
    M/eD                        d Z ddlZddlmZ ddlmZ ddlZddlZddlmZ ddlmZ ddl	m
Z
 ddl	mZ dd	lmZ dd
lmZ ddlmZ ddlZddlZddlmZ ddlmZ dZ G d dej6                        Z G d dej6                        Zej<                  	 dd       Zd Z dZ!dZ"dZ#dZ$dZ%dZ&dZ'e(dk(  r4 ejR                   ejT                  ejV                  dd e,gz                yy)zTests for ocsp.py    N)datetime)	timedelta)mock)x509)InvalidSignature)UnsupportedAlgorithm)default_backend)hashesocsp)errors)utilz;Missing = in header key=value
ocsp: Use -help for summary.
c                   ~   e Zd ZdZd Z ej                  d       ej                  d       ej                  d      d                      Z ej                  d       ej                  d       ej                  d	      d
                      Zd Z	 ej                  d       ej                  d	      d               Z
y)OCSPTestOpenSSLz5
    OCSP revocation tests using OpenSSL binary.
    c                 
   ddl m} t        j                  d      5 }t        j                  d      5 }t        |_        d|_        |j                  d      | _        d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   y xY w)Nr   r   certbot.ocsp.subprocess.runcertbot.util.exe_existsTenforce_openssl_binary_usage)	certbotr   r   patchoutstderrreturn_valueRevocationCheckerchecker)selfr   mock_runmock_existss       C/usr/lib/python3/dist-packages/certbot/_internal/tests/ocsp_test.pysetUpzOCSPTestOpenSSL.setUp    s     ZZ56 	Y(56 Y+"%+/(#55SW5XY	Y 	YY Y	Y 	Ys"   A9*A-A9-A6	2A99Bzcertbot.ocsp.logger.infor   r   c                 "   t         |j                  _        d|_        ddlm} |j                  d      }|j                  dk(  sJ |j                  d      dgk(  sJ t         j                  d      d	   |j                  _        |j                  d      }|j                  d      d
dgk(  sJ |j                  du sJ d|_        d|_        |j                  d      }|j                  dk(  sJ |j                  dk(  sJ |j                  du sJ y )NTr   r   r      xzHost=x
   HostF)
r   r   r   r   r   r   
call_count	host_args	partitionbroken)r   r   r   mock_logr   r   s         r    	test_initzOCSPTestOpenSSL.test_init(   s    (+$#'  ((d(K""a'''  %(333'*}}T':1'=$((d(K  %&#666~~&&&#( ((d(K""a'''""a'''~~%%%    #certbot.ocsp._determine_ocsp_server!certbot.ocsp.crypto_util.notAfterzcertbot.util.run_scriptc                 H   t        j                  t        j                        }t	        j
                         }d|_        d|_        |t        d      z   |_	        d| j                  _        d|_	        | j                  j                  |      du sJ d| j                  _        t        t        dd        |_	        | j                  j                  |      du sJ |j                  d	k(  sJ d
|_	        | j                  j                  |      du sJ t!        j"                  d      |_        | j                  j                  |      du sJ |j                  dk(  sJ ||_	        d|_	        |j                  }| j                  j                  |      du sJ |j                  |k(  sJ y )Nr$   yr&   hoursT) r5   Fr#   r   )zhttp://x.cozx.coz#Unable to load certificate launcher)r   nowpytzUTCr   	MagicMock	cert_path
chain_pathr   r   r   r+   ocsp_revokedtupleopenssl_happyr(   r   SubprocessErrorside_effect)r   r   mock_namock_determiner6   cert_objcount_befores          r    test_ocsp_revokedz!OCSPTestOpenSSL.test_ocsp_revoked@   s~    ll488$>># !"YQ%77"&.#||((2e;;;# %mAB&7 8||((2e;;;""a'''&=#||((2e;;;%556[\||((2e;;;""a'''  #&.#%00||((2e;;;((L888r.   c                 j    t        j                  d      }ddlm} |j	                  |      }d|k(  sJ y )Nocsp_certificate.pemr   r   )zhttp://ocsp.test4.buypass.comzocsp.test4.buypass.com)	test_utilvector_pathr   r   _determine_ocsp_server)r   r:   r   results       r    test_determine_ocsp_serverz*OCSPTestOpenSSL.test_determine_ocsp_server`   s4    ))*@A	 ,,Y7JfTTTr.   zcertbot.ocsp.loggerc                 \   t         |_        ddlm}  |j                  t
         du sJ  |j                  t          du sJ |j                  j                  dk(  sJ |j                  j                  dk(  sJ d|j                  _         |j                  t         du sJ |j                  j                  dk(  sJ |j                  j                  dk(  sJ  |j                  t         du sJ |j                  j                  dk(  sJ  |j                  t         du sJ |j                  j                  dk(  sJ d|j                  _         |j                  t         du sJ |j                  j                  dk(  sJ  |j                  t         du sJ |j                  j                  dk(  sJ y )Nr   r   Fr#   r&   T)openssl_confusedr   r   r   _translate_ocsp_queryr>   debugr(   warningopenssl_unknownopenssl_expired_ocspopenssl_brokeninfoopenssl_revokedopenssl_expired_ocsp_revoked)r   r   r,   r   s       r    test_translate_ocspz#OCSPTestOpenSSL.test_translate_ocspg   s    !1 )t))=9UBBB)t))+;<EEE~~((A---**a///$%!)t))?;uDDD~~((A---**a///)t))+?@EIII~~((A---)t))>:eCCC**a///#$ )t))?;tCCC}}''1,,,)t))+GHDPPP}}''1,,,r.   N)__name__
