jruby-openssl 0.7.5.dev → 0.7.5

data/test/fixture/purpose/ca/ca_config.rb

@@ -11,7 +11,7 @@ class CAConfig
   CA_CERT_DAYS = 20 * 365
   CA_RSA_KEY_LENGTH = 2048
 
-  CERT_DAYS = 19 * 365
+  CERT_DAYS = 18 * 365
   CERT_KEY_LENGTH_MIN = 1024
   CERT_KEY_LENGTH_MAX = 2048
   CDP_LOCATION = nil

data/test/fixture/purpose/ca/gen_cert.rb

@@ -0,0 +1,128 @@
+#!/usr/bin/env ruby
+
+require 'openssl'
+require 'ca_config'
+require 'fileutils'
+require 'getopts'
+
+include OpenSSL
+
+def usage
+  myname = File::basename($0)
+  $stderr.puts "Usage: #{myname} [--type (client|server|ca|ocsp)] [--out certfile] csr_file"
+  exit
+end
+
+getopts nil, 'type:client', 'out:', 'force'
+
+cert_type = $OPT_type
+out_file = $OPT_out || 'cert.pem'
+csr_file = ARGV.shift or usage
+ARGV.empty? or usage
+
+csr = X509::Request.new(File.open(csr_file).read)
+unless csr.verify(csr.public_key)
+  raise "CSR sign verification failed."
+end
+p csr.public_key
+if csr.public_key.n.num_bits < CAConfig::CERT_KEY_LENGTH_MIN
+  raise "Key length too short"
+end
+if csr.public_key.n.num_bits > CAConfig::CERT_KEY_LENGTH_MAX
+  raise "Key length too long"
+end
+if csr.subject.to_a[0, CAConfig::NAME.size] != CAConfig::NAME
+  unless $OPT_force
+    p csr.subject.to_a
+    p CAConfig::NAME
+    raise "DN does not match"
+  end
+end
+
+# Only checks signature here.  You must verify CSR according to your CP/CPS.
+
+$stdout.sync = true
+
+# CA setup
+
+ca_file = CAConfig::CERT_FILE
+puts "Reading CA cert (from #{ca_file})"
+ca = X509::Certificate.new(File.read(ca_file))
+
+ca_keypair_file = CAConfig::KEYPAIR_FILE
+puts "Reading CA keypair (from #{ca_keypair_file})"
+ca_keypair = PKey::RSA.new(File.read(ca_keypair_file), &CAConfig::PASSWD_CB)
+
+serial = File.open(CAConfig::SERIAL_FILE, "r").read.chomp.hex
+File.open(CAConfig::SERIAL_FILE, "w") do |f|
+  f << sprintf("%04X", serial + 1)
+end
+
+# Generate new cert
+
+cert = X509::Certificate.new
+from = Time.now # + 30 * 60	# Wait 30 minutes.
+cert.subject = csr.subject
+cert.issuer = ca.subject
+cert.not_before = from
+cert.not_after = from + CAConfig::CERT_DAYS * 24 * 60 * 60
+cert.public_key = csr.public_key
+cert.serial = serial
+cert.version = 2 # X509v3
+
+basic_constraint = nil
+key_usage = []
+ext_key_usage = []
+case cert_type
+when "ca"
+  basic_constraint = "CA:TRUE"
+  key_usage << "cRLSign" << "keyCertSign"
+when "terminalsubca"
+  basic_constraint = "CA:TRUE,pathlen:0"
+  key_usage << "cRLSign" << "keyCertSign"
+when "server"
+  basic_constraint = "CA:FALSE"
+  #key_usage << "digitalSignature" << "keyEncipherment"
+  key_usage << "keyEncipherment"
+  ext_key_usage << "serverAuth"
+when "ocsp"
+  basic_constraint = "CA:FALSE"
+  key_usage << "nonRepudiation" << "digitalSignature"
+  ext_key_usage << "serverAuth" << "OCSPSigning"
+when "client"
+  basic_constraint = "CA:FALSE"
+  key_usage << "nonRepudiation" << "digitalSignature" << "keyEncipherment"
+  ext_key_usage << "clientAuth" << "emailProtection"
+else
+  raise "unknonw cert type \"#{cert_type}\" is specified."
+end
+
+ef = X509::ExtensionFactory.new
+ef.subject_certificate = cert
+ef.issuer_certificate = ca
+ex = []
+ex << ef.create_extension("basicConstraints", basic_constraint, true)
+ex << ef.create_extension("nsComment","Ruby/OpenSSL Generated Certificate")
+ex << ef.create_extension("subjectKeyIdentifier", "hash")
+#ex << ef.create_extension("nsCertType", "client,email")
+ex << ef.create_extension("keyUsage", key_usage.join(",")) unless key_usage.empty?
+#ex << ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always")
+#ex << ef.create_extension("authorityKeyIdentifier", "keyid:always")
+ex << ef.create_extension("extendedKeyUsage", ext_key_usage.join(",")) unless ext_key_usage.empty?
+
+ex << ef.create_extension("crlDistributionPoints", CAConfig::CDP_LOCATION) if CAConfig::CDP_LOCATION
+ex << ef.create_extension("authorityInfoAccess", "OCSP;" << CAConfig::OCSP_LOCATION) if CAConfig::OCSP_LOCATION
+cert.extensions = ex
+cert.sign(ca_keypair, OpenSSL::Digest::SHA1.new)
+
+# For backup
+
+cert_file = CAConfig::NEW_CERTS_DIR + "/#{cert.serial}_cert.pem"
+File.open(cert_file, "w", 0644) do |f|
+  f << cert.to_pem
+end
+
+puts "Writing cert.pem..."
+FileUtils.copy(cert_file, out_file)
+
+puts "DONE. (Generated certificate for '#{cert.subject}')"

