openssl: add missing #to_der to OCSP::{CertificateId,BasicResponse}

* ext/openssl/ossl_ocsp.c (ossl_ocspbres_to_der, ossl_ocspcid_to_der):
  Implement #to_der methods for OCSP::BasicResponse and
  OCSP::CertificateId.

  (ossl_ocspreq_initialize, ossl_ocspres_initialize): Use GetOCSP*()
  instead of raw DATA_PTR().

  (ossl_ocspbres_initialize, ossl_ocspcid_initialize): Allow
  initializing from DER string.

  (Init_ossl_ocsp): Define new #to_der methods.

* test/openssl/test_ocsp.rb: Test these changes. Also add missing tests
  for OCSP::{Response,Request}#to_der.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55409 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 65 insertions, 2 deletions

diff --git a/test/openssl/test_ocsp.rb b/test/openssl/test_ocsp.rb
index d04b421615..7d4b39aec2 100644
--- a/test/openssl/test_ocsp.rb
+++ b/test/openssl/test_ocsp.rb
@@ -8,6 +8,10 @@ class OpenSSL::TestOCSP < OpenSSL::TestCase
     ca_subj = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=TestCA")
     ca_key = OpenSSL::TestUtils::TEST_KEY_RSA1024
     ca_serial = 0xabcabcabcabc
+    ca_exts = [
+      ["basicConstraints", "CA:TRUE", true],
+      ["keyUsage", "cRLSign,keyCertSign", true],
+    ]
 
     subj = OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=TestCert")
     @key = OpenSSL::TestUtils::TEST_KEY_RSA1024
@@ -17,9 +21,17 @@ class OpenSSL::TestOCSP < OpenSSL::TestCase
     dgst = OpenSSL::Digest::SHA1.new
 
     @ca_cert = OpenSSL::TestUtils.issue_cert(
-       ca_subj, ca_key, ca_serial, now, now+3600, [], nil, nil, dgst)
+       ca_subj, ca_key, ca_serial, now, now+3600, ca_exts, nil, nil, dgst)
     @cert = OpenSSL::TestUtils.issue_cert(
-       subj, @key, serial, now, now+3600, [], @ca_cert, nil, dgst)
+       subj, @key, serial, now, now+3600, [], @ca_cert, ca_key, dgst)
+
+    @key2 = OpenSSL::TestUtils::TEST_KEY_RSA2048
+    cert2_exts = [
+      ["extendedKeyUsage", "OCSPSigning", true],
+    ]
+    @cert2 = OpenSSL::TestUtils.issue_cert(
+       OpenSSL::X509::Name.parse("/DC=org/DC=ruby-lang/CN=TestCert2"),
+       @key2, serial+1, now, now+3600, cert2_exts, @ca_cert, ca_key, "SHA256")
   end
 
   def test_new_certificate_id
@@ -34,6 +46,30 @@ class OpenSSL::TestOCSP < OpenSSL::TestCase
     assert_equal @cert.serial, cid.serial
   end if defined?(OpenSSL::Digest::SHA256)
 
+  def test_certificate_id_der
+    cid = OpenSSL::OCSP::CertificateId.new(@cert, @ca_cert) # hash algorithm defaults to SHA-1
+    der = cid.to_der
+    asn1 = OpenSSL::ASN1.decode(der)
+    assert_equal OpenSSL::ASN1.ObjectId("SHA1").to_der, asn1.value[0].value[0].to_der
+    assert_equal OpenSSL::Digest::SHA1.digest(@cert.issuer.to_der), asn1.value[1].value
+    assert_equal OpenSSL::Digest::SHA1.digest(OpenSSL::ASN1.decode(@ca_cert.to_der).value[0].value[6].value[1].value), asn1.value[2].value
+    assert_equal @cert.serial, asn1.value[3].value
+    assert_equal der, OpenSSL::OCSP::CertificateId.new(der).to_der
+  end
+
+  def test_request_der
+    request = OpenSSL::OCSP::Request.new
+    cid = OpenSSL::OCSP::CertificateId.new(@cert, @ca_cert, OpenSSL::Digest::SHA1.new)
+    request.add_certid(cid)
+    request.sign(@cert, @key, [@ca_cert], 0)
+    asn1 = OpenSSL::ASN1.decode(request.to_der)
+    assert_equal cid.to_der, asn1.value[0].value.find { |a| a.tag_class == :UNIVERSAL }.value[0].value[0].to_der
+    assert_equal OpenSSL::ASN1.ObjectId("sha1WithRSAEncryption").to_der, asn1.value[1].value[0].value[0].value[0].to_der
+    assert_equal @cert.to_der, asn1.value[1].value[0].value[2].value[0].value[0].to_der
+    assert_equal @ca_cert.to_der, asn1.value[1].value[0].value[2].value[0].value[1].to_der
+    assert_equal asn1.to_der, OpenSSL::OCSP::Request.new(asn1.to_der).to_der
+  end
+
   def test_new_ocsp_request
     request = OpenSSL::OCSP::Request.new
     cid = OpenSSL::OCSP::CertificateId.new(@cert, @ca_cert, OpenSSL::Digest::SHA1.new)
@@ -43,6 +79,33 @@ class OpenSSL::TestOCSP < OpenSSL::TestCase
     # in current implementation not same instance of certificate id, but should contain same data
     assert_equal cid.serial, request.certid.first.serial
   end
+
+  def test_basic_response_der
+    bres = OpenSSL::OCSP::BasicResponse.new
+    cid = OpenSSL::OCSP::CertificateId.new(@cert, @ca_cert, OpenSSL::Digest::SHA1.new)
+    bres.add_status(cid, OpenSSL::OCSP::V_CERTSTATUS_GOOD, 0, nil, -300, 500, [])
+    bres.add_nonce("NONCE")
+    bres.sign(@cert2, @key2, [@ca_cert], 0)
+    der = bres.to_der
+    asn1 = OpenSSL::ASN1.decode(der)
+    assert_equal cid.to_der, asn1.value[0].value.find { |a| a.class == OpenSSL::ASN1::Sequence }.value[0].value[0].to_der
+    assert_equal OpenSSL::ASN1.Sequence([@cert2, @ca_cert]).to_der, asn1.value[3].value[0].to_der
+    assert_equal der, OpenSSL::OCSP::BasicResponse.new(der).to_der
+  end
+
+  def test_response_der
+    bres = OpenSSL::OCSP::BasicResponse.new
+    cid = OpenSSL::OCSP::CertificateId.new(@cert, @ca_cert, OpenSSL::Digest::SHA1.new)
+    bres.add_status(cid, OpenSSL::OCSP::V_CERTSTATUS_GOOD, 0, nil, -300, 500, [])
+    bres.sign(@cert2, @key2, [@ca_cert], 0)
+    res = OpenSSL::OCSP::Response.create(OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL, bres)
+    der = res.to_der
+    asn1 = OpenSSL::ASN1.decode(der)
+    assert_equal OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL, asn1.value[0].value
+    assert_equal OpenSSL::ASN1.ObjectId("basicOCSPResponse").to_der, asn1.value[1].value[0].value[0].to_der
+    assert_equal bres.to_der, asn1.value[1].value[0].value[1].value
+    assert_equal der, OpenSSL::OCSP::Response.new(der).to_der
+  end
 end
 
 end