Jean-Paul Calderone | 8671c85 | 2011-03-02 19:26:20 -0500 | [diff] [blame] | 1 | # Copyright (c) Jean-Paul Calderone |
| 2 | # See LICENSE file for details. |
Jean-Paul Calderone | 8b63d45 | 2008-03-21 18:31:12 -0400 | [diff] [blame] | 3 | |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 4 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 5 | Unit tests for :py:mod:`OpenSSL.crypto`. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 6 | """ |
| 7 | |
Jean-Paul Calderone | 0b88b6a | 2009-07-05 12:44:41 -0400 | [diff] [blame] | 8 | from unittest import main |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 9 | from warnings import catch_warnings, simplefilter |
Jean-Paul Calderone | 0b88b6a | 2009-07-05 12:44:41 -0400 | [diff] [blame] | 10 | |
Alex Gaynor | 4b9c96a | 2014-08-14 09:51:48 -0700 | [diff] [blame] | 11 | import base64 |
| 12 | import os |
| 13 | import re |
Jean-Paul Calderone | 62ca8da | 2010-08-11 19:58:08 -0400 | [diff] [blame] | 14 | from subprocess import PIPE, Popen |
Rick Dean | 47262da | 2009-07-08 16:17:17 -0500 | [diff] [blame] | 15 | from datetime import datetime, timedelta |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 16 | |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 17 | import pytest |
| 18 | |
Alex Gaynor | b8e3899 | 2015-09-04 08:14:04 -0400 | [diff] [blame] | 19 | from six import u, b, binary_type |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 20 | |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 21 | from OpenSSL.crypto import TYPE_RSA, TYPE_DSA, Error, PKey, PKeyType |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 22 | from OpenSSL.crypto import X509, X509Type, X509Name, X509NameType |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 23 | from OpenSSL.crypto import ( |
| 24 | X509Store, X509StoreType, X509StoreContext, X509StoreContextError |
| 25 | ) |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 26 | from OpenSSL.crypto import X509Req, X509ReqType |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 27 | from OpenSSL.crypto import X509Extension, X509ExtensionType |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 28 | from OpenSSL.crypto import load_certificate, load_privatekey |
Jean-Paul Calderone | f17e421 | 2009-04-01 14:21:40 -0400 | [diff] [blame] | 29 | from OpenSSL.crypto import FILETYPE_PEM, FILETYPE_ASN1, FILETYPE_TEXT |
Jean-Paul Calderone | 7191986 | 2009-04-01 13:01:19 -0400 | [diff] [blame] | 30 | from OpenSSL.crypto import dump_certificate, load_certificate_request |
| 31 | from OpenSSL.crypto import dump_certificate_request, dump_privatekey |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 32 | from OpenSSL.crypto import PKCS7Type, load_pkcs7_data |
Jean-Paul Calderone | 9178ee6 | 2010-01-25 17:55:30 -0500 | [diff] [blame] | 33 | from OpenSSL.crypto import PKCS12, PKCS12Type, load_pkcs12 |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 34 | from OpenSSL.crypto import CRL, Revoked, load_crl |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 35 | from OpenSSL.crypto import NetscapeSPKI, NetscapeSPKIType |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 36 | from OpenSSL.crypto import ( |
| 37 | sign, verify, get_elliptic_curve, get_elliptic_curves) |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 38 | from OpenSSL.test.util import ( |
| 39 | EqualityTestsMixin, TestCase, WARNING_TYPE_EXPECTED |
| 40 | ) |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 41 | from OpenSSL._util import native, lib |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 42 | |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 43 | |
Jean-Paul Calderone | 9da338d | 2011-05-04 11:40:54 -0400 | [diff] [blame] | 44 | def normalize_certificate_pem(pem): |
| 45 | return dump_certificate(FILETYPE_PEM, load_certificate(FILETYPE_PEM, pem)) |
| 46 | |
| 47 | |
| 48 | def normalize_privatekey_pem(pem): |
| 49 | return dump_privatekey(FILETYPE_PEM, load_privatekey(FILETYPE_PEM, pem)) |
| 50 | |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 51 | |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 52 | GOOD_CIPHER = "blowfish" |
| 53 | BAD_CIPHER = "zippers" |
| 54 | |
| 55 | GOOD_DIGEST = "MD5" |
| 56 | BAD_DIGEST = "monkeys" |
| 57 | |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 58 | root_cert_pem = b("""-----BEGIN CERTIFICATE----- |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 59 | MIIC7TCCAlagAwIBAgIIPQzE4MbeufQwDQYJKoZIhvcNAQEFBQAwWDELMAkGA1UE |
| 60 | BhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQHEwdDaGljYWdvMRAwDgYDVQQKEwdU |
| 61 | ZXN0aW5nMRgwFgYDVQQDEw9UZXN0aW5nIFJvb3QgQ0EwIhgPMjAwOTAzMjUxMjM2 |
| 62 | NThaGA8yMDE3MDYxMTEyMzY1OFowWDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAklM |
| 63 | MRAwDgYDVQQHEwdDaGljYWdvMRAwDgYDVQQKEwdUZXN0aW5nMRgwFgYDVQQDEw9U |
| 64 | ZXN0aW5nIFJvb3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAPmaQumL |
| 65 | urpE527uSEHdL1pqcDRmWzu+98Y6YHzT/J7KWEamyMCNZ6fRW1JCR782UQ8a07fy |
| 66 | 2xXsKy4WdKaxyG8CcatwmXvpvRQ44dSANMihHELpANTdyVp6DCysED6wkQFurHlF |
| 67 | 1dshEaJw8b/ypDhmbVIo6Ci1xvCJqivbLFnbAgMBAAGjgbswgbgwHQYDVR0OBBYE |
| 68 | FINVdy1eIfFJDAkk51QJEo3IfgSuMIGIBgNVHSMEgYAwfoAUg1V3LV4h8UkMCSTn |
| 69 | VAkSjch+BK6hXKRaMFgxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJJTDEQMA4GA1UE |
| 70 | BxMHQ2hpY2FnbzEQMA4GA1UEChMHVGVzdGluZzEYMBYGA1UEAxMPVGVzdGluZyBS |
| 71 | b290IENBggg9DMTgxt659DAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GB |
| 72 | AGGCDazMJGoWNBpc03u6+smc95dEead2KlZXBATOdFT1VesY3+nUOqZhEhTGlDMi |
| 73 | hkgaZnzoIq/Uamidegk4hirsCT/R+6vsKAAxNTcBjUeZjlykCJWy5ojShGftXIKY |
| 74 | w/njVbKMXrvc83qmTdGl3TAM0fxQIpqgcglFLveEBgzn |
| 75 | -----END CERTIFICATE----- |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 76 | """) |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 77 | |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 78 | root_key_pem = b("""-----BEGIN RSA PRIVATE KEY----- |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 79 | MIICXQIBAAKBgQD5mkLpi7q6ROdu7khB3S9aanA0Zls7vvfGOmB80/yeylhGpsjA |
| 80 | jWen0VtSQke/NlEPGtO38tsV7CsuFnSmschvAnGrcJl76b0UOOHUgDTIoRxC6QDU |
| 81 | 3claegwsrBA+sJEBbqx5RdXbIRGicPG/8qQ4Zm1SKOgotcbwiaor2yxZ2wIDAQAB |
| 82 | AoGBAPCgMpmLxzwDaUmcFbTJUvlLW1hoxNNYSu2jIZm1k/hRAcE60JYwvBkgz3UB |
| 83 | yMEh0AtLxYe0bFk6EHah11tMUPgscbCq73snJ++8koUw+csk22G65hOs51bVb7Aa |
| 84 | 6JBe67oLzdtvgCUFAA2qfrKzWRZzAdhUirQUZgySZk+Xq1pBAkEA/kZG0A6roTSM |
| 85 | BVnx7LnPfsycKUsTumorpXiylZJjTi9XtmzxhrYN6wgZlDOOwOLgSQhszGpxVoMD |
| 86 | u3gByT1b2QJBAPtL3mSKdvwRu/+40zaZLwvSJRxaj0mcE4BJOS6Oqs/hS1xRlrNk |
| 87 | PpQ7WJ4yM6ZOLnXzm2mKyxm50Mv64109FtMCQQDOqS2KkjHaLowTGVxwC0DijMfr |
| 88 | I9Lf8sSQk32J5VWCySWf5gGTfEnpmUa41gKTMJIbqZZLucNuDcOtzUaeWZlZAkA8 |
| 89 | ttXigLnCqR486JDPTi9ZscoZkZ+w7y6e/hH8t6d5Vjt48JVyfjPIaJY+km58LcN3 |
| 90 | 6AWSeGAdtRFHVzR7oHjVAkB4hutvxiOeiIVQNBhM6RSI9aBPMI21DoX2JRoxvNW2 |
| 91 | cbvAhow217X9V0dVerEOKxnNYspXRrh36h7k4mQA+sDq |
| 92 | -----END RSA PRIVATE KEY----- |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 93 | """) |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 94 | |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 95 | intermediate_cert_pem = b("""-----BEGIN CERTIFICATE----- |
| 96 | MIICVzCCAcCgAwIBAgIRAMPzhm6//0Y/g2pmnHR2C4cwDQYJKoZIhvcNAQENBQAw |
| 97 | WDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQHEwdDaGljYWdvMRAw |
| 98 | DgYDVQQKEwdUZXN0aW5nMRgwFgYDVQQDEw9UZXN0aW5nIFJvb3QgQ0EwHhcNMTQw |
| 99 | ODI4MDIwNDA4WhcNMjQwODI1MDIwNDA4WjBmMRUwEwYDVQQDEwxpbnRlcm1lZGlh |
| 100 | dGUxDDAKBgNVBAoTA29yZzERMA8GA1UECxMIb3JnLXVuaXQxCzAJBgNVBAYTAlVT |
| 101 | MQswCQYDVQQIEwJDQTESMBAGA1UEBxMJU2FuIERpZWdvMIGfMA0GCSqGSIb3DQEB |
| 102 | AQUAA4GNADCBiQKBgQDYcEQw5lfbEQRjr5Yy4yxAHGV0b9Al+Lmu7wLHMkZ/ZMmK |
| 103 | FGIbljbviiD1Nz97Oh2cpB91YwOXOTN2vXHq26S+A5xe8z/QJbBsyghMur88CjdT |
| 104 | 21H2qwMa+r5dCQwEhuGIiZ3KbzB/n4DTMYI5zy4IYPv0pjxShZn4aZTCCK2IUwID |
| 105 | AQABoxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAPIWSkLX |
| 106 | QRMApOjjyC+tMxumT5e2pMqChHmxobQK4NMdrf2VCx+cRT6EmY8sK3/Xl/X8UBQ+ |
| 107 | 9n5zXb1ZwhW/sTWgUvmOceJ4/XVs9FkdWOOn1J0XBch9ZIiFe/s5ASIgG7fUdcUF |
| 108 | 9mAWS6FK2ca3xIh5kIupCXOFa0dPvlw/YUFT |
| 109 | -----END CERTIFICATE----- |
| 110 | """) |
| 111 | |
| 112 | intermediate_key_pem = b("""-----BEGIN RSA PRIVATE KEY----- |
| 113 | MIICWwIBAAKBgQDYcEQw5lfbEQRjr5Yy4yxAHGV0b9Al+Lmu7wLHMkZ/ZMmKFGIb |
| 114 | ljbviiD1Nz97Oh2cpB91YwOXOTN2vXHq26S+A5xe8z/QJbBsyghMur88CjdT21H2 |
| 115 | qwMa+r5dCQwEhuGIiZ3KbzB/n4DTMYI5zy4IYPv0pjxShZn4aZTCCK2IUwIDAQAB |
| 116 | AoGAfSZVV80pSeOKHTYfbGdNY/jHdU9eFUa/33YWriXU+77EhpIItJjkRRgivIfo |
| 117 | rhFJpBSGmDLblaqepm8emsXMeH4+2QzOYIf0QGGP6E6scjTt1PLqdqKfVJ1a2REN |
| 118 | 147cujNcmFJb/5VQHHMpaPTgttEjlzuww4+BCDPsVRABWrkCQQD3loH36nLoQTtf |
| 119 | +kQq0T6Bs9/UWkTAGo0ND81ALj0F8Ie1oeZg6RNT96RxZ3aVuFTESTv6/TbjWywO |
| 120 | wdzlmV1vAkEA38rTJ6PTwaJlw5OttdDzAXGPB9tDmzh9oSi7cHwQQXizYd8MBYx4 |
| 121 | sjHUKD3dCQnb1dxJFhd3BT5HsnkRMbVZXQJAbXduH17ZTzcIOXc9jHDXYiFVZV5D |
| 122 | 52vV0WCbLzVCZc3jMrtSUKa8lPN5EWrdU3UchWybyG0MR5mX8S5lrF4SoQJAIyUD |
| 123 | DBKaSqpqONCUUx1BTFS9FYrFjzbL4+c1qHCTTPTblt8kUCrDOZjBrKAqeiTmNSum |
| 124 | /qUot9YUBF8m6BuGsQJATHHmdFy/fG1VLkyBp49CAa8tN3Z5r/CgTznI4DfMTf4C |
| 125 | NbRHn2UmYlwQBa+L5lg9phewNe8aEwpPyPLoV85U8Q== |
| 126 | -----END RSA PRIVATE KEY----- |
| 127 | """) |
| 128 | |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 129 | server_cert_pem = b("""-----BEGIN CERTIFICATE----- |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 130 | MIICKDCCAZGgAwIBAgIJAJn/HpR21r/8MA0GCSqGSIb3DQEBBQUAMFgxCzAJBgNV |
| 131 | BAYTAlVTMQswCQYDVQQIEwJJTDEQMA4GA1UEBxMHQ2hpY2FnbzEQMA4GA1UEChMH |
| 132 | VGVzdGluZzEYMBYGA1UEAxMPVGVzdGluZyBSb290IENBMCIYDzIwMDkwMzI1MTIz |
| 133 | NzUzWhgPMjAxNzA2MTExMjM3NTNaMBgxFjAUBgNVBAMTDWxvdmVseSBzZXJ2ZXIw |
| 134 | gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL6m+G653V0tpBC/OKl22VxOi2Cv |
| 135 | lK4TYu9LHSDP9uDVTe7V5D5Tl6qzFoRRx5pfmnkqT5B+W9byp2NU3FC5hLm5zSAr |
| 136 | b45meUhjEJ/ifkZgbNUjHdBIGP9MAQUHZa5WKdkGIJvGAvs8UzUqlr4TBWQIB24+ |
| 137 | lJ+Ukk/CRgasrYwdAgMBAAGjNjA0MB0GA1UdDgQWBBS4kC7Ij0W1TZXZqXQFAM2e |
| 138 | gKEG2DATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQUFAAOBgQBh30Li |
| 139 | dJ+NlxIOx5343WqIBka3UbsOb2kxWrbkVCrvRapCMLCASO4FqiKWM+L0VDBprqIp |
| 140 | 2mgpFQ6FHpoIENGvJhdEKpptQ5i7KaGhnDNTfdy3x1+h852G99f1iyj0RmbuFcM8 |
| 141 | uzujnS8YXWvM7DM1Ilozk4MzPug8jzFp5uhKCQ== |
| 142 | -----END CERTIFICATE----- |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 143 | """) |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 144 | |
Jean-Paul Calderone | 9da338d | 2011-05-04 11:40:54 -0400 | [diff] [blame] | 145 | server_key_pem = normalize_privatekey_pem(b("""-----BEGIN RSA PRIVATE KEY----- |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 146 | MIICWwIBAAKBgQC+pvhuud1dLaQQvzipdtlcTotgr5SuE2LvSx0gz/bg1U3u1eQ+ |
| 147 | U5eqsxaEUceaX5p5Kk+QflvW8qdjVNxQuYS5uc0gK2+OZnlIYxCf4n5GYGzVIx3Q |
| 148 | SBj/TAEFB2WuVinZBiCbxgL7PFM1Kpa+EwVkCAduPpSflJJPwkYGrK2MHQIDAQAB |
| 149 | AoGAbwuZ0AR6JveahBaczjfnSpiFHf+mve2UxoQdpyr6ROJ4zg/PLW5K/KXrC48G |
| 150 | j6f3tXMrfKHcpEoZrQWUfYBRCUsGD5DCazEhD8zlxEHahIsqpwA0WWssJA2VOLEN |
| 151 | j6DuV2pCFbw67rfTBkTSo32ahfXxEKev5KswZk0JIzH3ooECQQDgzS9AI89h0gs8 |
| 152 | Dt+1m11Rzqo3vZML7ZIyGApUzVan+a7hbc33nbGRkAXjHaUBJO31it/H6dTO+uwX |
| 153 | msWwNG5ZAkEA2RyFKs5xR5USTFaKLWCgpH/ydV96KPOpBND7TKQx62snDenFNNbn |
| 154 | FwwOhpahld+vqhYk+pfuWWUpQciE+Bu7ZQJASjfT4sQv4qbbKK/scePicnDdx9th |
| 155 | 4e1EeB9xwb+tXXXUo/6Bor/AcUNwfiQ6Zt9PZOK9sR3lMZSsP7rMi7kzuQJABie6 |
| 156 | 1sXXjFH7nNJvRG4S39cIxq8YRYTy68II/dlB2QzGpKxV/POCxbJ/zu0CU79tuYK7 |
| 157 | NaeNCFfH3aeTrX0LyQJAMBWjWmeKM2G2sCExheeQK0ROnaBC8itCECD4Jsve4nqf |
| 158 | r50+LF74iLXFwqysVCebPKMOpDWp/qQ1BbJQIPs7/A== |
| 159 | -----END RSA PRIVATE KEY----- |
Jean-Paul Calderone | 9da338d | 2011-05-04 11:40:54 -0400 | [diff] [blame] | 160 | """)) |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 161 | |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 162 | intermediate_server_cert_pem = b("""-----BEGIN CERTIFICATE----- |
| 163 | MIICWDCCAcGgAwIBAgIRAPQFY9jfskSihdiNSNdt6GswDQYJKoZIhvcNAQENBQAw |
| 164 | ZjEVMBMGA1UEAxMMaW50ZXJtZWRpYXRlMQwwCgYDVQQKEwNvcmcxETAPBgNVBAsT |
| 165 | CG9yZy11bml0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVNh |
| 166 | biBEaWVnbzAeFw0xNDA4MjgwMjEwNDhaFw0yNDA4MjUwMjEwNDhaMG4xHTAbBgNV |
| 167 | BAMTFGludGVybWVkaWF0ZS1zZXJ2aWNlMQwwCgYDVQQKEwNvcmcxETAPBgNVBAsT |
| 168 | CG9yZy11bml0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVNh |
| 169 | biBEaWVnbzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqpJZygd+w1faLOr1 |
| 170 | iOAmbBhx5SZWcTCZ/ZjHQTJM7GuPT624QkqsixFghRKdDROwpwnAP7gMRukLqiy4 |
| 171 | +kRuGT5OfyGggL95i2xqA+zehjj08lSTlvGHpePJgCyTavIy5+Ljsj4DKnKyuhxm |
| 172 | biXTRrH83NDgixVkObTEmh/OVK0CAwEAATANBgkqhkiG9w0BAQ0FAAOBgQBa0Npw |
| 173 | UkzjaYEo1OUE1sTI6Mm4riTIHMak4/nswKh9hYup//WVOlr/RBSBtZ7Q/BwbjobN |
| 174 | 3bfAtV7eSAqBsfxYXyof7G1ALANQERkq3+oyLP1iVt08W1WOUlIMPhdCF/QuCwy6 |
| 175 | x9MJLhUCGLJPM+O2rAPWVD9wCmvq10ALsiH3yA== |
| 176 | -----END CERTIFICATE----- |
| 177 | """) |
| 178 | |
| 179 | intermediate_server_key_pem = b("""-----BEGIN RSA PRIVATE KEY----- |
| 180 | MIICXAIBAAKBgQCqklnKB37DV9os6vWI4CZsGHHlJlZxMJn9mMdBMkzsa49PrbhC |
| 181 | SqyLEWCFEp0NE7CnCcA/uAxG6QuqLLj6RG4ZPk5/IaCAv3mLbGoD7N6GOPTyVJOW |
| 182 | 8Yel48mALJNq8jLn4uOyPgMqcrK6HGZuJdNGsfzc0OCLFWQ5tMSaH85UrQIDAQAB |
| 183 | AoGAIQ594j5zna3/9WaPsTgnmhlesVctt4AAx/n827DA4ayyuHFlXUuVhtoWR5Pk |
| 184 | 5ezj9mtYW8DyeCegABnsu2vZni/CdvU6uiS1Hv6qM1GyYDm9KWgovIP9rQCDSGaz |
| 185 | d57IWVGxx7ODFkm3gN5nxnSBOFVHytuW1J7FBRnEsehRroECQQDXHFOv82JuXDcz |
| 186 | z3+4c74IEURdOHcbycxlppmK9kFqm5lsUdydnnGW+mvwDk0APOB7Wg7vyFyr393e |
| 187 | dpmBDCzNAkEAyv6tVbTKUYhSjW+QhabJo896/EqQEYUmtMXxk4cQnKeR/Ao84Rkf |
| 188 | EqD5IykMUfUI0jJU4DGX+gWZ10a7kNbHYQJAVFCuHNFxS4Cpwo0aqtnzKoZaHY/8 |
| 189 | X9ABZfafSHCtw3Op92M+7ikkrOELXdS9KdKyyqbKJAKNEHF3LbOfB44WIQJAA2N4 |
| 190 | 9UNNVUsXRbElEnYUS529CdUczo4QdVgQjkvk5RiPAUwSdBd9Q0xYnFOlFwEmIowg |
| 191 | ipWJWe0aAlP18ZcEQQJBAL+5lekZ/GUdQoZ4HAsN5a9syrzavJ9VvU1KOOPorPZK |
| 192 | nMRZbbQgP+aSB7yl6K0gaLaZ8XaK0pjxNBh6ASqg9f4= |
| 193 | -----END RSA PRIVATE KEY----- |
| 194 | """) |
| 195 | |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 196 | client_cert_pem = b("""-----BEGIN CERTIFICATE----- |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 197 | MIICJjCCAY+gAwIBAgIJAKxpFI5lODkjMA0GCSqGSIb3DQEBBQUAMFgxCzAJBgNV |
| 198 | BAYTAlVTMQswCQYDVQQIEwJJTDEQMA4GA1UEBxMHQ2hpY2FnbzEQMA4GA1UEChMH |
| 199 | VGVzdGluZzEYMBYGA1UEAxMPVGVzdGluZyBSb290IENBMCIYDzIwMDkwMzI1MTIz |
| 200 | ODA1WhgPMjAxNzA2MTExMjM4MDVaMBYxFDASBgNVBAMTC3VnbHkgY2xpZW50MIGf |
| 201 | MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAZh/SRtNm5ntMT4qb6YzEpTroMlq2 |
| 202 | rn+GrRHRiZ+xkCw/CGNhbtPir7/QxaUj26BSmQrHw1bGKEbPsWiW7bdXSespl+xK |
| 203 | iku4G/KvnnmWdeJHqsiXeUZtqurMELcPQAw9xPHEuhqqUJvvEoMTsnCEqGM+7Dtb |
| 204 | oCRajYyHfluARQIDAQABozYwNDAdBgNVHQ4EFgQUNQB+qkaOaEVecf1J3TTUtAff |
| 205 | 0fAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQEFBQADgYEAyv/Jh7gM |
| 206 | Q3OHvmsFEEvRI+hsW8y66zK4K5de239Y44iZrFYkt7Q5nBPMEWDj4F2hLYWL/qtI |
| 207 | 9Zdr0U4UDCU9SmmGYh4o7R4TZ5pGFvBYvjhHbkSFYFQXZxKUi+WUxplP6I0wr2KJ |
| 208 | PSTJCjJOn3xo2NTKRgV1gaoTf2EhL+RG8TQ= |
| 209 | -----END CERTIFICATE----- |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 210 | """) |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 211 | |
Jean-Paul Calderone | 22cbe50 | 2011-05-04 17:01:43 -0400 | [diff] [blame] | 212 | client_key_pem = normalize_privatekey_pem(b("""-----BEGIN RSA PRIVATE KEY----- |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 213 | MIICXgIBAAKBgQDAZh/SRtNm5ntMT4qb6YzEpTroMlq2rn+GrRHRiZ+xkCw/CGNh |
| 214 | btPir7/QxaUj26BSmQrHw1bGKEbPsWiW7bdXSespl+xKiku4G/KvnnmWdeJHqsiX |
| 215 | eUZtqurMELcPQAw9xPHEuhqqUJvvEoMTsnCEqGM+7DtboCRajYyHfluARQIDAQAB |
| 216 | AoGATkZ+NceY5Glqyl4mD06SdcKfV65814vg2EL7V9t8+/mi9rYL8KztSXGlQWPX |
| 217 | zuHgtRoMl78yQ4ZJYOBVo+nsx8KZNRCEBlE19bamSbQLCeQMenWnpeYyQUZ908gF |
| 218 | h6L9qsFVJepgA9RDgAjyDoS5CaWCdCCPCH2lDkdcqC54SVUCQQDseuduc4wi8h4t |
| 219 | V8AahUn9fn9gYfhoNuM0gdguTA0nPLVWz4hy1yJiWYQe0H7NLNNTmCKiLQaJpAbb |
| 220 | TC6vE8C7AkEA0Ee8CMJUc20BnGEmxwgWcVuqFWaKCo8jTH1X38FlATUsyR3krjW2 |
| 221 | dL3yDD9NwHxsYP7nTKp/U8MV7U9IBn4y/wJBAJl7H0/BcLeRmuJk7IqJ7b635iYB |
| 222 | D/9beFUw3MUXmQXZUfyYz39xf6CDZsu1GEdEC5haykeln3Of4M9d/4Kj+FcCQQCY |
| 223 | si6xwT7GzMDkk/ko684AV3KPc/h6G0yGtFIrMg7J3uExpR/VdH2KgwMkZXisSMvw |
| 224 | JJEQjOMCVsEJlRk54WWjAkEAzoZNH6UhDdBK5F38rVt/y4SEHgbSfJHIAmPS32Kq |
| 225 | f6GGcfNpip0Uk7q7udTKuX7Q/buZi/C4YW7u3VKAquv9NA== |
| 226 | -----END RSA PRIVATE KEY----- |
Jean-Paul Calderone | 22cbe50 | 2011-05-04 17:01:43 -0400 | [diff] [blame] | 227 | """)) |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 228 | |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 229 | cleartextCertificatePEM = b("""-----BEGIN CERTIFICATE----- |
Jean-Paul Calderone | 20131f5 | 2009-04-01 12:05:45 -0400 | [diff] [blame] | 230 | MIIC7TCCAlagAwIBAgIIPQzE4MbeufQwDQYJKoZIhvcNAQEFBQAwWDELMAkGA1UE |
| 231 | BhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQHEwdDaGljYWdvMRAwDgYDVQQKEwdU |
| 232 | ZXN0aW5nMRgwFgYDVQQDEw9UZXN0aW5nIFJvb3QgQ0EwIhgPMjAwOTAzMjUxMjM2 |
| 233 | NThaGA8yMDE3MDYxMTEyMzY1OFowWDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAklM |
| 234 | MRAwDgYDVQQHEwdDaGljYWdvMRAwDgYDVQQKEwdUZXN0aW5nMRgwFgYDVQQDEw9U |
| 235 | ZXN0aW5nIFJvb3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAPmaQumL |
| 236 | urpE527uSEHdL1pqcDRmWzu+98Y6YHzT/J7KWEamyMCNZ6fRW1JCR782UQ8a07fy |
| 237 | 2xXsKy4WdKaxyG8CcatwmXvpvRQ44dSANMihHELpANTdyVp6DCysED6wkQFurHlF |
| 238 | 1dshEaJw8b/ypDhmbVIo6Ci1xvCJqivbLFnbAgMBAAGjgbswgbgwHQYDVR0OBBYE |
| 239 | FINVdy1eIfFJDAkk51QJEo3IfgSuMIGIBgNVHSMEgYAwfoAUg1V3LV4h8UkMCSTn |
| 240 | VAkSjch+BK6hXKRaMFgxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJJTDEQMA4GA1UE |
| 241 | BxMHQ2hpY2FnbzEQMA4GA1UEChMHVGVzdGluZzEYMBYGA1UEAxMPVGVzdGluZyBS |
| 242 | b290IENBggg9DMTgxt659DAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GB |
| 243 | AGGCDazMJGoWNBpc03u6+smc95dEead2KlZXBATOdFT1VesY3+nUOqZhEhTGlDMi |
| 244 | hkgaZnzoIq/Uamidegk4hirsCT/R+6vsKAAxNTcBjUeZjlykCJWy5ojShGftXIKY |
| 245 | w/njVbKMXrvc83qmTdGl3TAM0fxQIpqgcglFLveEBgzn |
| 246 | -----END CERTIFICATE----- |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 247 | """) |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 248 | |
Jean-Paul Calderone | d50d204 | 2011-05-04 17:00:49 -0400 | [diff] [blame] | 249 | cleartextPrivateKeyPEM = normalize_privatekey_pem(b("""\ |
| 250 | -----BEGIN RSA PRIVATE KEY----- |
Jean-Paul Calderone | 20131f5 | 2009-04-01 12:05:45 -0400 | [diff] [blame] | 251 | MIICXQIBAAKBgQD5mkLpi7q6ROdu7khB3S9aanA0Zls7vvfGOmB80/yeylhGpsjA |
| 252 | jWen0VtSQke/NlEPGtO38tsV7CsuFnSmschvAnGrcJl76b0UOOHUgDTIoRxC6QDU |
| 253 | 3claegwsrBA+sJEBbqx5RdXbIRGicPG/8qQ4Zm1SKOgotcbwiaor2yxZ2wIDAQAB |
| 254 | AoGBAPCgMpmLxzwDaUmcFbTJUvlLW1hoxNNYSu2jIZm1k/hRAcE60JYwvBkgz3UB |
| 255 | yMEh0AtLxYe0bFk6EHah11tMUPgscbCq73snJ++8koUw+csk22G65hOs51bVb7Aa |
| 256 | 6JBe67oLzdtvgCUFAA2qfrKzWRZzAdhUirQUZgySZk+Xq1pBAkEA/kZG0A6roTSM |
| 257 | BVnx7LnPfsycKUsTumorpXiylZJjTi9XtmzxhrYN6wgZlDOOwOLgSQhszGpxVoMD |
| 258 | u3gByT1b2QJBAPtL3mSKdvwRu/+40zaZLwvSJRxaj0mcE4BJOS6Oqs/hS1xRlrNk |
| 259 | PpQ7WJ4yM6ZOLnXzm2mKyxm50Mv64109FtMCQQDOqS2KkjHaLowTGVxwC0DijMfr |
| 260 | I9Lf8sSQk32J5VWCySWf5gGTfEnpmUa41gKTMJIbqZZLucNuDcOtzUaeWZlZAkA8 |
| 261 | ttXigLnCqR486JDPTi9ZscoZkZ+w7y6e/hH8t6d5Vjt48JVyfjPIaJY+km58LcN3 |
| 262 | 6AWSeGAdtRFHVzR7oHjVAkB4hutvxiOeiIVQNBhM6RSI9aBPMI21DoX2JRoxvNW2 |
| 263 | cbvAhow217X9V0dVerEOKxnNYspXRrh36h7k4mQA+sDq |
| 264 | -----END RSA PRIVATE KEY----- |
Jean-Paul Calderone | d50d204 | 2011-05-04 17:00:49 -0400 | [diff] [blame] | 265 | """)) |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 266 | |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 267 | cleartextCertificateRequestPEM = b("""-----BEGIN CERTIFICATE REQUEST----- |
| 268 | MIIBnjCCAQcCAQAwXjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQH |
| 269 | EwdDaGljYWdvMRcwFQYDVQQKEw5NeSBDb21wYW55IEx0ZDEXMBUGA1UEAxMORnJl |
| 270 | ZGVyaWNrIERlYW4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANp6Y17WzKSw |
| 271 | BsUWkXdqg6tnXy8H8hA1msCMWpc+/2KJ4mbv5NyD6UD+/SqagQqulPbF/DFea9nA |
| 272 | E0zhmHJELcM8gUTIlXv/cgDWnmK4xj8YkjVUiCdqKRAKeuzLG1pGmwwF5lGeJpXN |
| 273 | xQn5ecR0UYSOWj6TTGXB9VyUMQzCClcBAgMBAAGgADANBgkqhkiG9w0BAQUFAAOB |
| 274 | gQAAJGuF/R/GGbeC7FbFW+aJgr9ee0Xbl6nlhu7pTe67k+iiKT2dsl2ti68MVTnu |
| 275 | Vrb3HUNqOkiwsJf6kCtq5oPn3QVYzTa76Dt2y3Rtzv6boRSlmlfrgS92GNma8JfR |
| 276 | oICQk3nAudi6zl1Dix3BCv1pUp5KMtGn3MeDEi6QFGy2rA== |
| 277 | -----END CERTIFICATE REQUEST----- |
| 278 | """) |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 279 | |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 280 | encryptedPrivateKeyPEM = b("""-----BEGIN RSA PRIVATE KEY----- |
Jean-Paul Calderone | 20131f5 | 2009-04-01 12:05:45 -0400 | [diff] [blame] | 281 | Proc-Type: 4,ENCRYPTED |
| 282 | DEK-Info: DES-EDE3-CBC,9573604A18579E9E |
Jean-Paul Calderone | 5ef8651 | 2008-04-26 19:06:28 -0400 | [diff] [blame] | 283 | |
Jean-Paul Calderone | 20131f5 | 2009-04-01 12:05:45 -0400 | [diff] [blame] | 284 | SHOho56WxDkT0ht10UTeKc0F5u8cqIa01kzFAmETw0MAs8ezYtK15NPdCXUm3X/2 |
| 285 | a17G7LSF5bkxOgZ7vpXyMzun/owrj7CzvLxyncyEFZWvtvzaAhPhvTJtTIB3kf8B |
| 286 | 8+qRcpTGK7NgXEgYBW5bj1y4qZkD4zCL9o9NQzsKI3Ie8i0239jsDOWR38AxjXBH |
| 287 | mGwAQ4Z6ZN5dnmM4fhMIWsmFf19sNyAML4gHenQCHhmXbjXeVq47aC2ProInJbrm |
| 288 | +00TcisbAQ40V9aehVbcDKtS4ZbMVDwncAjpXpcncC54G76N6j7F7wL7L/FuXa3A |
| 289 | fvSVy9n2VfF/pJ3kYSflLHH2G/DFxjF7dl0GxhKPxJjp3IJi9VtuvmN9R2jZWLQF |
| 290 | tfC8dXgy/P9CfFQhlinqBTEwgH0oZ/d4k4NVFDSdEMaSdmBAjlHpc+Vfdty3HVnV |
| 291 | rKXj//wslsFNm9kIwJGIgKUa/n2jsOiydrsk1mgH7SmNCb3YHgZhbbnq0qLat/HC |
| 292 | gHDt3FHpNQ31QzzL3yrenFB2L9osIsnRsDTPFNi4RX4SpDgNroxOQmyzCCV6H+d4 |
| 293 | o1mcnNiZSdxLZxVKccq0AfRpHqpPAFnJcQHP6xyT9MZp6fBa0XkxDnt9kNU8H3Qw |
| 294 | 7SJWZ69VXjBUzMlQViLuaWMgTnL+ZVyFZf9hTF7U/ef4HMLMAVNdiaGG+G+AjCV/ |
| 295 | MbzjS007Oe4qqBnCWaFPSnJX6uLApeTbqAxAeyCql56ULW5x6vDMNC3dwjvS/CEh |
| 296 | 11n8RkgFIQA0AhuKSIg3CbuartRsJnWOLwgLTzsrKYL4yRog1RJrtw== |
| 297 | -----END RSA PRIVATE KEY----- |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 298 | """) |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 299 | |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 300 | encryptedPrivateKeyPEMPassphrase = b("foobar") |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 301 | |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 302 | # Some PKCS#7 stuff. Generated with the openssl command line: |
| 303 | # |
| 304 | # openssl crl2pkcs7 -inform pem -outform pem -certfile s.pem -nocrl |
| 305 | # |
| 306 | # with a certificate and key (but the key should be irrelevant) in s.pem |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 307 | pkcs7Data = b("""\ |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 308 | -----BEGIN PKCS7----- |
| 309 | MIIDNwYJKoZIhvcNAQcCoIIDKDCCAyQCAQExADALBgkqhkiG9w0BBwGgggMKMIID |
| 310 | BjCCAm+gAwIBAgIBATANBgkqhkiG9w0BAQQFADB7MQswCQYDVQQGEwJTRzERMA8G |
| 311 | A1UEChMITTJDcnlwdG8xFDASBgNVBAsTC00yQ3J5cHRvIENBMSQwIgYDVQQDExtN |
| 312 | MkNyeXB0byBDZXJ0aWZpY2F0ZSBNYXN0ZXIxHTAbBgkqhkiG9w0BCQEWDm5ncHNA |
| 313 | cG9zdDEuY29tMB4XDTAwMDkxMDA5NTEzMFoXDTAyMDkxMDA5NTEzMFowUzELMAkG |
| 314 | A1UEBhMCU0cxETAPBgNVBAoTCE0yQ3J5cHRvMRIwEAYDVQQDEwlsb2NhbGhvc3Qx |
| 315 | HTAbBgkqhkiG9w0BCQEWDm5ncHNAcG9zdDEuY29tMFwwDQYJKoZIhvcNAQEBBQAD |
| 316 | SwAwSAJBAKy+e3dulvXzV7zoTZWc5TzgApr8DmeQHTYC8ydfzH7EECe4R1Xh5kwI |
| 317 | zOuuFfn178FBiS84gngaNcrFi0Z5fAkCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAw |
| 318 | LAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0G |
| 319 | A1UdDgQWBBTPhIKSvnsmYsBVNWjj0m3M2z0qVTCBpQYDVR0jBIGdMIGagBT7hyNp |
| 320 | 65w6kxXlxb8pUU/+7Sg4AaF/pH0wezELMAkGA1UEBhMCU0cxETAPBgNVBAoTCE0y |
| 321 | Q3J5cHRvMRQwEgYDVQQLEwtNMkNyeXB0byBDQTEkMCIGA1UEAxMbTTJDcnlwdG8g |
| 322 | Q2VydGlmaWNhdGUgTWFzdGVyMR0wGwYJKoZIhvcNAQkBFg5uZ3BzQHBvc3QxLmNv |
| 323 | bYIBADANBgkqhkiG9w0BAQQFAAOBgQA7/CqT6PoHycTdhEStWNZde7M/2Yc6BoJu |
| 324 | VwnW8YxGO8Sn6UJ4FeffZNcYZddSDKosw8LtPOeWoK3JINjAk5jiPQ2cww++7QGG |
| 325 | /g5NDjxFZNDJP1dGiLAxPW6JXwov4v0FmdzfLOZ01jDcgQQZqEpYlgpuI5JEWUQ9 |
| 326 | Ho4EzbYCOaEAMQA= |
| 327 | -----END PKCS7----- |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 328 | """) |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 329 | |
Alex Gaynor | 8fa1dd6 | 2014-08-14 09:57:51 -0700 | [diff] [blame] | 330 | pkcs7DataASN1 = base64.b64decode(b""" |
Alex Gaynor | 4b9c96a | 2014-08-14 09:51:48 -0700 | [diff] [blame] | 331 | MIIDNwYJKoZIhvcNAQcCoIIDKDCCAyQCAQExADALBgkqhkiG9w0BBwGgggMKMIID |
| 332 | BjCCAm+gAwIBAgIBATANBgkqhkiG9w0BAQQFADB7MQswCQYDVQQGEwJTRzERMA8G |
| 333 | A1UEChMITTJDcnlwdG8xFDASBgNVBAsTC00yQ3J5cHRvIENBMSQwIgYDVQQDExtN |
| 334 | MkNyeXB0byBDZXJ0aWZpY2F0ZSBNYXN0ZXIxHTAbBgkqhkiG9w0BCQEWDm5ncHNA |
| 335 | cG9zdDEuY29tMB4XDTAwMDkxMDA5NTEzMFoXDTAyMDkxMDA5NTEzMFowUzELMAkG |
| 336 | A1UEBhMCU0cxETAPBgNVBAoTCE0yQ3J5cHRvMRIwEAYDVQQDEwlsb2NhbGhvc3Qx |
| 337 | HTAbBgkqhkiG9w0BCQEWDm5ncHNAcG9zdDEuY29tMFwwDQYJKoZIhvcNAQEBBQAD |
| 338 | SwAwSAJBAKy+e3dulvXzV7zoTZWc5TzgApr8DmeQHTYC8ydfzH7EECe4R1Xh5kwI |
| 339 | zOuuFfn178FBiS84gngaNcrFi0Z5fAkCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAw |
| 340 | LAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0G |
| 341 | A1UdDgQWBBTPhIKSvnsmYsBVNWjj0m3M2z0qVTCBpQYDVR0jBIGdMIGagBT7hyNp |
| 342 | 65w6kxXlxb8pUU/+7Sg4AaF/pH0wezELMAkGA1UEBhMCU0cxETAPBgNVBAoTCE0y |
| 343 | Q3J5cHRvMRQwEgYDVQQLEwtNMkNyeXB0byBDQTEkMCIGA1UEAxMbTTJDcnlwdG8g |
| 344 | Q2VydGlmaWNhdGUgTWFzdGVyMR0wGwYJKoZIhvcNAQkBFg5uZ3BzQHBvc3QxLmNv |
| 345 | bYIBADANBgkqhkiG9w0BAQQFAAOBgQA7/CqT6PoHycTdhEStWNZde7M/2Yc6BoJu |
| 346 | VwnW8YxGO8Sn6UJ4FeffZNcYZddSDKosw8LtPOeWoK3JINjAk5jiPQ2cww++7QGG |
| 347 | /g5NDjxFZNDJP1dGiLAxPW6JXwov4v0FmdzfLOZ01jDcgQQZqEpYlgpuI5JEWUQ9 |
| 348 | Ho4EzbYCOaEAMQA= |
Alex Gaynor | 8fa1dd6 | 2014-08-14 09:57:51 -0700 | [diff] [blame] | 349 | """) |
Alex Gaynor | 4b9c96a | 2014-08-14 09:51:48 -0700 | [diff] [blame] | 350 | |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 351 | crlData = b("""\ |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 352 | -----BEGIN X509 CRL----- |
| 353 | MIIBWzCBxTANBgkqhkiG9w0BAQQFADBYMQswCQYDVQQGEwJVUzELMAkGA1UECBMC |
| 354 | SUwxEDAOBgNVBAcTB0NoaWNhZ28xEDAOBgNVBAoTB1Rlc3RpbmcxGDAWBgNVBAMT |
| 355 | D1Rlc3RpbmcgUm9vdCBDQRcNMDkwNzI2MDQzNDU2WhcNMTIwOTI3MDI0MTUyWjA8 |
| 356 | MBUCAgOrGA8yMDA5MDcyNTIzMzQ1NlowIwICAQAYDzIwMDkwNzI1MjMzNDU2WjAM |
| 357 | MAoGA1UdFQQDCgEEMA0GCSqGSIb3DQEBBAUAA4GBAEBt7xTs2htdD3d4ErrcGAw1 |
| 358 | 4dKcVnIWTutoI7xxen26Wwvh8VCsT7i/UeP+rBl9rC/kfjWjzQk3/zleaarGTpBT |
| 359 | 0yp4HXRFFoRhhSE/hP+eteaPXRgrsNRLHe9ZDd69wmh7J1wMDb0m81RG7kqcbsid |
| 360 | vrzEeLDRiiPl92dyyWmu |
| 361 | -----END X509 CRL----- |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 362 | """) |
Jean-Paul Calderone | e890db3 | 2010-08-22 16:55:15 -0400 | [diff] [blame] | 363 | |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 364 | |
| 365 | # A broken RSA private key which can be used to test the error path through |
| 366 | # PKey.check. |
| 367 | inconsistentPrivateKeyPEM = b("""-----BEGIN RSA PRIVATE KEY----- |
| 368 | MIIBPAIBAAJBAKy+e3dulvXzV7zoTZWc5TzgApr8DmeQHTYC8ydfzH7EECe4R1Xh |
| 369 | 5kwIzOuuFfn178FBiS84gngaNcrFi0Z5fAkCAwEaAQJBAIqm/bz4NA1H++Vx5Ewx |
| 370 | OcKp3w19QSaZAwlGRtsUxrP7436QjnREM3Bm8ygU11BjkPVmtrKm6AayQfCHqJoT |
| 371 | zIECIQDW0BoMoL0HOYM/mrTLhaykYAVqgIeJsPjvkEhTFXWBuQIhAM3deFAvWNu4 |
| 372 | nklUQ37XsCT2c9tmNt1LAT+slG2JOTTRAiAuXDtC/m3NYVwyHfFm+zKHRzHkClk2 |
| 373 | HjubeEgjpj32AQIhAJqMGTaZVOwevTXvvHwNeH+vRWsAYU/gbx+OQB+7VOcBAiEA |
| 374 | oolb6NMg/R3enNPvS1O4UU1H8wpaF77L4yiSWlE0p4w= |
| 375 | -----END RSA PRIVATE KEY----- |
| 376 | """) |
| 377 | |
Jean-Paul Calderone | ff83cdd | 2013-08-12 18:05:51 -0400 | [diff] [blame] | 378 | # certificate with NULL bytes in subjectAltName and common name |
| 379 | |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 380 | nulbyteSubjectAltNamePEM = b("""-----BEGIN CERTIFICATE----- |
Jean-Paul Calderone | ff83cdd | 2013-08-12 18:05:51 -0400 | [diff] [blame] | 381 | MIIE2DCCA8CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBxTELMAkGA1UEBhMCVVMx |
| 382 | DzANBgNVBAgMBk9yZWdvbjESMBAGA1UEBwwJQmVhdmVydG9uMSMwIQYDVQQKDBpQ |
| 383 | eXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEgMB4GA1UECwwXUHl0aG9uIENvcmUg |
| 384 | RGV2ZWxvcG1lbnQxJDAiBgNVBAMMG251bGwucHl0aG9uLm9yZwBleGFtcGxlLm9y |
| 385 | ZzEkMCIGCSqGSIb3DQEJARYVcHl0aG9uLWRldkBweXRob24ub3JnMB4XDTEzMDgw |
| 386 | NzEzMTE1MloXDTEzMDgwNzEzMTI1MlowgcUxCzAJBgNVBAYTAlVTMQ8wDQYDVQQI |
| 387 | DAZPcmVnb24xEjAQBgNVBAcMCUJlYXZlcnRvbjEjMCEGA1UECgwaUHl0aG9uIFNv |
| 388 | ZnR3YXJlIEZvdW5kYXRpb24xIDAeBgNVBAsMF1B5dGhvbiBDb3JlIERldmVsb3Bt |
| 389 | ZW50MSQwIgYDVQQDDBtudWxsLnB5dGhvbi5vcmcAZXhhbXBsZS5vcmcxJDAiBgkq |
| 390 | hkiG9w0BCQEWFXB5dGhvbi1kZXZAcHl0aG9uLm9yZzCCASIwDQYJKoZIhvcNAQEB |
| 391 | BQADggEPADCCAQoCggEBALXq7cn7Rn1vO3aA3TrzA5QLp6bb7B3f/yN0CJ2XFj+j |
| 392 | pHs+Gw6WWSUDpybiiKnPec33BFawq3kyblnBMjBU61ioy5HwQqVkJ8vUVjGIUq3P |
| 393 | vX/wBmQfzCe4o4uM89gpHyUL9UYGG8oCRa17dgqcv7u5rg0Wq2B1rgY+nHwx3JIv |
| 394 | KRrgSwyRkGzpN8WQ1yrXlxWjgI9de0mPVDDUlywcWze1q2kwaEPTM3hLAmD1PESA |
