JFIF $
d d 7
Viewing File: /usr/lib/python3.9/site-packages/certbot/_internal/tests/__pycache__/ocsp_test.cpython-39.pyc
a
}|�g}H � @ sN d Z ddlZddlmZ ddlmZ ddlZddlZddlmZ ddlZddlm Z ddl
m Z ddl
m Z dd l
mZ dd
lmZ dd lmZ dd lmZ ddlZddlZdd
lmZ ddlmZ dZ G dd� dej �Z G dd� dej �Z ej!d"dd��Z"dd� Z#dZ$dZ%dZ&d Z'd Z(d Z)d Z*e+d k�rJe�,e�-ej.d!d� e/g �� dS )#zTests for ocsp.py� N)�datetime)� timedelta)�mock)�x509)�InvalidSignature)�UnsupportedAlgorithm)�default_backend)�hashes)� CryptographyDeprecationWarning��ocsp)�errors)�utilz;Missing = in header key=value
ocsp: Use -help for summary.
c @ s� e Zd ZdZdd� Ze�d�e�d�e�d�dd� ���Ze�d �e�d
�e�d �d d
� ���Zdd� Z e�d�e�d �dd� ��Z
dS )�OCSPTestOpenSSLz5
OCSP revocation tests using OpenSSL binary.
c C s~ ddl m} t�d��T}t�d��*}t|_d|_|jdd�| _W d � n1 sR0 Y W d � n1 sp0 Y d S )Nr r �certbot.ocsp.subprocess.run�certbot.util.exe_existsT�Z enforce_openssl_binary_usage) �certbotr r �patch�out�stderr� return_value�RevocationChecker�checker)�selfr �mock_run� mock_exists� r �E/usr/lib/python3.9/site-packages/certbot/_internal/tests/ocsp_test.py�setUp" s zOCSPTestOpenSSL.setUpzcertbot.ocsp.logger.infor r c C s� t |j_d|_ddlm} |jdd�}|jdks4J �|�d�dgksHJ �t �d�d |j_|jdd�}|�d�d
dgks|J �|j d u s�J �d |_d|_|jdd�}|jdks�J �|jdks�J �|j du s�J �d S ) NTr r r � �xzHost=x�
� ZHostF)
r r r r r r �
call_countZ host_args� partition�broken)r r r �mock_logr r r r r � test_init* s zOCSPTestOpenSSL.test_init�#certbot.ocsp._determine_ocsp_server�!certbot.ocsp.crypto_util.notAfterzcertbot.util.run_scriptc C s t �tj�}t�� }d|_d|_|tdd� |_ d| j
_ d|_ | j
� |�du sRJ �d| j
_ t
tdd � �|_ | j
� |�du s�J �|jd ks�J �d
|_ | j
� |�du s�J �t�d �|_| j
� |�du s�J �|jdks�J �||_ d|_ |j}| j
� |�du s�J �|j|k�s J �d S ) Nr! �yr# �ZhoursT)� r- Fr r )z http://x.cozx.coz#Unable to load certificate launcher)r �now�pytz�UTCr � MagicMock� cert_path�
chain_pathr r r r& � ocsp_revoked�tuple�
openssl_happyr$ r
ZSubprocessError� side_effect)r r Zmock_na�mock_determiner. �cert_objZ count_beforer r r �test_ocsp_revokedB s, z!OCSPTestOpenSSL.test_ocsp_revokedc C s0 t �d�}ddlm} |�|�}d|ks,J �d S )N�ocsp_certificate.pemr r )z http://ocsp.test4.buypass.comzocsp.test4.buypass.com)� test_util� vector_pathr r Z_determine_ocsp_server)r r2 r �resultr r r �test_determine_ocsp_serverb s
z*OCSPTestOpenSSL.test_determine_ocsp_serverzcertbot.ocsp.loggerc C s( t |_ddlm} |jt� du s$J �|jt � du s6J �|jjdksFJ �|jjdksVJ �d|j_|jt � du spJ �|jjdks�J �|jjdks�J �|jt
� du s�J �|jjdks�J �|jt � du s�J �|jjdks�J �d|j _|jt
