mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
5505449793
- SSLContext#client_cert_cb is a Proc. it is called when a client
certificate is requested by a server and no certificate was yet
set for the SSLContext. it must return an Array which includes
OpenSSL::X509::Certificate and OpenSSL::PKey::RSA/DSA objects.
- SSLContext#tmp_dh_callback is called in key exchange with DH
algorithm. it must return an OpenSSL::PKey::DH object.
* ext/openssl/ossl_ssl.c:
(ossl_sslctx_set_ciphers): ignore the argument if it's nil.
(ossl_start_ssl, ossl_ssl_write): call rb_sys_fail if errno isn't 0.
[ruby-dev:25831]
* ext/openssl/ossl_pkey.c
(GetPrivPKeyPtr, ossl_pkey_sign): should call rb_funcall first.
(DupPrivPKeyPtr): new function.
* ext/openssl/ossl_pkey_dh.c: add default DH parameters.
* ext/openssl/ossl_pkey.h: ditto.
* ext/openssl/lib/openssl/cipher.rb: fix typo. [ruby-dev:24285]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@8129 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
289 lines
8.1 KiB
Ruby
289 lines
8.1 KiB
Ruby
begin
|
|
require "openssl"
|
|
require File.join(File.dirname(__FILE__), "utils.rb")
|
|
rescue LoadError
|
|
end
|
|
require "rbconfig"
|
|
require "socket"
|
|
require "test/unit"
|
|
begin
|
|
loadpath = $:.dup
|
|
$:.replace($: | [File.expand_path("../ruby", File.dirname(__FILE__))])
|
|
require 'envutil'
|
|
ensure
|
|
$:.replace(loadpath)
|
|
end
|
|
|
|
if defined?(OpenSSL)
|
|
|
|
class OpenSSL::TestSSL < Test::Unit::TestCase
|
|
RUBY = EnvUtil.rubybin
|
|
SSL_SERVER = File.join(File.dirname(__FILE__), "ssl_server.rb")
|
|
PORT = 20443
|
|
ITERATIONS = ($0 == __FILE__) ? 100 : 10
|
|
|
|
def setup
|
|
@ca_key = OpenSSL::TestUtils::TEST_KEY_RSA2048
|
|
@svr_key = OpenSSL::TestUtils::TEST_KEY_RSA1024
|
|
@cli_key = OpenSSL::TestUtils::TEST_KEY_DSA256
|
|
@ca = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=CA")
|
|
@svr = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=localhost")
|
|
@cli = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=localhost")
|
|
|
|
now = Time.at(Time.now.to_i)
|
|
ca_exts = [
|
|
["basicConstraints","CA:TRUE",true],
|
|
["keyUsage","cRLSign,keyCertSign",true],
|
|
]
|
|
ee_exts = [
|
|
["keyUsage","keyEncipherment,digitalSignature",true],
|
|
]
|
|
@ca_cert = issue_cert(@ca, @ca_key, 1, now, now+3600, ca_exts,
|
|
nil, nil, OpenSSL::Digest::SHA1.new)
|
|
@svr_cert = issue_cert(@svr, @svr_key, 2, now, now+1800, ee_exts,
|
|
@ca_cert, @ca_key, OpenSSL::Digest::SHA1.new)
|
|
@cli_cert = issue_cert(@cli, @cli_key, 3, now, now+1800, ee_exts,
|
|
@ca_cert, @ca_key, OpenSSL::Digest::SHA1.new)
|
|
@server = nil
|
|
end
|
|
|
|
def teardown
|
|
end
|
|
|
|
def issue_cert(*arg)
|
|
OpenSSL::TestUtils.issue_cert(*arg)
|
|
end
|
|
|
|
def issue_crl(*arg)
|
|
OpenSSL::TestUtils.issue_crl(*arg)
|
|
end
|
|
|
|
def start_server(port0, verify_mode, start_immediately, &block)
|
|
server = nil
|
|
begin
|
|
cmd = [RUBY]
|
|
cmd << "-d" if $DEBUG
|
|
cmd << SSL_SERVER << port0.to_s << verify_mode.to_s
|
|
cmd << (start_immediately ? "yes" : "no")
|
|
server = IO.popen(cmd, "w+")
|
|
server.write(@ca_cert.to_pem)
|
|
server.write(@svr_cert.to_pem)
|
|
server.write(@svr_key.to_pem)
|
|
pid = Integer(server.gets)
|
|
if port = server.gets
|
|
if $DEBUG
|
|
$stderr.printf("%s started: pid=%d port=%d\n", SSL_SERVER, pid, port)
|
|
end
|
|
block.call(server, port.to_i)
|
|
end
|
|
ensure
|
|
if server
|
|
Process.kill(:KILL, pid)
|
|
server.close
|
|
end
|
|
end
|
|
end
|
|
|
|
def starttls(ssl)
|
|
ssl.puts("STARTTLS")