| 395 | oY/n8A/RXoeeRs9i/Pm/DGUS8ZPINXk/yOzsR/XvvkTVroIeLZqfmFpnZeF0cHzL |
| 396 | 08LODkVJJ9zjLdT7SA4vnne4FEbAxDbKAq5qkYzaL4UCAwEAAaOB0DCBzTAMBgNV |
| 397 | HRMBAf8EAjAAMB0GA1UdDgQWBBSIWlXAUv9hzVKjNQ/qWpwkOCL3XDALBgNVHQ8E |
| 398 | BAMCBeAwgZAGA1UdEQSBiDCBhYIeYWx0bnVsbC5weXRob24ub3JnAGV4YW1wbGUu |
| 399 | Y29tgSBudWxsQHB5dGhvbi5vcmcAdXNlckBleGFtcGxlLm9yZ4YpaHR0cDovL251 |
| 400 | bGwucHl0aG9uLm9yZwBodHRwOi8vZXhhbXBsZS5vcmeHBMAAAgGHECABDbgAAAAA |
| 401 | AAAAAAAAAAEwDQYJKoZIhvcNAQEFBQADggEBAKxPRe99SaghcI6IWT7UNkJw9aO9 |
| 402 | i9eo0Fj2MUqxpKbdb9noRDy2CnHWf7EIYZ1gznXPdwzSN4YCjV5d+Q9xtBaowT0j |
| 403 | HPERs1ZuytCNNJTmhyqZ8q6uzMLoht4IqH/FBfpvgaeC5tBTnTT0rD5A/olXeimk |
| 404 | kX4LxlEx5RAvpGB2zZVRGr6LobD9rVK91xuHYNIxxxfEGE8tCCWjp0+3ksri9SXx |
| 405 | VHWBnbM9YaL32u3hxm8sYB/Yb8WSBavJCWJJqRStVRHM1koZlJmXNx2BX4vPo6iW |
| 406 | RFEIPQsFZRLrtnCAiEhyT8bC2s/Njlu6ly9gtJZWSV46Q3ZjBL4q9sHKqZQ= |
| 407 | -----END CERTIFICATE-----""") |
| 408 | |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 409 | |
Jean-Paul Calderone | 1880865 | 2009-07-05 12:54:05 -0400 | [diff] [blame] | 410 | class X509ExtTests(TestCase): |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 411 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 412 | Tests for :py:class:`OpenSSL.crypto.X509Extension`. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 413 | """ |
| 414 | |
| 415 | def setUp(self): |
| 416 | """ |
| 417 | Create a new private key and start a certificate request (for a test |
| 418 | method to finish in one way or another). |
| 419 | """ |
Jean-Paul Calderone | ef9a3dc | 2013-03-02 16:33:32 -0800 | [diff] [blame] | 420 | super(X509ExtTests, self).setUp() |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 421 | # Basic setup stuff to generate a certificate |
| 422 | self.pkey = PKey() |
| 423 | self.pkey.generate_key(TYPE_RSA, 384) |
| 424 | self.req = X509Req() |
| 425 | self.req.set_pubkey(self.pkey) |
| 426 | # Authority good you have. |
| 427 | self.req.get_subject().commonName = "Yoda root CA" |
| 428 | self.x509 = X509() |
| 429 | self.subject = self.x509.get_subject() |
| 430 | self.subject.commonName = self.req.get_subject().commonName |
| 431 | self.x509.set_issuer(self.subject) |
| 432 | self.x509.set_pubkey(self.pkey) |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 433 | now = b(datetime.now().strftime("%Y%m%d%H%M%SZ")) |
Alex Gaynor | 7f63649 | 2015-09-04 13:26:52 -0400 | [diff] [blame] | 434 | expire = b((datetime.now() + timedelta(days=100)).strftime("%Y%m%d%H%M%SZ")) |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 435 | self.x509.set_notBefore(now) |
| 436 | self.x509.set_notAfter(expire) |
| 437 | |
Jean-Paul Calderone | ef9a3dc | 2013-03-02 16:33:32 -0800 | [diff] [blame] | 438 | def tearDown(self): |
| 439 | """ |
| 440 | Forget all of the pyOpenSSL objects so they can be garbage collected, |
| 441 | their memory released, and not interfere with the leak detection code. |
| 442 | """ |
| 443 | self.pkey = self.req = self.x509 = self.subject = None |
| 444 | super(X509ExtTests, self).tearDown() |
| 445 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 446 | def test_str(self): |
| 447 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 448 | The string representation of :py:class:`X509Extension` instances as |
| 449 | returned by :py:data:`str` includes stuff. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 450 | """ |
| 451 | # This isn't necessarily the best string representation. Perhaps it |
| 452 | # will be changed/improved in the future. |
| 453 | self.assertEquals( |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 454 | str(X509Extension(b('basicConstraints'), True, b('CA:false'))), |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 455 | 'CA:FALSE') |
| 456 | |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 457 | def test_type(self): |
| 458 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 459 | :py:class:`X509Extension` and :py:class:`X509ExtensionType` refer to |
| 460 | the same type object and can be used to create instances of that type. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 461 | """ |
| 462 | self.assertIdentical(X509Extension, X509ExtensionType) |
| 463 | self.assertConsistentType( |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 464 | X509Extension, |
| 465 | 'X509Extension', b('basicConstraints'), True, b('CA:true')) |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 466 | |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 467 | def test_construction(self): |
| 468 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 469 | :py:class:`X509Extension` accepts an extension type name, a critical |
| 470 | flag, and an extension value and returns an |
| 471 | :py:class:`X509ExtensionType` instance. |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 472 | """ |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 473 | basic = X509Extension(b('basicConstraints'), True, b('CA:true')) |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 474 | self.assertTrue( |
| 475 | isinstance(basic, X509ExtensionType), |
| 476 | "%r is of type %r, should be %r" % ( |
| 477 | basic, type(basic), X509ExtensionType)) |
| 478 | |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 479 | comment = X509Extension( |
| 480 | b('nsComment'), False, b('pyOpenSSL unit test')) |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 481 | self.assertTrue( |
| 482 | isinstance(comment, X509ExtensionType), |
| 483 | "%r is of type %r, should be %r" % ( |
| 484 | comment, type(comment), X509ExtensionType)) |
| 485 | |
Jean-Paul Calderone | 391585f | 2008-12-31 14:36:31 -0500 | [diff] [blame] | 486 | def test_invalid_extension(self): |
| 487 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 488 | :py:class:`X509Extension` raises something if it is passed a bad |
| 489 | extension name or value. |
Jean-Paul Calderone | 391585f | 2008-12-31 14:36:31 -0500 | [diff] [blame] | 490 | """ |
| 491 | self.assertRaises( |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 492 | Error, X509Extension, b('thisIsMadeUp'), False, b('hi')) |
Jean-Paul Calderone | 391585f | 2008-12-31 14:36:31 -0500 | [diff] [blame] | 493 | self.assertRaises( |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 494 | Error, X509Extension, b('basicConstraints'), False, b('blah blah')) |
Jean-Paul Calderone | 391585f | 2008-12-31 14:36:31 -0500 | [diff] [blame] | 495 | |
Jean-Paul Calderone | 2ee1e7c | 2008-12-31 14:58:38 -0500 | [diff] [blame] | 496 | # Exercise a weird one (an extension which uses the r2i method). This |
| 497 | # exercises the codepath that requires a non-NULL ctx to be passed to |
| 498 | # X509V3_EXT_nconf. It can't work now because we provide no |
| 499 | # configuration database. It might be made to work in the future. |
| 500 | self.assertRaises( |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 501 | Error, X509Extension, b('proxyCertInfo'), True, |
| 502 | b('language:id-ppl-anyLanguage,pathlen:1,policy:text:AB')) |
Jean-Paul Calderone | 2ee1e7c | 2008-12-31 14:58:38 -0500 | [diff] [blame] | 503 | |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 504 | def test_get_critical(self): |
| 505 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 506 | :py:meth:`X509ExtensionType.get_critical` returns the value of the |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 507 | extension's critical flag. |
| 508 | """ |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 509 | ext = X509Extension(b('basicConstraints'), True, b('CA:true')) |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 510 | self.assertTrue(ext.get_critical()) |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 511 | ext = X509Extension(b('basicConstraints'), False, b('CA:true')) |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 512 | self.assertFalse(ext.get_critical()) |
| 513 | |
Jean-Paul Calderone | f8c5fab | 2008-12-31 15:53:48 -0500 | [diff] [blame] | 514 | def test_get_short_name(self): |
| 515 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 516 | :py:meth:`X509ExtensionType.get_short_name` returns a string giving the |
| 517 | short type name of the extension. |
Jean-Paul Calderone | f8c5fab | 2008-12-31 15:53:48 -0500 | [diff] [blame] | 518 | """ |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 519 | ext = X509Extension(b('basicConstraints'), True, b('CA:true')) |
| 520 | self.assertEqual(ext.get_short_name(), b('basicConstraints')) |
| 521 | ext = X509Extension(b('nsComment'), True, b('foo bar')) |
| 522 | self.assertEqual(ext.get_short_name(), b('nsComment')) |
Jean-Paul Calderone | f8c5fab | 2008-12-31 15:53:48 -0500 | [diff] [blame] | 523 | |
Jean-Paul Calderone | 5a9e461 | 2011-04-01 18:27:45 -0400 | [diff] [blame] | 524 | def test_get_data(self): |
| 525 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 526 | :py:meth:`X509Extension.get_data` returns a string giving the data of |
| 527 | the extension. |
Jean-Paul Calderone | 5a9e461 | 2011-04-01 18:27:45 -0400 | [diff] [blame] | 528 | """ |
| 529 | ext = X509Extension(b('basicConstraints'), True, b('CA:true')) |
| 530 | # Expect to get back the DER encoded form of CA:true. |
| 531 | self.assertEqual(ext.get_data(), b('0\x03\x01\x01\xff')) |
| 532 | |
Jean-Paul Calderone | 5a9e461 | 2011-04-01 18:27:45 -0400 | [diff] [blame] | 533 | def test_get_data_wrong_args(self): |
| 534 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 535 | :py:meth:`X509Extension.get_data` raises :py:exc:`TypeError` if passed |
| 536 | any arguments. |
Jean-Paul Calderone | 5a9e461 | 2011-04-01 18:27:45 -0400 | [diff] [blame] | 537 | """ |
| 538 | ext = X509Extension(b('basicConstraints'), True, b('CA:true')) |
| 539 | self.assertRaises(TypeError, ext.get_data, None) |
| 540 | self.assertRaises(TypeError, ext.get_data, "foo") |
| 541 | self.assertRaises(TypeError, ext.get_data, 7) |
| 542 | |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 543 | def test_unused_subject(self): |
Rick Dean | 47262da | 2009-07-08 16:17:17 -0500 | [diff] [blame] | 544 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 545 | The :py:data:`subject` parameter to :py:class:`X509Extension` may be |
| 546 | provided for an extension which does not use it and is ignored in this |
| 547 | case. |
Rick Dean | 47262da | 2009-07-08 16:17:17 -0500 | [diff] [blame] | 548 | """ |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 549 | ext1 = X509Extension( |
| 550 | b('basicConstraints'), False, b('CA:TRUE'), subject=self.x509) |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 551 | self.x509.add_extensions([ext1]) |
| 552 | self.x509.sign(self.pkey, 'sha1') |
| 553 | # This is a little lame. Can we think of a better way? |
| 554 | text = dump_certificate(FILETYPE_TEXT, self.x509) |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 555 | self.assertTrue(b('X509v3 Basic Constraints:') in text) |
| 556 | self.assertTrue(b('CA:TRUE') in text) |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 557 | |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 558 | def test_subject(self): |
| 559 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 560 | If an extension requires a subject, the :py:data:`subject` parameter to |
| 561 | :py:class:`X509Extension` provides its value. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 562 | """ |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 563 | ext3 = X509Extension( |
| 564 | b('subjectKeyIdentifier'), False, b('hash'), subject=self.x509) |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 565 | self.x509.add_extensions([ext3]) |
| 566 | self.x509.sign(self.pkey, 'sha1') |
| 567 | text = dump_certificate(FILETYPE_TEXT, self.x509) |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 568 | self.assertTrue(b('X509v3 Subject Key Identifier:') in text) |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 569 | |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 570 | def test_missing_subject(self): |
| 571 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 572 | If an extension requires a subject and the :py:data:`subject` parameter |
| 573 | is given no value, something happens. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 574 | """ |
| 575 | self.assertRaises( |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 576 | Error, X509Extension, b('subjectKeyIdentifier'), False, b('hash')) |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 577 | |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 578 | def test_invalid_subject(self): |
| 579 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 580 | If the :py:data:`subject` parameter is given a value which is not an |
| 581 | :py:class:`X509` instance, :py:exc:`TypeError` is raised. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 582 | """ |
| 583 | for badObj in [True, object(), "hello", [], self]: |
| 584 | self.assertRaises( |
| 585 | TypeError, |
| 586 | X509Extension, |
| 587 | 'basicConstraints', False, 'CA:TRUE', subject=badObj) |
| 588 | |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 589 | def test_unused_issuer(self): |
| 590 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 591 | The :py:data:`issuer` parameter to :py:class:`X509Extension` may be |
| 592 | provided for an extension which does not use it and is ignored in this |
| 593 | case. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 594 | """ |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 595 | ext1 = X509Extension( |
| 596 | b('basicConstraints'), False, b('CA:TRUE'), issuer=self.x509) |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 597 | self.x509.add_extensions([ext1]) |
| 598 | self.x509.sign(self.pkey, 'sha1') |
| 599 | text = dump_certificate(FILETYPE_TEXT, self.x509) |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 600 | self.assertTrue(b('X509v3 Basic Constraints:') in text) |
| 601 | self.assertTrue(b('CA:TRUE') in text) |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 602 | |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 603 | def test_issuer(self): |
| 604 | """ |
Alex Gaynor | 3b0ee97 | 2014-11-15 09:17:33 -0800 | [diff] [blame] | 605 | If an extension requires an issuer, the :py:data:`issuer` parameter to |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 606 | :py:class:`X509Extension` provides its value. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 607 | """ |
| 608 | ext2 = X509Extension( |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 609 | b('authorityKeyIdentifier'), False, b('issuer:always'), |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 610 | issuer=self.x509) |
| 611 | self.x509.add_extensions([ext2]) |
| 612 | self.x509.sign(self.pkey, 'sha1') |
| 613 | text = dump_certificate(FILETYPE_TEXT, self.x509) |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 614 | self.assertTrue(b('X509v3 Authority Key Identifier:') in text) |
| 615 | self.assertTrue(b('DirName:/CN=Yoda root CA') in text) |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 616 | |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 617 | def test_missing_issuer(self): |
| 618 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 619 | If an extension requires an issue and the :py:data:`issuer` parameter |
| 620 | is given no value, something happens. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 621 | """ |
| 622 | self.assertRaises( |
| 623 | Error, |
| 624 | X509Extension, |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 625 | b('authorityKeyIdentifier'), False, |
| 626 | b('keyid:always,issuer:always')) |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 627 | |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 628 | def test_invalid_issuer(self): |
| 629 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 630 | If the :py:data:`issuer` parameter is given a value which is not an |
| 631 | :py:class:`X509` instance, :py:exc:`TypeError` is raised. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 632 | """ |
| 633 | for badObj in [True, object(), "hello", [], self]: |
| 634 | self.assertRaises( |
| 635 | TypeError, |
| 636 | X509Extension, |
| 637 | 'authorityKeyIdentifier', False, 'keyid:always,issuer:always', |
| 638 | issuer=badObj) |
Rick Dean | 47262da | 2009-07-08 16:17:17 -0500 | [diff] [blame] | 639 | |
| 640 | |
Jean-Paul Calderone | 1880865 | 2009-07-05 12:54:05 -0400 | [diff] [blame] | 641 | class PKeyTests(TestCase): |
Jean-Paul Calderone | ac930e1 | 2008-03-06 18:50:51 -0500 | [diff] [blame] | 642 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 643 | Unit tests for :py:class:`OpenSSL.crypto.PKey`. |
Jean-Paul Calderone | ac930e1 | 2008-03-06 18:50:51 -0500 | [diff] [blame] | 644 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 645 | |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 646 | def test_type(self): |
| 647 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 648 | :py:class:`PKey` and :py:class:`PKeyType` refer to the same type object |
| 649 | and can be used to create instances of that type. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 650 | """ |
| 651 | self.assertIdentical(PKey, PKeyType) |
| 652 | self.assertConsistentType(PKey, 'PKey') |
| 653 | |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 654 | def test_construction(self): |
| 655 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 656 | :py:class:`PKey` takes no arguments and returns a new :py:class:`PKey` |
| 657 | instance. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 658 | """ |
| 659 | self.assertRaises(TypeError, PKey, None) |
| 660 | key = PKey() |
| 661 | self.assertTrue( |
| 662 | isinstance(key, PKeyType), |
| 663 | "%r is of type %r, should be %r" % (key, type(key), PKeyType)) |
| 664 | |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 665 | def test_pregeneration(self): |
| 666 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 667 | :py:attr:`PKeyType.bits` and :py:attr:`PKeyType.type` return |
| 668 | :py:data:`0` before the key is generated. :py:attr:`PKeyType.check` |
| 669 | raises :py:exc:`TypeError` before the key is generated. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 670 | """ |
| 671 | key = PKey() |
| 672 | self.assertEqual(key.type(), 0) |
| 673 | self.assertEqual(key.bits(), 0) |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 674 | self.assertRaises(TypeError, key.check) |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 675 | |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 676 | def test_failedGeneration(self): |
| 677 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 678 | :py:meth:`PKeyType.generate_key` takes two arguments, the first giving |
| 679 | the key type as one of :py:data:`TYPE_RSA` or :py:data:`TYPE_DSA` and |
| 680 | the second giving the number of bits to generate. If an invalid type |
| 681 | is specified or generation fails, :py:exc:`Error` is raised. If an |
| 682 | invalid number of bits is specified, :py:exc:`ValueError` or |
| 683 | :py:exc:`Error` is raised. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 684 | """ |
| 685 | key = PKey() |
| 686 | self.assertRaises(TypeError, key.generate_key) |
| 687 | self.assertRaises(TypeError, key.generate_key, 1, 2, 3) |
| 688 | self.assertRaises(TypeError, key.generate_key, "foo", "bar") |
| 689 | self.assertRaises(Error, key.generate_key, -1, 0) |
Jean-Paul Calderone | ab82db7 | 2008-03-06 00:09:31 -0500 | [diff] [blame] | 690 | |
Jean-Paul Calderone | ab82db7 | 2008-03-06 00:09:31 -0500 | [diff] [blame] | 691 | self.assertRaises(ValueError, key.generate_key, TYPE_RSA, -1) |
| 692 | self.assertRaises(ValueError, key.generate_key, TYPE_RSA, 0) |
Jean-Paul Calderone | d71fe98 | 2008-03-06 00:31:50 -0500 | [diff] [blame] | 693 | |
| 694 | # XXX RSA generation for small values of bits is fairly buggy in a wide |
| 695 | # range of OpenSSL versions. I need to figure out what the safe lower |
| 696 | # bound for a reasonable number of OpenSSL versions is and explicitly |
| 697 | # check for that in the wrapper. The failure behavior is typically an |
| 698 | # infinite loop inside OpenSSL. |
| 699 | |
| 700 | # self.assertRaises(Error, key.generate_key, TYPE_RSA, 2) |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 701 | |
| 702 | # XXX DSA generation seems happy with any number of bits. The DSS |
| 703 | # says bits must be between 512 and 1024 inclusive. OpenSSL's DSA |
| 704 | # generator doesn't seem to care about the upper limit at all. For |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 705 | # the lower limit, it uses 512 if anything smaller is specified. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 706 | # So, it doesn't seem possible to make generate_key fail for |
| 707 | # TYPE_DSA with a bits argument which is at least an int. |
| 708 | |
| 709 | # self.assertRaises(Error, key.generate_key, TYPE_DSA, -7) |
| 710 | |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 711 | def test_rsaGeneration(self): |
| 712 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 713 | :py:meth:`PKeyType.generate_key` generates an RSA key when passed |
| 714 | :py:data:`TYPE_RSA` as a type and a reasonable number of bits. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 715 | """ |
| 716 | bits = 128 |
| 717 | key = PKey() |
| 718 | key.generate_key(TYPE_RSA, bits) |
| 719 | self.assertEqual(key.type(), TYPE_RSA) |
| 720 | self.assertEqual(key.bits(), bits) |
Jean-Paul Calderone | 8e6ce97 | 2009-05-13 12:32:49 -0400 | [diff] [blame] | 721 | self.assertTrue(key.check()) |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 722 | |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 723 | def test_dsaGeneration(self): |
| 724 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 725 | :py:meth:`PKeyType.generate_key` generates a DSA key when passed |
| 726 | :py:data:`TYPE_DSA` as a type and a reasonable number of bits. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 727 | """ |
| 728 | # 512 is a magic number. The DSS (Digital Signature Standard) |
| 729 | # allows a minimum of 512 bits for DSA. DSA_generate_parameters |
| 730 | # will silently promote any value below 512 to 512. |
| 731 | bits = 512 |
| 732 | key = PKey() |
| 733 | key.generate_key(TYPE_DSA, bits) |
Jean-Paul Calderone | f6745b3 | 2013-03-01 15:08:46 -0800 | [diff] [blame] | 734 | # self.assertEqual(key.type(), TYPE_DSA) |
| 735 | # self.assertEqual(key.bits(), bits) |
| 736 | # self.assertRaises(TypeError, key.check) |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 737 | |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 738 | def test_regeneration(self): |
| 739 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 740 | :py:meth:`PKeyType.generate_key` can be called multiple times on the |
| 741 | same key to generate new keys. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 742 | """ |
| 743 | key = PKey() |
| 744 | for type, bits in [(TYPE_RSA, 512), (TYPE_DSA, 576)]: |
Alex Gaynor | 7f63649 | 2015-09-04 13:26:52 -0400 | [diff] [blame] | 745 | key.generate_key(type, bits) |
| 746 | self.assertEqual(key.type(), type) |
| 747 | self.assertEqual(key.bits(), bits) |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 748 | |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 749 | def test_inconsistentKey(self): |
| 750 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 751 | :py:`PKeyType.check` returns :py:exc:`Error` if the key is not |
| 752 | consistent. |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 753 | """ |
| 754 | key = load_privatekey(FILETYPE_PEM, inconsistentPrivateKeyPEM) |
Jean-Paul Calderone | d338e4e | 2009-05-13 15:45:07 -0400 | [diff] [blame] | 755 | self.assertRaises(Error, key.check) |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 756 | |
Jean-Paul Calderone | e81020e | 2011-06-12 21:48:57 -0400 | [diff] [blame] | 757 | def test_check_wrong_args(self): |
| 758 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 759 | :py:meth:`PKeyType.check` raises :py:exc:`TypeError` if called with any |
| 760 | arguments. |
Jean-Paul Calderone | e81020e | 2011-06-12 21:48:57 -0400 | [diff] [blame] | 761 | """ |
| 762 | self.assertRaises(TypeError, PKey().check, None) |
| 763 | self.assertRaises(TypeError, PKey().check, object()) |
| 764 | self.assertRaises(TypeError, PKey().check, 1) |
| 765 | |
Jean-Paul Calderone | 02d0197 | 2011-10-31 10:39:29 -0400 | [diff] [blame] | 766 | def test_check_public_key(self): |
| 767 | """ |
| 768 | :py:meth:`PKeyType.check` raises :py:exc:`TypeError` if only the public |
| 769 | part of the key is available. |
| 770 | """ |
| 771 | # A trick to get a public-only key |
| 772 | key = PKey() |
| 773 | key.generate_key(TYPE_RSA, 512) |
| 774 | cert = X509() |
| 775 | cert.set_pubkey(key) |
| 776 | pub = cert.get_pubkey() |
| 777 | self.assertRaises(TypeError, pub.check) |
| 778 | |
| 779 | |
Jean-Paul Calderone | 1880865 | 2009-07-05 12:54:05 -0400 | [diff] [blame] | 780 | class X509NameTests(TestCase): |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 781 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 782 | Unit tests for :py:class:`OpenSSL.crypto.X509Name`. |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 783 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 784 | |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 785 | def _x509name(self, **attrs): |
| 786 | # XXX There's no other way to get a new X509Name yet. |
| 787 | name = X509().get_subject() |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 788 | attrs = list(attrs.items()) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 789 | # Make the order stable - order matters! |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 790 | def key(attr): |
| 791 | return attr[1] |
| 792 | attrs.sort(key=key) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 793 | for k, v in attrs: |
| 794 | setattr(name, k, v) |
| 795 | return name |
| 796 | |
Rick Dean | e15b147 | 2009-07-09 15:53:42 -0500 | [diff] [blame] | 797 | def test_type(self): |
| 798 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 799 | The type of X509Name objects is :py:class:`X509NameType`. |
Rick Dean | e15b147 | 2009-07-09 15:53:42 -0500 | [diff] [blame] | 800 | """ |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 801 | self.assertIdentical(X509Name, X509NameType) |
| 802 | self.assertEqual(X509NameType.__name__, 'X509Name') |
| 803 | self.assertTrue(isinstance(X509NameType, type)) |
| 804 | |
Rick Dean | e15b147 | 2009-07-09 15:53:42 -0500 | [diff] [blame] | 805 | name = self._x509name() |
| 806 | self.assertTrue( |
| 807 | isinstance(name, X509NameType), |
| 808 | "%r is of type %r, should be %r" % ( |
| 809 | name, type(name), X509NameType)) |
Rick Dean | e15b147 | 2009-07-09 15:53:42 -0500 | [diff] [blame] | 810 | |
Jean-Paul Calderone | 9ce9afb | 2011-04-22 18:16:22 -0400 | [diff] [blame] | 811 | def test_onlyStringAttributes(self): |
| 812 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 813 | Attempting to set a non-:py:data:`str` attribute name on an |
| 814 | :py:class:`X509NameType` instance causes :py:exc:`TypeError` to be |
| 815 | raised. |
Jean-Paul Calderone | 9ce9afb | 2011-04-22 18:16:22 -0400 | [diff] [blame] | 816 | """ |
| 817 | name = self._x509name() |
| 818 | # Beyond these cases, you may also think that unicode should be |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 819 | # rejected. Sorry, you're wrong. unicode is automatically converted |
| 820 | # to str outside of the control of X509Name, so there's no way to |
| 821 | # reject it. |
Jean-Paul Calderone | ff363be | 2013-03-03 10:21:23 -0800 | [diff] [blame] | 822 | |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 823 | # Also, this used to test str subclasses, but that test is less |
| 824 | # relevant now that the implementation is in Python instead of C. Also |
| 825 | # PyPy automatically converts str subclasses to str when they are |
| 826 | # passed to setattr, so we can't test it on PyPy. Apparently CPython |
| 827 | # does this sometimes as well. |
Jean-Paul Calderone | 9ce9afb | 2011-04-22 18:16:22 -0400 | [diff] [blame] | 828 | self.assertRaises(TypeError, setattr, name, None, "hello") |
| 829 | self.assertRaises(TypeError, setattr, name, 30, "hello") |
Jean-Paul Calderone | 9ce9afb | 2011-04-22 18:16:22 -0400 | [diff] [blame] | 830 | |
| 831 | def test_setInvalidAttribute(self): |
| 832 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 833 | Attempting to set any attribute name on an :py:class:`X509NameType` |
| 834 | instance for which no corresponding NID is defined causes |
| 835 | :py:exc:`AttributeError` to be raised. |
Jean-Paul Calderone | 9ce9afb | 2011-04-22 18:16:22 -0400 | [diff] [blame] | 836 | """ |
| 837 | name = self._x509name() |
| 838 | self.assertRaises(AttributeError, setattr, name, "no such thing", None) |
| 839 | |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 840 | def test_attributes(self): |
| 841 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 842 | :py:class:`X509NameType` instances have attributes for each standard |
