← Back
Editing: configurator_test.cpython-38.pyc
U �]� � @ s� d Z ddlZddlZddlZddlmZ ddlmZ ddlmZ ddlm Z ddlm Z ddl m Z dd l mZ dd lmZ dd lmZ dd lmZ dd lmZ dd lmZ G dd� dej�ZG dd� dej�ZG dd� dej�Z e dkr�e� � dS )z$Test for certbot_nginx.configurator.� N)� challenges)�messages)� achallenges)� crypto_util)�errors)�os��util)�obj)�parser)�_redirect_block_for_domain)� UnspacedListc sV e Zd ZdZ� fdd�Ze�d�dd� �Zdd� Ze�d�e�d �d d � ��Z d d � Z e�d�dd� �Z e�d�dd� �Z dd� Z dd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Z d3d4� Z d5d6� Z d7d8� Z e�d9�d:d;� �Z d<d=� Z!d>d?� Z"e�d@�e�dA�e�dB�dCdD� ���Z#e�d �dEdF� �Z$e�d �dGdH� �Z%e�d �dIdJ� �Z&e�d �dKdL� �Z'e�d �dMdN� �Z(e�dO�dPdQ� �Z)e�dO�dRdS� �Z*e�dT�dUdV� �Z+e�dW�dXdY� �Z,e�dZ�d[d\� �Z-e�d]�d^d_� �Z.d`da� Z/dbdc� Z0ddde� Z1dfdg� Z2dhdi� Z3djdk� Z4dldm� Z5e�dn�dodp� �Z6dqdr� Z7dsdt� Z8dudv� Z9dwdx� Z:dydz� Z;d{d|� Z<d}d~� Z=dd�� Z>d�d�� Z?d�d�� Z@d�d�� ZAd�d�� ZBe�d��e�d��d�d�� ��ZCd�d�� ZDd�d�� ZEd�d�� ZFe�d��d�d�� �ZGe�d��d�d�� �ZHe�d��d�d�� �ZIe�d��d�d�� �ZJd�d�� ZK� ZLS )��NginxConfiguratorTestz(Test a semi complex vhost configuration.c s, t t| ��� t�| j| j| j| j�| _ d S �N) �superr �setUpr �get_nginx_configurator� config_path� config_dir�work_dir�logs_dir�config��self�� __class__� �G/usr/lib/python3/dist-packages/certbot_nginx/tests/configurator_test.pyr s �zNginxConfiguratorTest.setUpz*certbot_nginx.configurator.util.exe_existsc C s d|_ | �tj| jj� d S )NF)� return_value� assertRaisesr ZNoInstallationErrorr �prepare)r �mock_exe_existsr r r �test_prepare_no_install! s �z-NginxConfiguratorTest.test_prepare_no_installc C s* | � d| jj� | � dt| jjj�� d S )N�� � � � )� assertEqualr �version�lenr �parsedr r r r � test_prepare' s z"NginxConfiguratorTest.test_preparez+certbot_nginx.configurator.subprocess.Popenc C sT dd� ddddg�f|� j_d|_d | j_t�� | j_| j�� | � d| jj� d S ) N� � znginx version: nginx/1.6.2�:built by clang 6.0 (clang-600.0.56) (based on LLVM 3.5svn)�TLS SNI support enabled�Rconfigure arguments: --prefix=/usr/local/Cellar/nginx/1.6.2 --with-http_ssl_moduleTr# ) �join� communicater r r) �mock�Mock� config_testr r( )r � mock_popenr! r r r � test_prepare_initializes_version+ s �� z6NginxConfiguratorTest.test_prepare_initializes_versionc C sD | j �d�}ddlm} |j| �� t�� | j _t � | j |� d S )N� server-rootr r ) r �conf�certbotr Z_LOCKS�releaser4 r5 r6 �certbot_test_utilZ lock_and_call�_test_prepare_locked)r � server_rootZ certbot_utilr r r �test_prepare_locked= s z)NginxConfiguratorTest.test_prepare_lockedc C sn z| j �� W nP tjk r^ } z0t|�}| �d|k� | �| j �d�|k� W 5 d }~X Y n X | �d� d S )N�lockr9 zException wasn't raised!)r r r � PluginError�str� assertTruer: Zfail)r Zunused_exe_exists�err�err_msgr r r r> F s (z*NginxConfiguratorTest._test_prepare_lockedz/certbot_nginx.configurator.socket.gethostbyaddrc C s> dg g f|_ | j�� }| �|ddddddddd d d d h � d S ) Nz 155.225.50.69.nephoscale.netzwww.example.org� another.alias� migration.com� summer.com� geese.comz sslon.comz globalssl.comzglobalsslsetssl.com�ipv6.comz ipv6ssl.com� headers.com)r r Z get_all_namesr( )r Zmock_gethostbyaddr�namesr r r �test_get_all_namesQ s �z(NginxConfiguratorTest.test_get_all_namesc C s | � dddg| j�� � d S )N�redirect�ensure-http-header� staple-ocsp)r( r Zsupported_enhancementsr r r r �test_supported_enhancements[ s �z1NginxConfiguratorTest.test_supported_enhancementsc C s | � tj| jjdd� d S )N�myhostZunknown_enhancement�r r rB r �enhancer r r r � test_enhance_ s �z"NginxConfiguratorTest.test_enhancec C s | � tjg| j�d�� d S )NrS )r( r �HTTP01r Zget_chall_prefr r r r �test_get_chall_prefc s �z)NginxConfiguratorTest.test_get_chall_prefc C s� | j j�d�}t�|d d d tddg�d dg�}| j j�|dddddgg� | j �� | j jj|d d �}| � d gdd gdd gddgddgdddgdtj gggg|d � d S )N�sites-enabled/example.com� .example.com� example.