
    M/e                        d Z ddlZddlmZ ddlZddlZddlmZ ddlmZ ddl	m
Z
 ddl	mZ ddl	mZ dd	lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ  G d dej6                        Z G d dej6                        Z G d dej<                        Ze dk(  r4 ejB                   ejD                  ejF                  dd e$gz                yy)z.Test for certbot_nginx._internal.configurator.    N)mock)
challenges)messages)achallenges)crypto_util)errors)osutil)obj)parser)_redirect_block_for_domain)UnspacedList)	test_utilc                       e Zd ZdZ fdZ ej                  d      d        Zd Z ej                  d       ej                  d      d               Z	d Z
 ej                  d      d	        Z ej                  d
       ej                  d      d               Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Z ej                  d       d!        Z d" Z!d# Z" ej                  d$       ej                  d%       ej                  d&      d'                      Z# ej                  d      d(        Z$ ej                  d      d)        Z% ej                  d       ej                  d*      d+               Z& ej                  d       ej                  d,      d-               Z' ej                  d      d.        Z( ej                  d/      d0        Z) ej                  d/      d1        Z* ej                  d2      d3        Z+ ej                  d4      d5        Z, ej                  d6      d7        Z- ej                  d8      d9        Z.d: Z/d; Z0d< Z1d= Z2d> Z3d? Z4d@ Z5 ej                  dA      dB        Z6dC Z7dD Z8dE Z9dF Z:dG Z;dH Z<dI Z=dJ Z>dK Z?dL Z@dM ZAdN ZB ej                  dO       ej                  dP      dQ               ZCdR ZDdS ZEdT ZF ej                  dU      dV        ZG ej                  dU      dW        ZH ej                  dU      dX        ZI ej                  dU      dY        ZJdZ ZKd[ ZL xZMS )\NginxConfiguratorTestz(Test a semi complex vhost configuration.c                 .   t         |           | j                  | j                  | j                  | j
                  | j                        | _        t        j                  d      }|j                         | _        | j                  |j                         y )Nz8certbot_nginx._internal.configurator.display_util.notify)supersetUpget_nginx_configuratorconfig_path
config_dirwork_dirlogs_dirconfigr   patchstartmock_notify
addCleanupstop)selfr   	__class__s     Q/usr/lib/python3/dist-packages/certbot_nginx/_internal/tests/configurator_test.pyr   zNginxConfiguratorTest.setUp   si    11doot}}dmmM 

UV ;;=

#    z4certbot_nginx._internal.configurator.util.exe_existsc                     d|_         t        j                  t        j                        5  | j
                  j                          d d d        y # 1 sw Y   y xY w)NF)return_valuepytestraisesr   NoInstallationErrorr   prepare)r!   mock_exe_existss     r#   test_prepare_no_installz-NginxConfiguratorTest.test_prepare_no_install#   sA    ',$]]6556 	"KK!	" 	" 	"s   AAc                     d| j                   j                  k(  sJ dt        | j                   j                  j                        k(  sJ y )N            )r   versionlenr   parsedr!   s    r#   test_preparez"NginxConfiguratorTest.test_prepare)   s=    DKK/////S++223333r$   z3certbot_nginx._internal.configurator.subprocess.runc                 J   d|j                   _        dj                  g d      |j                   _        d|_         d | j                  _        t        j                         | j                  _        | j                  j                          d| j                  j
                  k(  sJ y )N 
)znginx version: nginx/1.6.2:built by clang 6.0 (clang-600.0.56) (based on LLVM 3.5svn)TLS SNI support enabledRconfigure arguments: --prefix=/usr/local/Cellar/nginx/1.6.2 --with-http_ssl_moduleTr.   )
r&   stdoutjoinstderrr   r3   r   Mockconfig_testr*   )r!   mock_runr+   s      r#    test_prepare_initializes_versionz6NginxConfiguratorTest.test_prepare_initializes_version-   s     (*$'+yyA(B$ (,$""&))+DKK/////r$   c                    | j                   j                  d      }ddlm} |j                  |   j                          t        j                         | j                   _        t        j                  | j                  |       y )Nserver-rootr   r
   )r   confcertbotr   _LOCKSreleaser   rA   rB   certbot_test_utillock_and_call_test_prepare_locked)r!   server_rootcertbot_utils      r#   test_prepare_lockedz)NginxConfiguratorTest.test_prepare_locked@   sZ     kk&&}50K(002"&))+''(A(A;Or$   c                     	 | j                   j                          | j                  d       y # t        j                  $ r:}t        |      }d|v sJ | j                   j                  d      |v sJ Y d }~y d }~ww xY w)NzException wasn't raised!lockrF   )r   r*   failr   PluginErrorstrrG   )r!   unused_exe_existserrerr_msgs       r#   rM   z*NginxConfiguratorTest._test_prepare_lockedP   sr    	2KK! II01 !! 	>#hGW$$$;;##M2g===	>s   . A;0A66A;z7certbot_nginx._internal.configurator.socket.gethostnamez9certbot_nginx._internal.configurator.socket.gethostbyaddrc                 l    dg g f|_         d|_         | j                  j                         }|h dk(  sJ y )N155.225.50.69.nephoscale.netexample.net>   	sslon.comipv6ssl.comglobalssl.comwww.example.orgglobalsslsetssl.comipv6.com	geese.com
summer.comr[   headers.comssl.both.comanother.aliasmigration.comrZ   )r&   r   get_all_names)r!   mock_gethostbyaddrmock_gethostnamenamess       r#   test_get_all_namesz(NginxConfiguratorTest.test_get_all_names[   sG     ,J2r*R')6%))+ ; ; 	; ;r$   c                 F    g d| j                   j                         k(  sJ y )N)redirectensure-http-headerstaple-ocsp)r   supported_enhancementsr6   s    r#   test_supported_enhancementsz1NginxConfiguratorTest.test_supported_enhancementsg   s$    @;;=> 	> >r$   c                     t        j                  t        j                        5  | j                  j                  dd       d d d        y # 1 sw Y   y xY w)Nmyhostunknown_enhancementr'   r(   r   rT   r   enhancer6   s    r#   test_enhancez"NginxConfiguratorTest.test_enhancek   sB    ]]6--. 	AKK*?@	A 	A 	As   A

Ac                 b    t         j                  g| j                  j                  d      k(  sJ y )Nrt   )r   HTTP01r   get_chall_prefr6   s    r#   test_get_chall_prefz)NginxConfiguratorTest.test_get_chall_prefo   s/    !!"33H=> 	> >r$   c           	         | j                   j                  j                  d      }t        j                  |d d d ddhd dg      }| j                   j                  j                  |g dg       | j                   j                          | j                   j                  j                  |d      }dgd	d
