mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
This commit was manufactured by cvs2svn to create branch 'ruby_1_8'.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@9112 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
(no author)
parent
580d8dca40
commit
a4164e5949
2 changed files with 207 additions and 0 deletions
59
test/openssl/test_ns_spki.rb
Normal file
59
test/openssl/test_ns_spki.rb
Normal file
|
|
@ -0,0 +1,59 @@
|
||||||
|
begin
|
||||||
|
require "openssl"
|
||||||
|
require File.join(File.dirname(__FILE__), "utils.rb")
|
||||||
|
rescue LoadError
|
||||||
|
end
|
||||||
|
require "test/unit"
|
||||||
|
|
||||||
|
if defined?(OpenSSL)
|
||||||
|
|
||||||
|
|
||||||
|
class OpenSSL::TestNSSPI < Test::Unit::TestCase
|
||||||
|
def setup
|
||||||
|
# This request data is adopt from the specification of
|
||||||
|
# "Netscape Extensions for User Key Generation".
|
||||||
|
# -- http://wp.netscape.com/eng/security/comm4-keygen.html
|
||||||
|
@b64 = "MIHFMHEwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAnX0TILJrOMUue+PtwBRE6XfV"
|
||||||
|
@b64 << "WtKQbsshxk5ZhcUwcwyvcnIq9b82QhJdoACdD34rqfCAIND46fXKQUnb0mvKzQID"
|
||||||
|
@b64 << "AQABFhFNb3ppbGxhSXNNeUZyaWVuZDANBgkqhkiG9w0BAQQFAANBAAKv2Eex2n/S"
|
||||||
|
@b64 << "r/7iJNroWlSzSMtTiQTEB+ADWHGj9u1xrUrOilq/o2cuQxIfZcNZkYAkWP4DubqW"
|
||||||
|
@b64 << "i0//rgBvmco="
|
||||||
|
end
|
||||||
|
|
||||||
|
def teardown
|
||||||
|
end
|
||||||
|
|
||||||
|
def test_build_data
|
||||||
|
key1 = OpenSSL::TestUtils::TEST_KEY_RSA1024
|
||||||
|
key2 = OpenSSL::TestUtils::TEST_KEY_RSA2048
|
||||||
|
spki = OpenSSL::Netscape::SPKI.new
|
||||||
|
spki.challenge = "RandomString"
|
||||||
|
spki.public_key = key1.public_key
|
||||||
|
spki.sign(key1, OpenSSL::Digest::SHA1.new)
|
||||||
|
assert(spki.verify(spki.public_key))
|
||||||
|
assert(spki.verify(key1.public_key))
|
||||||
|
assert(!spki.verify(key2.public_key))
|
||||||
|
|
||||||
|
der = spki.to_der
|
||||||
|
spki = OpenSSL::Netscape::SPKI.new(der)
|
||||||
|
assert_equal("RandomString", spki.challenge)
|
||||||
|
assert_equal(key1.public_key.to_der, spki.public_key.to_der)
|
||||||
|
assert(spki.verify(spki.public_key))
|
||||||
|
end
|
||||||
|
|
||||||
|
def test_decode_data
|
||||||
|
spki = OpenSSL::Netscape::SPKI.new(@b64)
|
||||||
|
assert_equal(@b64, spki.to_pem)
|
||||||
|
assert_equal(@b64.unpack("m").first, spki.to_der)
|
||||||
|
assert_equal("MozillaIsMyFriend", spki.challenge)
|
||||||
|
assert_equal(OpenSSL::PKey::RSA, spki.public_key.class)
|
||||||
|
|
||||||
|
spki = OpenSSL::Netscape::SPKI.new(@b64.unpack("m").first)
|
||||||
|
assert_equal(@b64, spki.to_pem)
|
||||||
|
assert_equal(@b64.unpack("m").first, spki.to_der)
|
||||||
|
assert_equal("MozillaIsMyFriend", spki.challenge)
|
||||||
|
assert_equal(OpenSSL::PKey::RSA, spki.public_key.class)
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
148
test/openssl/test_pkcs7.rb
Normal file
148
test/openssl/test_pkcs7.rb
Normal file
|
|
@ -0,0 +1,148 @@
|
||||||
|
begin
|
||||||
|
require "openssl"
|
||||||
|
require File.join(File.dirname(__FILE__), "utils.rb")
|
||||||
|
rescue LoadError
|
||||||
|
end
|
||||||
|
require "test/unit"
|
||||||
|
|
||||||
|
if defined?(OpenSSL)
|
||||||
|
|
||||||
|
class OpenSSL::TestPKCS7 < Test::Unit::TestCase
