← Back
Editing: ocsp_test.cpython-38.pyc
U �]0A � @ s< d Z ddlZddlZddlmZmZ ddlmZ ddlmZ ddl m Z m Z ddl m Z z ddlmZ eejd � W n eefk r� dZY nX ddlZddlZdd lmZ dd lmZ d Z G d d� dej �Z ej e dd�G dd� dej ��Z ej!d dd��Z"dd� Z#dZ$dZ%dZ&dZ'd Z(d Z)d Z*e+d k�r8e�,� dS )!zTests for ocsp.py� N)�datetime� timedelta)�default_backend)�hashes)�UnsupportedAlgorithm�InvalidSignature)�x509��ocspZsignature_hash_algorithm)�errors)�utilz;Missing = in header key=value ocsp: Use -help for summary. c @ s� e Zd ZdZdd� Zdd� Ze�d�e�d�e�d�d d � ���Ze�d �e�d �d d� ��Z dd� Z e�d�e�d �dd� ��Z dS )�OCSPTestOpenSSLz5 OCSP revokation tests using OpenSSL binary. c C sj ddl m} t�d��J}t�d��4}t�� }d tf|j_||_d|_|jdd�| _ W 5 Q R X W 5 Q R X d S )Nr r �certbot.ocsp.Popen�certbot.util.exe_existsT�Z enforce_openssl_binary_usage) �certbotr �mock�patch� MagicMock�out� communicate� return_value�RevocationChecker�checker)�selfr � mock_popen� mock_exists�mock_communicate� r �9/usr/lib/python3/dist-packages/certbot/tests/ocsp_test.py�setUp" s zOCSPTestOpenSSL.setUpc C s d S �Nr )r r r r �tearDown, s zOCSPTestOpenSSL.tearDownzcertbot.ocsp.logger.infor r c C s� t �� }d tf|j_||_d|_ddlm} |jdd�}| �|j d� | �|� d�dg� d t� d�d f|j_|jdd�}| �|� d�d dg� | �|j d � d |_d|_ |jdd�}| �|j d� | �|j d� | �|j d� d S ) NTr r r � �xzHost=x� � ZHostF) r r r r r r r r � assertEqual� call_countZ host_args� partition�broken)r r r �mock_logr r r r r r � test_init/ s$ zOCSPTestOpenSSL.test_init�#certbot.ocsp._determine_ocsp_serverzcertbot.util.run_scriptc C s t j�t�� �}t�� }d|_d|_|t dd� |_ d| j _ d|_ | �| j �|�d� d| j _ ttdd � �|_ | �| j �|�d� | �|jd � d |_ | �| j �|�d� t�d �|_| �| j �|�d� | �|jd� ||_ d|_ |j}| �| j �|�d� | �|j|� d S ) Nr$ �yr& �ZhoursT)� r0 Fr# r )z http://x.cozx.coz#Unable to load certificate launcher)�pytz�UTC�fromutcr �utcnowr r �cert�chainr � target_expiryr r* r r' � ocsp_revoked�tuple� openssl_happyr( r ZSubprocessError� side_effect)r �mock_run�mock_determine�now�cert_objZ count_beforer r r �test_ocsp_revokedI s, z!OCSPTestOpenSSL.test_ocsp_revokedc C s0 t �d�}ddlm} |�|�}| �d|� d S )N�ocsp_certificate.pemr r )z http://ocsp.test4.buypass.comzocsp.test4.buypass.com)� test_util� vector_pathr r Z_determine_ocsp_serverr' )r � cert_pathr �resultr r r �test_determine_ocsp_serverh s z*OCSPTestOpenSSL.test_determine_ocsp_serverzcertbot.ocsp.loggerc C s$ t |_ddlm} | �|jt� d� | �|jt � d� | �|jjd� | �|j jd� d|j_| �|jt � d� | �|jjd� | �|j jd� | �|jt � d� | �|jjd� | �|jt � d� | �|j jd� d|j _| �|jt� d� | �|j jd� | �|jt� d� | �|j jd� d S )Nr r Fr# r& T)�openssl_confusedr r r r' Z_translate_ocsp_queryr: �debugr( Zwarning�openssl_unknown�openssl_expired_ocsp�openssl_broken�info�openssl_revoked� openssl_expired_ocsp_revoked)r r< r+ r r r r �test_translate_ocspo s& z#OCSPTestOpenSSL.test_translate_ocspN) �__name__� __module__� __qualname__�__doc__r r" r r r, r@ rF rO r r r r r s r zFThis class tests functionalities available only on cryptography>=2.5.0)�reasonc @ sT e Zd ZdZdd� Ze�d�e�d�dd� ��Zdd � Zd d � Z d d � Z dd� Z dS )�OSCPTestCryptographyz; OCSP revokation tests using Cryptography >= 2.4.0 c C sr ddl m} |�� | _t�d�| _t�d�| _t� � | _ | j| j _ | j| j _ t j�t�� �}|tdd� | j _d S )Nr r rA �ocsp_issuer_certificate.pemr& r/ )r r r r rB rC rD � chain_pathr r r? r5 r6 r1 r2 r3 r r4 r r7 )r r r> r r r r � s zOSCPTestCryptography.setUpr- z%certbot.ocsp._check_ocsp_cryptographyc C s* d|_ | j�| j� |�| j| jd� d S )N)�http://example.com� example.comrX )r r r8 r? Zassert_called_once_withrD rW )r Z mock_revoker= r r r � test_ensure_cryptography_toggled� s z5OSCPTestCryptography.test_ensure_cryptography_toggledc C s: t tjjtjj�� | j�| j�}W 5 Q R X | � |� d S r! ) � _ocsp_mock�ocsp_lib�OCSPCertStatus�REVOKED�OCSPResponseStatus� SUCCESSFULr r8 r? Z assertTrue)r �revokedr r r � test_revoke� s z OSCPTestCryptography.test_revokec C s� t �t�d�t� �}ttjjtj j ��"}|j |d j _ | j�| j� W 5 Q R X | �|d jd� | �|d jd d �� |�� �� � d S )NrV � mock_response� mock_checkr# r )r �load_pem_x509_certificaterB � load_vectorr r[ r\ r] r^ r_ r` �subjectr �responder_namer r8 r? r' r( Z call_args�public_numbers� public_key)r �issuer�mocksr r r �test_responder_is_issuer� s �� �z-OSCPTestCryptography.test_responder_is_issuerc C s� t �t�d�t� �}t �t�d�t� �}ttjjtj j ��}| j � | j � W 5 Q R X | �|d jd� | �|d jd d d �� |�� �� � | �|d jd d d �� |�� �� � d S )NrV � ocsp_responder_certificate.pemrd r& r r# )r re rB rf r r[ r\ r] r^ r_ r` r r8 r? r' r( Zcall_args_listri rj )r rk � responderrl r r r �%test_responder_is_authorized_delegate� s( � �� � �z:OSCPTestCryptography.test_responder_is_authorized_delegatec C s� t tjjtjjdd�� | j�| j�}W 5 Q R X | � |� t tjjtjj �� | j�| j�}W 5 Q R X | � |� t tjjtjj�� | j�| j�}W 5 Q R X | � |� t tjj tjj��: t j dt�dtjj�d�� | j�| j�}W 5 Q R X W 5 Q R X | � |� t tjj tjjtd�d�� | j�| j�}W 5 Q R X | � |� t tjj tjjtd�d�� | j�| j�}W 5 Q R X | � |� t tjj tjjtd�d�� | j�| j�}W 5 Q R X | � |� t tjj tjj�� }g |d j_| j�| j�}W 5 Q R X | � |� t tjj tjj��@}|d jjd }t jd |jd �|d jjd < | j�| j�}W 5 Q R X | � |� t tjj tjj��V t � d ��@}d |_t j dt�dtjj�d�� | j�| j�}W 5 Q R X W 5 Q R X W 5 Q R X | � |� d S )Ni� )�http_status_codez4cryptography.x509.Extensions.get_extension_for_classz Not found)r; Zfoo)�check_signature_side_effectrc r