*r �listen� �5001�sslT)�override�server�69.50.225.155:9000� 127.0.0.1� server_name�#) r r �abs_pathr Z VirtualHost�setZadd_server_directives�saveZ _parse_filesr( �COMMENT)r �filepZ mock_vhostr+ r r r � test_saveg s4 �� ���z NginxConfiguratorTest.test_savec C s | � dd� d S )N�alias� server_conf��_test_choose_vhosts_commonr r r r �test_choose_vhosts_alias} s z.NginxConfiguratorTest.test_choose_vhosts_aliasc C s | � dd� d S )N� example.com� example_confrn r r r r � test_choose_vhosts_example_com� s z4NginxConfiguratorTest.test_choose_vhosts_example_comc C s | � dd� d S )N� localhost�localhost_confrn r r r r � test_choose_vhosts_localhost� s z2NginxConfiguratorTest.test_choose_vhosts_localhostc C s | � dd� d S )N�example.com.uk.testrr rn r r r r �&test_choose_vhosts_example_com_uk_test� s z<NginxConfiguratorTest.test_choose_vhosts_example_com_uk_testc C s | � dd� d S )N�www.example.comrr rn r r r r �"test_choose_vhosts_www_example_com� s z8NginxConfiguratorTest.test_choose_vhosts_www_example_comc C s | � dd� d S )N�test.www.example.com�foo_confrn r r r r �'test_choose_vhosts_test_www_example_com� s z=NginxConfiguratorTest.test_choose_vhosts_test_www_example_comc C s | � dd� d S )N�abc.www.foo.comr| rn r r r r �"test_choose_vhosts_abc_www_foo_com� s z8NginxConfiguratorTest.test_choose_vhosts_abc_www_foo_comc C s | � dd� d S )N� www.bar.co.ukru rn r r r r � test_choose_vhosts_www_bar_co_uk� s z6NginxConfiguratorTest.test_choose_vhosts_www_bar_co_ukc C s | � dd� d S )NrK � ipv6_confrn r r r r �test_choose_vhosts_ipv6_com� s z1NginxConfiguratorTest.test_choose_vhosts_ipv6_comc C s� t ddg�t dddg�t ddg�t dd g�t d g�d �}d d d d d ddd dd� }dd� |�� D �}| j�|�d }tj�|j| j�}| � || |j � | � || |� |d kr�| � |� � � | � t dd� |jD ��� d S )Nrt z~^(www\.)?(example|bar)\.�somenamerG rl rZ r[ z *.www.foo.comz*.www.example.comrK )ru rm rr r| r� zetc_nginx/nginx.confz#etc_nginx/sites-enabled/example.comzetc_nginx/foo.confz etc_nginx/sites-enabled/ipv6.com) rt rl rq rw ry r{ r~ r� rK c S s i | ]\}}|t j�|��qS r )r �path�normpath)�.0�key�valuer r r � <dictcomp>� s zDNginxConfiguratorTest._test_choose_vhosts_common.<locals>.<dictcomp>r c S s g | ]}|j r|jrd �qS )T)r_ Zipv6�r� �xr r r � <listcomp>� s zDNginxConfiguratorTest._test_choose_vhosts_common.<locals>.<listcomp>)rg �itemsr � choose_vhostsr r� �relpathrj Ztemp_dirr( rM rD Z ipv6_enabled�any�addrs)r �namer: Z conf_namesZ conf_path�vhostr� r r r ro � s4 �� �z0NginxConfiguratorTest._test_choose_vhosts_commonc C s. ddddg}|D ]}| � tj| jj|� qd S )Nz www.foo.comZexamplez t.www.bar.coz69.255.225.155)r r �MisconfigurationErrorr r� )r Z bad_resultsr� r r r �test_choose_vhosts_bad� s � �z,NginxConfiguratorTest.test_choose_vhosts_badc C s, | � d| j�d�� | � d| j�d�� d S )N)TF�80)TTZ443)r( r Z ipv6_infor r r r � test_ipv6only� s z#NginxConfiguratorTest.test_ipv6onlyc C sD d| j _| j �ddddd� | j �d�d jD ]}| �|j� q.d S )N�r$ � r$ rK �example/cert.pem�example/key.pem�example/chain.pem�example/fullchain.pemr )r r) � deploy_certr� r� � assertFalseZipv6only)r Zaddrr r r �test_ipv6only_detection� s �z-NginxConfiguratorTest.test_ipv6only_detectionc C s | � d| j�� k� d S )N� nginx.conf)rD r Z more_infor r r r �test_more_info� s