JFIF $
d d 7
Viewing File: /usr/lib/python3.9/site-packages/certbot/_internal/tests/__pycache__/ocsp_test.cpython-39.opt-1.pyc
a
}|�g}H � @ sN d Z ddlZddlmZ ddlmZ ddlZddlZddlmZ ddlZddlm Z ddl
m Z ddl
m Z dd l
mZ dd
lmZ dd lmZ dd lmZ ddlZddlZdd
lmZ ddlmZ dZ G dd� dej �Z G dd� dej �Z ej!d"dd��Z"dd� Z#dZ$dZ%dZ&d Z'd Z(d Z)d Z*e+d k�rJe�,e�-ej.d!d� e/g �� dS )#zTests for ocsp.py� N)�datetime)� timedelta)�mock)�x509)�InvalidSignature)�UnsupportedAlgorithm)�default_backend)�hashes)� CryptographyDeprecationWarning��ocsp)�errors)�utilz;Missing = in header key=value
ocsp: Use -help for summary.
c @ s� e Zd ZdZdd� Ze�d�e�d�e�d�dd� ���Ze�d �e�d
�e�d �d d
� ���Zdd� Z e�d�e�d �dd� ��Z
dS )�OCSPTestOpenSSLz5
OCSP revocation tests using OpenSSL binary.
c C s~ ddl m} t�d��T}t�d��*}t|_d|_|jdd�| _W d � n1 sR0 Y W d � n1 sp0 Y d S )Nr r �certbot.ocsp.subprocess.run�certbot.util.exe_existsT�Z enforce_openssl_binary_usage) �certbotr r �patch�out�stderr� return_value�RevocationChecker�checker)�selfr �mock_run� mock_exists� r �E/usr/lib/python3.9/site-packages/certbot/_internal/tests/ocsp_test.py�setUp" s zOCSPTestOpenSSL.setUpzcertbot.ocsp.logger.infor r c C s` t |j_d|_ddlm} |jdd�}t �d�d |j_|jdd�}d|_d|_|jdd�}d S )NTr r r �
� F)r r r r r r � partition�
call_count)r r r �mock_logr r r r r � test_init* s zOCSPTestOpenSSL.test_init�#certbot.ocsp._determine_ocsp_server�!certbot.ocsp.crypto_util.notAfterzcertbot.util.run_scriptc C s� t �tj�}t�� }d|_d|_|tdd� |_ d| j
_ d|_ d| j
_ t t
dd � �|_ d |_ t�d
�|_||_ d|_ |j}d S ) N�x�yr! �ZhoursT)� r+ F� )z http://x.cozx.coz#Unable to load certificate launcher)r �now�pytz�UTCr � MagicMock� cert_path�
chain_pathr r r �broken�tuple�
openssl_happyr
ZSubprocessError� side_effectr# )r r Zmock_na�mock_determiner- �cert_objZ count_beforer r r �test_ocsp_revokedB s z!OCSPTestOpenSSL.test_ocsp_revokedc C s$ t �d�}ddlm} |�|�}d S )N�ocsp_certificate.pemr r )� test_util� vector_pathr r Z_determine_ocsp_server)r r1 r �resultr r r �test_determine_ocsp_serverb s
z*OCSPTestOpenSSL.test_determine_ocsp_serverzcertbot.ocsp.loggerc C s& t |_ddlm} d|j_d|j_d S )Nr r )�openssl_confusedr r r �debugr# �info)r r r$ r r r r �test_translate_ocspi s
z#OCSPTestOpenSSL.test_translate_ocspN) �__name__�
__module__� __qualname__�__doc__r r r r% r9 r> rB r r r r r s r c @ s\ e Zd ZdZdd� Ze�d�e�d�dd� ��Zdd � Zd
d � Z d d
� Z
dd� Z dd� Z dS )�OSCPTestCryptographyz;
OCSP revokation tests using Cryptography >= 2.4.0
c C s� ddl m} |�� | _t�d�| _t�d�| _t� � | _
| j| j
_| j| j
_t � t
j�}tjd|tdd� d�| _| j�� | �| jj� d S ) Nr r r: �ocsp_issuer_certificate.pemr' r! r* )r )r r r r r; r< r1 r2 r r0 r8 r r- r. r/ r r Z
mock_notAfter�startZ
addCleanup�stop)r r r- r r r r � s
�
zOSCPTestCryptography.setUpr& z%certbot.ocsp._check_ocsp_cryptographyc C s, d|_ | j�| j� |�| j| jdd� d S )N)�http://example.com� example.comrK �
)r r � ocsp_revokedr8 Zassert_called_once_withr1 r2 )r �
mock_checkr7 r r r � test_ensure_cryptography_toggled� s z5OSCPTestCryptography.test_ensure_cryptography_toggledc C sD t tjjtjj�� | j�| j�}W d � n1 s60 Y d S )N) �
_ocsp_mock�ocsp_lib�OCSPCertStatus�REVOKED�OCSPResponseStatus�
SUCCESSFULr rN r8 )r �revokedr r r � test_revoke� s ,z OSCPTestCryptography.test_revokec C s� t �t�d�t� �}ttjjtj j
��p}|j |d j _
d |d j _| j�| j� t j�|�� �j}d |d j _
||d j _| j�| j� W d � n1 s�0 Y d S )NrH �
mock_response�r �load_pem_x509_certificater; � load_vectorr rQ rR rS rT rU rV �subjectr �responder_nameZresponder_key_hashr rN r8 ZSubjectKeyIdentifierZfrom_public_keyZ
public_keyZdigest)r �issuer�mocks�key_hashr r r �test_responder_is_issuer� s �� ,z-OSCPTestCryptography.test_responder_is_issuerc C s� t �t�d�t� �}t �t�d�t� �}ttjjtj j
��p}|j |d j _
d |d j _| j�| j� t j�|�� �j}d |d j _
||d j _| j�| j� W d � n1 s�0 Y d S )NrH � ocsp_responder_certificate.pemrY rZ )r r_ � responderr` ra r r r �%test_responder_is_authorized_delegate� s$ � �� , z:OSCPTestCryptography.test_responder_is_authorized_delegatec
C s� t tjjtjjdd�� | j�| j�}W d � n1 s:0 Y t tjjtjj �� | j�| j�}W d � n1 sz0 Y t tjjtjj�� | j�| j�}W d � n1 s�0 Y t tjj
tjj��Z t j dt
�dt
jj�d�� | j�| j�}W d � n1 �s0 Y W d � n1 �s80 Y t tjj
tjjtd�d�� | j�| j�}W d � n1 �s�0 Y t tjj
tjjtd�d�� | j�| j�}W d � n1 �s�0 Y t tjj
tjjtd�d�� | j�| j�}W d � n1 �s0 Y t tjj
tjj��*}g |d j_| j�| j�}W d � n1 �sd0 Y t tjj
tjj��J}|d jjd }t jd
|jd �|d jjd < | j�| j�}W d � n1 �s�0 Y t tjj
tjj��� t � d ��`}d
|_t j dt
�dt
jj�d�� | j�| j�}W d � n1 �sB0 Y W d � n1 �sb0 Y W d � n1 �s�0 Y d S )Ni� )�http_status_codez4cryptography.x509.Extensions.get_extension_for_classz Not found�r6 Zfoo)�check_signature_side_effectrY r Zfake)r_ r] r& )zhttps://example.comrL )rQ rR rS ZUNKNOWNrU rV r rN r8 Z UNAUTHORIZEDrT r r r ZExtensionNotFoundZ AuthorityInformationAccessOIDZOCSPr r �AssertionErrorr � certificates�Mockr] )r rW r` �certZ mock_serverr r r �test_revoke_resiliency� sh �,,,��N�.�.�.� .��. ��nz+OSCPTestCryptography.test_revoke_resiliencyc sx t tjjtjj��R}|d jj� � fdd�}tj |d�}|t
|d j�_| j � | j
�}W d � n1 sj0 Y d S )NrY c s d} t �| t� � S )Nug Properties that return a naïve datetime object have been deprecated. Please switch to this_update_utc.)�warnings�warnr
)�msg��valuer r �
warn_first& s zAOSCPTestCryptography.test_this_update_warning.<locals>.warn_firstrg )rQ rR rS ZGOODrU rV r � this_updater Z PropertyMock�typer rN r8 )r r` rs Z
property_mockrW r rq r �test_this_update_warning! s � ,z-OSCPTestCryptography.test_this_update_warningN)
rC rD rE rF r r r rP rX rb re rm rv r r r r rG � s GrG �� c
c s� t �d���}t| |�|_t �d��`}t j|d�|_t �d��(}|rH||_|||d�V W d � n1 sj0 Y W d � n1 s�0 Y W d � n1 s�0 Y d S )Nz(certbot.ocsp.ocsp.load_der_ocsp_responsezcertbot.ocsp.requests.post)Z status_codez.certbot.ocsp.crypto_util.verify_signed_payload)rY � mock_postrO )r r � _construct_mock_ocsp_responser rk r6 )�certificate_status�response_statusrf rh rY rx rO r r r rQ 5 s �
�rQ c C s� t �t�d�t� �}t �t�d�t� �}t �t�d�t� �}t�� }|�||t� � �}|�
� }t j || |j
|j|j|j|gt� � t�tj�jd d�tdd� t�tj�jd d�tdd� t jjjd� S )Nr: rH rc )Ztzinfor, )Zdays) r{ rz �
