From 0f500e8010b0a67072857a45e4b2e4e30cad3f3c Mon Sep 17 00:00:00 2001 From: Alex Gaynor Date: Thu, 19 Dec 2024 13:24:16 -0500 Subject: [PATCH] Convert `crypto_util_test.py` to use cryptography's APIs (#10100) --- .../_internal/tests/crypto_util_test.py | 25 ++++++++++++------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/certbot/certbot/_internal/tests/crypto_util_test.py b/certbot/certbot/_internal/tests/crypto_util_test.py index d1733ff48..be60b875e 100644 --- a/certbot/certbot/_internal/tests/crypto_util_test.py +++ b/certbot/certbot/_internal/tests/crypto_util_test.py @@ -1,4 +1,5 @@ """Tests for certbot.crypto_util.""" +import binascii import logging import re import sys @@ -7,6 +8,10 @@ from unittest import mock import OpenSSL import pytest +from cryptography import x509 +from cryptography.hazmat.primitives import hashes +from cryptography.hazmat.primitives import serialization +from cryptography.hazmat.primitives.asymmetric import ec from certbot import errors from certbot import util @@ -168,18 +173,19 @@ class MakeKeyTest(unittest.TestCase): from certbot.crypto_util import make_key # Do not test larger keys as it takes too long. - OpenSSL.crypto.load_privatekey(OpenSSL.crypto.FILETYPE_PEM, make_key(2048)) + serialization.load_pem_private_key(make_key(2048), password=None) def test_ec(self): # pylint: disable=no-self-use # ECDSA Key Type Tests from certbot.crypto_util import make_key for (name, bits) in [('secp256r1', 256), ('secp384r1', 384), ('secp521r1', 521)]: - pkey = OpenSSL.crypto.load_privatekey( - OpenSSL.crypto.FILETYPE_PEM, - make_key(elliptic_curve=name, key_type='ecdsa') + pkey = serialization.load_pem_private_key( + make_key(elliptic_curve=name, key_type='ecdsa'), + password=None ) - assert pkey.bits() == bits + assert isinstance(pkey, ec.EllipticCurvePrivateKey) + assert pkey.curve.key_size == bits def test_bad_key_sizes(self): from certbot.crypto_util import make_key @@ -199,8 +205,7 @@ class MakeKeyTest(unittest.TestCase): # Try a bad --key-type with pytest.raises(errors.Error, match=re.escape('Invalid key_type specified: unf. Use [rsa|ecdsa]')): - OpenSSL.crypto.load_privatekey( - OpenSSL.crypto.FILETYPE_PEM, make_key(2048, key_type='unf')) + make_key(2048, key_type='unf') class VerifyCertSetup(unittest.TestCase): @@ -393,8 +398,10 @@ class CertLoaderTest(unittest.TestCase): from certbot.crypto_util import pyopenssl_load_certificate cert, file_type = pyopenssl_load_certificate(CERT) - assert cert.digest('sha256') == \ - OpenSSL.crypto.load_certificate(file_type, CERT).digest('sha256') + assert file_type == OpenSSL.crypto.FILETYPE_PEM + assert binascii.unhexlify( + cert.digest("sha256").replace(b":", b"") + ) == x509.load_pem_x509_certificate(CERT).fingerprint(hashes.SHA256()) def test_load_invalid_cert(self): from certbot.crypto_util import pyopenssl_load_certificate