From a147699cabf935b0c770d5c72fb8d2305737d66a Mon Sep 17 00:00:00 2001
From: Paul Kehrer <paul.l.kehrer@gmail.com>
Date: Mon, 4 May 2015 17:35:47 -0500
Subject: add support for authority information access in the openssl backend

---
 tests/test_x509_ext.py | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 98 insertions(+)

(limited to 'tests/test_x509_ext.py')

diff --git a/tests/test_x509_ext.py b/tests/test_x509_ext.py
index ad36b5c0..8a227953 100644
--- a/tests/test_x509_ext.py
+++ b/tests/test_x509_ext.py
@@ -1138,6 +1138,104 @@ class TestAuthorityInformationAccess(object):
         assert aia != object()
 
 
+@pytest.mark.requires_backend_interface(interface=RSABackend)
+@pytest.mark.requires_backend_interface(interface=X509Backend)
+class TestAuthorityInformationAccessExtension(object):
+    def test_aia_ocsp_ca_issuers(self, backend):
+        cert = _load_cert(
+            os.path.join("x509", "cryptography.io.pem"),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_AUTHORITY_INFORMATION_ACCESS
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        assert ext.value == x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://gv.symcd.com")
+            ),
+            x509.AccessDescription(
+                x509.OID_CA_ISSUERS,
+                x509.UniformResourceIdentifier(u"http://gv.symcb.com/gv.crt")
+            ),
+        ])
+
+    def test_aia_multiple_ocsp_ca_issuers(self, backend):
+        cert = _load_cert(
+            os.path.join("x509", "custom", "aia_ocsp_ca_issuers.pem"),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_AUTHORITY_INFORMATION_ACCESS
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        assert ext.value == x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+            ),
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://ocsp2.domain.com")
+            ),
+            x509.AccessDescription(
+                x509.OID_CA_ISSUERS,
+                x509.DirectoryName(x509.Name([
+                    x509.NameAttribute(x509.OID_COMMON_NAME, "myCN"),
+                    x509.NameAttribute(x509.OID_ORGANIZATION_NAME, "some Org"),
+                ]))
+            ),
+        ])
+
+    def test_aia_ocsp_only(self, backend):
+        cert = _load_cert(
+            os.path.join("x509", "custom", "aia_ocsp.pem"),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_AUTHORITY_INFORMATION_ACCESS
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        assert ext.value == x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_OCSP,
+                x509.UniformResourceIdentifier(u"http://ocsp.domain.com")
+            ),
+        ])
+
+    def test_aia_ca_issuers_only(self, backend):
+        cert = _load_cert(
+            os.path.join("x509", "custom", "aia_ca_issuers.pem"),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_AUTHORITY_INFORMATION_ACCESS
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        assert ext.value == x509.AuthorityInformationAccess([
+            x509.AccessDescription(
+                x509.OID_CA_ISSUERS,
+                x509.DirectoryName(x509.Name([
+                    x509.NameAttribute(x509.OID_COMMON_NAME, "myCN"),
+                    x509.NameAttribute(x509.OID_ORGANIZATION_NAME, "some Org"),
+                ]))
+            ),
+        ])
+
+
 @pytest.mark.requires_backend_interface(interface=RSABackend)
 @pytest.mark.requires_backend_interface(interface=X509Backend)
 class TestAuthorityKeyIdentifierExtension(object):
-- 
cgit v1.2.3