a
}|g @ s d Z ddlZddlZddlmZ ddlZddlZddlm Z ddl
Z
ddl
m Z ddl Z
ddlZddlZddlmZ ddlmZ ddlmZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ e d
Z e dZ e dZ e
j !e dZ"e#ddddej#$ dZ%G dd de
j&Z'G dd de
j(Z)G dd de
j&Z*G d d d e
j&Z+e,d kre-e.ej/d d e0g dS ) zTests for acme.client. N)Dict)mock)
challenges)errors)jws)messages)
messages_test) test_util)
ClientNetwork)ClientV2z cert-san.pemz
csr-mixed.pemzcsr-nosans.pemzrsa512_key.pemz1https://www.letsencrypt-demo.org/acme/new-account/https://www.letsencrypt-demo.org/acme/new-noncez/https://www.letsencrypt-demo.org/acme/new-orderz1https://www.letsencrypt-demo.org/acme/revoke-cert)
newAccountnewNonceZnewOrder
revokeCertmetac @ sT e Zd ZdZdd Zdd Zdd Zdd Zd
d Zd d
Z dd Z
dd Z dd Z e
ddd Ze
ddd Zdd Zdd Zd d Zd d Zd!d" Zd#d$ Zd%d& Zd'd( Zd)d* Zd+d, Zd-d. Zd/d0 Z d1d2 Z d3d4 Z d5d6 Z d7d8 Z d9d: Z!e
dd;d< Z"e
dd=d> Z#e
dd?d@ Z$e
ddAdB Z%dCdD Z&dES )F ClientV2Testz Tests for acme.client.ClientV2.c C s t jdtji i d| _t | _| j| jj_| j| jj_t j
t j dd| _ d| _
t j| j
t d}t|}t jf i || _t j|dd| _d }t j|d
t jtjtd d d
}t j ||d| _ t j t j
t j dd|fd| _ t j | j |d| _!d| _"t#| _$t%| j$| j| _&| jj'dd| _d| _(| j j't j
t j ddt j)d| _*t j | j*| j(d| _+t j,| j j | j*j ft j)| j!j-| j(fdd| _.t j/| j.d| j!| j+gt0d| _1t j/| j.d| j!| j+gt2d| _3d S )NT)ok status_codeheaderslinksz example.com)typvalue)z mailto:cert-admin@example.comztel:+12025551212)contactkey+https://www.letsencrypt-demo.org/acme/reg/1bodyuriz-https://www.letsencrypt-demo.org/acme/authz/1z/1z+evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA)token)r statusZchall)r
authzr_uri)
identifierr )Zterms_of_service_agreedz-https://www.letsencrypt-demo.org/acme/authz/2zwww.example.com)r! r z=https://www.letsencrypt-demo.org/acme/acct/1/order/1/finalize)Z identifiersr authorizationsfinalizez4https://www.letsencrypt-demo.org/acme/acct/1/order/1)r r r# Zcsr_pem)4r MagicMock http_clientOKresponsenetpost return_valuegetr Z
IdentifierZIDENTIFIER_FQDNr! r Z RegistrationKEYZ
public_keydictZNewRegistrationnew_regZRegistrationResourceregrZ
ChallengeBody STATUS_VALIDr ZDNSjose b64decodeZChallengeResourcechallrZ
AuthorizationauthzAuthorizationResourceauthzrrsn DIRECTORY_V2 directoryr clientupdate authzr_uri2ZSTATUS_PENDINGauthz2authzr2ZOrderr orderZ
OrderResource
CSR_MIXED_PEMorderrCSR_NO_SANS_PEMorderr2)selfZregZthe_argr challb rG D/usr/lib/python3.9/site-packages/acme/_internal/tests/client_test.pysetUp* s
zClientV2Test.setUpc C sH t j| j_| jj | jj_| jj | jj
d< | j| j | j
ksDJ d S NLocation)r& CREATEDr( r r0 r to_jsonjsonr+ r r r; new_accountr/ rE rG rG rH test_new_accountj s
