1require_relative "utils"
2
3if defined?(OpenSSL)
4
5class OpenSSL::TestX509Certificate < Test::Unit::TestCase
6  def setup
7    @rsa1024 = OpenSSL::TestUtils::TEST_KEY_RSA1024
8    @rsa2048 = OpenSSL::TestUtils::TEST_KEY_RSA2048
9    @dsa256  = OpenSSL::TestUtils::TEST_KEY_DSA256
10    @dsa512  = OpenSSL::TestUtils::TEST_KEY_DSA512
11    @ca = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=CA")
12    @ee1 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=EE1")
13    @ee2 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=EE2")
14  end
15
16  def teardown
17  end
18
19  def issue_cert(*args)
20    OpenSSL::TestUtils.issue_cert(*args)
21  end
22
23  def test_serial
24    [1, 2**32, 2**100].each{|s|
25      cert = issue_cert(@ca, @rsa2048, s, Time.now, Time.now+3600, [],
26                        nil, nil, OpenSSL::Digest::SHA1.new)
27      assert_equal(s, cert.serial)
28      cert = OpenSSL::X509::Certificate.new(cert.to_der)
29      assert_equal(s, cert.serial)
30    }
31  end
32
33  def test_public_key
34    exts = [
35      ["basicConstraints","CA:TRUE",true],
36      ["subjectKeyIdentifier","hash",false],
37      ["authorityKeyIdentifier","keyid:always",false],
38    ]
39
40    sha1 = OpenSSL::Digest::SHA1.new
41    dsa_digest = OpenSSL::TestUtils::DSA_SIGNATURE_DIGEST.new
42
43    [
44      [@rsa1024, sha1], [@rsa2048, sha1], [@dsa256, dsa_digest], [@dsa512, dsa_digest]
45    ].each{|pk, digest|
46      cert = issue_cert(@ca, pk, 1, Time.now, Time.now+3600, exts,
47                        nil, nil, digest)
48      assert_equal(cert.extensions[1].value,
49                   OpenSSL::TestUtils.get_subject_key_id(cert))
50      cert = OpenSSL::X509::Certificate.new(cert.to_der)
51      assert_equal(cert.extensions[1].value,
52                   OpenSSL::TestUtils.get_subject_key_id(cert))
53    }
54  end
55
56  def test_validity
57    now = Time.now until now && now.usec != 0
58    cert = issue_cert(@ca, @rsa2048, 1, now, now+3600, [],
59                      nil, nil, OpenSSL::Digest::SHA1.new)
60    assert_not_equal(now, cert.not_before)
61    assert_not_equal(now+3600, cert.not_after)
62
63    now = Time.at(now.to_i)
64    cert = issue_cert(@ca, @rsa2048, 1, now, now+3600, [],
65                      nil, nil, OpenSSL::Digest::SHA1.new)
66    assert_equal(now.getutc, cert.not_before)
67    assert_equal((now+3600).getutc, cert.not_after)
68
69    now = Time.at(0)
70    cert = issue_cert(@ca, @rsa2048, 1, now, now, [],
71                      nil, nil, OpenSSL::Digest::SHA1.new)
72    assert_equal(now.getutc, cert.not_before)
73    assert_equal(now.getutc, cert.not_after)
74
75    now = Time.at(0x7fffffff)
76    cert = issue_cert(@ca, @rsa2048, 1, now, now, [],
77                      nil, nil, OpenSSL::Digest::SHA1.new)
78    assert_equal(now.getutc, cert.not_before)
79    assert_equal(now.getutc, cert.not_after)
80  end
81
82  def test_extension
83    ca_exts = [
84      ["basicConstraints","CA:TRUE",true],
85      ["keyUsage","keyCertSign, cRLSign",true],
86      ["subjectKeyIdentifier","hash",false],
87      ["authorityKeyIdentifier","keyid:always",false],
88    ]
89    ca_cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, ca_exts,
90                         nil, nil, OpenSSL::Digest::SHA1.new)
91    ca_cert.extensions.each_with_index{|ext, i|
92      assert_equal(ca_exts[i].first, ext.oid)
93      assert_equal(ca_exts[i].last, ext.critical?)
94    }
95
96    ee1_exts = [
97      ["keyUsage","Non Repudiation, Digital Signature, Key Encipherment",true],
98      ["subjectKeyIdentifier","hash",false],
99      ["authorityKeyIdentifier","keyid:always",false],
100      ["extendedKeyUsage","clientAuth, emailProtection, codeSigning",false],
101      ["subjectAltName","email:ee1@ruby-lang.org",false],
102    ]
103    ee1_cert = issue_cert(@ee1, @rsa1024, 2, Time.now, Time.now+1800, ee1_exts,
104                          ca_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
105    assert_equal(ca_cert.subject.to_der, ee1_cert.issuer.to_der)
106    ee1_cert.extensions.each_with_index{|ext, i|
107      assert_equal(ee1_exts[i].first, ext.oid)
108      assert_equal(ee1_exts[i].last, ext.critical?)
