RAHHH

backend/lib/python3.12/site-packages/twisted/cred/test/__init__.py

@@ -0,0 +1,7 @@
+# -*- test-case-name: twisted.cred.test -*-
+# Copyright (c) Twisted Matrix Laboratories.
+# See LICENSE for details.
+
+"""
+Unit tests for C{twisted.cred}.
+"""

backend/lib/python3.12/site-packages/twisted/cred/test/test_cramauth.py

@@ -0,0 +1,89 @@
+# Copyright (c) Twisted Matrix Laboratories.
+# See LICENSE for details.
+
+"""
+Tests for L{twisted.cred}'s implementation of CRAM-MD5.
+"""
+
+
+import hashlib
+from binascii import hexlify
+from hmac import HMAC
+
+from twisted.cred.credentials import CramMD5Credentials, IUsernameHashedPassword
+from twisted.trial.unittest import TestCase
+
+
+class CramMD5CredentialsTests(TestCase):
+    """
+    Tests for L{CramMD5Credentials}.
+    """
+
+    def test_idempotentChallenge(self) -> None:
+        """
+        The same L{CramMD5Credentials} will always provide the same challenge,
+        no matter how many times it is called.
+        """
+        c = CramMD5Credentials()
+        chal = c.getChallenge()
+        self.assertEqual(chal, c.getChallenge())
+
+    def test_checkPassword(self) -> None:
+        """
+        When a valid response (which is a hex digest of the challenge that has
+        been encrypted by the user's shared secret) is set on the
+        L{CramMD5Credentials} that created the challenge, and C{checkPassword}
+        is called with the user's shared secret, it will return L{True}.
+        """
+        c = CramMD5Credentials()
+        chal = c.getChallenge()
+        c.response = hexlify(HMAC(b"secret", chal, digestmod=hashlib.md5).digest())
+        self.assertTrue(c.checkPassword(b"secret"))
+
+    def test_noResponse(self) -> None:
+        """
+        When there is no response set, calling C{checkPassword} will return
+        L{False}.
+        """
+        c = CramMD5Credentials()
+        self.assertFalse(c.checkPassword(b"secret"))
+
+    def test_wrongPassword(self) -> None:
+        """
+        When an invalid response is set on the L{CramMD5Credentials} (one that
+        is not the hex digest of the challenge, encrypted with the user's shared
+        secret) and C{checkPassword} is called with the user's correct shared
+        secret, it will return L{False}.
+        """
+        c = CramMD5Credentials()
+        chal = c.getChallenge()
+        c.response = hexlify(
+            HMAC(b"thewrongsecret", chal, digestmod=hashlib.md5).digest()
+        )
+        self.assertFalse(c.checkPassword(b"secret"))
+
+    def test_setResponse(self) -> None:
+        """
+        When C{setResponse} is called with a string that is the username and
+        the hashed challenge separated with a space, they will be set on the
+        L{CramMD5Credentials}.
+        """
+        c = CramMD5Credentials()
+        chal = c.getChallenge()
+        c.setResponse(
+            b" ".join(
+                (
+                    b"squirrel",
+                    hexlify(HMAC(b"supersecret", chal, digestmod=hashlib.md5).digest()),
+                )
+            )
+        )
+        self.assertTrue(c.checkPassword(b"supersecret"))
+        self.assertEqual(c.username, b"squirrel")
+
+    def test_interface(self) -> None:
+        """
+        L{CramMD5Credentials} implements the L{IUsernameHashedPassword}
+        interface.
+        """
+        self.assertTrue(IUsernameHashedPassword.implementedBy(CramMD5Credentials))

backend/lib/python3.12/site-packages/twisted/cred/test/test_cred.py

@@ -0,0 +1,461 @@
+# Copyright (c) Twisted Matrix Laboratories.
+# See LICENSE for details.
+
+"""
+Tests for L{twisted.cred}, now with 30% more starch.
+"""
+
+
+from binascii import hexlify, unhexlify
+
+from zope.interface import Interface, implementer
+
+from twisted.cred import checkers, credentials, error, portal
+from twisted.internet import defer
+from twisted.python import components
+from twisted.python.versions import Version
+from twisted.trial import unittest
+
+try:
+    from crypt import crypt as _crypt
+except ImportError:
+    crypt = None
+else:
+    crypt = _crypt
+
+
+# The Twisted version in which UsernameHashedPassword is first deprecated.
+_uhpVersion = Version("Twisted", 21, 2, 0)
+
+
+class ITestable(Interface):
+    """
+    An interface for a theoretical protocol.
+    """
+
+    pass
+
+
+class TestAvatar:
+    """
+    A test avatar.
+    """
+
+    def __init__(self, name):
+        self.name = name
+        self.loggedIn = False
+        self.loggedOut = False
+
+    def login(self):
+        assert not self.loggedIn
+        self.loggedIn = True
+
+    def logout(self):
+        self.loggedOut = True
+
+
+@implementer(ITestable)
+class Testable(components.Adapter):
+    """
+    A theoretical protocol for testing.
+    """
+
+    pass
+
+
+components.registerAdapter(Testable, TestAvatar, ITestable)
+
+
+class IDerivedCredentials(credentials.IUsernamePassword):
+    pass
+
+
+@implementer(IDerivedCredentials, ITestable)
+class DerivedCredentials:
+    def __init__(self, username, password):
+        self.username = username
+        self.password = password
+
+    def checkPassword(self, password):
+        return password == self.password
+
+
+@implementer(portal.IRealm)
+class TestRealm:
+    """
+    A basic test realm.
+    """
+
+    def __init__(self):
+        self.avatars = {}
+
+    def requestAvatar(self, avatarId, mind, *interfaces):
+        if avatarId in self.avatars:
+            avatar = self.avatars[avatarId]
+        else:
+            avatar = TestAvatar(avatarId)
+            self.avatars[avatarId] = avatar
+        avatar.login()
+        return (interfaces[0], interfaces[0](avatar), avatar.logout)
+
+
+class CredTests(unittest.TestCase):
+    """
+    Tests for the meat of L{twisted.cred} -- realms, portals, avatars, and
+    checkers.
+    """
+
+    def setUp(self):
+        self.realm = TestRealm()
+        self.portal = portal.Portal(self.realm)
+        self.checker = checkers.InMemoryUsernamePasswordDatabaseDontUse()
+        self.checker.addUser(b"bob", b"hello")
+        self.portal.registerChecker(self.checker)
+
+    def test_listCheckers(self):
+        """
+        The checkers in a portal can check only certain types of credentials.
+        Since this portal has
+        L{checkers.InMemoryUsernamePasswordDatabaseDontUse} registered, it
+        """
+        expected = [credentials.IUsernamePassword, credentials.IUsernameHashedPassword]
+        got = self.portal.listCredentialsInterfaces()
+        self.assertEqual(sorted(got), sorted(expected))
+
+    def test_basicLogin(self):
+        """
+        Calling C{login} on a portal with correct credentials and an interface
+        that the portal's realm supports works.
+        """
+        login = self.successResultOf(
+            self.portal.login(
+                credentials.UsernamePassword(b"bob", b"hello"), self, ITestable
+            )
+        )
+        iface, impl, logout = login
+
+        # whitebox
+        self.assertEqual(iface, ITestable)
+        self.assertTrue(iface.providedBy(impl), f"{impl} does not implement {iface}")
+
+        # greybox
+        self.assertTrue(impl.original.loggedIn)
+        self.assertTrue(not impl.original.loggedOut)
+        logout()
+        self.assertTrue(impl.original.loggedOut)
+
+    def test_derivedInterface(self):
+        """
+        Logging in with correct derived credentials and an interface
+        that the portal's realm supports works.
+        """
+        login = self.successResultOf(
+            self.portal.login(DerivedCredentials(b"bob", b"hello"), self, ITestable)
+        )
+        iface, impl, logout = login
+
+        # whitebox
+        self.assertEqual(iface, ITestable)
+        self.assertTrue(iface.providedBy(impl), f"{impl} does not implement {iface}")
+
+        # greybox
+        self.assertTrue(impl.original.loggedIn)
+        self.assertTrue(not impl.original.loggedOut)
+        logout()
+        self.assertTrue(impl.original.loggedOut)
+
+    def test_failedLoginPassword(self):
+        """
+        Calling C{login} with incorrect credentials (in this case a wrong
+        password) causes L{error.UnauthorizedLogin} to be raised.
+        """
+        login = self.failureResultOf(
+            self.portal.login(
+                credentials.UsernamePassword(b"bob", b"h3llo"), self, ITestable
+            )
+        )
+        self.assertTrue(login)
+        self.assertEqual(error.UnauthorizedLogin, login.type)
+
+    def test_failedLoginName(self):
+        """
+        Calling C{login} with incorrect credentials (in this case no known
+        user) causes L{error.UnauthorizedLogin} to be raised.
