websms/freeipa
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Imported Upstream version 4.8.10

Browse Source
This commit is contained in:
Mario Fetka
2021-10-03 11:06:28 +02:00
parent 10dfc9587b
commit 03a8170b15
2361 changed files with 1883897 additions and 338759 deletions
Download Patch File Download Diff File Expand all files Collapse all files

389
ipatests/test_xmlrpc/test_cert_plugin.py
View File

@@ -17,28 +17,35 @@
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
"""
Test the `ipalib/plugins/cert.py` module against a RA.
Test the `ipaserver/plugins/cert.py` module against a RA.
"""
from __future__ import print_function, absolute_import
import sys
import base64
import os
import shutil
from nose.tools import raises, assert_raises # pylint: disable=E0611
from xmlrpc_test import XMLRPC_test, assert_attr_equal
import pytest
import six
from ipalib import api
from ipalib import errors
from ipalib import x509
import tempfile
from ipapython import ipautil
import nose
import base64
from ipaplatform.paths import paths
from ipapython.certdb import NSSDatabase
from ipapython.dn import DN
from ipapython.ipautil import run
from ipatests.test_xmlrpc.testcert import subject_base
from ipatests.test_xmlrpc.xmlrpc_test import XMLRPC_test
if six.PY3:
unicode = str
# So we can save the cert from issuance and compare it later
cert = None
newcert = None
sn = None
_DOMAIN = api.env.domain
_EXP_CRL_URI = ''.join(['http://ipa-ca.', _DOMAIN, '/ipa/crl/MasterCRL.bin'])
_EXP_OCSP_URI = ''.join(['http://ipa-ca.', _DOMAIN, '/ca/ocsp'])
def is_db_configured():
"""
@@ -48,8 +55,8 @@ def is_db_configured():
aliasdir = api.env.dot_ipa + os.sep + 'alias' + os.sep + '.pwd'
if (api.env.xmlrpc_uri == u'http://localhost:8888/ipa/xml' and
not ipautil.file_exists(aliasdir)):
raise nose.SkipTest('developer CA not configured in %s' % aliasdir)
not os.path.isfile(aliasdir)):
pytest.skip('developer CA not configured in %s' % aliasdir)
# Test setup
#
@@ -60,66 +67,60 @@ def is_db_configured():
#
# To test against Dogtag CA in the lite-server:
#
# - Copy the 3 NSS db files from /etc/httpd/alias to ~/.ipa/alias
# - Copy /etc/httpd/alias/pwdfile.txt to ~/.ipa/alias/.pwd.
# - Copy the 3 NSS db files from /var/lib/ipa/radb to ~/.ipa/alias
# - Copy /var/lib/ipa/radb/pwdfile.txt to ~/.ipa/alias/.pwd.
# - Change ownership of these files to be readable by you.
#
# The API tested depends on the value of ~/.ipa/default/ra_plugin when
# running as the lite-server.
class test_cert(XMLRPC_test):
@classmethod
def setUpClass(cls):
super(test_cert, cls).setUpClass()
class BaseCert(XMLRPC_test):
host_fqdn = u'ipatestcert.%s' % api.env.domain
service_princ = u'test/%s@%s' % (host_fqdn, api.env.realm)
certfile = None
nssdb = None
reqfile = None
subject = None
@pytest.fixture(autouse=True, scope="class")
def basecert_setup(self, request, xmlrpc_setup):
if 'cert_request' not in api.Command:
raise nose.SkipTest('cert_request not registered')
pytest.skip('cert_request not registered')
if 'cert_show' not in api.Command:
pytest.skip('cert_show not registered')
is_db_configured()
def run_certutil(self, args, stdin=None):
new_args = [paths.CERTUTIL, "-d", self.reqdir]
new_args = new_args + args
return ipautil.run(new_args, stdin)
def setUp(self):
super(test_cert, self).setUp()
self.reqdir = tempfile.mkdtemp(prefix = "tmp-")
self.reqfile = self.reqdir + "/test.csr"
self.pwname = self.reqdir + "/pwd"
# Create an empty password file
fp = open(self.pwname, "w")
fp.write("\n")
fp.close()
@pytest.fixture(autouse=True)
def basecert_fsetup(self, request):
self.nssdb = NSSDatabase()
secdir = self.nssdb.secdir
self.reqfile = os.path.join(secdir, "test.csr")
self.certfile = os.path.join(secdir, "cert.crt")
# Create our temporary NSS database
self.run_certutil(["-N", "-f", self.pwname])
self.nssdb.create_db()
self.subject = DN(('CN', self.host_fqdn), subject_base())
self.subject = DN(('CN', self.host_fqdn), x509.subject_base())
def tearDown(self):
super(test_cert, self).tearDown()
shutil.rmtree(self.reqdir, ignore_errors=True)
def fin():
self.nssdb.close()
request.addfinalizer(fin)
def generateCSR(self, subject):
self.run_certutil(["-R", "-s", subject,
"-o", self.reqfile,
"-z", paths.GROUP,
"-f", self.pwname,
"-a",
])
fp = open(self.reqfile, "r")
data = fp.read()
fp.close()
return data
self.nssdb.run_certutil([
"-R", "-s", subject,
"-o", self.reqfile,
"-z", paths.GROUP,
"-a",
])
with open(self.reqfile, "rb") as f:
return f.read().decode('ascii')
@pytest.mark.tier1
class test_cert(BaseCert):
"""
Test the `cert` plugin.
