a ‚oeôIã@s®dZddlZddlZddlZddlZddlmZddlZddlZddlm Z ddlm Z ddl m Z ddl m Z ddlmm Ze d¡Ze d¡Ze d ¡Ze d ¡Ze d ¡Ze d ¡Ze d ¡Ze d ¡Ze d ¡Ze d¡Ze d¡Ze d¡Ze d¡Ze d¡Z Gdd„dej!ƒZ"Gdd„dej!ƒZ#Gdd„dej$ƒZ%Gdd„dej$ƒZ&Gdd„dej$ƒZ'Gdd„dej$ƒZ(Gdd„dej$ƒZ)Gd d!„d!e)ƒZ*Gd"d#„d#e)ƒZ+Gd$d%„d%e)ƒZ,Gd&d'„d'e)ƒZ-Gd(d)„d)ej$ƒZ.Gd*d+„d+ej$ƒZ/Gd,d-„d-ej$ƒZ0Gd.d/„d/ej$ƒZ1Gd0d1„d1ej$ƒZ2Gd2d3„d3ej$ƒZ3Gd4d5„d5ej$ƒZ4Gd6d7„d7ej$ƒZ5Gd8d9„d9ej$ƒZ6Gd:d;„d;ej$ƒZ7e8dzTests for certbot.crypto_util.éN)Úmock)Úerrors)Úutil)Ú filesystem)Úoszrsa256_key.pemzrsa512_key.pemzrsa2048_key.pemú cert_512.pemz cert_2048.pemznistp256_key.pemzcert-nosans_nistp256.pemz cert_leaf.pemzcert_intermediate_1.pemzcert_intermediate_2.pemcs\eZdZdZ‡fdd„Z‡fdd„Zedd„ƒZe  d¡d d „ƒZ e  d¡d d „ƒZ ‡Z S) ÚGenerateKeyTestz+Tests for certbot.crypto_util.generate_key.cs<tƒ ¡tj |jd¡|_tj|jdd�t   t j ¡dS)NÚworkdiriÀ)Úmode) ÚsuperÚsetUprÚpathÚjoinÚtempdirr rÚmkdirÚloggingÚdisableZCRITICAL©Úself©Ú __class__©úIC:\Program Files\Certbot\pkgs\certbot\_internal\tests\crypto_util_test.pyr $s zGenerateKeyTest.setUpcstƒ ¡t tj¡dS©N)r ÚtearDownrrZNOTSETrrrrr,s zGenerateKeyTest.tearDowncCsddlm}|||ddd�S)Nr)Ú generate_keyúkey-certbot.pemT©Zstrict_permissions)Úcertbot.crypto_utilr)ÚclsZkey_sizeZkey_dirrrrrÚ_call1s zGenerateKeyTest._callzcertbot.crypto_util.make_keycCsRd|_| d|j¡}|jdks"J‚d|jvs0J‚tj tj |j|j¡¡sNJ‚dS)Nskey_pemér) Ú return_valuer r ÚpemÚfilerr Úexistsr)rÚ mock_makeÚkeyrrrÚ test_success6s zGenerateKeyTest.test_successcCsBt|_t t¡�| d|j¡Wdƒn1s40YdS)Ni¯)Ú ValueErrorÚ side_effectÚpytestÚraisesr r )rr&rrrÚtest_key_failure>s z GenerateKeyTest.test_key_failure) Ú__name__Ú __module__Ú __qualname__Ú__doc__r rÚ classmethodr rÚpatchr(r-Ú __classcell__rrrrr"s    rc@s,eZdZdZe d¡e d¡dd„ƒƒZdS)ÚGenerateCSRTestz+Tests for certbot.crypto_util.generate_csr.zacme.crypto_util.make_csrz+certbot.crypto_util.util.make_or_verify_dircCsLddlm}d|_|tjdd�d|jdd�}|jdks:J‚d |jvsHJ‚dS) Nr)Ú generate_csrscsr_pemZ dummy_key)r#ú example.comTrzcsr-certbot.pem)rr6r"rZMockrÚdatar$)rZunused_mock_verifyZmock_csrr6ÚcsrrrrÚtest_itGs ÿzGenerateCSRTest.test_itN)r.r/r0r1rr3r:rrrrr5Esr5c@sDeZdZdZedd„ƒZdd„Zdd„Zdd „Zd d „Z d d „Z dS)Ú ValidCSRTestz(Tests for