serial_number�issuer_key_hash�issuer_name_hashr^ rj Zhash_algorithmZ next_updatert Zsignature_algorithm_oid)r r[ r; r\ r rR ZOCSPRequestBuilderZadd_certificater ZSHA1Zbuildr rk r| r} r~ r] r r- r. r/ �replacer ZoidZSignatureAlgorithmOIDZ
RSA_WITH_SHA1)rz r{ rl r_ rd ZbuilderZrequestr r r ry H s2 � � � �ry )r+ z�
/etc/letsencrypt/live/example.org/cert.pem: good
This Update: Dec 17 00:00:00 2016 GMT
Next Update: Dec 24 00:00:00 2016 GMT
z�
Response Verify Failure
139903674214048:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:138:Verify error:unable to get local issuer certificate
)�blah.pemz^
blah.pem: good
This Update: Dec 20 18:00:00 2016 GMT
Next Update: Dec 27 18:00:00 2016 GMT
�Response verify OK)r� z�
blah.pem: revoked
This Update: Dec 20 01:00:00 2016 GMT
Next Update: Dec 27 01:00:00 2016 GMT
Revocation Time: Dec 20 01:46:34 2016 GMT
r� )r� za
blah.pem: unknown
This Update: Dec 20 18:00:00 2016 GMT
Next Update: Dec 27 18:00:00 2016 GMT
r� )r+ Z tentaclesr� )r� z�
blah.pem: WARNING: Status times invalid.
140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372:
good
This Update: Apr 6 00:00:00 2016 GMT
Next Update: Apr 13 00:00:00 2016 GMT
r� )r� z�
blah.pem: WARNING: Status times invalid.
140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372:
revoked
This Update: Apr 6 00:00:00 2016 GMT
Next Update: Apr 13 00:00:00 2016 GMT
r� �__main__r, )rw N)0rF �
contextlibr r �sysZunittestr rn Z cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr Zcryptography.utilsr
Zcryptography.x509r rR Zpytestr. r r
Z
certbot.testsr r; r ZTestCaser rG �contextmanagerrQ ry r? r5 Zopenssl_revokedZopenssl_unknownZopenssl_brokenZopenssl_expired_ocspZ openssl_expired_ocsp_revokedrC �exit�main�argv�__file__r r r r �<module> sF e 4 �
Back to Directory
nL+D550H?Mx ,D"v]qv;6*Zqn)ZP 0 !1 A "#a$2Qr D8 a Ri[f\mIykIw0 cuFcRı?lO7к_f˓[C$殷WF<_W ԣs KcëIzyQy /_LKℂ;C",pFA: /]=H ~,ls/9ć:[=/#f;)x {ٛEQ )~ =𘙲r*2~ a _V=' kumF D}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq 1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo( 3=M(zȰ+i*NA r6KnSl )!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\ ͔]ޒ SJȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtf h9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N +0e2]] 9VTPO7h(F*癈 '=QVZDF,d߬~TX
G[`le69CR(!S2!P
<0x < !1AQ "Raq02Br#SCTb
?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ
τVYTD I62'8Y2 7'\TP.6d&˦@Vqi|8- OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL
u"TÙM=6 (^"7r} =6YݾlCuhquympǦ
G jhsǜNlɻ}o7 #S6aw4!OSrD57%|?x>L
|/nD6?/8w#[)L7+6〼T ATg ! %5MmZ/c-{1_Je"|^$'O&ޱմ Trb$ w)R$&
N1EtdU3Uȉ1pM" N*(DN yd96.(jQ)X
5cQɎMyW? Q*!R>6=7)Xj5`J]e 8%t!+'!1Q 5 !1 AQaqё#2"0BRb ? Gt^## .llQT $v,,m 㵜5 ubV =sY+@d{N! dnO< .-B; _wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc. WDtA$j@:) -# u
c1<@ۗ9F)KJ-hpP]_x[qBlbp ʖw q"LFGd ƶ*s+ډ_Zc"? %t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi` ]uJVoV DG< SB 6ϏQ@ TiUly OU0kfV~~}SZ@*WUUi##; s/[ =!7}" WN]'(L! ~y5g9T̅JkbM' +s:S + B)v@Mj
e Cf jE 0Y\QnzG1д~Wo{T 9?`Rmyhsy3!HAD]mc1~2L Su7xT;j$`}4->L#vzŏ ILS ֭ T { rjGKC; bpU= -`BsK.SFw4Mq]ZdHS0)tLg