r509 0.9.2 → 0.10.0

data/spec/cert/extensions/subject_alternative_name_spec.rb

@@ -0,0 +1,354 @@
+require 'spec_helper'
+
+include R509::Cert::Extensions
+
+shared_examples_for "a correct R509 SubjectAlternativeName object" do |critical|
+  before :all do
+    extension_name = "subjectAltName"
+    klass = SubjectAlternativeName
+    ef = OpenSSL::X509::ExtensionFactory.new
+    ef.config = OpenSSL::Config.parse(@conf)
+    openssl_ext = ef.create_extension( extension_name, @extension_value , critical )
+    @r509_ext = klass.new( openssl_ext )
+  end
+
+  it "dns_names should be correct critical:#{critical}" do
+    @r509_ext.dns_names.should == @dns_names
+  end
+
+  it "ip_addresses should be correct critical:#{critical}" do
+    @r509_ext.ip_addresses.should == @ip_addresses
+  end
+
+  it "rfc_822names should be correct critical:#{critical}" do
+    @r509_ext.rfc_822_names.should == @rfc_822_names
+  end
+
+  it "uris should be correct critical:#{critical}" do
+    @r509_ext.uris.should == @uris
+  end
+
+  it "dirNames should be correct critical:#{critical}" do
+    @r509_ext.directory_names.size.should == @directory_names.size
+  end
+
+  it "ordered should be correct critical:#{critical}" do
+    @r509_ext.names.size.should == @dns_names.size + @ip_addresses.size + @rfc_822_names.size + @uris.size + @directory_names.size
+  end
+
+  it "reports #critical? properly" do
+    @r509_ext.critical?.should == critical
+  end
+end
+
+describe R509::Cert::Extensions::SubjectAlternativeName do
+  include R509::Cert::Extensions
+
+
+  context "validation" do
+    it "errors when not supplying a hash" do
+      expect {
+        R509::Cert::Extensions::SubjectAlternativeName.new("create")
+      }.to raise_error(ArgumentError,"You must supply a hash with a :value")
+    end
+
+    it "errors when not supplying :value" do
+      expect {
+        R509::Cert::Extensions::SubjectAlternativeName.new({})
+      }.to raise_error(ArgumentError,"You must supply a hash with a :value")
+    end
+  end
+  context "SubjectAlternativeName" do
+    context "creation & yaml generation" do
+
+      context "GeneralNames object" do
+        before :all do
+          gns = R509::ASN1::GeneralNames.new
+          gns.create_item(:type => "rfc822Name", :value => "random string")
+          @san = R509::Cert::Extensions::SubjectAlternativeName.new(:value => gns)
+        end
+
+        it "creates extension" do
+          @san.rfc_822_names.should == ['random string']
+        end
+
+        it "builds yaml" do
+          YAML.load(@san.to_yaml).should == {:critical=>false, :value=>[{:type=>"email", :value=>"random string"}]}
+        end
+      end
+
+      context "single name" do
+        before :all do
+          @args = { :value => [{:type => "DNS", :value => 'domain.com' }], :critical => false }
+          @san = R509::Cert::Extensions::SubjectAlternativeName.new(@args)
+        end
+
+        it "creates extension" do
+          @san.dns_names.should == ['domain.com']
+        end
+
+        it "builds yaml" do
+          @san.to_h.should == @args
+        end
+      end
+
+      context "multiple names" do
+        before :all do
+          @args = { :value => [{:type => 'DNS', :value => 'domain.com' },{ :type => 'IP', :value => '127.0.0.1' }], :critical => false }
+          @san = R509::Cert::Extensions::SubjectAlternativeName.new(@args)
+        end
+        it "creates extension" do
+          @san.dns_names.should == ['domain.com']
+          @san.ip_addresses.should == ['127.0.0.1']
+        end
+
+        it "builds yaml" do
+          @san.to_h.should == @args
+        end
+      end
+
+      context "default criticality" do
+        before :all do
+          @args = { :value => [{:type => "DNS", :value => 'domain.com' }] }
+          @san = R509::Cert::Extensions::SubjectAlternativeName.new(@args)
+        end
+
+        it "creates extension" do
+          @san.critical?.should be_false
+        end
+
+        it "builds yaml" do
+          @san.to_h.should == @args.merge(:critical => false)
+        end
+      end
+
+      context "creates with non-default criticality" do
+        before :all do
+          @args = { :value => [{:type => "DNS", :value => 'domain.com' }], :critical => true }
+          @san = R509::Cert::Extensions::SubjectAlternativeName.new(@args)
+        end
+
+        it "creates extension" do
+          @san.critical?.should be_true
+        end
+
+        it "builds yaml" do
+          @san.to_h.should == @args
+        end
+      end
+
+    end
+
+    context "with an unimplemented GeneralName type" do
+      it "errors as expected" do
+        ef = OpenSSL::X509::ExtensionFactory.new
+        ext = ef.create_extension("subjectAltName","otherName:1.2.3.4;IA5STRING:Hello World")
+        expect { R509::Cert::Extensions::SubjectAlternativeName.new ext }.to raise_error(R509::R509Error, 'Unimplemented GeneralName tag: 0. At this time R509 does not support GeneralName types other than rfc822Name, dNSName, uniformResourceIdentifier, iPAddress, and directoryName')
+      end
+    end
+    context "with a DNS alternative name only" do
+      before :all do
+        @dns_names = ["www.test.local"]
+        @ip_addresses = []
+        @uris = []
+        @rfc_822_names = []
+        @directory_names = []
+        total = [@dns_names,@ip_addresses,@uris,@rfc_822_names,@directory_names].flatten(1)
+        gns = R509::ASN1.general_name_parser(total)
+        serialized = gns.serialize_names
+        @conf = serialized[:conf]
+        @extension_value = serialized[:extension_string]
+      end
+
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", false
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", true
+    end
+
+    context "with multiple DNS alternative names only" do
+      before :all do
+        @dns_names = ["www.test.local", "www2.test.local"]
+        @ip_addresses = []
+        @uris = []
+        @rfc_822_names = []
+        @directory_names = []
+        total = [@dns_names,@ip_addresses,@uris,@rfc_822_names,@directory_names].flatten(1)
+        gns = R509::ASN1.general_name_parser(total)
+        serialized = gns.serialize_names
+        @conf = serialized[:conf]
+        @extension_value = serialized[:extension_string]
+      end
+
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", false
