mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
e29819df6e
ext/openssl/ossl.c: Expose OpenSSL::OPENSSL_FIPS constant to indicate whether OpenSSL runs in FIPS mode. test/openssl/test_pkey_dh.rb: Generate 256 bit keys for non-FIPS installations to improve test performance (e.g. for rubyci). test/openssl/utils.rb: Replace DSS1 as certificate signature digest with SHA1 for FIPS installations when using DSA by introducing TestUtils::DSA_SIGNATURE_DIGEST. test/openssl/test_x509cert.rb: test/openssl/test_x509crl.rb: test/openssl/test_x509req.rb: Use DSA_SIGNATURE_DIGEST NEWS: Introduce OpenSSL::OPENSSL_FIPS These changes allow running the OpenSSL tests in FIPS mode while keeping a high performance for non-FIPS installations. Introduction of OpenSSL::OPENSSL_FIPS allows for applications to react to special requirements when using OpenSSL in FIPS mode. [Feature #6946] [ruby-core:47345] - Diese und die folgenden Zeilen werden ignoriert -- M ext/openssl/extconf.rb M ext/openssl/ossl.c M NEWS M ChangeLog M test/openssl/utils.rb M test/openssl/test_x509crl.rb M test/openssl/test_x509req.rb M test/openssl/test_x509cert.rb M test/openssl/test_pkey_dh.rb git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@36884 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
150 lines
5.1 KiB
Ruby
150 lines
5.1 KiB
Ruby
require_relative "utils"
|
|
|
|
if defined?(OpenSSL)
|
|
|
|
class OpenSSL::TestX509Request < Test::Unit::TestCase
|
|
def setup
|
|
@rsa1024 = OpenSSL::TestUtils::TEST_KEY_RSA1024
|
|
@rsa2048 = OpenSSL::TestUtils::TEST_KEY_RSA2048
|
|
@dsa256 = OpenSSL::TestUtils::TEST_KEY_DSA256
|
|
@dsa512 = OpenSSL::TestUtils::TEST_KEY_DSA512
|
|
@dn = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=GOTOU Yuuzou")
|
|
end
|
|
|
|
def issue_csr(ver, dn, key, digest)
|
|
req = OpenSSL::X509::Request.new
|
|
req.version = ver
|
|
req.subject = dn
|
|
req.public_key = key.public_key
|
|
req.sign(key, digest)
|
|
req
|
|
end
|
|
|
|
def test_public_key
|
|
req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
|
|
assert_equal(@rsa1024.public_key.to_der, req.public_key.to_der)
|
|
req = OpenSSL::X509::Request.new(req.to_der)
|
|
assert_equal(@rsa1024.public_key.to_der, req.public_key.to_der)
|
|
|
|
req = issue_csr(0, @dn, @dsa512, OpenSSL::TestUtils::DSA_SIGNATURE_DIGEST.new)
|
|
assert_equal(@dsa512.public_key.to_der, req.public_key.to_der)
|
|
req = OpenSSL::X509::Request.new(req.to_der)
|
|
assert_equal(@dsa512.public_key.to_der, req.public_key.to_der)
|
|
end
|
|
|
|
def test_version
|
|
req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
|
|
assert_equal(0, req.version)
|
|
req = OpenSSL::X509::Request.new(req.to_der)
|
|
assert_equal(0, req.version)
|
|
|
|
req = issue_csr(1, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
|
|
assert_equal(1, req.version)
|
|
req = OpenSSL::X509::Request.new(req.to_der)
|
|
assert_equal(1, req.version)
|
|
end
|
|
|
|
def test_subject
|
|
req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
|
|
assert_equal(@dn.to_der, req.subject.to_der)
|
|
req = OpenSSL::X509::Request.new(req.to_der)
|
|
assert_equal(@dn.to_der, req.subject.to_der)
|
|
end
|
|
|
|
def create_ext_req(exts)
|
|
ef = OpenSSL::X509::ExtensionFactory.new
|
|
exts = exts.collect{|e| ef.create_extension(*e) }
|
|
return OpenSSL::ASN1::Set([OpenSSL::ASN1::Sequence(exts)])
