Move _pyopenssl_cert_or_req_san to acme.

acme/acme/challenges.py

@@ -14,8 +14,6 @@ from acme import interfaces
 from acme import jose
 from acme import other
 
-from letsencrypt import crypto_util as le_crypto_util
-
 
 logger = logging.getLogger(__name__)
 
@@ -267,7 +265,7 @@ class DVSNIResponse(ChallengeResponse):
         # return False if not
 
         # pylint: disable=protected-access
-        sans = le_crypto_util._pyopenssl_cert_or_req_san(cert)
+        sans = crypto_util._pyopenssl_cert_or_req_san(cert)
         logging.debug('Certificate %s. SANs: %s', cert.digest('sha1'), sans)
 
         key_filetype = OpenSSL.crypto.FILETYPE_ASN1

acme/acme/crypto_util.py

@@ -17,3 +17,45 @@ def _probe_sni(server_hostname, host, port, timeout=10,
     sock.close()
     # TODO: shutdown()
     return cert
+
+
+def _pyopenssl_cert_or_req_san(cert_or_req):
+    """Get Subject Alternative Names from certificate or CSR using pyOpenSSL.
+
+    .. todo:: Implement directly in PyOpenSSL!
+
+    .. note:: Although this is `acme` internal API, it is used by
+        `letsencrypt`.
+
+    :param cert_or_req: Certificate or CSR.
+    :type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`.
+
+    :returns: A list of Subject Alternative Names.
+    :rtype: list
+
+    """
+    # constants based on implementation of
+    # OpenSSL.crypto.X509Error._subjectAltNameString
+    parts_separator = ", "
+    part_separator = ":"
+    extension_short_name = "subjectAltName"
+
+    if hasattr(cert_or_req, 'get_extensions'):  # X509Req
+        extensions = cert_or_req.get_extensions()
+    else:  # X509
+        extensions = [cert_or_req.get_extension(i)
+                      for i in xrange(cert_or_req.get_extension_count())]
+
+    # pylint: disable=protected-access,no-member
+    label = OpenSSL.crypto.X509Extension._prefixes[OpenSSL.crypto._lib.GEN_DNS]
+    assert parts_separator not in label
+    prefix = label + part_separator
+
+    san_extensions = [
+        ext._subjectAltNameString().split(parts_separator)
+        for ext in extensions if ext.get_short_name() == extension_short_name]
+    # WARNING: this function assumes that no SAN can include
+    # parts_separator, hence the split!
+
+    return [part.split(part_separator)[1] for parts in san_extensions
+            for part in parts if part.startswith(prefix)]

acme/acme/crypto_util_test.py

@@ -4,6 +4,8 @@ import unittest
 
 import OpenSSL
 
+from acme import test_util
+
 
 class ProbeSNITest(unittest.TestCase):
     """Tests for acme.crypto_util._probe_sni."""
@@ -16,5 +18,44 @@ class ProbeSNITest(unittest.TestCase):
         self.assertTrue(isinstance(cert, OpenSSL.crypto.X509))
 
 
+class PyOpenSSLCertOrReqSANTest(unittest.TestCase):
+    """Test for acme.crypto_util._pyopenssl_cert_or_req_san."""
+
+    @classmethod
+    def _call(cls, loader, name):
+        # pylint: disable=protected-access
+        from acme.crypto_util import _pyopenssl_cert_or_req_san
+        return _pyopenssl_cert_or_req_san(loader(name))
+
+    def _call_cert(self, name):
+        return self._call(test_util.load_cert, name)
+
+    def _call_csr(self, name):
+        return self._call(test_util.load_csr, name)
+
+    def test_cert_no_sans(self):
+        self.assertEqual(self._call_cert('cert.pem'), [])
+
+    def test_cert_two_sans(self):
+        self.assertEqual(self._call_cert('cert-san.pem'),
+                         ['example.com', 'www.example.com'])
+
+    def test_csr_no_sans(self):
+        self.assertEqual(self._call_csr('csr-nosans.pem'), [])
+
+    def test_csr_one_san(self):
+        self.assertEqual(self._call_csr('csr.pem'), ['example.com'])
+
+    def test_csr_two_sans(self):
+        self.assertEqual(self._call_csr('csr-san.pem'),
+                         ['example.com', 'www.example.com'])
+
+    def test_csr_six_sans(self):
+        self.assertEqual(self._call_csr('csr-6sans.pem'),
+                         ["example.com", "example.org", "example.net",
+                          "example.info", "subdomain.example.com",
+                          "other.subdomain.example.com"])
+
+
 if __name__ == "__main__":
     unittest.main()  # pragma: no cover

