def test_ed25519(self):
        key1 = Ed25519Key.from_private_key_file(test_path('test_ed25519.key'))
        key2 = Ed25519Key.from_private_key_file(
            test_path('test_ed25519_password.key'), b'abc123'
        )

        self.assertNotEqual(key1.asbytes(), key2.asbytes())

    def test_certificates(self):
        # PKey.load_certificate
        key = RSAKey.from_private_key_file(test_path('test_rsa.key'))
        self.assertTrue(key.public_blob is None)
        key.load_certificate(test_path('test_rsa.key-cert.pub'))
        self.assertTrue(key.public_blob is not None)
        self.assertEqual(key.public_blob.key_type, '[email protected]')
        self.assertEqual(key.public_blob.comment, 'test_rsa.key.pub')
        # Delve into blob contents, for test purposes
        msg = Message(key.public_blob.key_blob)
        self.assertEqual(msg.get_text(), '[email protected]')
        nonce = msg.get_string()
        e = msg.get_mpint()
        n = msg.get_mpint()
        self.assertEqual(e, key.public_numbers.e)
        self.assertEqual(n, key.public_numbers.n)
        # Serial number
        self.assertEqual(msg.get_int64(), 1234)

        # Prevented from loading certificate that doesn't match
        key1 = Ed25519Key.from_private_key_file(test_path('test_ed25519.key'))
        self.assertRaises(
            ValueError,
            key1.load_certificate,
            test_path('test_rsa.key-cert.pub'),
        )

    def test_2_client_dsa(self):
        """
        verify that SSHClient works with a DSA key.
        """
        threading.Thread(target=self._run).start()
        host_key = paramiko.RSAKey.from_private_key_file(test_path('test_rsa.key'))
        public_host_key = paramiko.RSAKey(data=host_key.asbytes())

        self.tc = paramiko.SSHClient()
        self.tc.get_host_keys().add('[%s]:%d' % (self.addr, self.port), 'ssh-rsa', public_host_key)
        self.tc.connect(self.addr, self.port, username='slowdive', key_filename=test_path('test_dss.key'))

        self.event.wait(1.0)
        self.assertTrue(self.event.isSet())
        self.assertTrue(self.ts.is_active())
        self.assertEqual('slowdive', self.ts.get_username())
        self.assertEqual(True, self.ts.is_authenticated())

        stdin, stdout, stderr = self.tc.exec_command('yes')
        schan = self.ts.accept(1.0)

        schan.send('Hello there.\n')
        schan.send_stderr('This is on stderr.\n')
        schan.close()

        self.assertEqual('Hello there.\n', stdout.readline())
        self.assertEqual('', stdout.readline())
        self.assertEqual('This is on stderr.\n', stderr.readline())
        self.assertEqual('', stderr.readline())

        stdin.close()
        stdout.close()
        stderr.close()

 def _run(self, allowed_keys=None, delay=0):
     if allowed_keys is None:
         allowed_keys = FINGERPRINTS.keys()
     self.socks, addr = self.sockl.accept()
     self.ts = paramiko.Transport(self.socks)
     keypath = test_path('test_rsa.key')
     host_key = paramiko.RSAKey.from_private_key_file(keypath)
     self.ts.add_server_key(host_key)
     keypath = test_path('test_ecdsa_256.key')
     host_key = paramiko.ECDSAKey.from_private_key_file(keypath)
     self.ts.add_server_key(host_key)
     server = NullServer(allowed_keys=allowed_keys)
     if delay:
         time.sleep(delay)
     self.ts.start_server(self.event, server)

 def _run(self):
     self.socks, addr = self.sockl.accept()
     self.ts = paramiko.Transport(self.socks)
     host_key = paramiko.RSAKey.from_private_key_file(test_path('test_rsa.key'))
     self.ts.add_server_key(host_key)
     server = NullServer()
     self.ts.start_server(self.event, server)

 def test_L_handshake_timeout(self):
     """
     verify that we can get a hanshake timeout.
     """
     # Tweak client Transport instance's Packetizer instance so
     # its read_message() sleeps a bit. This helps prevent race conditions
     # where the client Transport's timeout timer thread doesn't even have
     # time to get scheduled before the main client thread finishes
     # handshaking with the server.
     # (Doing this on the server's transport *sounds* more 'correct' but
     # actually doesn't work nearly as well for whatever reason.)
     class SlowPacketizer(Packetizer):
         def read_message(self):
             time.sleep(1)
             return super(SlowPacketizer, self).read_message()
     # NOTE: prettttty sure since the replaced .packetizer Packetizer is now
     # no longer doing anything with its copy of the socket...everything'll
     # be fine. Even tho it's a bit squicky.
     self.tc.packetizer = SlowPacketizer(self.tc.sock)
     # Continue with regular test red tape.
     host_key = RSAKey.from_private_key_file(test_path('test_rsa.key'))
     public_host_key = RSAKey(data=host_key.asbytes())
     self.ts.add_server_key(host_key)
     event = threading.Event()
     server = NullServer()
     self.assertTrue(not event.is_set())
     self.tc.handshake_timeout = 0.000000000001
     self.ts.start_server(event, server)
     self.assertRaises(EOFError, self.tc.connect,
                       hostkey=public_host_key,
                       username='slowdive',
                       password='pygmalion')

