a
}|gJ @ s d Z ddlZddlZddlZddlZddlZddlmZ ddlZddlZddl m
Z
ddl m Z ddl m
Z
ddlmZ ddlmZ dd lmZ dd
lmZ dd lmZ ddlm mZ ed Zed Z ed
Z edZ edZ edZ edZ!edZ"edZ#edZ$edZ%edZ&edZ'edZ(G dd dej)Z*G dd dej)Z+G dd dej,Z-G d d d ej,Z.G d d d ej,Z/G d d! d!ej,Z0G d"d# d#ej,Z1G d$d% d%e1Z2G d&d' d'e1Z3G d(d) d)e1Z4G d*d+ d+e1Z5G d,d- d-ej,Z6G d.d/ d/ej,Z7G d0d1 d1ej,Z8G d2d3 d3ej,Z9G d4d5 d5ej,Z:G d6d7 d7ej,Z;G d8d9 d9ej,ZG d>d? d?ej,Z?e@d@kreAeBejCdAd eDg dS )Bz Tests for certbot.crypto_util. N)mock)x509)hashes)
serialization)ec)errors)util)
filesystem)oszrsa256_key.pemzrsa512_key.pemzrsa2048_key.pem cert_512.pemz
cert_2048.pemznistp256_key.pemzcert-nosans_nistp256.pemz
cert_leaf.pemzcert_intermediate_1.pemzcert_intermediate_2.pemc s\ e Zd ZdZ fddZ fddZedd Ze dd d
Z
e dd d Z Z S )
GenerateKeyTestz+Tests for certbot.crypto_util.generate_key.c s< t tj| jd| _tj| jdd t
t j d S )Nworkdiri )mode) supersetUpr
pathjointempdirr
r mkdirloggingdisableZCRITICALself __class__ L/usr/lib/python3.9/site-packages/certbot/_internal/tests/crypto_util_test.pyr ) s
zGenerateKeyTest.setUpc s t ttj d S N)r tearDownr r ZNOTSETr r r r r 1 s
zGenerateKeyTest.tearDownc C s ddl m} |||dddS )Nr ) generate_keykey-certbot.pemTZstrict_permissions)certbot.crypto_utilr )clskey_sizeZkey_dirr r r r _call6 s zGenerateKeyTest._callz certbot.crypto_util.make_keyc C sR d|_ | d| j}|jdks"J d|jv s0J tjtj| j|jsNJ d S )Ns key_pem r ) return_valuer% r
pemfiler
r existsr )r mock_makekeyr r r test_success; s
z GenerateKeyTest.test_successc C sB t |_tt | d| j W d n1 s40 Y d S )Ni )
ValueError side_effectpytestraisesr% r
)r r+ r r r test_key_failureC s z GenerateKeyTest.test_key_failure)
__name__
__module__ __qualname____doc__r r classmethodr% r patchr- r2
__classcell__r r r r r ' s
r c @ s, e Zd ZdZededdd ZdS )GenerateCSRTestz+Tests for certbot.crypto_util.generate_csr.zacme.crypto_util.make_csrz+certbot.crypto_util.util.make_or_verify_dirc C sL ddl m} d|_|tjddd| jdd}|jdks:J d |jv sHJ d S )
Nr ) generate_csrs csr_pemZ dummy_key)r( example.comTr! zcsr-certbot.pem)r" r; r' r ZMockr datar) )r Zunused_mock_verifyZmock_csrr; csrr r r test_itL s zGenerateCSRTest.test_itN)r3 r4 r5 r6 r r8 r? r r r r r: J s r: c @ sD e Zd ZdZedd Zdd Zdd Zdd Zd
d Z d d
Z
dS ) ValidCSRTestz(Tests for certbot.crypto_util.valid_csr.c C s ddl m} ||S )Nr ) valid_csr)r" rA )r# r> rA r r r r% ] s zValidCSRTest._callc C s | tdsJ d S N csr_512.pemr% test_util load_vectorr r r r test_valid_pem_trueb s z ValidCSRTest.test_valid_pem_truec C s | tdsJ d S )Nzcsr-san_512.pemrD r r r r test_valid_pem_san_truee s z$ValidCSRTest.test_valid_pem_san_truec C s | tdrJ d S )N csr_512.derrD r r r r test_valid_der_falseh s z!ValidCSRTest.test_valid_der_falsec C s | drJ d S N r% r r r r test_empty_falsek s z ValidCSRTest.test_empty_falsec C s | drJ d S Nzfoo barrM r r r r test_random_falsen s z ValidCSRTest.test_random_falseN) r3 r4 r5 r6 r7 r% rG rH rJ rN rP r r r r r@ Z s
