algorithms, then the server notes that the client supports extension negotiation. See RFC 8308, section 2.1. rJ s/ diffie-hellman-group-exchange-sha256,ext-info-cr� r r r r1 r r r� N)r r4 r� r� r r� r% rw �r2 � kexInitPacketr) r) r* � test_KEXINITExtensionNegotiation� s: �������� � � � �� z8ServerSSHTransportTests.test_KEXINITExtensionNegotiationc C s� dd� dd� dd� | jjddd� | jj| jj| jj| jj| jj| jj| jj| jj| jjf D �D �� d }| j�|� | � | jj � | j� d � | � | jj � | j� d � | � | jj � | �| jg � d | j_ | j�d � | � | jj � | �| jg � dS ) a< The client is allowed to send a guessed key exchange packet after it sends the KEXINIT packet. However, if the key exchanges do not match, that guess packet must be ignored. This tests that the packet is ignored in the case of the key exchange method not matching. rJ r1 c S � g | ]}t �|��qS r) �r r4 r� r) r) r* r� � ��zEServerSSHTransportTests.test_ignoreGuessPacketKex.<locals>.<listcomp>c S � g | ]}d � |��qS �rT �r �r� r> r) r) r* r� r* Nr� � � � test � T� �r r� rV rW rL rX rY rZ r� r% �ignoreNextPacket� ssh_DEBUG�ssh_KEX_DH_GEX_REQUEST_OLDr# r r� �ssh_KEX_DH_GEX_REQUESTr% r) r) r* �test_ignoreGuessPacketKex� sB ������� z1ServerSSHTransportTests.test_ignoreGuessPacketKexc C s� dd� dd� dd� | jj| jjddd� | jj| jj| jj| jj| jj| jj| jj| jjf D �D �� d }| j�|� | � | jj � | j� d � | � | jj � | j� d � | � | jj � | �| jg � d | j_ | j�d � | � | jj � | �| jg � dS ) zk Like test_ignoreGuessPacketKex, but for an incorrectly guessed public key format. rJ r1 c S r( r) r) r� r) r) r* r� 2 r* zEServerSSHTransportTests.test_ignoreGuessPacketKey.<locals>.<listcomp>c S r+ r, r- r. r) r) r* r� 4 r* Nr� r/ r0 r1 Tr2 r3 r% r) r) r* �test_ignoreGuessPacketKey) sB ������� z1ServerSSHTransportTests.test_ignoreGuessPacketKeyc C sz |g| j _dg| j _| j �| j�� � t�|�\}}t|d|�}| j � t � |�� t � t � d|d ��d }t| j j|| j j�}| �| j j|� t||| j j�}t� } | �t � | j j�d � | �t � | j j�d � | �t � | j jjd �� �� | �t � |�� | �|� | �|� | �� } | j jjd � | �} | �| j tj t � | j jjd �� �| t � | � ftj dfg� dS ) z� Test that the KEXDH_INIT packet causes the server to send a KEXDH_REPLY with the server's public key and a signature. @param kexAlgorithm: The key exchange algorithm to use. @type kexAlgorithm: L{str} r� i� r� � r rj r1 N) r� rV rW r� r" r r r� r< r6 r r; �getMPr4 r@ r� r� r r� r �updater� �ourKexInitPayloadr � publicKeysr� r� � privateKeys�signr� �MSG_KEXDH_REPLY� MSG_NEWKEYS) r2 r� r� r� r� �er> r9 r� �hr� � signaturer) r) r* �assertKexDHInitResponseV s> �����z/ServerSSHTransportTests.assertKexDHInitResponsec C s, d| j _d| j _| �t| j jt�d�� dS )�� Test that if the server receives a KEX_DH_GEX_REQUEST_OLD message and the key exchange algorithm is not set, we raise a ConchError. s bad-curver� s unused-keyN)r� r� r rh r �_ssh_KEX_ECDH_INITr r4 rI r) r) r* �%test_checkBad_KEX_ECDH_INIT_CurveName� s �z=ServerSSHTransportTests.test_checkBad_KEX_ECDH_INIT_CurveNamec C s� dt �d� t �d� t �d� t �d� t �d� t �d� t �d� t �d� t �d� t �d� d d }| j�|� | �t� | �t� d S ) zy Test that if the server received a bad name for a curve we raise an UnsupportedAlgorithm error. r r r� r r r r1 r r N)r r4 r� r� rh �AttributeErrorr )r2 �kexmsgr) r) r* � test_checkBad_KEX_INIT_CurveName� s: �������� � � � �� z8ServerSSHTransportTests.test_checkBad_KEX_INIT_CurveNamec C � | � dd� dS )z� KEXDH_INIT messages are processed when the diffie-hellman-group14-sha1 key exchange algorithm is requested. r� r� N)rF rI r) r) r* �test_KEXDH_INIT_GROUP14� � z/ServerSSHTransportTests.test_KEXDH_INIT_GROUP14c � d� j _t� � j _� �dd� � �� j jd� � �dd� � �� j jd� � �� jd tj df� � fdd�t d �D �}� �� j jj |d |d |d |d |d |d f� dS )�G Test that _keySetup sets up the next encryption keys. r� r� r� r� r� r1 c � g | ] }� j �|d d��qS �r� r� �r� r� r rI r) r* r� � � z9ServerSSHTransportTests.test_keySetup.<locals>.