U
    ]%W                     @   s8  d Z ddlZddlZddlZddlZddlZddlmZ ddlm	Z
 ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ dd	lmZ G dd dejZG dd dejZejddfddZG dd dejZG dd dejZG dd dejZdd ZdddZedkr4e   dS )zTests for certbot.auth_handler.    N)
challenges)client)messages)errors)achallenges)
interfaces)util)	acme_utilc                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
ChallengeFactoryTestc                 C   sH   ddl m} |d d tjddg | _ttjdtj	tjgd d| _
d S )Nr   AuthHandlerZmock_keykeytest   F)certbot.auth_handlerr   mockMockhandlerr	   
gen_authzrr   STATUS_PENDING
CHALLENGESauthzrselfr    r   A/usr/lib/python3/dist-packages/certbot/tests/auth_handler_test.pysetUp   s      
 zChallengeFactoryTest.setUpc                 C   s8   | j | jtdttj}| dd |D tj d S )Nr   c                 S   s   g | ]
}|j qS r   chall.0achallr   r   r   
<listcomp>)   s     z1ChallengeFactoryTest.test_all.<locals>.<listcomp>)r   _challenge_factoryr   rangelenr	   r   assertEqualr   Zachallsr   r   r   test_all$   s      zChallengeFactoryTest.test_allc                 C   s0   | j | jdg}| dd |D tjg d S )Nr   c                 S   s   g | ]
}|j qS r   r   r    r   r   r   r#   /   s     z6ChallengeFactoryTest.test_one_http.<locals>.<listcomp>)r   r$   r   r'   r	   HTTP01r(   r   r   r   test_one_http+   s
     z"ChallengeFactoryTest.test_one_httpc                 C   s>   t tjdtjdddgtjg}| tj| j	j
|dg d S )Nr   r   Zunrecognized)r   typr   )r	   r   r   r   r   r   assertRaisesr   Errorr   r$   )r   r   r   r   r   test_unrecognized1   s        z&ChallengeFactoryTest.test_unrecognizedN)__name__
__module____qualname__r   r)   r+   r/   r   r   r   r   r
      s   
r
   c                   @   s   e Zd ZdZdd Zdd Zdd Zdd	 Zd
d Zdd Z	dd Z
dd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Zd4d5 Zd6d7 Zd8S )9HandleAuthorizationsTestzmhandle_authorizations test.

    This tests everything except for all functions under _poll_challenges.

    c                 C   s   ddl m} t | _tj| jtj	 tjtjddtj
 tjdd| _tjg| jj_t| jj_tjtddd	| _tjtjd
| _d| j_tjj| jj_|| j| j| jg | _ttj d S )Nr   r   FZdebug_challengesZApacheConfigurator)nameZ	file_pathZPEMr   )spec   ) r   r   r   r   mock_displayzope	componentprovideUtilityr   ZIDisplayIConfig	MagicMock	mock_authr   r*   get_chall_prefreturn_valuegen_auth_respperformside_effectr   ZKeyZmock_accountacme_clientZClientmock_netacme_versionZretry_afterr   loggingdisableZCRITICALr   r   r   r   r   B   s0    
 
