Added a test vector for duplicate extensions in OCSP requests (pyca#6064)

alex · web-flow · commit f94ce1271516 · 2021-05-24T19:58:33.000-05:00
diff --git a/docs/development/test-vectors.rst b/docs/development/test-vectors.rst
@@ -540,8 +540,6 @@ X.509 OCSP Test Vectors
   ``CT Certificate SCTs`` single extension, from the SwissSign OCSP responder.
 * ``x509/ocsp/ocsp-army.deps.mil-resp.der`` - An OCSP response containing
   multiple ``SINGLERESP`` values.
-* ``x509/ocsp/resp-unknown-extension.der`` - An OCSP response containing an
-  extension with an unknown OID.
 
 Custom X.509 OCSP Test Vectors
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -555,6 +553,10 @@ Custom X.509 OCSP Test Vectors
   extension.
 * ``x509/ocsp/req-ext-unknown-oid.der`` - An OCSP request containing an
   extension with an unknown OID.
+* ``x509/ocsp/req-duplicate-ext.der`` - An OCSP request with duplicate
+  extensions.
+* ``x509/ocsp/resp-unknown-extension.der`` - An OCSP response containing an
+  extension with an unknown OID.
 
 Custom PKCS12 Test Vectors
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/tests/x509/test_ocsp.py b/tests/x509/test_ocsp.py
@@ -119,6 +119,14 @@ def test_load_request_with_unknown_extension(self):
             b"\x04\x10{\x80Z\x1d7&\xb8\xb8OH\xd2\xf8\xbf\xd7-\xfd",
         )
 
+    def test_load_request_with_duplicate_extension(self):
+        req = _load_data(
+            os.path.join("x509", "ocsp", "req-duplicate-ext.der"),
+            ocsp.load_der_ocsp_request,
+        )
+        with pytest.raises(x509.DuplicateExtension):
+            req.extensions
+
     def test_load_request_two_requests(self):
         with pytest.raises(NotImplementedError):
             _load_data(
diff --git a/vectors/cryptography_vectors/x509/ocsp/req-duplicate-ext.der b/vectors/cryptography_vectors/x509/ocsp/req-duplicate-ext.der
