Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 1 | # This file is dual licensed under the terms of the Apache License, Version |
| 2 | # 2.0, and the BSD License. See the LICENSE file in the root of this repository |
| 3 | # for complete details. |
| 4 | |
| 5 | from __future__ import absolute_import, division, print_function |
| 6 | |
Paul Kehrer | 0307c37 | 2014-11-27 09:49:31 -1000 | [diff] [blame] | 7 | import binascii |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 8 | import datetime |
Paul Kehrer | 235e5a1 | 2015-07-10 19:45:47 -0500 | [diff] [blame] | 9 | import ipaddress |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 10 | import os |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 11 | |
| 12 | import pytest |
| 13 | |
Ian Cordasco | a908d69 | 2015-06-16 21:35:24 -0500 | [diff] [blame] | 14 | import six |
| 15 | |
Paul Kehrer | 474a647 | 2015-07-11 12:29:52 -0500 | [diff] [blame] | 16 | from cryptography import utils, x509 |
Paul Kehrer | 8802a5b | 2015-02-13 12:06:57 -0600 | [diff] [blame] | 17 | from cryptography.exceptions import UnsupportedAlgorithm |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 18 | from cryptography.hazmat.backends.interfaces import ( |
| 19 | DSABackend, EllipticCurveBackend, RSABackend, X509Backend |
| 20 | ) |
Andre Caron | 476c5df | 2015-05-18 10:23:28 -0400 | [diff] [blame] | 21 | from cryptography.hazmat.primitives import hashes, serialization |
Alex Gaynor | 32c57df | 2015-02-23 21:51:27 -0800 | [diff] [blame] | 22 | from cryptography.hazmat.primitives.asymmetric import dsa, ec, rsa |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 23 | |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 24 | from .hazmat.primitives.fixtures_dsa import DSA_KEY_2048 |
Ian Cordasco | 41f51ce | 2015-06-17 11:49:11 -0500 | [diff] [blame] | 25 | from .hazmat.primitives.fixtures_rsa import RSA_KEY_2048 |
Ian Cordasco | 4d46eb7 | 2015-06-17 12:08:27 -0500 | [diff] [blame] | 26 | from .hazmat.primitives.test_ec import _skip_curve_unsupported |
Paul Kehrer | a9d78c1 | 2014-11-26 10:59:03 -1000 | [diff] [blame] | 27 | from .utils import load_vectors_from_file |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 28 | |
| 29 | |
Paul Kehrer | 474a647 | 2015-07-11 12:29:52 -0500 | [diff] [blame] | 30 | @utils.register_interface(x509.GeneralName) |
| 31 | class FakeGeneralName(object): |
| 32 | def __init__(self, value): |
| 33 | self._value = value |
| 34 | |
| 35 | value = utils.read_only_property("_value") |
| 36 | |
| 37 | |
Paul Kehrer | 4112032 | 2014-12-02 18:31:14 -1000 | [diff] [blame] | 38 | def _load_cert(filename, loader, backend): |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 39 | cert = load_vectors_from_file( |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 40 | filename=filename, |
| 41 | loader=lambda pemfile: loader(pemfile.read(), backend), |
| 42 | mode="rb" |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 43 | ) |
| 44 | return cert |
| 45 | |
| 46 | |
| 47 | @pytest.mark.requires_backend_interface(interface=RSABackend) |
| 48 | @pytest.mark.requires_backend_interface(interface=X509Backend) |
Paul Kehrer | e76cd27 | 2014-12-14 19:00:51 -0600 | [diff] [blame] | 49 | class TestRSACertificate(object): |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 50 | def test_load_pem_cert(self, backend): |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 51 | cert = _load_cert( |
| 52 | os.path.join("x509", "custom", "post2000utctime.pem"), |
Paul Kehrer | 4112032 | 2014-12-02 18:31:14 -1000 | [diff] [blame] | 53 | x509.load_pem_x509_certificate, |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 54 | backend |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 55 | ) |
Paul Kehrer | e76cd27 | 2014-12-14 19:00:51 -0600 | [diff] [blame] | 56 | assert isinstance(cert, x509.Certificate) |
| 57 | assert cert.serial == 11559813051657483483 |
| 58 | fingerprint = binascii.hexlify(cert.fingerprint(hashes.SHA1())) |
| 59 | assert fingerprint == b"2b619ed04bfc9c3b08eb677d272192286a0947a8" |
Paul Kehrer | 8802a5b | 2015-02-13 12:06:57 -0600 | [diff] [blame] | 60 | assert isinstance(cert.signature_hash_algorithm, hashes.SHA1) |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 61 | |
| 62 | def test_load_der_cert(self, backend): |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 63 | cert = _load_cert( |
| 64 | os.path.join("x509", "PKITS_data", "certs", "GoodCACert.crt"), |
Paul Kehrer | 4112032 | 2014-12-02 18:31:14 -1000 | [diff] [blame] | 65 | x509.load_der_x509_certificate, |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 66 | backend |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 67 | ) |
Paul Kehrer | e76cd27 | 2014-12-14 19:00:51 -0600 | [diff] [blame] | 68 | assert isinstance(cert, x509.Certificate) |
| 69 | assert cert.serial == 2 |
| 70 | fingerprint = binascii.hexlify(cert.fingerprint(hashes.SHA1())) |
| 71 | assert fingerprint == b"6f49779533d565e8b7c1062503eab41492c38e4d" |
Paul Kehrer | 8802a5b | 2015-02-13 12:06:57 -0600 | [diff] [blame] | 72 | assert isinstance(cert.signature_hash_algorithm, hashes.SHA256) |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 73 | |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 74 | def test_issuer(self, backend): |
| 75 | cert = _load_cert( |
| 76 | os.path.join( |
| 77 | "x509", "PKITS_data", "certs", |
| 78 | "Validpre2000UTCnotBeforeDateTest3EE.crt" |
| 79 | ), |
| 80 | x509.load_der_x509_certificate, |
| 81 | backend |
| 82 | ) |
| 83 | issuer = cert.issuer |
| 84 | assert isinstance(issuer, x509.Name) |
Paul Kehrer | 8b21a4a | 2015-02-14 07:56:36 -0600 | [diff] [blame] | 85 | assert list(issuer) == [ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 86 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 87 | x509.NameAttribute( |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 88 | x509.OID_ORGANIZATION_NAME, u'Test Certificates 2011' |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 89 | ), |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 90 | x509.NameAttribute(x509.OID_COMMON_NAME, u'Good CA') |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 91 | ] |
Paul Kehrer | e901d64 | 2015-02-11 18:50:58 -0600 | [diff] [blame] | 92 | assert issuer.get_attributes_for_oid(x509.OID_COMMON_NAME) == [ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 93 | x509.NameAttribute(x509.OID_COMMON_NAME, u'Good CA') |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 94 | ] |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 95 | |
| 96 | def test_all_issuer_name_types(self, backend): |
| 97 | cert = _load_cert( |
| 98 | os.path.join( |
| 99 | "x509", "custom", |
| 100 | "all_supported_names.pem" |
| 101 | ), |
| 102 | x509.load_pem_x509_certificate, |
| 103 | backend |
| 104 | ) |
| 105 | issuer = cert.issuer |
| 106 | |
| 107 | assert isinstance(issuer, x509.Name) |
Paul Kehrer | 8b21a4a | 2015-02-14 07:56:36 -0600 | [diff] [blame] | 108 | assert list(issuer) == [ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 109 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
| 110 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'CA'), |
| 111 | x509.NameAttribute(x509.OID_STATE_OR_PROVINCE_NAME, u'Texas'), |
| 112 | x509.NameAttribute(x509.OID_STATE_OR_PROVINCE_NAME, u'Illinois'), |
| 113 | x509.NameAttribute(x509.OID_LOCALITY_NAME, u'Chicago'), |
| 114 | x509.NameAttribute(x509.OID_LOCALITY_NAME, u'Austin'), |
| 115 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, u'Zero, LLC'), |
| 116 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, u'One, LLC'), |
| 117 | x509.NameAttribute(x509.OID_COMMON_NAME, u'common name 0'), |
| 118 | x509.NameAttribute(x509.OID_COMMON_NAME, u'common name 1'), |
| 119 | x509.NameAttribute(x509.OID_ORGANIZATIONAL_UNIT_NAME, u'OU 0'), |
| 120 | x509.NameAttribute(x509.OID_ORGANIZATIONAL_UNIT_NAME, u'OU 1'), |
| 121 | x509.NameAttribute(x509.OID_DN_QUALIFIER, u'dnQualifier0'), |
| 122 | x509.NameAttribute(x509.OID_DN_QUALIFIER, u'dnQualifier1'), |
| 123 | x509.NameAttribute(x509.OID_SERIAL_NUMBER, u'123'), |
| 124 | x509.NameAttribute(x509.OID_SERIAL_NUMBER, u'456'), |
| 125 | x509.NameAttribute(x509.OID_TITLE, u'Title 0'), |
| 126 | x509.NameAttribute(x509.OID_TITLE, u'Title 1'), |
| 127 | x509.NameAttribute(x509.OID_SURNAME, u'Surname 0'), |
| 128 | x509.NameAttribute(x509.OID_SURNAME, u'Surname 1'), |
| 129 | x509.NameAttribute(x509.OID_GIVEN_NAME, u'Given Name 0'), |
| 130 | x509.NameAttribute(x509.OID_GIVEN_NAME, u'Given Name 1'), |
| 131 | x509.NameAttribute(x509.OID_PSEUDONYM, u'Incognito 0'), |
| 132 | x509.NameAttribute(x509.OID_PSEUDONYM, u'Incognito 1'), |
| 133 | x509.NameAttribute(x509.OID_GENERATION_QUALIFIER, u'Last Gen'), |
| 134 | x509.NameAttribute(x509.OID_GENERATION_QUALIFIER, u'Next Gen'), |
| 135 | x509.NameAttribute(x509.OID_DOMAIN_COMPONENT, u'dc0'), |
| 136 | x509.NameAttribute(x509.OID_DOMAIN_COMPONENT, u'dc1'), |
| 137 | x509.NameAttribute(x509.OID_EMAIL_ADDRESS, u'test0@test.local'), |
| 138 | x509.NameAttribute(x509.OID_EMAIL_ADDRESS, u'test1@test.local'), |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 139 | ] |
| 140 | |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 141 | def test_subject(self, backend): |
| 142 | cert = _load_cert( |
| 143 | os.path.join( |
| 144 | "x509", "PKITS_data", "certs", |
| 145 | "Validpre2000UTCnotBeforeDateTest3EE.crt" |
| 146 | ), |
| 147 | x509.load_der_x509_certificate, |
| 148 | backend |
| 149 | ) |
| 150 | subject = cert.subject |
| 151 | assert isinstance(subject, x509.Name) |
