a
}|ga @ sf d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlZddl m
Z
ddl m Z ddl m
Z ddl mZ dd lmZ ddlm
Z
dd
lmZ dd lmZ dd lmZ dd
lmZ G dd dej Z G dd dej Z ej ddfddZ G dd dej Z!G dd dej Z"G dd dej Z#dd Z$d d Z%e&d krbe'e(ej)dd e*g dS ) z)Tests for certbot._internal.auth_handler. N)mock) b64encode)
challenges)client)errors)messages) achallenges)obj)common) acme_util)utilc @ s, e Zd Zdd Zdd Zdd Zdd Zd S )
ChallengeFactoryTestc C sF ddl m} |d d tjddg | _ttjdtj tjgd | _
d S )Nr AuthHandlerZmock_key)keytest ) certbot._internal.auth_handlerr r Mockhandlerr
gen_authzrr STATUS_PENDING
CHALLENGESauthzrselfr r M/usr/lib/python3.9/site-packages/certbot/_internal/tests/auth_handler_test.pysetUp s
zChallengeFactoryTest.setUpc C s8 | j | jtdttj}dd |D tjks4J d S )Nr c S s g | ]
}|j qS r chall.0Zachallr r r
( z1ChallengeFactoryTest.test_all..)r _challenge_factoryr rangelenr r r achallsr r r test_all$ s z ChallengeFactoryTest.test_allc C s0 | j | jdg}dd |D tjgks,J d S )Nr c S s g | ]
}|j qS r r r! r r r r# - r$ z6ChallengeFactoryTest.test_one_http..)r r% r r HTTP01r( r r r
test_one_http* s z"ChallengeFactoryTest.test_one_httpc C sL t tjdtjdddgtjg}| j|dg}t|d t j
ksHJ d S )Nr r Z unrecognized)r typr ) r r r r r r r r% typer ZOther)r r r) r r r test_unrecognized/ s z&ChallengeFactoryTest.test_unrecognizedN)__name__
__module__ __qualname__r r* r, r/ r r r r r
s
r
c @ s e Zd ZdZdd Zdd Zdd Zdd Zd
d Zd d
Z dd Z
dd Z dd Z dd Z
eddd Zdd Zdd Zd d Zd d Zd!d" Zd#d$ Zd%d& Zd'd( Zd)d* Zd+d, Zd-S ).HandleAuthorizationsTestzmhandle_authorizations test.
This tests everything except for all functions under _poll_challenges.
c C s ddl m} t | _tjdd| _t| j tjdd| _ t
j g| j j _
t| j j_t | _tjtjd| _tjj| jj_|| j | j| jg | _ttj d S )Nr r F)debug_challengesZ
Authenticatorname)spec)r r r r mock_display mock_config display_objZ set_display MagicMock mock_authr r+ get_chall_pref return_value
gen_auth_respperform side_effect mock_account acme_clientZClientV2mock_netZ retry_afterr loggingdisableZCRITICALr r r r r @ s
z HandleAuthorizationsTest.setUpc C s t t j d S NrE rF ZNOTSETr r r r tearDownV s z!HandleAuthorizationsTest.tearDownc C s t dtjd}tj|gd}tddd| jj_t d}| j
|| j }| jj
jdks\J | jjjdksnJ |jjdks~J |jjd d d dksJ |jjd d d d
ksJ | jjjdksJ | jjjd d d jd ksJ t|dksJ W d n1 s0 Y d S ) N0domainZchallsZauthorizations )retry
wait_valuez#certbot._internal.auth_handler.time r http-01)gen_dom_authzrr r r r; _gen_mock_on_pollrD pollrA patchr handle_authorizationsr9 answer_challenge
call_countsleepcall_args_listr< cleanup call_argsr- r' )r r