+        """
+        login = self.failureResultOf(
+            self.portal.login(
+                credentials.UsernamePassword(b"jay", b"hello"), self, ITestable
+            )
+        )
+        self.assertTrue(login)
+        self.assertEqual(error.UnauthorizedLogin, login.type)
+
+
+class OnDiskDatabaseTests(unittest.TestCase):
+    users = [
+        (b"user1", b"pass1"),
+        (b"user2", b"pass2"),
+        (b"user3", b"pass3"),
+    ]
+
+    def setUp(self):
+        self.dbfile = self.mktemp()
+        with open(self.dbfile, "wb") as f:
+            for u, p in self.users:
+                f.write(u + b":" + p + b"\n")
+
+    def test_getUserNonexistentDatabase(self):
+        """
+        A missing db file will cause a permanent rejection of authorization
+        attempts.
+        """
+        self.db = checkers.FilePasswordDB("test_thisbetternoteverexist.db")
+
+        self.assertRaises(error.UnauthorizedLogin, self.db.getUser, "user")
+
+    def testUserLookup(self):
+        self.db = checkers.FilePasswordDB(self.dbfile)
+        for u, p in self.users:
+            self.assertRaises(KeyError, self.db.getUser, u.upper())
+            self.assertEqual(self.db.getUser(u), (u, p))
+
+    def testCaseInSensitivity(self):
+        self.db = checkers.FilePasswordDB(self.dbfile, caseSensitive=False)
+        for u, p in self.users:
+            self.assertEqual(self.db.getUser(u.upper()), (u, p))
+
+    def testRequestAvatarId(self):
+        self.db = checkers.FilePasswordDB(self.dbfile)
+        creds = [credentials.UsernamePassword(u, p) for u, p in self.users]
+        d = defer.gatherResults(
+            [defer.maybeDeferred(self.db.requestAvatarId, c) for c in creds]
+        )
+        d.addCallback(self.assertEqual, [u for u, p in self.users])
+        return d
+
+    def testRequestAvatarId_hashed(self):
+        self.db = checkers.FilePasswordDB(self.dbfile)
+        UsernameHashedPassword = self.getDeprecatedModuleAttribute(
+            "twisted.cred.credentials", "UsernameHashedPassword", _uhpVersion
+        )
+        creds = [UsernameHashedPassword(u, p) for u, p in self.users]
+        d = defer.gatherResults(
+            [defer.maybeDeferred(self.db.requestAvatarId, c) for c in creds]
+        )
+        d.addCallback(self.assertEqual, [u for u, p in self.users])
+        return d
+
+
+class HashedPasswordOnDiskDatabaseTests(unittest.TestCase):
+    users = [
+        (b"user1", b"pass1"),
+        (b"user2", b"pass2"),
+        (b"user3", b"pass3"),
+    ]
+
+    def setUp(self):
+        dbfile = self.mktemp()
+        self.db = checkers.FilePasswordDB(dbfile, hash=self.hash)
+        with open(dbfile, "wb") as f:
+            for u, p in self.users:
+                f.write(u + b":" + self.hash(u, p, u[:2]) + b"\n")
+
+        r = TestRealm()
+        self.port = portal.Portal(r)
+        self.port.registerChecker(self.db)
+
+    def hash(self, u: bytes, p: bytes, s: bytes) -> bytes:
+        hashed_password = crypt(p.decode("ascii"), s.decode("ascii"))  # type: ignore[misc]
+        return hashed_password.encode("ascii")
+
+    def testGoodCredentials(self):
+        goodCreds = [credentials.UsernamePassword(u, p) for u, p in self.users]
+        d = defer.gatherResults([self.db.requestAvatarId(c) for c in goodCreds])
+        d.addCallback(self.assertEqual, [u for u, p in self.users])
+        return d
+
+    def testGoodCredentials_login(self):
+        goodCreds = [credentials.UsernamePassword(u, p) for u, p in self.users]
+        d = defer.gatherResults(
+            [self.port.login(c, None, ITestable) for c in goodCreds]
+        )
+        d.addCallback(lambda x: [a.original.name for i, a, l in x])
+        d.addCallback(self.assertEqual, [u for u, p in self.users])
+        return d
+
+    def testBadCredentials(self):
+        badCreds = [
+            credentials.UsernamePassword(u, b"wrong password") for u, p in self.users
+        ]
+        d = defer.DeferredList(
+            [self.port.login(c, None, ITestable) for c in badCreds], consumeErrors=True
+        )
+        d.addCallback(self._assertFailures, error.UnauthorizedLogin)
+        return d
+
+    def testHashedCredentials(self):
+        UsernameHashedPassword = self.getDeprecatedModuleAttribute(
+            "twisted.cred.credentials", "UsernameHashedPassword", _uhpVersion
+        )
+        hashedCreds = [
+            UsernameHashedPassword(u, self.hash(None, p, u[:2])) for u, p in self.users
+        ]
+        d = defer.DeferredList(
+            [self.port.login(c, None, ITestable) for c in hashedCreds],
+            consumeErrors=True,
+        )
+        d.addCallback(self._assertFailures, error.UnhandledCredentials)
+        return d
+
+    def _assertFailures(self, failures, *expectedFailures):
+        for flag, failure in failures:
+            self.assertEqual(flag, defer.FAILURE)
+            failure.trap(*expectedFailures)
+        return None
+
+    if crypt is None:
+        skip = "crypt module not available"
+
+
+class CheckersMixin:
+    """
+    L{unittest.TestCase} mixin for testing that some checkers accept
+    and deny specified credentials.
+
+    Subclasses must provide
+      - C{getCheckers} which returns a sequence of
+        L{checkers.ICredentialChecker}
+      - C{getGoodCredentials} which returns a list of 2-tuples of
+        credential to check and avaterId to expect.
+      - C{getBadCredentials} which returns a list of credentials
+        which are expected to be unauthorized.
+    """
+
+    @defer.inlineCallbacks
+    def test_positive(self):
+        """
+        The given credentials are accepted by all the checkers, and give
+        the expected C{avatarID}s
+        """
+        for chk in self.getCheckers():
+            for cred, avatarId in self.getGoodCredentials():
+                r = yield chk.requestAvatarId(cred)
+                self.assertEqual(r, avatarId)
+
+    @defer.inlineCallbacks
+    def test_negative(self):
+        """
+        The given credentials are rejected by all the checkers.
+        """
+        for chk in self.getCheckers():
+            for cred in self.getBadCredentials():
+                d = chk.requestAvatarId(cred)
+                yield self.assertFailure(d, error.UnauthorizedLogin)
+
+
+class HashlessFilePasswordDBMixin:
+    credClass = credentials.UsernamePassword
+    diskHash = None
+
+    @staticmethod
+    def networkHash(x: bytes) -> bytes:
+        return x
+
+    _validCredentials = [
+        (b"user1", b"password1"),
+        (b"user2", b"password2"),
+        (b"user3", b"password3"),
+    ]
+
+    def getGoodCredentials(self):
+        for u, p in self._validCredentials:
+            yield self.credClass(u, self.networkHash(p)), u
+
+    def getBadCredentials(self):
+        for u, p in [
+            (b"user1", b"password3"),
+            (b"user2", b"password1"),
+            (b"bloof", b"blarf"),
+        ]:
+            yield self.credClass(u, self.networkHash(p))
+
+    def getCheckers(self):
+        diskHash = self.diskHash or (lambda x: x)
+        hashCheck = self.diskHash and (
+            lambda username, password, stored: self.diskHash(password)
+        )
+
+        for cache in True, False:
+            fn = self.mktemp()
+            with open(fn, "wb") as fObj:
+                for u, p in self._validCredentials:
+                    fObj.write(u + b":" + diskHash(p) + b"\n")
+            yield checkers.FilePasswordDB(fn, cache=cache, hash=hashCheck)
+
+            fn = self.mktemp()
+            with open(fn, "wb") as fObj:
+                for u, p in self._validCredentials:
+                    fObj.write(diskHash(p) + b" dingle dongle " + u + b"\n")
+            yield checkers.FilePasswordDB(fn, b" ", 3, 0, cache=cache, hash=hashCheck)
+
+            fn = self.mktemp()
+            with open(fn, "wb") as fObj:
+                for u, p in self._validCredentials:
+                    fObj.write(
+                        b"zip,zap," + u.title() + b",zup," + diskHash(p) + b"\n",
+                    )
+            yield checkers.FilePasswordDB(
+                fn, b",", 2, 4, False, cache=cache, hash=hashCheck
+            )
+
+
+class LocallyHashedFilePasswordDBMixin(HashlessFilePasswordDBMixin):
+    @staticmethod
+    def diskHash(x):
+        return hexlify(x)
+
+
+class NetworkHashedFilePasswordDBMixin(HashlessFilePasswordDBMixin):
+    @staticmethod
+    def networkHash(x: bytes) -> bytes:
+        return hexlify(x)
+
+    class credClass(credentials.UsernamePassword):
+        def checkPassword(self, password):
+            return unhexlify(self.password) == password
+
+
+class HashlessFilePasswordDBCheckerTests(
+    HashlessFilePasswordDBMixin, CheckersMixin, unittest.TestCase
+):
+    pass
+
+
+class LocallyHashedFilePasswordDBCheckerTests(
+    LocallyHashedFilePasswordDBMixin, CheckersMixin, unittest.TestCase
+):
+    pass
+
+
+class NetworkHashedFilePasswordDBCheckerTests(
+    NetworkHashedFilePasswordDBMixin, CheckersMixin, unittest.TestCase
+):
+    pass
+
+
+class UsernameHashedPasswordTests(unittest.TestCase):
+    """
+    UsernameHashedPassword is a deprecated class that is functionally
+    equivalent to UsernamePassword.
