diff --git a/docs/development/test-vectors.rst b/docs/development/test-vectors.rst index 4b69310ce64a3241b3f31733a6e6487e60f8bedc_ZG9jcy9kZXZlbG9wbWVudC90ZXN0LXZlY3RvcnMucnN0..c15aeb0ed9a6c9c3763c0392ed0fd31d6e913875_ZG9jcy9kZXZlbG9wbWVudC90ZXN0LXZlY3RvcnMucnN0 100644 --- a/docs/development/test-vectors.rst +++ b/docs/development/test-vectors.rst @@ -532,6 +532,8 @@ contains a ``CRLReason`` single extension. * ``x509/ocsp/resp-sct-extension.der`` - An OCSP response containing a ``CT Certificate SCTs`` single extension, from the SwissSign OCSP responder. +* ``x509/ocsp/ocsp-army.deps.mil-resp.der`` - An OCSP response containing + multiple ``SINGLERESP`` values. Custom X.509 OCSP Test Vectors ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/src/cryptography/hazmat/backends/openssl/ocsp.py b/src/cryptography/hazmat/backends/openssl/ocsp.py index 4b69310ce64a3241b3f31733a6e6487e60f8bedc_c3JjL2NyeXB0b2dyYXBoeS9oYXptYXQvYmFja2VuZHMvb3BlbnNzbC9vY3NwLnB5..c15aeb0ed9a6c9c3763c0392ed0fd31d6e913875_c3JjL2NyeXB0b2dyYXBoeS9oYXptYXQvYmFja2VuZHMvb3BlbnNzbC9vY3NwLnB5 100644 --- a/src/cryptography/hazmat/backends/openssl/ocsp.py +++ b/src/cryptography/hazmat/backends/openssl/ocsp.py @@ -104,9 +104,13 @@ self._basic = self._backend._ffi.gc( basic, self._backend._lib.OCSP_BASICRESP_free ) - self._backend.openssl_assert( - self._backend._lib.OCSP_resp_count(self._basic) == 1 - ) + num_resp = self._backend._lib.OCSP_resp_count(self._basic) + if num_resp != 1: + raise ValueError( + "OCSP response contains more than one SINGLERESP structure" + ", which this library does not support. " + "{} found".format(num_resp) + ) self._single = self._backend._lib.OCSP_resp_get0(self._basic, 0) self._backend.openssl_assert( self._single != self._backend._ffi.NULL diff --git a/tests/x509/test_ocsp.py b/tests/x509/test_ocsp.py index 4b69310ce64a3241b3f31733a6e6487e60f8bedc_dGVzdHMveDUwOS90ZXN0X29jc3AucHk=..c15aeb0ed9a6c9c3763c0392ed0fd31d6e913875_dGVzdHMveDUwOS90ZXN0X29jc3AucHk= 100644 --- a/tests/x509/test_ocsp.py +++ b/tests/x509/test_ocsp.py @@ -695,6 +695,13 @@ assert resp.serial_number == 271024907440004808294641238224534273948400 assert len(resp.extensions) == 0 + def test_load_multi_valued_response(self): + with pytest.raises(ValueError): + _load_data( + os.path.join("x509", "ocsp", "ocsp-army.deps.mil-resp.der"), + ocsp.load_der_ocsp_response, + ) + def