def _lookup(self, name, cls, type, timeout):
        now = self._reactor.seconds()
        q = dns.Query(name, type, cls)
        try:
            when, (ans, auth, add) = self.cache[q]
        except KeyError:
            if self.verbose > 1:
                log.msg('Cache miss for ' + repr(name))
            return defer.fail(failure.Failure(dns.DomainError(name)))
        else:
            if self.verbose:
                log.msg('Cache hit for ' + repr(name))
            diff = now - when

            try:
                result = (
                    [dns.RRHeader(r.name.name, r.type, r.cls, r.ttl - diff,
                                  r.payload) for r in ans],
                    [dns.RRHeader(r.name.name, r.type, r.cls, r.ttl - diff,
                                  r.payload) for r in auth],
                    [dns.RRHeader(r.name.name, r.type, r.cls, r.ttl - diff,
                                  r.payload) for r in add])
            except ValueError:
                return defer.fail(failure.Failure(dns.DomainError(name)))
            else:
                return defer.succeed(result)

    def _pamConv(self, items):
        """
        Convert a list of PAM authentication questions into a
        MSG_USERAUTH_INFO_REQUEST.  Returns a Deferred that will be called
        back when the user has responses to the questions.

        @param items: a list of 2-tuples (message, kind).  We only care about
            kinds 1 (password) and 2 (text).
        @type items: C{list}
        @rtype: L{defer.Deferred}
        """
        resp = []
        for message, kind in items:
            if kind == 1: # password
                resp.append((message, 0))
            elif kind == 2: # text
                resp.append((message, 1))
            elif kind in (3, 4):
                return defer.fail(error.ConchError(
                    'cannot handle PAM 3 or 4 messages'))
            else:
                return defer.fail(error.ConchError(
                    'bad PAM auth kind %i' % kind))
        packet = NS('') + NS('') + NS('')
        packet += struct.pack('>L', len(resp))
        for prompt, echo in resp:
            packet += NS(prompt)
            packet += chr(echo)
        self.transport.sendPacket(MSG_USERAUTH_INFO_REQUEST, packet)
        self._pamDeferred = defer.Deferred()
        return self._pamDeferred

 def _get(self, keys, withIdentifier, multiple):
     """
     Helper method for C{get} and C{getMultiple}.
     """
     keys = list(keys)
     if self._disconnected:
         return fail(RuntimeError("not connected"))
     for key in keys:
         if not isinstance(key, bytes):
             return fail(ClientError(
                 "Invalid type for key: %s, expecting bytes" %
                 (type(key),)))
         if len(key) > self.MAX_KEY_LENGTH:
             return fail(ClientError("Key too long"))
     if withIdentifier:
         cmd = b"gets"
     else:
         cmd = b"get"
     fullcmd = b" ".join([cmd] + keys)
     self.sendLine(fullcmd)
     if multiple:
         values = dict([(key, (0, b"", None)) for key in keys])
         cmdObj = Command(cmd, keys=keys, values=values, multiple=True)
     else:
         cmdObj = Command(cmd, key=keys[0], value=None, flags=0, cas=b"",
                          multiple=False)
     self._current.append(cmdObj)
     return cmdObj._deferred

        def wrapped(*args, **kwargs):
            if self.__closed:
                return defer.fail(self.__closed)

            d = defer.Deferred()
            self.__calls.add(d)
            d.addCallback(self.__clear_call, d)

            def single_argument(*args):
                """
                Make sure that the deferred is called with a single argument.
                In case the original callback fires with more than one, convert
                to a tuple.
                """
                if len(args) > 1:
                    d.callback(tuple(args))
                else:
                    d.callback(*args)

            kwargs['callback'] = single_argument

            try:
                method(*args, **kwargs)
            except:
                return defer.fail()
            return d

    def start(self):
        """
        Start TLS negotiation.

        This checks if the receiving entity requires TLS, the SSL library is
        available and uses the C{required} and C{wanted} instance variables to
        determine what to do in the various different cases.