Paul Kehrer | 8b21a4a | 2015-02-14 07:56:36 -0600 | [diff] [blame] | 152 | assert list(subject) == [ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 153 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 154 | x509.NameAttribute( |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 155 | x509.OID_ORGANIZATION_NAME, u'Test Certificates 2011' |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 156 | ), |
| 157 | x509.NameAttribute( |
| 158 | x509.OID_COMMON_NAME, |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 159 | u'Valid pre2000 UTC notBefore Date EE Certificate Test3' |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 160 | ) |
| 161 | ] |
Paul Kehrer | e901d64 | 2015-02-11 18:50:58 -0600 | [diff] [blame] | 162 | assert subject.get_attributes_for_oid(x509.OID_COMMON_NAME) == [ |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 163 | x509.NameAttribute( |
| 164 | x509.OID_COMMON_NAME, |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 165 | u'Valid pre2000 UTC notBefore Date EE Certificate Test3' |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 166 | ) |
| 167 | ] |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 168 | |
| 169 | def test_unicode_name(self, backend): |
| 170 | cert = _load_cert( |
| 171 | os.path.join( |
| 172 | "x509", "custom", |
| 173 | "utf8_common_name.pem" |
| 174 | ), |
| 175 | x509.load_pem_x509_certificate, |
| 176 | backend |
| 177 | ) |
Paul Kehrer | e901d64 | 2015-02-11 18:50:58 -0600 | [diff] [blame] | 178 | assert cert.subject.get_attributes_for_oid(x509.OID_COMMON_NAME) == [ |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 179 | x509.NameAttribute( |
| 180 | x509.OID_COMMON_NAME, |
Eeshan Garg | f123415 | 2015-04-29 18:41:00 +0530 | [diff] [blame] | 181 | u'We heart UTF8!\u2122' |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 182 | ) |
| 183 | ] |
Paul Kehrer | e901d64 | 2015-02-11 18:50:58 -0600 | [diff] [blame] | 184 | assert cert.issuer.get_attributes_for_oid(x509.OID_COMMON_NAME) == [ |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 185 | x509.NameAttribute( |
| 186 | x509.OID_COMMON_NAME, |
Eeshan Garg | f123415 | 2015-04-29 18:41:00 +0530 | [diff] [blame] | 187 | u'We heart UTF8!\u2122' |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 188 | ) |
| 189 | ] |
| 190 | |
| 191 | def test_all_subject_name_types(self, backend): |
| 192 | cert = _load_cert( |
| 193 | os.path.join( |
| 194 | "x509", "custom", |
| 195 | "all_supported_names.pem" |
| 196 | ), |
| 197 | x509.load_pem_x509_certificate, |
| 198 | backend |
| 199 | ) |
| 200 | subject = cert.subject |
| 201 | assert isinstance(subject, x509.Name) |
Paul Kehrer | 8b21a4a | 2015-02-14 07:56:36 -0600 | [diff] [blame] | 202 | assert list(subject) == [ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 203 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'AU'), |
| 204 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'DE'), |
| 205 | x509.NameAttribute(x509.OID_STATE_OR_PROVINCE_NAME, u'California'), |
| 206 | x509.NameAttribute(x509.OID_STATE_OR_PROVINCE_NAME, u'New York'), |
| 207 | x509.NameAttribute(x509.OID_LOCALITY_NAME, u'San Francisco'), |
| 208 | x509.NameAttribute(x509.OID_LOCALITY_NAME, u'Ithaca'), |
| 209 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, u'Org Zero, LLC'), |
| 210 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, u'Org One, LLC'), |
| 211 | x509.NameAttribute(x509.OID_COMMON_NAME, u'CN 0'), |
| 212 | x509.NameAttribute(x509.OID_COMMON_NAME, u'CN 1'), |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 213 | x509.NameAttribute( |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 214 | x509.OID_ORGANIZATIONAL_UNIT_NAME, u'Engineering 0' |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 215 | ), |
| 216 | x509.NameAttribute( |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 217 | x509.OID_ORGANIZATIONAL_UNIT_NAME, u'Engineering 1' |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 218 | ), |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 219 | x509.NameAttribute(x509.OID_DN_QUALIFIER, u'qualified0'), |
| 220 | x509.NameAttribute(x509.OID_DN_QUALIFIER, u'qualified1'), |
| 221 | x509.NameAttribute(x509.OID_SERIAL_NUMBER, u'789'), |
| 222 | x509.NameAttribute(x509.OID_SERIAL_NUMBER, u'012'), |
| 223 | x509.NameAttribute(x509.OID_TITLE, u'Title IX'), |
| 224 | x509.NameAttribute(x509.OID_TITLE, u'Title X'), |
| 225 | x509.NameAttribute(x509.OID_SURNAME, u'Last 0'), |
| 226 | x509.NameAttribute(x509.OID_SURNAME, u'Last 1'), |
| 227 | x509.NameAttribute(x509.OID_GIVEN_NAME, u'First 0'), |
| 228 | x509.NameAttribute(x509.OID_GIVEN_NAME, u'First 1'), |
| 229 | x509.NameAttribute(x509.OID_PSEUDONYM, u'Guy Incognito 0'), |
| 230 | x509.NameAttribute(x509.OID_PSEUDONYM, u'Guy Incognito 1'), |
| 231 | x509.NameAttribute(x509.OID_GENERATION_QUALIFIER, u'32X'), |
| 232 | x509.NameAttribute(x509.OID_GENERATION_QUALIFIER, u'Dreamcast'), |
| 233 | x509.NameAttribute(x509.OID_DOMAIN_COMPONENT, u'dc2'), |
| 234 | x509.NameAttribute(x509.OID_DOMAIN_COMPONENT, u'dc3'), |
| 235 | x509.NameAttribute(x509.OID_EMAIL_ADDRESS, u'test2@test.local'), |
| 236 | x509.NameAttribute(x509.OID_EMAIL_ADDRESS, u'test3@test.local'), |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 237 | ] |
| 238 | |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 239 | def test_load_good_ca_cert(self, backend): |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 240 | cert = _load_cert( |
| 241 | os.path.join("x509", "PKITS_data", "certs", "GoodCACert.crt"), |
Paul Kehrer | 4112032 | 2014-12-02 18:31:14 -1000 | [diff] [blame] | 242 | x509.load_der_x509_certificate, |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 243 | backend |
| 244 | ) |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 245 | |
Paul Kehrer | d9fc725 | 2014-12-11 12:25:00 -0600 | [diff] [blame] | 246 | assert cert.not_valid_before == datetime.datetime(2010, 1, 1, 8, 30) |
| 247 | assert cert.not_valid_after == datetime.datetime(2030, 12, 31, 8, 30) |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 248 | assert cert.serial == 2 |
| 249 | public_key = cert.public_key() |
Alex Gaynor | 32c57df | 2015-02-23 21:51:27 -0800 | [diff] [blame] | 250 | assert isinstance(public_key, rsa.RSAPublicKey) |
Paul Kehrer | e76cd27 | 2014-12-14 19:00:51 -0600 | [diff] [blame] | 251 | assert cert.version is x509.Version.v3 |
Paul Kehrer | 0307c37 | 2014-11-27 09:49:31 -1000 | [diff] [blame] | 252 | fingerprint = binascii.hexlify(cert.fingerprint(hashes.SHA1())) |
Paul Kehrer | 4e1db79 | 2014-11-27 10:50:55 -1000 | [diff] [blame] | 253 | assert fingerprint == b"6f49779533d565e8b7c1062503eab41492c38e4d" |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 254 | |
Paul Kehrer | 1eb5b86 | 2014-11-26 11:44:03 -1000 | [diff] [blame] | 255 | def test_utc_pre_2000_not_before_cert(self, backend): |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 256 | cert = _load_cert( |
| 257 | os.path.join( |
| 258 | "x509", "PKITS_data", "certs", |
| 259 | "Validpre2000UTCnotBeforeDateTest3EE.crt" |
| 260 | ), |
Paul Kehrer | 4112032 | 2014-12-02 18:31:14 -1000 | [diff] [blame] | 261 | x509.load_der_x509_certificate, |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 262 | backend |
| 263 | ) |
| 264 | |
Paul Kehrer | d9fc725 | 2014-12-11 12:25:00 -0600 | [diff] [blame] | 265 | assert cert.not_valid_before == datetime.datetime(1950, 1, 1, 12, 1) |
Paul Kehrer | 1eb5b86 | 2014-11-26 11:44:03 -1000 | [diff] [blame] | 266 | |
| 267 | def test_pre_2000_utc_not_after_cert(self, backend): |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 268 | cert = _load_cert( |
| 269 | os.path.join( |
| 270 | "x509", "PKITS_data", "certs", |
| 271 | "Invalidpre2000UTCEEnotAfterDateTest7EE.crt" |
| 272 | ), |
Paul Kehrer | 4112032 | 2014-12-02 18:31:14 -1000 | [diff] [blame] | 273 | x509.load_der_x509_certificate, |
Paul Kehrer | 1eb5b86 | 2014-11-26 11:44:03 -1000 | [diff] [blame] | 274 | backend |
| 275 | ) |
| 276 | |
Paul Kehrer | d9fc725 | 2014-12-11 12:25:00 -0600 | [diff] [blame] | 277 | assert cert.not_valid_after == datetime.datetime(1999, 1, 1, 12, 1) |
Paul Kehrer | 1eb5b86 | 2014-11-26 11:44:03 -1000 | [diff] [blame] | 278 | |
| 279 | def test_post_2000_utc_cert(self, backend): |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 280 | cert = _load_cert( |
Paul Kehrer | 1eb5b86 | 2014-11-26 11:44:03 -1000 | [diff] [blame] | 281 | os.path.join("x509", "custom", "post2000utctime.pem"), |
Paul Kehrer | 4112032 | 2014-12-02 18:31:14 -1000 | [diff] [blame] | 282 | x509.load_pem_x509_certificate, |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 283 | backend |
Paul Kehrer | 1eb5b86 | 2014-11-26 11:44:03 -1000 | [diff] [blame] | 284 | ) |
Paul Kehrer | d9fc725 | 2014-12-11 12:25:00 -0600 | [diff] [blame] | 285 | assert cert.not_valid_before == datetime.datetime( |
| 286 | 2014, 11, 26, 21, 41, 20 |
| 287 | ) |
| 288 | assert cert.not_valid_after == datetime.datetime( |
| 289 | 2014, 12, 26, 21, 41, 20 |
| 290 | ) |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 291 | |
| 292 | def test_generalized_time_not_before_cert(self, backend): |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 293 | cert = _load_cert( |
| 294 | os.path.join( |
| 295 | "x509", "PKITS_data", "certs", |
| 296 | "ValidGeneralizedTimenotBeforeDateTest4EE.crt" |
| 297 | ), |
Paul Kehrer | 4112032 | 2014-12-02 18:31:14 -1000 | [diff] [blame] | 298 | x509.load_der_x509_certificate, |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 299 | backend |
| 300 | ) |
Paul Kehrer | d9fc725 | 2014-12-11 12:25:00 -0600 | [diff] [blame] | 301 | assert cert.not_valid_before == datetime.datetime(2002, 1, 1, 12, 1) |
| 302 | assert cert.not_valid_after == datetime.datetime(2030, 12, 31, 8, 30) |
