Skip to content

Commit

Permalink
Backport tlv fix, 38.0.1 bump (#7576)
Browse files Browse the repository at this point in the history
* fix parsing for CRLs with TLVs > 65535 bytes (#7575)

* add CRL test vector with 9,999 revoked items

* bump rust-asn1

* add large CRL test

this tests CRLs larger than 65535 bytes in size. rust-asn1 supports up
to 4GiB TLVs now, but we'll avoid putting a test vector that big for now

* changelog and 38.0.1 bump
  • Loading branch information
reaperhulk authored Sep 7, 2022
1 parent 52d6f1a commit 3ff5218
Show file tree
Hide file tree
Showing 8 changed files with 4,406 additions and 7 deletions.
8 changes: 8 additions & 0 deletions CHANGELOG.rst
Original file line number Diff line number Diff line change
@@ -1,6 +1,14 @@
Changelog
=========

.. _v38-0-1:

38.0.0 - 2022-09-07
~~~~~~~~~~~~~~~~~~~

* Fixed parsing TLVs in ASN.1 with length greater than 65535 bytes (typically
seen in large CRLs).

.. _v38-0-0:

38.0.0 - 2022-09-06
Expand Down
1 change: 1 addition & 0 deletions docs/development/test-vectors.rst
Original file line number Diff line number Diff line change
Expand Up @@ -597,6 +597,7 @@ Custom X.509 Certificate Revocation List Vectors
* ``crl_no_next_time.pem`` - Contains a CRL with no ``nextUpdate`` value. The
signature on this CRL is invalid.
* ``crl_bad_version.pem`` - Contains a CRL with an invalid version.
* ``crl_almost_10k.pem`` - Contains a CRL with 9,999 entries.

X.509 OCSP Test Vectors
~~~~~~~~~~~~~~~~~~~~~~~
Expand Down
2 changes: 1 addition & 1 deletion src/cryptography/__about__.py
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"__copyright__",
]

__version__ = "38.0.0"
__version__ = "38.0.1"

__author__ = "The Python Cryptographic Authority and individual contributors"
__copyright__ = "Copyright 2013-2022 {}".format(__author__)
8 changes: 4 additions & 4 deletions src/rust/Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion src/rust/Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ publish = false
[dependencies]
once_cell = "1"
pyo3 = { version = "0.15.2" }
asn1 = { version = "0.12.1", default-features = false, features = ["derive"] }
asn1 = { version = "0.12.2", default-features = false, features = ["derive"] }
pem = "1.1"
chrono = { version = "0.4.22", default-features = false, features = ["alloc", "clock"] }
ouroboros = "0.15"
Expand Down
8 changes: 8 additions & 0 deletions tests/x509/test_x509.py
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,14 @@ def test_load_der_crl(self, backend):
assert fingerprint == b"dd3db63c50f4c4a13e090f14053227cb1011a5ad"
assert isinstance(crl.signature_hash_algorithm, hashes.SHA256)

def test_load_large_crl(self, backend):
crl = _load_cert(
os.path.join("x509", "custom", "crl_almost_10k.pem"),
x509.load_pem_x509_crl,
backend,
)
assert len(crl) == 9999

def test_empty_crl_no_sequence(self, backend):
# The SEQUENCE for revoked certificates is optional so let's
# test that we handle it properly.
Expand Down
2 changes: 1 addition & 1 deletion vectors/cryptography_vectors/__about__.py
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,4 @@
"__version__",
]

__version__ = "38.0.0"
__version__ = "38.0.1"
4,382 changes: 4,382 additions & 0 deletions vectors/cryptography_vectors/x509/custom/crl_almost_10k.pem

Large diffs are not rendered by default.

0 comments on commit 3ff5218

Please sign in to comment.