­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ 3 iO@s.ddlZddlZddlZddlZddlmZmZddlZddl m Z m Z m Z ddl m Z mZmZmZmZmZmZmZddl mZmZddl mZmZmZmZddl mZdd l mZdd lmZmZdd l m!Z!dd l m"Z"dd l m#Z#ddl m$Z$ddl m%Z%GdddZ&GdddZ'GdddZ(dS)N)hexlify unhexlify) PassphrasePasswordRetriesExceeded bin_to_hex) PlaintextKey PassphraseKeyAuthenticatedKeyRepoKey KeyfileKeyBlake2KeyfileKey Blake2RepoKeyBlake2AuthenticatedKey)ID_HMAC_SHA_256ID_BLAKE2b_256)TAMRequiredError TAMInvalidTAMUnsupportedSuiteErrorUnsupportedManifestError)ArchiveTAMInvalid) identify_key) bytes_to_longnum_aes_blocks)IntegrityError)Location) StableDict)get_security_dir)msgpackc@seZdZGdddZdjZeejdddZ edZ djZ e j d Ze j d Zejd d Zejeeeeeeefd ddZGdddZddZddZddZddZddZ ddZ!ddZ"d d!Z#d"d#Z$d$d%Z%d&d'Z&d(d)Z'd*d+Z(d,d-Z)d.d/Z*d0S)1TestKeyc@seZdZeejdZdS)zTestKey.MockArgsN)__name__ __module__ __qualname__rtempfileZmkstemplocationr&r&/usr/lib64/python3.6/key.pyMockArgssr(aU BORG_KEY 0000000000000000000000000000000000000000000000000000000000000000 hqppdGVyYXRpb25zzgABhqCkaGFzaNoAIMyonNI+7Cjv0qHi0AOBM6bLGxACJhfgzVD2oq bIS9SFqWFsZ29yaXRobaZzaGEyNTakc2FsdNoAINNK5qqJc1JWSUjACwFEWGTdM7Nd0a5l 1uBGPEb+9XM9p3ZlcnNpb24BpGRhdGHaANAYDT5yfPpU099oBJwMomsxouKyx/OG4QIXK2 hQCG2L2L/9PUu4WIuKvGrsXoP7syemujNfcZws5jLp2UPva4PkQhQsrF1RYDEMLh2eF9Ol rwtkThq1tnh7KjWMG9Ijt7/aoQtq0zDYP/xaFF8XXSJxiyP5zjH5+spB6RL0oQHvbsliSh /cXJq7jrqmrJ1phd6dg4SHAM/i+hubadZoS6m25OQzYAW09wZD/phG8OVa698Z5ed3HTaT SmrtgJL3EoOKgUI9d6BLE4dJdBqntifoz\Wz 0055f161493fcfc16276e8c31493c4641e1eb19a79d0326fad0291e5a9c98e5933 00000000000003e8d21eaf9b86c297a8cd56432e1915bb Z@c3fbf14bc001ebcc3cd86e696c13482ed071740927cd7cbe1b01b4bfcee49314ay BORG_KEY 0000000000000000000000000000000000000000000000000000000000000000 hqlhbGdvcml0aG2mc2hhMjU2pGRhdGHaAZBu680Do3CmfWzeMCwe48KJi3Vps9mEDy7MKF TastsEhiAd1RQMuxfZpklkLeddMMWk+aPtFiURRFb02JLXV5cKRC1o2ZDdiNa0nao+o6+i gUjjsea9TAu25t3vxh8uQWs5BuKRLBRr0nUgrSd0IYMUgn+iVbLJRzCCssvxsklkwQxN3F Y+MvBnn8kUXSeoSoQ2l0fBHzq94Y7LMOm/owMam5URnE8/UEc6ZXBrbyX4EXxDtUqJcs+D i451thtlGdigDLpvf9nyK66mjiCpPCTCgtlzq0Pe1jcdhnsUYLg+qWzXZ7e2opEZoC6XxS 3DIuBOxG3Odqj9IKB+6/kl94vz98awPWFSpYcLZVWu7sIP38ZkUK+ad5MHTo/LvTuZdFnd iqKzZIDUJl3Zl1WGmP/0xVOmfIlznkCZy4d3SMuujwIcqQ5kDvwDRPpdhBBk+UWQY5vFXk kR1NBNLSTyhAzu3fiUmFl0qZ+UWPRkGAEBy/NuoEibrWwab8BX97cATyvnmOqYkU9PT0C6 l2l9E4bPpGhhc2jaACDnIa8KgKv84/b5sjaMgSZeIVkuKSLJy2NN8zoH8lnd36ppdGVyYX Rpb25zzgABhqCkc2FsdNoAIEJLlLh7q74j3q53856H5GgzA1HH+aW5bA/as544+PGkp3Zl