r47019 - clarify bytes in transport.py
hawkowl-TA+aISz0psMTMxyoc4vAAJOcrHinNvQL0E9HWUfgJXw@public.gmane.org Fri, 18 Mar 2016 03:18:49 -0600 (MDT)
| Newsgroups | gmane.comp.python.twisted.commits |
|---|---|
| Message-ID | <[email protected]> |
Author: hawkowl
Date: Fri Mar 18 03:18:44 2016
New Revision: 47019
Modified:
branches/clarity-sshtransport-8237/twisted/conch/ssh/transport.py
Log:
clarify bytes in transport.py
Modified: branches/clarity-sshtransport-8237/twisted/conch/ssh/transport.py
==============================================================================
--- branches/clarity-sshtransport-8237/twisted/conch/ssh/transport.py (original)
+++ branches/clarity-sshtransport-8237/twisted/conch/ssh/transport.py Fri Mar 18 03:18:44 2016
@@ -10,11 +10,15 @@
Maintainer: Paul Swartz
"""
+from __future__ import absolute_import, division
+
import struct
import zlib
-from hashlib import md5, sha1, sha256, sha512
import string
import hmac
+import binascii
+
+from hashlib import md5, sha1, sha256, sha512
from cryptography.exceptions import UnsupportedAlgorithm
from cryptography.hazmat.backends import default_backend
@@ -48,7 +52,7 @@
"""
if bits % 8:
raise ValueError("bits (%d) must be a multiple of 8" % (bits,))
- return int_from_bytes(random(bits / 8), 'big')
+ return int_from_bytes(random(bits // 8), 'big')
@@ -122,26 +126,26 @@
"""
cipherMap = {
- '3des-cbc': (algorithms.TripleDES, 24, modes.CBC),
- 'blowfish-cbc': (algorithms.Blowfish, 16, modes.CBC),
- 'aes256-cbc': (algorithms.AES, 32, modes.CBC),
- 'aes192-cbc': (algorithms.AES, 24, modes.CBC),
- 'aes128-cbc': (algorithms.AES, 16, modes.CBC),
- 'cast128-cbc': (algorithms.CAST5, 16, modes.CBC),
- 'aes128-ctr': (algorithms.AES, 16, modes.CTR),
- 'aes192-ctr': (algorithms.AES, 24, modes.CTR),
- 'aes256-ctr': (algorithms.AES, 32, modes.CTR),
- '3des-ctr': (algorithms.TripleDES, 24, modes.CTR),
- 'blowfish-ctr': (algorithms.Blowfish, 16, modes.CTR),
- 'cast128-ctr': (algorithms.CAST5, 16, modes.CTR),
- 'none': (None, 0, modes.CBC),
+ b'3des-cbc': (algorithms.TripleDES, 24, modes.CBC),
+ b'blowfish-cbc': (algorithms.Blowfish, 16, modes.CBC),
+ b'aes256-cbc': (algorithms.AES, 32, modes.CBC),
+ b'aes192-cbc': (algorithms.AES, 24, modes.CBC),
+ b'aes128-cbc': (algorithms.AES, 16, modes.CBC),
+ b'cast128-cbc': (algorithms.CAST5, 16, modes.CBC),
+ b'aes128-ctr': (algorithms.AES, 16, modes.CTR),
+ b'aes192-ctr': (algorithms.AES, 24, modes.CTR),
+ b'aes256-ctr': (algorithms.AES, 32, modes.CTR),
+ b'3des-ctr': (algorithms.TripleDES, 24, modes.CTR),
+ b'blowfish-ctr': (algorithms.Blowfish, 16, modes.CTR),
+ b'cast128-ctr': (algorithms.CAST5, 16, modes.CTR),
+ b'none': (None, 0, modes.CBC),
}
macMap = {
- 'hmac-sha2-512': sha512,
- 'hmac-sha2-256': sha256,
- 'hmac-sha1': sha1,
- 'hmac-md5': md5,
- 'none': None
+ b'hmac-sha2-512': sha512,
+ b'hmac-sha2-256': sha256,
+ b'hmac-sha1': sha1,
+ b'hmac-md5': md5,
+ b'none': None
}
@@ -153,8 +157,8 @@
self.encBlockSize = 0
self.decBlockSize = 0
self.verifyDigestSize = 0
- self.outMAC = (None, '', '', 0)
- self.inMAC = (None, '', '', 0)
+ self.outMAC = (None, b'', b'', 0)
+ self.inMAC = (None, b'', b'', 0)
def setKeys(self, outIV, outKey, inIV, inKey, outInteg, inInteg):
@@ -218,7 +222,7 @@
"""
mod = self.macMap[mac]
if not mod:
- return (None, '', '', 0)
+ return (None, b'', b'', 0)
# With stdlib we can only get attributes fron an instantiated object.
hashObject = mod()
