a
}|g}H @ sN d Z ddlZddlmZ ddlmZ ddlZddlZddlmZ ddlZddlm Z ddl
m Z ddl
m Z dd l
mZ dd
lmZ dd lmZ dd lmZ ddlZddlZdd
lmZ ddlmZ dZ G dd dej Z G dd dej Z ej!d"ddZ"dd Z#dZ$dZ%dZ&d Z'd Z(d Z)d Z*e+d krJe,e-ej.d!d e/g dS )#zTests for ocsp.py N)datetime) timedelta)mock)x509)InvalidSignature)UnsupportedAlgorithm)default_backend)hashes) CryptographyDeprecationWarningocsp)errors)utilz;Missing = in header key=value
ocsp: Use -help for summary.
c @ s e Zd ZdZdd Zedededdd Zed ed
ed d d
Zdd Z eded dd Z
dS )OCSPTestOpenSSLz5
OCSP revocation tests using OpenSSL binary.
c C s~ ddl m} tdT}td*}t|_d|_|jdd| _W d n1 sR0 Y W d n1 sp0 Y d S )Nr r certbot.ocsp.subprocess.runcertbot.util.exe_existsTZ enforce_openssl_binary_usage) certbotr r patchoutstderr return_valueRevocationCheckerchecker)selfr mock_run mock_exists r E/usr/lib/python3.9/site-packages/certbot/_internal/tests/ocsp_test.pysetUp" s zOCSPTestOpenSSL.setUpzcertbot.ocsp.logger.infor r c C s` t |j_d|_ddlm} |jdd}t dd |j_|jdd}d|_d|_|jdd}d S )NTr r r
F)r r r r r r partition
call_count)r r r mock_logr r r r r test_init* s zOCSPTestOpenSSL.test_init#certbot.ocsp._determine_ocsp_server!certbot.ocsp.crypto_util.notAfterzcertbot.util.run_scriptc C s t tj}t }d|_d|_|tdd |_ d| j
_ d|_ d| j
_ t t
dd |_ d |_ td
|_||_ d|_ |j}d S ) Nxyr! ZhoursT) r+ F )z http://x.cozx.coz#Unable to load certificate launcher)r nowpytzUTCr MagicMock cert_path
chain_pathr r r brokentuple
openssl_happyr
ZSubprocessError side_effectr# )r r Zmock_namock_determiner- cert_objZ count_beforer r r test_ocsp_revokedB s z!OCSPTestOpenSSL.test_ocsp_revokedc C s$ t d}ddlm} ||}d S )Nocsp_certificate.pemr r ) test_util vector_pathr r Z_determine_ocsp_server)r r1 r resultr r r test_determine_ocsp_serverb s
z*OCSPTestOpenSSL.test_determine_ocsp_serverzcertbot.ocsp.loggerc C s& t |_ddlm} d|j_d|j_d S )Nr r )openssl_confusedr r r debugr# info)r r r$ r r r r test_translate_ocspi s
z#OCSPTestOpenSSL.test_translate_ocspN) __name__
__module__ __qualname____doc__r r r r% r9 r> rB r r r r r s r c @ s\ e Zd ZdZdd Zededdd Zdd Zd
d Z d d
Z
dd Z dd Z dS )OSCPTestCryptographyz;
OCSP revokation tests using Cryptography >= 2.4.0
c C s ddl m} | | _td| _td| _t | _
| j| j
_| j| j
_t t
j}tjd|tdd d| _| j | | jj d S ) Nr r r: ocsp_issuer_certificate.pemr' r! r* )r )r r r r r; r< r1 r2 r r0 r8 r r- r. r/ r r Z
mock_notAfterstartZ
addCleanupstop)r r r- r r r r s
zOSCPTestCryptography.setUpr& z%certbot.ocsp._check_ocsp_cryptographyc C s, d|_ | j| j || j| jdd d S )N)http://example.com example.comrK
)r r ocsp_revokedr8 Zassert_called_once_withr1 r2 )r
mock_checkr7 r r r test_ensure_cryptography_toggled s z5OSCPTestCryptography.test_ensure_cryptography_toggledc C sD t tjjtjj | j| j}W d n1 s60 Y d S )N)
_ocsp_mockocsp_libOCSPCertStatusREVOKEDOCSPResponseStatus
SUCCESSFULr rN r8 )r revokedr r r test_revoke s ,z OSCPTestCryptography.test_revokec C s t tdt }ttjjtj j
p}|j |d j _
d |d j _| j| j t j| j}d |d j _
||d j _| j| j W d n1 s0 Y d S )NrH
mock_responser load_pem_x509_certificater; load_vectorr rQ rR rS rT rU rV subjectr responder_nameZresponder_key_hashr rN r8 ZSubjectKeyIdentifierZfrom_public_keyZ
public_keyZdigest)r issuermockskey_hashr r r test_responder_is_issuer s ,z-OSCPTestCryptography.test_responder_is_issuerc C s t tdt }t tdt }ttjjtj j
p}|j |d j _
d |d j _| j| j t j| j}d |d j _
||d j _| j| j W d n1 s0 Y d S )NrH ocsp_responder_certificate.pemrY rZ )r r_ responderr` ra r r r %test_responder_is_authorized_delegate s$ , z:OSCPTestCryptography.test_responder_is_authorized_delegatec
