Jean-Paul Calderone | 8671c85 | 2011-03-02 19:26:20 -0500 | [diff] [blame] | 1 | # Copyright (c) Jean-Paul Calderone |
| 2 | # See LICENSE file for details. |
Jean-Paul Calderone | 8b63d45 | 2008-03-21 18:31:12 -0400 | [diff] [blame] | 3 | |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 4 | """ |
Jonathan Ballet | 648875f | 2011-07-16 14:14:58 +0900 | [diff] [blame] | 5 | Unit tests for :py:mod:`OpenSSL.crypto`. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 6 | """ |
| 7 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 8 | from warnings import simplefilter |
Jean-Paul Calderone | 0b88b6a | 2009-07-05 12:44:41 -0400 | [diff] [blame] | 9 | |
Alex Gaynor | 4b9c96a | 2014-08-14 09:51:48 -0700 | [diff] [blame] | 10 | import base64 |
Jean-Paul Calderone | 62ca8da | 2010-08-11 19:58:08 -0400 | [diff] [blame] | 11 | from subprocess import PIPE, Popen |
Rick Dean | 47262da | 2009-07-08 16:17:17 -0500 | [diff] [blame] | 12 | from datetime import datetime, timedelta |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 13 | |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 14 | import pytest |
| 15 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 16 | from six import binary_type |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 17 | |
Alex Gaynor | 9939ba1 | 2017-06-25 16:28:24 -0400 | [diff] [blame] | 18 | from cryptography import x509 |
Paul Kehrer | 72d968b | 2016-07-29 15:31:04 +0800 | [diff] [blame] | 19 | from cryptography.hazmat.backends.openssl.backend import backend |
| 20 | from cryptography.hazmat.primitives import serialization |
| 21 | from cryptography.hazmat.primitives.asymmetric import rsa |
| 22 | |
Alex Gaynor | e466bc9 | 2017-07-06 23:43:47 -0400 | [diff] [blame] | 23 | import flaky |
| 24 | |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 25 | from OpenSSL.crypto import TYPE_RSA, TYPE_DSA, Error, PKey, PKeyType |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 26 | from OpenSSL.crypto import X509, X509Type, X509Name, X509NameType |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 27 | from OpenSSL.crypto import ( |
Dan Sully | 44e767a | 2016-06-04 18:05:27 -0700 | [diff] [blame] | 28 | X509Store, |
| 29 | X509StoreFlags, |
| 30 | X509StoreType, |
| 31 | X509StoreContext, |
| 32 | X509StoreContextError |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 33 | ) |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 34 | from OpenSSL.crypto import X509Req, X509ReqType |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 35 | from OpenSSL.crypto import X509Extension, X509ExtensionType |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 36 | from OpenSSL.crypto import load_certificate, load_privatekey |
Cory Benfield | 6492f7c | 2015-10-27 16:57:58 +0900 | [diff] [blame] | 37 | from OpenSSL.crypto import load_publickey, dump_publickey |
Jean-Paul Calderone | f17e421 | 2009-04-01 14:21:40 -0400 | [diff] [blame] | 38 | from OpenSSL.crypto import FILETYPE_PEM, FILETYPE_ASN1, FILETYPE_TEXT |
Jean-Paul Calderone | 7191986 | 2009-04-01 13:01:19 -0400 | [diff] [blame] | 39 | from OpenSSL.crypto import dump_certificate, load_certificate_request |
| 40 | from OpenSSL.crypto import dump_certificate_request, dump_privatekey |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 41 | from OpenSSL.crypto import PKCS7, PKCS7Type, load_pkcs7_data |
Jean-Paul Calderone | 9178ee6 | 2010-01-25 17:55:30 -0500 | [diff] [blame] | 42 | from OpenSSL.crypto import PKCS12, PKCS12Type, load_pkcs12 |
Dominic Chen | f05b212 | 2015-10-13 16:32:35 +0000 | [diff] [blame] | 43 | from OpenSSL.crypto import CRL, Revoked, dump_crl, load_crl |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 44 | from OpenSSL.crypto import NetscapeSPKI, NetscapeSPKIType |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 45 | from OpenSSL.crypto import ( |
| 46 | sign, verify, get_elliptic_curve, get_elliptic_curves) |
Hynek Schlawack | f0e6685 | 2015-10-16 20:18:38 +0200 | [diff] [blame] | 47 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 48 | from .util import EqualityTestsMixin, is_consistent_type, WARNING_TYPE_EXPECTED |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 49 | |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 50 | |
Jean-Paul Calderone | 9da338d | 2011-05-04 11:40:54 -0400 | [diff] [blame] | 51 | def normalize_privatekey_pem(pem): |
| 52 | return dump_privatekey(FILETYPE_PEM, load_privatekey(FILETYPE_PEM, pem)) |
| 53 | |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 54 | |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 55 | GOOD_CIPHER = "blowfish" |
| 56 | BAD_CIPHER = "zippers" |
| 57 | |
Anthony Alba | 2ce737f | 2015-12-04 11:04:56 +0800 | [diff] [blame] | 58 | GOOD_DIGEST = "SHA1" |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 59 | BAD_DIGEST = "monkeys" |
| 60 | |
Paul Kehrer | a40898b | 2017-06-11 16:30:58 -1000 | [diff] [blame] | 61 | old_root_cert_pem = b"""-----BEGIN CERTIFICATE----- |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 62 | MIIC7TCCAlagAwIBAgIIPQzE4MbeufQwDQYJKoZIhvcNAQEFBQAwWDELMAkGA1UE |
| 63 | BhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQHEwdDaGljYWdvMRAwDgYDVQQKEwdU |
| 64 | ZXN0aW5nMRgwFgYDVQQDEw9UZXN0aW5nIFJvb3QgQ0EwIhgPMjAwOTAzMjUxMjM2 |
| 65 | NThaGA8yMDE3MDYxMTEyMzY1OFowWDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAklM |
| 66 | MRAwDgYDVQQHEwdDaGljYWdvMRAwDgYDVQQKEwdUZXN0aW5nMRgwFgYDVQQDEw9U |
| 67 | ZXN0aW5nIFJvb3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAPmaQumL |
| 68 | urpE527uSEHdL1pqcDRmWzu+98Y6YHzT/J7KWEamyMCNZ6fRW1JCR782UQ8a07fy |
| 69 | 2xXsKy4WdKaxyG8CcatwmXvpvRQ44dSANMihHELpANTdyVp6DCysED6wkQFurHlF |
| 70 | 1dshEaJw8b/ypDhmbVIo6Ci1xvCJqivbLFnbAgMBAAGjgbswgbgwHQYDVR0OBBYE |
| 71 | FINVdy1eIfFJDAkk51QJEo3IfgSuMIGIBgNVHSMEgYAwfoAUg1V3LV4h8UkMCSTn |
| 72 | VAkSjch+BK6hXKRaMFgxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJJTDEQMA4GA1UE |
| 73 | BxMHQ2hpY2FnbzEQMA4GA1UEChMHVGVzdGluZzEYMBYGA1UEAxMPVGVzdGluZyBS |
| 74 | b290IENBggg9DMTgxt659DAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GB |
| 75 | AGGCDazMJGoWNBpc03u6+smc95dEead2KlZXBATOdFT1VesY3+nUOqZhEhTGlDMi |
| 76 | hkgaZnzoIq/Uamidegk4hirsCT/R+6vsKAAxNTcBjUeZjlykCJWy5ojShGftXIKY |
| 77 | w/njVbKMXrvc83qmTdGl3TAM0fxQIpqgcglFLveEBgzn |
| 78 | -----END CERTIFICATE----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 79 | """ |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 80 | |
Paul Kehrer | a40898b | 2017-06-11 16:30:58 -1000 | [diff] [blame] | 81 | root_cert_pem = b"""-----BEGIN CERTIFICATE----- |
| 82 | MIIC6TCCAlKgAwIBAgIIPQzE4MbeufQwDQYJKoZIhvcNAQEFBQAwWDELMAkGA1UE |
| 83 | BhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQHEwdDaGljYWdvMRAwDgYDVQQKEwdU |
| 84 | ZXN0aW5nMRgwFgYDVQQDEw9UZXN0aW5nIFJvb3QgQ0EwHhcNMTcwNjExMjIzMjU5 |
| 85 | WhcNMzcwNjA2MjIzMjU5WjBYMQswCQYDVQQGEwJVUzELMAkGA1UECBMCSUwxEDAO |
| 86 | BgNVBAcTB0NoaWNhZ28xEDAOBgNVBAoTB1Rlc3RpbmcxGDAWBgNVBAMTD1Rlc3Rp |
| 87 | bmcgUm9vdCBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA+ZpC6Yu6ukTn |
| 88 | bu5IQd0vWmpwNGZbO773xjpgfNP8nspYRqbIwI1np9FbUkJHvzZRDxrTt/LbFewr |
| 89 | LhZ0prHIbwJxq3CZe+m9FDjh1IA0yKEcQukA1N3JWnoMLKwQPrCRAW6seUXV2yER |
| 90 | onDxv/KkOGZtUijoKLXG8ImqK9ssWdsCAwEAAaOBuzCBuDAdBgNVHQ4EFgQUg1V3 |
| 91 | LV4h8UkMCSTnVAkSjch+BK4wgYgGA1UdIwSBgDB+gBSDVXctXiHxSQwJJOdUCRKN |
| 92 | yH4ErqFcpFowWDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQHEwdD |
| 93 | aGljYWdvMRAwDgYDVQQKEwdUZXN0aW5nMRgwFgYDVQQDEw9UZXN0aW5nIFJvb3Qg |
| 94 | Q0GCCD0MxODG3rn0MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEANFYQ |
| 95 | R+T70VcZ+SnvURnwviFgCXeedBzCr21meo+DNHbkp2gudB9W8Xrned/wtUBVymy9 |
| 96 | gjB5jINfU7Lci0H57Evsw96UJJVfhXdUMHpqt1RGCoEd9FWnrDyrSy0NysnBT2bH |
| 97 | lEqxh3aFEUx9IOQ4sgnx1/NOFXBpkRtivl6O0Ec= |
| 98 | -----END CERTIFICATE----- |
| 99 | """ |
| 100 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 101 | root_key_pem = b"""-----BEGIN RSA PRIVATE KEY----- |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 102 | MIICXQIBAAKBgQD5mkLpi7q6ROdu7khB3S9aanA0Zls7vvfGOmB80/yeylhGpsjA |
| 103 | jWen0VtSQke/NlEPGtO38tsV7CsuFnSmschvAnGrcJl76b0UOOHUgDTIoRxC6QDU |
| 104 | 3claegwsrBA+sJEBbqx5RdXbIRGicPG/8qQ4Zm1SKOgotcbwiaor2yxZ2wIDAQAB |
| 105 | AoGBAPCgMpmLxzwDaUmcFbTJUvlLW1hoxNNYSu2jIZm1k/hRAcE60JYwvBkgz3UB |
| 106 | yMEh0AtLxYe0bFk6EHah11tMUPgscbCq73snJ++8koUw+csk22G65hOs51bVb7Aa |
| 107 | 6JBe67oLzdtvgCUFAA2qfrKzWRZzAdhUirQUZgySZk+Xq1pBAkEA/kZG0A6roTSM |
| 108 | BVnx7LnPfsycKUsTumorpXiylZJjTi9XtmzxhrYN6wgZlDOOwOLgSQhszGpxVoMD |
| 109 | u3gByT1b2QJBAPtL3mSKdvwRu/+40zaZLwvSJRxaj0mcE4BJOS6Oqs/hS1xRlrNk |
| 110 | PpQ7WJ4yM6ZOLnXzm2mKyxm50Mv64109FtMCQQDOqS2KkjHaLowTGVxwC0DijMfr |
| 111 | I9Lf8sSQk32J5VWCySWf5gGTfEnpmUa41gKTMJIbqZZLucNuDcOtzUaeWZlZAkA8 |
| 112 | ttXigLnCqR486JDPTi9ZscoZkZ+w7y6e/hH8t6d5Vjt48JVyfjPIaJY+km58LcN3 |
| 113 | 6AWSeGAdtRFHVzR7oHjVAkB4hutvxiOeiIVQNBhM6RSI9aBPMI21DoX2JRoxvNW2 |
| 114 | cbvAhow217X9V0dVerEOKxnNYspXRrh36h7k4mQA+sDq |
| 115 | -----END RSA PRIVATE KEY----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 116 | """ |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 117 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 118 | intermediate_cert_pem = b"""-----BEGIN CERTIFICATE----- |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 119 | MIICVzCCAcCgAwIBAgIRAMPzhm6//0Y/g2pmnHR2C4cwDQYJKoZIhvcNAQENBQAw |
| 120 | WDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQHEwdDaGljYWdvMRAw |
| 121 | DgYDVQQKEwdUZXN0aW5nMRgwFgYDVQQDEw9UZXN0aW5nIFJvb3QgQ0EwHhcNMTQw |
| 122 | ODI4MDIwNDA4WhcNMjQwODI1MDIwNDA4WjBmMRUwEwYDVQQDEwxpbnRlcm1lZGlh |
| 123 | dGUxDDAKBgNVBAoTA29yZzERMA8GA1UECxMIb3JnLXVuaXQxCzAJBgNVBAYTAlVT |
| 124 | MQswCQYDVQQIEwJDQTESMBAGA1UEBxMJU2FuIERpZWdvMIGfMA0GCSqGSIb3DQEB |
| 125 | AQUAA4GNADCBiQKBgQDYcEQw5lfbEQRjr5Yy4yxAHGV0b9Al+Lmu7wLHMkZ/ZMmK |
| 126 | FGIbljbviiD1Nz97Oh2cpB91YwOXOTN2vXHq26S+A5xe8z/QJbBsyghMur88CjdT |
| 127 | 21H2qwMa+r5dCQwEhuGIiZ3KbzB/n4DTMYI5zy4IYPv0pjxShZn4aZTCCK2IUwID |
| 128 | AQABoxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAPIWSkLX |
| 129 | QRMApOjjyC+tMxumT5e2pMqChHmxobQK4NMdrf2VCx+cRT6EmY8sK3/Xl/X8UBQ+ |
| 130 | 9n5zXb1ZwhW/sTWgUvmOceJ4/XVs9FkdWOOn1J0XBch9ZIiFe/s5ASIgG7fUdcUF |
| 131 | 9mAWS6FK2ca3xIh5kIupCXOFa0dPvlw/YUFT |
| 132 | -----END CERTIFICATE----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 133 | """ |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 134 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 135 | intermediate_key_pem = b"""-----BEGIN RSA PRIVATE KEY----- |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 136 | MIICWwIBAAKBgQDYcEQw5lfbEQRjr5Yy4yxAHGV0b9Al+Lmu7wLHMkZ/ZMmKFGIb |
| 137 | ljbviiD1Nz97Oh2cpB91YwOXOTN2vXHq26S+A5xe8z/QJbBsyghMur88CjdT21H2 |
| 138 | qwMa+r5dCQwEhuGIiZ3KbzB/n4DTMYI5zy4IYPv0pjxShZn4aZTCCK2IUwIDAQAB |
| 139 | AoGAfSZVV80pSeOKHTYfbGdNY/jHdU9eFUa/33YWriXU+77EhpIItJjkRRgivIfo |
| 140 | rhFJpBSGmDLblaqepm8emsXMeH4+2QzOYIf0QGGP6E6scjTt1PLqdqKfVJ1a2REN |
| 141 | 147cujNcmFJb/5VQHHMpaPTgttEjlzuww4+BCDPsVRABWrkCQQD3loH36nLoQTtf |
| 142 | +kQq0T6Bs9/UWkTAGo0ND81ALj0F8Ie1oeZg6RNT96RxZ3aVuFTESTv6/TbjWywO |
| 143 | wdzlmV1vAkEA38rTJ6PTwaJlw5OttdDzAXGPB9tDmzh9oSi7cHwQQXizYd8MBYx4 |
| 144 | sjHUKD3dCQnb1dxJFhd3BT5HsnkRMbVZXQJAbXduH17ZTzcIOXc9jHDXYiFVZV5D |
| 145 | 52vV0WCbLzVCZc3jMrtSUKa8lPN5EWrdU3UchWybyG0MR5mX8S5lrF4SoQJAIyUD |
| 146 | DBKaSqpqONCUUx1BTFS9FYrFjzbL4+c1qHCTTPTblt8kUCrDOZjBrKAqeiTmNSum |
| 147 | /qUot9YUBF8m6BuGsQJATHHmdFy/fG1VLkyBp49CAa8tN3Z5r/CgTznI4DfMTf4C |
| 148 | NbRHn2UmYlwQBa+L5lg9phewNe8aEwpPyPLoV85U8Q== |
| 149 | -----END RSA PRIVATE KEY----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 150 | """ |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 151 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 152 | server_cert_pem = b"""-----BEGIN CERTIFICATE----- |
Paul Kehrer | a40898b | 2017-06-11 16:30:58 -1000 | [diff] [blame] | 153 | MIICJDCCAY2gAwIBAgIJAJn/HpR21r/8MA0GCSqGSIb3DQEBBQUAMFgxCzAJBgNV |
| 154 | BAYTAlVTMQswCQYDVQQIDAJJTDEQMA4GA1UEBwwHQ2hpY2FnbzEQMA4GA1UECgwH |
| 155 | VGVzdGluZzEYMBYGA1UEAwwPVGVzdGluZyBSb290IENBMB4XDTE3MDYxMjAwMTA1 |
| 156 | N1oXDTM3MDYwNzAwMTA1N1owGDEWMBQGA1UEAwwNbG92ZWx5IHNlcnZlcjCBnzAN |
| 157 | BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvqb4brndXS2kEL84qXbZXE6LYK+UrhNi |
| 158 | 70sdIM/24NVN7tXkPlOXqrMWhFHHml+aeSpPkH5b1vKnY1TcULmEubnNICtvjmZ5 |
| 159 | SGMQn+J+RmBs1SMd0EgY/0wBBQdlrlYp2QYgm8YC+zxTNSqWvhMFZAgHbj6Un5SS |
| 160 | T8JGBqytjB0CAwEAAaM2MDQwHQYDVR0OBBYEFINVdy1eIfFJDAkk51QJEo3IfgSu |
| 161 | MBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBBQUAA4GBAGki1K6WgHHJ |
| 162 | qC6aY2EowjaWOXLO6jUZIhGk7BA7vMRfNug429AOZ4m5F6OQhzmJmlw67Jyu2FeI |
| 163 | h0VtBuQoHPtjqZXF59oX6hMMmGLMs9pV0UA3fJs5MYA4/V5ZcQy0Ie0QoJNejLzE |
| 164 | 6V1Qz1rRTYLUyEcpI7ZCmBg2KQQI8YZI |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 165 | -----END CERTIFICATE----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 166 | """ |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 167 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 168 | server_key_pem = normalize_privatekey_pem(b"""-----BEGIN RSA PRIVATE KEY----- |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 169 | MIICWwIBAAKBgQC+pvhuud1dLaQQvzipdtlcTotgr5SuE2LvSx0gz/bg1U3u1eQ+ |
| 170 | U5eqsxaEUceaX5p5Kk+QflvW8qdjVNxQuYS5uc0gK2+OZnlIYxCf4n5GYGzVIx3Q |
| 171 | SBj/TAEFB2WuVinZBiCbxgL7PFM1Kpa+EwVkCAduPpSflJJPwkYGrK2MHQIDAQAB |
| 172 | AoGAbwuZ0AR6JveahBaczjfnSpiFHf+mve2UxoQdpyr6ROJ4zg/PLW5K/KXrC48G |
| 173 | j6f3tXMrfKHcpEoZrQWUfYBRCUsGD5DCazEhD8zlxEHahIsqpwA0WWssJA2VOLEN |
| 174 | j6DuV2pCFbw67rfTBkTSo32ahfXxEKev5KswZk0JIzH3ooECQQDgzS9AI89h0gs8 |
| 175 | Dt+1m11Rzqo3vZML7ZIyGApUzVan+a7hbc33nbGRkAXjHaUBJO31it/H6dTO+uwX |
| 176 | msWwNG5ZAkEA2RyFKs5xR5USTFaKLWCgpH/ydV96KPOpBND7TKQx62snDenFNNbn |
| 177 | FwwOhpahld+vqhYk+pfuWWUpQciE+Bu7ZQJASjfT4sQv4qbbKK/scePicnDdx9th |
| 178 | 4e1EeB9xwb+tXXXUo/6Bor/AcUNwfiQ6Zt9PZOK9sR3lMZSsP7rMi7kzuQJABie6 |
| 179 | 1sXXjFH7nNJvRG4S39cIxq8YRYTy68II/dlB2QzGpKxV/POCxbJ/zu0CU79tuYK7 |
| 180 | NaeNCFfH3aeTrX0LyQJAMBWjWmeKM2G2sCExheeQK0ROnaBC8itCECD4Jsve4nqf |
| 181 | r50+LF74iLXFwqysVCebPKMOpDWp/qQ1BbJQIPs7/A== |
| 182 | -----END RSA PRIVATE KEY----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 183 | """) |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 184 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 185 | intermediate_server_cert_pem = b"""-----BEGIN CERTIFICATE----- |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 186 | MIICWDCCAcGgAwIBAgIRAPQFY9jfskSihdiNSNdt6GswDQYJKoZIhvcNAQENBQAw |
| 187 | ZjEVMBMGA1UEAxMMaW50ZXJtZWRpYXRlMQwwCgYDVQQKEwNvcmcxETAPBgNVBAsT |
| 188 | CG9yZy11bml0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVNh |
| 189 | biBEaWVnbzAeFw0xNDA4MjgwMjEwNDhaFw0yNDA4MjUwMjEwNDhaMG4xHTAbBgNV |
| 190 | BAMTFGludGVybWVkaWF0ZS1zZXJ2aWNlMQwwCgYDVQQKEwNvcmcxETAPBgNVBAsT |
| 191 | CG9yZy11bml0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVNh |
| 192 | biBEaWVnbzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqpJZygd+w1faLOr1 |
| 193 | iOAmbBhx5SZWcTCZ/ZjHQTJM7GuPT624QkqsixFghRKdDROwpwnAP7gMRukLqiy4 |
| 194 | +kRuGT5OfyGggL95i2xqA+zehjj08lSTlvGHpePJgCyTavIy5+Ljsj4DKnKyuhxm |
| 195 | biXTRrH83NDgixVkObTEmh/OVK0CAwEAATANBgkqhkiG9w0BAQ0FAAOBgQBa0Npw |
| 196 | UkzjaYEo1OUE1sTI6Mm4riTIHMak4/nswKh9hYup//WVOlr/RBSBtZ7Q/BwbjobN |
| 197 | 3bfAtV7eSAqBsfxYXyof7G1ALANQERkq3+oyLP1iVt08W1WOUlIMPhdCF/QuCwy6 |
| 198 | x9MJLhUCGLJPM+O2rAPWVD9wCmvq10ALsiH3yA== |
| 199 | -----END CERTIFICATE----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 200 | """ |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 201 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 202 | intermediate_server_key_pem = b"""-----BEGIN RSA PRIVATE KEY----- |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 203 | MIICXAIBAAKBgQCqklnKB37DV9os6vWI4CZsGHHlJlZxMJn9mMdBMkzsa49PrbhC |
| 204 | SqyLEWCFEp0NE7CnCcA/uAxG6QuqLLj6RG4ZPk5/IaCAv3mLbGoD7N6GOPTyVJOW |
| 205 | 8Yel48mALJNq8jLn4uOyPgMqcrK6HGZuJdNGsfzc0OCLFWQ5tMSaH85UrQIDAQAB |
| 206 | AoGAIQ594j5zna3/9WaPsTgnmhlesVctt4AAx/n827DA4ayyuHFlXUuVhtoWR5Pk |
| 207 | 5ezj9mtYW8DyeCegABnsu2vZni/CdvU6uiS1Hv6qM1GyYDm9KWgovIP9rQCDSGaz |
| 208 | d57IWVGxx7ODFkm3gN5nxnSBOFVHytuW1J7FBRnEsehRroECQQDXHFOv82JuXDcz |
| 209 | z3+4c74IEURdOHcbycxlppmK9kFqm5lsUdydnnGW+mvwDk0APOB7Wg7vyFyr393e |
| 210 | dpmBDCzNAkEAyv6tVbTKUYhSjW+QhabJo896/EqQEYUmtMXxk4cQnKeR/Ao84Rkf |
| 211 | EqD5IykMUfUI0jJU4DGX+gWZ10a7kNbHYQJAVFCuHNFxS4Cpwo0aqtnzKoZaHY/8 |
| 212 | X9ABZfafSHCtw3Op92M+7ikkrOELXdS9KdKyyqbKJAKNEHF3LbOfB44WIQJAA2N4 |
| 213 | 9UNNVUsXRbElEnYUS529CdUczo4QdVgQjkvk5RiPAUwSdBd9Q0xYnFOlFwEmIowg |
| 214 | ipWJWe0aAlP18ZcEQQJBAL+5lekZ/GUdQoZ4HAsN5a9syrzavJ9VvU1KOOPorPZK |
| 215 | nMRZbbQgP+aSB7yl6K0gaLaZ8XaK0pjxNBh6ASqg9f4= |
| 216 | -----END RSA PRIVATE KEY----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 217 | """ |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 218 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 219 | client_cert_pem = b"""-----BEGIN CERTIFICATE----- |
Paul Kehrer | a40898b | 2017-06-11 16:30:58 -1000 | [diff] [blame] | 220 | MIICIjCCAYugAwIBAgIJAKxpFI5lODkjMA0GCSqGSIb3DQEBBQUAMFgxCzAJBgNV |
| 221 | BAYTAlVTMQswCQYDVQQIDAJJTDEQMA4GA1UEBwwHQ2hpY2FnbzEQMA4GA1UECgwH |
| 222 | VGVzdGluZzEYMBYGA1UEAwwPVGVzdGluZyBSb290IENBMB4XDTE3MDYxMjAwMDQx |
| 223 | M1oXDTM3MDYwNzAwMDQxM1owFjEUMBIGA1UEAwwLdWdseSBjbGllbnQwgZ8wDQYJ |
| 224 | KoZIhvcNAQEBBQADgY0AMIGJAoGBAMBmH9JG02bme0xPipvpjMSlOugyWrauf4at |
| 225 | EdGJn7GQLD8IY2Fu0+Kvv9DFpSPboFKZCsfDVsYoRs+xaJbtt1dJ6ymX7EqKS7gb |
| 226 | 8q+eeZZ14keqyJd5Rm2q6swQtw9ADD3E8cS6GqpQm+8SgxOycISoYz7sO1ugJFqN |
| 227 | jId+W4BFAgMBAAGjNjA0MB0GA1UdDgQWBBSDVXctXiHxSQwJJOdUCRKNyH4ErjAT |
| 228 | BgNVHSUEDDAKBggrBgEFBQcDAjANBgkqhkiG9w0BAQUFAAOBgQAMqcHyweaCOZNN |
| 229 | dWQQOsBKQlL5wqVVZwucHPWqobjxpULKy9gS2ha2zbgkXcB/BnBOSwe0Fm+MJV0T |
| 230 | NbnTghcGJNpEH7VKn4xSLvIGZmnZZWgxeIB16z4GhpkK2fShBJ+6GKZjsgjT0lSH |
| 231 | JRgjHbWutZfZvbSHXr9n7PIphG1Ojg== |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 232 | -----END CERTIFICATE----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 233 | """ |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 234 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 235 | client_key_pem = normalize_privatekey_pem(b"""-----BEGIN RSA PRIVATE KEY----- |
Rick Dean | 94e46fd | 2009-07-18 14:51:24 -0500 | [diff] [blame] | 236 | MIICXgIBAAKBgQDAZh/SRtNm5ntMT4qb6YzEpTroMlq2rn+GrRHRiZ+xkCw/CGNh |
| 237 | btPir7/QxaUj26BSmQrHw1bGKEbPsWiW7bdXSespl+xKiku4G/KvnnmWdeJHqsiX |
| 238 | eUZtqurMELcPQAw9xPHEuhqqUJvvEoMTsnCEqGM+7DtboCRajYyHfluARQIDAQAB |
| 239 | AoGATkZ+NceY5Glqyl4mD06SdcKfV65814vg2EL7V9t8+/mi9rYL8KztSXGlQWPX |
| 240 | zuHgtRoMl78yQ4ZJYOBVo+nsx8KZNRCEBlE19bamSbQLCeQMenWnpeYyQUZ908gF |
| 241 | h6L9qsFVJepgA9RDgAjyDoS5CaWCdCCPCH2lDkdcqC54SVUCQQDseuduc4wi8h4t |
| 242 | V8AahUn9fn9gYfhoNuM0gdguTA0nPLVWz4hy1yJiWYQe0H7NLNNTmCKiLQaJpAbb |
| 243 | TC6vE8C7AkEA0Ee8CMJUc20BnGEmxwgWcVuqFWaKCo8jTH1X38FlATUsyR3krjW2 |
| 244 | dL3yDD9NwHxsYP7nTKp/U8MV7U9IBn4y/wJBAJl7H0/BcLeRmuJk7IqJ7b635iYB |
| 245 | D/9beFUw3MUXmQXZUfyYz39xf6CDZsu1GEdEC5haykeln3Of4M9d/4Kj+FcCQQCY |
| 246 | si6xwT7GzMDkk/ko684AV3KPc/h6G0yGtFIrMg7J3uExpR/VdH2KgwMkZXisSMvw |
| 247 | JJEQjOMCVsEJlRk54WWjAkEAzoZNH6UhDdBK5F38rVt/y4SEHgbSfJHIAmPS32Kq |
| 248 | f6GGcfNpip0Uk7q7udTKuX7Q/buZi/C4YW7u3VKAquv9NA== |
| 249 | -----END RSA PRIVATE KEY----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 250 | """) |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 251 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 252 | cleartextCertificatePEM = b"""-----BEGIN CERTIFICATE----- |
Paul Kehrer | a40898b | 2017-06-11 16:30:58 -1000 | [diff] [blame] | 253 | MIIC6TCCAlKgAwIBAgIIPQzE4MbeufQwDQYJKoZIhvcNAQEFBQAwWDELMAkGA1UE |
Jean-Paul Calderone | 20131f5 | 2009-04-01 12:05:45 -0400 | [diff] [blame] | 254 | BhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQHEwdDaGljYWdvMRAwDgYDVQQKEwdU |
Paul Kehrer | a40898b | 2017-06-11 16:30:58 -1000 | [diff] [blame] | 255 | ZXN0aW5nMRgwFgYDVQQDEw9UZXN0aW5nIFJvb3QgQ0EwHhcNMTcwNjExMjIzMjU5 |
| 256 | WhcNMzcwNjA2MjIzMjU5WjBYMQswCQYDVQQGEwJVUzELMAkGA1UECBMCSUwxEDAO |
| 257 | BgNVBAcTB0NoaWNhZ28xEDAOBgNVBAoTB1Rlc3RpbmcxGDAWBgNVBAMTD1Rlc3Rp |
| 258 | bmcgUm9vdCBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA+ZpC6Yu6ukTn |
| 259 | bu5IQd0vWmpwNGZbO773xjpgfNP8nspYRqbIwI1np9FbUkJHvzZRDxrTt/LbFewr |
| 260 | LhZ0prHIbwJxq3CZe+m9FDjh1IA0yKEcQukA1N3JWnoMLKwQPrCRAW6seUXV2yER |
| 261 | onDxv/KkOGZtUijoKLXG8ImqK9ssWdsCAwEAAaOBuzCBuDAdBgNVHQ4EFgQUg1V3 |
| 262 | LV4h8UkMCSTnVAkSjch+BK4wgYgGA1UdIwSBgDB+gBSDVXctXiHxSQwJJOdUCRKN |
| 263 | yH4ErqFcpFowWDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQHEwdD |
| 264 | aGljYWdvMRAwDgYDVQQKEwdUZXN0aW5nMRgwFgYDVQQDEw9UZXN0aW5nIFJvb3Qg |
| 265 | Q0GCCD0MxODG3rn0MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEANFYQ |
| 266 | R+T70VcZ+SnvURnwviFgCXeedBzCr21meo+DNHbkp2gudB9W8Xrned/wtUBVymy9 |
| 267 | gjB5jINfU7Lci0H57Evsw96UJJVfhXdUMHpqt1RGCoEd9FWnrDyrSy0NysnBT2bH |
| 268 | lEqxh3aFEUx9IOQ4sgnx1/NOFXBpkRtivl6O0Ec= |
Jean-Paul Calderone | 20131f5 | 2009-04-01 12:05:45 -0400 | [diff] [blame] | 269 | -----END CERTIFICATE----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 270 | """ |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 271 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 272 | cleartextPrivateKeyPEM = normalize_privatekey_pem(b"""\ |
Jean-Paul Calderone | d50d204 | 2011-05-04 17:00:49 -0400 | [diff] [blame] | 273 | -----BEGIN RSA PRIVATE KEY----- |
Jean-Paul Calderone | 20131f5 | 2009-04-01 12:05:45 -0400 | [diff] [blame] | 274 | MIICXQIBAAKBgQD5mkLpi7q6ROdu7khB3S9aanA0Zls7vvfGOmB80/yeylhGpsjA |
| 275 | jWen0VtSQke/NlEPGtO38tsV7CsuFnSmschvAnGrcJl76b0UOOHUgDTIoRxC6QDU |
| 276 | 3claegwsrBA+sJEBbqx5RdXbIRGicPG/8qQ4Zm1SKOgotcbwiaor2yxZ2wIDAQAB |
| 277 | AoGBAPCgMpmLxzwDaUmcFbTJUvlLW1hoxNNYSu2jIZm1k/hRAcE60JYwvBkgz3UB |
| 278 | yMEh0AtLxYe0bFk6EHah11tMUPgscbCq73snJ++8koUw+csk22G65hOs51bVb7Aa |
| 279 | 6JBe67oLzdtvgCUFAA2qfrKzWRZzAdhUirQUZgySZk+Xq1pBAkEA/kZG0A6roTSM |
| 280 | BVnx7LnPfsycKUsTumorpXiylZJjTi9XtmzxhrYN6wgZlDOOwOLgSQhszGpxVoMD |
| 281 | u3gByT1b2QJBAPtL3mSKdvwRu/+40zaZLwvSJRxaj0mcE4BJOS6Oqs/hS1xRlrNk |
| 282 | PpQ7WJ4yM6ZOLnXzm2mKyxm50Mv64109FtMCQQDOqS2KkjHaLowTGVxwC0DijMfr |
| 283 | I9Lf8sSQk32J5VWCySWf5gGTfEnpmUa41gKTMJIbqZZLucNuDcOtzUaeWZlZAkA8 |
| 284 | ttXigLnCqR486JDPTi9ZscoZkZ+w7y6e/hH8t6d5Vjt48JVyfjPIaJY+km58LcN3 |
| 285 | 6AWSeGAdtRFHVzR7oHjVAkB4hutvxiOeiIVQNBhM6RSI9aBPMI21DoX2JRoxvNW2 |
| 286 | cbvAhow217X9V0dVerEOKxnNYspXRrh36h7k4mQA+sDq |
| 287 | -----END RSA PRIVATE KEY----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 288 | """) |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 289 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 290 | cleartextCertificateRequestPEM = b"""-----BEGIN CERTIFICATE REQUEST----- |
Jean-Paul Calderone | add7bf0 | 2010-08-22 17:38:30 -0400 | [diff] [blame] | 291 | MIIBnjCCAQcCAQAwXjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAklMMRAwDgYDVQQH |
| 292 | EwdDaGljYWdvMRcwFQYDVQQKEw5NeSBDb21wYW55IEx0ZDEXMBUGA1UEAxMORnJl |
| 293 | ZGVyaWNrIERlYW4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANp6Y17WzKSw |
| 294 | BsUWkXdqg6tnXy8H8hA1msCMWpc+/2KJ4mbv5NyD6UD+/SqagQqulPbF/DFea9nA |
| 295 | E0zhmHJELcM8gUTIlXv/cgDWnmK4xj8YkjVUiCdqKRAKeuzLG1pGmwwF5lGeJpXN |
| 296 | xQn5ecR0UYSOWj6TTGXB9VyUMQzCClcBAgMBAAGgADANBgkqhkiG9w0BAQUFAAOB |
| 297 | gQAAJGuF/R/GGbeC7FbFW+aJgr9ee0Xbl6nlhu7pTe67k+iiKT2dsl2ti68MVTnu |
| 298 | Vrb3HUNqOkiwsJf6kCtq5oPn3QVYzTa76Dt2y3Rtzv6boRSlmlfrgS92GNma8JfR |
| 299 | oICQk3nAudi6zl1Dix3BCv1pUp5KMtGn3MeDEi6QFGy2rA== |
| 300 | -----END CERTIFICATE REQUEST----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 301 | """ |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 302 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 303 | encryptedPrivateKeyPEM = b"""-----BEGIN RSA PRIVATE KEY----- |
Jean-Paul Calderone | 20131f5 | 2009-04-01 12:05:45 -0400 | [diff] [blame] | 304 | Proc-Type: 4,ENCRYPTED |
| 305 | DEK-Info: DES-EDE3-CBC,9573604A18579E9E |
Jean-Paul Calderone | 5ef8651 | 2008-04-26 19:06:28 -0400 | [diff] [blame] | 306 | |
Jean-Paul Calderone | 20131f5 | 2009-04-01 12:05:45 -0400 | [diff] [blame] | 307 | SHOho56WxDkT0ht10UTeKc0F5u8cqIa01kzFAmETw0MAs8ezYtK15NPdCXUm3X/2 |
| 308 | a17G7LSF5bkxOgZ7vpXyMzun/owrj7CzvLxyncyEFZWvtvzaAhPhvTJtTIB3kf8B |
| 309 | 8+qRcpTGK7NgXEgYBW5bj1y4qZkD4zCL9o9NQzsKI3Ie8i0239jsDOWR38AxjXBH |
| 310 | mGwAQ4Z6ZN5dnmM4fhMIWsmFf19sNyAML4gHenQCHhmXbjXeVq47aC2ProInJbrm |
| 311 | +00TcisbAQ40V9aehVbcDKtS4ZbMVDwncAjpXpcncC54G76N6j7F7wL7L/FuXa3A |
| 312 | fvSVy9n2VfF/pJ3kYSflLHH2G/DFxjF7dl0GxhKPxJjp3IJi9VtuvmN9R2jZWLQF |
| 313 | tfC8dXgy/P9CfFQhlinqBTEwgH0oZ/d4k4NVFDSdEMaSdmBAjlHpc+Vfdty3HVnV |
| 314 | rKXj//wslsFNm9kIwJGIgKUa/n2jsOiydrsk1mgH7SmNCb3YHgZhbbnq0qLat/HC |
| 315 | gHDt3FHpNQ31QzzL3yrenFB2L9osIsnRsDTPFNi4RX4SpDgNroxOQmyzCCV6H+d4 |
| 316 | o1mcnNiZSdxLZxVKccq0AfRpHqpPAFnJcQHP6xyT9MZp6fBa0XkxDnt9kNU8H3Qw |
| 317 | 7SJWZ69VXjBUzMlQViLuaWMgTnL+ZVyFZf9hTF7U/ef4HMLMAVNdiaGG+G+AjCV/ |
| 318 | MbzjS007Oe4qqBnCWaFPSnJX6uLApeTbqAxAeyCql56ULW5x6vDMNC3dwjvS/CEh |
| 319 | 11n8RkgFIQA0AhuKSIg3CbuartRsJnWOLwgLTzsrKYL4yRog1RJrtw== |
| 320 | -----END RSA PRIVATE KEY----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 321 | """ |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 322 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 323 | encryptedPrivateKeyPEMPassphrase = b"foobar" |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 324 | |
Cory Benfield | 6492f7c | 2015-10-27 16:57:58 +0900 | [diff] [blame] | 325 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 326 | cleartextPublicKeyPEM = b"""-----BEGIN PUBLIC KEY----- |
Cory Benfield | 6492f7c | 2015-10-27 16:57:58 +0900 | [diff] [blame] | 327 | MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxszlc+b71LvlLS0ypt/l |
| 328 | gT/JzSVJtnEqw9WUNGeiChywX2mmQLHEt7KP0JikqUFZOtPclNY823Q4pErMTSWC |
| 329 | 90qlUxI47vNJbXGRfmO2q6Zfw6SE+E9iUb74xezbOJLjBuUIkQzEKEFV+8taiRV+ |
| 330 | ceg1v01yCT2+OjhQW3cxG42zxyRFmqesbQAUWgS3uhPrUQqYQUEiTmVhh4FBUKZ5 |
| 331 | XIneGUpX1S7mXRxTLH6YzRoGFqRoc9A0BBNcoXHTWnxV215k4TeHMFYE5RG0KYAS |
| 332 | 8Xk5iKICEXwnZreIt3jyygqoOKsKZMK/Zl2VhMGhJR6HXRpQCyASzEG7bgtROLhL |
| 333 | ywIDAQAB |
| 334 | -----END PUBLIC KEY----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 335 | """ |
Cory Benfield | 6492f7c | 2015-10-27 16:57:58 +0900 | [diff] [blame] | 336 | |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 337 | # Some PKCS#7 stuff. Generated with the openssl command line: |
| 338 | # |
| 339 | # openssl crl2pkcs7 -inform pem -outform pem -certfile s.pem -nocrl |
| 340 | # |
| 341 | # with a certificate and key (but the key should be irrelevant) in s.pem |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 342 | pkcs7Data = b"""\ |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 343 | -----BEGIN PKCS7----- |
| 344 | MIIDNwYJKoZIhvcNAQcCoIIDKDCCAyQCAQExADALBgkqhkiG9w0BBwGgggMKMIID |
| 345 | BjCCAm+gAwIBAgIBATANBgkqhkiG9w0BAQQFADB7MQswCQYDVQQGEwJTRzERMA8G |
| 346 | A1UEChMITTJDcnlwdG8xFDASBgNVBAsTC00yQ3J5cHRvIENBMSQwIgYDVQQDExtN |
| 347 | MkNyeXB0byBDZXJ0aWZpY2F0ZSBNYXN0ZXIxHTAbBgkqhkiG9w0BCQEWDm5ncHNA |
| 348 | cG9zdDEuY29tMB4XDTAwMDkxMDA5NTEzMFoXDTAyMDkxMDA5NTEzMFowUzELMAkG |
| 349 | A1UEBhMCU0cxETAPBgNVBAoTCE0yQ3J5cHRvMRIwEAYDVQQDEwlsb2NhbGhvc3Qx |
| 350 | HTAbBgkqhkiG9w0BCQEWDm5ncHNAcG9zdDEuY29tMFwwDQYJKoZIhvcNAQEBBQAD |
| 351 | SwAwSAJBAKy+e3dulvXzV7zoTZWc5TzgApr8DmeQHTYC8ydfzH7EECe4R1Xh5kwI |
| 352 | zOuuFfn178FBiS84gngaNcrFi0Z5fAkCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAw |
| 353 | LAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0G |
| 354 | A1UdDgQWBBTPhIKSvnsmYsBVNWjj0m3M2z0qVTCBpQYDVR0jBIGdMIGagBT7hyNp |
| 355 | 65w6kxXlxb8pUU/+7Sg4AaF/pH0wezELMAkGA1UEBhMCU0cxETAPBgNVBAoTCE0y |
| 356 | Q3J5cHRvMRQwEgYDVQQLEwtNMkNyeXB0byBDQTEkMCIGA1UEAxMbTTJDcnlwdG8g |
| 357 | Q2VydGlmaWNhdGUgTWFzdGVyMR0wGwYJKoZIhvcNAQkBFg5uZ3BzQHBvc3QxLmNv |
| 358 | bYIBADANBgkqhkiG9w0BAQQFAAOBgQA7/CqT6PoHycTdhEStWNZde7M/2Yc6BoJu |
| 359 | VwnW8YxGO8Sn6UJ4FeffZNcYZddSDKosw8LtPOeWoK3JINjAk5jiPQ2cww++7QGG |
| 360 | /g5NDjxFZNDJP1dGiLAxPW6JXwov4v0FmdzfLOZ01jDcgQQZqEpYlgpuI5JEWUQ9 |
| 361 | Ho4EzbYCOaEAMQA= |
| 362 | -----END PKCS7----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 363 | """ |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 364 | |
Alex Gaynor | 8fa1dd6 | 2014-08-14 09:57:51 -0700 | [diff] [blame] | 365 | pkcs7DataASN1 = base64.b64decode(b""" |
Alex Gaynor | 4b9c96a | 2014-08-14 09:51:48 -0700 | [diff] [blame] | 366 | MIIDNwYJKoZIhvcNAQcCoIIDKDCCAyQCAQExADALBgkqhkiG9w0BBwGgggMKMIID |
| 367 | BjCCAm+gAwIBAgIBATANBgkqhkiG9w0BAQQFADB7MQswCQYDVQQGEwJTRzERMA8G |
| 368 | A1UEChMITTJDcnlwdG8xFDASBgNVBAsTC00yQ3J5cHRvIENBMSQwIgYDVQQDExtN |
| 369 | MkNyeXB0byBDZXJ0aWZpY2F0ZSBNYXN0ZXIxHTAbBgkqhkiG9w0BCQEWDm5ncHNA |
| 370 | cG9zdDEuY29tMB4XDTAwMDkxMDA5NTEzMFoXDTAyMDkxMDA5NTEzMFowUzELMAkG |
| 371 | A1UEBhMCU0cxETAPBgNVBAoTCE0yQ3J5cHRvMRIwEAYDVQQDEwlsb2NhbGhvc3Qx |
| 372 | HTAbBgkqhkiG9w0BCQEWDm5ncHNAcG9zdDEuY29tMFwwDQYJKoZIhvcNAQEBBQAD |
| 373 | SwAwSAJBAKy+e3dulvXzV7zoTZWc5TzgApr8DmeQHTYC8ydfzH7EECe4R1Xh5kwI |
| 374 | zOuuFfn178FBiS84gngaNcrFi0Z5fAkCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAw |
| 375 | LAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0G |
| 376 | A1UdDgQWBBTPhIKSvnsmYsBVNWjj0m3M2z0qVTCBpQYDVR0jBIGdMIGagBT7hyNp |
| 377 | 65w6kxXlxb8pUU/+7Sg4AaF/pH0wezELMAkGA1UEBhMCU0cxETAPBgNVBAoTCE0y |
| 378 | Q3J5cHRvMRQwEgYDVQQLEwtNMkNyeXB0byBDQTEkMCIGA1UEAxMbTTJDcnlwdG8g |
| 379 | Q2VydGlmaWNhdGUgTWFzdGVyMR0wGwYJKoZIhvcNAQkBFg5uZ3BzQHBvc3QxLmNv |
| 380 | bYIBADANBgkqhkiG9w0BAQQFAAOBgQA7/CqT6PoHycTdhEStWNZde7M/2Yc6BoJu |
| 381 | VwnW8YxGO8Sn6UJ4FeffZNcYZddSDKosw8LtPOeWoK3JINjAk5jiPQ2cww++7QGG |
| 382 | /g5NDjxFZNDJP1dGiLAxPW6JXwov4v0FmdzfLOZ01jDcgQQZqEpYlgpuI5JEWUQ9 |
| 383 | Ho4EzbYCOaEAMQA= |
Alex Gaynor | 8fa1dd6 | 2014-08-14 09:57:51 -0700 | [diff] [blame] | 384 | """) |
Alex Gaynor | 4b9c96a | 2014-08-14 09:51:48 -0700 | [diff] [blame] | 385 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 386 | crlData = b"""\ |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 387 | -----BEGIN X509 CRL----- |
| 388 | MIIBWzCBxTANBgkqhkiG9w0BAQQFADBYMQswCQYDVQQGEwJVUzELMAkGA1UECBMC |
| 389 | SUwxEDAOBgNVBAcTB0NoaWNhZ28xEDAOBgNVBAoTB1Rlc3RpbmcxGDAWBgNVBAMT |
| 390 | D1Rlc3RpbmcgUm9vdCBDQRcNMDkwNzI2MDQzNDU2WhcNMTIwOTI3MDI0MTUyWjA8 |
| 391 | MBUCAgOrGA8yMDA5MDcyNTIzMzQ1NlowIwICAQAYDzIwMDkwNzI1MjMzNDU2WjAM |
| 392 | MAoGA1UdFQQDCgEEMA0GCSqGSIb3DQEBBAUAA4GBAEBt7xTs2htdD3d4ErrcGAw1 |
| 393 | 4dKcVnIWTutoI7xxen26Wwvh8VCsT7i/UeP+rBl9rC/kfjWjzQk3/zleaarGTpBT |
| 394 | 0yp4HXRFFoRhhSE/hP+eteaPXRgrsNRLHe9ZDd69wmh7J1wMDb0m81RG7kqcbsid |
| 395 | vrzEeLDRiiPl92dyyWmu |
| 396 | -----END X509 CRL----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 397 | """ |
Jean-Paul Calderone | e890db3 | 2010-08-22 16:55:15 -0400 | [diff] [blame] | 398 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 399 | crlDataUnsupportedExtension = b"""\ |
Paul Kehrer | 5e3dd4c | 2016-03-11 09:58:28 -0400 | [diff] [blame] | 400 | -----BEGIN X509 CRL----- |
| 401 | MIIGRzCCBS8CAQIwDQYJKoZIhvcNAQELBQAwJzELMAkGA1UEBhMCVVMxGDAWBgNV |
| 402 | BAMMD2NyeXB0b2dyYXBoeS5pbxgPMjAxNTAxMDEwMDAwMDBaGA8yMDE2MDEwMTAw |
| 403 | MDAwMFowggTOMBQCAQAYDzIwMTUwMTAxMDAwMDAwWjByAgEBGA8yMDE1MDEwMTAw |
| 404 | MDAwMFowXDAYBgNVHRgEERgPMjAxNTAxMDEwMDAwMDBaMDQGA1UdHQQtMCukKTAn |
| 405 | MQswCQYDVQQGEwJVUzEYMBYGA1UEAwwPY3J5cHRvZ3JhcGh5LmlvMAoGA1UdFQQD |
| 406 | CgEAMHICAQIYDzIwMTUwMTAxMDAwMDAwWjBcMBgGA1UdGAQRGA8yMDE1MDEwMTAw |
| 407 | MDAwMFowNAYDVR0dBC0wK6QpMCcxCzAJBgNVBAYTAlVTMRgwFgYDVQQDDA9jcnlw |
| 408 | dG9ncmFwaHkuaW8wCgYDVR0VBAMKAQEwcgIBAxgPMjAxNTAxMDEwMDAwMDBaMFww |
| 409 | GAYDVR0YBBEYDzIwMTUwMTAxMDAwMDAwWjA0BgNVHR0ELTArpCkwJzELMAkGA1UE |
| 410 | BhMCVVMxGDAWBgNVBAMMD2NyeXB0b2dyYXBoeS5pbzAKBgNVHRUEAwoBAjByAgEE |
| 411 | GA8yMDE1MDEwMTAwMDAwMFowXDAYBgNVHRgEERgPMjAxNTAxMDEwMDAwMDBaMDQG |
| 412 | A1UdHQQtMCukKTAnMQswCQYDVQQGEwJVUzEYMBYGA1UEAwwPY3J5cHRvZ3JhcGh5 |
| 413 | LmlvMAoGA1UdFQQDCgEDMHICAQUYDzIwMTUwMTAxMDAwMDAwWjBcMBgGA1UdGAQR |
| 414 | GA8yMDE1MDEwMTAwMDAwMFowNAYDVR0dBC0wK6QpMCcxCzAJBgNVBAYTAlVTMRgw |
| 415 | FgYDVQQDDA9jcnlwdG9ncmFwaHkuaW8wCgYDVR0VBAMKAQQwcgIBBhgPMjAxNTAx |
| 416 | MDEwMDAwMDBaMFwwGAYDVR0YBBEYDzIwMTUwMTAxMDAwMDAwWjA0BgNVHR0ELTAr |
| 417 | pCkwJzELMAkGA1UEBhMCVVMxGDAWBgNVBAMMD2NyeXB0b2dyYXBoeS5pbzAKBgNV |
| 418 | HRUEAwoBBTByAgEHGA8yMDE1MDEwMTAwMDAwMFowXDAYBgNVHRgEERgPMjAxNTAx |
| 419 | MDEwMDAwMDBaMDQGA1UdHQQtMCukKTAnMQswCQYDVQQGEwJVUzEYMBYGA1UEAwwP |
| 420 | Y3J5cHRvZ3JhcGh5LmlvMAoGA1UdFQQDCgEGMHICAQgYDzIwMTUwMTAxMDAwMDAw |
| 421 | WjBcMBgGA1UdGAQRGA8yMDE1MDEwMTAwMDAwMFowNAYDVR0dBC0wK6QpMCcxCzAJ |
| 422 | BgNVBAYTAlVTMRgwFgYDVQQDDA9jcnlwdG9ncmFwaHkuaW8wCgYDVR0VBAMKAQgw |