        For example, if the SSL library is not available, and wanted and
        required by the user, it raises an exception. However if it is not
        required by both parties, initialization silently succeeds, moving
        on to the next step.
        """
        if self.wanted:
            if ssl is None:
                if self.required:
                    return defer.fail(TLSNotSupported())
                else:
                    return defer.succeed(None)
            else:
                pass
        elif self.xmlstream.features[self.feature].required:
            return defer.fail(TLSRequired())
        else:
            return defer.succeed(None)

        self._deferred = defer.Deferred()
        self.xmlstream.addOnetimeObserver("/proceed", self.onProceed)
        self.xmlstream.addOnetimeObserver("/failure", self.onFailure)
        self.xmlstream.send(domish.Element((NS_XMPP_TLS, "starttls")))
        return self._deferred

    def getStep(self, stepid=None, buildid=None, number=None, name=None):
        tbl = self.db.model.steps
        if stepid is not None:
            wc = (tbl.c.id == stepid)
        else:
            if buildid is None:
                return defer.fail(RuntimeError('must supply either stepid or buildid'))
            if number is not None:
                wc = (tbl.c.number == number)
            elif name is not None:
                wc = (tbl.c.name == name)
            else:
                return defer.fail(RuntimeError('must supply either number or name'))
            wc = wc & (tbl.c.buildid == buildid)

        def thd(conn):
            q = self.db.model.steps.select(whereclause=wc)
            res = conn.execute(q)
            row = res.fetchone()

            rv = None
            if row:
                rv = self._stepdictFromRow(row)
            res.close()
            return rv
        return self.db.pool.do(thd)

 def runBehavior(self, behavior, args, command):
     """
     Implement the given behavior.  Returns a Deferred.
     """
     if behavior == 'rc':
         command.rc = args[0]
     elif behavior == 'err':
         return defer.fail(args[0])
     elif behavior == 'update':
         command.updates.setdefault(args[0], []).append(args[1])
     elif behavior == 'log':
         name, streams = args
         if 'header' in streams:
             command.logs[name].addHeader(streams['header'])
         if 'stdout' in streams:
             command.logs[name].addStdout(streams['stdout'])
             if command.collectStdout:
                 command.stdout += streams['stdout']
         if 'stderr' in streams:
             command.logs[name].addStderr(streams['stderr'])
             if command.collectStderr:
                 command.stderr += streams['stderr']
     elif behavior == 'callable':
         return defer.maybeDeferred(lambda: args[0](command))
     else:
         return defer.fail(failure.Failure(
             AssertionError('invalid behavior %s' % behavior)))
     return defer.succeed(None)

 def requestAvatarId(self, cred): # pylint: disable=R0201
     """get user id from database"""
     args = cred.username.split(SERVERMARK)
     if len(args) > 1:
         if args[0] == 'adduser':
             cred.username = args[1]
             password = args[2]
             with Transaction():
                 query = Query('insert into player(name,password) values(?,?)',
                     list([cred.username.decode('utf-8'), password.decode('utf-8')]))
                 if not query.success:
                     if query.msg.startswith('ERROR: constraint failed') \
                     or 'not unique' in query.msg:
                         template = m18nE('User %1 already exists')
                         logInfo(m18n(template, cred.username))
                         query.msg = srvMessage(template, cred.username)
                     else:
                         logInfo(query.msg)
                     return fail(credError.UnauthorizedLogin(query.msg))
         elif args[1] == 'deluser':
             pass
     query = Query('select id, password from player where name=?',
         list([cred.username.decode('utf-8')]))
     if not len(query.records):
         template = 'Wrong username: %1'
         logInfo(m18n(template, cred.username))
         return fail(credError.UnauthorizedLogin(srvMessage(template, cred.username)))
     userid, password = query.records[0]
     # checkPassword uses md5 which cannot handle unicode strings (python 2.7)
     defer1 = maybeDeferred(cred.checkPassword, password.encode('utf-8'))
     defer1.addCallback(DBPasswordChecker._checkedPassword, userid)
     return defer1

 def callRemote(self, signal_name):
     """Fake a call to a given remote method."""
     if signal_name == self.missing_signal:
         return defer.fail(NoSuchMethod())
     if signal_name == self.failing_signal:
         return defer.fail(self.random_exception)
     raise ValueError("not a valid fake signal name")