+    """
+
+    def test_deprecation(self):
+        """
+        Tests that UsernameHashedPassword is deprecated.
+        """
+        self.getDeprecatedModuleAttribute(
+            "twisted.cred.credentials",
+            "UsernameHashedPassword",
+            _uhpVersion,
+            "Use twisted.cred.credentials.UsernamePassword instead.",
+        )

backend/lib/python3.12/site-packages/twisted/cred/test/test_digestauth.py

@@ -0,0 +1,694 @@
+# Copyright (c) Twisted Matrix Laboratories.
+# See LICENSE for details.
+
+"""
+Tests for L{twisted.cred._digest} and the associated bits in
+L{twisted.cred.credentials}.
+"""
+
+
+import base64
+from binascii import hexlify
+from hashlib import md5, sha1
+
+from zope.interface.verify import verifyObject
+
+from twisted.cred.credentials import (
+    DigestCredentialFactory,
+    IUsernameDigestHash,
+    calcHA1,
+    calcHA2,
+    calcResponse,
+)
+from twisted.cred.error import LoginFailed
+from twisted.internet.address import IPv4Address
+from twisted.python.compat import networkString
+from twisted.trial.unittest import TestCase
+
+
+def b64encode(s):
+    return base64.b64encode(s).strip()
+
+
+class FakeDigestCredentialFactory(DigestCredentialFactory):
+    """
+    A Fake Digest Credential Factory that generates a predictable
+    nonce and opaque
+    """
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.privateKey = b"0"
+
+    def _generateNonce(self):
+        """
+        Generate a static nonce
+        """
+        return b"178288758716122392881254770685"
+
+    def _getTime(self):
+        """
+        Return a stable time
+        """
+        return 0
+
+
+class DigestAuthTests(TestCase):
+    """
+    L{TestCase} mixin class which defines a number of tests for
+    L{DigestCredentialFactory}.  Because this mixin defines C{setUp}, it
+    must be inherited before L{TestCase}.
+    """
+
+    def setUp(self):
+        """
+        Create a DigestCredentialFactory for testing
+        """
+        self.username = b"foobar"
+        self.password = b"bazquux"
+        self.realm = b"test realm"
+        self.algorithm = b"md5"
+        self.cnonce = b"29fc54aa1641c6fa0e151419361c8f23"
+        self.qop = b"auth"
+        self.uri = b"/write/"
+        self.clientAddress = IPv4Address("TCP", "10.2.3.4", 43125)
+        self.method = b"GET"
+        self.credentialFactory = DigestCredentialFactory(self.algorithm, self.realm)
+
+    def test_MD5HashA1(self, _algorithm=b"md5", _hash=md5):
+        """
+        L{calcHA1} accepts the C{'md5'} algorithm and returns an MD5 hash of
+        its parameters, excluding the nonce and cnonce.
+        """
+        nonce = b"abc123xyz"
+        hashA1 = calcHA1(
+            _algorithm, self.username, self.realm, self.password, nonce, self.cnonce
+        )
+        a1 = b":".join((self.username, self.realm, self.password))
+        expected = hexlify(_hash(a1).digest())
+        self.assertEqual(hashA1, expected)
+
+    def test_MD5SessionHashA1(self):
+        """
+        L{calcHA1} accepts the C{'md5-sess'} algorithm and returns an MD5 hash
+        of its parameters, including the nonce and cnonce.
+        """
+        nonce = b"xyz321abc"
+        hashA1 = calcHA1(
+            b"md5-sess", self.username, self.realm, self.password, nonce, self.cnonce
+        )
+        a1 = self.username + b":" + self.realm + b":" + self.password
+        ha1 = hexlify(md5(a1).digest())
+        a1 = ha1 + b":" + nonce + b":" + self.cnonce
+        expected = hexlify(md5(a1).digest())
+        self.assertEqual(hashA1, expected)
+
+    def test_SHAHashA1(self):
+        """
+        L{calcHA1} accepts the C{'sha'} algorithm and returns a SHA hash of its
+        parameters, excluding the nonce and cnonce.
+        """
+        self.test_MD5HashA1(b"sha", sha1)
+
+    def test_MD5HashA2Auth(self, _algorithm=b"md5", _hash=md5):
+        """
+        L{calcHA2} accepts the C{'md5'} algorithm and returns an MD5 hash of
+        its arguments, excluding the entity hash for QOP other than
+        C{'auth-int'}.
+        """
+        method = b"GET"
+        hashA2 = calcHA2(_algorithm, method, self.uri, b"auth", None)
+        a2 = method + b":" + self.uri
+        expected = hexlify(_hash(a2).digest())
+        self.assertEqual(hashA2, expected)
+
+    def test_MD5HashA2AuthInt(self, _algorithm=b"md5", _hash=md5):
+        """
+        L{calcHA2} accepts the C{'md5'} algorithm and returns an MD5 hash of
+        its arguments, including the entity hash for QOP of C{'auth-int'}.
+        """
+        method = b"GET"
+        hentity = b"foobarbaz"
+        hashA2 = calcHA2(_algorithm, method, self.uri, b"auth-int", hentity)
+        a2 = method + b":" + self.uri + b":" + hentity
+        expected = hexlify(_hash(a2).digest())
+        self.assertEqual(hashA2, expected)
+
+    def test_MD5SessHashA2Auth(self):
+        """
+        L{calcHA2} accepts the C{'md5-sess'} algorithm and QOP of C{'auth'} and
+        returns the same value as it does for the C{'md5'} algorithm.
+        """
+        self.test_MD5HashA2Auth(b"md5-sess")
+
+    def test_MD5SessHashA2AuthInt(self):
+        """
+        L{calcHA2} accepts the C{'md5-sess'} algorithm and QOP of C{'auth-int'}
+        and returns the same value as it does for the C{'md5'} algorithm.
+        """
+        self.test_MD5HashA2AuthInt(b"md5-sess")
+
+    def test_SHAHashA2Auth(self):
+        """
+        L{calcHA2} accepts the C{'sha'} algorithm and returns a SHA hash of
+        its arguments, excluding the entity hash for QOP other than
+        C{'auth-int'}.
+        """
+        self.test_MD5HashA2Auth(b"sha", sha1)
+
+    def test_SHAHashA2AuthInt(self):
+        """
+        L{calcHA2} accepts the C{'sha'} algorithm and returns a SHA hash of
+        its arguments, including the entity hash for QOP of C{'auth-int'}.
+        """
+        self.test_MD5HashA2AuthInt(b"sha", sha1)
+
+    def test_MD5HashResponse(self, _algorithm=b"md5", _hash=md5):
+        """
+        L{calcResponse} accepts the C{'md5'} algorithm and returns an MD5 hash
+        of its parameters, excluding the nonce count, client nonce, and QoP
+        value if the nonce count and client nonce are L{None}
+        """
+        hashA1 = b"abc123"
+        hashA2 = b"789xyz"
+        nonce = b"lmnopq"
+
+        response = hashA1 + b":" + nonce + b":" + hashA2
+        expected = hexlify(_hash(response).digest())
+
+        digest = calcResponse(hashA1, hashA2, _algorithm, nonce, None, None, None)
+        self.assertEqual(expected, digest)
+
+    def test_MD5SessionHashResponse(self):
+        """
+        L{calcResponse} accepts the C{'md5-sess'} algorithm and returns an MD5
+        hash of its parameters, excluding the nonce count, client nonce, and
+        QoP value if the nonce count and client nonce are L{None}
+        """
+        self.test_MD5HashResponse(b"md5-sess")
+
+    def test_SHAHashResponse(self):
+        """
+        L{calcResponse} accepts the C{'sha'} algorithm and returns a SHA hash
+        of its parameters, excluding the nonce count, client nonce, and QoP
+        value if the nonce count and client nonce are L{None}
+        """
+        self.test_MD5HashResponse(b"sha", sha1)
+
+    def test_MD5HashResponseExtra(self, _algorithm=b"md5", _hash=md5):
+        """
+        L{calcResponse} accepts the C{'md5'} algorithm and returns an MD5 hash
+        of its parameters, including the nonce count, client nonce, and QoP
+        value if they are specified.
+        """
+        hashA1 = b"abc123"
+        hashA2 = b"789xyz"
+        nonce = b"lmnopq"
+        nonceCount = b"00000004"
+        clientNonce = b"abcxyz123"
+        qop = b"auth"
+
+        response = (
+            hashA1
+            + b":"
+            + nonce
+            + b":"
+            + nonceCount
+            + b":"
+            + clientNonce
+            + b":"
+            + qop
+            + b":"
+            + hashA2
+        )
+        expected = hexlify(_hash(response).digest())
+
+        digest = calcResponse(
+            hashA1, hashA2, _algorithm, nonce, nonceCount, clientNonce, qop
+        )
+        self.assertEqual(expected, digest)
+
+    def test_MD5SessionHashResponseExtra(self):
+        """
+        L{calcResponse} accepts the C{'md5-sess'} algorithm and returns an MD5
+        hash of its parameters, including the nonce count, client nonce, and
+        QoP value if they are specified.