<listcomp>� ABCDEFra r� r rj r� r� N� r� r� r^ rl r� r r� r� r" rB r r! �r2 �newKeysr) rI r* � test_keySetup� � &�z%ServerSSHTransportTests.test_keySetupc C s� g d�| j _d| j _t� | j _d| j _| �dd� | �| jd t j df� | �| jd t j d t � d � t � d � f� | �dd � | �| jd t j df� d S )a If the client advertised support for extension negotiation, then _keySetup sends SSH_MSG_EXT_INFO with the "server-sig-algs" extension as the next packet following the server's first SSH_MSG_NEWKEYS. See RFC 8308, sections 2.4 and 3.1. )r� s rsa-sha2-256s rsa-sha2-512r� Tr� r� ���r1 r� s rr r| r� N)r� rW r� r^ rl rw r� r r� r" rB ry r r4 rI r) r) r* �test_keySetupWithExtInfo� s$ ���� z0ServerSSHTransportTests.test_keySetupWithExtInfoc rP )rQ r r� r� r� r� r1 c rR rS rT r rI r) r* r� � rU z>ServerSSHTransportTests.test_ECDH_keySetup.<locals>.<listcomp>rV ra r� r rj r� r� NrW rX r) rI r* �test_ECDH_keySetup� r[ z*ServerSSHTransportTests.test_ECDH_keySetupc C s� | � � t�dddd�| j_| j�d� | �| jj| jj� | �| jj � | �| jj � d| j_ | � dd� | j�d� | � | jj � d| j_| � dd� | j�d� | � | jj � dS )zj Test that NEWKEYS transitions the keys in nextEncryptions to currentEncryptions. r r1 � zlibr� r� r� N)r$ r" rK r� rl � ssh_NEWKEYS�assertIsr0 rA r5 rD r r� �assertIsNotNoner! rI r) r) r* � test_NEWKEYS� s � z$ServerSSHTransportTests.test_NEWKEYSc C sD | j �t�d�� | �| jtjt�d�fg� | �| j jj d� dS )z^ Test that the SERVICE_REQUEST message requests and starts a service. r� r� N) r� �ssh_SERVICE_REQUESTr r4 r r� r" �MSG_SERVICE_ACCEPTr r� rI r) r) r* �test_SERVICE_REQUEST s �z,ServerSSHTransportTests.test_SERVICE_REQUESTc C � | j �d� | �� dS �zD Test that NEWKEYS disconnects if it receives data. s bad packetN�r� r` r� rI r) r) r* �test_disconnectNEWKEYSData � z2ServerSSHTransportTests.test_disconnectNEWKEYSDatac C s" | j �t�d�� | �tj� dS )zd Test that SERVICE_REQUESTS disconnects if an unknown service is requested. s no serviceN)r� rd r r4 r� r" � DISCONNECT_SERVICE_NOT_AVAILABLErI r) r) r* �(test_disconnectSERVICE_REQUESTBadService s z@ServerSSHTransportTests.test_disconnectSERVICE_REQUESTBadServiceN)r& r' r( r] r$ r' r8 r9 rF rI rL rN rZ r] r^ rc rf rj rm r) r) r) r* r � s" #0-- r c @ s8 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd S ) �)ServerSSHTransportDHGroupExchangeBaseCasezE Diffie-Hellman group exchange tests for SSHServerTransport. c C � | j g| j_dg| j_| j�| j�� � | j�d� | jj� � � d�d \}}| � | j tj t�|�d fg� | � | jjd� | � | jj|� dS )z� Test that the KEX_DH_GEX_REQUEST_OLD message causes the server to reply with a KEX_DH_GEX_GROUP message with the correct Diffie-Hellman group. r� � r� r � rj N)r� r� rV rW r� r" r r6 r r� �getr r� �MSG_KEX_DH_GEX_GROUPr r; r� r� �r2 � dhGenerator�dhPrimer) r) r* �test_KEX_DH_GEX_REQUEST_OLD" s ��� zEServerSSHTransportDHGroupExchangeBaseCase.test_KEX_DH_GEX_REQUEST_OLDc C s d| j _| �t| j jd� dS )rG N)r� r� rh r r6 rI r) r) r* �%test_KEX_DH_GEX_REQUEST_OLD_badKexAlg9 s zOServerSSHTransportDHGroupExchangeBaseCase.test_KEX_DH_GEX_REQUEST_OLD_badKexAlgc C ro )z� Test that the KEX_DH_GEX_REQUEST message causes the server to reply with a KEX_DH_GEX_GROUP message with the correct Diffie-Hellman group. r� � r� r rq rj N)r� r� rV rW r� r" r r7 r r� rr r r� rs r r; r� r� rt r) r) r* �test_KEX_DH_GEX_REQUESTA s � ��� zAServerSSHTransportDHGroupExchangeBaseCase.test_KEX_DH_GEX_REQUESTc C s� | � � t| jjd| jj�}t�d�d }| �| jj� � j |� t | jj|| jj�}| �| jj |� t ||| jj�}| � � }|�t�| jj�d � |�t�| jj�d � |�t�| jjjd �� �� |�d� |�t�| jj�� |�t�| jj�� |�t�|�� |�|� |�|� |�� }| j�t�|�� | �| jdd� tjt�| jjjd �� �| t�| jjjd � |�� ftj d fg� dS ) z� Test that the KEX_DH_GEX_INIT message after the client sends KEX_DH_GEX_REQUEST_OLD causes the server to send a KEX_DH_GEX_INIT message with a public key and signature. r� s ��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������r rj r� rp ra Nr1 ) rw r< r� r� r� r