Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/certbot/certbot.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/acme/tests
diff options
context:
space:
mode:
Diffstat (limited to 'acme/tests')
-rw-r--r--acme/tests/challenges_test.py87
-rw-r--r--acme/tests/crypto_util_test.py16
-rw-r--r--acme/tests/standalone_test.py57
-rw-r--r--acme/tests/testdata/README6
-rw-r--r--acme/tests/testdata/rsa1024_cert.pem13
5 files changed, 163 insertions, 16 deletions
diff --git a/acme/tests/challenges_test.py b/acme/tests/challenges_test.py
index adebaffc5..2b44d677d 100644
--- a/acme/tests/challenges_test.py
+++ b/acme/tests/challenges_test.py
@@ -2,10 +2,13 @@
import unittest
import josepy as jose
+import OpenSSL
import mock
import requests
from six.moves.urllib import parse as urllib_parse
+from acme import errors
+
import test_util
CERT = test_util.load_comparable_cert('cert.pem')
@@ -256,30 +259,87 @@ class HTTP01Test(unittest.TestCase):
class TLSALPN01ResponseTest(unittest.TestCase):
def setUp(self):
- from acme.challenges import TLSALPN01Response
- self.msg = TLSALPN01Response(key_authorization=u'foo')
+ from acme.challenges import TLSALPN01
+ self.chall = TLSALPN01(
+ token=jose.b64decode(b'a82d5ff8ef740d12881f6d3c2277ab2e'))
+ self.domain = u'example.com'
+ self.domain2 = u'example2.com'
+
+ self.response = self.chall.response(KEY)
self.jmsg = {
'resource': 'challenge',
'type': 'tls-alpn-01',
- 'keyAuthorization': u'foo',
+ 'keyAuthorization': self.response.key_authorization,
}
- from acme.challenges import TLSALPN01
- self.chall = TLSALPN01(token=(b'x' * 16))
- self.response = self.chall.response(KEY)
-
def test_to_partial_json(self):
self.assertEqual({k: v for k, v in self.jmsg.items() if k != 'keyAuthorization'},
- self.msg.to_partial_json())
+ self.response.to_partial_json())
def test_from_json(self):
from acme.challenges import TLSALPN01Response
- self.assertEqual(self.msg, TLSALPN01Response.from_json(self.jmsg))
+ self.assertEqual(self.response, TLSALPN01Response.from_json(self.jmsg))
def test_from_json_hashable(self):
from acme.challenges import TLSALPN01Response
hash(TLSALPN01Response.from_json(self.jmsg))
+ def test_gen_verify_cert(self):
+ key1 = test_util.load_pyopenssl_private_key('rsa512_key.pem')
+ cert, key2 = self.response.gen_cert(self.domain, key1)
+ self.assertEqual(key1, key2)
+ self.assertTrue(self.response.verify_cert(self.domain, cert))
+
+ def test_gen_verify_cert_gen_key(self):
+ cert, key = self.response.gen_cert(self.domain)
+ self.assertTrue(isinstance(key, OpenSSL.crypto.PKey))
+ self.assertTrue(self.response.verify_cert(self.domain, cert))
+
+ def test_verify_bad_cert(self):
+ self.assertFalse(self.response.verify_cert(self.domain,
+ test_util.load_cert('cert.pem')))
+
+ def test_verify_bad_domain(self):
+ key1 = test_util.load_pyopenssl_private_key('rsa512_key.pem')
+ cert, key2 = self.response.gen_cert(self.domain, key1)
+ self.assertEqual(key1, key2)
+ self.assertFalse(self.response.verify_cert(self.domain2, cert))
+
+ def test_simple_verify_bad_key_authorization(self):
+ key2 = jose.JWKRSA.load(test_util.load_vector('rsa256_key.pem'))
+ self.response.simple_verify(self.chall, "local", key2.public_key())
+
+ @mock.patch('acme.challenges.TLSALPN01Response.verify_cert', autospec=True)
+ def test_simple_verify(self, mock_verify_cert):
+ mock_verify_cert.return_value = mock.sentinel.verification
+ self.assertEqual(
+ mock.sentinel.verification, self.response.simple_verify(
+ self.chall, self.domain, KEY.public_key(),
+ cert=mock.sentinel.cert))
+ mock_verify_cert.assert_called_once_with(
+ self.response, self.domain, mock.sentinel.cert)
+
+ @mock.patch('acme.challenges.socket.gethostbyname')
+ @mock.patch('acme.challenges.crypto_util.probe_sni')
+ def test_probe_cert(self, mock_probe_sni, mock_gethostbyname):
+ mock_gethostbyname.return_value = '127.0.0.1'
