~bzr-pqm/bzr/bzr.dev

6437.25.1 by Vincent Ladeuil
Provide default paths for ca certs for supported platforms
1
# Copyright (C) 2011,2012 Canonical Ltd
6238.2.10 by Jelmer Vernooij
Add more tests for ssl.ca_certs option.
2
#
3
# This program is free software; you can redistribute it and/or modify
4
# it under the terms of the GNU General Public License as published by
5
# the Free Software Foundation; either version 2 of the License, or
6
# (at your option) any later version.
7
#
8
# This program is distributed in the hope that it will be useful,
9
# but WITHOUT ANY WARRANTY; without even the implied warranty of
10
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
11
# GNU General Public License for more details.
12
#
13
# You should have received a copy of the GNU General Public License
14
# along with this program; if not, write to the Free Software
15
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
16
17
"""Tests for the SSL support in the urllib HTTP transport.
18
19
"""
20
6238.2.19 by Vincent Ladeuil
Just hack the tests until they pass.
21
import os
6238.2.10 by Jelmer Vernooij
Add more tests for ssl.ca_certs option.
22
import ssl
23
6238.2.19 by Vincent Ladeuil
Just hack the tests until they pass.
24
from bzrlib import (
25
    config,
26
    trace,
27
    )
6238.2.11 by Jelmer Vernooij
add basic tests for match_hostname.
28
from bzrlib.errors import (
29
    CertificateError,
30
    ConfigOptionValueError,
31
    )
32
from bzrlib.tests import (
33
    TestCase,
34
    TestCaseInTempDir,
35
    )
6238.2.10 by Jelmer Vernooij
Add more tests for ssl.ca_certs option.
36
from bzrlib.transport.http import _urllib2_wrappers
37
38
39
class CaCertsConfigTests(TestCaseInTempDir):
40
6238.2.19 by Vincent Ladeuil
Just hack the tests until they pass.
41
    def get_stack(self, content):
42
        return config.MemoryStack(content.encode('utf-8'))
43
6238.2.10 by Jelmer Vernooij
Add more tests for ssl.ca_certs option.
44
    def test_default_exists(self):
6437.25.1 by Vincent Ladeuil
Provide default paths for ca certs for supported platforms
45
        """Check that the default we provide exists for the tested platform."""
6238.2.19 by Vincent Ladeuil
Just hack the tests until they pass.
46
        stack = self.get_stack("")
6437.25.1 by Vincent Ladeuil
Provide default paths for ca certs for supported platforms
47
        self.assertPathExists(stack.get('ssl.ca_certs'))
6238.2.10 by Jelmer Vernooij
Add more tests for ssl.ca_certs option.
48
49
    def test_specified(self):
50
        self.build_tree(['cacerts.pem'])
51
        path = os.path.join(self.test_dir, "cacerts.pem")
6238.2.19 by Vincent Ladeuil
Just hack the tests until they pass.
52
        stack = self.get_stack("ssl.ca_certs = %s\n" % path)
6238.2.10 by Jelmer Vernooij
Add more tests for ssl.ca_certs option.
53
        self.assertEquals(path, stack.get('ssl.ca_certs'))
54
55
    def test_specified_doesnt_exist(self):
6437.25.6 by Vincent Ladeuil
Feedback from mgz.
56
        stack = self.get_stack('')
57
        # Disable the default value mechanism to force the behavior we want
58
        self.overrideAttr(_urllib2_wrappers.opt_ssl_ca_certs, 'default',
59
                          os.path.join(self.test_dir, u"nonexisting.pem"))
60
        self.warnings = []
61
        def warning(*args):
62
            self.warnings.append(args[0] % args[1:])
63
        self.overrideAttr(trace, 'warning', warning)
64
        self.assertEquals(None, stack.get('ssl.ca_certs'))
65
        self.assertLength(1, self.warnings)
66
        self.assertContainsRe(self.warnings[0],
67
                              "is not valid for \"ssl.ca_certs\"")
6238.2.10 by Jelmer Vernooij
Add more tests for ssl.ca_certs option.