r; r r� �private_numbersr= r@ r� r� r< r4 r� r= r r> r� r; r� �ssh_KEX_DH_GEX_INITr� r" �MSG_KEX_DH_GEX_REPLYr? r@ rB �r2 rC r> r9 r� rD r� r) r) r* �&test_KEX_DH_GEX_INIT_after_REQUEST_OLDZ sB ������zPServerSSHTransportDHGroupExchangeBaseCase.test_KEX_DH_GEX_INIT_after_REQUEST_OLDc C sb | � � t| jjd| jj�}t�d�d }t| jj|| jj�}t||| jj�}| �� }|� t� | jj �d � |� t� | jj �d � |� t� | jj jd �� �� |� d� |� t�| jj�� |� t�| jj�� |� t�|�� |� |� |� |� |�� }| j�t�|�� | �| jd tjt� | jj jd �� �| t� | jj jd �|�� f� dS ) z� Test that the KEX_DH_GEX_INIT message after the client sends KEX_DH_GEX_REQUEST causes the server to send a KEX_DH_GEX_INIT message with a public key and signature. r� s ����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������r rj r� ry ra N)rz r< r� r� r� r r; r@ r� r< r4 r� r= r r> r� r; r� r| r r� r" r} r? r@ r~ r) r) r* �"test_KEX_DH_GEX_INIT_after_REQUEST� s: �����zLServerSSHTransportDHGroupExchangeBaseCase.test_KEX_DH_GEX_INIT_after_REQUESTN) r& r' r( r] rw rx rz r r� r) r) r) r* rn s (rn c @ r� )�*ServerSSHTransportDHGroupExchangeSHA1TestszJ diffie-hellman-group-exchange-sha1 tests for SSHServerTransport. Nr� r) r) r) r* r� � r� r� c @ r� )�,ServerSSHTransportDHGroupExchangeSHA256TestszL diffie-hellman-group-exchange-sha256 tests for SSHServerTransport. Nr� r) r) r) r* r� � r� r� c @ r� )� ServerSSHTransportECDHBaseCasezE Elliptic Curve Diffie-Hellman tests for SSHServerTransport. c C s� | j g| j_dg| j_| j�| j�� � | jjjd }| jjj d }| j� � }|� � }| j� |�}| j� t�|�� | j�|| j� | jj��}| �� }|�t�| jj�� |�t�| jj�� |�t�| jj�� |�t�| jj�� |�t�|�� �� |�t�|�� |�t�| j� | jj��� |�|� |�� }|�|�} | �| j tj t�|�� �t�| j� | jj�� t�| � ftj dfg� dS )z� Test that the KEXDH_INIT message causes the server to send a KEXDH_REPLY with the server's public key and a signature. r� r1 N) r� r� rV rW r� r" r r r? r> �_generateECPrivateKeyr� �_encodeECPublicKeyr6 r r4 �_generateECSharedSecret�ecPubr� r< r� r� �otherKexInitPayloadr= r� r� r@ r r� rA rB � r2 �privKey�pubKey�ecPrivr� �encPubr� rD r� rE r) r) r* �test_KEX_ECDH_INIT� sF � �����z1ServerSSHTransportECDHBaseCase.test_KEX_ECDH_INITN)r& r' r( r] r� r) r) r) r* r� � r� r� c @ r� )�ServerSSHTransportECDHTestsz: ecdh-sha2-nistp256 tests for SSHServerTransport. Nr� r) r) r) r* r� � r� r� c @ r� )�'ServerSSHTransportCurve25519SHA256Testsz9 curve25519-sha256 tests for SSHServerTransport. Nr� r) r) r) r* r� � r� r� c @ r )�ClientSSHTransportBaseCasez1 Base case for SSHClientTransport tests. r� c C s@ d| _ | �|| j� | �|�dd�t�t|��� �� t� d�S )zC Mock version of SSHClientTransport.verifyHostKey. T� :r1 ) �calledVerifyHostKeyr r� �replace�binascii�hexlifyr r� r �succeed)r2 r� � fingerprintr) r) r* � verifyHostKey s � z(ClientSSHTransportBaseCase.verifyHostKeyc C sB t �| � tj�tj��� | _tj�tj�| _ d| _ | j | j _ d S )NF) r� r� r! r� r� r# r� r� r� �privObjr� r� r� rI r) r) r* r� s z ClientSSHTransportBaseCase.setUpN) r& r' r( r] r" r. r� r r r+ r� r� r� r) r) r) r* r� s r� c @ s� e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$S )%�ClientSSHTransportTestsz' Tests for SSHClientTransport. c C s� | j �d� | �| j jd� | �| j jd� | �| j jd� | �| j jd� | j j}| �|jd� | �|j d� | �|j d� | �|j d� dS )z� Receiving a KEXINIT packet listing multiple supported algorithms will set up the first common algorithm, ordered after our preference. s SSH-2.0-Twisted ����������������� bdiffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256 ssh-dss,ssh-rsa �aes128-ctr,aes128-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc,cast128-ctr,cast128-cbc,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc �aes128-ctr,aes128-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc,cast128-ctr,cast128-cbc,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc hmac-md5,hmac-sha1 hmac-md5,hmac-sha1 zlib,none zlib,none ����r� r� r r r N) r� r� r r� r r r! rl r| r} r r~ r" r) r) r* r$ ! s �z6ClientSSHTransportTests.test_KEXINITMultipleAlgorithmsc C s< | � t| �� j� dd� }| �� �dd�}|�| j��|�S )z� verifyHostKey() should return a Deferred which fails with a NotImplementedError exception. connectionSecure() should raise NotImplementedError(). c S s | � t� d S r� )�trap�NotImplementedErrorr8 r) r) r* � _checkRaisesK r� zNClientSSHTransportTests.test_notImplementedClientMethods.