fix signature-alg to default to NULL and report it as 0.0 (like MRI)

jruby · Nov 2, 2017 · 2ced388 · 2ced388
1 parent ec7b8e7
commit 2ced388
Showing 5 changed files with 18 additions and 6 deletions.
diff --git a/src/main/java/org/jruby/ext/openssl/X509CRL.java b/src/main/java/org/jruby/ext/openssl/X509CRL.java
@@ -434,7 +434,7 @@ public IRubyObject signature_algorithm() {
     }
 
     private RubyString signature_algorithm(final Ruby runtime) {
-        return RubyString.newString(runtime, getSignatureAlgorithm(runtime, "itu-t"));
+        return RubyString.newString(runtime, getSignatureAlgorithm(runtime, "NULL"));
     }
 
     private String getSignatureAlgorithm(final Ruby runtime, final String def) {

diff --git a/src/main/java/org/jruby/ext/openssl/X509Cert.java b/src/main/java/org/jruby/ext/openssl/X509Cert.java
@@ -225,8 +225,8 @@ private void initialize(final ThreadContext context, final byte[] encoded, final
         if ( sigAlgorithm == null ) sigAlgorithm = cert.getSigAlgName(); // e.g. SHA256withRSA
         else {
             sigAlgorithm = ASN1.oid2name(runtime, new ASN1ObjectIdentifier(sigAlgorithm), true);
-            if ( sigAlgorithm == null ) {
-                sigAlgorithm = "itu-t"; // MRI compability ... the "crazy" parts
+            if (sigAlgorithm == null) {
+                sigAlgorithm = "0.0"; // "NULL";
                 // for some certificates that MRI parses,
                 // we get getSigAlgOID() == getSigAlgName() == "0.0"
 

diff --git a/src/test/ruby/test_helper.rb b/src/test/ruby/test_helper.rb
@@ -137,6 +137,8 @@ def jruby?; self.class.jruby? end
 
   private
 
+  def debug(msg); puts msg if $VERBOSE end
+
   def issue_cert(dn, key, serial, not_before, not_after, extensions, issuer, issuer_key, digest)
     cert = OpenSSL::X509::Certificate.new
     issuer = cert unless issuer
@@ -186,6 +188,15 @@ def issue_crl(revoke_info, serial, lastup, nextup, extensions,
     crl
   end
 
+  def get_subject_key_id(cert)
+    asn1_cert = OpenSSL::ASN1.decode(cert)
+    tbscert   = asn1_cert.value[0]
+    pkinfo    = tbscert.value[6]
+    publickey = pkinfo.value[1]
+    pkvalue   = publickey.value
+    OpenSSL::Digest::SHA1.hexdigest(pkvalue).scan(/../).join(":").upcase
+  end
+
 end
 
 begin

diff --git a/src/test/ruby/x509/test_x509cert.rb b/src/test/ruby/x509/test_x509cert.rb
@@ -311,7 +311,8 @@ def test_to_text_npe_regression
   def test_cert_loading_regression
     cert_text = "0\x82\x01\xAD0\x82\x01\xA1\xA0\x03\x02\x01\x02\x02\x01\x010\x03\x06\x01\x000g1\v0\t\x06\x03U\x04\x06\x13\x02US1\x130\x11\x06\x03U\x04\b\f\nCalifornia1\x150\x13\x06\x03U\x04\a\f\fSanta Monica1\x110\x0F\x06\x03U\x04\n\f\bOneLogin1\x190\x17\x06\x03U\x04\x03\f\x10app.onelogin.com0\x1E\x17\r100309095845Z\x17\r150309095845Z0g1\v0\t\x06\x03U\x04\x06\x13\x02US1\x130\x11\x06\x03U\x04\b\f\nCalifornia1\x150\x13\x06\x03U\x04\a\f\fSanta Monica1\x110\x0F\x06\x03U\x04\n\f\bOneLogin1\x190\x17\x06\x03U\x04\x03\f\x10app.onelogin.com0\x81\x9F0\r\x06\t*\x86H\x86\xF7\r\x01\x01\x01\x05\x00\x03\x81\x8D\x000\x81\x89\x02\x81\x81\x00\xE8\xD2\xBBW\xE3?/\x1D\xE7\x0E\x10\xC8\xBD~\xCD\xDE!#\rL\x92G\xDF\xE1f?L\xB1\xBC9\x99\x14\xE5\x84\xD2Zi\x87<>d\xBD\x81\xF9\xBA\x85\xD2\xFF\xAA\x90\xF3Z\x97\xA5\x1D\xB0W\xC0\x93\xA3\x06IP\xB84\xF5\xD7Qu\x19\xFCB\xCA\xA3\xD4\\\x8E\v\x9B%\x13|\xB6m\x9D\xA8\x16\xE6\xBB\xDA\x87\xFF\xE3\xD7\xE9\xBA9\xC5O\xA2\xA7C\xADB\x04\xCA\xA5\x0E\x84\xD0\xA8\xE4\xFA\xDA\xF1\x89\xF2s\xFA1\x95\xAF\x03\xAB1\xAA\xE7y\x02\x03\x01\x00\x010\x03\x06\x01\x00\x03\x01\x00"
     assert cert = OpenSSL::X509::Certificate.new(cert_text)
-    assert cert.to_text.index('itu-t')
+    debug cert.to_text
+    assert cert.to_text.index('Signature Algorithm: 0.0')
   end
 
   TEST_KEY_RSA1024 = <<-_end_of_pem_

diff --git a/src/test/ruby/x509/test_x509crl.rb b/src/test/ruby/x509/test_x509crl.rb
@@ -11,7 +11,7 @@ def test_new_crl
     assert_equal nil, crl.last_update
     assert_equal nil, crl.next_update
     assert_equal [], crl.revoked
-    assert_equal "itu-t", crl.signature_algorithm
+    assert_equal "NULL", crl.signature_algorithm
 
     if RUBY_VERSION >= '2.0.0' || defined? JRUBY_VERSION
       assert crl.inspect.index('#<OpenSSL::X509::CRL:') == 0, crl.inspect
@@ -140,7 +140,7 @@ def test_extension
     exts = crl.extensions
 
     # MRI expects to retain extension order : crlNumber, authorityKeyIdentifier, issuerAltName
-    exts = exts.dup;
+    exts = exts.dup
     ext1 = exts.find { |ext| ext.oid == 'authorityKeyIdentifier' }
     exts.delete(ext1); exts.unshift(ext1)
     ext0 = exts.find { |ext| ext.oid == 'crlNumber' }