r@ c @ s, e Zd ZdZedd Zdd Zdd ZdS ) CSRMatchesPubkeyTestz1Tests for certbot.crypto_util.csr_matches_pubkey.c O s ddl m} ||i |S )Nr )csr_matches_pubkey)r" rR )r# argskwargsrR r r r r% u s zCSRMatchesPubkeyTest._callc C s | tdtsJ d S rB )r% rE rF
RSA512_KEYr r r r test_valid_truez s
z$CSRMatchesPubkeyTest.test_valid_truec C s | tdtrJ d S rB )r% rE rF
RSA256_KEYr r r r test_invalid_false~ s
z'CSRMatchesPubkeyTest.test_invalid_falseN)r3 r4 r5 r6 r7 r% rV rX r r r r rQ r s
rQ c @ s4 e Zd ZdZedd Zdd Zdd Zdd Zd
S ) ImportCSRFileTestz/Tests for certbot.certbot_util.import_csr_file.c O s ddl m} ||i |S )Nr )import_csr_file)r" rZ )r# rS rT rZ r r r r% s zImportCSRFileTest._callc C sN t d}t d}t d}tjjtj||dddgf| ||ksJJ d S )NrI rC r( r) r= Zform Example.com rE vector_pathrF OpenSSLcrypto FILETYPE_PEMr ZCSRr% )r csrfiler= Zdata_pemr r r test_der_csr s
z ImportCSRFileTest.test_der_csrc C sD t d}t d}tjjtj||dddgf| ||ks@J d S )NrC r( r[ r\ r] )r rb r= r r r test_pem_csr s
z ImportCSRFileTest.test_pem_csrc C sH t tj( | tdtd W d n1 s:0 Y d S Nr )r0 r1 r Errorr% rE r^ rF r r r r test_bad_csr s z ImportCSRFileTest.test_bad_csrN) r3 r4 r5 r6 r7 r% rc rd rg r r r r rY s
rY c @ s8 e Zd ZdZdd Zdd Zdd Zdd Zd
d Zd S )
MakeKeyTestz'Tests for certbot.crypto_util.make_key.c C s" ddl m} tj|dd d d S )Nr make_key password)r" rj r load_pem_private_keyr rj r r r test_rsa s zMakeKeyTest.test_rsac C sT ddl m} dD ]>\}}tj||ddd d}t|tjs>J |jj|ksJ qd S )Nr ri ))Z secp256r1 )Z secp384r1i )Z secp521r1i ecdsaZelliptic_curvekey_typerl ) r" rj r rn
isinstancer ZEllipticCurvePrivateKeyZcurver$ )r rj namebitsZpkeyr r r test_ec s
zMakeKeyTest.test_ecc C sL ddl m} tjtjdd |ddd W d n1 s>0 Y d S )Nr ri z Unsupported RSA key length: 1024matchr& Zrsa)rw rt r" rj r0 r1 r rf ro r r r test_bad_key_sizes s z MakeKeyTest.test_bad_key_sizesc C sL ddl m} tjtjdd |ddd W d n1 s>0 Y d S )Nr ri z#Unsupported elliptic curve: notherery Znothererr rs r{ ro r r r test_bad_elliptic_curve_name s z(MakeKeyTest.test_bad_elliptic_curve_namec C sR ddl m} tjtjtdd |ddd W d n1 sD0 Y d S )Nr ri z1Invalid key_type specified: unf. Use [rsa|ecdsa]ry rk Zunf)rt )r" rj r0 r1 r rf reescapero r r r test_bad_key_type s
z MakeKeyTest.test_bad_key_typeN) r3 r4 r5 r6 rp rx r| r} r r r r r rh s rh c @ s e Zd ZdZdd ZdS )VerifyCertSetupz#Refactoring for verification tests.c C sV t | _t| j_t| j_t| j_t d| j_
t | _ t| j _t| j _t| j _
d S )Nzcert_fullchain_2048.pem) r MagicMockrenewable_cert SS_CERT_PATH cert_path
chain_pathRSA2048_KEY_PATHkey_pathrE r^ Zfullchain_pathbad_renewable_certr r r r r s
zVerifyCertSetup.setUpN)r3 r4 r5 r6 r r r r r r s r c @ s< e Zd ZdZdd Zdd Zejde ddd d
Z
