|
Server : Apache/2.4.41 (Ubuntu) System : Linux vmi1525618.contaboserver.net 5.4.0-105-generic #119-Ubuntu SMP Mon Mar 7 18:49:24 UTC 2022 x86_64 User : www-data ( 33) PHP Version : 8.2.12 Disable Function : NONE Directory : /lib/python3/dist-packages/certbot/tests/__pycache__/ |
Upload File : |
U
�]0A � @ s< d Z ddlZddlZddlmZmZ ddlmZ ddlmZ ddl m
Z
m Z ddl m
Z
z ddlmZ eejd � W n eefk
r� dZY nX ddlZddlZdd
lmZ dd lmZ d Z G d
d� dej �Z ej e dd�G dd� dej ��Z ej!d dd��Z"dd� Z#dZ$dZ%dZ&dZ'd Z(d Z)d Z*e+d k�r8e�,� dS )!zTests for ocsp.py� N)�datetime� timedelta)�default_backend)�hashes)�UnsupportedAlgorithm�InvalidSignature)�x509��ocspZsignature_hash_algorithm)�errors)�utilz;Missing = in header key=value
ocsp: Use -help for summary.
c @ s� e Zd ZdZdd� Zdd� Ze�d�e�d�e�d�d d
� ���Ze�d �e�d �d
d� ��Z dd� Z
e�d�e�d �dd� ��Z dS )�OCSPTestOpenSSLz5
OCSP revokation tests using OpenSSL binary.
c
C sj ddl m} t�d��J}t�d��4}t�� }d tf|j_||_d|_|jdd�| _ W 5 Q R X W 5 Q R X d S )Nr r �certbot.ocsp.Popen�certbot.util.exe_existsT�Z enforce_openssl_binary_usage)
�certbotr
�mock�patch� MagicMock�out� communicate� return_value�RevocationChecker�checker)�selfr
�
mock_popen� mock_exists�mock_communicate� r �9/usr/lib/python3/dist-packages/certbot/tests/ocsp_test.py�setUp" s zOCSPTestOpenSSL.setUpc C s d S �Nr )r r r r �tearDown, s zOCSPTestOpenSSL.tearDownzcertbot.ocsp.logger.infor r c C s� t �� }d tf|j_||_d|_ddlm} |jdd�}| �|j d� | �|�
d�dg� d t� d�d f|j_|jdd�}| �|�
d�d
dg� | �|j d � d |_d|_ |jdd�}| �|j d� | �|j d� | �|j d� d S ) NTr r r � �xzHost=x�
� ZHostF)
r r r r r r r
r � assertEqual�
call_countZ host_args� partition�broken)r r r �mock_logr r
r r r r � test_init/ s$ zOCSPTestOpenSSL.test_init�#certbot.ocsp._determine_ocsp_serverzcertbot.util.run_scriptc C s t j�t�� �}t�� }d|_d|_|t dd� |_
d| j _ d|_
| �| j �|�d� d| j _ ttdd � �|_
| �| j �|�d� | �|jd � d
|_
| �| j �|�d� t�d �|_| �| j �|�d� | �|jd� ||_
d|_
|j}| �| j �|�d� | �|j|� d S ) Nr$ �yr& �ZhoursT)� r0 Fr# r )z http://x.cozx.coz#Unable to load certificate launcher)�pytz�UTC�fromutcr �utcnowr r �cert�chainr �
target_expiryr r* r r' � ocsp_revoked�tuple�
openssl_happyr( r ZSubprocessError� side_effect)r �mock_run�mock_determine�now�cert_objZ count_beforer r r �test_ocsp_revokedI s, z!OCSPTestOpenSSL.test_ocsp_revokedc C s0 t �d�}ddlm} |�|�}| �d|� d S )N�ocsp_certificate.pemr r )z http://ocsp.test4.buypass.comzocsp.test4.buypass.com)� test_util� vector_pathr r
Z_determine_ocsp_serverr' )r � cert_pathr
�resultr r r �test_determine_ocsp_serverh s
z*OCSPTestOpenSSL.test_determine_ocsp_serverzcertbot.ocsp.loggerc C s$ t |_ddlm} | �|jt� d� | �|jt � d� | �|jjd� | �|j jd� d|j_| �|jt
� d� | �|jjd� | �|j jd� | �|jt � d� | �|jjd� | �|jt � d� | �|j jd� d|j
