1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[ruby/openssl] ssl: manually craft invalid SAN extensions in tests

Browse Source 
Starting with LibreSSL 3.5, OpenSSL::X509::ExtensionFactory refuses to
create SAN extensions that are not valid according to RFC 6125. While
this behavior makes sense, we need such invalid extensions to test our
own validation routine. Let's construct SAN extensions manually instead.

https://github.com/ruby/openssl/commit/b420d6d739
This commit is contained in:
Kazuki Yamaguchi 2025-02-25 20:38:18 +09:00 committed by git
parent 244363b23e
commit 9994a95790
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
test/openssl/test_ssl.rb
View File

@ -835,11 +835,6 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase
# buzz.example.net, respectively). ...
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
create_cert_with_san('DNS:baz*.example.com'), 'baz1.example.com'))
# LibreSSL 3.5.0+ doesn't support other wildcard certificates
# (it isn't required to, as RFC states MAY, not MUST)
return if libressl?
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
create_cert_with_san('DNS:*baz.example.com'), 'foobaz.example.com'))
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
@ -923,11 +918,17 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase
end
def create_cert_with_san(san)
ef = OpenSSL::X509::ExtensionFactory.new
cert = OpenSSL::X509::Certificate.new
cert.subject = OpenSSL::X509::Name.parse("/DC=some/DC=site/CN=Some Site")
ext = ef.create_ext('subjectAltName', san)
cert.add_extension(ext)
v = OpenSSL::ASN1::Sequence(san.split(",").map { |item|
type, value = item.split(":", 2)
case type
when "DNS" then OpenSSL::ASN1::IA5String(value, 2, :IMPLICIT)
when "IP" then OpenSSL::ASN1::OctetString(IPAddr.new(value).hton, 7, :IMPLICIT)
else raise "unsupported"
end
})
cert.add_extension(OpenSSL::X509::Extension.new("subjectAltName", v))
cert
end