d S ) VerifyRenewableCertTest4Tests for certbot.crypto_util.verify_renewable_cert.c C s ddl m} ||S )Nr )verify_renewable_cert)r" r )r r r r r r r% s z VerifyRenewableCertTest._callc C s | | jd u sJ d S r r% r r r r r test_verify_renewable_cert s z2VerifyRenewableCertTest.test_verify_renewable_certz-certbot.crypto_util.verify_renewable_cert_sigrL )r/ c C s< t tj | | j W d n1 s.0 Y d S r r0 r1 r rf r% r )r Z!unused_verify_renewable_cert_signr r r "test_verify_renewable_cert_failure s z:VerifyRenewableCertTest.test_verify_renewable_cert_failureN) r3 r4 r5 r6 r% r r r8 r rf r r r r r r s
r c @ s0 e Zd ZdZdd Zdd Zdd Zdd Zd
S ) VerifyRenewableCertSigTestr c C s ddl m} ||S )Nr )verify_renewable_cert_sig)r" r )r r r r r r r% s z VerifyRenewableCertSigTest._callc C s | | jd u sJ d S r r r r r r test_cert_sig_match s z.VerifyRenewableCertSigTest.test_cert_sig_matchc C s0 t }t|_t|_t|_| |d u s,J d S r )r r P256_CERT_PATHr r P256_KEYr r% )r r r r r test_cert_sig_match_ec s
z1VerifyRenewableCertSigTest.test_cert_sig_match_ecc C sJ t d| j_ttj | | j W d n1 s<0 Y d S )Nzcert_512_bad.pem) rE r^ r r r0 r1 r rf r% r r r r test_cert_sig_mismatch s z1VerifyRenewableCertSigTest.test_cert_sig_mismatchN)r3 r4 r5 r6 r% r r r r r r r r s
r c @ s0 e Zd ZdZdd Zdd Zdd Zdd Zd
S ) VerifyFullchainTestz/Tests for certbot.crypto_util.verify_fullchain.c C s ddl m} ||S )Nr )verify_fullchain)r" r )r r r r r r r%
s zVerifyFullchainTest._callc C s | | jd u sJ d S r r r r r r test_fullchain_matches s z*VerifyFullchainTest.test_fullchain_matchesc C s< t tj | | j W d n1 s.0 Y d S r r r r r r test_fullchain_mismatch s z+VerifyFullchainTest.test_fullchain_mismatchc C sD d| j _ttj | | j W d n1 s60 Y d S )NZdog)r chainr0 r1 r rf r% r r r r test_fullchain_ioerror s z*VerifyFullchainTest.test_fullchain_ioerrorN)r3 r4 r5 r6 r% r r r r r r r r
s
r c @ s( e Zd ZdZdd Zdd Zdd ZdS ) VerifyCertMatchesPrivKeyTestz;Tests for certbot.crypto_util.verify_cert_matches_priv_key.c C s ddl m} ||j|jS )Nr ) verify_cert_matches_priv_key)r" r certprivkey)r r r r r r r% ! s z"VerifyCertMatchesPrivKeyTest._callc C s( t | j_t| j_| | jd u s$J d S r )r r r r r r% r r r r test_cert_priv_key_match% s z5VerifyCertMatchesPrivKeyTest.test_cert_priv_key_matchc C sL t | j_t| j_ttj | | j W d n1 s>0 Y d S r )
RSA256_KEY_PATHr r r r r0 r1 r rf r% r r r r test_cert_priv_key_mismatch* s z8VerifyCertMatchesPrivKeyTest.test_cert_priv_key_mismatchN)r3 r4 r5 r6 r% r r r r r r r s r c @ s4 e Zd ZdZedd Zdd Zdd Zdd Zd
S ) ValidPrivkeyTestz,Tests for certbot.crypto_util.valid_privkey.c C s ddl m} ||S )Nr )
valid_privkey)r" r )r# r r r r r r% 5 s zValidPrivkeyTest._callc C s | tsJ d S r )r% rU r r r r rV : s z ValidPrivkeyTest.test_valid_truec C s | drJ d S rK rM r r r r rN = s z!ValidPrivkeyTest.test_empty_falsec C s | drJ d S rO rM r r r r rP @ s z"ValidPrivkeyTest.test_random_falseN) r3 r4 r5 r6 r7 r% rV rN rP r r r r r 2 s
