"""Tests for certbot._internal.auth_handler.""" import datetime import logging import sys import unittest from unittest import mock from josepy import b64encode import pytest from acme import challenges from acme import client as acme_client from acme import errors as acme_errors from acme import messages from certbot import achallenges from certbot import errors from certbot._internal.display import obj as display_obj from certbot.plugins import common as plugin_common from certbot.tests import acme_util from certbot.tests import util as test_util class ChallengeFactoryTest(unittest.TestCase): # pylint: disable=protected-access def setUp(self): from certbot._internal.auth_handler import AuthHandler # Account is mocked... self.handler = AuthHandler(None, None, mock.Mock(key="mock_key"), []) self.authzr = acme_util.gen_authzr( messages.STATUS_PENDING, "test", acme_util.CHALLENGES, [messages.STATUS_PENDING] * 6) def test_all(self): achalls = self.handler._challenge_factory( self.authzr, range(0, len(acme_util.CHALLENGES))) assert [achall.chall for achall in achalls] == acme_util.CHALLENGES def test_one_http(self): achalls = self.handler._challenge_factory(self.authzr, [0]) assert [achall.chall for achall in achalls] == [acme_util.HTTP01] def test_unrecognized(self): authzr = acme_util.gen_authzr( messages.STATUS_PENDING, "test", [mock.Mock(chall="chall", typ="unrecognized")], [messages.STATUS_PENDING]) achalls = self.handler._challenge_factory(authzr, [0]) assert type(achalls[0]) == achallenges.Other class HandleAuthorizationsTest(unittest.TestCase): """handle_authorizations test. This tests everything except for all functions under _poll_challenges. """ def setUp(self): from certbot._internal.auth_handler import AuthHandler self.mock_display = mock.Mock() self.mock_config = mock.Mock(debug_challenges=False) display_obj.set_display(self.mock_display) self.mock_auth = mock.MagicMock(name="Authenticator") self.mock_auth.get_chall_pref.return_value = [challenges.HTTP01] self.mock_auth.perform.side_effect = gen_auth_resp self.mock_account = mock.MagicMock() self.mock_net = mock.MagicMock(spec=acme_client.ClientV2) self.mock_net.retry_after.side_effect = acme_client.ClientV2.retry_after self.handler = AuthHandler( self.mock_auth, self.mock_net, self.mock_account, []) logging.disable(logging.CRITICAL) def tearDown(self): logging.disable(logging.NOTSET) def _test_name1_http_01_1_common(self): authzr = gen_dom_authzr(domain="0", challs=acme_util.CHALLENGES) mock_order = mock.MagicMock(authorizations=[authzr]) self.mock_net.poll.side_effect = _gen_mock_on_poll(retry=1, wait_value=30) with mock.patch('certbot._internal.auth_handler.time') as mock_time: authzr = self.handler.handle_authorizations(mock_order, self.mock_config) assert self.mock_net.answer_challenge.call_count == 1 assert self.mock_net.poll.call_count == 2 # Because there is one retry assert mock_time.sleep.call_count == 2 # Retry-After header is 30 seconds, but at the time sleep is invoked, several # instructions are executed, and next pool is in less than 30 seconds. assert mock_time.sleep.call_args_list[1][0][0] <= 30 # However, assert that we did not took the default value of 3 seconds. assert mock_time.sleep.call_args_list[1][0][0] > 3 assert self.mock_auth.cleanup.call_count == 1 # Test if list first element is http-01, use typ because it is an achall assert self.mock_auth.cleanup.call_args[0][0][0].typ == "http-01" assert len(authzr) == 1 def test_name1_http_01_1_acme_2(self): self._test_name1_http_01_1_common() def test_name1_http_01_1_dns_1_acme_2(self): self.mock_net.poll.side_effect = _gen_mock_on_poll() self.mock_auth.get_chall_pref.return_value.append(challenges.DNS01) authzr = gen_dom_authzr(domain="0", challs=acme_util.CHALLENGES) mock_order = mock.MagicMock(authorizations=[authzr]) authzr = self.handler.handle_authorizations(mock_order, self.mock_config) assert self.mock_net.answer_challenge.call_count == 1 assert self.mock_net.poll.call_count == 1 assert self.mock_auth.cleanup.call_count == 1 cleaned_up_achalls = self.mock_auth.cleanup.call_args[0][0] assert len(cleaned_up_achalls) == 1 assert cleaned_up_achalls[0].typ == "http-01" # Length