jruby-openssl 0.0.4 → 0.1

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.

This version of jruby-openssl might be problematic. Click here for more details.

Files changed (26) hide show
  1. data/History.txt +12 -0
  2. data/License.txt +30 -0
  3. data/README.txt +18 -0
  4. data/lib/jopenssl.jar +0 -0
  5. data/lib/jopenssl/version.rb +5 -0
  6. data/lib/openssl/dummy.rb +34 -0
  7. data/lib/openssl/dummyssl.rb +13 -0
  8. data/test/openssl/ssl_server.rb +81 -0
  9. data/test/openssl/test_asn1.rb +199 -0
  10. data/test/openssl/test_cipher.rb +151 -0
  11. data/test/openssl/test_digest.rb +88 -0
  12. data/test/openssl/test_hmac.rb +34 -0
  13. data/test/openssl/test_ns_spki.rb +69 -0
  14. data/test/openssl/test_pair.rb +149 -0
  15. data/test/openssl/test_pkey_rsa.rb +49 -0
  16. data/test/openssl/test_ssl.rb +284 -0
  17. data/test/openssl/test_x509cert.rb +174 -0
  18. data/test/openssl/test_x509crl.rb +218 -0
  19. data/test/openssl/test_x509ext.rb +74 -0
  20. data/test/openssl/test_x509name.rb +265 -0
  21. data/test/openssl/test_x509req.rb +140 -0
  22. data/test/openssl/test_x509store.rb +217 -0
  23. data/test/openssl/utils.rb +135 -0
  24. data/test/test_openssl.rb +21 -0
  25. data/test/ut_eof.rb +128 -0
  26. metadata +69 -33
data/test/openssl/test_x509name.rb ADDED
@@ -0,0 +1,265 @@
1
+ begin
2
+ require "openssl"
3
+ rescue LoadError
4
+ end
5
+ require "test/unit"
6
+
7
+ if defined?(OpenSSL)
8
+
9
+ class OpenSSL::TestX509Name < Test::Unit::TestCase
10
+ OpenSSL::ASN1::ObjectId.register(
11
+ "1.2.840.113549.1.9.1", "emailAddress", "emailAddress")
12
+ OpenSSL::ASN1::ObjectId.register(
13
+ "2.5.4.5", "serialNumber", "serialNumber")
14
+
15
+ def setup
16
+ @obj_type_tmpl = Hash.new(OpenSSL::ASN1::PRINTABLESTRING)
17
+ @obj_type_tmpl.update(OpenSSL::X509::Name::OBJECT_TYPE_TEMPLATE)
18
+ end
19
+
20
+ def teardown
21
+ end
22
+
23
+ def test_s_new
24
+ dn = [ ["C", "JP"], ["O", "example"], ["CN", "www.example.jp"] ]
25
+ name = OpenSSL::X509::Name.new(dn)
26
+ ary = name.to_a
27
+ assert_equal("/C=JP/O=example/CN=www.example.jp", name.to_s)
28
+ assert_equal("C", ary[0][0])
29
+ assert_equal("O", ary[1][0])
30
+ assert_equal("CN", ary[2][0])
31
+ assert_equal("JP", ary[0][1])
32
+ assert_equal("example", ary[1][1])
33
+ assert_equal("www.example.jp", ary[2][1])
34
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[0][2])
35
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[1][2])
36
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[2][2])
37
+
38
+ dn = [
39
+ ["countryName", "JP"],
40
+ ["organizationName", "example"],
41
+ ["commonName", "www.example.jp"]
42
+ ]
43
+ name = OpenSSL::X509::Name.new(dn)
44
+ ary = name.to_a
45
+ assert_equal("/C=JP/O=example/CN=www.example.jp", name.to_s)
46
+ assert_equal("C", ary[0][0])
47
+ assert_equal("O", ary[1][0])
48
+ assert_equal("CN", ary[2][0])
49
+ assert_equal("JP", ary[0][1])
50
+ assert_equal("example", ary[1][1])
51
+ assert_equal("www.example.jp", ary[2][1])
52
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[0][2])
53
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[1][2])
54
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[2][2])