 
   zHandleAuthorizationsTest.setUpc                 C   s   t t j d S NrG   rH   ZNOTSETr   r   r   r   tearDown[   s    z!HandleAuthorizationsTest.tearDownc              	   C   s  t dtj|d}tj|gd}tddd| jj_t	d}| j
|}| | jjjd | | jjjd | |jjd | |jjd d	 d	 dk | |jjd d	 d	 d
k | | jjjd | | jjjd	 d	 d	 jd | t|d W 5 Q R X d S )N0domainchallscombosZauthorizationsr7      )retry
wait_valuezcertbot.auth_handler.time   r      http-01)gen_dom_authzrr	   r   r   r=   _gen_mock_on_pollrE   pollrC   patchr   handle_authorizationsr'   answer_challenge
call_countsleep
assertTruecall_args_listr>   cleanup	call_argsr,   r&   )r   rQ   r   
mock_orderZ	mock_timer   r   r   _test_name1_http_01_1_common^   s      z5HandleAuthorizationsTest._test_name1_http_01_1_commonc                 C   s   | j dd d S NTrQ   )rf   rK   r   r   r   test_name1_http_01_1_acme_1w   s    z4HandleAuthorizationsTest.test_name1_http_01_1_acme_1c                 C   s   d| j _| jdd d S NrV   Frh   )rE   rF   rf   rK   r   r   r   test_name1_http_01_1_acme_2z   s    z4HandleAuthorizationsTest.test_name1_http_01_1_acme_2c                 C   s   t  | jj_| jjjtj	 t
dtjdd}tj|gd}| j|}| | jjjd | | jjjd | | jjjd | jjjd d D ]}| |jdk q| t|d d S )	NrM   FrN   rR   rV   r7   r   )rX   zdns-01)rZ   rE   r[   rC   r>   r?   r@   appendr   DNS01rY   r	   r   r   r=   r   r]   r'   r^   r_   rc   rd   ra   r,   r&   )r   r   re   r"   r   r   r   !test_name1_http_01_1_dns_1_acme_1~   s    z:HandleAuthorizationsTest.test_name1_http_01_1_dns_1_acme_1c                 C   s   d| j _t | j j_| jjjt	j
 tdtjdd}tj|gd}| j|}| | j jjd | | j jjd | | jjjd | jjjd d }| t|d | |d jd | t|d d S )	NrV   rM   FrN   rR   r7   r   rX   )rE   rF   rZ   r[   rC   r>   r?   r@   rl   r   rm   rY   r	   r   r   r=   r   r]   r'   r^   r_   rc   rd   r&   r,   )r   r   re   Zcleaned_up_achallsr   r   r   !test_name1_http_01_1_dns_1_acme_2   s    z:HandleAuthorizationsTest.test_name1_http_01_1_dns_1_acme_2c                 C   s   t jttj|d| jj_tdtjdtdtjdtdtjdg}tj	|d}t
 | jj_| j|}| | jjjd | | jjjd | | jjjd | t|d d S )	N)rP   rQ   rM   rO   rP   12rR   rW   r7   )	functoolspartialrY   r	   r   rE   Zrequest_domain_challengesrC   r   r=   rZ   r[   r   r]   r'   r^   r_   r>   rc   r&   )r   rQ   authzrsre   r   r   r   r   _test_name3_http_01_3_common   s       z5HandleAuthorizationsTest._test_name3_http_01_3_commonc                 C   s   | j dd d S rg   )rv   rK   r   r   r   "test_name3_http_01_3_common_acme_1   s    z;HandleAuthorizationsTest.test_name3_http_01_3_common_acme_1c                 C   s   d| j _| jdd d S rj   )rE   rF   rv   rK   r   r   r   "test_name3_http_01_3_common_acme_2   s    z;HandleAuthorizationsTest.test_name3_http_01_3_common_acme_2c                 C   st   t jtjddtj tdtj	dg}tj
|d}t | jj_| j| | | jjjd | | jjjd d S )NTr4   rM   rp   rR   r7   )r9   r:   r;   r   r   r   r<   rY   r	   r   r=   rZ   rE   r[   rC   r   r]   r'   r^   r_   r8   Znotificationr   ru   re   r   r   r   test_debug_challenges   s    
 z.HandleAuthorizationsTest.test_debug_challengesc                 C   s@   t dtjdg}tj|d}tj| jj_	| 
tj| jj| d S NrM   rp   rR   )rY   r	   r   r   r=   r   AuthorizationErrorr>   rB   rC   r-   r   r]   ry   r   r   r   test_perform_failure   s      z-HandleAuthorizationsTest.test_perform_failurec              	   C   sl   t dtjdg}tj|d}tdd| jj_| 	t
