From 2ec7bcfd32c2151e2e42ae7b19631dcc4018f93e Mon Sep 17 00:00:00 2001 From: Folker Bernitt Date: Fri, 27 Mar 2015 11:14:14 +0100 Subject: Splitting certificate validation into provider and bootstrap certificate. - Issue #333 - Now a different certificate is used to communicate with the provider's HTTPS website than for all other connections, e.g. to the api --- .../unit/bitmask_libraries/test_abstract_leap.py | 2 +- service/test/unit/bitmask_libraries/test_certs.py | 24 +++++++++++++--- .../test/unit/bitmask_libraries/test_nicknym.py | 2 +- .../test/unit/bitmask_libraries/test_provider.py | 33 +++++++++++++++++++++- 4 files changed, 54 insertions(+), 7 deletions(-) (limited to 'service/test/unit') diff --git a/service/test/unit/bitmask_libraries/test_abstract_leap.py b/service/test/unit/bitmask_libraries/test_abstract_leap.py index 2634f330..c11c7ea9 100644 --- a/service/test/unit/bitmask_libraries/test_abstract_leap.py +++ b/service/test/unit/bitmask_libraries/test_abstract_leap.py @@ -28,7 +28,7 @@ class AbstractLeapTest(unittest.TestCase): leap_home = os.path.join(tempfile.mkdtemp(), 'leap') - config = Mock(leap_home=leap_home, ca_cert_bundle='/some/path/to/ca_cert', gpg_binary='/path/to/gpg') + config = Mock(leap_home=leap_home, bootstrap_ca_cert_bundle='/some/path/to/ca_cert', ca_cert_bundle='/some/path/to/provider_ca_cert', gpg_binary='/path/to/gpg') provider = Mock(config=config, server_name='some-server.test', domain='some-server.test', api_uri='https://api.some-server.test:4430', api_version='1') soledad = Mock() diff --git a/service/test/unit/bitmask_libraries/test_certs.py b/service/test/unit/bitmask_libraries/test_certs.py index 8caafe7e..3683f9ae 100644 --- a/service/test/unit/bitmask_libraries/test_certs.py +++ b/service/test/unit/bitmask_libraries/test_certs.py @@ -1,6 +1,6 @@ import unittest -from pixelated.bitmask_libraries.certs import which_bundle +from pixelated.bitmask_libraries.certs import which_bootstrap_bundle, which_bundle from pixelated.bitmask_libraries.config import AUTO_DETECT_CA_BUNDLE from mock import MagicMock, patch @@ -8,12 +8,28 @@ from mock import MagicMock, patch class CertsTest(unittest.TestCase): @patch('pixelated.bitmask_libraries.certs.os.path.isfile') - def test_that_which_bundle_returns_byte_string(self, mock_isfile): + @patch('pixelated.bitmask_libraries.certs.os.path.isdir') + def test_that_which_bootstrap_bundle_returns_byte_string(self, mock_isdir, mock_isfile): mock_isfile.return_value = True - config = MagicMock(ca_cert_bundle=AUTO_DETECT_CA_BUNDLE, certs_home='/some/path') + mock_isdir.return_value = True + config = MagicMock(bootstrap_ca_cert_bundle=AUTO_DETECT_CA_BUNDLE, certs_home='/some/path') provider = MagicMock(server_name=u'test.leap.net', config=config) - bundle = which_bundle(provider) + bundle = which_bootstrap_bundle(provider) self.assertEqual('/some/path/test.leap.net.ca.crt', bundle) self.assertEqual(str, type(bundle)) + + @patch('pixelated.bitmask_libraries.certs.os.path.isfile') + @patch('pixelated.bitmask_libraries.certs.os.path.isdir') + def test_that_which_bundle_returns_byte_string(self, mock_isdir, mock_isfile): + mock_isfile.return_value = True + mock_isdir.return_value = True + + config = MagicMock(bootstrap_ca_cert_bundle=AUTO_DETECT_CA_BUNDLE, ca_cert_bundle=None, leap_home='/some/leap/home', certs_home='/some/path') + provider = MagicMock(server_name=u'test.leap.net', config=config) + + bundle = which_bundle(provider) + + self.assertEqual('/some/leap/home/providers/test.leap.net/keys/client/provider.pem', bundle) + self.assertEqual(str, type(bundle)) diff --git a/service/test/unit/bitmask_libraries/test_nicknym.py b/service/test/unit/bitmask_libraries/test_nicknym.py index 7dec4b2c..6e589ae9 100644 --- a/service/test/unit/bitmask_libraries/test_nicknym.py +++ b/service/test/unit/bitmask_libraries/test_nicknym.py @@ -30,7 +30,7 @@ class NickNymTest(AbstractLeapTest): # then init_mock.assert_called_with('test_user@some-server.test', 'https://nicknym.some-server.test:6425/', - self.soledad, self.token, '/some/path/to/ca_cert', + self.soledad, self.token, '/some/path/to/provider_ca_cert', 'https://api.some-server.test:4430', '1', self.uuid, '/path/to/gpg') diff --git a/service/test/unit/bitmask_libraries/test_provider.py b/service/test/unit/bitmask_libraries/test_provider.py index af8aa291..8c0cf97e 100644 --- a/service/test/unit/bitmask_libraries/test_provider.py +++ b/service/test/unit/bitmask_libraries/test_provider.py @@ -15,11 +15,14 @@ # along with Pixelated. If not, see . import json +from mock import patch, MagicMock from httmock import all_requests, HTTMock, urlmatch from requests import HTTPError from pixelated.bitmask_libraries.config import LeapConfig from pixelated.bitmask_libraries.provider import LeapProvider from test_abstract_leap import AbstractLeapTest +from requests import Session +import requests @all_requests @@ -130,9 +133,13 @@ VeJ6 """ +CA_CERT = '/tmp/ca.crt' +BOOTSTRAP_CA_CERT = '/tmp/bootstrap-ca.crt' + + class LeapProviderTest(AbstractLeapTest): def setUp(self): - self.config = LeapConfig(verify_ssl=False, leap_home='/tmp/foobar', ca_cert_bundle='/tmp/ca.crt') + self.config = LeapConfig(verify_ssl=False, leap_home='/tmp/foobar', bootstrap_ca_cert_bundle=BOOTSTRAP_CA_CERT, ca_cert_bundle=CA_CERT) def test_provider_fetches_provider_json(self): with HTTMock(provider_json_mock): @@ -183,3 +190,27 @@ class LeapProviderTest(AbstractLeapTest): with HTTMock(provider_json_invalid_fingerprint_mock, ca_cert_mock, not_found_mock): provider = LeapProvider('some-provider.test', self.config) self.assertRaises(Exception, provider.fetch_valid_certificate) + + def test_that_bootstrap_cert_is_used_to_fetch_certificate(self): + session = MagicMock(wraps=requests.session()) + session_func = MagicMock(return_value=session) + get_func = MagicMock(wraps=requests.get) + + with patch('pixelated.bitmask_libraries.provider.requests.session', new=session_func): + with patch('pixelated.bitmask_libraries.provider.requests.get', new=get_func): + with HTTMock(provider_json_mock, ca_cert_mock, not_found_mock): + provider = LeapProvider('some-provider.test', self.config) + provider.fetch_valid_certificate() + + get_func.assert_called_once_with('https://some-provider.test/provider.json', verify=BOOTSTRAP_CA_CERT, timeout=15) + session.get.assert_called_once_with('https://some-provider.test/ca.crt', verify=BOOTSTRAP_CA_CERT, timeout=15) + + def test_that_provider_cert_is_used_to_fetch_soledad_json(self): + get_func = MagicMock(wraps=requests.get) + + with patch('pixelated.bitmask_libraries.provider.requests.get', new=get_func): + with HTTMock(provider_json_mock, soledad_json_mock, not_found_mock): + provider = LeapProvider('some-provider.test', self.config) + provider.fetch_soledad_json() + + get_func.assert_called_with('https://api.some-provider.test:4430/1/config/soledad-service.json', verify=CA_CERT, timeout=15) -- cgit v1.2.3