90 lines
2.9 KiB
Python
90 lines
2.9 KiB
Python
|
# Copyright (c) Twisted Matrix Laboratories.
|
||
|
|
# See LICENSE for details.
|
||
|
|
|
||
|
|
"""
|
||
|
|
Tests for L{twisted.cred}'s implementation of CRAM-MD5.
|
||
|
|
"""
|
||
|
|
|
||
|
|
|
||
|
|
import hashlib
|
||
|
|
from binascii import hexlify
|
||
|
|
from hmac import HMAC
|
||
|
|
|
||
|
|
from twisted.cred.credentials import CramMD5Credentials, IUsernameHashedPassword
|
||
|
|
from twisted.trial.unittest import TestCase
|
||
|
|
|
||
|
|
|
||
|
|
class CramMD5CredentialsTests(TestCase):
|
||
|
|
"""
|
||
|
|
Tests for L{CramMD5Credentials}.
|
||
|
|
"""
|
||
|
|
|
||
|
|
def test_idempotentChallenge(self) -> None:
|
||
|
|
"""
|
||
|
|
The same L{CramMD5Credentials} will always provide the same challenge,
|
||
|
|
no matter how many times it is called.
|
||
|
|
"""
|
||
|
|
c = CramMD5Credentials()
|
||
|
|
chal = c.getChallenge()
|
||
|
|
self.assertEqual(chal, c.getChallenge())
|
||
|
|
|
||
|
|
def test_checkPassword(self) -> None:
|
||
|
|
"""
|
||
|
|
When a valid response (which is a hex digest of the challenge that has
|
||
|
|
been encrypted by the user's shared secret) is set on the
|
||
|
|
L{CramMD5Credentials} that created the challenge, and C{checkPassword}
|
||
|
|
is called with the user's shared secret, it will return L{True}.
|
||
|
|
"""
|
||
|
|
c = CramMD5Credentials()
|
||
|
|
chal = c.getChallenge()
|
||
|
|
c.response = hexlify(HMAC(b"secret", chal, digestmod=hashlib.md5).digest())
|
||
|
|
self.assertTrue(c.checkPassword(b"secret"))
|
||
|
|
|
||
|
|
def test_noResponse(self) -> None:
|
||
|
|
"""
|
||
|
|
When there is no response set, calling C{checkPassword} will return
|
||
|
|
L{False}.
|
||
|
|
"""
|
||
|
|
c = CramMD5Credentials()
|
||
|
|
self.assertFalse(c.checkPassword(b"secret"))
|
||
|
|
|
||
|
|
def test_wrongPassword(self) -> None:
|
||
|
|
"""
|
||
|
|
When an invalid response is set on the L{CramMD5Credentials} (one that
|
||
|
|
is not the hex digest of the challenge, encrypted with the user's shared
|
||
|
|
secret) and C{checkPassword} is called with the user's correct shared
|
||
|
|
secret, it will return L{False}.
|
||
|
|
"""
|
||
|
|
c = CramMD5Credentials()
|
||
|
|
chal = c.getChallenge()
|
||
|
|
c.response = hexlify(
|
||
|
|
HMAC(b"thewrongsecret", chal, digestmod=hashlib.md5).digest()
|
||
|
|
)
|
||
|
|
self.assertFalse(c.checkPassword(b"secret"))
|
||
|
|
|
||
|
|
def test_setResponse(self) -> None:
|
||
|
|
"""
|
||
|
|
When C{setResponse} is called with a string that is the username and
|
||
|
|
the hashed challenge separated with a space, they will be set on the
|
||
|
|
L{CramMD5Credentials}.
|
||
|
|
"""
|
||
|
|
c = CramMD5Credentials()
|
||
|
|
chal = c.getChallenge()
|
||
|
|
c.setResponse(
|
||
|
|
b" ".join(
|
||
|
|
(
|
||
|
|
b"squirrel",
|
||
|
|
hexlify(HMAC(b"supersecret", chal, digestmod=hashlib.md5).digest()),
|
||
|
|
)
|
||
|
|
)
|
||
|
|
)
|
||
|
|
self.assertTrue(c.checkPassword(b"supersecret"))
|
||
|
|
self.assertEqual(c.username, b"squirrel")
|
||
|
|
|
||
|
|
def test_interface(self) -> None:
|
||
|
|
"""
|
||
|
|
L{CramMD5Credentials} implements the L{IUsernameHashedPassword}
|
||
|
|
interface.
|
||
|
|
"""
|
||
|
|
self.assertTrue(IUsernameHashedPassword.implementedBy(CramMD5Credentials))
|