<locals>._checkRaisesN)rh r� r� �connectionSecurer� � addCallback�fail� addErrback)r2 r� �dr) r) r* � test_notImplementedClientMethodsC s z8ClientSSHTransportTests.test_notImplementedClientMethodsc C sj |g| j _| j �| j�� � | j j�� j}| �t � |�dd� d|d � | �| j tj | j j fg� dS )z� Test that a KEXINIT packet with a group1 or group14 key exchange results in a correct KEXDH_INIT response. @param kexAlgorithm: The key exchange algorithm to use @type kexAlgorithm: L{str} r� Nr� r: )r� rV r� r" r r� r{ r= r r r; r� �MSG_KEXDH_INITr� )r2 r� r� r= r) r) r* �assertKexInitResponseForDHQ s "�z2ClientSSHTransportTests.assertKexInitResponseForDHc C rM )zq KEXINIT messages requesting diffie-hellman-group14-sha1 result in KEXDH_INIT responses. r� r� N)r� rI r) r) r* �test_KEXINIT_group14h rO z,ClientSSHTransportTests.test_KEXINIT_group14c C s2 dg| j _| j�� �dd�}| �t| j j|� dS )z� Test that the client raises a ConchError if it receives a KEXINIT message but doesn't have a key exchange algorithm that we understand. s diffie-hellman-group24-sha1s group14s group24N)r� rV r" r r� rh r r� r� r) r) r* �test_KEXINIT_badKexAlgo s z.ClientSSHTransportTests.test_KEXINIT_badKexAlgc C s� dt �d� t �d� t �d� t �d� t �d� t �d� t �d� t �d� t �d� t �d� d d }| j�|� | �| jj� d S ) z� If the server sends "ext-info-s" in its key exchange algorithms, then the client notes that the server supports extension negotiation. See RFC 8308, section 2.1. rJ s/ diffie-hellman-group-exchange-sha256,ext-info-sr� r r r r1 r r N)r r4 r� r� r% rw r% r) r) r* r' y s8 �������� � � � �� z8ClientSSHTransportTests.test_KEXINITExtensionNegotiationc C s� | � � d}t�|�}| jj�� j}| jj}t|||�}t � }|� t� | jj �d � |� t� | jj �d � |� t� | j�� |� | jj� |� |� |� |� |�� }| j�|�}||t� | j�| fS )a Utility for test_KEXDH_REPLY and test_disconnectKEXDH_REPLYBadSignature. Begins a Diffie-Hellman key exchange in the named group Group-14 and computes information needed to return either a correct or incorrect signature. rj )r� r r; r� r� r{ r= r� r@ r r< r4 r� r= r� r� r� r� r@ ) r2 r9 �fMPr= r� r� rD r� rE r) r) r* �begin_KEXDH_REPLY� s z)ClientSSHTransportTests.begin_KEXDH_REPLYc �@ �� � \� }}� �fdd�}�j�|t�|� �}|�|� |S )zH Test that the KEXDH_REPLY message verifies the server. c �* �� | � ���j� ���jj� � d S r� �rA r% r� r r� r� �r �r� r2 r) r* �_cbTestKEXDH_REPLY� � zDClientSSHTransportTests.test_KEXDH_REPLY.<locals>._cbTestKEXDH_REPLY�r� r� �ssh_KEX_DH_GEX_GROUPr r4 r� �r2 rE � packetStartr� r� r) r� r* �test_KEXDH_REPLY� s z(ClientSSHTransportTests.test_KEXDH_REPLYc rP )rQ r� r� r� r� r� r1 c rR rS rT r rI r) r* r� � rU z9ClientSSHTransportTests.test_keySetup.<locals>.<listcomp>rV r rj ra r� r� r� NrW rX r) rI r* rZ � r[ z%ClientSSHTransportTests.test_keySetupc s | � � dg� � fdd�}|| j_t�dddd�| j_| �dd� | �| jj| jj� t � | j_| j� d� | � | jj � | � | jj � | �| jj| jj� | �� d � d | j_| �dd � | j� d� | �| jj � d | j_| �dd � | j� d� | �| jj � d S ) zl Test that NEWKEYS transitions the keys from nextEncryptions to currentEncryptions. Fc r� r� r) r) ��securer) r* �stubConnectionSecure� r� zBClientSSHTransportTests.test_NEWKEYS.