+        """
+        self.test_MD5HashResponseExtra(b"md5-sess")
+
+    def test_SHAHashResponseExtra(self):
+        """
+        L{calcResponse} accepts the C{'sha'} algorithm and returns a SHA hash
+        of its parameters, including the nonce count, client nonce, and QoP
+        value if they are specified.
+        """
+        self.test_MD5HashResponseExtra(b"sha", sha1)
+
+    def formatResponse(self, quotes=True, **kw):
+        """
+        Format all given keyword arguments and their values suitably for use as
+        the value of an HTTP header.
+
+        @types quotes: C{bool}
+        @param quotes: A flag indicating whether to quote the values of each
+            field in the response.
+
+        @param **kw: Keywords and C{bytes} values which will be treated as field
+            name/value pairs to include in the result.
+
+        @rtype: C{bytes}
+        @return: The given fields formatted for use as an HTTP header value.
+        """
+        if "username" not in kw:
+            kw["username"] = self.username
+        if "realm" not in kw:
+            kw["realm"] = self.realm
+        if "algorithm" not in kw:
+            kw["algorithm"] = self.algorithm
+        if "qop" not in kw:
+            kw["qop"] = self.qop
+        if "cnonce" not in kw:
+            kw["cnonce"] = self.cnonce
+        if "uri" not in kw:
+            kw["uri"] = self.uri
+        if quotes:
+            quote = b'"'
+        else:
+            quote = b""
+
+        return b", ".join(
+            [
+                b"".join((networkString(k), b"=", quote, v, quote))
+                for (k, v) in kw.items()
+                if v is not None
+            ]
+        )
+
+    def getDigestResponse(self, challenge, ncount):
+        """
+        Calculate the response for the given challenge
+        """
+        nonce = challenge.get("nonce")
+        algo = challenge.get("algorithm").lower()
+        qop = challenge.get("qop")
+
+        ha1 = calcHA1(
+            algo, self.username, self.realm, self.password, nonce, self.cnonce
+        )
+        ha2 = calcHA2(algo, b"GET", self.uri, qop, None)
+        expected = calcResponse(ha1, ha2, algo, nonce, ncount, self.cnonce, qop)
+        return expected
+
+    def test_response(self, quotes=True):
+        """
+        L{DigestCredentialFactory.decode} accepts a digest challenge response
+        and parses it into an L{IUsernameHashedPassword} provider.
+        """
+        challenge = self.credentialFactory.getChallenge(self.clientAddress.host)
+
+        nc = b"00000001"
+        clientResponse = self.formatResponse(
+            quotes=quotes,
+            nonce=challenge["nonce"],
+            response=self.getDigestResponse(challenge, nc),
+            nc=nc,
+            opaque=challenge["opaque"],
+        )
+        creds = self.credentialFactory.decode(
+            clientResponse, self.method, self.clientAddress.host
+        )
+        self.assertTrue(creds.checkPassword(self.password))
+        self.assertFalse(creds.checkPassword(self.password + b"wrong"))
+
+    def test_responseWithoutQuotes(self):
+        """
+        L{DigestCredentialFactory.decode} accepts a digest challenge response
+        which does not quote the values of its fields and parses it into an
+        L{IUsernameHashedPassword} provider in the same way it would a
+        response which included quoted field values.
+        """
+        self.test_response(False)
+
+    def test_responseWithCommaURI(self):
+        """
+        L{DigestCredentialFactory.decode} accepts a digest challenge response
+        which quotes the values of its fields and includes a C{b","} in the URI
+        field.
+        """
+        self.uri = b"/some,path/"
+        self.test_response(True)
+
+    def test_caseInsensitiveAlgorithm(self):
+        """
+        The case of the algorithm value in the response is ignored when
+        checking the credentials.
+        """
+        self.algorithm = b"MD5"
+        self.test_response()
+
+    def test_md5DefaultAlgorithm(self):
+        """
+        The algorithm defaults to MD5 if it is not supplied in the response.
+        """
+        self.algorithm = None
+        self.test_response()
+
+    def test_responseWithoutClientIP(self):
+        """
+        L{DigestCredentialFactory.decode} accepts a digest challenge response
+        even if the client address it is passed is L{None}.
+        """
+        challenge = self.credentialFactory.getChallenge(None)
+
+        nc = b"00000001"
+        clientResponse = self.formatResponse(
+            nonce=challenge["nonce"],
+            response=self.getDigestResponse(challenge, nc),
+            nc=nc,
+            opaque=challenge["opaque"],
+        )
+        creds = self.credentialFactory.decode(clientResponse, self.method, None)
+        self.assertTrue(creds.checkPassword(self.password))
+        self.assertFalse(creds.checkPassword(self.password + b"wrong"))
+
+    def test_multiResponse(self):
+        """
+        L{DigestCredentialFactory.decode} handles multiple responses to a
+        single challenge.
+        """
+        challenge = self.credentialFactory.getChallenge(self.clientAddress.host)
+
+        nc = b"00000001"
+        clientResponse = self.formatResponse(
+            nonce=challenge["nonce"],
+            response=self.getDigestResponse(challenge, nc),
+            nc=nc,
+            opaque=challenge["opaque"],
+        )
+
+        creds = self.credentialFactory.decode(
+            clientResponse, self.method, self.clientAddress.host
+        )
+        self.assertTrue(creds.checkPassword(self.password))
+        self.assertFalse(creds.checkPassword(self.password + b"wrong"))
+
+        nc = b"00000002"
+        clientResponse = self.formatResponse(
+            nonce=challenge["nonce"],
+            response=self.getDigestResponse(challenge, nc),
+            nc=nc,
+            opaque=challenge["opaque"],
+        )
+
+        creds = self.credentialFactory.decode(
+            clientResponse, self.method, self.clientAddress.host
+        )
+        self.assertTrue(creds.checkPassword(self.password))
+        self.assertFalse(creds.checkPassword(self.password + b"wrong"))
+
+    def test_failsWithDifferentMethod(self):
+        """
+        L{DigestCredentialFactory.decode} returns an L{IUsernameHashedPassword}
+        provider which rejects a correct password for the given user if the
+        challenge response request is made using a different HTTP method than
+        was used to request the initial challenge.
+        """
+        challenge = self.credentialFactory.getChallenge(self.clientAddress.host)
+
+        nc = b"00000001"
+        clientResponse = self.formatResponse(
+            nonce=challenge["nonce"],
+            response=self.getDigestResponse(challenge, nc),
+            nc=nc,
+            opaque=challenge["opaque"],
+        )
+        creds = self.credentialFactory.decode(
+            clientResponse, b"POST", self.clientAddress.host
+        )
+        self.assertFalse(creds.checkPassword(self.password))
+        self.assertFalse(creds.checkPassword(self.password + b"wrong"))
+
+    def test_noUsername(self):
+        """
+        L{DigestCredentialFactory.decode} raises L{LoginFailed} if the response
+        has no username field or if the username field is empty.
+        """
+        # Check for no username
+        e = self.assertRaises(
+            LoginFailed,
+            self.credentialFactory.decode,
+            self.formatResponse(username=None),
+            self.method,
+            self.clientAddress.host,
+        )
+        self.assertEqual(str(e), "Invalid response, no username given.")
+
+        # Check for an empty username
+        e = self.assertRaises(
+            LoginFailed,
+            self.credentialFactory.decode,
+            self.formatResponse(username=b""),
+            self.method,
+            self.clientAddress.host,
+        )
+        self.assertEqual(str(e), "Invalid response, no username given.")
+
+    def test_noNonce(self):
+        """
+        L{DigestCredentialFactory.decode} raises L{LoginFailed} if the response
+        has no nonce.
+        """
+        e = self.assertRaises(
+            LoginFailed,
+            self.credentialFactory.decode,
+            self.formatResponse(opaque=b"abc123"),
+            self.method,
+            self.clientAddress.host,
+        )
+        self.assertEqual(str(e), "Invalid response, no nonce given.")
+
+    def test_noOpaque(self):
+        """
+        L{DigestCredentialFactory.decode} raises L{LoginFailed} if the response
+        has no opaque.
+        """
+        e = self.assertRaises(
+            LoginFailed,
+            self.credentialFactory.decode,
+            self.formatResponse(),
+            self.method,
+            self.clientAddress.host,
+        )
+        self.assertEqual(str(e), "Invalid response, no opaque given.")
+
+    def test_checkHash(self):
+        """
+        L{DigestCredentialFactory.decode} returns an L{IUsernameDigestHash}
+        provider which can verify a hash of the form 'username:realm:password'.
+        """
+        challenge = self.credentialFactory.getChallenge(self.clientAddress.host)
+
+        nc = b"00000001"
+        clientResponse = self.formatResponse(
+            nonce=challenge["nonce"],
+            response=self.getDigestResponse(challenge, nc),
+            nc=nc,
+            opaque=challenge["opaque"],
+        )
+
+        creds = self.credentialFactory.decode(
+            clientResponse, self.method, self.clientAddress.host
+        )
+        self.assertTrue(verifyObject(IUsernameDigestHash, creds))
+
+        cleartext = self.username + b":" + self.realm + b":" + self.password
+        hash = md5(cleartext)
+        self.assertTrue(creds.checkHash(hexlify(hash.digest())))
+        hash.update(b"wrong")
+        self.assertFalse(creds.checkHash(hexlify(hash.digest())))
+
+    def test_invalidOpaque(self):
+        """
+        L{DigestCredentialFactory.decode} raises L{LoginFailed} when the opaque
+        value does not contain all the required parts.