of authorizations list assert len(authzr) == 1 def test_name3_http_01_3_common_acme_2(self): authzrs = [gen_dom_authzr(domain="0", challs=acme_util.CHALLENGES), gen_dom_authzr(domain="1", challs=acme_util.CHALLENGES), gen_dom_authzr(domain="2", challs=acme_util.CHALLENGES)] mock_order = mock.MagicMock(authorizations=authzrs) self.mock_net.poll.side_effect = _gen_mock_on_poll() authzr = self.handler.handle_authorizations(mock_order, self.mock_config) assert self.mock_net.answer_challenge.call_count == 3 # Check poll call assert self.mock_net.poll.call_count == 3 assert self.mock_auth.cleanup.call_count == 1 assert len(authzr) == 3 def test_debug_challenges(self): config = mock.Mock(debug_challenges=True, verbose_count=0) authzrs = [gen_dom_authzr(domain="0", challs=acme_util.CHALLENGES)] mock_order = mock.MagicMock(authorizations=authzrs) account_key_thumbprint = b"foobarbaz" self.mock_account.key.thumbprint.return_value = account_key_thumbprint self.mock_net.poll.side_effect = _gen_mock_on_poll() self.handler.handle_authorizations(mock_order, config) assert self.mock_net.answer_challenge.call_count == 1 assert self.mock_display.notification.call_count == 1 assert 'Pass "-v" for more info' in \ self.mock_display.notification.call_args[0][0] assert f"http://{authzrs[0].body.identifier.value}/.well-known/acme-challenge/" + \ b64encode(authzrs[0].body.challenges[0].chall.token).decode() not in \ self.mock_display.notification.call_args[0][0] assert b64encode(account_key_thumbprint).decode() not in \ self.mock_display.notification.call_args[0][0] def test_debug_challenges_verbose(self): config = mock.Mock(debug_challenges=True, verbose_count=1) authzrs = [gen_dom_authzr(domain="0", challs=[acme_util.HTTP01]), gen_dom_authzr(domain="1", challs=[acme_util.DNS01])] mock_order = mock.MagicMock(authorizations=authzrs) account_key_thumbprint = b"foobarbaz" self.mock_account.key.thumbprint.return_value = account_key_thumbprint self.mock_net.poll.side_effect = _gen_mock_on_poll() self.mock_auth.get_chall_pref.return_value = [challenges.HTTP01, challenges.DNS01] self.handler.handle_authorizations(mock_order, config) assert self.mock_net.answer_challenge.call_count == 2 assert self.mock_display.notification.call_count == 1 assert 'Pass "-v" for more info' not in \ self.mock_display.notification.call_args[0][0] assert f"http://{authzrs[0].body.identifier.value}/.well-known/acme-challenge/" + \ b64encode(authzrs[0].body.challenges[0].chall.token).decode() in \ self.mock_display.notification.call_args[0][0] assert b64encode(account_key_thumbprint).decode() in \ self.mock_display.notification.call_args[0][0] assert f"_acme-challenge.{authzrs[1].body.identifier.value}" in \ self.mock_display.notification.call_args[0][0] assert authzrs[1].body.challenges[0].validation(self.mock_account.key) in \ self.mock_display.notification.call_args[0][0] def test_perform_failure(self): authzrs = [gen_dom_authzr(domain="0", challs=acme_util.CHALLENGES)] mock_order = mock.MagicMock(authorizations=authzrs) self.mock_auth.perform.side_effect = errors.AuthorizationError with pytest.raises(errors.AuthorizationError): self.handler.handle_authorizations(mock_order, self.mock_config) def test_max_retries_exceeded(self): authzrs = [gen_dom_authzr(domain="0", challs=acme_util.CHALLENGES)] mock_order = mock.MagicMock(authorizations=authzrs) # We will return STATUS_PENDING twice before returning STATUS_VALID. self.mock_net.poll.side_effect = _gen_mock_on_poll(retry=2) with pytest.raises(errors.AuthorizationError, match='All authorizations were not finalized by the CA.'): # We retry only once, so retries will be exhausted before STATUS_VALID is returned. self.handler.handle_authorizations(mock_order, self.mock_config, False, 1) @mock.patch('certbot._internal.auth_handler.time.sleep') def test_deadline_exceeded(self, mock_sleep): authzrs = [gen_dom_authzr(domain="0", challs=acme_util.CHALLENGES)] mock_order = mock.MagicMock(authorizations=authzrs) orig_now = datetime.datetime.now state = {'time_slept': 0} def mock_sleep_effect(secs): state['time_slept'] += secs mock_sleep.side_effect = mock_sleep_effect def mock_now_effect(): return