55 lines
2.4 KiB
Python
55 lines
2.4 KiB
Python
import json
|
|
from pathlib import Path
|
|
import shutil
|
|
import sys
|
|
import tempfile
|
|
import unittest
|
|
|
|
from renew_local_tls import identity, openssl, renew
|
|
|
|
|
|
class IdentityTests(unittest.TestCase):
|
|
def test_ip_and_dns_names(self):
|
|
self.assertEqual(identity("192.168.188.45"), ("192.168.188.45", "IP", "-verify_ip"))
|
|
self.assertEqual(identity("Inventory.Example.org")[0], "inventory.example.org")
|
|
|
|
def test_invalid_names_are_rejected(self):
|
|
for name in ("https://example.org", "example.org:443", "", "a\nsubjectAltName=DNS:evil", "*.example.org"):
|
|
with self.subTest(name=name), self.assertRaises(ValueError):
|
|
identity(name)
|
|
|
|
|
|
@unittest.skipUnless(sys.platform != "win32" and shutil.which("openssl"), "Linux/OpenSSL required")
|
|
class CertificateTests(unittest.TestCase):
|
|
def test_issue_reuse_and_renew_preserve_ca(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
project = Path(directory)
|
|
renew(project, "192.168.188.45")
|
|
ca = (project / "tls/ca/root.crt").read_bytes()
|
|
state = project / "tls/certs/current.json"
|
|
first = json.loads(state.read_text())
|
|
renew(project, "192.168.188.45")
|
|
self.assertEqual(first, json.loads(state.read_text()))
|
|
renew(project, "192.168.188.45", force=True)
|
|
second = json.loads(state.read_text())
|
|
self.assertNotEqual(first["serial"], second["serial"])
|
|
self.assertEqual(ca, (project / "tls/ca/root.crt").read_bytes())
|
|
self.assertIn(second["serial"], (project / "traefik/dynamic/tls.yml").read_text())
|
|
self.assertEqual((project / "tls/certs" / (second["serial"] + ".key")).stat().st_mode & 0o777, 0o600)
|
|
openssl("verify", "-CAfile", project / "tls/ca/root.crt", "-verify_ip", "192.168.188.45",
|
|
project / "tls/certs" / (second["serial"] + ".crt"))
|
|
|
|
def test_incomplete_ca_is_not_overwritten(self):
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
project = Path(directory)
|
|
ca = project / "tls/ca"
|
|
ca.mkdir(parents=True)
|
|
(ca / "root.key").write_text("existing key")
|
|
with self.assertRaises(RuntimeError):
|
|
renew(project, "192.168.188.45")
|
|
self.assertEqual((ca / "root.key").read_text(), "existing key")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|