summaryrefslogtreecommitdiff
path: root/tests/x509
Commit message (Collapse)AuthorAgeFilesLines
* Remove utils.int_from_bytes (#5609)Alex Gaynor2020-12-091-3/+2
|
* Remove __future__ import from our code (#5610)Alex Gaynor2020-12-095-5/+0
|
* Switch black to py36 as the minimum version (#5608)Alex Gaynor2020-12-085-992/+916
|
* Remove Python2 from CI and code that branched on it (#5607)Alex Gaynor2020-12-082-280/+113
| | | | | | | | | | | | | * Remove Python2 from CI and code that branched on it * Update setup.py Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com> * remove * review feedback Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>
* Fixed DH tests for latest CentOS FIPS OpenSSL (#5604)Alex Gaynor2020-12-081-7/+11
| | | * Fixed DH tests for latest CentOS FIPS OpenSSL (1.1.1g)
* fixes #4531 -- support encoding SCTs in certificates (#5594)Alex Gaynor2020-11-301-0/+27
|
* Delete all the 1.0.2 code (#5511)Alex Gaynor2020-10-252-8/+2
|
* new black, actually slightly different than the old black (#5429)Paul Kehrer2020-08-262-21/+53
|
* more error simplification (#5354)Paul Kehrer2020-07-271-3/+1
| | | | | | | X509 signing for RSA keys that are too small. Let's just say signing failed and attach the more specific problem as the error stack. A bit uglier, but far more generic and stable to OpenSSL/LibreSSL/BoringSSL Also be a bit more generic for OCSP signing
* remove idna support finally (#5351)Paul Kehrer2020-07-261-57/+10
| | | | | * remove idna support finally * remove unused import
* Refs #5113 -- build against openssl with no ct (#5343)Alex Gaynor2020-07-242-44/+22
|
* Paint it Black by the Rolling Stones (#5324)Alex Gaynor2020-07-205-3823/+4795
|
* test exceptions and properly reject duplicate attributes in csrbuilder (#5319)Paul Kehrer2020-07-181-0/+21
|
* Implement __deepcopy__ for x509 certificates (#5318)Alex Gaynor2020-07-181-0/+9
| | | fixes #5129
* raise a valueerror on multi-SINGLERESP valued OCSP responses (#5316)Paul Kehrer2020-07-181-0/+7
| | | InternalErrors are bad when we know they're reachable
* support encoding attributes via CertificateSigningRequestBuilder (#5315)Paul Kehrer2020-07-181-0/+30
| | | | | | | * support encoding attributes via CertificateSigningRequestBuilder * use a constant. now you know what 12 means! * pep8
* change KeyUsage repr to be less confusing (#5314)Paul Kehrer2020-07-181-2/+2
| | | fixes #5127
* support unstructured name x509 attributes (#5313)Paul Kehrer2020-07-181-1/+14
|
* support x509 request challenge password parsing (#4944)Paul Kehrer2020-07-051-0/+39
| | | | | | | | | | | | | * support x509 request challenge password parsing * switch to a more generic (but not too generic) attribute parsing * make it raise a valueerror * Update tests/x509/test_x509.py Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com> Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* Enforce that X.509 versions on valid on parse. (#5299)Alex Gaynor2020-07-051-6/+5
| | | Closes #5290
* Support parsing SCTs in OCSPResponse (#5298)Paul Kehrer2020-07-051-0/+111
| | | | | | | | | * Support parsing SCTs in OCSPResponse * s/typically/only and pep8 * remove unused vector Co-authored-by: Szilárd Pfeiffer <szilard.pfeiffer@balasys.hu>
* add SubjectInformationAccess extension support (#5295)Paul Kehrer2020-07-022-2/+267
| | | | | * add SubjectInformationAccess extension support * fixes
* Fix up crl_delta_crl_indicator.pem. (#5283)David Benjamin2020-06-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The CRL is missing a CRL number and should mark the delta CRL extension as critical. RFC 5280 says the following: Section 5.2.3: > CRL issuers conforming to this profile MUST include this extension > [CRL number] in all CRLs and MUST mark this extension as > non-critical. Section 5.2.4: > The delta CRL indicator is a critical CRL extension that identifies a > CRL as being a delta CRL. > When a conforming CRL issuer generates a delta CRL, the delta CRL > MUST include a critical delta CRL indicator extension. Sadly, RFC 5280 is often unclear about the difference between issuer requirements and verifier requirements, but test certificates should conform to issuer requirements where possible, in case the underly library becomes stricter. Section 5.2.4 includes further text which implies a delta CRL without a CRL number is unusable for a verifier anyway: > A complete CRL and a delta CRL MAY be combined if the following four > conditions are satisfied: > > [...] > > (d) The CRL number of the complete CRL is less than the CRL number > of the delta CRL. That is, the delta CRL follows the complete > CRL in the numbering sequence. Note I have not updated the signature in crl_delta_crl_indicator.pem. The test does not care, and it is unclear which key to sign it with.