orig_now() + datetime.timedelta(seconds=state["time_slept"]) # We will return STATUS_PENDING and ask Certbot to sleep for 20 minutes at a time. interval = datetime.timedelta(minutes=20).seconds self.mock_net.poll.side_effect = _gen_mock_on_poll(status=messages.STATUS_PENDING, wait_value=interval) with pytest.raises(errors.AuthorizationError, match='All authorizations were not finalized by the CA.'): with mock.patch('certbot._internal.auth_handler.datetime.datetime') as mock_dt: mock_dt.now.side_effect = mock_now_effect # Polling will only proceed for 30 minutes at most, so the second 20 minute sleep # should be truncated and the polling should be aborted. self.handler.handle_authorizations(mock_order, self.mock_config, False) assert mock_sleep.call_count == 3 # 1s, 20m and 10m sleep assert mock_sleep.call_args_list[0][0][0] == 1 assert abs(mock_sleep.call_args_list[1][0][0] - (interval - 1)) <= 1 assert abs(mock_sleep.call_args_list[2][0][0] - (interval/2 - 1)) <= 1 def test_no_domains(self): mock_order = mock.MagicMock(authorizations=[]) with pytest.raises(errors.AuthorizationError): self.handler.handle_authorizations(mock_order, self.mock_config) def test_preferred_challenge_choice_common_acme_2(self): authzrs = [gen_dom_authzr(domain="0", challs=acme_util.CHALLENGES)] mock_order = mock.MagicMock(authorizations=authzrs) self.mock_auth.get_chall_pref.return_value.append(challenges.HTTP01) self.handler.pref_challs.extend((challenges.HTTP01.typ, challenges.DNS01.typ,)) self.mock_net.poll.side_effect = _gen_mock_on_poll() self.handler.handle_authorizations(mock_order, self.mock_config) assert self.mock_auth.cleanup.call_count == 1 assert self.mock_auth.cleanup.call_args[0][0][0].typ == "http-01" def test_preferred_challenges_not_supported_acme_2(self): authzrs = [gen_dom_authzr(domain="0", challs=acme_util.CHALLENGES)] mock_order = mock.MagicMock(authorizations=authzrs) self.handler.pref_challs.append(challenges.DNS01.typ) with pytest.raises(errors.AuthorizationError): self.handler.handle_authorizations(mock_order, self.mock_config) def test_dns_only_challenge_not_supported(self): authzrs = [gen_dom_authzr(domain="0", challs=[acme_util.DNS01])] mock_order = mock.MagicMock(authorizations=authzrs) with pytest.raises(errors.AuthorizationError): self.handler.handle_authorizations(mock_order, self.mock_config) def test_perform_error(self): self.mock_auth.perform.side_effect = errors.AuthorizationError authzr = gen_dom_authzr(domain="0", challs=acme_util.CHALLENGES) mock_order = mock.MagicMock(authorizations=[authzr]) with pytest.raises(errors.AuthorizationError): self.handler.handle_authorizations(mock_order, self.mock_config) assert self.mock_auth.cleanup.call_count == 1 assert self.mock_auth.cleanup.call_args[0][0][0].typ == "http-01" def test_answer_error(self): self.mock_net.answer_challenge.side_effect = errors.AuthorizationError authzrs = [gen_dom_authzr(domain="0", challs=acme_util.CHALLENGES)] mock_order = mock.MagicMock(authorizations=authzrs) with pytest.raises(errors.AuthorizationError): self.handler.handle_authorizations(mock_order, self.mock_config) assert self.mock_auth.cleanup.call_count == 1 assert self.mock_auth.cleanup.call_args[0][0][0].typ == "http-01" def test_incomplete_authzr_error(self): authzrs = [gen_dom_authzr(domain="0", challs=acme_util.CHALLENGES)] mock_order = mock.MagicMock(authorizations=authzrs) self.mock_net.poll.side_effect = _gen_mock_on_poll(status=messages.STATUS_INVALID) with test_util.patch_display_util(): with pytest.raises(errors.AuthorizationError, match='Some challenges have failed.'): self.handler.handle_authorizations(mock_order, self.mock_config, False) assert self.mock_auth.cleanup.call_count == 1 assert self.mock_auth.cleanup.call_args[0][0][0].typ == "http-01" def test_best_effort(self): def _conditional_mock_on_poll(authzr): """This mock will invalidate one authzr, and invalidate the other one""" valid_mock = _gen_mock_on_poll(messages.STATUS_VALID) invalid_mock = _gen_mock_on_poll(messages.STATUS_INVALID) if authzr.body.identifier.value == 'will-be-invalid': return invalid_mock(authzr) return valid_mock(authzr) # Two authzrs. Only one will be valid. authzrs = [gen_dom_authzr(domain="will-be-valid", challs=acme_util.CHALLENGES), gen_dom_authzr(domain="will-be-invalid", challs=acme_util.CHALLENGES)] self.mock_net.poll.side_effect = _conditional_mock_on_poll mock_order = mock.MagicMock(authorizations=authzrs) with mock.patch('certbot._internal.auth_handler.AuthHandler._report_failed_authzrs') \ as mock_report: valid_authzr = self.handler.handle_authorizations(mock_order, self.mock_config, True) # Because best_effort=True, we did not blow up. Instead ... assert len(valid_authzr) == 1 # ... the valid authzr has been processed assert mock_report.call_count == 1 # ... the invalid authzr has been reported self.mock_net.poll.side_effect = _gen_mock_on_poll(status=messages.STATUS_INVALID) with test_util.patch_display_util(): with pytest.raises(errors.AuthorizationError, match='All challenges have failed.'): # Despite best_effort=True, process will fail because no authzr is valid. self.handler.handle_authorizations(mock_order, self.mock_config, True) def test_validated_challenge_not_rerun(self): # With a pending challenge that is not supported by the plugin, we # expect an exception to be raised. authzr = acme_util.gen_authzr( messages.STATUS_PENDING, "0", [acme_util.DNS01], [messages.STATUS_PENDING]) mock_order = mock.MagicMock(authorizations=[authzr]) with pytest.raises(errors.AuthorizationError): self.handler.handle_authorizations(mock_order, self.mock_config) # With a validated challenge that is not supported by the plugin, we # expect the challenge to not be solved again and # handle_authorizations() to succeed. authzr = acme_util.gen_authzr( messages.STATUS_VALID, "0", [acme_util.DNS01], [messages.STATUS_VALID]) mock_order = mock.MagicMock(authorizations=[authzr]) self.handler.handle_authorizations(mock_order, self.mock_config) def test_valid_authzrs_deactivated(self): """When we deactivate valid authzrs in an orderr, we expect them to become deactivated and to receive a list of deactivated authzrs in return.""" def _mock_deactivate(authzr): if authzr.body.status == messages.STATUS_VALID: if authzr.body.identifier.value == "is_valid_but_will_fail": raise acme_errors.Error("Mock deactivation ACME error") authzb = authzr.body.update(status=messages.STATUS_DEACTIVATED) authzr = messages.AuthorizationResource(body=authzb) else: # pragma: no cover raise errors.Error("Can't deactivate non-valid authz") return authzr to_deactivate = [("is_valid", messages.STATUS_VALID), ("is_pending", messages.STATUS_PENDING), ("is_valid_but_will_fail", messages.STATUS_VALID)] to_deactivate = [acme_util.gen_authzr(a[1], a[0], [acme_util.HTTP01], [a[1]]) for a in to_deactivate] orderr = mock.MagicMock(authorizations=to_deactivate) self.mock_net.deactivate_authorization.side_effect = _mock_deactivate authzrs, failed = self.handler.deactivate_valid_authorizations(orderr) assert self.mock_net.deactivate_authorization.call_count == 2 assert len(authzrs) == 1 assert len(failed) == 1 assert authzrs[0].body.identifier.value == "is_valid" assert authzrs[0].body.status == messages.STATUS_DEACTIVATED assert failed[0].body.identifier.value == "is_valid_but_will_fail" assert failed[0].body.status == messages.STATUS_VALID def _gen_mock_on_poll(status=messages.STATUS_VALID, retry=0, wait_value=1): state = {'count': retry} def _mock(authzr): state['count'] = state['count'] - 1 effective_status = status if state['count'] < 0 else messages.STATUS_PENDING updated_azr = acme_util.gen_authzr( effective_status, authzr.body.identifier.value, [challb.chall for challb in authzr.body.challenges], [effective_status] * len(authzr.body.challenges)) return updated_azr, mock.MagicMock(headers={'Retry-After': str(wait_value)}) return _mock class ChallbToAchallTest(unittest.TestCase): """Tests for certbot._internal.auth_handler.challb_to_achall.""" def _call(self, challb): from certbot._internal.auth_handler import challb_to_achall return challb_to_achall(challb, "account_key", "domain") def test_it(self): assert self._call(acme_util.HTTP01_P) == \ achallenges.KeyAuthorizationAnnotatedChallenge( challb=acme_util.HTTP01_P, account_key="account_key", domain="domain") class GenChallengePathTest(unittest.TestCase): """Tests for