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", true
+    end
+
+    context "with an IP address alternative name only" do
+      before :all do
+        @dns_names = []
+        @ip_addresses = ["203.1.2.3"]
+        @rfc_822_names = []
+        @uris = []
+        @directory_names = []
+        total = [@dns_names,@ip_addresses,@uris,@rfc_822_names,@directory_names].flatten(1)
+        gns = R509::ASN1.general_name_parser(total)
+        serialized = gns.serialize_names
+        @conf = serialized[:conf]
+        @extension_value = serialized[:extension_string]
+      end
+
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", false
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", true
+    end
+
+    context "with multiple IP address alternative names only" do
+      before :all do
+        @dns_names = []
+        @ip_addresses = ["10.1.2.3", "10.1.2.4"]
+        @uris = []
+        @rfc_822_names = []
+        @directory_names = []
+        total = [@dns_names,@ip_addresses,@uris,@rfc_822_names,@directory_names].flatten(1)
+        gns = R509::ASN1.general_name_parser(total)
+        serialized = gns.serialize_names
+        @conf = serialized[:conf]
+        @extension_value = serialized[:extension_string]
+      end
+
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", false
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", true
+    end
+
+    context "with an rfc822Name alternative name only" do
+      before :all do
+        @dns_names = []
+        @ip_addresses = []
+        @rfc_822_names = ["some@guy.com"]
+        @uris = []
+        @directory_names = []
+        total = [@dns_names,@ip_addresses,@uris,@rfc_822_names,@directory_names].flatten(1)
+        gns = R509::ASN1.general_name_parser(total)
+        serialized = gns.serialize_names
+        @conf = serialized[:conf]
+        @extension_value = serialized[:extension_string]
+      end
+
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", false
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", true
+    end
+
+    context "with multiple rfc822Name alternative names only" do
+      before :all do
+        @dns_names = []
+        @ip_addresses = []
+        @rfc_822_names = ["some@guy.com","other@guy.com"]
+        @uris = []
+        @directory_names = []
+        total = [@dns_names,@ip_addresses,@uris,@rfc_822_names,@directory_names].flatten(1)
+        gns = R509::ASN1.general_name_parser(total)
+        serialized = gns.serialize_names
+        @conf = serialized[:conf]
+        @extension_value = serialized[:extension_string]
+      end
+
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", false
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", true
+    end
+
+    context "with a URI alternative name only" do
+      before :all do
+        @dns_names = []
+        @ip_addresses = []
+        @rfc_822_names = []
+        @uris = ["http://www.test.local"]
+        @directory_names = []
+        total = [@dns_names,@ip_addresses,@uris,@rfc_822_names,@directory_names].flatten(1)
+        gns = R509::ASN1.general_name_parser(total)
+        serialized = gns.serialize_names
+        @conf = serialized[:conf]
+        @extension_value = serialized[:extension_string]
+      end
+
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", false
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", true
+    end
+
+    context "with multiple URI alternative names only" do
+      before :all do
+        @dns_names = []
+        @ip_addresses = []
+        @rfc_822_names = []
+        @uris = ["http://www.test.local","http://www2.test.local"]
+        @directory_names = []
+        total = [@dns_names,@ip_addresses,@uris,@rfc_822_names,@directory_names].flatten(1)
+        gns = R509::ASN1.general_name_parser(total)
+        serialized = gns.serialize_names
+        @conf = serialized[:conf]
+        @extension_value = serialized[:extension_string]
+      end
+
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", false
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", true
+    end
+
+    context "with a directoryName alternative name only" do
+      before :all do
+        @dns_names = []
+        @ip_addresses = []
+        @rfc_822_names = []
+        @uris = []
+        @directory_names = [
+          [['CN','langui.sh'],['O','org'],['L','locality']]
+        ]
+        total = [@dns_names,@ip_addresses,@uris,@rfc_822_names,@directory_names].flatten(1)
+        gns = R509::ASN1.general_name_parser(total)
+        serialized = gns.serialize_names
+        @conf = serialized[:conf]
+        @extension_value = serialized[:extension_string]
+      end
+
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", false
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", true
+    end
+
+    context "with multiple directoryName alternative names only" do
+      before :all do
+        @dns_names = []
+        @ip_addresses = []
+        @rfc_822_names = []
+        @uris = []
+        @directory_names = [
+          [['CN','langui.sh'],['O','org'],['L','locality']],
+          [['CN','otherdomain.com'],['O','org-like']]
+        ]
+        total = [@dns_names,@ip_addresses,@uris,@rfc_822_names,@directory_names].flatten(1)
+        gns = R509::ASN1.general_name_parser(total)
+        serialized = gns.serialize_names
+        @conf = serialized[:conf]
+        @extension_value = serialized[:extension_string]
+      end
+
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", false
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", true
+    end
+
+    context "with multiple different alternative names" do
+      before :all do
+        @dns_names = ["www.test.local"]
+        @ip_addresses = ["10.1.2.3"]
+        @rfc_822_names = ["myemail@email.com"]
+        @uris = ["http://www.test.local"]
+        @directory_names = [
+          [['CN','langui.sh'],['O','org'],['L','locality']]
+        ]
+        total = [@dns_names,@ip_addresses,@uris,@rfc_822_names,@directory_names].flatten(1)
+        gns = R509::ASN1.general_name_parser(total)
+        serialized = gns.serialize_names
+        @conf = serialized[:conf]
+        @extension_value = serialized[:extension_string]
+      end
+
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", false
+      it_should_behave_like "a correct R509 SubjectAlternativeName object", true
+    end
+  end
+end