+ self.response.probe_cert('foo.com')
+ mock_gethostbyname.assert_called_once_with('foo.com')
+ mock_probe_sni.assert_called_once_with(
+ host='127.0.0.1', port=self.response.PORT, name='foo.com',
+ alpn_protocols=['acme-tls/1'])
+
+ self.response.probe_cert('foo.com', host='8.8.8.8')
+ mock_probe_sni.assert_called_with(
+ host='8.8.8.8', port=mock.ANY, name='foo.com',
+ alpn_protocols=['acme-tls/1'])
+
+ @mock.patch('acme.challenges.TLSALPN01Response.probe_cert')
+ def test_simple_verify_false_on_probe_error(self, mock_probe_cert):
+ mock_probe_cert.side_effect = errors.Error
+ self.assertFalse(self.response.simple_verify(
+ self.chall, self.domain, KEY.public_key()))
+
class TLSALPN01Test(unittest.TestCase):
@@ -309,8 +369,13 @@ class TLSALPN01Test(unittest.TestCase):
self.assertRaises(
jose.DeserializationError, TLSALPN01.from_json, self.jmsg)
- def test_validation(self):
- self.assertRaises(NotImplementedError, self.msg.validation, KEY)
+ @mock.patch('acme.challenges.TLSALPN01Response.gen_cert')
+ def test_validation(self, mock_gen_cert):
+ mock_gen_cert.return_value = ('cert', 'key')
+ self.assertEqual(('cert', 'key'), self.msg.validation(
+ KEY, cert_key=mock.sentinel.cert_key, domain=mock.sentinel.domain))
+ mock_gen_cert.assert_called_once_with(key=mock.sentinel.cert_key,
+ domain=mock.sentinel.domain)
class DNSTest(unittest.TestCase):
diff --git a/acme/tests/crypto_util_test.py b/acme/tests/crypto_util_test.py
index 41640ed60..ff08a5405 100644
--- a/acme/tests/crypto_util_test.py
+++ b/acme/tests/crypto_util_test.py
@@ -18,7 +18,6 @@ import test_util
class SSLSocketAndProbeSNITest(unittest.TestCase):
"""Tests for acme.crypto_util.SSLSocket/probe_sni."""
-
def setUp(self):
self.cert = test_util.load_comparable_cert('rsa2048_cert.pem')
key = test_util.load_pyopenssl_private_key('rsa2048_key.pem')
@@ -32,7 +31,8 @@ class SSLSocketAndProbeSNITest(unittest.TestCase):
# six.moves.* | pylint: disable=attribute-defined-outside-init,no-init
def server_bind(self): # pylint: disable=missing-docstring
- self.socket = SSLSocket(socket.socket(), certs=certs)
+ self.socket = SSLSocket(socket.socket(),
+ certs)
socketserver.TCPServer.server_bind(self)
self.server = _TestServer(('', 0), socketserver.BaseRequestHandler)
@@ -73,6 +73,18 @@ class SSLSocketAndProbeSNITest(unittest.TestCase):
socket.setdefaulttimeout(original_timeout)
+class SSLSocketTest(unittest.TestCase):
+ """Tests for acme.crypto_util.SSLSocket."""
+
+ def test_ssl_socket_invalid_arguments(self):
+ from acme.crypto_util import SSLSocket
+ with self.assertRaises(ValueError):
+ _ = SSLSocket(None, {'sni': ('key', 'cert')},
+ cert_selection=lambda _: None)
+ with self.assertRaises(ValueError):
+ _ = SSLSocket(None)
+
+
class PyOpenSSLCertOrReqAllNamesTest(unittest.TestCase):
"""Test for acme.crypto_util._pyopenssl_cert_or_req_all_names."""
diff --git a/acme/tests/standalone_test.py b/acme/tests/standalone_test.py
index 83ced12b0..e2817b29c 100644
--- a/acme/tests/standalone_test.py
+++ b/acme/tests/standalone_test.py
@@ -10,7 +10,10 @@ from six.moves import http_client # pylint: disable=import-error
from six.moves import socketserver # type: ignore # pylint: disable=import-error
from acme import challenges
+from acme import crypto_util
+from acme import errors
from acme.magic_typing import Set # pylint: disable=unused-import, no-name-in-module
+
import test_util
@@ -84,6 +87,59 @@ class HTTP01ServerTest(unittest.TestCase):
self.assertFalse(self._test_http01(add=False))
+@unittest.skipIf(not challenges.TLSALPN01.is_supported(), "pyOpenSSL too old")
+class TLSALPN01ServerTest(unittest.TestCase):
+ """Test for acme.standalone.TLSALPN01Server."""
+
+ def setUp(self):
+ self.certs = {b'localhost': (
+ test_util.load_pyopenssl_private_key('rsa2048_key.pem'),
+ test_util.load_cert('rsa2048_cert.pem'),
+ )}
+ # Use different certificate for challenge.