gd	dgddgddgg ddt        j                  gggg|d   k(  sJ y )Nsites-enabled/example.com.example.com	example.*r   )listen 5001r   sslT)overrideserverr   69.50.225.155:9000	127.0.0.1server_namer   r   r   #)	r   r   abs_pathr   VirtualHostadd_server_directivessave_parse_filesCOMMENT)r!   filep
mock_vhostr5   s       r#   	test_savezNginxConfiguratorTest.test_saves   s    ""++,GH__U%)4&4k%B%)A30
 	0001	3 	 ##000F%';<%{3*N;*K85 &..134 5  # 	# #r$   c                 (    | j                  dd       y )Naliasserver_conf_test_choose_vhosts_commonr6   s    r#   test_choose_vhosts_aliasz.NginxConfiguratorTest.test_choose_vhosts_alias   s    ''?r$   c                 (    | j                  dd       y )Nexample.comexample_confr   r6   s    r#   test_choose_vhosts_example_comz4NginxConfiguratorTest.test_choose_vhosts_example_com   s    ''~Fr$   c                 (    | j                  dd       y )N	localhostlocalhost_confr   r6   s    r#   test_choose_vhosts_localhostz2NginxConfiguratorTest.test_choose_vhosts_localhost   s    ''5EFr$   c                 (    | j                  dd       y )Nexample.com.uk.testr   r   r6   s    r#   &test_choose_vhosts_example_com_uk_testz<NginxConfiguratorTest.test_choose_vhosts_example_com_uk_test   s    ''(=~Nr$   c                 (    | j                  dd       y )Nwww.example.comr   r   r6   s    r#   "test_choose_vhosts_www_example_comz8NginxConfiguratorTest.test_choose_vhosts_www_example_com   s    ''(9>Jr$   c                 (    | j                  dd       y )Ntest.www.example.comfoo_confr   r6   s    r#   'test_choose_vhosts_test_www_example_comz=NginxConfiguratorTest.test_choose_vhosts_test_www_example_com   s    ''(>
Kr$   c                 (    | j                  dd       y )Nabc.www.foo.comr   r   r6   s    r#   "test_choose_vhosts_abc_www_foo_comz8NginxConfiguratorTest.test_choose_vhosts_abc_www_foo_com   s    ''(9:Fr$   c                 (    | j                  dd       y )Nwww.bar.co.ukr   r   r6   s    r#    test_choose_vhosts_www_bar_co_ukz6NginxConfiguratorTest.test_choose_vhosts_www_bar_co_uk   s    ''9IJr$   c                 (    | j                  dd       y )Nra   	ipv6_confr   r6   s    r#   test_choose_vhosts_ipv6_comz1NginxConfiguratorTest.test_choose_vhosts_ipv6_com   s    ''
K@r$   c           
         ddhh dddhddhdhd	}d
d
dddddd
dd	}|j                         D ci c]%  \  }}|t        j                  j                  |      ' }}}| j                  j                  |      d   }t        j                  j                  |j                  | j                        }||   |j                  k(  sJ ||   |k(  sJ |dk(  r1|j                         sJ t        d |j                  D              sJ y y c c}}w )Nr   z~^(www\.)?(example|bar)\.>   r   somenamerf   r   r   z*.www.foo.comz*.www.example.comra   )r   r   r   r   r   zetc_nginx/nginx.confz#etc_nginx/sites-enabled/example.comzetc_nginx/foo.confz etc_nginx/sites-enabled/ipv6.com)	r   r   r   r   r   r   r   r   ra   r   c              3   T   K   | ]   }|j                   s|j                  sd  " yw)TN)r   ipv6).0xs     r#   	<genexpr>zCNginxConfiguratorTest._test_choose_vhosts_common.<locals>.<genexpr>   s     EAEEafftEs   ((()itemsr	   pathnormpathr   choose_vhostsrelpathr   temp_dirrk   ipv6_enabledanyaddrs)	r!   namerG   
conf_names	conf_pathkeyvaluevhostr   s	            r#   r   z0NginxConfiguratorTest._test_choose_vhosts_common   s!   )46R(S F"0+!>-/BC)l	,
 #92"G*O&K+?&:$:AC	 ENOODUVjc5S"''**511V	V))$/2wwu{{DMM:$5;;...$&&&:%%'''EU[[EEEE  Ws   *Dc                    g d}|D ]d  }| j                  |      5  t        j                  t        j                        5  | j
                  j                  |       d d d        d d d        f y # 1 sw Y   xY w# 1 sw Y   }xY w)N)zwww.foo.comexamplezt.www.bar.coz69.255.225.155)r   )subTestr'   r(   r   MisconfigurationErrorr   r   )r!   bad_resultsr   s      r#   test_choose_vhosts_badz,NginxConfiguratorTest.test_choose_vhosts_bad   s{    )   	4D4( 4]]6#?#?@ 4KK--d344 4	44 44 4s#   $A; A/A;/A84A;;B	c                     d| j                   j                  d      k(  sJ d| j                   j                  d      k(  sJ y )N)TF80)TT443)r   	ipv6_infor6   s    r#   test_ipv6onlyz#NginxConfiguratorTest.test_ipv6only   s<     5 5d ;;;;t{{44U;;;;r$   c                     d| j                   _        | j                   j                  ddddd       | j                   j                  d      d   j                  D ]  }|j
                  sJ  y )Nr/      r/   ra   example/cert.pemexample/key.pemexample/chain.pemexample/fullchain.pemr   )r   r3   deploy_certr   r   ipv6only)r!   addrs     r#   test_ipv6only_detectionz-NginxConfiguratorTest.test_ipv6only_detection   sg    '#	% KK--j9!<BB 	%D}}$$	%r$   c                 @    d| j                   j                         v sJ y )N
nginx.conf)r   	more_infor6   s    r#   test_more_infoz$NginxConfiguratorTest.test_more_info   s    t{{446666r$   c                     d| j                   _        t        j                  t        j
                        5  | j                   j                  ddddd        d d d        y # 1 sw Y   y xY w)Nr   r   r   r   r   )r   r3   r'   r(   r   rT   r   r6   s    r#   (test_deploy_cert_requires_fullchain_pathz>NginxConfiguratorTest.test_deploy_cert_requires_fullchain_path   sV    ']]6--. 	KK##$5		 	 	    AA'zJcertbot_nginx._internal.parser.NginxParser.update_or_add_server_directivesc                     t        j                         |_        t        j                  t         j
                        5  | j                  j                  ddddd       d d d        y # 1 sw Y   y xY w)Nrg   r   r   r   r   )r   r   side_effectr'   r(   rT   r   r   )r!   $mock_update_or_add_server_directivess     r#   #test_deploy_cert_raise_on_add_errorz9NginxConfiguratorTest.test_deploy_cert_raise_on_add_error   s[    ;A;W;W;Y,8]]6--. 	%KK##O#	%	% 	% 	%s    A&&A/c                    | j                   j                  j                  d      }| j                   j                  j                  d      }| j                   j                  j                  d      }d| j                   _        | j                   j	                  ddddd	       | j                   j	                  d
dddd       | j                   j                          | j                   j                  j                          t        j                  | j                   j                  j                  |         }t        j                  | j                   j                  j                  |         }t        j                  | j                   j                  j                  |         }dgddgddgddgddgg ddd	gddgd| j                   j                  gd| j                   j                  gg	gg|k(  sJ g dg|k(  sJ t        j                  |dgddgddgddgddgd d!gg d"ggg dddgddgd| j                   j                  gd| j                   j                  gg	gd#      sJ y )$Nzserver.confr   r~   r   r   r   r   r   r   rf   z/etc/nginx/cert.pemz/etc/nginx/key.pemz/etc/nginx/chain.pemz/etc/nginx/fullchain.pemr   r   r   r   r   r   r   r   ssl_certificatessl_certificate_keyincludessl_dhparam)r   r   r   rf   8000zsomename:8080location/roothtmlindexz