data/test/fixture/purpose/ca/newcerts/4_cert.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDBjCCAe6gAwIBAgIBBDANBgkqhkiG9w0BAQUFADBMMQswCQYDVQQGEwJKUDEa
+MBgGA1UECgwRd3d3LnJ1YnktbGFuZy5vcmcxFDASBgNVBAsMC2RldmVsb3BtZW50
+MQswCQYDVQQDDAJDQTAeFw0xMTEyMTQwNDQxNTNaFw0yOTEyMDkwNDQxNTNaMD0x
+CzAJBgNVBAYTAkpQMRowGAYDVQQKDBF3d3cucnVieS1sYW5nLm9yZzESMBAGA1UE
+AwwJc3Nsc2VydmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDgYsazavfR
+a72yK4qfnIjOrDT9Uv2ToL4swbE86PXY5N+YvUig3fVmNJo72rT5JlAODs+MtJJU
+aJ8HsczlGdrhjTWyT/0fyoY/rC4mi5UFASBCbaoaviDPgbhI6ehBY6d5vEYQOW79
+fL95KIa+OyGzUNYy+EkSxJmvt/8EJYtqIwIDAQABo4GFMIGCMAwGA1UdEwEB/wQC
+MAAwMQYJYIZIAYb4QgENBCQWIlJ1YnkvT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlm
+aWNhdGUwHQYDVR0OBBYEFJsUyGU/R4muSKVIeckJElcBNbipMAsGA1UdDwQEAwIF
+IDATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQUFAAOCAQEArdmTvG5H
+elHkiHWp/yFdiIrbUHfDsAmB1jN7Zhte9yWzUuaVKR6GS6FzL4zU6dgAA3UNroVK
+MuyeL5Cejsck2+HgOvAtwTJFjP4c8YwdlYuycvMkk5EbaByY1h59ZvV1J+GxmoDA
+uO3iTqGrKwrFDK59yuxhdn1yyGTwYTBAdvllfSmTmfnbOkV/faF8gpRvrenx3lLK
+eAVhBCzAw2cblXKJEvly+wzAXykS6jagtrnHm5ilt2R5zPzS1wNJlzBq4laI+pZU
+timqb2wMA9TLd4FCKqK4HwiUKyAR7eknxtdskQ0/2DBAiOoh1Gl5hwnrDAlb73vA
+DDOusxgmoBZS4w==
+-----END CERTIFICATE-----

