Python proton.SASL類代碼示例

    def test_aaa_qdstat_connect_sasl_over_ssl(self):
        """
        Make qdstat use sasl plain authentication over ssl.
        """
        if not SASL.extended():
            self.skipTest("Cyrus library not available. skipping test")

        p = self.popen(
            ['qdstat', '-b', str(self.routers[0].addresses[2]), '-c',
             # The following are SASL args
             '--sasl-mechanisms=PLAIN',
             '[email protected]',
             '--sasl-password=password',
             # The following are SSL args
             '--ssl-disable-peer-name-verify',
             '--ssl-trustfile=' + self.ssl_file('ca-certificate.pem'),
             '--ssl-certificate=' + self.ssl_file('client-certificate.pem'),
             '--ssl-key=' + self.ssl_file('client-private-key.pem'),
             '--ssl-password=client-password'],
            name='qdstat-'+self.id(), stdout=PIPE, expect=None)

        out = p.communicate()[0]
        assert p.returncode == 0, \
            "qdstat exit status %s, output:\n%s" % (p.returncode, out)

        split_list = out.split()

        # There will be 2 connections that have authenticated using SASL PLAIN. One inter-router connection
        # and the other connection that this qdstat client is making
        self.assertEqual(2, split_list.count("[email protected](PLAIN)"))
        self.assertEqual(1, split_list.count("inter-router"))
        self.assertEqual(1, split_list.count("normal"))

    def test_qdstat_connect_sasl_password_file(self):
        """
        Make qdstat use sasl plain authentication with client password specified in a file.
        """
        if not SASL.extended():
            self.skipTest("Cyrus library not available. skipping test")

        password_file = os.getcwd() + '/sasl-client-password-file.txt'
        # Create a SASL configuration file.
        with open(password_file, 'w') as sasl_client_password_file:
            sasl_client_password_file.write("password")

        sasl_client_password_file.close()

        p = self.popen(
            ['qdstat', '-b', str(self.routers[0].addresses[2]), '-c', '--sasl-mechanisms=PLAIN',
             '[email protected]', '--sasl-password-file=' + password_file],
            name='qdstat-'+self.id(), stdout=PIPE, expect=None)

        out = p.communicate()[0]
        assert p.returncode == 0, \
            "qdstat exit status %s, output:\n%s" % (p.returncode, out)

        split_list = out.split()

        # There will be 2 connections that have authenticated using SASL PLAIN. One inter-router connection
        # and the other connection that this qdstat client is making
        self.assertEqual(2, split_list.count("[email protected](PLAIN)"))
        self.assertEqual(1, split_list.count("inter-router"))
        self.assertEqual(1, split_list.count("normal"))

    def setUpClass(cls):
        """
        Tests the delegation of sasl auth to an external auth service.

        Creates two routers, one acts as the authe service, the other configures the auth service plugin
        to point at this auth service.

        """
        super(AuthServicePluginTest, cls).setUpClass()

        if not SASL.extended():
            return

        cls.createSaslFiles()

        print('launching auth service...')
        auth_service_port = cls.tester.get_port()
        cls.tester.qdrouterd('auth_service', Qdrouterd.Config([
                     ('listener', {'host': '0.0.0.0', 'role': 'normal', 'port': auth_service_port,
                                   'saslMechanisms':'PLAIN', 'authenticatePeer': 'yes'}),
                     ('router', {'workerThreads': 1,
                                 'id': 'auth_service',
                                 'mode': 'standalone',
                                 'saslConfigName': 'tests-mech-PLAIN',
                                 'saslConfigPath': os.getcwd()})
        ])).wait_ready()

        cls.router_port = cls.tester.get_port()
        cls.tester.qdrouterd('router', Qdrouterd.Config([
                     ('authServicePlugin', {'name':'myauth', 'authService': '127.0.0.1:%d' % auth_service_port}),
                     ('listener', {'host': '0.0.0.0', 'port': cls.router_port, 'role': 'normal', 'saslPlugin':'myauth', 'saslMechanisms':'PLAIN'}),
                     ('router', {'mode': 'standalone', 'id': 'router'})
        ])).wait_ready()

    def test_connected_tls_sasl_routers(self):
        """
        Validates if all expected routers are connected in the network
        """
        if not SASL.extended():
            self.skipTest("Cyrus library not available. skipping test")

        router_nodes = self.get_router_nodes()
        self.assertTrue(router_nodes)
        for node in router_nodes:
            self.assertTrue(node in self.connected_tls_sasl_routers,
                            "%s should not be connected" % node)

        # Router A and B are always expected (no tls version restriction)
        expected_nodes = len(self.connected_tls_sasl_routers)

        # Router C only if TLSv1.2 is allowed
        if not RouterTestSslClient.OPENSSL_ALLOW_TLSV1_2:
            expected_nodes -= 1

        # Router D only if TLSv1.1 is allowed
        if not RouterTestSslClient.OPENSSL_ALLOW_TLSV1_1:
            expected_nodes -= 1

        self.assertEqual(len(router_nodes), expected_nodes)

    def test_inter_router_plain_over_ssl_exists(self):
        """The setUpClass sets up two routers with SASL PLAIN enabled over TLS/SSLv3.

