Skip to content

Fix(MockCA, Batch): Fix PVNO Setting Batch PKIMessage Responses #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ralienpp merged 6 commits into from
Apr 14, 2026
Merged

Fix(MockCA, Batch): Fix PVNO Setting Batch PKIMessage Responses #78

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b0fe01d
feat(test, batch): Add test case to check the correct handling of the…
Mar 12, 2026
f295da3
test(batch, pvno): Add tests for correct PVNO responses in nested bat…
Mar 12, 2026
a8dd90f
test(batch-message): Add PVNO checks in batch message processing tests.
Guiliano99 Mar 11, 2026
90ae1a6
fix(nested-handler): Fix the returned pvno to return teh version of t…
Guiliano99 Mar 11, 2026
7d669a3
fix(batch-message): Add pvno parameter to batch message processing
Guiliano99 Apr 13, 2026
bb21c9d
Merge branch 'main' into FixBatchPVNO2
ralienpp Apr 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions mock_ca/nested_handler.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -319,5 +319,6 @@ def process_batched_request(
recip_nonce=request["header"]["senderNonce"].asOctets(),
sender=prot_handler.sender,
recipient=request["header"]["sender"],
pvno=request["header"]["pvno"],
)
return prot_handler.protect_pkimessage(response=pki_message, request=request)
128 changes: 128 additions & 0 deletions tests/pki_mgmt_entity_op.robot
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -194,6 +194,28 @@ CA MUST Respond with MAC To Added Protection For MAC Inner Request
Fail The response to the wrapped protected message was not MAC-based protected.
END

CA MUST Respond with A Correct PVNO For Inner Added Protection
[Documentation] According to RFC 9483 Section 3.1 and RFC 9480 Section 7 the `pvno` field in the header of a
... PKIMessage MUST be set to the request message's `pvno` value when the response is returned. We send a
... added protection nested PKIMessage with pvno set to 2 and a inner PKIMessage with pvno set to 3. The CA
... MUST respond with a message that has the `pvno` value set to 3.
[Tags] adding-protection nested positive added-protection pvno
Skip If Cert Or Key Not Set
${protected_ir}= Default Build Inner IR Message pvno=3
${nested}= Build Nested PKIMessage
... exclude_fields=${None}
... sender=${SENDER}
... recipient=${RECIPIENT}
... other_messages=${protected_ir}
... for_added_protection=True
... pvno=3
${prot_nested}= Default Protect With Trusted Cert ${nested}
${response}= Exchange PKIMessage ${prot_nested}
PKIMessage Body Type Must Be ${response} ip
PKIStatus Must Be ${response} status=accepted
${response_pvno}= Get Asn1 Value As Number ${response} header.pvno
Should Be Equal As Integers ${response_pvno} 3

## Section 5.2.2.2. Batching Messages

CA MUST Accept Valid Nested Batch Message
Expand Down Expand Up @@ -263,6 +285,112 @@ CA MUST Check The Protection Of All Inner Messages
PKIStatus Must Be ${response} status=rejection
PKIStatusInfo Failinfo Bit Must Be ${response} failinfo=badMessageCheck exclusive=True

CA MUST Respond With Correct PVNO For Outer And Inner Batch Message
[Documentation] According to RFC 9483 Section 3.1 and RFC 9480 Section 7, the `pvno` field in the
... response MUST match the `pvno` of the corresponding request. We send a nested batch PKIMessage
... where the outer message has `pvno` set to 3 and all three inner IR messages have `pvno` set to 2.
... The CA MUST respond with a nested message where the outer response has `pvno` 3 and each inner
... `ip` response has `pvno` 2.
[Tags] batching nested positive batch pvno
Skip If Cert Or Key Not Set
${nonces}= Generate Unique Byte Values length=4
${ids}= Generate Unique Byte Values length=4
VAR @{inner_irs}
FOR ${i} IN RANGE 3
${ir}= Default Build Inner IR Message
... pvno=2
... transaction_id=${ids}[${i}]
... sender_nonce=${nonces}[${i}]
Append To List ${inner_irs} ${ir}
END
${nested}= Build Nested PKIMessage
... recipient=${RECIPIENT}
... other_messages=${inner_irs}
... sender_nonce=${nonces}[3]
... transaction_id=${ids}[3]
... pvno=3
${prot_nested}= Default Protect With Trusted Cert ${nested}
${response}= Exchange PKIMessage ${prot_nested}
PKIMessage Body Type Must Be ${response} nested
${outer_pvno}= Get Asn1 Value As Number ${response} header.pvno
Should Be Equal As Integers ${outer_pvno} 3
FOR ${i} IN RANGE 3
${inner_response}= Get Inner PKIMessage ${response} index=${i}
${inner_pvno}= Get Asn1 Value As Number ${inner_response} header.pvno
Should Be Equal As Integers ${inner_pvno} 2
END

