jruby-openssl 0.0.4 → 0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of jruby-openssl might be problematic. Click here for more details.

Files changed (26) hide show
  1. data/History.txt +12 -0
  2. data/License.txt +30 -0
  3. data/README.txt +18 -0
  4. data/lib/jopenssl.jar +0 -0
  5. data/lib/jopenssl/version.rb +5 -0
  6. data/lib/openssl/dummy.rb +34 -0
  7. data/lib/openssl/dummyssl.rb +13 -0
  8. data/test/openssl/ssl_server.rb +81 -0
  9. data/test/openssl/test_asn1.rb +199 -0
  10. data/test/openssl/test_cipher.rb +151 -0
  11. data/test/openssl/test_digest.rb +88 -0
  12. data/test/openssl/test_hmac.rb +34 -0
  13. data/test/openssl/test_ns_spki.rb +69 -0
  14. data/test/openssl/test_pair.rb +149 -0
  15. data/test/openssl/test_pkey_rsa.rb +49 -0
  16. data/test/openssl/test_ssl.rb +284 -0
  17. data/test/openssl/test_x509cert.rb +174 -0
  18. data/test/openssl/test_x509crl.rb +218 -0
  19. data/test/openssl/test_x509ext.rb +74 -0
  20. data/test/openssl/test_x509name.rb +265 -0
  21. data/test/openssl/test_x509req.rb +140 -0
  22. data/test/openssl/test_x509store.rb +217 -0
  23. data/test/openssl/utils.rb +135 -0
  24. data/test/test_openssl.rb +21 -0
  25. data/test/ut_eof.rb +128 -0
  26. metadata +69 -33
data/test/openssl/test_x509name.rb ADDED
@@ -0,0 +1,265 @@
1
+ begin
2
+ require "openssl"
3
+ rescue LoadError
4
+ end
5
+ require "test/unit"
6
+
7
+ if defined?(OpenSSL)
8
+
9
+ class OpenSSL::TestX509Name < Test::Unit::TestCase
10
+ OpenSSL::ASN1::ObjectId.register(
11
+ "1.2.840.113549.1.9.1", "emailAddress", "emailAddress")
12
+ OpenSSL::ASN1::ObjectId.register(
13
+ "2.5.4.5", "serialNumber", "serialNumber")
14
+
15
+ def setup
16
+ @obj_type_tmpl = Hash.new(OpenSSL::ASN1::PRINTABLESTRING)
17
+ @obj_type_tmpl.update(OpenSSL::X509::Name::OBJECT_TYPE_TEMPLATE)
18
+ end
19
+
20
+ def teardown
21
+ end
22
+
23
+ def test_s_new
24
+ dn = [ ["C", "JP"], ["O", "example"], ["CN", "www.example.jp"] ]
25
+ name = OpenSSL::X509::Name.new(dn)
26
+ ary = name.to_a
27
+ assert_equal("/C=JP/O=example/CN=www.example.jp", name.to_s)
28
+ assert_equal("C", ary[0][0])
29
+ assert_equal("O", ary[1][0])
30
+ assert_equal("CN", ary[2][0])
31
+ assert_equal("JP", ary[0][1])
32
+ assert_equal("example", ary[1][1])
33
+ assert_equal("www.example.jp", ary[2][1])
34
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[0][2])
35
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[1][2])
36
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[2][2])
37
+
38
+ dn = [
39
+ ["countryName", "JP"],
40
+ ["organizationName", "example"],
41
+ ["commonName", "www.example.jp"]
42
+ ]
43
+ name = OpenSSL::X509::Name.new(dn)
44
+ ary = name.to_a
45
+ assert_equal("/C=JP/O=example/CN=www.example.jp", name.to_s)
46
+ assert_equal("C", ary[0][0])
47
+ assert_equal("O", ary[1][0])
48
+ assert_equal("CN", ary[2][0])
49
+ assert_equal("JP", ary[0][1])
50
+ assert_equal("example", ary[1][1])