"""
host_fqdn = u'ipatestcert.%s' % api.env.domain
service_princ = u'test/%s@%s' % (host_fqdn, api.env.realm)
def test_0001_cert_add(self):
"""
@@ -128,31 +129,32 @@ class test_cert(XMLRPC_test):
This should fail because the service principal doesn't exist
"""
# First create the host that will use this policy
res = api.Command['host_add'](self.host_fqdn, force= True)['result']
assert 'result' in api.Command['host_add'](self.host_fqdn, force=True)
csr = unicode(self.generateCSR(str(self.subject)))
with assert_raises(errors.NotFound):
res = api.Command['cert_request'](csr, principal=self.service_princ)
csr = self.generateCSR(str(self.subject))
with pytest.raises(errors.NotFound):
api.Command['cert_request'](csr, principal=self.service_princ)
def test_0002_cert_add(self):
"""
Test the `xmlrpc.cert_request` method with --add.
"""
# Our host should exist from previous test
global cert
global cert, sn
csr = unicode(self.generateCSR(str(self.subject)))
csr = self.generateCSR(str(self.subject))
res = api.Command['cert_request'](csr, principal=self.service_princ, add=True)['result']
assert DN(res['subject']) == self.subject
assert 'cacn' in res
# save the cert for the service_show/find tests
cert = res['certificate']
cert = res['certificate'].encode('ascii')
# save cert's SN for URI test
sn = res['serial_number']
def test_0003_service_show(self):
"""
Verify that service-show has the right certificate using service-show.
"""
global cert
res = api.Command['service_show'](self.service_princ)['result']
assert base64.b64encode(res['usercertificate'][0]) == cert
@@ -160,37 +162,99 @@ class test_cert(XMLRPC_test):
"""
Verify that service-find has the right certificate using service-find.
"""
global cert
# Assume there is only one service
res = api.Command['service_find'](self.service_princ)['result']
assert base64.b64encode(res[0]['usercertificate'][0]) == cert
def test_0005_cert_renew(self):
def test_0005_cert_uris(self):
"""Test URI details and OCSP-URI in certificate.
See https://fedorahosted.org/freeipa/ticket/5881
"""
result = api.Command.cert_show(sn, out=unicode(self.certfile))
with open(self.certfile, "rb") as f:
pem_cert = f.read().decode('ascii')
result = run([paths.OPENSSL, 'x509', '-text'],
stdin=pem_cert, capture_output=True)
assert _EXP_CRL_URI in result.output
assert _EXP_OCSP_URI in result.output
def test_0006_cert_renew(self):
"""
Issue a new certificate for a service
"""
global newcert
csr = unicode(self.generateCSR(str(self.subject)))
csr = self.generateCSR(str(self.subject))
res = api.Command['cert_request'](csr, principal=self.service_princ)['result']
assert DN(res['subject']) == self.subject
# save the cert for the service_show/find tests
newcert = res['certificate']
newcert = res['certificate'].encode('ascii')
def test_0006_service_show(self):
def test_0007_service_show(self):
"""
Verify the new certificate with service-show.