certbot._internal.auth_handler.gen_challenge_path. """ def setUp(self): logging.disable(logging.FATAL) def tearDown(self): logging.disable(logging.NOTSET) @classmethod def _call(cls, challbs, preferences): from certbot._internal.auth_handler import gen_challenge_path return gen_challenge_path(challbs, preferences) def test_common_case(self): """Given DNS01 and HTTP01 with appropriate combos.""" challbs = (acme_util.DNS01_P, acme_util.HTTP01_P) prefs = [challenges.DNS01, challenges.HTTP01] assert self._call(challbs, prefs) == (0,) assert self._call(challbs[::-1], prefs) == (1,) def test_not_supported(self): challbs = (acme_util.DNS01_P,) prefs = [challenges.HTTP01] # smart path fails because no challs in prefs satisfies combos with pytest.raises(errors.AuthorizationError): self._call(challbs, prefs) class ReportFailedAuthzrsTest(unittest.TestCase): """Tests for certbot._internal.auth_handler.AuthHandler._report_failed_authzrs.""" # pylint: disable=protected-access def setUp(self): from certbot._internal.auth_handler import AuthHandler self.mock_auth = mock.MagicMock(spec=plugin_common.Plugin, name="buzz") self.mock_auth.name = "buzz" self.mock_auth.auth_hint.return_value = "the buzz hint" self.handler = AuthHandler(self.mock_auth, mock.MagicMock(), mock.MagicMock(), []) kwargs = { "chall": acme_util.HTTP01, "uri": "uri", "status": messages.STATUS_INVALID, "error": messages.Error.with_code("tls", detail="detail"), } # Prevent future regressions if the error type changes assert kwargs["error"].description is not None http_01 = messages.ChallengeBody(**kwargs) kwargs["chall"] = acme_util.HTTP01 http_01 = messages.ChallengeBody(**kwargs) self.authzr1 = mock.MagicMock() self.authzr1.body.identifier.value = 'example.com' self.authzr1.body.challenges = [http_01, http_01] kwargs["error"] = messages.Error.with_code("dnssec", detail="detail") http_01_diff = messages.ChallengeBody(**kwargs) self.authzr2 = mock.MagicMock() self.authzr2.body.identifier.value = 'foo.bar' self.authzr2.body.challenges = [http_01_diff] @mock.patch('certbot._internal.auth_handler.display_util.notify') def test_same_error_and_domain(self, mock_notify): self.handler._report_failed_authzrs([self.authzr1]) mock_notify.assert_called_with( '\n' 'Certbot failed to authenticate some domains (authenticator: buzz). ' 'The Certificate Authority reported these problems:\n' ' Domain: example.com\n' ' Type: tls\n' ' Detail: detail\n' '\n' ' Domain: example.com\n' ' Type: tls\n' ' Detail: detail\n' '\nHint: the buzz hint\n' ) @mock.patch('certbot._internal.auth_handler.display_util.notify') def test_different_errors_and_domains(self, mock_notify): self.mock_auth.name = "quux" self.mock_auth.auth_hint.return_value = "quuuuuux" self.handler._report_failed_authzrs([self.authzr1, self.authzr2]) mock_notify.assert_called_with( '\n' 'Certbot failed to authenticate some domains (authenticator: quux). ' 'The Certificate Authority reported these problems:\n' ' Domain: foo.bar\n' ' Type: dnssec\n' ' Detail: detail\n' '\n' ' Domain: example.com\n' ' Type: tls\n' ' Detail: detail\n' '\n' ' Domain: example.com\n' ' Type: tls\n' ' Detail: detail\n' '\nHint: quuuuuux\n' ) @mock.patch('certbot._internal.auth_handler.display_util.notify') def test_non_subclassed_authenticator(self, mock_notify): """If authenticator not derived from common.Plugin, we shouldn't call .auth_hint""" from certbot._internal.auth_handler import AuthHandler self.mock_auth = mock.MagicMock(name="quuz") self.mock_auth.name = "quuz" self.mock_auth.auth_hint.side_effect = Exception self.handler = AuthHandler(self.mock_auth, mock.MagicMock(), mock.MagicMock(), []) self.handler._report_failed_authzrs([self.authzr1]) assert mock_notify.call_count == 1 def gen_auth_resp(chall_list): """Generate a dummy authorization response.""" return ["%s%s" % (chall.__class__.__name__, chall.domain) for chall in chall_list] def gen_dom_authzr(domain, challs): """Generates new authzr for domains.""" return acme_util.gen_authzr( messages.STATUS_PENDING, domain, challs, [messages.STATUS_PENDING] * len(challs)) if __name__ == "__main__": sys.exit(pytest.main(sys.argv[1:] + [__file__])) # pragma: no cover SIMPAN PERUBAHAN