__module____qualname____doc__r!   r   r   r-   rE   rL   rX    r.   r    r   r      s    Y TZZ*+TZZ-.TZZ)*& + / ,&* TZZ56TZZ34TZZ)*9 + 5 79:U TZZ%&TZZ)*- + '-r.   r   c                       e Zd ZdZd Z ej                  d       ej                  d      d               Zd Zd Z	d Z
d	 Zy
)OSCPTestCryptographyz;
    OCSP revokation tests using Cryptography >= 2.4.0
    c                 V   ddl m} |j                         | _        t	        j
                  d      | _        t	        j
                  d      | _        t        j                         | _
        | j                  | j                  _        | j                  | j                  _        t        j                  t        j                        }t        j                  d|t!        d      z         | _        | j"                  j%                          | j'                  | j"                  j(                         y )	Nr   r   rG   ocsp_issuer_certificate.pemr0   r&   r3   )r   )r   r   r   r   rH   rI   r:   r;   r   r9   rC   r   r6   r7   r8   r   r   mock_notAfterstart
addCleanupstop)r   r   r6   s      r    r!   zOSCPTestCryptography.setUp   s     --/"../EF#//0MN("&..#'?? ll488$!ZZ(K5891;M5MO  "**//0r.   r/   z%certbot.ocsp._check_ocsp_cryptographyc                     d|_         | j                  j                  | j                         |j	                  | j
                  | j                  dd       y )N)http://example.comexample.comrg   
   )r   r   r<   rC   assert_called_once_withr:   r;   )r   
mock_checkrB   s      r     test_ensure_cryptography_toggledz5OSCPTestCryptography.test_ensure_cryptography_toggled   sA     'L#!!$--0**4>>4??L`bder.   c                     t        t        j                  j                  t        j                  j
                        5  | j                  j                  | j                        }d d d        sJ y # 1 sw Y   xY w)N)	
_ocsp_mockocsp_libOCSPCertStatusREVOKEDOCSPResponseStatus
SUCCESSFULr   r<   rC   )r   revokeds     r    test_revokez OSCPTestCryptography.test_revoke   sX    //779T9T9_9_` 	?ll//>G	?w	? 	?s   &A00A9c                    t        j                  t        j                  d      t	                     }t        t        j                  j                  t        j                  j                        5 }|j                  |d   j                  _        d |d   j                  _        | j                  j!                  | j"                         t         j$                  j'                  |j)                               j*                  }d |d   j                  _        ||d   j                  _        | j                  j!                  | j"                         d d d        d   j,                  dk(  sJ |d   j.                  d   d   d   j1                         |j)                         j1                         k(  sJ |d   j.                  d   d   d   j1                         |j)                         j1                         k(  sJ y # 1 sw Y   xY w)Nra   mock_responserk   r&   r   r#   r   load_pem_x509_certificaterH   load_vectorr	   rn   ro   rp   rq   rr   rs   subjectr   responder_nameresponder_key_hashr   r<   rC   SubjectKeyIdentifierfrom_public_key
public_keydigestr(   call_args_listpublic_numbers)r   issuermockskey_hashs       r    test_responder_is_issuerz-OSCPTestCryptography.test_responder_is_issuer   s   //!!"?@/BSU //77 33>>@ 
	5CHAGE/"//>EIE/"//BLL%%dmm400@@ARARATU\\HAEE/"//>EME/"//BLL%%dmm4
	5 \"--222\"11!4Q7:IIK..01 	1 1\"11!4Q7:IIK..01 	1 1#
	5 
	5s   .CG55G>c                    t        j                  t        j                  d      t	                     }t        j                  t        j                  d      t	                     }t        t        j                  j                  t        j                  j                        5 }|j                  |d   j                  _        d |d   j                  _        | j                  j!                  | j"                         t         j$                  j'                  |j)                               j*                  }d |d   j                  _        ||d   j                  _        | j                  j!                  | j"                         d d d        d   j,                  dk(  sJ |d   j.                  d   d   d   j1                         |j)                         j1                         k(  sJ |d   j.                  d   d   d   j1                         |j)                         j1                         k(  sJ |d   j.                  d   d   d   j1                         |j)                         j1                         k(  sJ |d   j.                  d	   d   d   j1                         |j)                         j1                         k(  sJ y # 1 sw Y   ;xY w)