cnNpb24BZd04fdf9475cf2323c0ba7a99ddc011064f2e7d039f539f2e4480e6f5fc6ff9993d604040404040404098c8cee1c6db8c28947Z@d8bc68e961c79f99be39061589e5179b2113cd9226e07b08ddd4a1fef7ce93fbcCs|jdt||S)NZ BORG_KEYS_DIR)setenvstr)selfrequest monkeypatchtmpdirr&r&r'keys_dirEszTestKey.keys_dir)ZparamscCs"|jdd|jj|j|jS)NBORG_PASSPHRASEtest)r*ZparamcreateMockRepositoryr()r,r-r.r&r&r'keyJs z TestKey.keyc@sPeZdZGdddZeZedZeeZddZ ddZ dd Z d d Z d S) zTestKey.MockRepositoryc@seZdZdZZddZdS)z TestKey.MockRepository._Locationz /some/placecCs|jS)N) processed)r,r&r&r'canonical_path[sz/TestKey.MockRepository._Location.canonical_pathN)r!r"r#rawr6r7r&r&r&r' _LocationXsr9 cCsdS)Nr&)r,r&r&r'get_free_noncebsz%TestKey.MockRepository.get_free_noncecCsdS)Nr&)r,Znext_unreservedZ start_noncer&r&r'commit_nonce_reservationesz/TestKey.MockRepository.commit_nonce_reservationcCs ||_dS)N)key_data)r,datar&r&r'save_keyhszTestKey.MockRepository.save_keycCs|jS)N)r=)r,r&r&r'load_keykszTestKey.MockRepository.load_keyN) r!r"r#r9Z _locationbytesidrid_strr;r<r?r@r&r&r&r'r4Wsr4cCsJtjdd}d}t|j|dks&t||j|j||j|ksFtdS)Nsfoos@2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae)rr3rid_hashAssertionErrordecryptencrypt)r,r5chunkr&r&r'test_plaintextns zTestKey.test_plaintextc Cs.|jddtj|j|j}t|jjddks6t|j d}|j |dksRt|j d}||ksht|j d||j d|kst|j |dkst|j |}tj |j|}t|jjd|t t|tjkstt|j|j|jhdkst|jdkstd}||j |j||j |ks*tdS) Nr1r2rsABCr sfoo)r*r r3r4r(r enc_cipherivrErG extract_noncerFdetectrlenPAYLOAD_OVERHEADid_keyenc_key enc_hmac_key chunk_seedrD) r,r.r0r5manifest manifest2rMkey2rHr&r&r' test_keyfilets      (zTestKey.test_keyfilec Cs|jdd|j}ttjjt|jdd}|jdWdQRXt j ||j }|j d}|j |dkspt|jd|dkstdS)Nr1r2ZnoncewZ0000000000002000sABCi )r*r4openospathjoinrrCwriter r3r(rGrNrErF)r,r.r0 repositoryfdr5r>r&r&r'&test_keyfile_nonce_rollback_protections  z.TestKey.test_keyfile_nonce_rollback_protectionc Cs|jd}|jdt||jdd|j s4ttj|j|j}|jsTtd}|j |}|j |}tj |j|}||j ||kst|j tjttj |j|WdQRXdS)Nkeyfile BORG_KEY_FILEr1ZtestkfsABC)r^r*r+existsrEr r3r4r(rDrGrOrFremovepytestraisesFileNotFoundError)r,r/r.rcr5rHZchunk_idZ chunk_cdatar&r&r'test_keyfile_kfenvs      zTestKey.test_keyfile_kfenvc Csb|jdjd}|j|jWdQRX|jddtj|j|j}|j |j |jdks^t dS)NrcrZr1 passphrasespayload) r^r[r_keyfile2_key_filer*r rOr4keyfile2_cdatarF keyfile2_idrE)r,r.r0rar5r&r&r' test_keyfile2s  zTestKey.test_keyfile2c Csv|jd}|jd}|j|jWdQRX|jdt||jddtj|j|j }|j |j |j dksrt dS)NrcrZrdr1rkspayload) r^r[r_rlr*r+r rOr4rmrFrnrE)r,r/r.rcrar5r&r&r'test_keyfile2_kfenvs   zTestKey.test_keyfile2_kfenvc Csb|jdjd}|j|jWdQRX|jddtj|j|j}|j |j |jdks^t dS)NrcrZr1rkspayload) r^r[r_keyfile_blake2_key_filer*r