Zfake)rk rg r- )zhttps://example.comrY )r[ r\ r] ZUNKNOWNr_ r` r r8 r? Z assertFalseZ UNAUTHORIZEDr^ r r r ZExtensionNotFoundZ AuthorityInformationAccessOIDZOCSPr r �AssertionErrorr � certificates�Mockrg )r ra rl r5 Z mock_serverr r r �test_revoke_resiliency� s� � ��" � � � � � � ��,z+OSCPTestCryptography.test_revoke_resiliencyN) rP rQ rR rS r r r rZ rb rm rp rv r r r r rU � s rU �� c c sx t �d��d}t| |�|_t �d��B}t j|d�|_t �d�� }|rH||_|||d�V W 5 Q R X W 5 Q R X W 5 Q R X d S )Nz(certbot.ocsp.ocsp.load_der_ocsp_responsezcertbot.ocsp.requests.post)Z status_codez.certbot.ocsp.crypto_util.verify_signed_payload)rc � mock_postrd )r r � _construct_mock_ocsp_responser ru r; )�certificate_status�response_statusrq rr rc rx rd r r r r[ s � �r[ c C s� t �t�d�t� �}t �t�d�t� �}t �t�d�t� �}t�� }|�||t� � �}|� � }t j || |j |j|j|j|gt� � t�� tdd� t�� tdd� t jjjd� S )NrA rV rn r# )Zdays) r{ rz � serial_number�issuer_key_hash�issuer_name_hashrh rt Zhash_algorithmZ next_updateZ this_updateZsignature_algorithm_oid)r re rB rf r r\ ZOCSPRequestBuilderZadd_certificater ZSHA1Zbuildr ru r| r} r~ rg r r> r ZoidZSignatureAlgorithmOIDZ RSA_WITH_SHA1)rz r{ r5 rk ro ZbuilderZrequestr r r ry ! s8 � � ��ry )r0 z� /etc/letsencrypt/live/example.org/cert.pem: good This Update: Dec 17 00:00:00 2016 GMT Next Update: Dec 24 00:00:00 2016 GMT z� Response Verify Failure 139903674214048:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:138:Verify error:unable to get local issuer certificate )�blah.pemz^ blah.pem: good This Update: Dec 20 18:00:00 2016 GMT Next Update: Dec 27 18:00:00 2016 GMT �Response verify OK)r z� blah.pem: revoked This Update: Dec 20 01:00:00 2016 GMT Next Update: Dec 27 01:00:00 2016 GMT Revocation Time: Dec 20 01:46:34 2016 GMT r� )r za blah.pem: unknown This Update: Dec 20 18:00:00 2016 GMT Next Update: Dec 27 18:00:00 2016 GMT r� )r0 Z tentaclesr� )r z� blah.pem: WARNING: Status times invalid. 140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372: good This Update: Apr 6 00:00:00 2016 GMT Next Update: Apr 13 00:00:00 2016 GMT r� )r z� blah.pem: WARNING: Status times invalid. 140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372: revoked This Update: Apr 6 00:00:00 2016 GMT Next Update: Apr 13 00:00:00 2016 GMT r� �__main__)rw N)-rS � contextlibZunittestr r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr Zcryptography.exceptionsr r Z cryptographyr Zcryptography.x509r r\ �getattrZ OCSPResponse� ImportError�AttributeErrorr r1 r r Z certbot.testsr rB r ZTestCaser ZskipIfrU �contextmanagerr[ ry rG r: rM rI rK rJ rN rP �mainr r r r �<module> sJ k� �
Save File
Cancel