"""
global cert, newcert
res = api.Command['service_show'](self.service_princ)['result']
# It should no longer match our old cert
assert base64.b64encode(res['usercertificate'][0]) != cert
# And it should match the new one
assert base64.b64encode(res['usercertificate'][0]) == newcert
def test_0007_cleanup(self):
# Both the old and the new certs should be listed as certificates now
certs_encoded = (
base64.b64encode(usercert) for usercert in res['usercertificate']
)
assert set(certs_encoded) == set([cert, newcert])
def test_0008_cert_show(self):
"""
Verify that cert-show shows CA of the certificate without --all
"""
res = api.Command['cert_show'](sn)['result']
assert 'cacn' in res
assert 'valid_not_before' in res
assert 'valid_not_after' in res
def test_0009_cert_find(self):
"""
Verify that cert-find shows CA of the certificate without --all
"""
res = api.Command['cert_find'](min_serial_number=sn,
max_serial_number=sn)['result'][0]
assert 'cacn' in res
assert 'valid_not_before' in res
assert 'valid_not_after' in res
def test_00010_san_in_cert(self):
"""
Test if SAN extension is automatically added with default profile.
"""
csr = self.generateCSR(str(self.subject))
res = api.Command[
'cert_request'](csr, principal=self.service_princ)['result']
assert 'san_dnsname' in res
def test_00011_emails_are_valid(self):
"""
Verify the different scenarios when checking if any email addr
from DN or SAN extension does not appear in ldap entry.
"""
from ipaserver.plugins.cert import _emails_are_valid
email_addrs = [u'any@EmAiL.CoM']
result = _emails_are_valid(email_addrs, [u'any@email.com'])
assert result
email_addrs = [u'any@EmAiL.CoM']
result = _emails_are_valid(email_addrs, [u'any@email.com',
u'another@email.com'])
assert result
result = _emails_are_valid([], [u'any@email.com'])
assert result
email_addrs = [u'invalidEmailAddress']
result = _emails_are_valid(email_addrs, [])
assert not result
def test_99999_cleanup(self):
"""
Clean up cert test data
"""
@@ -201,24 +265,23 @@ class test_cert(XMLRPC_test):
res = api.Command['service_find'](self.service_princ)
assert res['count'] == 0
@pytest.mark.tier1
class test_cert_find(XMLRPC_test):
@classmethod
def setUpClass(cls):
super(test_cert_find, cls).setUpClass()
if 'cert_find' not in api.Command:
raise nose.SkipTest('cert_find not registered')
if api.env.ra_plugin != 'dogtag':
raise nose.SkipTest('cert_find for dogtag CA only')
is_db_configured()
"""
Test the `cert-find` command.
"""
short = api.env.host.replace('.' + api.env.domain, '')
@pytest.fixture(autouse=True, scope="class")
def certfind_setup(self, request, xmlrpc_setup):
if 'cert_find' not in api.Command:
pytest.skip('cert_find not registered')
if api.env.ra_plugin != 'dogtag':
pytest.skip('cert_find for dogtag CA only')
is_db_configured()
short = api.env.host.split('.')[0]
def test_0001_find_all(self):
"""
@@ -242,6 +305,8 @@ class test_cert_find(XMLRPC_test):
Search for the OCSP certificate.
"""
res = api.Command['cert_find'](subject=u'OCSP Subsystem')
assert 'count' in res
assert res['count'], "No OSCP certificate found"
def test_0004_find_this_host(self):
"""
@@ -264,80 +329,7 @@ class test_cert_find(XMLRPC_test):
res = api.Command['cert_find'](subject=self.short, exactly=True)
assert 'count' in res and res['count'] == 0
def test_0007_find_revocation_reason_0(self):
"""
Find all certificates with revocation reason 0
"""
res = api.Command['cert_find'](revocation_reason=0)
assert 'count' in res and res['count'] == 0
def test_0008_find_revocation_reason_1(self):
"""
Find all certificates with revocation reason 1
"""
res = api.Command['cert_find'](revocation_reason=1)
assert 'count' in res and res['count'] == 0
def test_0009_find_revocation_reason_2(self):
"""
Find all certificates with revocation reason 2
"""
res = api.Command['cert_find'](revocation_reason=2)
assert 'count' in res and res['count'] == 0
def test_0010_find_revocation_reason_3(self):
"""
Find all certificates with revocation reason 3
"""
res = api.Command['cert_find'](revocation_reason=3)
assert 'count' in res and res['count'] == 0
def test_0011_find_revocation_reason_4(self):
"""
Find all certificates with revocation reason 4
There is no way to know in advance how many revoked certificates
we'll have but in the context of make-test we'll have at least one.