|
||||||
|
def setup
|
||||||
|
@rsa1024 = OpenSSL::TestUtils::TEST_KEY_RSA1024
|
||||||
|
@rsa2048 = OpenSSL::TestUtils::TEST_KEY_RSA2048
|
||||||
|
ca = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=CA")
|
||||||
|
ee1 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=EE1")
|
||||||
|
ee2 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=EE2")
|
||||||
|
|
||||||
|
now = Time.now
|
||||||
|
ca_exts = [
|
||||||
|
["basicConstraints","CA:TRUE",true],
|
||||||
|
["keyUsage","keyCertSign, cRLSign",true],
|
||||||
|
["subjectKeyIdentifier","hash",false],
|
||||||
|
["authorityKeyIdentifier","keyid:always",false],
|
||||||
|
]
|
||||||
|
@ca_cert = issue_cert(ca, @rsa2048, 1, Time.now, Time.now+3600, ca_exts,
|
||||||
|
nil, nil, OpenSSL::Digest::SHA1.new)
|
||||||
|
ee_exts = [
|
||||||
|
["keyUsage","Non Repudiation, Digital Signature, Key Encipherment",true],
|
||||||
|
["authorityKeyIdentifier","keyid:always",false],
|
||||||
|
["extendedKeyUsage","clientAuth, emailProtection, codeSigning",false],
|
||||||
|
]
|
||||||
|
@ee1_cert = issue_cert(ee1, @rsa1024, 2, Time.now, Time.now+1800, ee_exts,
|
||||||
|
@ca_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
|
||||||
|
@ee2_cert = issue_cert(ee2, @rsa1024, 3, Time.now, Time.now+1800, ee_exts,
|
||||||
|
@ca_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
|
||||||
|
end
|
||||||
|
|
||||||
|
def issue_cert(*args)
|
||||||
|
OpenSSL::TestUtils.issue_cert(*args)
|
||||||
|
end
|
||||||
|
|
||||||
|
def test_signed
|
||||||
|
store = OpenSSL::X509::Store.new
|
||||||
|
store.add_cert(@ca_cert)
|
||||||
|
ca_certs = [@ca_cert]
|
||||||
|
|
||||||
|
data = "aaaaa\r\nbbbbb\r\nccccc\r\n"
|
||||||
|
tmp = OpenSSL::PKCS7.sign(@ee1_cert, @rsa1024, data, ca_certs)
|
||||||
|
p7 = OpenSSL::PKCS7::PKCS7.new(tmp.to_der)
|
||||||
|
certs = p7.certificates
|
||||||
|
signers = p7.signers
|
||||||
|
assert(p7.verify([], store))
|
||||||
|
assert_equal(data, p7.data)
|
||||||
|
assert_equal(2, certs.size)
|
||||||
|
assert_equal(@ee1_cert.subject.to_s, certs[0].subject.to_s)
|
||||||
|
assert_equal(@ca_cert.subject.to_s, certs[1].subject.to_s)
|
||||||
|
assert_equal(1, signers.size)
|
||||||
|
assert_equal(@ee1_cert.serial, signers[0].serial)
|
||||||
|
assert_equal(@ee1_cert.issuer.to_s, signers[0].issuer.to_s)
|
||||||
|
|
||||||
|
# Normaly OpenSSL tries to translate the supplied content into canonical
|
||||||
|
# MIME format (e.g. a newline character is converted into CR+LF).
|
||||||
|
# If the content is a binary, PKCS7::BINARY flag should be used.
|
||||||
|
|
||||||
|
data = "aaaaa\nbbbbb\nccccc\n"
|
||||||
|
flag = OpenSSL::PKCS7::BINARY
|
||||||
|
tmp = OpenSSL::PKCS7.sign(@ee1_cert, @rsa1024, data, ca_certs, flag)
|
||||||
|
p7 = OpenSSL::PKCS7::PKCS7.new(tmp.to_der)
|
||||||
|
certs = p7.certificates
|
||||||
|
signers = p7.signers
|
||||||
|
assert(p7.verify([], store))
|
||||||
|
assert_equal(data, p7.data)
|
||||||
|
assert_equal(2, certs.size)
|
||||||
|
assert_equal(@ee1_cert.subject.to_s, certs[0].subject.to_s)
|
||||||
|
assert_equal(@ca_cert.subject.to_s, certs[1].subject.to_s)
|
||||||
|
assert_equal(1, signers.size)
|
||||||
|
assert_equal(@ee1_cert.serial, signers[0].serial)
|
||||||
|
assert_equal(@ee1_cert.issuer.to_s, signers[0].issuer.to_s)