51
+ assert_equal("www.example.jp", ary[2][1])
52
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[0][2])
53
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[1][2])
54
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[2][2])
55
+
56
+ name = OpenSSL::X509::Name.new(dn, @obj_type_tmpl)
57
+ ary = name.to_a
58
+ assert_equal("/C=JP/O=example/CN=www.example.jp", name.to_s)
59
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[0][2])
60
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[1][2])
61
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[2][2])
62
+
63
+ dn = [
64
+ ["countryName", "JP", OpenSSL::ASN1::PRINTABLESTRING],
65
+ ["organizationName", "example", OpenSSL::ASN1::PRINTABLESTRING],
66
+ ["commonName", "www.example.jp", OpenSSL::ASN1::PRINTABLESTRING]
67
+ ]
68
+ name = OpenSSL::X509::Name.new(dn)
69
+ ary = name.to_a
70
+ assert_equal("/C=JP/O=example/CN=www.example.jp", name.to_s)
71
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[0][2])
72
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[1][2])
73
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[2][2])
74
+
75
+ dn = [
76
+ ["DC", "org"],
77
+ ["DC", "ruby-lang"],
78
+ ["CN", "GOTOU Yuuzou"],
79
+ ["emailAddress", "gotoyuzo@ruby-lang.org"],
80
+ ["serialNumber", "123"],
81
+ ]
82
+ name = OpenSSL::X509::Name.new(dn)
83
+ ary = name.to_a
84
+ assert_equal("/DC=org/DC=ruby-lang/CN=GOTOU Yuuzou/emailAddress=gotoyuzo@ruby-lang.org/serialNumber=123", name.to_s)
85
+ assert_equal("DC", ary[0][0])
86
+ assert_equal("DC", ary[1][0])
87
+ assert_equal("CN", ary[2][0])
88
+ assert_equal("emailAddress", ary[3][0])
89
+ assert_equal("serialNumber", ary[4][0])
90
+ assert_equal("org", ary[0][1])
91
+ assert_equal("ruby-lang", ary[1][1])
92
+ assert_equal("GOTOU Yuuzou", ary[2][1])
93
+ assert_equal("gotoyuzo@ruby-lang.org", ary[3][1])
94
+ assert_equal("123", ary[4][1])
95
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[0][2])
96
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[1][2])
97
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[2][2])
98
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[3][2])
99
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[4][2])
100
+
101
+ name_from_der = OpenSSL::X509::Name.new(name.to_der)
102
+ assert_equal(name_from_der.to_s, name.to_s)
103
+ assert_equal(name_from_der.to_a, name.to_a)
104
+ assert_equal(name_from_der.to_der, name.to_der)
105
+ end
106
+
107
+ def test_s_parse
108
+ dn = "/DC=org/DC=ruby-lang/CN=www.ruby-lang.org"
109
+ name = OpenSSL::X509::Name.parse(dn)
110
+ assert_equal(dn, name.to_s)
111
+ ary = name.to_a
112
+ assert_equal("DC", ary[0][0])
113
+ assert_equal("DC", ary[1][0])
114
+ assert_equal("CN", ary[2][0])
115
+ assert_equal("org", ary[0][1])
116
+ assert_equal("ruby-lang", ary[1][1])
117
+ assert_equal("www.ruby-lang.org", ary[2][1])
118
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[0][2])
