From 20e4e83129f024dc92578f2022a4bfff1dae2b04 Mon Sep 17 00:00:00 2001 From: Javid Khan Date: Tue, 13 Oct 2026 12:57:12 +0530 Subject: [PATCH] raise ValueError for unrecognised TLS feature values --- src/rust/src/x509/certificate.rs | 7 ++++++- tests/x509/test_x509.py | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+), 1 deletion(-) diff --git a/src/rust/src/x509/certificate.rs b/src/rust/src/x509/certificate.rs index af5b6fe499f9..f0b08ece8b5f 100644 --- a/src/rust/src/x509/certificate.rs +++ b/src/rust/src/x509/certificate.rs @@ -830,7 +830,12 @@ pub fn parse_cert_ext<'p>( let features = pyo3::types::PyList::empty(py); for feature in ext.value::>()? { - let py_feature = tls_feature_type_to_enum.get_item(feature)?; + // A value that is not a known TLSFeatureType cannot be + // represented, so surface it as a parse error rather than + // letting the dict lookup raise a bare KeyError. + let py_feature = tls_feature_type_to_enum + .get_item(feature) + .map_err(|_| asn1::ParseError::new(asn1::ParseErrorKind::InvalidValue))?; features.append(py_feature)?; } Ok(Some(types::TLS_FEATURE.get(py)?.call1((features,))?)) diff --git a/tests/x509/test_x509.py b/tests/x509/test_x509.py index 8552fe79f8c9..589183269828 100644 --- a/tests/x509/test_x509.py +++ b/tests/x509/test_x509.py @@ -1748,6 +1748,38 @@ def test_parse_tls_feature_extension(self): [x509.TLSFeatureType.status_request] ) + def test_tls_feature_unknown_value(self, rsa_key_2048: rsa.RSAPrivateKey): + # A TLSFeature extension carrying a value that is not a known + # TLSFeatureType must raise a ValueError, not a bare KeyError. + private_key = rsa_key_2048 + cert = ( + x509.CertificateBuilder() + .subject_name( + x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "x")]) + ) + .issuer_name( + x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "x")]) + ) + .public_key(private_key.public_key()) + .serial_number(1) + .not_valid_before(datetime.datetime(2020, 1, 1)) + .not_valid_after(datetime.datetime(2030, 1, 1)) + .add_extension( + # SEQUENCE { INTEGER 99 }; 99 is not a valid TLSFeatureType. + x509.UnrecognizedExtension( + x509.ObjectIdentifier("1.3.6.1.5.5.7.1.24"), + b"\x30\x03\x02\x01\x63", + ), + critical=False, + ) + .sign(private_key, hashes.SHA256()) + ) + cert = x509.load_der_x509_certificate( + cert.public_bytes(serialization.Encoding.DER) + ) + with pytest.raises(ValueError): + cert.extensions + def test_verify_directly_issued_by_rsa_pss( self, rsa_key_2048: rsa.RSAPrivateKey ):