| 423 | cgIBCRgPMjAxNTAxMDEwMDAwMDBaMFwwGAYDVR0YBBEYDzIwMTUwMTAxMDAwMDAw |
| 424 | WjA0BgNVHR0ELTArpCkwJzELMAkGA1UEBhMCVVMxGDAWBgNVBAMMD2NyeXB0b2dy |
| 425 | YXBoeS5pbzAKBgNVHRUEAwoBCTByAgEKGA8yMDE1MDEwMTAwMDAwMFowXDAYBgNV |
| 426 | HRgEERgPMjAxNTAxMDEwMDAwMDBaMDQGA1UdHQQtMCukKTAnMQswCQYDVQQGEwJV |
| 427 | UzEYMBYGA1UEAwwPY3J5cHRvZ3JhcGh5LmlvMAoGA1UdFQQDCgEKMC4CAQsYDzIw |
| 428 | MTUwMTAxMDAwMDAwWjAYMAoGA1UdFQQDCgEBMAoGAyoDBAQDCgEAMA0GCSqGSIb3 |
| 429 | DQEBCwUAA4IBAQBTaloHlPaCZzYee8LxkWej5meiqxQVNWFoVdjesroa+f1FRrH+ |
| 430 | drRU60Nq97KCKf7f9GNN/J3ZIlQmYhmuDqh12f+XLpotoj1ZRfBz2hjFCkJlv+2c |
| 431 | oWWGNHgA70ndFoVtcmX088SYpX8E3ARATivS4q2h9WlwV6rO93mhg3HGIe3JpcK4 |
| 432 | 7BcW6Poi/ut/zsDOkVbI00SqaujRpdmdCTht82MH3ztjyDkI9KYaD/YEweKSrWOz |
| 433 | SdEILd164bfBeLuplVI+xpmTEMVNpXBlSXl7+xIw9Vk7p7Q1Pa3k/SvhOldYCm6y |
| 434 | C1xAg/AAq6w78yzYt18j5Mj0s6eeHi1YpHKw |
| 435 | -----END X509 CRL----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 436 | """ |
Paul Kehrer | 5e3dd4c | 2016-03-11 09:58:28 -0400 | [diff] [blame] | 437 | |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 438 | |
| 439 | # A broken RSA private key which can be used to test the error path through |
| 440 | # PKey.check. |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 441 | inconsistentPrivateKeyPEM = b"""-----BEGIN RSA PRIVATE KEY----- |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 442 | MIIBPAIBAAJBAKy+e3dulvXzV7zoTZWc5TzgApr8DmeQHTYC8ydfzH7EECe4R1Xh |
| 443 | 5kwIzOuuFfn178FBiS84gngaNcrFi0Z5fAkCAwEaAQJBAIqm/bz4NA1H++Vx5Ewx |
| 444 | OcKp3w19QSaZAwlGRtsUxrP7436QjnREM3Bm8ygU11BjkPVmtrKm6AayQfCHqJoT |
| 445 | zIECIQDW0BoMoL0HOYM/mrTLhaykYAVqgIeJsPjvkEhTFXWBuQIhAM3deFAvWNu4 |
| 446 | nklUQ37XsCT2c9tmNt1LAT+slG2JOTTRAiAuXDtC/m3NYVwyHfFm+zKHRzHkClk2 |
| 447 | HjubeEgjpj32AQIhAJqMGTaZVOwevTXvvHwNeH+vRWsAYU/gbx+OQB+7VOcBAiEA |
| 448 | oolb6NMg/R3enNPvS1O4UU1H8wpaF77L4yiSWlE0p4w= |
| 449 | -----END RSA PRIVATE KEY----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 450 | """ |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 451 | |
Jean-Paul Calderone | ff83cdd | 2013-08-12 18:05:51 -0400 | [diff] [blame] | 452 | # certificate with NULL bytes in subjectAltName and common name |
| 453 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 454 | nulbyteSubjectAltNamePEM = b"""-----BEGIN CERTIFICATE----- |
Jean-Paul Calderone | ff83cdd | 2013-08-12 18:05:51 -0400 | [diff] [blame] | 455 | MIIE2DCCA8CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBxTELMAkGA1UEBhMCVVMx |
| 456 | DzANBgNVBAgMBk9yZWdvbjESMBAGA1UEBwwJQmVhdmVydG9uMSMwIQYDVQQKDBpQ |
| 457 | eXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEgMB4GA1UECwwXUHl0aG9uIENvcmUg |
| 458 | RGV2ZWxvcG1lbnQxJDAiBgNVBAMMG251bGwucHl0aG9uLm9yZwBleGFtcGxlLm9y |
| 459 | ZzEkMCIGCSqGSIb3DQEJARYVcHl0aG9uLWRldkBweXRob24ub3JnMB4XDTEzMDgw |
| 460 | NzEzMTE1MloXDTEzMDgwNzEzMTI1MlowgcUxCzAJBgNVBAYTAlVTMQ8wDQYDVQQI |
| 461 | DAZPcmVnb24xEjAQBgNVBAcMCUJlYXZlcnRvbjEjMCEGA1UECgwaUHl0aG9uIFNv |
| 462 | ZnR3YXJlIEZvdW5kYXRpb24xIDAeBgNVBAsMF1B5dGhvbiBDb3JlIERldmVsb3Bt |
| 463 | ZW50MSQwIgYDVQQDDBtudWxsLnB5dGhvbi5vcmcAZXhhbXBsZS5vcmcxJDAiBgkq |
| 464 | hkiG9w0BCQEWFXB5dGhvbi1kZXZAcHl0aG9uLm9yZzCCASIwDQYJKoZIhvcNAQEB |
| 465 | BQADggEPADCCAQoCggEBALXq7cn7Rn1vO3aA3TrzA5QLp6bb7B3f/yN0CJ2XFj+j |
| 466 | pHs+Gw6WWSUDpybiiKnPec33BFawq3kyblnBMjBU61ioy5HwQqVkJ8vUVjGIUq3P |
| 467 | vX/wBmQfzCe4o4uM89gpHyUL9UYGG8oCRa17dgqcv7u5rg0Wq2B1rgY+nHwx3JIv |
| 468 | KRrgSwyRkGzpN8WQ1yrXlxWjgI9de0mPVDDUlywcWze1q2kwaEPTM3hLAmD1PESA |
| 469 | oY/n8A/RXoeeRs9i/Pm/DGUS8ZPINXk/yOzsR/XvvkTVroIeLZqfmFpnZeF0cHzL |
| 470 | 08LODkVJJ9zjLdT7SA4vnne4FEbAxDbKAq5qkYzaL4UCAwEAAaOB0DCBzTAMBgNV |
| 471 | HRMBAf8EAjAAMB0GA1UdDgQWBBSIWlXAUv9hzVKjNQ/qWpwkOCL3XDALBgNVHQ8E |
| 472 | BAMCBeAwgZAGA1UdEQSBiDCBhYIeYWx0bnVsbC5weXRob24ub3JnAGV4YW1wbGUu |
| 473 | Y29tgSBudWxsQHB5dGhvbi5vcmcAdXNlckBleGFtcGxlLm9yZ4YpaHR0cDovL251 |
| 474 | bGwucHl0aG9uLm9yZwBodHRwOi8vZXhhbXBsZS5vcmeHBMAAAgGHECABDbgAAAAA |
| 475 | AAAAAAAAAAEwDQYJKoZIhvcNAQEFBQADggEBAKxPRe99SaghcI6IWT7UNkJw9aO9 |
| 476 | i9eo0Fj2MUqxpKbdb9noRDy2CnHWf7EIYZ1gznXPdwzSN4YCjV5d+Q9xtBaowT0j |
| 477 | HPERs1ZuytCNNJTmhyqZ8q6uzMLoht4IqH/FBfpvgaeC5tBTnTT0rD5A/olXeimk |
| 478 | kX4LxlEx5RAvpGB2zZVRGr6LobD9rVK91xuHYNIxxxfEGE8tCCWjp0+3ksri9SXx |
| 479 | VHWBnbM9YaL32u3hxm8sYB/Yb8WSBavJCWJJqRStVRHM1koZlJmXNx2BX4vPo6iW |
| 480 | RFEIPQsFZRLrtnCAiEhyT8bC2s/Njlu6ly9gtJZWSV46Q3ZjBL4q9sHKqZQ= |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 481 | -----END CERTIFICATE-----""" |
Jean-Paul Calderone | ff83cdd | 2013-08-12 18:05:51 -0400 | [diff] [blame] | 482 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 483 | large_key_pem = b"""-----BEGIN RSA PRIVATE KEY----- |
Colleen Murphy | e09399b | 2016-03-01 17:40:49 -0800 | [diff] [blame] | 484 | MIIJYgIBAAKCAg4AtRua8eIeevRfsj+fkcHr1vmse7Kgb+oX1ssJAvCb1R7JQMnH |
| 485 | hNDjDP6b3vEkZuPUzlDHymP+cNkXvvi4wJ4miVbO3+SeU4Sh+jmsHeHzGIXat9xW |
| 486 | 9PFtuPM5FQq8zvkY8aDeRYmYwN9JKu4/neMBCBqostYlTEWg+bSytO/qWnyHTHKh |
| 487 | g0GfaDdqUQPsGQw+J0MgaYIjQOCVASHAPlzbDQLCtuOb587rwTLkZA2GwoHB/LyJ |
| 488 | BwT0HHgBaiObE12Vs6wi2en0Uu11CiwEuK1KIBcZ2XbE6eApaZa6VH9ysEmUxPt7 |
| 489 | TqyZ4E2oMIYaLPNRxuvozdwTlj1svI1k1FrkaXGc5MTjbgigPMKjIb0T7b/4GNzt |
| 490 | DhP1LvAeUMnrEi3hJJrcJPXHPqS8/RiytR9xQQW6Sdh4LaA3f9MQm3WSevWage3G |
| 491 | P8YcCLssOVKsArDjuA52NF5LmYuAeUzXprm4ITDi2oO+0iFBpFW6VPEK4A9vO0Yk |
| 492 | M/6Wt6tG8zyWhaSH1zFUTwfQ9Yvjyt5w1lrUaAJuoTpwbMVZaDJaEhjOaXU0dyPQ |
| 493 | jOsePDOQcU6dkeTWsQ3LsHPEEug/X6819TLG5mb3V7bvV9nPFBfTJSCEG794kr90 |
| 494 | XgZfIN71FrdByxLerlbuJI21pPs/nZi9SXi9jAWeiS45/azUxMsyYgJArui+gjq7 |
| 495 | sV1pWiBm6/orAgMBAAECggINQp5L6Yu+oIXBqcSjgq8tfF9M5hd30pLuf/EheHZf |
| 496 | LA7uAqn2fVGFI2OInIJhXIOT5OxsAXO0xXfltzawZxIFpOFMqajj4F7aYjvSpw9V |
| 497 | J4EdSiJ/zgv8y1qUdbwEZbHVThRZjoSlrtSzilonBoHZAE0mHtqMz7iRFSk1zz6t |
| 498 | GunRrvo/lROPentf3TsvHquVNUYI5yaapyO1S7xJhecMIIYSb8nbsHI54FBDGNas |
| 499 | 6mFmpPwI/47/6HTwOEWupnn3NicsjrHzUInOUpaMig4cRR+aP5bjqg/ty8xI8AoN |
| 500 | evEmCytiWTc+Rvbp1ieN+1jpjN18PjUk80/W7qioHUDt4ieLic8uxWH2VD9SCEnX |
| 501 | Mpi9tA/FqoZ+2A/3m1OfrY6jiZVE2g+asi9lCK7QVWL39eK82H4rPvtp0/dyo1/i |
| 502 | ZZz68TXg+m8IgEZcp88hngbkuoTTzpGE73QuPKhGA1uMIimDdqPPB5WP76q+03Oi |
| 503 | IRR5DfZnqPERed49by0enJ7tKa/gFPZizOV8ALKr0Dp+vfAkxGDLPLBLd2A3//tw |
| 504 | xg0Q/wltihHSBujv4nYlDXdc5oYyMYZ+Lhc/VuOghHfBq3tgEQ1ECM/ofqXEIdy7 |
| 505 | nVcpZn3Eeq8Jl5CrqxE1ee3NxlzsJHn99yGQpr7mOhW/psJF3XNz80Meg3L4m1T8 |
| 506 | sMBK0GbaassuJhdzb5whAoIBBw48sx1b1WR4XxQc5O/HjHva+l16i2pjUnOUTcDF |
| 507 | RWmSbIhBm2QQ2rVhO8+fak0tkl6ZnMWW4i0U/X5LOEBbC7+IS8bO3j3Revi+Vw5x |
| 508 | j96LMlIe9XEub5i/saEWgiz7maCvfzLFU08e1OpT4qPDpP293V400ubA6R7WQTCv |
| 509 | pBkskGwHeu0l/TuKkVqBFFUTu7KEbps8Gjg7MkJaFriAOv1zis/umK8pVS3ZAM6e |
| 510 | 8w5jfpRccn8Xzta2fRwTB5kCmfxdDsY0oYGxPLRAbW72bORoLGuyyPp/ojeGwoik |
| 511 | JX9RttErc6FjyZtks370Pa8UL5QskyhMbDhrZW2jFD+RXYM1BrvmZRjbAoIBBwy4 |
| 512 | iFJpuDfytJfz1MWtaL5DqEL/kmiZYAXl6hifNhGu5GAipVIIGsDqEYW4i+VC15aa |
| 513 | 7kOCwz/I5zsB3vSDW96IRs4wXtqEZSibc2W/bqfVi+xcvPPl1ZhQ2EAwa4D/x035 |
| 514 | kyf20ffWOU+1yf2cnijzqs3IzlveUm+meLw5s3Rc+iG7DPWWeCoe1hVwANI1euNc |
| 515 | pqKwKY905yFyjOje2OgiEU2kS4YME4zGeBys8yo7E42hNnN2EPK6xkkUqzdudLLQ |
| 516 | 8OUlKRTc8AbIf3XG1rpA4VUpTv3hhxGGwCRy6If8zgZQsNYchgNztRGk72Gcb8Dm |
| 517 | vFSEN3ZtwxU64G3YZzntdcr2WPzxAoIBBw30g6Fgdb/gmVnOpL0//T0ePNDKIMPs |
| 518 | jVJLaRduhoZgB1Bb9qPUPX0SzRzLZtg1tkZSDjBDoHmOHJfhxUaXt+FLCPPbrE4t |
| 519 | +nq9n/nBaMM779w9ClqhqLOyGrwKoxjSmhi+TVEHyIxCbXMvPHVHfX9WzxjbcGrN |
| 520 | ZvRaEVZWo+QlIX8yqdSwqxLk1WtAIRzvlcj7NKum8xBxPed6BNFep/PtgIAmoLT5 |
| 521 | L8wb7EWb2iUdc2KbZ4OaY51lDScqpATgXu3WjXfM+Q52G0mX6Wyd0cjlL711Zrjb |
| 522 | yLbiueZT94lgIHHRRKtKc8CEqcjkQV5OzABS3P/gQSfgZXBdLKjOpTnKDUq7IBeH |
| 523 | AoIBBweAOEIAPLQg1QRUrr3xRrYKRwlakgZDii9wJt1l5AgBTICzbTA1vzDJ1JM5 |
| 524 | AqSpCV6w9JWyYVcXK+HLdKBRZLaPPNEQDJ5lOxD6uMziWGl2rg8tj+1xNMWfxiPz |
| 525 | aTCjoe4EoBUMoTq2gwzRcM2usEQNikXVhnj9Wzaivsaeb4bJ3GRPW5DkrO6JSEtT |
| 526 | w+gvyMqQM2Hy5k7E7BT46sXVwaj/jZxuqGnebRixXtnp0WixdRIqYWUr1UqLf6hQ |
| 527 | G7WP2BgoxCMaCmNW8+HMD/xuxucEotoIhZ+GgJKBFoNnjl3BX+qxYdSe9RbL/5Tr |
| 528 | 4It6Jxtj8uETJXEbv9Cg6v1agWPS9YY8RLTBAoIBBwrU2AsAUts6h1LgGLKK3UWZ |
| 529 | oLH5E+4o+7HqSGRcRodVeN9NBXIYdHHOLeEG6YNGJiJ3bFP5ZQEu9iDsyoFVKJ9O |
| 530 | Mw/y6dKZuxOCZ+X8FopSROg3yWfdOpAm6cnQZp3WqLNX4n/Q6WvKojfyEiPphjwT |
| 531 | 0ymrUJELXLWJmjUyPoAk6HgC0Gs28ZnEXbyhx7CSbZNFyCU/PNUDZwto3GisIPD3 |
| 532 | le7YjqHugezmjMGlA0sDw5aCXjfbl74vowRFYMO6e3ItApfSRgNV86CDoX74WI/5 |
| 533 | AYU/QVM4wGt8XGT2KwDFJaxYGKsGDMWmXY04dS+WPuetCbouWUusyFwRb9SzFave |
| 534 | vYeU7Ab/ |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 535 | -----END RSA PRIVATE KEY-----""" |
Colleen Murphy | e09399b | 2016-03-01 17:40:49 -0800 | [diff] [blame] | 536 | |
Paul Kehrer | 72d968b | 2016-07-29 15:31:04 +0800 | [diff] [blame] | 537 | ec_private_key_pem = b"""-----BEGIN PRIVATE KEY----- |
| 538 | MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgYirTZSx+5O8Y6tlG |
| 539 | cka6W6btJiocdrdolfcukSoTEk+hRANCAAQkvPNu7Pa1GcsWU4v7ptNfqCJVq8Cx |
| 540 | zo0MUVPQgwJ3aJtNM1QMOQUayCrRwfklg+D/rFSUwEUqtZh7fJDiFqz3 |
| 541 | -----END PRIVATE KEY----- |
| 542 | """ |
| 543 | |
Paul Kehrer | 59d2625 | 2017-07-20 10:45:54 +0200 | [diff] [blame] | 544 | ec_root_key_pem = b"""-----BEGIN EC PRIVATE KEY----- |
| 545 | MIGlAgEBBDEAz/HOBFPYLB0jLWeTpJn4Yc4m/C4mdWymVHBjOmnwiPHKT326iYN/ |
| 546 | ZhmSs+RM94RsoAcGBSuBBAAioWQDYgAEwE5vDdla/nLpWAPAQ0yFGqwLuw4BcN2r |
| 547 | U+sKab5EAEHzLeceRa8ffncYdCXNoVsBcdob1y66CFZMEWLetPTmGapyWkBAs6/L |
| 548 | 8kUlkU9OsE+7IVo4QQJkgV5gM+Dim1XE |
| 549 | -----END EC PRIVATE KEY----- |
| 550 | """ |
| 551 | |
| 552 | ec_root_cert_pem = b"""-----BEGIN CERTIFICATE----- |
| 553 | MIICLTCCAbKgAwIBAgIMWW/hwTl6ufz6/WkCMAoGCCqGSM49BAMDMFgxGDAWBgNV |
| 554 | BAMTD1Rlc3RpbmcgUm9vdCBDQTEQMA4GA1UEChMHVGVzdGluZzEQMA4GA1UEBxMH |
| 555 | Q2hpY2FnbzELMAkGA1UECBMCSUwxCzAJBgNVBAYTAlVTMCAXDTE3MDcxOTIyNDgz |
| 556 | M1oYDzk5OTkxMjMxMjM1OTU5WjBYMRgwFgYDVQQDEw9UZXN0aW5nIFJvb3QgQ0Ex |
| 557 | EDAOBgNVBAoTB1Rlc3RpbmcxEDAOBgNVBAcTB0NoaWNhZ28xCzAJBgNVBAgTAklM |
| 558 | MQswCQYDVQQGEwJVUzB2MBAGByqGSM49AgEGBSuBBAAiA2IABMBObw3ZWv5y6VgD |
| 559 | wENMhRqsC7sOAXDdq1PrCmm+RABB8y3nHkWvH353GHQlzaFbAXHaG9cuughWTBFi |
| 560 | 3rT05hmqclpAQLOvy/JFJZFPTrBPuyFaOEECZIFeYDPg4ptVxKNDMEEwDwYDVR0T |
| 561 | AQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQAMB0GA1UdDgQWBBSoTrF0H2m8RDzB |
| 562 | MnY2KReEPfz7ZjAKBggqhkjOPQQDAwNpADBmAjEA3+G1oVCxGjYX4iUN93QYcNHe |
| 563 | e3fJQJwX9+KsHRut6qNZDUbvRbtO1YIAwB4UJZjwAjEAtXCPURS5A4McZHnSwgTi |
| 564 | Td8GMrwKz0557OxxtKN6uVVy4ACFMqEw0zN/KJI1vxc9 |
| 565 | -----END CERTIFICATE-----""" |
| 566 | |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 567 | |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 568 | @pytest.fixture |
| 569 | def x509_data(): |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 570 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 571 | Create a new private key and start a certificate request (for a test |
| 572 | to finish in one way or another). |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 573 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 574 | # Basic setup stuff to generate a certificate |
| 575 | pkey = PKey() |
| 576 | pkey.generate_key(TYPE_RSA, 384) |
| 577 | req = X509Req() |
| 578 | req.set_pubkey(pkey) |
| 579 | # Authority good you have. |
| 580 | req.get_subject().commonName = "Yoda root CA" |
| 581 | x509 = X509() |
| 582 | subject = x509.get_subject() |
| 583 | subject.commonName = req.get_subject().commonName |
| 584 | x509.set_issuer(subject) |
| 585 | x509.set_pubkey(pkey) |
| 586 | now = datetime.now() |
| 587 | expire = datetime.now() + timedelta(days=100) |
| 588 | x509.set_notBefore(now.strftime("%Y%m%d%H%M%SZ").encode()) |
| 589 | x509.set_notAfter(expire.strftime("%Y%m%d%H%M%SZ").encode()) |
| 590 | yield pkey, x509 |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 591 | |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 592 | |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 593 | class TestX509Ext(object): |
| 594 | """ |
| 595 | Tests for `OpenSSL.crypto.X509Extension`. |
| 596 | """ |
Jean-Paul Calderone | ef9a3dc | 2013-03-02 16:33:32 -0800 | [diff] [blame] | 597 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 598 | def test_str(self): |
| 599 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 600 | The string representation of `X509Extension` instances as |
| 601 | returned by `str` includes stuff. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 602 | """ |
| 603 | # This isn't necessarily the best string representation. Perhaps it |
| 604 | # will be changed/improved in the future. |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 605 | assert ( |
| 606 | str(X509Extension(b'basicConstraints', True, b'CA:false')) == |
| 607 | 'CA:FALSE' |
| 608 | ) |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 609 | |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 610 | def test_type(self): |
| 611 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 612 | `X509Extension` and `X509ExtensionType` refer to the same type object |
| 613 | and can be used to create instances of that type. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 614 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 615 | assert X509Extension is X509ExtensionType |
| 616 | assert is_consistent_type( |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 617 | X509Extension, |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 618 | 'X509Extension', b'basicConstraints', True, b'CA:true') |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 619 | |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 620 | def test_construction(self): |
| 621 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 622 | `X509Extension` accepts an extension type name, a critical flag, |
| 623 | and an extension value and returns an `X509ExtensionType` instance. |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 624 | """ |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 625 | basic = X509Extension(b'basicConstraints', True, b'CA:true') |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 626 | assert isinstance(basic, X509ExtensionType) |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 627 | |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 628 | comment = X509Extension(b'nsComment', False, b'pyOpenSSL unit test') |
| 629 | assert isinstance(comment, X509ExtensionType) |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 630 | |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 631 | @pytest.mark.parametrize('type_name, critical, value', [ |
| 632 | (b'thisIsMadeUp', False, b'hi'), |
| 633 | (b'basicConstraints', False, b'blah blah'), |
Jean-Paul Calderone | 391585f | 2008-12-31 14:36:31 -0500 | [diff] [blame] | 634 | |
Jean-Paul Calderone | 2ee1e7c | 2008-12-31 14:58:38 -0500 | [diff] [blame] | 635 | # Exercise a weird one (an extension which uses the r2i method). This |
| 636 | # exercises the codepath that requires a non-NULL ctx to be passed to |
| 637 | # X509V3_EXT_nconf. It can't work now because we provide no |
| 638 | # configuration database. It might be made to work in the future. |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 639 | (b'proxyCertInfo', True, |
| 640 | b'language:id-ppl-anyLanguage,pathlen:1,policy:text:AB') |
| 641 | ]) |
| 642 | def test_invalid_extension(self, type_name, critical, value): |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 643 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 644 | `X509Extension` raises something if it is passed a bad |
| 645 | extension name or value. |
| 646 | """ |
| 647 | with pytest.raises(Error): |
| 648 | X509Extension(type_name, critical, value) |
| 649 | |
| 650 | @pytest.mark.parametrize('critical_flag', [True, False]) |
| 651 | def test_get_critical(self, critical_flag): |
| 652 | """ |
| 653 | `X509ExtensionType.get_critical` returns the value of the |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 654 | extension's critical flag. |
| 655 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 656 | ext = X509Extension(b'basicConstraints', critical_flag, b'CA:true') |
| 657 | assert ext.get_critical() == critical_flag |
Jean-Paul Calderone | e7db4b4 | 2008-12-31 13:39:24 -0500 | [diff] [blame] | 658 | |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 659 | @pytest.mark.parametrize('short_name, value', [ |
| 660 | (b'basicConstraints', b'CA:true'), |
| 661 | (b'nsComment', b'foo bar'), |
| 662 | ]) |
| 663 | def test_get_short_name(self, short_name, value): |
Jean-Paul Calderone | f8c5fab | 2008-12-31 15:53:48 -0500 | [diff] [blame] | 664 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 665 | `X509ExtensionType.get_short_name` returns a string giving the |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 666 | short type name of the extension. |
Jean-Paul Calderone | f8c5fab | 2008-12-31 15:53:48 -0500 | [diff] [blame] | 667 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 668 | ext = X509Extension(short_name, True, value) |
| 669 | assert ext.get_short_name() == short_name |
Jean-Paul Calderone | f8c5fab | 2008-12-31 15:53:48 -0500 | [diff] [blame] | 670 | |
Jean-Paul Calderone | 5a9e461 | 2011-04-01 18:27:45 -0400 | [diff] [blame] | 671 | def test_get_data(self): |
| 672 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 673 | `X509Extension.get_data` returns a string giving the data of |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 674 | the extension. |
Jean-Paul Calderone | 5a9e461 | 2011-04-01 18:27:45 -0400 | [diff] [blame] | 675 | """ |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 676 | ext = X509Extension(b'basicConstraints', True, b'CA:true') |
Jean-Paul Calderone | 5a9e461 | 2011-04-01 18:27:45 -0400 | [diff] [blame] | 677 | # Expect to get back the DER encoded form of CA:true. |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 678 | assert ext.get_data() == b'0\x03\x01\x01\xff' |
Jean-Paul Calderone | 5a9e461 | 2011-04-01 18:27:45 -0400 | [diff] [blame] | 679 | |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 680 | def test_unused_subject(self, x509_data): |
Jean-Paul Calderone | 5a9e461 | 2011-04-01 18:27:45 -0400 | [diff] [blame] | 681 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 682 | The `subject` parameter to `X509Extension` may be provided for an |
| 683 | extension which does not use it and is ignored in this case. |
Jean-Paul Calderone | 5a9e461 | 2011-04-01 18:27:45 -0400 | [diff] [blame] | 684 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 685 | pkey, x509 = x509_data |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 686 | ext1 = X509Extension( |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 687 | b'basicConstraints', False, b'CA:TRUE', subject=x509) |
| 688 | x509.add_extensions([ext1]) |
| 689 | x509.sign(pkey, 'sha1') |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 690 | # This is a little lame. Can we think of a better way? |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 691 | text = dump_certificate(FILETYPE_TEXT, x509) |
| 692 | assert b'X509v3 Basic Constraints:' in text |
| 693 | assert b'CA:TRUE' in text |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 694 | |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 695 | def test_subject(self, x509_data): |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 696 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 697 | If an extension requires a subject, the `subject` parameter to |
| 698 | `X509Extension` provides its value. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 699 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 700 | pkey, x509 = x509_data |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 701 | ext3 = X509Extension( |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 702 | b'subjectKeyIdentifier', False, b'hash', subject=x509) |
| 703 | x509.add_extensions([ext3]) |
| 704 | x509.sign(pkey, 'sha1') |
| 705 | text = dump_certificate(FILETYPE_TEXT, x509) |
| 706 | assert b'X509v3 Subject Key Identifier:' in text |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 707 | |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 708 | def test_missing_subject(self): |
| 709 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 710 | If an extension requires a subject and the `subject` parameter |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 711 | is given no value, something happens. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 712 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 713 | with pytest.raises(Error): |
| 714 | X509Extension(b'subjectKeyIdentifier', False, b'hash') |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 715 | |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 716 | @pytest.mark.parametrize('bad_obj', [ |
| 717 | True, |
| 718 | object(), |
| 719 | "hello", |
| 720 | [], |
| 721 | ]) |
| 722 | def test_invalid_subject(self, bad_obj): |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 723 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 724 | If the `subject` parameter is given a value which is not an |
| 725 | `X509` instance, `TypeError` is raised. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 726 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 727 | with pytest.raises(TypeError): |
| 728 | X509Extension( |
| 729 | 'basicConstraints', False, 'CA:TRUE', subject=bad_obj) |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 730 | |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 731 | def test_unused_issuer(self, x509_data): |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 732 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 733 | The `issuer` parameter to `X509Extension` may be provided for an |
| 734 | extension which does not use it and is ignored in this case. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 735 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 736 | pkey, x509 = x509_data |
Jean-Paul Calderone | 40dd099 | 2010-08-22 17:52:07 -0400 | [diff] [blame] | 737 | ext1 = X509Extension( |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 738 | b'basicConstraints', False, b'CA:TRUE', issuer=x509) |
| 739 | x509.add_extensions([ext1]) |
| 740 | x509.sign(pkey, 'sha1') |
| 741 | text = dump_certificate(FILETYPE_TEXT, x509) |
| 742 | assert b'X509v3 Basic Constraints:' in text |
| 743 | assert b'CA:TRUE' in text |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 744 | |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 745 | def test_issuer(self, x509_data): |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 746 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 747 | If an extension requires an issuer, the `issuer` parameter to |
| 748 | `X509Extension` provides its value. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 749 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 750 | pkey, x509 = x509_data |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 751 | ext2 = X509Extension( |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 752 | b'authorityKeyIdentifier', False, b'issuer:always', |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 753 | issuer=x509) |
| 754 | x509.add_extensions([ext2]) |
| 755 | x509.sign(pkey, 'sha1') |
| 756 | text = dump_certificate(FILETYPE_TEXT, x509) |
| 757 | assert b'X509v3 Authority Key Identifier:' in text |
| 758 | assert b'DirName:/CN=Yoda root CA' in text |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 759 | |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 760 | def test_missing_issuer(self): |
| 761 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 762 | If an extension requires an issue and the `issuer` parameter is |
| 763 | given no value, something happens. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 764 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 765 | with pytest.raises(Error): |
| 766 | X509Extension( |
| 767 | b'authorityKeyIdentifier', |
| 768 | False, b'keyid:always,issuer:always') |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 769 | |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 770 | @pytest.mark.parametrize('bad_obj', [ |
| 771 | True, |
| 772 | object(), |
| 773 | "hello", |
| 774 | [], |
| 775 | ]) |
| 776 | def test_invalid_issuer(self, bad_obj): |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 777 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 778 | If the `issuer` parameter is given a value which is not an |
| 779 | `X509` instance, `TypeError` is raised. |
Jean-Paul Calderone | f0179c7 | 2009-07-17 15:48:22 -0400 | [diff] [blame] | 780 | """ |
Alex Chan | c607706 | 2016-11-18 13:53:39 +0000 | [diff] [blame] | 781 | with pytest.raises(TypeError): |
| 782 | X509Extension( |
| 783 | 'basicConstraints', False, 'keyid:always,issuer:always', |
| 784 | issuer=bad_obj) |
Rick Dean | 47262da | 2009-07-08 16:17:17 -0500 | [diff] [blame] | 785 | |
| 786 | |
Paul Kehrer | 72d968b | 2016-07-29 15:31:04 +0800 | [diff] [blame] | 787 | class TestPKey(object): |
| 788 | """ |
Hynek Schlawack | 3bcf315 | 2017-02-18 08:25:34 +0100 | [diff] [blame] | 789 | Tests for `OpenSSL.crypto.PKey`. |
Paul Kehrer | 72d968b | 2016-07-29 15:31:04 +0800 | [diff] [blame] | 790 | """ |
| 791 | |
| 792 | def test_convert_from_cryptography_private_key(self): |
| 793 | """ |
| 794 | PKey.from_cryptography_key creates a proper private PKey. |
| 795 | """ |
| 796 | key = serialization.load_pem_private_key( |
| 797 | intermediate_key_pem, None, backend |
| 798 | ) |
| 799 | pkey = PKey.from_cryptography_key(key) |
| 800 | |
| 801 | assert isinstance(pkey, PKey) |
| 802 | assert pkey.bits() == key.key_size |
| 803 | assert pkey._only_public is False |
| 804 | assert pkey._initialized is True |
| 805 | |
| 806 | def test_convert_from_cryptography_public_key(self): |
| 807 | """ |
| 808 | PKey.from_cryptography_key creates a proper public PKey. |
| 809 | """ |
| 810 | key = serialization.load_pem_public_key(cleartextPublicKeyPEM, backend) |
| 811 | pkey = PKey.from_cryptography_key(key) |
| 812 | |
| 813 | assert isinstance(pkey, PKey) |
| 814 | assert pkey.bits() == key.key_size |
| 815 | assert pkey._only_public is True |
| 816 | assert pkey._initialized is True |
| 817 | |
| 818 | def test_convert_from_cryptography_unsupported_type(self): |
| 819 | """ |
| 820 | PKey.from_cryptography_key raises TypeError with an unsupported type. |
| 821 | """ |
| 822 | key = serialization.load_pem_private_key( |
| 823 | ec_private_key_pem, None, backend |
| 824 | ) |
| 825 | with pytest.raises(TypeError): |
| 826 | PKey.from_cryptography_key(key) |
| 827 | |
| 828 | def test_convert_public_pkey_to_cryptography_key(self): |
| 829 | """ |
| 830 | PKey.to_cryptography_key creates a proper cryptography public key. |
| 831 | """ |
| 832 | pkey = load_publickey(FILETYPE_PEM, cleartextPublicKeyPEM) |
| 833 | key = pkey.to_cryptography_key() |
| 834 | |
| 835 | assert isinstance(key, rsa.RSAPublicKey) |
| 836 | assert pkey.bits() == key.key_size |
| 837 | |
| 838 | def test_convert_private_pkey_to_cryptography_key(self): |
| 839 | """ |
| 840 | PKey.to_cryptography_key creates a proper cryptography private key. |
| 841 | """ |
| 842 | pkey = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
| 843 | key = pkey.to_cryptography_key() |
| 844 | |
| 845 | assert isinstance(key, rsa.RSAPrivateKey) |
| 846 | assert pkey.bits() == key.key_size |
| 847 | |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 848 | def test_type(self): |
| 849 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 850 | `PKey` and `PKeyType` refer to the same type object and can be used to |
| 851 | create instances of that type. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 852 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 853 | assert PKey is PKeyType |
| 854 | assert is_consistent_type(PKey, 'PKey') |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 855 | |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 856 | def test_construction(self): |
| 857 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 858 | `PKey` takes no arguments and returns a new `PKey` instance. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 859 | """ |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 860 | key = PKey() |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 861 | assert isinstance(key, PKey) |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 862 | |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 863 | def test_pregeneration(self): |
| 864 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 865 | `PKey.bits` and `PKey.type` return `0` before the key is generated. |
| 866 | `PKey.check` raises `TypeError` before the key is generated. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 867 | """ |
| 868 | key = PKey() |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 869 | assert key.type() == 0 |
| 870 | assert key.bits() == 0 |
| 871 | with pytest.raises(TypeError): |
| 872 | key.check() |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 873 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 874 | def test_failed_generation(self): |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 875 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 876 | `PKey.generate_key` takes two arguments, the first giving the key type |
| 877 | as one of `TYPE_RSA` or `TYPE_DSA` and the second giving the number of |
| 878 | bits to generate. If an invalid type is specified or generation fails, |
| 879 | `Error` is raised. If an invalid number of bits is specified, |
| 880 | `ValueError` or `Error` is raised. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 881 | """ |
| 882 | key = PKey() |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 883 | with pytest.raises(TypeError): |
| 884 | key.generate_key("foo", "bar") |
| 885 | with pytest.raises(Error): |
| 886 | key.generate_key(-1, 0) |
Jean-Paul Calderone | ab82db7 | 2008-03-06 00:09:31 -0500 | [diff] [blame] | 887 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 888 | with pytest.raises(ValueError): |
| 889 | key.generate_key(TYPE_RSA, -1) |
| 890 | with pytest.raises(ValueError): |
| 891 | key.generate_key(TYPE_RSA, 0) |
Jean-Paul Calderone | d71fe98 | 2008-03-06 00:31:50 -0500 | [diff] [blame] | 892 | |
Alex Gaynor | 5bb2bd1 | 2016-07-03 10:48:32 -0400 | [diff] [blame] | 893 | with pytest.raises(TypeError): |
| 894 | key.generate_key(TYPE_RSA, object()) |
| 895 | |
Jean-Paul Calderone | d71fe98 | 2008-03-06 00:31:50 -0500 | [diff] [blame] | 896 | # XXX RSA generation for small values of bits is fairly buggy in a wide |
| 897 | # range of OpenSSL versions. I need to figure out what the safe lower |
| 898 | # bound for a reasonable number of OpenSSL versions is and explicitly |
| 899 | # check for that in the wrapper. The failure behavior is typically an |
| 900 | # infinite loop inside OpenSSL. |
| 901 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 902 | # with pytest.raises(Error): |
| 903 | # key.generate_key(TYPE_RSA, 2) |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 904 | |
| 905 | # XXX DSA generation seems happy with any number of bits. The DSS |
| 906 | # says bits must be between 512 and 1024 inclusive. OpenSSL's DSA |
| 907 | # generator doesn't seem to care about the upper limit at all. For |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 908 | # the lower limit, it uses 512 if anything smaller is specified. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 909 | # So, it doesn't seem possible to make generate_key fail for |
| 910 | # TYPE_DSA with a bits argument which is at least an int. |
| 911 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 912 | # with pytest.raises(Error): |
| 913 | # key.generate_key(TYPE_DSA, -7) |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 914 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 915 | def test_rsa_generation(self): |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 916 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 917 | `PKey.generate_key` generates an RSA key when passed `TYPE_RSA` as a |
| 918 | type and a reasonable number of bits. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 919 | """ |
| 920 | bits = 128 |
| 921 | key = PKey() |
| 922 | key.generate_key(TYPE_RSA, bits) |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 923 | assert key.type() == TYPE_RSA |
| 924 | assert key.bits() == bits |
| 925 | assert key.check() |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 926 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 927 | def test_dsa_generation(self): |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 928 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 929 | `PKey.generate_key` generates a DSA key when passed `TYPE_DSA` as a |