119
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[1][2])
120
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[2][2])
121
+
122
+ dn2 = "DC=org, DC=ruby-lang, CN=www.ruby-lang.org"
123
+ name = OpenSSL::X509::Name.parse(dn)
124
+ ary = name.to_a
125
+ assert_equal(dn, name.to_s)
126
+ assert_equal("org", ary[0][1])
127
+ assert_equal("ruby-lang", ary[1][1])
128
+ assert_equal("www.ruby-lang.org", ary[2][1])
129
+
130
+ name = OpenSSL::X509::Name.parse(dn, @obj_type_tmpl)
131
+ ary = name.to_a
132
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[0][2])
133
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[1][2])
134
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[2][2])
135
+ end
136
+
137
+ def test_s_parse_rfc2253
138
+ scanner = OpenSSL::X509::Name::RFC2253DN.method(:scan)
139
+ assert_equal([["C", "JP"]], scanner.call("C=JP"))
140
+ assert_equal([
141
+ ["DC", "org"],
142
+ ["DC", "ruby-lang"],
143
+ ["CN", "GOTOU Yuuzou"],
144
+ ["emailAddress", "gotoyuzo@ruby-lang.org"],
145
+ ],
146
+ scanner.call(
147
+ "emailAddress=gotoyuzo@ruby-lang.org,CN=GOTOU Yuuzou,"+
148
+ "DC=ruby-lang,DC=org")
149
+ )
150
+
151
+ u8 = OpenSSL::ASN1::UTF8STRING
152
+ assert_equal([
153
+ ["DC", "org"],
154
+ ["DC", "ruby-lang"],
155
+ ["O", ",=+<>#;"],
156
+ ["O", ",=+<>#;"],
157
+ ["OU", ""],
158
+ ["OU", ""],
159
+ ["L", "aaa=\"bbb, ccc\""],
160
+ ["L", "aaa=\"bbb, ccc\""],
161
+ ["CN", "\345\276\214\350\227\244\350\243\225\350\224\265"],
162
+ ["CN", "\345\276\214\350\227\244\350\243\225\350\224\265"],
163
+ ["CN", "\345\276\214\350\227\244\350\243\225\350\224\265"],
164
+ ["CN", "\345\276\214\350\227\244\350\243\225\350\224\265", u8],
165
+ ["2.5.4.3", "GOTOU, Yuuzou"],
166
+ ["2.5.4.3", "GOTOU, Yuuzou"],
167
+ ["2.5.4.3", "GOTOU, Yuuzou"],
168
+ ["2.5.4.3", "GOTOU, Yuuzou"],
169
+ ["CN", "GOTOU \"gotoyuzo\" Yuuzou"],
170
+ ["CN", "GOTOU \"gotoyuzo\" Yuuzou"],
171
+ ["1.2.840.113549.1.9.1", "gotoyuzo@ruby-lang.org"],
172
+ ["emailAddress", "gotoyuzo@ruby-lang.org"],
173
+ ],
174
+ scanner.call(
175
+ "emailAddress=gotoyuzo@ruby-lang.org," +
176
+ "1.2.840.113549.1.9.1=gotoyuzo@ruby-lang.org," +
177
+ 'CN=GOTOU \"gotoyuzo\" Yuuzou,' +
178
+ 'CN="GOTOU \"gotoyuzo\" Yuuzou",' +
179
+ '2.5.4.3=GOTOU\,\20Yuuzou,' +
180
+ '2.5.4.3=GOTOU\, Yuuzou,' +
181
+ '2.5.4.3="GOTOU, Yuuzou",' +
182
+ '2.5.4.3="GOTOU\, Yuuzou",' +
183
+ "CN=#0C0CE5BE8CE897A4E8A395E894B5," +
184
+ 'CN=\E5\BE\8C\E8\97\A4\E8\A3\95\E8\94\B5,' +
185
+ "CN=\"\xE5\xBE\x8C\xE8\x97\xA4\xE8\xA3\x95\xE8\x94\xB5\"," +
186
+ "CN=\xE5\xBE\x8C\xE8\x97\xA4\xE8\xA3\x95\xE8\x94\xB5," +
187
+ 'L=aaa\=\"bbb\, ccc\",' +
188
+ 'L="aaa=\"bbb, ccc\"",' +
189
+ 'OU=,' +
190
+ 'OU="",' +
191
+ 'O=\,\=\+\<\>\#\;,' +
192
+ 'O=",=+<>#;",' +
193
+ "DC=ruby-lang," +
194
+ "DC=org")
195
+ )
196
+
197
+ [
198
+ "DC=org+DC=jp",
199
+ "DC=org,DC=ruby-lang+DC=rubyist,DC=www"
200
+ ].each{|dn|
201
+ ex = scanner.call(dn) rescue $!