certbot.crypto_util.valid_csr.cCsddlm}||ƒS)Nr)Ú valid_csr)rr<)rr9r<rrrr Xs zValidCSRTest._callcCs| t d¡¡sJ‚dS©Nú csr_512.pem©r Ú test_utilÚ load_vectorrrrrÚtest_valid_pem_true]sz ValidCSRTest.test_valid_pem_truecCs| t d¡¡sJ‚dS)Nzcsr-san_512.pemr?rrrrÚtest_valid_pem_san_true`sz$ValidCSRTest.test_valid_pem_san_truecCs| t d¡¡rJ‚dS)Nú csr_512.derr?rrrrÚtest_valid_der_falsecsz!ValidCSRTest.test_valid_der_falsecCs| d¡rJ‚dS©NÚ©r rrrrÚtest_empty_falsefszValidCSRTest.test_empty_falsecCs| d¡rJ‚dS©Nzfoo barrHrrrrÚtest_random_falseiszValidCSRTest.test_random_falseN) r.r/r0r1r2r rBrCrErIrKrrrrr;Us r;c@s,eZdZdZedd„ƒZdd„Zdd„ZdS) ÚCSRMatchesPubkeyTestz1Tests for certbot.crypto_util.csr_matches_pubkey.cOsddlm}||i|¤ŽS)Nr)Úcsr_matches_pubkey)rrM)rÚargsÚkwargsrMrrrr ps zCSRMatchesPubkeyTest._callcCs| t d¡t¡sJ‚dSr=)r r@rAÚ RSA512_KEYrrrrÚtest_valid_trueus ÿz$CSRMatchesPubkeyTest.test_valid_truecCs| t d¡t¡rJ‚dSr=)r r@rAÚ RSA256_KEYrrrrÚtest_invalid_falseys ÿz'CSRMatchesPubkeyTest.test_invalid_falseN)r.r/r0r1r2r rQrSrrrrrLms  rLc@s4eZdZdZedd„ƒZdd„Zdd„Zdd „Zd S) ÚImportCSRFileTestz/Tests for certbot.certbot_util.import_csr_file.cOsddlm}||i|¤ŽS)Nr)Úimport_csr_file)rrU)rrNrOrUrrrr �s zImportCSRFileTest._callcCsNt d¡}t d¡}t d¡}tjjtj||dd�dgf| ||¡ksJJ‚dS)NrDr>r#©r$r8Zformú Example.com© r@Ú vector_pathrAÚOpenSSLÚcryptoÚ FILETYPE_PEMrZCSRr )rÚcsrfiler8Zdata_pemrrrÚ test_der_csr†s   þü ûzImportCSRFileTest.test_der_csrcCsDt d¡}t d¡}tjjtj||dd�dgf| ||¡ks@J‚dS)Nr>r#rVrWrX)rr]r8rrrÚ test_pem_csr’s  þü ûzImportCSRFileTest.test_pem_csrcCsHt tj¡�(| t d¡t d¡¡Wdƒn1s:0YdS©Nr)r+r,rÚErrorr r@rYrArrrrÚ test_bad_csr�s ÿzImportCSRFileTest.test_bad_csrN) r.r/r0r1r2r r^r_rbrrrrrT~s    rTc@s8eZdZdZdd„Zdd„Zdd„Zdd „Zd d „Zd S) Ú MakeKeyTestz'Tests for certbot.crypto_util.make_key.cCs&ddlm}tj tjj|dƒ¡dS)Nr©Úmake_keyr!)rrerZr[Úload_privatekeyr\©rrerrrÚtest_rsa¦s zMakeKeyTest.test_rsacCsHddlm}dD]2\}}tj tjj||dd�¡}| ¡|ksJ‚qdS)Nrrd))Z secp256r1é)Z secp384r1i€)Z secp521r1i Úecdsa©Zelliptic_curveÚkey_type)rrerZr[rfr\Úbits)rreÚnamermZpkeyrrrÚtest_ec­s   þzMakeKeyTest.test_eccCsLddlm}tjtjdd��|ddd�Wdƒn1s>0YdS)NrrdzUnsupported RSA key length: 512©ÚmatchiZrsa)rmrl©rrer+r,rrargrrrÚtest_bad_key_sizes¸s