 def test_3_simple(self):
     """
     verify that we can establish an ssh link with ourselves across the
     loopback sockets.  this is hardly "simple" but it's simpler than the
     later tests. :)
     """
     host_key = RSAKey.from_private_key_file(test_path('test_rsa.key'))
     public_host_key = RSAKey(data=host_key.asbytes())
     self.ts.add_server_key(host_key)
     event = threading.Event()
     server = NullServer()
     self.assertTrue(not event.is_set())
     self.assertEqual(None, self.tc.get_username())
     self.assertEqual(None, self.ts.get_username())
     self.assertEqual(False, self.tc.is_authenticated())
     self.assertEqual(False, self.ts.is_authenticated())
     self.ts.start_server(event, server)
     self.tc.connect(hostkey=public_host_key,
                     username='slowdive', password='pygmalion')
     event.wait(1.0)
     self.assertTrue(event.is_set())
     self.assertTrue(self.ts.is_active())
     self.assertEqual('slowdive', self.tc.get_username())
     self.assertEqual('slowdive', self.ts.get_username())
     self.assertEqual(True, self.tc.is_authenticated())
     self.assertEqual(True, self.ts.is_authenticated())

 def test_3_multiple_key_files(self):
     """
     verify that SSHClient accepts and tries multiple key files.
     """
     # This is dumb :(
     types_ = {
         'rsa': 'ssh-rsa',
         'dss': 'ssh-dss',
         'ecdsa': 'ecdsa-sha2-nistp256',
     }
     # Various combos of attempted & valid keys
     # TODO: try every possible combo using itertools functions
     for attempt, accept in (
         (['rsa', 'dss'], ['dss']), # Original test #3
         (['dss', 'rsa'], ['dss']), # Ordering matters sometimes, sadly
         (['dss', 'rsa', 'ecdsa'], ['dss']), # Try ECDSA but fail
         (['rsa', 'ecdsa'], ['ecdsa']), # ECDSA success
     ):
         try:
             self._test_connection(
                 key_filename=[
                     test_path('test_{0}.key'.format(x)) for x in attempt
                 ],
                 allowed_keys=[types_[x] for x in accept],
             )
         finally:
             # Clean up to avoid occasional gc-related deadlocks.
             # TODO: use nose test generators after nose port
             self.tearDown()
             self.setUp()

    def setup_test_server(
        self, client_options=None, server_options=None, connect_kwargs=None,
    ):
        host_key = RSAKey.from_private_key_file(test_path('test_rsa.key'))
        public_host_key = RSAKey(data=host_key.asbytes())
        self.ts.add_server_key(host_key)

        if client_options is not None:
            client_options(self.tc.get_security_options())
        if server_options is not None:
            server_options(self.ts.get_security_options())

        event = threading.Event()
        self.server = NullServer()
        self.assertTrue(not event.is_set())
        self.ts.start_server(event, self.server)
        if connect_kwargs is None:
            connect_kwargs = dict(
                hostkey=public_host_key,
                username='slowdive',
                password='pygmalion',
            )
        self.tc.connect(**connect_kwargs)
        event.wait(1.0)
        self.assertTrue(event.is_set())
        self.assertTrue(self.ts.is_active())

    def test_5_save_host_keys(self):
        """
        verify that SSHClient correctly saves a known_hosts file.
        """
        warnings.filterwarnings('ignore', 'tempnam.*')

        host_key = paramiko.RSAKey.from_private_key_file(test_path('test_rsa.key'))
        public_host_key = paramiko.RSAKey(data=host_key.asbytes())
        fd, localname = mkstemp()
        os.close(fd)

        client = paramiko.SSHClient()
        self.assertEquals(0, len(client.get_host_keys()))

        host_id = '[%s]:%d' % (self.addr, self.port)

        client.get_host_keys().add(host_id, 'ssh-rsa', public_host_key)
        self.assertEquals(1, len(client.get_host_keys()))
        self.assertEquals(public_host_key, client.get_host_keys()[host_id]['ssh-rsa'])

        client.save_host_keys(localname)

        with open(localname) as fd:
            assert host_id in fd.read()

        os.unlink(localname)