+        """
+        credentialFactory = FakeDigestCredentialFactory(self.algorithm, self.realm)
+        challenge = credentialFactory.getChallenge(self.clientAddress.host)
+
+        exc = self.assertRaises(
+            LoginFailed,
+            credentialFactory._verifyOpaque,
+            b"badOpaque",
+            challenge["nonce"],
+            self.clientAddress.host,
+        )
+        self.assertEqual(str(exc), "Invalid response, invalid opaque value")
+
+        badOpaque = b"foo-" + b64encode(b"nonce,clientip")
+
+        exc = self.assertRaises(
+            LoginFailed,
+            credentialFactory._verifyOpaque,
+            badOpaque,
+            challenge["nonce"],
+            self.clientAddress.host,
+        )
+        self.assertEqual(str(exc), "Invalid response, invalid opaque value")
+
+        exc = self.assertRaises(
+            LoginFailed,
+            credentialFactory._verifyOpaque,
+            b"",
+            challenge["nonce"],
+            self.clientAddress.host,
+        )
+        self.assertEqual(str(exc), "Invalid response, invalid opaque value")
+
+        badOpaque = b"foo-" + b64encode(
+            b",".join(
+                (challenge["nonce"], networkString(self.clientAddress.host), b"foobar")
+            )
+        )
+        exc = self.assertRaises(
+            LoginFailed,
+            credentialFactory._verifyOpaque,
+            badOpaque,
+            challenge["nonce"],
+            self.clientAddress.host,
+        )
+        self.assertEqual(str(exc), "Invalid response, invalid opaque/time values")
+
+    def test_incompatibleNonce(self):
+        """
+        L{DigestCredentialFactory.decode} raises L{LoginFailed} when the given
+        nonce from the response does not match the nonce encoded in the opaque.
+        """
+        credentialFactory = FakeDigestCredentialFactory(self.algorithm, self.realm)
+        challenge = credentialFactory.getChallenge(self.clientAddress.host)
+
+        badNonceOpaque = credentialFactory._generateOpaque(
+            b"1234567890", self.clientAddress.host
+        )
+
+        exc = self.assertRaises(
+            LoginFailed,
+            credentialFactory._verifyOpaque,
+            badNonceOpaque,
+            challenge["nonce"],
+            self.clientAddress.host,
+        )
+        self.assertEqual(str(exc), "Invalid response, incompatible opaque/nonce values")
+
+        exc = self.assertRaises(
+            LoginFailed,
+            credentialFactory._verifyOpaque,
+            badNonceOpaque,
+            b"",
+            self.clientAddress.host,
+        )
+        self.assertEqual(str(exc), "Invalid response, incompatible opaque/nonce values")
+
+    def test_incompatibleClientIP(self):
+        """
+        L{DigestCredentialFactory.decode} raises L{LoginFailed} when the
+        request comes from a client IP other than what is encoded in the
+        opaque.
+        """
+        credentialFactory = FakeDigestCredentialFactory(self.algorithm, self.realm)
+        challenge = credentialFactory.getChallenge(self.clientAddress.host)
+
+        badAddress = "10.0.0.1"
+        # Sanity check
+        self.assertNotEqual(self.clientAddress.host, badAddress)
+
+        badNonceOpaque = credentialFactory._generateOpaque(
+            challenge["nonce"], badAddress
+        )
+
+        self.assertRaises(
+            LoginFailed,
+            credentialFactory._verifyOpaque,
+            badNonceOpaque,
+            challenge["nonce"],
+            self.clientAddress.host,
+        )
+
+    def test_oldNonce(self):
+        """
+        L{DigestCredentialFactory.decode} raises L{LoginFailed} when the given
+        opaque is older than C{DigestCredentialFactory.CHALLENGE_LIFETIME_SECS}
+        """
+        credentialFactory = FakeDigestCredentialFactory(self.algorithm, self.realm)
+        challenge = credentialFactory.getChallenge(self.clientAddress.host)
+
+        key = b",".join(
+            (challenge["nonce"], networkString(self.clientAddress.host), b"-137876876")
+        )
+        digest = hexlify(md5(key + credentialFactory.privateKey).digest())
+        ekey = b64encode(key)
+
+        oldNonceOpaque = b"-".join((digest, ekey.strip(b"\n")))
+
+        self.assertRaises(
+            LoginFailed,
+            credentialFactory._verifyOpaque,
+            oldNonceOpaque,
+            challenge["nonce"],
+            self.clientAddress.host,
+        )
+
+    def test_mismatchedOpaqueChecksum(self):
+        """
+        L{DigestCredentialFactory.decode} raises L{LoginFailed} when the opaque
+        checksum fails verification.
+        """
+        credentialFactory = FakeDigestCredentialFactory(self.algorithm, self.realm)
+        challenge = credentialFactory.getChallenge(self.clientAddress.host)
+
+        key = b",".join(
+            (challenge["nonce"], networkString(self.clientAddress.host), b"0")
+        )
+
+        digest = hexlify(md5(key + b"this is not the right pkey").digest())
+        badChecksum = b"-".join((digest, b64encode(key)))
+
+        self.assertRaises(
+            LoginFailed,
+            credentialFactory._verifyOpaque,
+            badChecksum,
+            challenge["nonce"],
+            self.clientAddress.host,
+        )
+
+    def test_incompatibleCalcHA1Options(self):
+        """
+        L{calcHA1} raises L{TypeError} when any of the pszUsername, pszRealm,
+        or pszPassword arguments are specified with the preHA1 keyword
+        argument.
+        """
+        arguments = (
+            (b"user", b"realm", b"password", b"preHA1"),
+            (None, b"realm", None, b"preHA1"),
+            (None, None, b"password", b"preHA1"),
+        )
+
+        for pszUsername, pszRealm, pszPassword, preHA1 in arguments:
+            self.assertRaises(
+                TypeError,
+                calcHA1,
+                b"md5",
+                pszUsername,
+                pszRealm,
+                pszPassword,
+                b"nonce",
+                b"cnonce",
+                preHA1=preHA1,
+            )
+
+    def test_noNewlineOpaque(self):
+        """
+        L{DigestCredentialFactory._generateOpaque} returns a value without
+        newlines, regardless of the length of the nonce.
+        """
+        opaque = self.credentialFactory._generateOpaque(b"long nonce " * 10, None)
+        self.assertNotIn(b"\n", opaque)

backend/lib/python3.12/site-packages/twisted/cred/test/test_simpleauth.py

@@ -0,0 +1,101 @@
+# Copyright (c) Twisted Matrix Laboratories.
+# See LICENSE for details.
+
+"""
+Tests for basic constructs of L{twisted.cred.credentials}.
+"""
+
+
+from twisted.cred.credentials import (
+    IUsernameHashedPassword,
+    IUsernamePassword,
+    UsernamePassword,
+)
+from twisted.cred.test.test_cred import _uhpVersion
+from twisted.trial.unittest import TestCase
+
+
+class UsernamePasswordTests(TestCase):
+    """
+    Tests for L{UsernamePassword}.
+    """
+
+    def test_initialisation(self) -> None:
+        """
+        The initialisation of L{UsernamePassword} will set C{username} and
+        C{password} on it.
+        """
+        creds = UsernamePassword(b"foo", b"bar")
+        self.assertEqual(creds.username, b"foo")
+        self.assertEqual(creds.password, b"bar")
+
+    def test_correctPassword(self) -> None:
+        """
+        Calling C{checkPassword} on a L{UsernamePassword} will return L{True}
+        when the password given is the password on the object.
+        """
+        creds = UsernamePassword(b"user", b"pass")
+        self.assertTrue(creds.checkPassword(b"pass"))
+
+    def test_wrongPassword(self) -> None:
+        """
+        Calling C{checkPassword} on a L{UsernamePassword} will return L{False}
+        when the password given is NOT the password on the object.
+        """
+        creds = UsernamePassword(b"user", b"pass")
+        self.assertFalse(creds.checkPassword(b"someotherpass"))
+
+    def test_interface(self) -> None:
+        """
+        L{UsernamePassword} implements L{IUsernamePassword}.
+        """
+        self.assertTrue(IUsernamePassword.implementedBy(UsernamePassword))
+
+
+class UsernameHashedPasswordTests(TestCase):
+    """
+    Tests for L{UsernameHashedPassword}.
+    """
+
+    def test_initialisation(self) -> None:
+        """
+        The initialisation of L{UsernameHashedPassword} will set C{username}
+        and C{hashed} on it.
+        """
+        UsernameHashedPassword = self.getDeprecatedModuleAttribute(
+            "twisted.cred.credentials", "UsernameHashedPassword", _uhpVersion
+        )
+        creds = UsernameHashedPassword(b"foo", b"bar")
+        self.assertEqual(creds.username, b"foo")
+        self.assertEqual(creds.hashed, b"bar")
+
+    def test_correctPassword(self) -> None:
+        """
+        Calling C{checkPassword} on a L{UsernameHashedPassword} will return
+        L{True} when the password given is the password on the object.