<locals>.stubConnectionSecurer r� r� r1 r r_ s GHs IJN)r$ r� r� r" rK rl r� � assertIsNotr0 r^ r` rA r5 rD ra r% r rb r! )r2 r� r) r� r* rc � s. � z$ClientSSHTransportTests.test_NEWKEYSc C s* t � | j_| j�d� | �| jjj� dS )zS Test that the SERVICE_ACCEPT packet starts the requested service. � MockServiceN)r� r� �instance�ssh_SERVICE_ACCEPTr% r� rI r) r) r* �test_SERVICE_ACCEPT� s z+ClientSSHTransportTests.test_SERVICE_ACCEPTc C s( | j �t� � | �| jtjdfg� dS )zP Test that requesting a service sends a SERVICE_REQUEST packet. r� N)r� �requestServicer� r r� r" rk rI r) r) r* �test_requestService� s �z+ClientSSHTransportTests.test_requestServicec �6 � � � \}}}� j�|t�d� �}|�� fdd��S )zL Test that KEXDH_REPLY disconnects if the signature is bad. � bad signaturec � � � tj�S r� �r� r" r� ��_rI r) r* r< r� zPClientSSHTransportTests.test_disconnectKEXDH_REPLYBadSignature.<locals>.<lambda>r� �r2 r� rE r� r� r) rI r* �&test_disconnectKEXDH_REPLYBadSignature � �z>ClientSSHTransportTests.test_disconnectKEXDH_REPLYBadSignaturec C �4 dt �d� t �d� t �d� t �d� t �d� t �d� t �d� t �d� t �d� t �d� d d }| j�|� | j�d � t�t�� t� �| j_ | jj � � | j_ t�t�� t� �}|� � }|� t jjt jj�}t�� | j_d| j_| j�t �t� �� d �� �t �|� t �d � � | �tj� d S � �O Test that KEX_ECDH_REPLY disconnects if the signature is bad. r r r� r r r r1 r r s SSH-2.0-OpenSSH s bad-signatureN�r r4 r� r� r� r �generate_private_key� SECP256R1r r� r� r� � public_bytesr �Encoding�X962� PublicFormat�UncompressedPoint�curver� �_ssh_KEX_ECDH_REPLYr� r� r� r� r" r� �r2 rK �thisPriv�thisPubr� r) r) r* �)test_disconnectKEX_ECDH_REPLYBadSignature �Z �������� � � � �� � ���zAClientSSHTransportTests.test_disconnectKEX_ECDH_REPLYBadSignaturec C rg rh ri rI r) r) r* rj = rk z2ClientSSHTransportTests.test_disconnectNEWKEYSDatac C s" t � | j_| j�d� | �� dS )z� Test that SERVICE_ACCEPT disconnects if the accepted protocol is differet from the asked-for protocol. s badN)r� r� r� r� r� rI r) r) r* � test_disconnectSERVICE_ACCEPTD s z5ClientSSHTransportTests.test_disconnectSERVICE_ACCEPTc C s< t � | j_| j�d� | �| jjj� | �t| j�d� dS )z� Some commercial SSH servers don't send a payload with the SERVICE_ACCEPT message. Conch pretends that it got the correct name of the service. r1 r N) r� r� r� r� r% r� r rd r� rI r) r) r* � test_noPayloadSERVICE_ACCEPTM s z4ClientSSHTransportTests.test_noPayloadSERVICE_ACCEPTN)r& r' r( r] r$ r� r� r� r� r' r� r� rZ rc r� r� r� r� rj r� r� r) r) r) r* r� s& " " . r� c @ sL e Zd ZdZ edd�Zdd� Zdd� Zdd � Zd d � Z d d � Z dd� Z dS )�)ClientSSHTransportDHGroupExchangeBaseCasezE Diffie-Hellman group exchange tests for SSHClientTransport. �� FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA237327FFFFFFFFFFFFFFFF� c C s8 | j g| j_| j�| j�� � | �| jtjdfg� dS )zt KEXINIT packet with a group-exchange key exchange results in a KEX_DH_GEX_REQUEST message. � N) r� r� rV r� r" r r r� �MSG_KEX_DH_GEX_REQUESTrI r) r) r* �test_KEXINIT_groupexchangem s ���zDClientSSHTransportDHGroupExchangeBaseCase.test_KEXINIT_groupexchangec C s� | � � | j�t�| j�t�d� � | �| jj| j� | �| jjd� | jj � � j }| �t�|�dd� d� | �| jj t�t d|| j��� | �| jdd� tj| jj fg� dS )z� Test that the KEX_DH_GEX_GROUP message results in a KEX_DH_GEX_INIT message with the client's Diffie-Hellman public key. rj r� Ns� ������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������ra )r� r� r� r r; �P1536r r� r� r� r{ r= r� r< r� r" �MSG_KEX_DH_GEX_INITrg r) r) r* �test_KEX_DH_GEX_GROUP s � �z?ClientSSHTransportDHGroupExchangeBaseCase.test_KEX_DH_GEX_GROUPc C s� | � � | jj}d}t�|�}t|| jj�� j|�}| � � }|� t� | jj �d � |� t� | jj �d � |� t� | j�� |� d� |� t�| j�t�d� � |� | jj� |� |� |� |� |�� }| j�|�}||t� | j�| fS )a Utility for test_KEX_DH_GEX_REPLY and test_disconnectGEX_REPLYBadSignature. Begins a Diffie-Hellman key exchange in an unnamed (server-specified) group and computes information needed to return either a correct or incorrect signature. r� rj r� )r� r� r� r r; r@ r� r{ r= r� r< r4 r� r= r� r� r� r� r� r@ )r2 r� r9 r� r� rD r� rE r) r) r* �begin_KEX_DH_GEX_REPLY� s" z@ClientSSHTransportDHGroupExchangeBaseCase.begin_KEX_DH_GEX_REPLYc r� )z^ Test that the KEX_DH_GEX_REPLY message results in a verified server. c r� r� r� r� r� r) r* �_cbTestKEX_DH_GEX_REPLY� r� z`ClientSSHTransportDHGroupExchangeBaseCase.test_KEX_DH_GEX_REPLY.