zMakeKeyTest.test_bad_key_sizescCsLddlm}tjtjdd��|ddd�Wdƒn1s>0YdS)Nrrdz#Unsupported elliptic curve: nothererpZnothererjrkrrrgrrrÚtest_bad_elliptic_curve_name¿s z(MakeKeyTest.test_bad_elliptic_curve_namecCs`ddlm}tjtjt d¡d��*tj   tj j |ddd�¡Wdƒn1sR0YdS)Nrrdz1Invalid key_type specified: unf. Use [rsa|ecdsa]rpr!Zunf)rl) rrer+r,rraÚreÚescaperZr[rfr\rgrrrÚtest_bad_key_typeÄs ÿÿzMakeKeyTest.test_bad_key_typeN) r.r/r0r1rhrorsrtrwrrrrrc£s  rcc@seZdZdZdd„ZdS)ÚVerifyCertSetupz#Refactoring for verification tests.cCsVt ¡|_t|j_t|j_t|j_t  d¡|j_ t ¡|_ t|j _t|j _t|j _ dS)Nzcert_fullchain_2048.pem) rÚ MagicMockÚrenewable_certÚ SS_CERT_PATHÚ cert_pathÚ chain_pathÚRSA2048_KEY_PATHÚkey_pathr@rYZfullchain_pathÚbad_renewable_certrrrrr Ñs  zVerifyCertSetup.setUpN)r.r/r0r1r rrrrrxÎsrxc@s<eZdZdZdd„Zdd„Zejde  d¡d�d d „ƒZ d S) ÚVerifyRenewableCertTestú4Tests for certbot.crypto_util.verify_renewable_cert.cCsddlm}||ƒS)Nr)Úverify_renewable_cert)rrƒ)rrzrƒrrrr ás zVerifyRenewableCertTest._callcCs| |j¡dusJ‚dSr©r rzrrrrÚtest_verify_renewable_certåsz2VerifyRenewableCertTest.test_verify_renewable_certz-certbot.crypto_util.verify_renewable_cert_sigrG)r*cCs<t tj¡�| |j¡Wdƒn1s.0YdSr©r+r,rrar r€)rZ!unused_verify_renewable_cert_signrrrÚ"test_verify_renewable_cert_failureèsz:VerifyRenewableCertTest.test_verify_renewable_cert_failureN) r.r/r0r1r r…rr3rrar‡rrrrr�Þs r�c@s0eZdZdZdd„Zdd„Zdd„Zdd „Zd S) ÚVerifyRenewableCertSigTestr‚cCsddlm}||ƒS)Nr)Úverify_renewable_cert_sig)rr‰)rrzr‰rrrr ñs z VerifyRenewableCertSigTest._callcCs| |j¡dusJ‚dSrr„rrrrÚtest_cert_sig_matchõsz.VerifyRenewableCertSigTest.test_cert_sig_matchcCs0t ¡}t|_t|_t|_| |¡dus,J‚dSr)rryÚP256_CERT_PATHr|r}ÚP256_KEYrr )rrzrrrÚtest_cert_sig_match_ecøs z1VerifyRenewableCertSigTest.test_cert_sig_match_eccCsJt d¡|j_t tj¡�| |j¡Wdƒn1s<0YdS)Nzcert_512_bad.pem) r@rYr€r|r+r,rrar rrrrÚtest_cert_sig_mismatchÿsz1VerifyRenewableCertSigTest.test_cert_sig_mismatchN)r.r/r0r1r rŠr�rŽrrrrrˆîs rˆc@s0eZdZdZdd„Zdd„Zdd„Zdd „Zd S) ÚVerifyFullchainTestz/Tests for certbot.crypto_util.verify_fullchain.cCsddlm}||ƒS)Nr)Úverify_fullchain)rr�)rrzr�rrrr s zVerifyFullchainTest._callcCs| |j¡dusJ‚dSrr„rrrrÚtest_fullchain_matches sz*VerifyFullchainTest.test_fullchain_matchescCs<t