@@ -228,9 +232,9 @@
# Truncation here appears to contravene RFC 2104, section 2. However,
# implementing the hashing behavior prescribed by the RFC breaks
# interoperability with OpenSSH (at least version 5.5p1).
- key = key[:digestSize] + ('\x00' * (blockSize - digestSize))
- i = string.translate(key, hmac.trans_36)
- o = string.translate(key, hmac.trans_5C)
+ key = key[:digestSize] + (b'\x00' * (blockSize - digestSize))
+ i = key.translate(hmac.trans_36)
+ o = key.translate(hmac.trans_5C)
result = _MACParams((mod, i, o, digestSize))
result.key = key
return result
@@ -277,7 +281,7 @@
@return: The serialized MAC.
"""
if not self.outMAC[0]:
- return ''
+ return b''
data = struct.pack('>L', seqid) + data
return hmac.HMAC(self.outMAC.key, data, self.outMAC[0]).digest()
@@ -299,7 +303,7 @@
@return: C{True} if the MAC is valid.
"""
if not self.inMAC[0]:
- return mac == ''
+ return mac == b''
data = struct.pack('>L', seqid) + data
outer = hmac.HMAC(self.inMAC.key, data, self.inMAC[0]).digest()
return mac == outer
@@ -314,9 +318,9 @@
@rtype: L{list} of L{str}
"""
supportedCiphers = []
- cs = ['aes256-ctr', 'aes256-cbc', 'aes192-ctr', 'aes192-cbc',
- 'aes128-ctr', 'aes128-cbc', 'cast128-ctr', 'cast128-cbc',
- 'blowfish-ctr', 'blowfish-cbc', '3des-ctr', '3des-cbc']
+ cs = [b'aes256-ctr', b'aes256-cbc', b'aes192-ctr', b'aes192-cbc',
+ b'aes128-ctr', b'aes128-cbc', b'cast128-ctr', b'cast128-cbc',
+ b'blowfish-ctr', b'blowfish-cbc', b'3des-ctr', b'3des-cbc']
for cipher in cs:
algorithmClass, keySize, modeClass = SSHCiphers.cipherMap[cipher]
try:
@@ -447,10 +451,10 @@
to send them while a key exchange is in progress. When the key
exchange completes, another attempt is made to send these messages.
"""
- protocolVersion = '2.0'
- version = 'Twisted'
- comment = ''
- ourVersionString = ('SSH-' + protocolVersion + '-' + version + ' '
+ protocolVersion = b'2.0'
+ version = b'Twisted'
+ comment = b''
+ ourVersionString = (b'SSH-' + protocolVersion + b'-' + version + b' '
+ comment).strip()
# C{none} is supported as cipher and hmac. For security they are disabled
@@ -459,21 +463,21 @@
# List ordered by preference.
supportedCiphers = _getSupportedCiphers()
supportedMACs = [
- 'hmac-sha2-512',
- 'hmac-sha2-256',
- 'hmac-sha1',
- 'hmac-md5',
+ b'hmac-sha2-512',
+ b'hmac-sha2-256',
+ b'hmac-sha1',
+ b'hmac-md5',
# `none`,
- ]
+ ]
supportedKeyExchanges = _kex.getSupportedKeyExchanges()
- supportedPublicKeys = ['ssh-rsa', 'ssh-dss']
- supportedCompressions = ['none', 'zlib']
+ supportedPublicKeys = [b'ssh-rsa', b'ssh-dss']
+ supportedCompressions = [b'none', b'zlib']
supportedLanguages = ()
- supportedVersions = ('1.99', '2.0')
+ supportedVersions = (b'1.99', b'2.0')
isClient = False
gotVersion = False
- buf = ''
+ buf = b''
outgoingPacketSequence = 0
incomingPacketSequence = 0
outgoingCompression = None
@@ -518,9 +522,9 @@
Called when the connection is made to the other side. We sent our
version and the MSG_KEXINIT packet.