� du s�J �|j jdks�J �|jt� du �sJ �|j jdk�s$J �d S )Nr r Fr r# T)�openssl_confusedr r r Z_translate_ocsp_queryr6 �debugr$ Zwarning�openssl_unknown�openssl_expired_ocsp�openssl_broken�info�openssl_revoked� openssl_expired_ocsp_revoked)r r r' r r r r �test_translate_ocspi s& z#OCSPTestOpenSSL.test_translate_ocspN) �__name__�
__module__� __qualname__�__doc__r r r r( r: r? rH r r r r r s r c @ s\ e Zd ZdZdd� Ze�d�e�d�dd� ��Zdd � Zd
d � Z d d
� Z
dd� Z dd� Z dS )�OSCPTestCryptographyz;
OCSP revokation tests using Cryptography >= 2.4.0
c C s� ddl m} |�� | _t�d�| _t�d�| _t� � | _
| j| j
_| j| j
_t � t
j�}tjd|tdd� d�| _| j�� | �| jj� d S ) Nr r r; �ocsp_issuer_certificate.pemr* r# r, )r )r r r r r< r= r2 r3 r r1 r9 r r. r/ r0 r r Z
mock_notAfter�startZ
addCleanup�stop)r r r. r r r r � s
�
zOSCPTestCryptography.setUpr) z%certbot.ocsp._check_ocsp_cryptographyc C s, d|_ | j�| j� |�| j| jdd� d S )N)�http://example.com� example.comrQ �
)r r r4 r9 Zassert_called_once_withr2 r3 )r �
mock_checkr8 r r r � test_ensure_cryptography_toggled� s z5OSCPTestCryptography.test_ensure_cryptography_toggledc C sL t tjjtjj�� | j�| j�}W d � n1 s60 Y |sHJ �d S )N) �
_ocsp_mock�ocsp_lib�OCSPCertStatus�REVOKED�OCSPResponseStatus�
SUCCESSFULr r4 r9 )r �revokedr r r � test_revoke� s ,z OSCPTestCryptography.test_revokec C s t �t�d�t� �}ttjjtj j
��p}|j |d j _
d |d j _| j�| j� t j�|�� �j}d |d j _
||d j _| j�| j� W d � n1 s�0 Y |d jdks�J �|d jd d d �� |�� �� ks�J �|d jd d d �� |�� �� k�sJ �d S )NrN �
mock_responserT r# r r �r �load_pem_x509_certificater< � load_vectorr rV rW rX rY rZ r[ �subjectr �responder_nameZresponder_key_hashr r4 r9 ZSubjectKeyIdentifierZfrom_public_keyZ
public_keyZdigestr$ Zcall_args_listZpublic_numbers)r �issuer�mocks�key_hashr r r �test_responder_is_issuer� s* �� ,
�
�z-OSCPTestCryptography.test_responder_is_issuerc C s~ t �t�d�t� �}t �t�d�t� �}ttjjtj j
��p}|j |d j _
d |d j _| j�| j� t j�|�� �j}d |d j _
||d j _| j�| j� W d � n1 s�0 Y |d jdks�J �|d jd d d �� |�� �� ks�J �|d jd d d �� |�� �� k�s"J �|d jd d d �� |�� �� k�sNJ �|d jd d d �� |�� �� k�szJ �d S )
NrN � ocsp_responder_certificate.pemr^ rT � r r r# � r_ )r rd � responderre rf r r r �%test_responder_is_authorized_delegate� s< � �� ,
�
�
�
�z:OSCPTestCryptography.test_responder_is_authorized_delegatec
C s t tjjtjjdd�� | j�| j�}W d � n1 s:0 Y |du sPJ �t tjjtjj �� | j�| j�}W d � n1 s�0 Y |du s�J �t tjjtjj�� | j�| j�}W d � n1 s�0 Y |du s�J �t tjj
tjj��Z t j dt
�dt
jj�d�� | j�| j�}W d � n1 �s<0 Y W d � n1 �s\0 Y |du �stJ �t tjj
tjjtd�d�� | j�| j�}W d � n1 �s�0 Y |du �s�J �t tjj
tjjtd�d�� | j�| j�}W d � n1 �s 0 Y |du �s$J �t tjj
tjjtd�d�� | j�| j�}W d � n1 �sd0 Y |du �s|J �t tjj
tjj��*}g |d j_| j�| j�}W d � n1 �s�0 Y |du �s�J �t tjj
tjj��J}|d jjd
}t jd |jd �|d jjd
< | j�| j�}W d � n1 �s<0 Y |du �sTJ �t tjj
tjj��� t � d
��`}d|_t j dt
�dt
