openssl: import v2.0.0

Import Ruby/OpenSSL 2.0.0. The full commit history since 2.0.0 beta.2
(imported at r56098) can be found at:

  https://github.com/ruby/openssl/compare/v2.0.0.beta.2...v2.0.0

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56946 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 24 insertions, 59 deletions

diff --git a/test/openssl/test_x509cert.rb b/test/openssl/test_x509cert.rb
index 269d017298..fb757c44ec 100644
--- a/test/openssl/test_x509cert.rb
+++ b/test/openssl/test_x509cert.rb
@@ -11,7 +11,6 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase
     @dsa512  = OpenSSL::TestUtils::TEST_KEY_DSA512
     @ca = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=CA")
     @ee1 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=EE1")
-    @ee2 = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=EE2")
   end
 
   def issue_cert(*args)
@@ -20,8 +19,7 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase
 
   def test_serial
     [1, 2**32, 2**100].each{|s|
-      cert = issue_cert(@ca, @rsa2048, s, Time.now, Time.now+3600, [],
-                        nil, nil, OpenSSL::Digest::SHA1.new)
+      cert = issue_cert(@ca, @rsa2048, s, [], nil, nil)
       assert_equal(s, cert.serial)
       cert = OpenSSL::X509::Certificate.new(cert.to_der)
       assert_equal(s, cert.serial)
@@ -41,8 +39,7 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase
     [
       [@rsa1024, sha1], [@rsa2048, sha1], [@dsa256, dsa_digest], [@dsa512, dsa_digest]
     ].each{|pk, digest|
-      cert = issue_cert(@ca, pk, 1, Time.now, Time.now+3600, exts,
-                        nil, nil, digest)
+      cert = issue_cert(@ca, pk, 1, exts, nil, nil, digest: digest)
       assert_equal(cert.extensions.sort_by(&:to_s)[2].value,
                    OpenSSL::TestUtils.get_subject_key_id(cert))
       cert = OpenSSL::X509::Certificate.new(cert.to_der)
@@ -52,27 +49,27 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase
   end
 
   def test_validity
-    now = Time.now until now && now.usec != 0
-    cert = issue_cert(@ca, @rsa2048, 1, now, now+3600, [],
-                      nil, nil, OpenSSL::Digest::SHA1.new)
-    assert_not_equal(now, cert.not_before)
-    assert_not_equal(now+3600, cert.not_after)
+    now = Time.at(Time.now.to_i + 0.9)
+    cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil,
+                      not_before: now, not_after: now+3600)
+    assert_equal(Time.at(now.to_i), cert.not_before)
+    assert_equal(Time.at(now.to_i+3600), cert.not_after)
 
     now = Time.at(now.to_i)
-    cert = issue_cert(@ca, @rsa2048, 1, now, now+3600, [],
-                      nil, nil, OpenSSL::Digest::SHA1.new)
+    cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil,
+                      not_before: now, not_after: now+3600)
     assert_equal(now.getutc, cert.not_before)
     assert_equal((now+3600).getutc, cert.not_after)
 
     now = Time.at(0)
-    cert = issue_cert(@ca, @rsa2048, 1, now, now, [],
-                      nil, nil, OpenSSL::Digest::SHA1.new)
+    cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil,
+                      not_before: now, not_after: now)
     assert_equal(now.getutc, cert.not_before)
     assert_equal(now.getutc, cert.not_after)
 
     now = Time.at(0x7fffffff)
-    cert = issue_cert(@ca, @rsa2048, 1, now, now, [],
-                      nil, nil, OpenSSL::Digest::SHA1.new)
+    cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil,
+                      not_before: now, not_after: now)
     assert_equal(now.getutc, cert.not_before)
     assert_equal(now.getutc, cert.not_after)
   end
@@ -84,8 +81,7 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase
       ["subjectKeyIdentifier","hash",false],
       ["authorityKeyIdentifier","keyid:always",false],
     ]
-    ca_cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, ca_exts,
-                         nil, nil, OpenSSL::Digest::SHA1.new)
+    ca_cert = issue_cert(@ca, @rsa2048, 1, ca_exts, nil, nil)
     ca_cert.extensions.each_with_index{|ext, i|
       assert_equal(ca_exts[i].first, ext.oid)
       assert_equal(ca_exts[i].last, ext.critical?)
@@ -98,34 +94,16 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase
       ["extendedKeyUsage","clientAuth, emailProtection, codeSigning",false],
       ["subjectAltName","email:ee1@ruby-lang.org",false],
     ]
-    ee1_cert = issue_cert(@ee1, @rsa1024, 2, Time.now, Time.now+1800, ee1_exts,
-                          ca_cert, @rsa2048, OpenSSL::Digest::SHA1.new)
+    ee1_cert = issue_cert(@ee1, @rsa1024, 2, ee1_exts, ca_cert, @rsa2048)
     assert_equal(ca_cert.subject.to_der, ee1_cert.issuer.to_der)
     ee1_cert.extensions.each_with_index{|ext, i|
       assert_equal(ee1_exts[i].first, ext.oid)
       assert_equal(ee1_exts[i].last, ext.critical?)
     }
-
-    ee2_exts = [
-      ["keyUsage","Non Repudiation, Digital Signature, Key Encipherment",true],
-      ["subjectKeyIdentifier","hash",false],
-      ["authorityKeyIdentifier","issuer:always",false],
-      ["extendedKeyUsage","clientAuth, emailProtection, codeSigning",false],
-      ["subjectAltName","email:ee2@ruby-lang.org",false],
-    ]
-    ee2_cert = issue_cert(@ee2, @rsa1024, 3, Time.now, Time.now+1800, ee2_exts,
-                          ca_cert, @rsa2048, OpenSSL::Digest::MD5.new)
-    assert_equal(ca_cert.subject.to_der, ee2_cert.issuer.to_der)
-    ee2_cert.extensions.each_with_index{|ext, i|
-      assert_equal(ee2_exts[i].first, ext.oid)
-      assert_equal(ee2_exts[i].last, ext.critical?)
-    }
-
   end
 