202
+ dn_r = Regexp.escape(dn)
203
+ assert_match(/^multi-valued RDN is not supported: #{dn_r}/, ex.message)
204
+ }
205
+
206
+ [
207
+ ["DC=org,DC=exapmle,CN", "CN"],
208
+ ["DC=org,DC=example,", ""],
209
+ ["DC=org,DC=exapmle,CN=www.example.org;", "CN=www.example.org;"],
210
+ ["DC=org,DC=exapmle,CN=#www.example.org", "CN=#www.example.org"],
211
+ ["DC=org,DC=exapmle,CN=#777777.example.org", "CN=#777777.example.org"],
212
+ ["DC=org,DC=exapmle,CN=\"www.example\".org", "CN=\"www.example\".org"],
213
+ ["DC=org,DC=exapmle,CN=www.\"example.org\"", "CN=www.\"example.org\""],
214
+ ["DC=org,DC=exapmle,CN=www.\"example\".org", "CN=www.\"example\".org"],
215
+ ].each{|dn, msg|
216
+ ex = scanner.call(dn) rescue $!
217
+ assert_match(/^malformed RDN: .*=>#{Regexp.escape(msg)}/, ex.message)
218
+ }
219
+
220
+ dn = "CN=www.ruby-lang.org,DC=ruby-lang,DC=org"
221
+ name = OpenSSL::X509::Name.parse_rfc2253(dn)
222
+ assert_equal(dn, name.to_s(OpenSSL::X509::Name::RFC2253))
223
+ ary = name.to_a
224
+ assert_equal("DC", ary[0][0])
225
+ assert_equal("DC", ary[1][0])
226
+ assert_equal("CN", ary[2][0])
227
+ assert_equal("org", ary[0][1])
228
+ assert_equal("ruby-lang", ary[1][1])
229
+ assert_equal("www.ruby-lang.org", ary[2][1])
230
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[0][2])
231
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[1][2])
232
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[2][2])
233
+ end
234
+
235
+ def test_add_entry
236
+ dn = [
237
+ ["DC", "org"],
238
+ ["DC", "ruby-lang"],
239
+ ["CN", "GOTOU Yuuzou"],
240
+ ["emailAddress", "gotoyuzo@ruby-lang.org"],
241
+ ["serialNumber", "123"],
242
+ ]
243
+ name = OpenSSL::X509::Name.new
244
+ dn.each{|attr| name.add_entry(*attr) }
245
+ ary = name.to_a
246
+ assert_equal("/DC=org/DC=ruby-lang/CN=GOTOU Yuuzou/emailAddress=gotoyuzo@ruby-lang.org/serialNumber=123", name.to_s)
247
+ assert_equal("DC", ary[0][0])
248
+ assert_equal("DC", ary[1][0])
249
+ assert_equal("CN", ary[2][0])
250
+ assert_equal("emailAddress", ary[3][0])
251
+ assert_equal("serialNumber", ary[4][0])
252
+ assert_equal("org", ary[0][1])
253
+ assert_equal("ruby-lang", ary[1][1])
254
+ assert_equal("GOTOU Yuuzou", ary[2][1])
255
+ assert_equal("gotoyuzo@ruby-lang.org", ary[3][1])
256
+ assert_equal("123", ary[4][1])
257
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[0][2])
258
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[1][2])
259
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[2][2])
260
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[3][2])
261
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[4][2])
262
+ end
263
+ end
264
+
265
+ end
data/test/openssl/test_x509req.rb ADDED
@@ -0,0 +1,140 @@
1
+ begin
2
+ require "openssl"
3
+ require File.join(File.dirname(__FILE__), "utils.rb")
4
+ rescue LoadError
5
+ end
6
+ require "test/unit"
7
+
8
+ if defined?(OpenSSL)
9
+
10
+ class OpenSSL::TestX509Request < Test::Unit::TestCase
11
+ def setup
12
+ @rsa1024 = OpenSSL::TestUtils::TEST_KEY_RSA1024
13
+ @rsa2048 = OpenSSL::TestUtils::TEST_KEY_RSA2048
14
+ @dsa256 = OpenSSL::TestUtils::TEST_KEY_DSA256
15
+ @dsa512 = OpenSSL::TestUtils::TEST_KEY_DSA512
16
+ @dn = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=GOTOU Yuuzou")
17
+ end
18
+
19
+ def issue_csr(ver, dn, key, digest)
20
+ req = OpenSSL::X509::Request.new
21
+ req.version = ver
22
+ req.subject = dn
23
+ req.public_key = key.public_key
24
+ req.sign(key, digest)
25