<locals>._cbTestKEX_DH_GEX_REPLY�r� r� �ssh_KEX_DH_GEX_REPLYr r4 r� )r2 rE r� r� r� r) r� r* �test_KEX_DH_GEX_REPLY� s z?ClientSSHTransportDHGroupExchangeBaseCase.test_KEX_DH_GEX_REPLYc r� )zQ Test that KEX_DH_GEX_REPLY disconnects if the signature is bad. r� c r� r� r� r� rI r) r* r< � r� z`ClientSSHTransportDHGroupExchangeBaseCase.test_disconnectGEX_REPLYBadSignature.<locals>.<lambda>r� r� r) rI r* �$test_disconnectGEX_REPLYBadSignature� r� zNClientSSHTransportDHGroupExchangeBaseCase.test_disconnectGEX_REPLYBadSignaturec C r� r� r� r� r) r) r* r� � r� zSClientSSHTransportDHGroupExchangeBaseCase.test_disconnectKEX_ECDH_REPLYBadSignatureN) r& r' r( r] �intr� r� r� r� r� r� r� r) r) r) r* r� Y s � r� c @ r� )�*ClientSSHTransportDHGroupExchangeSHA1TestszJ diffie-hellman-group-exchange-sha1 tests for SSHClientTransport. Nr� r) r) r) r* r� � r� r� c @ r� )�,ClientSSHTransportDHGroupExchangeSHA256TestszL diffie-hellman-group-exchange-sha256 tests for SSHClientTransport. Nr� r) r) r) r* r� r� r� c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd S ) � ClientSSHTransportECDHBaseCasezE Elliptic Curve Diffie-Hellman tests for SSHClientTransport. c C sJ | j g| j_| j�| j�� � | �| jtjt � | j� | jj ��fg� dS )zm KEXINIT packet with an elliptic curve key exchange results in a KEXDH_INIT message. N) r� r� rV r� r" r r r� r� r r4 r� r� rI r) r) r* � test_KEXINIT s ���z+ClientSSHTransportECDHBaseCase.test_KEXINITc C s. | � � t� �� d }t� �� d }| j�� }|�� }| j�|�}| j�|| j�| jj ��}| � � }|� t � | jj�� |� t � | jj�� |� t � | jj�� |� t � | jj�� |� t � |�� �� |� t � | j�| jj ��� |� t � |�� |� |� |�� }|�|�} || t � |�� �t � |� fS )a Utility for test_KEXDH_REPLY and test_disconnectKEXDH_REPLYBadSignature. Begins an Elliptic Curve Diffie-Hellman key exchange and computes information needed to return either a correct or incorrect signature. r� )r� r� r� r� r� r� r� r� r� r� r� r< r r4 r� r� r= r� r� r� r@ r� r) r) r* r� & s* � z0ClientSSHTransportECDHBaseCase.begin_KEXDH_REPLYc r� )zO Test that the KEXDH_REPLY message completes the key exchange. c r� r� r� r� r� r) r* r� P r� zKClientSSHTransportECDHBaseCase.test_KEXDH_REPLY.<locals>._cbTestKEXDH_REPLYr� r� r) r� r* r� J s z/ClientSSHTransportECDHBaseCase.test_KEXDH_REPLYc r� )r� r� c r� r� r� r� rI r) r* r< a r� zWClientSSHTransportECDHBaseCase.test_disconnectKEXDH_REPLYBadSignature.<locals>.<lambda>r� r� r) rI r* r� Y r� zEClientSSHTransportECDHBaseCase.test_disconnectKEXDH_REPLYBadSignatureN)r& r' r( r] r� r� r� r� r) r) r) r* r� s $ r� c @ r� )�ClientSSHTransportECDHTestsz: ecdh-sha2-nistp256 tests for SSHClientTransport. Nr� r) r) r) r* r� e r� r� c @ r� )�'ClientSSHTransportCurve25519SHA256Testsz9 curve25519-sha256 tests for SSHClientTransport. Nr� r) r) r) r* r� m r� r� c @ s` e Zd ZdZer eZdd� Zdd� Zdd� Zdd � Z d d � Z d d � Z dd� Z dd� Z dd� ZdS )� GetMACTestsz* Tests for L{SSHCiphers._getMAC}. c C s t �dddd�| _d S )NrG r4 rH rI )r" rK rN rI r) r) r* r� ~ r� zGetMACTests.setUpc C s t d�S )z� Generate a new shared secret to be used with the tests. @return: A new secret. @rtype: L{bytes} �@ r rI r) r) r* �getSharedSecret� s zGetMACTests.getSharedSecretc C s| | � � }| j�||�}|d|� d| }tdd� t|�D ��}tdd� t|�D ��} | �||| |f|� | �||j� dS )a� Check that when L{SSHCiphers._getMAC} is called with a supportd HMAC algorithm name it returns a tuple of (digest object, inner pad, outer pad, digest size) with a C{key} attribute set to the value of the key supplied. @param hmacName: Identifier of HMAC algorithm. @type hmacName: L{bytes} @param hashProcessor: Callable for the hash algorithm. @type hashProcessor: C{callable} @param digestSize: Size of the digest for algorithm. @type digestSize: L{int} @param blockPadSize: Size of padding applied to the shared secret to match the block size. @type blockPadSize: L{int} Nr c s � � | ] }t |�d A V qdS )�6 N�r- �r� �br) r) r* r� � � � z+GetMACTests.assertGetMAC.