Index: third_party/twisted_8_1/twisted/conch/checkers.py |
diff --git a/third_party/twisted_8_1/twisted/conch/checkers.py b/third_party/twisted_8_1/twisted/conch/checkers.py |
deleted file mode 100644 |
index 90512f4683c0fb33aadf961bd7a21a6f4b9e2e39..0000000000000000000000000000000000000000 |
--- a/third_party/twisted_8_1/twisted/conch/checkers.py |
+++ /dev/null |
@@ -1,176 +0,0 @@ |
-import os, base64, binascii |
-try: |
- import pwd |
-except ImportError: |
- pwd = None |
-else: |
- import crypt |
- |
-try: |
- # get this from http://www.twistedmatrix.com/users/z3p/files/pyshadow-0.2.tar.gz |
- import shadow |
-except: |
- shadow = None |
- |
-try: |
- import pamauth |
-except ImportError: |
- pamauth = None |
- |
-from twisted.conch import error |
-from twisted.conch.ssh import keys |
-from twisted.cred.checkers import ICredentialsChecker |
-from twisted.cred.credentials import IUsernamePassword, ISSHPrivateKey, IPluggableAuthenticationModules |
-from twisted.cred.error import UnauthorizedLogin, UnhandledCredentials |
-from twisted.internet import defer |
-from twisted.python import failure, reflect, log |
-from zope import interface |
- |
-def verifyCryptedPassword(crypted, pw): |
- if crypted[0] == '$': # md5_crypt encrypted |
- salt = '$1$' + crypted.split('$')[2] |
- else: |
- salt = crypted[:2] |
- return crypt.crypt(pw, salt) == crypted |
- |
-class UNIXPasswordDatabase: |
- credentialInterfaces = IUsernamePassword, |
- interface.implements(ICredentialsChecker) |
- |
- def requestAvatarId(self, credentials): |
- if pwd: |
- try: |
- cryptedPass = pwd.getpwnam(credentials.username)[1] |
- except KeyError: |
- return defer.fail(UnauthorizedLogin()) |
- else: |
- if cryptedPass not in ['*', 'x'] and \ |
- verifyCryptedPassword(cryptedPass, credentials.password): |
- return defer.succeed(credentials.username) |
- if shadow: |
- gid = os.getegid() |
- uid = os.geteuid() |
- os.setegid(0) |
- os.seteuid(0) |
- try: |
- shadowPass = shadow.getspnam(credentials.username)[1] |
- except KeyError: |
- os.setegid(gid) |
- os.seteuid(uid) |
- return defer.fail(UnauthorizedLogin()) |
- os.setegid(gid) |
- os.seteuid(uid) |
- if verifyCryptedPassword(shadowPass, credentials.password): |
- return defer.succeed(credentials.username) |
- return defer.fail(UnauthorizedLogin()) |
- |
- return defer.fail(UnauthorizedLogin()) |
- |
- |
-class SSHPublicKeyDatabase: |
- credentialInterfaces = ISSHPrivateKey, |
- interface.implements(ICredentialsChecker) |
- |
- def requestAvatarId(self, credentials): |
- d = defer.maybeDeferred(self.checkKey, credentials) |
- d.addCallback(self._cbRequestAvatarId, credentials) |
- d.addErrback(self._ebRequestAvatarId) |
- return d |
- |
- def _cbRequestAvatarId(self, validKey, credentials): |
- if not validKey: |
- return failure.Failure(UnauthorizedLogin()) |
- if not credentials.signature: |
- return failure.Failure(error.ValidPublicKey()) |
- else: |
- try: |
- pubKey = keys.getPublicKeyObject(data = credentials.blob) |
- if keys.verifySignature(pubKey, credentials.signature, |
- credentials.sigData): |
- return credentials.username |
- except: # any error should be treated as a failed login |
- f = failure.Failure() |
- log.err() |
- return f |
- return failure.Failure(UnauthorizedLogin()) |
- |
- def checkKey(self, credentials): |
- sshDir = os.path.expanduser('~%s/.ssh/' % credentials.username) |
- if sshDir.startswith('~'): # didn't expand |
- return 0 |
- uid, gid = os.geteuid(), os.getegid() |
- ouid, ogid = pwd.getpwnam(credentials.username)[2:4] |
- os.setegid(0) |
- os.seteuid(0) |
- os.setegid(ogid) |
- os.seteuid(ouid) |
- for name in ['authorized_keys2', 'authorized_keys']: |
- if not os.path.exists(sshDir+name): |
- continue |
- lines = open(sshDir+name).xreadlines() |
- os.setegid(0) |
- os.seteuid(0) |
- os.setegid(gid) |
- os.seteuid(uid) |
- for l in lines: |
- l2 = l.split() |
- if len(l2) < 2: |
- continue |
- try: |
- if base64.decodestring(l2[1]) == credentials.blob: |
- return 1 |
- except binascii.Error: |
- continue |
- return 0 |
- |
- def _ebRequestAvatarId(self, f): |
- if not f.check(UnauthorizedLogin, error.ValidPublicKey): |
- log.msg(f) |
- return failure.Failure(UnauthorizedLogin()) |
- return f |
- |
- |
-class SSHProtocolChecker: |
- interface.implements(ICredentialsChecker) |
- |
- checkers = {} |
- |
- successfulCredentials = {} |
- |
- def get_credentialInterfaces(self): |
- return self.checkers.keys() |
- |
- credentialInterfaces = property(get_credentialInterfaces) |
- |
- def registerChecker(self, checker, *credentialInterfaces): |
- if not credentialInterfaces: |
- credentialInterfaces = checker.credentialInterfaces |
- for credentialInterface in credentialInterfaces: |
- self.checkers[credentialInterface] = checker |
- |
- def requestAvatarId(self, credentials): |
- ifac = interface.providedBy(credentials) |
- for i in ifac: |
- c = self.checkers.get(i) |
- if c is not None: |
- return c.requestAvatarId(credentials).addCallback( |
- self._cbGoodAuthentication, credentials) |
- return defer.fail(UnhandledCredentials("No checker for %s" % \ |
- ', '.join(map(reflect.qal, ifac)))) |
- |
- def _cbGoodAuthentication(self, avatarId, credentials): |
- if avatarId not in self.successfulCredentials: |
- self.successfulCredentials[avatarId] = [] |
- self.successfulCredentials[avatarId].append(credentials) |
- if self.areDone(avatarId): |
- del self.successfulCredentials[avatarId] |
- return avatarId |
- else: |
- raise error.NotEnoughAuthentication() |
- |
- def areDone(self, avatarId): |
- """Override to determine if the authentication is finished for a given |
- avatarId. |
- """ |
- return 1 |
- |