Skip to content

Commit

Permalink
chg: usr: Include /.well-known/ in CA URL.
Browse files Browse the repository at this point in the history 
Close #62
  • Loading branch information
@ashdwilson
ashdwilson committed Jun 4, 2021
1 parent 5ef7a21 commit 4799753
Show file tree
Hide file tree
Showing 4 changed files with 16 additions and 12 deletions.
2 changes: 1 addition & 1 deletion dane_discovery/dane.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -493,7 +493,7 @@ def generate_url_for_ca_certificate(cls, authority_hostname, authority_key_id):
Return:
str: URL where a CA certificate should be found.
"""
path = "ca/{}.pem".format(authority_key_id)
path = ".well-known/ca/{}.pem".format(authority_key_id)
authority_url = urllib.parse.urlunsplit(["https", authority_hostname, path, "", ""])
return authority_url

Expand Down
8 changes: 4 additions & 4 deletions tests/integration/test_integration_dane.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -263,7 +263,7 @@ def test_integration_dane_generate_url_for_ca_certificate(self):
"""Test generation of the CA certificate URL."""
authority_hostname = "device.example.com"
aki = "aa-bc-de-00-12-34"
auth_name = "https://device.example.com/ca/aa-bc-de-00-12-34.pem"
auth_name = "https://device.example.com/.well-known/ca/aa-bc-de-00-12-34.pem"
result = DANE.generate_url_for_ca_certificate(authority_hostname, aki)
assert result == auth_name

Expand Down Expand Up @@ -296,7 +296,7 @@ def test_integration_dane_get_ca_certificate_for_identity_success(self, requests
id_cert = self.get_dyn_asset("{}.cert.pem".format(id_name))
aki = DANE.get_authority_key_id_from_certificate(id_cert)
ca_certificate = self.get_dyn_asset(ca_certificate_name)
requests_mock.get("https://device.example.net/ca/{}.pem".format(aki),
requests_mock.get("https://device.example.net/.well-known/ca/{}.pem".format(aki),
content=ca_certificate)
retrieved = DANE.get_ca_certificate_for_identity(id_name, id_cert)
assert retrieved == ca_certificate
Expand All @@ -308,7 +308,7 @@ def test_integration_dane_authenticate_tlsa_pkix_cd(self, requests_mock):
aki = DANE.get_authority_key_id_from_certificate(entity_certificate)
x509_obj = DANE.build_x509_object(entity_certificate)
ca_certificate = self.get_dyn_asset("ca.example.net.cert.pem")
requests_mock.get("https://device.example.net/ca/{}.pem".format(aki),
requests_mock.get("https://device.example.net/.well-known/ca/{}.pem".format(aki),
content=ca_certificate)
cert_bytes = x509_obj.public_bytes(encoding=serialization.Encoding.DER)
certificate_association = binascii.hexlify(cert_bytes).decode()
Expand All @@ -324,7 +324,7 @@ def test_integration_dane_authenticate_tlsa_pkix_cd_fail(self, requests_mock):
aki = DANE.get_authority_key_id_from_certificate(entity_certificate)
x509_obj = DANE.build_x509_object(entity_certificate)
ca_certificate = self.get_dyn_asset("{}.cert.pem".format(id_name))
requests_mock.get("https://device.example.net/ca/{}.pem".format(aki),
requests_mock.get("https://device.example.net/.well-known/ca/{}.pem".format(aki),
content=ca_certificate)
cert_bytes = x509_obj.public_bytes(encoding=serialization.Encoding.DER)
certificate_association = binascii.hexlify(cert_bytes).decode()
Expand Down
12 changes: 6 additions & 6 deletions tests/integration/test_integration_identity.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -125,7 +125,7 @@ def test_integration_identity_validate_certificate_pkix_cd_pass(self, requests_m
identity.tcp = True
aki = DANE.get_authority_key_id_from_certificate(certificate)
ca_certificate = self.get_dyn_asset(ca_certificate_name)
requests_mock.get("https://device.example.net/ca/{}.pem".format(aki),
requests_mock.get("https://device.example.net/.well-known/ca/{}.pem".format(aki),
content=ca_certificate)
assert identity.validate_certificate(certificate)

Expand All @@ -143,7 +143,7 @@ def test_integration_identity_validate_certificate_pkix_cd_dnssec_pass(self, req
identity.dnssec = True
aki = DANE.get_authority_key_id_from_certificate(certificate)
ca_certificate = self.get_dyn_asset(ca_certificate_name)
requests_mock.get("https://device.example.net/ca/{}.pem".format(aki),
requests_mock.get("https://device.example.net/.well-known/ca/{}.pem".format(aki),
content=ca_certificate)
assert identity.validate_certificate(certificate)

Expand All @@ -162,7 +162,7 @@ def test_integration_identity_validate_certificate_pkix_cd_fail(self, requests_m
identity.tcp = True
aki = DANE.get_authority_key_id_from_certificate(certificate)
ca_certificate = self.get_dyn_asset(ca_certificate_name)
requests_mock.get("https://device.example.net/ca/{}.pem".format(aki),
requests_mock.get("https://device.example.net/.well-known/ca/{}.pem".format(aki),
content=ca_certificate)
assert identity.validate_certificate(certificate)

Expand All @@ -182,7 +182,7 @@ def test_integration_identity_validate_certificate_pkix_cd_dnssec_fail(self, req
identity.dnssec = True
aki = DANE.get_authority_key_id_from_certificate(certificate)
ca_certificate = self.get_dyn_asset(ca_certificate_name)
requests_mock.get("https://device.example.net/ca/{}.pem".format(aki),
requests_mock.get("https://device.example.net/.well-known/ca/{}.pem".format(aki),
content=ca_certificate)
assert identity.validate_certificate(certificate)

Expand All @@ -205,7 +205,7 @@ def test_integration_identity_get_all_certs_for_identity(self, requests_mock):
certificate = self.get_dyn_asset(certificate_path)
# Both identities have the same CA.
aki = DANE.get_authority_key_id_from_certificate(certificate)
requests_mock.get("https://device.example.net/ca/{}.pem".format(aki),
requests_mock.get("https://device.example.net/.well-known/ca/{}.pem".format(aki),
content=ca_certificate)
certs = identity.get_all_certificates()
# We only have two UNIQUE certs, across four TLSA records.
Expand All @@ -232,7 +232,7 @@ def test_integration_identity_get_all_certs_for_identity_filtered(self, requests
certificate = self.get_dyn_asset(certificate_path)
# Both identities have the same CA.
aki = DANE.get_authority_key_id_from_certificate(certificate)
requests_mock.get("https://device.example.net/ca/{}.pem".format(aki),
requests_mock.get("https://device.example.net/.well-known/ca/{}.pem".format(aki),
content=ca_certificate)
certs = identity.get_all_certificates(filters=["PKIX-EE"])
# We only have one PKIX-EE cert.
Expand Down
6 changes: 5 additions & 1 deletion tests/unit/test_unit_dane.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -70,4 +70,8 @@ def test_unit_process_response_fail(self):
with pytest.raises(TLSAError) as err:
DANE.process_response(response)
assert "certificate association" in str(err)


def test_unit_generate_url_for_ca_certificate(self):
desired = "https://device.organization.example/.well-known/ca/a-k-i.pem"
actual = DANE.generate_url_for_ca_certificate("device.organization.example", "a-k-i")
assert desired == actual

0 comments on commit 4799753

Please sign in to comment.