z ClientV2Test.test_new_accountc C s^ t j| j_| jj | jj_| jj | jj
d< | jj dddii | j
| jjdksZJ d S )NrK zterms-of-serviceurlz$https://www.letsencrypt-demo.org/tos)r& rL r( r r0 r rM rN r+ r r r r< r; rO r/ Zterms_of_servicerP rG rG rH test_new_account_tos_linkq s
z&ClientV2Test.test_new_account_tos_linkc C sX t j| j_| jj| jjd< tt j
| j | j
W d n1 sJ0 Y d S rJ )r& r' r( r r0 r r pytestraisesr
ConflictErrorr; rO r/ rP rG rG rH test_new_account_conflict} s
z&ClientV2Test.test_new_account_conflictc C s^ | j j| j jjddd}|j | jj_tj| j_ | j j
| jj d< | j
| j |ksZJ d S )NZ deactivatedr r rK )r0 r< r rM r( rN r+ r& r' r r r r; Zdeactivate_registration)rE Zdeactivated_regrrG rG rH test_deactivate_account s
z$ClientV2Test.test_deactivate_accountc C s | j j| j jjtjdd}|j | jj_| j
| j }|j|jksJJ | j j j j
dks^J | j j| j j jd d v s|J d S )NrX rY r" r )r7 r< r r ZSTATUS_DEACTIVATEDrM r( rN r+ r; Zdeactivate_authorizationr) r*
call_countr call_args_list)rE Zdeactivated_authzr7 rG rG rH test_deactivate_authorization s z*ClientV2Test.test_deactivate_authorizationc C s t | j}tj|_| j |j_ | j
j |j d< || j
j_ t | j}| j |j_ | jj |j d< | j}| j |j_ | jj |j d< td0}||f|_| jt| j
ksJ W d n1 s0 Y td0}||f|_| jt| jksJ W d n1 s0 Y d S )NrK z!acme.client.ClientV2._post_as_get)copydeepcopyr( r& rL r r@ rM rN r+ rB r r r) r* r5 r7 r> r? r patch side_effectr; Z new_orderrA rC rD )rE Zorder_responseZauthz_responseZauthz_response2Zmock_post_as_getrG rG rH test_new_order s"
4
zClientV2Test.test_new_orderc C s d| j ji| jjd< | j j | jj_tj d d}| j
| j j| t
tj* | j
| j jjdd| W d n1 s0 Y d S )NrR ZupZ
validationfoo)r )r4 r r( r r rM rN r+ r DNSResponser; answer_challengerT rU r UnexpectedUpdater< )rE Zchall_responserG rG rH test_answer_challege s z!ClientV2Test.test_answer_challegec C sJ t tj* | j| jjtj d d W d n1 s<0 Y d S )Nrc )
rT rU r ClientErrorr; rf r4 r r re rP rG rG rH "test_answer_challenge_missing_next s z/ClientV2Test.test_answer_challenge_missing_nextzacme.client.datetimec C s t ddd|j j_t j|_|j t jdd }tj| jd| j_tj| jd| j_ | j
| j| jksnJ | jj | j| | jj | j| d S )N Z Zsecondsr+ ) datetimenowr+ timedeltar ZMockrB r; poll_authorizationsfinalize_orderZpoll_and_finalizeassert_called_once_with)rE
mock_datetimeZexpected_deadlinerG rG rH test_poll_and_finalize s z#ClientV2Test.test_poll_and_finalizec C s t dddt dddt dddg}||j j_| j | j | j g| jj_t t
j $ | j
| j|d W d n1 s0 Y d S )Nrk rl rm r" )rq rr ra r5 rM r> r( rN rT rU r TimeoutErrorr; rt rB )rE rw Znow_side_effectrG rG rH test_poll_authorizations_timeout s
z-ClientV2Test.test_poll_authorizations_timeoutc C s t ddd}| jjjtjtjdd}| jjtj|fd}| | j
