raise a valueerror on multi-SINGLERESP valued OCSP responses (pyca#5316)

reaperhulk · web-flow · commit c51f7957ddf0 · 2020-07-18T20:59:56.000-04:00
InternalErrors are bad when we know they're reachable
diff --git a/docs/development/test-vectors.rst b/docs/development/test-vectors.rst
@@ -532,6 +532,8 @@ X.509 OCSP Test Vectors
   contains a ``CRLReason`` single extension.
 * ``x509/ocsp/resp-sct-extension.der`` - An OCSP response containing a
   ``CT Certificate SCTs`` single extension, from the SwissSign OCSP responder.
+* ``x509/ocsp/ocsp-army.deps.mil-resp.der`` - An OCSP response containing
+  multiple ``SINGLERESP`` values.
 
 Custom X.509 OCSP Test Vectors
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/src/cryptography/hazmat/backends/openssl/ocsp.py b/src/cryptography/hazmat/backends/openssl/ocsp.py
@@ -104,9 +104,13 @@ def __init__(self, backend, ocsp_response):
             self._basic = self._backend._ffi.gc(
                 basic, self._backend._lib.OCSP_BASICRESP_free
             )
-            self._backend.openssl_assert(
-                self._backend._lib.OCSP_resp_count(self._basic) == 1
-            )
+            num_resp = self._backend._lib.OCSP_resp_count(self._basic)
+            if num_resp != 1:
+                raise ValueError(
+                    "OCSP response contains more than one SINGLERESP structure"
+                    ", which this library does not support. "
+                    "{} found".format(num_resp)
+                )
             self._single = self._backend._lib.OCSP_resp_get0(self._basic, 0)
             self._backend.openssl_assert(
                 self._single != self._backend._ffi.NULL
diff --git a/tests/x509/test_ocsp.py b/tests/x509/test_ocsp.py
@@ -695,6 +695,13 @@ def test_load_response(self):
         assert resp.serial_number == 271024907440004808294641238224534273948400
         assert len(resp.extensions) == 0
 
+    def test_load_multi_valued_response(self):
+        with pytest.raises(ValueError):
+            _load_data(
+                os.path.join("x509", "ocsp", "ocsp-army.deps.mil-resp.der"),
+                ocsp.load_der_ocsp_response,
+            )
+
     def test_load_unauthorized(self):
         resp = _load_data(
             os.path.join("x509", "ocsp", "resp-unauthorized.der"),
diff --git a/vectors/cryptography_vectors/x509/ocsp/ocsp-army.deps.mil-resp.der b/vectors/cryptography_vectors/x509/ocsp/ocsp-army.deps.mil-resp.der