index.htmlz	index.htmr1   )r   r   r   r3   r   r   loadr   filter_commentsr5   mod_ssl_confssl_dhparamscontains_at_depth)r!   r   
nginx_confr   parsed_example_confparsed_server_confparsed_nginx_confs          r#   test_deploy_certz&NginxConfiguratorTest.test_deploy_cert   sy   kk((11-@[[''00>
{{))223NO' 	#	% 	! "&	( 	!"224;;3E3E3L3L\3Z[!11$++2D2D2K2KK2XY 001C1C1J1J:1VW%';<%{3*N;*K85.0GH24EF&(@(@A*DKK,D,DE   -- 	- - FF+, 	, ,%%Z )-(C  467 ( "<=$&:;$++223dkk667 ! 	 r$   c           
         | j                   j                  j                  d      }| j                   j                  ddddd       | j                   j	                          | j                   j                  j                          t        j                  | j                   j                  j                  |         }dgdd	gddgd
dgg dddgddgd| j                   j                  gd| j                   j                  ggg|d   k(  sJ y )Nsites-enabled/migration.comrc   zsummer/cert.pemzsummer/key.pemzsummer/chain.pemzsummer/fullchain.pemr   r   rg   r   r   r   r   r   r   r   r   )r   r   r   r   r   r   r   r   r5   r   r   )r!   migration_confparsed_migration_confs      r#   $test_deploy_cert_add_explicit_listenz:NginxConfiguratorTest.test_deploy_cert_add_explicit_listen0  s   ++445RS"	$ 	! $ 4 4T[[5G5G5N5N~5^ _
)?;)<8$d+4-/EF13CD%t{{'?'?@)4;;+C+CD
 /q12 	2 2r$   z@certbot_nginx._internal.configurator.http_01.NginxHttp01.performz>certbot_nginx._internal.configurator.NginxConfigurator.restartzNcertbot_nginx._internal.configurator.NginxConfigurator.revert_challenge_configc           	      (   t        j                  t        j                  t	        j
                  d      dt        j                  d            d| j                        }|j                  | j                        g}|d d  |_	        | j                  j                  |g      }|j                  dk(  sJ ||k(  sJ | j                  j                  |g       d	| j                  j                  k(  sJ |j                  dk(  sJ |j                  d
k(  sJ y )Ns   m8TdO1qik4JVFtgPPurJmg)tokenzhttps://ca.org/chall1_uripending)challuristatusr   )challbdomainaccount_keyr/   r   r1   )r   "KeyAuthorizationAnnotatedChallenger   ChallengeBodyr   rz   Status	rsa512jwkresponser&   r   perform
call_countcleanup
_chall_out)r!   mock_revertmock_restartmock_http_performachallexpected	responsess          r#   test_perform_and_cleanupz.NginxConfiguratorTest.test_perform_and_cleanupI  s     ??)) ''.GH/y1 $A OODNN+
 *2!&KK''1	 ++q000H$$$VH%DKK*****%%***&&!+++r$   c                 <   d|j                   _        dj                  g d      |j                   _        | j                  j                         dk(  sJ d|j                   _        dj                  g d      |j                   _        | j                  j                         dk(  sJ d|j                   _        dj                  g d      |j                   _        t        j                  t        j                        5  | j                  j                          d d d        d|j                   _        dj                  dd	g      |j                   _        t        j                  t        j                        5  | j                  j                          d d d        d|j                   _        dj                  g d
      |j                   _        t        j                  t        j                        5  | j                  j                          d d d        d|j                   _        dj                  g d      |j                   _        t        j                  t        j                        5  | j                  j                          d d d        t        d      |_        t        j                  t        j                        5  | j                  j                          d d d        y # 1 sw Y   xY w# 1 sw Y   `xY w# 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   y xY w)Nr9   r:   )nginx version: nginx/1.4.2r;   r<   r=   )r/      r1   )znginx version: nginx/0.9r;   r<   +configure arguments: --with-http_ssl_module)r   	   )z
blah 0.0.1r;   r<   r$  r"  r<   )r"  r;   r$  )znginx version: nginx/0.8.1r;   r<   r$  Can't find program)r&   r>   r?   r@   r   get_versionr'   r(   r   rT   NotSupportedErrorOSErrorr   r!   rC   s     r#   test_get_versionz&NginxConfiguratorTest.test_get_versione  s~   ')$'+yyA(B$ {{&&(I555')$'+yyJ(K$ {{&&(F222')$'+yyJ(K$ ]]6--. 	&KK##%	& (*$'+yy746(7$ ]]6--. 	&KK##%	& (*$'+yyJ(K$
 ]]6--. 	&KK##%	& (*$'+yyJ(K$ ]]6334 	&KK##%	&  '';<]]6--. 	&KK##%	& 	&=	& 	&	& 	&	& 	&	& 	&	& 	&s<   ;K 4K--K:&L<L K*-K7:LLLc                    d|j                   _        d|j                   _        | j                  j	                         dk(  sJ d|j                   _        d|j                   _        | j                  j	                         dk(  sJ d|j                   _        d|j                   _        | j                  j	                         dk(  sJ d|j                   _        d|j                   _        | j                  j	                         d	k(  sJ d|j                   _        d
|j                   _        | j                  j	                         dk(  sJ d|j                   _        d|j                   _        | j                  j	                         dk(  sJ y )Nr9   a  
                nginx version: nginx/1.15.5
                built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9)
                built with OpenSSL 1.0.2g  1 Mar 2016
                TLS SNI support enabled
                configure arguments:
            1.0.2ga  
                nginx version: nginx/1.15.5
                built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9)
                built with OpenSSL 1.0.2-beta1  1 Mar 2016
                TLS SNI support enabled
                configure arguments:
            z1.0.2-beta1a  
                nginx version: nginx/1.15.5
                built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9)
                built with OpenSSL 1.0.2  1 Mar 2016
                TLS SNI support enabled
                configure arguments:
            z1.0.2a2  
                nginx version: nginx/1.15.5
                built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9)
                built with OpenSSL 1.0.2g  1 Mar 2016 (running with OpenSSL 1.0.2a  1 Mar 2016)
                TLS SNI support enabled
                configure arguments:
            z1.0.2az
                nginx version: nginx/1.15.5
                built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9)
                built with LibreSSL 2.2.2
                TLS SNI support enabled
                configure arguments:
            z
                nginx version: nginx/1.15.5
                built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9)
                TLS SNI support enabled
                configure arguments:
            )r&   r>   r@   r   _get_openssl_versionr*  s     r#   test_get_openssl_versionz.NginxConfiguratorTest.test_get_openssl_version  sf    (*$($ {{//1X===')$($ {{//1]BBB')$($ {{//1W<<<')$($ {{//1X===')$($ {{//1R777')$($ {{//1R777r$   z)certbot_nginx._internal.configurator.timec                     |j                   }d|_        d|_        d|_        | j                  j                          |j                  dk(  sJ |j                  j                  d       y )Nr9   r   r/   gSt$?)	r&   r>   r@   
returncoder   restartr  sleepassert_called_once_with)r!   	mock_timerC   mockeds       r#   test_nginx_restartz(NginxConfiguratorTest.test_nginx_restart  s[     &&""a'''//7r$   z1certbot_nginx._internal.configurator.logger.debugc                 0   |j                   }d|_        d|_        d|_        t	        j
                  t        j                        5  | j                  j                          d d d        |j                  dk(  sJ |j                  dd       y # 1 sw Y   -xY w)Nr9   r/   r1   znginx reload failed:
%s)r&   r>   r@   r1  r'   r(   r   r   r   r2  r  r4  )r!   mock_log_debugrC   r6  s       r#   test_nginx_restart_failz-NginxConfiguratorTest.test_nginx_restart_fail  s     &&]]6778 	"KK!	"""a'''../I2N	" 	"s   BBc                     t        d      |_        t        j                  t        j
                        5  | j                  j                          d d d        y # 1 sw Y   y xY w)Nr&  )r)  r   r'   r(   r   r   r   r2  r*  s     r#   test_no_nginx_startz)NginxConfiguratorTest.test_no_nginx_start  sG    &';<]]6778 	"KK!	" 	" 	"s   AA!zcertbot.util.run_scriptc                     t         j                  |_        t        j                  t         j
                        5  | j                  j                          d d d        y # 1 sw Y   y xY wN)r   SubprocessErrorr   r'   r(   r   r   rB   )r!   mock_run_scripts     r#   test_config_test_bad_processz2NginxConfiguratorTest.test_config_test_bad_process  sG    &,&<&<#]]6778 	&KK##%	& 	& 	&s   AA&c                 8    | j                   j                          y r>  )r   rB   )r!   _s     r#   test_config_testz&NginxConfiguratorTest.test_config_test  s    !r$   z*certbot.reverter.Reverter.recovery_routinec                     t        j                  d      |_        t        j                  t         j
                        5  | j                  j                          d d d        y # 1 sw Y   y xY wNfoo)r   ReverterErrorr   r'   r(   rT   r   recovery_routine)r!   mock_recovery_routines     r#   0test_recovery_routine_throws_error_from_reverterzFNginxConfiguratorTest.test_recovery_routine_throws_error_from_reverter  sM    ,2,@,@,G)]]6--. 	+KK((*	+ 	+ 	+   A""A+z.certbot.reverter.Reverter.rollback_checkpointsc                     t        j                  d      |_        t        j                  t         j
                        5  | j                  j                          d d d        y # 1 sw Y   y xY wrF  )r   rH  r   r'   r(   rT   r   rollback_checkpoints)r!   mock_rollback_checkpointss     r#   4test_rollback_checkpoints_throws_error_from_reverterzJNginxConfiguratorTest.test_rollback_checkpoints_throws_error_from_reverter  sM    060D0DU0K!-]]6--. 	/KK,,.	/ 	/ 	/rL  z1certbot.reverter.Reverter.revert_temporary_configc                     t        j                  d      |_        t        j                  t         j
                        5  | j                  j                          d d d        y # 1 sw Y   y xY wrF  )r   rH  r   r'   r(   rT   r   revert_challenge_config)r!   mock_revert_temporary_configs     r#   7test_revert_challenge_config_throws_error_from_reverterzMNginxConfiguratorTest.test_revert_challenge_config_throws_error_from_reverter  sM    393G3G3N$0]]6--. 	2KK//1	2 	2 	2rL  z+certbot.reverter.Reverter.add_to_checkpointc                     t        j                  d      |_        t        j                  t         j
                        5  | j                  j                          d d d        y # 1 sw Y   y xY wrF  )r   rH  r   r'   r(   rT   r   r   )r!   mock_add_to_checkpoints     r#   $test_save_throws_error_from_reverterz:NginxConfiguratorTest.test_save_throws_error_from_reverter  sM    -3-A-A%-H*]]6--. 	KK	 	 	rL  c                 Z   | j                   j                         \  }}t        j                  j	                  |      sJ t        j                  j	                  |      sJ t        |      5 }t        j                  j                  t        j                  j                  |j                                d d d        t        |      5 }t        j                  j                  t        j                  j                  |j                                d d d        y # 1 sw Y   dxY w# 1 sw Y   y xY wr>  )r   _get_snakeoil_pathsr	   r   existsopenOpenSSLcryptoload_certificateFILETYPE_PEMreadload_privatekey)r!   certr   	cert_filekey_files        r#   test_get_snakeoil_pathsz-NginxConfiguratorTest.test_get_snakeoil_paths  s    KK335	cww~~d###ww~~c"""$Z 	?9NN++++Y^^-=?	? #Y 	>(NN**++X]]_>	> 	>	? 	?	> 	>s   +ADAD!D!D*c                 \   t        t        d            d   }| j                  j                  j	                  d      }| j                  j                  dd       | j                  j                  j                  |   }t        j                  ||d      du sJ | j                  j                  j	                  d      }| j                  j                  dd       t        t        d            d   }| j                  j                  j                  |   }t        j                  ||d      du sJ y )	Nr   r   r~   rn   r1   Tr  rg   )	r   r   r   r   r   rw   r5   r   r   )r!   r  r   generated_confr  s        r#   test_redirect_enhancez+NginxConfiguratorTest.test_redirect_enhance+  s       :;L MNqQ{{))223NO-z:++22<@%%nhBdJJJ ++445RSOZ8 :? KLQO++22>B%%nhBdJJJr$   c                    | j                   j                  j                  d      }| j                   j                  ddddd       | j                   j	                  dd       | j                   j                  j
                  |   }d	gd
dgd
dgg g dddgddgddgddgddgd| j                   j                  gddgd| j                   j                  gddgg g ggd	gg dg dggddgg ddgddgd
dgd
dgddgddgg g g ggg|k(  sJ y )Nr~   example.orgr   r   r   r   r   rn   r   r   r   r   r   r    managed by Certbotr   r   r   r   )ifz($host=zwww.example.com))return301zhttps://$host$request_urir   r   r   rn  404r   r   r   r   rw   r5   r   r   r!   r   rg  s      r#   test_split_for_redirectz-NginxConfiguratorTest.test_split_for_redirect@  sw   {{))223NO#	% 	-z:++22<@~.{+R(30E*F!#:;cCX=Y%'89CAV;W4;;334s<Q6Rt{{7783@U:V2  j9?<A B*+R./+&~.{+% 3(=">BL MN$ % 	 r$   c                    | j                   j                  j                  d      }| j                   j                  ddddd       | j                   j	                  ddd	       | j                   j                  j