    def test_3_multiple_key_files(self):
        """
        verify that SSHClient accepts and tries multiple key files.
        """
        threading.Thread(target=self._run).start()
        host_key = paramiko.RSAKey.from_private_key_file(test_path('test_rsa.key'))
        public_host_key = paramiko.RSAKey(data=host_key.asbytes())

        self.tc = paramiko.SSHClient()
        self.tc.get_host_keys().add('[%s]:%d' % (self.addr, self.port), 'ssh-rsa', public_host_key)
        self.tc.connect(self.addr, self.port, username='slowdive', key_filename=[test_path('test_rsa.key'), test_path('test_dss.key')])

        self.event.wait(1.0)
        self.assertTrue(self.event.isSet())
        self.assertTrue(self.ts.is_active())
        self.assertEqual('slowdive', self.ts.get_username())
        self.assertEqual(True, self.ts.is_authenticated())

 def test_ed25519_nonbytes_password(self):
     # https://github.com/paramiko/paramiko/issues/1039
     key = Ed25519Key.from_private_key_file(
         test_path('test_ed25519_password.key'),
         # NOTE: not a bytes. Amusingly, the test above for same key DOES
         # explicitly cast to bytes...code smell!
         'abc123',
     )

 def test_6_compare_rsa(self):
     # verify that the private & public keys compare equal
     key = RSAKey.from_private_key_file(test_path("test_rsa.key"))
     self.assertEqual(key, key)
     pub = RSAKey(data=key.asbytes())
     self.assertTrue(key.can_sign())
     self.assertTrue(not pub.can_sign())
     self.assertEqual(key, pub)

 def start_server(self):
     host_key = RSAKey.from_private_key_file(test_path('test_rsa.key'))
     self.public_host_key = RSAKey(data=host_key.asbytes())
     self.ts.add_server_key(host_key)
     self.event = threading.Event()
     self.server = NullServer()
     self.assertTrue(not self.event.is_set())
     self.ts.start_server(self.event, self.server)

 def test_20_compare_ecdsa_521(self):
     # verify that the private & public keys compare equal
     key = ECDSAKey.from_private_key_file(test_path('test_ecdsa_521.key'))
     self.assertEqual(key, key)
     pub = ECDSAKey(data=key.asbytes())
     self.assertTrue(key.can_sign())
     self.assertTrue(not pub.can_sign())
     self.assertEqual(key, pub)

 def test_7_compare_dss(self):
     # verify that the private & public keys compare equal
     key = DSSKey.from_private_key_file(test_path('test_dss.key'))
     self.assertEqual(key, key)
     pub = DSSKey(data=key.asbytes())
     self.assertTrue(key.can_sign())
     self.assertTrue(not pub.can_sign())
     self.assertEqual(key, pub)

 def test_3_load_rsa_password(self):
     key = RSAKey.from_private_key_file(test_path('test_rsa_password.key'), 'television')
     self.assertEqual('ssh-rsa', key.get_name())
     exp_rsa = b(FINGER_RSA.split()[1].replace(':', ''))
     my_rsa = hexlify(key.get_fingerprint())
     self.assertEqual(exp_rsa, my_rsa)
     self.assertEqual(PUB_RSA.split()[1], key.get_base64())
     self.assertEqual(1024, key.get_bits())

 def test_5_load_dss_password(self):
     key = DSSKey.from_private_key_file(test_path('test_dss_password.key'), 'television')
     self.assertEqual('ssh-dss', key.get_name())
     exp_dss = b(FINGER_DSS.split()[1].replace(':', ''))
     my_dss = hexlify(key.get_fingerprint())
     self.assertEqual(exp_dss, my_dss)
     self.assertEqual(PUB_DSS.split()[1], key.get_base64())
     self.assertEqual(1024, key.get_bits())

 def test_11_load_ecdsa_password(self):
     key = ECDSAKey.from_private_key_file(test_path("test_ecdsa_password.key"), b"television")
     self.assertEqual("ecdsa-sha2-nistp256", key.get_name())
     exp_ecdsa = b(FINGER_ECDSA.split()[1].replace(":", ""))
     my_ecdsa = hexlify(key.get_fingerprint())
     self.assertEqual(exp_ecdsa, my_ecdsa)
     self.assertEqual(PUB_ECDSA.split()[1], key.get_base64())
     self.assertEqual(256, key.get_bits())

 def test_19_load_ecdsa_password_521(self):
     key = ECDSAKey.from_private_key_file(test_path('test_ecdsa_password_521.key'), b'television')
     self.assertEqual('ecdsa-sha2-nistp521', key.get_name())
     exp_ecdsa = b(FINGER_ECDSA_521.split()[1].replace(':', ''))
     my_ecdsa = hexlify(key.get_fingerprint())
     self.assertEqual(exp_ecdsa, my_ecdsa)
     self.assertEqual(PUB_ECDSA_521.split()[1], key.get_base64())
     self.assertEqual(521, key.get_bits())