* Unify X.509 signature algorithm validation (#5276)Marko Kreen2020-06-141-0/+55
| | | | | - Use common implementation - OCSP signing was using different validation - Check if private key is usable for signing
* Removed deprecated behavior in AKI.from_issuer_subject_key_identifier (#5182)Alex Gaynor2020-04-051-7/+0
|
* Allow NameAttribute.value to be an empty string (#5109)Andrea De Pasquale2020-03-191-4/+18
| | | | | | | | | | | | * Allow NameAttribute.value to be an empty string RFC 4514 https://tools.ietf.org/html/rfc4514 does not mention that "AttributeValue" can not be an empty (zero-length) string. Fixes #5106 * reverse order to match fix from another PR Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>
* Reversed the order of RDNs in x509.Name.rfc4514_string() (#5120)Thomas Erbesdobler2020-03-021-3/+3
| | | | RFC4514 requires in section 2.1 that RDNs are converted to string representation in reversed order.
* Parse single_extensions in OCSP responses (#5059)Paul Kehrer2019-11-111-0/+10
| | | | | | | | | | | | * add single_extensions to OCSPResponse (#4753) * new vector, updateed docs, more stringent parser, changelog, etc * simplify PR (no SCT for now) * add a comment * finish pulling out the sct stuff so tests might actually run
* UniversalString needs to be encoded as UCS-4 (#5000)Marko Kreen2019-10-171-0/+17
|
* one more missing branch (#4992)Paul Kehrer2019-09-091-0/+23
|
* fix coverage, small cleanups in tests (#4990)Paul Kehrer2019-09-092-30/+30
|
* Finish ed25519 and ed448 support in x509 module (#4972)Marko Kreen2019-09-094-7/+488
| | | | | | | | | | | | | | | | | | * Support ed25519 in csr/crl creation * Tests for ed25519/x509 * Support ed448 in crt/csr/crl creation * Tests for ed448/x509 * Support ed25519/ed448 in OCSPResponseBuilder * Tests for eddsa in OCSPResponseBuilder * Builder check missing in create_x509_csr * Documentation update for ed25519+ed448 in x509
* Allow FreshestCRL extension in CRL (#4975)Marko Kreen2019-09-071-0/+33
| | | Per RFC5280 it is allowed in both certificates and CRL-s.
* fix coverage by adding two artificial DSA public keys (#4984)Paul Kehrer2019-09-061-0/+32
| | | | | | | | | | * fix coverage by adding two artificial DSA public keys One key removes the optional parameters from the structure to cover a branch conditional, and the other key has its BITSTRING padding value set to a non-zero value. * lexicographic? never heard of it
* Make DER reader into a context manager (#4957)Alex Gaynor2019-07-281-37/+35
| | | | | | | | * Make DER reader into a context manager * Added another test case * flake8
* Remove asn1crypto dependency (#4941)David Benjamin2019-07-281-22/+76
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Remove non-test dependencies on asn1crypto. cryptography.io actually contains two OpenSSL bindings right now, the expected cffi one, and an optional one hidden in asn1crypto. asn1crypto contains a lot of things that cryptography.io doesn't use, including a BER parser and a hand-rolled and not constant-time EC implementation. Instead, check in a much small DER-only parser in cryptography/hazmat. A quick benchmark suggests this parser is also faster than asn1crypto: from __future__ import absolute_import, division, print_function import timeit print(timeit.timeit( "decode_dss_signature(sig)", setup=r""" from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature sig=b"\x30\x2d\x02\x15\x00\xb5\xaf\x30\x78\x67\xfb\x8b\x54\x39\x00\x13\xcc\x67\x02\x0d\xdf\x1f\x2c\x0b\x81\x02\x14\x62\x0d\x3b\x22\xab\x50\x31\x44\x0c\x3e\x35\xea\xb6\xf4\x81\x29\x8f\x9e\x9f\x08" """, number=10000)) Python 2.7: asn1crypto: 0.25 _der.py: 0.098 Python 3.5: asn1crypto: 0.17 _der.py: 0.10 * Remove test dependencies on asn1crypto. The remaining use of asn1crypto was some sanity-checking of Certificates. Add a minimal X.509 parser to extract the relevant fields. * Add a read_single_element helper function. The outermost read is a little tedious. * Address flake8 warnings * Fix test for long-form vs short-form lengths. Testing a zero length trips both this check and the non-minimal long form check. Use a one-byte length to cover the missing branch. * Remove support for negative integers. These never come up in valid signatures. Note, however, this does change public API. * Update src/cryptography/hazmat/primitives/asymmetric/utils.py Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com> * Review comments * Avoid hardcoding the serialization of NULL in decode_asn1.py too.