                  |   }d
gddgddgg g dddgddgddgddgddgd| j                   j                  gddgd| j                   j                  gddgg g g dddgg g ggd
gddgddgddgddgg g g ggg|k(  sJ y )Nr~   rj  r   r   r   r   r   ro   Strict-Transport-Securityr   r   r   r   r   r   rk  r   r   r   r   
add_headerru  z"max-age=31536000"alwaysr   r   r   rq  rr  s      r#   test_split_for_headersz,NginxConfiguratorTest.test_split_for_headers^  s]   {{))223NO#	% 	-/CE`a++22<@~.{+R(30E*F!#:;cCX=Y%'89CAV;W4;;334s<Q6Rt{{7783@U:V2Z*+2  j./+&~.{+2r $ % 	 r$   c                    | j                   j                  j                  d      }| j                   j                  ddd       g d}| j                   j                  j                  |   }t        j                  ||d      du sJ y )Nr~   r   ro   ru  rv  r1   Tr   r   r   rw   r5   r   r   )r!   r   r  rg  s       r#   test_http_header_hstsz+NginxConfiguratorTest.test_http_header_hsts|  st    {{))223NO-/C7	9^++22<@%%nhBdJJJr$   c                    | j                   j                  j                  d      }| j                   j                  ddd       g d}| j                   j                  j                  |   }t        j                  ||d      du sJ y )Nzsites-enabled/headers.comrd   ro   ru  rv  r1   Tr{  )r!   headers_confr  rg  s       r#   test_multiple_headers_hstsz0NginxConfiguratorTest.test_multiple_headers_hsts  ss    {{))223NOM+?7	9^++22<@%%nhBdJJJr$   c                     | j                   j                  ddd       t        j                  t        j
                        5  | j                   j                  ddd       d d d        y # 1 sw Y   y xY w)Nr   ro   ru  )r   rw   r'   r(   r   PluginEnhancementAlreadyPresentr6   s    r#   test_http_header_hsts_twicez1NginxConfiguratorTest.test_http_header_hsts_twice  s_    -/C7	9]]6AAB 	?KK 1 "=?	? 	? 	?   A((A1z5certbot_nginx._internal.obj.VirtualHost.contains_listc                     d|_         t        j                  d      5 }| j                  j	                  dd       |j
                  j                  d   d   dk(  sJ 	 d d d        y # 1 sw Y   y xY w)NT+certbot_nginx._internal.configurator.loggerr   rn   r   z3Traffic on port %s already redirecting to ssl in %s)r&   r   r   r   rw   info	call_args)r!   mock_contains_listmock_loggers      r#   test_certbot_redirect_existsz2NginxConfiguratorTest.test_certbot_redirect_exists  sx    
 +/'ZZEF 	F+KK 1:>##--a03EF F F	F 	F 	Fs   >A%%A.c                     t        j                  d      5 }| j                  j                  dd       d d d        j                  j
                  d   d   dk(  sJ y # 1 sw Y   +xY w)Nr  rb   rn   r   z>No matching insecure server blocks listening on port %s found.)r   r   r   rw   r  r  )r!   r  s     r#   test_redirect_dont_enhancez0NginxConfiguratorTest.test_redirect_dont_enhance  sh    ZZEF 	9+KKZ8	9))!,Q/PQ 	Q Q	9 	9s   AA&c                    | j                   j                  j                  d      }| j                   j                  dd       | j                   j                  dd       t	        t        d            d   }t	        t        d            d   }| j                   j                  j                  |   }t        j                  ||d      sJ t        j                  ||d      sJ y )Nr~   r   rn   rj  r   r1   )	r   r   r   rw   r   r   r5   r   r   )r!   r   	expected1	expected2rg  s        r#   test_double_redirectz*NginxConfiguratorTest.test_double_redirect  s    {{))223NOM:6M:6 !;M!JKAN	 !;M!JKAN	++22<@%%niCCC%%niCCCr$   c                     d| j                   _        t        j                  t        j
                        5  | j                   j                  ddd       d d d        y # 1 sw Y   y xY w)Nr   r   rp   
chain_path)r   r3   r'   r(   r   rT   rw   r6   s    r#   test_staple_ocsp_bad_versionz2NginxConfiguratorTest.test_staple_ocsp_bad_version  sP    ']]6--. 	PKK 1=,O	P 	P 	Ps   AA%c                     t        j                  t        j                        5  | j                  j                  ddd        d d d        y # 1 sw Y   y xY w)Nr   rp   rv   r6   s    r#   test_staple_ocsp_no_chain_pathz4NginxConfiguratorTest.test_staple_ocsp_no_chain_path  sD    ]]6--. 	HKK 1=$G	H 	H 	Hs   AAc                     | j                   j                  ddd       t        j                  t        j
                        5  | j                   j                  ddd       d d d        y # 1 sw Y   y xY w)Nr   rp   r  different_path)r   rw   r'   r(   r   rT   r6   s    r#   test_staple_ocsp_internal_errorz5NginxConfiguratorTest.test_staple_ocsp_internal_error  s\    -}lK]]6--. 	TKK 1=BRS	T 	T 	Tr  c                 t   d}| j                   j                  dd|       | j                   j                  j                  d      }| j                   j                  j                  |   }t        j                  |ddgd      sJ t        j                  |ddgd      sJ t        j                  |d	dgd      sJ y )
Nr   r   rp   r~   ssl_trusted_certificater1   ssl_staplingonssl_stapling_verify)r   rw   r   r   r5   r   r   )r!   r  r   rg  s       r#   test_staple_ocspz&NginxConfiguratorTest.test_staple_ocsp  s    (
-}jI{{))223NO++22<@%%&(;<aA 	A A %%^T2A7 	7 7%%2D91> 	> >r$   c                 t   | j                   j                  j                  d      }| j                   j                  j                  d      }| j                   j                  j                  |   d   d   d   d   d= d| j                   _        | j                   j                  ddd	d
d       | j                   j                          | j                   j                  j                          t        j                  | j                   j                  j                  |         }dgg dg dddgddgddgg dggggdgddgddgddgddgddgg dggg dddgdd	gd| j                   j                  gd| j                   j                  gg	gg|k(  sJ | j                   j                  ddd	d
d       | j                   j                          | j                   j                  j                          t        j                  | j                   j                  j                  |         }t        j                  |dd      sJ y ) Nsites-enabled/defaultfoo.confr1   r/   r   r   www.nomatch.comr   r   r   r   r   )r   rt   default_server)r   	otherhostr  r   z"www.example.org"r   r   r   r   r   r   rt   r  r   r   r   r   r   nomatch.comr   )r   r   r   r5   r3   r   r   r   r   r   r   r   r   )r!   default_confr   parsed_default_confs       r#    test_deploy_no_match_default_setz6NginxConfiguratorTest.test_deploy_no_match_default_set  sL   {{))223JK;;%%..z:KK%%h/215a8;A>'#	% 	!"224;;3E3E3L3L\3Z[BE*,?@(#.%v.BDEFG %:%x0%{3*,=>(#.%v.BDE 6.0GH24EF&(@(@A*DKK,D,DE