| 930 | type and a reasonable number of bits. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 931 | """ |
| 932 | # 512 is a magic number. The DSS (Digital Signature Standard) |
| 933 | # allows a minimum of 512 bits for DSA. DSA_generate_parameters |
| 934 | # will silently promote any value below 512 to 512. |
| 935 | bits = 512 |
| 936 | key = PKey() |
| 937 | key.generate_key(TYPE_DSA, bits) |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 938 | assert key.type() == TYPE_DSA |
| 939 | assert key.bits() == bits |
| 940 | with pytest.raises(TypeError): |
| 941 | key.check() |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 942 | |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 943 | def test_regeneration(self): |
| 944 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 945 | `PKey.generate_key` can be called multiple times on the same key to |
| 946 | generate new keys. |
Jean-Paul Calderone | d8782ad | 2008-03-04 23:39:59 -0500 | [diff] [blame] | 947 | """ |
| 948 | key = PKey() |
| 949 | for type, bits in [(TYPE_RSA, 512), (TYPE_DSA, 576)]: |
Alex Gaynor | 7f63649 | 2015-09-04 13:26:52 -0400 | [diff] [blame] | 950 | key.generate_key(type, bits) |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 951 | assert key.type() == type |
| 952 | assert key.bits() == bits |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 953 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 954 | def test_inconsistent_key(self): |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 955 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 956 | `PKey.check` returns `Error` if the key is not consistent. |
Jean-Paul Calderone | 55ec171 | 2009-05-13 14:14:30 -0400 | [diff] [blame] | 957 | """ |
| 958 | key = load_privatekey(FILETYPE_PEM, inconsistentPrivateKeyPEM) |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 959 | with pytest.raises(Error): |
| 960 | key.check() |
Jean-Paul Calderone | e81020e | 2011-06-12 21:48:57 -0400 | [diff] [blame] | 961 | |
Jean-Paul Calderone | 02d0197 | 2011-10-31 10:39:29 -0400 | [diff] [blame] | 962 | def test_check_public_key(self): |
| 963 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 964 | `PKey.check` raises `TypeError` if only the public part of the key |
| 965 | is available. |
Jean-Paul Calderone | 02d0197 | 2011-10-31 10:39:29 -0400 | [diff] [blame] | 966 | """ |
| 967 | # A trick to get a public-only key |
| 968 | key = PKey() |
| 969 | key.generate_key(TYPE_RSA, 512) |
| 970 | cert = X509() |
| 971 | cert.set_pubkey(key) |
| 972 | pub = cert.get_pubkey() |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 973 | with pytest.raises(TypeError): |
| 974 | pub.check() |
Jean-Paul Calderone | 02d0197 | 2011-10-31 10:39:29 -0400 | [diff] [blame] | 975 | |
| 976 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 977 | def x509_name(**attrs): |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 978 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 979 | Return a new X509Name with the given attributes. |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 980 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 981 | # XXX There's no other way to get a new X509Name yet. |
| 982 | name = X509().get_subject() |
| 983 | attrs = list(attrs.items()) |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 984 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 985 | # Make the order stable - order matters! |
| 986 | def key(attr): |
| 987 | return attr[1] |
| 988 | attrs.sort(key=key) |
| 989 | for k, v in attrs: |
| 990 | setattr(name, k, v) |
| 991 | return name |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 992 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 993 | |
| 994 | class TestX509Name(object): |
| 995 | """ |
| 996 | Unit tests for `OpenSSL.crypto.X509Name`. |
| 997 | """ |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 998 | |
Rick Dean | e15b147 | 2009-07-09 15:53:42 -0500 | [diff] [blame] | 999 | def test_type(self): |
| 1000 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1001 | The type of X509Name objects is `X509NameType`. |
Rick Dean | e15b147 | 2009-07-09 15:53:42 -0500 | [diff] [blame] | 1002 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1003 | assert X509Name is X509NameType |
| 1004 | assert X509NameType.__name__ == 'X509Name' |
| 1005 | assert isinstance(X509NameType, type) |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 1006 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1007 | name = x509_name() |
| 1008 | assert isinstance(name, X509NameType) |
Rick Dean | e15b147 | 2009-07-09 15:53:42 -0500 | [diff] [blame] | 1009 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1010 | def test_only_string_attributes(self): |
Jean-Paul Calderone | 9ce9afb | 2011-04-22 18:16:22 -0400 | [diff] [blame] | 1011 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1012 | Attempting to set a non-`str` attribute name on an `X509Name` instance |
| 1013 | causes `TypeError` to be raised. |
Jean-Paul Calderone | 9ce9afb | 2011-04-22 18:16:22 -0400 | [diff] [blame] | 1014 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1015 | name = x509_name() |
Jean-Paul Calderone | 9ce9afb | 2011-04-22 18:16:22 -0400 | [diff] [blame] | 1016 | # Beyond these cases, you may also think that unicode should be |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1017 | # rejected. Sorry, you're wrong. unicode is automatically converted |
| 1018 | # to str outside of the control of X509Name, so there's no way to |
| 1019 | # reject it. |
Jean-Paul Calderone | ff363be | 2013-03-03 10:21:23 -0800 | [diff] [blame] | 1020 | |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1021 | # Also, this used to test str subclasses, but that test is less |
| 1022 | # relevant now that the implementation is in Python instead of C. Also |
| 1023 | # PyPy automatically converts str subclasses to str when they are |
| 1024 | # passed to setattr, so we can't test it on PyPy. Apparently CPython |
| 1025 | # does this sometimes as well. |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1026 | with pytest.raises(TypeError): |
| 1027 | setattr(name, None, "hello") |
| 1028 | with pytest.raises(TypeError): |
| 1029 | setattr(name, 30, "hello") |
Jean-Paul Calderone | 9ce9afb | 2011-04-22 18:16:22 -0400 | [diff] [blame] | 1030 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1031 | def test_set_invalid_attribute(self): |
Jean-Paul Calderone | 9ce9afb | 2011-04-22 18:16:22 -0400 | [diff] [blame] | 1032 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1033 | Attempting to set any attribute name on an `X509Name` instance for |
| 1034 | which no corresponding NID is defined causes `AttributeError` to be |
| 1035 | raised. |
Jean-Paul Calderone | 9ce9afb | 2011-04-22 18:16:22 -0400 | [diff] [blame] | 1036 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1037 | name = x509_name() |
| 1038 | with pytest.raises(AttributeError): |
| 1039 | setattr(name, "no such thing", None) |
Jean-Paul Calderone | 9ce9afb | 2011-04-22 18:16:22 -0400 | [diff] [blame] | 1040 | |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 1041 | def test_attributes(self): |
| 1042 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1043 | `X509Name` instances have attributes for each standard (?) |
| 1044 | X509Name field. |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 1045 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1046 | name = x509_name() |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 1047 | name.commonName = "foo" |
Alex Gaynor | 3772611 | 2016-07-04 09:51:32 -0400 | [diff] [blame] | 1048 | assert name.commonName == "foo" |
| 1049 | assert name.CN == "foo" |
| 1050 | |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 1051 | name.CN = "baz" |
Alex Gaynor | 3772611 | 2016-07-04 09:51:32 -0400 | [diff] [blame] | 1052 | assert name.commonName == "baz" |
| 1053 | assert name.CN == "baz" |
| 1054 | |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 1055 | name.commonName = "bar" |
Alex Gaynor | 3772611 | 2016-07-04 09:51:32 -0400 | [diff] [blame] | 1056 | assert name.commonName == "bar" |
| 1057 | assert name.CN == "bar" |
| 1058 | |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 1059 | name.CN = "quux" |
Alex Gaynor | 3772611 | 2016-07-04 09:51:32 -0400 | [diff] [blame] | 1060 | assert name.commonName == "quux" |
| 1061 | assert name.CN == "quux" |
| 1062 | |
| 1063 | assert name.OU is None |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 1064 | |
Alex Gaynor | 7778e79 | 2016-07-03 23:38:48 -0400 | [diff] [blame] | 1065 | with pytest.raises(AttributeError): |
| 1066 | name.foobar |
| 1067 | |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 1068 | def test_copy(self): |
| 1069 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1070 | `X509Name` creates a new `X509Name` instance with all the same |
| 1071 | attributes as an existing `X509Name` instance when called with one. |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 1072 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1073 | name = x509_name(commonName="foo", emailAddress="bar@example.com") |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 1074 | |
| 1075 | copy = X509Name(name) |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1076 | assert copy.commonName == "foo" |
| 1077 | assert copy.emailAddress == "bar@example.com" |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1078 | |
| 1079 | # Mutate the copy and ensure the original is unmodified. |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 1080 | copy.commonName = "baz" |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1081 | assert name.commonName == "foo" |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1082 | |
| 1083 | # Mutate the original and ensure the copy is unmodified. |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 1084 | name.emailAddress = "quux@example.com" |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1085 | assert copy.emailAddress == "bar@example.com" |
Jean-Paul Calderone | eff3cd9 | 2008-03-05 22:35:26 -0500 | [diff] [blame] | 1086 | |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1087 | def test_repr(self): |
| 1088 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1089 | `repr` passed an `X509Name` instance should return a string containing |
| 1090 | a description of the type and the NIDs which have been set on it. |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1091 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1092 | name = x509_name(commonName="foo", emailAddress="bar") |
| 1093 | assert repr(name) == "<X509Name object '/emailAddress=bar/CN=foo'>" |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1094 | |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1095 | def test_comparison(self): |
| 1096 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1097 | `X509Name` instances should compare based on their NIDs. |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1098 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1099 | def _equality(a, b, assert_true, assert_false): |
| 1100 | assert_true(a == b) |
| 1101 | assert_false(a != b) |
| 1102 | assert_true(b == a) |
| 1103 | assert_false(b != a) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1104 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1105 | def assert_true(x): |
| 1106 | assert x |
| 1107 | |
| 1108 | def assert_false(x): |
| 1109 | assert not x |
| 1110 | |
| 1111 | def assert_equal(a, b): |
| 1112 | _equality(a, b, assert_true, assert_false) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1113 | |
| 1114 | # Instances compare equal to themselves. |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1115 | name = x509_name() |
| 1116 | assert_equal(name, name) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1117 | |
| 1118 | # Empty instances should compare equal to each other. |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1119 | assert_equal(x509_name(), x509_name()) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1120 | |
| 1121 | # Instances with equal NIDs should compare equal to each other. |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1122 | assert_equal(x509_name(commonName="foo"), |
| 1123 | x509_name(commonName="foo")) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1124 | |
| 1125 | # Instance with equal NIDs set using different aliases should compare |
| 1126 | # equal to each other. |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1127 | assert_equal(x509_name(commonName="foo"), |
| 1128 | x509_name(CN="foo")) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1129 | |
| 1130 | # Instances with more than one NID with the same values should compare |
| 1131 | # equal to each other. |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1132 | assert_equal(x509_name(CN="foo", organizationalUnitName="bar"), |
| 1133 | x509_name(commonName="foo", OU="bar")) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1134 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1135 | def assert_not_equal(a, b): |
| 1136 | _equality(a, b, assert_false, assert_true) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1137 | |
| 1138 | # Instances with different values for the same NID should not compare |
| 1139 | # equal to each other. |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1140 | assert_not_equal(x509_name(CN="foo"), |
| 1141 | x509_name(CN="bar")) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1142 | |
| 1143 | # Instances with different NIDs should not compare equal to each other. |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1144 | assert_not_equal(x509_name(CN="foo"), |
| 1145 | x509_name(OU="foo")) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1146 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1147 | assert_not_equal(x509_name(), object()) |
Alex Gaynor | 7778e79 | 2016-07-03 23:38:48 -0400 | [diff] [blame] | 1148 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1149 | def _inequality(a, b, assert_true, assert_false): |
| 1150 | assert_true(a < b) |
| 1151 | assert_true(a <= b) |
| 1152 | assert_true(b > a) |
| 1153 | assert_true(b >= a) |
| 1154 | assert_false(a > b) |
| 1155 | assert_false(a >= b) |
| 1156 | assert_false(b < a) |
| 1157 | assert_false(b <= a) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1158 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1159 | def assert_less_than(a, b): |
| 1160 | _inequality(a, b, assert_true, assert_false) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1161 | |
| 1162 | # An X509Name with a NID with a value which sorts less than the value |
| 1163 | # of the same NID on another X509Name compares less than the other |
| 1164 | # X509Name. |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1165 | assert_less_than(x509_name(CN="abc"), |
| 1166 | x509_name(CN="def")) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1167 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1168 | def assert_greater_than(a, b): |
| 1169 | _inequality(a, b, assert_false, assert_true) |
Jean-Paul Calderone | e098dc7 | 2008-03-06 18:36:19 -0500 | [diff] [blame] | 1170 | |
| 1171 | # An X509Name with a NID with a value which sorts greater than the |
| 1172 | # value of the same NID on another X509Name compares greater than the |
| 1173 | # other X509Name. |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1174 | assert_greater_than(x509_name(CN="def"), |
| 1175 | x509_name(CN="abc")) |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1176 | |
Jean-Paul Calderone | 110cd09 | 2008-03-24 17:27:42 -0400 | [diff] [blame] | 1177 | def test_hash(self): |
| 1178 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1179 | `X509Name.hash` returns an integer hash based on the value of the name. |
Jean-Paul Calderone | 110cd09 | 2008-03-24 17:27:42 -0400 | [diff] [blame] | 1180 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1181 | a = x509_name(CN="foo") |
| 1182 | b = x509_name(CN="foo") |
| 1183 | assert a.hash() == b.hash() |
Jean-Paul Calderone | 110cd09 | 2008-03-24 17:27:42 -0400 | [diff] [blame] | 1184 | a.CN = "bar" |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1185 | assert a.hash() != b.hash() |
Jean-Paul Calderone | 110cd09 | 2008-03-24 17:27:42 -0400 | [diff] [blame] | 1186 | |
Jean-Paul Calderone | e957a00 | 2008-03-25 15:16:51 -0400 | [diff] [blame] | 1187 | def test_der(self): |
| 1188 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1189 | `X509Name.der` returns the DER encoded form of the name. |
Jean-Paul Calderone | e957a00 | 2008-03-25 15:16:51 -0400 | [diff] [blame] | 1190 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1191 | a = x509_name(CN="foo", C="US") |
| 1192 | assert (a.der() == |
| 1193 | b'0\x1b1\x0b0\t\x06\x03U\x04\x06\x13\x02US' |
| 1194 | b'1\x0c0\n\x06\x03U\x04\x03\x0c\x03foo') |
Jean-Paul Calderone | e957a00 | 2008-03-25 15:16:51 -0400 | [diff] [blame] | 1195 | |
Jean-Paul Calderone | c54cc18 | 2008-03-26 21:11:07 -0400 | [diff] [blame] | 1196 | def test_get_components(self): |
| 1197 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1198 | `X509Name.get_components` returns a `list` of two-tuples of `str` |
Jean-Paul Calderone | c54cc18 | 2008-03-26 21:11:07 -0400 | [diff] [blame] | 1199 | giving the NIDs and associated values which make up the name. |
| 1200 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1201 | a = x509_name() |
| 1202 | assert a.get_components() == [] |
Jean-Paul Calderone | c54cc18 | 2008-03-26 21:11:07 -0400 | [diff] [blame] | 1203 | a.CN = "foo" |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1204 | assert a.get_components() == [(b"CN", b"foo")] |
Jean-Paul Calderone | c54cc18 | 2008-03-26 21:11:07 -0400 | [diff] [blame] | 1205 | a.organizationalUnitName = "bar" |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1206 | assert a.get_components() == [(b"CN", b"foo"), (b"OU", b"bar")] |
Jean-Paul Calderone | c54cc18 | 2008-03-26 21:11:07 -0400 | [diff] [blame] | 1207 | |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1208 | def test_load_nul_byte_attribute(self): |
| 1209 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1210 | An `X509Name` from an `X509` instance loaded from a file can have a |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1211 | NUL byte in the value of one of its attributes. |
| 1212 | """ |
| 1213 | cert = load_certificate(FILETYPE_PEM, nulbyteSubjectAltNamePEM) |
| 1214 | subject = cert.get_subject() |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1215 | assert "null.python.org\x00example.org" == subject.commonName |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1216 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1217 | def test_set_attribute_failure(self): |
Jean-Paul Calderone | 5300d6a | 2013-12-29 16:36:50 -0500 | [diff] [blame] | 1218 | """ |
| 1219 | If the value of an attribute cannot be set for some reason then |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1220 | `Error` is raised. |
Jean-Paul Calderone | 5300d6a | 2013-12-29 16:36:50 -0500 | [diff] [blame] | 1221 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1222 | name = x509_name() |
Jean-Paul Calderone | 5300d6a | 2013-12-29 16:36:50 -0500 | [diff] [blame] | 1223 | # This value is too long |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1224 | with pytest.raises(Error): |
| 1225 | setattr(name, "O", b"x" * 512) |
Jean-Paul Calderone | 5300d6a | 2013-12-29 16:36:50 -0500 | [diff] [blame] | 1226 | |
| 1227 | |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1228 | class _PKeyInteractionTestsMixin: |
| 1229 | """ |
| 1230 | Tests which involve another thing and a PKey. |
| 1231 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 1232 | |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1233 | def signable(self): |
| 1234 | """ |
Alex Chan | fb078d8 | 2017-04-20 11:16:15 +0100 | [diff] [blame] | 1235 | Return something with a `set_pubkey`, `set_pubkey`, and `sign` method. |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1236 | """ |
| 1237 | raise NotImplementedError() |
| 1238 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1239 | def test_sign_with_ungenerated(self): |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1240 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1241 | `X509Req.sign` raises `ValueError` when passed a `PKey` with no parts. |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1242 | """ |
| 1243 | request = self.signable() |
| 1244 | key = PKey() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1245 | with pytest.raises(ValueError): |
| 1246 | request.sign(key, GOOD_DIGEST) |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1247 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1248 | def test_sign_with_public_key(self): |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1249 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1250 | `X509Req.sign` raises `ValueError` when passed a `PKey` with no private |
| 1251 | part as the signing key. |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1252 | """ |
| 1253 | request = self.signable() |
| 1254 | key = PKey() |
| 1255 | key.generate_key(TYPE_RSA, 512) |
| 1256 | request.set_pubkey(key) |
| 1257 | pub = request.get_pubkey() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1258 | with pytest.raises(ValueError): |
| 1259 | request.sign(pub, GOOD_DIGEST) |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1260 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1261 | def test_sign_with_unknown_digest(self): |
Jean-Paul Calderone | cc05a91 | 2010-08-03 18:24:19 -0400 | [diff] [blame] | 1262 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1263 | `X509Req.sign` raises `ValueError` when passed a digest name which is |
| 1264 | not known. |
Jean-Paul Calderone | cc05a91 | 2010-08-03 18:24:19 -0400 | [diff] [blame] | 1265 | """ |
| 1266 | request = self.signable() |
| 1267 | key = PKey() |
| 1268 | key.generate_key(TYPE_RSA, 512) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1269 | with pytest.raises(ValueError): |
| 1270 | request.sign(key, BAD_DIGEST) |
Jean-Paul Calderone | cc05a91 | 2010-08-03 18:24:19 -0400 | [diff] [blame] | 1271 | |
Jean-Paul Calderone | b972559 | 2010-08-03 18:17:22 -0400 | [diff] [blame] | 1272 | def test_sign(self): |
| 1273 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1274 | `X509Req.sign` succeeds when passed a private key object and a |
| 1275 | valid digest function. `X509Req.verify` can be used to check |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1276 | the signature. |
Jean-Paul Calderone | b972559 | 2010-08-03 18:17:22 -0400 | [diff] [blame] | 1277 | """ |
| 1278 | request = self.signable() |
| 1279 | key = PKey() |
| 1280 | key.generate_key(TYPE_RSA, 512) |
| 1281 | request.set_pubkey(key) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1282 | request.sign(key, GOOD_DIGEST) |
Jean-Paul Calderone | b972559 | 2010-08-03 18:17:22 -0400 | [diff] [blame] | 1283 | # If the type has a verify method, cover that too. |
| 1284 | if getattr(request, 'verify', None) is not None: |
| 1285 | pub = request.get_pubkey() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1286 | assert request.verify(pub) |
Jean-Paul Calderone | b972559 | 2010-08-03 18:17:22 -0400 | [diff] [blame] | 1287 | # Make another key that won't verify. |
| 1288 | key = PKey() |
| 1289 | key.generate_key(TYPE_RSA, 512) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1290 | with pytest.raises(Error): |
| 1291 | request.verify(key) |
Jean-Paul Calderone | b972559 | 2010-08-03 18:17:22 -0400 | [diff] [blame] | 1292 | |
| 1293 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1294 | class TestX509Req(_PKeyInteractionTestsMixin): |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1295 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1296 | Tests for `OpenSSL.crypto.X509Req`. |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1297 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 1298 | |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1299 | def signable(self): |
| 1300 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1301 | Create and return a new `X509Req`. |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1302 | """ |
| 1303 | return X509Req() |
| 1304 | |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 1305 | def test_type(self): |
| 1306 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1307 | `X509Req` and `X509ReqType` refer to the same type object and can be |
| 1308 | used to create instances of that type. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 1309 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1310 | assert X509Req is X509ReqType |
| 1311 | assert is_consistent_type(X509Req, 'X509Req') |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1312 | |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1313 | def test_construction(self): |
| 1314 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1315 | `X509Req` takes no arguments and returns an `X509ReqType` instance. |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1316 | """ |
| 1317 | request = X509Req() |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1318 | assert isinstance(request, X509ReqType) |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1319 | |
Jean-Paul Calderone | 8dd19b8 | 2008-12-28 20:41:16 -0500 | [diff] [blame] | 1320 | def test_version(self): |
| 1321 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1322 | `X509Req.set_version` sets the X.509 version of the certificate |
| 1323 | request. `X509Req.get_version` returns the X.509 version of the |
| 1324 | certificate request. The initial value of the version is 0. |
Jean-Paul Calderone | 8dd19b8 | 2008-12-28 20:41:16 -0500 | [diff] [blame] | 1325 | """ |
| 1326 | request = X509Req() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1327 | assert request.get_version() == 0 |
Jean-Paul Calderone | 8dd19b8 | 2008-12-28 20:41:16 -0500 | [diff] [blame] | 1328 | request.set_version(1) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1329 | assert request.get_version() == 1 |
Jean-Paul Calderone | 8dd19b8 | 2008-12-28 20:41:16 -0500 | [diff] [blame] | 1330 | request.set_version(3) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1331 | assert request.get_version() == 3 |
Jean-Paul Calderone | 8dd19b8 | 2008-12-28 20:41:16 -0500 | [diff] [blame] | 1332 | |
Jean-Paul Calderone | 54e49e9 | 2010-07-30 11:04:46 -0400 | [diff] [blame] | 1333 | def test_version_wrong_args(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 1334 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1335 | `X509Req.set_version` raises `TypeError` if called with a non-`int` |
| 1336 | argument. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 1337 | """ |
Jean-Paul Calderone | 54e49e9 | 2010-07-30 11:04:46 -0400 | [diff] [blame] | 1338 | request = X509Req() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1339 | with pytest.raises(TypeError): |
| 1340 | request.set_version("foo") |
Jean-Paul Calderone | 54e49e9 | 2010-07-30 11:04:46 -0400 | [diff] [blame] | 1341 | |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1342 | def test_get_subject(self): |
| 1343 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1344 | `X509Req.get_subject` returns an `X509Name` for the subject of the |
| 1345 | request and which is valid even after the request object is |
| 1346 | otherwise dead. |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1347 | """ |
| 1348 | request = X509Req() |
| 1349 | subject = request.get_subject() |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1350 | assert isinstance(subject, X509NameType) |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1351 | subject.commonName = "foo" |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1352 | assert request.get_subject().commonName == "foo" |
Jean-Paul Calderone | 2aa2b33 | 2008-03-06 21:43:14 -0500 | [diff] [blame] | 1353 | del request |
| 1354 | subject.commonName = "bar" |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1355 | assert subject.commonName == "bar" |
Jean-Paul Calderone | 54e49e9 | 2010-07-30 11:04:46 -0400 | [diff] [blame] | 1356 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1357 | def test_add_extensions(self): |
| 1358 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1359 | `X509Req.add_extensions` accepts a `list` of `X509Extension` instances |
| 1360 | and adds them to the X509 request. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1361 | """ |
| 1362 | request = X509Req() |
| 1363 | request.add_extensions([ |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1364 | X509Extension(b'basicConstraints', True, b'CA:false')]) |
Stephen Holsapple | ca545b7 | 2014-01-28 21:43:25 -0800 | [diff] [blame] | 1365 | exts = request.get_extensions() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1366 | assert len(exts) == 1 |
| 1367 | assert exts[0].get_short_name() == b'basicConstraints' |
| 1368 | assert exts[0].get_critical() == 1 |
| 1369 | assert exts[0].get_data() == b'0\x00' |
Stephen Holsapple | 7fbdf64 | 2014-03-01 20:05:47 -0800 | [diff] [blame] | 1370 | |
Stephen Holsapple | 7fbdf64 | 2014-03-01 20:05:47 -0800 | [diff] [blame] | 1371 | def test_get_extensions(self): |
| 1372 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1373 | `X509Req.get_extensions` returns a `list` of extensions added to this |
| 1374 | X509 request. |
Stephen Holsapple | 7fbdf64 | 2014-03-01 20:05:47 -0800 | [diff] [blame] | 1375 | """ |
| 1376 | request = X509Req() |
| 1377 | exts = request.get_extensions() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1378 | assert exts == [] |
Stephen Holsapple | 7fbdf64 | 2014-03-01 20:05:47 -0800 | [diff] [blame] | 1379 | request.add_extensions([ |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1380 | X509Extension(b'basicConstraints', True, b'CA:true'), |
| 1381 | X509Extension(b'keyUsage', False, b'digitalSignature')]) |
Stephen Holsapple | 7fbdf64 | 2014-03-01 20:05:47 -0800 | [diff] [blame] | 1382 | exts = request.get_extensions() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1383 | assert len(exts) == 2 |
| 1384 | assert exts[0].get_short_name() == b'basicConstraints' |
| 1385 | assert exts[0].get_critical() == 1 |
| 1386 | assert exts[0].get_data() == b'0\x03\x01\x01\xff' |
| 1387 | assert exts[1].get_short_name() == b'keyUsage' |
| 1388 | assert exts[1].get_critical() == 0 |
| 1389 | assert exts[1].get_data() == b'\x03\x02\x07\x80' |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1390 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1391 | def test_add_extensions_wrong_args(self): |
| 1392 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1393 | `X509Req.add_extensions` raises `TypeError` if called with a |
| 1394 | non-`list`. Or it raises `ValueError` if called with a `list` |
| 1395 | containing objects other than `X509Extension` instances. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1396 | """ |
| 1397 | request = X509Req() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1398 | with pytest.raises(TypeError): |
| 1399 | request.add_extensions(object()) |
| 1400 | with pytest.raises(ValueError): |
| 1401 | request.add_extensions([object()]) |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1402 | |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1403 | def test_verify_wrong_args(self): |
| 1404 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1405 | `X509Req.verify` raises `TypeError` if passed anything other than a |
| 1406 | `PKey` instance as its single argument. |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1407 | """ |
| 1408 | request = X509Req() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1409 | with pytest.raises(TypeError): |
| 1410 | request.verify(object()) |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1411 | |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1412 | def test_verify_uninitialized_key(self): |
| 1413 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1414 | `X509Req.verify` raises `OpenSSL.crypto.Error` if called with a |
| 1415 | `OpenSSL.crypto.PKey` which contains no key data. |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1416 | """ |
| 1417 | request = X509Req() |
| 1418 | pkey = PKey() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1419 | with pytest.raises(Error): |
| 1420 | request.verify(pkey) |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1421 | |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1422 | def test_verify_wrong_key(self): |
