Skip to content

Commit 30e82d4

Browse files
authored
Don't try to serialize invalid objects in tests (#1037)
A default-constructed X509_REQ or NETSCAPE_SPKI contains empty values for all its fields, notably the OIDs in public keys. This initial state is incomplete and not yet a valid object. The ASN.1 structures make the public key mandatory. When serializing, OpenSSL would previously silently omit the field, which doesn't actually produce a valid structure. As of openssl/openssl#16027, OpenSSL will notice this and return an error rather than serialize garbage. Sadly, that had to be reverted on 1.1.1, but it is present in the 3.0 branch. With that change, some of pyOpenSSL's tests fail. The bug here is in pyOpenSSL: pyOpenSSL tests are trying to serialize incomplete objects. Instead, fill in the public key. While not syntactically necessary (the empty string is a BIT STRING), also fill in the signature for NetscapeSPKI, to better align with real code. Tested by running pyOpenSSL tests against a copy of OpenSSL 1.1.1's dev branch, prior to the changes getting reverted.
1 parent ef43021 commit 30e82d4

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

tests/test_crypto.py

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1668,6 +1668,7 @@ def test_verify_wrong_key(self):
16681668
"""
16691669
request = X509Req()
16701670
pkey = load_privatekey(FILETYPE_PEM, root_key_pem)
1671+
request.set_pubkey(pkey)
16711672
request.sign(pkey, GOOD_DIGEST)
16721673
another_pkey = load_privatekey(FILETYPE_PEM, client_key_pem)
16731674
with pytest.raises(Error):
@@ -1680,6 +1681,7 @@ def test_verify_success(self):
16801681
"""
16811682
request = X509Req()
16821683
pkey = load_privatekey(FILETYPE_PEM, root_key_pem)
1684+
request.set_pubkey(pkey)
16831685
request.sign(pkey, GOOD_DIGEST)
16841686
assert request.verify(pkey)
16851687

@@ -3373,6 +3375,9 @@ def test_b64_encode(self):
33733375
`NetscapeSPKI.b64_encode` encodes the certificate to a base64 blob.
33743376
"""
33753377
nspki = NetscapeSPKI()
3378+
pkey = load_privatekey(FILETYPE_PEM, root_key_pem)
3379+
nspki.set_pubkey(pkey)
3380+
nspki.sign(pkey, GOOD_DIGEST)
33763381
blob = nspki.b64_encode()
33773382
assert isinstance(blob, bytes)
33783383

0 commit comments

Comments
 (0)