| 843 | (?) X509Name field. |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 844 | """ |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 845 | name = self._x509name() |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 846 | name.commonName = "foo" |
| 847 | self.assertEqual(name.commonName, "foo") |
| 848 | self.assertEqual(name.CN, "foo") |
| 849 | name.CN = "baz" |
| 850 | self.assertEqual(name.commonName, "baz") |
| 851 | self.assertEqual(name.CN, "baz") |
| 852 | name.commonName = "bar" |
| 853 | self.assertEqual(name.commonName, "bar") |
| 854 | self.assertEqual(name.CN, "bar") |
| 855 | name.CN = "quux" |
| 856 | self.assertEqual(name.commonName, "quux") |
| 857 | self.assertEqual(name.CN, "quux") |
| 858 | |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 859 | def test_copy(self): |
| 860 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 861 | :py:class:`X509Name` creates a new :py:class:`X509NameType` instance |
| 862 | with all the same attributes as an existing :py:class:`X509NameType` |
| 863 | instance when called with one. |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 864 | """ |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 865 | name = self._x509name(commonName="foo", emailAddress="bar@example.com") |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 866 | |
| 867 | copy = X509Name(name) |
| 868 | self.assertEqual(copy.commonName, "foo") |
| 869 | self.assertEqual(copy.emailAddress, "bar@example.com") |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 870 | |
| 871 | # Mutate the copy and ensure the original is unmodified. |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 872 | copy.commonName = "baz" |
| 873 | self.assertEqual(name.commonName, "foo") |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 874 | |
| 875 | # Mutate the original and ensure the copy is unmodified. |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 876 | name.emailAddress = "quux@example.com" |
| 877 | self.assertEqual(copy.emailAddress, "bar@example.com") |
| 878 | |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 879 | def test_repr(self): |
| 880 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 881 | :py:func:`repr` passed an :py:class:`X509NameType` instance should |
| 882 | return a string containing a description of the type and the NIDs which |
| 883 | have been set on it. |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 884 | """ |
| 885 | name = self._x509name(commonName="foo", emailAddress="bar") |
| 886 | self.assertEqual( |
| 887 | repr(name), |
| 888 | "<X509Name object '/emailAddress=bar/CN=foo'>") |
| 889 | |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 890 | def test_comparison(self): |
| 891 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 892 | :py:class:`X509NameType` instances should compare based on their NIDs. |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 893 | """ |
| 894 | def _equality(a, b, assertTrue, assertFalse): |
| 895 | assertTrue(a == b, "(%r == %r) --> False" % (a, b)) |
| 896 | assertFalse(a != b) |
| 897 | assertTrue(b == a) |
| 898 | assertFalse(b != a) |
| 899 | |
| 900 | def assertEqual(a, b): |
| 901 | _equality(a, b, self.assertTrue, self.assertFalse) |
| 902 | |
| 903 | # Instances compare equal to themselves. |
| 904 | name = self._x509name() |
| 905 | assertEqual(name, name) |
| 906 | |
| 907 | # Empty instances should compare equal to each other. |
| 908 | assertEqual(self._x509name(), self._x509name()) |
| 909 | |
| 910 | # Instances with equal NIDs should compare equal to each other. |
| 911 | assertEqual(self._x509name(commonName="foo"), |
| 912 | self._x509name(commonName="foo")) |
| 913 | |
| 914 | # Instance with equal NIDs set using different aliases should compare |
| 915 | # equal to each other. |
| 916 | assertEqual(self._x509name(commonName="foo"), |
| 917 | self._x509name(CN="foo")) |
| 918 | |
| 919 | # Instances with more than one NID with the same values should compare |
| 920 | # equal to each other. |
| 921 | assertEqual(self._x509name(CN="foo", organizationalUnitName="bar"), |
| 922 | self._x509name(commonName="foo", OU="bar")) |
| 923 | |
| 924 | def assertNotEqual(a, b): |
| 925 | _equality(a, b, self.assertFalse, self.assertTrue) |
| 926 | |
| 927 | # Instances with different values for the same NID should not compare |
| 928 | # equal to each other. |
| 929 | assertNotEqual(self._x509name(CN="foo"), |
| 930 | self._x509name(CN="bar")) |
| 931 | |
| 932 | # Instances with different NIDs should not compare equal to each other. |
| 933 | assertNotEqual(self._x509name(CN="foo"), |
| 934 | self._x509name(OU="foo")) |
| 935 | |
| 936 | def _inequality(a, b, assertTrue, assertFalse): |
| 937 | assertTrue(a < b) |
| 938 | assertTrue(a <= b) |
| 939 | assertTrue(b > a) |
| 940 | assertTrue(b >= a) |
| 941 | assertFalse(a > b) |
| 942 | assertFalse(a >= b) |
| 943 | assertFalse(b < a) |
| 944 | assertFalse(b <= a) |
| 945 | |
| 946 | def assertLessThan(a, b): |
| 947 | _inequality(a, b, self.assertTrue, self.assertFalse) |
| 948 | |
| 949 | # An X509Name with a NID with a value which sorts less than the value |
| 950 | # of the same NID on another X509Name compares less than the other |
| 951 | # X509Name. |
| 952 | assertLessThan(self._x509name(CN="abc"), |
| 953 | self._x509name(CN="def")) |
| 954 | |
| 955 | def assertGreaterThan(a, b): |
| 956 | _inequality(a, b, self.assertFalse, self.assertTrue) |
| 957 | |
| 958 | # An X509Name with a NID with a value which sorts greater than the |
| 959 | # value of the same NID on another X509Name compares greater than the |
| 960 | # other X509Name. |
| 961 | assertGreaterThan(self._x509name(CN="def"), |
| 962 | self._x509name(CN="abc")) |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 963 | |
Jean-Paul Calderone | 110cd09 | 2008-03-24 17:27:42 -0400 | [diff] [blame] | 964 | def test_hash(self): |
| 965 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 966 | :py:meth:`X509Name.hash` returns an integer hash based on the value of |
| 967 | the name. |
Jean-Paul Calderone | 110cd09 | 2008-03-24 17:27:42 -0400 | [diff] [blame] | 968 | """ |
| 969 | a = self._x509name(CN="foo") |
| 970 | b = self._x509name(CN="foo") |
| 971 | self.assertEqual(a.hash(), b.hash()) |
| 972 | a.CN = "bar" |
| 973 | self.assertNotEqual(a.hash(), b.hash()) |
| 974 | |
Jean-Paul Calderone | e957a00 | 2008-03-25 15:16:51 -0400 | [diff] [blame] | 975 | def test_der(self): |
| 976 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 977 | :py:meth:`X509Name.der` returns the DER encoded form of the name. |
Jean-Paul Calderone | e957a00 | 2008-03-25 15:16:51 -0400 | [diff] [blame] | 978 | """ |
| 979 | a = self._x509name(CN="foo", C="US") |
| 980 | self.assertEqual( |
| 981 | a.der(), |
Jean-Paul Calderone | 2ac721b | 2010-08-22 19:20:00 -0400 | [diff] [blame] | 982 | b('0\x1b1\x0b0\t\x06\x03U\x04\x06\x13\x02US' |
D.S. Ljungmark | 5533e25 | 2014-05-31 13:18:41 +0200 | [diff] [blame] | 983 | '1\x0c0\n\x06\x03U\x04\x03\x0c\x03foo')) |
Jean-Paul Calderone | e957a00 | 2008-03-25 15:16:51 -0400 | [diff] [blame] | 984 | |
Jean-Paul Calderone | c54cc18 | 2008-03-26 21:11:07 -0400 | [diff] [blame] | 985 | def test_get_components(self): |
| 986 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 987 | :py:meth:`X509Name.get_components` returns a :py:data:`list` of |
| 988 | two-tuples of :py:data:`str` |
Jean-Paul Calderone | c54cc18 | 2008-03-26 21:11:07 -0400 | [diff] [blame] | 989 | giving the NIDs and associated values which make up the name. |
| 990 | """ |
| 991 | a = self._x509name() |
| 992 | self.assertEqual(a.get_components(), []) |
| 993 | a.CN = "foo" |
Jean-Paul Calderone | 2ac721b | 2010-08-22 19:20:00 -0400 | [diff] [blame] | 994 | self.assertEqual(a.get_components(), [(b("CN"), b("foo"))]) |
Jean-Paul Calderone | c54cc18 | 2008-03-26 21:11:07 -0400 | [diff] [blame] | 995 | a.organizationalUnitName = "bar" |
| 996 | self.assertEqual( |
| 997 | a.get_components(), |
Jean-Paul Calderone | 2ac721b | 2010-08-22 19:20:00 -0400 | [diff] [blame] | 998 | [(b("CN"), b("foo")), (b("OU"), b("bar"))]) |
Jean-Paul Calderone | c54cc18 | 2008-03-26 21:11:07 -0400 | [diff] [blame] | 999 | |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1000 | def test_load_nul_byte_attribute(self): |
| 1001 | """ |
Jean-Paul Calderone | 9af07b0 | 2013-08-23 16:07:31 -0400 | [diff] [blame] | 1002 | An :py:class:`OpenSSL.crypto.X509Name` from an |
| 1003 | :py:class:`OpenSSL.crypto.X509` instance loaded from a file can have a |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1004 | NUL byte in the value of one of its attributes. |
| 1005 | """ |
| 1006 | cert = load_certificate(FILETYPE_PEM, nulbyteSubjectAltNamePEM) |
| 1007 | subject = cert.get_subject() |
| 1008 | self.assertEqual( |
Jean-Paul Calderone | 06754fc | 2013-08-23 15:47:47 -0400 | [diff] [blame] | 1009 | "null.python.org\x00example.org", subject.commonName) |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1010 | |
Jean-Paul Calderone | 5300d6a | 2013-12-29 16:36:50 -0500 | [diff] [blame] | 1011 | def test_setAttributeFailure(self): |
| 1012 | """ |
| 1013 | If the value of an attribute cannot be set for some reason then |
| 1014 | :py:class:`OpenSSL.crypto.Error` is raised. |
| 1015 | """ |
| 1016 | name = self._x509name() |
| 1017 | # This value is too long |
| 1018 | self.assertRaises(Error, setattr, name, "O", b"x" * 512) |
| 1019 | |
| 1020 | |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1021 | class _PKeyInteractionTestsMixin: |
| 1022 | """ |
| 1023 | Tests which involve another thing and a PKey. |
| 1024 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 1025 | |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1026 | def signable(self): |
| 1027 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1028 | Return something with a :py:meth:`set_pubkey`, :py:meth:`set_pubkey`, |
| 1029 | and :py:meth:`sign` method. |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1030 | """ |
| 1031 | raise NotImplementedError() |
| 1032 | |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1033 | def test_signWithUngenerated(self): |
| 1034 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1035 | :py:meth:`X509Req.sign` raises :py:exc:`ValueError` when pass a |
| 1036 | :py:class:`PKey` with no parts. |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1037 | """ |
| 1038 | request = self.signable() |
| 1039 | key = PKey() |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1040 | self.assertRaises(ValueError, request.sign, key, GOOD_DIGEST) |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1041 | |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1042 | def test_signWithPublicKey(self): |
| 1043 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1044 | :py:meth:`X509Req.sign` raises :py:exc:`ValueError` when pass a |
| 1045 | :py:class:`PKey` with no private part as the signing key. |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1046 | """ |
| 1047 | request = self.signable() |
| 1048 | key = PKey() |
| 1049 | key.generate_key(TYPE_RSA, 512) |
| 1050 | request.set_pubkey(key) |
| 1051 | pub = request.get_pubkey() |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1052 | self.assertRaises(ValueError, request.sign, pub, GOOD_DIGEST) |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1053 | |
Jean-Paul Calderone | cc05a91 | 2010-08-03 18:24:19 -0400 | [diff] [blame] | 1054 | def test_signWithUnknownDigest(self): |
| 1055 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1056 | :py:meth:`X509Req.sign` raises :py:exc:`ValueError` when passed a |
| 1057 | digest name which is not known. |
Jean-Paul Calderone | cc05a91 | 2010-08-03 18:24:19 -0400 | [diff] [blame] | 1058 | """ |
| 1059 | request = self.signable() |
| 1060 | key = PKey() |
| 1061 | key.generate_key(TYPE_RSA, 512) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1062 | self.assertRaises(ValueError, request.sign, key, BAD_DIGEST) |
Jean-Paul Calderone | cc05a91 | 2010-08-03 18:24:19 -0400 | [diff] [blame] | 1063 | |
Jean-Paul Calderone | b972559 | 2010-08-03 18:17:22 -0400 | [diff] [blame] | 1064 | def test_sign(self): |
| 1065 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1066 | :py:meth:`X509Req.sign` succeeds when passed a private key object and a |
| 1067 | valid digest function. :py:meth:`X509Req.verify` can be used to check |
| 1068 | the signature. |
Jean-Paul Calderone | b972559 | 2010-08-03 18:17:22 -0400 | [diff] [blame] | 1069 | """ |
| 1070 | request = self.signable() |
| 1071 | key = PKey() |
| 1072 | key.generate_key(TYPE_RSA, 512) |
| 1073 | request.set_pubkey(key) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1074 | request.sign(key, GOOD_DIGEST) |
Jean-Paul Calderone | b972559 | 2010-08-03 18:17:22 -0400 | [diff] [blame] | 1075 | # If the type has a verify method, cover that too. |
| 1076 | if getattr(request, 'verify', None) is not None: |
| 1077 | pub = request.get_pubkey() |
| 1078 | self.assertTrue(request.verify(pub)) |
| 1079 | # Make another key that won't verify. |
| 1080 | key = PKey() |
| 1081 | key.generate_key(TYPE_RSA, 512) |
| 1082 | self.assertRaises(Error, request.verify, key) |
| 1083 | |
| 1084 | |
Jean-Paul Calderone | 1880865 | 2009-07-05 12:54:05 -0400 | [diff] [blame] | 1085 | class X509ReqTests(TestCase, _PKeyInteractionTestsMixin): |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1086 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1087 | Tests for :py:class:`OpenSSL.crypto.X509Req`. |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1088 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 1089 | |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1090 | def signable(self): |
| 1091 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1092 | Create and return a new :py:class:`X509Req`. |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1093 | """ |
| 1094 | return X509Req() |
| 1095 | |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 1096 | def test_type(self): |
| 1097 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1098 | :py:obj:`X509Req` and :py:obj:`X509ReqType` refer to the same type |
| 1099 | object and can be used to create instances of that type. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 1100 | """ |
| 1101 | self.assertIdentical(X509Req, X509ReqType) |
| 1102 | self.assertConsistentType(X509Req, 'X509Req') |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1103 | |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1104 | def test_construction(self): |
| 1105 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1106 | :py:obj:`X509Req` takes no arguments and returns an |
| 1107 | :py:obj:`X509ReqType` instance. |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1108 | """ |
| 1109 | request = X509Req() |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1110 | assert isinstance(request, X509ReqType) |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1111 | |
Jean-Paul Calderone | 8dd19b8 | 2008-12-28 20:41:16 -0500 | [diff] [blame] | 1112 | def test_version(self): |
| 1113 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1114 | :py:obj:`X509ReqType.set_version` sets the X.509 version of the |
| 1115 | certificate request. :py:obj:`X509ReqType.get_version` returns the |
| 1116 | X.509 version of the certificate request. The initial value of the |
| 1117 | version is 0. |
Jean-Paul Calderone | 8dd19b8 | 2008-12-28 20:41:16 -0500 | [diff] [blame] | 1118 | """ |
| 1119 | request = X509Req() |
| 1120 | self.assertEqual(request.get_version(), 0) |
| 1121 | request.set_version(1) |
| 1122 | self.assertEqual(request.get_version(), 1) |
| 1123 | request.set_version(3) |
| 1124 | self.assertEqual(request.get_version(), 3) |
| 1125 | |
Jean-Paul Calderone | 54e49e9 | 2010-07-30 11:04:46 -0400 | [diff] [blame] | 1126 | def test_version_wrong_args(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 1127 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1128 | :py:obj:`X509ReqType.set_version` raises :py:obj:`TypeError` if called |
| 1129 | with the wrong number of arguments or with a non-:py:obj:`int` |
| 1130 | argument. :py:obj:`X509ReqType.get_version` raises :py:obj:`TypeError` |
| 1131 | if called with any arguments. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 1132 | """ |
Jean-Paul Calderone | 54e49e9 | 2010-07-30 11:04:46 -0400 | [diff] [blame] | 1133 | request = X509Req() |
| 1134 | self.assertRaises(TypeError, request.set_version) |
| 1135 | self.assertRaises(TypeError, request.set_version, "foo") |
| 1136 | self.assertRaises(TypeError, request.set_version, 1, 2) |
| 1137 | self.assertRaises(TypeError, request.get_version, None) |
| 1138 | |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1139 | def test_get_subject(self): |
| 1140 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1141 | :py:obj:`X509ReqType.get_subject` returns an :py:obj:`X509Name` for the |
| 1142 | subject of the request and which is valid even after the request object |
| 1143 | is otherwise dead. |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1144 | """ |
| 1145 | request = X509Req() |
| 1146 | subject = request.get_subject() |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1147 | assert isinstance(subject, X509NameType) |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1148 | subject.commonName = "foo" |
| 1149 | self.assertEqual(request.get_subject().commonName, "foo") |
| 1150 | del request |
| 1151 | subject.commonName = "bar" |
| 1152 | self.assertEqual(subject.commonName, "bar") |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1153 | |
Jean-Paul Calderone | 54e49e9 | 2010-07-30 11:04:46 -0400 | [diff] [blame] | 1154 | def test_get_subject_wrong_args(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 1155 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1156 | :py:obj:`X509ReqType.get_subject` raises :py:obj:`TypeError` if called |
| 1157 | with any arguments. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 1158 | """ |
Jean-Paul Calderone | 54e49e9 | 2010-07-30 11:04:46 -0400 | [diff] [blame] | 1159 | request = X509Req() |
| 1160 | self.assertRaises(TypeError, request.get_subject, None) |
| 1161 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1162 | def test_add_extensions(self): |
| 1163 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1164 | :py:obj:`X509Req.add_extensions` accepts a :py:obj:`list` of |
| 1165 | :py:obj:`X509Extension` instances and adds them to the X509 request. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1166 | """ |
| 1167 | request = X509Req() |
| 1168 | request.add_extensions([ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 1169 | X509Extension(b('basicConstraints'), True, b('CA:false'))]) |
Stephen Holsapple | ca545b7 | 2014-01-28 21:43:25 -0800 | [diff] [blame] | 1170 | exts = request.get_extensions() |
Stephen Holsapple | 7fbdf64 | 2014-03-01 20:05:47 -0800 | [diff] [blame] | 1171 | self.assertEqual(len(exts), 1) |
| 1172 | self.assertEqual(exts[0].get_short_name(), b('basicConstraints')) |
| 1173 | self.assertEqual(exts[0].get_critical(), 1) |
| 1174 | self.assertEqual(exts[0].get_data(), b('0\x00')) |
| 1175 | |
Stephen Holsapple | 7fbdf64 | 2014-03-01 20:05:47 -0800 | [diff] [blame] | 1176 | def test_get_extensions(self): |
| 1177 | """ |
| 1178 | :py:obj:`X509Req.get_extensions` returns a :py:obj:`list` of |
| 1179 | extensions added to this X509 request. |
| 1180 | """ |
| 1181 | request = X509Req() |
| 1182 | exts = request.get_extensions() |
| 1183 | self.assertEqual(exts, []) |
| 1184 | request.add_extensions([ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 1185 | X509Extension(b('basicConstraints'), True, b('CA:true')), |
| 1186 | X509Extension(b('keyUsage'), False, b('digitalSignature'))]) |
Stephen Holsapple | 7fbdf64 | 2014-03-01 20:05:47 -0800 | [diff] [blame] | 1187 | exts = request.get_extensions() |
| 1188 | self.assertEqual(len(exts), 2) |
| 1189 | self.assertEqual(exts[0].get_short_name(), b('basicConstraints')) |
| 1190 | self.assertEqual(exts[0].get_critical(), 1) |
| 1191 | self.assertEqual(exts[0].get_data(), b('0\x03\x01\x01\xff')) |
| 1192 | self.assertEqual(exts[1].get_short_name(), b('keyUsage')) |
| 1193 | self.assertEqual(exts[1].get_critical(), 0) |
| 1194 | self.assertEqual(exts[1].get_data(), b('\x03\x02\x07\x80')) |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1195 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1196 | def test_add_extensions_wrong_args(self): |
| 1197 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1198 | :py:obj:`X509Req.add_extensions` raises :py:obj:`TypeError` if called |
| 1199 | with the wrong number of arguments or with a non-:py:obj:`list`. Or it |
| 1200 | raises :py:obj:`ValueError` if called with a :py:obj:`list` containing |
| 1201 | objects other than :py:obj:`X509Extension` instances. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1202 | """ |
| 1203 | request = X509Req() |
| 1204 | self.assertRaises(TypeError, request.add_extensions) |
| 1205 | self.assertRaises(TypeError, request.add_extensions, object()) |
| 1206 | self.assertRaises(ValueError, request.add_extensions, [object()]) |
| 1207 | self.assertRaises(TypeError, request.add_extensions, [], None) |
| 1208 | |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1209 | def test_verify_wrong_args(self): |
| 1210 | """ |
| 1211 | :py:obj:`X509Req.verify` raises :py:obj:`TypeError` if called with zero |
| 1212 | arguments or more than one argument or if passed anything other than a |
| 1213 | :py:obj:`PKey` instance as its single argument. |
| 1214 | """ |
| 1215 | request = X509Req() |
| 1216 | self.assertRaises(TypeError, request.verify) |
| 1217 | self.assertRaises(TypeError, request.verify, object()) |
| 1218 | self.assertRaises(TypeError, request.verify, PKey(), object()) |
| 1219 | |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1220 | def test_verify_uninitialized_key(self): |
| 1221 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1222 | :py:obj:`X509Req.verify` raises :py:obj:`OpenSSL.crypto.Error` if |
| 1223 | called with a :py:obj:`OpenSSL.crypto.PKey` which contains no key data. |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1224 | """ |
| 1225 | request = X509Req() |
| 1226 | pkey = PKey() |
| 1227 | self.assertRaises(Error, request.verify, pkey) |
| 1228 | |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1229 | def test_verify_wrong_key(self): |
| 1230 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1231 | :py:obj:`X509Req.verify` raises :py:obj:`OpenSSL.crypto.Error` if |
| 1232 | called with a :py:obj:`OpenSSL.crypto.PKey` which does not represent |
| 1233 | the public part of the key which signed the request. |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1234 | """ |
| 1235 | request = X509Req() |
| 1236 | pkey = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1237 | request.sign(pkey, GOOD_DIGEST) |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1238 | another_pkey = load_privatekey(FILETYPE_PEM, client_key_pem) |
| 1239 | self.assertRaises(Error, request.verify, another_pkey) |
| 1240 | |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1241 | def test_verify_success(self): |
| 1242 | """ |
| 1243 | :py:obj:`X509Req.verify` returns :py:obj:`True` if called with a |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1244 | :py:obj:`OpenSSL.crypto.PKey` which represents the public part of the |
| 1245 | key which signed the request. |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1246 | """ |
| 1247 | request = X509Req() |
| 1248 | pkey = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1249 | request.sign(pkey, GOOD_DIGEST) |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1250 | self.assertEqual(True, request.verify(pkey)) |
| 1251 | |
| 1252 | |
Jean-Paul Calderone | 1880865 | 2009-07-05 12:54:05 -0400 | [diff] [blame] | 1253 | class X509Tests(TestCase, _PKeyInteractionTestsMixin): |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1254 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1255 | Tests for :py:obj:`OpenSSL.crypto.X509`. |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1256 | """ |
Jean-Paul Calderone | 5ef8651 | 2008-04-26 19:06:28 -0400 | [diff] [blame] | 1257 | pemData = cleartextCertificatePEM + cleartextPrivateKeyPEM |
Jean-Paul Calderone | 8114b45 | 2008-03-25 15:27:59 -0400 | [diff] [blame] | 1258 | |
Roland Hedberg | 7e4930e | 2008-04-22 22:58:50 +0200 | [diff] [blame] | 1259 | extpem = """ |
| 1260 | -----BEGIN CERTIFICATE----- |
| 1261 | MIIC3jCCAkegAwIBAgIJAJHFjlcCgnQzMA0GCSqGSIb3DQEBBQUAMEcxCzAJBgNV |
| 1262 | BAYTAlNFMRUwEwYDVQQIEwxXZXN0ZXJib3R0b20xEjAQBgNVBAoTCUNhdGFsb2dp |
| 1263 | eDENMAsGA1UEAxMEUm9vdDAeFw0wODA0MjIxNDQ1MzhaFw0wOTA0MjIxNDQ1Mzha |
| 1264 | MFQxCzAJBgNVBAYTAlNFMQswCQYDVQQIEwJXQjEUMBIGA1UEChMLT3Blbk1ldGFk |
| 1265 | aXIxIjAgBgNVBAMTGW5vZGUxLm9tMi5vcGVubWV0YWRpci5vcmcwgZ8wDQYJKoZI |
| 1266 | hvcNAQEBBQADgY0AMIGJAoGBAPIcQMrwbk2nESF/0JKibj9i1x95XYAOwP+LarwT |
| 1267 | Op4EQbdlI9SY+uqYqlERhF19w7CS+S6oyqx0DRZSk4Y9dZ9j9/xgm2u/f136YS1u |
| 1268 | zgYFPvfUs6PqYLPSM8Bw+SjJ+7+2+TN+Tkiof9WP1cMjodQwOmdsiRbR0/J7+b1B |
| 1269 | hec1AgMBAAGjgcQwgcEwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNT |
| 1270 | TCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFIdHsBcMVVMbAO7j6NCj |
| 1271 | 03HgLnHaMB8GA1UdIwQYMBaAFL2h9Bf9Mre4vTdOiHTGAt7BRY/8MEYGA1UdEQQ/ |
| 1272 | MD2CDSouZXhhbXBsZS5vcmeCESoub20yLmV4bWFwbGUuY29thwSC7wgKgRNvbTJA |
| 1273 | b3Blbm1ldGFkaXIub3JnMA0GCSqGSIb3DQEBBQUAA4GBALd7WdXkp2KvZ7/PuWZA |
| 1274 | MPlIxyjS+Ly11+BNE0xGQRp9Wz+2lABtpgNqssvU156+HkKd02rGheb2tj7MX9hG |
| 1275 | uZzbwDAZzJPjzDQDD7d3cWsrVcfIdqVU7epHqIadnOF+X0ghJ39pAm6VVadnSXCt |
| 1276 | WpOdIpB8KksUTCzV591Nr1wd |
| 1277 | -----END CERTIFICATE----- |
| 1278 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 1279 | |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1280 | def signable(self): |
| 1281 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1282 | Create and return a new :py:obj:`X509`. |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1283 | """ |
| 1284 | return X509() |
| 1285 | |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 1286 | def test_type(self): |
| 1287 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1288 | :py:obj:`X509` and :py:obj:`X509Type` refer to the same type object and |
| 1289 | can be used to create instances of that type. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 1290 | """ |
| 1291 | self.assertIdentical(X509, X509Type) |
| 1292 | self.assertConsistentType(X509, 'X509') |
| 1293 | |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1294 | def test_construction(self): |
| 1295 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1296 | :py:obj:`X509` takes no arguments and returns an instance of |
| 1297 | :py:obj:`X509Type`. |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1298 | """ |
| 1299 | certificate = X509() |
| 1300 | self.assertTrue( |
| 1301 | isinstance(certificate, X509Type), |
| 1302 | "%r is of type %r, should be %r" % (certificate, |
| 1303 | type(certificate), |
| 1304 | X509Type)) |
Rick Dean | e15b147 | 2009-07-09 15:53:42 -0500 | [diff] [blame] | 1305 | self.assertEqual(type(X509Type).__name__, 'type') |
| 1306 | self.assertEqual(type(certificate).__name__, 'X509') |
| 1307 | self.assertEqual(type(certificate), X509Type) |
Rick Dean | 04113e7 | 2009-07-16 12:06:35 -0500 | [diff] [blame] | 1308 | self.assertEqual(type(certificate), X509) |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1309 | |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1310 | def test_get_version_wrong_args(self): |
| 1311 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1312 | :py:obj:`X509.get_version` raises :py:obj:`TypeError` if invoked with |
| 1313 | any arguments. |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1314 | """ |
| 1315 | cert = X509() |
| 1316 | self.assertRaises(TypeError, cert.get_version, None) |
| 1317 | |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1318 | def test_set_version_wrong_args(self): |
| 1319 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1320 | :py:obj:`X509.set_version` raises :py:obj:`TypeError` if invoked with |
| 1321 | the wrong number of arguments or an argument not of type :py:obj:`int`. |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1322 | """ |
| 1323 | cert = X509() |
| 1324 | self.assertRaises(TypeError, cert.set_version) |
| 1325 | self.assertRaises(TypeError, cert.set_version, None) |
| 1326 | self.assertRaises(TypeError, cert.set_version, 1, None) |
| 1327 | |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1328 | def test_version(self): |
| 1329 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1330 | :py:obj:`X509.set_version` sets the certificate version number. |
| 1331 | :py:obj:`X509.get_version` retrieves it. |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1332 | """ |
| 1333 | cert = X509() |
| 1334 | cert.set_version(1234) |
| 1335 | self.assertEquals(cert.get_version(), 1234) |
| 1336 | |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1337 | def test_get_serial_number_wrong_args(self): |
| 1338 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1339 | :py:obj:`X509.get_serial_number` raises :py:obj:`TypeError` if invoked |