_| �|jt� d� | �|j
jd� | �|jt� d� | �|j
jd� d S )Nr r Fr# r& T)�openssl_confusedr r r
r' Z_translate_ocsp_queryr: �debugr( Zwarning�openssl_unknown�openssl_expired_ocsp�openssl_broken�info�openssl_revoked� openssl_expired_ocsp_revoked)r r< r+ r
r r r �test_translate_ocspo s& z#OCSPTestOpenSSL.test_translate_ocspN) �__name__�
__module__� __qualname__�__doc__r r" r r r, r@ rF rO r r r r r
s
r
zFThis class tests functionalities available only on cryptography>=2.5.0)�reasonc @ sT e Zd ZdZdd� Ze�d�e�d�dd� ��Zdd � Zd
d � Z d d
� Z
dd� Z dS )�OSCPTestCryptographyz;
OCSP revokation tests using Cryptography >= 2.4.0
c C sr ddl m} |�� | _t�d�| _t�d�| _t� � | _
| j| j
_ | j| j
_ t
j�t�� �}|tdd� | j
_d S )Nr r rA �ocsp_issuer_certificate.pemr& r/ )r r
r r rB rC rD �
chain_pathr r r? r5 r6 r1 r2 r3 r r4 r r7 )r r
r> r r r r � s
zOSCPTestCryptography.setUpr- z%certbot.ocsp._check_ocsp_cryptographyc C s* d|_ | j�| j� |�| j| jd� d S )N)�http://example.com� example.comrX )r r r8 r? Zassert_called_once_withrD rW )r Z mock_revoker= r r r � test_ensure_cryptography_toggled� s z5OSCPTestCryptography.test_ensure_cryptography_toggledc C s: t tjjtjj�� | j�| j�}W 5 Q R X | � |� d S r! )
�
_ocsp_mock�ocsp_lib�OCSPCertStatus�REVOKED�OCSPResponseStatus�
SUCCESSFULr r8 r? Z
assertTrue)r �revokedr r r � test_revoke� s z OSCPTestCryptography.test_revokec C s� t �t�d�t� �}ttjjtj j
��"}|j |d j _
| j�| j� W 5 Q R X | �|d jd� | �|d jd d �� |�� �� � d S )NrV �
mock_response�
mock_checkr# r )r �load_pem_x509_certificaterB � load_vectorr r[ r\ r] r^ r_ r` �subjectr �responder_namer r8 r? r' r( Z call_args�public_numbers�
public_key)r �issuer�mocksr r r �test_responder_is_issuer� s ��
�z-OSCPTestCryptography.test_responder_is_issuerc C s� t �t�d�t� �}t �t�d�t� �}ttjjtj j
��}| j � | j
� W 5 Q R X | �|d jd� | �|d jd d d �� |�� �� � | �|d jd d d �� |�� �� � d S )NrV � ocsp_responder_certificate.pemrd r& r r# )r re rB rf r r[ r\ r] r^ r_ r` r r8 r? r' r( Zcall_args_listri rj )r rk � responderrl r r r �%test_responder_is_authorized_delegate� s( � ��
�
�z:OSCPTestCryptography.test_responder_is_authorized_delegatec C s� t tjjtjjdd�� | j�| j�}W 5 Q R X | � |� t tjjtjj
�� | j�| j�}W 5 Q R X | � |� t tjjtjj�� | j�| j�}W 5 Q R X | � |� t tjj tjj��: t j
dt�dtjj�d�� | j�| j�}W 5 Q R X W 5 Q R X | � |� t tjj tjjtd�d�� | j�| j�}W 5 Q R X | � |� t tjj tjjtd�d�� | j�| j�}W 5 Q R X | � |� t tjj tjjtd�d�� | j�| j�}W 5 Q R X | � |� t tjj tjj�� }g |d j_| j�| j�}W 5 Q R X | � |� t tjj tjj��@}|d jjd }t jd
|jd �|d jjd < | j�| j�}W 5 Q R X | � |� t tjj tjj��V t �
d ��@}d
|_t j