mock_orderZ mock_timer r r _test_name1_http_01_1_commonY s z5HandleAuthorizationsTest._test_name1_http_01_1_commonc C s | d S rG )rb rI r r r test_name1_http_01_1_acme_2q s z4HandleAuthorizationsTest.test_name1_http_01_1_acme_2c C s t | jj_| jjjtj t
dt j d}t
j|gd}| j|| j}| jjjdks\J | jjjdksnJ | jjjdksJ | jjjd d }t|dksJ |d jdksJ t|dksJ d S NrK rL rN rO r rU )rW rD rX rA r< r= r> appendr DNS01rV r r r r; r rZ r9 r[ r\ r_ r` r' r- )r r ra Zcleaned_up_achallsr r r !test_name1_http_01_1_dns_1_acme_2t s z:HandleAuthorizationsTest.test_name1_http_01_1_dns_1_acme_2c C s t dtjdt dtjdt dtjdg}tj|d}t | jj_| j
|| j }| jj j
dksbJ | jjj
dkstJ | jjj
dksJ t|dksJ d S )NrK rL 12rN rT rO )rV r r r r; rW rD rX rA r rZ r9 r[ r\ r< r_ r' )r authzrsra r r r r "test_name3_http_01_3_common_acme_2 s z;HandleAuthorizationsTest.test_name3_http_01_3_common_acme_2c C s t jddd}tdtjdg}t j|d}d}|| jjj_ t
| j j _
| j|| | j jjdksfJ | jjjdksxJ d | jjjd d v sJ d
|d jjj d t|d jjd jj | jjjd d vsJ t| | jjjd d vsJ d S ) NTr r4 Z
verbose_countrK rL rN foobarbazrO Pass "-v" for more infohttp:// /.well-known/acme-challenge/) r r rV r r r; rB r
thumbprintr> rW rD rX rA r rZ r[ r\ r8 notificationr` body
identifiervaluer r r tokendecoder Zconfigrj ra Zaccount_key_thumbprintr r r test_debug_challenges s(
z.HandleAuthorizationsTest.test_debug_challengesc C s t jddd}tdtjgdtdtjgdg}t j|d}d}|| jjj _
t | j j
_tjtjg| jj_
| j|| | j jjd ksJ | jjjdksJ d
| jjjd d vsJ d |d jjj d
t |d jjd j j | jjjd d v sJ t | | jjjd d v s J d|d jjj | jjjd d v sLJ |d jjd | jj| jjjd d v s~J d S )NTrO rl rK rL rh rN rm rS rn r ro rp z_acme-challenge.)!r r rV r r+ rf r; rB r rq r> rW rD rX rA r r< r= r rZ r[ r\ r8 rr r` rs rt ru r r rv rw Z
validationrx r r r test_debug_challenges_verbose s>
z6HandleAuthorizationsTest.test_debug_challenges_verbosec C sh t dtjdg}tj|d}tj| jj_ t
tj | j
|| j W d n1 sZ0 Y d S NrK rL rN )rV r r r r; r AuthorizationErrorr< r@ rA pytestraisesr rZ r9 r rj ra r r r test_perform_failure s
z-HandleAuthorizationsTest.test_perform_failurec C st t dtjdg}tj|d}tdd| jj_t j
t j dd$ | j
|| jdd W d n1 sf0 Y d S )
NrK rL rN rS )rQ 0All authorizations were not finalized by the CA.matchFrO )rV r r r r; rW rD rX rA r} r~ r r| r rZ r9 r r r r test_max_retries_exceeded s z2HandleAuthorizationsTest.test_max_retries_exceededz)certbot._internal.auth_handler.time.sleepc sd t dtjdg}tj|d}tjj ddifdd}||_ fdd }tjd
d j }t
t j |d | j
j_tjtjd
dT td*}||j_| j|| jd W d n1 s0 Y W d n1 s0 Y |jdksJ |jd d d dks J t|jd d d |d dks4J t|jd d d |d d dks`J d S )NrK rL rN