j _ t
tj | j| j| W d n1 s~0 Y d S )N' unauthorized)r error)r r )rq r4 r r< r STATUS_INVALIDError with_coder5 rM r( rN r+ rT rU r ZValidationErrorr; rt rB )rE deadlinerF r5 rG rG rH test_poll_authorizations_failure s
z-ClientV2Test.test_poll_authorizations_failurec C s~ t ddd}| jjtjd}tj|| jd}| jj| j|gd}| j
| j
|
f| j j _
| j| j||kszJ d S )Nr} r~ rX r )r# )rq r> r< r r1 r6 r= rB r7 r5 rM r( rN ra r; rt )rE r Zupdated_authz2Zupdated_authzr2updated_orderrrG rG rH test_poll_authorizations_success s
z-ClientV2Test.test_poll_authorizations_successc C sd | j j| jjddd}| | jj_tt j
| j | j
W d n1 sV0 Y d S )Nrd r )r! )r5 r< r! rM r( rN r+ rT rU r rg r; pollr7 )rE Z
updated_authzrG rG rH test_poll_unexpected_update s z(ClientV2Test.test_poll_unexpected_updatec C sb | j jdtjd}| jj|td}| | jj_ t| j_
t ddd}| j
| j||ks^J d S )N+https://www.letsencrypt-demo.org/acme/cert/Z certificater )r
fullchain_pemr} r~ )r@ r< r r1 rB CERT_SAN_PEMrM r( rN r+ textrq r; ru )rE
updated_orderr r rG rG rH test_finalize_order_success s z(ClientV2Test.test_finalize_order_successc C sv | j jtjdtjd}| | jj_ t
ddd}t t
j | j| j| W d n1 sh0 Y d S )Nr r r r} r~ )r@ r< r r r r rM r( rN r+ rq rT rU r Z
IssuanceErrorr; ru rB )rE r r rG rG rH test_finalize_order_error s
z&ClientV2Test.test_finalize_order_errorc C sn | j jd tjd}| | jj_tj t
j dd* | j
| jtddd W d n1 s`0 Y d S )Nr z The certificate order failed)matchr} r~ )r@ r< r r rM r( rN r+ rT rU r r r; ru rB rq )rE r@ rG rG rH "test_finalize_order_invalid_status s z/ClientV2Test.test_finalize_order_invalid_statusc C sV t j t jdd }ttj | j| j | W d n1 sH0 Y d S )N< ro )
rq rr rs rT rU r r{ r; ru rB )rE r rG rG rH test_finalize_order_timeout s z(ClientV2Test.test_finalize_order_timeoutc C s | j jdtjd}| jj|tttgd}| | jj_ t| j_
d| jj d< t ddd}| j
j| j|dd }| jjjd
tjtjd | jjjd tjtjd ||ksJ | jj d= | j
j| j|dd }||jg d
ksJ d S )Nr r )r r alternative_fullchains_pemz;rel="alternate", ;rel="index", ;title="foo";rel="alternate"ZLinkr} r~ T)Zfetch_alternative_chainsz https://example.com/acme/cert/1
new_nonce_urlz https://example.com/acme/cert/2)r )r@ r< r r1 rB r rM r( rN r+ r r rq r; ru r) r* Zassert_any_callr ANY)rE r r r ZresprG rG rH test_finalize_order_alt_chains
s2
z+ClientV2Test.test_finalize_order_alt_chainsc C s6 | j tj| j | jjj| jd t j
t d d d S )Nr r r ) r; revoker CERTr8 r) r* rv r: r r r9 rP rG rG rH test_revoke( s zClientV2Test.test_revokec C sL t j| j_ttj" | j t
j | j W d n1 s>0 Y d S N)
r& METHOD_NOT_ALLOWEDr( r rT rU r ri r; r r r r8 rP rG rG rH #test_revoke_bad_status_raises_error- s