Nra   ocsp_responder_certificate.pemrw   rk      r   r#   r&      rx   )r   r   	responderr   r   s        r    %test_responder_is_authorized_delegatez:OSCPTestCryptography.test_responder_is_authorized_delegate   sx   //!!"?@/BSU22!!"BC_EVX	 //77 33>>@ 
	5CHAJARARE/"//>EIE/"//BLL%%dmm400@@AUAUAWX__HAEE/"//>EME/"//BLL%%dmm4
	5 \"--222\"11!4Q7:IIK**,;;=> 	> >\"11!4Q7:IIK"--/>>@A 	A A\"11!4Q7:IIK**,;;=> 	> >\"11!4Q7:IIK"--/>>@A 	A A-
	5 
	5s   CJ44J>c           	         t        t        j                  j                  t        j                  j
                  d      5  | j                  j                  | j                        }d d d        du sJ t        t        j                  j                  t        j                  j                        5  | j                  j                  | j                        }d d d        |du sJ t        t        j                  j                  t        j                  j
                        5  | j                  j                  | j                        }d d d        |du sJ t        t        j                  j                  t        j                  j
                        5  t        j                  dt        j                  dt        j                  j                               5  | j                  j                  | j                        }d d d        d d d        |du sJ t        t        j                  j                  t        j                  j
                  t#        d            5  | j                  j                  | j                        }d d d        |du sJ t        t        j                  j                  t        j                  j
                  t%        d            5  | j                  j                  | j                        }d d d        |du sJ t        t        j                  j                  t        j                  j
                  t'        d            5  | j                  j                  | j                        }d d d        |du sJ t        t        j                  j                  t        j                  j
                        5 }g |d	   j(                  _        | j                  j                  | j                        }d d d        |du sJ t        t        j                  j                  t        j                  j
                        5 }|d	   j(                  j*                  d
   }t        j,                  d|j.                        |d	   j(                  j*                  d
<   | j                  j                  | j                        }d d d        |du sJ t        t        j                  j                  t        j                  j
                        5  t        j                  d      5 }d|_        t        j                  dt        j                  dt        j                  j                               5  | j                  j                  | j                        }d d d        d d d        d d d        |du sJ y # 1 sw Y   JxY w# 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   txY w# 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   !xY w# 1 sw Y   gxY w# 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   xY w)Ni  )http_status_codeFz4cryptography.x509.Extensions.get_extension_for_classz	Not found)r@   foo)check_signature_side_effectrw   r   fake)r   r{   r/   )zhttps://example.comrh   )rn   ro   rp   UNKNOWNrr   rs   r   r<   rC   UNAUTHORIZEDrq   r   r   r   ExtensionNotFoundAuthorityInformationAccessOIDOCSPr   r   AssertionErrorr   certificatesMockr{   )r   rt   r   certmock_servers        r    test_revoke_resiliencyz+OSCPTestCryptography.test_revoke_resiliency   s%   //779T9T9_9_),. 	?ll//>G	? % //779T9T9a9ab 	?ll//>G	?% //779T9T9_9_` 	?ll//>G	?% //779T9T9_9_` 	CR(,(>(> +T-O-O-T-T)VW C ,,33DMMBC	C
 % //779T9T9_9_4H4OQ 	?ll//>G	? % //779T9T9_9_4DU4KM 	?ll//>G	? % //779T9T9_9_4B54IK 	?ll//>G	? % //77 33>>@ 	?CH?AE/"//<ll//>G	? % //77 33>>@ 	?CH)66CCAFDBF))t||C5E/"//<<Q?ll//>G	? %//779T9T9_9_` 	G AB Gk+Q(ZZ V,0,B,B$/1S1S1X1X-Z[ G #ll77FGGG	G %G	? 	?	? 	?