55
+
56
+ name = OpenSSL::X509::Name.new(dn, @obj_type_tmpl)
57
+ ary = name.to_a
58
+ assert_equal("/C=JP/O=example/CN=www.example.jp", name.to_s)
59
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[0][2])
60
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[1][2])
61
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[2][2])
62
+
63
+ dn = [
64
+ ["countryName", "JP", OpenSSL::ASN1::PRINTABLESTRING],
65
+ ["organizationName", "example", OpenSSL::ASN1::PRINTABLESTRING],
66
+ ["commonName", "www.example.jp", OpenSSL::ASN1::PRINTABLESTRING]
67
+ ]
68
+ name = OpenSSL::X509::Name.new(dn)
69
+ ary = name.to_a
70
+ assert_equal("/C=JP/O=example/CN=www.example.jp", name.to_s)
71
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[0][2])
72
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[1][2])
73
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[2][2])
74
+
75
+ dn = [
76
+ ["DC", "org"],
77
+ ["DC", "ruby-lang"],
78
+ ["CN", "GOTOU Yuuzou"],
79
+ ["emailAddress", "gotoyuzo@ruby-lang.org"],
80
+ ["serialNumber", "123"],
81
+ ]
82
+ name = OpenSSL::X509::Name.new(dn)
83
+ ary = name.to_a
84
+ assert_equal("/DC=org/DC=ruby-lang/CN=GOTOU Yuuzou/emailAddress=gotoyuzo@ruby-lang.org/serialNumber=123", name.to_s)
85
+ assert_equal("DC", ary[0][0])
86
+ assert_equal("DC", ary[1][0])
87
+ assert_equal("CN", ary[2][0])
88
+ assert_equal("emailAddress", ary[3][0])
89
+ assert_equal("serialNumber", ary[4][0])
90
+ assert_equal("org", ary[0][1])
91
+ assert_equal("ruby-lang", ary[1][1])
92
+ assert_equal("GOTOU Yuuzou", ary[2][1])
93
+ assert_equal("gotoyuzo@ruby-lang.org", ary[3][1])
94
+ assert_equal("123", ary[4][1])
95
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[0][2])
96
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[1][2])
97
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[2][2])
98
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[3][2])
99
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[4][2])
100
+
101
+ name_from_der = OpenSSL::X509::Name.new(name.to_der)
102
+ assert_equal(name_from_der.to_s, name.to_s)
103
+ assert_equal(name_from_der.to_a, name.to_a)
104
+ assert_equal(name_from_der.to_der, name.to_der)
105
+ end
106
+
107
+ def test_s_parse
108
+ dn = "/DC=org/DC=ruby-lang/CN=www.ruby-lang.org"
109
+ name = OpenSSL::X509::Name.parse(dn)
110
+ assert_equal(dn, name.to_s)
111
+ ary = name.to_a
112
+ assert_equal("DC", ary[0][0])
113
+ assert_equal("DC", ary[1][0])
114
+ assert_equal("CN", ary[2][0])
115
+ assert_equal("org", ary[0][1])
116
+ assert_equal("ruby-lang", ary[1][1])
117
+ assert_equal("www.ruby-lang.org", ary[2][1])
118
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[0][2])
119
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[1][2])
120
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[2][2])
121
+
122
+ dn2 = "DC=org, DC=ruby-lang, CN=www.ruby-lang.org"
123
+ name = OpenSSL::X509::Name.parse(dn)
124
+ ary = name.to_a
125
+ assert_equal(dn, name.to_s)
126
+ assert_equal("org", ary[0][1])
127
+ assert_equal("ruby-lang", ary[1][1])
128
+ assert_equal("www.ruby-lang.org", ary[2][1])
129
+
130
+ name = OpenSSL::X509::Name.parse(dn, @obj_type_tmpl)