tj¡�| |j¡Wdƒn1s.0YdSrr†rrrrÚtest_fullchain_mismatchsz+VerifyFullchainTest.test_fullchain_mismatchcCsDd|j_t tj¡�| |j¡Wdƒn1s60YdS)NZdog)r€Úchainr+r,rrar rrrrÚtest_fullchain_ioerrorsz*VerifyFullchainTest.test_fullchain_ioerrorN)r.r/r0r1r r‘r’r”rrrrr�s r�c@s(eZdZdZdd„Zdd„Zdd„ZdS) ÚVerifyCertMatchesPrivKeyTestz;Tests for certbot.crypto_util.verify_cert_matches_priv_key.cCsddlm}||j|jƒS)Nr)Úverify_cert_matches_priv_key)rr–ÚcertÚprivkey)rrzr–rrrr s z"VerifyCertMatchesPrivKeyTest._callcCs(t|j_t|j_| |j¡dus$J‚dSr)r{rzr—r~r˜r rrrrÚtest_cert_priv_key_match sz5VerifyCertMatchesPrivKeyTest.test_cert_priv_key_matchcCsLt|j_t|j_t tj¡�|  |j¡Wdƒn1s>0YdSr) ÚRSA256_KEY_PATHr€r˜r{r—r+r,rrar rrrrÚtest_cert_priv_key_mismatch%sz8VerifyCertMatchesPrivKeyTest.test_cert_priv_key_mismatchN)r.r/r0r1r r™r›rrrrr•sr•c@s4eZdZdZedd„ƒZdd„Zdd„Zdd „Zd S) ÚValidPrivkeyTestz,Tests for certbot.crypto_util.valid_privkey.cCsddlm}||ƒS)Nr)Ú valid_privkey)rr�)rr˜r�rrrr 0s zValidPrivkeyTest._callcCs| t¡sJ‚dSr)r rPrrrrrQ5sz ValidPrivkeyTest.test_valid_truecCs| d¡rJ‚dSrFrHrrrrrI8sz!ValidPrivkeyTest.test_empty_falsecCs| d¡rJ‚dSrJrHrrrrrK;sz"ValidPrivkeyTest.test_random_falseN) r.r/r0r1r2r rQrIrKrrrrrœ-s  rœc@s,eZdZdZedd„ƒZdd„Zdd„ZdS) ÚGetSANsFromCertTestz1Tests for certbot.crypto_util.get_sans_from_cert.cOsddlm}||i|¤ŽS)Nr)Úget_sans_from_cert)rrŸ)rrNrOrŸrrrr Bs zGetSANsFromCertTest._callcCsg| t d¡¡ksJ‚dSr`r?rrrrÚ test_singleGszGetSANsFromCertTest.test_singlecCs ddg| t d¡¡ksJ‚dS©Nr7zwww.example.comzcert-san_512.pemr?rrrrÚtest_sanJsÿzGetSANsFromCertTest.test_sanN)r.r/r0r1r2r r r¢rrrrrž?s  ržc@s<eZdZdZedd„ƒZdd„Zdd„Zdd „Zd d „Z d S) ÚGetNamesFromCertTestz2Tests for certbot.crypto_util.get_names_from_cert.cOsddlm}||i|¤ŽS)Nr)Úget_names_from_cert)rr¤)rrNrOr¤rrrr Rs zGetNamesFromCertTest._callcCsdg| t d¡¡ksJ‚dS)Nr7rr?rrrrr Wsÿz GetNamesFromCertTest.test_singlecCs ddg| t d¡¡ksJ‚dSr¡r?rrrrr¢[sÿzGetNamesFromCertTest.test_sancCs,dgdd„dDƒ| t d¡¡ks(J‚dS)Nr7cSsg|]}d |¡‘qS)z{0}.example.com)Úformat)Ú.0ÚcrrrÚ bózDGetNamesFromCertTest.test_common_name_sans_order..Zabcdzcert-5sans_512.pemr?rrrrÚtest_common_name_sans_order_sÿz0GetNamesFromCertTest.test_common_name_sans_ordercCs<t tjj¡�| d¡Wdƒn1s.0YdS)Nz hello