151 lines
4.4 KiB
Python
151 lines
4.4 KiB
Python
from cryptography import x509
|
|
from cryptography.hazmat.backends import default_backend
|
|
from cryptography.hazmat.primitives import hashes
|
|
|
|
from .vectors import SAN_CERT, WILDCARD_CERT, INTERMEDIATE_CERT
|
|
|
|
|
|
def test_cert_get_cn(client):
|
|
from lemur.common.defaults import common_name
|
|
|
|
assert common_name(SAN_CERT) == "san.example.org"
|
|
|
|
|
|
def test_cert_sub_alt_domains(client):
|
|
from lemur.common.defaults import domains
|
|
|
|
assert domains(INTERMEDIATE_CERT) == []
|
|
assert domains(SAN_CERT) == [
|
|
"san.example.org",
|
|
"san2.example.org",
|
|
"daniel-san.example.org",
|
|
]
|
|
|
|
|
|
def test_cert_is_san(client):
|
|
from lemur.common.defaults import san
|
|
|
|
assert san(SAN_CERT)
|
|
# Wildcard cert has just one SAN record that matches the common name
|
|
assert not san(WILDCARD_CERT)
|
|
|
|
|
|
def test_cert_is_wildcard(client):
|
|
from lemur.common.defaults import is_wildcard
|
|
|
|
assert is_wildcard(WILDCARD_CERT)
|
|
assert not is_wildcard(INTERMEDIATE_CERT)
|
|
|
|
|
|
def test_cert_bitstrength(client):
|
|
from lemur.common.defaults import bitstrength
|
|
|
|
assert bitstrength(INTERMEDIATE_CERT) == 2048
|
|
|
|
|
|
def test_cert_issuer(client):
|
|
from lemur.common.defaults import issuer
|
|
|
|
assert issuer(INTERMEDIATE_CERT) == "LemurTrustUnittestsRootCA2018"
|
|
|
|
|
|
def test_text_to_slug(client):
|
|
from lemur.common.defaults import text_to_slug
|
|
|
|
assert text_to_slug("test - string") == "test-string"
|
|
assert text_to_slug("test - string", "") == "teststring"
|
|
# Accented characters are decomposed
|
|
assert text_to_slug("föö bär") == "foo-bar"
|
|
# Melt away the Unicode Snowman
|
|
assert text_to_slug("\u2603") == ""
|
|
assert text_to_slug("\u2603test\u2603") == "test"
|
|
assert text_to_slug("snow\u2603man") == "snow-man"
|
|
assert text_to_slug("snow\u2603man", "") == "snowman"
|
|
# IDNA-encoded domain names should be kept as-is
|
|
assert (
|
|
text_to_slug("xn--i1b6eqas.xn--xmpl-loa9b3671b.com")
|
|
== "xn--i1b6eqas.xn--xmpl-loa9b3671b.com"
|
|
)
|
|
|
|
|
|
def test_create_name(client):
|
|
from lemur.common.defaults import certificate_name
|
|
from datetime import datetime
|
|
|
|
assert (
|
|
certificate_name(
|
|
"example.com",
|
|
"Example Inc,",
|
|
datetime(2015, 5, 7, 0, 0, 0),
|
|
datetime(2015, 5, 12, 0, 0, 0),
|
|
False,
|
|
)
|
|
== "example.com-ExampleInc-20150507-20150512"
|
|
)
|
|
assert (
|
|
certificate_name(
|
|
"example.com",
|
|
"Example Inc,",
|
|
datetime(2015, 5, 7, 0, 0, 0),
|
|
datetime(2015, 5, 12, 0, 0, 0),
|
|
True,
|
|
)
|
|
== "SAN-example.com-ExampleInc-20150507-20150512"
|
|
)
|
|
assert (
|
|
certificate_name(
|
|
"xn--mnchen-3ya.de",
|
|
"Vertrauenswürdig Autorität",
|
|
datetime(2015, 5, 7, 0, 0, 0),
|
|
datetime(2015, 5, 12, 0, 0, 0),
|
|
False,
|
|
)
|
|
== "xn--mnchen-3ya.de-VertrauenswurdigAutoritat-20150507-20150512"
|
|
)
|
|
assert (
|
|
certificate_name(
|
|
"selfie.example.org",
|
|
"<selfsigned>",
|
|
datetime(2015, 5, 7, 0, 0, 0),
|
|
datetime(2025, 5, 12, 13, 37, 0),
|
|
False,
|
|
)
|
|
== "selfie.example.org-selfsigned-20150507-20250512"
|
|
)
|
|
|
|
|
|
def test_issuer(client, cert_builder, issuer_private_key):
|
|
from lemur.common.defaults import issuer
|
|
|
|
assert issuer(INTERMEDIATE_CERT) == "LemurTrustUnittestsRootCA2018"
|
|
|
|
# We need to override builder's issuer name
|
|
cert_builder._issuer_name = None
|
|
# Unicode issuer name
|
|
cert = cert_builder.issuer_name(
|
|
x509.Name(
|
|
[x509.NameAttribute(x509.NameOID.COMMON_NAME, "Vertrauenswürdig Autorität")]
|
|
)
|
|
).sign(issuer_private_key, hashes.SHA256(), default_backend())
|
|
assert issuer(cert) == "VertrauenswurdigAutoritat"
|
|
|
|
# Fallback to 'Organization' field when issuer CN is missing
|
|
cert = cert_builder.issuer_name(
|
|
x509.Name(
|
|
[x509.NameAttribute(x509.NameOID.ORGANIZATION_NAME, "No Such Organization")]
|
|
)
|
|
).sign(issuer_private_key, hashes.SHA256(), default_backend())
|
|
assert issuer(cert) == "NoSuchOrganization"
|
|
|
|
# Missing issuer name
|
|
cert = cert_builder.issuer_name(x509.Name([])).sign(
|
|
issuer_private_key, hashes.SHA256(), default_backend()
|
|
)
|
|
assert issuer(cert) == "<unknown>"
|
|
|
|
|
|
def test_issuer_selfsigned(selfsigned_cert):
|
|
from lemur.common.defaults import issuer
|
|
|
|
assert issuer(selfsigned_cert) == "<selfsigned>"
|