z0ClientV2Test.test_revoke_bad_status_raises_errorc C s | j j| jjd< | j j | jj_| j | j | j ks:J | jj
j d usLJ | jj
j j
dks`J tj| j
j jd d v s|J | j jjdd | jj_d S )NrK rl r rG )r )r0 r r( r r rM rN r+ r; Zupdate_registrationr) accountr* r[ r9 r
r\ r< rP rG rG rH test_update_registration3 s z%ClientV2Test.test_update_registrationc C s. t dt jjddi| j_| j s*J d S )Nr Texternal_account_requiredr DirectoryMetar; r: r rP rG rG rH #test_external_account_required_true? s
z0ClientV2Test.test_external_account_required_truec C s. t dt jjddi| j_| j r*J d S )Nr Fr r rP rG rG rH $test_external_account_required_falseF s
z1ClientV2Test.test_external_account_required_falsec C s | j rJ d S r )r; r rP rG rG rH &test_external_account_required_defaultM s z3ClientV2Test.test_external_account_required_defaultc C s: | j j | jj_d| jjd< | j | j| j ks6J d S )Nr rK ) r0 r rM r( rN r+ r r; Zquery_registrationrP rG rG rH test_query_registration_clientP s z+ClientV2Test.test_query_registration_clientc C sl t dN}| j|_| j| j | jjjj| jj d dd | jjj
W d n1 s^0 Y d S )Nz*acme.client.ClientV2._authzr_from_responser r ) r r` r? r+ r; r r) r* rv r r, Zassert_not_called)rE Z mock_clientrG rG rH test_post_as_getU s
z ClientV2Test.test_post_as_getc C s: d| j jd< tdddddd| jj| j dd ks6J d S )
Nz Fri, 31 Dec 1999 23:59:59 GMT Retry-Afteri ;
r( default)r( r rq r; retry_afterrP rG rG rH test_retry_after_date` s z"ClientV2Test.test_retry_after_datec C sV t ddd|j j_t j|_d| jjd< t dddddd| jj| jddksRJ d S ) N Zfoooor r r r rq rr r+ rs r( r r; r rE Zdt_mockrG rG rH test_retry_after_invalide s z%ClientV2Test.test_retry_after_invalidc C s` t ddd|j j_t j|_t j |j _d| jjd< t dddddd| jj| jddks\J d S ) Nr r r z Tue, 116 Feb 2016 11:50:00 MSTr r r r ) rq rr r+ rs ra r( r r; r r rG rG rH test_retry_after_overflown s
z&ClientV2Test.test_retry_after_overflowc C sV t ddd|j j_t j|_d| jjd< t dddddd| jj| jdd ksRJ d S )
Nr r r Z50r r 2 r r r r rG rG rH test_retry_after_secondsx s z%ClientV2Test.test_retry_after_secondsc C sJ t ddd|j j_t j|_t dddddd| jj| jddksFJ d S )Nr r r r r r )rq rr r+ rs r; r r( r rG rG rH test_retry_after_missing s
z%ClientV2Test.test_retry_after_missingc C s0 t | jj_t td| j ks,J d S )Nzhttps://example.com/dir) r9 rM r( rN r+ to_partial_jsonr Z
get_directoryr) rP rG rG rH test_get_directory s z ClientV2Test.test_get_directoryN)'__name__
__module__ __qualname____doc__rI rQ rS rW rZ r] rb rh rj r r` rx r| r r r r r r r r r r r r r r r r r r r r r r rG rG rG rH r ' sP @
r c @ s( e Zd Zdd Zdd Zedd ZdS )MockJSONDeSerializablec C s
|| _ d S r r )rE r rG rG rH __init__ s z MockJSONDeSerializable.__init__c C s