Paul Kehrer | e76cd27 | 2014-12-14 19:00:51 -0600 | [diff] [blame] | 303 | assert cert.version is x509.Version.v3 |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 304 | |
| 305 | def test_generalized_time_not_after_cert(self, backend): |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 306 | cert = _load_cert( |
| 307 | os.path.join( |
| 308 | "x509", "PKITS_data", "certs", |
| 309 | "ValidGeneralizedTimenotAfterDateTest8EE.crt" |
| 310 | ), |
Paul Kehrer | 4112032 | 2014-12-02 18:31:14 -1000 | [diff] [blame] | 311 | x509.load_der_x509_certificate, |
Paul Kehrer | 016e08a | 2014-11-26 09:41:18 -1000 | [diff] [blame] | 312 | backend |
| 313 | ) |
Paul Kehrer | d9fc725 | 2014-12-11 12:25:00 -0600 | [diff] [blame] | 314 | assert cert.not_valid_before == datetime.datetime(2010, 1, 1, 8, 30) |
| 315 | assert cert.not_valid_after == datetime.datetime(2050, 1, 1, 12, 1) |
Paul Kehrer | e76cd27 | 2014-12-14 19:00:51 -0600 | [diff] [blame] | 316 | assert cert.version is x509.Version.v3 |
Paul Kehrer | a9d78c1 | 2014-11-26 10:59:03 -1000 | [diff] [blame] | 317 | |
| 318 | def test_invalid_version_cert(self, backend): |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 319 | cert = _load_cert( |
Paul Kehrer | a9d78c1 | 2014-11-26 10:59:03 -1000 | [diff] [blame] | 320 | os.path.join("x509", "custom", "invalid_version.pem"), |
Paul Kehrer | 4112032 | 2014-12-02 18:31:14 -1000 | [diff] [blame] | 321 | x509.load_pem_x509_certificate, |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 322 | backend |
Paul Kehrer | a9d78c1 | 2014-11-26 10:59:03 -1000 | [diff] [blame] | 323 | ) |
Paul Kehrer | d5cccf7 | 2014-12-15 17:20:33 -0600 | [diff] [blame] | 324 | with pytest.raises(x509.InvalidVersion) as exc: |
Paul Kehrer | a9d78c1 | 2014-11-26 10:59:03 -1000 | [diff] [blame] | 325 | cert.version |
Paul Kehrer | 30c5ccd | 2014-11-26 11:10:28 -1000 | [diff] [blame] | 326 | |
Paul Kehrer | d5cccf7 | 2014-12-15 17:20:33 -0600 | [diff] [blame] | 327 | assert exc.value.parsed_version == 7 |
| 328 | |
Paul Kehrer | 8bbdc6f | 2015-04-30 16:47:16 -0500 | [diff] [blame] | 329 | def test_eq(self, backend): |
| 330 | cert = _load_cert( |
| 331 | os.path.join("x509", "custom", "post2000utctime.pem"), |
| 332 | x509.load_pem_x509_certificate, |
| 333 | backend |
| 334 | ) |
| 335 | cert2 = _load_cert( |
| 336 | os.path.join("x509", "custom", "post2000utctime.pem"), |
| 337 | x509.load_pem_x509_certificate, |
| 338 | backend |
| 339 | ) |
| 340 | assert cert == cert2 |
| 341 | |
| 342 | def test_ne(self, backend): |
| 343 | cert = _load_cert( |
| 344 | os.path.join("x509", "custom", "post2000utctime.pem"), |
| 345 | x509.load_pem_x509_certificate, |
| 346 | backend |
| 347 | ) |
| 348 | cert2 = _load_cert( |
| 349 | os.path.join( |
| 350 | "x509", "PKITS_data", "certs", |
| 351 | "ValidGeneralizedTimenotAfterDateTest8EE.crt" |
| 352 | ), |
| 353 | x509.load_der_x509_certificate, |
| 354 | backend |
| 355 | ) |
| 356 | assert cert != cert2 |
| 357 | assert cert != object() |
| 358 | |
Alex Gaynor | 969f3a5 | 2015-07-06 18:52:41 -0400 | [diff] [blame] | 359 | def test_hash(self, backend): |
| 360 | cert1 = _load_cert( |
| 361 | os.path.join("x509", "custom", "post2000utctime.pem"), |
| 362 | x509.load_pem_x509_certificate, |
| 363 | backend |
| 364 | ) |
| 365 | cert2 = _load_cert( |
| 366 | os.path.join("x509", "custom", "post2000utctime.pem"), |
| 367 | x509.load_pem_x509_certificate, |
| 368 | backend |
| 369 | ) |
| 370 | cert3 = _load_cert( |
| 371 | os.path.join( |
| 372 | "x509", "PKITS_data", "certs", |
| 373 | "ValidGeneralizedTimenotAfterDateTest8EE.crt" |
| 374 | ), |
| 375 | x509.load_der_x509_certificate, |
| 376 | backend |
| 377 | ) |
| 378 | |
| 379 | assert hash(cert1) == hash(cert2) |
| 380 | assert hash(cert1) != hash(cert3) |
| 381 | |
Paul Kehrer | 30c5ccd | 2014-11-26 11:10:28 -1000 | [diff] [blame] | 382 | def test_version_1_cert(self, backend): |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 383 | cert = _load_cert( |
Paul Kehrer | 30c5ccd | 2014-11-26 11:10:28 -1000 | [diff] [blame] | 384 | os.path.join("x509", "v1_cert.pem"), |
Paul Kehrer | 4112032 | 2014-12-02 18:31:14 -1000 | [diff] [blame] | 385 | x509.load_pem_x509_certificate, |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 386 | backend |
Paul Kehrer | 30c5ccd | 2014-11-26 11:10:28 -1000 | [diff] [blame] | 387 | ) |
Paul Kehrer | e76cd27 | 2014-12-14 19:00:51 -0600 | [diff] [blame] | 388 | assert cert.version is x509.Version.v1 |
Paul Kehrer | 7638c31 | 2014-11-26 11:13:31 -1000 | [diff] [blame] | 389 | |
| 390 | def test_invalid_pem(self, backend): |
| 391 | with pytest.raises(ValueError): |
| 392 | x509.load_pem_x509_certificate(b"notacert", backend) |
| 393 | |
| 394 | def test_invalid_der(self, backend): |
| 395 | with pytest.raises(ValueError): |
| 396 | x509.load_der_x509_certificate(b"notacert", backend) |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 397 | |
Paul Kehrer | 8802a5b | 2015-02-13 12:06:57 -0600 | [diff] [blame] | 398 | def test_unsupported_signature_hash_algorithm_cert(self, backend): |
| 399 | cert = _load_cert( |
| 400 | os.path.join("x509", "verisign_md2_root.pem"), |
| 401 | x509.load_pem_x509_certificate, |
| 402 | backend |
| 403 | ) |
| 404 | with pytest.raises(UnsupportedAlgorithm): |
| 405 | cert.signature_hash_algorithm |
| 406 | |
Andre Caron | a8aded6 | 2015-05-19 20:11:57 -0400 | [diff] [blame] | 407 | def test_public_bytes_pem(self, backend): |
| 408 | # Load an existing certificate. |
| 409 | cert = _load_cert( |
| 410 | os.path.join("x509", "PKITS_data", "certs", "GoodCACert.crt"), |
| 411 | x509.load_der_x509_certificate, |
| 412 | backend |
| 413 | ) |
| 414 | |
| 415 | # Encode it to PEM and load it back. |
| 416 | cert = x509.load_pem_x509_certificate(cert.public_bytes( |
| 417 | encoding=serialization.Encoding.PEM, |
| 418 | ), backend) |
| 419 | |
| 420 | # We should recover what we had to start with. |
| 421 | assert cert.not_valid_before == datetime.datetime(2010, 1, 1, 8, 30) |
| 422 | assert cert.not_valid_after == datetime.datetime(2030, 12, 31, 8, 30) |
| 423 | assert cert.serial == 2 |
| 424 | public_key = cert.public_key() |
| 425 | assert isinstance(public_key, rsa.RSAPublicKey) |
| 426 | assert cert.version is x509.Version.v3 |
| 427 | fingerprint = binascii.hexlify(cert.fingerprint(hashes.SHA1())) |
| 428 | assert fingerprint == b"6f49779533d565e8b7c1062503eab41492c38e4d" |
| 429 | |
| 430 | def test_public_bytes_der(self, backend): |
| 431 | # Load an existing certificate. |
| 432 | cert = _load_cert( |
| 433 | os.path.join("x509", "PKITS_data", "certs", "GoodCACert.crt"), |
| 434 | x509.load_der_x509_certificate, |
| 435 | backend |
| 436 | ) |
| 437 | |
| 438 | # Encode it to DER and load it back. |
| 439 | cert = x509.load_der_x509_certificate(cert.public_bytes( |
| 440 | encoding=serialization.Encoding.DER, |
| 441 | ), backend) |
| 442 | |
| 443 | # We should recover what we had to start with. |
| 444 | assert cert.not_valid_before == datetime.datetime(2010, 1, 1, 8, 30) |
| 445 | assert cert.not_valid_after == datetime.datetime(2030, 12, 31, 8, 30) |
| 446 | assert cert.serial == 2 |
| 447 | public_key = cert.public_key() |
| 448 | assert isinstance(public_key, rsa.RSAPublicKey) |
| 449 | assert cert.version is x509.Version.v3 |
| 450 | fingerprint = binascii.hexlify(cert.fingerprint(hashes.SHA1())) |
| 451 | assert fingerprint == b"6f49779533d565e8b7c1062503eab41492c38e4d" |
| 452 | |
| 453 | def test_public_bytes_invalid_encoding(self, backend): |
| 454 | cert = _load_cert( |
| 455 | os.path.join("x509", "PKITS_data", "certs", "GoodCACert.crt"), |
| 456 | x509.load_der_x509_certificate, |
| 457 | backend |
| 458 | ) |
| 459 | |
| 460 | with pytest.raises(TypeError): |
| 461 | cert.public_bytes('NotAnEncoding') |
| 462 | |
| 463 | @pytest.mark.parametrize( |
| 464 | ("cert_path", "loader_func", "encoding"), |
| 465 | [ |
| 466 | ( |
| 467 | os.path.join("x509", "v1_cert.pem"), |
| 468 | x509.load_pem_x509_certificate, |
| 469 | serialization.Encoding.PEM, |
| 470 | ), |
| 471 | ( |
| 472 | os.path.join("x509", "PKITS_data", "certs", "GoodCACert.crt"), |
| 473 | x509.load_der_x509_certificate, |
| 474 | serialization.Encoding.DER, |
| 475 | ), |
| 476 | ] |
| 477 | ) |
| 478 | def test_public_bytes_match(self, cert_path, loader_func, encoding, |
| 479 | backend): |
| 480 | cert_bytes = load_vectors_from_file( |
| 481 | cert_path, lambda pemfile: pemfile.read(), mode="rb" |
| 482 | ) |
| 483 | cert = loader_func(cert_bytes, backend) |
| 484 | serialized = cert.public_bytes(encoding) |
| 485 | assert serialized == cert_bytes |
| 486 | |
Major Hayden | f315af2 | 2015-06-17 14:02:26 -0500 | [diff] [blame] | 487 | def test_certificate_repr(self, backend): |
| 488 | cert = _load_cert( |
| 489 | os.path.join( |
| 490 | "x509", "cryptography.io.pem" |
| 491 | ), |
| 492 | x509.load_pem_x509_certificate, |
| 493 | backend |
| 494 | ) |
| 495 | if six.PY3: |
| 496 | assert repr(cert) == ( |
| 497 | "<Certificate(subject=<Name([<NameAttribute(oid=<ObjectIdentif" |
| 498 | "ier(oid=2.5.4.11, name=organizationalUnitName)>, value='GT487" |
| 499 | "42965')>, <NameAttribute(oid=<ObjectIdentifier(oid=2.5.4.11, " |
| 500 | "name=organizationalUnitName)>, value='See www.rapidssl.com/re" |
| 501 | "sources/cps (c)14')>, <NameAttribute(oid=<ObjectIdentifier(oi" |
| 502 | "d=2.5.4.11, name=organizationalUnitName)>, value='Domain Cont" |
| 503 | "rol Validated - RapidSSL(R)')>, <NameAttribute(oid=<ObjectIde" |
| 504 | "ntifier(oid=2.5.4.3, name=commonName)>, value='www.cryptograp" |
| 505 | "hy.io')>])>, ...)>" |
| 506 | ) |
| 507 | else: |