j}| j|dd W 5 Q R X | dt|jk d S )	NrM   rp   rR   rV   )rT   Fr7   z0All authorizations were not finalized by the CA.)rY   r	   r   r   r=   rZ   rE   r[   rC   r-   r   r|   r   r]   ra   str	exceptionr   ru   re   errorr   r   r   test_max_retries_exceeded   s    z2HandleAuthorizationsTest.test_max_retries_exceededc                 C   s$   t jg d}| tj| jj| d S )NrR   )r   r=   r-   r   r|   r   r]   )r   re   r   r   r   test_no_domains   s    z(HandleAuthorizationsTest.test_no_domainsc                 C   s   t dtj|dg}tj|d}| jjjt	j
 | jjt	j
jt	jjf t | jj_| j| | | jjjd | | jjjd d d jd d S )NrM   rN   rR   r7   r   rX   )rY   r	   r   r   r=   r>   r?   r@   rl   r   r*   r   pref_challsextendr,   rm   rZ   rE   r[   rC   r]   r'   rc   r_   rd   r   rQ   ru   re   r   r   r   '_test_preferred_challenge_choice_common   s     z@HandleAuthorizationsTest._test_preferred_challenge_choice_commonc                 C   s   | j dd d S rg   )r   rK   r   r   r   -test_preferred_challenge_choice_common_acme_1   s    zFHandleAuthorizationsTest.test_preferred_challenge_choice_common_acme_1c                 C   s   d| j _| jdd d S rj   )rE   rF   r   rK   r   r   r   -test_preferred_challenge_choice_common_acme_2   s    zFHandleAuthorizationsTest.test_preferred_challenge_choice_common_acme_2c                 C   sH   t dtj|dg}tj|d}| jjtj	j
 | tj| jj| d S )NrM   rN   rR   )rY   r	   r   r   r=   r   r   rl   r   rm   r,   r-   r   r|   r]   r   r   r   r   /_test_preferred_challenges_not_supported_common   s      zHHandleAuthorizationsTest._test_preferred_challenges_not_supported_commonc                 C   s   | j dd d S rg   )r   rK   r   r   r   .test_preferred_challenges_not_supported_acme_1  s    zGHandleAuthorizationsTest.test_preferred_challenges_not_supported_acme_1c                 C   s   d| j _| jdd d S rj   )rE   rF   r   rK   r   r   r   .test_preferred_challenges_not_supported_acme_2
  s    zGHandleAuthorizationsTest.test_preferred_challenges_not_supported_acme_2c                 C   s6   t dtjgdg}tj|d}| tj| jj	| d S r{   )
rY   r	   rm   r   r=   r-   r   r|   r   r]   ry   r   r   r   %test_dns_only_challenge_not_supported  s      z>HandleAuthorizationsTest.test_dns_only_challenge_not_supportedc                 C   st   t j| jj_tdtjdd}tj	|gd}| 
t j| jj| | | jjjd | | jjjd d d jd d S )NrM   TrN   rR   r7   r   rX   )r   r|   r>   rB   rC   rY   r	   r   r   r=   r-   r   r]   r'   rc   r_   rd   r,   r   r   re   r   r   r   test_perform_error  s     z+HandleAuthorizationsTest.test_perform_errorc                 C   sr   t j| jj_tdtjdg}tj	|d}| 
t j| jj| | | jjjd | | jjjd d d jd d S )NrM   rp   rR   r7   r   rX   )r   r|   rE   r^   rC   rY   r	   r   r   r=   r-   r   r]   r'   r>   rc   r_   rd   r,   ry   r   r   r   test_answer_error  s       z*HandleAuthorizationsTest.test_answer_errorc              
   C   s   t dtjdg}tj|d}ttjd| jj	_
t , | tj}| j|d W 5 Q R X W 5 Q R X | dt|jk | | jjjd | | jjjd d d jd	 d S )
NrM   rp   rR   statusFzSome challenges have failed.r7   r   rX   )rY   r	   r   r   r=   rZ   r   STATUS_INVALIDrE   r[   rC   	test_utilpatch_get_utilityr-   r   r|   r   r]   ra   r~   r   r'   r>   rc   r_   rd   r,   r   r   r   r   test_incomplete_authzr_error+  s    
" z5HandleAuthorizationsTest.test_incomplete_authzr_errorc              
   C   s   dd }t dtjdt dtjdg}|| jj_tj|d}td}| j	
|d}W 5 Q R X | t|d	 | |jd	 ttjd
| jj_t , | tj}| j	
|d W 5 Q R X W 5 Q R X | dt|jk d S )Nc                 S   s2   t tj}t tj}| jjjdkr*|| S || S )zBThis mock will invalidate one authzr, and invalidate the other onewill-be-invalid)rZ   r   STATUS_VALIDr   body
identifiervalue)r   Z
valid_mockZinvalid_mockr   r   r   _conditional_mock_on_poll9  s
    