time_sleptr c s d | 7 < d S )Nr r )Zsecs)stater r mock_sleep_effect s zJHandleAuthorizationsTest.test_deadline_exceeded..mock_sleep_effectc s t jd d S )Nr )seconds)datetime timedeltar Zorig_nowr r r mock_now_effect s zHHandleAuthorizationsTest.test_deadline_exceeded..mock_now_effect )Zminutes)statusrR r r z0certbot._internal.auth_handler.datetime.datetimeFrT rO rS )rV r r r r; r ZnowrA r r rW r r rD rX r} r~ r r| rY r rZ r9 r\ r^ abs)r Z
mock_sleeprj ra r r intervalZmock_dtr r r test_deadline_exceeded s* N (z/HandleAuthorizationsTest.test_deadline_exceededc C sL t jg d}ttj | j|| j W d n1 s>0 Y d S )NrN ) r r; r} r~ r r| r rZ r9 )r ra r r r test_no_domains s z(HandleAuthorizationsTest.test_no_domainsc C s t dtjdg}tj|d}| jjjt j
| j j
t j
jt jjf t | jj_| j || j | jjjdksvJ | jjjd d d jdksJ d S rd )rV r r r r; r< r= r> re r r+ r pref_challsextendr- rf rW rD rX rA rZ r9 r_ r\ r` r r r r -test_preferred_challenge_choice_common_acme_2 s zFHandleAuthorizationsTest.test_preferred_challenge_choice_common_acme_2c C sn t dtjdg}tj|d}| jjtj j
t t
j | j|| j W d n1 s`0 Y d S r{ )rV r r r r; r r re r rf r- r} r~ r r| rZ r9 r r r r .test_preferred_challenges_not_supported_acme_2 s
zGHandleAuthorizationsTest.test_preferred_challenges_not_supported_acme_2c C s^ t dtjgdg}tj|d}ttj | j
|| j W d n1 sP0 Y d S r{ ) rV r rf r r; r} r~ r r| r rZ r9 r r r r %test_dns_only_challenge_not_supported s z>HandleAuthorizationsTest.test_dns_only_challenge_not_supportedc C s t j| jj_tdtjd}tj |gd}t
t j | j
|| j W d n1 sZ0 Y | jjjdksvJ | jjjd d d jdksJ d S rd )r r| r< r@ rA rV r r r r; r} r~ r rZ r9 r_ r\ r` r- r r ra r r r test_perform_error% s .z+HandleAuthorizationsTest.test_perform_errorc C s t j| jj_tdtjdg}tj |d}t
t j | j
|| j W d n1 sZ0 Y | jjjdksvJ | jjjd d d jdksJ d S rd )r r| rD r[ rA rV r r r r; r} r~ r rZ r9 r< r_ r\ r` r- r r r r test_answer_error0 s .z*HandleAuthorizationsTest.test_answer_errorc C s t dtjdg}tj|d}ttjd| jj _
t R t
jtjdd" | j|| jd W d n1 sp0 Y W d n1 s0 Y | jjjdksJ | jjjd d d jd
ksJ d S ) NrK rL rN r z Some challenges have failed.r FrO r rU )rV r r r r; rW r STATUS_INVALIDrD rX rA test_utilpatch_display_utilr} r~ r r| r rZ r9 r< r_ r\ r` r- r r r r test_incomplete_authzr_error; s
Nz5HandleAuthorizationsTest.test_incomplete_authzr_errorc C s dd }t dtjdt dtjdg}|| jj_tj|d}td"}| j
|| j d}W d n1 sl0 Y t |d ksJ |j
d ksJ ttjd
| jj_t R tjtjd d " | j
|| j d W d n1 s0 Y W d n1 s0 Y d S )
Nc S s2 t tj}t tj}| jjjdkr*|| S || S )zBThis mock will invalidate one authzr, and invalidate the other onewill-be-invalid)rW r STATUS_VALIDr rs rt ru )r Z
valid_mockZ invalid_mockr r r _conditional_mock_on_pollG s