   def test_sign_and_verify_rsa_sha1
-    cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [],
-                      nil, nil, OpenSSL::Digest::SHA1.new)
+    cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil, digest: "sha1")
     assert_equal(false, cert.verify(@rsa1024))
     assert_equal(true,  cert.verify(@rsa2048))
     assert_equal(false, certificate_error_returns_false { cert.verify(@dsa256) })
@@ -135,8 +113,7 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase
   end
 
   def test_sign_and_verify_rsa_md5
-    cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [],
-                      nil, nil, OpenSSL::Digest::MD5.new)
+    cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil, digest: "md5")
     assert_equal(false, cert.verify(@rsa1024))
     assert_equal(true, cert.verify(@rsa2048))
 
@@ -148,8 +125,7 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase
   end
 
   def test_sign_and_verify_dsa
-    cert = issue_cert(@ca, @dsa512, 1, Time.now, Time.now+3600, [],
-                      nil, nil, OpenSSL::TestUtils::DSA_SIGNATURE_DIGEST.new)
+    cert = issue_cert(@ca, @dsa512, 1, [], nil, nil)
     assert_equal(false, certificate_error_returns_false { cert.verify(@rsa1024) })
     assert_equal(false, certificate_error_returns_false { cert.verify(@rsa2048) })
     assert_equal(false, cert.verify(@dsa256))
@@ -159,8 +135,7 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase
   end
 
   def test_sign_and_verify_rsa_dss1
-    cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [],
-                      nil, nil, OpenSSL::Digest::DSS1.new)
+    cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil, digest: OpenSSL::Digest::DSS1.new)
     assert_equal(false, cert.verify(@rsa1024))
     assert_equal(true, cert.verify(@rsa2048))
     assert_equal(false, certificate_error_returns_false { cert.verify(@dsa256) })
@@ -172,27 +147,19 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase
 
   def test_sign_and_verify_dsa_md5
     assert_raise(OpenSSL::X509::CertificateError){
-      issue_cert(@ca, @dsa512, 1, Time.now, Time.now+3600, [],
-                 nil, nil, OpenSSL::Digest::MD5.new)
+      issue_cert(@ca, @dsa512, 1, [], nil, nil, digest: "md5")
     }
   end
 
   def test_dsig_algorithm_mismatch
     assert_raise(OpenSSL::X509::CertificateError) do
-      issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [],
-                 nil, nil, OpenSSL::Digest::DSS1.new)
+      issue_cert(@ca, @rsa2048, 1, [], nil, nil, digest: OpenSSL::Digest::DSS1.new)
     end if OpenSSL::OPENSSL_VERSION_NUMBER < 0x10001000 # [ruby-core:42949]
-
-    assert_raise(OpenSSL::X509::CertificateError) do
-      issue_cert(@ca, @dsa512, 1, Time.now, Time.now+3600, [],
-                 nil, nil, OpenSSL::Digest::MD5.new)
-    end
   end
 
   def test_dsa_with_sha2
     begin
-      cert = issue_cert(@ca, @dsa256, 1, Time.now, Time.now+3600, [],
-                        nil, nil, OpenSSL::Digest::SHA256.new)
+      cert = issue_cert(@ca, @dsa256, 1, [], nil, nil, digest: "sha256")
       assert_equal("dsa_with_SHA256", cert.signature_algorithm)
     rescue OpenSSL::X509::CertificateError
       # dsa_with_sha2 not supported. skip following test.
@@ -201,14 +168,12 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase
     # TODO: need more tests for dsa + sha2
 
     # SHA1 is allowed from OpenSSL 1.0.0 (0.9.8 requires DSS1)
-    cert = issue_cert(@ca, @dsa256, 1, Time.now, Time.now+3600, [],
-                      nil, nil, OpenSSL::Digest::SHA1.new)
+    cert = issue_cert(@ca, @dsa256, 1, [], nil, nil, digest: "sha1")
     assert_equal("dsaWithSHA1", cert.signature_algorithm)
   end if defined?(OpenSSL::Digest::SHA256)
 
   def test_check_private_key
-    cert = issue_cert(@ca, @rsa2048, 1, Time.now, Time.now+3600, [],
-                      nil, nil, OpenSSL::Digest::SHA1.new)
+    cert = issue_cert(@ca, @rsa2048, 1, [], nil, nil)
     assert_equal(true, cert.check_private_key(@rsa2048))
   end