d| j iS )Nrd r rP rG rG rH r s z&MockJSONDeSerializable.to_partial_jsonc C s d S r rG )clsZjobjrG rG rH from_json s z MockJSONDeSerializable.from_jsonN)r r r r r classmethodr rG rG rG rH r s r c @ s e Zd ZdZdd Zdd Zdd Zdd Zd
d Zd d
Z dd Z
dd Z dd Z e
ddd Ze
ddd Zdd Zdd Zd d Ze
dd d Zd!d" Zd#d$ Zd%d& Zd'd( Zd3d*d+Zd,d- Ze
d.d/d0 Zd1d2 Z d)S )4ClientNetworkTestz$Tests for acme.client.ClientNetwork.c C sX t | _t jt jjd| _tttj | jdd| _
t jdt j d| _
i | j
_i | j
_d S )Nrp acme-python-test)r alg
verify_sslZ
user_agentTr r )r r% r sentinelwrappedZ wrap_in_jwsr
r- r2 ZRS256r) r& r' r( r r rP rG rG rH rI s
zClientNetworkTest.setUpc C s | j j| ju sJ d S r )r) r rP rG rG rH test_init s zClientNetworkTest.test_initc C sT | j jtdddd}tj|}t|j ddiks>J |j
j j dksPJ d S )Nrd TgrR noncerR )
r) _wrap_in_jwsr acme_jwsJWS
json_loadsrN loadspayloaddecode signaturecombinedr rE Zjws_dumpr rG rG rH test_wrap_in_jws s
z"ClientNetworkTest.test_wrap_in_jwsc C s ddi| j _| j jtdddd}tj|}t|j
ddiksJJ |j j j
dks\J |j j jdksnJ |j j jdksJ d S )Nr zacct-urird r rR r )r) r r r r r r rN r r r r r r ZkidrR r rG rG rH test_wrap_in_jws_v2 s
z%ClientNetworkTest.test_wrap_in_jws_v2c C s d| j _i | j j_tdR}tj|_t
t j | j
| j W d n1 sV0 Y W d n1 st0 Y d S )NFz$acme.client.messages.Error.from_json)r( r rN r+ r r` r2 ZDeserializationErrorra rT rU r ri r) _check_response)rE r rG rG rH (test_check_response_not_ok_jobj_no_error s
z:ClientNetworkTest.test_check_response_not_ok_jobj_no_errorc C sb d| j _tjjdddd | j j_t tj | j
| j W d n1 sT0 Y d S )NFZserverInternalrd z
some title)Zdetailtitle) r( r r r r rM rN r+ rT rU r) r rP rG rG rH %test_check_response_not_ok_jobj_error s z7ClientNetworkTest.test_check_response_not_ok_jobj_errorc C sP d| j _t| j j_ttj | j
| j W d n1 sB0 Y d S )NF) r( r
ValueErrorrN ra rT rU r ri r) r rP rG rG rH "test_check_response_not_ok_no_jobj s
z4ClientNetworkTest.test_check_response_not_ok_no_jobjc C sn t | jj_| jjdfD ]R}|| jjd< tt j
& | jj | j| jjd W d q1 s^0 Y qd S )Nrd Content-Type content_type) r r( rN ra r) JSON_CONTENT_TYPEr rT rU r ri r rE Z response_ctrG rG rH *test_check_response_ok_no_jobj_ct_required s
z.send_request)ra rp )r
r) r r% r& r' r( r r checkedr r% objZ wrapped_objr r r2 b64encode
all_noncesr& r r+ check_responser r )rE r+ rG rP rH rI s,
z)ClientNetworkWithMockedResponseTest.setUpc C s6 | j |ksJ | j|ks J | j js(J d| j _| j S )NT)r( r r r, )rE r( r rG rG rH r0 s
z2ClientNetworkWithMockedResponseTest.check_responsec C s4 | j | jjddddks J | jjddddd d S )Nr rd r r r )r% r) headr+ rv rP rG rG rH test_head s