<locals>.<genexpr>c s r� )�\ Nr� r� r) r) r* r� � r� )r� rN �_getMACrn r r r� ) r2 �hmacNamer� � digestSize� blockPadSize�secret�paramsr� �innerPad�outerPadr) r) r* � assertGetMAC� s zGetMACTests.assertGetMACc C � | j dtddd� dS )a When L{SSHCiphers._getMAC} is called with the C{b"hmac-sha2-512"} MAC algorithm name it returns a tuple of (sha512 digest object, inner pad, outer pad, sha512 digest size) with a C{key} attribute set to the value of the key supplied. s hmac-sha2-512r� �r r N)r r rI r) r) r* �test_hmacsha2512� � z GetMACTests.test_hmacsha2512c C � | j dtddd� dS )a When L{SSHCiphers._getMAC} is called with the C{b"hmac-sha2-384"} MAC algorithm name it returns a tuple of (sha384 digest object, inner pad, outer pad, sha384 digest size) with a C{key} attribute set to the value of the key supplied. s hmac-sha2-384�0 �P r N)r r rI r) r) r* �test_hmacsha2384� r z GetMACTests.test_hmacsha2384c C r )a When L{SSHCiphers._getMAC} is called with the C{b"hmac-sha2-256"} MAC algorithm name it returns a tuple of (sha256 digest object, inner pad, outer pad, sha256 digest size) with a C{key} attribute set to the value of the key supplied. s hmac-sha2-256� r N)r r rI r) r) r* �test_hmacsha2256� r z GetMACTests.test_hmacsha2256c C r )a When L{SSHCiphers._getMAC} is called with the C{b"hmac-sha1"} MAC algorithm name it returns a tuple of (sha1 digest object, inner pad, outer pad, sha1 digest size) with a C{key} attribute set to the value of the key supplied. r � �, r N)r r rI r) r) r* � test_hmacsha1� r zGetMACTests.test_hmacsha1c C r )a When L{SSHCiphers._getMAC} is called with the C{b"hmac-md5"} MAC algorithm name it returns a tuple of (md5 digest object, inner pad, outer pad, md5 digest size) with a C{key} attribute set to the value of the key supplied. r r� r r N)r r rI r) r) r* � test_hmacmd5� r zGetMACTests.test_hmacmd5c C s& | � � }| j�d|�}| �d|� dS )z� When L{SSHCiphers._getMAC} is called with the C{b"none"} MAC algorithm name it returns a tuple of (None, "", "", 0). r )Nr1 r1 r N)r� rN r� r )r2 r� r r) r) r* � test_none� s zGetMACTests.test_noneN)r& r' r( r] r r7 r� r� r r r r r r r r) r) r) r* r� v s r� c @ �@ e Zd ZdZer eZdd� Zdd� Zdd� Zdd � Z d d � Z d S ) �SSHCiphersTestsz0 Tests for the SSHCiphers helper class. c C sL t �dddd�}| �|jd� | �|jd� | �|jd� | �|jd� dS )zJ Test that the initializer sets up the SSHCiphers object. rG r4 rH rI N)r" rK r r| r} r r~ )r2 rN r) r) r* � test_init� s zSSHCiphersTests.test_initc C sj t �dddd�}d }}|j�� D ]!\}\}}}|�|||�}|dkr+| �|t j� q| �|j|� qdS )zM Test that the _getCipher method returns the correct cipher. rG r4 rH rI rJ r N)r" rK � cipherMapr� rM �assertIsInstance� _DummyCipher� algorithm) r2 rN rO r� rP �algClass�keySize�counter�cipr) r) r* �test_getCipher� s �z SSHCiphersTests.test_getCipherc C s: d}t jjD ]�}t jj| \}}}t �|ddd�}t �d|dd�}|�|||�}|jjd } |�||dddd� |�dd||dd� | � |j | � | � |j | � |� � } | � |d| � �} | � |d| � �} | � |�|d| � �| � | � |�|d| � �| � | � |�| �|d| � � | � |�| �|d| � � qdS )z8 Test that setKeys sets up the ciphers. �@ r r: r1 N)r" r+ rL rK r rM r � block_sizer{ r re rk � encryptorr< rh rl ) r2 r� rP �modNamer r � encCipher� decCipherr �bsr$ �enc�enc2r) r) r* �test_setKeysCiphers s& �z#SSHCiphersTests.test_setKeysCiphersc C s� d}t jj�� D ]s\}}t �dd|d�}t �ddd|�}|�dddd|d� |�ddddd|� |r7|� j}nd}| �|j|� |rL|�||�\}}}}d} |} d| } |re||||| �� � �� � } nd} | �|� | | �| � | � |� | | | �� qdS )z5 Test that setKeys sets up the MACs. r" r r1 r r N) r" rK �macMapr� r{ � digest_sizer r� r� r� rq r% rt ) r2 r� �macName�mod�outMac�inMac�ds�i�o�seqidr� r[ �macr) r) r* �test_setKeysMACs s* �z