zLHandleAuthorizationsTest.test_best_effort.._conditional_mock_on_pollz
will-be-validrL r rN zAcertbot._internal.auth_handler.AuthHandler._report_failed_authzrsTrO r zAll challenges have failed.r )rV r r rD rX rA r r; rY r rZ r9 r' r\ rW r r r r r} r~ r r| )r r rj ra Z mock_reportZ valid_authzrr r r test_best_effortF s
0
z)HandleAuthorizationsTest.test_best_effortc C s t tjdt jgtjg}tj|gd}tt j
| j || j
W d n1 sZ0 Y t tjdt jgtjg}tj|gd}| j || j
d S )NrK rN )r r r r rf r r; r} r~ r r| r rZ r9 r r r r r "test_validated_challenge_not_rerunf s .z;HandleAuthorizationsTest.test_validated_challenge_not_rerunc C s dd }dt jfdt jfdt jfg}dd |D }tj|d}|| jj_| j |\}}| jjj
d ksjJ t |d
kszJ t |d
ksJ |d j j
jdksJ |d j jt jksJ |d j j
jdksJ |d j jt jksJ d S )
zWhen we deactivate valid authzrs in an orderr, we expect them to become deactivated
and to receive a list of deactivated authzrs in return.c S sR | j jtjkrD| j jjdkr&td| j jtj d}tj
|d} n
t d| S )Nis_valid_but_will_failz Mock deactivation ACME errorr )rs z Can't deactivate non-valid authz) rs r r r rt ru acme_errorsErrorupdateSTATUS_DEACTIVATEDZAuthorizationResourcer )r Zauthzbr r r _mock_deactivate~ s
zQHandleAuthorizationsTest.test_valid_authzrs_deactivated.._mock_deactivateZis_validZ
is_pendingr c S s. g | ]&}t |d |d t jg|d gqS )rO r )r r r+ )r" ar r r r# s zKHandleAuthorizationsTest.test_valid_authzrs_deactivated..rN rS rO r N)r r r r r; rD Zdeactivate_authorizationrA r Z deactivate_valid_authorizationsr\ r' rs rt ru r r )r r Z
to_deactivateZorderrrj Zfailedr r r test_valid_authzrs_deactivated{ s$
z7HandleAuthorizationsTest.test_valid_authzrs_deactivatedN)r0 r1 r2 __doc__r rJ rb rc rg rk ry rz r r r rY r r r r r r r r r r r r r r r r3 9 s.
r3 rO c s d|i fdd}|S )Ncountc sp d d d< d dk r nt j}t|| jjjdd | jjD |gt| jj }|t j
dt idfS )Nr rO r c S s g | ]
}|j qS r r )r" challbr r r r# r$ z4_gen_mock_on_poll.._mock..z Retry-After)Zheaders) r r r r rs rt ru r r' r r; str)r Zeffective_statusZ updated_azrr r rR r r _mock s z _gen_mock_on_poll.._mockr )r rQ rR r r r r rW s rW c @ s e Zd ZdZdd Zdd ZdS )ChallbToAchallTestz:Tests for certbot._internal.auth_handler.challb_to_achall.c C s ddl m} ||ddS )Nr )challb_to_achall account_keyrM )r r )r r r r r r _call s zChallbToAchallTest._callc C s& | tjtjtjdddks"J d S )Nr rM )r r rM )r r HTTP01_Pr Z"KeyAuthorizationAnnotatedChallengerI r r r test_it s
zChallbToAchallTest.test_itN)r0 r1 r2 r r r r r r r r s r c @ s< e Zd ZdZdd Zdd Zedd Zdd Zd
d Z d S )
GenChallengePathTestzBTests for certbot._internal.auth_handler.gen_challenge_path.