jj�d�� | j�| j�}W d � n1 �s�0 Y W d � n1 �s�0 Y W d � n1 �s�0 Y |du �sJ �d S )Ni� )�http_status_codeFz4cryptography.x509.Extensions.get_extension_for_classz Not found�r7 Zfoo)�check_signature_side_effectr^ r Zfake)rd rb r) )zhttps://example.comrR )rV rW rX ZUNKNOWNrZ r[ r r4 r9 Z UNAUTHORIZEDrY r r r ZExtensionNotFoundZ AuthorityInformationAccessOIDZOCSPr r �AssertionErrorr � certificates�Mockrb )r r\ re �certZ mock_serverr r r �test_revoke_resiliency� sz �, , , ��N�.�.�.� .��. ��nz+OSCPTestCryptography.test_revoke_resiliencyc s� t tjjtjj��R}|d jj� � fdd�}tj |d�}|t
|d j�_| j � | j
�}W d � n1 sj0 Y |du s�J �d S )Nr^ c s d} t �| t� � S )Nug Properties that return a naïve datetime object have been deprecated. Please switch to this_update_utc.)�warnings�warnr
)�msg��valuer r �
warn_first& s zAOSCPTestCryptography.test_this_update_warning.<locals>.warn_firstrn F)rV rW rX ZGOODrZ r[ r � this_updater Z PropertyMock�typer r4 r9 )r re rz Z
property_mockr\ r rx r �test_this_update_warning! s � ,z-OSCPTestCryptography.test_this_update_warningN)
rI rJ rK rL r r r rU r] rg rl rt r} r r r r rM � s GrM �� c
c s� t �d���}t| |�|_t �d��`}t j|d�|_t �d��(}|rH||_|||d�V W d � n1 sj0 Y W d � n1 s�0 Y W d � n1 s�0 Y d S )Nz(certbot.ocsp.ocsp.load_der_ocsp_responsezcertbot.ocsp.requests.post)Z status_codez.certbot.ocsp.crypto_util.verify_signed_payload)r^ � mock_postrT )r r � _construct_mock_ocsp_responser rr r7 )�certificate_status�response_statusrm ro r^ r rT r r r rV 5 s �
�rV c C s� t �t�d�t� �}t �t�d�t� �}t �t�d�t� �}t�� }|�||t� � �}|�
� }t j || |j
|j|j|j|gt� � t�tj�jd d�tdd� t�tj�jd d�tdd� t jjjd� S )Nr; rN rh )Ztzinfor )Zdays) r� r� �
serial_number�issuer_key_hash�issuer_name_hashrc rq Zhash_algorithmZ next_updater{ Zsignature_algorithm_oid)r r` r< ra r rW ZOCSPRequestBuilderZadd_certificater ZSHA1Zbuildr rr r� r� r� rb r r. r/ r0 �replacer ZoidZSignatureAlgorithmOIDZ
RSA_WITH_SHA1)r� r� rs rd rk ZbuilderZrequestr r r r� H s2 � � � �r� )r- z�
/etc/letsencrypt/live/example.org/cert.pem: good
This Update: Dec 17 00:00:00 2016 GMT
Next Update: Dec 24 00:00:00 2016 GMT
z�
Response Verify Failure
139903674214048:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:138:Verify error:unable to get local issuer certificate
)�blah.pemz^
blah.pem: good
This Update: Dec 20 18:00:00 2016 GMT
Next Update: Dec 27 18:00:00 2016 GMT
�Response verify OK)r� z�
blah.pem: revoked
This Update: Dec 20 01:00:00 2016 GMT
Next Update: Dec 27 01:00:00 2016 GMT
Revocation Time: Dec 20 01:46:34 2016 GMT
r� )r� za
blah.pem: unknown
This Update: Dec 20 18:00:00 2016 GMT
Next Update: Dec 27 18:00:00 2016 GMT
r� )r- Z tentaclesr� )r� z�
blah.pem: WARNING: Status times invalid.