| 508 | assert repr(cert) == ( |
| 509 | "<Certificate(subject=<Name([<NameAttribute(oid=<ObjectIdentif" |
| 510 | "ier(oid=2.5.4.11, name=organizationalUnitName)>, value=u'GT48" |
| 511 | "742965')>, <NameAttribute(oid=<ObjectIdentifier(oid=2.5.4.11," |
| 512 | " name=organizationalUnitName)>, value=u'See www.rapidssl.com/" |
| 513 | "resources/cps (c)14')>, <NameAttribute(oid=<ObjectIdentifier(" |
| 514 | "oid=2.5.4.11, name=organizationalUnitName)>, value=u'Domain C" |
| 515 | "ontrol Validated - RapidSSL(R)')>, <NameAttribute(oid=<Object" |
| 516 | "Identifier(oid=2.5.4.3, name=commonName)>, value=u'www.crypto" |
| 517 | "graphy.io')>])>, ...)>" |
| 518 | ) |
| 519 | |
Andre Caron | a8aded6 | 2015-05-19 20:11:57 -0400 | [diff] [blame] | 520 | |
| 521 | @pytest.mark.requires_backend_interface(interface=RSABackend) |
| 522 | @pytest.mark.requires_backend_interface(interface=X509Backend) |
| 523 | class TestRSACertificateRequest(object): |
Paul Kehrer | 1effb6e | 2015-03-30 15:05:59 -0500 | [diff] [blame] | 524 | @pytest.mark.parametrize( |
| 525 | ("path", "loader_func"), |
| 526 | [ |
| 527 | [ |
| 528 | os.path.join("x509", "requests", "rsa_sha1.pem"), |
| 529 | x509.load_pem_x509_csr |
| 530 | ], |
| 531 | [ |
| 532 | os.path.join("x509", "requests", "rsa_sha1.der"), |
| 533 | x509.load_der_x509_csr |
| 534 | ], |
| 535 | ] |
| 536 | ) |
| 537 | def test_load_rsa_certificate_request(self, path, loader_func, backend): |
| 538 | request = _load_cert(path, loader_func, backend) |
Paul Kehrer | dc480ad | 2015-02-23 12:14:54 -0600 | [diff] [blame] | 539 | assert isinstance(request.signature_hash_algorithm, hashes.SHA1) |
| 540 | public_key = request.public_key() |
| 541 | assert isinstance(public_key, rsa.RSAPublicKey) |
| 542 | subject = request.subject |
| 543 | assert isinstance(subject, x509.Name) |
| 544 | assert list(subject) == [ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 545 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
| 546 | x509.NameAttribute(x509.OID_STATE_OR_PROVINCE_NAME, u'Texas'), |
| 547 | x509.NameAttribute(x509.OID_LOCALITY_NAME, u'Austin'), |
| 548 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, u'PyCA'), |
| 549 | x509.NameAttribute(x509.OID_COMMON_NAME, u'cryptography.io'), |
Paul Kehrer | dc480ad | 2015-02-23 12:14:54 -0600 | [diff] [blame] | 550 | ] |
Andre Caron | 6e721a9 | 2015-05-17 15:08:48 -0400 | [diff] [blame] | 551 | extensions = request.extensions |
| 552 | assert isinstance(extensions, x509.Extensions) |
| 553 | assert list(extensions) == [] |
Paul Kehrer | dc480ad | 2015-02-23 12:14:54 -0600 | [diff] [blame] | 554 | |
Paul Kehrer | 1effb6e | 2015-03-30 15:05:59 -0500 | [diff] [blame] | 555 | @pytest.mark.parametrize( |
| 556 | "loader_func", |
| 557 | [x509.load_pem_x509_csr, x509.load_der_x509_csr] |
| 558 | ) |
| 559 | def test_invalid_certificate_request(self, loader_func, backend): |
Paul Kehrer | b759e29 | 2015-03-17 07:34:41 -0500 | [diff] [blame] | 560 | with pytest.raises(ValueError): |
Paul Kehrer | 1effb6e | 2015-03-30 15:05:59 -0500 | [diff] [blame] | 561 | loader_func(b"notacsr", backend) |
Paul Kehrer | b759e29 | 2015-03-17 07:34:41 -0500 | [diff] [blame] | 562 | |
Paul Kehrer | dc480ad | 2015-02-23 12:14:54 -0600 | [diff] [blame] | 563 | def test_unsupported_signature_hash_algorithm_request(self, backend): |
| 564 | request = _load_cert( |
| 565 | os.path.join("x509", "requests", "rsa_md4.pem"), |
Paul Kehrer | 31e3988 | 2015-03-11 11:37:04 -0500 | [diff] [blame] | 566 | x509.load_pem_x509_csr, |
Paul Kehrer | dc480ad | 2015-02-23 12:14:54 -0600 | [diff] [blame] | 567 | backend |
| 568 | ) |
| 569 | with pytest.raises(UnsupportedAlgorithm): |
| 570 | request.signature_hash_algorithm |
| 571 | |
Andre Caron | 6e721a9 | 2015-05-17 15:08:48 -0400 | [diff] [blame] | 572 | def test_duplicate_extension(self, backend): |
| 573 | request = _load_cert( |
| 574 | os.path.join( |
| 575 | "x509", "requests", "two_basic_constraints.pem" |
| 576 | ), |
| 577 | x509.load_pem_x509_csr, |
| 578 | backend |
| 579 | ) |
| 580 | with pytest.raises(x509.DuplicateExtension) as exc: |
| 581 | request.extensions |
| 582 | |
| 583 | assert exc.value.oid == x509.OID_BASIC_CONSTRAINTS |
| 584 | |
| 585 | def test_unsupported_critical_extension(self, backend): |
| 586 | request = _load_cert( |
| 587 | os.path.join( |
| 588 | "x509", "requests", "unsupported_extension_critical.pem" |
| 589 | ), |
| 590 | x509.load_pem_x509_csr, |
| 591 | backend |
| 592 | ) |
| 593 | with pytest.raises(x509.UnsupportedExtension) as exc: |
| 594 | request.extensions |
| 595 | |
| 596 | assert exc.value.oid == x509.ObjectIdentifier('1.2.3.4') |
| 597 | |
| 598 | def test_unsupported_extension(self, backend): |
| 599 | request = _load_cert( |
| 600 | os.path.join( |
| 601 | "x509", "requests", "unsupported_extension.pem" |
| 602 | ), |
| 603 | x509.load_pem_x509_csr, |
| 604 | backend |
| 605 | ) |
| 606 | extensions = request.extensions |
| 607 | assert len(extensions) == 0 |
| 608 | |
| 609 | def test_request_basic_constraints(self, backend): |
| 610 | request = _load_cert( |
| 611 | os.path.join( |
| 612 | "x509", "requests", "basic_constraints.pem" |
| 613 | ), |
| 614 | x509.load_pem_x509_csr, |
| 615 | backend |
| 616 | ) |
| 617 | extensions = request.extensions |
| 618 | assert isinstance(extensions, x509.Extensions) |
| 619 | assert list(extensions) == [ |
| 620 | x509.Extension( |
| 621 | x509.OID_BASIC_CONSTRAINTS, |
| 622 | True, |
Ian Cordasco | 0112b02 | 2015-06-16 17:51:18 -0500 | [diff] [blame] | 623 | x509.BasicConstraints(ca=True, path_length=1), |
Andre Caron | 6e721a9 | 2015-05-17 15:08:48 -0400 | [diff] [blame] | 624 | ), |
| 625 | ] |
| 626 | |
Alex Gaynor | 37b82df | 2015-07-03 10:26:37 -0400 | [diff] [blame] | 627 | def test_subject_alt_name(self, backend): |
| 628 | request = _load_cert( |
| 629 | os.path.join("x509", "requests", "san_rsa_sha1.pem"), |
| 630 | x509.load_pem_x509_csr, |
| 631 | backend, |
| 632 | ) |
| 633 | ext = request.extensions.get_extension_for_oid( |
| 634 | x509.OID_SUBJECT_ALTERNATIVE_NAME |
| 635 | ) |
| 636 | assert list(ext.value) == [ |
| 637 | x509.DNSName(u"cryptography.io"), |
| 638 | x509.DNSName(u"sub.cryptography.io"), |
| 639 | ] |
| 640 | |
Andre Caron | f27e4f4 | 2015-05-18 17:54:59 -0400 | [diff] [blame] | 641 | def test_public_bytes_pem(self, backend): |
Andre Caron | 476c5df | 2015-05-18 10:23:28 -0400 | [diff] [blame] | 642 | # Load an existing CSR. |
| 643 | request = _load_cert( |
| 644 | os.path.join("x509", "requests", "rsa_sha1.pem"), |
| 645 | x509.load_pem_x509_csr, |
| 646 | backend |
| 647 | ) |
| 648 | |
| 649 | # Encode it to PEM and load it back. |
| 650 | request = x509.load_pem_x509_csr(request.public_bytes( |
| 651 | encoding=serialization.Encoding.PEM, |
| 652 | ), backend) |
| 653 | |
| 654 | # We should recover what we had to start with. |
| 655 | assert isinstance(request.signature_hash_algorithm, hashes.SHA1) |
| 656 | public_key = request.public_key() |
| 657 | assert isinstance(public_key, rsa.RSAPublicKey) |
| 658 | subject = request.subject |
| 659 | assert isinstance(subject, x509.Name) |
| 660 | assert list(subject) == [ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 661 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
| 662 | x509.NameAttribute(x509.OID_STATE_OR_PROVINCE_NAME, u'Texas'), |
| 663 | x509.NameAttribute(x509.OID_LOCALITY_NAME, u'Austin'), |
| 664 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, u'PyCA'), |
| 665 | x509.NameAttribute(x509.OID_COMMON_NAME, u'cryptography.io'), |
Andre Caron | 476c5df | 2015-05-18 10:23:28 -0400 | [diff] [blame] | 666 | ] |
| 667 | |
Andre Caron | f27e4f4 | 2015-05-18 17:54:59 -0400 | [diff] [blame] | 668 | def test_public_bytes_der(self, backend): |
Andre Caron | 476c5df | 2015-05-18 10:23:28 -0400 | [diff] [blame] | 669 | # Load an existing CSR. |
| 670 | request = _load_cert( |
| 671 | os.path.join("x509", "requests", "rsa_sha1.pem"), |
| 672 | x509.load_pem_x509_csr, |
| 673 | backend |
| 674 | ) |
| 675 | |
| 676 | # Encode it to DER and load it back. |
| 677 | request = x509.load_der_x509_csr(request.public_bytes( |
| 678 | encoding=serialization.Encoding.DER, |
| 679 | ), backend) |
| 680 | |
| 681 | # We should recover what we had to start with. |
| 682 | assert isinstance(request.signature_hash_algorithm, hashes.SHA1) |
| 683 | public_key = request.public_key() |
| 684 | assert isinstance(public_key, rsa.RSAPublicKey) |
| 685 | subject = request.subject |
| 686 | assert isinstance(subject, x509.Name) |
| 687 | assert list(subject) == [ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 688 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
| 689 | x509.NameAttribute(x509.OID_STATE_OR_PROVINCE_NAME, u'Texas'), |
| 690 | x509.NameAttribute(x509.OID_LOCALITY_NAME, u'Austin'), |
| 691 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, u'PyCA'), |
| 692 | x509.NameAttribute(x509.OID_COMMON_NAME, u'cryptography.io'), |
Andre Caron | 476c5df | 2015-05-18 10:23:28 -0400 | [diff] [blame] | 693 | ] |
| 694 | |
Andre Caron | f27e4f4 | 2015-05-18 17:54:59 -0400 | [diff] [blame] | 695 | def test_public_bytes_invalid_encoding(self, backend): |
Andre Caron | 476c5df | 2015-05-18 10:23:28 -0400 | [diff] [blame] | 696 | request = _load_cert( |
| 697 | os.path.join("x509", "requests", "rsa_sha1.pem"), |
| 698 | x509.load_pem_x509_csr, |
| 699 | backend |
| 700 | ) |
| 701 | |
| 702 | with pytest.raises(TypeError): |
| 703 | request.public_bytes('NotAnEncoding') |
| 704 | |
Andre Caron | acb1897 | 2015-05-18 21:04:15 -0400 | [diff] [blame] | 705 | @pytest.mark.parametrize( |
| 706 | ("request_path", "loader_func", "encoding"), |