"""
- self.transport.write('%s\r\n' % (self.ourVersionString,))
- self.currentEncryptions = SSHCiphers('none', 'none', 'none', 'none')
- self.currentEncryptions.setKeys('', '', '', '', '', '')
+ self.transport.write(self.ourVersionString + b'\r\n')
+ self.currentEncryptions = SSHCiphers(b'none', b'none', b'none', b'none')
+ self.currentEncryptions.setKeys(b'', b'', b'', b'', b'', b'')
self.sendKexInit()
@@ -541,17 +545,17 @@
self.ourKexInitPayload = (chr(MSG_KEXINIT) +
randbytes.secureRandom(16) +
- NS(','.join(self.supportedKeyExchanges)) +
- NS(','.join(self.supportedPublicKeys)) +
- NS(','.join(self.supportedCiphers)) +
- NS(','.join(self.supportedCiphers)) +
- NS(','.join(self.supportedMACs)) +
- NS(','.join(self.supportedMACs)) +
- NS(','.join(self.supportedCompressions)) +
- NS(','.join(self.supportedCompressions)) +
- NS(','.join(self.supportedLanguages)) +
- NS(','.join(self.supportedLanguages)) +
- '\000' + '\000\000\000\000')
+ NS(b','.join(self.supportedKeyExchanges)) +
+ NS(b','.join(self.supportedPublicKeys)) +
+ NS(b','.join(self.supportedCiphers)) +
+ NS(b','.join(self.supportedCiphers)) +
+ NS(b','.join(self.supportedMACs)) +
+ NS(b','.join(self.supportedMACs)) +
+ NS(b','.join(self.supportedCompressions)) +
+ NS(b','.join(self.supportedCompressions)) +
+ NS(b','.join(self.supportedLanguages)) +
+ NS(b','.join(self.supportedLanguages)) +
+ b'\000' + b'\000\000\000\000')
self.sendPacket(MSG_KEXINIT, self.ourKexInitPayload[1:])
self._keyExchangeState = self._KEY_EXCHANGE_REQUESTED
self._blockedByKeyExchange = []
@@ -655,13 +659,13 @@
packet = first + self.currentEncryptions.decrypt(encData[bs:])
if len(packet) != 4 + packetLen:
self.sendDisconnect(DISCONNECT_PROTOCOL_ERROR,
- 'bad decryption')
+ b'bad decryption')
return
if ms:
macData, self.buf = self.buf[:ms], self.buf[ms:]
if not self.currentEncryptions.verify(self.incomingPacketSequence,
packet, macData):
- self.sendDisconnect(DISCONNECT_MAC_ERROR, 'bad MAC')
+ self.sendDisconnect(DISCONNECT_MAC_ERROR, b'bad MAC')
return
payload = packet[5:-paddingLen]
if self.incomingCompression:
@@ -671,7 +675,7 @@
# Tolerate any errors in decompression
log.err()
self.sendDisconnect(DISCONNECT_COMPRESSION_ERROR,
- 'compression error')
+ b'compression error')
return
self.incomingPacketSequence += 1
return payload
@@ -687,7 +691,7 @@
@type remoteVersion: C{str}
"""
self.sendDisconnect(DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED,
- 'bad version ' + remoteVersion)
+ b'bad version ' + remoteVersion)
def dataReceived(self, data):
@@ -701,19 +705,19 @@
"""
self.buf = self.buf + data
if not self.gotVersion:
- if self.buf.find('\n', self.buf.find('SSH-')) == -1:
+ if self.buf.find(b'\n', self.buf.find(b'SSH-')) == -1:
return
- lines = self.buf.split('\n')
+ lines = self.buf.split(b'\n')
for p in lines:
- if p.startswith('SSH-'):
+ if p.startswith(b'SSH-'):
self.gotVersion = True
self.otherVersionString = p.strip()
- remoteVersion = p.split('-')[1]
+ remoteVersion = p.split(b'-')[1]
if remoteVersion not in self.supportedVersions:
self._unsupportedVersionReceived(remoteVersion)
return
i = lines.index(p)
- self.buf = '\n'.join(lines[i + 1:])
+ self.buf = b'\n'.join(lines[i + 1:])
packet = self.getPacket()
while packet:
messageNum = ord(packet[0])
@@ -840,7 +844,7 @@
k = getNS(packet[16:], 10)
strings, rest = k[:-1], k[-1]
(kexAlgs, keyAlgs, encCS, encSC, macCS, macSC, compCS, compSC, langCS,
- langSC) = [s.split(',') for s in strings]
+ langSC) = [s.split(b',') for s in strings]
# These are the server directions
outs = [encSC, macSC, compSC]
ins = [encCS, macSC, compCS]
@@ -866,11 +870,11 @@
if None in (self.kexAlg, self.keyAlg, self.outgoingCompressionType,
self.incomingCompressionType):
self.sendDisconnect(DISCONNECT_KEY_EXCHANGE_FAILED,
- "couldn't match all kex parts")
+ b"couldn't match all kex parts")
return
if None in self.nextEncryptions.__dict__.values():
self.sendDisconnect(DISCONNECT_KEY_EXCHANGE_FAILED,
- "couldn't match all kex parts")
+ b"couldn't match all kex parts")
return
log.msg('kex alg, key alg: %s %s' % (self.kexAlg, self.keyAlg))
log.msg('outgoing: %s %s %s' % (self.nextEncryptions.outCipType,
@@ -963,7 +967,7 @@
self.service.serviceStarted()
- def sendDebug(self, message, alwaysDisplay=False, language=''):
+ def sendDebug(self, message, alwaysDisplay=False, language=b''):
"""
Send a debug message to the other side.