data/spec/cert/extensions/subject_key_identifier_spec.rb

@@ -0,0 +1,64 @@
+require 'spec_helper'
+
+include R509::Cert::Extensions
+
+shared_examples_for "a correct R509 SubjectKeyIdentifier object" do
+  before :all do
+    extension_name = "subjectKeyIdentifier"
+    klass = SubjectKeyIdentifier
+    openssl_ext = OpenSSL::X509::Extension.new( extension_name, @extension_value )
+    @r509_ext = klass.new( openssl_ext )
+  end
+
+  it "key should be correct" do
+    @r509_ext.key.should == @key
+  end
+end
+
+describe R509::Cert::Extensions::SubjectKeyIdentifier do
+  include R509::Cert::Extensions
+
+  context "SubjectKeyIdentifier" do
+    before :all do
+      @extension_value = "00:11:22:33:44:55:66:77:88:99:00:AA:BB:CC:DD:EE:FF:00:11:22"
+      @key = @extension_value
+    end
+
+    context "creation" do
+      before :all do
+        @pk = R509::PrivateKey.new(:bit_strength => 768)
+      end
+
+      it "errors when not supplying a public key" do
+        expect {
+          R509::Cert::Extensions::SubjectKeyIdentifier.new({})
+        }.to raise_error(ArgumentError,"You must supply a hash with a :public_key")
+      end
+
+      it "errors when supplying a non-hash" do
+        expect {
+          R509::Cert::Extensions::SubjectKeyIdentifier.new("junk!!!")
+        }.to raise_error(ArgumentError,"You must supply a hash with a :public_key")
+      end
+
+      it "creates successfully" do
+        ski = R509::Cert::Extensions::SubjectKeyIdentifier.new(:public_key => @pk.public_key)
+        ski.key.should_not be_nil
+      end
+
+      it "creates with default criticality" do
+        ski = R509::Cert::Extensions::SubjectKeyIdentifier.new(:public_key => @pk.public_key)
+        ski.critical?.should be_false
+      end
+
+      it "creates with non-default criticality" do
+        ski = R509::Cert::Extensions::SubjectKeyIdentifier.new(:public_key => @pk.public_key, :critical => true)
+        ski.critical?.should be_true
+      end
+
+    end
+
+    it_should_behave_like "a correct R509 SubjectKeyIdentifier object"
+  end
+
+end