data/test/fixture/purpose/ca/serial

@@ -1 +1 @@
-0004
+0005

data/test/fixture/purpose/sslserver_no_dsig_in_keyUsage.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDBjCCAe6gAwIBAgIBBDANBgkqhkiG9w0BAQUFADBMMQswCQYDVQQGEwJKUDEa
+MBgGA1UECgwRd3d3LnJ1YnktbGFuZy5vcmcxFDASBgNVBAsMC2RldmVsb3BtZW50
+MQswCQYDVQQDDAJDQTAeFw0xMTEyMTQwNDQxNTNaFw0yOTEyMDkwNDQxNTNaMD0x
+CzAJBgNVBAYTAkpQMRowGAYDVQQKDBF3d3cucnVieS1sYW5nLm9yZzESMBAGA1UE
+AwwJc3Nsc2VydmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDgYsazavfR
+a72yK4qfnIjOrDT9Uv2ToL4swbE86PXY5N+YvUig3fVmNJo72rT5JlAODs+MtJJU
+aJ8HsczlGdrhjTWyT/0fyoY/rC4mi5UFASBCbaoaviDPgbhI6ehBY6d5vEYQOW79
+fL95KIa+OyGzUNYy+EkSxJmvt/8EJYtqIwIDAQABo4GFMIGCMAwGA1UdEwEB/wQC
+MAAwMQYJYIZIAYb4QgENBCQWIlJ1YnkvT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlm
+aWNhdGUwHQYDVR0OBBYEFJsUyGU/R4muSKVIeckJElcBNbipMAsGA1UdDwQEAwIF
+IDATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQUFAAOCAQEArdmTvG5H
+elHkiHWp/yFdiIrbUHfDsAmB1jN7Zhte9yWzUuaVKR6GS6FzL4zU6dgAA3UNroVK
+MuyeL5Cejsck2+HgOvAtwTJFjP4c8YwdlYuycvMkk5EbaByY1h59ZvV1J+GxmoDA
+uO3iTqGrKwrFDK59yuxhdn1yyGTwYTBAdvllfSmTmfnbOkV/faF8gpRvrenx3lLK
+eAVhBCzAw2cblXKJEvly+wzAXykS6jagtrnHm5ilt2R5zPzS1wNJlzBq4laI+pZU
+timqb2wMA9TLd4FCKqK4HwiUKyAR7eknxtdskQ0/2DBAiOoh1Gl5hwnrDAlb73vA
+DDOusxgmoBZS4w==
+-----END CERTIFICATE-----

