<commit_before>import os
import re
import time

import pytest

from md_conf import HttpdConf


EABS = [
    {'kid': '0123', 'hmac': 'abcdef'},
    # set the environment variable SECTIGO_EAB="$kid $hmac" for
    # these tests to become active
]

def missing_eab():
    if len(EABS) == 1 and 'SECTIGO_EAB' in os.environ:
        m = re.match(r'^\s*(\S+)\s+(\S+)\s*$', os.environ['SECTIGO_EAB'])
        if m:
            EABS.append({'kid': m.group(1), 'hmac': m.group(2)})
    return len(EABS) == 1

@pytest.mark.skipif(condition=missing_eab(), reason="no Sectigo EAB added")
class TestSectigo:

    DEMO_ACME = "https://acme.demo.sectigo.com/"
    DEMO_TLD = "eissing.org"

    @pytest.fixture(autouse=True, scope='class')
    def _class_scope(self, env, acme):
        acme.start(config='eab')
        env.check_acme()
        env.clear_store()
        HttpdConf(env).install()
        assert env.apache_restart() == 0

    @pytest.fixture(autouse=True, scope='function')
    def _method_scope(self, env, request):
        env.clear_store()
        self.test_domain = env.get_request_domain(request)

    def test_751_001(self, env):
        # valid config, expect cert with correct chain
        domain = f"test1.{self.DEMO_TLD}"
        domains = [domain]
        conf = HttpdConf(env)
        conf.start_md(domains)
        conf.add(f"MDCertificateAuthority {self.DEMO_ACME}")
        conf.add("MDCACertificateFile none")
        conf.add(f"MDExternalAccountBinding {EABS[1]['kid']} {EABS[1]['hmac']}")
        conf.end_md()
        conf.add_vhost(domains=domains)
        conf.install()
        assert env.apache_restart() == 0
        assert env.await_completion(domains)
        r = env.curl_get(f"https://{domain}:{env.https_port}", options=[
            "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem"
        ])
        assert r.response['status'] == 200

    def test_751_002(self, env):
        # without EAB set
        domain = f"test1.{self.DEMO_TLD}"
        domains = [domain]
        conf = HttpdConf(env)
        conf.start_md(domains)
        conf.add(f"MDCertificateAuthority {self.DEMO_ACME}")
        conf.add("MDCACertificateFile none")
        conf.end_md()
        conf.add_vhost(domains=domains)
        conf.install()
        assert env.apache_restart() == 0
        assert env.await_error(domain)
        md = env.get_md_status(domain)
        assert md['renewal']['errors'] > 0
        assert md['renewal']['last']['problem'] == 'urn:ietf:params:acme:error:externalAccountRequired'

    def test_751_003(self, env):
        # with wrong EAB set
        domain = f"test1.{self.DEMO_TLD}"
        domains = [domain]
        conf = HttpdConf(env)
        conf.start_md(domains)
        conf.add(f"MDCertificateAuthority {self.DEMO_ACME}")
        conf.add("MDCACertificateFile none")
        conf.add(f"MDExternalAccountBinding xxxxxx aaaaaaaaaaaaasdddddsdasdsadsadsadasdsadsa")
        conf.end_md()
        conf.add_vhost(domains=domains)
        conf.install()
        assert env.apache_restart() == 0
        assert env.await_error(domain)
        md = env.get_md_status(domain)
        assert md['renewal']['errors'] > 0
        assert md['renewal']['last']['problem'] == 'urn:ietf:params:acme:error:unauthorized'

    def test_751_004(self, env):
        # valid config, get cert, add dns name, renew cert
        domain = f"test1.{self.DEMO_TLD}"
        domain2 = f"test2.{self.DEMO_TLD}"
        domains = [domain]
        conf = HttpdConf(env)
        conf.start_md(domains)
        conf.add(f"MDCertificateAuthority {self.DEMO_ACME}")
        conf.add("MDCACertificateFile none")
        conf.add(f"MDExternalAccountBinding {EABS[1]['kid']} {EABS[1]['hmac']}")
        conf.end_md()
        conf.add_vhost(domains=domains)
        conf.install()
        assert env.apache_restart() == 0
        assert env.await_completion(domains)
        r = env.curl_get(f"https://{domain}:{env.https_port}", options=[
            "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem"
        ])
        assert r.response['status'] == 200
        r = env.curl_get(f"https://{domain2}:{env.https_port}", options=[
            "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem"
        ])
        assert r.exit_code != 0
        md1 = env.get_md_status(domain)
        acct1 = md1['ca']['account']
        # add the domain2 to the dns names
        domains = [domain, domain2]
        conf = HttpdConf(env)
        conf.start_md(domains)
        conf.add(f"MDCertificateAuthority {self.DEMO_ACME}")
        conf.add("MDCACertificateFile none")
        conf.add(f"MDExternalAccountBinding {EABS[1]['kid']} {EABS[1]['hmac']}")
        conf.end_md()
        conf.add_vhost(domains=domains)
        conf.install()
        assert env.apache_restart() == 0
        assert env.await_completion(domains)
        r = env.curl_get(f"https://{domain2}:{env.https_port}", options=[
            "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem"
        ])
        assert r.response['status'] == 200
        md2 = env.get_md_status(domain)
        acct2 = md2['ca']['account']
        assert acct2 == acct1, f"ACME account was not reused: {acct1} became {acct2}"