|
|
|
|
sleep 1 # When this line is eliminated, process on Cygwin blocks
|
|
# forever at ssl.connect. But I don't know why it does.
|
|
|
|
ssl.connect
|
|
end
|
|
|
|
def test_connect_and_close
|
|
start_server(PORT, OpenSSL::SSL::VERIFY_NONE, true){|s, p|
|
|
sock = TCPSocket.new("127.0.0.1", p)
|
|
ssl = OpenSSL::SSL::SSLSocket.new(sock)
|
|
assert(ssl.connect)
|
|
ssl.close
|
|
assert(!sock.closed?)
|
|
sock.close
|
|
|
|
sock = TCPSocket.new("127.0.0.1", p)
|
|
ssl = OpenSSL::SSL::SSLSocket.new(sock)
|
|
ssl.sync_close = true # !!
|
|
assert(ssl.connect)
|
|
ssl.close
|
|
assert(sock.closed?)
|
|
}
|
|
end
|
|
|
|
def test_read_and_write
|
|
start_server(PORT, OpenSSL::SSL::VERIFY_NONE, true){|s, p|
|
|
sock = TCPSocket.new("127.0.0.1", p)
|
|
ssl = OpenSSL::SSL::SSLSocket.new(sock)
|
|
ssl.sync_close = true
|
|
ssl.connect
|
|
|
|
# syswrite and sysread
|
|
ITERATIONS.times{|i|
|
|
str = "x" * 100 + "\n"
|
|
ssl.syswrite(str)
|
|
assert_equal(str, ssl.sysread(str.size))
|
|
|
|
str = "x" * i * 100 + "\n"
|
|
buf = ""
|
|
ssl.syswrite(str)
|
|
assert_equal(buf.object_id, ssl.sysread(str.size, buf).object_id)
|
|
assert_equal(str, buf)
|
|
}
|
|
|
|
# puts and gets
|
|
ITERATIONS.times{
|
|
str = "x" * 100 + "\n"
|
|
ssl.puts(str)
|
|
assert_equal(str, ssl.gets)
|
|
}
|
|
|
|
# read and write
|
|
ITERATIONS.times{|i|
|
|
str = "x" * 100 + "\n"
|
|
ssl.write(str)
|
|
assert_equal(str, ssl.read(str.size))
|
|
|
|
str = "x" * i * 100 + "\n"
|
|
buf = ""
|
|
ssl.write(str)
|
|
assert_equal(buf.object_id, ssl.read(str.size, buf).object_id)
|
|
assert_equal(str, buf)
|
|
}
|
|
|
|
ssl.close
|
|
}
|
|
end
|
|
|
|
def test_client_auth
|
|
vflag = OpenSSL::SSL::VERIFY_PEER|OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
|
|
start_server(PORT, vflag, true){|s, p|
|
|
assert_raises(OpenSSL::SSL::SSLError){
|
|
sock = TCPSocket.new("127.0.0.1", p)
|
|
ssl = OpenSSL::SSL::SSLSocket.new(sock)
|
|
ssl.connect
|
|
}
|
|
|
|
ctx = OpenSSL::SSL::SSLContext.new
|
|
ctx.key = @cli_key
|
|
ctx.cert = @cli_cert
|
|
sock = TCPSocket.new("127.0.0.1", p)
|
|
ssl = OpenSSL::SSL::SSLSocket.new(sock, ctx)
|
|
ssl.sync_close = true
|
|
ssl.connect
|
|
ssl.puts("foo")
|
|
assert_equal("foo\n", ssl.gets)
|
|
ssl.close
|
|
|
|
called = nil
|
|
ctx = OpenSSL::SSL::SSLContext.new
|
|
ctx.client_cert_cb = Proc.new{|ssl|
|
|
called = true
|
|
[@cli_cert, @cli_key]
|
|
}
|
|
sock = TCPSocket.new("127.0.0.1", p)
|
|
ssl = OpenSSL::SSL::SSLSocket.new(sock, ctx)
|
|
ssl.sync_close = true
|
|
ssl.connect
|
|
assert(called)
|
|
ssl.puts("foo")
|
|
assert_equal("foo\n", ssl.gets)
|
|
ssl.close
|
|
}
|
|
end
|
|
|
|
def test_starttls
|
|
start_server(PORT, OpenSSL::SSL::VERIFY_NONE, false){|s, p|
|
|
sock = TCPSocket.new("127.0.0.1", p)