zLHandleAuthorizationsTest.test_best_effort.<locals>._conditional_mock_on_pollzwill-be-validrp   r   rR   z+certbot.auth_handler._report_failed_authzrsTr7   r   zAll challenges have failed.)rY   r	   r   rE   r[   rC   r   r=   r\   r   r]   r'   r&   r_   rZ   r   r   r   r   r-   r   r|   ra   r~   r   )r   r   ru   re   Zmock_reportZvalid_authzrr   r   r   r   test_best_effort8  s    


"z)HandleAuthorizationsTest.test_best_effortc                 C   sx   t tjdt jgtjgd}tj|gd}| tj	| j
j| t tjdt jgtjgd}tj|gd}| j
| d S )NrM   FrR   )r	   r   r   r   rm   r   r=   r-   r   r|   r   r]   r   r   r   r   r   "test_validated_challenge_not_rerunY  s,          z;HandleAuthorizationsTest.test_validated_challenge_not_rerunc                 C   s   dd }dt jfdt jfdt jfg}dd |D }tj|d}|| jj_| j	|\}}| 
| jjjd	 | 
t|d
 | 
t|d
 | 
|d jjjd | 
|d jjt j | 
|d jjjd | 
|d jjt j dS )zWhen we deactivate valid authzrs in an orderr, we expect them to become deactivated
        and to receive a list of deactivated authzrs in return.c                 S   sR   | j jtjkrD| j jjdkr&td| j jtj	d}tj
|d} n
td| S )Nis_valid_but_will_failzMock deactivation ACME errorr   )r   z Can't deactivate non-valid authz)r   r   r   r   r   r   acme_errorsr.   updateSTATUS_DEACTIVATEDZAuthorizationResourcer   )r   Zauthzbr   r   r   _mock_deactivateq  s    

zQHandleAuthorizationsTest.test_valid_authzrs_deactivated.<locals>._mock_deactivateZis_validZ
is_pendingr   c              	   S   s0   g | ](}t |d  |d t jg|d  dgqS )r7   r   F)r	   r   r*   )r!   ar   r   r   r#     s   
zKHandleAuthorizationsTest.test_valid_authzrs_deactivated.<locals>.<listcomp>rR   rV   r7   r   N)r   r   r   r   r=   rE   Zdeactivate_authorizationrC   r   Zdeactivate_valid_authorizationsr'   r_   r&   r   r   r   r   r   )r   r   Zto_deactivateZorderrru   Zfailedr   r   r   test_valid_authzrs_deactivatedn  s$    

z7HandleAuthorizationsTest.test_valid_authzrs_deactivatedN)r0   r1   r2   __doc__r   rL   rf   ri   rk   rn   ro   rv   rw   rx   rz   r}   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r3   ;   s8   	!r3   r7   c                    s   d|i  fdd}|S )Ncountc                    sv    d d  d<  d dk r nt j}t|| jjjdd | jjD |gt| jj | jj	}|t
jdtidfS )Nr   r7   r   c                 S   s   g | ]
}|j qS r   r   )r!   challbr   r   r   r#     s     z4_gen_mock_on_poll.<locals>._mock.<locals>.<listcomp>zRetry-After)Zheaders)r   r   r	   r   r   r   r   r   r&   combinationsr   r=   r~   )r   Zeffective_statusZupdated_azrstater   rU   r   r   _mock  s    z _gen_mock_on_poll.<locals>._mockr   )r   rT   rU   r   r   r   r   rZ     s    
rZ   c                   @   s    e Zd ZdZdd Zdd ZdS )ChallbToAchallTestz0Tests for certbot.auth_handler.challb_to_achall.c                 C   s   ddl m} ||ddS )Nr   )challb_to_achallaccount_keyrO   )r   r   )r   r   r   r   r   r   _call  s    zChallbToAchallTest._callc                 C   s&   |  | tjtjtjddd d S )Nr   rO   )r   r   rO   )r'   r   r	   HTTP01_Pr   Z"KeyAuthorizationAnnotatedChallengerK   r   r   r   test_it  s    
 zChallbToAchallTest.test_itN)r0   r1   r2   r   r   r   r   r   r   r   r     s   r   c                   @   s<   e Zd ZdZdd Zdd Zedd Zdd	 Zd
d Z	dS )GenChallengePathTestzTests for certbot.auth_handler.gen_challenge_path.