@@ -1011,7 +1015,7 @@
@type desc: C{str}
"""
self.sendPacket(
- MSG_DISCONNECT, struct.pack('>L', reason) + NS(desc) + NS(''))
+ MSG_DISCONNECT, struct.pack('>L', reason) + NS(desc) + NS(b''))
log.msg('Disconnecting with error, code %s\nreason: %s' % (reason,
desc))
self.transport.loseConnection()
@@ -1054,12 +1058,12 @@
"""
if not self.sessionID:
self.sessionID = exchangeHash
- initIVCS = self._getKey('A', sharedSecret, exchangeHash)
- initIVSC = self._getKey('B', sharedSecret, exchangeHash)
- encKeyCS = self._getKey('C', sharedSecret, exchangeHash)
- encKeySC = self._getKey('D', sharedSecret, exchangeHash)
- integKeyCS = self._getKey('E', sharedSecret, exchangeHash)
- integKeySC = self._getKey('F', sharedSecret, exchangeHash)
+ initIVCS = self._getKey(b'A', sharedSecret, exchangeHash)
+ initIVSC = self._getKey(b'B', sharedSecret, exchangeHash)
+ encKeyCS = self._getKey(b'C', sharedSecret, exchangeHash)
+ encKeySC = self._getKey(b'D', sharedSecret, exchangeHash)
+ integKeyCS = self._getKey(b'E', sharedSecret, exchangeHash)
+ integKeySC = self._getKey(b'F', sharedSecret, exchangeHash)
outs = [initIVSC, encKeySC, integKeySC]
ins = [initIVCS, encKeyCS, integKeyCS]
if self.isClient: # Reverse for the client
@@ -1067,7 +1071,7 @@
outs, ins = ins, outs
self.nextEncryptions.setKeys(outs[0], outs[1], ins[0], ins[1],
outs[2], ins[2])
- self.sendPacket(MSG_NEWKEYS, '')
+ self.sendPacket(MSG_NEWKEYS, b'')
def _newKeys(self):
@@ -1079,9 +1083,9 @@
"""
log.msg('NEW KEYS')
self.currentEncryptions = self.nextEncryptions
- if self.outgoingCompressionType == 'zlib':
+ if self.outgoingCompressionType == b'zlib':
self.outgoingCompression = zlib.compressobj(6)
- if self.incomingCompressionType == 'zlib':
+ if self.incomingCompressionType == b'zlib':
self.incomingCompression = zlib.decompressobj()
self._keyExchangeState = self._KEY_EXCHANGE_NONE
@@ -1102,9 +1106,9 @@
@return: C{True} if it is encrypted.
"""
if direction == "out":
- return self.currentEncryptions.outCipType != 'none'
+ return self.currentEncryptions.outCipType != b'none'
elif direction == "in":
- return self.currentEncryptions.inCipType != 'none'
+ return self.currentEncryptions.inCipType != b'none'
elif direction == "both":
return self.isEncrypted("in") and self.isEncrypted("out")
else:
@@ -1122,9 +1126,9 @@
@return: C{True} if it is verified.