109    }
110
111    ee2_exts = [
112      ["keyUsage","Non Repudiation, Digital Signature, Key Encipherment",true],
113      ["subjectKeyIdentifier","hash",false],
114      ["authorityKeyIdentifier","issuer:always",false],
115      ["extendedKeyUsage","clientAuth, emailProtection, codeSigning",false],
116      ["subjectAltName","email:ee2@ruby-lang.org",false],
117    ]
118    ee2_cert = issue_cert(@ee2, @rsa1024, 3, Time.now, Time.now+1800, ee2_exts,
119                          ca_cert, @rsa2048, OpenSSL::Digest::MD5.new)
120    assert_equal(ca_cert.subject.to_der, ee2_cert.issuer.to_der)
121    ee2_cert.extensions.each_with_index{|ext, i|
122      assert_equal(ee2_exts[i].first, ext.oid)
123      assert_equal(ee2_exts[i].last, ext.critical?)
124    }
125
126  end
127
128  def test_sign_and_verify
129    cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [],
130                      nil, nil, OpenSSL::Digest::SHA1.new)
131    assert_equal(false, cert.verify(@rsa1024))
132    assert_equal(true,  cert.verify(@rsa2048))
133    assert_equal(false, certificate_error_returns_false { cert.verify(@dsa256) })
134    assert_equal(false, certificate_error_returns_false { cert.verify(@dsa512) })
135    cert.serial = 2
136    assert_equal(false, cert.verify(@rsa2048))
137
138    cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [],
139                      nil, nil, OpenSSL::Digest::MD5.new)
140    assert_equal(false, cert.verify(@rsa1024))
141    assert_equal(true, cert.verify(@rsa2048))
142
143    assert_equal(false, certificate_error_returns_false { cert.verify(@dsa256) })
144    assert_equal(false, certificate_error_returns_false { cert.verify(@dsa512) })
145    cert.subject = @ee1
146    assert_equal(false, cert.verify(@rsa2048))
147
148    cert = issue_cert(@ca, @dsa512, 1, Time.now, Time.now+3600, [],
149                      nil, nil, OpenSSL::TestUtils::DSA_SIGNATURE_DIGEST.new)
150    assert_equal(false, certificate_error_returns_false { cert.verify(@rsa1024) })
151    assert_equal(false, certificate_error_returns_false { cert.verify(@rsa2048) })
152    assert_equal(false, cert.verify(@dsa256))
153    assert_equal(true,  cert.verify(@dsa512))
154    cert.not_after = Time.now
155    assert_equal(false, cert.verify(@dsa512))
156
157    begin
158      cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [],
159                        nil, nil, OpenSSL::Digest::DSS1.new)
160      assert_equal(false, cert.verify(@rsa1024))
161      assert_equal(true, cert.verify(@rsa2048))
162      assert_equal(false, certificate_error_returns_false { cert.verify(@dsa256) })
163      assert_equal(false, certificate_error_returns_false { cert.verify(@dsa512) })
164      cert.subject = @ee1
165      assert_equal(false, cert.verify(@rsa2048))
166    rescue OpenSSL::X509::CertificateError
167    end
168
169    assert_raise(OpenSSL::X509::CertificateError){
170      issue_cert(@ca, @dsa512, 1, Time.now, Time.now+3600, [],
171                 nil, nil, OpenSSL::Digest::MD5.new)
172    }
173  end
174
175  def test_dsig_algorithm_mismatch
176    assert_raise(OpenSSL::X509::CertificateError) do
177      issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [],
178                 nil, nil, OpenSSL::Digest::DSS1.new)
179    end if OpenSSL::OPENSSL_VERSION_NUMBER < 0x10001000 # [ruby-core:42949]
180
181    assert_raise(OpenSSL::X509::CertificateError) do
182      issue_cert(@ca, @dsa512, 1, Time.now, Time.now+3600, [],
183                 nil, nil, OpenSSL::Digest::MD5.new)
184    end
185  end
186
187  def test_dsa_with_sha2
188    begin
189      cert = issue_cert(@ca, @dsa256, 1, Time.now, Time.now+3600, [],
190                        nil, nil, OpenSSL::Digest::SHA256.new)
191      assert_equal("dsa_with_SHA256", cert.signature_algorithm)
192    rescue OpenSSL::X509::CertificateError
193      # dsa_with_sha2 not supported. skip following test.
194      return
195    end
196    # TODO: need more tests for dsa + sha2
197
198    # SHA1 is allowed from OpenSSL 1.0.0 (0.9.8 requires DSS1)
199    cert = issue_cert(@ca, @dsa256, 1, Time.now, Time.now+3600, [],
200                      nil, nil, OpenSSL::Digest::SHA1.new)
201    assert_equal("dsaWithSHA1", cert.signature_algorithm)
202  end if defined?(OpenSSL::Digest::SHA256)
203
204  def test_check_private_key
205    cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [],
206                      nil, nil, OpenSSL::Digest::SHA1.new)
207    assert_equal(true, cert.check_private_key(@rsa2048))
208  end
209
210  private
211
212  def certificate_error_returns_false
213    yield
214  rescue OpenSSL::X509::CertificateError
215    false
216  end
217end
218
219end
220