"""
res = api.Command['cert_find'](revocation_reason=4)
assert 'count' in res and res['count'] >= 1
def test_0012_find_revocation_reason_5(self):
"""
Find all certificates with revocation reason 5
"""
res = api.Command['cert_find'](revocation_reason=5)
assert 'count' in res and res['count'] == 0
def test_0013_find_revocation_reason_6(self):
"""
Find all certificates with revocation reason 6
"""
res = api.Command['cert_find'](revocation_reason=6)
assert 'count' in res and res['count'] == 0
# There is no revocation reason #7
def test_0014_find_revocation_reason_8(self):
"""
Find all certificates with revocation reason 8
"""
res = api.Command['cert_find'](revocation_reason=8)
assert 'count' in res and res['count'] == 0
def test_0015_find_revocation_reason_9(self):
"""
Find all certificates with revocation reason 9
"""
res = api.Command['cert_find'](revocation_reason=9)
assert 'count' in res and res['count'] == 0
def test_0016_find_revocation_reason_10(self):
"""
Find all certificates with revocation reason 10
"""
res = api.Command['cert_find'](revocation_reason=10)
assert 'count' in res and res['count'] == 0
# tests 0007 to 0016 removed
def test_0017_find_by_issuedon(self):
"""
@@ -423,15 +415,16 @@ class test_cert_find(XMLRPC_test):
"""
Search with a sizelimit of 0
"""
count_all = api.Command['cert_find']()['count']
res = api.Command['cert_find'](sizelimit=0)
assert 'count' in res and res['count'] == 0
assert 'count' in res and res['count'] == count_all
@raises(errors.ValidationError)
def test_0028_find_negative_size(self):
"""
Search with a negative sizelimit
"""
res = api.Command['cert_find'](sizelimit=-100)
with pytest.raises(errors.ValidationError):
api.Command['cert_find'](sizelimit=-100)
def test_0029_search_for_notfound(self):
"""
@@ -447,9 +440,67 @@ class test_cert_find(XMLRPC_test):
res = api.Command['cert_find'](subject=u'ipatestcert.%s' % api.env.domain)
assert 'count' in res and res['count'] >= 1
@raises(errors.ValidationError)
def test_0031_search_on_invalid_date(self):
"""
Search using invalid date format
"""
res = api.Command['cert_find'](issuedon_from=u'xyz')
with pytest.raises(errors.ConversionError):
api.Command['cert_find'](issuedon_from=u'xyz')
@pytest.mark.tier1
class test_cert_revocation(BaseCert):
# create CSR, request cert, revoke cert, check cert attributes
def revoke_cert(self, reason):
# add host
assert 'result' in api.Command['host_add'](self.host_fqdn, force=True)
# generate CSR, request certificate, obtain serial number
self.csr = self.generateCSR(str(self.subject))
res = api.Command['cert_request'](self.csr,
principal=self.service_princ,
add=True, all=True)['result']
serial_number = res['serial_number']
# revoke created certificate
assert 'result' in api.Command['cert_revoke'](
serial_number, revocation_reason=reason)
# verify that certificate is revoked with correct reason
res2 = api.Command['cert_show'](serial_number, all=True)['result']
assert res2['revoked']
assert res2['revocation_reason'] == reason
# remove host
assert 'result' in api.Command['host_del'](self.host_fqdn)
def test_revoke_with_reason_0(self):
self.revoke_cert(0)
def test_revoke_with_reason_1(self):
self.revoke_cert(1)
def test_revoke_with_reason_2(self):
self.revoke_cert(2)
def test_revoke_with_reason_3(self):
self.revoke_cert(3)
def test_revoke_with_reason_4(self):
self.revoke_cert(4)
def test_revoke_with_reason_5(self):
self.revoke_cert(5)
def test_revoke_with_reason_6(self):
self.revoke_cert(6)
def test_revoke_with_reason_8(self):
self.revoke_cert(8)
def test_revoke_with_reason_9(self):
self.revoke_cert(9)
def test_revoke_with_reason_10(self):
self.revoke_cert(10)