        This test makes executes a query for type='org.apache.qpid.dispatch.connection' over
        an unauthenticated listener to
        QDR.X and makes sure that the output has an "inter-router" connection to
        QDR.Y whose authentication is PLAIN. This ensures that QDR.Y did not
        somehow use SASL ANONYMOUS to connect to QDR.X
        Also makes sure that TLSv1/SSLv3 was used as sslProto

        """
        if not SASL.extended():
            self.skipTest("Cyrus library not available. skipping test")

        local_node = Node.connect(self.routers[0].addresses[1], timeout=TIMEOUT)
        results = local_node.query(type='org.apache.qpid.dispatch.connection').results

        # sslProto should be TLSv1/SSLv3
        self.assertEqual(u'TLSv1/SSLv3', results[0][10])

        # role should be inter-router
        self.assertEqual(u'inter-router', results[0][3])

        # sasl must be plain
        self.assertEqual(u'PLAIN', results[0][6])

        # user must be [email protected]
        self.assertEqual(u'[email protected]', results[0][8])

    def setUpClass(cls):
        """
        Creates two routers (QDR.X and QDR.Y) and sets up PLAIN authentication on QDR.X.
        QDR.Y connects to QDR.X by providing a sasl_username and a sasl_password.

        """
        super(RouterTestDeprecated, cls).setUpClass()

        if not SASL.extended():
            return

        super(RouterTestDeprecated, cls).createSaslFiles()

        cls.routers = []

        x_listener_port = cls.tester.get_port()
        y_listener_port = cls.tester.get_port()

        super(RouterTestDeprecated, cls).router('X', [
                     ('listener', {'addr': '0.0.0.0', 'role': 'inter-router', 'port': x_listener_port,
                                   'saslMechanisms':'PLAIN', 'authenticatePeer': 'yes'}),
                     # This unauthenticated listener is for qdstat to connect to it.
                     ('listener', {'addr': '0.0.0.0', 'role': 'normal', 'port': cls.tester.get_port(),
                                   'authenticatePeer': 'no'}),
                     ('container', {'workerThreads': 1,
                                    'containerName': 'Qpid.Dispatch.Router.A',
                                    'saslConfigName': 'tests-mech-PLAIN',
                                    'saslConfigPath': os.getcwd()}),
                     ('linkRoutePattern', {'prefix': 'org.apache'}),
                     ('router', {'routerId': 'QDR.X', 'mode': 'interior'}),
                     ('fixedAddress', {'prefix': '/closest/', 'fanout': 'single', 'bias': 'closest'}),
                     ('fixedAddress', {'prefix': '/spread/', 'fanout': 'single', 'bias': 'spread'}),
                     ('fixedAddress', {'prefix': '/multicast/', 'fanout': 'multiple'}),
                     ('fixedAddress', {'prefix': '/', 'fanout': 'multiple'}),
        ])

        super(RouterTestDeprecated, cls).router('Y', [
                     ('connector', {'addr': '0.0.0.0', 'role': 'inter-router',
                                    'port': x_listener_port,
                                    'saslMechanisms': 'PLAIN',
                                    'saslUsername': '[email protected]',
                                    'saslPassword': 'password'}),

                     ('router', {'mode': 'interior',
                                 'routerId': 'QDR.Y'}),
                     ('linkRoutePattern', {'prefix': 'org.apache'}),
                     ('container', {'workerThreads': 1,
                                    'containerName': 'Qpid.Dispatch.Router.Y'}),

                     ('listener', {'addr': '0.0.0.0',
                                   'role': 'normal',
                                   'port': y_listener_port}),
                     ('fixedAddress', {'prefix': '/closest/', 'fanout': 'single', 'bias': 'closest'}),
                     ('fixedAddress', {'prefix': '/spread/', 'fanout': 'single', 'bias': 'spread'}),
                     ('fixedAddress', {'prefix': '/multicast/', 'fanout': 'multiple'}),
                     ('fixedAddress', {'prefix': '/', 'fanout': 'multiple'}),
        ])

        cls.routers[1].wait_router_connected('QDR.X')

    def test_deprecated(self):
        """
        Tests deprecated attributes like linkRoutePattern, container, fixedAddress etc.
        This test makes executes a query for type='org.apache.qpid.dispatch.connection' over
        an unauthenticated listener to
        QDR.X and makes sure that the output has an "inter-router" connection to
        QDR.Y whose authentication is PLAIN. This ensures that QDR.Y did not
        somehow use SASL ANONYMOUS to connect to QDR.X
        Also makes sure that TLSv1/SSLv3 was used as sslProto

        """
        if not SASL.extended():
            self.skipTest("Cyrus library not available. skipping test")
            
        local_node = Node.connect(self.routers[0].addresses[1], timeout=TIMEOUT)

        # saslConfigName and saslConfigPath were set in the ContainerEntity. This tests makes sure that the
        # saslConfigName and saslConfigPath were loaded properly from the ContainerEntity.
        # ContainerEntity has been deprecated.

