simplify and handle /32 and /128
diff --git a/src/cryptography/hazmat/backends/openssl/x509.py b/src/cryptography/hazmat/backends/openssl/x509.py
index c2a32b2..0aa2e2d 100644
--- a/src/cryptography/hazmat/backends/openssl/x509.py
+++ b/src/cryptography/hazmat/backends/openssl/x509.py
@@ -154,10 +154,14 @@
# find the first 0 bit, which will be the prefix. If another 1
# bit is present after that the netmask is invalid.
base = ipaddress.ip_address(data[:data_len // 2])
- netmask = utils.int_from_bytes(data[data_len // 2:], 'big')
- bits = bin(netmask)[2:]
+ netmask = ipaddress.ip_address(data[data_len // 2:])
+ bits = bin(int(netmask))[2:]
prefix = bits.find('0')
- if bits[prefix:].find('1') != -1:
+ # If no 0 bits are found it is a /32 or /128
+ if prefix == -1:
+ prefix = len(bits)
+
+ if b"1" in bits[prefix:]:
raise ValueError("Invalid netmask")
ip = ipaddress.ip_network(base.exploded + u"/{0}".format(prefix))
diff --git a/tests/test_x509_ext.py b/tests/test_x509_ext.py
index 7a7e79e..af0ffaf 100644
--- a/tests/test_x509_ext.py
+++ b/tests/test_x509_ext.py
@@ -2206,6 +2206,25 @@
]
)
+ def test_single_ip_netmask(self, backend):
+ cert = _load_cert(
+ os.path.join(
+ "x509", "custom", "nc_single_ip_netmask.pem"
+ ),
+ x509.load_pem_x509_certificate,
+ backend
+ )
+ nc = cert.extensions.get_extension_for_oid(
+ x509.OID_NAME_CONSTRAINTS
+ ).value
+ assert nc == x509.NameConstraints(
+ permitted_subtrees=[
+ x509.IPAddress(ipaddress.IPv6Network(u"FF:0:0:0:0:0:0:0/128")),
+ x509.IPAddress(ipaddress.IPv4Network(u"192.168.0.1/32")),
+ ],
+ excluded_subtrees=None
+ )
+
def test_invalid_netmask(self, backend):
cert = _load_cert(
os.path.join(