3 files changed, 130 insertions, 2 deletions
diff --git a/tests/hazmat/backends/test_multibackend.py b/tests/hazmat/backends/test_multibackend.py
index 2a533750..81a64ce0 100644
--- a/tests/hazmat/backends/test_multibackend.py
+++ b/tests/hazmat/backends/test_multibackend.py
@@ -200,6 +200,12 @@ class DummyX509Backend(object):
     def load_der_x509_certificate(self, data):
         pass
 
+    def load_pem_x509_crl(self, data):
+        pass
+
+    def load_der_x509_crl(self, data):
+        pass
+
     def load_pem_x509_csr(self, data):
         pass
 
@@ -502,6 +508,8 @@ class TestMultiBackend(object):
 
         backend.load_pem_x509_certificate(b"certdata")
         backend.load_der_x509_certificate(b"certdata")
+        backend.load_pem_x509_crl(b"crldata")
+        backend.load_der_x509_crl(b"crldata")
         backend.load_pem_x509_csr(b"reqdata")
         backend.load_der_x509_csr(b"reqdata")
         backend.create_x509_csr(object(), b"privatekey", hashes.SHA1())
@@ -513,6 +521,10 @@ class TestMultiBackend(object):
         with raises_unsupported_algorithm(_Reasons.UNSUPPORTED_X509):
             backend.load_der_x509_certificate(b"certdata")
         with raises_unsupported_algorithm(_Reasons.UNSUPPORTED_X509):
+            backend.load_pem_x509_crl(b"crldata")
+        with raises_unsupported_algorithm(_Reasons.UNSUPPORTED_X509):
+            backend.load_der_x509_crl(b"crldata")
+        with raises_unsupported_algorithm(_Reasons.UNSUPPORTED_X509):
             backend.load_pem_x509_csr(b"reqdata")
         with raises_unsupported_algorithm(_Reasons.UNSUPPORTED_X509):
             backend.load_der_x509_csr(b"reqdata")
diff --git a/tests/hazmat/bindings/test_openssl.py b/tests/hazmat/bindings/test_openssl.py
index 20171fa7..76a9218b 100644
--- a/tests/hazmat/bindings/test_openssl.py
+++ b/tests/hazmat/bindings/test_openssl.py
@@ -89,8 +89,8 @@ class TestOpenSSL(object):
 
     def test_add_engine_more_than_once(self):
         b = Binding()
-        with pytest.raises(RuntimeError):
-            b._register_osrandom_engine()
+        b._register_osrandom_engine()
+        assert b.lib.ERR_get_error() == 0
 
