a ‚oeDã@s:dZddlZddlmZddlmZddlZddlZddlmZddlmZddl m Z ddl m Z dd l m Z dd lmZdd lmZddlZddlZdd lmZdd lmZdZGdd„dejƒZGdd„dejƒZejd!dd„ƒZdd„Z dZ!dZ"dZ#dZ$dZ%dZ&dZ'e(dk�r6e )e *ej+d d…e,g¡¡dS)"zTests for ocsp.pyéN)Údatetime)Ú timedelta)Úmock)Úx509)ÚInvalidSignature)ÚUnsupportedAlgorithm)Údefault_backend)Úhashes©Úocsp)Úerrors)Úutilz;Missing = in header key=value ocsp: Use -help for summary. c@sˆeZdZdZdd„Ze d¡e d¡e d¡dd„ƒƒƒZe d ¡e d ¡e d ¡d d „ƒƒƒZdd„Z e d¡e d ¡dd„ƒƒZ dS)ÚOCSPTestOpenSSLz5 OCSP revocation tests using OpenSSL binary. c Cs~ddlm}t d¡�T}t d¡�*}t|_d|_|jdd�|_Wdƒn1sR0YWdƒn1sp0YdS)Nrr úcertbot.ocsp.subprocess.runúcertbot.util.exe_existsT©Zenforce_openssl_binary_usage) Úcertbotr rÚpatchÚoutÚstderrÚ return_valueÚRevocationCheckerÚchecker)Úselfr Úmock_runÚ mock_exists©rúBC:\Program Files\Certbot\pkgs\certbot\_internal\tests\ocsp_test.pyÚsetUp s    zOCSPTestOpenSSL.setUpzcertbot.ocsp.logger.inforrcCsÐt|j_d|_ddlm}|jdd�}|jdks4J‚| d¡dgksHJ‚t d¡d |j_|jdd�}| d¡d dgks|J‚|j d usŠJ‚d |_d|_|jdd�}|jdks°J‚|jdks¾J‚|j dusÌJ‚dS) NTrr réÚxzHost=xÚ éZHostF) rrrrr rÚ call_countZ host_argsÚ partitionÚbroken)rrrÚmock_logr rrrrÚ test_init(s     zOCSPTestOpenSSL.test_initú#certbot.ocsp._determine_ocsp_serverú!certbot.ocsp.crypto_util.notAfterzcertbot.util.run_scriptcCst tj¡}t ¡}d|_d|_|tdd�|_ d|j _ d|_ |j   |¡dusRJ‚d|j _ t tdd…ƒ|_ |j   |¡dus€J‚|jd ksŽJ‚d |_ |j   |¡dus¨J‚t d ¡|_|j   |¡dusÈJ‚|jdksÖJ‚||_ d|_ |j}|j   |¡dusüJ‚|j|k�s J‚dS) Nr Úyr"©ZhoursT)Úr,Frr)z http://x.cozx.coz#Unable to load certificate launcher)rÚnowÚpytzÚUTCrÚ MagicMockÚ cert_pathÚ chain_pathrrrr%Ú ocsp_revokedÚtupleÚ openssl_happyr#r ZSubprocessErrorÚ side_effect)rrZmock_naÚmock_determiner-Úcert_objZ count_beforerrrÚtest_ocsp_revoked@s,  z!OCSPTestOpenSSL.test_ocsp_revokedcCs0t d¡}ddlm}| |¡}d|ks,J‚dS)Núocsp_certificate.pemrr )zhttp://ocsp.test4.buypass.comzocsp.test4.buypass.com)Ú test_utilÚ vector_pathrr Z_determine_ocsp_server)rr1r ÚresultrrrÚtest_determine_ocsp_server`s   z*OCSPTestOpenSSL.test_determine_ocsp_serverzcertbot.ocsp.loggercCs(t|_ddlm}|jtŽdus$J‚|jtŽdus6J‚|jjdksFJ‚|jjdksVJ‚d|j_|jt ŽduspJ‚|jjdks€J‚|jjdks�J‚|jt Ždus¢J‚|jjdks²J‚|jt ŽdusÄJ‚|jjdksÔJ‚d|j _|jt ŽdusîJ‚|j jdksþJ‚|jtŽdu�sJ‚|j jdk�s$J‚dS)Nrr Frr"T)Úopenssl_confusedrrr Z_translate_ocsp_queryr5Údebugr#ZwarningÚopenssl_unknownÚopenssl_expired_ocspÚopenssl_brokenÚinfoÚopenssl_revokedÚopenssl_expired_ocsp_revoked)rrr&r