z$NginxConfiguratorTest.test_more_infoc C s( d| j _| �tj| j jddddd � d S )Nr� ry r� r� r� )r r) r r rB r� r r r r �(test_deploy_cert_requires_fullchain_path� s �z>NginxConfiguratorTest.test_deploy_cert_requires_fullchain_pathz@certbot_nginx.parser.NginxParser.update_or_add_server_directivesc C s* t �� |_| �t j| jjddddd� d S )NrH r� r� r� r� )r r� � side_effectr rB r r� )r Z$mock_update_or_add_server_directivesr r r �#test_deploy_cert_raise_on_add_error� s �z9NginxConfiguratorTest.test_deploy_cert_raise_on_add_errorc C s� | j j�d�}| j j�d�}| j j�d�}d| j _| j �ddddd � | j �d d d d d� | j �� | j j�� t�| j jj | �}t�| j jj | �}t�| j jj | �}| � dgddgddgddgddgdddgdd gddgd| j j gd| j j gg gg|� | � dd d d gg|� | � t�|dgdd gdd gddgd d!gd"d#gd$d%d&gggdddgddgdd gd| j j gd| j j gg gd'�� d S )(Nz server.confr� rY r� ry r� r� r� r� rG z/etc/nginx/cert.pemz/etc/nginx/key.pemz/etc/nginx/chain.pemz/etc/nginx/fullchain.pemra r\ rb rc rd rZ r[ r^ r_ �ssl_certificate�ssl_certificate_key�include� ssl_dhparamr� rl Z8000z somename:8080�location�/�root�html�index� index.html� index.htmr& )r r rf r) r� rh �loadr �filter_commentsr+ r( � mod_ssl_conf� ssl_dhparamsrD �contains_at_depth)r rm Z nginx_confrr Zparsed_example_confZparsed_server_confZparsed_nginx_confr r r �test_deploy_cert� sx �� �� ���� ���z&NginxConfiguratorTest.test_deploy_certc C s� | j j�d�}| j �ddddd� | j �� | j j�� t�| j jj| �}| � dgdd gddgd d gd d d gddgddgd| j j gd| j j ggg|d � d S )N�sites-enabled/migration.comrI zsummer/cert.pemzsummer/key.pemzsummer/chain.pemzsummer/fullchain.pemra rd rH r\ r� r^ r_ r� r� r� r� r ) r r rf r� rh r� r r� r+ r( r� r� )r �migration_confZparsed_migration_confr r r �$test_deploy_cert_add_explicit_listen& s0 � �� �z:NginxConfiguratorTest.test_deploy_cert_add_explicit_listenz6certbot_nginx.configurator.http_01.NginxHttp01.performz4certbot_nginx.configurator.NginxConfigurator.restartzDcertbot_nginx.configurator.NginxConfigurator.revert_challenge_configc C s� t jtjtjdd�dt�d�d�d| jd�}|�| j�g}|d d � |_ | j � |g�}| � |j d� | � ||� | j �|g� | � d | j j� | � |j d� | � |j d � d S ) Ns m8TdO1qik4JVFtgPPurJmg)�tokenzhttps://ca.org/chall1_uri�pending)ZchallZuriZstatusrq )ZchallbZdomainZ account_keyr$ r r& )r Z"KeyAuthorizationAnnotatedChallenger Z ChallengeBodyr rW ZStatusZ rsa512jwkZresponser r Zperformr( � call_countZcleanupZ _chall_out)r Z mock_revertZ mock_restartZmock_http_performZachall�expectedZ responsesr r r �test_perform_and_cleanup? s& � � � z.NginxConfiguratorTest.test_perform_and_cleanupc C s. dd� ddddg�f|� j_| �| j�� d� dd� dddd g�f|� j_| �| j�� d � dd� d ddd g�f|� j_| �tj| jj� dd� ddg�f|� j_| �tj| jj� dd� ddd g�f|� j_| �tj| jj� dd� d ddd g�f|� j_| �tj | jj� t d �|_ | �tj| jj� d S )Nr- r. znginx version: nginx/1.4.2r/ r0 r1 )r$ � r& znginx version: nginx/0.9z+configure arguments: --with-http_ssl_module)r � z blah 0.0.1znginx version: nginx/0.8.1�Can't find program) r2 r3 r r( r Z get_versionr r rB ZNotSupportedError�OSErrorr� �r r7 r r r �test_get_version[ s^ �� �� �� �� �� �� z&NginxConfiguratorTest.test_get_versionc C s� d|� j _| �| j�� d� d|� j _| �| j�� d� d|� j _| �| j�� d� d|� j _| �| j�� d� d |� j _| �| j�� d � d |� j _| �| j�� d � d S ) N)r- a nginx version: nginx/1.15.5 built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9) built with OpenSSL 1.0.2g 1 Mar 2016 TLS SNI support enabled configure arguments: �1.0.2g)r- a nginx version: nginx/1.15.5 built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9) built with OpenSSL 1.0.2-beta1 1 Mar 2016 