r c @ s, e Zd ZdZedd Zdd Zdd ZdS ) GetSANsFromCertTestz1Tests for certbot.crypto_util.get_sans_from_cert.c O s ddl m} ||i |S )Nr )get_sans_from_cert)r" r )r# rS rT r r r r r% G s zGetSANsFromCertTest._callc C s g | tdksJ d S re rD r r r r test_singleL s z GetSANsFromCertTest.test_singlec C s ddg| tdks J d S Nr< zwww.example.comzcert-san_512.pemrD r r r r test_sanO s z GetSANsFromCertTest.test_sanN)r3 r4 r5 r6 r7 r% r r r r r r r D s
r c @ s< e Zd ZdZedd Zdd Zdd Zdd Zd
d Z d S )
GetNamesFromCertTestz2Tests for certbot.crypto_util.get_names_from_cert.c O s ddl m} ||i |S )Nr )get_names_from_cert)r" r )r# rS rT r r r r r% W s zGetNamesFromCertTest._callc C s dg| tdksJ d S )Nr< r rD r r r r r \ s z GetNamesFromCertTest.test_singlec C s ddg| tdks J d S r rD r r r r r ` s z GetNamesFromCertTest.test_sanc C s, dgdd dD | tdks(J d S )Nr< c S s g | ]}d |qS )z{0}.example.com)format).0cr r r
g zDGetNamesFromCertTest.test_common_name_sans_order..Zabcdzcert-5sans_512.pemrD r r r r test_common_name_sans_orderd s z0GetNamesFromCertTest.test_common_name_sans_orderc C s8 t t | d W d n1 s*0 Y d S )Ns hello there)r0 r1 r. r% r r r r test_parse_non_certj s z(GetNamesFromCertTest.test_parse_non_certN)
r3 r4 r5 r6 r7 r% r r r r r r r r r T s
r c @ s< e Zd ZdZedd Zdd Zdd Zdd Zd
d Z d S )
GetNamesFromReqTestz1Tests for certbot.crypto_util.get_names_from_req.c O s ddl m} ||i |S )Nr )get_names_from_req)r" r )r# rS rT r r r r r% r s zGetNamesFromReqTest._callc C s g | tdksJ d S )Nzcsr-nonames_512.pemrD r r r r test_nonamesw s z GetNamesFromReqTest.test_nonamesc C s dg| tdksJ d S )Nr< zcsr-nosans_512.pemrD r r r r test_nosans{ s z GetNamesFromReqTest.test_nosansc C s g d| tdks J d S )N)r< z example.orgz example.netz example.infozsubdomain.example.comzother.subdomain.example.comzcsr-6sans_512.pemrD r r r r test_sans s z GetNamesFromReqTest.test_sansc C s. ddl m} dg| jtd|dks*J d S )Nr )
FILETYPE_ASN1r\ rI )typ)ZOpenSSL.cryptor r% rE rF )r r r r r test_der s z GetNamesFromReqTest.test_derN)
r3 r4 r5 r6 r7 r% r r r r r r r r r o s
r c @ s e Zd ZdZdd Zdd ZdS )CertLoaderTestz8Tests for certbot.crypto_util.pyopenssl_load_certificatec C s\ ddl m} |t\}}|tjjks(J t|d ddt
t t
ksXJ d S )Nr pyopenssl_load_certificateZsha256 :r )r" r CERTr_ r` ra binasciiZ unhexlifyZdigestreplacer Zload_pem_x509_certificateZ fingerprintr ZSHA256)r r r Z file_typer r r test_load_valid_cert s z#CertLoaderTest.test_load_valid_certc C sP ddl m} tdd}ttj || W d n1 sB0 Y d S )Nr r s BEGIN CERTIFICATEs ASDFASDFASDF!!!)r" r r r r0 r1 r rf )r r Z
bad_cert_datar r r test_load_invalid_cert s z%CertLoaderTest.test_load_invalid_certN)r3 r4 r5 r6 r r r r r r r s r c @ s e Zd ZdZdd ZdS )
NotBeforeTestz'Tests for certbot.crypto_util.notBeforec C s$ ddl m} |t dks J d S )Nr ) notBeforez2014-12-11T22:34:45+00:00)r" r CERT_PATH isoformat)r r r r r test_notBefore s
z NotBeforeTest.test_notBeforeN)r3 r4 r5 r6 r r r r r r s r c @ s e Zd ZdZdd ZdS ) NotAfterTest&Tests for certbot.crypto_util.notAfterc C s$ ddl m} |t dks J d S )Nr )notAfterz2014-12-18T22:34:45+00:00)r" r r r )r r r r r