+ req
26
+ end
27
+
28
+ def test_public_key
29
+ req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
30
+ assert_equal(@rsa1024.public_key.to_der, req.public_key.to_der)
31
+ req = OpenSSL::X509::Request.new(req.to_der)
32
+ assert_equal(@rsa1024.public_key.to_der, req.public_key.to_der)
33
+
34
+ req = issue_csr(0, @dn, @dsa512, OpenSSL::Digest::DSS1.new)
35
+ assert_equal(@dsa512.public_key.to_der, req.public_key.to_der)
36
+ req = OpenSSL::X509::Request.new(req.to_der)
37
+ assert_equal(@dsa512.public_key.to_der, req.public_key.to_der)
38
+ end
39
+
40
+ def test_version
41
+ req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
42
+ assert_equal(0, req.version)
43
+ req = OpenSSL::X509::Request.new(req.to_der)
44
+ assert_equal(0, req.version)
45
+
46
+ req = issue_csr(1, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
47
+ assert_equal(1, req.version)
48
+ req = OpenSSL::X509::Request.new(req.to_der)
49
+ assert_equal(1, req.version)
50
+ end
51
+
52
+ def test_subject
53
+ req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
54
+ assert_equal(@dn.to_der, req.subject.to_der)
55
+ req = OpenSSL::X509::Request.new(req.to_der)
56
+ assert_equal(@dn.to_der, req.subject.to_der)
57
+ end
58
+
59
+ def create_ext_req(exts)
60
+ ef = OpenSSL::X509::ExtensionFactory.new
61
+ exts = exts.collect{|e| ef.create_extension(*e) }
62
+ return OpenSSL::ASN1::Set([OpenSSL::ASN1::Sequence(exts)])
63
+ end
64
+
65
+ def get_ext_req(ext_req_value)
66
+ set = OpenSSL::ASN1.decode(ext_req_value)
67
+ seq = set.value[0]
68
+ seq.value.collect{|asn1ext|
69
+ OpenSSL::X509::Extension.new(asn1ext).to_a
70
+ }
71
+ end
72
+
73
+ def test_attr
74
+ exts = [
75
+ ["keyUsage", "Digital Signature, Key Encipherment", true],
76
+ ["subjectAltName", "email:gotoyuzo@ruby-lang.org", false],
77
+ ]
78
+ attrval = create_ext_req(exts)
79
+ attrs = [
80
+ OpenSSL::X509::Attribute.new("extReq", attrval),
81
+ OpenSSL::X509::Attribute.new("msExtReq", attrval),
82
+ ]
83
+
84
+ req0 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
85
+ attrs.each{|attr| req0.add_attribute(attr) }
86
+ req1 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
87
+ req1.attributes = attrs
88
+ assert_equal(req0.to_der, req1.to_der)
89
+
90
+ attrs = req0.attributes
91
+ assert_equal(2, attrs.size)
92
+ assert_equal("extReq", attrs[0].oid)
93
+ assert_equal("msExtReq", attrs[1].oid)
94
+ assert_equal(exts, get_ext_req(attrs[0].value))
95
+ assert_equal(exts, get_ext_req(attrs[1].value))
96
+
97
+ req = OpenSSL::X509::Request.new(req0.to_der)
98
+ attrs = req.attributes
99
+ assert_equal(2, attrs.size)
100
+ assert_equal("extReq", attrs[0].oid)
101
+ assert_equal("msExtReq", attrs[1].oid)
102
+ assert_equal(exts, get_ext_req(attrs[0].value))
103
+ assert_equal(exts, get_ext_req(attrs[1].value))
104
+ end
105
+
106
+ def test_sign_and_verify
107
+ req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
108
+ assert_equal(true, req.verify(@rsa1024))
109
+ assert_equal(false, req.verify(@rsa2048))
110
+ assert_equal(false, req.verify(@dsa256))
111
+ assert_equal(false, req.verify(@dsa512))
112
+ req.version = 1
113
+ assert_equal(false, req.verify(@rsa1024))
114
+
115
+ req = issue_csr(0, @dn, @rsa2048, OpenSSL::Digest::MD5.new)
116
+ assert_equal(false, req.verify(@rsa1024))
117
+ assert_equal(true, req.verify(@rsa2048))
118
+ assert_equal(false, req.verify(@dsa256))
119
+ assert_equal(false, req.verify(@dsa512))
120