* some test improvements (#4954)Paul Kehrer2019-07-271-1/+25
| | | | detect md5 and don't generate short RSA keys these changes will help if we actually try to run FIPS enabled
* Write a test for an uncovered line (#4940)Alex Gaynor2019-07-061-0/+24
|
* ed25519 support in x509 certificate builder (#4937)Paul Kehrer2019-07-061-3/+122
| | | | | | | | | | * ed25519 support in x509 certificate builder This adds minimal ed25519 support. More to come. * Apply suggestions from code review Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com>
* Small style cleanup (#4891)Alex Gaynor2019-05-191-1/+1
|
* add name for ExtensionOID.PRECERT_POISON (#4853)redshiftzero2019-05-191-1/+8
| | | | | | | | * test: ensure all public members of ExtensionOID have names defined * add name for ExtensionOID.PRECERT_POISON ref: https://github.com/google/certificate-transparency/blob/5fce65cb60cfe7808afc98de23c7dd5ddbfa1509/python/ct/crypto/asn1/oid.py#L338
* fix from_issuer_subject_key_identifier to take the right type (#4864)Paul Kehrer2019-05-041-2/+9
| | | | | | | | | | * fix from_issuer_subject_key_identifier to take the right type deprecate passing the old Extension wrapper object * don't use a try:except: * hilarious contortions to satisfy doc8
* 4810 bugfix: avoid UnicodeEncodeError on python 2 (#4846)redshiftzero2019-04-161-4/+19
| | | | | | | | * test: regression test for UnicodeEncodeError in x509 name in #4810 added utf8 encoding at the top of the file due to PEP 263 * bugfix: #4810 resolve UnicodeEncodeError in x509 name
* Fixes #4830 -- handle negative serial numbers (#4843)Alex Gaynor2019-04-131-0/+8
|
* fix != comparison in py2 (fixes #4821) (#4822)Mathias Ertl2019-03-251-4/+10
| | | | | | | | * fix != comparison in py2 (fixes #4821) * remove blank line b/c pep8 * move __ne__ next to __eq__ as per review request
* implement eq__, __hash__ and __repr__ for OCSPNoCheck and PrecertPoison (#4819)Mathias Ertl2019-03-251-0/+44
|
* Fixes for the latest pep8-naming (#4744)Alex Gaynor2019-02-021-1/+1
|
* Fixes #4734 -- Deal with deprecated things (#4736)Alex Gaynor2019-01-232-27/+6
| | | | | | | | | | * Fixes #4734 -- Deal with deprecated things - Make year based aliases of PersistentlyDeprecated so we can easily assess age - Removed encode/decode rfc6979 signature - Removed Certificate.serial * Unused import
* allow asn1 times of 1950-01-01 and later. (#4728)Paul Kehrer2019-01-223-8/+37
| | | | | | | | * allow asn1 times of 1950-01-01 and later. * add a test * pretty up the test
* allow 32-bit platforms to encode certs with dates > unix epoch (#4727)Paul Kehrer2019-01-211-8/+13
| | | | | | | | | | | | | | | | | Previously we used unix timestamps, but now we are switching to using ASN1_TIME_set_string and automatically formatting the string based on the year. The rule is as follows: Per RFC 5280 (section 4.1.2.5.), the valid input time strings should be encoded with the following rules: 1. UTC: YYMMDDHHMMSSZ, if YY < 50 (20YY) --> UTC: YYMMDDHHMMSSZ 2. UTC: YYMMDDHHMMSSZ, if YY >= 50 (19YY) --> UTC: YYMMDDHHMMSSZ 3. G'd: YYYYMMDDHHMMSSZ, if YYYY >= 2050 --> G'd: YYYYMMDDHHMMSSZ 4. G'd: YYYYMMDDHHMMSSZ, if YYYY < 2050 --> UTC: YYMMDDHHMMSSZ Notably, Dates < 1950 are not valid UTCTime. At the moment we still reject dates < Jan 1, 1970 in all cases but a followup PR can fix that.
View Lorry Controller Status