mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-02-04 08:13:38 +00:00
b64ea720fc
Closes: Debian bug #1088760. - OpenSSL.crypto.sign has been deprecated and in the current version of python3-openssl in Debian testing, it has been dropped. The recommended alternative is cryptography.hazmat.primitives. So, use this instead. - The entire OpenSSL.crypto module is planned to be deprecated in the future. So, stop using it entirely by using cryptography.hazmat.primitives. - sso app does not use openssl anymore, so drop dependency on it. Other apps such as Let's Encrypt do depend on it and but they have their own dependency declared. The freedombox package on the overall retains on 'openssl' package. - We are not using the python OpenSSL module anywhere else, so drop dependency on it. - Use pathlib to simplify some code. - Ensure proper permissions on private and public keys as they are being written to. Tests: - Freshly setup container and ensure that first run succeeds. Permission on the public/private key files and the parent directly are correct. Users are able login to FreedomBox. SSO works when accessing apps such as transmission. - Without patches, setup freedombox container. Apply patches. Permission for keys directory is updated but keys are not overwritten. Login to FreedomBox works. SSO works when accessing apps such as transmission. - Run code to perform signatures using old code and ensure that newer code generates bit-identical signatures. - Running ./run --list-dependencies show 'openssl' and python3-cryptography. - Running unit tests works. - Building debian package works. Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org> Reviewed-by: Joseph Nuthalapati <njoseph@riseup.net>
56 lines
1.7 KiB
Python
56 lines
1.7 KiB
Python
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
"""
|
|
Test module for sso module operations.
|
|
"""
|
|
|
|
import os
|
|
import pathlib
|
|
|
|
import pytest
|
|
|
|
from plinth.modules.sso import privileged
|
|
from plinth.modules.sso.views import PRIVATE_KEY_FILE_NAME
|
|
|
|
pytestmark = pytest.mark.usefixtures('mock_privileged')
|
|
privileged_modules_to_mock = ['plinth.modules.sso.privileged']
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def fixture_keys_directory(tmpdir):
|
|
"""Set keys directory in the actions module."""
|
|
privileged.KEYS_DIRECTORY = str(tmpdir)
|
|
|
|
|
|
@pytest.fixture(name='existing_key_pair')
|
|
def fixture_existing_key_pair():
|
|
"""A fixture to create key pair if needed."""
|
|
privileged.create_key_pair()
|
|
keys_directory = pathlib.Path(privileged.KEYS_DIRECTORY)
|
|
assert keys_directory.stat().st_mode == 0o40750
|
|
assert (keys_directory / 'privkey.pem').stat().st_mode == 0o100440
|
|
assert (keys_directory / 'pubkey.pem').stat().st_mode == 0o100440
|
|
|
|
|
|
def test_generate_ticket(existing_key_pair):
|
|
"""Test generating a ticket."""
|
|
username = 'tester'
|
|
groups = ['freedombox-share', 'syncthing', 'web-search']
|
|
|
|
private_key_file = os.path.join(privileged.KEYS_DIRECTORY,
|
|
PRIVATE_KEY_FILE_NAME)
|
|
ticket = privileged.generate_ticket(username, private_key_file, groups)
|
|
|
|
fields = {}
|
|
for item in ticket.split(';'):
|
|
try:
|
|
key, value = item.split('=')
|
|
fields[key] = value
|
|
except ValueError:
|
|
# The 'sig' field can also contain '='.
|
|
continue
|
|
|
|
assert fields['uid'] == username
|
|
assert int(fields['validuntil']) > 0
|
|
assert fields['tokens'] == ','.join(groups)
|
|
assert int(fields['graceperiod']) > 0
|