a
}|g}H @ sN d Z ddlZddlmZ ddlmZ ddlZddlZddlmZ ddlZddlm Z ddl
m Z ddl
m Z dd l
mZ dd
lmZ dd lmZ dd lmZ ddlZddlZdd
lmZ ddlmZ dZ G dd dej Z G dd dej Z ej!d"ddZ"dd Z#dZ$dZ%dZ&d Z'd Z(d Z)d Z*e+d krJe,e-ej.d!d e/g dS )#zTests for ocsp.py N)datetime) timedelta)mock)x509)InvalidSignature)UnsupportedAlgorithm)default_backend)hashes) CryptographyDeprecationWarningocsp)errors)utilz;Missing = in header key=value
ocsp: Use -help for summary.
c @ s e Zd ZdZdd Zedededdd Zed ed
ed d d
Zdd Z eded dd Z
dS )OCSPTestOpenSSLz5
OCSP revocation tests using OpenSSL binary.
c C s~ ddl m} tdT}td*}t|_d|_|jdd| _W d n1 sR0 Y W d n1 sp0 Y d S )Nr r certbot.ocsp.subprocess.runcertbot.util.exe_existsTZ enforce_openssl_binary_usage) certbotr r patchoutstderr return_valueRevocationCheckerchecker)selfr mock_run mock_exists r E/usr/lib/python3.9/site-packages/certbot/_internal/tests/ocsp_test.pysetUp" s zOCSPTestOpenSSL.setUpzcertbot.ocsp.logger.infor r c C s t |j_d|_ddlm} |jdd}|jdks4J |ddgksHJ t dd |j_|jdd}|dd
dgks|J |j d u sJ d |_d|_|jdd}|jdksJ |jdksJ |j du sJ d S ) NTr r r xzHost=x
ZHostF)
r r r r r r
call_countZ host_args partitionbroken)r r r mock_logr r r r r test_init* s zOCSPTestOpenSSL.test_init#certbot.ocsp._determine_ocsp_server!certbot.ocsp.crypto_util.notAfterzcertbot.util.run_scriptc C s t tj}t }d|_d|_|tdd |_ d| j
_ d|_ | j
|du sRJ d| j
_ t
tdd |_ | j
|du sJ |jd ksJ d
|_ | j
|du sJ td |_| j
|du sJ |jdksJ ||_ d|_ |j}| j
|du sJ |j|ks J d S ) Nr! yr# ZhoursT) r- Fr r )z http://x.cozx.coz#Unable to load certificate launcher)r nowpytzUTCr MagicMock cert_path
chain_pathr r r r& ocsp_revokedtuple
openssl_happyr$ r
ZSubprocessError side_effect)r r Zmock_namock_determiner. cert_objZ count_beforer r r test_ocsp_revokedB s, z!OCSPTestOpenSSL.test_ocsp_revokedc C s0 t d}ddlm} ||}d|ks,J d S )Nocsp_certificate.pemr r )z http://ocsp.test4.buypass.comzocsp.test4.buypass.com) test_util vector_pathr r Z_determine_ocsp_server)r r2 r resultr r r test_determine_ocsp_serverb s
z*OCSPTestOpenSSL.test_determine_ocsp_serverzcertbot.ocsp.loggerc C s( t |_ddlm} |jt du s$J |jt du s6J |jjdksFJ |jjdksVJ d|j_|jt du spJ |jjdksJ |jjdksJ |jt
du sJ |jjdksJ |jt du sJ |jjdksJ d|j _|jt
du sJ |j jdksJ |jt du sJ |j jdks$J d S )Nr r Fr r# T)openssl_confusedr r r Z_translate_ocsp_queryr6 debugr$ Zwarningopenssl_unknownopenssl_expired_ocspopenssl_brokeninfoopenssl_revoked openssl_expired_ocsp_revoked)r r r' r r r r test_translate_ocspi s& z#OCSPTestOpenSSL.test_translate_ocspN) __name__
__module__ __qualname____doc__r r r r( r: r? rH r r r r r s r c @ s\ e Zd ZdZdd Zededdd Zdd Zd
d Z d d
Z