| 1423 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1424 | `X509Req.verify` raises `OpenSSL.crypto.Error` if called with a |
| 1425 | `OpenSSL.crypto.PKey` which does not represent the public part of the |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1426 | key which signed the request. |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1427 | """ |
| 1428 | request = X509Req() |
| 1429 | pkey = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1430 | request.sign(pkey, GOOD_DIGEST) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1431 | another_pkey = load_privatekey(FILETYPE_PEM, client_key_pem) |
| 1432 | with pytest.raises(Error): |
| 1433 | request.verify(another_pkey) |
| 1434 | |
| 1435 | def test_verify_success(self): |
| 1436 | """ |
| 1437 | `X509Req.verify` returns `True` if called with a `OpenSSL.crypto.PKey` |
| 1438 | which represents the public part of the key which signed the request. |
| 1439 | """ |
| 1440 | request = X509Req() |
| 1441 | pkey = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
| 1442 | request.sign(pkey, GOOD_DIGEST) |
| 1443 | assert request.verify(pkey) |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1444 | |
Paul Kehrer | 41c1024 | 2017-06-29 18:24:17 -0500 | [diff] [blame] | 1445 | def test_convert_from_cryptography(self): |
| 1446 | crypto_req = x509.load_pem_x509_csr( |
| 1447 | cleartextCertificateRequestPEM, backend |
| 1448 | ) |
| 1449 | req = X509Req.from_cryptography(crypto_req) |
| 1450 | assert isinstance(req, X509Req) |
| 1451 | |
| 1452 | def test_convert_from_cryptography_unsupported_type(self): |
| 1453 | with pytest.raises(TypeError): |
| 1454 | X509Req.from_cryptography(object()) |
| 1455 | |
| 1456 | def test_convert_to_cryptography_key(self): |
| 1457 | req = load_certificate_request( |
| 1458 | FILETYPE_PEM, cleartextCertificateRequestPEM |
| 1459 | ) |
| 1460 | crypto_req = req.to_cryptography() |
| 1461 | assert isinstance(crypto_req, x509.CertificateSigningRequest) |
| 1462 | |
Jean-Paul Calderone | 5565f0f | 2013-03-06 11:10:20 -0800 | [diff] [blame] | 1463 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1464 | class TestX509(_PKeyInteractionTestsMixin): |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1465 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1466 | Tests for `OpenSSL.crypto.X509`. |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1467 | """ |
Jean-Paul Calderone | 5ef8651 | 2008-04-26 19:06:28 -0400 | [diff] [blame] | 1468 | pemData = cleartextCertificatePEM + cleartextPrivateKeyPEM |
Jean-Paul Calderone | 8114b45 | 2008-03-25 15:27:59 -0400 | [diff] [blame] | 1469 | |
Roland Hedberg | 7e4930e | 2008-04-22 22:58:50 +0200 | [diff] [blame] | 1470 | extpem = """ |
| 1471 | -----BEGIN CERTIFICATE----- |
| 1472 | MIIC3jCCAkegAwIBAgIJAJHFjlcCgnQzMA0GCSqGSIb3DQEBBQUAMEcxCzAJBgNV |
| 1473 | BAYTAlNFMRUwEwYDVQQIEwxXZXN0ZXJib3R0b20xEjAQBgNVBAoTCUNhdGFsb2dp |
| 1474 | eDENMAsGA1UEAxMEUm9vdDAeFw0wODA0MjIxNDQ1MzhaFw0wOTA0MjIxNDQ1Mzha |
| 1475 | MFQxCzAJBgNVBAYTAlNFMQswCQYDVQQIEwJXQjEUMBIGA1UEChMLT3Blbk1ldGFk |
| 1476 | aXIxIjAgBgNVBAMTGW5vZGUxLm9tMi5vcGVubWV0YWRpci5vcmcwgZ8wDQYJKoZI |
| 1477 | hvcNAQEBBQADgY0AMIGJAoGBAPIcQMrwbk2nESF/0JKibj9i1x95XYAOwP+LarwT |
| 1478 | Op4EQbdlI9SY+uqYqlERhF19w7CS+S6oyqx0DRZSk4Y9dZ9j9/xgm2u/f136YS1u |
| 1479 | zgYFPvfUs6PqYLPSM8Bw+SjJ+7+2+TN+Tkiof9WP1cMjodQwOmdsiRbR0/J7+b1B |
| 1480 | hec1AgMBAAGjgcQwgcEwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNT |
| 1481 | TCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFIdHsBcMVVMbAO7j6NCj |
| 1482 | 03HgLnHaMB8GA1UdIwQYMBaAFL2h9Bf9Mre4vTdOiHTGAt7BRY/8MEYGA1UdEQQ/ |
| 1483 | MD2CDSouZXhhbXBsZS5vcmeCESoub20yLmV4bWFwbGUuY29thwSC7wgKgRNvbTJA |
| 1484 | b3Blbm1ldGFkaXIub3JnMA0GCSqGSIb3DQEBBQUAA4GBALd7WdXkp2KvZ7/PuWZA |
| 1485 | MPlIxyjS+Ly11+BNE0xGQRp9Wz+2lABtpgNqssvU156+HkKd02rGheb2tj7MX9hG |
| 1486 | uZzbwDAZzJPjzDQDD7d3cWsrVcfIdqVU7epHqIadnOF+X0ghJ39pAm6VVadnSXCt |
| 1487 | WpOdIpB8KksUTCzV591Nr1wd |
| 1488 | -----END CERTIFICATE----- |
| 1489 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 1490 | |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1491 | def signable(self): |
| 1492 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1493 | Create and return a new `X509`. |
Jean-Paul Calderone | ac0d95f | 2008-03-10 00:00:42 -0400 | [diff] [blame] | 1494 | """ |
| 1495 | return X509() |
| 1496 | |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 1497 | def test_type(self): |
| 1498 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1499 | `X509` and `X509Type` refer to the same type object and can be used to |
| 1500 | create instances of that type. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 1501 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1502 | assert X509 is X509Type |
| 1503 | assert is_consistent_type(X509, 'X509') |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 1504 | |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1505 | def test_construction(self): |
| 1506 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1507 | `X509` takes no arguments and returns an instance of `X509Type`. |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1508 | """ |
| 1509 | certificate = X509() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1510 | assert isinstance(certificate, X509Type) |
| 1511 | assert type(X509Type).__name__ == 'type' |
| 1512 | assert type(certificate).__name__ == 'X509' |
| 1513 | assert type(certificate) == X509Type |
| 1514 | assert type(certificate) == X509 |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1515 | |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1516 | def test_set_version_wrong_args(self): |
| 1517 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1518 | `X509.set_version` raises `TypeError` if invoked with an argument |
| 1519 | not of type `int`. |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1520 | """ |
| 1521 | cert = X509() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1522 | with pytest.raises(TypeError): |
| 1523 | cert.set_version(None) |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1524 | |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1525 | def test_version(self): |
| 1526 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1527 | `X509.set_version` sets the certificate version number. |
| 1528 | `X509.get_version` retrieves it. |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1529 | """ |
| 1530 | cert = X509() |
| 1531 | cert.set_version(1234) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1532 | assert cert.get_version() == 1234 |
Jean-Paul Calderone | 3544eb4 | 2010-07-30 22:09:47 -0400 | [diff] [blame] | 1533 | |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1534 | def test_serial_number(self): |
| 1535 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1536 | The serial number of an `X509` can be retrieved and |
| 1537 | modified with `X509.get_serial_number` and |
| 1538 | `X509.set_serial_number`. |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1539 | """ |
| 1540 | certificate = X509() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1541 | with pytest.raises(TypeError): |
| 1542 | certificate.set_serial_number("1") |
| 1543 | assert certificate.get_serial_number() == 0 |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1544 | certificate.set_serial_number(1) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1545 | assert certificate.get_serial_number() == 1 |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1546 | certificate.set_serial_number(2 ** 32 + 1) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1547 | assert certificate.get_serial_number() == 2 ** 32 + 1 |
Jean-Paul Calderone | 78381d2 | 2008-03-06 23:35:22 -0500 | [diff] [blame] | 1548 | certificate.set_serial_number(2 ** 64 + 1) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1549 | assert certificate.get_serial_number() == 2 ** 64 + 1 |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1550 | certificate.set_serial_number(2 ** 128 + 1) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1551 | assert certificate.get_serial_number() == 2 ** 128 + 1 |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1552 | |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1553 | def _setBoundTest(self, which): |
| 1554 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1555 | `X509.set_notBefore` takes a string in the format of an |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1556 | ASN1 GENERALIZEDTIME and sets the beginning of the certificate's |
| 1557 | validity period to it. |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1558 | """ |
| 1559 | certificate = X509() |
| 1560 | set = getattr(certificate, 'set_not' + which) |
| 1561 | get = getattr(certificate, 'get_not' + which) |
| 1562 | |
Jean-Paul Calderone | e0615b5 | 2008-03-09 21:44:46 -0400 | [diff] [blame] | 1563 | # Starts with no value. |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1564 | assert get() is None |
Jean-Paul Calderone | e0615b5 | 2008-03-09 21:44:46 -0400 | [diff] [blame] | 1565 | |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1566 | # GMT (Or is it UTC?) -exarkun |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1567 | when = b"20040203040506Z" |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1568 | set(when) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1569 | assert get() == when |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1570 | |
| 1571 | # A plus two hours and thirty minutes offset |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1572 | when = b"20040203040506+0530" |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1573 | set(when) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1574 | assert get() == when |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1575 | |
| 1576 | # A minus one hour fifteen minutes offset |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1577 | when = b"20040203040506-0115" |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1578 | set(when) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1579 | assert get() == when |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1580 | |
| 1581 | # An invalid string results in a ValueError |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1582 | with pytest.raises(ValueError): |
| 1583 | set(b"foo bar") |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1584 | |
Jean-Paul Calderone | 31ca200 | 2010-01-30 15:14:43 -0500 | [diff] [blame] | 1585 | # The wrong number of arguments results in a TypeError. |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1586 | with pytest.raises(TypeError): |
| 1587 | set() |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 1588 | with pytest.raises(TypeError): |
| 1589 | set(b"20040203040506Z", b"20040203040506Z") |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1590 | with pytest.raises(TypeError): |
| 1591 | get(b"foo bar") |
Jean-Paul Calderone | e890db3 | 2010-08-22 16:55:15 -0400 | [diff] [blame] | 1592 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1593 | # XXX ASN1_TIME (not GENERALIZEDTIME) |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1594 | |
| 1595 | def test_set_notBefore(self): |
| 1596 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1597 | `X509.set_notBefore` takes a string in the format of an |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1598 | ASN1 GENERALIZEDTIME and sets the beginning of the certificate's |
| 1599 | validity period to it. |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1600 | """ |
| 1601 | self._setBoundTest("Before") |
| 1602 | |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1603 | def test_set_notAfter(self): |
| 1604 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1605 | `X509.set_notAfter` takes a string in the format of an ASN1 |
Jean-Paul Calderone | 525ef80 | 2008-03-09 20:39:42 -0400 | [diff] [blame] | 1606 | GENERALIZEDTIME and sets the end of the certificate's validity period |
| 1607 | to it. |
| 1608 | """ |
| 1609 | self._setBoundTest("After") |
Jean-Paul Calderone | 76576d5 | 2008-03-24 16:04:46 -0400 | [diff] [blame] | 1610 | |
Jean-Paul Calderone | 38a646d | 2008-03-25 15:16:18 -0400 | [diff] [blame] | 1611 | def test_get_notBefore(self): |
| 1612 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1613 | `X509.get_notBefore` returns a string in the format of an |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1614 | ASN1 GENERALIZEDTIME even for certificates which store it as UTCTIME |
Jean-Paul Calderone | 38a646d | 2008-03-25 15:16:18 -0400 | [diff] [blame] | 1615 | internally. |
| 1616 | """ |
Paul Kehrer | a40898b | 2017-06-11 16:30:58 -1000 | [diff] [blame] | 1617 | cert = load_certificate(FILETYPE_PEM, old_root_cert_pem) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1618 | assert cert.get_notBefore() == b"20090325123658Z" |
Jean-Paul Calderone | 38a646d | 2008-03-25 15:16:18 -0400 | [diff] [blame] | 1619 | |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1620 | def test_get_notAfter(self): |
| 1621 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1622 | `X509.get_notAfter` returns a string in the format of an |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1623 | ASN1 GENERALIZEDTIME even for certificates which store it as UTCTIME |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1624 | internally. |
| 1625 | """ |
Paul Kehrer | a40898b | 2017-06-11 16:30:58 -1000 | [diff] [blame] | 1626 | cert = load_certificate(FILETYPE_PEM, old_root_cert_pem) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1627 | assert cert.get_notAfter() == b"20170611123658Z" |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1628 | |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1629 | def test_gmtime_adj_notBefore_wrong_args(self): |
| 1630 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1631 | `X509.gmtime_adj_notBefore` raises `TypeError` if called with a |
| 1632 | non-`int` argument. |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1633 | """ |
| 1634 | cert = X509() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1635 | with pytest.raises(TypeError): |
| 1636 | cert.gmtime_adj_notBefore(None) |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1637 | |
Alex Gaynor | 7f5610c | 2017-07-07 00:09:34 -0400 | [diff] [blame] | 1638 | @flaky.flaky |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1639 | def test_gmtime_adj_notBefore(self): |
| 1640 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1641 | `X509.gmtime_adj_notBefore` changes the not-before timestamp to be the |
| 1642 | current time plus the number of seconds passed in. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1643 | """ |
| 1644 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 1645 | not_before_min = ( |
| 1646 | datetime.utcnow().replace(microsecond=0) + timedelta(seconds=100) |
| 1647 | ) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1648 | cert.gmtime_adj_notBefore(100) |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 1649 | not_before = datetime.strptime( |
| 1650 | cert.get_notBefore().decode(), "%Y%m%d%H%M%SZ" |
| 1651 | ) |
Alex Gaynor | 7f5610c | 2017-07-07 00:09:34 -0400 | [diff] [blame] | 1652 | not_before_max = datetime.utcnow() + timedelta(seconds=100) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1653 | assert not_before_min <= not_before <= not_before_max |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1654 | |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1655 | def test_gmtime_adj_notAfter_wrong_args(self): |
| 1656 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1657 | `X509.gmtime_adj_notAfter` raises `TypeError` if called with a |
| 1658 | non-`int` argument. |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1659 | """ |
| 1660 | cert = X509() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1661 | with pytest.raises(TypeError): |
| 1662 | cert.gmtime_adj_notAfter(None) |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1663 | |
Alex Gaynor | 642de6f | 2017-07-24 00:57:38 -0400 | [diff] [blame] | 1664 | @flaky.flaky |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1665 | def test_gmtime_adj_notAfter(self): |
| 1666 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1667 | `X509.gmtime_adj_notAfter` changes the not-after timestamp |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1668 | to be the current time plus the number of seconds passed in. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1669 | """ |
| 1670 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 1671 | not_after_min = ( |
| 1672 | datetime.utcnow().replace(microsecond=0) + timedelta(seconds=100) |
| 1673 | ) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1674 | cert.gmtime_adj_notAfter(100) |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 1675 | not_after = datetime.strptime( |
| 1676 | cert.get_notAfter().decode(), "%Y%m%d%H%M%SZ" |
| 1677 | ) |
Maximilian Hils | bed25c9 | 2015-07-25 12:58:07 +0200 | [diff] [blame] | 1678 | not_after_max = datetime.utcnow() + timedelta(seconds=100) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1679 | assert not_after_min <= not_after <= not_after_max |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1680 | |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1681 | def test_has_expired(self): |
| 1682 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1683 | `X509.has_expired` returns `True` if the certificate's not-after time |
| 1684 | is in the past. |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1685 | """ |
| 1686 | cert = X509() |
| 1687 | cert.gmtime_adj_notAfter(-1) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1688 | assert cert.has_expired() |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1689 | |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1690 | def test_has_not_expired(self): |
| 1691 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1692 | `X509.has_expired` returns `False` if the certificate's not-after time |
| 1693 | is in the future. |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1694 | """ |
| 1695 | cert = X509() |
| 1696 | cert.gmtime_adj_notAfter(2) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1697 | assert not cert.has_expired() |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1698 | |
Jeff Tang | fc18f7b | 2015-04-15 17:42:33 -0400 | [diff] [blame] | 1699 | def test_root_has_not_expired(self): |
| 1700 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1701 | `X509.has_expired` returns `False` if the certificate's not-after time |
| 1702 | is in the future. |
Jeff Tang | fc18f7b | 2015-04-15 17:42:33 -0400 | [diff] [blame] | 1703 | """ |
| 1704 | cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1705 | assert not cert.has_expired() |
Jeff Tang | fc18f7b | 2015-04-15 17:42:33 -0400 | [diff] [blame] | 1706 | |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1707 | def test_digest(self): |
| 1708 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1709 | `X509.digest` returns a string giving ":"-separated hex-encoded |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1710 | words of the digest of the certificate. |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1711 | """ |
Paul Kehrer | a40898b | 2017-06-11 16:30:58 -1000 | [diff] [blame] | 1712 | cert = load_certificate(FILETYPE_PEM, old_root_cert_pem) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1713 | assert ( |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 1714 | # This is MD5 instead of GOOD_DIGEST because the digest algorithm |
| 1715 | # actually matters to the assertion (ie, another arbitrary, good |
| 1716 | # digest will not product the same digest). |
Jeff Tang | fc18f7b | 2015-04-15 17:42:33 -0400 | [diff] [blame] | 1717 | # Digest verified with the command: |
| 1718 | # openssl x509 -in root_cert.pem -noout -fingerprint -md5 |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1719 | cert.digest("MD5") == |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1720 | b"19:B3:05:26:2B:F8:F2:FF:0B:8F:21:07:A8:28:B8:75") |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 1721 | |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1722 | def _extcert(self, pkey, extensions): |
| 1723 | cert = X509() |
| 1724 | cert.set_pubkey(pkey) |
| 1725 | cert.get_subject().commonName = "Unit Tests" |
| 1726 | cert.get_issuer().commonName = "Unit Tests" |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1727 | when = datetime.now().strftime("%Y%m%d%H%M%SZ").encode("ascii") |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1728 | cert.set_notBefore(when) |
| 1729 | cert.set_notAfter(when) |
| 1730 | |
| 1731 | cert.add_extensions(extensions) |
Jeff Tang | fc18f7b | 2015-04-15 17:42:33 -0400 | [diff] [blame] | 1732 | cert.sign(pkey, 'sha1') |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1733 | return load_certificate( |
| 1734 | FILETYPE_PEM, dump_certificate(FILETYPE_PEM, cert)) |
| 1735 | |
Roland Hedberg | 7e4930e | 2008-04-22 22:58:50 +0200 | [diff] [blame] | 1736 | def test_extension_count(self): |
| 1737 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1738 | `X509.get_extension_count` returns the number of extensions |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1739 | that are present in the certificate. |
Roland Hedberg | 7e4930e | 2008-04-22 22:58:50 +0200 | [diff] [blame] | 1740 | """ |
Jean-Paul Calderone | f7b3ee6 | 2011-04-01 17:36:24 -0400 | [diff] [blame] | 1741 | pkey = load_privatekey(FILETYPE_PEM, client_key_pem) |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1742 | ca = X509Extension(b'basicConstraints', True, b'CA:FALSE') |
| 1743 | key = X509Extension(b'keyUsage', True, b'digitalSignature') |
Jean-Paul Calderone | f7b3ee6 | 2011-04-01 17:36:24 -0400 | [diff] [blame] | 1744 | subjectAltName = X509Extension( |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1745 | b'subjectAltName', True, b'DNS:example.com') |
Jean-Paul Calderone | f7b3ee6 | 2011-04-01 17:36:24 -0400 | [diff] [blame] | 1746 | |
| 1747 | # Try a certificate with no extensions at all. |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1748 | c = self._extcert(pkey, []) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1749 | assert c.get_extension_count() == 0 |
Jean-Paul Calderone | f7b3ee6 | 2011-04-01 17:36:24 -0400 | [diff] [blame] | 1750 | |
| 1751 | # And a certificate with one |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1752 | c = self._extcert(pkey, [ca]) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1753 | assert c.get_extension_count() == 1 |
Jean-Paul Calderone | f7b3ee6 | 2011-04-01 17:36:24 -0400 | [diff] [blame] | 1754 | |
| 1755 | # And a certificate with several |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1756 | c = self._extcert(pkey, [ca, key, subjectAltName]) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1757 | assert c.get_extension_count() == 3 |
Roland Hedberg | 7e4930e | 2008-04-22 22:58:50 +0200 | [diff] [blame] | 1758 | |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1759 | def test_get_extension(self): |
| 1760 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1761 | `X509.get_extension` takes an integer and returns an |
| 1762 | `X509Extension` corresponding to the extension at that index. |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1763 | """ |
| 1764 | pkey = load_privatekey(FILETYPE_PEM, client_key_pem) |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1765 | ca = X509Extension(b'basicConstraints', True, b'CA:FALSE') |
| 1766 | key = X509Extension(b'keyUsage', True, b'digitalSignature') |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1767 | subjectAltName = X509Extension( |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1768 | b'subjectAltName', False, b'DNS:example.com') |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1769 | |
| 1770 | cert = self._extcert(pkey, [ca, key, subjectAltName]) |
| 1771 | |
| 1772 | ext = cert.get_extension(0) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1773 | assert isinstance(ext, X509Extension) |
| 1774 | assert ext.get_critical() |
| 1775 | assert ext.get_short_name() == b'basicConstraints' |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1776 | |
| 1777 | ext = cert.get_extension(1) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1778 | assert isinstance(ext, X509Extension) |
| 1779 | assert ext.get_critical() |
| 1780 | assert ext.get_short_name() == b'keyUsage' |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1781 | |
| 1782 | ext = cert.get_extension(2) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1783 | assert isinstance(ext, X509Extension) |
| 1784 | assert not ext.get_critical() |
| 1785 | assert ext.get_short_name() == b'subjectAltName' |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1786 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1787 | with pytest.raises(IndexError): |
| 1788 | cert.get_extension(-1) |
| 1789 | with pytest.raises(IndexError): |
| 1790 | cert.get_extension(4) |
| 1791 | with pytest.raises(TypeError): |
| 1792 | cert.get_extension("hello") |
Jean-Paul Calderone | 83a593d | 2011-04-01 17:45:07 -0400 | [diff] [blame] | 1793 | |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1794 | def test_nullbyte_subjectAltName(self): |
Jean-Paul Calderone | ff83cdd | 2013-08-12 18:05:51 -0400 | [diff] [blame] | 1795 | """ |
Jean-Paul Calderone | 9af07b0 | 2013-08-23 16:07:31 -0400 | [diff] [blame] | 1796 | The fields of a `subjectAltName` extension on an X509 may contain NUL |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1797 | bytes and this value is reflected in the string representation of the |
| 1798 | extension object. |
Jean-Paul Calderone | ff83cdd | 2013-08-12 18:05:51 -0400 | [diff] [blame] | 1799 | """ |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1800 | cert = load_certificate(FILETYPE_PEM, nulbyteSubjectAltNamePEM) |
Jean-Paul Calderone | ff83cdd | 2013-08-12 18:05:51 -0400 | [diff] [blame] | 1801 | |
| 1802 | ext = cert.get_extension(3) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1803 | assert ext.get_short_name() == b'subjectAltName' |
| 1804 | assert ( |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1805 | b"DNS:altnull.python.org\x00example.com, " |
| 1806 | b"email:null@python.org\x00user@example.org, " |
| 1807 | b"URI:http://null.python.org\x00http://example.org, " |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1808 | b"IP Address:192.0.2.1, IP Address:2001:DB8:0:0:0:0:0:1\n" == |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1809 | str(ext).encode("ascii")) |
Jean-Paul Calderone | 4bf75c6 | 2013-08-23 15:39:53 -0400 | [diff] [blame] | 1810 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1811 | def test_invalid_digest_algorithm(self): |
| 1812 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1813 | `X509.digest` raises `ValueError` if called with an unrecognized hash |
| 1814 | algorithm. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 1815 | """ |
| 1816 | cert = X509() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1817 | with pytest.raises(ValueError): |
| 1818 | cert.digest(BAD_DIGEST) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1819 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1820 | def test_get_subject(self): |
| 1821 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1822 | `X509.get_subject` returns an `X509Name` instance. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1823 | """ |
| 1824 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
| 1825 | subj = cert.get_subject() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1826 | assert isinstance(subj, X509Name) |
| 1827 | assert ( |
| 1828 | subj.get_components() == |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1829 | [(b'C', b'US'), (b'ST', b'IL'), (b'L', b'Chicago'), |
| 1830 | (b'O', b'Testing'), (b'CN', b'Testing Root CA')]) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1831 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1832 | def test_set_subject_wrong_args(self): |
| 1833 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1834 | `X509.set_subject` raises a `TypeError` if called with an argument not |
| 1835 | of type `X509Name`. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1836 | """ |
| 1837 | cert = X509() |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 1838 | with pytest.raises(TypeError): |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1839 | cert.set_subject(None) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1840 | |
| 1841 | def test_set_subject(self): |
| 1842 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1843 | `X509.set_subject` changes the subject of the certificate to the one |
| 1844 | passed in. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1845 | """ |
| 1846 | cert = X509() |
| 1847 | name = cert.get_subject() |
| 1848 | name.C = 'AU' |
| 1849 | name.O = 'Unit Tests' |
| 1850 | cert.set_subject(name) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1851 | assert ( |
| 1852 | cert.get_subject().get_components() == |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1853 | [(b'C', b'AU'), (b'O', b'Unit Tests')]) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1854 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1855 | def test_get_issuer(self): |
| 1856 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1857 | `X509.get_issuer` returns an `X509Name` instance. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1858 | """ |
| 1859 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
| 1860 | subj = cert.get_issuer() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1861 | assert isinstance(subj, X509Name) |
Jean-Paul Calderone | 30a4cb3 | 2010-08-11 23:54:12 -0400 | [diff] [blame] | 1862 | comp = subj.get_components() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1863 | assert ( |
| 1864 | comp == |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1865 | [(b'C', b'US'), (b'ST', b'IL'), (b'L', b'Chicago'), |
| 1866 | (b'O', b'Testing'), (b'CN', b'Testing Root CA')]) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1867 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1868 | def test_set_issuer_wrong_args(self): |
| 1869 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1870 | `X509.set_issuer` raises a `TypeError` if called with an argument not |
| 1871 | of type `X509Name`. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1872 | """ |
| 1873 | cert = X509() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1874 | with pytest.raises(TypeError): |
| 1875 | cert.set_issuer(None) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1876 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1877 | def test_set_issuer(self): |
| 1878 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1879 | `X509.set_issuer` changes the issuer of the certificate to the |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1880 | one passed in. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1881 | """ |
| 1882 | cert = X509() |
| 1883 | name = cert.get_issuer() |
| 1884 | name.C = 'AU' |
| 1885 | name.O = 'Unit Tests' |
| 1886 | cert.set_issuer(name) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1887 | assert ( |
| 1888 | cert.get_issuer().get_components() == |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1889 | [(b'C', b'AU'), (b'O', b'Unit Tests')]) |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1890 | |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1891 | def test_get_pubkey_uninitialized(self): |
| 1892 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1893 | When called on a certificate with no public key, `X509.get_pubkey` |
| 1894 | raises `OpenSSL.crypto.Error`. |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1895 | """ |
| 1896 | cert = X509() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1897 | with pytest.raises(Error): |
| 1898 | cert.get_pubkey() |
Jean-Paul Calderone | 4f237b2 | 2010-07-30 22:29:39 -0400 | [diff] [blame] | 1899 | |
Alex Gaynor | 7778e79 | 2016-07-03 23:38:48 -0400 | [diff] [blame] | 1900 | def test_set_pubkey_wrong_type(self): |
| 1901 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1902 | `X509.set_pubkey` raises `TypeError` when given an object of the |
| 1903 | wrong type. |
Alex Gaynor | 7778e79 | 2016-07-03 23:38:48 -0400 | [diff] [blame] | 1904 | """ |
| 1905 | cert = X509() |
| 1906 | with pytest.raises(TypeError): |
| 1907 | cert.set_pubkey(object()) |
| 1908 | |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1909 | def test_subject_name_hash(self): |