        # role should be inter-router
        self.assertEqual(u'inter-router', local_node.query(type='org.apache.qpid.dispatch.connection').results[0][3])

        # sasl must be plain
        self.assertEqual(u'PLAIN', local_node.query(type='org.apache.qpid.dispatch.connection').results[0][6])

        # user must be [email protected]
        self.assertEqual(u'[email protected]', local_node.query(type='org.apache.qpid.dispatch.connection').results[0][8])

        # Make sure that the deprecated linkRoutePattern is set up correctly
        query_response = local_node.query(type='org.apache.qpid.dispatch.router.config.linkRoute')

        self.assertEqual(2, len(query_response.results))
        self.assertEqual("in", query_response.results[0][7])
        self.assertEqual("out", query_response.results[1][7])

        results = local_node.query(type='org.apache.qpid.dispatch.router.config.address').results

        multicast_found = False
        spread_found = False
        closest_found = False

        for result in results:
            if result[3] == 'closest':
                closest_found = True
                self.assertEqual(result[4], 'closest')
            if result[3] == 'spread':
                spread_found = True
                self.assertEqual(result[4], 'balanced')
            if result[3] == 'multicast':
                multicast_found = True
                self.assertEqual(result[4], 'multicast')

        self.assertTrue(multicast_found)
        self.assertTrue(spread_found)
        self.assertTrue(closest_found)

    def test_ssl_sasl_client_invalid(self):
        """
        Attempts to connect a Proton client using a valid SASL authentication info
        and forcing the TLS protocol version, which should be rejected by the listener.
        :return:
        """
        if not SASL.extended():
            self.skipTest("Cyrus library not available. skipping test")

        exp_tls_results = self.get_expected_tls_result([True, False, True, False])
        self.assertEqual(exp_tls_results[1], self.is_ssl_sasl_client_accepted(self.PORT_TLS_SASL, "TLSv1.1"))

    def test_valid_credentials(self):
        """
        Check authentication succeeds when valid credentials are presented.

        """
        if not SASL.extended():
            self.skipTest("Cyrus library not available. skipping test")

        test = SimpleConnect("127.0.0.1:%d" % self.router_port, '[email protected]', 'password')
        test.run()
        self.assertEqual(True, test.connected)
        self.assertEqual(None, test.error)

    def test_invalid_credentials(self):
        """
        Check authentication fails when invalid credentials are presented.

        """
        if not SASL.extended():
            self.skipTest("Cyrus library not available. skipping test")

        test = SimpleConnect("127.0.0.1:%d" % self.router_port, '[email protected]', 'foo')
        test.run()
        self.assertEqual(False, test.connected)
        self.assertEqual('amqp:unauthorized-access', test.error.name)
        self.assertEqual(test.error.description.startswith('Authentication failed'), True)

    def setUpClass(cls):
        """
        Tests the sasl_username, sasl_password property of the dispatch router.

        Creates two routers (QDR.X and QDR.Y) and sets up PLAIN authentication on QDR.X.
        QDR.Y connects to QDR.X by providing a sasl_username and a sasl_password.

        """
        super(RouterTestPlainSasl, cls).setUpClass()

        if not SASL.extended():
            return

        super(RouterTestPlainSasl, cls).createSaslFiles()

        cls.routers = []

        x_listener_port = cls.tester.get_port()
        y_listener_port = cls.tester.get_port()

        super(RouterTestPlainSasl, cls).router('X', [
                     ('listener', {'host': '0.0.0.0', 'role': 'inter-router', 'port': x_listener_port,
                                   'saslMechanisms':'PLAIN', 'authenticatePeer': 'yes'}),
                     # This unauthenticated listener is for qdstat to connect to it.
                     ('listener', {'host': '0.0.0.0', 'role': 'normal', 'port': cls.tester.get_port(),
                                   'authenticatePeer': 'no'}),
                     ('listener', {'host': '0.0.0.0', 'role': 'normal', 'port': cls.tester.get_port(),
                                   'saslMechanisms':'PLAIN', 'authenticatePeer': 'yes'}),
                     ('router', {'workerThreads': 1,
                                 'id': 'QDR.X',
                                 'mode': 'interior',
                                 'saslConfigName': 'tests-mech-PLAIN',
                                 # Leave as saslConfigPath for testing backward compatibility
                                 'saslConfigPath': os.getcwd()}),
        ])