| 707 | [ |
| 708 | ( |
| 709 | os.path.join("x509", "requests", "rsa_sha1.pem"), |
| 710 | x509.load_pem_x509_csr, |
| 711 | serialization.Encoding.PEM, |
| 712 | ), |
| 713 | ( |
| 714 | os.path.join("x509", "requests", "rsa_sha1.der"), |
| 715 | x509.load_der_x509_csr, |
| 716 | serialization.Encoding.DER, |
| 717 | ), |
| 718 | ] |
| 719 | ) |
| 720 | def test_public_bytes_match(self, request_path, loader_func, encoding, |
| 721 | backend): |
| 722 | request_bytes = load_vectors_from_file( |
| 723 | request_path, lambda pemfile: pemfile.read(), mode="rb" |
| 724 | ) |
| 725 | request = loader_func(request_bytes, backend) |
| 726 | serialized = request.public_bytes(encoding) |
| 727 | assert serialized == request_bytes |
| 728 | |
Alex Gaynor | 70c8f8b | 2015-07-06 21:02:54 -0400 | [diff] [blame] | 729 | def test_eq(self, backend): |
| 730 | request1 = _load_cert( |
| 731 | os.path.join("x509", "requests", "rsa_sha1.pem"), |
| 732 | x509.load_pem_x509_csr, |
| 733 | backend |
| 734 | ) |
| 735 | request2 = _load_cert( |
| 736 | os.path.join("x509", "requests", "rsa_sha1.pem"), |
| 737 | x509.load_pem_x509_csr, |
| 738 | backend |
| 739 | ) |
| 740 | |
| 741 | assert request1 == request2 |
| 742 | |
| 743 | def test_ne(self, backend): |
| 744 | request1 = _load_cert( |
| 745 | os.path.join("x509", "requests", "rsa_sha1.pem"), |
| 746 | x509.load_pem_x509_csr, |
| 747 | backend |
| 748 | ) |
| 749 | request2 = _load_cert( |
Alex Gaynor | eb2df54 | 2015-07-06 21:50:15 -0400 | [diff] [blame] | 750 | os.path.join("x509", "requests", "san_rsa_sha1.pem"), |
Alex Gaynor | 70c8f8b | 2015-07-06 21:02:54 -0400 | [diff] [blame] | 751 | x509.load_pem_x509_csr, |
| 752 | backend |
| 753 | ) |
| 754 | |
| 755 | assert request1 != request2 |
| 756 | assert request1 != object() |
| 757 | |
Alex Gaynor | 978137d | 2015-07-08 20:59:16 -0400 | [diff] [blame] | 758 | def test_hash(self, backend): |
| 759 | request1 = _load_cert( |
| 760 | os.path.join("x509", "requests", "rsa_sha1.pem"), |
| 761 | x509.load_pem_x509_csr, |
| 762 | backend |
| 763 | ) |
| 764 | request2 = _load_cert( |
| 765 | os.path.join("x509", "requests", "rsa_sha1.pem"), |
| 766 | x509.load_pem_x509_csr, |
| 767 | backend |
| 768 | ) |
| 769 | request3 = _load_cert( |
| 770 | os.path.join("x509", "requests", "san_rsa_sha1.pem"), |
| 771 | x509.load_pem_x509_csr, |
| 772 | backend |
| 773 | ) |
| 774 | |
| 775 | assert hash(request1) == hash(request2) |
| 776 | assert hash(request1) != hash(request3) |
| 777 | |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 778 | |
Andre Caron | 0ef595f | 2015-05-18 13:53:43 -0400 | [diff] [blame] | 779 | @pytest.mark.requires_backend_interface(interface=X509Backend) |
| 780 | class TestCertificateSigningRequestBuilder(object): |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 781 | @pytest.mark.requires_backend_interface(interface=RSABackend) |
Andre Caron | 0ef595f | 2015-05-18 13:53:43 -0400 | [diff] [blame] | 782 | def test_sign_invalid_hash_algorithm(self, backend): |
Ian Cordasco | 4d46eb7 | 2015-06-17 12:08:27 -0500 | [diff] [blame] | 783 | private_key = RSA_KEY_2048.private_key(backend) |
| 784 | |
Alex Gaynor | ba19c2e | 2015-06-27 00:07:09 -0400 | [diff] [blame] | 785 | builder = x509.CertificateSigningRequestBuilder().subject_name( |
| 786 | x509.Name([]) |
| 787 | ) |
Andre Caron | 0ef595f | 2015-05-18 13:53:43 -0400 | [diff] [blame] | 788 | with pytest.raises(TypeError): |
Alex Gaynor | b3b0fbe | 2015-06-26 19:57:18 -0400 | [diff] [blame] | 789 | builder.sign(private_key, 'NotAHash', backend) |
Andre Caron | 0ef595f | 2015-05-18 13:53:43 -0400 | [diff] [blame] | 790 | |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 791 | @pytest.mark.requires_backend_interface(interface=RSABackend) |
Alex Gaynor | ba19c2e | 2015-06-27 00:07:09 -0400 | [diff] [blame] | 792 | def test_no_subject_name(self, backend): |
| 793 | private_key = RSA_KEY_2048.private_key(backend) |
| 794 | |
| 795 | builder = x509.CertificateSigningRequestBuilder() |
| 796 | with pytest.raises(ValueError): |
| 797 | builder.sign(private_key, hashes.SHA256(), backend) |
| 798 | |
| 799 | @pytest.mark.requires_backend_interface(interface=RSABackend) |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 800 | def test_build_ca_request_with_rsa(self, backend): |
Ian Cordasco | 4d46eb7 | 2015-06-17 12:08:27 -0500 | [diff] [blame] | 801 | private_key = RSA_KEY_2048.private_key(backend) |
| 802 | |
Andre Caron | a9a5117 | 2015-06-06 20:18:44 -0400 | [diff] [blame] | 803 | request = x509.CertificateSigningRequestBuilder().subject_name( |
Andre Caron | 99d0f90 | 2015-06-01 08:36:59 -0400 | [diff] [blame] | 804 | x509.Name([ |
Ian Cordasco | 94b34d3 | 2015-06-17 10:55:07 -0500 | [diff] [blame] | 805 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, u'PyCA'), |
Andre Caron | 99d0f90 | 2015-06-01 08:36:59 -0400 | [diff] [blame] | 806 | ]) |
Andre Caron | 472fd69 | 2015-06-06 20:04:44 -0400 | [diff] [blame] | 807 | ).add_extension( |
Ian Cordasco | 41f51ce | 2015-06-17 11:49:11 -0500 | [diff] [blame] | 808 | x509.BasicConstraints(ca=True, path_length=2), critical=True |
Alex Gaynor | b3b0fbe | 2015-06-26 19:57:18 -0400 | [diff] [blame] | 809 | ).sign(private_key, hashes.SHA1(), backend) |
Andre Caron | 0ef595f | 2015-05-18 13:53:43 -0400 | [diff] [blame] | 810 | |
| 811 | assert isinstance(request.signature_hash_algorithm, hashes.SHA1) |
| 812 | public_key = request.public_key() |
| 813 | assert isinstance(public_key, rsa.RSAPublicKey) |
| 814 | subject = request.subject |
| 815 | assert isinstance(subject, x509.Name) |
| 816 | assert list(subject) == [ |
Ian Cordasco | 94b34d3 | 2015-06-17 10:55:07 -0500 | [diff] [blame] | 817 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, u'PyCA'), |
Andre Caron | 0ef595f | 2015-05-18 13:53:43 -0400 | [diff] [blame] | 818 | ] |
| 819 | basic_constraints = request.extensions.get_extension_for_oid( |
| 820 | x509.OID_BASIC_CONSTRAINTS |
| 821 | ) |
| 822 | assert basic_constraints.value.ca is True |
| 823 | assert basic_constraints.value.path_length == 2 |
| 824 | |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 825 | @pytest.mark.requires_backend_interface(interface=RSABackend) |
Ian Cordasco | 13cdc7b | 2015-06-24 21:45:55 -0500 | [diff] [blame] | 826 | def test_build_ca_request_with_unicode(self, backend): |
| 827 | private_key = RSA_KEY_2048.private_key(backend) |
| 828 | |
| 829 | request = x509.CertificateSigningRequestBuilder().subject_name( |
| 830 | x509.Name([ |
Ian Cordasco | 13cdc7b | 2015-06-24 21:45:55 -0500 | [diff] [blame] | 831 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, |
| 832 | u'PyCA\U0001f37a'), |
Ian Cordasco | 13cdc7b | 2015-06-24 21:45:55 -0500 | [diff] [blame] | 833 | ]) |
| 834 | ).add_extension( |
| 835 | x509.BasicConstraints(ca=True, path_length=2), critical=True |
Alex Gaynor | b3b0fbe | 2015-06-26 19:57:18 -0400 | [diff] [blame] | 836 | ).sign(private_key, hashes.SHA1(), backend) |
Ian Cordasco | 13cdc7b | 2015-06-24 21:45:55 -0500 | [diff] [blame] | 837 | |
| 838 | loaded_request = x509.load_pem_x509_csr( |
| 839 | request.public_bytes(encoding=serialization.Encoding.PEM), backend |
| 840 | ) |
| 841 | subject = loaded_request.subject |
| 842 | assert isinstance(subject, x509.Name) |
| 843 | assert list(subject) == [ |
Ian Cordasco | 13cdc7b | 2015-06-24 21:45:55 -0500 | [diff] [blame] | 844 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, u'PyCA\U0001f37a'), |
Ian Cordasco | 13cdc7b | 2015-06-24 21:45:55 -0500 | [diff] [blame] | 845 | ] |
| 846 | |
| 847 | @pytest.mark.requires_backend_interface(interface=RSABackend) |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 848 | def test_build_nonca_request_with_rsa(self, backend): |
Ian Cordasco | 4d46eb7 | 2015-06-17 12:08:27 -0500 | [diff] [blame] | 849 | private_key = RSA_KEY_2048.private_key(backend) |
| 850 | |
Andre Caron | a9a5117 | 2015-06-06 20:18:44 -0400 | [diff] [blame] | 851 | request = x509.CertificateSigningRequestBuilder().subject_name( |
Andre Caron | 99d0f90 | 2015-06-01 08:36:59 -0400 | [diff] [blame] | 852 | x509.Name([ |
Ian Cordasco | 94b34d3 | 2015-06-17 10:55:07 -0500 | [diff] [blame] | 853 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
Andre Caron | 99d0f90 | 2015-06-01 08:36:59 -0400 | [diff] [blame] | 854 | ]) |
Andre Caron | 472fd69 | 2015-06-06 20:04:44 -0400 | [diff] [blame] | 855 | ).add_extension( |
Ian Cordasco | 0112b02 | 2015-06-16 17:51:18 -0500 | [diff] [blame] | 856 | x509.BasicConstraints(ca=False, path_length=None), critical=True, |
Alex Gaynor | b3b0fbe | 2015-06-26 19:57:18 -0400 | [diff] [blame] | 857 | ).sign(private_key, hashes.SHA1(), backend) |
Andre Caron | 0ef595f | 2015-05-18 13:53:43 -0400 | [diff] [blame] | 858 | |
| 859 | assert isinstance(request.signature_hash_algorithm, hashes.SHA1) |
| 860 | public_key = request.public_key() |
| 861 | assert isinstance(public_key, rsa.RSAPublicKey) |
| 862 | subject = request.subject |
| 863 | assert isinstance(subject, x509.Name) |
| 864 | assert list(subject) == [ |
Ian Cordasco | 94b34d3 | 2015-06-17 10:55:07 -0500 | [diff] [blame] | 865 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
Andre Caron | 0ef595f | 2015-05-18 13:53:43 -0400 | [diff] [blame] | 866 | ] |
| 867 | basic_constraints = request.extensions.get_extension_for_oid( |
| 868 | x509.OID_BASIC_CONSTRAINTS |
| 869 | ) |
| 870 | assert basic_constraints.value.ca is False |
| 871 | assert basic_constraints.value.path_length is None |
| 872 | |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 873 | @pytest.mark.requires_backend_interface(interface=EllipticCurveBackend) |