dd Z dd Z dS )OSCPTestCryptographyz;
OCSP revokation tests using Cryptography >= 2.4.0
c C s ddl m} | | _td| _td| _t | _
| j| j
_| j| j
_t t
j}tjd|tdd d| _| j | | jj d S ) Nr r r; ocsp_issuer_certificate.pemr* r# r, )r )r r r r r< r= r2 r3 r r1 r9 r r. r/ r0 r r Z
mock_notAfterstartZ
addCleanupstop)r r r. r r r r s
zOSCPTestCryptography.setUpr) z%certbot.ocsp._check_ocsp_cryptographyc C s, d|_ | j| j || j| jdd d S )N)http://example.com example.comrQ
)r r r4 r9 Zassert_called_once_withr2 r3 )r
mock_checkr8 r r r test_ensure_cryptography_toggled s z5OSCPTestCryptography.test_ensure_cryptography_toggledc C sL t tjjtjj | j| j}W d n1 s60 Y |sHJ d S )N)
_ocsp_mockocsp_libOCSPCertStatusREVOKEDOCSPResponseStatus
SUCCESSFULr r4 r9 )r revokedr r r test_revoke s ,z OSCPTestCryptography.test_revokec C s t tdt }ttjjtj j
p}|j |d j _
d |d j _| j| j t j| j}d |d j _
||d j _| j| j W d n1 s0 Y |d jdksJ |d jd d d | ksJ |d jd d d | ksJ d S )NrN
mock_responserT r# r r r load_pem_x509_certificater< load_vectorr rV rW rX rY rZ r[ subjectr responder_nameZresponder_key_hashr r4 r9 ZSubjectKeyIdentifierZfrom_public_keyZ
public_keyZdigestr$ Zcall_args_listZpublic_numbers)r issuermockskey_hashr r r test_responder_is_issuer s* ,
z-OSCPTestCryptography.test_responder_is_issuerc C s~ t tdt }t tdt }ttjjtj j
p}|j |d j _
d |d j _| j| j t j| j}d |d j _
||d j _| j| j W d n1 s0 Y |d jdksJ |d jd d d | ksJ |d jd d d | ks"J |d jd d d | ksNJ |d jd d d | kszJ d S )
NrN ocsp_responder_certificate.pemr^ rT r r r# r_ )r rd responderre rf r r r %test_responder_is_authorized_delegate s< ,
z:OSCPTestCryptography.test_responder_is_authorized_delegatec
C s t tjjtjjdd | j| j}W d n1 s:0 Y |du sPJ t tjjtjj | j| j}W d n1 s0 Y |du sJ t tjjtjj | j| j}W d n1 s0 Y |du sJ t tjj
tjjZ t j dt
dt
jjd | j| j}W d n1 s<0 Y W d n1 s\0 Y |du stJ t tjj
tjjtdd | j| j}W d n1 s0 Y |du sJ t tjj
tjjtdd | j| j}W d n1 s 0 Y |du s$J t tjj
tjjtdd | j| j}W d n1 sd0 Y |du s|J t tjj
tjj*}g |d j_| j| j}W d n1 s0 Y |du sJ t tjj
tjjJ}|d jjd
}t jd |jd |d jjd
< | j| j}W d n1 s<0 Y |du sTJ t tjj
tjj t d
`}d|_t j dt
dt
jjd | j| j}W d n1 s0 Y W d n1 s0 Y W d n1 s0 Y |du sJ d S )Ni )http_status_codeFz4cryptography.x509.Extensions.get_extension_for_classz Not foundr7 Zfoo)check_signature_side_effectr^ r Zfake)rd rb r) )zhttps://example.comrR )rV rW rX ZUNKNOWNrZ r[ r r4 r9 Z UNAUTHORIZEDrY r r r ZExtensionNotFoundZ AuthorityInformationAccessOIDZOCSPr r AssertionErrorr certificatesMockrb )r r\ re certZ mock_serverr r r test_revoke_resiliency sz , , , N... .. nz+OSCPTestCryptography.test_revoke_resiliencyc s t tjjtjjR}|d jj fdd}tj |d}|t