rrrÚtest_translate_ocspgs& z#OCSPTestOpenSSL.test_translate_ocspN) Ú__name__Ú __module__Ú __qualname__Ú__doc__rrrr'r9r>rGrrrrrsrc@sTeZdZdZdd„Ze d¡e d¡dd„ƒƒZdd „Zd d „Z d d „Z dd„Z dS)ÚOSCPTestCryptographyz; OCSP revokation tests using Cryptography >= 2.4.0 cCsŽddlm}| ¡|_t d¡|_t d¡|_t  ¡|_ |j|j _|j|j _t   t j¡}tjd|tdd�d�|_|j ¡| |jj¡dS) Nrr r:úocsp_issuer_certificate.pemr)r"r+)r)rr rrr;r<r1r2rr0r8rr-r.r/rrZ mock_notAfterÚstartZ addCleanupÚstop)rr r-rrrr…s         ÿ zOSCPTestCryptography.setUpr(z%certbot.ocsp._check_ocsp_cryptographycCs,d|_|j |j¡| |j|jdd¡dS)N)úhttp://example.comú example.comrPé )rrr3r8Zassert_called_once_withr1r2)rÚ mock_checkr7rrrÚ test_ensure_cryptography_toggled”sz5OSCPTestCryptography.test_ensure_cryptography_toggledcCsLttjjtjjƒ�|j |j¡}Wdƒn1s60Y|sHJ‚dS)N) Ú _ocsp_mockÚocsp_libÚOCSPCertStatusÚREVOKEDÚOCSPResponseStatusÚ SUCCESSFULrr3r8)rÚrevokedrrrÚ test_revokeœs,z OSCPTestCryptography.test_revokecCst t d¡tƒ¡}ttjjtj j ƒ�p}|j |dj _ d|dj _|j |j¡tj | ¡¡j}d|dj _ ||dj _|j |j¡Wdƒn1sœ0Y|djdks¸J‚|djddd ¡| ¡ ¡ksâJ‚|djddd ¡| ¡ ¡k�sJ‚dS)NrMÚ mock_responserSr"rr©rÚload_pem_x509_certificater;Ú load_vectorrrUrVrWrXrYrZÚsubjectrÚresponder_nameZresponder_key_hashrr3r8ZSubjectKeyIdentifierZfrom_public_keyZ public_keyZdigestr#Zcall_args_listZpublic_numbers)rÚissuerÚmocksÚkey_hashrrrÚtest_responder_is_issuer¡s* ÿÿ   , ÿ ÿz-OSCPTestCryptography.test_responder_is_issuercCs~t t d¡tƒ¡}t t d¡tƒ¡}ttjjtj j ƒ�p}|j |dj _ d|dj _|j |j¡tj | ¡¡j}d|dj _ ||dj _|j |j¡Wdƒn1s°0Y|djdksÌJ‚|djddd ¡| ¡ ¡ksöJ‚|djddd ¡| ¡ ¡k�s"J‚|djddd ¡| ¡ ¡k�sNJ‚|djd dd ¡| ¡ ¡k�szJ‚dS) NrMúocsp_responder_certificate.pemr]rSérrr"ér^)rrcÚ responderrdrerrrÚ%test_responder_is_authorized_delegate¹s< ÿ ÿÿ   , ÿ ÿ  ÿ  ÿz:OSCPTestCryptography.test_responder_is_authorized_delegatec Csttjjtjjdd��|j |j¡}Wdƒn1s:0Y|dusPJ‚ttjjtjj ƒ�|j |j¡}Wdƒn1s†0Y|dusœJ‚ttjjtjjƒ�|j |j¡}Wdƒn1sÒ0Y|dusèJ‚ttjj tjjƒ�Zt j dt  dt jj¡d��|j |j¡}Wdƒn1�s<0YWdƒn1�s\0Y|du�stJ‚ttjj tjjtdƒd��|j |j¡}Wdƒn1�s´0Y|du�sÌJ‚ttjj tjjtdƒd��|j |j¡}Wdƒn1�s 0Y|du�s$J‚ttjj tjjtdƒd��|j |j¡}Wdƒn1�sd0Y|du�s|J‚ttjj tjjƒ�*}g|d j_|j |j¡}Wdƒn1�sÀ0Y|du�sØJ‚ttjj tjjƒ�J}|d jjd }t jd |jd �|d jjd <|j |j¡}Wdƒn1�s<0Y|du�sTJ‚ttjj tjjƒ�Œt   d ¡�`}d|_t j dt  dt jj¡d��|j |j¡}Wdƒn1�sº0YWdƒn1�sÚ0YWdƒn1�sú0Y|du�sJ‚dS)Ni�)Úhttp_status_codeFz4cryptography.x509.Extensions.get_extension_for_classz Not found)r6Zfoo)Úcheck_signature_side_effectr]rZfake)rcrar()zhttps://example.comrQ)rUrVrWZUNKNOWNrYrZrr3r8Z UNAUTHORIZEDrXrrrZExtensionNotFoundZAuthorityInformationAccessOIDZOCSPrrÚAssertionErrorrÚ certificatesÚMockra)rr[rdÚcertZ mock_serverrrrÚtest_revoke_resiliencyØszÿ, , , ÿÿNÿ.