Skip to content

instead of looking of NIDs and then using X509V3_EXT_nconf_nid, #141

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Aug 31, 2023
Merged

instead of looking of NIDs and then using X509V3_EXT_nconf_nid, #141

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9cdfa3a
test/openssl/test_ossl.rb: relax assertion for error messages
rhenium Aug 31, 2023
91ae46c
x509ext: test OpenSSL::X509::ExtensionFactory#create_ext with ln
rhenium Aug 31, 2023
9f15741
x509ext: let X509::ExtensionFactory#create_ext take a dotted OID string
mcr Aug 27, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions ext/openssl/ossl_x509ext.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -209,15 +209,16 @@ ossl_x509extfactory_create_ext(int argc, VALUE *argv, VALUE self)
int nid;
VALUE rconf;
CONF *conf;
const char *oid_cstr = NULL;

rb_scan_args(argc, argv, "21", &oid, &value, &critical);
StringValueCStr(oid);
StringValue(value);
if(NIL_P(critical)) critical = Qfalse;

nid = OBJ_ln2nid(RSTRING_PTR(oid));
if(!nid) nid = OBJ_sn2nid(RSTRING_PTR(oid));
if(!nid) ossl_raise(eX509ExtError, "unknown OID `%"PRIsVALUE"'", oid);
oid_cstr = StringValueCStr(oid);
nid = OBJ_ln2nid(oid_cstr);
if (nid != NID_undef)
oid_cstr = OBJ_nid2sn(nid);

valstr = rb_str_new2(RTEST(critical) ? "critical," : "");
rb_str_append(valstr, value);
Expand All @@ -228,7 +229,12 @@ ossl_x509extfactory_create_ext(int argc, VALUE *argv, VALUE self)
rconf = rb_iv_get(self, "@config");
conf = NIL_P(rconf) ? NULL : GetConfig(rconf);
X509V3_set_nconf(ctx, conf);
ext = X509V3_EXT_nconf_nid(conf, ctx, nid, RSTRING_PTR(valstr));

#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_IS_LIBRESSL
ext = X509V3_EXT_nconf(conf, ctx, oid_cstr, RSTRING_PTR(valstr));
#else
ext = X509V3_EXT_nconf(conf, ctx, (char *)oid_cstr, RSTRING_PTR(valstr));
#endif
X509V3_set_ctx_nodb(ctx);
if (!ext){
ossl_raise(eX509ExtError, "%"PRIsVALUE" = %"PRIsVALUE, oid, valstr);
Expand Down
3 changes: 2 additions & 1 deletion test/openssl/test_ossl.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,8 +67,9 @@ def test_error_data
#
# The generated message should look like:
# "subjectAltName = IP:not.a.valid.ip.address: bad ip address (value=not.a.valid.ip.address)"
# "subjectAltName = IP:not.a.valid.ip.address: error in extension (name=subjectAltName, value=IP:not.a.valid.ip.address)"
ef = OpenSSL::X509::ExtensionFactory.new
assert_raise_with_message(OpenSSL::X509::ExtensionError, /\(value=not.a.valid.ip.address\)/) {
assert_raise_with_message(OpenSSL::X509::ExtensionError, /value=(IP:)?not.a.valid.ip.address\)/) {
ef.create_ext("subjectAltName", "IP:not.a.valid.ip.address")
}
end
Expand Down
19 changes: 19 additions & 0 deletions test/openssl/test_x509ext.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,25 @@ def test_create_by_factory
assert_match(%r{http://cps.example.com}, cp.value)
end

def test_factory_create_extension_sn_ln
ef = OpenSSL::X509::ExtensionFactory.new
bc_sn = ef.create_extension("basicConstraints", "critical, CA:TRUE, pathlen:2")
bc_ln = ef.create_extension("X509v3 Basic Constraints", "critical, CA:TRUE, pathlen:2")
assert_equal(@basic_constraints.to_der, bc_sn.to_der)
assert_equal(@basic_constraints.to_der, bc_ln.to_der)
end

def test_factory_create_extension_oid
ef = OpenSSL::X509::ExtensionFactory.new
ef.config = OpenSSL::Config.parse(<<~_end_of_cnf_)
[basic_constraints]
cA = BOOLEAN:TRUE
pathLenConstraint = INTEGER:2
_end_of_cnf_
bc_oid = ef.create_extension("2.5.29.19", "ASN1:SEQUENCE:basic_constraints", true)
assert_equal(@basic_constraints.to_der, bc_oid.to_der)
end

def test_dup
ext = OpenSSL::X509::Extension.new(@basic_constraints.to_der)
assert_equal(@basic_constraints.to_der, ext.to_der)
Expand Down