rOr4keyfile_blake2_cdatarFkeyfile_blake2_idrE)r,r.r0rar5r&r&r'test_keyfile_blake2s  zTestKey.test_keyfile_blake2c Cs|jddtj|jd}t|jjddks2tt|j dksDtt|j dksVtt|j dksht|j d ksvt|j d }|j|dkst|j d }||kst|jd||jd|kst|j|d kst|j|}tj|j|}t|jjd|tt|tjkst|j |j ks,t|j |j ks>t|j |j ksPt|j |j ksbtd }t|j|d ks~t||j|j||j |kstdS)Nr1r2rJrs@793b0717f9d8fb01c751a487e9b827897ceea62409870600013fbc6b4d8d7ca6s@b885a05d329a086627412a6142aaeb9f6c54ab7950f996dd65587251f6bc0901s@2ff3654c6daf7381dbbe718d2b20b4f1ea1e34caa6cc65f6bb3ac376b93fed2ai=<.sABCr sfoos@818217cf07d37efad3860766dcdf1d21e401650fed2d76ed1d797d3aae925990i#)r*r r3r4rrLrMrErrRrTrSrUrGrNrFrOrrPrQrD) r,r0r.r5rVrWrMrXrHr&r&r'test_passphrases.     *zTestKey.test_passphrasec Cs>t|}||dN<tjt|jd|WdQRXdS)Nr ) bytearrayrgrhrrF)r,r5r>offsetr&r&r' _corrupt_bytes zTestKey._corrupt_bytecCs|jdjd}|j|jWdQRX|jddtj|j|j}|j}x"t t |D]}|j |||qZWt j t2t|j}t|j|}d|d<|j||WdQRXdS)NrcrZr1rkr )r^r[r_rlr*r rOr4rmrangerPryrgrhrrwrDrF)r,r.r0rar5r>irBr&r&r'test_decrypt_integritys   zTestKey.test_decrypt_integritycCsR|j}d}|j|}t|}||jks*t|j||}|jd|}||ksNtdS)Nsfoo)r`rGr __class__rErOrF)r,r5r` plaintext encryptedZidentified_key_classZ loaded_keyZ decryptedr&r&r'test_roundtrips   zTestKey.test_roundtripcCs>d}|j|}|jd|dd|ks&t|jd||ks:tdS)Ns 123456789F)Z decompress)rGrFrE)r,r5rrr&r&r'test_decrypt_decompresss zTestKey.test_decrypt_decompresscCsd}|j|}|j||t|}|ddN<tjt|j||WdQRX|d}tjt|j||WdQRXdS)Ns 123456789rr 1)rDZ assert_idrwrgrhr)r,r5rrBZ id_changedZplaintext_changedr&r&r'test_assert_ids    zTestKey.test_assert_idcCsd|jddtj|j|j}tjtjks0tt|j dksBtd}|j |}|d|ks`tdS)Nr1r2r:s 123456789s) r*r r3r4r(rDrrErPrRrG)r,r.r5r authenticatedr&r&r'test_authenticated_encrypts  z"TestKey.test_authenticated_encryptcCsd|jddtj|j|j}tjtjks0tt|j dksBtd}|j |}|d|ks`tdS)Nr1r2s 123456789s) r*rr3r4r(rDrrErPrRrG)r,r.r5rrr&r&r'!test_blake2_authenticated_encrypts  z)TestKey.test_blake2_authenticated_encryptN)+r!r"r#r(striprlrresubrmrnrqrAfromhexrrrsrgfixturer0rr r r r rrr5r4rIrYrbrjrorprtruryr}rrrrrr&r&r&r'rsB        rc@s,eZdZddZddZddZddZd S) TestPassphrasecCs|jtddd|jddtj|j\}}d|ks>td|ksJt|jddtj}|j\}}d|ksvtd|kst|d kst|jtdd dtj|j\}}d |kstd |kstdS) NgetpasscSsdS)Nu 12aöäür&)promptr&r&r'szATestPassphrase.test_passphrase_new_verification..ZBORG_DISPLAY_PASSPHRASEnoZ12yesZ313261c3b6c3a4c3bcu 12aöäücSsdS)Nz1234/@=r&)rr&r&r'r*sz1234/@=)setattrrr*rnew readouterrrE)r,capsysr.outerrrkr&r&r' test_passphrase_new_verifications"           z/TestPassphrase.test_passphrase_new_verificationc Cs\|jdd|jtdddtjttjddWdQRX|j\}}d|ksXt