| 1910 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1911 | `X509.subject_name_hash` returns the hash of the certificate's |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 1912 | subject name. |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1913 | """ |
| 1914 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1915 | assert cert.subject_name_hash() in [ |
| 1916 | 3350047874, # OpenSSL 0.9.8, MD5 |
| 1917 | 3278919224, # OpenSSL 1.0.0, SHA1 |
| 1918 | ] |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1919 | |
Jean-Paul Calderone | 2755fa5 | 2011-05-18 19:42:10 -0400 | [diff] [blame] | 1920 | def test_get_signature_algorithm(self): |
| 1921 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1922 | `X509.get_signature_algorithm` returns a string which means |
Jean-Paul Calderone | 2755fa5 | 2011-05-18 19:42:10 -0400 | [diff] [blame] | 1923 | the algorithm used to sign the certificate. |
| 1924 | """ |
| 1925 | cert = load_certificate(FILETYPE_PEM, self.pemData) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1926 | assert b"sha1WithRSAEncryption" == cert.get_signature_algorithm() |
Jean-Paul Calderone | 2755fa5 | 2011-05-18 19:42:10 -0400 | [diff] [blame] | 1927 | |
Jean-Paul Calderone | 2755fa5 | 2011-05-18 19:42:10 -0400 | [diff] [blame] | 1928 | def test_get_undefined_signature_algorithm(self): |
Jean-Paul Calderone | 5d8e405 | 2011-05-19 17:51:43 -0400 | [diff] [blame] | 1929 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1930 | `X509.get_signature_algorithm` raises `ValueError` if the signature |
| 1931 | algorithm is undefined or unknown. |
Jean-Paul Calderone | 5d8e405 | 2011-05-19 17:51:43 -0400 | [diff] [blame] | 1932 | """ |
| 1933 | # This certificate has been modified to indicate a bogus OID in the |
| 1934 | # signature algorithm field so that OpenSSL does not recognize it. |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1935 | certPEM = b"""\ |
Jean-Paul Calderone | 2755fa5 | 2011-05-18 19:42:10 -0400 | [diff] [blame] | 1936 | -----BEGIN CERTIFICATE----- |
| 1937 | MIIC/zCCAmigAwIBAgIBATAGBgJ8BQUAMHsxCzAJBgNVBAYTAlNHMREwDwYDVQQK |
| 1938 | EwhNMkNyeXB0bzEUMBIGA1UECxMLTTJDcnlwdG8gQ0ExJDAiBgNVBAMTG00yQ3J5 |
| 1939 | cHRvIENlcnRpZmljYXRlIE1hc3RlcjEdMBsGCSqGSIb3DQEJARYObmdwc0Bwb3N0 |
| 1940 | MS5jb20wHhcNMDAwOTEwMDk1MTMwWhcNMDIwOTEwMDk1MTMwWjBTMQswCQYDVQQG |
| 1941 | EwJTRzERMA8GA1UEChMITTJDcnlwdG8xEjAQBgNVBAMTCWxvY2FsaG9zdDEdMBsG |
| 1942 | CSqGSIb3DQEJARYObmdwc0Bwb3N0MS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBI |
| 1943 | AkEArL57d26W9fNXvOhNlZzlPOACmvwOZ5AdNgLzJ1/MfsQQJ7hHVeHmTAjM664V |
| 1944 | +fXvwUGJLziCeBo1ysWLRnl8CQIDAQABo4IBBDCCAQAwCQYDVR0TBAIwADAsBglg |
| 1945 | hkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0O |
| 1946 | BBYEFM+EgpK+eyZiwFU1aOPSbczbPSpVMIGlBgNVHSMEgZ0wgZqAFPuHI2nrnDqT |
| 1947 | FeXFvylRT/7tKDgBoX+kfTB7MQswCQYDVQQGEwJTRzERMA8GA1UEChMITTJDcnlw |
| 1948 | dG8xFDASBgNVBAsTC00yQ3J5cHRvIENBMSQwIgYDVQQDExtNMkNyeXB0byBDZXJ0 |
| 1949 | aWZpY2F0ZSBNYXN0ZXIxHTAbBgkqhkiG9w0BCQEWDm5ncHNAcG9zdDEuY29tggEA |
| 1950 | MA0GCSqGSIb3DQEBBAUAA4GBADv8KpPo+gfJxN2ERK1Y1l17sz/ZhzoGgm5XCdbx |
| 1951 | jEY7xKfpQngV599k1xhl11IMqizDwu0855agrckg2MCTmOI9DZzDD77tAYb+Dk0O |
| 1952 | PEVk0Mk/V0aIsDE9bolfCi/i/QWZ3N8s5nTWMNyBBBmoSliWCm4jkkRZRD0ejgTN |
| 1953 | tgI5 |
| 1954 | -----END CERTIFICATE----- |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 1955 | """ |
Jean-Paul Calderone | 2755fa5 | 2011-05-18 19:42:10 -0400 | [diff] [blame] | 1956 | cert = load_certificate(FILETYPE_PEM, certPEM) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1957 | with pytest.raises(ValueError): |
| 1958 | cert.get_signature_algorithm() |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1959 | |
Alex Gaynor | 3772611 | 2016-07-04 09:51:32 -0400 | [diff] [blame] | 1960 | def test_sign_bad_pubkey_type(self): |
| 1961 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 1962 | `X509.sign` raises `TypeError` when called with the wrong type. |
Alex Gaynor | 3772611 | 2016-07-04 09:51:32 -0400 | [diff] [blame] | 1963 | """ |
| 1964 | cert = X509() |
| 1965 | with pytest.raises(TypeError): |
| 1966 | cert.sign(object(), b"sha256") |
| 1967 | |
Alex Gaynor | 9939ba1 | 2017-06-25 16:28:24 -0400 | [diff] [blame] | 1968 | def test_convert_from_cryptography(self): |
| 1969 | crypto_cert = x509.load_pem_x509_certificate( |
| 1970 | intermediate_cert_pem, backend |
| 1971 | ) |
| 1972 | cert = X509.from_cryptography(crypto_cert) |
| 1973 | |
| 1974 | assert isinstance(cert, X509) |
| 1975 | assert cert.get_version() == crypto_cert.version.value |
| 1976 | |
| 1977 | def test_convert_from_cryptography_unsupported_type(self): |
| 1978 | with pytest.raises(TypeError): |
| 1979 | X509.from_cryptography(object()) |
| 1980 | |
| 1981 | def test_convert_to_cryptography_key(self): |
| 1982 | cert = load_certificate(FILETYPE_PEM, intermediate_cert_pem) |
| 1983 | crypto_cert = cert.to_cryptography() |
| 1984 | |
| 1985 | assert isinstance(crypto_cert, x509.Certificate) |
| 1986 | assert crypto_cert.version.value == cert.get_version() |
| 1987 | |
Jean-Paul Calderone | ccf9d48 | 2010-07-30 22:36:42 -0400 | [diff] [blame] | 1988 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1989 | class TestX509Store(object): |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 1990 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1991 | Test for `OpenSSL.crypto.X509Store`. |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 1992 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 1993 | |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 1994 | def test_type(self): |
| 1995 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1996 | `X509Store` is a type object. |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 1997 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 1998 | assert X509Store is X509StoreType |
| 1999 | assert is_consistent_type(X509Store, 'X509Store') |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 2000 | |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 2001 | def test_add_cert(self): |
Jean-Paul Calderone | e6f32b8 | 2013-03-06 10:27:57 -0800 | [diff] [blame] | 2002 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 2003 | `X509Store.add_cert` adds a `X509` instance to the certificate store. |
Jean-Paul Calderone | e6f32b8 | 2013-03-06 10:27:57 -0800 | [diff] [blame] | 2004 | """ |
| 2005 | cert = load_certificate(FILETYPE_PEM, cleartextCertificatePEM) |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 2006 | store = X509Store() |
Jean-Paul Calderone | e6f32b8 | 2013-03-06 10:27:57 -0800 | [diff] [blame] | 2007 | store.add_cert(cert) |
| 2008 | |
Alex Chan | fb078d8 | 2017-04-20 11:16:15 +0100 | [diff] [blame] | 2009 | @pytest.mark.parametrize('cert', [None, 1.0, 'cert', object()]) |
| 2010 | def test_add_cert_wrong_args(self, cert): |
| 2011 | """ |
| 2012 | `X509Store.add_cert` raises `TypeError` if passed a non-X509 object |
| 2013 | as its first argument. |
| 2014 | """ |
| 2015 | store = X509Store() |
| 2016 | with pytest.raises(TypeError): |
| 2017 | store.add_cert(cert) |
| 2018 | |
Jean-Paul Calderone | e6f32b8 | 2013-03-06 10:27:57 -0800 | [diff] [blame] | 2019 | def test_add_cert_rejects_duplicate(self): |
| 2020 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 2021 | `X509Store.add_cert` raises `OpenSSL.crypto.Error` if an attempt is |
| 2022 | made to add the same certificate to the store more than once. |
Jean-Paul Calderone | e6f32b8 | 2013-03-06 10:27:57 -0800 | [diff] [blame] | 2023 | """ |
| 2024 | cert = load_certificate(FILETYPE_PEM, cleartextCertificatePEM) |
| 2025 | store = X509Store() |
| 2026 | store.add_cert(cert) |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 2027 | with pytest.raises(Error): |
| 2028 | store.add_cert(cert) |
Jean-Paul Calderone | a63714c | 2013-03-05 17:02:26 -0800 | [diff] [blame] | 2029 | |
| 2030 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2031 | class TestPKCS12(object): |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2032 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2033 | Test for `OpenSSL.crypto.PKCS12` and `OpenSSL.crypto.load_pkcs12`. |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2034 | """ |
| 2035 | pemData = cleartextCertificatePEM + cleartextPrivateKeyPEM |
| 2036 | |
Jean-Paul Calderone | c3a41f7 | 2009-07-25 12:36:02 -0400 | [diff] [blame] | 2037 | def test_type(self): |
| 2038 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2039 | `PKCS12Type` is a type object. |
Jean-Paul Calderone | c3a41f7 | 2009-07-25 12:36:02 -0400 | [diff] [blame] | 2040 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2041 | assert PKCS12 is PKCS12Type |
| 2042 | assert is_consistent_type(PKCS12, 'PKCS12') |
Jean-Paul Calderone | c3a41f7 | 2009-07-25 12:36:02 -0400 | [diff] [blame] | 2043 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2044 | def test_empty_construction(self): |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 2045 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2046 | `PKCS12` returns a new instance of `PKCS12` with no certificate, |
| 2047 | private key, CA certificates, or friendly name. |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 2048 | """ |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 2049 | p12 = PKCS12() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2050 | assert None is p12.get_certificate() |
| 2051 | assert None is p12.get_privatekey() |
| 2052 | assert None is p12.get_ca_certificates() |
| 2053 | assert None is p12.get_friendlyname() |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2054 | |
| 2055 | def test_type_errors(self): |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 2056 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2057 | The `PKCS12` setter functions (`set_certificate`, `set_privatekey`, |
| 2058 | `set_ca_certificates`, and `set_friendlyname`) raise `TypeError` |
| 2059 | when passed objects of types other than those expected. |
Rick Dean | 38a05c8 | 2009-07-18 01:41:30 -0500 | [diff] [blame] | 2060 | """ |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 2061 | p12 = PKCS12() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2062 | for bad_arg in [3, PKey(), X509]: |
| 2063 | with pytest.raises(TypeError): |
| 2064 | p12.set_certificate(bad_arg) |
| 2065 | for bad_arg in [3, 'legbone', X509()]: |
| 2066 | with pytest.raises(TypeError): |
| 2067 | p12.set_privatekey(bad_arg) |
| 2068 | for bad_arg in [3, X509(), (3, 4), (PKey(),)]: |
| 2069 | with pytest.raises(TypeError): |
| 2070 | p12.set_ca_certificates(bad_arg) |
| 2071 | for bad_arg in [6, ('foo', 'bar')]: |
| 2072 | with pytest.raises(TypeError): |
| 2073 | p12.set_friendlyname(bad_arg) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2074 | |
| 2075 | def test_key_only(self): |
| 2076 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2077 | A `PKCS12` with only a private key can be exported using |
| 2078 | `PKCS12.export` and loaded again using `load_pkcs12`. |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2079 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2080 | passwd = b"blah" |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2081 | p12 = PKCS12() |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 2082 | pkey = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2083 | p12.set_privatekey(pkey) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2084 | assert None is p12.get_certificate() |
| 2085 | assert pkey == p12.get_privatekey() |
Rick Dean | 321a051 | 2009-08-13 17:21:29 -0500 | [diff] [blame] | 2086 | try: |
| 2087 | dumped_p12 = p12.export(passphrase=passwd, iter=2, maciter=3) |
| 2088 | except Error: |
| 2089 | # Some versions of OpenSSL will throw an exception |
| 2090 | # for this nearly useless PKCS12 we tried to generate: |
| 2091 | # [('PKCS12 routines', 'PKCS12_create', 'invalid null argument')] |
| 2092 | return |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2093 | p12 = load_pkcs12(dumped_p12, passwd) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2094 | assert None is p12.get_ca_certificates() |
| 2095 | assert None is p12.get_certificate() |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2096 | |
| 2097 | # OpenSSL fails to bring the key back to us. So sad. Perhaps in the |
| 2098 | # future this will be improved. |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2099 | assert isinstance(p12.get_privatekey(), (PKey, type(None))) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2100 | |
| 2101 | def test_cert_only(self): |
| 2102 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2103 | A `PKCS12` with only a certificate can be exported using |
| 2104 | `PKCS12.export` and loaded again using `load_pkcs12`. |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2105 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2106 | passwd = b"blah" |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2107 | p12 = PKCS12() |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 2108 | cert = load_certificate(FILETYPE_PEM, cleartextCertificatePEM) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2109 | p12.set_certificate(cert) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2110 | assert cert == p12.get_certificate() |
| 2111 | assert None is p12.get_privatekey() |
Rick Dean | 321a051 | 2009-08-13 17:21:29 -0500 | [diff] [blame] | 2112 | try: |
| 2113 | dumped_p12 = p12.export(passphrase=passwd, iter=2, maciter=3) |
| 2114 | except Error: |
| 2115 | # Some versions of OpenSSL will throw an exception |
| 2116 | # for this nearly useless PKCS12 we tried to generate: |
| 2117 | # [('PKCS12 routines', 'PKCS12_create', 'invalid null argument')] |
| 2118 | return |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2119 | p12 = load_pkcs12(dumped_p12, passwd) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2120 | assert None is p12.get_privatekey() |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2121 | |
| 2122 | # OpenSSL fails to bring the cert back to us. Groany mcgroan. |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2123 | assert isinstance(p12.get_certificate(), (X509, type(None))) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2124 | |
| 2125 | # Oh ho. It puts the certificate into the ca certificates list, in |
| 2126 | # fact. Totally bogus, I would think. Nevertheless, let's exploit |
| 2127 | # that to check to see if it reconstructed the certificate we expected |
| 2128 | # it to. At some point, hopefully this will change so that |
| 2129 | # p12.get_certificate() is actually what returns the loaded |
| 2130 | # certificate. |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2131 | assert ( |
| 2132 | cleartextCertificatePEM == |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2133 | dump_certificate(FILETYPE_PEM, p12.get_ca_certificates()[0])) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2134 | |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 2135 | def gen_pkcs12(self, cert_pem=None, key_pem=None, ca_pem=None, |
| 2136 | friendly_name=None): |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2137 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2138 | Generate a PKCS12 object with components from PEM. Verify that the set |
| 2139 | functions return None. |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2140 | """ |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2141 | p12 = PKCS12() |
| 2142 | if cert_pem: |
| 2143 | ret = p12.set_certificate(load_certificate(FILETYPE_PEM, cert_pem)) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2144 | assert ret is None |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2145 | if key_pem: |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2146 | ret = p12.set_privatekey(load_privatekey(FILETYPE_PEM, key_pem)) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2147 | assert ret is None |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2148 | if ca_pem: |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 2149 | ret = p12.set_ca_certificates( |
| 2150 | (load_certificate(FILETYPE_PEM, ca_pem),) |
| 2151 | ) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2152 | assert ret is None |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2153 | if friendly_name: |
| 2154 | ret = p12.set_friendlyname(friendly_name) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2155 | assert ret is None |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2156 | return p12 |
| 2157 | |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2158 | def check_recovery(self, p12_str, key=None, cert=None, ca=None, passwd=b"", |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2159 | extra=()): |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2160 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2161 | Use openssl program to confirm three components are recoverable from a |
| 2162 | PKCS12 string. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2163 | """ |
| 2164 | if key: |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2165 | recovered_key = _runopenssl( |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2166 | p12_str, b"pkcs12", b"-nocerts", b"-nodes", b"-passin", |
| 2167 | b"pass:" + passwd, *extra) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2168 | assert recovered_key[-len(key):] == key |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2169 | if cert: |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2170 | recovered_cert = _runopenssl( |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2171 | p12_str, b"pkcs12", b"-clcerts", b"-nodes", b"-passin", |
| 2172 | b"pass:" + passwd, b"-nokeys", *extra) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2173 | assert recovered_cert[-len(cert):] == cert |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2174 | if ca: |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2175 | recovered_cert = _runopenssl( |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2176 | p12_str, b"pkcs12", b"-cacerts", b"-nodes", b"-passin", |
| 2177 | b"pass:" + passwd, b"-nokeys", *extra) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2178 | assert recovered_cert[-len(ca):] == ca |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2179 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2180 | def verify_pkcs12_container(self, p12): |
| 2181 | """ |
| 2182 | Verify that the PKCS#12 container contains the correct client |
| 2183 | certificate and private key. |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2184 | |
| 2185 | :param p12: The PKCS12 instance to verify. |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2186 | :type p12: `PKCS12` |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2187 | """ |
| 2188 | cert_pem = dump_certificate(FILETYPE_PEM, p12.get_certificate()) |
| 2189 | key_pem = dump_privatekey(FILETYPE_PEM, p12.get_privatekey()) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2190 | assert ( |
| 2191 | (client_cert_pem, client_key_pem, None) == |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2192 | (cert_pem, key_pem, p12.get_ca_certificates())) |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2193 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2194 | def test_load_pkcs12(self): |
| 2195 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2196 | A PKCS12 string generated using the openssl command line can be loaded |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2197 | with `load_pkcs12` and its components extracted and examined. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2198 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2199 | passwd = b"whatever" |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2200 | pem = client_key_pem + client_cert_pem |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2201 | p12_str = _runopenssl( |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 2202 | pem, |
| 2203 | b"pkcs12", |
| 2204 | b"-export", |
| 2205 | b"-clcerts", |
| 2206 | b"-passout", |
| 2207 | b"pass:" + passwd |
| 2208 | ) |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2209 | p12 = load_pkcs12(p12_str, passphrase=passwd) |
| 2210 | self.verify_pkcs12_container(p12) |
| 2211 | |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2212 | def test_load_pkcs12_text_passphrase(self): |
| 2213 | """ |
| 2214 | A PKCS12 string generated using the openssl command line can be loaded |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2215 | with `load_pkcs12` and its components extracted and examined. |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2216 | Using text as passphrase instead of bytes. DeprecationWarning expected. |
| 2217 | """ |
| 2218 | pem = client_key_pem + client_cert_pem |
| 2219 | passwd = b"whatever" |
| 2220 | p12_str = _runopenssl(pem, b"pkcs12", b"-export", b"-clcerts", |
| 2221 | b"-passout", b"pass:" + passwd) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2222 | with pytest.warns(DeprecationWarning) as w: |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2223 | simplefilter("always") |
Jean-Paul Calderone | 13a0e65 | 2015-03-29 07:58:51 -0400 | [diff] [blame] | 2224 | p12 = load_pkcs12(p12_str, passphrase=b"whatever".decode("ascii")) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2225 | assert ( |
Jean-Paul Calderone | 13a0e65 | 2015-03-29 07:58:51 -0400 | [diff] [blame] | 2226 | "{0} for passphrase is no longer accepted, use bytes".format( |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 2227 | WARNING_TYPE_EXPECTED |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2228 | ) == str(w[-1].message)) |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 2229 | |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2230 | self.verify_pkcs12_container(p12) |
| 2231 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2232 | def test_load_pkcs12_no_passphrase(self): |
| 2233 | """ |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2234 | A PKCS12 string generated using openssl command line can be loaded with |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2235 | `load_pkcs12` without a passphrase and its components extracted |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2236 | and examined. |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2237 | """ |
| 2238 | pem = client_key_pem + client_cert_pem |
| 2239 | p12_str = _runopenssl( |
| 2240 | pem, b"pkcs12", b"-export", b"-clcerts", b"-passout", b"pass:") |
| 2241 | p12 = load_pkcs12(p12_str) |
| 2242 | self.verify_pkcs12_container(p12) |
| 2243 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2244 | def _dump_and_load(self, dump_passphrase, load_passphrase): |
| 2245 | """ |
| 2246 | A helper method to dump and load a PKCS12 object. |
| 2247 | """ |
| 2248 | p12 = self.gen_pkcs12(client_cert_pem, client_key_pem) |
| 2249 | dumped_p12 = p12.export(passphrase=dump_passphrase, iter=2, maciter=3) |
| 2250 | return load_pkcs12(dumped_p12, passphrase=load_passphrase) |
| 2251 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2252 | def test_load_pkcs12_null_passphrase_load_empty(self): |
| 2253 | """ |
| 2254 | A PKCS12 string can be dumped with a null passphrase, loaded with an |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2255 | empty passphrase with `load_pkcs12`, and its components |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2256 | extracted and examined. |
| 2257 | """ |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2258 | self.verify_pkcs12_container( |
| 2259 | self._dump_and_load(dump_passphrase=None, load_passphrase=b'')) |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2260 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2261 | def test_load_pkcs12_null_passphrase_load_null(self): |
| 2262 | """ |
| 2263 | A PKCS12 string can be dumped with a null passphrase, loaded with a |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2264 | null passphrase with `load_pkcs12`, and its components |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2265 | extracted and examined. |
| 2266 | """ |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2267 | self.verify_pkcs12_container( |
| 2268 | self._dump_and_load(dump_passphrase=None, load_passphrase=None)) |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2269 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2270 | def test_load_pkcs12_empty_passphrase_load_empty(self): |
| 2271 | """ |
| 2272 | A PKCS12 string can be dumped with an empty passphrase, loaded with an |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2273 | empty passphrase with `load_pkcs12`, and its components |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2274 | extracted and examined. |
| 2275 | """ |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2276 | self.verify_pkcs12_container( |
| 2277 | self._dump_and_load(dump_passphrase=b'', load_passphrase=b'')) |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2278 | |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2279 | def test_load_pkcs12_empty_passphrase_load_null(self): |
| 2280 | """ |
| 2281 | A PKCS12 string can be dumped with an empty passphrase, loaded with a |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2282 | null passphrase with `load_pkcs12`, and its components |
Stephen Holsapple | 3848262 | 2014-04-05 20:29:34 -0700 | [diff] [blame] | 2283 | extracted and examined. |
| 2284 | """ |
Jean-Paul Calderone | f0ff13b | 2014-05-05 12:48:33 -0400 | [diff] [blame] | 2285 | self.verify_pkcs12_container( |
| 2286 | self._dump_and_load(dump_passphrase=b'', load_passphrase=None)) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2287 | |
Rick Dean | ee56830 | 2009-07-24 09:56:29 -0500 | [diff] [blame] | 2288 | def test_load_pkcs12_garbage(self): |
| 2289 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2290 | `load_pkcs12` raises `OpenSSL.crypto.Error` when passed |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 2291 | a string which is not a PKCS12 dump. |
Rick Dean | ee56830 | 2009-07-24 09:56:29 -0500 | [diff] [blame] | 2292 | """ |
| 2293 | passwd = 'whatever' |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2294 | with pytest.raises(Error) as err: |
| 2295 | load_pkcs12(b'fruit loops', passwd) |
| 2296 | assert err.value.args[0][0][0] == 'asn1 encoding routines' |
| 2297 | assert len(err.value.args[0][0]) == 3 |
Rick Dean | ee56830 | 2009-07-24 09:56:29 -0500 | [diff] [blame] | 2298 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2299 | def test_replace(self): |
| 2300 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2301 | `PKCS12.set_certificate` replaces the certificate in a PKCS12 |
| 2302 | cluster. `PKCS12.set_privatekey` replaces the private key. |
| 2303 | `PKCS12.set_ca_certificates` replaces the CA certificates. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2304 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2305 | p12 = self.gen_pkcs12(client_cert_pem, client_key_pem, root_cert_pem) |
| 2306 | p12.set_certificate(load_certificate(FILETYPE_PEM, server_cert_pem)) |
| 2307 | p12.set_privatekey(load_privatekey(FILETYPE_PEM, server_key_pem)) |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 2308 | root_cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2309 | client_cert = load_certificate(FILETYPE_PEM, client_cert_pem) |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2310 | p12.set_ca_certificates([root_cert]) # not a tuple |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2311 | assert 1 == len(p12.get_ca_certificates()) |
| 2312 | assert root_cert == p12.get_ca_certificates()[0] |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2313 | p12.set_ca_certificates([client_cert, root_cert]) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2314 | assert 2 == len(p12.get_ca_certificates()) |
| 2315 | assert client_cert == p12.get_ca_certificates()[0] |
| 2316 | assert root_cert == p12.get_ca_certificates()[1] |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2317 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2318 | def test_friendly_name(self): |
| 2319 | """ |
Jean-Paul Calderone | 64efa2c | 2011-09-11 10:00:09 -0400 | [diff] [blame] | 2320 | The *friendlyName* of a PKCS12 can be set and retrieved via |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2321 | `PKCS12.get_friendlyname` and `PKCS12_set_friendlyname`, and a |
| 2322 | `PKCS12` with a friendly name set can be dumped with `PKCS12.export`. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2323 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2324 | passwd = b'Dogmeat[]{}!@#$%^&*()~`?/.,<>-_+=";:' |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2325 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem, root_cert_pem) |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 2326 | for friendly_name in [b'Serverlicious', None, b'###']: |
Rick Dean | 42d69e1 | 2009-07-20 11:36:08 -0500 | [diff] [blame] | 2327 | p12.set_friendlyname(friendly_name) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2328 | assert p12.get_friendlyname() == friendly_name |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 2329 | dumped_p12 = p12.export(passphrase=passwd, iter=2, maciter=3) |
Rick Dean | 42d69e1 | 2009-07-20 11:36:08 -0500 | [diff] [blame] | 2330 | reloaded_p12 = load_pkcs12(dumped_p12, passwd) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2331 | assert p12.get_friendlyname() == reloaded_p12.get_friendlyname() |
Jean-Paul Calderone | a202edb | 2009-07-25 12:22:12 -0400 | [diff] [blame] | 2332 | # We would use the openssl program to confirm the friendly |
| 2333 | # name, but it is not possible. The pkcs12 command |
| 2334 | # does not store the friendly name in the cert's |
Rick Dean | 42d69e1 | 2009-07-20 11:36:08 -0500 | [diff] [blame] | 2335 | # alias, which we could then extract. |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2336 | self.check_recovery( |
| 2337 | dumped_p12, key=server_key_pem, cert=server_cert_pem, |
| 2338 | ca=root_cert_pem, passwd=passwd) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2339 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2340 | def test_various_empty_passphrases(self): |
| 2341 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2342 | Test that missing, None, and '' passphrases are identical for PKCS12 |
| 2343 | export. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2344 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2345 | p12 = self.gen_pkcs12(client_cert_pem, client_key_pem, root_cert_pem) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2346 | passwd = b"" |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2347 | dumped_p12_empty = p12.export(iter=2, maciter=0, passphrase=passwd) |
| 2348 | dumped_p12_none = p12.export(iter=3, maciter=2, passphrase=None) |
| 2349 | dumped_p12_nopw = p12.export(iter=9, maciter=4) |
| 2350 | for dumped_p12 in [dumped_p12_empty, dumped_p12_none, dumped_p12_nopw]: |
| 2351 | self.check_recovery( |
| 2352 | dumped_p12, key=client_key_pem, cert=client_cert_pem, |
| 2353 | ca=root_cert_pem, passwd=passwd) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2354 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2355 | def test_removing_ca_cert(self): |
| 2356 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2357 | Passing `None` to `PKCS12.set_ca_certificates` removes all CA |
| 2358 | certificates. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2359 | """ |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2360 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem, root_cert_pem) |
| 2361 | p12.set_ca_certificates(None) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2362 | assert None is p12.get_ca_certificates() |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2363 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2364 | def test_export_without_mac(self): |
| 2365 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2366 | Exporting a PKCS12 with a `maciter` of `-1` excludes the MAC entirely. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2367 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2368 | passwd = b"Lake Michigan" |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2369 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem, root_cert_pem) |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2370 | dumped_p12 = p12.export(maciter=-1, passphrase=passwd, iter=2) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2371 | self.check_recovery( |
