1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
|
# Copyright (C) 2008 Robey Pointer <robeypointer@gmail.com>
#
# This file is part of paramiko.
#
# Paramiko is free software; you can redistribute it and/or modify it under the
# terms of the GNU Lesser General Public License as published by the Free
# Software Foundation; either version 2.1 of the License, or (at your option)
# any later version.
#
# Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
# details.
#
# You should have received a copy of the GNU Lesser General Public License
# along with Paramiko; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
"""
Some unit tests for authenticating over a Transport.
"""
import unittest
from pytest import raises
from paramiko import (
DSSKey,
BadAuthenticationType,
AuthenticationException,
)
from ._util import _support, server, unicodey
class AuthHandler_:
def bad_auth_type(self):
"""
verify that we get the right exception when an unsupported auth
type is requested.
"""
# Server won't allow password auth for this user, so should fail
# and return just publickey allowed types
with server(
connect=dict(username="unknown", password="error"),
catch_error=True,
) as (_, _, err):
assert isinstance(err, BadAuthenticationType)
assert err.allowed_types == ["publickey"]
def bad_password(self):
"""
verify that a bad password gets the right exception, and that a retry
with the right password works.
"""
# NOTE: Transport.connect doesn't do any auth upfront if no userauth
# related kwargs given.
with server(defer=True) as (tc, ts):
# Auth once, badly
with raises(AuthenticationException):
tc.auth_password(username="slowdive", password="error")
# And again, correctly
tc.auth_password(username="slowdive", password="pygmalion")
def multipart_auth(self):
"""
verify that multipart auth works.
"""
with server(defer=True) as (tc, ts):
assert tc.auth_password(
username="paranoid", password="paranoid"
) == ["publickey"]
key = DSSKey.from_private_key_file(_support("dss.key"))
assert tc.auth_publickey(username="paranoid", key=key) == []
def interactive_auth(self):
"""
verify keyboard-interactive auth works.
"""
def handler(title, instructions, prompts):
self.got_title = title
self.got_instructions = instructions
self.got_prompts = prompts
return ["cat"]
with server(defer=True) as (tc, ts):
assert tc.auth_interactive("commie", handler) == []
assert self.got_title == "password"
assert self.got_prompts == [("Password", False)]
def interactive_fallback(self):
"""
verify that a password auth attempt will fallback to "interactive"
if password auth isn't supported but interactive is.
"""
with server(defer=True) as (tc, ts):
# This username results in an allowed_auth of just kbd-int,
# and has a configured interactive->response on the server.
assert tc.auth_password("commie", "cat") == []
def utf8(self):
"""
verify that utf-8 encoding happens in authentication.
"""
with server(defer=True) as (tc, ts):
assert tc.auth_password("utf8", unicodey) == []
def non_utf8(self):
"""
verify that non-utf-8 encoded passwords can be used for broken
servers.
"""
with server(defer=True) as (tc, ts):
assert tc.auth_password("non-utf8", "\xff") == []
def auth_exception_when_disconnected(self):
"""
verify that we catch a server disconnecting during auth, and report
it as an auth failure.
"""
with server(defer=True, skip_verify=True) as (tc, ts), raises(
AuthenticationException
):
tc.auth_password("bad-server", "hello")
def non_responsive_triggers_auth_exception(self):
"""
verify that authentication times out if server takes to long to
respond (or never responds).
"""
with server(defer=True, skip_verify=True) as (tc, ts), raises(
AuthenticationException
) as info:
tc.auth_timeout = 1 # 1 second, to speed up test
tc.auth_password("unresponsive-server", "hello")
assert "Authentication timeout" in str(info.value)
|