acme/acme/testdata/csr-6sans.pem

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIBuzCCAWUCAQAweTELMAkGA1UEBhMCVVMxETAPBgNVBAgTCE1pY2hpZ2FuMRIw
+EAYDVQQHEwlBbm4gQXJib3IxDDAKBgNVBAoTA0VGRjEfMB0GA1UECxMWVW5pdmVy
+c2l0eSBvZiBNaWNoaWdhbjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wXDANBgkqhkiG
+9w0BAQEFAANLADBIAkEA9LYRcVE3Nr+qleecEcX8JwVDnjeG1X7ucsCasuuZM0e0
+9cmYuUzxIkMjO/9x4AVcvXXRXPEV+LzWWkfkTlzRMwIDAQABoIGGMIGDBgkqhkiG
+9w0BCQ4xdjB0MHIGA1UdEQRrMGmCC2V4YW1wbGUuY29tggtleGFtcGxlLm9yZ4IL
+ZXhhbXBsZS5uZXSCDGV4YW1wbGUuaW5mb4IVc3ViZG9tYWluLmV4YW1wbGUuY29t
+ghtvdGhlci5zdWJkb21haW4uZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADQQBd
+k4BE5qvEvkYoZM/2++Xd9RrQ6wsdj0QiJQCozfsI4lQx6ZJnbtNc7HpDrX4W6XIv
+IvzVBz/nD11drfz/RNuX
+-----END CERTIFICATE REQUEST-----

acme/acme/testdata/csr-nosans.pem

@@ -0,0 +1,8 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIBFTCBwAIBADBbMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEh
+MB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRQwEgYDVQQDDAtleGFt
+cGxlLm9yZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQD0thFxUTc2v6qV55wRxfwn
+BUOeN4bVfu5ywJqy65kzR7T1yZi5TPEiQyM7/3HgBVy9ddFc8RX4vNZaR+ROXNEz
+AgMBAAGgADANBgkqhkiG9w0BAQsFAANBAMikGL8Ch7hQCStXH7chhDp6+pt2+VSo
+wgsrPQ2Bw4veDMlSemUrH+4e0TwbbntHfvXTDHWs9P3BiIDJLxFrjuA=
+-----END CERTIFICATE REQUEST-----

acme/setup.py

@@ -11,7 +11,8 @@ install_requires = [
     'pyrfc3339',
     'ndg-httpsclient',  # urllib3 InsecurePlatformWarning (#304)
     'pyasn1',  # urllib3 InsecurePlatformWarning (#304)
-    'PyOpenSSL>=0.13',  # Connection.set_tlsext_host_name
+    # Connection.set_tlsext_host_name (>=0.13), X509Req.get_extensions (>=0.15)
+    'PyOpenSSL>=0.15',
     'pytz',
     'requests',
     'werkzeug',

letsencrypt/crypto_util.py

@@ -11,6 +11,7 @@ import os
 from cryptography.hazmat.primitives import serialization
 import OpenSSL
 
+from acme import crypto_util as acme_crypto_util
 from acme import jose
 
 from letsencrypt import errors
@@ -260,45 +261,6 @@ def make_ss_cert(key, domains, not_before=None,
     return OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_PEM, cert)
 