+        """
+        UsernameHashedPassword = self.getDeprecatedModuleAttribute(
+            "twisted.cred.credentials", "UsernameHashedPassword", _uhpVersion
+        )
+        creds = UsernameHashedPassword(b"user", b"pass")
+        self.assertTrue(creds.checkPassword(b"pass"))
+
+    def test_wrongPassword(self) -> None:
+        """
+        Calling C{checkPassword} on a L{UsernameHashedPassword} will return
+        L{False} when the password given is NOT the password on the object.
+        """
+        UsernameHashedPassword = self.getDeprecatedModuleAttribute(
+            "twisted.cred.credentials", "UsernameHashedPassword", _uhpVersion
+        )
+        creds = UsernameHashedPassword(b"user", b"pass")
+        self.assertFalse(creds.checkPassword(b"someotherpass"))
+
+    def test_interface(self) -> None:
+        """
+        L{UsernameHashedPassword} implements L{IUsernameHashedPassword}.
+        """
+        UsernameHashedPassword = self.getDeprecatedModuleAttribute(
+            "twisted.cred.credentials", "UsernameHashedPassword", _uhpVersion
+        )
+        self.assertTrue(IUsernameHashedPassword.implementedBy(UsernameHashedPassword))

backend/lib/python3.12/site-packages/twisted/cred/test/test_strcred.py

@@ -0,0 +1,699 @@
+# Copyright (c) Twisted Matrix Laboratories.
+# See LICENSE for details.
+
+"""
+L{twisted.cred.strcred}.
+"""
+
+
+import os
+from io import StringIO
+from typing import Sequence, Type
+from unittest import skipIf
+
+from zope.interface import Interface
+
+from twisted import plugin
+from twisted.cred import checkers, credentials, error, strcred
+from twisted.plugins import cred_anonymous, cred_file, cred_unix
+from twisted.python import usage
+from twisted.python.fakepwd import UserDatabase
+from twisted.python.filepath import FilePath
+from twisted.python.reflect import requireModule
+from twisted.trial.unittest import TestCase
+
+crypt = requireModule("crypt")
+pwd = requireModule("pwd")
+spwd = requireModule("spwd")
+
+
+def getInvalidAuthType():
+    """
+    Helper method to produce an auth type that doesn't exist.
+    """
+    invalidAuthType = "ThisPluginDoesNotExist"
+    while invalidAuthType in [
+        factory.authType for factory in strcred.findCheckerFactories()
+    ]:
+        invalidAuthType += "_"
+    return invalidAuthType
+
+
+class PublicAPITests(TestCase):
+    def test_emptyDescription(self):
+        """
+        The description string cannot be empty.
+        """
+        iat = getInvalidAuthType()
+        self.assertRaises(strcred.InvalidAuthType, strcred.makeChecker, iat)
+        self.assertRaises(strcred.InvalidAuthType, strcred.findCheckerFactory, iat)
+
+    def test_invalidAuthType(self):
+        """
+        An unrecognized auth type raises an exception.
+        """
+        iat = getInvalidAuthType()
+        self.assertRaises(strcred.InvalidAuthType, strcred.makeChecker, iat)
+        self.assertRaises(strcred.InvalidAuthType, strcred.findCheckerFactory, iat)
+
+
+class StrcredFunctionsTests(TestCase):
+    def test_findCheckerFactories(self):
+        """
+        L{strcred.findCheckerFactories} returns all available plugins.
+        """
+        availablePlugins = list(strcred.findCheckerFactories())
+        for plg in plugin.getPlugins(strcred.ICheckerFactory):
+            self.assertIn(plg, availablePlugins)
+
+    def test_findCheckerFactory(self):
+        """
+        L{strcred.findCheckerFactory} returns the first plugin
+        available for a given authentication type.
+        """
+        self.assertIdentical(
+            strcred.findCheckerFactory("file"), cred_file.theFileCheckerFactory
+        )
+
+
+class MemoryCheckerTests(TestCase):
+    def setUp(self):
+        self.admin = credentials.UsernamePassword("admin", "asdf")
+        self.alice = credentials.UsernamePassword("alice", "foo")
+        self.badPass = credentials.UsernamePassword("alice", "foobar")
+        self.badUser = credentials.UsernamePassword("x", "yz")
+        self.checker = strcred.makeChecker("memory:admin:asdf:alice:foo")
+
+    def test_isChecker(self):
+        """
+        Verifies that strcred.makeChecker('memory') returns an object
+        that implements the L{ICredentialsChecker} interface.
+        """
+        self.assertTrue(checkers.ICredentialsChecker.providedBy(self.checker))
+        self.assertIn(credentials.IUsernamePassword, self.checker.credentialInterfaces)
+
+    def test_badFormatArgString(self):
+        """
+        An argument string which does not contain user:pass pairs
+        (i.e., an odd number of ':' characters) raises an exception.
+        """
+        self.assertRaises(
+            strcred.InvalidAuthArgumentString, strcred.makeChecker, "memory:a:b:c"
+        )
+
+    def test_memoryCheckerSucceeds(self):
+        """
+        The checker works with valid credentials.
+        """
+
+        def _gotAvatar(username):
+            self.assertEqual(username, self.admin.username)
+
+        return self.checker.requestAvatarId(self.admin).addCallback(_gotAvatar)
+
+    def test_memoryCheckerFailsUsername(self):
+        """
+        The checker fails with an invalid username.
+        """
+        return self.assertFailure(
+            self.checker.requestAvatarId(self.badUser), error.UnauthorizedLogin
+        )
+
+    def test_memoryCheckerFailsPassword(self):
+        """
+        The checker fails with an invalid password.
+        """
+        return self.assertFailure(
+            self.checker.requestAvatarId(self.badPass), error.UnauthorizedLogin
+        )
+
+
+class AnonymousCheckerTests(TestCase):
+    def test_isChecker(self):
+        """
+        Verifies that strcred.makeChecker('anonymous') returns an object
+        that implements the L{ICredentialsChecker} interface.
+        """
+        checker = strcred.makeChecker("anonymous")
+        self.assertTrue(checkers.ICredentialsChecker.providedBy(checker))
+        self.assertIn(credentials.IAnonymous, checker.credentialInterfaces)
+
+    def testAnonymousAccessSucceeds(self):
+        """
+        We can log in anonymously using this checker.
+        """
+        checker = strcred.makeChecker("anonymous")
+        request = checker.requestAvatarId(credentials.Anonymous())
+
+        def _gotAvatar(avatar):
+            self.assertIdentical(checkers.ANONYMOUS, avatar)
+
+        return request.addCallback(_gotAvatar)
+
+
+@skipIf(not pwd, "Required module not available: pwd")
+@skipIf(not crypt, "Required module not available: crypt")
+@skipIf(not spwd, "Required module not available: spwd")
+class UnixCheckerTests(TestCase):
+    users = {
+        "admin": "asdf",
+        "alice": "foo",
+    }
+
+    def _spwd_getspnam(self, username):
+        return spwd.struct_spwd(
+            (
+                username,
+                crypt.crypt(self.users[username], "F/"),
+                0,
+                0,
+                99999,
+                7,
+                -1,
+                -1,
+                -1,
+            )
+        )
+
+    def setUp(self):
+        self.admin = credentials.UsernamePassword("admin", "asdf")
+        self.alice = credentials.UsernamePassword("alice", "foo")
+        self.badPass = credentials.UsernamePassword("alice", "foobar")
+        self.badUser = credentials.UsernamePassword("x", "yz")
+        self.checker = strcred.makeChecker("unix")
+        self.adminBytes = credentials.UsernamePassword(b"admin", b"asdf")
+        self.aliceBytes = credentials.UsernamePassword(b"alice", b"foo")
+        self.badPassBytes = credentials.UsernamePassword(b"alice", b"foobar")
+        self.badUserBytes = credentials.UsernamePassword(b"x", b"yz")
+        self.checkerBytes = strcred.makeChecker("unix")
+
+        # Hack around the pwd and spwd modules, since we can't really
+        # go about reading your /etc/passwd or /etc/shadow files
+        if pwd:
+            database = UserDatabase()
+            for username, password in self.users.items():
+                database.addUser(
+                    username,
+                    crypt.crypt(password, "F/"),
+                    1000,
+                    1000,
+                    username,
+                    "/home/" + username,
+                    "/bin/sh",
+                )
+            self.patch(pwd, "getpwnam", database.getpwnam)
+        if spwd:
+            self.patch(spwd, "getspnam", self._spwd_getspnam)
+
+    def test_isChecker(self):
+        """
+        Verifies that strcred.makeChecker('unix') returns an object
+        that implements the L{ICredentialsChecker} interface.
+        """
+        self.assertTrue(checkers.ICredentialsChecker.providedBy(self.checker))
+        self.assertIn(credentials.IUsernamePassword, self.checker.credentialInterfaces)
+        self.assertTrue(checkers.ICredentialsChecker.providedBy(self.checkerBytes))
+        self.assertIn(
+            credentials.IUsernamePassword, self.checkerBytes.credentialInterfaces
+        )
+
+    def test_unixCheckerSucceeds(self):
+        """
+        The checker works with valid credentials.