    def test_751_020(self, env):
        # valid config, get cert, check OCSP status
        domain = f"test1.{self.DEMO_TLD}"
        domains = [domain]
        conf = HttpdConf(env)
        conf.add("MDStapling on")
        conf.start_md(domains)
        conf.add(f"""
            MDCertificateAuthority {self.DEMO_ACME}
            MDCACertificateFile none
            MDExternalAccountBinding {EABS[1]['kid']} {EABS[1]['hmac']}
            """)
        conf.end_md()
        conf.add_vhost(domains=domains)
        conf.install()
        assert env.apache_restart() == 0
        assert env.await_completion(domains)
        r = env.curl_get(f"https://{domain}:{env.https_port}", options=[
            "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem"
        ])
        assert r.response['status'] == 200
        time.sleep(1)
        for domain in domains:
            stat = env.await_ocsp_status(domain,
                                         ca_file=f"{env.test_dir}/data/sectigo-demo-root.pem")
            assert stat['ocsp'] == "successful (0x0)"
            assert stat['verify'] == "0 (ok)"
<commit_msg> * test cases 751: making test dns tld also configurable<commit_after>import os
import re
import time

import pytest

from md_conf import HttpdConf

# set the environment variables
#   SECTIGO_EAB="$kid $hmac" for
#   SECTIGO_TLD="<your registered dns name>"
# these tests to become active
#

DEMO_ACME = "https://acme.demo.sectigo.com/"
DEMO_TLD = None

EABS = [
    {'kid': '0123', 'hmac': 'abcdef'},
]


def missing_eab():
    global EABS
    if len(EABS) == 1 and 'SECTIGO_EAB' in os.environ:
        m = re.match(r'^\s*(\S+)\s+(\S+)\s*$', os.environ['SECTIGO_EAB'])
        if m:
            EABS.append({'kid': m.group(1), 'hmac': m.group(2)})
    return len(EABS) == 1


def missing_tld():
    global DEMO_TLD
    if 'SECTIGO_TLD' in os.environ:
        DEMO_TLD = os.environ['SECTIGO_TLD']
    return DEMO_TLD is None


@pytest.mark.skipif(condition=missing_tld(), reason="env var SECTIGO_TLD not set")
@pytest.mark.skipif(condition=missing_eab(), reason="env var SECTIGO_EAB not set")
class TestSectigo:

    @pytest.fixture(autouse=True, scope='class')
    def _class_scope(self, env, acme):
        acme.start(config='eab')
        env.check_acme()
        env.clear_store()
        HttpdConf(env).install()
        assert env.apache_restart() == 0

    @pytest.fixture(autouse=True, scope='function')
    def _method_scope(self, env, request):
        env.clear_store()
        self.test_domain = env.get_request_domain(request)

    def test_751_001(self, env):
        # valid config, expect cert with correct chain
        domain = f"test1.{DEMO_TLD}"
        domains = [domain]
        conf = HttpdConf(env)
        conf.start_md(domains)
        conf.add(f"MDCertificateAuthority {DEMO_ACME}")
        conf.add("MDCACertificateFile none")
        conf.add(f"MDExternalAccountBinding {EABS[1]['kid']} {EABS[1]['hmac']}")
        conf.end_md()
        conf.add_vhost(domains=domains)
        conf.install()
        assert env.apache_restart() == 0
        assert env.await_completion(domains)
        r = env.curl_get(f"https://{domain}:{env.https_port}", options=[
            "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem"
        ])
        assert r.response['status'] == 200