|
|
ssl = OpenSSL::SSL::SSLSocket.new(sock)
|
|
ssl.sync_close = true
|
|
str = "x" * 1000 + "\n"
|
|
|
|
ITERATIONS.times{
|
|
ssl.puts(str)
|
|
assert_equal(str, ssl.gets)
|
|
}
|
|
|
|
starttls(ssl)
|
|
|
|
ITERATIONS.times{
|
|
ssl.puts(str)
|
|
assert_equal(str, ssl.gets)
|
|
}
|
|
|
|
ssl.close
|
|
}
|
|
end
|
|
|
|
def test_parallel
|
|
start_server(PORT, OpenSSL::SSL::VERIFY_NONE, true){|s, p|
|
|
ssls = []
|
|
10.times{
|
|
sock = TCPSocket.new("127.0.0.1", p)
|
|
ssl = OpenSSL::SSL::SSLSocket.new(sock)
|
|
ssl.connect
|
|
ssl.sync_close = true
|
|
ssls << ssl
|
|
}
|
|
str = "x" * 1000 + "\n"
|
|
ITERATIONS.times{
|
|
ssls.each{|ssl|
|
|
ssl.puts(str)
|
|
assert_equal(str, ssl.gets)
|
|
}
|
|
}
|
|
ssls.each{|ssl| ssl.close }
|
|
}
|
|
end
|
|
|
|
def test_post_connection_check
|
|
sslerr = OpenSSL::SSL::SSLError
|
|
|
|
start_server(PORT, OpenSSL::SSL::VERIFY_NONE, true){|s, p|
|
|
sock = TCPSocket.new("127.0.0.1", p)
|
|
ssl = OpenSSL::SSL::SSLSocket.new(sock)
|
|
ssl.connect
|
|
assert_raises(sslerr){ssl.post_connection_check("localhost.localdomain")}
|
|
assert_raises(sslerr){ssl.post_connection_check("127.0.0.1")}
|
|
assert(ssl.post_connection_check("localhost"))
|
|
assert_raises(sslerr){ssl.post_connection_check("foo.example.com")}
|
|
}
|
|
|
|
now = Time.now
|
|
exts = [
|
|
["keyUsage","keyEncipherment,digitalSignature",true],
|
|
["subjectAltName","DNS:localhost.localdomain",false],
|
|
["subjectAltName","IP:127.0.0.1",false],
|
|
]
|
|
@svr_cert = issue_cert(@svr, @svr_key, 4, now, now+1800, exts,
|
|
@ca_cert, @ca_key, OpenSSL::Digest::SHA1.new)
|
|
start_server(PORT, OpenSSL::SSL::VERIFY_NONE, true){|s, p|
|
|
sock = TCPSocket.new("127.0.0.1", p)
|
|
ssl = OpenSSL::SSL::SSLSocket.new(sock)
|
|
ssl.connect
|
|
assert(ssl.post_connection_check("localhost.localdomain"))
|
|
assert(ssl.post_connection_check("127.0.0.1"))
|
|
assert_raises(sslerr){ssl.post_connection_check("localhost")}
|
|
assert_raises(sslerr){ssl.post_connection_check("foo.example.com")}
|
|
}
|
|
|
|
now = Time.now
|
|
exts = [
|
|
["keyUsage","keyEncipherment,digitalSignature",true],
|
|
["subjectAltName","DNS:*.localdomain",false],
|
|
]
|
|
@svr_cert = issue_cert(@svr, @svr_key, 5, now, now+1800, exts,
|
|
@ca_cert, @ca_key, OpenSSL::Digest::SHA1.new)
|
|
start_server(PORT, OpenSSL::SSL::VERIFY_NONE, true){|s, p|
|
|
sock = TCPSocket.new("127.0.0.1", p)
|
|
ssl = OpenSSL::SSL::SSLSocket.new(sock)
|
|
ssl.connect
|
|
assert(ssl.post_connection_check("localhost.localdomain"))
|
|
assert_raises(sslerr){ssl.post_connection_check("127.0.0.1")}
|
|
assert_raises(sslerr){ssl.post_connection_check("localhost")}
|
|
assert_raises(sslerr){ssl.post_connection_check("foo.example.com")}
|
|
}
|
|
end
|
|
end
|
|
|
|
end
|