TLS SNI support enabled configure arguments: z 1.0.2-beta1)r- a nginx version: nginx/1.15.5 built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9) built with OpenSSL 1.0.2 1 Mar 2016 TLS SNI support enabled configure arguments: z1.0.2)r- a2 nginx version: nginx/1.15.5 built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9) built with OpenSSL 1.0.2g 1 Mar 2016 (running with OpenSSL 1.0.2a 1 Mar 2016) TLS SNI support enabled configure arguments: z1.0.2a)r- z� nginx version: nginx/1.15.5 built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9) built with LibreSSL 2.2.2 TLS SNI support enabled configure arguments: r- )r- z� nginx version: nginx/1.15.5 built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9) TLS SNI support enabled configure arguments: )r3 r r( r Z_get_openssl_versionr� r r r �test_get_openssl_version� s z.NginxConfiguratorTest.test_get_openssl_versionc C s" |� }d|j _d|_| j�� d S )N�r- r- r )r3 r � returncoder �restart�r r7 Zmockedr r r �test_nginx_restart� s z(NginxConfiguratorTest.test_nginx_restartc C s* |� }d|j _d|_| �tj| jj� d S )Nr� r$ )r3 r r� r r r� r r� r� r r r �test_nginx_restart_fail� s z-NginxConfiguratorTest.test_nginx_restart_failc C s t d�|_| �tj| jj� d S )Nr� )r� r� r r r� r r� r� r r r �test_no_nginx_start� s z)NginxConfiguratorTest.test_no_nginx_startzcertbot.util.run_scriptc C s t j|_| �t j| jj� d S r )r ZSubprocessErrorr� r r� r r6 )r Zmock_run_scriptr r r � test_config_test_bad_process� s z2NginxConfiguratorTest.test_config_test_bad_processc C s | j �� d S r )r r6 )r �_r r r �test_config_test� s z&NginxConfiguratorTest.test_config_testz*certbot.reverter.Reverter.recovery_routinec C s" t �d�|_| �t j| jj� d S �NZfoo)r � ReverterErrorr� r rB r �recovery_routine)r Zmock_recovery_routiner r r �0test_recovery_routine_throws_error_from_reverter� s zFNginxConfiguratorTest.test_recovery_routine_throws_error_from_reverterz.certbot.reverter.Reverter.rollback_checkpointsc C s" t �d�|_| �t j| jj� d S r� )r r� r� r rB r �rollback_checkpoints)r Zmock_rollback_checkpointsr r r �4test_rollback_checkpoints_throws_error_from_reverter� s zJNginxConfiguratorTest.test_rollback_checkpoints_throws_error_from_reverterz1certbot.reverter.Reverter.revert_temporary_configc C s" t �d�|_| �t j| jj� d S r� )r r� r� r rB r �revert_challenge_config)r Z mock_revert_temporary_configr r r �7test_revert_challenge_config_throws_error_from_reverter� s zMNginxConfiguratorTest.test_revert_challenge_config_throws_error_from_reverterz+certbot.reverter.Reverter.add_to_checkpointc C s" t �d�|_| �t j| jj� d S r� )r r� r� r rB r rh )r Zmock_add_to_checkpointr r r �$test_save_throws_error_from_reverter� s z:NginxConfiguratorTest.test_save_throws_error_from_reverterc C s� | j �� \}}| �tj�|�� | �tj�|�� t|�� }tj� tjj |� � � W 5 Q R X t|�� }tj� tjj |� � � W 5 Q R X d S r ) r Z_get_snakeoil_pathsrD r r� �exists�open�OpenSSLZcryptoZload_certificateZ FILETYPE_PEM�readZload_privatekey)r Zcertr� Z cert_fileZkey_filer r r �test_get_snakeoil_paths� s � �z-NginxConfiguratorTest.test_get_snakeoil_pathsc C s� t td��d }| jj�d�}| j�dd� | jjj| }| �t� ||d�� | jj�d�}| j�dd� t td��d }| jjj| }| �t� ||d�� d S )Nry r rY rO r& r� rH ) r r r r rf rU r+ rD r r� )r r� rr �generated_confr� r r r �test_redirect_enhance s z+NginxConfiguratorTest.test_redirect_enhancec C s� | j j�d�}| j �ddddd� | j �dd� | j jj| }| �d gd d gd d gg d ddgddgddgddgddgddgd| j jgddgd| j jgddgg g ggd gddddgddd gggddgg d d gd d gd d gd d gdd gddgg g g g gg|� d S ) NrY � example.orgr� r� r� r� ry rO ra rd rZ r[ r\ r^ r_ re � managed by Certbotr� r� r� r� �ifz($host�=zwww.example.com)�returnZ301zhttps://$host$request_urirb rc Z404� r r rf r� rU r+ r( r� r� �r rr r� r r r �test_split_for_redirect s^ � � � ���z-NginxConfiguratorTest.test_split_for_redirectc C s� | j j�d�}| j �ddddd� | j �ddd � | j jj| }| �d gd d gd d gg dddgddgddgddgddgddgd| j jgddgd| j jgddgg g dd ddgddgg g ggd gddgddgd d gd d gg g g ggg|� d S ) NrY r� r� r� r� r� ry rP �Strict-Transport-Securityra rd rZ r[ r\ r^ r_ re r� r� r� r� r� � add_header�"max-age=31536000"�alwaysrb rc r� r� r r r �test_split_for_headers; sX � � ���z,NginxConfiguratorTest.test_split_for_headersc C sP | j j�d�}| j �ddd� ddddg}| j jj| }| �t�||d�� d S ) NrY ry rP r� r� r� r� r& �r r rf rU r+ rD r r� )r rr r� r� r r r �test_http_header_hstsZ s � z+NginxConfiguratorTest.test_http_header_hstsc C sP | j j�d�}| j �ddd� ddddg}| j jj| }| �t�||d�� d S ) Nzsites-enabled/headers.comrL rP r� r� r� r� r& r� )r Z headers_confr� r� r r r �test_multiple_headers_hstsb s � z0NginxConfiguratorTest.test_multiple_headers_hstsc C s, | j �ddd� | �tj| j jddd� d S )Nry rP r� )r rU r r Z PluginEnhancementAlreadyPresentr r r r �test_http_header_hsts_twicej s � �z1NginxConfiguratorTest.test_http_header_hsts_twicez+certbot_nginx.obj.VirtualHost.contains_listc C sF d|_ t�d��,}| j�dd� | �|jjd d d� W 5 Q R X d S )NT�!certbot_nginx.configurator.loggerry rO r z3Traffic on port %s already redirecting to ssl in %s)r r4 �patchr rU r( �info� call_args)r Zmock_contains_list� mock_loggerr r r � test_certbot_redirect_existss s �z2NginxConfiguratorTest.test_certbot_redirect_existsc C s@ t �d��}| j�dd� W 5 Q R X | �|jjd d d� d S )Nr� rJ rO r z>No matching insecure server blocks listening on port %s found.)r4 r� r rU r( r� r� )r r� r r r �test_redirect_dont_enhance~ s �z0NginxConfiguratorTest.test_redirect_dont_enhancec C s� | j j�d�}| j �dd� | j �dd� ttd��d }ttd��d }| j jj| }| �t� ||d�� | �t� ||d�� d S )NrY rq rO r� r r& ) r r rf rU r r r+ rD r r� )r rr Z expected1Z expected2r� r r r �test_double_redirect� s z*NginxConfiguratorTest.test_double_redirectc C s$ d| j _| �tj| j jddd� d S )Nr� ry rQ � chain_path)r r) r r rB rU r r r r � test_staple_ocsp_bad_version� s �z2NginxConfiguratorTest.test_staple_ocsp_bad_versionc C s | � tj| jjddd � d S )Nry rQ rT r r r r � test_staple_ocsp_no_chain_path� s �z4NginxConfiguratorTest.test_staple_ocsp_no_chain_pathc C s, | j �ddd� | �tj| j jddd� d S )Nry rQ r� Zdifferent_path)r rU r r rB r r r r � test_staple_ocsp_internal_error� s �z5NginxConfiguratorTest.test_staple_ocsp_internal_errorc C s| d}| j �dd|� | j j�d�}| j jj| }| �t�|ddgd�� | �t�|ddgd�� | �t�|d dgd�� d S ) Nr� ry rQ rY Zssl_trusted_certificater& Z ssl_staplingZonZssl_stapling_verify)r rU r rf r+ rD r r� )r r� rr r� r r r �test_staple_ocsp� s& � � �z&NginxConfiguratorTest.test_staple_ocspc C st | j j�d�}| j j�d�}| j jj| d d d d d= d| j _| j �ddd d d � | j �� | j j�� t� | j jj| �}| � d gd ddgd ddgddgddgddgdddgggggd gd dgd dgddgddgddgdddgggd ddgd d gd d gd | j j gd | j j gg gg|� | j �d dd d d � | j �� | j j�� t� | j jj| �}| � t�|d d!