dS)Nr1FrcSsdS)Nr)r&)rr&r&r'r2sz:TestPassphrase.test_passphrase_new_empty..)Z allow_emptyzmust not be blank) delenvrrrgrhrrrrrE)r,rr.rrr&r&r'test_passphrase_new_empty0s    z(TestPassphrase.test_passphrase_new_emptyc sP|jddttd|jtdfddtjttj WdQRXdS)Nr1Frcs ttS)N)r+next)r)ascending_numbersr&r'r;sz.) riterr{rrrgrhrrr)r,r.r&)rr'test_passphrase_new_retries8s    z*TestPassphrase.test_passphrase_new_retriescCsdttdkstdS)NZsecret)reprrrE)r,r&r&r'test_passphrase_repr?sz#TestPassphrase.test_passphrase_reprN)r!r"r#rrrrr&r&r&r'rsrc@s eZdZejddZddZddZddZd d Z d d Z ej j d ie fddie fdefdeffddZej j d ie fddie fdefdeffddZej j diedfedifdedfeddffddZddZddZej j dd%d!d"Zej j dd&d#d$ZdS)'TestTAMcCs |jddtjtjtjS)Nr1r2)r*r r3rr4r()r,r.r&r&r'r5Ds z TestTAM.keycCsRd}tjt|j|WdQRXd}tjttjf|j|WdQRXdS)Ns foobars)rgrhrunpack_and_verify_manifest ValueErrorrZUnpackException)r,r5blobr&r&r'test_unpack_futureIs  zTestTAM.test_unpack_futurecCsNtji}tjt|j|WdQRXtjt|j|WdQRXdS)N)rpackbrgrhrrunpack_and_verify_archive)r,r5rr&r&r'test_missing_when_requiredRs    z"TestTAM.test_missing_when_requiredcCs^tji}d|_|j|\}}|iks*t| s4t|j|\}}}|iksPt| sZtdS)NF)rr tam_requiredrrEr)r,r5runpackedverified_r&r&r' test_missingYs    zTestTAM.test_missingcCsVtjdddii}tjt|j|WdQRXtjt|j|WdQRXdS)Ntamtype HMAC_VOLLBIT)rrrgrhrrr)r,r5rr&r&r'test_unknown_type_when_requiredcs   z'TestTAM.test_unknown_type_when_requiredcCsftjdddii}d|_|j|\}}|iks2t| srrr&r&r'test_wrong_typess    zTestTAM.test_wrong_typescCsxddi}|j|dd}|jds$ttj|}|dddksBt|j|\}}|sXt|d d kshtd|ksttdS) Nfoobarsmanifest)contextstamstypesHKDF_HMAC_SHA512sfoosbar)pack_and_authenticate_metadata startswithrErunpackbr)r,r5r>rrrr&r&r'test_round_trip_manifests z TestTAM.test_round_trip_manifestcCszddi}|j|dd}|jds$ttj|}|dddksBt|j|\}}}|sZt|d d ksjtd|ksvtdS) Nrrsarchive)rrstamstypesHKDF_HMAC_SHA512sfoosbar)rrrErrr)r,r5r>rrrrr&r&r'test_round_trip_archives zTestTAM.test_round_trip_archivewhichhmacsaltc Csddi}|j|dd}|jds$ttj|td}t|d|dksJt|d|d d td |d|<t|d|dksttj|}t j t |j |WdQRXdS) Nrrsmanifest)rr) object_hookstamrrr:) rrrErrrrPrArrgrhrr)r,r5rr>rrr&r&r'test_tampered_manifests$  zTestTAM.test_tampered_manifestc Csddi}|j|dd}|jds$ttj|td}t|d|dksJt|d|d d td |d|<t|d|dksttj|}t j t |j |WdQRXdS) Nrrsarchive)rr)rstamrrr:) rrrErrrrPrArrgrhrr)r,r5rr>rrr&r&r'test_tampered_archives$  zTestTAM.test_tampered_archive)rr)rr)r!r"r#rgrr5rrrrrZmarkZ parametrizerrrrrrArrrrrr&r&r&r'rCs2            r))rZos.pathr\rr$ZbinasciirrrgZ crypto.keyrrrrr r r r r rrrrrrrrrrZcrypto.low_levelrrZhelpersrrrrrrrrr&r&r&r's,(       )