GHI& -'- 	- -* 	#	% 	!"224;;3E3E3L3L\3Z[%%&9=!LLLr$   c                    | j                   j                  j                  d      }| j                   j                  j                  d      }| j                   j                  j                  |   d   d   d= | j                   j                  j                  |   d   d   d= d| j                   _        | j                   j                  dddd	d
       | j                   j                          | j                   j                  j                          t        j                  | j                   j                  j                  |         }dgg dddgddgddgdgddgggggg dddgddgggg dg gg dg gg dg gdd
gddgg
g|d   d   d   k(  sJ y )Nr  r  r   r/   r   r  r   r   r   r   r   )r   z*:80r   r   r   z/home/ubuntu/sites/foo/r   z/statustypesz
image/jpegjpg)r   ~zcase_sensitive\.php$r   z	index.phpz	/var/root)r   z~*zcase_insensitive\.php$)r   rm  zexact_match\.php$)r   z^~zignore_regex\.php$r   r   )
r   r   r   r5   r3   r   r   r   r   r   )r!   r  r   parsed_foo_confs       r#   1test_deploy_no_match_default_set_multi_level_pathzGNginxConfiguratorTest.test_deploy_no_match_default_set_multi_level_path  s   {{))223JK;;%%..z:KK%%l3A6q9!<KK%%l3A6q9!<'#	% 	!..t{{/A/A/H/H/RS
4(*;<!#<=&	2wi<QVBWAX5Y4Z[ER]H^"K0H2 3H"MBBGDbI,.EF02CD
FG )+A.q12 	2 2r$   c                 p   | j                   j                  j                  d      }| j                   j                  j                  d      }| j                   j                  j                  |   d   d   d= | j                   j                  j                  |   d   d   d= | j                   j                  j                  |   d   d   d   d   d= d| j                   _        t        j                  t        j                        5  | j                   j                  ddd	d
d       d d d        y # 1 sw Y   y xY w)Nr  r  r   r/   r1   r   r  r   r   r   r   )
r   r   r   r5   r3   r'   r(   r   r   r   )r!   r  r   s      r#   #test_deploy_no_match_no_default_setz9NginxConfiguratorTest.test_deploy_no_match_no_default_set&  s
   {{))223JK;;%%..z:KK%%l3A6q9!<KK%%l3A6q9!<KK%%h/215a8;A>']]6778 	:KK##$57IK\!8:	: 	: 	:s    D,,D5c                     d| j                   _        t        j                  t        j
                        5  | j                   j                  ddddd       d d d        y # 1 sw Y   y xY w)Nr   r  r   r   r   r   )r   r3   r'   r(   r   r   r   r6   s    r#   +test_deploy_no_match_fail_multiple_defaultszANginxConfiguratorTest.test_deploy_no_match_fail_multiple_defaults2  sV    ']]6778 	:KK##$57IK\!8:	: 	: 	:r   c                    | j                   j                  j                  d      }d| j                   j                  j                  |   d   d   d   d   d   d<   d| j                   _        | j                   j                  ddd	d
d       y )Nr  z*:5001r1   r/   r   r   r  r   r   r   r   )r   r   r   r5   r3   r   )r!   r   s     r#   )test_deploy_no_match_multiple_defaults_okz?NginxConfiguratorTest.test_deploy_no_match_multiple_defaults_ok8  s    ;;%%..z:@H!!(+A.q1!4Q7:1=' 13EGX!8	:r$   c                    | j                   j                  j                  d      }| j                   j                  j                  d      }| j                   j                  j                  |   d   d   d   d   d= d| j                   _        | j                   j                  ddd	d
d       | j                   j                  ddd	d
d       | j                   j                  dd       | j                   j                          | j                   j                  j                          t        t        d            d   }| j                   j                  j                  |   }t        j                  ||d      sJ y )Nr  r  r1   r/   r   r   r  r   r   r   r   r  rn   )r   r   r   r5   r3   r   rw   r   r   r   r   r   r   )r!   r  r   r  rg  s        r#   !test_deploy_no_match_add_redirectz7NginxConfiguratorTest.test_deploy_no_match_add_redirect?  s=   {{))223JK;;%%..z:KK%%h/215a8;A>'#	% 	#	% 	-z:! :;L MNqQ++22<@%%nhBBBr$   zcertbot.reverter.loggerz/certbot_nginx._internal.parser.NginxParser.loadc                     | j                   j                          | j                   j                          | j                   j                          |j                  dk(  sJ y )Nr   )r   rI  rR  rN  r  )r!   mock_parser_loadunused_mock_loggers      r#   'test_parser_reload_after_config_changesz=NginxConfiguratorTest.test_parser_reload_after_config_changes^  sH     	$$&++-((***a///r$   c                    d}t        j                  |      5 }| j                  j                  j	                         D cg c]  }d|j
                  v r| c}d   }|g|_        | j                  j                  dd      }||j                  d   d   v sJ t        |      dk(  sJ |d   |k(  sJ 	 d d d        y c c}w # 1 sw Y   y xY w)N9certbot_nginx._internal.display_ops.select_vhost_multiplerc   r   *.comT
prefer_sslr/   
r   r   r   r   
get_vhostsrk   r&   _choose_vhosts_wildcardr  r4   r!   	mock_pathmock_select_vhsr   r   vhss         r#   test_choose_vhosts_wildcardz1NginxConfiguratorTest.test_choose_vhosts_wildcardf  s    O	ZZ	" 	#o $ 2 2 = = ? *1(  **+-E,17O(++55g@D 6 FC O55a8;;;; s8q= =q6U?"?	# 	#*	# 	#   'C B;AC ;C  C	c                    d}t        j                  |      5 }| j                  j                  j	                         D cg c]  }d|j
                  v r| c}d   }|g|_        | j                  j                  dd      }||j                  d   d   v sJ t        |      dk(  sJ |d   |k(  sJ 	 d d d        y c c}w # 1 sw Y   y xY w)Nr  rc   r   r  Fr  r/   r  r  s         r#   $test_choose_vhosts_wildcard_redirectz:NginxConfiguratorTest.test_choose_vhosts_wildcard_redirectv  s    O	ZZ	" 	#o $ 2 2 = = ? *1(  **+-E,17O(++55g@E 6 GC O55a8;;;; s8q= =q6U?"?	# 	#*	# 	#r  c                 
   t        j                         }| j                  j                  j	                         D cg c]  }d|j
                  v r| c}d   }|g|_        || j                  _        d}t        j                  |      5 }| j                  j                  ddddd       |j                  sJ t        |j                        dk(  sJ ||j                  d   d   d   k(  sJ 	 d d d        y c c}w # 1 sw Y   y xY w)Nrb   r   zCcertbot_nginx._internal.configurator.NginxConfigurator._deploy_certr  	/tmp/pathr/   )r   	MagicMockr   r   r  rk   r&   r  r   r   calledr4   call_args_list)r!   mock_choose_vhostsr   r   mock_dmock_deps         r#   test_deploy_cert_wildcardz/NginxConfiguratorTest.test_deploy_cert_wildcard  s    !^^- KK..99; 'qagg%  ''(*+0''.@+VZZ 	=8KK##G[$/kK??"?x../1444H33A6q9!<<<<	= 	='