dt�dtjj�d�� | j�| j�}W 5 Q R X W 5 Q R X W 5 Q R X | � |� d S )Ni� )�http_status_codez4cryptography.x509.Extensions.get_extension_for_classz Not found)r; Zfoo)�check_signature_side_effectrc r Zfake)rk rg r- )zhttps://example.comrY )r[ r\ r] ZUNKNOWNr_ r` r r8 r? Z assertFalseZ UNAUTHORIZEDr^ r r r ZExtensionNotFoundZ AuthorityInformationAccessOIDZOCSPr r �AssertionErrorr � certificates�Mockrg )r ra rl r5 Z mock_serverr r r �test_revoke_resiliency� s� �
��"
�
�
�
�
� �
��,z+OSCPTestCryptography.test_revoke_resiliencyN) rP rQ rR rS r r r rZ rb rm rp rv r r r r rU � s rU �� c c sx t �d��d}t| |�|_t �d��B}t j|d�|_t �d�� }|rH||_|||d�V W 5 Q R X W 5 Q R X W 5 Q R X d S )Nz(certbot.ocsp.ocsp.load_der_ocsp_responsezcertbot.ocsp.requests.post)Z status_codez.certbot.ocsp.crypto_util.verify_signed_payload)rc � mock_postrd )r r � _construct_mock_ocsp_responser ru r; )�certificate_status�response_statusrq rr rc rx rd r r r r[ s � �r[ c C s� t �t�d�t� �}t �t�d�t� �}t �t�d�t� �}t�� }|�||t� � �}|�
� }t j || |j
|j|j|j|gt� � t�� tdd� t�� tdd� t jjjd� S )NrA rV rn r# )Zdays) r{ rz �
serial_number�issuer_key_hash�issuer_name_hashrh rt Zhash_algorithmZ next_updateZ this_updateZsignature_algorithm_oid)r re rB rf r r\ ZOCSPRequestBuilderZadd_certificater ZSHA1Zbuildr ru r| r} r~ rg r r> r ZoidZSignatureAlgorithmOIDZ
RSA_WITH_SHA1)rz r{ r5 rk ro ZbuilderZrequestr r r ry ! s8 � � ��ry )r0 z�
/etc/letsencrypt/live/example.org/cert.pem: good
This Update: Dec 17 00:00:00 2016 GMT
Next Update: Dec 24 00:00:00 2016 GMT
z�
Response Verify Failure
139903674214048:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:138:Verify error:unable to get local issuer certificate
)�blah.pemz^
blah.pem: good
This Update: Dec 20 18:00:00 2016 GMT
Next Update: Dec 27 18:00:00 2016 GMT
�Response verify OK)r z�
blah.pem: revoked
This Update: Dec 20 01:00:00 2016 GMT
Next Update: Dec 27 01:00:00 2016 GMT
Revocation Time: Dec 20 01:46:34 2016 GMT
r� )r za
blah.pem: unknown
This Update: Dec 20 18:00:00 2016 GMT
Next Update: Dec 27 18:00:00 2016 GMT
r� )r0 Z tentaclesr� )r z�
blah.pem: WARNING: Status times invalid.
140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372:
good
This Update: Apr 6 00:00:00 2016 GMT
Next Update: Apr 13 00:00:00 2016 GMT
r� )r z�
blah.pem: WARNING: Status times invalid.
140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372:
revoked
This Update: Apr 6 00:00:00 2016 GMT
Next Update: Apr 13 00:00:00 2016 GMT
r� �__main__)rw N)-rS �
contextlibZunittestr r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr Zcryptography.exceptionsr r Z cryptographyr Zcryptography.x509r
r\ �getattrZ OCSPResponse� ImportError�AttributeErrorr r1 r r Z
certbot.testsr rB r ZTestCaser
ZskipIfrU �contextmanagerr[ ry rG r: rM rI rK rJ rN rP �mainr r r r �<module> sJ
k� �