�� d S )"N�sites-enabled/default�foo.confr& r$ r r� �www.nomatch.comr� r� r� r� ra r\ rS Zdefault_serverZ otherhostrd z"www.example.org"r� r� r� r� r� r� r� r^ r_ r� r� r� r� � nomatch.comr� )r r rf r+ r) r� rh r� r r� r( r� r� rD r� )r � default_confr| Zparsed_default_confr r r � test_deploy_no_match_default_set� sn � ������ ����� z6NginxConfiguratorTest.test_deploy_no_match_default_setc C s( | j j�d�}| j j�d�}| j jj| d d d= | j jj| d d d= d| j _| j �dddd d � | j �� | j j�� t� | j jj| �}| � d gd d dgddgddgddgdgddgggggdddgddgddgggdd d gg gdd d gg gdd d!gg gd"d gd#dgg g|d d d � d S )$Nr r r r$ r� r r� r� r� r� ra r\ z*:80r_ rd r� z/home/ubuntu/sites/foo/r� z/status�typesz image/jpegZjpg�~zcase_sensitive\.php$r� z index.phpz /var/rootz~*zcase_insensitive\.php$r� zexact_match\.php$z^~zignore_regex\.php$r� r� ) r r rf r+ r) r� rh r� r r� r( )r r r| Zparsed_foo_confr r r �1test_deploy_no_match_default_set_multi_level_path� s@ � � �� �zGNginxConfiguratorTest.test_deploy_no_match_default_set_multi_level_pathc C s� | j j�d�}| j j�d�}| j jj| d d d= | j jj| d d d= | j jj| d d d d d= d| j _| �tj| j jddd d d � d S ) Nr r r r$ r& r� r r� r� r� r� ) r r rf r+ r) r r r� r� )r r r| r r r �#test_deploy_no_match_no_default_set s �z9NginxConfiguratorTest.test_deploy_no_match_no_default_setc C s( d| j _| �tj| j jddddd� d S )Nr� r r� r� r� r� )r r) r r r� r� r r r r �+test_deploy_no_match_fail_multiple_defaults s �zANginxConfiguratorTest.test_deploy_no_match_fail_multiple_defaultsc C sT | j j�d�}d| j jj| d d d d d d< d| j _| j �ddd d d � d S ) Nr z*:5001r& r$ r r� r r� r� r� r� )r r rf r+ r) r� )r r| r r r �)test_deploy_no_match_multiple_defaults_ok s & �z?NginxConfiguratorTest.test_deploy_no_match_multiple_defaults_okc C s� | j j�d�}| j j�d�}| j jj| d d d d d= d| j _| j �ddd d d � | j �d dd d d � | j �dd � | j �� | j j�� t t d��d }| j jj| }| � t � ||d�� d S )Nr r r& r$ r r� r r� r� r� r� r rO )r r rf r+ r) r� rU rh r� r r rD r r� )r r r| r� r� r r r �!test_deploy_no_match_add_redirect s0 �� z7NginxConfiguratorTest.test_deploy_no_match_add_redirectzcertbot.reverter.loggerz%certbot_nginx.parser.NginxParser.loadc C s2 | j �� | j �� | j �� | �|jdk� d S )Nr� )r r� r� r� rD r� )r Zmock_parser_loadZunused_mock_loggerr r r �'test_parser_reload_after_config_changes> s z=NginxConfiguratorTest.test_parser_reload_after_config_changesc C s� d}t �|��p}dd� | jj�� D �d }|g|_| jjddd�}| �||jd d k� | � t |�d� | � |d |� W 5 Q R X d S ) N�/certbot_nginx.display_ops.select_vhost_multiplec S s g | ]}d |j kr|�qS �rI �rM r� r r r r� J s �zENginxConfiguratorTest.test_choose_vhosts_wildcard.<locals>.<listcomp>r �*.comT�� prefer_sslr$ � r4 r� r r � get_vhostsr �_choose_vhosts_wildcardrD r� r( r* �r � mock_path�mock_select_vhsr� Zvhsr r r �test_choose_vhosts_wildcardF s ��z1NginxConfiguratorTest.test_choose_vhosts_wildcardc C s� d}t �|��p}dd� | jj�� D �d }|g|_| jjddd�}| �||jd d k� | � t |�d� | � |d |� W 5 Q R X d S ) Nr c S s g | ]}d |j kr|�qS r r r� r r r r� Z s �zNNginxConfiguratorTest.test_choose_vhosts_wildcard_redirect.<locals>.<listcomp>r r Fr r$ r r r r r �$test_choose_vhosts_wildcard_redirectV s ��z:NginxConfiguratorTest.test_choose_vhosts_wildcard_redirectc C s� t �� }dd� | jj�� D �d }|g|_|| j_d}t �|��R}| j�ddddd� | � |j � | � t |j �d� | � ||j d d d � W 5 Q R X d S )Nc S s g | ]}d |j kr|�qS �rJ r r� r r r r� i s �zCNginxConfiguratorTest.test_deploy_cert_wildcard.<locals>.<listcomp>r z9certbot_nginx.configurator.NginxConfigurator._deploy_certr � /tmp/pathr$ )r4 Z MagicMockr r r r r r� r� rD �calledr( r* Zcall_args_list)r Zmock_choose_vhostsr� Zmock_dZmock_depr r r �test_deploy_cert_wildcardf s � � z/NginxConfiguratorTest.test_deploy_cert_wildcardr c C s& g |_ | �tj| jjddddd� d S )Nz *.wild.catr )r r r rB r r� )r � mock_dialogr r r �#test_deploy_cert_wildcard_no_vhostsu s �z9NginxConfiguratorTest.test_deploy_cert_wildcard_no_vhostsc C sH dd� | j j�� D �d }|g| j jd< | j �ddd� | �|j� d S )Nc S s g | ]}d |j kr|�qS r r r� r r r r� � s �zRNginxConfiguratorTest.test_enhance_wildcard_ocsp_after_install.