+ req.subject = OpenSSL::X509::Name.parse("/C=JP/CN=FooBar")
121
+ assert_equal(false, req.verify(@rsa2048))
122
+
123
+ req = issue_csr(0, @dn, @dsa512, OpenSSL::Digest::DSS1.new)
124
+ assert_equal(false, req.verify(@rsa1024))
125
+ assert_equal(false, req.verify(@rsa2048))
126
+ assert_equal(false, req.verify(@dsa256))
127
+ assert_equal(true, req.verify(@dsa512))
128
+ req.public_key = @rsa1024.public_key
129
+ assert_equal(false, req.verify(@dsa512))
130
+
131
+ assert_raise(OpenSSL::X509::RequestError){
132
+ issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::DSS1.new) }
133
+ assert_raise(OpenSSL::X509::RequestError){
134
+ issue_csr(0, @dn, @dsa512, OpenSSL::Digest::SHA1.new) }
135
+ assert_raise(OpenSSL::X509::RequestError){
136
+ issue_csr(0, @dn, @dsa512, OpenSSL::Digest::MD5.new) }
137
+ end
138
+ end
139
+
140
+ end
data/test/openssl/test_x509store.rb ADDED
@@ -0,0 +1,217 @@
1
+ begin
2
+ require "openssl"
3
+ require File.join(File.dirname(__FILE__), "utils.rb")
4
+ rescue LoadError
5
+ end
6
+ require "test/unit"
7
+
8
+ if defined?(OpenSSL)
9
+
10
+ class OpenSSL::TestX509Store < Test::Unit::TestCase
11
+ def setup
12
+ @rsa1024 = OpenSSL::TestUtils::TEST_KEY_RSA1024
13
+ @rsa2048 = OpenSSL::TestUtils::TEST_KEY_RSA2048
14
+ @dsa256 = OpenSSL::TestUtils::TEST_KEY_DSA256
15
+ @dsa512 = OpenSSL::TestUtils::TEST_KEY_DSA512
16
+ @ca1 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=CA1")
17
+ @ca2 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=CA2")
18
+ @ee1 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=EE1")
19
+ @ee2 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=EE2")
20
+ end
21
+
22
+ def teardown
23
+ end
24
+
25
+ def issue_cert(*args)
26
+ OpenSSL::TestUtils.issue_cert(*args)
27
+ end
28
+
29
+ def issue_crl(*args)
30
+ OpenSSL::TestUtils.issue_crl(*args)
31
+ end
32
+
33
+ def test_verify
34
+ now = Time.at(Time.now.to_i)
35
+ ca_exts = [
36
+ ["basicConstraints","CA:TRUE",true],
37
+ ["keyUsage","cRLSign,keyCertSign",true],
38
+ ]
39
+ ee_exts = [
40
+ ["keyUsage","keyEncipherment,digitalSignature",true],
41
+ ]
42
+ ca1_cert = issue_cert(@ca1, @rsa2048, 1, now, now+3600, ca_exts,
43
+ nil, nil, OpenSSL::Digest::SHA1.new)
44
+ ca2_cert = issue_cert(@ca2, @rsa1024, 2, now, now+1800, ca_exts,
45
+ ca1_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
46
+ ee1_cert = issue_cert(@ee1, @dsa256, 10, now, now+1800, ee_exts,
47
+ ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
48
+ ee2_cert = issue_cert(@ee2, @dsa512, 20, now, now+1800, ee_exts,
49
+ ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
50
+ ee3_cert = issue_cert(@ee2, @dsa512, 30, now-100, now-1, ee_exts,
51
+ ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
52
+ ee4_cert = issue_cert(@ee2, @dsa512, 40, now+1000, now+2000, ee_exts,
53
+ ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
54
+
55
+ revoke_info = []
56
+ crl1 = issue_crl(revoke_info, 1, now, now+1800, [],
57
+ ca1_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
58
+ revoke_info = [ [2, now, 1], ]
59
+ crl1_2 = issue_crl(revoke_info, 2, now, now+1800, [],
60
+ ca1_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
61
+ revoke_info = [ [20, now, 1], ]
62
+ crl2 = issue_crl(revoke_info, 1, now, now+1800, [],
63
+ ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
64
+ revoke_info = []
65
+ crl2_2 = issue_crl(revoke_info, 2, now-100, now-1, [],
66
+ ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
67
+
68