	= 	=s   C4A"C99Dr  c                     g |_         t        j                  t        j                        5  | j
                  j                  ddddd       d d d        y # 1 sw Y   y xY w)Nz
*.wild.catr  )r&   r'   r(   r   rT   r   r   )r!   mock_dialogs     r#   #test_deploy_cert_wildcard_no_vhostsz9NginxConfiguratorTest.test_deploy_cert_wildcard_no_vhosts  sP     $& ]]6--. 	5KK##L+{&5	5 	5 	5s    AAc                    | j                   j                  j                         D cg c]  }d|j                  v r| c}d   }|g| j                   j                  d<   | j                   j                  ddd       |j                  rJ y c c}w )Nrb   r   r  rp   r   )r   r   r  rk   _wildcard_vhostsrw   r  r!   r  r   r   s       r#   (test_enhance_wildcard_ocsp_after_installz>NginxConfiguratorTest.test_enhance_wildcard_ocsp_after_install  s     !KK..99; 'qagg%  ''(*16$$W-G]4GH%%%%%	's   B
c                     | j                   j                  j                         D cg c]  }d|j                  v r| c}d   }|g|_        | j                   j                  ddd       |j                  du sJ y c c}w )Nrc   r   r  rp   r   T)r   r   r  rk   r&   rw   r  r  s       r#   1test_enhance_wildcard_redirect_or_ocsp_no_installzGNginxConfiguratorTest.test_enhance_wildcard_redirect_or_ocsp_no_install  sz     KK..99; (qqww&  (()+$)7 G]4GH!!T)))	(s   A:c                    | j                   j                  j                         D cg c]  }d|j                  v r| c}d   }|g| j                   j                  d<   | j                   j                  dd       |j                  rJ y c c}w )Nrc   r   r  rn   )r   r   r  rk   _wildcard_redirect_vhostsrw   r  r  s       r#   %test_enhance_wildcard_double_redirectz;NginxConfiguratorTest.test_enhance_wildcard_double_redirect  s     !KK..99; (qqww&  (()+:?--g6GZ0%%%%%	(s   B	c                     d}t        j                  |      5 }g |_        | j                  j	                  ddd       t        |j                  d   d         dk(  sJ 	 d d d        y # 1 sw Y   y xY w)Nr  r  Fr   )r  no_ssl_filter_portr      )r   r   r&   r   r  r4   r  )r!   r  r  s      r#   .test_choose_vhosts_wildcard_no_ssl_filter_portzDNginxConfiguratorTest.test_choose_vhosts_wildcard_no_ssl_filter_port  sw    O	ZZ	" 	=o+-O(KK//;@CG 0 I 003A671<<<	= 	= 	=s   AA((A1c                 |   | j                   j                  d      \  }}t        |      dk(  sJ t        |      dk(  sJ |d   j                  dhk(  sJ |d   j                  dhk(  sJ |d   j                  dhk(  sJ |d   j                  dhk(  sJ |d   j                  dhk(  sJ |d   j                  dhk(  sJ y)	zFchoose_auth_vhosts correctly selects duplicative and HTTP/HTTPS vhostsre   r#  r1   r   r/   r   z
*.both.comN)r   choose_auth_vhostsr4   rk   )r!   httphttpss      r#   test_choose_auth_vhostsz-NginxConfiguratorTest.test_choose_auth_vhosts  s    kk44^De4yA~~5zQAw}} 0000Aw}} 0000Aw}} 0000Aw}}...Qx~~.!1111Qx~~,///r$   )N__name__
__module____qualname____doc__r   r   r   r,   r7   rD   rP   rM   rl   rr   rx   r|   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r   r+  r/  r7  r:  r<  rA  rD  rK  rP  rT  rW  re  rh  rs  ry  r|  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  __classcell__r"   s   @r#   r   r      s   2$ TZZFG" H"
4 TZZFGTZZEF0 G H0"P  TZZFG2 H2 TZZIJTZZKL; M K;>A>#,@GGOKLGKAF:4<%7 TZZ\]% ^%;z22 TZZRSTZZPQTZZ`a, b R T,2 TZZEF:& G:&x TZZEF;8 G;8z TZZEFTZZ;<8 = G8 TZZEFTZZCDO E GO TZZEF" G"
 TZZ)*& +&
 TZZ)*" +" TZZ<=+ >+
 TZZ@A/ B/
 TZZCD2 E2
 TZZ=> ?

>K*<<KK? TZZGHF IFQDP
HT>3Mj2B
:::C> TZZ)*TZZAB0 C +0# # = TZZKL5 M5 TZZKL& M& TZZKL* M* TZZKL& M&	=
0r$   r   c                   p     e Zd ZdZ fdZd Zd Zd Zd Zd Z	d Z
d	 Zd
 Zd Zd Zd Zd Zd Z xZS )InstallSslOptionsConfTestzLTest that the options-ssl-nginx.conf file is installed and updated properly.c                     t         |           | j                  | j                  | j                  | j
                  | j                        | _        y r>  )r   r   r   r   r   r   r   r   )r!   r"   s    r#   r   zInstallSslOptionsConfTest.setUp  s:    11doot}}dmmMr$   c                     | j                   j                  | j                   j                  | j                   j                         y r>  )r   install_ssl_options_confr   updated_mod_ssl_conf_digestr6   s    r#   _callzInstallSslOptionsConfTest._call  s-    ,,T[[-E-EKK33	5r$   c                 T    t        j                  | j                  j                        S r>  )r   	sha256sumr   mod_ssl_conf_srcr6   s    r#   _current_ssl_options_hashz3InstallSslOptionsConfTest._current_ssl_options_hash  s    $$T[[%A%ABBr$   c                     t         j                  j                  | j                  j                        sJ t        j                  | j                  j                        | j                         k(  sJ y r>  )r	   r   isfiler   r   r   r  r  r6   s    r#   _assert_current_filez.InstallSslOptionsConfTest._assert_current_file  sU    ww~~dkk66777$$T[[%=%=>**,- 	- -r$   c                     | j                          t        j                  | j                  j                         t        j
                  j                  | j                  j                        rJ | j                          | j                          y r>  )r  r	   remover   r   r   r  r  r6   s    r#   test_no_filez&InstallSslOptionsConfTest.test_no_file  sY    !!#
		$++**+77>>$++":":;;;

!!#r$   c                 d    | j                          | j                          | j                          y r>  )r  r  r6   s    r#   test_current_filez+InstallSslOptionsConfTest.test_current_file  s#    !!#

!!#r$   c                      t         j                  j                  d      5 }|j                  d       d d d        t        j
                   fd}|S # 1 sw Y   "xY w)Nwbogusc                 J    | j                   j                  k(  r |       S S r>  )r   r  )filename	fake_hashr!   sha256s    r#   _hashzGInstallSslOptionsConfTest._mock_hash_except_ssl_conf_src.<locals>._hash  s%    '/4;;3O3O'O6(#^U^^r$   )r[  r   r   writer   r  )r!   r  fr	  r  s   ``  @r#   _mock_hash_except_ssl_conf_srcz8InstallSslOptionsConfTest._mock_hash_except_ssl_conf_src  sR     $++**C0 	AGGG	&&	_	 	s   AA c                     ddl m} t        j                  d| j	                  |d               5  | j                          d d d        | j                          y # 1 sw Y   xY w)Nr   ALL_SSL_OPTIONS_HASHEScertbot.crypto_util.sha256sumnew)!certbot_nginx._internal.constantsr  r   r   r  r  r  r!   r  s     r#   !test_prev_file_updates_to_currentz;InstallSslOptionsConfTest.test_prev_file_updates_to_current  sU    LZZ7778Nq8QRT 	JJL	 	!!#	 	s   AA#c                     ddl m} d| j                  _        t	        j