| 1340 | with any arguments. |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1341 | """ |
| 1342 | cert = X509() |
| 1343 | self.assertRaises(TypeError, cert.get_serial_number, None) |
| 1344 | |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1345 | def test_serial_number(self): |
| 1346 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1347 | The serial number of an :py:obj:`X509Type` can be retrieved and |
| 1348 | modified with :py:obj:`X509Type.get_serial_number` and |
| 1349 | :py:obj:`X509Type.set_serial_number`. |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1350 | """ |
| 1351 | certificate = X509() |
| 1352 | self.assertRaises(TypeError, certificate.set_serial_number) |
| 1353 | self.assertRaises(TypeError, certificate.set_serial_number, 1, 2) |
| 1354 | self.assertRaises(TypeError, certificate.set_serial_number, "1") |
| 1355 | self.assertRaises(TypeError, certificate.set_serial_number, 5.5) |
| 1356 | self.assertEqual(certificate.get_serial_number(), 0) |
| 1357 | certificate.set_serial_number(1) |
| 1358 | self.assertEqual(certificate.get_serial_number(), 1) |
| 1359 | certificate.set_serial_number(2 ** 32 + 1) |
| 1360 | self.assertEqual(certificate.get_serial_number(), 2 ** 32 + 1) |
| 1361 | certificate.set_serial_number(2 ** 64 + 1) |
| 1362 | self.assertEqual(certificate.get_serial_number(), 2 ** 64 + 1) |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1363 | certificate.set_serial_number(2 ** 128 + 1) |
| 1364 | self.assertEqual(certificate.get_serial_number(), 2 ** 128 + 1) |
| 1365 | |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1366 | def _setBoundTest(self, which): |
| 1367 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1368 | :py:obj:`X509Type.set_notBefore` takes a string in the format of an |
| 1369 | ASN1 GENERALIZEDTIME and sets the beginning of the certificate's |
| 1370 | validity period to it. |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1371 | """ |
| 1372 | certificate = X509() |
| 1373 | set = getattr(certificate, 'set_not' + which) |
| 1374 | get = getattr(certificate, 'get_not' + which) |
| 1375 | |
Jean-Paul Calderone | e0615b5 | 2008-03-09 21:44:46 -0400 | [diff] [blame] | 1376 | # Starts with no value. |
| 1377 | self.assertEqual(get(), None) |
| 1378 | |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1379 | # GMT (Or is it UTC?) -exarkun |
Jean-Paul Calderone | e890db3 | 2010-08-22 16:55:15 -0400 | [diff] [blame] | 1380 | when = b("20040203040506Z") |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1381 | set(when) |
| 1382 | self.assertEqual(get(), when) |
| 1383 | |
| 1384 | # A plus two hours and thirty minutes offset |
Jean-Paul Calderone | e890db3 | 2010-08-22 16:55:15 -0400 | [diff] [blame] | 1385 | when = b("20040203040506+0530") |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1386 | set(when) |
| 1387 | self.assertEqual(get(), when) |
| 1388 | |
| 1389 | # A minus one hour fifteen minutes offset |
Jean-Paul Calderone | e890db3 | 2010-08-22 16:55:15 -0400 | [diff] [blame] | 1390 | when = b("20040203040506-0115") |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1391 | set(when) |
| 1392 | self.assertEqual(get(), when) |
| 1393 | |
| 1394 | # An invalid string results in a ValueError |
Jean-Paul Calderone | e890db3 | 2010-08-22 16:55:15 -0400 | [diff] [blame] | 1395 | self.assertRaises(ValueError, set, b("foo bar")) |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1396 | |
Jean-Paul Calderone | 31ca200 | 2010-01-30 15:14:43 -0500 | [diff] [blame] | 1397 | # The wrong number of arguments results in a TypeError. |
| 1398 | self.assertRaises(TypeError, set) |
Jean-Paul Calderone | e890db3 | 2010-08-22 16:55:15 -0400 | [diff] [blame] | 1399 | self.assertRaises(TypeError, set, b("20040203040506Z"), b("20040203040506Z")) |
| 1400 | self.assertRaises(TypeError, get, b("foo bar")) |
| 1401 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1402 | # XXX ASN1_TIME (not GENERALIZEDTIME) |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1403 | |
| 1404 | def test_set_notBefore(self): |
| 1405 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1406 | :py:obj:`X509Type.set_notBefore` takes a string in the format of an |
| 1407 | ASN1 GENERALIZEDTIME and sets the beginning of the certificate's |
| 1408 | validity period to it. |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1409 | """ |
| 1410 | self._setBoundTest("Before") |
| 1411 | |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1412 | def test_set_notAfter(self): |
| 1413 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1414 | :py:obj:`X509Type.set_notAfter` takes a string in the format of an ASN1 |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1415 | GENERALIZEDTIME and sets the end of the certificate's validity period |
| 1416 | to it. |
| 1417 | """ |
| 1418 | self._setBoundTest("After") |
Jean-Paul Calderone | 76576d5 | 2008-03-24 16:04:46 -0400 | [diff] [blame] | 1419 | |
Jean-Paul Calderone | 38a646d | 2008-03-25 15:16:18 -0400 | [diff] [blame] | 1420 | def test_get_notBefore(self): |
| 1421 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1422 | :py:obj:`X509Type.get_notBefore` returns a string in the format of an |
| 1423 | ASN1 GENERALIZEDTIME even for certificates which store it as UTCTIME |
Jean-Paul Calderone | 38a646d | 2008-03-25 15:16:18 -0400 | [diff] [blame] | 1424 | internally. |
| 1425 | """ |
Jean-Paul Calderone | 8114b45 | 2008-03-25 15:27:59 -0400 | [diff] [blame] | 1426 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
Jean-Paul Calderone | e890db3 | 2010-08-22 16:55:15 -0400 | [diff] [blame] | 1427 | self.assertEqual(cert.get_notBefore(), b("20090325123658Z")) |
Jean-Paul Calderone | 38a646d | 2008-03-25 15:16:18 -0400 | [diff] [blame] | 1428 | |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1429 | def test_get_notAfter(self): |
| 1430 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1431 | :py:obj:`X509Type.get_notAfter` returns a string in the format of an |
| 1432 | ASN1 GENERALIZEDTIME even for certificates which store it as UTCTIME |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1433 | internally. |
| 1434 | """ |
| 1435 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
Jean-Paul Calderone | e890db3 | 2010-08-22 16:55:15 -0400 | [diff] [blame] | 1436 | self.assertEqual(cert.get_notAfter(), b("20170611123658Z")) |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1437 | |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1438 | def test_gmtime_adj_notBefore_wrong_args(self): |
| 1439 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1440 | :py:obj:`X509Type.gmtime_adj_notBefore` raises :py:obj:`TypeError` if |
| 1441 | called with the wrong number of arguments or a non-:py:obj:`int` |
| 1442 | argument. |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1443 | """ |
| 1444 | cert = X509() |
| 1445 | self.assertRaises(TypeError, cert.gmtime_adj_notBefore) |
| 1446 | self.assertRaises(TypeError, cert.gmtime_adj_notBefore, None) |
| 1447 | self.assertRaises(TypeError, cert.gmtime_adj_notBefore, 123, None) |
| 1448 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1449 | def test_gmtime_adj_notBefore(self): |
| 1450 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1451 | :py:obj:`X509Type.gmtime_adj_notBefore` changes the not-before |
| 1452 | timestamp to be the current time plus the number of seconds passed in. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1453 | """ |
| 1454 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
Maximilian Hils | bed25c9 | 2015-07-25 12:58:07 +0200 | [diff] [blame] | 1455 | not_before_min = datetime.utcnow().replace(microsecond=0) + timedelta(seconds=100) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1456 | cert.gmtime_adj_notBefore(100) |
Maximilian Hils | bed25c9 | 2015-07-25 12:58:07 +0200 | [diff] [blame] | 1457 | not_before = datetime.strptime(cert.get_notBefore().decode(), "%Y%m%d%H%M%SZ") |
| 1458 | not_before_max = datetime.utcnow() + timedelta(seconds=100) |
| 1459 | self.assertTrue(not_before_min <= not_before <= not_before_max) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1460 | |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1461 | def test_gmtime_adj_notAfter_wrong_args(self): |
| 1462 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1463 | :py:obj:`X509Type.gmtime_adj_notAfter` raises :py:obj:`TypeError` if |
| 1464 | called with the wrong number of arguments or a non-:py:obj:`int` |
| 1465 | argument. |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1466 | """ |
| 1467 | cert = X509() |
| 1468 | self.assertRaises(TypeError, cert.gmtime_adj_notAfter) |
| 1469 | self.assertRaises(TypeError, cert.gmtime_adj_notAfter, None) |
| 1470 | self.assertRaises(TypeError, cert.gmtime_adj_notAfter, 123, None) |
| 1471 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1472 | def test_gmtime_adj_notAfter(self): |
| 1473 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1474 | :py:obj:`X509Type.gmtime_adj_notAfter` changes the not-after timestamp |
| 1475 | to be the current time plus the number of seconds passed in. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1476 | """ |
| 1477 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
Maximilian Hils | bed25c9 | 2015-07-25 12:58:07 +0200 | [diff] [blame] | 1478 | not_after_min = datetime.utcnow().replace(microsecond=0) + timedelta(seconds=100) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1479 | cert.gmtime_adj_notAfter(100) |
Maximilian Hils | bed25c9 | 2015-07-25 12:58:07 +0200 | [diff] [blame] | 1480 | not_after = datetime.strptime(cert.get_notAfter().decode(), "%Y%m%d%H%M%SZ") |
| 1481 | not_after_max = datetime.utcnow() + timedelta(seconds=100) |
| 1482 | self.assertTrue(not_after_min <= not_after <= not_after_max) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1483 | |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1484 | def test_has_expired_wrong_args(self): |
| 1485 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1486 | :py:obj:`X509Type.has_expired` raises :py:obj:`TypeError` if called |
| 1487 | with any arguments. |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1488 | """ |
| 1489 | cert = X509() |
| 1490 | self.assertRaises(TypeError, cert.has_expired, None) |
| 1491 | |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1492 | def test_has_expired(self): |
| 1493 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1494 | :py:obj:`X509Type.has_expired` returns :py:obj:`True` if the |
| 1495 | certificate's not-after time is in the past. |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1496 | """ |
| 1497 | cert = X509() |
| 1498 | cert.gmtime_adj_notAfter(-1) |
| 1499 | self.assertTrue(cert.has_expired()) |
| 1500 | |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1501 | def test_has_not_expired(self): |
| 1502 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1503 | :py:obj:`X509Type.has_expired` returns :py:obj:`False` if the |
| 1504 | certificate's not-after time is in the future. |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1505 | """ |
| 1506 | cert = X509() |
| 1507 | cert.gmtime_adj_notAfter(2) |
| 1508 | self.assertFalse(cert.has_expired()) |
| 1509 | |
Jeff Tang | fc18f7b | 2015-04-15 17:42:33 -0400 | [diff] [blame] | 1510 | def test_root_has_not_expired(self): |
| 1511 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1512 | :py:obj:`X509Type.has_expired` returns :py:obj:`False` if the |
| 1513 | certificate's not-after time is in the future. |
Jeff Tang | fc18f7b | 2015-04-15 17:42:33 -0400 | [diff] [blame] | 1514 | """ |
| 1515 | cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
| 1516 | self.assertFalse(cert.has_expired()) |
| 1517 | |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1518 | def test_digest(self): |
| 1519 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1520 | :py:obj:`X509.digest` returns a string giving ":"-separated hex-encoded |
| 1521 | words of the digest of the certificate. |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1522 | """ |
Jeff Tang | fc18f7b | 2015-04-15 17:42:33 -0400 | [diff] [blame] | 1523 | cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1524 | self.assertEqual( |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1525 | # This is MD5 instead of GOOD_DIGEST because the digest algorithm |
| 1526 | # actually matters to the assertion (ie, another arbitrary, good |
| 1527 | # digest will not product the same digest). |
Jeff Tang | fc18f7b | 2015-04-15 17:42:33 -0400 | [diff] [blame] | 1528 | # Digest verified with the command: |
| 1529 | # openssl x509 -in root_cert.pem -noout -fingerprint -md5 |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1530 | cert.digest("MD5"), |
Jeff Tang | fc18f7b | 2015-04-15 17:42:33 -0400 | [diff] [blame] | 1531 | b("19:B3:05:26:2B:F8:F2:FF:0B:8F:21:07:A8:28:B8:75")) |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1532 | |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1533 | def _extcert(self, pkey, extensions): |
| 1534 | cert = X509() |
| 1535 | cert.set_pubkey(pkey) |
| 1536 | cert.get_subject().commonName = "Unit Tests" |
| 1537 | cert.get_issuer().commonName = "Unit Tests" |
| 1538 | when = b(datetime.now().strftime("%Y%m%d%H%M%SZ")) |
| 1539 | cert.set_notBefore(when) |
| 1540 | cert.set_notAfter(when) |
| 1541 | |
| 1542 | cert.add_extensions(extensions) |
Jeff Tang | fc18f7b | 2015-04-15 17:42:33 -0400 | [diff] [blame] | 1543 | cert.sign(pkey, 'sha1') |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1544 | return load_certificate( |
| 1545 | FILETYPE_PEM, dump_certificate(FILETYPE_PEM, cert)) |
| 1546 | |
Roland Hedberg | 7e4930e | 2008-04-22 22:58:50 +0200 | [diff] [blame] | 1547 | def test_extension_count(self): |
| 1548 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1549 | :py:obj:`X509.get_extension_count` returns the number of extensions |
| 1550 | that are present in the certificate. |
Roland Hedberg | 7e4930e | 2008-04-22 22:58:50 +0200 | [diff] [blame] | 1551 | """ |
Jean-Paul Calderone | f7b3ee6 | 2011-04-01 17:36:24 -0400 | [diff] [blame] | 1552 | pkey = load_privatekey(FILETYPE_PEM, client_key_pem) |
Jean-Paul Calderone | 90abbc0 | 2011-04-06 18:20:22 -0400 | [diff] [blame] | 1553 | ca = X509Extension(b('basicConstraints'), True, b('CA:FALSE')) |
| 1554 | key = X509Extension(b('keyUsage'), True, b('digitalSignature')) |
Jean-Paul Calderone | f7b3ee6 | 2011-04-01 17:36:24 -0400 | [diff] [blame] | 1555 | subjectAltName = X509Extension( |
Jean-Paul Calderone | 90abbc0 | 2011-04-06 18:20:22 -0400 | [diff] [blame] | 1556 | b('subjectAltName'), True, b('DNS:example.com')) |
Jean-Paul Calderone | f7b3ee6 | 2011-04-01 17:36:24 -0400 | [diff] [blame] | 1557 | |
| 1558 | # Try a certificate with no extensions at all. |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1559 | c = self._extcert(pkey, []) |
Jean-Paul Calderone | f7b3ee6 | 2011-04-01 17:36:24 -0400 | [diff] [blame] | 1560 | self.assertEqual(c.get_extension_count(), 0) |
| 1561 | |
| 1562 | # And a certificate with one |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1563 | c = self._extcert(pkey, [ca]) |
Jean-Paul Calderone | f7b3ee6 | 2011-04-01 17:36:24 -0400 | [diff] [blame] | 1564 | self.assertEqual(c.get_extension_count(), 1) |
| 1565 | |
| 1566 | # And a certificate with several |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1567 | c = self._extcert(pkey, [ca, key, subjectAltName]) |
Jean-Paul Calderone | f7b3ee6 | 2011-04-01 17:36:24 -0400 | [diff] [blame] | 1568 | self.assertEqual(c.get_extension_count(), 3) |
Roland Hedberg | 7e4930e | 2008-04-22 22:58:50 +0200 | [diff] [blame] | 1569 | |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1570 | def test_get_extension(self): |
| 1571 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1572 | :py:obj:`X509.get_extension` takes an integer and returns an |
| 1573 | :py:obj:`X509Extension` corresponding to the extension at that index. |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1574 | """ |
| 1575 | pkey = load_privatekey(FILETYPE_PEM, client_key_pem) |
Jean-Paul Calderone | 90abbc0 | 2011-04-06 18:20:22 -0400 | [diff] [blame] | 1576 | ca = X509Extension(b('basicConstraints'), True, b('CA:FALSE')) |
| 1577 | key = X509Extension(b('keyUsage'), True, b('digitalSignature')) |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1578 | subjectAltName = X509Extension( |
Jean-Paul Calderone | 90abbc0 | 2011-04-06 18:20:22 -0400 | [diff] [blame] | 1579 | b('subjectAltName'), False, b('DNS:example.com')) |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1580 | |
| 1581 | cert = self._extcert(pkey, [ca, key, subjectAltName]) |
| 1582 | |
| 1583 | ext = cert.get_extension(0) |
| 1584 | self.assertTrue(isinstance(ext, X509Extension)) |
| 1585 | self.assertTrue(ext.get_critical()) |
Jean-Paul Calderone | 90abbc0 | 2011-04-06 18:20:22 -0400 | [diff] [blame] | 1586 | self.assertEqual(ext.get_short_name(), b('basicConstraints')) |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1587 | |
| 1588 | ext = cert.get_extension(1) |
| 1589 | self.assertTrue(isinstance(ext, X509Extension)) |
| 1590 | self.assertTrue(ext.get_critical()) |
Jean-Paul Calderone | 90abbc0 | 2011-04-06 18:20:22 -0400 | [diff] [blame] | 1591 | self.assertEqual(ext.get_short_name(), b('keyUsage')) |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1592 | |
| 1593 | ext = cert.get_extension(2) |
| 1594 | self.assertTrue(isinstance(ext, X509Extension)) |
| 1595 | self.assertFalse(ext.get_critical()) |
Jean-Paul Calderone | 90abbc0 | 2011-04-06 18:20:22 -0400 | [diff] [blame] | 1596 | self.assertEqual(ext.get_short_name(), b('subjectAltName')) |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1597 | |
| 1598 | self.assertRaises(IndexError, cert.get_extension, -1) |
| 1599 | self.assertRaises(IndexError, cert.get_extension, 4) |
| 1600 | self.assertRaises(TypeError, cert.get_extension, "hello") |
| 1601 | |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1602 | def test_nullbyte_subjectAltName(self): |
Jean-Paul Calderone | ff83cdd | 2013-08-12 18:05:51 -0400 | [diff] [blame] | 1603 | """ |
Jean-Paul Calderone | 9af07b0 | 2013-08-23 16:07:31 -0400 | [diff] [blame] | 1604 | The fields of a `subjectAltName` extension on an X509 may contain NUL |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1605 | bytes and this value is reflected in the string representation of the |
| 1606 | extension object. |
Jean-Paul Calderone | ff83cdd | 2013-08-12 18:05:51 -0400 | [diff] [blame] | 1607 | """ |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1608 | cert = load_certificate(FILETYPE_PEM, nulbyteSubjectAltNamePEM) |
Jean-Paul Calderone | ff83cdd | 2013-08-12 18:05:51 -0400 | [diff] [blame] | 1609 | |
| 1610 | ext = cert.get_extension(3) |
| 1611 | self.assertEqual(ext.get_short_name(), b('subjectAltName')) |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1612 | self.assertEqual( |
| 1613 | b("DNS:altnull.python.org\x00example.com, " |
| 1614 | "email:null@python.org\x00user@example.org, " |
| 1615 | "URI:http://null.python.org\x00http://example.org, " |
| 1616 | "IP Address:192.0.2.1, IP Address:2001:DB8:0:0:0:0:0:1\n"), |
| 1617 | b(str(ext))) |
| 1618 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1619 | def test_invalid_digest_algorithm(self): |
| 1620 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1621 | :py:obj:`X509.digest` raises :py:obj:`ValueError` if called with an |
| 1622 | unrecognized hash algorithm. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1623 | """ |
| 1624 | cert = X509() |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1625 | self.assertRaises(ValueError, cert.digest, BAD_DIGEST) |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1626 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1627 | def test_get_subject_wrong_args(self): |
| 1628 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1629 | :py:obj:`X509.get_subject` raises :py:obj:`TypeError` if called with |
| 1630 | any arguments. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1631 | """ |
| 1632 | cert = X509() |
| 1633 | self.assertRaises(TypeError, cert.get_subject, None) |
| 1634 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1635 | def test_get_subject(self): |
| 1636 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1637 | :py:obj:`X509.get_subject` returns an :py:obj:`X509Name` instance. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1638 | """ |
| 1639 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
| 1640 | subj = cert.get_subject() |
| 1641 | self.assertTrue(isinstance(subj, X509Name)) |
| 1642 | self.assertEquals( |
| 1643 | subj.get_components(), |
Jean-Paul Calderone | dc3275f | 2010-08-22 17:04:09 -0400 | [diff] [blame] | 1644 | [(b('C'), b('US')), (b('ST'), b('IL')), (b('L'), b('Chicago')), |
| 1645 | (b('O'), b('Testing')), (b('CN'), b('Testing Root CA'))]) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1646 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1647 | def test_set_subject_wrong_args(self): |
| 1648 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1649 | :py:obj:`X509.set_subject` raises a :py:obj:`TypeError` if called with |
| 1650 | the wrong number of arguments or an argument not of type |
| 1651 | :py:obj:`X509Name`. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1652 | """ |
| 1653 | cert = X509() |
| 1654 | self.assertRaises(TypeError, cert.set_subject) |
| 1655 | self.assertRaises(TypeError, cert.set_subject, None) |
| 1656 | self.assertRaises(TypeError, cert.set_subject, cert.get_subject(), None) |
| 1657 | |
| 1658 | |
| 1659 | def test_set_subject(self): |
| 1660 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1661 | :py:obj:`X509.set_subject` changes the subject of the certificate to |
| 1662 | the one passed in. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1663 | """ |
| 1664 | cert = X509() |
| 1665 | name = cert.get_subject() |
| 1666 | name.C = 'AU' |
| 1667 | name.O = 'Unit Tests' |
| 1668 | cert.set_subject(name) |
| 1669 | self.assertEquals( |
| 1670 | cert.get_subject().get_components(), |
Jean-Paul Calderone | dc3275f | 2010-08-22 17:04:09 -0400 | [diff] [blame] | 1671 | [(b('C'), b('AU')), (b('O'), b('Unit Tests'))]) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1672 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1673 | def test_get_issuer_wrong_args(self): |
| 1674 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1675 | :py:obj:`X509.get_issuer` raises :py:obj:`TypeError` if called with any |
| 1676 | arguments. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1677 | """ |
| 1678 | cert = X509() |
| 1679 | self.assertRaises(TypeError, cert.get_issuer, None) |
| 1680 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1681 | def test_get_issuer(self): |
| 1682 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1683 | :py:obj:`X509.get_issuer` returns an :py:obj:`X509Name` instance. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1684 | """ |
| 1685 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
| 1686 | subj = cert.get_issuer() |
| 1687 | self.assertTrue(isinstance(subj, X509Name)) |
Jean-Paul Calderone | 30a4cb3 | 2010-08-11 23:54:12 -0400 | [diff] [blame] | 1688 | comp = subj.get_components() |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1689 | self.assertEquals( |
Jean-Paul Calderone | 30a4cb3 | 2010-08-11 23:54:12 -0400 | [diff] [blame] | 1690 | comp, |
Jean-Paul Calderone | dc3275f | 2010-08-22 17:04:09 -0400 | [diff] [blame] | 1691 | [(b('C'), b('US')), (b('ST'), b('IL')), (b('L'), b('Chicago')), |
| 1692 | (b('O'), b('Testing')), (b('CN'), b('Testing Root CA'))]) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1693 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1694 | def test_set_issuer_wrong_args(self): |
| 1695 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1696 | :py:obj:`X509.set_issuer` raises a :py:obj:`TypeError` if called with |
| 1697 | the wrong number of arguments or an argument not of type |
| 1698 | :py:obj:`X509Name`. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1699 | """ |
| 1700 | cert = X509() |
| 1701 | self.assertRaises(TypeError, cert.set_issuer) |
| 1702 | self.assertRaises(TypeError, cert.set_issuer, None) |
| 1703 | self.assertRaises(TypeError, cert.set_issuer, cert.get_issuer(), None) |
| 1704 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1705 | def test_set_issuer(self): |
| 1706 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1707 | :py:obj:`X509.set_issuer` changes the issuer of the certificate to the |
| 1708 | one passed in. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1709 | """ |
| 1710 | cert = X509() |
| 1711 | name = cert.get_issuer() |
| 1712 | name.C = 'AU' |
| 1713 | name.O = 'Unit Tests' |
| 1714 | cert.set_issuer(name) |
| 1715 | self.assertEquals( |
| 1716 | cert.get_issuer().get_components(), |
Jean-Paul Calderone | dc3275f | 2010-08-22 17:04:09 -0400 | [diff] [blame] | 1717 | [(b('C'), b('AU')), (b('O'), b('Unit Tests'))]) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1718 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1719 | def test_get_pubkey_uninitialized(self): |
| 1720 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1721 | When called on a certificate with no public key, |
| 1722 | :py:obj:`X509.get_pubkey` raises :py:obj:`OpenSSL.crypto.Error`. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1723 | """ |
| 1724 | cert = X509() |
| 1725 | self.assertRaises(Error, cert.get_pubkey) |
| 1726 | |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1727 | def test_subject_name_hash_wrong_args(self): |
| 1728 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1729 | :py:obj:`X509.subject_name_hash` raises :py:obj:`TypeError` if called |
| 1730 | with any arguments. |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1731 | """ |
| 1732 | cert = X509() |
| 1733 | self.assertRaises(TypeError, cert.subject_name_hash, None) |
| 1734 | |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1735 | def test_subject_name_hash(self): |
| 1736 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1737 | :py:obj:`X509.subject_name_hash` returns the hash of the certificate's |
| 1738 | subject name. |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1739 | """ |
| 1740 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
Jean-Paul Calderone | 060a57e | 2011-05-04 18:02:49 -0400 | [diff] [blame] | 1741 | self.assertIn( |
Jean-Paul Calderone | 2755fa5 | 2011-05-18 19:42:10 -0400 | [diff] [blame] | 1742 | cert.subject_name_hash(), |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 1743 | [3350047874, # OpenSSL 0.9.8, MD5 |
| 1744 | 3278919224, # OpenSSL 1.0.0, SHA1 |
Jean-Paul Calderone | 060a57e | 2011-05-04 18:02:49 -0400 | [diff] [blame] | 1745 | ]) |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1746 | |
Jean-Paul Calderone | 2755fa5 | 2011-05-18 19:42:10 -0400 | [diff] [blame] | 1747 | def test_get_signature_algorithm(self): |
| 1748 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1749 | :py:obj:`X509Type.get_signature_algorithm` returns a string which means |
Jean-Paul Calderone | 2755fa5 | 2011-05-18 19:42:10 -0400 | [diff] [blame] | 1750 | the algorithm used to sign the certificate. |
| 1751 | """ |
| 1752 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
Jean-Paul Calderone | 5d8e405 | 2011-05-19 17:51:43 -0400 | [diff] [blame] | 1753 | self.assertEqual( |
| 1754 | b("sha1WithRSAEncryption"), cert.get_signature_algorithm()) |
Jean-Paul Calderone | 2755fa5 | 2011-05-18 19:42:10 -0400 | [diff] [blame] | 1755 | |
Jean-Paul Calderone | 2755fa5 | 2011-05-18 19:42:10 -0400 | [diff] [blame] | 1756 | def test_get_undefined_signature_algorithm(self): |
Jean-Paul Calderone | 5d8e405 | 2011-05-19 17:51:43 -0400 | [diff] [blame] | 1757 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1758 | :py:obj:`X509Type.get_signature_algorithm` raises :py:obj:`ValueError` |
| 1759 | if the signature algorithm is undefined or unknown. |
Jean-Paul Calderone | 5d8e405 | 2011-05-19 17:51:43 -0400 | [diff] [blame] | 1760 | """ |
| 1761 | # This certificate has been modified to indicate a bogus OID in the |
| 1762 | # signature algorithm field so that OpenSSL does not recognize it. |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1763 | certPEM = b("""\ |
Jean-Paul Calderone | 2755fa5 | 2011-05-18 19:42:10 -0400 | [diff] [blame] | 1764 | -----BEGIN CERTIFICATE----- |
| 1765 | MIIC/zCCAmigAwIBAgIBATAGBgJ8BQUAMHsxCzAJBgNVBAYTAlNHMREwDwYDVQQK |
| 1766 | EwhNMkNyeXB0bzEUMBIGA1UECxMLTTJDcnlwdG8gQ0ExJDAiBgNVBAMTG00yQ3J5 |
| 1767 | cHRvIENlcnRpZmljYXRlIE1hc3RlcjEdMBsGCSqGSIb3DQEJARYObmdwc0Bwb3N0 |
| 1768 | MS5jb20wHhcNMDAwOTEwMDk1MTMwWhcNMDIwOTEwMDk1MTMwWjBTMQswCQYDVQQG |
| 1769 | EwJTRzERMA8GA1UEChMITTJDcnlwdG8xEjAQBgNVBAMTCWxvY2FsaG9zdDEdMBsG |
| 1770 | CSqGSIb3DQEJARYObmdwc0Bwb3N0MS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBI |
| 1771 | AkEArL57d26W9fNXvOhNlZzlPOACmvwOZ5AdNgLzJ1/MfsQQJ7hHVeHmTAjM664V |
| 1772 | +fXvwUGJLziCeBo1ysWLRnl8CQIDAQABo4IBBDCCAQAwCQYDVR0TBAIwADAsBglg |
| 1773 | hkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0O |