<locals>.<listcomp>r r rQ r� )r r r Z_wildcard_vhostsrU r� r �r r r� r r r �(test_enhance_wildcard_ocsp_after_install~ s �z>NginxConfiguratorTest.test_enhance_wildcard_ocsp_after_installc C sB dd� | j j�� D �d }|g|_| j �ddd� | �|j� d S )Nc S s g | ]}d |j kr|�qS r r r� r r r r� � s �z[NginxConfiguratorTest.test_enhance_wildcard_redirect_or_ocsp_no_install.<locals>.<listcomp>r r rQ r� )r r r r rU rD r r" r r r �1test_enhance_wildcard_redirect_or_ocsp_no_install� s �zGNginxConfiguratorTest.test_enhance_wildcard_redirect_or_ocsp_no_installc C sF dd� | j j�� D �d }|g| j jd< | j �dd� | �|j� d S )Nc S s g | ]}d |j kr|�qS r r r� r r r r� � s �zONginxConfiguratorTest.test_enhance_wildcard_double_redirect.<locals>.<listcomp>r r rO )r r r Z_wildcard_redirect_vhostsrU r� r r" r r r �%test_enhance_wildcard_double_redirect� s �z;NginxConfiguratorTest.test_enhance_wildcard_double_redirectc C sP d}t �|��8}g |_| jjdddd� | �t|jd d �d� W 5 Q R X d S )Nr r Fr� )r Zno_ssl_filter_portr � )r4 r� r r r r( r* r� )r r r r r r �.test_choose_vhosts_wildcard_no_ssl_filter_port� s �zDNginxConfiguratorTest.test_choose_vhosts_wildcard_no_ssl_filter_port)M�__name__� __module__� __qualname__�__doc__r r4 r� r" r, r8 r@ r> rN rR rV rX rk rp rs rv rx rz r} r r� r� ro r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r r! r# r$ r% r' � __classcell__r r r r r s� = 1 = 5! r c s� e Zd ZdZ� fdd�Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd� Zd d � Z� ZS ) �InstallSslOptionsConfTestzLTest that the options-ssl-nginx.conf file is installed and updated properly.c s, t t| ��� t�| j| j| j| j�| _ d S r ) r r- r r r r r r r r r r r r r � s �z InstallSslOptionsConfTest.setUpc C s | j �| j j| j j� d S r )r Zinstall_ssl_options_confr� �updated_mod_ssl_conf_digestr r r r �_call� s �z InstallSslOptionsConfTest._callc C s t �| jj�S r )r � sha256sumr �mod_ssl_conf_srcr r r r �_current_ssl_options_hash� s z3InstallSslOptionsConfTest._current_ssl_options_hashc C s4 | � tj�| jj�� | �t�| jj�| � � � d S r ) rD r r� �isfiler r� r( r r0 r2 r r r r �_assert_current_file� s �z.InstallSslOptionsConfTest._assert_current_filec C s@ | � � t�| jj� | �tj�| jj�� | �� | � � d S r ) r4 r �remover r� r� r� r3 r/ r r r r � test_no_file� s z&InstallSslOptionsConfTest.test_no_filec C s | � � | �� | � � d S r )r4 r/ r r r r �test_current_file� s z+InstallSslOptionsConfTest.test_current_filec s> t �jjd��}|�d� W 5 Q R X tj�� ��fdd�}|S )N�wZbogusc s | �j jkr�| �S � S r )r r1 )�filename�� fake_hashr Zsha256r r �_hash� s zGInstallSslOptionsConfTest._mock_hash_except_ssl_conf_src.<locals>._hash)r� r r� �writer r0 )r r; �fr< r r: r � _mock_hash_except_ssl_conf_src� s z8InstallSslOptionsConfTest._mock_hash_except_ssl_conf_srcc C sD ddl m} tjd| �|d �d�� | �� W 5 Q R X | �� d S )Nr ��ALL_SSL_OPTIONS_HASHES� certbot.crypto_util.sha256sum��new)�certbot_nginx.constantsrA r4 r� r? r/ r4 �r rA r r r �!test_prev_file_updates_to_current� s �z;InstallSslOptionsConfTest.test_prev_file_updates_to_currentc C sL ddl m} d| j_tjd| �|d �d�� | �� W 5 Q R X | �� d S )Nr r@ �r$ r& � rB rC ) rE rA r r) r4 r� r? r/ r4 rF r r r �+test_prev_file_updates_to_current_old_nginx� s �zEInstallSslOptionsConfTest.test_prev_file_updates_to_current_old_nginxc C s� t | jjd��}|�d� W 5 Q R X t�d�� }| �� | �|jj � W 5 Q R X | � t j � | jj�� | �t�| jj�| �� � | �t�| jj�| �� � d S )N�a� a new