ÿ.ÿ.ÿ .ÿÿ. ÿÿnz+OSCPTestCryptography.test_revoke_resiliencyN) rHrIrJrKrrrrTr\rfrkrrrrrrrL€s rLéÈc cs´t d¡�–}t||ƒ|_t d¡�`}tj|d�|_t d¡�(}|rH||_|||dœVWdƒn1sj0YWdƒn1sˆ0YWdƒn1s¦0YdS)Nz(certbot.ocsp.ocsp.load_der_ocsp_responsezcertbot.ocsp.requests.post)Z status_codez.certbot.ocsp.crypto_util.verify_signed_payload)r]Ú mock_postrS)rrÚ_construct_mock_ocsp_responserrpr6)Úcertificate_statusÚresponse_statusrlrmr]rtrSrrrrU s ÿ  ýrUcCsÆt t d¡tƒ¡}t t d¡tƒ¡}t t d¡tƒ¡}t ¡}| ||t  ¡¡}|  ¡}t j |||j |j|j|j|gt  ¡t tj¡jdd�tdd�t tj¡jdd�tdd�tjjjd� S)Nr:rMrg)Ztzinfor)Zdays) rwrvÚ serial_numberÚissuer_key_hashÚissuer_name_hashrbroZhash_algorithmZ next_updateZ this_updateZsignature_algorithm_oid)rr_r;r`rrVZOCSPRequestBuilderZadd_certificater ZSHA1Úbuildrrprxryrzrarr-r.r/ÚreplacerZoidZSignatureAlgorithmOIDZ RSA_WITH_SHA1)rvrwrqrcrjZbuilderZrequestrrrru3s2 ÿ ÿ ÿõru)r,z€ /etc/letsencrypt/live/example.org/cert.pem: good This Update: Dec 17 00:00:00 2016 GMT Next Update: Dec 24 00:00:00 2016 GMT z´ Response Verify Failure 139903674214048:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:138:Verify error:unable to get local issuer certificate )úblah.pemz^ blah.pem: good This Update: Dec 20 18:00:00 2016 GMT Next Update: Dec 27 18:00:00 2016 GMT úResponse verify OK)r}zŒ blah.pem: revoked This Update: Dec 20 01:00:00 2016 GMT Next Update: Dec 27 01:00:00 2016 GMT Revocation Time: Dec 20 01:46:34 2016 GMT r~)r}za blah.pem: unknown This Update: Dec 20 18:00:00 2016 GMT Next Update: Dec 27 18:00:00 2016 GMT r~)r,Z tentaclesr~)r}zÜ blah.pem: WARNING: Status times invalid. 140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372: good This Update: Apr 6 00:00:00 2016 GMT Next Update: Apr 13 00:00:00 2016 GMT r~)r}zß blah.pem: WARNING: Status times invalid. 140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372: revoked This Update: Apr 6 00:00:00 2016 GMT Next Update: Apr 13 00:00:00 2016 GMT r~Ú__main__r)rsN)-rKÚ contextlibrrÚsysZunittestrZ cryptographyrZcryptography.exceptionsrrZcryptography.hazmat.backendsrZcryptography.hazmat.primitivesr Zcryptography.x509r rVZpytestr.rr Z certbot.testsr r;rZTestCaserrLÚcontextmanagerrUrur?r5rErArCrBrFrHÚexitÚmainÚargvÚ__file__rrrrÚsB           e!ÿ