131
+ ary = name.to_a
132
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[0][2])
133
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[1][2])
134
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[2][2])
135
+ end
136
+
137
+ def test_s_parse_rfc2253
138
+ scanner = OpenSSL::X509::Name::RFC2253DN.method(:scan)
139
+ assert_equal([["C", "JP"]], scanner.call("C=JP"))
140
+ assert_equal([
141
+ ["DC", "org"],
142
+ ["DC", "ruby-lang"],
143
+ ["CN", "GOTOU Yuuzou"],
144
+ ["emailAddress", "gotoyuzo@ruby-lang.org"],
145
+ ],
146
+ scanner.call(
147
+ "emailAddress=gotoyuzo@ruby-lang.org,CN=GOTOU Yuuzou,"+
148
+ "DC=ruby-lang,DC=org")
149
+ )
150
+
151
+ u8 = OpenSSL::ASN1::UTF8STRING
152
+ assert_equal([
153
+ ["DC", "org"],
154
+ ["DC", "ruby-lang"],
155
+ ["O", ",=+<>#;"],
156
+ ["O", ",=+<>#;"],
157
+ ["OU", ""],
158
+ ["OU", ""],
159
+ ["L", "aaa=\"bbb, ccc\""],
160
+ ["L", "aaa=\"bbb, ccc\""],
161
+ ["CN", "\345\276\214\350\227\244\350\243\225\350\224\265"],
162
+ ["CN", "\345\276\214\350\227\244\350\243\225\350\224\265"],
163
+ ["CN", "\345\276\214\350\227\244\350\243\225\350\224\265"],
164
+ ["CN", "\345\276\214\350\227\244\350\243\225\350\224\265", u8],
165
+ ["2.5.4.3", "GOTOU, Yuuzou"],
166
+ ["2.5.4.3", "GOTOU, Yuuzou"],
167
+ ["2.5.4.3", "GOTOU, Yuuzou"],
168
+ ["2.5.4.3", "GOTOU, Yuuzou"],
169
+ ["CN", "GOTOU \"gotoyuzo\" Yuuzou"],
170
+ ["CN", "GOTOU \"gotoyuzo\" Yuuzou"],
171
+ ["1.2.840.113549.1.9.1", "gotoyuzo@ruby-lang.org"],
172
+ ["emailAddress", "gotoyuzo@ruby-lang.org"],
173
+ ],
174
+ scanner.call(
175
+ "emailAddress=gotoyuzo@ruby-lang.org," +
176
+ "1.2.840.113549.1.9.1=gotoyuzo@ruby-lang.org," +
177
+ 'CN=GOTOU \"gotoyuzo\" Yuuzou,' +
178
+ 'CN="GOTOU \"gotoyuzo\" Yuuzou",' +
179
+ '2.5.4.3=GOTOU\,\20Yuuzou,' +
180
+ '2.5.4.3=GOTOU\, Yuuzou,' +
181
+ '2.5.4.3="GOTOU, Yuuzou",' +
182
+ '2.5.4.3="GOTOU\, Yuuzou",' +
183
+ "CN=#0C0CE5BE8CE897A4E8A395E894B5," +
184
+ 'CN=\E5\BE\8C\E8\97\A4\E8\A3\95\E8\94\B5,' +
185
+ "CN=\"\xE5\xBE\x8C\xE8\x97\xA4\xE8\xA3\x95\xE8\x94\xB5\"," +
186
+ "CN=\xE5\xBE\x8C\xE8\x97\xA4\xE8\xA3\x95\xE8\x94\xB5," +
187
+ 'L=aaa\=\"bbb\, ccc\",' +
188
+ 'L="aaa=\"bbb, ccc\"",' +
189
+ 'OU=,' +
190
+ 'OU="",' +
191
+ 'O=\,\=\+\<\>\#\;,' +
192
+ 'O=",=+<>#;",' +
193
+ "DC=ruby-lang," +
194
+ "DC=org")
195
+ )
196
+
197
+ [
198
+ "DC=org+DC=jp",
199
+ "DC=org,DC=ruby-lang+DC=rubyist,DC=www"
200
+ ].each{|dn|
201
+ ex = scanner.call(dn) rescue $!
202
+ dn_r = Regexp.escape(dn)
203
+ assert_match(/^multi-valued RDN is not supported: #{dn_r}/, ex.message)
204
+ }
205
+
206
+ [
207
+ ["DC=org,DC=exapmle,CN", "CN"],
208
+ ["DC=org,DC=example,", ""],
209
+ ["DC=org,DC=exapmle,CN=www.example.org;", "CN=www.example.org;"],
210
+ ["DC=org,DC=exapmle,CN=#www.example.org", "CN=#www.example.org"],
211
+ ["DC=org,DC=exapmle,CN=#777777.example.org", "CN=#777777.example.org"],
212
+ ["DC=org,DC=exapmle,CN=\"www.example\".org", "CN=\"www.example\".org"],
213
+ ["DC=org,DC=exapmle,CN=www.\"example.org\"", "CN=www.\"example.org\""],
214
+ ["DC=org,DC=exapmle,CN=www.\"example\".org", "CN=www.\"example\".org"],
215
+ ].each{|dn, msg|
216
+ ex = scanner.call(dn) rescue $!