+ self.challenge_certs = {b'localhost': (
+ test_util.load_pyopenssl_private_key('rsa1024_key.pem'),
+ test_util.load_cert('rsa1024_cert.pem'),
+ )}
+ from acme.standalone import TLSALPN01Server
+ self.server = TLSALPN01Server(("localhost", 0), certs=self.certs,
+ challenge_certs=self.challenge_certs)
+ # pylint: disable=no-member
+ self.thread = threading.Thread(target=self.server.serve_forever)
+ self.thread.start()
+
+ def tearDown(self):
+ self.server.shutdown() # pylint: disable=no-member
+ self.thread.join()
+
+ # TODO: This is not implemented yet, see comments in standalone.py
+ # def test_certs(self):
+ # host, port = self.server.socket.getsockname()[:2]
+ # cert = crypto_util.probe_sni(
+ # b'localhost', host=host, port=port, timeout=1)
+ # # Expect normal cert when connecting without ALPN.
+ # self.assertEqual(jose.ComparableX509(cert),
+ # jose.ComparableX509(self.certs[b'localhost'][1]))
+
+ def test_challenge_certs(self):
+ host, port = self.server.socket.getsockname()[:2]
+ cert = crypto_util.probe_sni(
+ b'localhost', host=host, port=port, timeout=1,
+ alpn_protocols=[b"acme-tls/1"])
+ # Expect challenge cert when connecting with ALPN.
+ self.assertEqual(
+ jose.ComparableX509(cert),
+ jose.ComparableX509(self.challenge_certs[b'localhost'][1])
+ )
+
+ def test_bad_alpn(self):
+ host, port = self.server.socket.getsockname()[:2]
+ with self.assertRaises(errors.Error):
+ crypto_util.probe_sni(
+ b'localhost', host=host, port=port, timeout=1,
+ alpn_protocols=[b"bad-alpn"])
+
+
class BaseDualNetworkedServersTest(unittest.TestCase):
"""Test for acme.standalone.BaseDualNetworkedServers."""
@@ -138,7 +194,6 @@ class BaseDualNetworkedServersTest(unittest.TestCase):
class HTTP01DualNetworkedServersTest(unittest.TestCase):
"""Tests for acme.standalone.HTTP01DualNetworkedServers."""
-
def setUp(self):
self.account_key = jose.JWK.load(
test_util.load_vector('rsa1024_key.pem'))
diff --git a/acme/tests/testdata/README b/acme/tests/testdata/README
index dfe3f5405..d65cc3018 100644
--- a/acme/tests/testdata/README
+++ b/acme/tests/testdata/README
@@ -10,6 +10,8 @@ and for the CSR:
openssl req -key rsa2048_key.pem -new -subj '/CN=example.com' -outform DER > csr.der
-and for the certificate:
+and for the certificates:
- openssl req -key rsa2047_key.pem -new -subj '/CN=example.com' -x509 -outform DER > cert.der
+ openssl req -key rsa2048_key.pem -new -subj '/CN=example.com' -x509 -outform DER > cert.der
+ openssl req -key rsa2048_key.pem -new -subj '/CN=example.com' -x509 > rsa2048_cert.pem
+ openssl req -key rsa1024_key.pem -new -subj '/CN=example.com' -x509 > rsa1024_cert.pem
diff --git a/acme/tests/testdata/rsa1024_cert.pem b/acme/tests/testdata/rsa1024_cert.pem
new file mode 100644
index 000000000..1b7912181
--- /dev/null
+++ b/acme/tests/testdata/rsa1024_cert.pem
@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB/TCCAWagAwIBAgIJAOyRIBs3QT8QMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNV
+BAMMC2V4YW1wbGUuY29tMB4XDTE4MDQyMzEwMzE0NFoXDTE4MDUyMzEwMzE0NFow
+FjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
+AoGBAJqJ87R8aVwByONxgQA9hwgvQd/QqI1r1UInXhEF2VnEtZGtUWLi100IpIqr
+Mq4qusDwNZ3g8cUPtSkvJGs89djoajMDIJP7lQUEKUYnYrI0q755Tr/DgLWSk7iW
+l5ezym0VzWUD0/xXUz8yRbNMTjTac80rS5SZk2ja2wWkYlRJAgMBAAGjUzBRMB0G
+A1UdDgQWBBSsaX0IVZ4XXwdeffVAbG7gnxSYjTAfBgNVHSMEGDAWgBSsaX0IVZ4X
+XwdeffVAbG7gnxSYjTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GB
+ADe7SVmvGH2nkwVfONk8TauRUDkePN1CJZKFb2zW1uO9ANJ2v5Arm/OQp0BG/xnI
+Djw/aLTNVESF89oe15dkrUErtcaF413MC1Ld5lTCaJLHLGqDKY69e02YwRuxW7jY
+qarpt7k7aR5FbcfO5r4V/FK/Gvp4Dmoky8uap7SJIW6x
+-----END CERTIFICATE-----
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-03 14:59:42 +0300