+ assert(true, ca1_cert.verify(ca1_cert.public_key)) # self signed
69
+ assert(true, ca2_cert.verify(ca1_cert.public_key)) # issued by ca1
70
+ assert(true, ee1_cert.verify(ca2_cert.public_key)) # issued by ca2
71
+ assert(true, ee2_cert.verify(ca2_cert.public_key)) # issued by ca2
72
+ assert(true, ee3_cert.verify(ca2_cert.public_key)) # issued by ca2
73
+ assert(true, crl1.verify(ca1_cert.public_key)) # issued by ca1
74
+ assert(true, crl1_2.verify(ca1_cert.public_key)) # issued by ca1
75
+ assert(true, crl2.verify(ca2_cert.public_key)) # issued by ca2
76
+ assert(true, crl2_2.verify(ca2_cert.public_key)) # issued by ca2
77
+
78
+ store = OpenSSL::X509::Store.new
79
+ assert_equal(false, store.verify(ca1_cert))
80
+ assert_not_equal(OpenSSL::X509::V_OK, store.error)
81
+
82
+ assert_equal(false, store.verify(ca2_cert))
83
+ assert_not_equal(OpenSSL::X509::V_OK, store.error)
84
+
85
+ store.add_cert(ca1_cert)
86
+ assert_equal(true, store.verify(ca2_cert))
87
+ assert_equal(OpenSSL::X509::V_OK, store.error)
88
+ assert_equal("ok", store.error_string)
89
+ chain = store.chain
90
+ assert_equal(2, chain.size)
91
+ assert_equal(@ca2.to_der, chain[0].subject.to_der)
92
+ assert_equal(@ca1.to_der, chain[1].subject.to_der)
93
+
94
+ store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
95
+ assert_equal(false, store.verify(ca2_cert))
96
+ assert_not_equal(OpenSSL::X509::V_OK, store.error)
97
+
98
+ store.purpose = OpenSSL::X509::PURPOSE_CRL_SIGN
99
+ assert_equal(true, store.verify(ca2_cert))
100
+ assert_equal(OpenSSL::X509::V_OK, store.error)
101
+ store.add_cert(ca2_cert)
102
+ store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
103
+ assert_equal(true, store.verify(ee1_cert))
104
+ assert_equal(true, store.verify(ee2_cert))
105
+ assert_equal(OpenSSL::X509::V_OK, store.error)
106
+ assert_equal("ok", store.error_string)
107
+ chain = store.chain
108
+ assert_equal(3, chain.size)
109
+ assert_equal(@ee2.to_der, chain[0].subject.to_der)
110
+ assert_equal(@ca2.to_der, chain[1].subject.to_der)
111
+ assert_equal(@ca1.to_der, chain[2].subject.to_der)
112
+ assert_equal(false, store.verify(ee3_cert))
113
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
114
+ assert_match(/expire/i, store.error_string)
115
+ assert_equal(false, store.verify(ee4_cert))
116
+ assert_equal(OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID, store.error)
117
+ assert_match(/not yet valid/i, store.error_string)
118
+
119
+ store = OpenSSL::X509::Store.new
120
+ store.add_cert(ca1_cert)
121
+ store.add_cert(ca2_cert)
122
+ store.time = now + 1500
123
+ assert_equal(true, store.verify(ca1_cert))
124
+ assert_equal(true, store.verify(ca2_cert))
125
+ assert_equal(true, store.verify(ee4_cert))
126
+ store.time = now + 1900
127
+ assert_equal(true, store.verify(ca1_cert))
128
+ assert_equal(false, store.verify(ca2_cert))
129
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
130
+ assert_equal(false, store.verify(ee4_cert))
131
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
132
+ store.time = now + 4000
133
+ assert_equal(false, store.verify(ee1_cert))
134
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
135
+ assert_equal(false, store.verify(ee4_cert))
136
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
137
+
138
+ # the underlying X509 struct caches the result of the last
139
+ # verification for signature and not-before. so the following code
140
+ # rebuilds new objects to avoid site effect.