217
+ assert_match(/^malformed RDN: .*=>#{Regexp.escape(msg)}/, ex.message)
218
+ }
219
+
220
+ dn = "CN=www.ruby-lang.org,DC=ruby-lang,DC=org"
221
+ name = OpenSSL::X509::Name.parse_rfc2253(dn)
222
+ assert_equal(dn, name.to_s(OpenSSL::X509::Name::RFC2253))
223
+ ary = name.to_a
224
+ assert_equal("DC", ary[0][0])
225
+ assert_equal("DC", ary[1][0])
226
+ assert_equal("CN", ary[2][0])
227
+ assert_equal("org", ary[0][1])
228
+ assert_equal("ruby-lang", ary[1][1])
229
+ assert_equal("www.ruby-lang.org", ary[2][1])
230
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[0][2])
231
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[1][2])
232
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[2][2])
233
+ end
234
+
235
+ def test_add_entry
236
+ dn = [
237
+ ["DC", "org"],
238
+ ["DC", "ruby-lang"],
239
+ ["CN", "GOTOU Yuuzou"],
240
+ ["emailAddress", "gotoyuzo@ruby-lang.org"],
241
+ ["serialNumber", "123"],
242
+ ]
243
+ name = OpenSSL::X509::Name.new
244
+ dn.each{|attr| name.add_entry(*attr) }
245
+ ary = name.to_a
246
+ assert_equal("/DC=org/DC=ruby-lang/CN=GOTOU Yuuzou/emailAddress=gotoyuzo@ruby-lang.org/serialNumber=123", name.to_s)
247
+ assert_equal("DC", ary[0][0])
248
+ assert_equal("DC", ary[1][0])
249
+ assert_equal("CN", ary[2][0])
250
+ assert_equal("emailAddress", ary[3][0])
251
+ assert_equal("serialNumber", ary[4][0])
252
+ assert_equal("org", ary[0][1])
253
+ assert_equal("ruby-lang", ary[1][1])
254
+ assert_equal("GOTOU Yuuzou", ary[2][1])
255
+ assert_equal("gotoyuzo@ruby-lang.org", ary[3][1])
256
+ assert_equal("123", ary[4][1])
257
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[0][2])
258
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[1][2])
259
+ assert_equal(OpenSSL::ASN1::UTF8STRING, ary[2][2])
260
+ assert_equal(OpenSSL::ASN1::IA5STRING, ary[3][2])
261
+ assert_equal(OpenSSL::ASN1::PRINTABLESTRING, ary[4][2])
262
+ end
263
+ end
264
+
265
+ end
data/test/openssl/test_x509req.rb ADDED
@@ -0,0 +1,140 @@
1
+ begin
2
+ require "openssl"
3
+ require File.join(File.dirname(__FILE__), "utils.rb")
4
+ rescue LoadError
5
+ end
6
+ require "test/unit"
7
+
8
+ if defined?(OpenSSL)
9
+
10
+ class OpenSSL::TestX509Request < Test::Unit::TestCase
11
+ def setup
12
+ @rsa1024 = OpenSSL::TestUtils::TEST_KEY_RSA1024
13
+ @rsa2048 = OpenSSL::TestUtils::TEST_KEY_RSA2048
14
+ @dsa256 = OpenSSL::TestUtils::TEST_KEY_DSA256
15
+ @dsa512 = OpenSSL::TestUtils::TEST_KEY_DSA512
16
+ @dn = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=GOTOU Yuuzou")
17
+ end
18
+
19
+ def issue_csr(ver, dn, key, digest)
20
+ req = OpenSSL::X509::Request.new
21
+ req.version = ver
22
+ req.subject = dn
23
+ req.public_key = key.public_key
24
+ req.sign(key, digest)
25
+ req
26
+ end
27
+
28
+ def test_public_key
29
+ req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
30
+ assert_equal(@rsa1024.public_key.to_der, req.public_key.to_der)
31
+ req = OpenSSL::X509::Request.new(req.to_der)
32
+ assert_equal(@rsa1024.public_key.to_der, req.public_key.to_der)
33
+
34
+ req = issue_csr(0, @dn, @dsa512, OpenSSL::Digest::DSS1.new)
35
+ assert_equal(@dsa512.public_key.to_der, req.public_key.to_der)
36
+ req = OpenSSL::X509::Request.new(req.to_der)
37
+ assert_equal(@dsa512.public_key.to_der, req.public_key.to_der)
38