| 2372 | dumped_p12, key=server_key_pem, cert=server_cert_pem, |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2373 | passwd=passwd, extra=(b"-nomacver",)) |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2374 | |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2375 | def test_load_without_mac(self): |
| 2376 | """ |
| 2377 | Loading a PKCS12 without a MAC does something other than crash. |
| 2378 | """ |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2379 | passwd = b"Lake Michigan" |
Jean-Paul Calderone | 7426ed8 | 2009-07-25 21:19:23 -0400 | [diff] [blame] | 2380 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem, root_cert_pem) |
| 2381 | dumped_p12 = p12.export(maciter=-1, passphrase=passwd, iter=2) |
Rick Dean | 321a051 | 2009-08-13 17:21:29 -0500 | [diff] [blame] | 2382 | try: |
| 2383 | recovered_p12 = load_pkcs12(dumped_p12, passwd) |
| 2384 | # The person who generated this PCKS12 should be flogged, |
| 2385 | # or better yet we should have a means to determine |
| 2386 | # whether a PCKS12 had a MAC that was verified. |
| 2387 | # Anyway, libopenssl chooses to allow it, so the |
| 2388 | # pyopenssl binding does as well. |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2389 | assert isinstance(recovered_p12, PKCS12) |
Rick Dean | 321a051 | 2009-08-13 17:21:29 -0500 | [diff] [blame] | 2390 | except Error: |
| 2391 | # Failing here with an exception is preferred as some openssl |
| 2392 | # versions do. |
| 2393 | pass |
Rick Dean | 623ee36 | 2009-07-17 12:22:16 -0500 | [diff] [blame] | 2394 | |
Rick Dean | 25bcc1f | 2009-07-20 11:53:13 -0500 | [diff] [blame] | 2395 | def test_zero_len_list_for_ca(self): |
| 2396 | """ |
Jean-Paul Calderone | da1ffa7 | 2009-07-25 21:24:34 -0400 | [diff] [blame] | 2397 | A PKCS12 with an empty CA certificates list can be exported. |
Rick Dean | 25bcc1f | 2009-07-20 11:53:13 -0500 | [diff] [blame] | 2398 | """ |
Alex Gaynor | 6575bd1 | 2015-09-05 16:44:36 -0400 | [diff] [blame] | 2399 | passwd = b'Hobie 18' |
Jean-Paul Calderone | da1ffa7 | 2009-07-25 21:24:34 -0400 | [diff] [blame] | 2400 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem) |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 2401 | p12.set_ca_certificates([]) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2402 | assert () == p12.get_ca_certificates() |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 2403 | dumped_p12 = p12.export(passphrase=passwd, iter=3) |
| 2404 | self.check_recovery( |
| 2405 | dumped_p12, key=server_key_pem, cert=server_cert_pem, |
| 2406 | passwd=passwd) |
Rick Dean | 25bcc1f | 2009-07-20 11:53:13 -0500 | [diff] [blame] | 2407 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2408 | def test_export_without_args(self): |
Jean-Paul Calderone | 38a646d | 2008-03-25 15:16:18 -0400 | [diff] [blame] | 2409 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2410 | All the arguments to `PKCS12.export` are optional. |
Jean-Paul Calderone | 38a646d | 2008-03-25 15:16:18 -0400 | [diff] [blame] | 2411 | """ |
Jean-Paul Calderone | da1ffa7 | 2009-07-25 21:24:34 -0400 | [diff] [blame] | 2412 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem, root_cert_pem) |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2413 | dumped_p12 = p12.export() # no args |
Jean-Paul Calderone | da1ffa7 | 2009-07-25 21:24:34 -0400 | [diff] [blame] | 2414 | self.check_recovery( |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2415 | dumped_p12, key=server_key_pem, cert=server_cert_pem, passwd=b"") |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2416 | |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2417 | def test_export_without_bytes(self): |
| 2418 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2419 | Test `PKCS12.export` with text not bytes as passphrase |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2420 | """ |
| 2421 | p12 = self.gen_pkcs12(server_cert_pem, server_key_pem, root_cert_pem) |
| 2422 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2423 | with pytest.warns(DeprecationWarning) as w: |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2424 | simplefilter("always") |
Jean-Paul Calderone | 13a0e65 | 2015-03-29 07:58:51 -0400 | [diff] [blame] | 2425 | dumped_p12 = p12.export(passphrase=b"randomtext".decode("ascii")) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2426 | assert ( |
Jean-Paul Calderone | 13a0e65 | 2015-03-29 07:58:51 -0400 | [diff] [blame] | 2427 | "{0} for passphrase is no longer accepted, use bytes".format( |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 2428 | WARNING_TYPE_EXPECTED |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2429 | ) == str(w[-1].message)) |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2430 | self.check_recovery( |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2431 | dumped_p12, |
| 2432 | key=server_key_pem, |
| 2433 | cert=server_cert_pem, |
| 2434 | passwd=b"randomtext" |
| 2435 | ) |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 2436 | |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2437 | def test_key_cert_mismatch(self): |
| 2438 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2439 | `PKCS12.export` raises an exception when a key and certificate |
Jean-Paul Calderone | da1ffa7 | 2009-07-25 21:24:34 -0400 | [diff] [blame] | 2440 | mismatch. |
Rick Dean | f94096c | 2009-07-18 14:23:06 -0500 | [diff] [blame] | 2441 | """ |
Jean-Paul Calderone | da1ffa7 | 2009-07-25 21:24:34 -0400 | [diff] [blame] | 2442 | p12 = self.gen_pkcs12(server_cert_pem, client_key_pem, root_cert_pem) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2443 | with pytest.raises(Error): |
| 2444 | p12.export() |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2445 | |
| 2446 | |
Rick Dean | 4c9ad61 | 2009-07-17 15:05:22 -0500 | [diff] [blame] | 2447 | def _runopenssl(pem, *args): |
| 2448 | """ |
| 2449 | Run the command line openssl tool with the given arguments and write |
Rick Dean | 55d1ce6 | 2009-08-13 17:40:24 -0500 | [diff] [blame] | 2450 | the given PEM to its stdin. Not safe for quotes. |
Rick Dean | 4c9ad61 | 2009-07-17 15:05:22 -0500 | [diff] [blame] | 2451 | """ |
Alex Gaynor | 6cbc69a | 2017-07-25 09:07:04 -0400 | [diff] [blame] | 2452 | proc = Popen([b"openssl"] + list(args), stdin=PIPE, stdout=PIPE) |
Jean-Paul Calderone | 62ca8da | 2010-08-11 19:58:08 -0400 | [diff] [blame] | 2453 | proc.stdin.write(pem) |
| 2454 | proc.stdin.close() |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2455 | output = proc.stdout.read() |
| 2456 | proc.stdout.close() |
| 2457 | proc.wait() |
| 2458 | return output |
Rick Dean | 4c9ad61 | 2009-07-17 15:05:22 -0500 | [diff] [blame] | 2459 | |
| 2460 | |
Hynek Schlawack | 40d448f | 2016-06-03 16:15:14 -0700 | [diff] [blame] | 2461 | class TestLoadPublicKey(object): |
Paul Kehrer | 32fc4e6 | 2016-06-03 15:21:44 -0700 | [diff] [blame] | 2462 | """ |
Hynek Schlawack | 40d448f | 2016-06-03 16:15:14 -0700 | [diff] [blame] | 2463 | Tests for :func:`load_publickey`. |
Paul Kehrer | 32fc4e6 | 2016-06-03 15:21:44 -0700 | [diff] [blame] | 2464 | """ |
Hynek Schlawack | 40d448f | 2016-06-03 16:15:14 -0700 | [diff] [blame] | 2465 | def test_loading_works(self): |
Paul Kehrer | 32fc4e6 | 2016-06-03 15:21:44 -0700 | [diff] [blame] | 2466 | """ |
Hynek Schlawack | 40d448f | 2016-06-03 16:15:14 -0700 | [diff] [blame] | 2467 | load_publickey loads public keys and sets correct attributes. |
Paul Kehrer | 32fc4e6 | 2016-06-03 15:21:44 -0700 | [diff] [blame] | 2468 | """ |
| 2469 | key = load_publickey(FILETYPE_PEM, cleartextPublicKeyPEM) |
Hynek Schlawack | 40d448f | 2016-06-03 16:15:14 -0700 | [diff] [blame] | 2470 | |
| 2471 | assert True is key._only_public |
| 2472 | assert 2048 == key.bits() |
| 2473 | assert TYPE_RSA == key.type() |
| 2474 | |
| 2475 | def test_invalid_type(self): |
| 2476 | """ |
| 2477 | load_publickey doesn't support FILETYPE_TEXT. |
| 2478 | """ |
| 2479 | with pytest.raises(ValueError): |
| 2480 | load_publickey(FILETYPE_TEXT, cleartextPublicKeyPEM) |
| 2481 | |
| 2482 | def test_invalid_key_format(self): |
| 2483 | """ |
| 2484 | load_publickey explodes on incorrect keys. |
| 2485 | """ |
| 2486 | with pytest.raises(Error): |
| 2487 | load_publickey(FILETYPE_ASN1, cleartextPublicKeyPEM) |
| 2488 | |
| 2489 | def test_tolerates_unicode_strings(self): |
| 2490 | """ |
| 2491 | load_publickey works with text strings, not just bytes. |
| 2492 | """ |
| 2493 | serialized = cleartextPublicKeyPEM.decode('ascii') |
| 2494 | key = load_publickey(FILETYPE_PEM, serialized) |
| 2495 | dumped_pem = dump_publickey(FILETYPE_PEM, key) |
| 2496 | |
| 2497 | assert dumped_pem == cleartextPublicKeyPEM |
Paul Kehrer | 32fc4e6 | 2016-06-03 15:21:44 -0700 | [diff] [blame] | 2498 | |
| 2499 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2500 | class TestFunction(object): |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2501 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2502 | Tests for free-functions in the `OpenSSL.crypto` module. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2503 | """ |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2504 | |
| 2505 | def test_load_privatekey_invalid_format(self): |
| 2506 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2507 | `load_privatekey` raises `ValueError` if passed an unknown filetype. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2508 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2509 | with pytest.raises(ValueError): |
| 2510 | load_privatekey(100, root_key_pem) |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2511 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2512 | def test_load_privatekey_invalid_passphrase_type(self): |
| 2513 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2514 | `load_privatekey` raises `TypeError` if passed a passphrase that is |
| 2515 | neither a `str` nor a callable. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2516 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2517 | with pytest.raises(TypeError): |
| 2518 | load_privatekey( |
| 2519 | FILETYPE_PEM, encryptedPrivateKeyPEMPassphrase, object()) |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2520 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2521 | def test_load_privatekey_wrongPassphrase(self): |
| 2522 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2523 | `load_privatekey` raises `OpenSSL.crypto.Error` when it is passed an |
| 2524 | encrypted PEM and an incorrect passphrase. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2525 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2526 | with pytest.raises(Error) as err: |
| 2527 | load_privatekey(FILETYPE_PEM, encryptedPrivateKeyPEM, b"quack") |
| 2528 | assert err.value.args[0] != [] |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2529 | |
Ziga Seilnacht | 376cf97 | 2009-12-22 16:04:10 +0100 | [diff] [blame] | 2530 | def test_load_privatekey_passphraseWrongType(self): |
| 2531 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2532 | `load_privatekey` raises `ValueError` when it is passeda passphrase |
| 2533 | with a private key encoded in a format, that doesn't support |
| 2534 | encryption. |
Ziga Seilnacht | 376cf97 | 2009-12-22 16:04:10 +0100 | [diff] [blame] | 2535 | """ |
| 2536 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
| 2537 | blob = dump_privatekey(FILETYPE_ASN1, key) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2538 | with pytest.raises(ValueError): |
| 2539 | load_privatekey(FILETYPE_ASN1, blob, "secret") |
Ziga Seilnacht | 376cf97 | 2009-12-22 16:04:10 +0100 | [diff] [blame] | 2540 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2541 | def test_load_privatekey_passphrase(self): |
| 2542 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2543 | `load_privatekey` can create a `PKey` object from an encrypted PEM |
| 2544 | string if given the passphrase. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2545 | """ |
| 2546 | key = load_privatekey( |
| 2547 | FILETYPE_PEM, encryptedPrivateKeyPEM, |
| 2548 | encryptedPrivateKeyPEMPassphrase) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2549 | assert isinstance(key, PKeyType) |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2550 | |
Ziga Seilnacht | 6b90a40 | 2009-12-22 14:33:47 +0100 | [diff] [blame] | 2551 | def test_load_privatekey_passphrase_exception(self): |
| 2552 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2553 | If the passphrase callback raises an exception, that exception is |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2554 | raised by `load_privatekey`. |
Ziga Seilnacht | 6b90a40 | 2009-12-22 14:33:47 +0100 | [diff] [blame] | 2555 | """ |
| 2556 | def cb(ignored): |
| 2557 | raise ArithmeticError |
| 2558 | |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2559 | with pytest.raises(ArithmeticError): |
| 2560 | load_privatekey(FILETYPE_PEM, encryptedPrivateKeyPEM, cb) |
Ziga Seilnacht | 6b90a40 | 2009-12-22 14:33:47 +0100 | [diff] [blame] | 2561 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2562 | def test_load_privatekey_wrongPassphraseCallback(self): |
| 2563 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2564 | `load_privatekey` raises `OpenSSL.crypto.Error` when it |
Jean-Paul Calderone | d440a08 | 2011-09-14 11:02:05 -0400 | [diff] [blame] | 2565 | is passed an encrypted PEM and a passphrase callback which returns an |
| 2566 | incorrect passphrase. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2567 | """ |
| 2568 | called = [] |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2569 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2570 | def cb(*a): |
| 2571 | called.append(None) |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 2572 | return b"quack" |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2573 | with pytest.raises(Error) as err: |
| 2574 | load_privatekey(FILETYPE_PEM, encryptedPrivateKeyPEM, cb) |
| 2575 | assert called |
| 2576 | assert err.value.args[0] != [] |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2577 | |
| 2578 | def test_load_privatekey_passphraseCallback(self): |
| 2579 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2580 | `load_privatekey` can create a `PKey` object from an encrypted PEM |
| 2581 | string if given a passphrase callback which returns the correct |
| 2582 | password. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2583 | """ |
| 2584 | called = [] |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2585 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2586 | def cb(writing): |
| 2587 | called.append(writing) |
| 2588 | return encryptedPrivateKeyPEMPassphrase |
| 2589 | key = load_privatekey(FILETYPE_PEM, encryptedPrivateKeyPEM, cb) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2590 | assert isinstance(key, PKeyType) |
| 2591 | assert called == [False] |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2592 | |
Jean-Paul Calderone | 105cb95 | 2011-09-14 10:16:46 -0400 | [diff] [blame] | 2593 | def test_load_privatekey_passphrase_wrong_return_type(self): |
| 2594 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2595 | `load_privatekey` raises `ValueError` if the passphrase callback |
| 2596 | returns something other than a byte string. |
Jean-Paul Calderone | 105cb95 | 2011-09-14 10:16:46 -0400 | [diff] [blame] | 2597 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2598 | with pytest.raises(ValueError): |
| 2599 | load_privatekey( |
| 2600 | FILETYPE_PEM, encryptedPrivateKeyPEM, lambda *args: 3) |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2601 | |
Alex Chan | fb078d8 | 2017-04-20 11:16:15 +0100 | [diff] [blame] | 2602 | def test_dump_privatekey_wrong_args(self): |
| 2603 | """ |
| 2604 | `dump_privatekey` raises `TypeError` if called with a `cipher` |
| 2605 | argument but no `passphrase` argument. |
| 2606 | """ |
| 2607 | key = PKey() |
| 2608 | key.generate_key(TYPE_RSA, 512) |
| 2609 | with pytest.raises(TypeError): |
| 2610 | dump_privatekey(FILETYPE_PEM, key, cipher=GOOD_CIPHER) |
| 2611 | |
Paul Kehrer | cded993 | 2017-06-29 18:43:42 -0500 | [diff] [blame] | 2612 | def test_dump_privatekey_not_rsa_key(self): |
| 2613 | """ |
| 2614 | `dump_privatekey` raises `TypeError` if called with a key that is |
| 2615 | not RSA. |
| 2616 | """ |
| 2617 | key = PKey() |
| 2618 | key.generate_key(TYPE_DSA, 512) |
| 2619 | with pytest.raises(TypeError): |
| 2620 | dump_privatekey(FILETYPE_TEXT, key) |
| 2621 | |
| 2622 | def test_dump_privatekey_invalid_pkey(self): |
| 2623 | with pytest.raises(TypeError): |
| 2624 | dump_privatekey(FILETYPE_TEXT, object()) |
| 2625 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2626 | def test_dump_privatekey_unknown_cipher(self): |
| 2627 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2628 | `dump_privatekey` raises `ValueError` if called with an unrecognized |
| 2629 | cipher name. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2630 | """ |
| 2631 | key = PKey() |
| 2632 | key.generate_key(TYPE_RSA, 512) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2633 | with pytest.raises(ValueError): |
| 2634 | dump_privatekey(FILETYPE_PEM, key, BAD_CIPHER, "passphrase") |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2635 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2636 | def test_dump_privatekey_invalid_passphrase_type(self): |
| 2637 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2638 | `dump_privatekey` raises `TypeError` if called with a passphrase which |
| 2639 | is neither a `str` nor a callable. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2640 | """ |
| 2641 | key = PKey() |
| 2642 | key.generate_key(TYPE_RSA, 512) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2643 | with pytest.raises(TypeError): |
| 2644 | dump_privatekey(FILETYPE_PEM, key, GOOD_CIPHER, object()) |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2645 | |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2646 | def test_dump_privatekey_invalid_filetype(self): |
| 2647 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2648 | `dump_privatekey` raises `ValueError` if called with an unrecognized |
| 2649 | filetype. |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2650 | """ |
| 2651 | key = PKey() |
| 2652 | key.generate_key(TYPE_RSA, 512) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2653 | with pytest.raises(ValueError): |
| 2654 | dump_privatekey(100, key) |
Jean-Paul Calderone | fe1b9bd | 2010-08-03 18:00:21 -0400 | [diff] [blame] | 2655 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2656 | def test_load_privatekey_passphrase_callback_length(self): |
Ziga Seilnacht | 781295a | 2009-12-22 14:58:01 +0100 | [diff] [blame] | 2657 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2658 | `crypto.load_privatekey` should raise an error when the passphrase |
| 2659 | provided by the callback is too long, not silently truncate it. |
Ziga Seilnacht | 781295a | 2009-12-22 14:58:01 +0100 | [diff] [blame] | 2660 | """ |
| 2661 | def cb(ignored): |
| 2662 | return "a" * 1025 |
| 2663 | |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2664 | with pytest.raises(ValueError): |
| 2665 | load_privatekey(FILETYPE_PEM, encryptedPrivateKeyPEM, cb) |
Ziga Seilnacht | 781295a | 2009-12-22 14:58:01 +0100 | [diff] [blame] | 2666 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2667 | def test_dump_privatekey_passphrase(self): |
| 2668 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2669 | `dump_privatekey` writes an encrypted PEM when given a passphrase. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2670 | """ |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 2671 | passphrase = b"foo" |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2672 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2673 | pem = dump_privatekey(FILETYPE_PEM, key, GOOD_CIPHER, passphrase) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2674 | assert isinstance(pem, binary_type) |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2675 | loadedKey = load_privatekey(FILETYPE_PEM, pem, passphrase) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2676 | assert isinstance(loadedKey, PKeyType) |
| 2677 | assert loadedKey.type() == key.type() |
| 2678 | assert loadedKey.bits() == key.bits() |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2679 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2680 | def test_dump_privatekey_passphrase_wrong_type(self): |
Ziga Seilnacht | 376cf97 | 2009-12-22 16:04:10 +0100 | [diff] [blame] | 2681 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2682 | `dump_privatekey` raises `ValueError` when it is passed a passphrase |
| 2683 | with a private key encoded in a format, that doesn't support |
| 2684 | encryption. |
Ziga Seilnacht | 376cf97 | 2009-12-22 16:04:10 +0100 | [diff] [blame] | 2685 | """ |
| 2686 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2687 | with pytest.raises(ValueError): |
| 2688 | dump_privatekey(FILETYPE_ASN1, key, GOOD_CIPHER, "secret") |
Ziga Seilnacht | 376cf97 | 2009-12-22 16:04:10 +0100 | [diff] [blame] | 2689 | |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2690 | def test_dump_certificate(self): |
| 2691 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2692 | `dump_certificate` writes PEM, DER, and text. |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2693 | """ |
Jean-Paul Calderone | f17e421 | 2009-04-01 14:21:40 -0400 | [diff] [blame] | 2694 | pemData = cleartextCertificatePEM + cleartextPrivateKeyPEM |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2695 | cert = load_certificate(FILETYPE_PEM, pemData) |
| 2696 | dumped_pem = dump_certificate(FILETYPE_PEM, cert) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2697 | assert dumped_pem == cleartextCertificatePEM |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2698 | dumped_der = dump_certificate(FILETYPE_ASN1, cert) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2699 | good_der = _runopenssl(dumped_pem, b"x509", b"-outform", b"DER") |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2700 | assert dumped_der == good_der |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2701 | cert2 = load_certificate(FILETYPE_ASN1, dumped_der) |
| 2702 | dumped_pem2 = dump_certificate(FILETYPE_PEM, cert2) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2703 | assert dumped_pem2 == cleartextCertificatePEM |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2704 | dumped_text = dump_certificate(FILETYPE_TEXT, cert) |
Alex Gaynor | 316aa2c | 2016-09-10 14:42:53 -0400 | [diff] [blame] | 2705 | good_text = _runopenssl( |
| 2706 | dumped_pem, b"x509", b"-noout", b"-text", b"-nameopt", b"") |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2707 | assert dumped_text == good_text |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2708 | |
Alex Gaynor | 3772611 | 2016-07-04 09:51:32 -0400 | [diff] [blame] | 2709 | def test_dump_certificate_bad_type(self): |
| 2710 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2711 | `dump_certificate` raises a `ValueError` if it's called with |
Alex Gaynor | 3772611 | 2016-07-04 09:51:32 -0400 | [diff] [blame] | 2712 | a bad type. |
| 2713 | """ |
| 2714 | cert = load_certificate(FILETYPE_PEM, cleartextCertificatePEM) |
| 2715 | with pytest.raises(ValueError): |
| 2716 | dump_certificate(object(), cert) |
| 2717 | |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2718 | def test_dump_privatekey_pem(self): |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2719 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2720 | `dump_privatekey` writes a PEM |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2721 | """ |
| 2722 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2723 | assert key.check() |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2724 | dumped_pem = dump_privatekey(FILETYPE_PEM, key) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2725 | assert dumped_pem == cleartextPrivateKeyPEM |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2726 | |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2727 | def test_dump_privatekey_asn1(self): |
| 2728 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2729 | `dump_privatekey` writes a DER |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2730 | """ |
| 2731 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
| 2732 | dumped_pem = dump_privatekey(FILETYPE_PEM, key) |
| 2733 | |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2734 | dumped_der = dump_privatekey(FILETYPE_ASN1, key) |
Jean-Paul Calderone | f17e421 | 2009-04-01 14:21:40 -0400 | [diff] [blame] | 2735 | # XXX This OpenSSL call writes "writing RSA key" to standard out. Sad. |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2736 | good_der = _runopenssl(dumped_pem, b"rsa", b"-outform", b"DER") |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2737 | assert dumped_der == good_der |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2738 | key2 = load_privatekey(FILETYPE_ASN1, dumped_der) |
| 2739 | dumped_pem2 = dump_privatekey(FILETYPE_PEM, key2) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2740 | assert dumped_pem2 == cleartextPrivateKeyPEM |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2741 | |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2742 | def test_dump_privatekey_text(self): |
| 2743 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2744 | `dump_privatekey` writes a text |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2745 | """ |
| 2746 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
| 2747 | dumped_pem = dump_privatekey(FILETYPE_PEM, key) |
| 2748 | |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2749 | dumped_text = dump_privatekey(FILETYPE_TEXT, key) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2750 | good_text = _runopenssl(dumped_pem, b"rsa", b"-noout", b"-text") |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2751 | assert dumped_text == good_text |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2752 | |
Cory Benfield | 6492f7c | 2015-10-27 16:57:58 +0900 | [diff] [blame] | 2753 | def test_dump_publickey_pem(self): |
| 2754 | """ |
Cory Benfield | 11c1019 | 2015-10-27 17:23:03 +0900 | [diff] [blame] | 2755 | dump_publickey writes a PEM. |
Cory Benfield | 6492f7c | 2015-10-27 16:57:58 +0900 | [diff] [blame] | 2756 | """ |
| 2757 | key = load_publickey(FILETYPE_PEM, cleartextPublicKeyPEM) |
| 2758 | dumped_pem = dump_publickey(FILETYPE_PEM, key) |
Cory Benfield | d86f1d8 | 2015-10-27 17:25:17 +0900 | [diff] [blame] | 2759 | assert dumped_pem == cleartextPublicKeyPEM |
Cory Benfield | 6492f7c | 2015-10-27 16:57:58 +0900 | [diff] [blame] | 2760 | |
| 2761 | def test_dump_publickey_asn1(self): |
| 2762 | """ |
Cory Benfield | 11c1019 | 2015-10-27 17:23:03 +0900 | [diff] [blame] | 2763 | dump_publickey writes a DER. |
Cory Benfield | 6492f7c | 2015-10-27 16:57:58 +0900 | [diff] [blame] | 2764 | """ |
| 2765 | key = load_publickey(FILETYPE_PEM, cleartextPublicKeyPEM) |
| 2766 | dumped_der = dump_publickey(FILETYPE_ASN1, key) |
| 2767 | key2 = load_publickey(FILETYPE_ASN1, dumped_der) |
| 2768 | dumped_pem2 = dump_publickey(FILETYPE_PEM, key2) |
Cory Benfield | d86f1d8 | 2015-10-27 17:25:17 +0900 | [diff] [blame] | 2769 | assert dumped_pem2 == cleartextPublicKeyPEM |
Cory Benfield | 6492f7c | 2015-10-27 16:57:58 +0900 | [diff] [blame] | 2770 | |
Cory Benfield | e02c7d8 | 2015-10-27 17:34:49 +0900 | [diff] [blame] | 2771 | def test_dump_publickey_invalid_type(self): |
| 2772 | """ |
| 2773 | dump_publickey doesn't support FILETYPE_TEXT. |
| 2774 | """ |
| 2775 | key = load_publickey(FILETYPE_PEM, cleartextPublicKeyPEM) |
| 2776 | |
| 2777 | with pytest.raises(ValueError): |
| 2778 | dump_publickey(FILETYPE_TEXT, key) |
| 2779 | |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2780 | def test_dump_certificate_request(self): |
| 2781 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2782 | `dump_certificate_request` writes a PEM, DER, and text. |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2783 | """ |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 2784 | req = load_certificate_request( |
| 2785 | FILETYPE_PEM, cleartextCertificateRequestPEM) |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2786 | dumped_pem = dump_certificate_request(FILETYPE_PEM, req) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2787 | assert dumped_pem == cleartextCertificateRequestPEM |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2788 | dumped_der = dump_certificate_request(FILETYPE_ASN1, req) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2789 | good_der = _runopenssl(dumped_pem, b"req", b"-outform", b"DER") |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2790 | assert dumped_der == good_der |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2791 | req2 = load_certificate_request(FILETYPE_ASN1, dumped_der) |
| 2792 | dumped_pem2 = dump_certificate_request(FILETYPE_PEM, req2) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2793 | assert dumped_pem2 == cleartextCertificateRequestPEM |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2794 | dumped_text = dump_certificate_request(FILETYPE_TEXT, req) |
Alex Gaynor | 316aa2c | 2016-09-10 14:42:53 -0400 | [diff] [blame] | 2795 | good_text = _runopenssl( |
| 2796 | dumped_pem, b"req", b"-noout", b"-text", b"-nameopt", b"") |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2797 | assert dumped_text == good_text |
| 2798 | with pytest.raises(ValueError): |
| 2799 | dump_certificate_request(100, req) |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2800 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2801 | def test_dump_privatekey_passphrase_callback(self): |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2802 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2803 | `dump_privatekey` writes an encrypted PEM when given a callback |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2804 | which returns the correct passphrase. |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2805 | """ |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 2806 | passphrase = b"foo" |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2807 | called = [] |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2808 | |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2809 | def cb(writing): |
| 2810 | called.append(writing) |
| 2811 | return passphrase |
| 2812 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 2813 | pem = dump_privatekey(FILETYPE_PEM, key, GOOD_CIPHER, cb) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2814 | assert isinstance(pem, binary_type) |
| 2815 | assert called == [True] |
Jean-Paul Calderone | 828c9cb | 2008-04-26 18:06:54 -0400 | [diff] [blame] | 2816 | loadedKey = load_privatekey(FILETYPE_PEM, pem, passphrase) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2817 | assert isinstance(loadedKey, PKeyType) |
| 2818 | assert loadedKey.type() == key.type() |
| 2819 | assert loadedKey.bits() == key.bits() |
Rick Dean | 5b7b637 | 2009-04-01 11:34:06 -0500 | [diff] [blame] | 2820 | |
Ziga Seilnacht | 6b90a40 | 2009-12-22 14:33:47 +0100 | [diff] [blame] | 2821 | def test_dump_privatekey_passphrase_exception(self): |
| 2822 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2823 | `dump_privatekey` should not overwrite the exception raised |
Ziga Seilnacht | 6b90a40 | 2009-12-22 14:33:47 +0100 | [diff] [blame] | 2824 | by the passphrase callback. |
| 2825 | """ |
| 2826 | def cb(ignored): |
| 2827 | raise ArithmeticError |
| 2828 | |
| 2829 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 2830 | with pytest.raises(ArithmeticError): |
| 2831 | dump_privatekey(FILETYPE_PEM, key, GOOD_CIPHER, cb) |
Ziga Seilnacht | 6b90a40 | 2009-12-22 14:33:47 +0100 | [diff] [blame] | 2832 | |
Ziga Seilnacht | 781295a | 2009-12-22 14:58:01 +0100 | [diff] [blame] | 2833 | def test_dump_privatekey_passphraseCallbackLength(self): |
| 2834 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2835 | `crypto.dump_privatekey` should raise an error when the passphrase |
| 2836 | provided by the callback is too long, not silently truncate it. |
Ziga Seilnacht | 781295a | 2009-12-22 14:58:01 +0100 | [diff] [blame] | 2837 | """ |
| 2838 | def cb(ignored): |
| 2839 | return "a" * 1025 |
| 2840 | |
| 2841 | key = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 2842 | with pytest.raises(ValueError): |
| 2843 | dump_privatekey(FILETYPE_PEM, key, GOOD_CIPHER, cb) |
Ziga Seilnacht | 781295a | 2009-12-22 14:58:01 +0100 | [diff] [blame] | 2844 | |
Alex Gaynor | 4b9c96a | 2014-08-14 09:51:48 -0700 | [diff] [blame] | 2845 | def test_load_pkcs7_data_pem(self): |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2846 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2847 | `load_pkcs7_data` accepts a PKCS#7 string and returns an instance of |
