Skip to content

Commit eb30f9b

Browse files
kareskares
committed
re-invent OpenSSL::TestX509CRL#test_extension without the order requirement
1 parent 29b1950 commit eb30f9b

File tree

1 file changed

+103
-6
lines changed

1 file changed

+103
-6
lines changed

‎src/test/ruby/x509/test_x509crl.rb‎

Lines changed: 103 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,6 @@
44

55
class TestX509CRL < TestCase
66

7-
if defined? JRUBY_VERSION
8-
def setup; require 'jopenssl/load' end
9-
else
10-
def setup; require 'openssl' end
11-
end
12-
137
def test_new_crl
148
crl = OpenSSL::X509::CRL.new
159
assert_equal 0, crl.version
@@ -106,4 +100,107 @@ def test_revoked_crl_loading
106100
assert_equal Date.new(2014, 07, 07), Date.parse(revoked.time.strftime('%Y/%m/%d'))
107101
end
108102

103+
# NOTE: same as OpenSSL's test_extension but without extension order requirement ...
104+
def test_extension
105+
_rsa2048 = OpenSSL::PKey::RSA.new TEST_KEY_RSA2048
106+
_ca = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=CA")
107+
108+
cert_exts = [
109+
["basicConstraints", "CA:TRUE", true],
110+
["subjectKeyIdentifier", "hash", false],
111+
["authorityKeyIdentifier", "keyid:always", false],
112+
["subjectAltName", "email:xyzzy@ruby-lang.org", false],
113+
["keyUsage", "cRLSign, keyCertSign", true],
114+
]
115+
crl_exts = [
116+
["authorityKeyIdentifier", "keyid:always", false],
117+
["issuerAltName", "issuer:copy", false],
118+
]
119+
120+
now = Time.now
121+
cert = issue_cert(_ca, _rsa2048, 1, now, now + 3600, cert_exts, nil, nil, OpenSSL::Digest::SHA1.new)
122+
crl = issue_crl([], 1, now, now+1600, crl_exts, cert, _rsa2048, OpenSSL::Digest::SHA1.new)
123+
124+
exts = crl.extensions
125+
assert_equal(3, exts.size)
126+
assert_equal("1", exts[0].value)
127+
assert_equal("crlNumber", exts[0].oid)
128+
assert_equal(false, exts[0].critical?)
129+
130+
assert_equal("authorityKeyIdentifier", exts[1].oid)
131+
keyid = get_subject_key_id(cert)
132+
assert_match(/^keyid:#{keyid}/, exts[1].value)
133+
assert_equal(false, exts[1].critical?)
134+
135+
assert_equal("issuerAltName", exts[2].oid)
136+
assert_equal("email:xyzzy@ruby-lang.org", exts[2].value)
137+
assert_equal(false, exts[2].critical?)
138+
139+
crl = OpenSSL::X509::CRL.new(crl.to_der)
140+
exts = crl.extensions
141+
142+
# MRI expects to retain extension order : crlNumber, authorityKeyIdentifier, issuerAltName
143+
exts = exts.dup;
144+
ext1 = exts.find { |ext| ext.oid == 'authorityKeyIdentifier' }
145+
exts.delete(ext1); exts.unshift(ext1)
146+
ext0 = exts.find { |ext| ext.oid == 'crlNumber' }
147+
exts.delete(ext0); exts.unshift(ext0)
148+
# MRI
149+
150+
assert_equal(3, exts.size)
151+
assert_equal("1", exts[0].value)