    .. todo:: Add more tests for dumb_path... depending on what we want to do.

    c                 C   s   t t j d S rI   )rG   rH   ZFATALrK   r   r   r   r     s    zGenChallengePathTest.setUpc                 C   s   t t j d S rI   rJ   rK   r   r   r   rL     s    zGenChallengePathTest.tearDownc                 C   s   ddl m} ||||S )Nr   )gen_challenge_path)r   r   )clschallbsZpreferencesr   r   r   r   r   r     s    zGenChallengePathTest._callc                 C   s   t jt jf}tjtjg}d}| | |||d | | ||d | | |ddd ||d | | |ddd |d dS )z/Given DNS01 and HTTP01 with appropriate combos.)r   r7   r   Nr   )	r	   DNS01_Pr   r   rm   r*   r'   r   ra   r   r   ZprefsrQ   r   r   r   test_common_case  s     z%GenChallengePathTest.test_common_casec                 C   sH   t jt jf}tjg}d}| tj| j||| | tj| j||d  d S )N))r   r7   )	r	   r   r   r   r*   r-   r   r|   r   r   r   r   r   test_not_supported  s"            z'GenChallengePathTest.test_not_supportedN)
r0   r1   r2   r   r   rL   classmethodr   r   r   r   r   r   r   r     s   
r   c                   @   s8   e Zd ZdZdd Ze dd Ze dd ZdS )	ReportFailedAuthzrsTestz6Tests for certbot.auth_handler._report_failed_authzrs.c                 C   s   t jdtjtjjdddd}| |d jd k	 tjf |}t j|d< tjf |}t	
 | _d| jjj_||g| jj_tjd	dd
|d< tjf |}t	
 | _d| jjj_|g| jj_d S )NuriZtlsdetail)r   )r   r   r   r   r   r   zexample.comZdnssec)r,   r   zfoo.bar)r	   r*   r   r   r.   Z	with_codera   ZdescriptionZChallengeBodyr   r=   authzr1r   r   r   r   authzr2)r   kwargsZhttp_01Zhttp_01_diffr   r   r   r     s"    


zReportFailedAuthzrsTest.setUpc                 C   sV   ddl m} || jgd | jj}| t|dk | d|d d d k d S )Nr   auth_handlerr   r7   z.Domain: example.com
Type:   tls
Detail: detail)certbotr   _report_failed_authzrsr   add_messagerb   ra   r&   )r   	mock_zoper   Z	call_listr   r   r   test_same_error_and_domain  s
    
z2ReportFailedAuthzrsTest.test_same_error_and_domainc                 C   s8   ddl m} || j| jgd | | jjdk d S )Nr   r   r   rV   )r   r   r   r   r   ra   r   r_   )r   r   r   r   r   r   !test_different_errors_and_domains  s    z9ReportFailedAuthzrsTest.test_different_errors_and_domainsN)	r0   r1   r2   r   r   r   r   r   r   r   r   r   r   r     s   
r   c                 C   s   dd | D S )z(Generate a dummy authorization response.c                 S   s   g | ]}d |j j|jf qS )z%s%s)	__class__r0   rO   )r!   r   r   r   r   r#     s   z!gen_auth_resp.<locals>.<listcomp>r   )Z
chall_listr   r   r   rA     s    rA   Tc                 C   s    t tj| |tjgt| |S )z!Generates new authzr for domains.)r	   r   r   r   r&   rN   r   r   r   rY     s       rY   __main__)T)!r   rs   rG   Zunittestr   Zzope.componentr9   Zacmer   r   rD   r   r   r   r   r   r   r   Zcertbot.testsr	   r   ZTestCaser
   r3   r   rZ   r   r   r   rA   rY   r0   mainr   r   r   r   <module>   s6   $  W+0