| 2848 | `PKCS`. |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2849 | """ |
| 2850 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2851 | assert isinstance(pkcs7, PKCS7) |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2852 | |
Alex Gaynor | 4b9c96a | 2014-08-14 09:51:48 -0700 | [diff] [blame] | 2853 | def test_load_pkcs7_data_asn1(self): |
Alex Gaynor | 9875a91 | 2014-08-14 13:35:05 -0700 | [diff] [blame] | 2854 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2855 | `load_pkcs7_data` accepts a bytes containing ASN1 data representing |
| 2856 | PKCS#7 and returns an instance of `PKCS7`. |
Alex Gaynor | 9875a91 | 2014-08-14 13:35:05 -0700 | [diff] [blame] | 2857 | """ |
Alex Gaynor | 4b9c96a | 2014-08-14 09:51:48 -0700 | [diff] [blame] | 2858 | pkcs7 = load_pkcs7_data(FILETYPE_ASN1, pkcs7DataASN1) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2859 | assert isinstance(pkcs7, PKCS7) |
Alex Gaynor | 4b9c96a | 2014-08-14 09:51:48 -0700 | [diff] [blame] | 2860 | |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2861 | def test_load_pkcs7_data_invalid(self): |
| 2862 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2863 | If the data passed to `load_pkcs7_data` is invalid, `Error` is raised. |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2864 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2865 | with pytest.raises(Error): |
| 2866 | load_pkcs7_data(FILETYPE_PEM, b"foo") |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2867 | |
Alex Gaynor | 09a386e | 2016-07-03 09:32:44 -0400 | [diff] [blame] | 2868 | def test_load_pkcs7_type_invalid(self): |
| 2869 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2870 | If the type passed to `load_pkcs7_data`, `ValueError` is raised. |
Alex Gaynor | 09a386e | 2016-07-03 09:32:44 -0400 | [diff] [blame] | 2871 | """ |
| 2872 | with pytest.raises(ValueError): |
| 2873 | load_pkcs7_data(object(), b"foo") |
| 2874 | |
Jean-Paul Calderone | e82e325 | 2013-03-03 10:14:10 -0800 | [diff] [blame] | 2875 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 2876 | class TestLoadCertificate(object): |
Jean-Paul Calderone | 4a68b40 | 2013-12-29 16:54:58 -0500 | [diff] [blame] | 2877 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 2878 | Tests for `load_certificate_request`. |
Jean-Paul Calderone | 4a68b40 | 2013-12-29 16:54:58 -0500 | [diff] [blame] | 2879 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2880 | |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 2881 | def test_bad_file_type(self): |
Jean-Paul Calderone | 4a68b40 | 2013-12-29 16:54:58 -0500 | [diff] [blame] | 2882 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 2883 | If the file type passed to `load_certificate_request` is neither |
| 2884 | `FILETYPE_PEM` nor `FILETYPE_ASN1` then `ValueError` is raised. |
Jean-Paul Calderone | 4a68b40 | 2013-12-29 16:54:58 -0500 | [diff] [blame] | 2885 | """ |
Alex Gaynor | 7778e79 | 2016-07-03 23:38:48 -0400 | [diff] [blame] | 2886 | with pytest.raises(ValueError): |
| 2887 | load_certificate_request(object(), b"") |
| 2888 | with pytest.raises(ValueError): |
| 2889 | load_certificate(object(), b"") |
Jean-Paul Calderone | 4a68b40 | 2013-12-29 16:54:58 -0500 | [diff] [blame] | 2890 | |
Alex Gaynor | 3772611 | 2016-07-04 09:51:32 -0400 | [diff] [blame] | 2891 | def test_bad_certificate(self): |
| 2892 | """ |
Alex Chan | 9e2a993 | 2017-01-25 14:29:19 +0000 | [diff] [blame] | 2893 | If the bytes passed to `load_certificate` are not a valid certificate, |
| 2894 | an exception is raised. |
Alex Gaynor | 3772611 | 2016-07-04 09:51:32 -0400 | [diff] [blame] | 2895 | """ |
| 2896 | with pytest.raises(Error): |
| 2897 | load_certificate(FILETYPE_ASN1, b"lol") |
| 2898 | |
Jean-Paul Calderone | 4a68b40 | 2013-12-29 16:54:58 -0500 | [diff] [blame] | 2899 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2900 | class TestPKCS7(object): |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 2901 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2902 | Tests for `PKCS7`. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 2903 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2904 | |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 2905 | def test_type(self): |
| 2906 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2907 | `PKCS7` is a type object. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 2908 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2909 | assert isinstance(PKCS7, type) |
| 2910 | assert PKCS7Type.__name__ == 'PKCS7' |
| 2911 | assert PKCS7 is PKCS7Type |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2912 | |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2913 | def test_type_is_signed(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2914 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2915 | `PKCS7.type_is_signed` returns `True` if the PKCS7 object is of |
| 2916 | the type *signed*. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2917 | """ |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2918 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2919 | assert pkcs7.type_is_signed() |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2920 | |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2921 | def test_type_is_enveloped(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2922 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2923 | `PKCS7.type_is_enveloped` returns `False` if the PKCS7 object is not |
| 2924 | of the type *enveloped*. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2925 | """ |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2926 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2927 | assert not pkcs7.type_is_enveloped() |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2928 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2929 | def test_type_is_signed_and_enveloped(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2930 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2931 | `PKCS7.type_is_signedAndEnveloped` returns `False` |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2932 | if the PKCS7 object is not of the type *signed and enveloped*. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2933 | """ |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2934 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2935 | assert not pkcs7.type_is_signedAndEnveloped() |
Jean-Paul Calderone | 07c9374 | 2010-07-30 10:53:41 -0400 | [diff] [blame] | 2936 | |
Jean-Paul Calderone | b4754b9 | 2010-07-30 11:00:08 -0400 | [diff] [blame] | 2937 | def test_type_is_data(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2938 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2939 | `PKCS7.type_is_data` returns `False` if the PKCS7 object is not of |
| 2940 | the type data. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2941 | """ |
Jean-Paul Calderone | b4754b9 | 2010-07-30 11:00:08 -0400 | [diff] [blame] | 2942 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2943 | assert not pkcs7.type_is_data() |
Jean-Paul Calderone | 97b28ca | 2010-07-30 10:56:07 -0400 | [diff] [blame] | 2944 | |
Jean-Paul Calderone | 4cbe05e | 2010-07-30 10:55:30 -0400 | [diff] [blame] | 2945 | def test_get_type_name(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2946 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2947 | `PKCS7.get_type_name` returns a `str` giving the |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2948 | type name. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2949 | """ |
Jean-Paul Calderone | 4cbe05e | 2010-07-30 10:55:30 -0400 | [diff] [blame] | 2950 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2951 | assert pkcs7.get_type_name() == b'pkcs7-signedData' |
Jean-Paul Calderone | 4cbe05e | 2010-07-30 10:55:30 -0400 | [diff] [blame] | 2952 | |
Jean-Paul Calderone | 4cbe05e | 2010-07-30 10:55:30 -0400 | [diff] [blame] | 2953 | def test_attribute(self): |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2954 | """ |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 2955 | If an attribute other than one of the methods tested here is accessed |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2956 | on an instance of `PKCS7`, `AttributeError` is raised. |
Jean-Paul Calderone | aa6c069 | 2010-09-08 22:43:09 -0400 | [diff] [blame] | 2957 | """ |
Jean-Paul Calderone | 4cbe05e | 2010-07-30 10:55:30 -0400 | [diff] [blame] | 2958 | pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data) |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2959 | with pytest.raises(AttributeError): |
| 2960 | pkcs7.foo |
Jean-Paul Calderone | 4cbe05e | 2010-07-30 10:55:30 -0400 | [diff] [blame] | 2961 | |
| 2962 | |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2963 | class TestNetscapeSPKI(_PKeyInteractionTestsMixin): |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2964 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2965 | Tests for `OpenSSL.crypto.NetscapeSPKI`. |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2966 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 2967 | |
Jean-Paul Calderone | b972559 | 2010-08-03 18:17:22 -0400 | [diff] [blame] | 2968 | def signable(self): |
| 2969 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2970 | Return a new `NetscapeSPKI` for use with signing tests. |
Jean-Paul Calderone | b972559 | 2010-08-03 18:17:22 -0400 | [diff] [blame] | 2971 | """ |
| 2972 | return NetscapeSPKI() |
| 2973 | |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 2974 | def test_type(self): |
| 2975 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2976 | `NetscapeSPKI` and `NetscapeSPKIType` refer to the same type object |
| 2977 | and can be used to create instances of that type. |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 2978 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2979 | assert NetscapeSPKI is NetscapeSPKIType |
| 2980 | assert is_consistent_type(NetscapeSPKI, 'NetscapeSPKI') |
Jean-Paul Calderone | 6864905 | 2009-07-17 21:14:27 -0400 | [diff] [blame] | 2981 | |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2982 | def test_construction(self): |
| 2983 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2984 | `NetscapeSPKI` returns an instance of `NetscapeSPKIType`. |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2985 | """ |
| 2986 | nspki = NetscapeSPKI() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2987 | assert isinstance(nspki, NetscapeSPKIType) |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 2988 | |
Jean-Paul Calderone | 969efaa | 2010-08-03 18:19:19 -0400 | [diff] [blame] | 2989 | def test_invalid_attribute(self): |
| 2990 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2991 | Accessing a non-existent attribute of a `NetscapeSPKI` instance |
| 2992 | causes an `AttributeError` to be raised. |
Jean-Paul Calderone | 969efaa | 2010-08-03 18:19:19 -0400 | [diff] [blame] | 2993 | """ |
| 2994 | nspki = NetscapeSPKI() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 2995 | with pytest.raises(AttributeError): |
| 2996 | nspki.foo |
Jean-Paul Calderone | 969efaa | 2010-08-03 18:19:19 -0400 | [diff] [blame] | 2997 | |
Jean-Paul Calderone | 06ada9f | 2010-08-03 18:26:52 -0400 | [diff] [blame] | 2998 | def test_b64_encode(self): |
| 2999 | """ |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 3000 | `NetscapeSPKI.b64_encode` encodes the certificate to a base64 blob. |
Jean-Paul Calderone | 06ada9f | 2010-08-03 18:26:52 -0400 | [diff] [blame] | 3001 | """ |
| 3002 | nspki = NetscapeSPKI() |
| 3003 | blob = nspki.b64_encode() |
Alex Chan | b00ede2 | 2017-01-30 07:24:40 +0000 | [diff] [blame] | 3004 | assert isinstance(blob, binary_type) |
Jean-Paul Calderone | 06ada9f | 2010-08-03 18:26:52 -0400 | [diff] [blame] | 3005 | |
| 3006 | |
Paul Kehrer | 2c605ba | 2016-03-11 11:17:26 -0400 | [diff] [blame] | 3007 | class TestRevoked(object): |
| 3008 | """ |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3009 | Tests for `OpenSSL.crypto.Revoked`. |
Paul Kehrer | 2c605ba | 2016-03-11 11:17:26 -0400 | [diff] [blame] | 3010 | """ |
| 3011 | def test_ignores_unsupported_revoked_cert_extension_get_reason(self): |
| 3012 | """ |
| 3013 | The get_reason method on the Revoked class checks to see if the |
| 3014 | extension is NID_crl_reason and should skip it otherwise. This test |
| 3015 | loads a CRL with extensions it should ignore. |
| 3016 | """ |
| 3017 | crl = load_crl(FILETYPE_PEM, crlDataUnsupportedExtension) |
| 3018 | revoked = crl.get_revoked() |
| 3019 | reason = revoked[1].get_reason() |
| 3020 | assert reason == b'Unspecified' |
| 3021 | |
| 3022 | def test_ignores_unsupported_revoked_cert_extension_set_new_reason(self): |
| 3023 | crl = load_crl(FILETYPE_PEM, crlDataUnsupportedExtension) |
| 3024 | revoked = crl.get_revoked() |
| 3025 | revoked[1].set_reason(None) |
| 3026 | reason = revoked[1].get_reason() |
| 3027 | assert reason is None |
| 3028 | |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3029 | def test_construction(self): |
| 3030 | """ |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3031 | Confirm we can create `OpenSSL.crypto.Revoked`. Check that it is |
| 3032 | empty. |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3033 | """ |
| 3034 | revoked = Revoked() |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3035 | assert isinstance(revoked, Revoked) |
| 3036 | assert type(revoked) == Revoked |
| 3037 | assert revoked.get_serial() == b'00' |
| 3038 | assert revoked.get_rev_date() is None |
| 3039 | assert revoked.get_reason() is None |
Jean-Paul Calderone | 4f74bfe | 2010-01-30 14:32:49 -0500 | [diff] [blame] | 3040 | |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3041 | def test_serial(self): |
| 3042 | """ |
Jean-Paul Calderone | b98eae0 | 2010-01-30 13:18:04 -0500 | [diff] [blame] | 3043 | Confirm we can set and get serial numbers from |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3044 | `OpenSSL.crypto.Revoked`. Confirm errors are handled with grace. |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3045 | """ |
| 3046 | revoked = Revoked() |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3047 | ret = revoked.set_serial(b'10b') |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3048 | assert ret is None |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3049 | ser = revoked.get_serial() |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3050 | assert ser == b'010B' |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3051 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3052 | revoked.set_serial(b'31ppp') # a type error would be nice |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3053 | ser = revoked.get_serial() |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3054 | assert ser == b'31' |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3055 | |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3056 | with pytest.raises(ValueError): |
| 3057 | revoked.set_serial(b'pqrst') |
| 3058 | with pytest.raises(TypeError): |
| 3059 | revoked.set_serial(100) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3060 | |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3061 | def test_date(self): |
| 3062 | """ |
Jean-Paul Calderone | b98eae0 | 2010-01-30 13:18:04 -0500 | [diff] [blame] | 3063 | Confirm we can set and get revocation dates from |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3064 | `OpenSSL.crypto.Revoked`. Confirm errors are handled with grace. |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3065 | """ |
| 3066 | revoked = Revoked() |
| 3067 | date = revoked.get_rev_date() |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3068 | assert date is None |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3069 | |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3070 | now = datetime.now().strftime("%Y%m%d%H%M%SZ").encode("ascii") |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3071 | ret = revoked.set_rev_date(now) |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3072 | assert ret is None |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3073 | date = revoked.get_rev_date() |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3074 | assert date == now |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3075 | |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 3076 | def test_reason(self): |
| 3077 | """ |
Jean-Paul Calderone | b98eae0 | 2010-01-30 13:18:04 -0500 | [diff] [blame] | 3078 | Confirm we can set and get revocation reasons from |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3079 | `OpenSSL.crypto.Revoked`. The "get" need to work as "set". |
| 3080 | Likewise, each reason of all_reasons() must work. |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 3081 | """ |
| 3082 | revoked = Revoked() |
| 3083 | for r in revoked.all_reasons(): |
Jean-Paul Calderone | eacad4a | 2010-08-22 17:12:55 -0400 | [diff] [blame] | 3084 | for x in range(2): |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 3085 | ret = revoked.set_reason(r) |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3086 | assert ret is None |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 3087 | reason = revoked.get_reason() |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3088 | assert ( |
| 3089 | reason.lower().replace(b' ', b'') == |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3090 | r.lower().replace(b' ', b'')) |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 3091 | r = reason # again with the resp of get |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 3092 | |
| 3093 | revoked.set_reason(None) |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3094 | assert revoked.get_reason() is None |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 3095 | |
Alex Chan | fb078d8 | 2017-04-20 11:16:15 +0100 | [diff] [blame] | 3096 | @pytest.mark.parametrize('reason', [object(), 1.0, u'foo']) |
| 3097 | def test_set_reason_wrong_args(self, reason): |
| 3098 | """ |
| 3099 | `Revoked.set_reason` raises `TypeError` if called with an argument |
| 3100 | which is neither `None` nor a byte string. |
| 3101 | """ |
| 3102 | revoked = Revoked() |
| 3103 | with pytest.raises(TypeError): |
| 3104 | revoked.set_reason(reason) |
| 3105 | |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3106 | def test_set_reason_invalid_reason(self): |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 3107 | """ |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3108 | Calling `OpenSSL.crypto.Revoked.set_reason` with an argument which |
| 3109 | isn't a valid reason results in `ValueError` being raised. |
Rick Dean | 6385faf | 2009-07-26 00:07:47 -0500 | [diff] [blame] | 3110 | """ |
| 3111 | revoked = Revoked() |
Alex Chan | deec934 | 2016-12-19 22:00:38 +0000 | [diff] [blame] | 3112 | with pytest.raises(ValueError): |
| 3113 | revoked.set_reason(b'blue') |
Jean-Paul Calderone | 4f74bfe | 2010-01-30 14:32:49 -0500 | [diff] [blame] | 3114 | |
| 3115 | |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3116 | class TestCRL(object): |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3117 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3118 | Tests for `OpenSSL.crypto.CRL`. |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3119 | """ |
| 3120 | cert = load_certificate(FILETYPE_PEM, cleartextCertificatePEM) |
| 3121 | pkey = load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM) |
| 3122 | |
Dan Sully | 44e767a | 2016-06-04 18:05:27 -0700 | [diff] [blame] | 3123 | root_cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
| 3124 | root_key = load_privatekey(FILETYPE_PEM, root_key_pem) |
| 3125 | intermediate_cert = load_certificate(FILETYPE_PEM, intermediate_cert_pem) |
| 3126 | intermediate_key = load_privatekey(FILETYPE_PEM, intermediate_key_pem) |
| 3127 | intermediate_server_cert = load_certificate( |
| 3128 | FILETYPE_PEM, intermediate_server_cert_pem) |
| 3129 | intermediate_server_key = load_privatekey( |
| 3130 | FILETYPE_PEM, intermediate_server_key_pem) |
| 3131 | |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3132 | def test_construction(self): |
| 3133 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3134 | Confirm we can create `OpenSSL.crypto.CRL`. Check |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3135 | that it is empty |
| 3136 | """ |
| 3137 | crl = CRL() |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3138 | assert isinstance(crl, CRL) |
| 3139 | assert crl.get_revoked() is None |
Jean-Paul Calderone | 2efd03e | 2010-01-30 13:59:55 -0500 | [diff] [blame] | 3140 | |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3141 | def _get_crl(self): |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3142 | """ |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3143 | Get a new ``CRL`` with a revocation. |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3144 | """ |
| 3145 | crl = CRL() |
| 3146 | revoked = Revoked() |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3147 | now = datetime.now().strftime("%Y%m%d%H%M%SZ").encode("ascii") |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3148 | revoked.set_rev_date(now) |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3149 | revoked.set_serial(b'3ab') |
| 3150 | revoked.set_reason(b'sUpErSeDEd') |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3151 | crl.add_revoked(revoked) |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3152 | return crl |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3153 | |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3154 | def test_export_pem(self): |
| 3155 | """ |
| 3156 | If not passed a format, ``CRL.export`` returns a "PEM" format string |
| 3157 | representing a serial number, a revoked reason, and certificate issuer |
| 3158 | information. |
| 3159 | """ |
| 3160 | crl = self._get_crl() |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3161 | # PEM format |
Alex Gaynor | 173e4ba | 2017-06-30 08:01:12 -0700 | [diff] [blame] | 3162 | dumped_crl = crl.export( |
| 3163 | self.cert, self.pkey, days=20, digest=b"sha256" |
| 3164 | ) |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 3165 | text = _runopenssl(dumped_crl, b"crl", b"-noout", b"-text") |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3166 | |
| 3167 | # These magic values are based on the way the CRL above was constructed |
| 3168 | # and with what certificate it was exported. |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3169 | text.index(b'Serial Number: 03AB') |
| 3170 | text.index(b'Superseded') |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3171 | text.index( |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3172 | b'Issuer: /C=US/ST=IL/L=Chicago/O=Testing/CN=Testing Root CA' |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3173 | ) |
| 3174 | |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3175 | def test_export_der(self): |
| 3176 | """ |
| 3177 | If passed ``FILETYPE_ASN1`` for the format, ``CRL.export`` returns a |
| 3178 | "DER" format string representing a serial number, a revoked reason, and |
| 3179 | certificate issuer information. |
| 3180 | """ |
| 3181 | crl = self._get_crl() |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3182 | |
| 3183 | # DER format |
Alex Gaynor | 173e4ba | 2017-06-30 08:01:12 -0700 | [diff] [blame] | 3184 | dumped_crl = crl.export( |
| 3185 | self.cert, self.pkey, FILETYPE_ASN1, digest=b"md5" |
| 3186 | ) |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3187 | text = _runopenssl( |
| 3188 | dumped_crl, b"crl", b"-noout", b"-text", b"-inform", b"DER" |
| 3189 | ) |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3190 | text.index(b'Serial Number: 03AB') |
| 3191 | text.index(b'Superseded') |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3192 | text.index( |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3193 | b'Issuer: /C=US/ST=IL/L=Chicago/O=Testing/CN=Testing Root CA' |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3194 | ) |
| 3195 | |
Alex Gaynor | e466bc9 | 2017-07-06 23:43:47 -0400 | [diff] [blame] | 3196 | # Flaky because we compare the output of running commands which sometimes |
| 3197 | # varies by 1 second |
| 3198 | @flaky.flaky |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3199 | def test_export_text(self): |
| 3200 | """ |
| 3201 | If passed ``FILETYPE_TEXT`` for the format, ``CRL.export`` returns a |
| 3202 | text format string like the one produced by the openssl command line |
| 3203 | tool. |
| 3204 | """ |
| 3205 | crl = self._get_crl() |
| 3206 | |
Alex Gaynor | 173e4ba | 2017-06-30 08:01:12 -0700 | [diff] [blame] | 3207 | dumped_crl = crl.export( |
| 3208 | self.cert, self.pkey, FILETYPE_ASN1, digest=b"md5" |
| 3209 | ) |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3210 | text = _runopenssl( |
| 3211 | dumped_crl, b"crl", b"-noout", b"-text", b"-inform", b"DER" |
| 3212 | ) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3213 | |
| 3214 | # text format |
Alex Gaynor | 173e4ba | 2017-06-30 08:01:12 -0700 | [diff] [blame] | 3215 | dumped_text = crl.export( |
| 3216 | self.cert, self.pkey, type=FILETYPE_TEXT, digest=b"md5" |
| 3217 | ) |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3218 | assert text == dumped_text |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3219 | |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3220 | def test_export_custom_digest(self): |
| 3221 | """ |
| 3222 | If passed the name of a digest function, ``CRL.export`` uses a |
| 3223 | signature algorithm based on that digest function. |
| 3224 | """ |
| 3225 | crl = self._get_crl() |
Jean-Paul Calderone | cce22d0 | 2015-04-13 13:56:09 -0400 | [diff] [blame] | 3226 | dumped_crl = crl.export(self.cert, self.pkey, digest=b"sha1") |
Bulat Gaifullin | 1966c97 | 2014-09-22 09:47:20 +0400 | [diff] [blame] | 3227 | text = _runopenssl(dumped_crl, b"crl", b"-noout", b"-text") |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3228 | text.index(b'Signature Algorithm: sha1') |
Bulat Gaifullin | 1966c97 | 2014-09-22 09:47:20 +0400 | [diff] [blame] | 3229 | |
Jean-Paul Calderone | cce22d0 | 2015-04-13 13:56:09 -0400 | [diff] [blame] | 3230 | def test_export_md5_digest(self): |
| 3231 | """ |
| 3232 | If passed md5 as the digest function, ``CRL.export`` uses md5 and does |
| 3233 | not emit a deprecation warning. |
| 3234 | """ |
| 3235 | crl = self._get_crl() |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3236 | with pytest.warns(None) as catcher: |
Jean-Paul Calderone | cce22d0 | 2015-04-13 13:56:09 -0400 | [diff] [blame] | 3237 | simplefilter("always") |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3238 | assert 0 == len(catcher) |
Jean-Paul Calderone | cce22d0 | 2015-04-13 13:56:09 -0400 | [diff] [blame] | 3239 | dumped_crl = crl.export(self.cert, self.pkey, digest=b"md5") |
| 3240 | text = _runopenssl(dumped_crl, b"crl", b"-noout", b"-text") |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3241 | text.index(b'Signature Algorithm: md5') |
Jean-Paul Calderone | cce22d0 | 2015-04-13 13:56:09 -0400 | [diff] [blame] | 3242 | |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3243 | def test_export_default_digest(self): |
| 3244 | """ |
Alex Gaynor | 173e4ba | 2017-06-30 08:01:12 -0700 | [diff] [blame] | 3245 | If not passed the name of a digest function, ``CRL.export`` raises a |
| 3246 | ``TypeError``. |
Jean-Paul Calderone | 6043279 | 2015-04-13 12:26:07 -0400 | [diff] [blame] | 3247 | """ |
| 3248 | crl = self._get_crl() |
Alex Gaynor | 173e4ba | 2017-06-30 08:01:12 -0700 | [diff] [blame] | 3249 | with pytest.raises(TypeError): |
| 3250 | crl.export(self.cert, self.pkey) |
Bulat Gaifullin | 1966c97 | 2014-09-22 09:47:20 +0400 | [diff] [blame] | 3251 | |
Jean-Paul Calderone | c7293bc | 2011-09-13 15:24:38 -0400 | [diff] [blame] | 3252 | def test_export_invalid(self): |
| 3253 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3254 | If `CRL.export` is used with an uninitialized `X509` instance, |
| 3255 | `OpenSSL.crypto.Error` is raised. |
Jean-Paul Calderone | c7293bc | 2011-09-13 15:24:38 -0400 | [diff] [blame] | 3256 | """ |
| 3257 | crl = CRL() |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3258 | with pytest.raises(Error): |
Alex Gaynor | 173e4ba | 2017-06-30 08:01:12 -0700 | [diff] [blame] | 3259 | crl.export(X509(), PKey(), digest=b"sha256") |
Jean-Paul Calderone | c7293bc | 2011-09-13 15:24:38 -0400 | [diff] [blame] | 3260 | |
Jean-Paul Calderone | 5651534 | 2010-01-30 13:49:38 -0500 | [diff] [blame] | 3261 | def test_add_revoked_keyword(self): |
| 3262 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3263 | `OpenSSL.CRL.add_revoked` accepts its single argument as the |
Jean-Paul Calderone | 64efa2c | 2011-09-11 10:00:09 -0400 | [diff] [blame] | 3264 | ``revoked`` keyword argument. |
Jean-Paul Calderone | 5651534 | 2010-01-30 13:49:38 -0500 | [diff] [blame] | 3265 | """ |
| 3266 | crl = CRL() |
| 3267 | revoked = Revoked() |
Paul Kehrer | b11bffc | 2016-03-10 18:30:29 -0400 | [diff] [blame] | 3268 | revoked.set_serial(b"01") |
Paul Kehrer | 2fe23b0 | 2016-03-09 22:02:15 -0400 | [diff] [blame] | 3269 | revoked.set_rev_date(b"20160310020145Z") |
Jean-Paul Calderone | 5651534 | 2010-01-30 13:49:38 -0500 | [diff] [blame] | 3270 | crl.add_revoked(revoked=revoked) |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3271 | assert isinstance(crl.get_revoked()[0], Revoked) |
Jean-Paul Calderone | 5651534 | 2010-01-30 13:49:38 -0500 | [diff] [blame] | 3272 | |
Jean-Paul Calderone | 883ca4b | 2010-01-30 13:55:13 -0500 | [diff] [blame] | 3273 | def test_export_wrong_args(self): |
| 3274 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3275 | Calling `OpenSSL.CRL.export` with arguments other than the certificate, |
Jean-Paul Calderone | f151586 | 2010-01-30 13:57:03 -0500 | [diff] [blame] | 3276 | private key, integer file type, and integer number of days it |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3277 | expects, results in a `TypeError` being raised. |
Jean-Paul Calderone | 883ca4b | 2010-01-30 13:55:13 -0500 | [diff] [blame] | 3278 | """ |
| 3279 | crl = CRL() |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 3280 | with pytest.raises(TypeError): |
| 3281 | crl.export(None, self.pkey, FILETYPE_PEM, 10) |
| 3282 | with pytest.raises(TypeError): |
| 3283 | crl.export(self.cert, None, FILETYPE_PEM, 10) |
| 3284 | with pytest.raises(TypeError): |
| 3285 | crl.export(self.cert, self.pkey, None, 10) |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3286 | with pytest.raises(TypeError): |
| 3287 | crl.export(self.cert, FILETYPE_PEM, None) |
Jean-Paul Calderone | f151586 | 2010-01-30 13:57:03 -0500 | [diff] [blame] | 3288 | |
Jean-Paul Calderone | ea19842 | 2010-01-30 13:58:23 -0500 | [diff] [blame] | 3289 | def test_export_unknown_filetype(self): |
| 3290 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3291 | Calling `OpenSSL.CRL.export` with a file type other than |
| 3292 | `FILETYPE_PEM`, `FILETYPE_ASN1`, or |
| 3293 | `FILETYPE_TEXT` results in a `ValueError` being raised. |
Jean-Paul Calderone | ea19842 | 2010-01-30 13:58:23 -0500 | [diff] [blame] | 3294 | """ |
| 3295 | crl = CRL() |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 3296 | with pytest.raises(ValueError): |
Alex Gaynor | 173e4ba | 2017-06-30 08:01:12 -0700 | [diff] [blame] | 3297 | crl.export(self.cert, self.pkey, 100, 10, digest=b"sha256") |
Jean-Paul Calderone | ea19842 | 2010-01-30 13:58:23 -0500 | [diff] [blame] | 3298 | |
Bulat Gaifullin | 925f786 | 2014-09-22 10:10:44 +0400 | [diff] [blame] | 3299 | def test_export_unknown_digest(self): |
Bulat Gaifullin | 5f9eea4 | 2014-09-23 19:35:15 +0400 | [diff] [blame] | 3300 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3301 | Calling `OpenSSL.CRL.export` with an unsupported digest results |
| 3302 | in a `ValueError` being raised. |
Bulat Gaifullin | 5f9eea4 | 2014-09-23 19:35:15 +0400 | [diff] [blame] | 3303 | """ |
Bulat Gaifullin | 925f786 | 2014-09-22 10:10:44 +0400 | [diff] [blame] | 3304 | crl = CRL() |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3305 | with pytest.raises(ValueError): |
| 3306 | crl.export( |
| 3307 | self.cert, self.pkey, FILETYPE_PEM, 10, b"strange-digest") |
Bulat Gaifullin | 925f786 | 2014-09-22 10:10:44 +0400 | [diff] [blame] | 3308 | |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3309 | def test_get_revoked(self): |
| 3310 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3311 | Use python to create a simple CRL with two revocations. Get back the |
| 3312 | `Revoked` using `OpenSSL.CRL.get_revoked` and verify them. |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3313 | """ |
