summaryrefslogtreecommitdiff
path: root/test/openssl
diff options
context:
space:
mode:
authorgotoyuzo <gotoyuzo@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2005-05-28 07:41:36 +0000
committergotoyuzo <gotoyuzo@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2005-05-28 07:41:36 +0000
commit1e0f2f7ca8053ba209fd3b68a64061b015eb24ba (patch)
tree7777edb93876cf1160b842ac12a7a93a54c6507a /test/openssl
parentca144bc1920c55a508728ed3d0fc662c00403797 (diff)
* test/openssl/test_x509store.rb: add test for expired CRL
and refine some assertions. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@8534 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'test/openssl')
-rw-r--r--test/openssl/test_x509store.rb35
1 files changed, 28 insertions, 7 deletions
diff --git a/test/openssl/test_x509store.rb b/test/openssl/test_x509store.rb
index 8151e5f..6696020 100644
--- a/test/openssl/test_x509store.rb
+++ b/test/openssl/test_x509store.rb
@@ -61,6 +61,9 @@ class OpenSSL::TestX509Store < Test::Unit::TestCase
revoke_info = [ [20, now, 1], ]
crl2 = issue_crl(revoke_info, 1, now, now+1800, [],
ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
+ revoke_info = []
+ crl2_2 = issue_crl(revoke_info, 2, now-100, now-1, [],
+ ca2_cert, @rsa1024, OpenSSL::Digest::SHA1.new)
assert(true, ca1_cert.verify(ca1_cert.public_key)) # self signed
assert(true, ca2_cert.verify(ca1_cert.public_key)) # issued by ca1
@@ -70,6 +73,7 @@ class OpenSSL::TestX509Store < Test::Unit::TestCase
assert(true, crl1.verify(ca1_cert.public_key)) # issued by ca1
assert(true, crl1_2.verify(ca1_cert.public_key)) # issued by ca1
assert(true, crl2.verify(ca2_cert.public_key)) # issued by ca2
+ assert(true, crl2_2.verify(ca2_cert.public_key)) # issued by ca2
store = OpenSSL::X509::Store.new
assert_equal(false, store.verify(ca1_cert))
@@ -107,8 +111,10 @@ class OpenSSL::TestX509Store < Test::Unit::TestCase
assert_equal(@ca2.to_der, chain[1].subject.to_der)
assert_equal(@ca1.to_der, chain[2].subject.to_der)
assert_equal(false, store.verify(ee3_cert))
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
assert_match(/expire/i, store.error_string)
assert_equal(false, store.verify(ee4_cert))
+ assert_equal(OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID, store.error)
assert_match(/not yet valid/i, store.error_string)
store = OpenSSL::X509::Store.new
@@ -121,23 +127,23 @@ class OpenSSL::TestX509Store < Test::Unit::TestCase
store.time = now + 1900
assert_equal(true, store.verify(ca1_cert))
assert_equal(false, store.verify(ca2_cert))
- assert_match(/expire/i, store.error_string)
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
assert_equal(false, store.verify(ee4_cert))
- assert_match(/expire/i, store.error_string)
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
store.time = now + 4000
assert_equal(false, store.verify(ee1_cert))
- assert_match(/expire/i, store.error_string)
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
assert_equal(false, store.verify(ee4_cert))
- assert_match(/expire/i, store.error_string)
+ assert_equal(OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED, store.error)
# the underlying X509 struct caches the result of the last
# verification for signature and not-before. so the following code
# rebuilds new objects to avoid site effect.
store.time = Time.now - 4000
assert_equal(false, store.verify(OpenSSL::X509::Certificate.new(ca2_cert)))
- assert_match(/not yet valid/i, store.error_string)
+ assert_equal(OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID, store.error)
assert_equal(false, store.verify(OpenSSL::X509::Certificate.new(ee1_cert)))
- assert_match(/not yet valid/i, store.error_string)
+ assert_equal(OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID, store.error)
return unless defined?(OpenSSL::X509::V_FLAG_CRL_CHECK)
@@ -160,7 +166,8 @@ class OpenSSL::TestX509Store < Test::Unit::TestCase
store.add_crl(crl2) # revoke ee2_cert
assert_equal(true, store.verify(ca1_cert))
assert_equal(false, store.verify(ca2_cert))
- assert_equal(true, store.verify(ee1_cert, [ca2_cert]))
+ assert_equal(true, store.verify(ee1_cert, [ca2_cert]),
+ "This test is expected to be success with OpenSSL 0.9.7c or later.")
assert_equal(false, store.verify(ee2_cert, [ca2_cert]))
store.flags =
@@ -169,6 +176,20 @@ class OpenSSL::TestX509Store < Test::Unit::TestCase
assert_equal(false, store.verify(ca2_cert))
assert_equal(false, store.verify(ee1_cert, [ca2_cert]))
assert_equal(false, store.verify(ee2_cert, [ca2_cert]))
+
+ store = OpenSSL::X509::Store.new
+ store.purpose = OpenSSL::X509::PURPOSE_ANY
+ store.flags =
+ OpenSSL::X509::V_FLAG_CRL_CHECK|OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
+ store.add_cert(ca1_cert)
+ store.add_cert(ca2_cert)
+ store.add_crl(crl1)
+ store.add_crl(crl2_2) # issued by ca2 but expired.
+ assert_equal(true, store.verify(ca1_cert))
+ assert_equal(true, store.verify(ca2_cert))
+ assert_equal(false, store.verify(ee1_cert))
+ assert_equal(OpenSSL::X509::V_ERR_CRL_HAS_EXPIRED, store.error)
+ assert_equal(false, store.verify(ee2_cert))
end
end