| 1774 | BBYEFM+EgpK+eyZiwFU1aOPSbczbPSpVMIGlBgNVHSMEgZ0wgZqAFPuHI2nrnDqT |
| 1775 | FeXFvylRT/7tKDgBoX+kfTB7MQswCQYDVQQGEwJTRzERMA8GA1UEChMITTJDcnlw |
| 1776 | dG8xFDASBgNVBAsTC00yQ3J5cHRvIENBMSQwIgYDVQQDExtNMkNyeXB0byBDZXJ0 |
| 1777 | aWZpY2F0ZSBNYXN0ZXIxHTAbBgkqhkiG9w0BCQEWDm5ncHNAcG9zdDEuY29tggEA |
| 1778 | MA0GCSqGSIb3DQEBBAUAA4GBADv8KpPo+gfJxN2ERK1Y1l17sz/ZhzoGgm5XCdbx |
| 1779 | jEY7xKfpQngV599k1xhl11IMqizDwu0855agrckg2MCTmOI9DZzDD77tAYb+Dk0O |
| 1780 | PEVk0Mk/V0aIsDE9bolfCi/i/QWZ3N8s5nTWMNyBBBmoSliWCm4jkkRZRD0ejgTN |
| 1781 | tgI5 |
| 1782 | -----END CERTIFICATE----- |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1783 | """) |
Jean-Paul Calderone | 2755fa5 | 2011-05-18 19:42:10 -0400 | [diff] [blame] | 1784 | cert = load_certificate(FILETYPE_PEM, certPEM) |
| 1785 | self.assertRaises(ValueError, cert.get_signature_algorithm) |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1786 | |
| 1787 | |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 1788 | class X509StoreTests(TestCase): |
| 1789 | """ |
| 1790 | Test for :py:obj:`OpenSSL.crypto.X509Store`. |
| 1791 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 1792 | |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 1793 | def test_type(self): |
| 1794 | """ |
| 1795 | :py:obj:`X509StoreType` is a type object. |
| 1796 | """ |
| 1797 | self.assertIdentical(X509Store, X509StoreType) |
| 1798 | self.assertConsistentType(X509Store, 'X509Store') |
| 1799 | |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 1800 | def test_add_cert_wrong_args(self): |
| 1801 | store = X509Store() |
| 1802 | self.assertRaises(TypeError, store.add_cert) |
| 1803 | self.assertRaises(TypeError, store.add_cert, object()) |
| 1804 | self.assertRaises(TypeError, store.add_cert, X509(), object()) |
| 1805 | |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 1806 | def test_add_cert(self): |
Jean-Paul Calderone | e6f32b8 | 2013-03-06 10:27:57 -0800 | [diff] [blame] | 1807 | """ |
| 1808 | :py:obj:`X509Store.add_cert` adds a :py:obj:`X509` instance to the |
| 1809 | certificate store. |
| 1810 | """ |
| 1811 | cert = load_certificate(FILETYPE_PEM, cleartextCertificatePEM) |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 1812 | store = X509Store() |
Jean-Paul Calderone | e6f32b8 | 2013-03-06 10:27:57 -0800 | [diff] [blame] | 1813 | store.add_cert(cert) |
| 1814 | |
Jean-Paul Calderone | e6f32b8 | 2013-03-06 10:27:57 -0800 | [diff] [blame] | 1815 | def test_add_cert_rejects_duplicate(self): |
| 1816 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1817 | :py:obj:`X509Store.add_cert` raises :py:obj:`OpenSSL.crypto.Error` if |
| 1818 | an attempt is made to add the same certificate to the store more than |
| 1819 | once. |
Jean-Paul Calderone | e6f32b8 | 2013-03-06 10:27:57 -0800 | [diff] [blame] | 1820 | """ |
| 1821 | cert = load_certificate(FILETYPE_PEM, cleartextCertificatePEM) |
| 1822 | store = X509Store() |
| 1823 | store.add_cert(cert) |
| 1824 | self.assertRaises(Error, store.add_cert, cert) |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 1825 | |
| 1826 | |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1827 | class PKCS12Tests(TestCase): |
| 1828 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1829 | Test for :py:obj:`OpenSSL.crypto.PKCS12` and |
| 1830 | :py:obj:`OpenSSL.crypto.load_pkcs12`. |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1831 | """ |
| 1832 | pemData = cleartextCertificatePEM + cleartextPrivateKeyPEM |
| 1833 | |
Jean-Paul Calderone | c3a41f7 | 2009-07-25 12:36:02 -0400 | [diff] [blame] | 1834 | def test_type(self): |
| 1835 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1836 | :py:obj:`PKCS12Type` is a type object. |
Jean-Paul Calderone | c3a41f7 | 2009-07-25 12:36:02 -0400 | [diff] [blame] | 1837 | """ |
| 1838 | self.assertIdentical(PKCS12, PKCS12Type) |
| 1839 | self.assertConsistentType(PKCS12, 'PKCS12') |
| 1840 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1841 | def test_empty_construction(self): |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1842 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1843 | :py:obj:`PKCS12` returns a new instance of :py:obj:`PKCS12` with no |
| 1844 | certificate, private key, CA certificates, or friendly name. |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1845 | """ |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 1846 | p12 = PKCS12() |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1847 | self.assertEqual(None, p12.get_certificate()) |
| 1848 | self.assertEqual(None, p12.get_privatekey()) |
| 1849 | self.assertEqual(None, p12.get_ca_certificates()) |
Rick Dean | 42d69e1 | 2009-07-20 11:36:08 -0500 | [diff] [blame] | 1850 | self.assertEqual(None, p12.get_friendlyname()) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1851 | |
| 1852 | def test_type_errors(self): |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1853 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1854 | The :py:obj:`PKCS12` setter functions (:py:obj:`set_certificate`, |
| 1855 | :py:obj:`set_privatekey`, :py:obj:`set_ca_certificates`, and |
| 1856 | :py:obj:`set_friendlyname`) raise :py:obj:`TypeError` when passed |
| 1857 | objects of types other than those expected. |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1858 | """ |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 1859 | p12 = PKCS12() |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1860 | self.assertRaises(TypeError, p12.set_certificate, 3) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1861 | self.assertRaises(TypeError, p12.set_certificate, PKey()) |
| 1862 | self.assertRaises(TypeError, p12.set_certificate, X509) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1863 | self.assertRaises(TypeError, p12.set_privatekey, 3) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1864 | self.assertRaises(TypeError, p12.set_privatekey, 'legbone') |
| 1865 | self.assertRaises(TypeError, p12.set_privatekey, X509()) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1866 | self.assertRaises(TypeError, p12.set_ca_certificates, 3) |
| 1867 | self.assertRaises(TypeError, p12.set_ca_certificates, X509()) |
| 1868 | self.assertRaises(TypeError, p12.set_ca_certificates, (3, 4)) |
Alex Gaynor | 7f63649 | 2015-09-04 13:26:52 -0400 | [diff] [blame] | 1869 | self.assertRaises(TypeError, p12.set_ca_certificates, (PKey(),)) |
Rick Dean | 42d69e1 | 2009-07-20 11:36:08 -0500 | [diff] [blame] | 1870 | self.assertRaises(TypeError, p12.set_friendlyname, 6) |
| 1871 | self.assertRaises(TypeError, p12.set_friendlyname, ('foo', 'bar')) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1872 | |
| 1873 | def test_key_only(self): |
| 1874 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1875 | A :py:obj:`PKCS12` with only a private key can be exported using |
| 1876 | :py:obj:`PKCS12.export` and loaded again using :py:obj:`load_pkcs12`. |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1877 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1878 | passwd = b"blah" |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1879 | p12 = PKCS12() |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 1880 | pkey = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1881 | p12.set_privatekey(pkey) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1882 | self.assertEqual(None, p12.get_certificate()) |
| 1883 | self.assertEqual(pkey, p12.get_privatekey()) |
Rick Dean | 321a051 | 2009-08-13 17:21:29 -0500 | [diff] [blame] | 1884 | try: |
| 1885 | dumped_p12 = p12.export(passphrase=passwd, iter=2, maciter=3) |
| 1886 | except Error: |
| 1887 | # Some versions of OpenSSL will throw an exception |
| 1888 | # for this nearly useless PKCS12 we tried to generate: |
| 1889 | # [('PKCS12 routines', 'PKCS12_create', 'invalid null argument')] |
| 1890 | return |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1891 | p12 = load_pkcs12(dumped_p12, passwd) |
| 1892 | self.assertEqual(None, p12.get_ca_certificates()) |
| 1893 | self.assertEqual(None, p12.get_certificate()) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1894 | |
| 1895 | # OpenSSL fails to bring the key back to us. So sad. Perhaps in the |
| 1896 | # future this will be improved. |
| 1897 | self.assertTrue(isinstance(p12.get_privatekey(), (PKey, type(None)))) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1898 | |
| 1899 | def test_cert_only(self): |
| 1900 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1901 | A :py:obj:`PKCS12` with only a certificate can be exported using |
| 1902 | :py:obj:`PKCS12.export` and loaded again using :py:obj:`load_pkcs12`. |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1903 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1904 | passwd = b"blah" |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1905 | p12 = PKCS12() |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 1906 | cert = load_certificate(FILETYPE_PEM, cleartextCertificatePEM) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1907 | p12.set_certificate(cert) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1908 | self.assertEqual(cert, p12.get_certificate()) |
| 1909 | self.assertEqual(None, p12.get_privatekey()) |
Rick Dean | 321a051 | 2009-08-13 17:21:29 -0500 | [diff] [blame] | 1910 | try: |
| 1911 | dumped_p12 = p12.export(passphrase=passwd, iter=2, maciter=3) |
| 1912 | except Error: |
| 1913 | # Some versions of OpenSSL will throw an exception |
| 1914 | # for this nearly useless PKCS12 we tried to generate: |
| 1915 | # [('PKCS12 routines', 'PKCS12_create', 'invalid null argument')] |
| 1916 | return |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1917 | p12 = load_pkcs12(dumped_p12, passwd) |
| 1918 | self.assertEqual(None, p12.get_privatekey()) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1919 | |
| 1920 | # OpenSSL fails to bring the cert back to us. Groany mcgroan. |
| 1921 | self.assertTrue(isinstance(p12.get_certificate(), (X509, type(None)))) |
| 1922 | |
| 1923 | # Oh ho. It puts the certificate into the ca certificates list, in |
| 1924 | # fact. Totally bogus, I would think. Nevertheless, let's exploit |
| 1925 | # that to check to see if it reconstructed the certificate we expected |
| 1926 | # it to. At some point, hopefully this will change so that |
| 1927 | # p12.get_certificate() is actually what returns the loaded |
| 1928 | # certificate. |
| 1929 | self.assertEqual( |
| 1930 | cleartextCertificatePEM, |
| 1931 | dump_certificate(FILETYPE_PEM, p12.get_ca_certificates()[0])) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1932 | |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1933 | def gen_pkcs12(self, cert_pem=None, key_pem=None, ca_pem=None, |
| 1934 | friendly_name=None): |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1935 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1936 | Generate a PKCS12 object with components from PEM. Verify that the set |
| 1937 | functions return None. |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1938 | """ |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1939 | p12 = PKCS12() |
| 1940 | if cert_pem: |
| 1941 | ret = p12.set_certificate(load_certificate(FILETYPE_PEM, cert_pem)) |
| 1942 | self.assertEqual(ret, None) |
| 1943 | if key_pem: |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1944 | ret = p12.set_privatekey(load_privatekey(FILETYPE_PEM, key_pem)) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1945 | self.assertEqual(ret, None) |
| 1946 | if ca_pem: |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1947 | ret = p12.set_ca_certificates((load_certificate(FILETYPE_PEM, ca_pem),)) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1948 | self.assertEqual(ret, None) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1949 | if friendly_name: |
| 1950 | ret = p12.set_friendlyname(friendly_name) |
Rick Dean | 42d69e1 | 2009-07-20 11:36:08 -0500 | [diff] [blame] | 1951 | self.assertEqual(ret, None) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1952 | return p12 |
| 1953 | |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1954 | def check_recovery(self, p12_str, key=None, cert=None, ca=None, passwd=b"", |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1955 | extra=()): |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1956 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1957 | Use openssl program to confirm three components are recoverable from a |
| 1958 | PKCS12 string. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1959 | """ |
| 1960 | if key: |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1961 | recovered_key = _runopenssl( |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1962 | p12_str, b"pkcs12", b"-nocerts", b"-nodes", b"-passin", |
| 1963 | b"pass:" + passwd, *extra) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1964 | self.assertEqual(recovered_key[-len(key):], key) |
| 1965 | if cert: |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1966 | recovered_cert = _runopenssl( |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1967 | p12_str, b"pkcs12", b"-clcerts", b"-nodes", b"-passin", |
| 1968 | b"pass:" + passwd, b"-nokeys", *extra) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1969 | self.assertEqual(recovered_cert[-len(cert):], cert) |
| 1970 | if ca: |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1971 | recovered_cert = _runopenssl( |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1972 | p12_str, b"pkcs12", b"-cacerts", b"-nodes", b"-passin", |
| 1973 | b"pass:" + passwd, b"-nokeys", *extra) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1974 | self.assertEqual(recovered_cert[-len(ca):], ca) |
| 1975 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 1976 | def verify_pkcs12_container(self, p12): |
| 1977 | """ |
| 1978 | Verify that the PKCS#12 container contains the correct client |
| 1979 | certificate and private key. |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 1980 | |
| 1981 | :param p12: The PKCS12 instance to verify. |
| 1982 | :type p12: :py:class:`PKCS12` |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 1983 | """ |
| 1984 | cert_pem = dump_certificate(FILETYPE_PEM, p12.get_certificate()) |
| 1985 | key_pem = dump_privatekey(FILETYPE_PEM, p12.get_privatekey()) |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 1986 | self.assertEqual( |
| 1987 | (client_cert_pem, client_key_pem, None), |
| 1988 | (cert_pem, key_pem, p12.get_ca_certificates())) |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 1989 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1990 | def test_load_pkcs12(self): |
| 1991 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1992 | A PKCS12 string generated using the openssl command line can be loaded |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 1993 | with :py:obj:`load_pkcs12` and its components extracted and examined. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 1994 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1995 | passwd = b"whatever" |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 1996 | pem = client_key_pem + client_cert_pem |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 1997 | p12_str = _runopenssl( |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1998 | pem, b"pkcs12", b"-export", b"-clcerts", b"-passout", b"pass:" + passwd) |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 1999 | p12 = load_pkcs12(p12_str, passphrase=passwd) |
| 2000 | self.verify_pkcs12_container(p12) |
| 2001 | |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2002 | def test_load_pkcs12_text_passphrase(self): |
| 2003 | """ |
| 2004 | A PKCS12 string generated using the openssl command line can be loaded |
| 2005 | with :py:obj:`load_pkcs12` and its components extracted and examined. |
| 2006 | Using text as passphrase instead of bytes. DeprecationWarning expected. |
| 2007 | """ |
| 2008 | pem = client_key_pem + client_cert_pem |
| 2009 | passwd = b"whatever" |
| 2010 | p12_str = _runopenssl(pem, b"pkcs12", b"-export", b"-clcerts", |
| 2011 | b"-passout", b"pass:" + passwd) |
| 2012 | with catch_warnings(record=True) as w: |
| 2013 | simplefilter("always") |
Jean-Paul Calderone | 13a0e65 | 2015-03-29 07:58:51 -0400 | [diff] [blame] | 2014 | p12 = load_pkcs12(p12_str, passphrase=b"whatever".decode("ascii")) |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 2015 | |
| 2016 | self.assertEqual( |
Jean-Paul Calderone | 13a0e65 | 2015-03-29 07:58:51 -0400 | [diff] [blame] | 2017 | "{0} for passphrase is no longer accepted, use bytes".format( |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 2018 | WARNING_TYPE_EXPECTED |
| 2019 | ), |
| 2020 | str(w[-1].message) |
| 2021 | ) |
| 2022 | self.assertIs(w[-1].category, DeprecationWarning) |
| 2023 | |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2024 | self.verify_pkcs12_container(p12) |
| 2025 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2026 | def test_load_pkcs12_no_passphrase(self): |
| 2027 | """ |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2028 | A PKCS12 string generated using openssl command line can be loaded with |
| 2029 | :py:obj:`load_pkcs12` without a passphrase and its components extracted |
| 2030 | and examined. |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2031 | """ |
| 2032 | pem = client_key_pem + client_cert_pem |
| 2033 | p12_str = _runopenssl( |
| 2034 | pem, b"pkcs12", b"-export", b"-clcerts", b"-passout", b"pass:") |
| 2035 | p12 = load_pkcs12(p12_str) |
| 2036 | self.verify_pkcs12_container(p12) |
| 2037 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2038 | def _dump_and_load(self, dump_passphrase, load_passphrase): |
| 2039 | """ |
| 2040 | A helper method to dump and load a PKCS12 object. |
| 2041 | """ |
| 2042 | p12 = self.gen_pkcs12(client_cert_pem, client_key_pem) |
| 2043 | dumped_p12 = p12.export(passphrase=dump_passphrase, iter=2, maciter=3) |
| 2044 | return load_pkcs12(dumped_p12, passphrase=load_passphrase) |
| 2045 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2046 | def test_load_pkcs12_null_passphrase_load_empty(self): |
| 2047 | """ |
| 2048 | A PKCS12 string can be dumped with a null passphrase, loaded with an |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2049 | empty passphrase with :py:obj:`load_pkcs12`, and its components |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2050 | extracted and examined. |
| 2051 | """ |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2052 | self.verify_pkcs12_container( |
| 2053 | self._dump_and_load(dump_passphrase=None, load_passphrase=b'')) |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2054 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2055 | def test_load_pkcs12_null_passphrase_load_null(self): |
| 2056 | """ |
| 2057 | A PKCS12 string can be dumped with a null passphrase, loaded with a |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2058 | null passphrase with :py:obj:`load_pkcs12`, and its components |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2059 | extracted and examined. |
| 2060 | """ |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2061 | self.verify_pkcs12_container( |
| 2062 | self._dump_and_load(dump_passphrase=None, load_passphrase=None)) |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2063 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2064 | def test_load_pkcs12_empty_passphrase_load_empty(self): |
| 2065 | """ |
| 2066 | A PKCS12 string can be dumped with an empty passphrase, loaded with an |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2067 | empty passphrase with :py:obj:`load_pkcs12`, and its components |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2068 | extracted and examined. |
| 2069 | """ |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2070 | self.verify_pkcs12_container( |
| 2071 | self._dump_and_load(dump_passphrase=b'', load_passphrase=b'')) |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2072 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2073 | def test_load_pkcs12_empty_passphrase_load_null(self): |
| 2074 | """ |
| 2075 | A PKCS12 string can be dumped with an empty passphrase, loaded with a |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2076 | null passphrase with :py:obj:`load_pkcs12`, and its components |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2077 | extracted and examined. |
| 2078 | """ |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2079 | self.verify_pkcs12_container( |
| 2080 | self._dump_and_load(dump_passphrase=b'', load_passphrase=None)) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2081 | |
Rick Dean | ee56830 | 2009-07-24 09:56:29 -0500 | [diff] [blame] | 2082 | def test_load_pkcs12_garbage(self): |
| 2083 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2084 | :py:obj:`load_pkcs12` raises :py:obj:`OpenSSL.crypto.Error` when passed a string |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2085 | which is not a PKCS12 dump. |
Rick Dean | ee56830 | 2009-07-24 09:56:29 -0500 | [diff] [blame] | 2086 | """ |
| 2087 | passwd = 'whatever' |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2088 | e = self.assertRaises(Error, load_pkcs12, b'fruit loops', passwd) |
Alex Gaynor | 7f63649 | 2015-09-04 13:26:52 -0400 | [diff] [blame] | 2089 | self.assertEqual(e.args[0][0][0], 'asn1 encoding routines') |
| 2090 | self.assertEqual(len(e.args[0][0]), 3) |
Rick Dean | ee56830 | 2009-07-24 09:56:29 -0500 | [diff] [blame] | 2091 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2092 | def test_replace(self): |
| 2093 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 2094 | :py:obj:`PKCS12.set_certificate` replaces the certificate in a PKCS12 |
| 2095 | cluster. :py:obj:`PKCS12.set_privatekey` replaces the private key. |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2096 | :py:obj:`PKCS12.set_ca_certificates` replaces the CA certificates. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2097 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2098 | p12 = self.gen_pkcs12(client_cert_pem, client_key_pem, root_cert_pem) |
| 2099 | p12.set_certificate(load_certificate(FILETYPE_PEM, server_cert_pem)) |
| 2100 | p12.set_privatekey(load_privatekey(FILETYPE_PEM, server_key_pem)) |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 2101 | root_cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2102 | client_cert = load_certificate(FILETYPE_PEM, client_cert_pem) |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2103 | p12.set_ca_certificates([root_cert]) # not a tuple |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2104 | self.assertEqual(1, len(p12.get_ca_certificates())) |
| 2105 | self.assertEqual(root_cert, p12.get_ca_certificates()[0]) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2106 | p12.set_ca_certificates([client_cert, root_cert]) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2107 | self.assertEqual(2, len(p12.get_ca_certificates())) |
| 2108 | self.assertEqual(client_cert, p12.get_ca_certificates()[0]) |
| 2109 | self.assertEqual(root_cert, p12.get_ca_certificates()[1]) |
| 2110 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2111 | def test_friendly_name(self): |
| 2112 | """ |
Jean-Paul Calderone | 64efa2c | 2011-09-11 10:00:09 -0400 | [diff] [blame] | 2113 | The *friendlyName* of a PKCS12 can be set and retrieved via |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 2114 | :py:obj:`PKCS12.get_friendlyname` and :py:obj:`PKCS12_set_friendlyname`, |
| 2115 | and a :py:obj:`PKCS12` with a friendly name set can be dumped with |
| 2116 | :py:obj:`PKCS12.export`. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2117 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2118 | passwd = b'Dogmeat[]{}!@#$%^&*()~`?/.,<>-_+=";:' |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2119 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem, root_cert_pem) |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 2120 | for friendly_name in [b('Serverlicious'), None, b('###')]: |
Rick Dean | 42d69e1 | 2009-07-20 11:36:08 -0500 | [diff] [blame] | 2121 | p12.set_friendlyname(friendly_name) |
| 2122 | self.assertEqual(p12.get_friendlyname(), friendly_name) |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 2123 | dumped_p12 = p12.export(passphrase=passwd, iter=2, maciter=3) |
Rick Dean | 42d69e1 | 2009-07-20 11:36:08 -0500 | [diff] [blame] | 2124 | reloaded_p12 = load_pkcs12(dumped_p12, passwd) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2125 | self.assertEqual( |
Jean-Paul Calderone | 9da338d | 2011-05-04 11:40:54 -0400 | [diff] [blame] | 2126 | p12.get_friendlyname(), reloaded_p12.get_friendlyname()) |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 2127 | # We would use the openssl program to confirm the friendly |
| 2128 | # name, but it is not possible. The pkcs12 command |
| 2129 | # does not store the friendly name in the cert's |
Rick Dean | 42d69e1 | 2009-07-20 11:36:08 -0500 | [diff] [blame] | 2130 | # alias, which we could then extract. |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2131 | self.check_recovery( |
| 2132 | dumped_p12, key=server_key_pem, cert=server_cert_pem, |
| 2133 | ca=root_cert_pem, passwd=passwd) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2134 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2135 | def test_various_empty_passphrases(self): |
| 2136 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2137 | Test that missing, None, and '' passphrases are identical for PKCS12 |
| 2138 | export. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2139 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2140 | p12 = self.gen_pkcs12(client_cert_pem, client_key_pem, root_cert_pem) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2141 | passwd = b"" |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2142 | dumped_p12_empty = p12.export(iter=2, maciter=0, passphrase=passwd) |
| 2143 | dumped_p12_none = p12.export(iter=3, maciter=2, passphrase=None) |
| 2144 | dumped_p12_nopw = p12.export(iter=9, maciter=4) |
| 2145 | for dumped_p12 in [dumped_p12_empty, dumped_p12_none, dumped_p12_nopw]: |
| 2146 | self.check_recovery( |
| 2147 | dumped_p12, key=client_key_pem, cert=client_cert_pem, |
| 2148 | ca=root_cert_pem, passwd=passwd) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2149 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2150 | def test_removing_ca_cert(self): |
| 2151 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 2152 | Passing :py:obj:`None` to :py:obj:`PKCS12.set_ca_certificates` removes |
| 2153 | all CA certificates. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2154 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2155 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem, root_cert_pem) |
| 2156 | p12.set_ca_certificates(None) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2157 | self.assertEqual(None, p12.get_ca_certificates()) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2158 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2159 | def test_export_without_mac(self): |
| 2160 | """ |
Jean-Paul Calderone | 64efa2c | 2011-09-11 10:00:09 -0400 | [diff] [blame] | 2161 | Exporting a PKCS12 with a :py:obj:`maciter` of ``-1`` excludes the MAC |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2162 | entirely. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2163 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2164 | passwd = b"Lake Michigan" |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2165 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem, root_cert_pem) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2166 | dumped_p12 = p12.export(maciter=-1, passphrase=passwd, iter=2) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2167 | self.check_recovery( |
| 2168 | dumped_p12, key=server_key_pem, cert=server_cert_pem, |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2169 | passwd=passwd, extra=(b"-nomacver",)) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2170 | |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2171 | def test_load_without_mac(self): |
| 2172 | """ |
| 2173 | Loading a PKCS12 without a MAC does something other than crash. |
| 2174 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2175 | passwd = b"Lake Michigan" |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2176 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem, root_cert_pem) |
| 2177 | dumped_p12 = p12.export(maciter=-1, passphrase=passwd, iter=2) |
Rick Dean | 321a051 | 2009-08-13 17:21:29 -0500 | [diff] [blame] | 2178 | try: |
| 2179 | recovered_p12 = load_pkcs12(dumped_p12, passwd) |
| 2180 | # The person who generated this PCKS12 should be flogged, |
| 2181 | # or better yet we should have a means to determine |
| 2182 | # whether a PCKS12 had a MAC that was verified. |
| 2183 | # Anyway, libopenssl chooses to allow it, so the |
| 2184 | # pyopenssl binding does as well. |
| 2185 | self.assertTrue(isinstance(recovered_p12, PKCS12)) |
| 2186 | except Error: |
| 2187 | # Failing here with an exception is preferred as some openssl |
| 2188 | # versions do. |
| 2189 | pass |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2190 | |