|d j_| j | j
}W d n1 sj0 Y |du sJ d S )Nr^ c s d} t | t S )Nug Properties that return a naïve datetime object have been deprecated. Please switch to this_update_utc.)warningswarnr
)msgvaluer r
warn_first& s zAOSCPTestCryptography.test_this_update_warning..warn_firstrn F)rV rW rX ZGOODrZ r[ r this_updater Z PropertyMocktyper r4 r9 )r re rz Z
property_mockr\ r rx r test_this_update_warning! s ,z-OSCPTestCryptography.test_this_update_warningN)
rI rJ rK rL r r r rU r] rg rl rt r} r r r r rM s GrM c
c s t d}t| ||_t d`}t j|d|_t d(}|rH||_|||dV W d n1 sj0 Y W d n1 s0 Y W d n1 s0 Y d S )Nz(certbot.ocsp.ocsp.load_der_ocsp_responsezcertbot.ocsp.requests.post)Z status_codez.certbot.ocsp.crypto_util.verify_signed_payload)r^ mock_postrT )r r _construct_mock_ocsp_responser rr r7 )certificate_statusresponse_statusrm ro r^ r rT r r r rV 5 s
rV c C s t tdt }t tdt }t tdt }t }|||t }|
}t j || |j
|j|j|j|gt ttjjd dtdd ttjjd dtdd t jjjd S )Nr; rN rh )Ztzinfor )Zdays) r r
serial_numberissuer_key_hashissuer_name_hashrc rq Zhash_algorithmZ next_updater{ Zsignature_algorithm_oid)r r` r< ra r rW ZOCSPRequestBuilderZadd_certificater ZSHA1Zbuildr rr r r r rb r r. r/ r0 replacer ZoidZSignatureAlgorithmOIDZ
RSA_WITH_SHA1)r r rs rd rk ZbuilderZrequestr r r r H s2 r )r- z
/etc/letsencrypt/live/example.org/cert.pem: good
This Update: Dec 17 00:00:00 2016 GMT
Next Update: Dec 24 00:00:00 2016 GMT
z
Response Verify Failure
139903674214048:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:138:Verify error:unable to get local issuer certificate
)blah.pemz^
blah.pem: good
This Update: Dec 20 18:00:00 2016 GMT
Next Update: Dec 27 18:00:00 2016 GMT
Response verify OK)r z
blah.pem: revoked
This Update: Dec 20 01:00:00 2016 GMT
Next Update: Dec 27 01:00:00 2016 GMT
Revocation Time: Dec 20 01:46:34 2016 GMT
r )r za
blah.pem: unknown
This Update: Dec 20 18:00:00 2016 GMT
Next Update: Dec 27 18:00:00 2016 GMT
r )r- Z tentaclesr )r z
blah.pem: WARNING: Status times invalid.
140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372:
good
This Update: Apr 6 00:00:00 2016 GMT
Next Update: Apr 13 00:00:00 2016 GMT
r )r z
blah.pem: WARNING: Status times invalid.
140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372:
revoked
This Update: Apr 6 00:00:00 2016 GMT
Next Update: Apr 13 00:00:00 2016 GMT
r __main__r )r~ N)0rL
contextlibr r sysZunittestr ru Z cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr Zcryptography.utilsr
Zcryptography.x509r rW Zpytestr/ r r
Z
certbot.testsr r< r ZTestCaser rM contextmanagerrV r r@ r6 rF rB rD rC rG rI exitmainargv__file__r r r r sF e 4