def httpRequest(url, payload, headers, method='POST', timeout=DEFAULT_TIMEOUT, ctx_factory=None):
    # copied from twisted.web.client in order to get access to the
    # factory (which contains response codes, headers, etc)

    if type(url) is not str:
        e = HTTPRequestError('URL must be string, not %s' % type(url))
        return defer.fail(e)

    if not url.startswith('http'):
        e = HTTPRequestError('URL does not start with http (URL %s)' % (url))
        return defer.fail(e)

    log.msg(" -- Sending Payload to %s --\n%s\n -- END. Sending Payload --" % (url, payload), system=LOG_SYSTEM, payload=True)

    scheme, netloc, _ , _, _, _ = twhttp.urlparse(url)
    if not ':' in netloc:
        host = netloc
        port = 80 if scheme == 'http' else 443
    else:
        host, s_port = netloc.split(':',1)
        port = int(s_port)

    factory = twclient.HTTPClientFactory(url, method, postdata=payload, timeout=timeout)
    factory.noisy = False # stop spewing about factory start/stop
    factory.protocol.handleStatus_204 = lambda _ : None # 204 is an ok reply, needed by NCS VPN backend

    # fix missing port in header (bug in twisted.web.client)
    factory.headers['host'] = host + ':' + str(port)
    factory.headers['User-Agent'] = 'OpenNSA/Twisted'

    for header, value in headers.items():
        factory.headers[header] = value

    if scheme == 'https':
        if ctx_factory is None:
            return defer.fail(HTTPRequestError('Cannot perform https request without context factory'))
        reactor.connectSSL(host, port, factory, ctx_factory)
    else:
        reactor.connectTCP(host, port, factory)

    def invocationError(err):
        if isinstance(err.value, ConnectionClosed): # note: this also includes ConnectionDone and ConnectionLost
            pass # these are pretty common when the remote shuts down
        elif isinstance(err.value, WebError):
            data = err.value.response
            log.msg(' -- Received Reply (fault) --\n%s\n -- END. Received Reply (fault) --' % data, system=LOG_SYSTEM, payload=True)
            return err
        elif isinstance(err.value, ConnectionRefusedError):
            log.msg('Connection refused for %s:%i. Request URL: %s' % (host, port, url), system=LOG_SYSTEM)
            return err
        else:
            return err

    def logReply(data):
        log.msg(" -- Received Reply --\n%s\n -- END. Received Reply --" % data, system=LOG_SYSTEM, payload=True)
        return data

    factory.deferred.addCallbacks(logReply, invocationError)

    return factory.deferred

    def startTLS(self, contextFactory=None):
        """
        Initiates a 'STLS' request and negotiates the TLS / SSL
        Handshake.

        @type contextFactory: C{ssl.ClientContextFactory} @param
        contextFactory: The context factory with which to negotiate
        TLS.  If C{None}, try to create a new one.

        @return: A Deferred which fires when the transport has been
        secured according to the given contextFactory, or which fails
        if the transport cannot be secured.
        """
        tls = interfaces.ITLSTransport(self.transport, None)
        if tls is None:
            return defer.fail(TLSError(
                "POP3Client transport does not implement "
                "interfaces.ITLSTransport"))

        if contextFactory is None:
            contextFactory = self._getContextFactory()

        if contextFactory is None:
            return defer.fail(TLSError(
                "POP3Client requires a TLS context to "
                "initiate the STLS handshake"))

        d = self.capabilities()
        d.addCallback(self._startTLS, contextFactory, tls)
        return d

    def get(self, key, withIdentifier=False):
        """
        Get the given C{key}. It doesn't support multiple keys. If
        C{withIdentifier} is set to C{True}, the command issued is a C{gets},
        that will return the current identifier associated with the value. This
        identifier has to be used when issuing C{checkAndSet} update later,
        using the corresponding method.