|
||||||
|
|
||||||
|
# A signed-data which have multiple signatures can be created
|
||||||
|
# through the following steps.
|
||||||
|
# 1. create two signed-data
|
||||||
|
# 2. copy signerInfo and certificate from one to another
|
||||||
|
|
||||||
|
tmp1 = OpenSSL::PKCS7.sign(@ee1_cert, @rsa1024, data, [], flag)
|
||||||
|
tmp2 = OpenSSL::PKCS7.sign(@ee2_cert, @rsa1024, data, [], flag)
|
||||||
|
tmp1.add_signer(tmp2.signers[0])
|
||||||
|
tmp1.add_certificate(@ee2_cert)
|
||||||
|
|
||||||
|
p7 = OpenSSL::PKCS7::PKCS7.new(tmp1.to_der)
|
||||||
|
certs = p7.certificates
|
||||||
|
signers = p7.signers
|
||||||
|
assert(p7.verify([], store))
|
||||||
|
assert_equal(data, p7.data)
|
||||||
|
assert_equal(2, certs.size)
|
||||||
|
assert_equal(2, signers.size)
|
||||||
|
assert_equal(@ee1_cert.serial, signers[0].serial)
|
||||||
|
assert_equal(@ee1_cert.issuer.to_s, signers[0].issuer.to_s)
|
||||||
|
assert_equal(@ee2_cert.serial, signers[1].serial)
|
||||||
|
assert_equal(@ee2_cert.issuer.to_s, signers[1].issuer.to_s)
|
||||||
|
end
|
||||||
|
|
||||||
|
def test_detached_sign
|
||||||
|
store = OpenSSL::X509::Store.new
|
||||||
|
store.add_cert(@ca_cert)
|
||||||
|
ca_certs = [@ca_cert]
|
||||||
|
|
||||||
|
data = "aaaaa\nbbbbb\nccccc\n"
|
||||||
|
flag = OpenSSL::PKCS7::BINARY|OpenSSL::PKCS7::DETACHED
|
||||||
|
tmp = OpenSSL::PKCS7.sign(@ee1_cert, @rsa1024, data, ca_certs, flag)
|
||||||
|
p7 = OpenSSL::PKCS7::PKCS7.new(tmp.to_der)
|
||||||
|
a1 = OpenSSL::ASN1.decode(p7)
|
||||||
|
|
||||||
|
certs = p7.certificates
|
||||||
|
signers = p7.signers
|
||||||
|
assert(!p7.verify([], store))
|
||||||
|
assert(p7.verify([], store, data))
|
||||||
|
assert_equal(data, p7.data)
|
||||||
|
assert_equal(2, certs.size)
|
||||||
|
assert_equal(@ee1_cert.subject.to_s, certs[0].subject.to_s)
|
||||||
|
assert_equal(@ca_cert.subject.to_s, certs[1].subject.to_s)
|
||||||
|
assert_equal(1, signers.size)
|
||||||
|
assert_equal(@ee1_cert.serial, signers[0].serial)
|
||||||
|
assert_equal(@ee1_cert.issuer.to_s, signers[0].issuer.to_s)
|
||||||
|
end
|
||||||
|
|
||||||
|
def test_enveloped
|
||||||
|
certs = [@ee1_cert, @ee2_cert]
|
||||||
|
cipher = OpenSSL::Cipher::AES.new("128-CBC")
|
||||||
|
data = "aaaaa\nbbbbb\nccccc\n"
|
||||||
|
|
||||||
|
tmp = OpenSSL::PKCS7.encrypt(certs, data, cipher, OpenSSL::PKCS7::BINARY)
|
||||||
|
p7 = OpenSSL::PKCS7::PKCS7.new(tmp.to_der)
|
||||||
|
recip = p7.recipients
|
||||||
|
assert_equal(:enveloped, p7.type)
|
||||||
|
assert_equal(2, recip.size)
|
||||||
|
|
||||||
|
assert_equal(@ca_cert.subject.to_s, recip[0].issuer.to_s)
|
||||||
|
assert_equal(2, recip[0].serial)
|
||||||
|
assert_equal(data, p7.decrypt(@rsa1024, @ee1_cert))
|
||||||
|
|
||||||
|
assert_equal(@ca_cert.subject.to_s, recip[1].issuer.to_s)
|
||||||
|
assert_equal(3, recip[1].serial)
|
||||||
|
assert_equal(data, p7.decrypt(@rsa1024, @ee2_cert))
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
Loading…
Add table
Reference in a new issue