+ end
39
+
40
+ def test_version
41
+ req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
42
+ assert_equal(0, req.version)
43
+ req = OpenSSL::X509::Request.new(req.to_der)
44
+ assert_equal(0, req.version)
45
+
46
+ req = issue_csr(1, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
47
+ assert_equal(1, req.version)
48
+ req = OpenSSL::X509::Request.new(req.to_der)
49
+ assert_equal(1, req.version)
50
+ end
51
+
52
+ def test_subject
53
+ req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
54
+ assert_equal(@dn.to_der, req.subject.to_der)
55
+ req = OpenSSL::X509::Request.new(req.to_der)
56
+ assert_equal(@dn.to_der, req.subject.to_der)
57
+ end
58
+
59
+ def create_ext_req(exts)
60
+ ef = OpenSSL::X509::ExtensionFactory.new
61
+ exts = exts.collect{|e| ef.create_extension(*e) }
62
+ return OpenSSL::ASN1::Set([OpenSSL::ASN1::Sequence(exts)])
63
+ end
64
+
65
+ def get_ext_req(ext_req_value)
66
+ set = OpenSSL::ASN1.decode(ext_req_value)
67
+ seq = set.value[0]
68
+ seq.value.collect{|asn1ext|
69
+ OpenSSL::X509::Extension.new(asn1ext).to_a
70
+ }
71
+ end
72
+
73
+ def test_attr
74
+ exts = [
75
+ ["keyUsage", "Digital Signature, Key Encipherment", true],
76
+ ["subjectAltName", "email:gotoyuzo@ruby-lang.org", false],
77
+ ]
78
+ attrval = create_ext_req(exts)
79
+ attrs = [
80
+ OpenSSL::X509::Attribute.new("extReq", attrval),
81
+ OpenSSL::X509::Attribute.new("msExtReq", attrval),
82
+ ]
83
+
84
+ req0 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
85
+ attrs.each{|attr| req0.add_attribute(attr) }
86
+ req1 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
87
+ req1.attributes = attrs
88
+ assert_equal(req0.to_der, req1.to_der)
89
+
90
+ attrs = req0.attributes
91
+ assert_equal(2, attrs.size)
92
+ assert_equal("extReq", attrs[0].oid)
93
+ assert_equal("msExtReq", attrs[1].oid)
94
+ assert_equal(exts, get_ext_req(attrs[0].value))
95
+ assert_equal(exts, get_ext_req(attrs[1].value))
96
+
97
+ req = OpenSSL::X509::Request.new(req0.to_der)
98
+ attrs = req.attributes
99
+ assert_equal(2, attrs.size)
100
+ assert_equal("extReq", attrs[0].oid)
101
+ assert_equal("msExtReq", attrs[1].oid)
102
+ assert_equal(exts, get_ext_req(attrs[0].value))
103
+ assert_equal(exts, get_ext_req(attrs[1].value))
104
+ end
105
+
106
+ def test_sign_and_verify
107
+ req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
108
+ assert_equal(true, req.verify(@rsa1024))
109
+ assert_equal(false, req.verify(@rsa2048))
110
+ assert_equal(false, req.verify(@dsa256))
111
+ assert_equal(false, req.verify(@dsa512))
112
+ req.version = 1
113
+ assert_equal(false, req.verify(@rsa1024))
114
+
115
+ req = issue_csr(0, @dn, @rsa2048, OpenSSL::Digest::MD5.new)
116
+ assert_equal(false, req.verify(@rsa1024))
117
+ assert_equal(true, req.verify(@rsa2048))
118
+ assert_equal(false, req.verify(@dsa256))
119
+ assert_equal(false, req.verify(@dsa512))
120
+ req.subject = OpenSSL::X509::Name.parse("/C=JP/CN=FooBar")
121
+ assert_equal(false, req.verify(@rsa2048))
122
+
123
+ req = issue_csr(0, @dn, @dsa512, OpenSSL::Digest::DSS1.new)
124
+ assert_equal(false, req.verify(@rsa1024))
125
+ assert_equal(false, req.verify(@rsa2048))
126
+ assert_equal(false, req.verify(@dsa256))
127
+ assert_equal(true, req.verify(@dsa512))
128