there)r+r,rZr[rar rrrrÚtest_parse_non_certesz(GetNamesFromCertTest.test_parse_non_certN) r.r/r0r1r2r r r¢rªr«rrrrr£Os r£c@s<eZdZdZedd„ƒZdd„Zdd„Zdd „Zd d „Z d S) ÚGetNamesFromReqTestz1Tests for certbot.crypto_util.get_names_from_req.cOsddlm}||i|¤ŽS)Nr)Úget_names_from_req)rr­)rrNrOr­rrrr ms zGetNamesFromReqTest._callcCsg| t d¡¡ksJ‚dS)Nzcsr-nonames_512.pemr?rrrrÚ test_nonamesrsÿz GetNamesFromReqTest.test_nonamescCsdg| t d¡¡ksJ‚dS)Nr7zcsr-nosans_512.pemr?rrrrÚ test_nosansvsÿzGetNamesFromReqTest.test_nosanscCs gd¢| t d¡¡ksJ‚dS)N)r7z example.orgz example.netz example.infozsubdomain.example.comzother.subdomain.example.comzcsr-6sans_512.pemr?rrrrÚ test_sanszsþzGetNamesFromReqTest.test_sanscCs.ddlm}dg|jt d¡|d�ks*J‚dS)Nr)Ú FILETYPE_ASN1rWrD)Útyp)ZOpenSSL.cryptor±r r@rA)rr±rrrÚtest_ders ÿzGetNamesFromReqTest.test_derN) r.r/r0r1r2r r®r¯r°r³rrrrr¬js r¬c@s eZdZdZdd„Zdd„ZdS)ÚCertLoaderTestz8Tests for certbot.crypto_util.pyopenssl_load_certificatecCs>ddlm}|tƒ\}}| d¡tj |t¡ d¡ks:J‚dS)Nr©Úpyopenssl_load_certificateZsha256)rr¶ÚCERTZdigestrZr[Úload_certificate)rr¶r—Z file_typerrrÚtest_load_valid_certˆs   ÿz#CertLoaderTest.test_load_valid_certcCsPddlm}t dd¡}t tj¡�||ƒWdƒn1sB0YdS)NrrµsBEGIN CERTIFICATEsASDFASDFASDF!!!)rr¶r·Úreplacer+r,rra)rr¶Z bad_cert_datarrrÚtest_load_invalid_cert�s  z%CertLoaderTest.test_load_invalid_certN)r.r/r0r1r¹r»rrrrr´…sr´c@seZdZdZdd„ZdS)Ú NotBeforeTestz'Tests for certbot.crypto_util.notBeforecCs$ddlm}|tƒ ¡dks J‚dS)Nr)Ú notBeforez2014-12-11T22:34:45+00:00)rr½Ú CERT_PATHÚ isoformat)rr½rrrÚtest_notBefore™s  ÿzNotBeforeTest.test_notBeforeN)r.r/r0r1rÀrrrrr¼–sr¼c@seZdZdZdd„ZdS)Ú NotAfterTestú&Tests for certbot.crypto_util.notAftercCs$ddlm}|tƒ ¡dks J‚dS)Nr)ÚnotAfterz2014-12-18T22:34:45+00:00)rrÃr¾r¿)rrÃrrrÚ test_notAfter¢s  ÿzNotAfterTest.test_notAfterN)r.r/r0r1rÄrrrrrÁŸsrÁc@seZdZdZdd„ZdS)Ú Sha256sumTestrÂcCs ddlm}|tƒdksJ‚dS)Nr)Ú sha256sumZ@914ffed8daf9e2c99d90ac95c77d54f32cbd556672facac380f0c063498df84e)rrÆr¾)rrÆrrrÚtest_sha256sumªs ÿzSha256sumTest.test_sha256sumN)r.r/r0r1rÇrrrrrŨsrÅc@s eZdZdZdd„Zdd„ZdS)ÚCertAndChainFromFullchainTestz;Tests for certbot.crypto_util.cert_and_chain_from_fullchaincCs(ddlm}| |j| |j|¡¡ ¡S)Nr)r[)rZr[Zdump_certificater\r¸Údecode)rÚcert_pemr[rrrÚ_parse_and_reencode_pem³s  ÿz5CertAndChainFromFullchainTest._parse_and_reencode_pemc CsÐt ¡}|t ¡}||}|d|}| dd¡}| |¡| |¡| t ¡¡}ddlm}||||fD](}||ƒ\} } | |ksŠJ‚| |ksnJ‚qnt t j ¡�||ƒWdƒn1sÂ0YdS)NÚ z r)Úcert_and_chain_from_fullchain) r·rÉÚSS_CERTrºrËrrÍr+r,rra) rrÊZ chain_pemZ fullchain_pemZspacey_fullchain_pemZcrlf_fullchain_pemZacmev1_fullchain_pemrÍZ fullchainZcert_outZ chain_outrrrÚ"test_cert_and_chain_from_fullchain¸s&   ÿ ÿ ÿ  z@CertAndChainFromFullchainTest.test_cert_and_chain_from_fullchainN)r.r/r0r1rËrÏrrrrrȰsrÈc@sbeZdZdZedd„ƒZdd„Zdd„Ze  d¡d d „ƒZ e  d¡d d „ƒZ e  d ¡dd„ƒZ dS)ÚFindChainWithIssuerTestz4Tests for certbot.crypto_util.find_chain_with_issuercKsddlm}||||ƒS)Nr)Úfind_chain_with_issuer)rrÑ)rÚ fullchainsZ issuer_cnrOrÑrrrr Ós zFindChainWithIssuerTest._callcCs t ¡t ¡t ¡t ¡gSr)Ú CERT_LEAFrÉÚ CERT_ISSUERÚCERT_ALT_ISSUERrrrrÚ_all_fullchainsØsÿz'FindChainWithIssuerTest._all_fullchainscCs(| ¡}| |d¡}||dks$J‚dS)z/Correctly pick the chain based on the root's CNúPebble Root CA 0cc6f0éN)rÖr )rrÒÚmatchedrrrÚtest_positive_matchÜs z+FindChainWithIssuerTest.test_positive_matchzcertbot.crypto_util.logger.infocCsD| ¡}|dt ¡|d<| |d¡}||dks8J‚| ¡dS)z5Don't pick a chain where only an intermediate matchesrØr×rN)rÖrÔrÉr Úassert_not_called©rZ mock_inforÒrÙrrrÚtest_intermediate_matchâs  z/FindChainWithIssuerTest.test_intermediate_matchcCs0| ¡}| |d¡}||dks$J‚| ¡dS)Núnon-existent issuerr)rÖr rÛrÜrrrÚ test_no_matchïs z%FindChainWithIssuerTest.test_no_matchz"certbot.crypto_util.logger.warningcCs8| ¡}|j|ddd�}||dks(J‚| dd¡dS)NrÞT)Zwarn_on_no_matchrz¥Certbot has been configured to prefer certificate chains with issuer '%s', but no chain from the CA matched this issuer. Using the default certificate chain instead.)rÖr Zassert_called_once_with)rZ mock_warningrÒrÙrrrÚtest_warning_on_no_matchösÿýz0FindChainWithIssuerTest.test_warning_on_no_matchN) r.r/r0r1r2r rÖrÚrr3rÝrßràrrrrrÐÐs   rÐÚ__main__rØ)=r1rruÚsysZunittestrrZr+ZcertbotrrZcertbot.compatrrZcertbot.tests.utilZtestsr@rArRrYršrPr~r¾r·r{rÎrŒr‹Z P256_CERTrÓrÔrÕZTempDirTestCaserr5ZTestCaser;rLrTrcrxr�rˆr�r•rœržr£r¬r´r¼rÁrÅrÈrÐr.ÚexitÚmainÚargvÚ__file__rrrrÚsb                   #%+   2