c C s t t j d S rG )rE rF ZFATALrI r r r r s zGenChallengePathTest.setUpc C s t t j d S rG rH rI r r r rJ s z GenChallengePathTest.tearDownc C s ddl m} |||S )Nr )gen_challenge_path)r r )clschallbsZ preferencesr r r r r s zGenChallengePathTest._callc C sN t jt jf}tjtjg}| ||dks,J | |ddd |dksJJ dS )z/Given DNS01 and HTTP01 with appropriate combos.)r N)rO )r DNS01_Pr r rf r+ r r r Zprefsr r r test_common_case s z%GenChallengePathTest.test_common_casec C sL t jf}tjg}ttj | || W d n1 s>0 Y d S rG ) r r r r+ r} r~ r r| r r r r r test_not_supported s z'GenChallengePathTest.test_not_supportedN)
r0 r1 r2 r r rJ classmethodr r r r r r r r s
r c @ sN e Zd ZdZdd Zeddd Zeddd Zedd d
Z d S ) ReportFailedAuthzrsTestzLTests for certbot._internal.auth_handler.AuthHandler._report_failed_authzrs.c C s ddl m} tjtjdd| _d| j_d| jj_ || jt t g | _
t j dt
jt
jjddd d
}|d jd uszJ t
jf i |}t j |d < t
jf i |}t | _d
| jjj_||g| jj_t
jjddd |d < t
jf i |}t | _d| jjj_|g| jj_d S )Nr r Zbuzz)r7 r6 z
the buzz hinturiZtlsdetail)r )r r r errorr r z example.comZdnsseczfoo.bar)r r r r;
plugin_commonZPluginr< r6 auth_hintr> r r r+ r r r Z with_code descriptionZ
ChallengeBodyauthzr1rs rt ru r authzr2)r r kwargsZhttp_01Z http_01_diffr r r r s,
z ReportFailedAuthzrsTest.setUpz2certbot._internal.auth_handler.display_util.notifyc C s | j | jg |d d S )Nz
Certbot failed to authenticate some domains (authenticator: buzz). The Certificate Authority reported these problems:
Domain: example.com
Type: tls
Detail: detail
Domain: example.com
Type: tls
Detail: detail
Hint: the buzz hint
)r _report_failed_authzrsr assert_called_withr mock_notifyr r r test_same_error_and_domain s z2ReportFailedAuthzrsTest.test_same_error_and_domainc C s4 d| j _d| j j_| j| j| jg |d d S )NZquuxZquuuuuuxa'
Certbot failed to authenticate some domains (authenticator: quux). The Certificate Authority reported these problems:
Domain: foo.bar
Type: dnssec
Detail: detail
Domain: example.com
Type: tls
Detail: detail
Domain: example.com
Type: tls
Detail: detail
Hint: quuuuuux
) r< r6 r r> r r r r r r r r r !test_different_errors_and_domains s
z9ReportFailedAuthzrsTest.test_different_errors_and_domainsc C sh ddl m} tjdd| _d| j_t| jj_|| jt t g | _ | j
| j g |j dksdJ dS )zMIf authenticator not derived from common.Plugin, we shouldn't call .auth_hintr r Zquuzr5 rO N)
r r r r; r< r6 Exceptionr rA r r r r\ )r r r r r r !test_non_subclassed_authenticator) s
z9ReportFailedAuthzrsTest.test_non_subclassed_authenticatorN)
r0 r1 r2 r r r rY r r r r r r r r s "
r c C s dd | D S )z(Generate a dummy authorization response.c S s g | ]}d |j j|jf qS )z%s%s) __class__r0 rM )r" r r r r r# 8 s z!gen_auth_resp..r )Z
chall_listr r r r? 6 s r? c C s t tj| |tjgt| S )z!Generates new authzr for domains.)r r r r r' rL r r r rV < s rV __main__)+r r rE sysZunittestr Zjosepyr r} Zacmer r rC r r r Zcertbotr Zcertbot._internal.displayr r: Zcertbot.pluginsr
r Z
certbot.testsr r r ZTestCaser
r3 r rW r r r r? rV r0 exitmainargv__file__r r r r s: " f \