 
-def _pyopenssl_cert_or_req_san(cert_or_req):
-    """Get Subject Alternative Names from certificate or CSR using pyOpenSSL.
-
-    .. todo:: Implement directly in PyOpenSSL!
-
-    :param cert_or_req: Certificate or CSR.
-    :type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`.
-
-    :returns: A list of Subject Alternative Names.
-    :rtype: list
-
-    """
-    # constants based on implementation of
-    # OpenSSL.crypto.X509Error._subjectAltNameString
-    parts_separator = ", "
-    part_separator = ":"
-    extension_short_name = "subjectAltName"
-
-    if hasattr(cert_or_req, 'get_extensions'):  # X509Req
-        extensions = cert_or_req.get_extensions()
-    else:  # X509
-        extensions = [cert_or_req.get_extension(i)
-                      for i in xrange(cert_or_req.get_extension_count())]
-
-    # pylint: disable=protected-access,no-member
-    label = OpenSSL.crypto.X509Extension._prefixes[OpenSSL.crypto._lib.GEN_DNS]
-    assert parts_separator not in label
-    prefix = label + part_separator
-
-    san_extensions = [
-        ext._subjectAltNameString().split(parts_separator)
-        for ext in extensions if ext.get_short_name() == extension_short_name]
-    # WARNING: this function assumes that no SAN can include
-    # parts_separator, hence the split!
-
-    return [part.split(part_separator)[1] for parts in san_extensions
-            for part in parts if part.startswith(prefix)]
-
-
 def _get_sans_from_cert_or_req(
         cert_or_req_str, load_func, typ=OpenSSL.crypto.FILETYPE_PEM):
     try:
@@ -306,7 +268,8 @@ def _get_sans_from_cert_or_req(
     except OpenSSL.crypto.Error as error:
         logger.exception(error)
         raise
-    return _pyopenssl_cert_or_req_san(cert_or_req)
+    # pylint: disable=protected-access
+    return acme_crypto_util._pyopenssl_cert_or_req_san(cert_or_req)
 
 
 def get_sans_from_cert(cert, typ=OpenSSL.crypto.FILETYPE_PEM):

letsencrypt/revoker.py

@@ -16,6 +16,7 @@ import tempfile
 import OpenSSL
 
 from acme import client as acme_client
+from acme import crypto_util as acme_crypto_util
 from acme.jose import util as jose_util
 
 from letsencrypt import crypto_util
@@ -520,7 +521,7 @@ class Cert(object):
     def get_san(self):
         """Get subject alternative name if available."""
         # pylint: disable=protected-access
-        return ", ".join(crypto_util._pyopenssl_cert_or_req_san(self._cert))
+        return ", ".join(acme_crypto_util._pyopenssl_cert_or_req_san(self._cert))
 
     def __str__(self):
         text = [

letsencrypt/tests/achallenges_test.py

@@ -4,6 +4,7 @@ import unittest
 import OpenSSL
 
 from acme import challenges
+from acme import crypto_util as acme_crypto_util
 from acme import jose
 
 from letsencrypt import crypto_util
@@ -35,7 +36,7 @@ class DVSNITest(unittest.TestCase):
             OpenSSL.crypto.FILETYPE_PEM, cert_pem)
         self.assertEqual(cert.get_subject().CN, "example.com")
         # pylint: disable=protected-access
-        self.assertEqual(crypto_util._pyopenssl_cert_or_req_san(cert), [
+        self.assertEqual(acme_crypto_util._pyopenssl_cert_or_req_san(cert), [
             "example.com", self.chall.nonce_domain,
             self.response.z_domain(self.chall)])
 

setup.py

@@ -37,8 +37,7 @@ install_requires = [
     'mock<1.1.0',  # py26
     'parsedatetime',
     'psutil>=2.1.0',  # net_connections introduced in 2.1.0
-    # https://pyopenssl.readthedocs.org/en/latest/api/crypto.html#OpenSSL.crypto.X509Req.get_extensions
-    'PyOpenSSL>=0.15',
+    'PyOpenSSL',
     'pyrfc3339',
     'python2-pythondialog>=3.2.2rc1',  # Debian squeeze support, cf. #280
     'pytz',