+ req.public_key = @rsa1024.public_key
129
+ assert_equal(false, req.verify(@dsa512))
130
+
131
+ assert_raise(OpenSSL::X509::RequestError){
132
+ issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::DSS1.new) }
133
+ assert_raise(OpenSSL::X509::RequestError){
134
+ issue_csr(0, @dn, @dsa512, OpenSSL::Digest::SHA1.new) }
135
+ assert_raise(OpenSSL::X509::RequestError){
136
+ issue_csr(0, @dn, @dsa512, OpenSSL::Digest::MD5.new) }
137
+ end
138
+ end
139
+
140
+ end
data/test/openssl/test_x509store.rb ADDED
@@ -0,0 +1,217 @@
1
+ begin
2
+ require "openssl"
3
+ require File.join(File.dirname(__FILE__), "utils.rb")
4
+ rescue LoadError
5
+ end
6
+ require "test/unit"
7
+
8
+ if defined?(OpenSSL)
9
+
10
+ class OpenSSL::TestX509Store < Test::Unit::TestCase
11
+ def setup
12
+ @rsa1024 = OpenSSL::TestUtils::TEST_KEY_RSA1024
13
+ @rsa2048 = OpenSSL::TestUtils::TEST_KEY_RSA2048
14
+ @dsa256 = OpenSSL::TestUtils::TEST_KEY_DSA256
15
+ @dsa512 = OpenSSL::TestUtils::TEST_KEY_DSA512
16
+ @ca1 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=CA1")
17
+ @ca2 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=CA2")
18
+ @ee1 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=EE1")
19
+ @ee2 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=EE2")
20
+ end
21
+
22
+ def teardown
23
+ end
24
+
25
+ def issue_cert(*args)
26
+ OpenSSL::TestUtils.issue_cert(*args)
27
+ end
28
+
29
+ def issue_crl(*args)
30
+ OpenSSL::TestUtils.issue_crl(*args)
31
+ end
32
+
33
+ def test_verify
34
+ now = Time.at(Time.now.to_i)
35
+ ca_exts = [
36
+ ["basicConstraints","CA:TRUE",true],
37
+ ["keyUsage","cRLSign,keyCertSign",true],
38
+ ]
39
+ ee_exts = [
40
+ ["keyUsage","keyEncipherment,digitalSignature",true],
41
+ ]
42
+ ca1_cert = issue_cert(@ca1, @rsa2048, 1, now, now+3600, ca_exts,
43
+ nil, nil, OpenSSL::Digest::SHA1.new)
44
+ ca2_cert = issue_cert(@ca2, @rsa1024, 2, now, now+1800, ca_exts,
45
+ ca1_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
46
+ ee1_cert = issue_cert(@ee1, @dsa256, 10, now, now+1800, ee_exts,
47
+ ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
48
+ ee2_cert = issue_cert(@ee2, @dsa512, 20, now, now+1800, ee_exts,
49
+ ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
50
+ ee3_cert = issue_cert(@ee2, @dsa512, 30, now-100, now-1, ee_exts,
51
+ ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
52
+ ee4_cert = issue_cert(@ee2, @dsa512, 40, now+1000, now+2000, ee_exts,
53
+ ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
54
+
55
+ revoke_info = []
56
+ crl1 = issue_crl(revoke_info, 1, now, now+1800, [],
57
+ ca1_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
58
+ revoke_info = [ [2, now, 1], ]
59
+ crl1_2 = issue_crl(revoke_info, 2, now, now+1800, [],
60
+ ca1_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
61
+ revoke_info = [ [20, now, 1], ]
62
+ crl2 = issue_crl(revoke_info, 1, now, now+1800, [],
63
+ ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
64
+ revoke_info = []
65
+ crl2_2 = issue_crl(revoke_info, 2, now-100, now-1, [],
66
+ ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
67
+
68
+ assert(true, ca1_cert.verify(ca1_cert.public_key)) # self signed
69
+ assert(true, ca2_cert.verify(ca1_cert.public_key)) # issued by ca1
70
+ assert(true, ee1_cert.verify(ca2_cert.public_key)) # issued by ca2