| 874 | def test_build_ca_request_with_ec(self, backend): |
| 875 | if backend._lib.OPENSSL_VERSION_NUMBER < 0x10001000: |
| 876 | pytest.skip("Requires a newer OpenSSL. Must be >= 1.0.1") |
| 877 | |
Ian Cordasco | 8cdcdfc | 2015-06-24 22:00:26 -0500 | [diff] [blame] | 878 | _skip_curve_unsupported(backend, ec.SECP256R1()) |
| 879 | private_key = ec.generate_private_key(ec.SECP256R1(), backend) |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 880 | |
| 881 | request = x509.CertificateSigningRequestBuilder().subject_name( |
| 882 | x509.Name([ |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 883 | x509.NameAttribute(x509.OID_STATE_OR_PROVINCE_NAME, u'Texas'), |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 884 | ]) |
| 885 | ).add_extension( |
| 886 | x509.BasicConstraints(ca=True, path_length=2), critical=True |
Alex Gaynor | b3b0fbe | 2015-06-26 19:57:18 -0400 | [diff] [blame] | 887 | ).sign(private_key, hashes.SHA1(), backend) |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 888 | |
| 889 | assert isinstance(request.signature_hash_algorithm, hashes.SHA1) |
| 890 | public_key = request.public_key() |
| 891 | assert isinstance(public_key, ec.EllipticCurvePublicKey) |
| 892 | subject = request.subject |
| 893 | assert isinstance(subject, x509.Name) |
| 894 | assert list(subject) == [ |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 895 | x509.NameAttribute(x509.OID_STATE_OR_PROVINCE_NAME, u'Texas'), |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 896 | ] |
| 897 | basic_constraints = request.extensions.get_extension_for_oid( |
| 898 | x509.OID_BASIC_CONSTRAINTS |
| 899 | ) |
| 900 | assert basic_constraints.value.ca is True |
| 901 | assert basic_constraints.value.path_length == 2 |
| 902 | |
| 903 | @pytest.mark.requires_backend_interface(interface=DSABackend) |
| 904 | def test_build_ca_request_with_dsa(self, backend): |
| 905 | if backend._lib.OPENSSL_VERSION_NUMBER < 0x10001000: |
| 906 | pytest.skip("Requires a newer OpenSSL. Must be >= 1.0.1") |
| 907 | |
| 908 | private_key = DSA_KEY_2048.private_key(backend) |
| 909 | |
| 910 | request = x509.CertificateSigningRequestBuilder().subject_name( |
| 911 | x509.Name([ |
| 912 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 913 | ]) |
| 914 | ).add_extension( |
| 915 | x509.BasicConstraints(ca=True, path_length=2), critical=True |
Alex Gaynor | b3b0fbe | 2015-06-26 19:57:18 -0400 | [diff] [blame] | 916 | ).sign(private_key, hashes.SHA1(), backend) |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 917 | |
| 918 | assert isinstance(request.signature_hash_algorithm, hashes.SHA1) |
| 919 | public_key = request.public_key() |
| 920 | assert isinstance(public_key, dsa.DSAPublicKey) |
| 921 | subject = request.subject |
| 922 | assert isinstance(subject, x509.Name) |
| 923 | assert list(subject) == [ |
| 924 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
Ian Cordasco | 8ed8edc | 2015-06-22 20:11:17 -0500 | [diff] [blame] | 925 | ] |
| 926 | basic_constraints = request.extensions.get_extension_for_oid( |
| 927 | x509.OID_BASIC_CONSTRAINTS |
| 928 | ) |
| 929 | assert basic_constraints.value.ca is True |
| 930 | assert basic_constraints.value.path_length == 2 |
| 931 | |
Paul Kehrer | ff91780 | 2015-06-26 17:29:04 -0500 | [diff] [blame] | 932 | def test_add_duplicate_extension(self): |
Andre Caron | fc164c5 | 2015-05-31 17:36:18 -0400 | [diff] [blame] | 933 | builder = x509.CertificateSigningRequestBuilder().add_extension( |
Andre Caron | 472fd69 | 2015-06-06 20:04:44 -0400 | [diff] [blame] | 934 | x509.BasicConstraints(True, 2), critical=True, |
Andre Caron | fc164c5 | 2015-05-31 17:36:18 -0400 | [diff] [blame] | 935 | ) |
Andre Caron | 0ef595f | 2015-05-18 13:53:43 -0400 | [diff] [blame] | 936 | with pytest.raises(ValueError): |
Andre Caron | 472fd69 | 2015-06-06 20:04:44 -0400 | [diff] [blame] | 937 | builder.add_extension( |
| 938 | x509.BasicConstraints(True, 2), critical=True, |
| 939 | ) |
Andre Caron | 0ef595f | 2015-05-18 13:53:43 -0400 | [diff] [blame] | 940 | |
Paul Kehrer | ff91780 | 2015-06-26 17:29:04 -0500 | [diff] [blame] | 941 | def test_set_invalid_subject(self): |
Andre Caron | 0ef595f | 2015-05-18 13:53:43 -0400 | [diff] [blame] | 942 | builder = x509.CertificateSigningRequestBuilder() |
| 943 | with pytest.raises(TypeError): |
Andre Caron | a9a5117 | 2015-06-06 20:18:44 -0400 | [diff] [blame] | 944 | builder.subject_name('NotAName') |
Andre Caron | 0ef595f | 2015-05-18 13:53:43 -0400 | [diff] [blame] | 945 | |
Paul Kehrer | ff91780 | 2015-06-26 17:29:04 -0500 | [diff] [blame] | 946 | def test_add_unsupported_extension(self): |
Ian Cordasco | 34853f3 | 2015-06-21 10:50:53 -0500 | [diff] [blame] | 947 | builder = x509.CertificateSigningRequestBuilder() |
Ian Cordasco | f06b6be | 2015-06-21 10:09:18 -0500 | [diff] [blame] | 948 | with pytest.raises(NotImplementedError): |
Andre Caron | 472fd69 | 2015-06-06 20:04:44 -0400 | [diff] [blame] | 949 | builder.add_extension( |
Ian Cordasco | f06b6be | 2015-06-21 10:09:18 -0500 | [diff] [blame] | 950 | x509.AuthorityKeyIdentifier('keyid', None, None), |
| 951 | critical=False, |
Andre Caron | 472fd69 | 2015-06-06 20:04:44 -0400 | [diff] [blame] | 952 | ) |
Andre Caron | 0ef595f | 2015-05-18 13:53:43 -0400 | [diff] [blame] | 953 | |
Paul Kehrer | 7e2fbe6 | 2015-06-26 17:59:05 -0500 | [diff] [blame] | 954 | def test_add_unsupported_extension_in_backend(self, backend): |
| 955 | private_key = RSA_KEY_2048.private_key(backend) |
| 956 | builder = x509.CertificateSigningRequestBuilder() |
| 957 | builder = builder.subject_name( |
| 958 | x509.Name([ |
| 959 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
| 960 | ]) |
| 961 | ).add_extension( |
Alex Gaynor | 7583f7f | 2015-07-03 10:56:49 -0400 | [diff] [blame] | 962 | x509.SubjectAlternativeName([x509.DNSName(u"cryptography.io")]), |
| 963 | critical=False, |
| 964 | ).add_extension( |
Alex Gaynor | ac7f70a | 2015-06-28 11:07:52 -0400 | [diff] [blame] | 965 | x509.KeyUsage( |
| 966 | digital_signature=True, |
| 967 | content_commitment=True, |
| 968 | key_encipherment=False, |
| 969 | data_encipherment=False, |
| 970 | key_agreement=False, |
| 971 | key_cert_sign=True, |
| 972 | crl_sign=False, |
| 973 | encipher_only=False, |
| 974 | decipher_only=False |
| 975 | ), |
Alex Gaynor | 887a408 | 2015-07-03 04:29:03 -0400 | [diff] [blame] | 976 | critical=False |
Paul Kehrer | 7e2fbe6 | 2015-06-26 17:59:05 -0500 | [diff] [blame] | 977 | ) |
| 978 | with pytest.raises(NotImplementedError): |
Alex Gaynor | 76a0a64 | 2015-06-26 20:26:25 -0400 | [diff] [blame] | 979 | builder.sign(private_key, hashes.SHA256(), backend) |
Paul Kehrer | 7e2fbe6 | 2015-06-26 17:59:05 -0500 | [diff] [blame] | 980 | |
Paul Kehrer | ff91780 | 2015-06-26 17:29:04 -0500 | [diff] [blame] | 981 | def test_set_subject_twice(self): |
| 982 | builder = x509.CertificateSigningRequestBuilder() |
| 983 | builder = builder.subject_name( |
| 984 | x509.Name([ |
| 985 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
| 986 | ]) |
| 987 | ) |
| 988 | with pytest.raises(ValueError): |
| 989 | builder.subject_name( |
| 990 | x509.Name([ |
| 991 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
| 992 | ]) |
| 993 | ) |
| 994 | |
Alex Gaynor | d3e8416 | 2015-06-28 10:14:55 -0400 | [diff] [blame] | 995 | def test_subject_alt_names(self, backend): |
| 996 | private_key = RSA_KEY_2048.private_key(backend) |
| 997 | |
| 998 | csr = x509.CertificateSigningRequestBuilder().subject_name( |
| 999 | x509.Name([ |
| 1000 | x509.NameAttribute(x509.OID_COMMON_NAME, u"SAN"), |
| 1001 | ]) |
| 1002 | ).add_extension( |
| 1003 | x509.SubjectAlternativeName([ |
Alex Gaynor | 6431d50 | 2015-07-05 12:28:46 -0400 | [diff] [blame] | 1004 | x509.DNSName(u"example.com"), |
| 1005 | x509.DNSName(u"*.example.com"), |
Paul Kehrer | a9e5a21 | 2015-07-05 23:38:25 -0500 | [diff] [blame] | 1006 | x509.RegisteredID(x509.ObjectIdentifier("1.2.3.4.5.6.7")), |
Paul Kehrer | 9ce25a9 | 2015-07-10 11:08:31 -0500 | [diff] [blame] | 1007 | x509.DirectoryName(x509.Name([ |
| 1008 | x509.NameAttribute(x509.OID_COMMON_NAME, u'PyCA'), |
| 1009 | x509.NameAttribute( |
| 1010 | x509.OID_ORGANIZATION_NAME, u'We heart UTF8!\u2122' |
| 1011 | ) |
| 1012 | ])), |
Paul Kehrer | 235e5a1 | 2015-07-10 19:45:47 -0500 | [diff] [blame] | 1013 | x509.IPAddress(ipaddress.ip_address(u"127.0.0.1")), |
| 1014 | x509.IPAddress(ipaddress.ip_address(u"ff::")), |
Paul Kehrer | 22f5fbb | 2015-07-10 20:34:18 -0500 | [diff] [blame] | 1015 | x509.OtherName( |
| 1016 | type_id=x509.ObjectIdentifier("1.2.3.3.3.3"), |
| 1017 | value=b"0\x03\x02\x01\x05" |
| 1018 | ), |
Paul Kehrer | f32abd7 | 2015-07-10 21:20:47 -0500 | [diff] [blame] | 1019 | x509.RFC822Name(u"test@example.com"), |
| 1020 | x509.RFC822Name(u"email"), |
| 1021 | x509.RFC822Name(u"email@em\xe5\xefl.com"), |
Paul Kehrer | 474a647 | 2015-07-11 12:29:52 -0500 | [diff] [blame] | 1022 | x509.UniformResourceIdentifier( |
| 1023 | u"https://\u043f\u044b\u043a\u0430.cryptography" |
| 1024 | ), |
| 1025 | x509.UniformResourceIdentifier( |
| 1026 | u"gopher://cryptography:70/some/path" |
| 1027 | ), |
Alex Gaynor | d3e8416 | 2015-06-28 10:14:55 -0400 | [diff] [blame] | 1028 | ]), |
| 1029 | critical=False, |
| 1030 | ).sign(private_key, hashes.SHA256(), backend) |
| 1031 | |
| 1032 | assert len(csr.extensions) == 1 |
| 1033 | ext = csr.extensions.get_extension_for_oid( |
| 1034 | x509.OID_SUBJECT_ALTERNATIVE_NAME |
| 1035 | ) |
| 1036 | assert not ext.critical |
| 1037 | assert ext.oid == x509.OID_SUBJECT_ALTERNATIVE_NAME |
| 1038 | assert list(ext.value) == [ |
Alex Gaynor | 6431d50 | 2015-07-05 12:28:46 -0400 | [diff] [blame] | 1039 | x509.DNSName(u"example.com"), |