Rick Dean | 25bcc1f | 2009-07-20 11:53:13 -0500 | [diff] [blame] | 2191 | def test_zero_len_list_for_ca(self): |
| 2192 | """ |
Jean-Paul Calderone | da1ffa7 | 2009-07-25 21:24:34 -0400 | [diff] [blame] | 2193 | A PKCS12 with an empty CA certificates list can be exported. |
Rick Dean | 25bcc1f | 2009-07-20 11:53:13 -0500 | [diff] [blame] | 2194 | """ |
| 2195 | passwd = 'Hobie 18' |
Jean-Paul Calderone | da1ffa7 | 2009-07-25 21:24:34 -0400 | [diff] [blame] | 2196 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem) |
Jean-Paul Calderone | f6745b3 | 2013-03-01 15:08:46 -0800 | [diff] [blame] | 2197 | # p12.set_ca_certificates([]) |
| 2198 | # self.assertEqual((), p12.get_ca_certificates()) |
| 2199 | # dumped_p12 = p12.export(passphrase=passwd, iter=3) |
| 2200 | # self.check_recovery( |
| 2201 | # dumped_p12, key=server_key_pem, cert=server_cert_pem, |
| 2202 | # passwd=passwd) |
Rick Dean | 25bcc1f | 2009-07-20 11:53:13 -0500 | [diff] [blame] | 2203 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2204 | def test_export_without_args(self): |
Jean-Paul Calderone | 38a646d | 2008-03-25 15:16:18 -0400 | [diff] [blame] | 2205 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2206 | All the arguments to :py:obj:`PKCS12.export` are optional. |
Jean-Paul Calderone | 38a646d | 2008-03-25 15:16:18 -0400 | [diff] [blame] | 2207 | """ |
Jean-Paul Calderone | da1ffa7 | 2009-07-25 21:24:34 -0400 | [diff] [blame] | 2208 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem, root_cert_pem) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2209 | dumped_p12 = p12.export() # no args |
Jean-Paul Calderone | da1ffa7 | 2009-07-25 21:24:34 -0400 | [diff] [blame] | 2210 | self.check_recovery( |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2211 | dumped_p12, key=server_key_pem, cert=server_cert_pem, passwd=b"") |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2212 | |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2213 | def test_export_without_bytes(self): |
| 2214 | """ |
| 2215 | Test :py:obj:`PKCS12.export` with text not bytes as passphrase |
| 2216 | """ |
| 2217 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem, root_cert_pem) |
| 2218 | |
| 2219 | with catch_warnings(record=True) as w: |
| 2220 | simplefilter("always") |
Jean-Paul Calderone | 13a0e65 | 2015-03-29 07:58:51 -0400 | [diff] [blame] | 2221 | dumped_p12 = p12.export(passphrase=b"randomtext".decode("ascii")) |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 2222 | self.assertEqual( |
Jean-Paul Calderone | 13a0e65 | 2015-03-29 07:58:51 -0400 | [diff] [blame] | 2223 | "{0} for passphrase is no longer accepted, use bytes".format( |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 2224 | WARNING_TYPE_EXPECTED |
| 2225 | ), |
| 2226 | str(w[-1].message) |
| 2227 | ) |
| 2228 | self.assertIs(w[-1].category, DeprecationWarning) |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2229 | self.check_recovery( |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2230 | dumped_p12, |
| 2231 | key=server_key_pem, |
| 2232 | cert=server_cert_pem, |
| 2233 | passwd=b"randomtext" |
| 2234 | ) |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2235 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2236 | def test_key_cert_mismatch(self): |
| 2237 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2238 | :py:obj:`PKCS12.export` raises an exception when a key and certificate |
Jean-Paul Calderone | da1ffa7 | 2009-07-25 21:24:34 -0400 | [diff] [blame] | 2239 | mismatch. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2240 | """ |
Jean-Paul Calderone | da1ffa7 | 2009-07-25 21:24:34 -0400 | [diff] [blame] | 2241 | p12 = self.gen_pkcs12(server_cert_pem, client_key_pem, root_cert_pem) |
| 2242 | self.assertRaises(Error, p12.export) |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2243 | |
| 2244 | |
Jean-Paul Calderone | 7b874db | 2009-08-27 12:32:47 -0400 | [diff] [blame] | 2245 | # These quoting functions taken directly from Twisted's twisted.python.win32. |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2246 | _cmdLineQuoteRe = re.compile(br'(\\*)"') |
| 2247 | _cmdLineQuoteRe2 = re.compile(br'(\\+)\Z') |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2248 | |
| 2249 | |
Jean-Paul Calderone | 7b874db | 2009-08-27 12:32:47 -0400 | [diff] [blame] | 2250 | def cmdLineQuote(s): |
| 2251 | """ |
| 2252 | Internal method for quoting a single command-line argument. |
| 2253 | |
Jean-Paul Calderone | 64efa2c | 2011-09-11 10:00:09 -0400 | [diff] [blame] | 2254 | See http://www.perlmonks.org/?node_id=764004 |
| 2255 | |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2256 | :type: :py:obj:`str` |
Jonathan Ballet | 78b92a2 | 2011-07-16 08:07:26 +0900 | [diff] [blame] | 2257 | :param s: A single unquoted string to quote for something that is expecting |
Jean-Paul Calderone | 7b874db | 2009-08-27 12:32:47 -0400 | [diff] [blame] | 2258 | cmd.exe-style quoting |
| 2259 | |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2260 | :rtype: :py:obj:`str` |
Jonathan Ballet | 78b92a2 | 2011-07-16 08:07:26 +0900 | [diff] [blame] | 2261 | :return: A cmd.exe-style quoted string |
Jean-Paul Calderone | 7b874db | 2009-08-27 12:32:47 -0400 | [diff] [blame] | 2262 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2263 | s = _cmdLineQuoteRe2.sub(br"\1\1", _cmdLineQuoteRe.sub(br'\1\1\\"', s)) |
| 2264 | return b'"' + s + b'"' |
Jean-Paul Calderone | 7b874db | 2009-08-27 12:32:47 -0400 | [diff] [blame] | 2265 | |
| 2266 | |
Jean-Paul Calderone | 7b874db | 2009-08-27 12:32:47 -0400 | [diff] [blame] | 2267 | def quoteArguments(arguments): |
| 2268 | """ |
| 2269 | Quote an iterable of command-line arguments for passing to CreateProcess or |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2270 | a similar API. This allows the list passed to |
| 2271 | :py:obj:`reactor.spawnProcess` to match the child process's |
| 2272 | :py:obj:`sys.argv` properly. |
Jean-Paul Calderone | 7b874db | 2009-08-27 12:32:47 -0400 | [diff] [blame] | 2273 | |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2274 | :type arguments: :py:obj:`iterable` of :py:obj:`str` |
Jonathan Ballet | 78b92a2 | 2011-07-16 08:07:26 +0900 | [diff] [blame] | 2275 | :param arguments: An iterable of unquoted arguments to quote |
Jean-Paul Calderone | 7b874db | 2009-08-27 12:32:47 -0400 | [diff] [blame] | 2276 | |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2277 | :rtype: :py:obj:`str` |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2278 | :return: A space-delimited string containing quoted versions of |
| 2279 | :py:obj:`arguments` |
Jean-Paul Calderone | 7b874db | 2009-08-27 12:32:47 -0400 | [diff] [blame] | 2280 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2281 | return b' '.join(map(cmdLineQuote, arguments)) |
Jean-Paul Calderone | 7b874db | 2009-08-27 12:32:47 -0400 | [diff] [blame] | 2282 | |
| 2283 | |
Rick Dean | 4c9ad61 | 2009-07-17 15:05:22 -0500 | [diff] [blame] | 2284 | def _runopenssl(pem, *args): |
| 2285 | """ |
| 2286 | Run the command line openssl tool with the given arguments and write |
Rick Dean | 55d1ce6 | 2009-08-13 17:40:24 -0500 | [diff] [blame] | 2287 | the given PEM to its stdin. Not safe for quotes. |
Rick Dean | 4c9ad61 | 2009-07-17 15:05:22 -0500 | [diff] [blame] | 2288 | """ |
Jean-Paul Calderone | 038de95 | 2009-08-21 12:16:06 -0400 | [diff] [blame] | 2289 | if os.name == 'posix': |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2290 | command = b"openssl " + b" ".join([ |
| 2291 | (b"'" + arg.replace(b"'", b"'\\''") + b"'") |
| 2292 | for arg in args]) |
Rick Dean | 55d1ce6 | 2009-08-13 17:40:24 -0500 | [diff] [blame] | 2293 | else: |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2294 | command = b"openssl " + quoteArguments(args) |
| 2295 | proc = Popen(native(command), shell=True, stdin=PIPE, stdout=PIPE) |
Jean-Paul Calderone | 62ca8da | 2010-08-11 19:58:08 -0400 | [diff] [blame] | 2296 | proc.stdin.write(pem) |
| 2297 | proc.stdin.close() |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2298 | output = proc.stdout.read() |
| 2299 | proc.stdout.close() |
| 2300 | proc.wait() |
| 2301 | return output |
Rick Dean | 4c9ad61 | 2009-07-17 15:05:22 -0500 | [diff] [blame] | 2302 | |
| 2303 | |
Jean-Paul Calderone | 1880865 | 2009-07-05 12:54:05 -0400 | [diff] [blame] | 2304 | class FunctionTests(TestCase): |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2305 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2306 | Tests for free-functions in the :py:obj:`OpenSSL.crypto` module. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2307 | """ |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2308 | |
| 2309 | def test_load_privatekey_invalid_format(self): |
| 2310 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2311 | :py:obj:`load_privatekey` raises :py:obj:`ValueError` if passed an |
| 2312 | unknown filetype. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2313 | """ |
| 2314 | self.assertRaises(ValueError, load_privatekey, 100, root_key_pem) |
| 2315 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2316 | def test_load_privatekey_invalid_passphrase_type(self): |
| 2317 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2318 | :py:obj:`load_privatekey` raises :py:obj:`TypeError` if passed a |
| 2319 | passphrase that is neither a :py:obj:`str` nor a callable. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2320 | """ |
| 2321 | self.assertRaises( |
| 2322 | TypeError, |
| 2323 | load_privatekey, |
| 2324 | FILETYPE_PEM, encryptedPrivateKeyPEMPassphrase, object()) |
| 2325 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2326 | def test_load_privatekey_wrong_args(self): |
| 2327 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2328 | :py:obj:`load_privatekey` raises :py:obj:`TypeError` if called with the |
| 2329 | wrong number of arguments. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2330 | """ |
| 2331 | self.assertRaises(TypeError, load_privatekey) |
| 2332 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2333 | def test_load_privatekey_wrongPassphrase(self): |
| 2334 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2335 | :py:obj:`load_privatekey` raises :py:obj:`OpenSSL.crypto.Error` when it |
| 2336 | is passed an encrypted PEM and an incorrect passphrase. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2337 | """ |
| 2338 | self.assertRaises( |
| 2339 | Error, |
Jean-Paul Calderone | 5be230f | 2010-08-22 19:27:58 -0400 | [diff] [blame] | 2340 | load_privatekey, FILETYPE_PEM, encryptedPrivateKeyPEM, b("quack")) |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2341 | |
Ziga Seilnacht | 376cf97 | 2009-12-22 16:04:10 +0100 | [diff] [blame] | 2342 | def test_load_privatekey_passphraseWrongType(self): |
| 2343 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2344 | :py:obj:`load_privatekey` raises :py:obj:`ValueError` when it is passed |
| 2345 | a passphrase with a private key encoded in a format, that doesn't |
| 2346 | support encryption. |
Ziga Seilnacht | 376cf97 | 2009-12-22 16:04:10 +0100 | [diff] [blame] | 2347 | """ |
| 2348 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
| 2349 | blob = dump_privatekey(FILETYPE_ASN1, key) |
| 2350 | self.assertRaises(ValueError, |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2351 | load_privatekey, FILETYPE_ASN1, blob, "secret") |
Ziga Seilnacht | 376cf97 | 2009-12-22 16:04:10 +0100 | [diff] [blame] | 2352 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2353 | def test_load_privatekey_passphrase(self): |
| 2354 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2355 | :py:obj:`load_privatekey` can create a :py:obj:`PKey` object from an |
| 2356 | encrypted PEM string if given the passphrase. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2357 | """ |
| 2358 | key = load_privatekey( |
| 2359 | FILETYPE_PEM, encryptedPrivateKeyPEM, |
| 2360 | encryptedPrivateKeyPEMPassphrase) |
| 2361 | self.assertTrue(isinstance(key, PKeyType)) |
| 2362 | |
Ziga Seilnacht | 6b90a40 | 2009-12-22 14:33:47 +0100 | [diff] [blame] | 2363 | def test_load_privatekey_passphrase_exception(self): |
| 2364 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2365 | If the passphrase callback raises an exception, that exception is |
| 2366 | raised by :py:obj:`load_privatekey`. |
Ziga Seilnacht | 6b90a40 | 2009-12-22 14:33:47 +0100 | [diff] [blame] | 2367 | """ |
| 2368 | def cb(ignored): |
| 2369 | raise ArithmeticError |
| 2370 | |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2371 | with pytest.raises(ArithmeticError): |
| 2372 | load_privatekey(FILETYPE_PEM, encryptedPrivateKeyPEM, cb) |
Ziga Seilnacht | 6b90a40 | 2009-12-22 14:33:47 +0100 | [diff] [blame] | 2373 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2374 | def test_load_privatekey_wrongPassphraseCallback(self): |
| 2375 | """ |
Jean-Paul Calderone | d440a08 | 2011-09-14 11:02:05 -0400 | [diff] [blame] | 2376 | :py:obj:`load_privatekey` raises :py:obj:`OpenSSL.crypto.Error` when it |
| 2377 | is passed an encrypted PEM and a passphrase callback which returns an |
| 2378 | incorrect passphrase. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2379 | """ |
| 2380 | called = [] |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2381 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2382 | def cb(*a): |
| 2383 | called.append(None) |
Jean-Paul Calderone | d440a08 | 2011-09-14 11:02:05 -0400 | [diff] [blame] | 2384 | return b("quack") |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2385 | self.assertRaises( |
| 2386 | Error, |
| 2387 | load_privatekey, FILETYPE_PEM, encryptedPrivateKeyPEM, cb) |
| 2388 | self.assertTrue(called) |
| 2389 | |
| 2390 | def test_load_privatekey_passphraseCallback(self): |
| 2391 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2392 | :py:obj:`load_privatekey` can create a :py:obj:`PKey` object from an |
| 2393 | encrypted PEM string if given a passphrase callback which returns the |
| 2394 | correct password. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2395 | """ |
| 2396 | called = [] |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2397 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2398 | def cb(writing): |
| 2399 | called.append(writing) |
| 2400 | return encryptedPrivateKeyPEMPassphrase |
| 2401 | key = load_privatekey(FILETYPE_PEM, encryptedPrivateKeyPEM, cb) |
| 2402 | self.assertTrue(isinstance(key, PKeyType)) |
| 2403 | self.assertEqual(called, [False]) |
| 2404 | |
Jean-Paul Calderone | 105cb95 | 2011-09-14 10:16:46 -0400 | [diff] [blame] | 2405 | def test_load_privatekey_passphrase_wrong_return_type(self): |
| 2406 | """ |
| 2407 | :py:obj:`load_privatekey` raises :py:obj:`ValueError` if the passphrase |
| 2408 | callback returns something other than a byte string. |
| 2409 | """ |
| 2410 | self.assertRaises( |
| 2411 | ValueError, |
| 2412 | load_privatekey, |
| 2413 | FILETYPE_PEM, encryptedPrivateKeyPEM, lambda *args: 3) |
| 2414 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2415 | def test_dump_privatekey_wrong_args(self): |
| 2416 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2417 | :py:obj:`dump_privatekey` raises :py:obj:`TypeError` if called with the |
| 2418 | wrong number of arguments. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2419 | """ |
| 2420 | self.assertRaises(TypeError, dump_privatekey) |
Jean-Paul Calderone | 1eeccd8 | 2011-09-14 10:18:52 -0400 | [diff] [blame] | 2421 | # If cipher name is given, password is required. |
| 2422 | self.assertRaises( |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2423 | TypeError, dump_privatekey, FILETYPE_PEM, PKey(), GOOD_CIPHER) |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2424 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2425 | def test_dump_privatekey_unknown_cipher(self): |
| 2426 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2427 | :py:obj:`dump_privatekey` raises :py:obj:`ValueError` if called with an |
| 2428 | unrecognized cipher name. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2429 | """ |
| 2430 | key = PKey() |
| 2431 | key.generate_key(TYPE_RSA, 512) |
| 2432 | self.assertRaises( |
| 2433 | ValueError, dump_privatekey, |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2434 | FILETYPE_PEM, key, BAD_CIPHER, "passphrase") |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2435 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2436 | def test_dump_privatekey_invalid_passphrase_type(self): |
| 2437 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2438 | :py:obj:`dump_privatekey` raises :py:obj:`TypeError` if called with a |
| 2439 | passphrase which is neither a :py:obj:`str` nor a callable. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2440 | """ |
| 2441 | key = PKey() |
| 2442 | key.generate_key(TYPE_RSA, 512) |
| 2443 | self.assertRaises( |
| 2444 | TypeError, |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2445 | dump_privatekey, FILETYPE_PEM, key, GOOD_CIPHER, object()) |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2446 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2447 | def test_dump_privatekey_invalid_filetype(self): |
| 2448 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2449 | :py:obj:`dump_privatekey` raises :py:obj:`ValueError` if called with an |
| 2450 | unrecognized filetype. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2451 | """ |
| 2452 | key = PKey() |
| 2453 | key.generate_key(TYPE_RSA, 512) |
| 2454 | self.assertRaises(ValueError, dump_privatekey, 100, key) |
| 2455 | |
Ziga Seilnacht | 781295a | 2009-12-22 14:58:01 +0100 | [diff] [blame] | 2456 | def test_load_privatekey_passphraseCallbackLength(self): |
| 2457 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2458 | :py:obj:`crypto.load_privatekey` should raise an error when the |
| 2459 | passphrase provided by the callback is too long, not silently truncate |
| 2460 | it. |
Ziga Seilnacht | 781295a | 2009-12-22 14:58:01 +0100 | [diff] [blame] | 2461 | """ |
| 2462 | def cb(ignored): |
| 2463 | return "a" * 1025 |
| 2464 | |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2465 | with pytest.raises(ValueError): |
| 2466 | load_privatekey(FILETYPE_PEM, encryptedPrivateKeyPEM, cb) |
Ziga Seilnacht | 781295a | 2009-12-22 14:58:01 +0100 | [diff] [blame] | 2467 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2468 | def test_dump_privatekey_passphrase(self): |
| 2469 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2470 | :py:obj:`dump_privatekey` writes an encrypted PEM when given a |
| 2471 | passphrase. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2472 | """ |
Jean-Paul Calderone | 5be230f | 2010-08-22 19:27:58 -0400 | [diff] [blame] | 2473 | passphrase = b("foo") |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2474 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2475 | pem = dump_privatekey(FILETYPE_PEM, key, GOOD_CIPHER, passphrase) |
| 2476 | self.assertTrue(isinstance(pem, binary_type)) |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2477 | loadedKey = load_privatekey(FILETYPE_PEM, pem, passphrase) |
| 2478 | self.assertTrue(isinstance(loadedKey, PKeyType)) |
| 2479 | self.assertEqual(loadedKey.type(), key.type()) |
| 2480 | self.assertEqual(loadedKey.bits(), key.bits()) |
| 2481 | |
Ziga Seilnacht | 376cf97 | 2009-12-22 16:04:10 +0100 | [diff] [blame] | 2482 | def test_dump_privatekey_passphraseWrongType(self): |
| 2483 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2484 | :py:obj:`dump_privatekey` raises :py:obj:`ValueError` when it is passed |
| 2485 | a passphrase with a private key encoded in a format, that doesn't |
| 2486 | support encryption. |
Ziga Seilnacht | 376cf97 | 2009-12-22 16:04:10 +0100 | [diff] [blame] | 2487 | """ |
| 2488 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2489 | with pytest.raises(ValueError): |
| 2490 | dump_privatekey(FILETYPE_ASN1, key, GOOD_CIPHER, "secret") |
Ziga Seilnacht | 376cf97 | 2009-12-22 16:04:10 +0100 | [diff] [blame] | 2491 | |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2492 | def test_dump_certificate(self): |
| 2493 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2494 | :py:obj:`dump_certificate` writes PEM, DER, and text. |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2495 | """ |
Jean-Paul Calderone | f17e421 | 2009-04-01 14:21:40 -0400 | [diff] [blame] | 2496 | pemData = cleartextCertificatePEM + cleartextPrivateKeyPEM |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2497 | cert = load_certificate(FILETYPE_PEM, pemData) |
| 2498 | dumped_pem = dump_certificate(FILETYPE_PEM, cert) |
| 2499 | self.assertEqual(dumped_pem, cleartextCertificatePEM) |
| 2500 | dumped_der = dump_certificate(FILETYPE_ASN1, cert) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2501 | good_der = _runopenssl(dumped_pem, b"x509", b"-outform", b"DER") |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2502 | self.assertEqual(dumped_der, good_der) |
| 2503 | cert2 = load_certificate(FILETYPE_ASN1, dumped_der) |
| 2504 | dumped_pem2 = dump_certificate(FILETYPE_PEM, cert2) |
| 2505 | self.assertEqual(dumped_pem2, cleartextCertificatePEM) |
| 2506 | dumped_text = dump_certificate(FILETYPE_TEXT, cert) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2507 | good_text = _runopenssl(dumped_pem, b"x509", b"-noout", b"-text") |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2508 | self.assertEqual(dumped_text, good_text) |
| 2509 | |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2510 | def test_dump_privatekey_pem(self): |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2511 | """ |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2512 | :py:obj:`dump_privatekey` writes a PEM |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2513 | """ |
| 2514 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Jean-Paul Calderone | 8e6ce97 | 2009-05-13 12:32:49 -0400 | [diff] [blame] | 2515 | self.assertTrue(key.check()) |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2516 | dumped_pem = dump_privatekey(FILETYPE_PEM, key) |
| 2517 | self.assertEqual(dumped_pem, cleartextPrivateKeyPEM) |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2518 | |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2519 | def test_dump_privatekey_asn1(self): |
| 2520 | """ |
| 2521 | :py:obj:`dump_privatekey` writes a DER |
| 2522 | """ |
| 2523 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
| 2524 | dumped_pem = dump_privatekey(FILETYPE_PEM, key) |
| 2525 | |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2526 | dumped_der = dump_privatekey(FILETYPE_ASN1, key) |
Jean-Paul Calderone | f17e421 | 2009-04-01 14:21:40 -0400 | [diff] [blame] | 2527 | # XXX This OpenSSL call writes "writing RSA key" to standard out. Sad. |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2528 | good_der = _runopenssl(dumped_pem, b"rsa", b"-outform", b"DER") |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2529 | self.assertEqual(dumped_der, good_der) |
| 2530 | key2 = load_privatekey(FILETYPE_ASN1, dumped_der) |
| 2531 | dumped_pem2 = dump_privatekey(FILETYPE_PEM, key2) |
| 2532 | self.assertEqual(dumped_pem2, cleartextPrivateKeyPEM) |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2533 | |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2534 | def test_dump_privatekey_text(self): |
| 2535 | """ |
| 2536 | :py:obj:`dump_privatekey` writes a text |
| 2537 | """ |
| 2538 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
| 2539 | dumped_pem = dump_privatekey(FILETYPE_PEM, key) |
| 2540 | |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2541 | dumped_text = dump_privatekey(FILETYPE_TEXT, key) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2542 | good_text = _runopenssl(dumped_pem, b"rsa", b"-noout", b"-text") |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2543 | self.assertEqual(dumped_text, good_text) |
| 2544 | |
| 2545 | def test_dump_certificate_request(self): |
| 2546 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2547 | :py:obj:`dump_certificate_request` writes a PEM, DER, and text. |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2548 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 2549 | req = load_certificate_request( |
| 2550 | FILETYPE_PEM, cleartextCertificateRequestPEM) |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2551 | dumped_pem = dump_certificate_request(FILETYPE_PEM, req) |
| 2552 | self.assertEqual(dumped_pem, cleartextCertificateRequestPEM) |
| 2553 | dumped_der = dump_certificate_request(FILETYPE_ASN1, req) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2554 | good_der = _runopenssl(dumped_pem, b"req", b"-outform", b"DER") |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2555 | self.assertEqual(dumped_der, good_der) |
| 2556 | req2 = load_certificate_request(FILETYPE_ASN1, dumped_der) |
| 2557 | dumped_pem2 = dump_certificate_request(FILETYPE_PEM, req2) |
| 2558 | self.assertEqual(dumped_pem2, cleartextCertificateRequestPEM) |
| 2559 | dumped_text = dump_certificate_request(FILETYPE_TEXT, req) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2560 | good_text = _runopenssl(dumped_pem, b"req", b"-noout", b"-text") |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2561 | self.assertEqual(dumped_text, good_text) |
Jean-Paul Calderone | af43cdf | 2010-08-03 18:40:52 -0400 | [diff] [blame] | 2562 | self.assertRaises(ValueError, dump_certificate_request, 100, req) |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2563 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2564 | def test_dump_privatekey_passphraseCallback(self): |
| 2565 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2566 | :py:obj:`dump_privatekey` writes an encrypted PEM when given a callback |
| 2567 | which returns the correct passphrase. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2568 | """ |
Jean-Paul Calderone | 5be230f | 2010-08-22 19:27:58 -0400 | [diff] [blame] | 2569 | passphrase = b("foo") |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2570 | called = [] |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2571 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2572 | def cb(writing): |
| 2573 | called.append(writing) |
| 2574 | return passphrase |
| 2575 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2576 | pem = dump_privatekey(FILETYPE_PEM, key, GOOD_CIPHER, cb) |
| 2577 | self.assertTrue(isinstance(pem, binary_type)) |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2578 | self.assertEqual(called, [True]) |
| 2579 | loadedKey = load_privatekey(FILETYPE_PEM, pem, passphrase) |
| 2580 | self.assertTrue(isinstance(loadedKey, PKeyType)) |
| 2581 | self.assertEqual(loadedKey.type(), key.type()) |
| 2582 | self.assertEqual(loadedKey.bits(), key.bits()) |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2583 | |
Ziga Seilnacht | 6b90a40 | 2009-12-22 14:33:47 +0100 | [diff] [blame] | 2584 | def test_dump_privatekey_passphrase_exception(self): |
| 2585 | """ |
Jean-Paul Calderone | 5d9d7f1 | 2011-09-14 09:48:58 -0400 | [diff] [blame] | 2586 | :py:obj:`dump_privatekey` should not overwrite the exception raised |
Ziga Seilnacht | 6b90a40 | 2009-12-22 14:33:47 +0100 | [diff] [blame] | 2587 | by the passphrase callback. |
| 2588 | """ |
| 2589 | def cb(ignored): |
| 2590 | raise ArithmeticError |
| 2591 | |
| 2592 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
| 2593 | self.assertRaises(ArithmeticError, |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2594 | dump_privatekey, FILETYPE_PEM, key, GOOD_CIPHER, cb) |
Ziga Seilnacht | 6b90a40 | 2009-12-22 14:33:47 +0100 | [diff] [blame] | 2595 | |
| 2596 | |
Ziga Seilnacht | 781295a | 2009-12-22 14:58:01 +0100 | [diff] [blame] | 2597 | def test_dump_privatekey_passphraseCallbackLength(self): |
| 2598 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2599 | :py:obj:`crypto.dump_privatekey` should raise an error when the |
| 2600 | passphrase provided by the callback is too long, not silently truncate |
| 2601 | it. |
Ziga Seilnacht | 781295a | 2009-12-22 14:58:01 +0100 | [diff] [blame] | 2602 | """ |
| 2603 | def cb(ignored): |
| 2604 | return "a" * 1025 |
| 2605 | |
| 2606 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
| 2607 | self.assertRaises(ValueError, |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2608 | dump_privatekey, FILETYPE_PEM, key, GOOD_CIPHER, cb) |
Ziga Seilnacht | 781295a | 2009-12-22 14:58:01 +0100 | [diff] [blame] | 2609 | |
| 2610 | |
Alex Gaynor | 4b9c96a | 2014-08-14 09:51:48 -0700 | [diff] [blame] | 2611 | def test_load_pkcs7_data_pem(self): |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2612 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2613 | :py:obj:`load_pkcs7_data` accepts a PKCS#7 string and returns an |
| 2614 | instance of :py:obj:`PKCS7Type`. |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2615 | """ |
| 2616 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
| 2617 | self.assertTrue(isinstance(pkcs7, PKCS7Type)) |
| 2618 | |
Alex Gaynor | 4b9c96a | 2014-08-14 09:51:48 -0700 | [diff] [blame] | 2619 | def test_load_pkcs7_data_asn1(self): |
Alex Gaynor | 9875a91 | 2014-08-14 13:35:05 -0700 | [diff] [blame] | 2620 | """ |