"""
if direction == "out":
- return self.currentEncryptions.outMACType != 'none'
+ return self.currentEncryptions.outMACType != b'none'
elif direction == "in":
- return self.currentEncryptions.inMACType != 'none'
+ return self.currentEncryptions.inMACType != b'none'
elif direction == "both":
return self.isVerified("in") and self.isVerified("out")
else:
@@ -1137,7 +1141,7 @@
DISCONNECT_CONNECTION_LOST message.
"""
self.sendDisconnect(DISCONNECT_CONNECTION_LOST,
- "user closed connection")
+ b"user closed connection")
# Client methods
@@ -1380,9 +1384,9 @@
@type packet: L{bytes}
@param packet: The message data.
"""
- if packet != '':
+ if packet != b'':
self.sendDisconnect(DISCONNECT_PROTOCOL_ERROR,
- "NEWKEYS takes no data")
+ b"NEWKEYS takes no data")
return
self._newKeys()
@@ -1403,7 +1407,7 @@
cls = self.factory.getService(self, service)
if not cls:
self.sendDisconnect(DISCONNECT_SERVICE_NOT_AVAILABLE,
- "don't have service %s" % service)
+ b"don't have service " + service)
return
else:
self.sendPacket(MSG_SERVICE_ACCEPT, NS(service))
@@ -1522,13 +1526,13 @@
pubKey, packet = getNS(packet)
f, packet = getMP(packet)
signature, packet = getNS(packet)
- fingerprint = ':'.join([ch.encode('hex') for ch in
- md5(pubKey).digest()])
+ fingerprint = b':'.join([binascii.hexlify(ch) for ch in
+ md5(pubKey).digest()])
d = self.verifyHostKey(pubKey, fingerprint)
d.addCallback(self._continueKEXDH_REPLY, pubKey, f, signature)
d.addErrback(
lambda unused: self.sendDisconnect(
- DISCONNECT_HOST_KEY_NOT_VERIFIABLE, 'bad host key'))
+ DISCONNECT_HOST_KEY_NOT_VERIFIABLE, b'bad host key'))
return d
@@ -1585,7 +1589,7 @@
exchangeHash = h.digest()
if not serverKey.verify(signature, exchangeHash):
self.sendDisconnect(DISCONNECT_KEY_EXCHANGE_FAILED,
- 'bad signature')
+ b'bad signature')
return
self._keySetup(sharedSecret, exchangeHash)
@@ -1613,7 +1617,7 @@
d.addCallback(self._continueGEX_REPLY, pubKey, f, signature)
d.addErrback(
lambda unused: self.sendDisconnect(
- DISCONNECT_HOST_KEY_NOT_VERIFIABLE, 'bad host key'))
+ DISCONNECT_HOST_KEY_NOT_VERIFIABLE, b'bad host key'))
return d
@@ -1653,7 +1657,7 @@
exchangeHash = h.digest()
if not serverKey.verify(signature, exchangeHash):
self.sendDisconnect(DISCONNECT_KEY_EXCHANGE_FAILED,
- 'bad signature')
+ b'bad signature')
return
self._keySetup(sharedSecret, exchangeHash)
@@ -1664,7 +1668,7 @@
"""
SSHTransportBase._keySetup(self, sharedSecret, exchangeHash)
if self._gotNewKeys:
- self.ssh_NEWKEYS('')
+ self.ssh_NEWKEYS(b'')
def ssh_NEWKEYS(self, packet):
@@ -1676,9 +1680,9 @@
@type packet: L{bytes}
@param packet: The message data.
"""
- if packet != '':
+ if packet != b'':
self.sendDisconnect(DISCONNECT_PROTOCOL_ERROR,
- "NEWKEYS takes no data")
+ b"NEWKEYS takes no data")
return
if not self.nextEncryptions.encBlockSize:
self._gotNewKeys = 1
@@ -1697,14 +1701,14 @@
@type packet: L{bytes}
@param packet: The message data.
"""
- if packet == '':
+ if packet == b'':
log.msg('got SERVICE_ACCEPT without payload')
else:
name = getNS(packet)[0]
if name != self.instance.name:
self.sendDisconnect(
DISCONNECT_PROTOCOL_ERROR,
- "received accept for service we did not request")
+ b"received accept for service we did not request")
self.setService(self.instance)
@@ -1802,7 +1806,7 @@
DH_GENERATOR, DH_PRIME = _kex.getDHGeneratorAndPrime(
- 'diffie-hellman-group1-sha1')
+ b'diffie-hellman-group1-sha1')
MSG_DISCONNECT = 1