                  d| j                  |d               5  | j                          d d d        | j                          y # 1 sw Y   xY w)Nr   r  r/      r  r  r  )	r  r  r   r3   r   r   r  r  r  r  s     r#   +test_prev_file_updates_to_current_old_nginxzEInstallSslOptionsConfTest.test_prev_file_updates_to_current_old_nginx  sa    L'ZZ7778Nq8QRT 	JJL	 	!!#	 	s   A++A4c                    t        | j                  j                  d      5 }|j                  d       d d d        t	        j
                  d      5 }| j                          |j                  j                  rJ 	 d d d        t        j                  j                  | j                  j                        sJ t        j                  | j                  j                        | j                         k(  sJ t        j                  | j                  j                        | j                         k7  sJ y # 1 sw Y   xY w# 1 sw Y   xY w)Naa new line for the wrong hash
certbot.plugins.common.logger)r[  r   r   r
  r   r   r  warningr  r	   r   r  r   r  r  r  )r!   r   r  s      r#   3test_manually_modified_current_file_does_not_updatezMInstallSslOptionsConfTest.test_manually_modified_current_file_does_not_update  s   $++**C0 	BL@A	BZZ78 	2KJJL"**11111	2 ww~~dkk66777$$T[[%A%AB**,- 	- -$$T[[%=%=>**,- 	- -	B 	B	2 	2s   D0)D<0D9<Ec                    t        | j                  j                  d      5 }|j                  d       d d d        t        | j                  j                  d      5 }|j                  d       d d d        t        j                  d      5 }| j                          |j                  j                  d   d   dk(  sJ 	 d d d        t        j                  | j                  j                        | j                         k(  sJ t        j                  d      5 }| j                          |j                  j                  rJ 	 d d d        y # 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   y xY w)Nr  r  r  hashofanoldversionr  r   zh%s has been manually modified; updated file saved to %s. We recommend updating %s for security purposes.)r[  r   r   r
  r  r   r   r  r  r  r   r  r  r  r  )r!   r   r  r  s       r#   &test_manually_modified_past_file_warnsz@InstallSslOptionsConfTest.test_manually_modified_past_file_warns  s[   $++**C0 	BL@A	B$++993? 	*1GG()	*ZZ78 	OKJJL&&003A6OO O O	O
 $$T[[%A%AB**,- 	- - ZZ78 	2KJJL"**11111	2 	2	B 	B	* 	*	O 	O	2 	2s/   E	E
2E")E.	EE"E+.E7c                 B    ddl m} | j                         |v sJ d       y )Nr   r  zvConstants.ALL_SSL_OPTIONS_HASHES must be appended with the sha256 hash of self.config.mod_ssl_conf when it is updated.)r  r  r  r  s     r#   $test_current_file_hash_in_all_hashesz>InstallSslOptionsConfTest.test_current_file_hash_in_all_hashes(  s,    L--/3II 	TT	TIr$   c                    t         j                  dk\  rddlm} nddl}ddlm} |j                  d      j                  dd      }|j                  |      5 }t        j                  |      D ]D  }t        j                  t        j                  j                  ||            }||v r;J d| d	        	 ddd       y# 1 sw Y   yxY w)
aa  
        It is really critical that all TLS Nginx config files have their SHA256 hash registered in
        constants.ALL_SSL_OPTIONS_HASHES. Otherwise Certbot will mistakenly assume that the config
        file has been manually edited by the user, and will refuse to update it.
        This test ensures that all necessary hashes are present.
        )r   r%  r   Nr  certbot_nginx	_internaltls_configszJConstants.ALL_SSL_OPTIONS_HASHES must be appended with the sha256 hash of z when it is updated.)sysversion_infoimportlib.resources	resourcesimportlib_resourcesr  r  filesjoinpathas_filer	   listdirr   r  r   r?   )r!   r-  r  tls_configs_reftls_configs_dirtls_config_file	file_hashs          r#   (test_ssl_config_files_hash_in_all_hasheszBInstallSslOptionsConfTest.test_ssl_config_files_hash_in_all_hashes.  s     v%=&L-33ODMM( ((9 	E_#%::o#> E'11"'',,P_2`a	 $:: E.//CEE:E	E 	E 	Es   AB>(B>>Cc                 r   d| j                   _        d| j                   _        t        j                  j                  | j                   j                        dk(  sJ | j                          | j                          d| j                   _        d| j                   _        t        j                  j                  | j                   j                        dk(  sJ | j                          | j                          d| j                   _        t        j                  j                  | j                   j                        dk(  sJ | j                          | j                          d| j                   _        d	| j                   _        t        j                  j                  | j                   j                        d
k(  sJ y )Nr  r-  zoptions-ssl-nginx-old.conf)r/   r  r%  z1.0.2lz!options-ssl-nginx-tls12-only.conf)r/      r   zoptions-ssl-nginx.confz1.0.2kz+options-ssl-nginx-tls13-session-tix-on.conf)	r   r3   openssl_versionr	   r   basenamer  r  r  r6   s    r#   &test_nginx_version_uses_correct_configz@InstallSslOptionsConfTest.test_nginx_version_uses_correct_configE  sP   '&.#ww < <=56 	6 6

!!#'&.#ww < <=<= 	= =

!!#(ww < <=12 	2 2

!!#(&.#ww < <=FG 	G Gr$   )r  r  r  r  r   r  r  r  r  r  r  r  r  r  r"  r$  r6  r;  r  r  s   @r#   r  r    sQ    VM5C-
$$
	$$
-2"TE.Gr$   r  c                       e Zd ZdZd Zej                  j                  ej                  ddi      d        Z
ej                  j                  ej                  i       d        Zd Zy)	DetermineDefaultServerRootTestzNTests for certbot_nginx._internal.configurator._determine_default_server_root.c                     ddl m}  |       S )Nr   )_determine_default_server_root)$certbot_nginx._internal.configuratorr?  )r!   r?  s     r#   r  z$DetermineDefaultServerRootTest._call`  s    W-//r$   CERTBOT_DOCS1c                 (    | j                  d       y )NTexpect_both_values_testr6   s    r#   test_docs_valuez.DetermineDefaultServerRootTest.test_docs_valued  s    

d
+r$   c                 (    | j                  d       y )NFrD  rF  r6   s    r#   test_real_valuesz/DetermineDefaultServerRootTest.test_real_valuesh  s    

e
,r$   c                 N    | j                         }|rd|v sJ d|v sJ y |dv sJ y )N/usr/local/etc/nginx
/etc/nginx)rM  rL  )r  )r!   rE  rN   s      r#   rG  z$DetermineDefaultServerRootTest._testl  s;    jjl)[888;..."HHHHr$   N)r  r  r  r  r  r   r   dictr	   environrH  rJ  rG   r$   r#   r=  r=  ]  sc    X0 
ZZ__RZZ.#!67, 8, 
ZZ__RZZ$- %-Ir$   r=  __main__r/   )%r  r)  unittestr   r\  r'   acmer   r   rH   r   r   r   certbot.compatr	   certbot.testsr   rK   certbot_nginx._internalr   r   r@  r   #certbot_nginx._internal.nginxparserr   certbot_nginx._internal.testsr   	NginxTestr   r  ConfigTestCaser=  r  exitmainargv__file__rP  r$   r#   <module>r_     s    4 
          3 ' * K < ;v0DNN v0rKG KG\I%6%E%E I2 zCHH[V[[!"
234 r$   