line for the wrong hash � certbot.plugins.common.logger)r� r r� r= r4 r� r/ r� �warningr rD r r� r3 r( r r0 r1 r2 ZassertNotEqual)r r� r� r r r �3test_manually_modified_current_file_does_not_update� s ��zMInstallSslOptionsConfTest.test_manually_modified_current_file_does_not_updatec C s� t | jjd��}|�d� W 5 Q R X t | jjd��}|�d� W 5 Q R X t�d��&}| �� | �|j j d d d� W 5 Q R X | �t � | jj �| �� � t�d�� }| �� | �|j j� W 5 Q R X d S )NrK rL r8 ZhashofanoldversionrM r zh%s has been manually modified; updated file saved to %s. We recommend updating %s for security purposes.)r� r r� r= r. r4 r� r/ r( rN r� r r0 r1 r2 r� r )r r� r> r� r r r �&test_manually_modified_past_file_warns� s �� z@InstallSslOptionsConfTest.test_manually_modified_past_file_warnsc C s$ ddl m} | �| �� |kd� d S )Nr r@ zvConstants.ALL_SSL_OPTIONS_HASHES must be appended with the sha256 hash of self.config.mod_ssl_conf when it is updated.)rE rA rD r2 rF r r r �$test_current_file_hash_in_all_hashes� s �z>InstallSslOptionsConfTest.test_current_file_hash_in_all_hashesc s^ ddl m} ddl� � fdd�dD �}| �|� |D ]$}t�|�}| �||kd�|�� q4dS )aa It is really critical that all TLS Nginx config files have their SHA256 hash registered in constants.ALL_SSL_OPTIONS_HASHES. Otherwise Certbot will mistakenly assume that the config file has been manually edited by the user, and will refuse to update it. This test ensures that all necessary hashes are present. r r@ Nc s" g | ]}� � d tj�d|���qS )� certbot_nginxZ tls_configs)Zresource_filenamer r� r2 r� �� pkg_resourcesr r r� s �zVInstallSslOptionsConfTest.test_ssl_config_files_hash_in_all_hashes.<locals>.<listcomp>)�options-ssl-nginx.conf�options-ssl-nginx-old.conf�!options-ssl-nginx-tls12-only.confzaConstants.ALL_SSL_OPTIONS_HASHES must be appended with the sha256 hash of {0} when it is updated.)rE rA rT rD r r0 �format)r rA Z all_filesZone_fileZ file_hashr rS r �(test_ssl_config_files_hash_in_all_hashes s � ��zBInstallSslOptionsConfTest.test_ssl_config_files_hash_in_all_hashesc C s� d| j _d| j _| �tj�| j j�d� | �� | � � d| j _d| j _| �tj�| j j�d� | �� | � � d| j _| �tj�| j j�d� | �� | � � d| j _d | j _| �tj�| j j�d � d S ) NrH r� rV )r$ r& r� z1.0.2lrW )r$ � r rU z1.0.2kz+options-ssl-nginx-tls13-session-tix-on.conf) r r) Zopenssl_versionr( r r� �basenamer1 r/ r4 r r r r �&test_nginx_version_uses_correct_config s2 ����z@InstallSslOptionsConfTest.test_nginx_version_uses_correct_config)r( r) r* r+ r r/ r2 r4 r6 r7 r? rG rJ rO rP rQ rY r\ r, r r r r r- � s r- c @ sT e Zd ZdZdd� Zej�ej ddi�dd� �Z ej�ej i �dd � �Z d d � Z d S ) � DetermineDefaultServerRootTestzDTests for certbot_nginx.configurator._determine_default_server_root.c C s ddl m} |� S )Nr )� _determine_default_server_root)�certbot_nginx.configuratorr^ )r r^ r r r r/ 4 s z$DetermineDefaultServerRootTest._callZ CERTBOT_DOCS�1c C s | j dd� d S )NT��expect_both_values��_testr r r r �test_docs_value8 s z.DetermineDefaultServerRootTest.test_docs_valuec C s | j dd� d S )NFra rc r r r r �test_real_values< s z/DetermineDefaultServerRootTest.test_real_valuesc C s@ | � � }|r&| �d|� | �d|� n| �|dkp8|dk� d S )Nz/usr/local/etc/nginxz /etc/nginx)r/ ZassertInrD )r rb r? r r r rd @ s z$DetermineDefaultServerRootTest._testN) r( r) r* r+ r/ r4 r� �dictr �environre rf rd r r r r r] 1 s r] �__main__) r+ Zunittestr� r4 Zacmer r r; r r r Zcertbot.compatr Z certbot.testsr r= rR r r r_ r Zcertbot_nginx.nginxparserr Zcertbot_nginx.testsZ NginxTestr r- ZConfigTestCaser] r( �mainr r r r �<module> s8
Save File
Cancel