     def test_ssl_ctx_options(self):
         # Test that we're properly handling 32-bit unsigned on all platforms.
diff --git a/tests/hazmat/primitives/test_keywrap.py b/tests/hazmat/primitives/test_keywrap.py
new file mode 100644
index 00000000..f1238c9a
--- /dev/null
+++ b/tests/hazmat/primitives/test_keywrap.py
@@ -0,0 +1,116 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+from __future__ import absolute_import, division, print_function
+
+import binascii
+import os
+
+import pytest
+
+from cryptography.hazmat.backends.interfaces import CipherBackend
+from cryptography.hazmat.primitives import keywrap
+from cryptography.hazmat.primitives.ciphers import algorithms, modes
+
+from .utils import _load_all_params
+from ...utils import load_nist_vectors
+
+
+@pytest.mark.requires_backend_interface(interface=CipherBackend)
+class TestAESKeyWrap(object):
+    @pytest.mark.parametrize(
+        "params",
+        _load_all_params(
+            os.path.join("keywrap", "kwtestvectors"),
+            ["KW_AE_128.txt", "KW_AE_192.txt", "KW_AE_256.txt"],
+            load_nist_vectors
+        )
+    )
+    @pytest.mark.supported(
+        only_if=lambda backend: backend.cipher_supported(
+            algorithms.AES("\x00" * 16), modes.ECB()
+        ),
+        skip_message="Does not support AES key wrap (RFC 3394) because AES-ECB"
+                     " is unsupported",
+    )
+    def test_wrap(self, backend, params):
+        wrapping_key = binascii.unhexlify(params["k"])
+        key_to_wrap = binascii.unhexlify(params["p"])
+        wrapped_key = keywrap.aes_key_wrap(wrapping_key, key_to_wrap, backend)
+        assert params["c"] == binascii.hexlify(wrapped_key)
+
+    @pytest.mark.parametrize(
+        "params",
+        _load_all_params(
+            os.path.join("keywrap", "kwtestvectors"),
+            ["KW_AD_128.txt", "KW_AD_192.txt", "KW_AD_256.txt"],
+            load_nist_vectors
+        )
+    )
+    @pytest.mark.supported(
+        only_if=lambda backend: backend.cipher_supported(
+            algorithms.AES("\x00" * 16), modes.ECB()
+        ),
+        skip_message="Does not support AES key wrap (RFC 3394) because AES-ECB"
+                     " is unsupported",
+    )
+    def test_unwrap(self, backend, params):
+        wrapping_key = binascii.unhexlify(params["k"])
+        wrapped_key = binascii.unhexlify(params["c"])
+        if params.get("fail") is True:
+            with pytest.raises(keywrap.InvalidUnwrap):
+                keywrap.aes_key_unwrap(wrapping_key, wrapped_key, backend)
+        else:
+            unwrapped_key = keywrap.aes_key_unwrap(
+                wrapping_key, wrapped_key, backend
+            )
+            assert params["p"] == binascii.hexlify(unwrapped_key)
+
+    @pytest.mark.supported(
+        only_if=lambda backend: backend.cipher_supported(
+            algorithms.AES("\x00" * 16), modes.ECB()
+        ),
+        skip_message="Does not support AES key wrap (RFC 3394) because AES-ECB"
+                     " is unsupported",
+    )
+    def test_wrap_invalid_key_length(self, backend):
+        # The wrapping key must be of length [16, 24, 32]
+        with pytest.raises(ValueError):
+            keywrap.aes_key_wrap(b"badkey", b"sixteen_byte_key", backend)
+
+    @pytest.mark.supported(
+        only_if=lambda backend: backend.cipher_supported(
+            algorithms.AES("\x00" * 16), modes.ECB()
+        ),
+        skip_message="Does not support AES key wrap (RFC 3394) because AES-ECB"
+                     " is unsupported",
+    )
+    def test_unwrap_invalid_key_length(self, backend):
+        with pytest.raises(ValueError):
+            keywrap.aes_key_unwrap(b"badkey", b"\x00" * 24, backend)
+
+    @pytest.mark.supported(
+        only_if=lambda backend: backend.cipher_supported(
+            algorithms.AES("\x00" * 16), modes.ECB()
+        ),
+        skip_message="Does not support AES key wrap (RFC 3394) because AES-ECB"
+                     " is unsupported",
+    )
+    def test_wrap_invalid_key_to_wrap_length(self, backend):
+        # Keys to wrap must be at least 16 bytes long
+        with pytest.raises(ValueError):
+            keywrap.aes_key_wrap(b"sixteen_byte_key", b"\x00" * 15, backend)
+
+        # Keys to wrap must be a multiple of 8 bytes
+        with pytest.raises(ValueError):
+            keywrap.aes_key_wrap(b"sixteen_byte_key", b"\x00" * 23, backend)
+
+    def test_unwrap_invalid_wrapped_key_length(self, backend):
+        # Keys to unwrap must be at least 24 bytes
+        with pytest.raises(ValueError):
+            keywrap.aes_key_unwrap(b"sixteen_byte_key", b"\x00" * 16, backend)
+
+        # Keys to unwrap must be a multiple of 8 bytes
+        with pytest.raises(ValueError):
+            keywrap.aes_key_unwrap(b"sixteen_byte_key", b"\x00" * 27, backend)