SSHCiphersTests.test_setKeysMACsc C s� g d�}|D ]9\}}}t �dddd�}|�d|�|_t�d|dd� �\}|dd� }| �|t�|� ||��d|�d|��� qdS ) z� L{SSHCiphers.makeMAC} computes the HMAC of an outgoing SSH message with a particular sequence id and content data. ))s s Hi Theres 9294727a3638bb1c13f48ef8158bfc9d)s Jefes what do ya want for nothing?s 750c783e6ab0b503eaa86e310a5db738)r s2 ��������������������������������������������������s 56be34521d144c88dbb8c733f0e8b3f6r r z>LNr� z Failed HMAC test vector; key=z data=) r" rK r� r� �struct�unpackr r� r� rq )r2 �vectorsr� r� r6 r� r5 � shortenedr) r) r* � test_makeMAC2 s ��z SSHCiphersTests.test_makeMACN) r& r' r( r] r r7 r r! r+ r7 r< r) r) r) r* r � s r c @ r ) �TransportLoopbackTestszL Test the server transport and client transport against each other, c s� t � }t�� �|�_|�� g �_�fdd��_t�� � dd� � _g � _� fdd�� _� fdd�� _ t �j� � � � ��_ |���|� �� �fdd�}t��� �}|�|�� � |S )z� Run an async client and server, modifying each using the mod function provided. Returns a Deferred called back when both Protocols have disconnected. @type mod: C{func} @rtype: C{defer.Deferred} c � � j �| |f�S r� rL ��code�desc)�serverr) r* r< d � z9TransportLoopbackTests._runClientServer.<locals>.<lambda>c S s t �d �S r� )r r� )r= r> r) r) r* r< f s c r> r� rL r? ��clientr) r* r< h rC c s � � � S r� )r� r) rD r) r* r< i s c s� t |jd |jd |jd |jd g�}� �|jg � � �|jtjdfg� |jd dkr>� � |� � |� � � |� � |� n� � |� � |� � � |� � |� |jd dkrg� � |� � |� � � |� � |� d S � � |� � |� � � |� � |� d S )Nr s user closed connectionr ) �reprrL rX rV rY r rD r" r� r# r� r% r� )�ignoredrB rE r� rI r) r* �checkn s, �� �z6TransportLoopbackTests._runClientServer.<locals>.check)r� r" r- r r rD rP r. r� r� �listr� r! rW r � loopbackAsyncr� )r2 r/ r rH r� r) )rE r2 rB r* �_runClientServerV s$ z'TransportLoopbackTests._runClientServerc �B g }t jjdg D ]� � fdd�}|�| �|�� q tj|dd�S )z{ Test that the client and server play nicely together, in all the various combinations of ciphers. r c � � g| _ | S r� r r� ��cipherr) r* � setCipher� � z6TransportLoopbackTests.test_ciphers.<locals>.setCipherT��fireOnOneErrback)r" r+ rL rM rK r � DeferredList)r2 � deferredsrP r) rN r* � test_ciphers� s z#TransportLoopbackTests.test_ciphersc rL )z> Like test_ciphers, but for the various MACs. r c rM r� r r� �r6 r) r* �setMAC� rQ z0TransportLoopbackTests.test_macs.<locals>.setMACTrR )r" r+ rX rM rK r rT )r2 rU rX r) rW r* � test_macs� s z TransportLoopbackTests.test_macsc �< g }t jjD ]� � fdd�}|�| �|�� qtj|dd�S )zG Like test_ciphers, but for the various key exchanges. c rM r� r� r� �r� r) r* �setKeyExchange� rQ z@TransportLoopbackTests.test_keyexchanges.<locals>.setKeyExchangeTrR )r" r+ rV rM rK r rT )r2 rU r\ r) r[ r* �test_keyexchanges� � z(TransportLoopbackTests.test_keyexchangesc rZ )zF Like test_ciphers, but for the various compressions. c rM r� r r� �� compressionr) r* �setCompression� rQ z@TransportLoopbackTests.test_compressions.<locals>.setCompressionTrR )r" r+ rY rM rK r rT )r2 rU ra r) r_ r* �test_compressions� r^ z(TransportLoopbackTests.test_compressionsN) r& r' r( r] r r7 rK rV rY r] rb r) r) r) r* r= N s 7 r= )kr] r� r r r8 r� �hashlibr r r r r �typingr r �twistedr r �twisted.conch.errorr �twisted.conch.sshr r r �twisted.internetr �twisted.protocolsr �twisted.pythonr �twisted.python.compatr �twisted.python.randbytesr �twisted.python.reflectr � twisted.testr �twisted.trial.unittestr r r �strr� r �cryptography.exceptionsr � cryptography.hazmat.backendsr � cryptography.hazmat.primitivesr �)cryptography.hazmat.primitives.asymmetricr r r r r! r" �twisted.conch.testr# �x25519_supportedr6 r: r@ r+ rB r^ r� � SSHServicer� r/ r� r� r� r� r� r� r� r r r r r� r� r� r� r� r� r r rn r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r= r) r) r) r* �<module> s EA#+= ; � � � �e g � � 5� � ? #� � V� �km
修改文件时间
将文件时间修改为当前时间的前一年
删除文件