68
69
70
class CertReqsConfigTests(TestCaseInTempDir):
71
72
    def test_default(self):
6238.2.19 by Vincent Ladeuil
Just hack the tests until they pass.
73
        stack = config.MemoryStack("")
6238.2.10 by Jelmer Vernooij
Add more tests for ssl.ca_certs option.
74
        self.assertEquals(ssl.CERT_REQUIRED, stack.get("ssl.cert_reqs"))
75
76
    def test_from_string(self):
6238.2.19 by Vincent Ladeuil
Just hack the tests until they pass.
77
        stack = config.MemoryStack("ssl.cert_reqs = none\n")
6238.2.10 by Jelmer Vernooij
Add more tests for ssl.ca_certs option.
78
        self.assertEquals(ssl.CERT_NONE, stack.get("ssl.cert_reqs"))
6238.2.19 by Vincent Ladeuil
Just hack the tests until they pass.
79
        stack = config.MemoryStack("ssl.cert_reqs = required\n")
6238.2.10 by Jelmer Vernooij
Add more tests for ssl.ca_certs option.
80
        self.assertEquals(ssl.CERT_REQUIRED, stack.get("ssl.cert_reqs"))
6238.2.19 by Vincent Ladeuil
Just hack the tests until they pass.
81
        stack = config.MemoryStack("ssl.cert_reqs = invalid\n")
6238.2.10 by Jelmer Vernooij
Add more tests for ssl.ca_certs option.
82
        self.assertRaises(ConfigOptionValueError, stack.get, "ssl.cert_reqs")
6238.2.11 by Jelmer Vernooij
add basic tests for match_hostname.
83
84
85
class MatchHostnameTests(TestCase):
86
87
    def test_no_certificate(self):
6238.2.19 by Vincent Ladeuil
Just hack the tests until they pass.
88
        self.assertRaises(ValueError,
89
                          _urllib2_wrappers.match_hostname, {}, "example.com")
6238.2.11 by Jelmer Vernooij
add basic tests for match_hostname.
90
6573.1.1 by Andrew Starr-Bochicchio
Fix possible abuse of _urllib2_wrappers.match_hostname() for denial of service using certificates with many wildcards (CVE-2013-2099).
91
    def test_wildcards_in_cert(self):
92
        def ok(cert, hostname):
93
            _urllib2_wrappers.match_hostname(cert, hostname)
94
95
        # Python Issue #17980: avoid denials of service by refusing more than
96
        # one wildcard per fragment.
97
        cert = {'subject': ((('commonName', 'a*b.com'),),)}
98
        ok(cert, 'axxb.com')
99
        cert = {'subject': ((('commonName', 'a*b.co*'),),)}
100
        ok(cert, 'axxb.com')
101
        cert = {'subject': ((('commonName', 'a*b*.com'),),)}
102
        try:
103
            _urllib2_wrappers.match_hostname(cert, 'axxbxxc.com')
104
        except ValueError as e:
105
            self.assertIn("too many wildcards", str(e))
106
6238.2.11 by Jelmer Vernooij
add basic tests for match_hostname.
107
    def test_no_valid_attributes(self):
6238.2.19 by Vincent Ladeuil
Just hack the tests until they pass.
108
        self.assertRaises(CertificateError, _urllib2_wrappers.match_hostname,
109
                          {"Problem": "Solved"}, "example.com")
6238.2.11 by Jelmer Vernooij
add basic tests for match_hostname.
110
111
    def test_common_name(self):
112
        cert = {'subject': ((('commonName', 'example.com'),),)}
6238.2.19 by Vincent Ladeuil
Just hack the tests until they pass.
113
        self.assertIs(None,
114
                      _urllib2_wrappers.match_hostname(cert, "example.com"))
6238.2.11 by Jelmer Vernooij
add basic tests for match_hostname.
115
        self.assertRaises(CertificateError, _urllib2_wrappers.match_hostname,
6238.2.19 by Vincent Ladeuil
Just hack the tests until they pass.
116
                          cert, "example.org")