152+
assert_equal("crlNumber", exts[0].oid)
153+
assert_equal(false, exts[0].critical?)
154+
155+
assert_equal("authorityKeyIdentifier", exts[1].oid)
156+
keyid = get_subject_key_id(cert)
157+
assert_match(/^keyid:#{keyid}/, exts[1].value)
158+
assert_equal(false, exts[1].critical?)
159+
160+
assert_equal("issuerAltName", exts[2].oid)
161+
assert_equal("email:xyzzy@ruby-lang.org", exts[2].value)
162+
assert_equal(false, exts[2].critical?)
163+
end
164+
165+
private
166+
167+
def get_subject_key_id(cert)
168+
asn1_cert = OpenSSL::ASN1.decode(cert)
169+
tbscert = asn1_cert.value[0]
170+
pkinfo = tbscert.value[6]
171+
publickey = pkinfo.value[1]
172+
pkvalue = publickey.value
173+
OpenSSL::Digest::SHA1.hexdigest(pkvalue).scan(/../).join(":").upcase
174+
end
175+
176+
TEST_KEY_RSA2048 = <<-_end_of_pem_
177+
-----BEGIN RSA PRIVATE KEY-----
178+
MIIEpAIBAAKCAQEAuV9ht9J7k4NBs38jOXvvTKY9gW8nLICSno5EETR1cuF7i4pN
179+
s9I1QJGAFAX0BEO4KbzXmuOvfCpD3CU+Slp1enenfzq/t/e/1IRW0wkJUJUFQign
180+
4CtrkJL+P07yx18UjyPlBXb81ApEmAB5mrJVSrWmqbjs07JbuS4QQGGXLc+Su96D
181+
kYKmSNVjBiLxVVSpyZfAY3hD37d60uG+X8xdW5v68JkRFIhdGlb6JL8fllf/A/bl
182+
NwdJOhVr9mESHhwGjwfSeTDPfd8ZLE027E5lyAVX9KZYcU00mOX+fdxOSnGqS/8J
183+
DRh0EPHDL15RcJjV2J6vZjPb0rOYGDoMcH+94wIDAQABAoIBAAzsamqfYQAqwXTb
184+
I0CJtGg6msUgU7HVkOM+9d3hM2L791oGHV6xBAdpXW2H8LgvZHJ8eOeSghR8+dgq
185+
PIqAffo4x1Oma+FOg3A0fb0evyiACyrOk+EcBdbBeLo/LcvahBtqnDfiUMQTpy6V
186+
seSoFCwuN91TSCeGIsDpRjbG1vxZgtx+uI+oH5+ytqJOmfCksRDCkMglGkzyfcl0
187+
Xc5CUhIJ0my53xijEUQl19rtWdMnNnnkdbG8PT3LZlOta5Do86BElzUYka0C6dUc
188+
VsBDQ0Nup0P6rEQgy7tephHoRlUGTYamsajGJaAo1F3IQVIrRSuagi7+YpSpCqsW
189+
wORqorkCgYEA7RdX6MDVrbw7LePnhyuaqTiMK+055/R1TqhB1JvvxJ1CXk2rDL6G
190+
0TLHQ7oGofd5LYiemg4ZVtWdJe43BPZlVgT6lvL/iGo8JnrncB9Da6L7nrq/+Rvj
191+
XGjf1qODCK+LmreZWEsaLPURIoR/Ewwxb9J2zd0CaMjeTwafJo1CZvcCgYEAyCgb
192+
aqoWvUecX8VvARfuA593Lsi50t4MEArnOXXcd1RnXoZWhbx5rgO8/ATKfXr0BK/n
193+
h2GF9PfKzHFm/4V6e82OL7gu/kLy2u9bXN74vOvWFL5NOrOKPM7Kg+9I131kNYOw
194+
Ivnr/VtHE5s0dY7JChYWE1F3vArrOw3T00a4CXUCgYEA0SqY+dS2LvIzW4cHCe9k
195+
IQqsT0yYm5TFsUEr4sA3xcPfe4cV8sZb9k/QEGYb1+SWWZ+AHPV3UW5fl8kTbSNb
196+
v4ng8i8rVVQ0ANbJO9e5CUrepein2MPL0AkOATR8M7t7dGGpvYV0cFk8ZrFx0oId
197+
U0PgYDotF/iueBWlbsOM430CgYEAqYI95dFyPI5/AiSkY5queeb8+mQH62sdcCCr
198+
vd/w/CZA/K5sbAo4SoTj8dLk4evU6HtIa0DOP63y071eaxvRpTNqLUOgmLh+D6gS
199+
Cc7TfLuFrD+WDBatBd5jZ+SoHccVrLR/4L8jeodo5FPW05A+9gnKXEXsTxY4LOUC
200+
9bS4e1kCgYAqVXZh63JsMwoaxCYmQ66eJojKa47VNrOeIZDZvd2BPVf30glBOT41
201+
gBoDG3WMPZoQj9pb7uMcrnvs4APj2FIhMU8U15LcPAj59cD6S6rWnAxO8NFK7HQG
202+
4Jxg3JNNf8ErQoCHb1B3oVdXJkmbJkARoDpBKmTCgKtP8ADYLmVPQw==
203+
-----END RSA PRIVATE KEY-----
204+
_end_of_pem_
205+
109206
end

0 commit comments

Comments
 (0)