From 688660a0545f5a29b6f4f2f06bbef23d3dbef688 Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Fri, 24 Jul 2015 09:23:07 -0400 Subject: [PATCH] Work around python-nss bug on unrecognised OIDs A bug in python-nss causes an error to be thrown when converting an unrecognised OID to a string. If cert-request receives a PKCS #10 CSR with an unknown extension, the error is thrown. Work around this error by first checking if the OID is recognised and, if it is not, using a different method to obtain its string representation. Once the python-nss bug is fixed, this workaround should be reverted. https://bugzilla.redhat.com/show_bug.cgi?id=1246729 Reviewed-By: Martin Babinsky --- ipalib/pkcs10.py | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/ipalib/pkcs10.py b/ipalib/pkcs10.py index 6299dfea43b7a3f4104f0b0ec78c4f105d9daf62..64670835127e96f1d724c5f32ed7a939d37b7f16 100644 --- a/ipalib/pkcs10.py +++ b/ipalib/pkcs10.py @@ -53,7 +53,20 @@ def get_extensions(csr, datatype=PEM): The return value is a tuple of strings """ request = load_certificate_request(csr, datatype) - return tuple(nss.oid_dotted_decimal(ext.oid_tag)[4:] + + # Work around a bug in python-nss where nss.oid_dotted_decimal + # errors on unrecognised OIDs + # + # https://bugzilla.redhat.com/show_bug.cgi?id=1246729 + # + def get_prefixed_oid_str(ext): + """Returns a string like 'OID.1.2...'.""" + if ext.oid_tag == 0: + return repr(ext) + else: + return nss.oid_dotted_decimal(ext.oid) + + return tuple(get_prefixed_oid_str(ext)[4:] for ext in request.extensions) class _PrincipalName(univ.Sequence): -- 2.4.3