z-ClientNetworkWithMockedResponseTest.test_headc C s4 | j | jjddddks J | jjddddd d S )Nr$ rd r r r )r( r) r1 r+ rv rP rG rG rH test_head_v2 s
z0ClientNetworkWithMockedResponseTest.test_head_v2c C s@ | j | jjd| jddks J | j js*J | jjdddd d S )Nr r )r r r r )r( r) r, r r, r+ rv rP rG rG rH test_get s
z,ClientNetworkWithMockedResponseTest.test_getc C s4 | j j| _| j| j d| jks$J | jjs0J d S )Nr )r) ZJOSE_CONTENT_TYPEr r( r* r- r, rP rG rG rH test_post_no_content_type s
z=ClientNetworkWithMockedResponseTest.test_post_no_content_typec C s | j | jjd| j| jdks J | j js,J | jj| jt | j
d g | _ t
tj& | jjd| j| jd W d n1 s0 Y | jj| jt | j
d d S )Nr r )r( r) r* r- r r, r rv r2 r3 r/ r' r& rT rU r Z MissingNoncer rP rG rG rH test_post s
4z-ClientNetworkWithMockedResponseTest.test_postc C sV dt dg| _ttj& | jjd| j | j
d W d n1 sH0 Y d S )N f goodr r r2 r. r& rT rU r ZBadNoncer) r* r- r rP rG rG rH test_post_wrong_initial_nonce s
zAClientNetworkWithMockedResponseTest.test_post_wrong_initial_noncec C sV t ddg| _ttj& | jjd| j | j
d W d n1 sH0 Y d S )Nr8 r7 r r r9 rP rG rG rH #test_post_wrong_post_response_nonce s
zGClientNetworkWithMockedResponseTest.test_post_wrong_post_response_noncec C sd t }tjd|_|| j_t tj& | jj
d| j | j d W d n1 sV0 Y d S NZbadNoncer r )
r r% r r r ra r) r rT rU r* r- r rE r0 rG rG rH test_post_failed_retry s z:ClientNetworkWithMockedResponseTest.test_post_failed_retryc C sj t }tjd| jg|_|| j_t
tj& | jj d| j | j
d W d n1 s\0 Y d S )NZ malformedr r )r r% r r r r( ra r) r rT rU r* r- r r= rG rG rH test_post_not_retried s
z9ClientNetworkWithMockedResponseTest.test_post_not_retriedc C s@ t }tjd| jg|_| j| jjd| j | j
dksClientNetworkWithMockedResponseTest.test_post_successful_retryc C s t jj| j_| jj| jjfD ]<}t t jj |dd W d q 1 sN0 Y q t t jj" | jj
d| j d W d n1 s0 Y d S )Nr r )r- ) r r r r+ ra r) r1 r, rT rU r* r- )rE r* rG rG rH $test_head_get_post_error_passthrough s *zHClientNetworkWithMockedResponseTest.test_head_get_post_error_passthroughc C s t jdtjd}t | j_|| jj_d | _t }|| j_t
t j ( | jj
d| j| jdd W d n1 sv0 Y |jdksJ d S )NFr r r$ r r r" )r r% r& ZSERVICE_UNAVAILABLEr) r r+ r r rT rU r ri r* r- r[ )rE Z bad_responser0 rG rG rH test_post_bad_nonce_head s
$zClientNetworkWithMockedResponseTest.test_new_nonce_uri_removedN)r r r r rI r0 r2 r3 r4 r5 r6 r: r; r> r? r@ rA rC rD rG rG rG rH r# s +
r# __main__r" )1r r^ rq Z http.clientr; r& rN systypingr Zunittestr Zjosepyr2 rT r Zacmer r r r r Zacme._internal.testsr r Z acme.clientr
r Z load_vectorr rA rC ZJWKRSAloadr- r r r9 ZTestCaser ZJSONDeSerializabler r r# r exitmainargv__file__rG rG rG rH sP
j
e #