| 1040 | x509.DNSName(u"*.example.com"), |
Paul Kehrer | a9e5a21 | 2015-07-05 23:38:25 -0500 | [diff] [blame] | 1041 | x509.RegisteredID(x509.ObjectIdentifier("1.2.3.4.5.6.7")), |
Paul Kehrer | 9ce25a9 | 2015-07-10 11:08:31 -0500 | [diff] [blame] | 1042 | x509.DirectoryName(x509.Name([ |
| 1043 | x509.NameAttribute(x509.OID_COMMON_NAME, u'PyCA'), |
| 1044 | x509.NameAttribute( |
| 1045 | x509.OID_ORGANIZATION_NAME, u'We heart UTF8!\u2122' |
| 1046 | ), |
| 1047 | ])), |
Paul Kehrer | 235e5a1 | 2015-07-10 19:45:47 -0500 | [diff] [blame] | 1048 | x509.IPAddress(ipaddress.ip_address(u"127.0.0.1")), |
| 1049 | x509.IPAddress(ipaddress.ip_address(u"ff::")), |
Paul Kehrer | 22f5fbb | 2015-07-10 20:34:18 -0500 | [diff] [blame] | 1050 | x509.OtherName( |
| 1051 | type_id=x509.ObjectIdentifier("1.2.3.3.3.3"), |
| 1052 | value=b"0\x03\x02\x01\x05" |
| 1053 | ), |
Paul Kehrer | f32abd7 | 2015-07-10 21:20:47 -0500 | [diff] [blame] | 1054 | x509.RFC822Name(u"test@example.com"), |
| 1055 | x509.RFC822Name(u"email"), |
| 1056 | x509.RFC822Name(u"email@em\xe5\xefl.com"), |
Paul Kehrer | 474a647 | 2015-07-11 12:29:52 -0500 | [diff] [blame] | 1057 | x509.UniformResourceIdentifier( |
| 1058 | u"https://\u043f\u044b\u043a\u0430.cryptography" |
| 1059 | ), |
| 1060 | x509.UniformResourceIdentifier( |
| 1061 | u"gopher://cryptography:70/some/path" |
| 1062 | ), |
Alex Gaynor | d3e8416 | 2015-06-28 10:14:55 -0400 | [diff] [blame] | 1063 | ] |
| 1064 | |
Paul Kehrer | 500ed9d | 2015-07-10 20:51:36 -0500 | [diff] [blame] | 1065 | def test_invalid_asn1_othername(self, backend): |
| 1066 | private_key = RSA_KEY_2048.private_key(backend) |
| 1067 | |
| 1068 | builder = x509.CertificateSigningRequestBuilder().subject_name( |
| 1069 | x509.Name([ |
| 1070 | x509.NameAttribute(x509.OID_COMMON_NAME, u"SAN"), |
| 1071 | ]) |
| 1072 | ).add_extension( |
| 1073 | x509.SubjectAlternativeName([ |
| 1074 | x509.OtherName( |
| 1075 | type_id=x509.ObjectIdentifier("1.2.3.3.3.3"), |
| 1076 | value=b"\x01\x02\x01\x05" |
| 1077 | ), |
| 1078 | ]), |
| 1079 | critical=False, |
| 1080 | ) |
| 1081 | with pytest.raises(ValueError): |
| 1082 | builder.sign(private_key, hashes.SHA256(), backend) |
| 1083 | |
Alex Gaynor | d5f718c | 2015-07-05 11:19:38 -0400 | [diff] [blame] | 1084 | def test_subject_alt_name_unsupported_general_name(self, backend): |
| 1085 | private_key = RSA_KEY_2048.private_key(backend) |
| 1086 | |
| 1087 | builder = x509.CertificateSigningRequestBuilder().subject_name( |
| 1088 | x509.Name([ |
| 1089 | x509.NameAttribute(x509.OID_COMMON_NAME, u"SAN"), |
| 1090 | ]) |
| 1091 | ).add_extension( |
Paul Kehrer | 474a647 | 2015-07-11 12:29:52 -0500 | [diff] [blame] | 1092 | x509.SubjectAlternativeName([FakeGeneralName("")]), |
Alex Gaynor | d5f718c | 2015-07-05 11:19:38 -0400 | [diff] [blame] | 1093 | critical=False, |
| 1094 | ) |
| 1095 | |
Paul Kehrer | 474a647 | 2015-07-11 12:29:52 -0500 | [diff] [blame] | 1096 | with pytest.raises(ValueError): |
Alex Gaynor | d5f718c | 2015-07-05 11:19:38 -0400 | [diff] [blame] | 1097 | builder.sign(private_key, hashes.SHA256(), backend) |
| 1098 | |
| 1099 | |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 1100 | @pytest.mark.requires_backend_interface(interface=DSABackend) |
| 1101 | @pytest.mark.requires_backend_interface(interface=X509Backend) |
Paul Kehrer | e76cd27 | 2014-12-14 19:00:51 -0600 | [diff] [blame] | 1102 | class TestDSACertificate(object): |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 1103 | def test_load_dsa_cert(self, backend): |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 1104 | cert = _load_cert( |
Paul Kehrer | 4903adc | 2014-12-13 16:57:50 -0600 | [diff] [blame] | 1105 | os.path.join("x509", "custom", "dsa_selfsigned_ca.pem"), |
Paul Kehrer | 4112032 | 2014-12-02 18:31:14 -1000 | [diff] [blame] | 1106 | x509.load_pem_x509_certificate, |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 1107 | backend |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 1108 | ) |
Paul Kehrer | 8802a5b | 2015-02-13 12:06:57 -0600 | [diff] [blame] | 1109 | assert isinstance(cert.signature_hash_algorithm, hashes.SHA1) |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 1110 | public_key = cert.public_key() |
Alex Gaynor | 32c57df | 2015-02-23 21:51:27 -0800 | [diff] [blame] | 1111 | assert isinstance(public_key, dsa.DSAPublicKey) |
Alex Gaynor | ece3872 | 2015-06-27 17:19:30 -0400 | [diff] [blame] | 1112 | num = public_key.public_numbers() |
| 1113 | assert num.y == int( |
| 1114 | "4c08bfe5f2d76649c80acf7d431f6ae2124b217abc8c9f6aca776ddfa94" |
| 1115 | "53b6656f13e543684cd5f6431a314377d2abfa068b7080cb8ddc065afc2" |
| 1116 | "dea559f0b584c97a2b235b9b69b46bc6de1aed422a6f341832618bcaae2" |
| 1117 | "198aba388099dafb05ff0b5efecb3b0ae169a62e1c72022af50ae68af3b" |
| 1118 | "033c18e6eec1f7df4692c456ccafb79cc7e08da0a5786e9816ceda651d6" |
| 1119 | "1b4bb7b81c2783da97cea62df67af5e85991fdc13aff10fc60e06586386" |
| 1120 | "b96bb78d65750f542f86951e05a6d81baadbcd35a2e5cad4119923ae6a2" |
| 1121 | "002091a3d17017f93c52970113cdc119970b9074ca506eac91c3dd37632" |
| 1122 | "5df4af6b3911ef267d26623a5a1c5df4a6d13f1c", 16 |
| 1123 | ) |
| 1124 | assert num.parameter_numbers.g == int( |
| 1125 | "4b7ced71dc353965ecc10d441a9a06fc24943a32d66429dd5ef44d43e67" |
| 1126 | "d789d99770aec32c0415dc92970880872da45fef8dd1e115a3e4801387b" |
| 1127 | "a6d755861f062fd3b6e9ea8e2641152339b828315b1528ee6c7b79458d2" |
| 1128 | "1f3db973f6fc303f9397174c2799dd2351282aa2d8842c357a73495bbaa" |
| 1129 | "c4932786414c55e60d73169f5761036fba29e9eebfb049f8a3b1b7cee6f" |
| 1130 | "3fbfa136205f130bee2cf5b9c38dc1095d4006f2e73335c07352c64130a" |
| 1131 | "1ab2b89f13b48f628d3cc3868beece9bb7beade9f830eacc6fa241425c0" |
| 1132 | "b3fcc0df416a0c89f7bf35668d765ec95cdcfbe9caff49cfc156c668c76" |
| 1133 | "fa6247676a6d3ac945844a083509c6a1b436baca", 16 |
| 1134 | ) |
| 1135 | assert num.parameter_numbers.p == int( |
| 1136 | "bfade6048e373cd4e48b677e878c8e5b08c02102ae04eb2cb5c46a523a3" |
| 1137 | "af1c73d16b24f34a4964781ae7e50500e21777754a670bd19a7420d6330" |
| 1138 | "84e5556e33ca2c0e7d547ea5f46a07a01bf8669ae3bdec042d9b2ae5e6e" |
| 1139 | "cf49f00ba9dac99ab6eff140d2cedf722ee62c2f9736857971444c25d0a" |
| 1140 | "33d2017dc36d682a1054fe2a9428dda355a851ce6e6d61e03e419fd4ca4" |
| 1141 | "e703313743d86caa885930f62ed5bf342d8165627681e9cc3244ba72aa2" |
| 1142 | "2148400a6bbe80154e855d042c9dc2a3405f1e517be9dea50562f56da93" |
| 1143 | "f6085f844a7e705c1f043e65751c583b80d29103e590ccb26efdaa0893d" |
| 1144 | "833e36468f3907cfca788a3cb790f0341c8a31bf", 16 |
| 1145 | ) |
| 1146 | assert num.parameter_numbers.q == int( |
| 1147 | "822ff5d234e073b901cf5941f58e1f538e71d40d", 16 |
| 1148 | ) |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 1149 | |
Paul Kehrer | 1effb6e | 2015-03-30 15:05:59 -0500 | [diff] [blame] | 1150 | @pytest.mark.parametrize( |
| 1151 | ("path", "loader_func"), |
| 1152 | [ |
| 1153 | [ |
| 1154 | os.path.join("x509", "requests", "dsa_sha1.pem"), |
| 1155 | x509.load_pem_x509_csr |
| 1156 | ], |
| 1157 | [ |
| 1158 | os.path.join("x509", "requests", "dsa_sha1.der"), |
| 1159 | x509.load_der_x509_csr |
| 1160 | ], |
| 1161 | ] |
| 1162 | ) |
| 1163 | def test_load_dsa_request(self, path, loader_func, backend): |
| 1164 | request = _load_cert(path, loader_func, backend) |
Paul Kehrer | dc480ad | 2015-02-23 12:14:54 -0600 | [diff] [blame] | 1165 | assert isinstance(request.signature_hash_algorithm, hashes.SHA1) |
| 1166 | public_key = request.public_key() |
| 1167 | assert isinstance(public_key, dsa.DSAPublicKey) |
| 1168 | subject = request.subject |
| 1169 | assert isinstance(subject, x509.Name) |
| 1170 | assert list(subject) == [ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1171 | x509.NameAttribute(x509.OID_COMMON_NAME, u'cryptography.io'), |
| 1172 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, u'PyCA'), |
| 1173 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
| 1174 | x509.NameAttribute(x509.OID_STATE_OR_PROVINCE_NAME, u'Texas'), |
| 1175 | x509.NameAttribute(x509.OID_LOCALITY_NAME, u'Austin'), |
Paul Kehrer | dc480ad | 2015-02-23 12:14:54 -0600 | [diff] [blame] | 1176 | ] |
| 1177 | |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 1178 | |
| 1179 | @pytest.mark.requires_backend_interface(interface=EllipticCurveBackend) |
| 1180 | @pytest.mark.requires_backend_interface(interface=X509Backend) |
Paul Kehrer | e76cd27 | 2014-12-14 19:00:51 -0600 | [diff] [blame] | 1181 | class TestECDSACertificate(object): |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 1182 | def test_load_ecdsa_cert(self, backend): |
| 1183 | _skip_curve_unsupported(backend, ec.SECP384R1()) |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 1184 | cert = _load_cert( |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 1185 | os.path.join("x509", "ecdsa_root.pem"), |
Paul Kehrer | 4112032 | 2014-12-02 18:31:14 -1000 | [diff] [blame] | 1186 | x509.load_pem_x509_certificate, |
Paul Kehrer | a693cfd | 2014-11-27 07:47:58 -1000 | [diff] [blame] | 1187 | backend |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 1188 | ) |
Paul Kehrer | 8802a5b | 2015-02-13 12:06:57 -0600 | [diff] [blame] | 1189 | assert isinstance(cert.signature_hash_algorithm, hashes.SHA384) |
Paul Kehrer | f1ef351 | 2014-11-26 17:36:05 -1000 | [diff] [blame] | 1190 | public_key = cert.public_key() |
Alex Gaynor | 32c57df | 2015-02-23 21:51:27 -0800 | [diff] [blame] | 1191 | assert isinstance(public_key, ec.EllipticCurvePublicKey) |
Alex Gaynor | ece3872 | 2015-06-27 17:19:30 -0400 | [diff] [blame] | 1192 | num = public_key.public_numbers() |
| 1193 | assert num.x == int( |
