From 80f575ccef78954160b47e2aeb59319fab0d4716 Mon Sep 17 00:00:00 2001 From: Adrien Ferrand Date: Mon, 29 Jul 2019 18:05:48 +0200 Subject: [PATCH] Continue work --- .../utils/acme_server.py | 2 +- .../utils/ocsp_server.py | 49 +++++++++++-------- .../utils/pebble_artifacts.py | 1 + 3 files changed, 30 insertions(+), 22 deletions(-) diff --git a/certbot-ci/certbot_integration_tests/utils/acme_server.py b/certbot-ci/certbot_integration_tests/utils/acme_server.py index b7886577f..dda2a304f 100755 --- a/certbot-ci/certbot_integration_tests/utils/acme_server.py +++ b/certbot-ci/certbot_integration_tests/utils/acme_server.py @@ -134,7 +134,7 @@ class ACMEServer(object): [challtestsrv_path, '-management', ':{0}'.format(CHALLTESTSRV_PORT), '-defaultIPv6', '""', '-defaultIPv4', '127.0.0.1', '-http01', '""', '-tlsalpn01', '""', '-https01', '""']) - self._launch_process([sys.executable, ocsp_server.__file__]) + #self._launch_process([sys.executable, ocsp_server.__file__]) # Wait for the ACME CA server to be up. print('=> Waiting for pebble instance to respond...') diff --git a/certbot-ci/certbot_integration_tests/utils/ocsp_server.py b/certbot-ci/certbot_integration_tests/utils/ocsp_server.py index a5d2e484c..8ede18c58 100644 --- a/certbot-ci/certbot_integration_tests/utils/ocsp_server.py +++ b/certbot-ci/certbot_integration_tests/utils/ocsp_server.py @@ -1,5 +1,4 @@ import datetime -import sys from dateutil import parser import requests @@ -17,10 +16,10 @@ from certbot_integration_tests.utils.constants import MOCK_OCSP_SERVER_PORT, PEB def _create_ocsp_handler(): class ProxyHandler(BaseHTTPServer.BaseHTTPRequestHandler): def do_POST(self): - request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediate-key', verify=False) + request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediate-keys/0', verify=False) issuer_key = serialization.load_pem_private_key(request.content, None, default_backend()) - request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediate', verify=False) + request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediates/0', verify=False) issuer_cert = x509.load_pem_x509_certificate(request.content, default_backend()) try: @@ -28,31 +27,39 @@ def _create_ocsp_handler(): except AttributeError: content_len = int(self.headers.get('Content-Length')) - cert = x509.load_pem_x509_certificate(self.rfile.read(content_len), default_backend()) - request = requests.get('{0}/cert-status-by-serial/{1}'.format( - PEBBLE_MANAGEMENT_URL, str(hex(cert.serial_number)).replace('0x', '')), verify=False) - data = request.json() + ocsp_request = ocsp.load_der_ocsp_request(self.rfile.read(content_len)) + response = requests.get('{0}/cert-status-by-serial/{1}'.format( + PEBBLE_MANAGEMENT_URL, str(hex(ocsp_request.serial_number)).replace('0x', '')), verify=False) - ocsp_status = getattr(ocsp.OCSPCertStatus, data['Status'].upper()) + if not response.ok: + ocsp_response = ocsp.OCSPResponseBuilder.build_unsuccessful(ocsp.OCSPResponseStatus.UNAUTHORIZED) + else: + data = response.json() - now = datetime.datetime.utcnow() - revocation_time = parser.parse(data['RevokedAt']) if ocsp_status == ocsp.OCSPCertStatus.REVOKED else None - revocation_reason = x509.ReasonFlags.unspecified if ocsp_status == ocsp.OCSPCertStatus.REVOKED else None + now = datetime.datetime.utcnow() + cert = x509.load_pem_x509_certificate(data['Certificate'].encode(), default_backend()) + if data['Status'] != 'Revoked': + ocsp_status, revocation_time, revocation_reason = ocsp.OCSPCertStatus.GOOD, None, None + else: + ocsp_status, revocation_reason = ocsp.OCSPCertStatus.REVOKED, x509.ReasonFlags.unspecified + print('time is') + print(data['RevokedAt']) + revocation_time = parser.parse(data['RevokedAt']) - builder = ocsp.OCSPResponseBuilder() - builder = builder.add_response( - cert=cert, issuer=issuer_cert, algorithm=hashes.SHA1(), - cert_status=ocsp_status, - this_update=now, - next_update=now + datetime.timedelta(hours=1), - revocation_time=revocation_time, revocation_reason=revocation_reason - ).responder_id(ocsp.OCSPResponderEncoding.NAME, issuer_cert) + builder = ocsp.OCSPResponseBuilder() + builder = builder.add_response( + cert=cert, issuer=issuer_cert, algorithm=hashes.SHA1(), + cert_status=ocsp_status, + this_update=now, + next_update=now + datetime.timedelta(hours=1), + revocation_time=revocation_time, revocation_reason=revocation_reason + ).responder_id(ocsp.OCSPResponderEncoding.NAME, issuer_cert) - response = builder.sign(issuer_key, hashes.SHA256()) + ocsp_response = builder.sign(issuer_key, hashes.SHA256()) self.send_response(200) self.end_headers() - self.wfile.write(response.public_bytes(serialization.Encoding.DER)) + self.wfile.write(ocsp_response.public_bytes(serialization.Encoding.DER)) return ProxyHandler diff --git a/certbot-ci/certbot_integration_tests/utils/pebble_artifacts.py b/certbot-ci/certbot_integration_tests/utils/pebble_artifacts.py index 2a96ea66f..cf16d7518 100644 --- a/certbot-ci/certbot_integration_tests/utils/pebble_artifacts.py +++ b/certbot-ci/certbot_integration_tests/utils/pebble_artifacts.py @@ -44,6 +44,7 @@ def _build_pebble_config(workspace): file_h.write(json.dumps({ 'pebble': { 'listenAddress': '0.0.0.0:14000', + 'managementListenAddress': '0.0.0.0:15000', 'certificate': os.path.join(ASSETS_PATH, 'cert.pem'), 'privateKey': os.path.join(ASSETS_PATH, 'key.pem'), 'httpPort': 5002,