140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372:
good
This Update: Apr 6 00:00:00 2016 GMT
Next Update: Apr 13 00:00:00 2016 GMT
r� )r� z�
blah.pem: WARNING: Status times invalid.
140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372:
revoked
This Update: Apr 6 00:00:00 2016 GMT
Next Update: Apr 13 00:00:00 2016 GMT
r� �__main__r )r~ N)0rL �
contextlibr r �sysZunittestr ru Z cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr Zcryptography.utilsr
Zcryptography.x509r rW Zpytestr/ r r
Z
certbot.testsr r< r ZTestCaser rM �contextmanagerrV r� r@ r6 rF rB rD rC rG rI �exit�main�argv�__file__r r r r �<module> sF e 4 �
Back to Directory
nL+D550H?Mx ,D"v]qv;6*Zqn)ZP 0 !1 A "#a$2Qr D8 a Ri[f\mIykIw0 cuFcRı?lO7к_f˓[C$殷WF<_W ԣs KcëIzyQy /_LKℂ;C",pFA: /]=H ~,ls/9ć:[=/#f;)x {ٛEQ )~ =𘙲r*2~ a _V=' kumF D}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq 1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo( 3=M(zȰ+i*NA r6KnSl )!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\ ͔]ޒ SJȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtf h9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N +0e2]] 9VTPO7h(F*癈 '=QVZDF,d߬~TX
G[`le69CR(!S2!P
<0x < !1AQ "Raq02Br#SCTb
?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ
τVYTD I62'8Y2 7'\TP.6d&˦@Vqi|8- OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL
u"TÙM=6 (^"7r} =6YݾlCuhquympǦ
G jhsǜNlɻ}o7 #S6aw4!OSrD57%|?x>L
|/nD6?/8w#[)L7+6〼T ATg ! %5MmZ/c-{1_Je"|^$'O&ޱմ Trb$ w)R$&
N1EtdU3Uȉ1pM" N*(DN yd96.(jQ)X
5cQɎMyW? Q*!R>6=7)Xj5`J]e 8%t!+'!1Q 5 !1 AQaqё#2"0BRb ? Gt^## .llQT $v,,m 㵜5 ubV =sY+@d{N! dnO< .-B; _wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc. WDtA$j@:) -# u
c1<@ۗ9F)KJ-hpP]_x[qBlbp ʖw q"LFGd ƶ*s+ډ_Zc"? %t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi` ]uJVoV DG< SB 6ϏQ@ TiUly OU0kfV~~}SZ@*WUUi##; s/[ =!7}" WN]'(L! ~y5g9T̅JkbM' +s:S + B)v@Mj
e Cf jE 0Y\QnzG1д~Wo{T 9?`Rmyhsy3!HAD]mc1~2L Su7xT;j$`}4->L#vzŏ ILS ֭ T { rjGKC; bpU= -`BsK.SFw4Mq]ZdHS0)tLg