44
55from __future__ import annotations
66
7- import datetime as dt
87import errno
98import pickle
109import socket
1312import time
1413from contextlib import suppress
1514from pathlib import Path
16- from typing import (
17- Any ,
18- Callable ,
19- Iterator ,
20- Mapping ,
21- Optional ,
22- Sequence ,
23- Tuple ,
24- Union ,
25- )
15+ from typing import Any , Callable , Iterator , Mapping , Sequence , Tuple , Union
2616
2717import pytest
2818
29- from mbedtls import hashlib
3019from mbedtls ._tls import (
3120 _SUPPORTED_DTLS_VERSION ,
3221 _SUPPORTED_TLS_VERSION ,
5443 WantReadError ,
5544 WantWriteError ,
5645)
57- from mbedtls .x509 import CRT , CSR , BasicConstraints
46+ from mbedtls .x509 import CRT
5847
5948_Key = Union [RSA , ECC ]
6049_HostName = str
@@ -65,77 +54,36 @@ def rootpath() -> Path:
6554 return Path (__file__ ).parent .parent
6655
6756
68- def make_root_ca (
69- # pylint: disable=too-many-arguments
70- subject : Optional [str ] = None ,
71- not_before : Optional [dt .datetime ] = None ,
72- not_after : Optional [dt .datetime ] = None ,
73- serial_number : Optional [int ] = None ,
74- basic_constraints : Optional [BasicConstraints ] = None ,
75- digestmod : Optional [hashlib .Algorithm ] = None ,
76- ) -> Tuple [CRT , _Key ]:
77- if subject is None :
78- subject = "OU=test, CN=Trusted CA"
79- if not_before is None :
80- not_before = dt .datetime .utcnow ()
81- if not_after is None :
82- not_after = not_before + dt .timedelta (days = 90 )
83- if serial_number is None :
84- serial_number = 0x123456
85- if basic_constraints is None :
86- basic_constraints = BasicConstraints (True , - 1 )
87- if digestmod is None :
88- digestmod = hashlib .sha256
89-
90- key = RSA ()
91- key .generate ()
92- crt = CRT .selfsign (
93- csr = CSR .new (key , subject , digestmod ()),
94- issuer_key = key ,
95- not_before = not_before ,
96- not_after = not_after ,
97- serial_number = serial_number ,
98- basic_constraints = basic_constraints ,
99- )
100- return crt , key
101-
102-
103- def make_crt (
104- # pylint: disable=too-many-arguments
105- issuer_crt : CRT ,
106- issuer_key : _Key ,
107- subject : Optional [str ] = None ,
108- not_before : Optional [dt .datetime ] = None ,
109- not_after : Optional [dt .datetime ] = None ,
110- serial_number : Optional [int ] = None ,
111- basic_constraints : Optional [BasicConstraints ] = None ,
112- digestmod : Optional [hashlib .Algorithm ] = None ,
113- ) -> Tuple [CRT , _Key ]:
114- if subject is None :
115- subject = "OU=test, CN=hostname"
116- if not_before is None :
117- not_before = issuer_crt .not_before
118- if not_after is None :
119- not_after = issuer_crt .not_after
120- if serial_number is None :
121- serial_number = 0x123456
122- if basic_constraints is None :
123- basic_constraints = BasicConstraints ()
124- if digestmod is None :
125- # TODO: issuer_crt.digestmod should work but doesn't.
126- digestmod = hashlib .sha256
127-
128- key = RSA ()
129- key .generate ()
130- crt = issuer_crt .sign (
131- csr = CSR .new (key , subject , digestmod ()),
132- issuer_key = issuer_key ,
133- not_before = not_before ,
134- not_after = not_after ,
135- serial_number = serial_number ,
136- basic_constraints = basic_constraints ,
137- )
138- return crt , key
57+ @pytest .fixture (scope = "module" )
58+ def assets (rootpath : Path ) -> Path :
59+ return rootpath / "tests" / "data"
60+
61+
62+ @pytest .fixture (scope = "module" )
63+ def ca_crt (assets : Path ) -> CRT :
64+ return CRT .from_file (assets / "ca.crt.pem" )
65+
66+
67+ @pytest .fixture (scope = "module" )
68+ def ca_key (assets : Path ) -> _Key :
69+ return RSA .from_file (assets / "ca.key.prv.pem" )
70+
71+
72+ @pytest .fixture (scope = "module" )
73+ def ee_crt (assets : Path ) -> CRT :
74+ return CRT .from_file (assets / "ee.crt.pem" )
75+
76+
77+ @pytest .fixture (scope = "module" )
78+ def ee_key (assets : Path ) -> _Key :
79+ return RSA .from_file (assets / "ee.key.prv.pem" )
80+
81+
82+ @pytest .fixture (scope = "module" )
83+ def certificate_chain (
84+ ca_crt : CRT , ee_crt : CRT , ee_key : _Key
85+ ) -> Tuple [Tuple [CRT , ...], _Key ]:
86+ return (ee_crt , ca_crt ), ee_key
13987
14088
14189class TestPickle :
@@ -328,10 +276,9 @@ def test_add_existing_certificate(self, store: TrustStore) -> None:
328276 store .add (store [0 ])
329277 assert len (store ) == length
330278
331- def test_add_new_certificate (self , store : TrustStore ) -> None :
332- root_ca = make_root_ca ()[0 ]
279+ def test_add_new_certificate (self , store : TrustStore , ca_crt : CRT ) -> None :
333280 length = len (store )
334- store .add (root_ca )
281+ store .add (ca_crt )
335282 assert len (store ) == length + 1
336283
337284
@@ -481,16 +428,6 @@ class TestTLSHandshake:
481428 def hostname (self ) -> _HostName :
482429 return "www.example.com"
483430
484- @pytest .fixture (scope = "class" )
485- def certificate_chain (
486- self , hostname : _HostName
487- ) -> Tuple [Tuple [CRT , ...], _Key ]:
488- root_crt , root_key = make_root_ca ()
489- ee_crt , ee_key = make_crt (
490- root_crt , root_key , subject = f"OU=test, CN={ hostname }
491- )
492- return (ee_crt , root_crt ), ee_key
493-
494431 def test_cert_without_validation (
495432 self , certificate_chain : Tuple [Tuple [CRT , ...], _Key ]
496433 ) -> None :
0 commit comments