	? 	?C C	C 	C	? 	?	? 	?	? 	?	? 	?	? 	?G GG G	G 	Gs   &V-/&V:&WAW!&W9W!&W.&W;&X<:X A=X"YAX;(&X/X;Y-V7:WWW	W!!W+.W8;XXX"X,/X84X;;Y	 YYN)rY   rZ   r[   r\   r!   r   r   rl   ru   r   r   r   r]   r.   r    r_   r_      sX    1 TZZ56TZZ78f 9 7f
10A>E r.   r_   c              #     K   t        j                  d      5 }t        | |      |_        t        j                  d      5 }t        j                  |      |_        t        j                  d      5 }|r||_        |||d d d d        d d d        d d d        y # 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   y xY ww)Nz(certbot.ocsp.ocsp.load_der_ocsp_responsezcertbot.ocsp.requests.post)status_codez.certbot.ocsp.crypto_util.verify_signed_payload)rw   	mock_postrk   )r   r   _construct_mock_ocsp_responser   r   r@   )certificate_statusresponse_statusr   r   rw   r   rk   s          r    rn   rn      s      
>	? =%B&1"ZZ45 
	%)YY;K%LI"LM .-HJ*%2!*", 	
	 
 
	 
	 sK   B?'B31B'0BB'
B3	B?B$ B''B0	,B33B<8B?c                    t        j                  t        j                  d      t	                     }t        j                  t        j                  d      t	                     }t        j                  t        j                  d      t	                     }t        j                         }|j                  ||t        j                               }|j                         }t        j                  || |j                  |j                  |j                  |j                   |gt        j                         t#        j$                  t&        j(                        j+                  d       t-        d      z   t#        j$                  t&        j(                        j+                  d       t-        d      z
  t         j.                  j0                  j2                        S )NrG   ra   r   )tzinfor#   )days)r   r   serial_numberissuer_key_hashissuer_name_hashr|   r   hash_algorithmnext_updatethis_updatesignature_algorithm_oid)r   ry   rH   rz   r	   ro   OCSPRequestBuilderadd_certificater
   SHA1buildr   r   r   r   r   r{   r   r6   r7   r8   replacer   oidSignatureAlgorithmOIDRSA_WITH_SHA1)r   r   r   r   r   builderrequests          r    r   r   3  sR   ))457HJD++;<o>OQF..>?ARTI))+G%%dFFKKMBGmmoG99'-++// 11 (([{{}LL*22$2?)QRBSSLL*22$2?)QRBSS $ > > L L r.   )r5   z
/etc/letsencrypt/live/example.org/cert.pem: good
	This Update: Dec 17 00:00:00 2016 GMT
	Next Update: Dec 24 00:00:00 2016 GMT
z
Response Verify Failure
139903674214048:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:138:Verify error:unable to get local issuer certificate
)blah.pemz^
blah.pem: good
	This Update: Dec 20 18:00:00 2016 GMT
	Next Update: Dec 27 18:00:00 2016 GMT
Response verify OK)r   z
blah.pem: revoked
	This Update: Dec 20 01:00:00 2016 GMT
	Next Update: Dec 27 01:00:00 2016 GMT
	Revocation Time: Dec 20 01:46:34 2016 GMT
r   )r   za
blah.pem: unknown
	This Update: Dec 20 18:00:00 2016 GMT
	Next Update: Dec 27 18:00:00 2016 GMT
r   )r5   	tentaclesr   )r   z
blah.pem: WARNING: Status times invalid.
140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372:
good
	This Update: Apr  6 00:00:00 2016 GMT
	Next Update: Apr 13 00:00:00 2016 GMT
r   )r   z
blah.pem: WARNING: Status times invalid.
140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372:
revoked
	This Update: Apr  6 00:00:00 2016 GMT
	Next Update: Apr 13 00:00:00 2016 GMT
r   __main__r#   )   N)-r\   
contextlibr   r   sysunittestr   cryptographyr   cryptography.exceptionsr   r   cryptography.hazmat.backendsr	   cryptography.hazmat.primitivesr
   cryptography.x509r   ro   pytestr7   r   r   certbot.testsr   rH   r   TestCaser   r_   contextmanagerrn   r   rN   r>   rV   rR   rT   rS   rW   rY   exitmainargv__file__r]   r.   r    <module>r      s        
    4 8 8 1 .    +
b-h'' b-J] 8,, ] @ AE $6  9    zCHH[V[[!"
234 r.   