        @param key: The key to retrieve.
        @type key: C{str}

        @param withIdentifier: If set to C{True}, retrieve the current
            identifier along with the value and the flags.
        @type withIdentifier: C{bool}

        @return: A deferred that will fire with the tuple (flags, value) if
            C{withIdentifier} is C{False}, or (flags, cas identifier, value)
            if C{True}.
        @rtype: L{Deferred}
        """
        if not isinstance(key, str):
            return fail(ClientError(
                "Invalid type for key: %s, expecting a string" % (type(key),)))
        if len(key) > self.MAX_KEY_LENGTH:
            return fail(ClientError("Key too long"))
        if withIdentifier:
            cmd = "gets"
        else:
            cmd = "get"
        fullcmd = "%s %s" % (cmd, key)
        self.sendLine(fullcmd)
        cmdObj = Command(cmd, key=key, value=None, flags=0, cas="")
        self._current.append(cmdObj)
        return cmdObj._deferred

 def _lookup(self, name, cls, type, timeout = None):
     results = []
     authority = []
     additional = []
     ttl = max(self.soa[1].minimum, self.soa[1].expire)
     try:
         for record in self.records[name.lower()]:
             if record.TYPE == type or type == dns.ALL_RECORDS:
                 results.append(
                     dns.RRHeader(name, record.TYPE, dns.IN, ttl, record)
                 )
             elif record.TYPE == dns.NS and type != dns.ALL_RECORDS:
                 authority.append(
                     dns.RRHeader(name, record.TYPE, dns.IN, ttl, record)
                 )
         
         for record in results + authority:
             if record.type == dns.NS or record.type == dns.CNAME:
                 n = str(record.payload.name)
                 for rec in self.records.get(n.lower(), ()):
                     if rec.TYPE == dns.A:
                         additional.append(
                             dns.RRHeader(n, dns.A, dns.IN, ttl, rec)
                         )
         return defer.succeed((results, authority, additional))
     except KeyError:
         if name.lower().endswith(self.soa[0].lower()):
             # We are the authority and we didn't find it.  Goodbye.
             return defer.fail(failure.Failure(dns.AuthoritativeDomainError(name)))
         return defer.fail(failure.Failure(dns.DomainError(name)))

    def test_acquire_retry_never_acquired(self):
        """BasicLock.acquire will retry max_retry times and then give up."""
        lock_uuid = uuid.uuid1()

        clock = task.Clock()
        lock = BasicLock(self.client, self.table_name, lock_uuid, max_retry=1, reactor=clock)

        responses = [
            defer.fail(BusyLockError('', '')),
            defer.fail(BusyLockError('', ''))
        ]

        def _new_verify_lock(response):
            return responses.pop(0)
        lock._verify_lock = _new_verify_lock

        def _side_effect(*args, **kwargs):
            return defer.succeed([])
        self.client.execute.side_effect = _side_effect

        d = lock.acquire()

        clock.advance(20)
        result = self.failureResultOf(d)
        self.assertTrue(result.check(BusyLockError))
        self.assertEqual(self.client.execute.call_count, 4)

    def requestAvatarId(self, credentials):
        if pwd:
            try:
                cryptedPass = pwd.getpwnam(credentials.username)[1]
            except KeyError:
                return defer.fail(UnauthorizedLogin())
            else:
                if cryptedPass not in ["*", "x"] and verifyCryptedPassword(cryptedPass, credentials.password):
                    return defer.succeed(credentials.username)
        if shadow:
            gid = os.getegid()
            uid = os.geteuid()
            os.setegid(0)
            os.seteuid(0)
            try:
                shadowPass = shadow.getspnam(credentials.username)[1]
            except KeyError:
                os.setegid(gid)
                os.seteuid(uid)
                return defer.fail(UnauthorizedLogin())
            os.setegid(gid)
            os.seteuid(uid)
            if verifyCryptedPassword(shadowPass, credentials.password):
                return defer.succeed(credentials.username)
            return defer.fail(UnauthorizedLogin())

        return defer.fail(UnauthorizedLogin())

    def requestAvatarId(self, credentials):
        # We get bytes, but the Py3 pwd module uses str. So attempt to decode
        # it using the same method that CPython does for the file on disk.
        if _PY3:
            username = credentials.username.decode(sys.getfilesystemencoding())
            password = credentials.password.decode(sys.getfilesystemencoding())
        else:
            username = credentials.username
            password = credentials.password