data/test/ruby/envutil.rb

@@ -0,0 +1,208 @@
+require "open3"
+require "timeout"
+
+module EnvUtil
+  def rubybin
+    unless ENV["RUBYOPT"]
+
+    end
+    if ruby = ENV["RUBY"]
+      return ruby
+    end
+    ruby = "ruby"
+    rubyexe = ruby+".exe"
+    3.times do
+      if File.exist? ruby and File.executable? ruby and !File.directory? ruby
+        return File.expand_path(ruby)
+      end
+      if File.exist? rubyexe and File.executable? rubyexe
+        return File.expand_path(rubyexe)
+      end
+      ruby = File.join("..", ruby)
+    end
+    if defined?(RbConfig.ruby)
+      RbConfig.ruby
+    else
+      "ruby"
+    end
+  end
+  module_function :rubybin
+
+  LANG_ENVS = %w"LANG LC_ALL LC_CTYPE"
+
+  def invoke_ruby(args, stdin_data="", capture_stdout=false, capture_stderr=false, opt={})
+    in_c, in_p = IO.pipe
+    out_p, out_c = IO.pipe if capture_stdout
+    err_p, err_c = IO.pipe if capture_stderr && capture_stderr != :merge_to_stdout
+    opt = opt.dup
+    opt[:in] = in_c
+    opt[:out] = out_c if capture_stdout
+    opt[:err] = capture_stderr == :merge_to_stdout ? out_c : err_c if capture_stderr
+    if enc = opt.delete(:encoding)
+      out_p.set_encoding(enc) if out_p
+      err_p.set_encoding(enc) if err_p
+    end
+    c = "C"
+    child_env = {}
+    LANG_ENVS.each {|lc| child_env[lc] = c}
+    if Array === args and Hash === args.first
+      child_env.update(args.shift)
+    end
+    args = [args] if args.kind_of?(String)
+    pid = spawn(child_env, EnvUtil.rubybin, *args, opt)
+    in_c.close
+    out_c.close if capture_stdout
+    err_c.close if capture_stderr && capture_stderr != :merge_to_stdout
+    if block_given?
+      return yield in_p, out_p, err_p
+    else
+      th_stdout = Thread.new { out_p.read } if capture_stdout
+      th_stderr = Thread.new { err_p.read } if capture_stderr && capture_stderr != :merge_to_stdout
+      in_p.write stdin_data.to_str
+      in_p.close
+      timeout = opt.fetch(:timeout, 10)
+      if (!th_stdout || th_stdout.join(timeout)) && (!th_stderr || th_stderr.join(timeout))
+        stdout = th_stdout.value if capture_stdout
+        stderr = th_stderr.value if capture_stderr && capture_stderr != :merge_to_stdout
+      else
+        raise Timeout::Error
+      end
+      out_p.close if capture_stdout
+      err_p.close if capture_stderr && capture_stderr != :merge_to_stdout
+      Process.wait pid
+      status = $?
+      return stdout, stderr, status
+    end
+  ensure
+    [in_c, in_p, out_c, out_p, err_c, err_p].each do |io|
+      io.close if io && !io.closed?
+    end
+    [th_stdout, th_stderr].each do |th|
+      (th.kill; th.join) if th
+    end
+  end
+  module_function :invoke_ruby
+
+  alias rubyexec invoke_ruby
+  class << self
+    alias rubyexec invoke_ruby
+  end
+
+  def verbose_warning
+    class << (stderr = "")
+      alias write <<
+    end
+    stderr, $stderr, verbose, $VERBOSE = $stderr, stderr, $VERBOSE, true
+    yield stderr
+  ensure
+    stderr, $stderr, $VERBOSE = $stderr, stderr, verbose
+    return stderr
+  end
+  module_function :verbose_warning
+
+  def suppress_warning
+    verbose, $VERBOSE = $VERBOSE, nil
+    yield
+  ensure
+    $VERBOSE = verbose
+  end
+  module_function :suppress_warning
+
+  def under_gc_stress
+    stress, GC.stress = GC.stress, true
+    yield
+  ensure
+    GC.stress = stress
+  end
+  module_function :under_gc_stress
+end
+
+module Test
+  module Unit
+    module Assertions
+      public
+      def assert_normal_exit(testsrc, message = '', opt = {})
+        if opt.include?(:child_env)
+          opt = opt.dup
+          child_env = [opt.delete(:child_env)] || []
+        else
+          child_env = []
+        end
+        out, _, status = EnvUtil.invoke_ruby(child_env + %W'-W0', testsrc, true, :merge_to_stdout, opt)
+        pid = status.pid
+        faildesc = proc do
+          signo = status.termsig
+          signame = Signal.list.invert[signo]
+          sigdesc = "signal #{signo}"
+          if signame
+            sigdesc = "SIG#{signame} (#{sigdesc})"
+          end
+          if status.coredump?
+            sigdesc << " (core dumped)"
+          end
+          full_message = ''
+          if !message.empty?
+            full_message << message << "\n"
+          end
+          full_message << "pid #{pid} killed by #{sigdesc}"
+          if !out.empty?
+            out << "\n" if /\n\z/ !~ out
+            full_message << "\n#{out.gsub(/^/, '| ')}"
+          end
+          full_message
+        end
+        assert !status.signaled?, faildesc
+      end
+
+      def assert_in_out_err(args, test_stdin = "", test_stdout = [], test_stderr = [], message = nil, opt={})
+        stdout, stderr, status = EnvUtil.invoke_ruby(args, test_stdin, true, true, opt)
+        if block_given?
+          yield(stdout.lines.map {|l| l.chomp }, stderr.lines.map {|l| l.chomp })
+        else
+          if test_stdout.is_a?(Regexp)
+            assert_match(test_stdout, stdout, message)
+          else
+            assert_equal(test_stdout, stdout.lines.map {|l| l.chomp }, message)
+          end
+          if test_stderr.is_a?(Regexp)
+            assert_match(test_stderr, stderr, message)
+          else
+            assert_equal(test_stderr, stderr.lines.map {|l| l.chomp }, message)
+          end
+          status
+        end
+      end
+
+      def assert_ruby_status(args, test_stdin="", message=nil, opt={})
+        _, _, status = EnvUtil.invoke_ruby(args, test_stdin, false, false, opt)
+        m = message ? "#{message} (#{status.inspect})" : "ruby exit status is not success: #{status.inspect}"
+        assert(status.success?, m)
+      end
+
+      def assert_warn(msg)
+        stderr = EnvUtil.verbose_warning { yield }
+        assert(msg === stderr, "warning message #{stderr.inspect} is expected to match #{msg.inspect}")
+      end
+
+    end
+  end
+end
+
+begin
+  require 'rbconfig'
+rescue LoadError
+else
+  module RbConfig
+    @ruby = EnvUtil.rubybin
+    class << self
+      undef ruby if method_defined?(:ruby)
+      attr_reader :ruby
+    end
+    dir = File.dirname(ruby)
+    name = File.basename(ruby, CONFIG['EXEEXT'])
+    CONFIG['bindir'] = dir
+    CONFIG['ruby_install_name'] = name
+    CONFIG['RUBY_INSTALL_NAME'] = name
+    Gem::ConfigMap[:bindir] = dir if defined?(Gem::ConfigMap)
+  end
+end