| 2621 | :py:obj:`load_pkcs7_data` accepts a bytes containing ASN1 data |
| 2622 | representing PKCS#7 and returns an instance of :py:obj`PKCS7Type`. |
| 2623 | """ |
Alex Gaynor | 4b9c96a | 2014-08-14 09:51:48 -0700 | [diff] [blame] | 2624 | pkcs7 = load_pkcs7_data(FILETYPE_ASN1, pkcs7DataASN1) |
| 2625 | self.assertTrue(isinstance(pkcs7, PKCS7Type)) |
| 2626 | |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2627 | def test_load_pkcs7_data_invalid(self): |
| 2628 | """ |
| 2629 | If the data passed to :py:obj:`load_pkcs7_data` is invalid, |
| 2630 | :py:obj:`Error` is raised. |
| 2631 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2632 | self.assertRaises(Error, load_pkcs7_data, FILETYPE_PEM, b"foo") |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2633 | |
| 2634 | |
Jean-Paul Calderone | 4a68b40 | 2013-12-29 16:54:58 -0500 | [diff] [blame] | 2635 | class LoadCertificateTests(TestCase): |
| 2636 | """ |
| 2637 | Tests for :py:obj:`load_certificate_request`. |
| 2638 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2639 | |
Jean-Paul Calderone | 4a68b40 | 2013-12-29 16:54:58 -0500 | [diff] [blame] | 2640 | def test_badFileType(self): |
| 2641 | """ |
| 2642 | If the file type passed to :py:obj:`load_certificate_request` is |
| 2643 | neither :py:obj:`FILETYPE_PEM` nor :py:obj:`FILETYPE_ASN1` then |
| 2644 | :py:class:`ValueError` is raised. |
| 2645 | """ |
| 2646 | self.assertRaises(ValueError, load_certificate_request, object(), b"") |
| 2647 | |
| 2648 | |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 2649 | class PKCS7Tests(TestCase): |
| 2650 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2651 | Tests for :py:obj:`PKCS7Type`. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 2652 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2653 | |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 2654 | def test_type(self): |
| 2655 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2656 | :py:obj:`PKCS7Type` is a type object. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 2657 | """ |
| 2658 | self.assertTrue(isinstance(PKCS7Type, type)) |
| 2659 | self.assertEqual(PKCS7Type.__name__, 'PKCS7') |
| 2660 | |
| 2661 | # XXX This doesn't currently work. |
| 2662 | # self.assertIdentical(PKCS7, PKCS7Type) |
| 2663 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2664 | # XXX Opposite results for all these following methods |
| 2665 | |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2666 | def test_type_is_signed_wrong_args(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2667 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2668 | :py:obj:`PKCS7Type.type_is_signed` raises :py:obj:`TypeError` if called |
| 2669 | with any arguments. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2670 | """ |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2671 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
| 2672 | self.assertRaises(TypeError, pkcs7.type_is_signed, None) |
| 2673 | |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2674 | def test_type_is_signed(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2675 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2676 | :py:obj:`PKCS7Type.type_is_signed` returns :py:obj:`True` if the PKCS7 |
| 2677 | object is of the type *signed*. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2678 | """ |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2679 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
| 2680 | self.assertTrue(pkcs7.type_is_signed()) |
| 2681 | |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2682 | def test_type_is_enveloped_wrong_args(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2683 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2684 | :py:obj:`PKCS7Type.type_is_enveloped` raises :py:obj:`TypeError` if |
| 2685 | called with any arguments. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2686 | """ |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2687 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
| 2688 | self.assertRaises(TypeError, pkcs7.type_is_enveloped, None) |
| 2689 | |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2690 | def test_type_is_enveloped(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2691 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2692 | :py:obj:`PKCS7Type.type_is_enveloped` returns :py:obj:`False` if the |
| 2693 | PKCS7 object is not of the type *enveloped*. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2694 | """ |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2695 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
| 2696 | self.assertFalse(pkcs7.type_is_enveloped()) |
| 2697 | |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2698 | def test_type_is_signedAndEnveloped_wrong_args(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2699 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2700 | :py:obj:`PKCS7Type.type_is_signedAndEnveloped` raises |
| 2701 | :py:obj:`TypeError` if called with any arguments. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2702 | """ |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2703 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
| 2704 | self.assertRaises(TypeError, pkcs7.type_is_signedAndEnveloped, None) |
| 2705 | |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2706 | def test_type_is_signedAndEnveloped(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2707 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2708 | :py:obj:`PKCS7Type.type_is_signedAndEnveloped` returns :py:obj:`False` |
| 2709 | if the PKCS7 object is not of the type *signed and enveloped*. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2710 | """ |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2711 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
| 2712 | self.assertFalse(pkcs7.type_is_signedAndEnveloped()) |
| 2713 | |
Jean-Paul Calderone | b4754b9 | 2010-07-30 11:00:08 -0400 | [diff] [blame] | 2714 | def test_type_is_data(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2715 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2716 | :py:obj:`PKCS7Type.type_is_data` returns :py:obj:`False` if the PKCS7 |
| 2717 | object is not of the type data. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2718 | """ |
Jean-Paul Calderone | b4754b9 | 2010-07-30 11:00:08 -0400 | [diff] [blame] | 2719 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
| 2720 | self.assertFalse(pkcs7.type_is_data()) |
| 2721 | |
Jean-Paul Calderone | b4754b9 | 2010-07-30 11:00:08 -0400 | [diff] [blame] | 2722 | def test_type_is_data_wrong_args(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2723 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2724 | :py:obj:`PKCS7Type.type_is_data` raises :py:obj:`TypeError` if called |
| 2725 | with any arguments. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2726 | """ |
Jean-Paul Calderone | b4754b9 | 2010-07-30 11:00:08 -0400 | [diff] [blame] | 2727 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
| 2728 | self.assertRaises(TypeError, pkcs7.type_is_data, None) |
| 2729 | |
Jean-Paul Calderone | 97b28ca | 2010-07-30 10:56:07 -0400 | [diff] [blame] | 2730 | def test_get_type_name_wrong_args(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2731 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2732 | :py:obj:`PKCS7Type.get_type_name` raises :py:obj:`TypeError` if called |
| 2733 | with any arguments. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2734 | """ |
Jean-Paul Calderone | 97b28ca | 2010-07-30 10:56:07 -0400 | [diff] [blame] | 2735 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
| 2736 | self.assertRaises(TypeError, pkcs7.get_type_name, None) |
| 2737 | |
Jean-Paul Calderone | 4cbe05e | 2010-07-30 10:55:30 -0400 | [diff] [blame] | 2738 | def test_get_type_name(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2739 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2740 | :py:obj:`PKCS7Type.get_type_name` returns a :py:obj:`str` giving the |
| 2741 | type name. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2742 | """ |
Jean-Paul Calderone | 4cbe05e | 2010-07-30 10:55:30 -0400 | [diff] [blame] | 2743 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
Jean-Paul Calderone | 07640f1 | 2010-08-22 17:14:43 -0400 | [diff] [blame] | 2744 | self.assertEquals(pkcs7.get_type_name(), b('pkcs7-signedData')) |
Jean-Paul Calderone | 4cbe05e | 2010-07-30 10:55:30 -0400 | [diff] [blame] | 2745 | |
Jean-Paul Calderone | 4cbe05e | 2010-07-30 10:55:30 -0400 | [diff] [blame] | 2746 | def test_attribute(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2747 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2748 | If an attribute other than one of the methods tested here is accessed |
| 2749 | on an instance of :py:obj:`PKCS7Type`, :py:obj:`AttributeError` is |
| 2750 | raised. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2751 | """ |
Jean-Paul Calderone | 4cbe05e | 2010-07-30 10:55:30 -0400 | [diff] [blame] | 2752 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
| 2753 | self.assertRaises(AttributeError, getattr, pkcs7, "foo") |
| 2754 | |
| 2755 | |
Jean-Paul Calderone | b972559 | 2010-08-03 18:17:22 -0400 | [diff] [blame] | 2756 | class NetscapeSPKITests(TestCase, _PKeyInteractionTestsMixin): |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2757 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2758 | Tests for :py:obj:`OpenSSL.crypto.NetscapeSPKI`. |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2759 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2760 | |
Jean-Paul Calderone | b972559 | 2010-08-03 18:17:22 -0400 | [diff] [blame] | 2761 | def signable(self): |
| 2762 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2763 | Return a new :py:obj:`NetscapeSPKI` for use with signing tests. |
Jean-Paul Calderone | b972559 | 2010-08-03 18:17:22 -0400 | [diff] [blame] | 2764 | """ |
| 2765 | return NetscapeSPKI() |
| 2766 | |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 2767 | def test_type(self): |
| 2768 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2769 | :py:obj:`NetscapeSPKI` and :py:obj:`NetscapeSPKIType` refer to the same |
| 2770 | type object and can be used to create instances of that type. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 2771 | """ |
| 2772 | self.assertIdentical(NetscapeSPKI, NetscapeSPKIType) |
| 2773 | self.assertConsistentType(NetscapeSPKI, 'NetscapeSPKI') |
| 2774 | |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2775 | def test_construction(self): |
| 2776 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2777 | :py:obj:`NetscapeSPKI` returns an instance of |
| 2778 | :py:obj:`NetscapeSPKIType`. |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2779 | """ |
| 2780 | nspki = NetscapeSPKI() |
| 2781 | self.assertTrue(isinstance(nspki, NetscapeSPKIType)) |
| 2782 | |
Jean-Paul Calderone | 969efaa | 2010-08-03 18:19:19 -0400 | [diff] [blame] | 2783 | def test_invalid_attribute(self): |
| 2784 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2785 | Accessing a non-existent attribute of a :py:obj:`NetscapeSPKI` instance |
| 2786 | causes an :py:obj:`AttributeError` to be raised. |
Jean-Paul Calderone | 969efaa | 2010-08-03 18:19:19 -0400 | [diff] [blame] | 2787 | """ |
| 2788 | nspki = NetscapeSPKI() |
| 2789 | self.assertRaises(AttributeError, lambda: nspki.foo) |
| 2790 | |
Jean-Paul Calderone | 06ada9f | 2010-08-03 18:26:52 -0400 | [diff] [blame] | 2791 | def test_b64_encode(self): |
| 2792 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2793 | :py:obj:`NetscapeSPKI.b64_encode` encodes the certificate to a base64 |
| 2794 | blob. |
Jean-Paul Calderone | 06ada9f | 2010-08-03 18:26:52 -0400 | [diff] [blame] | 2795 | """ |
| 2796 | nspki = NetscapeSPKI() |
| 2797 | blob = nspki.b64_encode() |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2798 | self.assertTrue(isinstance(blob, binary_type)) |
Jean-Paul Calderone | 06ada9f | 2010-08-03 18:26:52 -0400 | [diff] [blame] | 2799 | |
| 2800 | |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2801 | class RevokedTests(TestCase): |
| 2802 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2803 | Tests for :py:obj:`OpenSSL.crypto.Revoked` |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2804 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2805 | |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2806 | def test_construction(self): |
| 2807 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2808 | Confirm we can create :py:obj:`OpenSSL.crypto.Revoked`. Check |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2809 | that it is empty. |
| 2810 | """ |
| 2811 | revoked = Revoked() |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 2812 | self.assertTrue(isinstance(revoked, Revoked)) |
| 2813 | self.assertEquals(type(revoked), Revoked) |
| 2814 | self.assertEquals(revoked.get_serial(), b('00')) |
| 2815 | self.assertEquals(revoked.get_rev_date(), None) |
| 2816 | self.assertEquals(revoked.get_reason(), None) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2817 | |
Jean-Paul Calderone | 4f74bfe | 2010-01-30 14:32:49 -0500 | [diff] [blame] | 2818 | def test_construction_wrong_args(self): |
| 2819 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2820 | Calling :py:obj:`OpenSSL.crypto.Revoked` with any arguments results |
| 2821 | in a :py:obj:`TypeError` being raised. |
Jean-Paul Calderone | 4f74bfe | 2010-01-30 14:32:49 -0500 | [diff] [blame] | 2822 | """ |
| 2823 | self.assertRaises(TypeError, Revoked, None) |
| 2824 | self.assertRaises(TypeError, Revoked, 1) |
| 2825 | self.assertRaises(TypeError, Revoked, "foo") |
| 2826 | |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2827 | def test_serial(self): |
| 2828 | """ |
Jean-Paul Calderone | b98eae0 | 2010-01-30 13:18:04 -0500 | [diff] [blame] | 2829 | Confirm we can set and get serial numbers from |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2830 | :py:obj:`OpenSSL.crypto.Revoked`. Confirm errors are handled |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2831 | with grace. |
| 2832 | """ |
| 2833 | revoked = Revoked() |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 2834 | ret = revoked.set_serial(b('10b')) |
| 2835 | self.assertEquals(ret, None) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2836 | ser = revoked.get_serial() |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 2837 | self.assertEquals(ser, b('010B')) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2838 | |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 2839 | revoked.set_serial(b('31ppp')) # a type error would be nice |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2840 | ser = revoked.get_serial() |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 2841 | self.assertEquals(ser, b('31')) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2842 | |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 2843 | self.assertRaises(ValueError, revoked.set_serial, b('pqrst')) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2844 | self.assertRaises(TypeError, revoked.set_serial, 100) |
Jean-Paul Calderone | 4f74bfe | 2010-01-30 14:32:49 -0500 | [diff] [blame] | 2845 | self.assertRaises(TypeError, revoked.get_serial, 1) |
| 2846 | self.assertRaises(TypeError, revoked.get_serial, None) |
| 2847 | self.assertRaises(TypeError, revoked.get_serial, "") |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2848 | |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2849 | def test_date(self): |
| 2850 | """ |
Jean-Paul Calderone | b98eae0 | 2010-01-30 13:18:04 -0500 | [diff] [blame] | 2851 | Confirm we can set and get revocation dates from |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2852 | :py:obj:`OpenSSL.crypto.Revoked`. Confirm errors are handled |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2853 | with grace. |
| 2854 | """ |
| 2855 | revoked = Revoked() |
| 2856 | date = revoked.get_rev_date() |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 2857 | self.assertEquals(date, None) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2858 | |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 2859 | now = b(datetime.now().strftime("%Y%m%d%H%M%SZ")) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2860 | ret = revoked.set_rev_date(now) |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 2861 | self.assertEqual(ret, None) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2862 | date = revoked.get_rev_date() |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 2863 | self.assertEqual(date, now) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2864 | |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 2865 | def test_reason(self): |
| 2866 | """ |
Jean-Paul Calderone | b98eae0 | 2010-01-30 13:18:04 -0500 | [diff] [blame] | 2867 | Confirm we can set and get revocation reasons from |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2868 | :py:obj:`OpenSSL.crypto.Revoked`. The "get" need to work |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 2869 | as "set". Likewise, each reason of all_reasons() must work. |
| 2870 | """ |
| 2871 | revoked = Revoked() |
| 2872 | for r in revoked.all_reasons(): |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 2873 | for x in range(2): |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 2874 | ret = revoked.set_reason(r) |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 2875 | self.assertEquals(ret, None) |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 2876 | reason = revoked.get_reason() |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 2877 | self.assertEquals( |
| 2878 | reason.lower().replace(b(' '), b('')), |
| 2879 | r.lower().replace(b(' '), b(''))) |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2880 | r = reason # again with the resp of get |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 2881 | |
| 2882 | revoked.set_reason(None) |
| 2883 | self.assertEqual(revoked.get_reason(), None) |
| 2884 | |
Jean-Paul Calderone | 4f74bfe | 2010-01-30 14:32:49 -0500 | [diff] [blame] | 2885 | def test_set_reason_wrong_arguments(self): |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 2886 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2887 | Calling :py:obj:`OpenSSL.crypto.Revoked.set_reason` with other than |
Jean-Paul Calderone | 4f74bfe | 2010-01-30 14:32:49 -0500 | [diff] [blame] | 2888 | one argument, or an argument which isn't a valid reason, |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2889 | results in :py:obj:`TypeError` or :py:obj:`ValueError` being raised. |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 2890 | """ |
| 2891 | revoked = Revoked() |
| 2892 | self.assertRaises(TypeError, revoked.set_reason, 100) |
Jean-Paul Calderone | 281b62b | 2010-08-28 14:22:29 -0400 | [diff] [blame] | 2893 | self.assertRaises(ValueError, revoked.set_reason, b('blue')) |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 2894 | |
Jean-Paul Calderone | 4f74bfe | 2010-01-30 14:32:49 -0500 | [diff] [blame] | 2895 | def test_get_reason_wrong_arguments(self): |
| 2896 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2897 | Calling :py:obj:`OpenSSL.crypto.Revoked.get_reason` with any |
| 2898 | arguments results in :py:obj:`TypeError` being raised. |
Jean-Paul Calderone | 4f74bfe | 2010-01-30 14:32:49 -0500 | [diff] [blame] | 2899 | """ |
| 2900 | revoked = Revoked() |
| 2901 | self.assertRaises(TypeError, revoked.get_reason, None) |
| 2902 | self.assertRaises(TypeError, revoked.get_reason, 1) |
| 2903 | self.assertRaises(TypeError, revoked.get_reason, "foo") |
| 2904 | |
| 2905 | |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2906 | class CRLTests(TestCase): |
| 2907 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2908 | Tests for :py:obj:`OpenSSL.crypto.CRL` |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2909 | """ |
| 2910 | cert = load_certificate(FILETYPE_PEM, cleartextCertificatePEM) |
| 2911 | pkey = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
| 2912 | |
| 2913 | def test_construction(self): |
| 2914 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2915 | Confirm we can create :py:obj:`OpenSSL.crypto.CRL`. Check |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2916 | that it is empty |
| 2917 | """ |
| 2918 | crl = CRL() |
Alex Gaynor | 7f63649 | 2015-09-04 13:26:52 -0400 | [diff] [blame] | 2919 | self.assertTrue(isinstance(crl, CRL)) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2920 | self.assertEqual(crl.get_revoked(), None) |
| 2921 | |
Jean-Paul Calderone | 2efd03e | 2010-01-30 13:59:55 -0500 | [diff] [blame] | 2922 | def test_construction_wrong_args(self): |
| 2923 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 2924 | Calling :py:obj:`OpenSSL.crypto.CRL` with any number of arguments |
| 2925 | results in a :py:obj:`TypeError` being raised. |
Jean-Paul Calderone | 2efd03e | 2010-01-30 13:59:55 -0500 | [diff] [blame] | 2926 | """ |
| 2927 | self.assertRaises(TypeError, CRL, 1) |
| 2928 | self.assertRaises(TypeError, CRL, "") |
| 2929 | self.assertRaises(TypeError, CRL, None) |
| 2930 | |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 2931 | def _get_crl(self): |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2932 | """ |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 2933 | Get a new ``CRL`` with a revocation. |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2934 | """ |
| 2935 | crl = CRL() |
| 2936 | revoked = Revoked() |
Jean-Paul Calderone | b894fe1 | 2010-08-22 19:30:19 -0400 | [diff] [blame] | 2937 | now = b(datetime.now().strftime("%Y%m%d%H%M%SZ")) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2938 | revoked.set_rev_date(now) |
Jean-Paul Calderone | b894fe1 | 2010-08-22 19:30:19 -0400 | [diff] [blame] | 2939 | revoked.set_serial(b('3ab')) |
| 2940 | revoked.set_reason(b('sUpErSeDEd')) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2941 | crl.add_revoked(revoked) |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 2942 | return crl |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2943 | |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 2944 | def test_export_pem(self): |
| 2945 | """ |
| 2946 | If not passed a format, ``CRL.export`` returns a "PEM" format string |
| 2947 | representing a serial number, a revoked reason, and certificate issuer |
| 2948 | information. |
| 2949 | """ |
| 2950 | crl = self._get_crl() |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2951 | # PEM format |
| 2952 | dumped_crl = crl.export(self.cert, self.pkey, days=20) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2953 | text = _runopenssl(dumped_crl, b"crl", b"-noout", b"-text") |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 2954 | |
| 2955 | # These magic values are based on the way the CRL above was constructed |
| 2956 | # and with what certificate it was exported. |
Jean-Paul Calderone | b894fe1 | 2010-08-22 19:30:19 -0400 | [diff] [blame] | 2957 | text.index(b('Serial Number: 03AB')) |
| 2958 | text.index(b('Superseded')) |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 2959 | text.index( |
| 2960 | b('Issuer: /C=US/ST=IL/L=Chicago/O=Testing/CN=Testing Root CA') |
| 2961 | ) |
| 2962 | |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 2963 | def test_export_der(self): |
| 2964 | """ |
| 2965 | If passed ``FILETYPE_ASN1`` for the format, ``CRL.export`` returns a |
| 2966 | "DER" format string representing a serial number, a revoked reason, and |
| 2967 | certificate issuer information. |
| 2968 | """ |
| 2969 | crl = self._get_crl() |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2970 | |
| 2971 | # DER format |
| 2972 | dumped_crl = crl.export(self.cert, self.pkey, FILETYPE_ASN1) |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 2973 | text = _runopenssl( |
| 2974 | dumped_crl, b"crl", b"-noout", b"-text", b"-inform", b"DER" |
| 2975 | ) |
Jean-Paul Calderone | b894fe1 | 2010-08-22 19:30:19 -0400 | [diff] [blame] | 2976 | text.index(b('Serial Number: 03AB')) |
| 2977 | text.index(b('Superseded')) |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 2978 | text.index( |
| 2979 | b('Issuer: /C=US/ST=IL/L=Chicago/O=Testing/CN=Testing Root CA') |
| 2980 | ) |
| 2981 | |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 2982 | def test_export_text(self): |
| 2983 | """ |
| 2984 | If passed ``FILETYPE_TEXT`` for the format, ``CRL.export`` returns a |
| 2985 | text format string like the one produced by the openssl command line |
| 2986 | tool. |
| 2987 | """ |
| 2988 | crl = self._get_crl() |
| 2989 | |
| 2990 | dumped_crl = crl.export(self.cert, self.pkey, FILETYPE_ASN1) |
| 2991 | text = _runopenssl( |
| 2992 | dumped_crl, b"crl", b"-noout", b"-text", b"-inform", b"DER" |
| 2993 | ) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 2994 | |
| 2995 | # text format |
| 2996 | dumped_text = crl.export(self.cert, self.pkey, type=FILETYPE_TEXT) |
| 2997 | self.assertEqual(text, dumped_text) |
| 2998 | |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 2999 | def test_export_custom_digest(self): |
| 3000 | """ |
| 3001 | If passed the name of a digest function, ``CRL.export`` uses a |
| 3002 | signature algorithm based on that digest function. |
| 3003 | """ |
| 3004 | crl = self._get_crl() |
Jean-Paul Calderone | cce22d0 | 2015-04-13 13:56:09 -0400 | [diff] [blame] | 3005 | dumped_crl = crl.export(self.cert, self.pkey, digest=b"sha1") |
Bulat Gaifullin | 1966c97 | 2014-09-22 09:47:20 +0400 | [diff] [blame] | 3006 | text = _runopenssl(dumped_crl, b"crl", b"-noout", b"-text") |
| 3007 | text.index(b('Signature Algorithm: sha1')) |
| 3008 | |
Jean-Paul Calderone | cce22d0 | 2015-04-13 13:56:09 -0400 | [diff] [blame] | 3009 | def test_export_md5_digest(self): |
| 3010 | """ |
| 3011 | If passed md5 as the digest function, ``CRL.export`` uses md5 and does |
| 3012 | not emit a deprecation warning. |
| 3013 | """ |
| 3014 | crl = self._get_crl() |
| 3015 | with catch_warnings(record=True) as catcher: |
| 3016 | simplefilter("always") |
| 3017 | self.assertEqual(0, len(catcher)) |
| 3018 | dumped_crl = crl.export(self.cert, self.pkey, digest=b"md5") |
| 3019 | text = _runopenssl(dumped_crl, b"crl", b"-noout", b"-text") |
| 3020 | text.index(b('Signature Algorithm: md5')) |
| 3021 | |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3022 | def test_export_default_digest(self): |
| 3023 | """ |
| 3024 | If not passed the name of a digest function, ``CRL.export`` uses a |
| 3025 | signature algorithm based on MD5 and emits a deprecation warning. |
| 3026 | """ |
| 3027 | crl = self._get_crl() |
| 3028 | with catch_warnings(record=True) as catcher: |
| 3029 | simplefilter("always") |
| 3030 | dumped_crl = crl.export(self.cert, self.pkey) |
| 3031 | self.assertEqual( |
| 3032 | "The default message digest (md5) is deprecated. " |
| 3033 | "Pass the name of a message digest explicitly.", |
| 3034 | str(catcher[0].message), |
| 3035 | ) |
Bulat Gaifullin | 1966c97 | 2014-09-22 09:47:20 +0400 | [diff] [blame] | 3036 | text = _runopenssl(dumped_crl, b"crl", b"-noout", b"-text") |
| 3037 | text.index(b('Signature Algorithm: md5')) |
| 3038 | |
Jean-Paul Calderone | c7293bc | 2011-09-13 15:24:38 -0400 | [diff] [blame] | 3039 | def test_export_invalid(self): |
| 3040 | """ |
| 3041 | If :py:obj:`CRL.export` is used with an uninitialized :py:obj:`X509` |
Jean-Paul Calderone | b587107 | 2012-03-09 14:58:00 -0800 | [diff] [blame] | 3042 | instance, :py:obj:`OpenSSL.crypto.Error` is raised. |
Jean-Paul Calderone | c7293bc | 2011-09-13 15:24:38 -0400 | [diff] [blame] | 3043 | """ |
| 3044 | crl = CRL() |
| 3045 | self.assertRaises(Error, crl.export, X509(), PKey()) |
| 3046 | |
Jean-Paul Calderone | 5651534 | 2010-01-30 13:49:38 -0500 | [diff] [blame] | 3047 | def test_add_revoked_keyword(self): |
| 3048 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 3049 | :py:obj:`OpenSSL.CRL.add_revoked` accepts its single argument as the |
Jean-Paul Calderone | 64efa2c | 2011-09-11 10:00:09 -0400 | [diff] [blame] | 3050 | ``revoked`` keyword argument. |
Jean-Paul Calderone | 5651534 | 2010-01-30 13:49:38 -0500 | [diff] [blame] | 3051 | """ |
| 3052 | crl = CRL() |
| 3053 | revoked = Revoked() |
| 3054 | crl.add_revoked(revoked=revoked) |
| 3055 | self.assertTrue(isinstance(crl.get_revoked()[0], Revoked)) |
| 3056 | |
Jean-Paul Calderone | 883ca4b | 2010-01-30 13:55:13 -0500 | [diff] [blame] | 3057 | def test_export_wrong_args(self): |
| 3058 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 3059 | Calling :py:obj:`OpenSSL.CRL.export` with fewer than two or more than |
Jean-Paul Calderone | f151586 | 2010-01-30 13:57:03 -0500 | [diff] [blame] | 3060 | four arguments, or with arguments other than the certificate, |
| 3061 | private key, integer file type, and integer number of days it |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 3062 | expects, results in a :py:obj:`TypeError` being raised. |
Jean-Paul Calderone | 883ca4b | 2010-01-30 13:55:13 -0500 | [diff] [blame] | 3063 | """ |
| 3064 | crl = CRL() |
| 3065 | self.assertRaises(TypeError, crl.export) |
| 3066 | self.assertRaises(TypeError, crl.export, self.cert) |