        for func in self._getByNameFunctions:
            try:
                pwnam = func(username)
            except KeyError:
                return defer.fail(UnauthorizedLogin("invalid username"))
            else:
                if pwnam is not None:
                    crypted = pwnam[1]
                    if crypted == '':
                        continue

                    if verifyCryptedPassword(crypted, password):
                        return defer.succeed(credentials.username)
        # fallback
        return defer.fail(UnauthorizedLogin("unable to verify password"))

    def create_webhooks(self, policy_id, data):
        """
        see :meth:`otter.models.interface.IScalingGroup.create_webhooks`
        """
        if self.error is not None:
            return defer.fail(self.error)

        if policy_id in self.policies:
            max_webhooks = config_value('limits.absolute.maxWebhooksPerPolicy')
            curr_webhooks = len(self.webhooks.get(policy_id, []))
            if len(data) + curr_webhooks > max_webhooks:
                return defer.fail(
                    WebhooksOverLimitError(self.tenant_id, self.uuid,
                                           policy_id, max_webhooks,
                                           curr_webhooks, len(data)))

            created = []
            for webhook_input in data:
                webhook_real = {'metadata': {}}
                webhook_real.update(webhook_input)
                webhook_real['capability'] = {}

                (webhook_real['capability']['version'],
                 webhook_real['capability']['hash']) = generate_capability()

                uuid = str(uuid4())
                self.webhooks[policy_id][uuid] = webhook_real
                # return a copy so this store doesn't get mutated
                created.append(dict(id=uuid, **webhook_real))

            return defer.succeed(created)
        else:
            return defer.fail(NoSuchPolicyError(self.tenant_id,
                                                self.uuid, policy_id))

 def create_flowinfo(netinfos):
     for ni in netinfos:
         flowinfo  = _FlowInfo.from_netinfo_tuple(ni,rurl)
         return flowinfo
     #FIXME: in the future, we should throw an Auth_event for each
     # netinfo this IP is bound to.   
     defer.fail("No netinfos found matching %s" % request.getClientIP())

    def connect(self, *args, **kwargs):
        """
        Connect to the database.

        Positional arguments will be passed to the psycop2.connect()
        method. Use them to pass database names, usernames, passwords, etc.

        @rtype: C{Deferred}
        @returns: A Deferred that will fire when the connection is open.
        """
        if self._connection and not self._connection.closed:
            return defer.fail(AlreadyConnected())

        kwargs['async'] = True
        try:
            self._connection = self.connectionFactory(*args, **kwargs)
        except:
            return defer.fail()

        def startReadingAndPassthrough(ret):
            self.reactor.addReader(self)
            return ret

        # The connection is always a reader in the reactor, to receive NOTIFY
        # events immediately when they're available.
        d = self.poll()
        return d.addCallback(startReadingAndPassthrough)

    def startTLS(self, contextFactory=None):
        """
        Switch to encrypted communication using TLS.

        The first step of switching to encrypted communication is obtaining
        the server's capabilities.  When that is complete, the L{_startTLS}
        callback function continues the switching process.

        @type contextFactory: L{NoneType <types.NoneType>} or
            L{ClientContextFactory <twisted.internet.ssl.ClientContextFactory>}
        @param contextFactory: The context factory with which to negotiate TLS.
            If not provided, try to create a new one.

        @rtype: L{Deferred <defer.Deferred>} which successfully results in
            L{dict} mapping L{bytes} to L{list} of L{bytes} and/or L{bytes} to
            L{NoneType <types.NoneType>} or fails with L{TLSError}
        @return: A deferred which fires when the transport has been
            secured according to the given context factory with the server
            capabilities, or which fails with a TLS error if the transport
            cannot be secured.
        """
        tls = interfaces.ITLSTransport(self.transport, None)
        if tls is None:
            return defer.fail(TLSError("POP3Client transport does not implement " "interfaces.ITLSTransport"))

        if contextFactory is None:
            contextFactory = self._getContextFactory()

        if contextFactory is None:
            return defer.fail(TLSError("POP3Client requires a TLS context to " "initiate the STLS handshake"))

        d = self.capabilities()
        d.addCallback(self._startTLS, contextFactory, tls)
        return d