71
+ assert(true, ee2_cert.verify(ca2_cert.public_key)) # issued by ca2
72
+ assert(true, ee3_cert.verify(ca2_cert.public_key)) # issued by ca2
73
+ assert(true, crl1.verify(ca1_cert.public_key)) # issued by ca1
74
+ assert(true, crl1_2.verify(ca1_cert.public_key)) # issued by ca1
75
+ assert(true, crl2.verify(ca2_cert.public_key)) # issued by ca2
76
+ assert(true, crl2_2.verify(ca2_cert.public_key)) # issued by ca2
77
+
78
+ store = OpenSSL::X509::Store.new
79
+ assert_equal(false, store.verify(ca1_cert))
80
+ assert_not_equal(OpenSSL::X509::V_OK, store.error)
81
+
82
+ assert_equal(false, store.verify(ca2_cert))
83
+ assert_not_equal(OpenSSL::X509::V_OK, store.error)
84
+
85
+ store.add_cert(ca1_cert)
86
+ assert_equal(true, store.verify(ca2_cert))
87
+ assert_equal(OpenSSL::X509::V_OK, store.error)
88
+ assert_equal("ok", store.error_string)
89
+ chain = store.chain
90
+ assert_equal(2, chain.size)
91
+ assert_equal(@ca2.to_der, chain[0].subject.to_der)
92
+ assert_equal(@ca1.to_der, chain[1].subject.to_der)
93
+
94
+ store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
95
+ assert_equal(false, store.verify(ca2_cert))
96
+ assert_not_equal(OpenSSL::X509::V_OK, store.error)
97
+
98
+ store.purpose = OpenSSL::X509::PURPOSE_CRL_SIGN
99
+ assert_equal(true, store.verify(ca2_cert))
100
+ assert_equal(OpenSSL::X509::V_OK, store.error)
101
+ store.add_cert(ca2_cert)
102
+ store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
103
+ assert_equal(true, store.verify(ee1_cert))
104
+ assert_equal(true, store.verify(ee2_cert))
105
+ assert_equal(OpenSSL::X509::V_OK, store.error)
106
+ assert_equal("ok", store.error_string)
107
+ chain = store.chain
108
+ assert_equal(3, chain.size)
109
+ assert_equal(@ee2.to_der, chain[0].subject.to_der)
110
+ assert_equal(@ca2.to_der, chain[1].subject.to_der)
111
+ assert_equal(@ca1.to_der, chain[2].subject.to_der)
112
+ assert_equal(false, store.verify(ee3_cert))
113
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
114
+ assert_match(/expire/i, store.error_string)
115
+ assert_equal(false, store.verify(ee4_cert))
116
+ assert_equal(OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID, store.error)
117
+ assert_match(/not yet valid/i, store.error_string)
118
+
119
+ store = OpenSSL::X509::Store.new
120
+ store.add_cert(ca1_cert)
121
+ store.add_cert(ca2_cert)
122
+ store.time = now + 1500
123
+ assert_equal(true, store.verify(ca1_cert))
124
+ assert_equal(true, store.verify(ca2_cert))
125
+ assert_equal(true, store.verify(ee4_cert))
126
+ store.time = now + 1900
127
+ assert_equal(true, store.verify(ca1_cert))
128
+ assert_equal(false, store.verify(ca2_cert))
129
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
130
+ assert_equal(false, store.verify(ee4_cert))
131
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
132
+ store.time = now + 4000
133
+ assert_equal(false, store.verify(ee1_cert))
134
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
135
+ assert_equal(false, store.verify(ee4_cert))
136
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
137
+
138
+ # the underlying X509 struct caches the result of the last
139
+ # verification for signature and not-before. so the following code
140
+ # rebuilds new objects to avoid site effect.