Bulat Gaifullin | 925f786 | 2014-09-22 10:10:44 +0400 | [diff] [blame] | 3067 | self.assertRaises(TypeError, crl.export, self.cert, self.pkey, FILETYPE_PEM, 10, "md5", "foo") |
Jean-Paul Calderone | 883ca4b | 2010-01-30 13:55:13 -0500 | [diff] [blame] | 3068 | |
Jean-Paul Calderone | f151586 | 2010-01-30 13:57:03 -0500 | [diff] [blame] | 3069 | self.assertRaises(TypeError, crl.export, None, self.pkey, FILETYPE_PEM, 10) |
| 3070 | self.assertRaises(TypeError, crl.export, self.cert, None, FILETYPE_PEM, 10) |
| 3071 | self.assertRaises(TypeError, crl.export, self.cert, self.pkey, None, 10) |
| 3072 | self.assertRaises(TypeError, crl.export, self.cert, FILETYPE_PEM, None) |
| 3073 | |
Jean-Paul Calderone | ea19842 | 2010-01-30 13:58:23 -0500 | [diff] [blame] | 3074 | def test_export_unknown_filetype(self): |
| 3075 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 3076 | Calling :py:obj:`OpenSSL.CRL.export` with a file type other than |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 3077 | :py:obj:`FILETYPE_PEM`, :py:obj:`FILETYPE_ASN1`, or |
| 3078 | :py:obj:`FILETYPE_TEXT` results in a :py:obj:`ValueError` being raised. |
Jean-Paul Calderone | ea19842 | 2010-01-30 13:58:23 -0500 | [diff] [blame] | 3079 | """ |
| 3080 | crl = CRL() |
| 3081 | self.assertRaises(ValueError, crl.export, self.cert, self.pkey, 100, 10) |
| 3082 | |
| 3083 | |
Bulat Gaifullin | 925f786 | 2014-09-22 10:10:44 +0400 | [diff] [blame] | 3084 | def test_export_unknown_digest(self): |
Bulat Gaifullin | 5f9eea4 | 2014-09-23 19:35:15 +0400 | [diff] [blame] | 3085 | """ |
Alex Gaynor | ca87ff6 | 2015-09-04 23:31:03 -0400 | [diff] [blame] | 3086 | Calling :py:obj:`OpenSSL.CRL.export` with an unsupported digest results |
Bulat Gaifullin | 5f9eea4 | 2014-09-23 19:35:15 +0400 | [diff] [blame] | 3087 | in a :py:obj:`ValueError` being raised. |
| 3088 | """ |
Bulat Gaifullin | 925f786 | 2014-09-22 10:10:44 +0400 | [diff] [blame] | 3089 | crl = CRL() |
Jean-Paul Calderone | 9be8519 | 2015-04-13 21:20:51 -0400 | [diff] [blame] | 3090 | self.assertRaises( |
| 3091 | ValueError, |
| 3092 | crl.export, |
| 3093 | self.cert, self.pkey, FILETYPE_PEM, 10, b"strange-digest" |
| 3094 | ) |
Bulat Gaifullin | 925f786 | 2014-09-22 10:10:44 +0400 | [diff] [blame] | 3095 | |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3096 | def test_get_revoked(self): |
| 3097 | """ |
Jean-Paul Calderone | b98eae0 | 2010-01-30 13:18:04 -0500 | [diff] [blame] | 3098 | Use python to create a simple CRL with two revocations. |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 3099 | Get back the :py:obj:`Revoked` using :py:obj:`OpenSSL.CRL.get_revoked` |
| 3100 | and verify them. |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3101 | """ |
| 3102 | crl = CRL() |
| 3103 | |
| 3104 | revoked = Revoked() |
Jean-Paul Calderone | b894fe1 | 2010-08-22 19:30:19 -0400 | [diff] [blame] | 3105 | now = b(datetime.now().strftime("%Y%m%d%H%M%SZ")) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3106 | revoked.set_rev_date(now) |
Jean-Paul Calderone | b894fe1 | 2010-08-22 19:30:19 -0400 | [diff] [blame] | 3107 | revoked.set_serial(b('3ab')) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3108 | crl.add_revoked(revoked) |
Jean-Paul Calderone | b894fe1 | 2010-08-22 19:30:19 -0400 | [diff] [blame] | 3109 | revoked.set_serial(b('100')) |
| 3110 | revoked.set_reason(b('sUpErSeDEd')) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3111 | crl.add_revoked(revoked) |
| 3112 | |
| 3113 | revs = crl.get_revoked() |
| 3114 | self.assertEqual(len(revs), 2) |
| 3115 | self.assertEqual(type(revs[0]), Revoked) |
| 3116 | self.assertEqual(type(revs[1]), Revoked) |
Jean-Paul Calderone | b894fe1 | 2010-08-22 19:30:19 -0400 | [diff] [blame] | 3117 | self.assertEqual(revs[0].get_serial(), b('03AB')) |
| 3118 | self.assertEqual(revs[1].get_serial(), b('0100')) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3119 | self.assertEqual(revs[0].get_rev_date(), now) |
| 3120 | self.assertEqual(revs[1].get_rev_date(), now) |
| 3121 | |
Jean-Paul Calderone | 46bdce4 | 2010-01-30 13:44:16 -0500 | [diff] [blame] | 3122 | def test_get_revoked_wrong_args(self): |
| 3123 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 3124 | Calling :py:obj:`OpenSSL.CRL.get_revoked` with any arguments results |
| 3125 | in a :py:obj:`TypeError` being raised. |
Jean-Paul Calderone | 46bdce4 | 2010-01-30 13:44:16 -0500 | [diff] [blame] | 3126 | """ |
| 3127 | crl = CRL() |
| 3128 | self.assertRaises(TypeError, crl.get_revoked, None) |
| 3129 | self.assertRaises(TypeError, crl.get_revoked, 1) |
| 3130 | self.assertRaises(TypeError, crl.get_revoked, "") |
| 3131 | self.assertRaises(TypeError, crl.get_revoked, "", 1, None) |
| 3132 | |
Jean-Paul Calderone | ecef6fa | 2010-01-30 13:47:18 -0500 | [diff] [blame] | 3133 | def test_add_revoked_wrong_args(self): |
| 3134 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 3135 | Calling :py:obj:`OpenSSL.CRL.add_revoked` with other than one |
| 3136 | argument results in a :py:obj:`TypeError` being raised. |
Jean-Paul Calderone | ecef6fa | 2010-01-30 13:47:18 -0500 | [diff] [blame] | 3137 | """ |
| 3138 | crl = CRL() |
| 3139 | self.assertRaises(TypeError, crl.add_revoked) |
| 3140 | self.assertRaises(TypeError, crl.add_revoked, 1, 2) |
| 3141 | self.assertRaises(TypeError, crl.add_revoked, "foo", "bar") |
| 3142 | |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3143 | def test_load_crl(self): |
| 3144 | """ |
| 3145 | Load a known CRL and inspect its revocations. Both |
| 3146 | PEM and DER formats are loaded. |
| 3147 | """ |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3148 | crl = load_crl(FILETYPE_PEM, crlData) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3149 | revs = crl.get_revoked() |
| 3150 | self.assertEqual(len(revs), 2) |
Jean-Paul Calderone | b894fe1 | 2010-08-22 19:30:19 -0400 | [diff] [blame] | 3151 | self.assertEqual(revs[0].get_serial(), b('03AB')) |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 3152 | self.assertEqual(revs[0].get_reason(), None) |
Jean-Paul Calderone | b894fe1 | 2010-08-22 19:30:19 -0400 | [diff] [blame] | 3153 | self.assertEqual(revs[1].get_serial(), b('0100')) |
| 3154 | self.assertEqual(revs[1].get_reason(), b('Superseded')) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3155 | |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 3156 | der = _runopenssl(crlData, b"crl", b"-outform", b"DER") |
Jean-Paul Calderone | b98eae0 | 2010-01-30 13:18:04 -0500 | [diff] [blame] | 3157 | crl = load_crl(FILETYPE_ASN1, der) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3158 | revs = crl.get_revoked() |
| 3159 | self.assertEqual(len(revs), 2) |
Jean-Paul Calderone | b894fe1 | 2010-08-22 19:30:19 -0400 | [diff] [blame] | 3160 | self.assertEqual(revs[0].get_serial(), b('03AB')) |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 3161 | self.assertEqual(revs[0].get_reason(), None) |
Jean-Paul Calderone | b894fe1 | 2010-08-22 19:30:19 -0400 | [diff] [blame] | 3162 | self.assertEqual(revs[1].get_serial(), b('0100')) |
| 3163 | self.assertEqual(revs[1].get_reason(), b('Superseded')) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3164 | |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3165 | def test_load_crl_wrong_args(self): |
| 3166 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 3167 | Calling :py:obj:`OpenSSL.crypto.load_crl` with other than two |
| 3168 | arguments results in a :py:obj:`TypeError` being raised. |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3169 | """ |
| 3170 | self.assertRaises(TypeError, load_crl) |
| 3171 | self.assertRaises(TypeError, load_crl, FILETYPE_PEM) |
| 3172 | self.assertRaises(TypeError, load_crl, FILETYPE_PEM, crlData, None) |
| 3173 | |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3174 | def test_load_crl_bad_filetype(self): |
| 3175 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 3176 | Calling :py:obj:`OpenSSL.crypto.load_crl` with an unknown file type |
| 3177 | raises a :py:obj:`ValueError`. |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3178 | """ |
| 3179 | self.assertRaises(ValueError, load_crl, 100, crlData) |
| 3180 | |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3181 | def test_load_crl_bad_data(self): |
| 3182 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 3183 | Calling :py:obj:`OpenSSL.crypto.load_crl` with file data which can't |
| 3184 | be loaded raises a :py:obj:`OpenSSL.crypto.Error`. |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3185 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 3186 | self.assertRaises(Error, load_crl, FILETYPE_PEM, b"hello, world") |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3187 | |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 3188 | |
Stephen Holsapple | 08ffaa6 | 2015-01-30 17:18:40 -0800 | [diff] [blame] | 3189 | class X509StoreContextTests(TestCase): |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3190 | """ |
Stephen Holsapple | 08ffaa6 | 2015-01-30 17:18:40 -0800 | [diff] [blame] | 3191 | Tests for :py:obj:`OpenSSL.crypto.X509StoreContext`. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3192 | """ |
| 3193 | root_cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
| 3194 | intermediate_cert = load_certificate(FILETYPE_PEM, intermediate_cert_pem) |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 3195 | intermediate_server_cert = load_certificate( |
| 3196 | FILETYPE_PEM, intermediate_server_cert_pem) |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3197 | |
| 3198 | def test_valid(self): |
| 3199 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 3200 | :py:obj:`verify_certificate` returns ``None`` when called with a |
| 3201 | certificate and valid chain. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3202 | """ |
| 3203 | store = X509Store() |
| 3204 | store.add_cert(self.root_cert) |
| 3205 | store.add_cert(self.intermediate_cert) |
| 3206 | store_ctx = X509StoreContext(store, self.intermediate_server_cert) |
Stephen Holsapple | 08ffaa6 | 2015-01-30 17:18:40 -0800 | [diff] [blame] | 3207 | self.assertEqual(store_ctx.verify_certificate(), None) |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3208 | |
| 3209 | def test_reuse(self): |
| 3210 | """ |
Stephen Holsapple | 08ffaa6 | 2015-01-30 17:18:40 -0800 | [diff] [blame] | 3211 | :py:obj:`verify_certificate` can be called multiple times with the same |
Jean-Paul Calderone | 06e01b9 | 2015-01-18 15:43:13 -0500 | [diff] [blame] | 3212 | ``X509StoreContext`` instance to produce the same result. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3213 | """ |
| 3214 | store = X509Store() |
| 3215 | store.add_cert(self.root_cert) |
| 3216 | store.add_cert(self.intermediate_cert) |
| 3217 | store_ctx = X509StoreContext(store, self.intermediate_server_cert) |
Stephen Holsapple | 08ffaa6 | 2015-01-30 17:18:40 -0800 | [diff] [blame] | 3218 | self.assertEqual(store_ctx.verify_certificate(), None) |
| 3219 | self.assertEqual(store_ctx.verify_certificate(), None) |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3220 | |
| 3221 | def test_trusted_self_signed(self): |
| 3222 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 3223 | :py:obj:`verify_certificate` returns ``None`` when called with a |
| 3224 | self-signed certificate and itself in the chain. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3225 | """ |
| 3226 | store = X509Store() |
| 3227 | store.add_cert(self.root_cert) |
| 3228 | store_ctx = X509StoreContext(store, self.root_cert) |
Stephen Holsapple | 08ffaa6 | 2015-01-30 17:18:40 -0800 | [diff] [blame] | 3229 | self.assertEqual(store_ctx.verify_certificate(), None) |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3230 | |
| 3231 | def test_untrusted_self_signed(self): |
| 3232 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 3233 | :py:obj:`verify_certificate` raises error when a self-signed |
| 3234 | certificate is verified without itself in the chain. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3235 | """ |
| 3236 | store = X509Store() |
| 3237 | store_ctx = X509StoreContext(store, self.root_cert) |
Stephen Holsapple | 08ffaa6 | 2015-01-30 17:18:40 -0800 | [diff] [blame] | 3238 | e = self.assertRaises(X509StoreContextError, store_ctx.verify_certificate) |
Jean-Paul Calderone | 4c10a1e | 2015-01-18 16:31:27 -0500 | [diff] [blame] | 3239 | self.assertEqual(e.args[0][2], 'self signed certificate') |
Jean-Paul Calderone | 06e01b9 | 2015-01-18 15:43:13 -0500 | [diff] [blame] | 3240 | self.assertEqual(e.certificate.get_subject().CN, 'Testing Root CA') |
Jean-Paul Calderone | 517816e | 2015-01-18 15:39:26 -0500 | [diff] [blame] | 3241 | |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3242 | def test_invalid_chain_no_root(self): |
| 3243 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 3244 | :py:obj:`verify_certificate` raises error when a root certificate is |
| 3245 | missing from the chain. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3246 | """ |
| 3247 | store = X509Store() |
| 3248 | store.add_cert(self.intermediate_cert) |
| 3249 | store_ctx = X509StoreContext(store, self.intermediate_server_cert) |
Stephen Holsapple | 08ffaa6 | 2015-01-30 17:18:40 -0800 | [diff] [blame] | 3250 | e = self.assertRaises(X509StoreContextError, store_ctx.verify_certificate) |
Jean-Paul Calderone | 4c10a1e | 2015-01-18 16:31:27 -0500 | [diff] [blame] | 3251 | self.assertEqual(e.args[0][2], 'unable to get issuer certificate') |
Jean-Paul Calderone | 06e01b9 | 2015-01-18 15:43:13 -0500 | [diff] [blame] | 3252 | self.assertEqual(e.certificate.get_subject().CN, 'intermediate') |
Jean-Paul Calderone | 517816e | 2015-01-18 15:39:26 -0500 | [diff] [blame] | 3253 | |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3254 | def test_invalid_chain_no_intermediate(self): |
| 3255 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 3256 | :py:obj:`verify_certificate` raises error when an intermediate |
| 3257 | certificate is missing from the chain. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3258 | """ |
| 3259 | store = X509Store() |
| 3260 | store.add_cert(self.root_cert) |
| 3261 | store_ctx = X509StoreContext(store, self.intermediate_server_cert) |
Stephen Holsapple | 08ffaa6 | 2015-01-30 17:18:40 -0800 | [diff] [blame] | 3262 | e = self.assertRaises(X509StoreContextError, store_ctx.verify_certificate) |
Jean-Paul Calderone | 4c10a1e | 2015-01-18 16:31:27 -0500 | [diff] [blame] | 3263 | self.assertEqual(e.args[0][2], 'unable to get local issuer certificate') |
Jean-Paul Calderone | 06e01b9 | 2015-01-18 15:43:13 -0500 | [diff] [blame] | 3264 | self.assertEqual(e.certificate.get_subject().CN, 'intermediate-service') |
Jean-Paul Calderone | 517816e | 2015-01-18 15:39:26 -0500 | [diff] [blame] | 3265 | |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3266 | |
Stephen Holsapple | 46a0925 | 2015-02-12 14:45:43 -0800 | [diff] [blame] | 3267 | def test_modification_pre_verify(self): |
| 3268 | """ |
| 3269 | :py:obj:`verify_certificate` can use a store context modified after |
| 3270 | instantiation. |
| 3271 | """ |
| 3272 | store_bad = X509Store() |
| 3273 | store_bad.add_cert(self.intermediate_cert) |
| 3274 | store_good = X509Store() |
| 3275 | store_good.add_cert(self.root_cert) |
| 3276 | store_good.add_cert(self.intermediate_cert) |
| 3277 | store_ctx = X509StoreContext(store_bad, self.intermediate_server_cert) |
| 3278 | e = self.assertRaises(X509StoreContextError, store_ctx.verify_certificate) |
| 3279 | self.assertEqual(e.args[0][2], 'unable to get issuer certificate') |
| 3280 | self.assertEqual(e.certificate.get_subject().CN, 'intermediate') |
| 3281 | store_ctx.set_store(store_good) |
| 3282 | self.assertEqual(store_ctx.verify_certificate(), None) |
| 3283 | |
| 3284 | |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3285 | class SignVerifyTests(TestCase): |
| 3286 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 3287 | Tests for :py:obj:`OpenSSL.crypto.sign` and |
| 3288 | :py:obj:`OpenSSL.crypto.verify`. |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3289 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 3290 | |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3291 | def test_sign_verify(self): |
Jean-Paul Calderone | f3cb9d8 | 2010-06-22 10:29:33 -0400 | [diff] [blame] | 3292 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 3293 | :py:obj:`sign` generates a cryptographic signature which |
| 3294 | :py:obj:`verify` can check. |
Jean-Paul Calderone | f3cb9d8 | 2010-06-22 10:29:33 -0400 | [diff] [blame] | 3295 | """ |
Jean-Paul Calderone | ea305c5 | 2010-08-28 14:41:07 -0400 | [diff] [blame] | 3296 | content = b( |
Jean-Paul Calderone | b98ce21 | 2010-06-22 09:46:27 -0400 | [diff] [blame] | 3297 | "It was a bright cold day in April, and the clocks were striking " |
| 3298 | "thirteen. Winston Smith, his chin nuzzled into his breast in an " |
| 3299 | "effort to escape the vile wind, slipped quickly through the " |
| 3300 | "glass doors of Victory Mansions, though not quickly enough to " |
| 3301 | "prevent a swirl of gritty dust from entering along with him.") |
| 3302 | |
| 3303 | # sign the content with this private key |
Jean-Paul Calderone | f3cb9d8 | 2010-06-22 10:29:33 -0400 | [diff] [blame] | 3304 | priv_key = load_privatekey(FILETYPE_PEM, root_key_pem) |
Jean-Paul Calderone | b98ce21 | 2010-06-22 09:46:27 -0400 | [diff] [blame] | 3305 | # verify the content with this cert |
| 3306 | good_cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
| 3307 | # certificate unrelated to priv_key, used to trigger an error |
| 3308 | bad_cert = load_certificate(FILETYPE_PEM, server_cert_pem) |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3309 | |
Jean-Paul Calderone | d08feb0 | 2010-10-12 21:53:24 -0400 | [diff] [blame] | 3310 | for digest in ['md5', 'sha1']: |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3311 | sig = sign(priv_key, content, digest) |
| 3312 | |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 3313 | # Verify the signature of content, will throw an exception if |
| 3314 | # error. |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3315 | verify(good_cert, sig, content, digest) |
| 3316 | |
| 3317 | # This should fail because the certificate doesn't match the |
| 3318 | # private key that was used to sign the content. |
| 3319 | self.assertRaises(Error, verify, bad_cert, sig, content, digest) |
| 3320 | |
| 3321 | # This should fail because we've "tainted" the content after |
| 3322 | # signing it. |
Jean-Paul Calderone | ea305c5 | 2010-08-28 14:41:07 -0400 | [diff] [blame] | 3323 | self.assertRaises( |
| 3324 | Error, verify, |
| 3325 | good_cert, sig, content + b("tainted"), digest) |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3326 | |
| 3327 | # test that unknown digest types fail |
Jean-Paul Calderone | ea305c5 | 2010-08-28 14:41:07 -0400 | [diff] [blame] | 3328 | self.assertRaises( |
Jean-Paul Calderone | 9538f14 | 2010-10-13 22:13:40 -0400 | [diff] [blame] | 3329 | ValueError, sign, priv_key, content, "strange-digest") |
Jean-Paul Calderone | ea305c5 | 2010-08-28 14:41:07 -0400 | [diff] [blame] | 3330 | self.assertRaises( |
Jean-Paul Calderone | 9538f14 | 2010-10-13 22:13:40 -0400 | [diff] [blame] | 3331 | ValueError, verify, good_cert, sig, content, "strange-digest") |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3332 | |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 3333 | def test_sign_verify_with_text(self): |
| 3334 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 3335 | :py:obj:`sign` generates a cryptographic signature which |
| 3336 | :py:obj:`verify` can check. Deprecation warnings raised because using |
| 3337 | text instead of bytes as content |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 3338 | """ |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 3339 | content = ( |
Jean-Paul Calderone | 362c1f5 | 2015-03-29 08:01:39 -0400 | [diff] [blame] | 3340 | b"It was a bright cold day in April, and the clocks were striking " |
| 3341 | b"thirteen. Winston Smith, his chin nuzzled into his breast in an " |
| 3342 | b"effort to escape the vile wind, slipped quickly through the " |
| 3343 | b"glass doors of Victory Mansions, though not quickly enough to " |
| 3344 | b"prevent a swirl of gritty dust from entering along with him." |
Jean-Paul Calderone | 13a0e65 | 2015-03-29 07:58:51 -0400 | [diff] [blame] | 3345 | ).decode("ascii") |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 3346 | |
| 3347 | priv_key = load_privatekey(FILETYPE_PEM, root_key_pem) |
| 3348 | cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
| 3349 | for digest in ['md5', 'sha1']: |
| 3350 | with catch_warnings(record=True) as w: |
| 3351 | simplefilter("always") |
| 3352 | sig = sign(priv_key, content, digest) |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 3353 | |
| 3354 | self.assertEqual( |
Jean-Paul Calderone | 13a0e65 | 2015-03-29 07:58:51 -0400 | [diff] [blame] | 3355 | "{0} for data is no longer accepted, use bytes".format( |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 3356 | WARNING_TYPE_EXPECTED |
| 3357 | ), |
| 3358 | str(w[-1].message) |
| 3359 | ) |
| 3360 | self.assertIs(w[-1].category, DeprecationWarning) |
| 3361 | |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 3362 | with catch_warnings(record=True) as w: |
| 3363 | simplefilter("always") |
| 3364 | verify(cert, sig, content, digest) |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 3365 | |
| 3366 | self.assertEqual( |
Jean-Paul Calderone | 13a0e65 | 2015-03-29 07:58:51 -0400 | [diff] [blame] | 3367 | "{0} for data is no longer accepted, use bytes".format( |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 3368 | WARNING_TYPE_EXPECTED |
| 3369 | ), |
| 3370 | str(w[-1].message) |
| 3371 | ) |
| 3372 | self.assertIs(w[-1].category, DeprecationWarning) |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 3373 | |
Jean-Paul Calderone | 9828f66 | 2010-12-08 22:57:26 -0500 | [diff] [blame] | 3374 | def test_sign_nulls(self): |
| 3375 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 3376 | :py:obj:`sign` produces a signature for a string with embedded nulls. |
Jean-Paul Calderone | 9828f66 | 2010-12-08 22:57:26 -0500 | [diff] [blame] | 3377 | """ |
| 3378 | content = b("Watch out! \0 Did you see it?") |
| 3379 | priv_key = load_privatekey(FILETYPE_PEM, root_key_pem) |
| 3380 | good_cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
| 3381 | sig = sign(priv_key, content, "sha1") |
| 3382 | verify(good_cert, sig, content, "sha1") |
| 3383 | |
| 3384 | |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3385 | class EllipticCurveTests(TestCase): |
| 3386 | """ |
| 3387 | Tests for :py:class:`_EllipticCurve`, :py:obj:`get_elliptic_curve`, and |
| 3388 | :py:obj:`get_elliptic_curves`. |
| 3389 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 3390 | |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3391 | def test_set(self): |
| 3392 | """ |
| 3393 | :py:obj:`get_elliptic_curves` returns a :py:obj:`set`. |
| 3394 | """ |
| 3395 | self.assertIsInstance(get_elliptic_curves(), set) |
| 3396 | |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3397 | def test_some_curves(self): |
| 3398 | """ |
| 3399 | If :py:mod:`cryptography` has elliptic curve support then the set |
| 3400 | returned by :py:obj:`get_elliptic_curves` has some elliptic curves in |
| 3401 | it. |
| 3402 | |
| 3403 | There could be an OpenSSL that violates this assumption. If so, this |
| 3404 | test will fail and we'll find out. |
| 3405 | """ |
| 3406 | curves = get_elliptic_curves() |
| 3407 | if lib.Cryptography_HAS_EC: |
| 3408 | self.assertTrue(curves) |
| 3409 | else: |
| 3410 | self.assertFalse(curves) |
| 3411 | |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3412 | def test_a_curve(self): |
| 3413 | """ |
| 3414 | :py:obj:`get_elliptic_curve` can be used to retrieve a particular |
| 3415 | supported curve. |
| 3416 | """ |
| 3417 | curves = get_elliptic_curves() |
| 3418 | if curves: |
| 3419 | curve = next(iter(curves)) |
| 3420 | self.assertEqual(curve.name, get_elliptic_curve(curve.name).name) |
| 3421 | else: |
Jean-Paul Calderone | eb86f3a | 2014-04-19 09:45:57 -0400 | [diff] [blame] | 3422 | self.assertRaises(ValueError, get_elliptic_curve, u("prime256v1")) |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3423 | |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3424 | def test_not_a_curve(self): |
| 3425 | """ |
| 3426 | :py:obj:`get_elliptic_curve` raises :py:class:`ValueError` if called |
| 3427 | with a name which does not identify a supported curve. |
| 3428 | """ |
| 3429 | self.assertRaises( |
Jean-Paul Calderone | 5a82db9 | 2014-04-19 09:51:29 -0400 | [diff] [blame] | 3430 | ValueError, get_elliptic_curve, u("this curve was just invented")) |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3431 | |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3432 | def test_repr(self): |
| 3433 | """ |
| 3434 | The string representation of a curve object includes simply states the |
| 3435 | object is a curve and what its name is. |
| 3436 | """ |
| 3437 | curves = get_elliptic_curves() |
| 3438 | if curves: |
| 3439 | curve = next(iter(curves)) |
| 3440 | self.assertEqual("<Curve %r>" % (curve.name,), repr(curve)) |
| 3441 | |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3442 | def test_to_EC_KEY(self): |
| 3443 | """ |
| 3444 | The curve object can export a version of itself as an EC_KEY* via the |
| 3445 | private :py:meth:`_EllipticCurve._to_EC_KEY`. |
| 3446 | """ |
| 3447 | curves = get_elliptic_curves() |
| 3448 | if curves: |
| 3449 | curve = next(iter(curves)) |
| 3450 | # It's not easy to assert anything about this object. However, see |
| 3451 | # leakcheck/crypto.py for a test that demonstrates it at least does |
| 3452 | # not leak memory. |
| 3453 | curve._to_EC_KEY() |
| 3454 | |
| 3455 | |
Jean-Paul Calderone | 1be7708 | 2014-04-30 18:17:41 -0400 | [diff] [blame] | 3456 | class EllipticCurveFactory(object): |
| 3457 | """ |
| 3458 | A helper to get the names of two curves. |
| 3459 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 3460 | |
Jean-Paul Calderone | 1be7708 | 2014-04-30 18:17:41 -0400 | [diff] [blame] | 3461 | def __init__(self): |
| 3462 | curves = iter(get_elliptic_curves()) |
| 3463 | try: |
| 3464 | self.curve_name = next(curves).name |
| 3465 | self.another_curve_name = next(curves).name |
| 3466 | except StopIteration: |
| 3467 | self.curve_name = self.another_curve_name = None |
| 3468 | |
| 3469 | |
Jean-Paul Calderone | 1be7708 | 2014-04-30 18:17:41 -0400 | [diff] [blame] | 3470 | class EllipticCurveEqualityTests(TestCase, EqualityTestsMixin): |
| 3471 | """ |
| 3472 | Tests :py:type:`_EllipticCurve`\ 's implementation of ``==`` and ``!=``. |
| 3473 | """ |
| 3474 | curve_factory = EllipticCurveFactory() |
| 3475 | |
| 3476 | if curve_factory.curve_name is None: |
| 3477 | skip = "There are no curves available there can be no curve objects." |
| 3478 | |
Jean-Paul Calderone | 1be7708 | 2014-04-30 18:17:41 -0400 | [diff] [blame] | 3479 | def anInstance(self): |
| 3480 | """ |
| 3481 | Get the curve object for an arbitrary curve supported by the system. |
| 3482 | """ |
| 3483 | return get_elliptic_curve(self.curve_factory.curve_name) |
| 3484 | |
Jean-Paul Calderone | 1be7708 | 2014-04-30 18:17:41 -0400 | [diff] [blame] | 3485 | def anotherInstance(self): |
| 3486 | """ |
| 3487 | Get the curve object for an arbitrary curve supported by the system - |
| 3488 | but not the one returned by C{anInstance}. |
| 3489 | """ |
| 3490 | return get_elliptic_curve(self.curve_factory.another_curve_name) |
| 3491 | |
| 3492 | |
Jean-Paul Calderone | 22c3124 | 2014-05-01 07:49:47 -0400 | [diff] [blame] | 3493 | class EllipticCurveHashTests(TestCase): |
| 3494 | """ |
| 3495 | Tests for :py:type:`_EllipticCurve`\ 's implementation of hashing (thus use |
| 3496 | as an item in a :py:type:`dict` or :py:type:`set`). |
| 3497 | """ |
| 3498 | curve_factory = EllipticCurveFactory() |
| 3499 | |
| 3500 | if curve_factory.curve_name is None: |
| 3501 | skip = "There are no curves available there can be no curve objects." |
| 3502 | |
Jean-Paul Calderone | 22c3124 | 2014-05-01 07:49:47 -0400 | [diff] [blame] | 3503 | def test_contains(self): |
| 3504 | """ |
| 3505 | The ``in`` operator reports that a :py:type:`set` containing a curve |
| 3506 | does contain that curve. |
| 3507 | """ |
| 3508 | curve = get_elliptic_curve(self.curve_factory.curve_name) |
| 3509 | curves = set([curve]) |
| 3510 | self.assertIn(curve, curves) |
| 3511 | |
Jean-Paul Calderone | 22c3124 | 2014-05-01 07:49:47 -0400 | [diff] [blame] | 3512 | def test_does_not_contain(self): |
| 3513 | """ |
| 3514 | The ``in`` operator reports that a :py:type:`set` not containing a |
| 3515 | curve does not contain that curve. |
| 3516 | """ |
| 3517 | curve = get_elliptic_curve(self.curve_factory.curve_name) |
| 3518 | curves = set([get_elliptic_curve(self.curve_factory.another_curve_name)]) |
| 3519 | self.assertNotIn(curve, curves) |
| 3520 | |
| 3521 | |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 3522 | if __name__ == '__main__': |
| 3523 | main() |