        super(RouterTestPlainSasl, cls).router('Y', [
                     ('connector', {'host': '0.0.0.0', 'role': 'inter-router', 'port': x_listener_port,
                                    # Provide a sasl user name and password to connect to QDR.X
                                   'saslMechanisms': 'PLAIN',
                                    'saslUsername': '[email protected]',
                                    'saslPassword': 'password'}),
                     ('router', {'workerThreads': 1,
                                 'mode': 'interior',
                                 'id': 'QDR.Y'}),
                     ('listener', {'host': '0.0.0.0', 'role': 'normal', 'port': y_listener_port}),
        ])

        cls.routers[1].wait_router_connected('QDR.X')

    def get_router_nodes(self):
        """
        Retrieves connected router nodes.
        :return:
        """
        if not SASL.extended():
            self.skipTest("Cyrus library not available. skipping test")

        url = Url("amqp://0.0.0.0:%d/$management" % self.PORT_NO_SSL)
        node = Node.connect(url)
        response = node.query(type="org.apache.qpid.dispatch.router.node", attribute_names=["id"])
        router_nodes = []
        for resp in response.get_dicts():
            router_nodes.append(resp['id'])
        node.close()
        return router_nodes

    def test_no_inter_router_connection(self):
        """
        Tests to make sure that there are no 'inter-router' connections.
        The connection to the other router will not happen because the connection failed
        due to setting 'verifyHostName': 'yes'
        """
        if not SASL.extended():
            self.skipTest("Cyrus library not available. skipping test")

        local_node = Node.connect(self.routers[1].addresses[0], timeout=TIMEOUT)
        results = local_node.query(type='org.apache.qpid.dispatch.connection').results
        # There should be only two connections.
        # There will be no inter-router connection
        self.assertEqual(2, len(results))
        self.assertEqual('in', results[0][4])
        self.assertEqual('normal', results[0][3])
        self.assertEqual('anonymous', results[0][8])
        self.assertEqual('normal', results[1][3])
        self.assertEqual('anonymous', results[1][8])

    def test_zzz_delete_create_ssl_profile(self):
        """
        Deletes a connector and its corresponding ssl profile and recreates both
        """
        if not SASL.extended():
            self.skipTest("Cyrus library not available. skipping test")

        local_node = self.routers[1].management

        connections = local_node.query(type='org.apache.qpid.dispatch.connection').get_entities()
        self.assertIn("QDR.X", [c.container for c in connections]) # We can find the connection before
        local_node.delete(type='connector', name='connectorToX')
        local_node.delete(type='sslProfile', name='client-ssl-profile')
        connections = local_node.query(type='org.apache.qpid.dispatch.connection').get_entities()
        self.assertNotIn("QDR.X", [c.container for c in connections]) # Should not be present now

        # re-create the ssl profile
        local_node.create({'type': 'sslProfile',
                     'name': 'client-ssl-profile',
                     'certFile': self.ssl_file('client-certificate.pem'),
                     'keyFile': self.ssl_file('client-private-key.pem'),
                     'password': 'client-password',
                     'certDb': self.ssl_file('ca-certificate.pem')})
        # re-create connector
        local_node.create({'type': 'connector',
                     'name': 'connectorToX',
                     'host': '127.0.0.1',
                     'port': self.x_listener_port,
                     'saslMechanisms': 'PLAIN',
                     'sslProfile': 'client-ssl-profile',
                     'role': 'inter-router',
                     'verifyHostName': False,
                     'saslUsername': '[email protected]',
                     'saslPassword': 'password'})
        self.routers[1].wait_connectors()
        results = local_node.query(type='org.apache.qpid.dispatch.connection').results

        self.common_asserts(results)

    def test_inter_router_plain_exists(self):
        """
        Check authentication of inter-router link is PLAIN.

        This test makes executes a qdstat -c via an unauthenticated listener to
        QDR.X and makes sure that the output has an "inter-router" connection to
        QDR.Y whose authentication is PLAIN. This ensures that QDR.Y did not
        somehow use SASL ANONYMOUS to connect to QDR.X

        """

        if not SASL.extended():
            self.skipTest("Cyrus library not available. skipping test")

        p = self.popen(
            ['qdstat', '-b', str(self.routers[0].addresses[1]), '-c'],
            name='qdstat-'+self.id(), stdout=PIPE, expect=None)
        out = p.communicate()[0]
        assert p.returncode == 0, \
            "qdstat exit status %s, output:\n%s" % (p.returncode, out)

        self.assertIn("inter-router", out)
        self.assertIn("[email protected](PLAIN)", out)