CA MUST Respond With Correct PVNO For Outer And Inner Batch Message Reversed
[Documentation] According to RFC 9483 Section 3.1 and RFC 9480 Section 7, the `pvno` field in the
... response MUST match the `pvno` of the corresponding request. We send a nested batch PKIMessage
... where the outer message has `pvno` set to 2 and all three inner IR messages have `pvno` set to 3.
... The CA MUST respond with a nested message where the outer response has `pvno` 2 and each inner
... `ip` response has `pvno` 3.
[Tags] batching nested positive batch pvno
Skip If Cert Or Key Not Set
${nonces}= Generate Unique Byte Values length=4
${ids}= Generate Unique Byte Values length=4
VAR @{inner_irs}
FOR ${i} IN RANGE 3
${ir}= Default Build Inner IR Message
... pvno=3
... transaction_id=${ids}[${i}]
... sender_nonce=${nonces}[${i}]
Append To List ${inner_irs} ${ir}
END
${nested}= Build Nested PKIMessage
... recipient=${RECIPIENT}
... other_messages=${inner_irs}
... sender_nonce=${nonces}[3]
... transaction_id=${ids}[3]
... pvno=2
${prot_nested}= Default Protect With Trusted Cert ${nested}
${response}= Exchange PKIMessage ${prot_nested}
PKIMessage Body Type Must Be ${response} nested
${outer_pvno}= Get Asn1 Value As Number ${response} header.pvno
Should Be Equal As Integers ${outer_pvno} 2
FOR ${i} IN RANGE 3
${inner_response}= Get Inner PKIMessage ${response} index=${i}
${inner_pvno}= Get Asn1 Value As Number ${inner_response} header.pvno
Should Be Equal As Integers ${inner_pvno} 3
END

CA MUST Respond With Correct PVNO For Outer And Inner Batch Message Mixed
[Documentation] According to RFC 9483 Section 3.1 and RFC 9480 Section 7, the `pvno` field in the
... response MUST match the `pvno` of the corresponding request. We send a nested batch PKIMessage
... where the outer message has `pvno` set to 3 and three inner IR messages have `pvno` set to 2, 3, and 2.
... The CA MUST respond with a nested message where the outer response has `pvno` 3 and each inner
... `ip` response has the corresponding `pvno` (2, 3, 2).
[Tags] batching nested positive batch pvno
Skip If Cert Or Key Not Set
${nonces}= Generate Unique Byte Values length=4
${ids}= Generate Unique Byte Values length=4
VAR @{inner_irs}
VAR @{expected_pvnos} ${2} ${3} ${2}
FOR ${i} IN RANGE 3
${ir}= Default Build Inner IR Message
... pvno=${expected_pvnos}[${i}]
... transaction_id=${ids}[${i}]
... sender_nonce=${nonces}[${i}]
Append To List ${inner_irs} ${ir}
END
${nested}= Build Nested PKIMessage
... recipient=${RECIPIENT}
... other_messages=${inner_irs}
... sender_nonce=${nonces}[3]
... transaction_id=${ids}[3]
... pvno=3
${prot_nested}= Default Protect With Trusted Cert ${nested}
${response}= Exchange PKIMessage ${prot_nested}
PKIMessage Body Type Must Be ${response} nested
${outer_pvno}= Get Asn1 Value As Number ${response} header.pvno
Should Be Equal As Integers ${outer_pvno} 3
FOR ${i} IN RANGE 3
${inner_response}= Get Inner PKIMessage ${response} index=${i}
${inner_pvno}= Get Asn1 Value As Number ${inner_response} header.pvno
Should Be Equal As Integers ${inner_pvno} ${expected_pvnos}[${i}]
END

### Section 5.2.3 Replacing Protection

# According to Section 5.2.3, when an intermediate PKI management entity modifies a message,
Expand Down
8 changes: 8 additions & 0 deletions unit_tests/tests_experimental_and_mock_ca/tests_mock_ca/test_process_batch_message.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@ def _generate_nested_message(
sender_nonce=sender_nonce[0],
recip_nonce=recip_nonce[0] if include_recip_nonce else None,
for_mac=True,
pvno=2
)

ir = build_ir_from_key(
Expand Down Expand Up @@ -82,6 +83,7 @@ def _generate_nested_message(
transaction_id=trans_id[2],
sender_nonce=sender_nonce[2],
recip_nonce=recip_nonce[2] if include_recip_nonce else None,
pvno=3
)
return protect_pkimessage(
pki_message=nested,
Expand All @@ -93,6 +95,7 @@ def _generate_nested_message(
def test_process_batch_message(self):
"""Test processing a batch message."""
nested = self._generate_nested_message(False, False)
self.assertEqual(3, int(nested["header"]["pvno"]))
self.assertEqual(nested["body"].getName(), "nested")
self.assertEqual(len(nested["body"]["nested"]), 2)
self.assertEqual(nested["body"]["nested"][0]["body"].getName(), "ir")
Expand All @@ -105,6 +108,7 @@ def test_process_batch_message(self):

self.assertEqual(response["body"]["nested"][0]["header"]["protectionAlg"]["algorithm"], rfc9481.id_PBMAC1)
self.assertEqual(response["body"]["nested"][1]["header"]["protectionAlg"]["algorithm"], rfc9481.id_PBMAC1)
self.assertEqual(3, int(response["header"]["pvno"]))

def test_process_batch_message_bad_message_check(self):
"""Test processing a batch message with bad message check."""
Expand All @@ -118,3 +122,7 @@ def test_process_batch_message_bad_message_check(self):
texts = [x.prettyPrint() for x in pki_status_info["statusString"]]

self.assertIn("Invalid inner batch PKIMessage protection at index 1.", texts)


if __name__ == "__main__":
unittest.main()
Loading