test_load_unauthorized(self): resp = _load_data( os.path.join("x509", "ocsp", "resp-unauthorized.der"), diff --git a/vectors/cryptography_vectors/x509/ocsp/ocsp-army.deps.mil-resp.der b/vectors/cryptography_vectors/x509/ocsp/ocsp-army.deps.mil-resp.der new file mode 100644 index 0000000000000000000000000000000000000000..08125f0a9d48339b6b32f2620f51e25a2d3a7b36 GIT binary patch literal 3587 zc$~f0do)ye00;27bMK7D7_%CQA|u3@6Tdq%Lg`2|UTHmMNX@b-MzmgeB$Bv{M@k}F zS=li?JoA>L*V0lEu`5Xro1RGRW0D?X&!{%LXZM`WY0upMzQ5nSzt8!-?!7;Nk*Ad* zoERg&1Q_`_QHeo>2m}QHK?p{E2r%*xz!XCz8i@K6QPdpBOFPRQBQ;C9clEeV_B3iz zn1BfYlgUI;mL-Y`0H$aQqJcF~A`%#?Fn&G(ho~PmYrWq#T9_sFdC+vCV_D4d6lM#e zp4HaWIe9gUUvF}CSk0vSJ9_Zu4m=F+|Gr2~)+}lX%vpd5m@L#%@X-M?mq4ucSCJJ! zXNo?P6~AY#P{2e{HrtBHlm}b%p|>btp(u;RG6$c=`hONHNyN!PIVu<Bm|T?Oa#2pm zMJbkxQX&_nR4z)HT$FOTC>3&1PJW^i_gPA1k;cc51<D2}%Ss@Il_7#0dRQfwajce$ zQX?0o_7fEnQOP9LF?E6rK_nQ1Ae@JFWV;HE?`f4K-EuMB_>xPKai`v)0~swnTPq$- zrAJ#AIZ0Zy>7x02a}8Q=rv1d*nVJ}LF|b4`%2BVd_doM2&N<<m)RAo6k<w_o!RX0x zgVzn!j9$IoE1Q<SIy(`bTnXK;P3^_!GcuUF6kHdvMFG!EDf-9m*mB;~>{!Jg6ra}z zmkmyHisLEJ(9b=0YyEfgIC)SuKaWX`jnp|Mh{w^QlYOP@8uUZg>JDA>I3eK)pJQ0O zgN?v~al39#FM~()t#man)7f@V=&^FI_pQYj7VI+6Nq#&Mt(am+(v_MX7^#1)PY5U# z<@T*w@RdrVSI((@r~Bx|eKbWehO7q|;t4Rs9bmAP7{)_*JPZ$S0_0g^MZf_clmwKB zuqQ&K;ywAOCeV-tWh%wfly6FN2-_x%2n`X2MxiP|Syn@$!rU<KtmNkG^x-L(O5wV4 zX--@k-;2hvUBa>i3+It#Q-xXr08o~NU?#Ew>wN@%{|CPiXusp<%6JziH=c`~2hEkk zccU@6G;@GKi)MElBH&;QqTm1qDdT0UrTS@7v9P0VUx-gmL*vdu_3+Z(Yj(u$O1C`) zDfR3=BQ~ca-6-U=MA}qam`q3yAH3U8vmRHUbNSqjacv)Ir=#J-JZftj)yCU`dV4qj zSN4F)WZEBL?Qf~ghwUvP-+uC?BV7AzM(;V%Mu(KSBfOR}IPFmR)~fP`=tFVRB?S>2 zdf9Z!_{z7VJdw#@e^QUaSbxR-s^5Qka3M)2lh4-DYt)U*w;dq)IbR+QDyu@S-!qCI z%MV_?zx4Hwuf`mzmG>Il^6wY-l%%X)Te~DSq0Zz<%1u}N4=1|<)MDw6bFvczJeL=D z#|~bpIGz!+qkWyXyD<OFXl^AjU<XMJ4?{TUC<e^|7^DhxiLj@RKB5UU6908$0z0DO zyPtjtLacxVF#nJNK9wFA6&1eB%*-z$*wjBLa-(TTP_S8K(B@Dxt}EAx%lG2gZeUrO z`UxXuW?IJ(f~FDKY`$*-RsyQBa*C`Rf$<87fb#K-K|t^X9MF;7po;v*5d*A|RnrhV zz>&Qdd{Z4EAs!+b%nnAgg9%U}D$fKM55eTWCAEKS7g)AjoSf6U6Ep)at=Sg&tZBo; z#aenR&A+YDQhS=P-R_G5u-J}jY#wMb<>wp_^uXG$lUcVSxH{ISE!sVR%`oKTS5Ee% z>X-j^v}vKf?>#+tEu-?XIA7mPJMxzP;jZ3^fzZ5?&=n(_s~FcU;%;nMrRF&PR$`Nu zEV#3aw5MVqT!X7$m{(d-7QHll#C#rgynp(RsJ_nrM&Q$DUk{DZyq6WMc{z2A7*o>S z+;<DK*w|-=`IT<U%w*W)W+hQ1#@95Z!iWjS%5w*5?AnEq-rK8DN;5r3`sPB{;daL_ p&zyBSpBUKF^a4@t$}m=X6tVp3{J}!u;~-KaWooTY>ybs{e*!gl%!&X2