141
+ store.time = Time.now - 4000
142
+ assert_equal(false, store.verify(OpenSSL::X509::Certificate.new(ca2_cert)))
143
+ assert_equal(OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID, store.error)
144
+ assert_equal(false, store.verify(OpenSSL::X509::Certificate.new(ee1_cert)))
145
+ assert_equal(OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID, store.error)
146
+
147
+ return unless defined?(OpenSSL::X509::V_FLAG_CRL_CHECK)
148
+
149
+ store = OpenSSL::X509::Store.new
150
+ store.purpose = OpenSSL::X509::PURPOSE_ANY
151
+ store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK
152
+ store.add_cert(ca1_cert)
153
+ store.add_crl(crl1) # revoke no cert
154
+ store.add_crl(crl2) # revoke ee2_cert
155
+ assert_equal(true, store.verify(ca1_cert))
156
+ assert_equal(true, store.verify(ca2_cert))
157
+ assert_equal(true, store.verify(ee1_cert, [ca2_cert]))
158
+ assert_equal(false, store.verify(ee2_cert, [ca2_cert]))
159
+
160
+ store = OpenSSL::X509::Store.new
161
+ store.purpose = OpenSSL::X509::PURPOSE_ANY
162
+ store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK
163
+ store.add_cert(ca1_cert)
164
+ store.add_crl(crl1_2) # revoke ca2_cert
165
+ store.add_crl(crl2) # revoke ee2_cert
166
+ assert_equal(true, store.verify(ca1_cert))
167
+ assert_equal(false, store.verify(ca2_cert))
168
+ assert_equal(true, store.verify(ee1_cert, [ca2_cert]),
169
+ "This test is expected to be success with OpenSSL 0.9.7c or later.")
170
+ assert_equal(false, store.verify(ee2_cert, [ca2_cert]))
171
+
172
+ store.flags =
173
+ OpenSSL::X509::V_FLAG_CRL_CHECK|OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
174
+ assert_equal(true, store.verify(ca1_cert))
175
+ assert_equal(false, store.verify(ca2_cert))
176
+ assert_equal(false, store.verify(ee1_cert, [ca2_cert]))
177
+ assert_equal(false, store.verify(ee2_cert, [ca2_cert]))
178
+
179
+ store = OpenSSL::X509::Store.new
180
+ store.purpose = OpenSSL::X509::PURPOSE_ANY
181
+ store.flags =
182
+ OpenSSL::X509::V_FLAG_CRL_CHECK|OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
183
+ store.add_cert(ca1_cert)
184
+ store.add_cert(ca2_cert)
185
+ store.add_crl(crl1)
186
+ store.add_crl(crl2_2) # issued by ca2 but expired.
187
+ assert_equal(true, store.verify(ca1_cert))
188
+ assert_equal(true, store.verify(ca2_cert))
189
+ assert_equal(false, store.verify(ee1_cert))
190
+ assert_equal(OpenSSL::X509::V_ERR_CRL_HAS_EXPIRED, store.error)
191
+ assert_equal(false, store.verify(ee2_cert))
192
+ end
193
+
194
+ def test_set_errors
195
+ now = Time.now
196
+ ca1_cert = issue_cert(@ca1, @rsa2048, 1, now, now+3600, [],
197
+ nil, nil, OpenSSL::Digest::SHA1.new)
198
+ store = OpenSSL::X509::Store.new
199
+ store.add_cert(ca1_cert)
200
+ assert_raises(OpenSSL::X509::StoreError){
201
+ store.add_cert(ca1_cert) # add same certificate twice
202
+ }
203
+
204
+ revoke_info = []
205
+ crl1 = issue_crl(revoke_info, 1, now, now+1800, [],
206
+ ca1_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
207
+ revoke_info = [ [2, now, 1], ]
208
+ crl2 = issue_crl(revoke_info, 2, now+1800, now+3600, [],
209
+ ca1_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
210
+ store.add_crl(crl1)
211
+ assert_raises(OpenSSL::X509::StoreError){
212
+ store.add_crl(crl2) # add CRL issued by same CA twice.
213
+ }
214
+ end
215
+ end
216
+
217
+ end