+        """
+
+        def _gotAvatar(username):
+            self.assertEqual(username, self.admin.username)
+
+        return self.checker.requestAvatarId(self.admin).addCallback(_gotAvatar)
+
+    def test_unixCheckerSucceedsBytes(self):
+        """
+        The checker works with valid L{bytes} credentials.
+        """
+
+        def _gotAvatar(username):
+            self.assertEqual(username, self.adminBytes.username.decode("utf-8"))
+
+        return self.checkerBytes.requestAvatarId(self.adminBytes).addCallback(
+            _gotAvatar
+        )
+
+    def test_unixCheckerFailsUsername(self):
+        """
+        The checker fails with an invalid username.
+        """
+        return self.assertFailure(
+            self.checker.requestAvatarId(self.badUser), error.UnauthorizedLogin
+        )
+
+    def test_unixCheckerFailsUsernameBytes(self):
+        """
+        The checker fails with an invalid L{bytes} username.
+        """
+        return self.assertFailure(
+            self.checkerBytes.requestAvatarId(self.badUserBytes),
+            error.UnauthorizedLogin,
+        )
+
+    def test_unixCheckerFailsPassword(self):
+        """
+        The checker fails with an invalid password.
+        """
+        return self.assertFailure(
+            self.checker.requestAvatarId(self.badPass), error.UnauthorizedLogin
+        )
+
+    def test_unixCheckerFailsPasswordBytes(self):
+        """
+        The checker fails with an invalid L{bytes} password.
+        """
+        return self.assertFailure(
+            self.checkerBytes.requestAvatarId(self.badPassBytes),
+            error.UnauthorizedLogin,
+        )
+
+
+@skipIf(not crypt, "Required module is unavailable: crypt")
+class CryptTests(TestCase):
+    """
+    L{crypt} has functions for encrypting password.
+    """
+
+    def test_verifyCryptedPassword(self):
+        """
+        L{cred_unix.verifyCryptedPassword}
+        """
+        password = "sample password ^%$"
+
+        for salt in (None, "ab"):
+            try:
+                cryptedCorrect = crypt.crypt(password, salt)
+                if isinstance(cryptedCorrect, bytes):
+                    cryptedCorrect = cryptedCorrect.decode("utf-8")
+            except TypeError:
+                # Older Python versions would throw a TypeError if
+                # a value of None was is used for the salt.
+                # Newer Python versions allow it.
+                continue
+            cryptedIncorrect = "$1x1234"
+            self.assertTrue(cred_unix.verifyCryptedPassword(cryptedCorrect, password))
+            self.assertFalse(
+                cred_unix.verifyCryptedPassword(cryptedIncorrect, password)
+            )
+
+        # Python 3.3+ has crypt.METHOD_*, but not all
+        # platforms implement all methods.
+        for method in ("METHOD_SHA512", "METHOD_SHA256", "METHOD_MD5", "METHOD_CRYPT"):
+            cryptMethod = getattr(crypt, method, None)
+            if not cryptMethod:
+                continue
+            password = "interesting password xyz"
+            crypted = crypt.crypt(password, cryptMethod)
+            if isinstance(crypted, bytes):
+                crypted = crypted.decode("utf-8")
+            incorrectCrypted = crypted + "blahfooincorrect"
+            result = cred_unix.verifyCryptedPassword(crypted, password)
+            self.assertTrue(result)
+            # Try to pass in bytes
+            result = cred_unix.verifyCryptedPassword(
+                crypted.encode("utf-8"), password.encode("utf-8")
+            )
+            self.assertTrue(result)
+            result = cred_unix.verifyCryptedPassword(incorrectCrypted, password)
+            self.assertFalse(result)
+            # Try to pass in bytes
+            result = cred_unix.verifyCryptedPassword(
+                incorrectCrypted.encode("utf-8"), password.encode("utf-8")
+            )
+            self.assertFalse(result)
+
+    def test_verifyCryptedPasswordOSError(self):
+        """
+        L{cred_unix.verifyCryptedPassword} when OSError is raised
+        """
+
+        def mockCrypt(password, salt):
+            raise OSError("")
+
+        password = "sample password ^%$"
+        cryptedCorrect = crypt.crypt(password, "ab")
+        self.patch(crypt, "crypt", mockCrypt)
+        self.assertFalse(cred_unix.verifyCryptedPassword(cryptedCorrect, password))
+
+
+class FileDBCheckerTests(TestCase):
+    """
+    C{--auth=file:...} file checker.
+    """
+
+    def setUp(self):
+        self.admin = credentials.UsernamePassword(b"admin", b"asdf")
+        self.alice = credentials.UsernamePassword(b"alice", b"foo")
+        self.badPass = credentials.UsernamePassword(b"alice", b"foobar")
+        self.badUser = credentials.UsernamePassword(b"x", b"yz")
+        self.filename = self.mktemp()
+        FilePath(self.filename).setContent(b"admin:asdf\nalice:foo\n")
+        self.checker = strcred.makeChecker("file:" + self.filename)
+
+    def _fakeFilename(self):
+        filename = "/DoesNotExist"
+        while os.path.exists(filename):
+            filename += "_"
+        return filename
+
+    def test_isChecker(self):
+        """
+        Verifies that strcred.makeChecker('memory') returns an object
+        that implements the L{ICredentialsChecker} interface.
+        """
+        self.assertTrue(checkers.ICredentialsChecker.providedBy(self.checker))
+        self.assertIn(credentials.IUsernamePassword, self.checker.credentialInterfaces)
+
+    def test_fileCheckerSucceeds(self):
+        """
+        The checker works with valid credentials.
+        """
+
+        def _gotAvatar(username):
+            self.assertEqual(username, self.admin.username)
+
+        return self.checker.requestAvatarId(self.admin).addCallback(_gotAvatar)
+
+    def test_fileCheckerFailsUsername(self):
+        """
+        The checker fails with an invalid username.
+        """
+        return self.assertFailure(
+            self.checker.requestAvatarId(self.badUser), error.UnauthorizedLogin
+        )
+
+    def test_fileCheckerFailsPassword(self):
+        """
+        The checker fails with an invalid password.
+        """
+        return self.assertFailure(
+            self.checker.requestAvatarId(self.badPass), error.UnauthorizedLogin
+        )
+
+    def test_failsWithEmptyFilename(self):
+        """
+        An empty filename raises an error.
+        """
+        self.assertRaises(ValueError, strcred.makeChecker, "file")
+        self.assertRaises(ValueError, strcred.makeChecker, "file:")
+
+    def test_warnWithBadFilename(self):
+        """
+        When the file auth plugin is given a file that doesn't exist, it
+        should produce a warning.
+        """
+        oldOutput = cred_file.theFileCheckerFactory.errorOutput
+        newOutput = StringIO()
+        cred_file.theFileCheckerFactory.errorOutput = newOutput
+        strcred.makeChecker("file:" + self._fakeFilename())
+        cred_file.theFileCheckerFactory.errorOutput = oldOutput
+        self.assertIn(cred_file.invalidFileWarning, newOutput.getvalue())
+
+
+@skipIf(not pwd, "Required module not available: pwd")
+@skipIf(not requireModule("cryptography"), "cryptography is not available")
+class SSHCheckerTests(TestCase):
+    """
+    Tests for the C{--auth=sshkey:...} checker.  The majority of the
+    tests for the ssh public key database checker are in
+    L{twisted.conch.test.test_checkers.SSHPublicKeyCheckerTestCase}.
+    """
+
+    def test_isChecker(self):
+        """
+        Verifies that strcred.makeChecker('sshkey') returns an object
+        that implements the L{ICredentialsChecker} interface.
+        """
+        sshChecker = strcred.makeChecker("sshkey")
+        self.assertTrue(checkers.ICredentialsChecker.providedBy(sshChecker))
+        self.assertIn(credentials.ISSHPrivateKey, sshChecker.credentialInterfaces)
+
+
+class DummyOptions(usage.Options, strcred.AuthOptionMixin):
+    """
+    Simple options for testing L{strcred.AuthOptionMixin}.
+    """
+
+
+class CheckerOptionsTests(TestCase):
+    def test_createsList(self):
+        """
+        The C{--auth} command line creates a list in the
+        Options instance and appends values to it.
+        """
+        options = DummyOptions()
+        options.parseOptions(["--auth", "memory"])
+        self.assertEqual(len(options["credCheckers"]), 1)
+        options = DummyOptions()
+        options.parseOptions(["--auth", "memory", "--auth", "memory"])
+        self.assertEqual(len(options["credCheckers"]), 2)
+
+    def test_invalidAuthError(self):
+        """
+        The C{--auth} command line raises an exception when it
+        gets a parameter it doesn't understand.
+        """
+        options = DummyOptions()
+        # If someone adds a 'ThisPluginDoesNotExist' then this unit
+        # test should still run.