test_notAfter s
zNotAfterTest.test_notAfterN)r3 r4 r5 r6 r r r r r r s r c @ s e Zd ZdZdd ZdS )
Sha256sumTestr c C s ddl m} |tdks J d S )Nr ) sha256sumZ@914ffed8daf9e2c99d90ac95c77d54f32cbd556672facac380f0c063498df84e)r" r r )r r r r r test_sha256sum s z Sha256sumTest.test_sha256sumN)r3 r4 r5 r6 r r r r r r s r c @ s e Zd ZdZdd Zdd ZdS ) CertAndChainFromFullchainTestz;Tests for certbot.crypto_util.cert_and_chain_from_fullchainc C s( ddl m} ||j||j| S )Nr )r` )r_ r` Zdump_certificatera Zload_certificatedecode)r cert_pemr` r r r _parse_and_reencode_pem s z5CertAndChainFromFullchainTest._parse_and_reencode_pemc C s t }|t }|| }|d | }|dd}| || | | t }ddlm} ||||fD ](}||\} }
| |ksJ |
|ksnJ qntt j
|| W d n1 s0 Y d S )N
z
r ) cert_and_chain_from_fullchain) r r SS_CERTr r r" r r0 r1 r rf ) r r Z chain_pemZ
fullchain_pemZspacey_fullchain_pemZcrlf_fullchain_pemZacmev1_fullchain_pemr Z fullchainZcert_outZ chain_outr r r "test_cert_and_chain_from_fullchain s& z@CertAndChainFromFullchainTest.test_cert_and_chain_from_fullchainN)r3 r4 r5 r6 r r r r r r r s r c @ sb e Zd ZdZedd Zdd Zdd Ze dd d
Z
e dd d Z e d
dd Z dS )FindChainWithIssuerTestz4Tests for certbot.crypto_util.find_chain_with_issuerc K s ddl m} ||||S )Nr )find_chain_with_issuer)r" r )r#
fullchainsZ issuer_cnrT r r r r r% s z FindChainWithIssuerTest._callc C s t t t t gS r ) CERT_LEAFr CERT_ISSUERCERT_ALT_ISSUERr r r r _all_fullchains s z'FindChainWithIssuerTest._all_fullchainsc C s( | }| |d}||d ks$J dS )z/Correctly pick the chain based on the root's CNPebble Root CA 0cc6f0 N)r r% )r r matchedr r r test_positive_match s z+FindChainWithIssuerTest.test_positive_matchz certbot.crypto_util.logger.infoc C sD | }|d t |d< | |d}||d ks8J | dS )z5Don't pick a chain where only an intermediate matchesr r r N)r r r r% assert_not_calledr Z mock_infor r r r r test_intermediate_match s
z/FindChainWithIssuerTest.test_intermediate_matchc C s0 | }| |d}||d ks$J | d S )Nnon-existent issuerr )r r% r r r r r
test_no_match s z%FindChainWithIssuerTest.test_no_matchz"certbot.crypto_util.logger.warningc C s8 | }| j|ddd}||d ks(J |dd d S )Nr T)Zwarn_on_no_matchr zCertbot has been configured to prefer certificate chains with issuer '%s', but no chain from the CA matched this issuer. Using the default certificate chain instead.)r r% Zassert_called_once_with)r Z mock_warningr r r r r test_warning_on_no_match s z0FindChainWithIssuerTest.test_warning_on_no_matchN)
r3 r4 r5 r6 r7 r% r r r r8 r r r r r r r r s
r __main__r )Er6 r r r~ sysZunittestr r_ r0 Z cryptographyr Z cryptography.hazmat.primitivesr r Z)cryptography.hazmat.primitives.asymmetricr Zcertbotr r Zcertbot.compatr r
Zcertbot.tests.utilZtestsrE rF rW r^ r rU r r r r r r r Z P256_CERTr r r ZTempDirTestCaser r: ZTestCaser@ rQ rY rh r r r r r r r r r r r r r r r r3 exitmainargv__file__r r r r sl
#%+ 2