| 1194 | "dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f" |
| 1195 | "6f0ccd00bba615b51467e9e2d9fee8e630c17", 16 |
| 1196 | ) |
| 1197 | assert num.y == int( |
| 1198 | "ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c7" |
| 1199 | "2deae88a7a16bb543ce67dc23ff031ca3e23e", 16 |
| 1200 | ) |
| 1201 | assert isinstance(num.curve, ec.SECP384R1) |
Paul Kehrer | 6c660a8 | 2014-12-12 11:50:44 -0600 | [diff] [blame] | 1202 | |
| 1203 | def test_load_ecdsa_no_named_curve(self, backend): |
| 1204 | _skip_curve_unsupported(backend, ec.SECP256R1()) |
| 1205 | cert = _load_cert( |
| 1206 | os.path.join("x509", "custom", "ec_no_named_curve.pem"), |
| 1207 | x509.load_pem_x509_certificate, |
| 1208 | backend |
| 1209 | ) |
| 1210 | with pytest.raises(NotImplementedError): |
| 1211 | cert.public_key() |
Paul Kehrer | 912d3fb | 2015-01-29 11:19:22 -0600 | [diff] [blame] | 1212 | |
Paul Kehrer | 1effb6e | 2015-03-30 15:05:59 -0500 | [diff] [blame] | 1213 | @pytest.mark.parametrize( |
| 1214 | ("path", "loader_func"), |
| 1215 | [ |
| 1216 | [ |
| 1217 | os.path.join("x509", "requests", "ec_sha256.pem"), |
| 1218 | x509.load_pem_x509_csr |
| 1219 | ], |
| 1220 | [ |
| 1221 | os.path.join("x509", "requests", "ec_sha256.der"), |
| 1222 | x509.load_der_x509_csr |
| 1223 | ], |
| 1224 | ] |
| 1225 | ) |
| 1226 | def test_load_ecdsa_certificate_request(self, path, loader_func, backend): |
Paul Kehrer | dc480ad | 2015-02-23 12:14:54 -0600 | [diff] [blame] | 1227 | _skip_curve_unsupported(backend, ec.SECP384R1()) |
Paul Kehrer | 1effb6e | 2015-03-30 15:05:59 -0500 | [diff] [blame] | 1228 | request = _load_cert(path, loader_func, backend) |
Paul Kehrer | dc480ad | 2015-02-23 12:14:54 -0600 | [diff] [blame] | 1229 | assert isinstance(request.signature_hash_algorithm, hashes.SHA256) |
| 1230 | public_key = request.public_key() |
| 1231 | assert isinstance(public_key, ec.EllipticCurvePublicKey) |
| 1232 | subject = request.subject |
| 1233 | assert isinstance(subject, x509.Name) |
| 1234 | assert list(subject) == [ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1235 | x509.NameAttribute(x509.OID_COMMON_NAME, u'cryptography.io'), |
| 1236 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, u'PyCA'), |
| 1237 | x509.NameAttribute(x509.OID_COUNTRY_NAME, u'US'), |
| 1238 | x509.NameAttribute(x509.OID_STATE_OR_PROVINCE_NAME, u'Texas'), |
| 1239 | x509.NameAttribute(x509.OID_LOCALITY_NAME, u'Austin'), |
Paul Kehrer | dc480ad | 2015-02-23 12:14:54 -0600 | [diff] [blame] | 1240 | ] |
| 1241 | |
Paul Kehrer | 912d3fb | 2015-01-29 11:19:22 -0600 | [diff] [blame] | 1242 | |
Paul Kehrer | 806bfb2 | 2015-02-02 17:05:24 -0600 | [diff] [blame] | 1243 | class TestNameAttribute(object): |
Alex Gaynor | a56ff41 | 2015-02-10 17:26:32 -0500 | [diff] [blame] | 1244 | def test_init_bad_oid(self): |
| 1245 | with pytest.raises(TypeError): |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1246 | x509.NameAttribute(None, u'value') |
Alex Gaynor | a56ff41 | 2015-02-10 17:26:32 -0500 | [diff] [blame] | 1247 | |
Ian Cordasco | 7618fbe | 2015-06-16 19:12:17 -0500 | [diff] [blame] | 1248 | def test_init_bad_value(self): |
| 1249 | with pytest.raises(TypeError): |
| 1250 | x509.NameAttribute( |
| 1251 | x509.ObjectIdentifier('oid'), |
| 1252 | b'bytes' |
| 1253 | ) |
| 1254 | |
Paul Kehrer | 912d3fb | 2015-01-29 11:19:22 -0600 | [diff] [blame] | 1255 | def test_eq(self): |
Paul Kehrer | 806bfb2 | 2015-02-02 17:05:24 -0600 | [diff] [blame] | 1256 | assert x509.NameAttribute( |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1257 | x509.ObjectIdentifier('oid'), u'value' |
Paul Kehrer | 806bfb2 | 2015-02-02 17:05:24 -0600 | [diff] [blame] | 1258 | ) == x509.NameAttribute( |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1259 | x509.ObjectIdentifier('oid'), u'value' |
Paul Kehrer | 912d3fb | 2015-01-29 11:19:22 -0600 | [diff] [blame] | 1260 | ) |
| 1261 | |
| 1262 | def test_ne(self): |
Paul Kehrer | 806bfb2 | 2015-02-02 17:05:24 -0600 | [diff] [blame] | 1263 | assert x509.NameAttribute( |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1264 | x509.ObjectIdentifier('2.5.4.3'), u'value' |
Paul Kehrer | 806bfb2 | 2015-02-02 17:05:24 -0600 | [diff] [blame] | 1265 | ) != x509.NameAttribute( |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1266 | x509.ObjectIdentifier('2.5.4.5'), u'value' |
Paul Kehrer | 912d3fb | 2015-01-29 11:19:22 -0600 | [diff] [blame] | 1267 | ) |
Paul Kehrer | 806bfb2 | 2015-02-02 17:05:24 -0600 | [diff] [blame] | 1268 | assert x509.NameAttribute( |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1269 | x509.ObjectIdentifier('oid'), u'value' |
Paul Kehrer | 806bfb2 | 2015-02-02 17:05:24 -0600 | [diff] [blame] | 1270 | ) != x509.NameAttribute( |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1271 | x509.ObjectIdentifier('oid'), u'value2' |
Paul Kehrer | 912d3fb | 2015-01-29 11:19:22 -0600 | [diff] [blame] | 1272 | ) |
Paul Kehrer | 806bfb2 | 2015-02-02 17:05:24 -0600 | [diff] [blame] | 1273 | assert x509.NameAttribute( |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1274 | x509.ObjectIdentifier('oid'), u'value' |
Paul Kehrer | 912d3fb | 2015-01-29 11:19:22 -0600 | [diff] [blame] | 1275 | ) != object() |
| 1276 | |
Paul Kehrer | a498be8 | 2015-02-12 15:00:56 -0600 | [diff] [blame] | 1277 | def test_repr(self): |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1278 | na = x509.NameAttribute(x509.ObjectIdentifier('2.5.4.3'), u'value') |
Ian Cordasco | a908d69 | 2015-06-16 21:35:24 -0500 | [diff] [blame] | 1279 | if six.PY3: |
| 1280 | assert repr(na) == ( |
| 1281 | "<NameAttribute(oid=<ObjectIdentifier(oid=2.5.4.3, name=commo" |
| 1282 | "nName)>, value='value')>" |
| 1283 | ) |
| 1284 | else: |
| 1285 | assert repr(na) == ( |
| 1286 | "<NameAttribute(oid=<ObjectIdentifier(oid=2.5.4.3, name=commo" |
| 1287 | "nName)>, value=u'value')>" |
| 1288 | ) |
Paul Kehrer | a498be8 | 2015-02-12 15:00:56 -0600 | [diff] [blame] | 1289 | |
Paul Kehrer | 912d3fb | 2015-01-29 11:19:22 -0600 | [diff] [blame] | 1290 | |
| 1291 | class TestObjectIdentifier(object): |
| 1292 | def test_eq(self): |
Paul Kehrer | 806bfb2 | 2015-02-02 17:05:24 -0600 | [diff] [blame] | 1293 | oid1 = x509.ObjectIdentifier('oid') |
| 1294 | oid2 = x509.ObjectIdentifier('oid') |
Paul Kehrer | 912d3fb | 2015-01-29 11:19:22 -0600 | [diff] [blame] | 1295 | assert oid1 == oid2 |
| 1296 | |
| 1297 | def test_ne(self): |
Paul Kehrer | 806bfb2 | 2015-02-02 17:05:24 -0600 | [diff] [blame] | 1298 | oid1 = x509.ObjectIdentifier('oid') |
| 1299 | assert oid1 != x509.ObjectIdentifier('oid1') |
Paul Kehrer | 912d3fb | 2015-01-29 11:19:22 -0600 | [diff] [blame] | 1300 | assert oid1 != object() |
| 1301 | |
| 1302 | def test_repr(self): |
Paul Kehrer | 806bfb2 | 2015-02-02 17:05:24 -0600 | [diff] [blame] | 1303 | oid = x509.ObjectIdentifier("2.5.4.3") |
| 1304 | assert repr(oid) == "<ObjectIdentifier(oid=2.5.4.3, name=commonName)>" |
| 1305 | oid = x509.ObjectIdentifier("oid1") |
| 1306 | assert repr(oid) == "<ObjectIdentifier(oid=oid1, name=Unknown OID)>" |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 1307 | |
| 1308 | |
| 1309 | class TestName(object): |
| 1310 | def test_eq(self): |
| 1311 | name1 = x509.Name([ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1312 | x509.NameAttribute(x509.ObjectIdentifier('oid'), u'value1'), |
| 1313 | x509.NameAttribute(x509.ObjectIdentifier('oid2'), u'value2'), |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 1314 | ]) |
| 1315 | name2 = x509.Name([ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1316 | x509.NameAttribute(x509.ObjectIdentifier('oid'), u'value1'), |
| 1317 | x509.NameAttribute(x509.ObjectIdentifier('oid2'), u'value2'), |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 1318 | ]) |
| 1319 | assert name1 == name2 |
| 1320 | |
| 1321 | def test_ne(self): |
| 1322 | name1 = x509.Name([ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1323 | x509.NameAttribute(x509.ObjectIdentifier('oid'), u'value1'), |
| 1324 | x509.NameAttribute(x509.ObjectIdentifier('oid2'), u'value2'), |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 1325 | ]) |
| 1326 | name2 = x509.Name([ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1327 | x509.NameAttribute(x509.ObjectIdentifier('oid2'), u'value2'), |
| 1328 | x509.NameAttribute(x509.ObjectIdentifier('oid'), u'value1'), |
Paul Kehrer | 719d536 | 2015-01-01 20:03:52 -0600 | [diff] [blame] | 1329 | ]) |
| 1330 | assert name1 != name2 |
| 1331 | assert name1 != object() |
Paul Kehrer | 1fb35c9 | 2015-04-11 15:42:54 -0400 | [diff] [blame] | 1332 | |
| 1333 | def test_repr(self): |
| 1334 | name = x509.Name([ |
Ian Cordasco | 82fc376 | 2015-06-16 20:59:50 -0500 | [diff] [blame] | 1335 | x509.NameAttribute(x509.OID_COMMON_NAME, u'cryptography.io'), |
| 1336 | x509.NameAttribute(x509.OID_ORGANIZATION_NAME, u'PyCA'), |
Paul Kehrer | 1fb35c9 | 2015-04-11 15:42:54 -0400 | [diff] [blame] | 1337 | ]) |
| 1338 | |
Ian Cordasco | a908d69 | 2015-06-16 21:35:24 -0500 | [diff] [blame] | 1339 | if six.PY3: |
| 1340 | assert repr(name) == ( |
| 1341 | "<Name([<NameAttribute(oid=<ObjectIdentifier(oid=2.5.4.3, name" |
| 1342 | "=commonName)>, value='cryptography.io')>, <NameAttribute(oid=" |
| 1343 | "<ObjectIdentifier(oid=2.5.4.10, name=organizationName)>, valu" |
| 1344 | "e='PyCA')>])>" |
| 1345 | ) |
| 1346 | else: |
| 1347 | assert repr(name) == ( |
| 1348 | "<Name([<NameAttribute(oid=<ObjectIdentifier(oid=2.5.4.3, name" |
| 1349 | "=commonName)>, value=u'cryptography.io')>, <NameAttribute(oid" |
| 1350 | "=<ObjectIdentifier(oid=2.5.4.10, name=organizationName)>, val" |
| 1351 | "ue=u'PyCA')>])>" |
| 1352 | ) |