a oeD@s:dZddlZddlmZddlmZddlZddlZddlmZddlmZddl m Z ddl m Z dd l m Z dd lmZdd lmZddlZddlZdd lmZdd lmZdZGdddejZGdddejZejd!ddZddZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'e(dkr6e)e*ej+d de,gdS)"zTests for ocsp.pyN)datetime) timedelta)mock)x509)InvalidSignature)UnsupportedAlgorithm)default_backend)hashesocsp)errors)utilz;Missing = in header key=value ocsp: Use -help for summary. c@seZdZdZddZedededddZed ed ed d d ZddZ eded ddZ dS)OCSPTestOpenSSLz5 OCSP revocation tests using OpenSSL binary. c Cs~ddlm}tdT}td*}t|_d|_|jdd|_Wdn1sR0YWdn1sp0YdS)Nrr certbot.ocsp.subprocess.runcertbot.util.exe_existsTZenforce_openssl_binary_usage) certbotr rpatchoutstderr return_valueRevocationCheckerchecker)selfr mock_run mock_existsrBC:\Program Files\Certbot\pkgs\certbot\_internal\tests\ocsp_test.pysetUp s    zOCSPTestOpenSSL.setUpzcertbot.ocsp.logger.inforrcCst|j_d|_ddlm}|jdd}|jdks4J|ddgksHJtdd |j_|jdd}|dd dgks|J|j d usJd |_d|_|jdd}|jdksJ|jdksJ|j dusJdS) NTrr rxzHost=x ZHostF) rrrrr r call_countZ host_args partitionbroken)rrrmock_logr rrrr test_init(s     zOCSPTestOpenSSL.test_init#certbot.ocsp._determine_ocsp_server!certbot.ocsp.crypto_util.notAfterzcertbot.util.run_scriptcCsttj}t}d|_d|_|tdd|_ d|j _ d|_ |j |dusRJd|j _ t tdd|_ |j |dusJ|jd ksJd |_ |j |dusJtd |_|j |dusJ|jdksJ||_ d|_ |j}|j |dusJ|j|ks JdS) Nr yr"ZhoursT)r,Frr)z http://x.cozx.coz#Unable to load certificate launcher)rnowpytzUTCr MagicMock cert_path chain_pathrrrr% ocsp_revokedtuple openssl_happyr#r ZSubprocessError side_effect)rrZmock_namock_determiner-cert_objZ count_beforerrrtest_ocsp_revoked@s,  z!OCSPTestOpenSSL.test_ocsp_revokedcCs0td}ddlm}||}d|ks,JdS)Nocsp_certificate.pemrr )zhttp://ocsp.test4.buypass.comzocsp.test4.buypass.com) test_util vector_pathrr Z_determine_ocsp_server)rr1r resultrrrtest_determine_ocsp_server`s   z*OCSPTestOpenSSL.test_determine_ocsp_serverzcertbot.ocsp.loggercCs(t|_ddlm}|jtdus$J|jtdus6J|jjdksFJ|jjdksVJd|j_|jt duspJ|jjdksJ|jjdksJ|jt dusJ|jjdksJ|jt dusJ|jjdksJd|j _|jt dusJ|j jdksJ|jtdusJ|j jdks$JdS)Nrr Frr"T)openssl_confusedrrr Z_translate_ocsp_queryr5debugr#Zwarningopenssl_unknownopenssl_expired_ocspopenssl_brokeninfoopenssl_revokedopenssl_expired_ocsp_revoked)rrr&r rrrtest_translate_ocspgs& z#OCSPTestOpenSSL.test_translate_ocspN) __name__ __module__ __qualname____doc__rrrr'r9r>rGrrrrrsrc@sTeZdZdZddZededddZdd Zd d Z d d Z ddZ dS)OSCPTestCryptographyz; OCSP revokation tests using Cryptography >= 2.4.0 cCsddlm}||_td|_td|_t |_ |j|j _|j|j _t t j}tjd|tddd|_|j||jjdS) Nrr r:ocsp_issuer_certificate.pemr)r"r+)r)rr rrr;r<r1r2rr0r8rr-r.r/rrZ mock_notAfterstartZ addCleanupstop)rr r-rrrrs          zOSCPTestCryptography.setUpr(z%certbot.ocsp._check_ocsp_cryptographycCs,d|_|j|j||j|jdddS)N)http://example.com example.comrP )rrr3r8Zassert_called_once_withr1r2)r mock_checkr7rrr test_ensure_cryptography_toggledsz5OSCPTestCryptography.test_ensure_cryptography_toggledcCsLttjjtjj|j|j}Wdn1s60Y|sHJdS)N) _ocsp_mockocsp_libOCSPCertStatusREVOKEDOCSPResponseStatus SUCCESSFULrr3r8)rrevokedrrr test_revokes,z OSCPTestCryptography.test_revokecCsttdt}ttjjtj j p}|j |dj _ d|dj _|j|jtj|j}d|dj _ ||dj _|j|jWdn1s0Y|djdksJ|djddd|ksJ|djddd|ksJdS)NrM mock_responserSr"rrrload_pem_x509_certificater; load_vectorrrUrVrWrXrYrZsubjectrresponder_nameZresponder_key_hashrr3r8ZSubjectKeyIdentifierZfrom_public_keyZ public_keyZdigestr#Zcall_args_listZpublic_numbers)rissuermockskey_hashrrrtest_responder_is_issuers*    ,  z-OSCPTestCryptography.test_responder_is_issuercCs~ttdt}ttdt}ttjjtj j p}|j |dj _ d|dj _|j|jtj|j}d|dj _ ||dj _|j|jWdn1s0Y|djdksJ|djddd|ksJ|djddd|ks"J|djddd|ksNJ|djd dd|kszJdS) NrMocsp_responder_certificate.pemr]rSrrr"r^)rrc responderrdrerrr%test_responder_is_authorized_delegates<     ,    z:OSCPTestCryptography.test_responder_is_authorized_delegatec Csttjjtjjdd|j|j}Wdn1s:0Y|dusPJttjjtjj |j|j}Wdn1s0Y|dusJttjjtjj|j|j}Wdn1s0Y|dusJttjj tjjZt j dt dt jjd|j|j}Wdn1s<0YWdn1s\0Y|dustJttjj tjjtdd|j|j}Wdn1s0Y|dusJttjj tjjtdd|j|j}Wdn1s 0Y|dus$Jttjj tjjtdd|j|j}Wdn1sd0Y|dus|Jttjj tjj*}g|d j_|j|j}Wdn1s0Y|dusJttjj tjjJ}|d jjd }t jd |jd |d jjd <|j|j}Wdn1s<0Y|dusTJttjj tjjt d `}d|_t j dt dt jjd|j|j}Wdn1s0YWdn1s0YWdn1s0Y|dusJdS)Ni)http_status_codeFz4cryptography.x509.Extensions.get_extension_for_classz Not found)r6Zfoo)check_signature_side_effectr]rZfake)rcrar()zhttps://example.comrQ)rUrVrWZUNKNOWNrYrZrr3r8Z UNAUTHORIZEDrXrrrZExtensionNotFoundZAuthorityInformationAccessOIDZOCSPrrAssertionErrorr certificatesMockra)rr[rdcertZ mock_serverrrrtest_revoke_resiliencysz, , , N... .. nz+OSCPTestCryptography.test_revoke_resiliencyN) rHrIrJrKrrrrTr\rfrkrrrrrrrLs rLc cstd}t|||_td`}tj|d|_td(}|rH||_|||dVWdn1sj0YWdn1s0YWdn1s0YdS)Nz(certbot.ocsp.ocsp.load_der_ocsp_responsezcertbot.ocsp.requests.post)Z status_codez.certbot.ocsp.crypto_util.verify_signed_payload)r] mock_postrS)rr_construct_mock_ocsp_responserrpr6)certificate_statusresponse_statusrlrmr]rtrSrrrrU s   rUcCsttdt}ttdt}ttdt}t}|||t }| }t j |||j |j|j|j|gt ttjjddtddttjjddtddtjjjd S)Nr:rMrg)Ztzinfor)Zdays) rwrv serial_numberissuer_key_hashissuer_name_hashrbroZhash_algorithmZ next_updateZ this_updateZsignature_algorithm_oid)rr_r;r`rrVZOCSPRequestBuilderZadd_certificater ZSHA1buildrrprxryrzrarr-r.r/replacerZoidZSignatureAlgorithmOIDZ RSA_WITH_SHA1)rvrwrqrcrjZbuilderZrequestrrrru3s2   ru)r,z /etc/letsencrypt/live/example.org/cert.pem: good This Update: Dec 17 00:00:00 2016 GMT Next Update: Dec 24 00:00:00 2016 GMT z Response Verify Failure 139903674214048:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:138:Verify error:unable to get local issuer certificate )blah.pemz^ blah.pem: good This Update: Dec 20 18:00:00 2016 GMT Next Update: Dec 27 18:00:00 2016 GMT Response verify OK)r}z blah.pem: revoked This Update: Dec 20 01:00:00 2016 GMT Next Update: Dec 27 01:00:00 2016 GMT Revocation Time: Dec 20 01:46:34 2016 GMT r~)r}za blah.pem: unknown This Update: Dec 20 18:00:00 2016 GMT Next Update: Dec 27 18:00:00 2016 GMT r~)r,Z tentaclesr~)r}z blah.pem: WARNING: Status times invalid. 140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372: good This Update: Apr 6 00:00:00 2016 GMT Next Update: Apr 13 00:00:00 2016 GMT r~)r}z blah.pem: WARNING: Status times invalid. 140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372: revoked This Update: Apr 6 00:00:00 2016 GMT Next Update: Apr 13 00:00:00 2016 GMT r~__main__r)rsN)-rK contextlibrrsysZunittestrZ cryptographyrZcryptography.exceptionsrrZcryptography.hazmat.backendsrZcryptography.hazmat.primitivesr Zcryptography.x509r rVZpytestr.rr Z certbot.testsr r;rZTestCaserrLcontextmanagerrUrur?r5rErArCrBrFrHexitmainargv__file__rrrrsB           e!