| 3314 | crl = CRL() |
| 3315 | |
| 3316 | revoked = Revoked() |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3317 | now = datetime.now().strftime("%Y%m%d%H%M%SZ").encode("ascii") |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3318 | revoked.set_rev_date(now) |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3319 | revoked.set_serial(b'3ab') |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3320 | crl.add_revoked(revoked) |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3321 | revoked.set_serial(b'100') |
| 3322 | revoked.set_reason(b'sUpErSeDEd') |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3323 | crl.add_revoked(revoked) |
| 3324 | |
| 3325 | revs = crl.get_revoked() |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3326 | assert len(revs) == 2 |
| 3327 | assert type(revs[0]) == Revoked |
| 3328 | assert type(revs[1]) == Revoked |
| 3329 | assert revs[0].get_serial() == b'03AB' |
| 3330 | assert revs[1].get_serial() == b'0100' |
| 3331 | assert revs[0].get_rev_date() == now |
| 3332 | assert revs[1].get_rev_date() == now |
Jean-Paul Calderone | ecef6fa | 2010-01-30 13:47:18 -0500 | [diff] [blame] | 3333 | |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3334 | def test_load_crl(self): |
| 3335 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3336 | Load a known CRL and inspect its revocations. Both EM and DER formats |
| 3337 | are loaded. |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3338 | """ |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3339 | crl = load_crl(FILETYPE_PEM, crlData) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3340 | revs = crl.get_revoked() |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3341 | assert len(revs) == 2 |
| 3342 | assert revs[0].get_serial() == b'03AB' |
| 3343 | assert revs[0].get_reason() is None |
| 3344 | assert revs[1].get_serial() == b'0100' |
| 3345 | assert revs[1].get_reason() == b'Superseded' |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3346 | |
Jean-Paul Calderone | 4f0467a | 2014-01-11 11:58:41 -0500 | [diff] [blame] | 3347 | der = _runopenssl(crlData, b"crl", b"-outform", b"DER") |
Jean-Paul Calderone | b98eae0 | 2010-01-30 13:18:04 -0500 | [diff] [blame] | 3348 | crl = load_crl(FILETYPE_ASN1, der) |
Rick Dean | 536ba02 | 2009-07-24 23:57:27 -0500 | [diff] [blame] | 3349 | revs = crl.get_revoked() |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3350 | assert len(revs) == 2 |
| 3351 | assert revs[0].get_serial() == b'03AB' |
| 3352 | assert revs[0].get_reason() is None |
| 3353 | assert revs[1].get_serial() == b'0100' |
| 3354 | assert revs[1].get_reason() == b'Superseded' |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3355 | |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3356 | def test_load_crl_bad_filetype(self): |
| 3357 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3358 | Calling `OpenSSL.crypto.load_crl` with an unknown file type raises a |
| 3359 | `ValueError`. |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3360 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3361 | with pytest.raises(ValueError): |
| 3362 | load_crl(100, crlData) |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3363 | |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3364 | def test_load_crl_bad_data(self): |
| 3365 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3366 | Calling `OpenSSL.crypto.load_crl` with file data which can't be loaded |
| 3367 | raises a `OpenSSL.crypto.Error`. |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3368 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3369 | with pytest.raises(Error): |
| 3370 | load_crl(FILETYPE_PEM, b"hello, world") |
Jean-Paul Calderone | 3eb5cc7 | 2010-01-30 15:24:40 -0500 | [diff] [blame] | 3371 | |
Dan Sully | 44e767a | 2016-06-04 18:05:27 -0700 | [diff] [blame] | 3372 | def test_get_issuer(self): |
| 3373 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3374 | Load a known CRL and assert its issuer's common name is what we expect |
| 3375 | from the encoded crlData string. |
Dan Sully | 44e767a | 2016-06-04 18:05:27 -0700 | [diff] [blame] | 3376 | """ |
| 3377 | crl = load_crl(FILETYPE_PEM, crlData) |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3378 | assert isinstance(crl.get_issuer(), X509Name) |
| 3379 | assert crl.get_issuer().CN == 'Testing Root CA' |
Dan Sully | 44e767a | 2016-06-04 18:05:27 -0700 | [diff] [blame] | 3380 | |
Dominic Chen | f05b212 | 2015-10-13 16:32:35 +0000 | [diff] [blame] | 3381 | def test_dump_crl(self): |
| 3382 | """ |
| 3383 | The dumped CRL matches the original input. |
| 3384 | """ |
| 3385 | crl = load_crl(FILETYPE_PEM, crlData) |
| 3386 | buf = dump_crl(FILETYPE_PEM, crl) |
| 3387 | assert buf == crlData |
| 3388 | |
Dan Sully | 44e767a | 2016-06-04 18:05:27 -0700 | [diff] [blame] | 3389 | def _make_test_crl(self, issuer_cert, issuer_key, certs=()): |
| 3390 | """ |
| 3391 | Create a CRL. |
| 3392 | |
| 3393 | :param list[X509] certs: A list of certificates to revoke. |
| 3394 | :rtype: CRL |
| 3395 | """ |
| 3396 | crl = CRL() |
| 3397 | for cert in certs: |
| 3398 | revoked = Revoked() |
| 3399 | # FIXME: This string splicing is an unfortunate implementation |
| 3400 | # detail that has been reported in |
| 3401 | # https://github.com/pyca/pyopenssl/issues/258 |
| 3402 | serial = hex(cert.get_serial_number())[2:].encode('utf-8') |
| 3403 | revoked.set_serial(serial) |
| 3404 | revoked.set_reason(b'unspecified') |
| 3405 | revoked.set_rev_date(b'20140601000000Z') |
| 3406 | crl.add_revoked(revoked) |
| 3407 | crl.set_version(1) |
| 3408 | crl.set_lastUpdate(b'20140601000000Z') |
| 3409 | crl.set_nextUpdate(b'20180601000000Z') |
| 3410 | crl.sign(issuer_cert, issuer_key, digest=b'sha512') |
| 3411 | return crl |
| 3412 | |
| 3413 | def test_verify_with_revoked(self): |
| 3414 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3415 | `verify_certificate` raises error when an intermediate certificate is |
| 3416 | revoked. |
Dan Sully | 44e767a | 2016-06-04 18:05:27 -0700 | [diff] [blame] | 3417 | """ |
| 3418 | store = X509Store() |
| 3419 | store.add_cert(self.root_cert) |
| 3420 | store.add_cert(self.intermediate_cert) |
| 3421 | root_crl = self._make_test_crl( |
| 3422 | self.root_cert, self.root_key, certs=[self.intermediate_cert]) |
| 3423 | intermediate_crl = self._make_test_crl( |
| 3424 | self.intermediate_cert, self.intermediate_key, certs=[]) |
| 3425 | store.add_crl(root_crl) |
| 3426 | store.add_crl(intermediate_crl) |
| 3427 | store.set_flags( |
| 3428 | X509StoreFlags.CRL_CHECK | X509StoreFlags.CRL_CHECK_ALL) |
| 3429 | store_ctx = X509StoreContext(store, self.intermediate_server_cert) |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3430 | with pytest.raises(X509StoreContextError) as err: |
| 3431 | store_ctx.verify_certificate() |
| 3432 | assert err.value.args[0][2] == 'certificate revoked' |
Dan Sully | 44e767a | 2016-06-04 18:05:27 -0700 | [diff] [blame] | 3433 | |
| 3434 | def test_verify_with_missing_crl(self): |
| 3435 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3436 | `verify_certificate` raises error when an intermediate certificate's |
| 3437 | CRL is missing. |
Dan Sully | 44e767a | 2016-06-04 18:05:27 -0700 | [diff] [blame] | 3438 | """ |
| 3439 | store = X509Store() |
| 3440 | store.add_cert(self.root_cert) |
| 3441 | store.add_cert(self.intermediate_cert) |
| 3442 | root_crl = self._make_test_crl( |
| 3443 | self.root_cert, self.root_key, certs=[self.intermediate_cert]) |
| 3444 | store.add_crl(root_crl) |
| 3445 | store.set_flags( |
| 3446 | X509StoreFlags.CRL_CHECK | X509StoreFlags.CRL_CHECK_ALL) |
| 3447 | store_ctx = X509StoreContext(store, self.intermediate_server_cert) |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3448 | with pytest.raises(X509StoreContextError) as err: |
| 3449 | store_ctx.verify_certificate() |
| 3450 | assert err.value.args[0][2] == 'unable to get certificate CRL' |
| 3451 | assert err.value.certificate.get_subject().CN == 'intermediate-service' |
Dan Sully | 44e767a | 2016-06-04 18:05:27 -0700 | [diff] [blame] | 3452 | |
Paul Kehrer | 41c1024 | 2017-06-29 18:24:17 -0500 | [diff] [blame] | 3453 | def test_convert_from_cryptography(self): |
| 3454 | crypto_crl = x509.load_pem_x509_crl(crlData, backend) |
| 3455 | crl = CRL.from_cryptography(crypto_crl) |
| 3456 | assert isinstance(crl, CRL) |
| 3457 | |
| 3458 | def test_convert_from_cryptography_unsupported_type(self): |
| 3459 | with pytest.raises(TypeError): |
| 3460 | CRL.from_cryptography(object()) |
| 3461 | |
| 3462 | def test_convert_to_cryptography_key(self): |
| 3463 | crl = load_crl(FILETYPE_PEM, crlData) |
| 3464 | crypto_crl = crl.to_cryptography() |
| 3465 | assert isinstance(crypto_crl, x509.CertificateRevocationList) |
| 3466 | |
Jean-Paul Calderone | dc138fa | 2009-06-27 14:32:07 -0400 | [diff] [blame] | 3467 | |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3468 | class TestX509StoreContext(object): |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3469 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3470 | Tests for `OpenSSL.crypto.X509StoreContext`. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3471 | """ |
| 3472 | root_cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
| 3473 | intermediate_cert = load_certificate(FILETYPE_PEM, intermediate_cert_pem) |
Alex Gaynor | 3128750 | 2015-09-05 16:11:27 -0400 | [diff] [blame] | 3474 | intermediate_server_cert = load_certificate( |
| 3475 | FILETYPE_PEM, intermediate_server_cert_pem) |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3476 | |
| 3477 | def test_valid(self): |
| 3478 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3479 | `verify_certificate` returns ``None`` when called with a certificate |
| 3480 | and valid chain. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3481 | """ |
| 3482 | store = X509Store() |
| 3483 | store.add_cert(self.root_cert) |
| 3484 | store.add_cert(self.intermediate_cert) |
| 3485 | store_ctx = X509StoreContext(store, self.intermediate_server_cert) |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3486 | assert store_ctx.verify_certificate() is None |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3487 | |
| 3488 | def test_reuse(self): |
| 3489 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3490 | `verify_certificate` can be called multiple times with the same |
Jean-Paul Calderone | 06e01b9 | 2015-01-18 15:43:13 -0500 | [diff] [blame] | 3491 | ``X509StoreContext`` instance to produce the same result. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3492 | """ |
| 3493 | store = X509Store() |
| 3494 | store.add_cert(self.root_cert) |
| 3495 | store.add_cert(self.intermediate_cert) |
| 3496 | store_ctx = X509StoreContext(store, self.intermediate_server_cert) |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3497 | assert store_ctx.verify_certificate() is None |
| 3498 | assert store_ctx.verify_certificate() is None |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3499 | |
| 3500 | def test_trusted_self_signed(self): |
| 3501 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3502 | `verify_certificate` returns ``None`` when called with a self-signed |
| 3503 | certificate and itself in the chain. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3504 | """ |
| 3505 | store = X509Store() |
| 3506 | store.add_cert(self.root_cert) |
| 3507 | store_ctx = X509StoreContext(store, self.root_cert) |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3508 | assert store_ctx.verify_certificate() is None |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3509 | |
| 3510 | def test_untrusted_self_signed(self): |
| 3511 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3512 | `verify_certificate` raises error when a self-signed certificate is |
| 3513 | verified without itself in the chain. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3514 | """ |
| 3515 | store = X509Store() |
| 3516 | store_ctx = X509StoreContext(store, self.root_cert) |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 3517 | with pytest.raises(X509StoreContextError) as exc: |
| 3518 | store_ctx.verify_certificate() |
| 3519 | |
| 3520 | assert exc.value.args[0][2] == 'self signed certificate' |
| 3521 | assert exc.value.certificate.get_subject().CN == 'Testing Root CA' |
Jean-Paul Calderone | 517816e | 2015-01-18 15:39:26 -0500 | [diff] [blame] | 3522 | |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3523 | def test_invalid_chain_no_root(self): |
| 3524 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3525 | `verify_certificate` raises error when a root certificate is missing |
| 3526 | from the chain. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3527 | """ |
| 3528 | store = X509Store() |
| 3529 | store.add_cert(self.intermediate_cert) |
| 3530 | store_ctx = X509StoreContext(store, self.intermediate_server_cert) |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 3531 | |
| 3532 | with pytest.raises(X509StoreContextError) as exc: |
| 3533 | store_ctx.verify_certificate() |
| 3534 | |
| 3535 | assert exc.value.args[0][2] == 'unable to get issuer certificate' |
| 3536 | assert exc.value.certificate.get_subject().CN == 'intermediate' |
Jean-Paul Calderone | 517816e | 2015-01-18 15:39:26 -0500 | [diff] [blame] | 3537 | |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3538 | def test_invalid_chain_no_intermediate(self): |
| 3539 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3540 | `verify_certificate` raises error when an intermediate certificate is |
| 3541 | missing from the chain. |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3542 | """ |
| 3543 | store = X509Store() |
| 3544 | store.add_cert(self.root_cert) |
| 3545 | store_ctx = X509StoreContext(store, self.intermediate_server_cert) |
Jean-Paul Calderone | 517816e | 2015-01-18 15:39:26 -0500 | [diff] [blame] | 3546 | |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 3547 | with pytest.raises(X509StoreContextError) as exc: |
| 3548 | store_ctx.verify_certificate() |
| 3549 | |
| 3550 | assert exc.value.args[0][2] == 'unable to get local issuer certificate' |
| 3551 | assert exc.value.certificate.get_subject().CN == 'intermediate-service' |
Stephen Holsapple | 0d9815f | 2014-08-27 19:36:53 -0700 | [diff] [blame] | 3552 | |
Stephen Holsapple | 46a0925 | 2015-02-12 14:45:43 -0800 | [diff] [blame] | 3553 | def test_modification_pre_verify(self): |
| 3554 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3555 | `verify_certificate` can use a store context modified after |
Stephen Holsapple | 46a0925 | 2015-02-12 14:45:43 -0800 | [diff] [blame] | 3556 | instantiation. |
| 3557 | """ |
| 3558 | store_bad = X509Store() |
| 3559 | store_bad.add_cert(self.intermediate_cert) |
| 3560 | store_good = X509Store() |
| 3561 | store_good.add_cert(self.root_cert) |
| 3562 | store_good.add_cert(self.intermediate_cert) |
| 3563 | store_ctx = X509StoreContext(store_bad, self.intermediate_server_cert) |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 3564 | |
| 3565 | with pytest.raises(X509StoreContextError) as exc: |
| 3566 | store_ctx.verify_certificate() |
| 3567 | |
| 3568 | assert exc.value.args[0][2] == 'unable to get issuer certificate' |
| 3569 | assert exc.value.certificate.get_subject().CN == 'intermediate' |
| 3570 | |
Stephen Holsapple | 46a0925 | 2015-02-12 14:45:43 -0800 | [diff] [blame] | 3571 | store_ctx.set_store(store_good) |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3572 | assert store_ctx.verify_certificate() is None |
Stephen Holsapple | 46a0925 | 2015-02-12 14:45:43 -0800 | [diff] [blame] | 3573 | |
Thomas Sileo | e15e60a | 2016-11-22 18:13:30 +0100 | [diff] [blame] | 3574 | def test_verify_with_time(self): |
| 3575 | """ |
| 3576 | `verify_certificate` raises error when the verification time is |
| 3577 | set at notAfter. |
| 3578 | """ |
| 3579 | store = X509Store() |
| 3580 | store.add_cert(self.root_cert) |
| 3581 | store.add_cert(self.intermediate_cert) |
| 3582 | |
| 3583 | expire_time = self.intermediate_server_cert.get_notAfter() |
| 3584 | expire_datetime = datetime.strptime( |
| 3585 | expire_time.decode('utf-8'), '%Y%m%d%H%M%SZ' |
| 3586 | ) |
| 3587 | store.set_time(expire_datetime) |
| 3588 | |
| 3589 | store_ctx = X509StoreContext(store, self.intermediate_server_cert) |
| 3590 | with pytest.raises(X509StoreContextError) as exc: |
| 3591 | store_ctx.verify_certificate() |
| 3592 | |
| 3593 | assert exc.value.args[0][2] == 'certificate has expired' |
| 3594 | |
Stephen Holsapple | 46a0925 | 2015-02-12 14:45:43 -0800 | [diff] [blame] | 3595 | |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3596 | class TestSignVerify(object): |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3597 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3598 | Tests for `OpenSSL.crypto.sign` and `OpenSSL.crypto.verify`. |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3599 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 3600 | |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3601 | def test_sign_verify(self): |
Jean-Paul Calderone | f3cb9d8 | 2010-06-22 10:29:33 -0400 | [diff] [blame] | 3602 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3603 | `sign` generates a cryptographic signature which `verify` can check. |
Jean-Paul Calderone | f3cb9d8 | 2010-06-22 10:29:33 -0400 | [diff] [blame] | 3604 | """ |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3605 | content = ( |
| 3606 | b"It was a bright cold day in April, and the clocks were striking " |
| 3607 | b"thirteen. Winston Smith, his chin nuzzled into his breast in an " |
| 3608 | b"effort to escape the vile wind, slipped quickly through the " |
| 3609 | b"glass doors of Victory Mansions, though not quickly enough to " |
| 3610 | b"prevent a swirl of gritty dust from entering along with him.") |
Jean-Paul Calderone | b98ce21 | 2010-06-22 09:46:27 -0400 | [diff] [blame] | 3611 | |
| 3612 | # sign the content with this private key |
Jean-Paul Calderone | f3cb9d8 | 2010-06-22 10:29:33 -0400 | [diff] [blame] | 3613 | priv_key = load_privatekey(FILETYPE_PEM, root_key_pem) |
Jean-Paul Calderone | b98ce21 | 2010-06-22 09:46:27 -0400 | [diff] [blame] | 3614 | # verify the content with this cert |
| 3615 | good_cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
| 3616 | # certificate unrelated to priv_key, used to trigger an error |
| 3617 | bad_cert = load_certificate(FILETYPE_PEM, server_cert_pem) |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3618 | |
Jean-Paul Calderone | d08feb0 | 2010-10-12 21:53:24 -0400 | [diff] [blame] | 3619 | for digest in ['md5', 'sha1']: |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3620 | sig = sign(priv_key, content, digest) |
| 3621 | |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 3622 | # Verify the signature of content, will throw an exception if |
| 3623 | # error. |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3624 | verify(good_cert, sig, content, digest) |
| 3625 | |
| 3626 | # This should fail because the certificate doesn't match the |
| 3627 | # private key that was used to sign the content. |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3628 | with pytest.raises(Error): |
| 3629 | verify(bad_cert, sig, content, digest) |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3630 | |
| 3631 | # This should fail because we've "tainted" the content after |
| 3632 | # signing it. |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3633 | with pytest.raises(Error): |
| 3634 | verify(good_cert, sig, content + b"tainted", digest) |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3635 | |
| 3636 | # test that unknown digest types fail |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3637 | with pytest.raises(ValueError): |
| 3638 | sign(priv_key, content, "strange-digest") |
| 3639 | with pytest.raises(ValueError): |
| 3640 | verify(good_cert, sig, content, "strange-digest") |
James Yonan | 7c2e5d3 | 2010-02-27 05:45:50 -0700 | [diff] [blame] | 3641 | |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 3642 | def test_sign_verify_with_text(self): |
| 3643 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3644 | `sign` generates a cryptographic signature which |
| 3645 | `verify` can check. Deprecation warnings raised because using |
Alex Gaynor | 791212d | 2015-09-05 15:46:08 -0400 | [diff] [blame] | 3646 | text instead of bytes as content |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 3647 | """ |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 3648 | content = ( |
Jean-Paul Calderone | 362c1f5 | 2015-03-29 08:01:39 -0400 | [diff] [blame] | 3649 | b"It was a bright cold day in April, and the clocks were striking " |
| 3650 | b"thirteen. Winston Smith, his chin nuzzled into his breast in an " |
| 3651 | b"effort to escape the vile wind, slipped quickly through the " |
| 3652 | b"glass doors of Victory Mansions, though not quickly enough to " |
| 3653 | b"prevent a swirl of gritty dust from entering along with him." |
Jean-Paul Calderone | 13a0e65 | 2015-03-29 07:58:51 -0400 | [diff] [blame] | 3654 | ).decode("ascii") |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 3655 | |
| 3656 | priv_key = load_privatekey(FILETYPE_PEM, root_key_pem) |
| 3657 | cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
| 3658 | for digest in ['md5', 'sha1']: |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3659 | with pytest.warns(DeprecationWarning) as w: |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 3660 | simplefilter("always") |
| 3661 | sig = sign(priv_key, content, digest) |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3662 | assert ( |
| 3663 | "{0} for data is no longer accepted, use bytes".format( |
| 3664 | WARNING_TYPE_EXPECTED |
| 3665 | ) == str(w[-1].message)) |
Jean-Paul Calderone | 6462b07 | 2015-03-29 07:03:11 -0400 | [diff] [blame] | 3666 | |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3667 | with pytest.warns(DeprecationWarning) as w: |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 3668 | simplefilter("always") |
| 3669 | verify(cert, sig, content, digest) |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3670 | assert ( |
| 3671 | "{0} for data is no longer accepted, use bytes".format( |
| 3672 | WARNING_TYPE_EXPECTED |
| 3673 | ) == str(w[-1].message)) |
Abraham Martin | c5484ba | 2015-03-25 15:33:05 +0000 | [diff] [blame] | 3674 | |
Paul Kehrer | 59d2625 | 2017-07-20 10:45:54 +0200 | [diff] [blame] | 3675 | def test_sign_verify_ecdsa(self): |
| 3676 | """ |
| 3677 | `sign` generates a cryptographic signature which `verify` can check. |
| 3678 | ECDSA Signatures in the X9.62 format may have variable length, |
| 3679 | different from the length of the private key. |
| 3680 | """ |
| 3681 | content = ( |
| 3682 | b"It was a bright cold day in April, and the clocks were striking " |
| 3683 | b"thirteen. Winston Smith, his chin nuzzled into his breast in an " |
| 3684 | b"effort to escape the vile wind, slipped quickly through the " |
| 3685 | b"glass doors of Victory Mansions, though not quickly enough to " |
| 3686 | b"prevent a swirl of gritty dust from entering along with him." |
| 3687 | ).decode("ascii") |
| 3688 | priv_key = load_privatekey(FILETYPE_PEM, ec_root_key_pem) |
| 3689 | cert = load_certificate(FILETYPE_PEM, ec_root_cert_pem) |
| 3690 | sig = sign(priv_key, content, "sha1") |
| 3691 | verify(cert, sig, content, "sha1") |
| 3692 | |
Jean-Paul Calderone | 9828f66 | 2010-12-08 22:57:26 -0500 | [diff] [blame] | 3693 | def test_sign_nulls(self): |
| 3694 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3695 | `sign` produces a signature for a string with embedded nulls. |
Jean-Paul Calderone | 9828f66 | 2010-12-08 22:57:26 -0500 | [diff] [blame] | 3696 | """ |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3697 | content = b"Watch out! \0 Did you see it?" |
Jean-Paul Calderone | 9828f66 | 2010-12-08 22:57:26 -0500 | [diff] [blame] | 3698 | priv_key = load_privatekey(FILETYPE_PEM, root_key_pem) |
| 3699 | good_cert = load_certificate(FILETYPE_PEM, root_cert_pem) |
| 3700 | sig = sign(priv_key, content, "sha1") |
| 3701 | verify(good_cert, sig, content, "sha1") |
| 3702 | |
Colleen Murphy | e09399b | 2016-03-01 17:40:49 -0800 | [diff] [blame] | 3703 | def test_sign_with_large_key(self): |
| 3704 | """ |
Alex Chan | 7be83a5 | 2017-01-24 15:19:29 +0000 | [diff] [blame] | 3705 | `sign` produces a signature for a string when using a long key. |
Colleen Murphy | e09399b | 2016-03-01 17:40:49 -0800 | [diff] [blame] | 3706 | """ |
Alex Gaynor | e7f5198 | 2016-09-11 11:48:14 -0400 | [diff] [blame] | 3707 | content = ( |
| 3708 | b"It was a bright cold day in April, and the clocks were striking " |
| 3709 | b"thirteen. Winston Smith, his chin nuzzled into his breast in an " |
| 3710 | b"effort to escape the vile wind, slipped quickly through the " |
| 3711 | b"glass doors of Victory Mansions, though not quickly enough to " |
| 3712 | b"prevent a swirl of gritty dust from entering along with him.") |
Colleen Murphy | e09399b | 2016-03-01 17:40:49 -0800 | [diff] [blame] | 3713 | |
| 3714 | priv_key = load_privatekey(FILETYPE_PEM, large_key_pem) |
| 3715 | sign(priv_key, content, "sha1") |
| 3716 | |
Jean-Paul Calderone | 9828f66 | 2010-12-08 22:57:26 -0500 | [diff] [blame] | 3717 | |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3718 | class TestEllipticCurve(object): |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3719 | """ |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3720 | Tests for `_EllipticCurve`, `get_elliptic_curve`, and |
| 3721 | `get_elliptic_curves`. |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3722 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 3723 | |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3724 | def test_set(self): |
| 3725 | """ |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3726 | `get_elliptic_curves` returns a `set`. |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3727 | """ |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3728 | assert isinstance(get_elliptic_curves(), set) |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3729 | |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3730 | def test_a_curve(self): |
| 3731 | """ |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3732 | `get_elliptic_curve` can be used to retrieve a particular supported |
| 3733 | curve. |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3734 | """ |
| 3735 | curves = get_elliptic_curves() |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3736 | curve = next(iter(curves)) |
| 3737 | assert curve.name == get_elliptic_curve(curve.name).name |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3738 | |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3739 | def test_not_a_curve(self): |
| 3740 | """ |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3741 | `get_elliptic_curve` raises `ValueError` if called with a name which |
| 3742 | does not identify a supported curve. |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3743 | """ |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3744 | with pytest.raises(ValueError): |
| 3745 | get_elliptic_curve(u"this curve was just invented") |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3746 | |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3747 | def test_repr(self): |
| 3748 | """ |
| 3749 | The string representation of a curve object includes simply states the |
| 3750 | object is a curve and what its name is. |
| 3751 | """ |
| 3752 | curves = get_elliptic_curves() |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3753 | curve = next(iter(curves)) |
| 3754 | assert "<Curve %r>" % (curve.name,) == repr(curve) |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3755 | |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3756 | def test_to_EC_KEY(self): |
| 3757 | """ |
| 3758 | The curve object can export a version of itself as an EC_KEY* via the |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3759 | private `_EllipticCurve._to_EC_KEY`. |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3760 | """ |
| 3761 | curves = get_elliptic_curves() |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3762 | curve = next(iter(curves)) |
| 3763 | # It's not easy to assert anything about this object. However, see |
| 3764 | # leakcheck/crypto.py for a test that demonstrates it at least does |
| 3765 | # not leak memory. |
| 3766 | curve._to_EC_KEY() |
Jean-Paul Calderone | c09fd58 | 2014-04-18 22:00:10 -0400 | [diff] [blame] | 3767 | |
| 3768 | |
Jean-Paul Calderone | 1be7708 | 2014-04-30 18:17:41 -0400 | [diff] [blame] | 3769 | class EllipticCurveFactory(object): |
| 3770 | """ |
| 3771 | A helper to get the names of two curves. |
| 3772 | """ |
Alex Gaynor | aceb3e2 | 2015-09-05 12:00:22 -0400 | [diff] [blame] | 3773 | |
Jean-Paul Calderone | 1be7708 | 2014-04-30 18:17:41 -0400 | [diff] [blame] | 3774 | def __init__(self): |
| 3775 | curves = iter(get_elliptic_curves()) |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3776 | self.curve_name = next(curves).name |
| 3777 | self.another_curve_name = next(curves).name |
Jean-Paul Calderone | 1be7708 | 2014-04-30 18:17:41 -0400 | [diff] [blame] | 3778 | |
| 3779 | |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3780 | class TestEllipticCurveEquality(EqualityTestsMixin): |
Jean-Paul Calderone | 1be7708 | 2014-04-30 18:17:41 -0400 | [diff] [blame] | 3781 | """ |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3782 | Tests `_EllipticCurve`\ 's implementation of ``==`` and ``!=``. |
Jean-Paul Calderone | 1be7708 | 2014-04-30 18:17:41 -0400 | [diff] [blame] | 3783 | """ |
| 3784 | curve_factory = EllipticCurveFactory() |
| 3785 | |
| 3786 | if curve_factory.curve_name is None: |
| 3787 | skip = "There are no curves available there can be no curve objects." |
| 3788 | |
Jean-Paul Calderone | 1be7708 | 2014-04-30 18:17:41 -0400 | [diff] [blame] | 3789 | def anInstance(self): |
| 3790 | """ |
| 3791 | Get the curve object for an arbitrary curve supported by the system. |
| 3792 | """ |
| 3793 | return get_elliptic_curve(self.curve_factory.curve_name) |
| 3794 | |
Jean-Paul Calderone | 1be7708 | 2014-04-30 18:17:41 -0400 | [diff] [blame] | 3795 | def anotherInstance(self): |
| 3796 | """ |
| 3797 | Get the curve object for an arbitrary curve supported by the system - |
| 3798 | but not the one returned by C{anInstance}. |
| 3799 | """ |
| 3800 | return get_elliptic_curve(self.curve_factory.another_curve_name) |
| 3801 | |
| 3802 | |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3803 | class TestEllipticCurveHash(object): |
Jean-Paul Calderone | 22c3124 | 2014-05-01 07:49:47 -0400 | [diff] [blame] | 3804 | """ |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3805 | Tests for `_EllipticCurve`'s implementation of hashing (thus use as |
| 3806 | an item in a `dict` or `set`). |
Jean-Paul Calderone | 22c3124 | 2014-05-01 07:49:47 -0400 | [diff] [blame] | 3807 | """ |
| 3808 | curve_factory = EllipticCurveFactory() |
| 3809 | |
| 3810 | if curve_factory.curve_name is None: |
| 3811 | skip = "There are no curves available there can be no curve objects." |
| 3812 | |
Jean-Paul Calderone | 22c3124 | 2014-05-01 07:49:47 -0400 | [diff] [blame] | 3813 | def test_contains(self): |
| 3814 | """ |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3815 | The ``in`` operator reports that a `set` containing a curve does |
| 3816 | contain that curve. |
Jean-Paul Calderone | 22c3124 | 2014-05-01 07:49:47 -0400 | [diff] [blame] | 3817 | """ |
| 3818 | curve = get_elliptic_curve(self.curve_factory.curve_name) |
| 3819 | curves = set([curve]) |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3820 | assert curve in curves |
Jean-Paul Calderone | 22c3124 | 2014-05-01 07:49:47 -0400 | [diff] [blame] | 3821 | |
Jean-Paul Calderone | 22c3124 | 2014-05-01 07:49:47 -0400 | [diff] [blame] | 3822 | def test_does_not_contain(self): |
| 3823 | """ |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3824 | The ``in`` operator reports that a `set` not containing a curve |
| 3825 | does not contain that curve. |
Jean-Paul Calderone | 22c3124 | 2014-05-01 07:49:47 -0400 | [diff] [blame] | 3826 | """ |
| 3827 | curve = get_elliptic_curve(self.curve_factory.curve_name) |
Alex Gaynor | 85b4970 | 2015-09-05 16:30:59 -0400 | [diff] [blame] | 3828 | curves = set([ |
| 3829 | get_elliptic_curve(self.curve_factory.another_curve_name) |
| 3830 | ]) |
Alex Chan | 63ef9bc | 2016-12-19 12:02:06 +0000 | [diff] [blame] | 3831 | assert curve not in curves |