data/test/ruby/ut_eof.rb

@@ -0,0 +1,128 @@
+require 'test/unit'
+
+module TestEOF
+  def test_eof_0
+    open_file("") {|f|
+      assert_equal("", f.read(0))
+      assert_equal("", f.read(0))
+      assert_equal("", f.read)
+      assert_equal("", f.read(0))
+      assert_equal("", f.read(0))
+    }
+    open_file("") {|f|
+      assert_nil(f.read(1))
+      assert_equal("", f.read)
+      assert_nil(f.read(1))
+    }
+    open_file("") {|f|
+      s = "x"
+      assert_equal("", f.read(nil, s))
+      assert_equal("", s)
+    }
+    open_file("") {|f|
+      s = "x"
+      assert_nil(f.read(10, s))
+      assert_equal("", s)
+    }
+  end
+
+  def test_eof_0_rw
+    return unless respond_to? :open_file_rw
+    open_file_rw("") {|f|
+      assert_equal("", f.read)
+      assert_equal("", f.read)
+      assert_equal(0, f.syswrite(""))
+      assert_equal("", f.read)
+    }
+  end
+
+  def test_eof_1
+    open_file("a") {|f|
+      assert_equal("", f.read(0))
+      assert_equal("a", f.read(1))
+      assert_equal("" , f.read(0))
+      assert_equal("" , f.read(0))
+      assert_equal("", f.read)
+      assert_equal("", f.read(0))
+      assert_equal("", f.read(0))
+    }
+    open_file("a") {|f|
+      assert_equal("a", f.read(1))
+      assert_nil(f.read(1))
+    }
+    open_file("a") {|f|
+      assert_equal("a", f.read(2))
+      assert_nil(f.read(1))
+      assert_equal("", f.read)
+      assert_nil(f.read(1))
+    }
+    open_file("a") {|f|
+      assert_equal("a", f.read)
+      assert_nil(f.read(1))
+      assert_equal("", f.read)
+      assert_nil(f.read(1))
+    }
+    open_file("a") {|f|
+      assert_equal("a", f.read(2))
+      assert_equal("", f.read)
+      assert_equal("", f.read)
+    }
+    open_file("a") {|f|
+      assert_equal("a", f.read)
+      assert_equal("", f.read(0))
+    }
+    open_file("a") {|f|
+      s = "x"
+      assert_equal("a", f.read(nil, s))
+      assert_equal("a", s)
+    }
+    open_file("a") {|f|
+      s = "x"
+      assert_equal("a", f.read(10, s))
+      assert_equal("a", s)
+    }
+  end
+
+  def test_eof_2
+    open_file("") {|f|
+      assert_equal("", f.read)
+      assert(f.eof?)
+    }
+  end
+
+  def test_eof_3
+    open_file("") {|f|
+      assert(f.eof?)
+    }
+  end
+
+  module Seek
+    def open_file_seek(content, pos)
+      open_file(content) do |f|
+        f.seek(pos)
+        yield f
+      end
+    end
+
+    def test_eof_0_seek
+      open_file_seek("", 10) {|f|
+        assert_equal(10, f.pos)
+        assert_equal("", f.read(0))
+        assert_equal("", f.read)
+        assert_equal("", f.read(0))
+        assert_equal("", f.read)
+      }
+    end
+
+    def test_eof_1_seek
+      open_file_seek("a", 10) {|f|
+        assert_equal("", f.read)
+        assert_equal("", f.read)
+      }
+      open_file_seek("a", 1) {|f|
+        assert_equal("", f.read)
+        assert_equal("", f.read)
+      }
+    end
+  end
+end