+        invalidParameter = getInvalidAuthType()
+        self.assertRaises(
+            usage.UsageError, options.parseOptions, ["--auth", invalidParameter]
+        )
+        self.assertRaises(
+            usage.UsageError,
+            options.parseOptions,
+            ["--help-auth-type", invalidParameter],
+        )
+
+    def test_createsDictionary(self):
+        """
+        The C{--auth} command line creates a dictionary mapping supported
+        interfaces to the list of credentials checkers that support it.
+        """
+        options = DummyOptions()
+        options.parseOptions(["--auth", "memory", "--auth", "anonymous"])
+        chd = options["credInterfaces"]
+        self.assertEqual(len(chd[credentials.IAnonymous]), 1)
+        self.assertEqual(len(chd[credentials.IUsernamePassword]), 1)
+        chdAnonymous = chd[credentials.IAnonymous][0]
+        chdUserPass = chd[credentials.IUsernamePassword][0]
+        self.assertTrue(checkers.ICredentialsChecker.providedBy(chdAnonymous))
+        self.assertTrue(checkers.ICredentialsChecker.providedBy(chdUserPass))
+        self.assertIn(credentials.IAnonymous, chdAnonymous.credentialInterfaces)
+        self.assertIn(credentials.IUsernamePassword, chdUserPass.credentialInterfaces)
+
+    def test_credInterfacesProvidesLists(self):
+        """
+        When two C{--auth} arguments are passed along which support the same
+        interface, a list with both is created.
+        """
+        options = DummyOptions()
+        options.parseOptions(["--auth", "memory", "--auth", "unix"])
+        self.assertEqual(
+            options["credCheckers"],
+            options["credInterfaces"][credentials.IUsernamePassword],
+        )
+
+    def test_listDoesNotDisplayDuplicates(self):
+        """
+        The list for C{--help-auth} does not duplicate items.
+        """
+        authTypes = []
+        options = DummyOptions()
+        for cf in options._checkerFactoriesForOptHelpAuth():
+            self.assertNotIn(cf.authType, authTypes)
+            authTypes.append(cf.authType)
+
+    def test_displaysListCorrectly(self):
+        """
+        The C{--help-auth} argument correctly displays all
+        available authentication plugins, then exits.
+        """
+        newStdout = StringIO()
+        options = DummyOptions()
+        options.authOutput = newStdout
+        self.assertRaises(SystemExit, options.parseOptions, ["--help-auth"])
+        for checkerFactory in strcred.findCheckerFactories():
+            self.assertIn(checkerFactory.authType, newStdout.getvalue())
+
+    def test_displaysHelpCorrectly(self):
+        """
+        The C{--help-auth-for} argument will correctly display the help file
+        for a particular authentication plugin.
+        """
+        newStdout = StringIO()
+        options = DummyOptions()
+        options.authOutput = newStdout
+        self.assertRaises(
+            SystemExit, options.parseOptions, ["--help-auth-type", "file"]
+        )
+        for line in cred_file.theFileCheckerFactory.authHelp:
+            if line.strip():
+                self.assertIn(line.strip(), newStdout.getvalue())
+
+    def test_unexpectedException(self):
+        """
+        When the checker specified by C{--auth} raises an unexpected error, it
+        should be caught and re-raised within a L{usage.UsageError}.
+        """
+        options = DummyOptions()
+        err = self.assertRaises(
+            usage.UsageError, options.parseOptions, ["--auth", "file"]
+        )
+        self.assertEqual(str(err), "Unexpected error: 'file' requires a filename")
+
+
+class OptionsForUsernamePassword(usage.Options, strcred.AuthOptionMixin):
+    supportedInterfaces = (credentials.IUsernamePassword,)
+
+
+class OptionsForUsernameHashedPassword(usage.Options, strcred.AuthOptionMixin):
+    supportedInterfaces = (credentials.IUsernameHashedPassword,)
+
+
+class OptionsSupportsAllInterfaces(usage.Options, strcred.AuthOptionMixin):
+    supportedInterfaces = None
+
+
+class OptionsSupportsNoInterfaces(usage.Options, strcred.AuthOptionMixin):
+    supportedInterfaces: Sequence[Type[Interface]] = []
+
+
+class LimitingInterfacesTests(TestCase):
+    """
+    Tests functionality that allows an application to limit the
+    credential interfaces it can support. For the purposes of this
+    test, we use IUsernameHashedPassword, although this will never
+    really be used by the command line.
+
+    (I have, to date, not thought of a half-decent way for a user to
+    specify a hash algorithm via the command-line. Nor do I think it's
+    very useful.)
+
+    I should note that, at first, this test is counter-intuitive,
+    because we're using the checker with a pre-defined hash function
+    as the 'bad' checker. See the documentation for
+    L{twisted.cred.checkers.FilePasswordDB.hash} for more details.
+    """
+
+    def setUp(self):
+        self.filename = self.mktemp()
+        with open(self.filename, "wb") as f:
+            f.write(b"admin:asdf\nalice:foo\n")
+        self.goodChecker = checkers.FilePasswordDB(self.filename)
+        self.badChecker = checkers.FilePasswordDB(self.filename, hash=self._hash)
+        self.anonChecker = checkers.AllowAnonymousAccess()
+
+    def _hash(self, networkUsername, networkPassword, storedPassword):
+        """
+        A dumb hash that doesn't really do anything.
+        """
+        return networkPassword
+
+    def test_supportsInterface(self):
+        """
+        The supportsInterface method behaves appropriately.
+        """
+        options = OptionsForUsernamePassword()
+        self.assertTrue(options.supportsInterface(credentials.IUsernamePassword))
+        self.assertFalse(options.supportsInterface(credentials.IAnonymous))
+        self.assertRaises(
+            strcred.UnsupportedInterfaces, options.addChecker, self.anonChecker
+        )
+
+    def test_supportsAllInterfaces(self):
+        """
+        The supportsInterface method behaves appropriately
+        when the supportedInterfaces attribute is None.
+        """
+        options = OptionsSupportsAllInterfaces()
+        self.assertTrue(options.supportsInterface(credentials.IUsernamePassword))
+        self.assertTrue(options.supportsInterface(credentials.IAnonymous))
+
+    def test_supportsCheckerFactory(self):
+        """
+        The supportsCheckerFactory method behaves appropriately.
+        """
+        options = OptionsForUsernamePassword()
+        fileCF = cred_file.theFileCheckerFactory
+        anonCF = cred_anonymous.theAnonymousCheckerFactory
+        self.assertTrue(options.supportsCheckerFactory(fileCF))
+        self.assertFalse(options.supportsCheckerFactory(anonCF))
+
+    def test_canAddSupportedChecker(self):
+        """
+        When addChecker is called with a checker that implements at least one
+        of the interfaces our application supports, it is successful.
+        """
+        options = OptionsForUsernamePassword()
+        options.addChecker(self.goodChecker)
+        iface = options.supportedInterfaces[0]
+        # Test that we did get IUsernamePassword
+        self.assertIdentical(options["credInterfaces"][iface][0], self.goodChecker)
+        self.assertIdentical(options["credCheckers"][0], self.goodChecker)
+        # Test that we didn't get IUsernameHashedPassword
+        self.assertEqual(len(options["credInterfaces"][iface]), 1)
+        self.assertEqual(len(options["credCheckers"]), 1)
+
+    def test_failOnAddingUnsupportedChecker(self):
+        """
+        When addChecker is called with a checker that does not implement any
+        supported interfaces, it fails.
+        """
+        options = OptionsForUsernameHashedPassword()
+        self.assertRaises(
+            strcred.UnsupportedInterfaces, options.addChecker, self.badChecker
+        )
+
+    def test_unsupportedInterfaceError(self):
+        """
+        The C{--auth} command line raises an exception when it
+        gets a checker we don't support.
+        """
+        options = OptionsSupportsNoInterfaces()
+        authType = cred_anonymous.theAnonymousCheckerFactory.authType
+        self.assertRaises(usage.UsageError, options.parseOptions, ["--auth", authType])
+
+    def test_helpAuthLimitsOutput(self):
+        """
+        C{--help-auth} will only list checkers that purport to
+        supply at least one of the credential interfaces our
+        application can use.
+        """
+        options = OptionsForUsernamePassword()
+        for factory in options._checkerFactoriesForOptHelpAuth():
+            invalid = True
+            for interface in factory.credentialInterfaces:
+                if options.supportsInterface(interface):
+                    invalid = False
+            if invalid:
+                raise strcred.UnsupportedInterfaces()
+
+    def test_helpAuthTypeLimitsOutput(self):
+        """
+        C{--help-auth-type} will display a warning if you get
+        help for an authType that does not supply at least one of the
+        credential interfaces our application can use.
+        """
+        options = OptionsForUsernamePassword()
+        # Find an interface that we can use for our test
+        invalidFactory = None
+        for factory in strcred.findCheckerFactories():
+            if not options.supportsCheckerFactory(factory):
+                invalidFactory = factory
+                break
+        self.assertNotIdentical(invalidFactory, None)
+        # Capture output and make sure the warning is there
+        newStdout = StringIO()
+        options.authOutput = newStdout
+        self.assertRaises(
+            SystemExit, options.parseOptions, ["--help-auth-type", "anonymous"]
+        )
+        self.assertIn(strcred.notSupportedWarning, newStdout.getvalue())