data/spec/cert_spec.rb

@@ -97,11 +97,11 @@ describe R509::Cert do
   end
   it "returns the RSA key algorithm" do
     cert = R509::Cert.new(:cert => @cert)
-    cert.key_algorithm.should == :rsa
+    cert.key_algorithm.should == "RSA"
   end
   it "returns the DSA key algorithm" do
     cert = R509::Cert.new(:cert => @cert6)
-    cert.key_algorithm.should == :dsa
+    cert.key_algorithm.should == "DSA"
   end
   it "returns list of san names when it is a san cert" do
     cert = R509::Cert.new(:cert => @cert_san)
@@ -145,7 +145,7 @@ describe R509::Cert do
     sio = StringIO.new
     sio.set_encoding("BINARY") if sio.respond_to?(:set_encoding)
     cert.write_pem(sio)
-    sio.string.should == @cert + "\n"
+    sio.string.should == @cert
   end
   it "writes to der" do
     cert = R509::Cert.new(:cert => @cert)
@@ -269,7 +269,7 @@ describe R509::Cert do
   end
   it "returns an error for curve_name for DSA/RSA" do
     cert = R509::Cert.new(:cert => @cert)
-    expect { cert.curve_name }.to raise_error(R509::R509Error, 'Curve name is only available with EC certs')
+    expect { cert.curve_name }.to raise_error(R509::R509Error, 'Curve name is only available with EC')
   end
   it "checks dsa?" do
     cert = R509::Cert.new(:cert => @cert6)
@@ -312,12 +312,14 @@ describe R509::Cert do
     cert = R509::Cert.new(:cert => @cert3)
     crl_admin = R509::CRL::Administrator.new(TestFixtures.test_ca_config)
     crl_admin.revoke_cert(1425751142578902223005775172931960716533532010870)
-    cert.is_revoked_by_crl?(crl_admin.crl).should == true
+    crl = crl_admin.generate_crl
+    cert.is_revoked_by_crl?(crl).should == true
   end
   it "is not revoked by crl" do
     cert = R509::Cert.new(:cert => @cert3)
     crl_admin = R509::CRL::Administrator.new(TestFixtures.test_ca_config)
-    cert.is_revoked_by_crl?(crl_admin.crl).should == false
+    crl = crl_admin.generate_crl
+    cert.is_revoked_by_crl?(crl).should == false
   end
   it "loads a cert with load_from_file" do
     path = File.dirname(__FILE__) + '/fixtures/cert1.pem'
@@ -350,7 +352,7 @@ describe R509::Cert do
     end
     it "raises error on bit strength" do
       cert = R509::Cert.new(:cert => @cert_ec)
-      expect { cert.bit_strength }.to raise_error(R509::R509Error,'Bit strength is not available for EC at this time.')
+      expect { cert.bit_strength }.to raise_error(R509::R509Error,'Bit length is not available for EC at this time.')
     end
     it "returns curve name" do
       cert = R509::Cert.new(:cert => @cert_ec)
@@ -369,7 +371,7 @@ describe R509::Cert do
     end
     it "returns the key algorithm" do
       cert = R509::Cert.new(:cert => @cert_ec)
-      cert.key_algorithm.should == :ec
+      cert.key_algorithm.should == "EC"
     end
   end
 
@@ -390,7 +392,7 @@ describe R509::Cert do
     end
     it "returns RSA key algorithm for RSA CSR" do
       cert = R509::Cert.new(:cert => @cert)
-      cert.key_algorithm.should == :rsa
+      cert.key_algorithm.should == "RSA"
     end
   end
 end