141
+ store.time = Time.now - 4000
142
+ assert_equal(false, store.verify(OpenSSL::X509::Certificate.new(ca2_cert)))
143
+ assert_equal(OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID, store.error)
144
+ assert_equal(false, store.verify(OpenSSL::X509::Certificate.new(ee1_cert)))
145
+ assert_equal(OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID, store.error)
146
+
147
+ return unless defined?(OpenSSL::X509::V_FLAG_CRL_CHECK)
148
+
149
+ store = OpenSSL::X509::Store.new
150
+ store.purpose = OpenSSL::X509::PURPOSE_ANY
151
+ store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK
152
+ store.add_cert(ca1_cert)
153
+ store.add_crl(crl1) # revoke no cert
154
+ store.add_crl(crl2) # revoke ee2_cert
155
+ assert_equal(true, store.verify(ca1_cert))
156
+ assert_equal(true, store.verify(ca2_cert))
157
+ assert_equal(true, store.verify(ee1_cert, [ca2_cert]))
158
+ assert_equal(false, store.verify(ee2_cert, [ca2_cert]))
159
+
160
+ store = OpenSSL::X509::Store.new
161
+ store.purpose = OpenSSL::X509::PURPOSE_ANY
162
+ store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK
163
+ store.add_cert(ca1_cert)
164
+ store.add_crl(crl1_2) # revoke ca2_cert
165
+ store.add_crl(crl2) # revoke ee2_cert
166
+ assert_equal(true, store.verify(ca1_cert))
167
+ assert_equal(false, store.verify(ca2_cert))
168
+ assert_equal(true, store.verify(ee1_cert, [ca2_cert]),
169
+ "This test is expected to be success with OpenSSL 0.9.7c or later.")
170
+ assert_equal(false, store.verify(ee2_cert, [ca2_cert]))
171
+
172
+ store.flags =
173
+ OpenSSL::X509::V_FLAG_CRL_CHECK|OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
174
+ assert_equal(true, store.verify(ca1_cert))
175
+ assert_equal(false, store.verify(ca2_cert))
176
+ assert_equal(false, store.verify(ee1_cert, [ca2_cert]))
177
+ assert_equal(false, store.verify(ee2_cert, [ca2_cert]))
178
+
179
+ store = OpenSSL::X509::Store.new
180
+ store.purpose = OpenSSL::X509::PURPOSE_ANY
181
+ store.flags =
182
+ OpenSSL::X509::V_FLAG_CRL_CHECK|OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
183
+ store.add_cert(ca1_cert)
184
+ store.add_cert(ca2_cert)
185
+ store.add_crl(crl1)
186
+ store.add_crl(crl2_2) # issued by ca2 but expired.
187
+ assert_equal(true, store.verify(ca1_cert))
188
+ assert_equal(true, store.verify(ca2_cert))
189
+ assert_equal(false, store.verify(ee1_cert))
190
+ assert_equal(OpenSSL::X509::V_ERR_CRL_HAS_EXPIRED, store.error)
191
+ assert_equal(false, store.verify(ee2_cert))
192
+ end
193
+
194
+ def test_set_errors
195
+ now = Time.now
196
+ ca1_cert = issue_cert(@ca1, @rsa2048, 1, now, now+3600, [],
197
+ nil, nil, OpenSSL::Digest::SHA1.new)
198
+ store = OpenSSL::X509::Store.new
199
+ store.add_cert(ca1_cert)
200
+ assert_raises(OpenSSL::X509::StoreError){
201
+ store.add_cert(ca1_cert) # add same certificate twice
202
+ }
203
+
204
+ revoke_info = []
205
+ crl1 = issue_crl(revoke_info, 1, now, now+1800, [],
206
+ ca1_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
207
+ revoke_info = [ [2, now, 1], ]
208
+ crl2 = issue_crl(revoke_info, 2, now+1800, now+3600, [],
209
+ ca1_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
210
+ store.add_crl(crl1)
211
+ assert_raises(OpenSSL::X509::StoreError){
212
+ store.add_crl(crl2) # add CRL issued by same CA twice.
213
+ }
214
+ end
215
+ end
216
+
217
+ end