C s t tjjtjjdd | j| j}W d n1 s:0 Y t tjjtjj | j| j}W d n1 sz0 Y t tjjtjj | j| j}W d n1 s0 Y t tjj
tjjZ t j dt
dt
jjd | j| j}W d n1 s0 Y W d n1 s80 Y t tjj
tjjtdd | j| j}W d n1 s0 Y t tjj
tjjtdd | j| j}W d n1 s0 Y t tjj
tjjtdd | j| j}W d n1 s0 Y t tjj
tjj*}g |d j_| j| j}W d n1 sd0 Y t tjj
tjjJ}|d jjd }t jd
|jd |d jjd < | j| j}W d n1 s0 Y t tjj
tjj t d `}d
|_t j dt
dt
jjd | j| j}W d n1 sB0 Y W d n1 sb0 Y W d n1 s0 Y d S )Ni )http_status_codez4cryptography.x509.Extensions.get_extension_for_classz Not foundr6 Zfoo)check_signature_side_effectrY r Zfake)r_ r] r& )zhttps://example.comrL )rQ rR rS ZUNKNOWNrU rV r rN r8 Z UNAUTHORIZEDrT r r r ZExtensionNotFoundZ AuthorityInformationAccessOIDZOCSPr r AssertionErrorr certificatesMockr] )r rW r` certZ mock_serverr r r test_revoke_resiliency sh ,,,N... .. nz+OSCPTestCryptography.test_revoke_resiliencyc sx t tjjtjjR}|d jj fdd}tj |d}|t
|d j_| j | j
}W d n1 sj0 Y d S )NrY c s d} t | t S )Nug Properties that return a naïve datetime object have been deprecated. Please switch to this_update_utc.)warningswarnr
)msgvaluer r
warn_first& s zAOSCPTestCryptography.test_this_update_warning..warn_firstrg )rQ rR rS ZGOODrU rV r this_updater Z PropertyMocktyper rN r8 )r r` rs Z
property_mockrW r rq r test_this_update_warning! s ,z-OSCPTestCryptography.test_this_update_warningN)
rC rD rE rF r r r rP rX rb re rm rv r r r r rG s GrG c
c s t d}t| ||_t d`}t j|d|_t d(}|rH||_|||dV W d n1 sj0 Y W d n1 s0 Y W d n1 s0 Y d S )Nz(certbot.ocsp.ocsp.load_der_ocsp_responsezcertbot.ocsp.requests.post)Z status_codez.certbot.ocsp.crypto_util.verify_signed_payload)rY mock_postrO )r r _construct_mock_ocsp_responser rk r6 )certificate_statusresponse_statusrf rh rY rx rO r r r rQ 5 s
rQ c C s t tdt }t tdt }t tdt }t }|||t }|
}t j || |j
|j|j|j|gt ttjjd dtdd ttjjd dtdd t jjjd S )Nr: rH rc )Ztzinfor, )Zdays) r{ rz
serial_numberissuer_key_hashissuer_name_hashr^ rj Zhash_algorithmZ next_updatert Zsignature_algorithm_oid)r r[ r; r\ r rR ZOCSPRequestBuilderZadd_certificater ZSHA1Zbuildr rk r| r} r~ r] r r- r. r/ replacer ZoidZSignatureAlgorithmOIDZ
RSA_WITH_SHA1)rz r{ rl r_ rd ZbuilderZrequestr r r ry H s2 ry )r+ z
/etc/letsencrypt/live/example.org/cert.pem: good
This Update: Dec 17 00:00:00 2016 GMT
Next Update: Dec 24 00:00:00 2016 GMT
z
Response Verify Failure
139903674214048:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:138:Verify error:unable to get local issuer certificate
)blah.pemz^
blah.pem: good
This Update: Dec 20 18:00:00 2016 GMT
Next Update: Dec 27 18:00:00 2016 GMT
Response verify OK)r z
blah.pem: revoked
This Update: Dec 20 01:00:00 2016 GMT
Next Update: Dec 27 01:00:00 2016 GMT
Revocation Time: Dec 20 01:46:34 2016 GMT
r )r za
blah.pem: unknown
This Update: Dec 20 18:00:00 2016 GMT
Next Update: Dec 27 18:00:00 2016 GMT
r )r+ Z tentaclesr )r z
blah.pem: WARNING: Status times invalid.
140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372:
good
This Update: Apr 6 00:00:00 2016 GMT
Next Update: Apr 13 00:00:00 2016 GMT
r )r z
blah.pem: WARNING: Status times invalid.
140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372:
revoked
This Update: Apr 6 00:00:00 2016 GMT
Next Update: Apr 13 00:00:00 2016 GMT
r __main__r, )rw N)0rF
contextlibr r sysZunittestr rn Z cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr Zcryptography.utilsr
Zcryptography.x509r rR Zpytestr. r r
Z
certbot.testsr r; r ZTestCaser rG contextmanagerrQ ry r? r5 Zopenssl_revokedZopenssl_unknownZopenssl_brokenZopenssl_expired_ocspZ openssl_expired_ocsp_revokedrC exitmainargv__file__r r r r sF e 4