|
|
end
|
|
|
|
def get_ext_req(ext_req_value)
|
|
set = OpenSSL::ASN1.decode(ext_req_value)
|
|
seq = set.value[0]
|
|
seq.value.collect{|asn1ext|
|
|
OpenSSL::X509::Extension.new(asn1ext).to_a
|
|
}
|
|
end
|
|
|
|
def test_attr
|
|
exts = [
|
|
["keyUsage", "Digital Signature, Key Encipherment", true],
|
|
["subjectAltName", "email:gotoyuzo@ruby-lang.org", false],
|
|
]
|
|
attrval = create_ext_req(exts)
|
|
attrs = [
|
|
OpenSSL::X509::Attribute.new("extReq", attrval),
|
|
OpenSSL::X509::Attribute.new("msExtReq", attrval),
|
|
]
|
|
|
|
req0 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
|
|
attrs.each{|attr| req0.add_attribute(attr) }
|
|
req1 = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
|
|
req1.attributes = attrs
|
|
assert_equal(req0.to_der, req1.to_der)
|
|
|
|
attrs = req0.attributes
|
|
assert_equal(2, attrs.size)
|
|
assert_equal("extReq", attrs[0].oid)
|
|
assert_equal("msExtReq", attrs[1].oid)
|
|
assert_equal(exts, get_ext_req(attrs[0].value))
|
|
assert_equal(exts, get_ext_req(attrs[1].value))
|
|
|
|
req = OpenSSL::X509::Request.new(req0.to_der)
|
|
attrs = req.attributes
|
|
assert_equal(2, attrs.size)
|
|
assert_equal("extReq", attrs[0].oid)
|
|
assert_equal("msExtReq", attrs[1].oid)
|
|
assert_equal(exts, get_ext_req(attrs[0].value))
|
|
assert_equal(exts, get_ext_req(attrs[1].value))
|
|
end
|
|
|
|
def test_sign_and_verify
|
|
req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::SHA1.new)
|
|
assert_equal(true, req.verify(@rsa1024))
|
|
assert_equal(false, req.verify(@rsa2048))
|
|
assert_equal(false, request_error_returns_false { req.verify(@dsa256) })
|
|
assert_equal(false, request_error_returns_false { req.verify(@dsa512) })
|
|
req.version = 1
|
|
assert_equal(false, req.verify(@rsa1024))
|
|
|
|
req = issue_csr(0, @dn, @rsa2048, OpenSSL::Digest::MD5.new)
|
|
assert_equal(false, req.verify(@rsa1024))
|
|
assert_equal(true, req.verify(@rsa2048))
|
|
assert_equal(false, request_error_returns_false { req.verify(@dsa256) })
|
|
assert_equal(false, request_error_returns_false { req.verify(@dsa512) })
|
|
req.subject = OpenSSL::X509::Name.parse("/C=JP/CN=FooBar")
|
|
assert_equal(false, req.verify(@rsa2048))
|
|
|
|
req = issue_csr(0, @dn, @dsa512, OpenSSL::TestUtils::DSA_SIGNATURE_DIGEST.new)
|
|
assert_equal(false, request_error_returns_false { req.verify(@rsa1024) })
|
|
assert_equal(false, request_error_returns_false { req.verify(@rsa2048) })
|
|
assert_equal(false, req.verify(@dsa256))
|
|
assert_equal(true, req.verify(@dsa512))
|
|
req.public_key = @rsa1024.public_key
|
|
assert_equal(false, req.verify(@dsa512))
|
|
|
|
begin
|
|
req = issue_csr(0, @dn, @rsa1024, OpenSSL::Digest::DSS1.new)
|
|
assert_equal(true, req.verify(@rsa1024))
|
|
assert_equal(false, req.verify(@rsa2048))
|
|
assert_equal(false, request_error_returns_false { req.verify(@dsa256) })
|
|
assert_equal(false, request_error_returns_false { req.verify(@dsa512) })
|
|
req.version = 1
|
|
assert_equal(false, req.verify(@rsa1024))
|
|
rescue OpenSSL::X509::RequestError
|
|
end
|
|
|
|
assert_raise(OpenSSL::X509::RequestError){
|
|
issue_csr(0, @dn, @dsa512, OpenSSL::Digest::MD5.new) }
|
|
end
|
|
|
|
private
|
|
|
|
def request_error_returns_false
|
|
yield
|
|
rescue OpenSSL::X509::RequestError
|
|
false
|
|
end
|
|
end
|
|
|
|
end
|