    def test_751_002(self, env):
        # without EAB set
        domain = f"test1.{DEMO_TLD}"
        domains = [domain]
        conf = HttpdConf(env)
        conf.start_md(domains)
        conf.add(f"MDCertificateAuthority {DEMO_ACME}")
        conf.add("MDCACertificateFile none")
        conf.end_md()
        conf.add_vhost(domains=domains)
        conf.install()
        assert env.apache_restart() == 0
        assert env.await_error(domain)
        md = env.get_md_status(domain)
        assert md['renewal']['errors'] > 0
        assert md['renewal']['last']['problem'] == 'urn:ietf:params:acme:error:externalAccountRequired'

    def test_751_003(self, env):
        # with wrong EAB set
        domain = f"test1.{DEMO_TLD}"
        domains = [domain]
        conf = HttpdConf(env)
        conf.start_md(domains)
        conf.add(f"MDCertificateAuthority {DEMO_ACME}")
        conf.add("MDCACertificateFile none")
        conf.add(f"MDExternalAccountBinding xxxxxx aaaaaaaaaaaaasdddddsdasdsadsadsadasdsadsa")
        conf.end_md()
        conf.add_vhost(domains=domains)
        conf.install()
        assert env.apache_restart() == 0
        assert env.await_error(domain)
        md = env.get_md_status(domain)
        assert md['renewal']['errors'] > 0
        assert md['renewal']['last']['problem'] == 'urn:ietf:params:acme:error:unauthorized'

    def test_751_004(self, env):
        # valid config, get cert, add dns name, renew cert
        domain = f"test1.{DEMO_TLD}"
        domain2 = f"test2.{DEMO_TLD}"
        domains = [domain]
        conf = HttpdConf(env)
        conf.start_md(domains)
        conf.add(f"MDCertificateAuthority {DEMO_ACME}")
        conf.add("MDCACertificateFile none")
        conf.add(f"MDExternalAccountBinding {EABS[1]['kid']} {EABS[1]['hmac']}")
        conf.end_md()
        conf.add_vhost(domains=domains)
        conf.install()
        assert env.apache_restart() == 0
        assert env.await_completion(domains)
        r = env.curl_get(f"https://{domain}:{env.https_port}", options=[
            "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem"
        ])
        assert r.response['status'] == 200
        r = env.curl_get(f"https://{domain2}:{env.https_port}", options=[
            "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem"
        ])
        assert r.exit_code != 0
        md1 = env.get_md_status(domain)
        acct1 = md1['ca']['account']
        # add the domain2 to the dns names
        domains = [domain, domain2]
        conf = HttpdConf(env)
        conf.start_md(domains)
        conf.add(f"MDCertificateAuthority {DEMO_ACME}")
        conf.add("MDCACertificateFile none")
        conf.add(f"MDExternalAccountBinding {EABS[1]['kid']} {EABS[1]['hmac']}")
        conf.end_md()
        conf.add_vhost(domains=domains)
        conf.install()
        assert env.apache_restart() == 0
        assert env.await_completion(domains)
        r = env.curl_get(f"https://{domain2}:{env.https_port}", options=[
            "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem"
        ])
        assert r.response['status'] == 200
        md2 = env.get_md_status(domain)
        acct2 = md2['ca']['account']
        assert acct2 == acct1, f"ACME account was not reused: {acct1} became {acct2}"

    def test_751_020(self, env):
        # valid config, get cert, check OCSP status
        domain = f"test1.{DEMO_TLD}"
        domains = [domain]
        conf = HttpdConf(env)
        conf.add("MDStapling on")
        conf.start_md(domains)
        conf.add(f"""
            MDCertificateAuthority {DEMO_ACME}
            MDCACertificateFile none
            MDExternalAccountBinding {EABS[1]['kid']} {EABS[1]['hmac']}
            """)
        conf.end_md()
        conf.add_vhost(domains=domains)
        conf.install()
        assert env.apache_restart() == 0
        assert env.await_completion(domains)
        r = env.curl_get(f"https://{domain}:{env.https_port}", options=[
            "--cacert", f"{env.test_dir}/data/sectigo-demo-root.pem"
        ])
        assert r.response['status'] == 200
        time.sleep(1)
        for domain in domains:
            stat = env.await_ocsp_status(domain,
                                         ca_file=f"{env.test_dir}/data/sectigo-demo-root.pem")
            assert stat['ocsp'] == "successful (0x0)"
            assert stat['verify'] == "0 (ok)"
{'fraction_non_alphanumeric': 0.14437301525830687, 'fraction_numerical': 0.014638680195182403, 'mean_word_length': 2.5648812810601878, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 8, 'https://': 12, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 2, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6478428', 'n_tokens_mistral': 4574, 'n_tokens_neox': 4394, 'n_words': 754}