ruby.git/test/openssl/test_x509store.rb, branch v3_2_11

[ruby/openssl] test: adjust test cases for LibreSSL 3.2.4

2021-03-16T10:37:06+00:00

LibreSSL 3.2.4 made the certificate verification logic back closer to
pre-3.2.2 one, which is more compatible with OpenSSL.

Part of the fixes added by commit a0e98d48c91f ("Enhance TLS 1.3 support
on LibreSSL 3.2/3.3", 2020-12-03) is required for 3.2.2 and 3.2.3 only
(and ~3.3.1, however 3.3 does not have a stable release yet). Since both
releases are security fix, it should be safe to remove those special
treatment from our test suite.

While we are at it, TestSSL#test_ecdh_curves is split into TLS 1.2 and
TLS 1.3 variants for clarity.

https://github.com/ruby/openssl/commit/a9954bac22

[ruby/openssl] Enhance TLS 1.3 support on LibreSSL 3.2/3.3

2021-03-16T10:37:06+00:00

This defines TLS1_3_VERSION when using LibreSSL 3.2+.  LibreSSL 3.2/3.3
doesn't advertise this by default, even though it will use TLS 1.3
in both client and server modes.

Changes between LibreSSL 3.1 and 3.2/3.3 broke a few tests, Defining
TLS1_3_VERSION by itself fixes 1 test failure.  A few tests now
fail on LibreSSL 3.2/3.3 unless TLS 1.2 is set as the maximum version,
and this adjusts those tests.  The client CA test doesn't work in
LibreSSL 3.2+, so I've marked that as pending.

For the hostname verification, LibreSSL 3.2.2+ has a new stricter
hostname verifier that doesn't like subjectAltName such as
c*.example.com and d.*.example.com, so adjust the related tests.

With these changes, the tests pass on LibreSSL 3.2/3.3.

https://github.com/ruby/openssl/commit/a0e98d48c9

[ruby/openssl] test/openssl/test_x509store: tidy up tests for X509::Store#add_cert

2021-03-16T10:16:11+00:00

Rename the test case to test_add_cert_duplicate to clarify what it is
actually testing.

https://github.com/ruby/openssl/commit/4cc3c4110f

[ruby/openssl] test/openssl/test_x509store: break up test_verify

2021-03-16T10:16:11+00:00

The test case is huge and too complex. Break it up into separate test
cases for better documentation.

https://github.com/ruby/openssl/commit/61012df03b

[ruby/openssl] x509store: emit warning if arguments are given to X509::Store.new

2021-03-16T10:16:11+00:00

Anything passed to OpenSSL::X509::Store.new was always ignored. Let's
emit an explicit warning to not confuse users.

https://github.com/ruby/openssl/commit/d173700eeb

[ruby/openssl] x509store: let X509::Store#add_file raise TypeError if nil is given

2021-03-16T10:16:11+00:00

Undo special treatment of nil and simply pass the value to
StringValueCStr().

nil was never a valid argument for the method; OpenSSL::X509::StoreError
with an unhelpful error message "system lib" was raised in that case.

https://github.com/ruby/openssl/commit/fb2fcbb137

Revert the related commits about `Tempfile.open` change.

2020-09-09T12:10:48+00:00

  Start with https://github.com/ruby/ruby/commit/fa21985a7a2f8f52a8bd82bd12a724e9dca74934
  to https://github.com/ruby/ruby/commit/d7492a0be885ea9f2b9f71e3e95582f9a859c439

Fix usages of Tempfile.open(&block) that expected the file to still be there after the block

2020-08-29T10:30:24+00:00

Test out fix for OpenSSL test flakiness

2020-08-11T16:01:51+00:00

`OpenSSL::TestX509Store#test_verify` has been failing intermittently on
CI about once a day:
  - http://ci.rvm.jp/results/trunk-random2@phosphorus-docker/3121244
  - http://ci.rvm.jp/results/trunk-random1@phosphorus-docker/3117661
  - http://ci.rvm.jp/results/trunk-random1@phosphorus-docker/3111684

According to the test:
 > OpenSSL uses time(2) while Time.now uses clock_gettime(CLOCK_REALTIME),
 > and there may be difference.

This difference is could be the cause for the flaky failures. Let's see
if giving the certificate more room solves the problem.

In any case, I will revert this in a week. I think changes to these
should go to https://github.com/ruby/openssl/?

Add more debug info to test_verify

2020-08-06T15:16:06+00:00

http://ci.rvm.jp/results/trunk-random1@phosphorus-docker/3111684