mirror of
https://github.com/emmansun/gmsm.git
synced 2025-04-26 12:16:20 +08:00
x509: supplement test cases
This commit is contained in:
Sun Yimin
GitHub
parent
204419818f
commit
58513465fa
99
smx509/parser_test.go
Normal file
99
smx509/parser_test.go
Normal file
@ -0,0 +1,99 @@
|
|||||||
|
package smx509
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/asn1"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
cryptobyte_asn1 "golang.org/x/crypto/cryptobyte/asn1"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestParseASN1String(t *testing.T) {
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
tag cryptobyte_asn1.Tag
|
||||||
|
value []byte
|
||||||
|
expected string
|
||||||
|
expectedErr string
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "T61String",
|
||||||
|
tag: cryptobyte_asn1.T61String,
|
||||||
|
value: []byte{80, 81, 82},
|
||||||
|
expected: string("PQR"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "PrintableString",
|
||||||
|
tag: cryptobyte_asn1.PrintableString,
|
||||||
|
value: []byte{80, 81, 82},
|
||||||
|
expected: string("PQR"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "PrintableString (invalid)",
|
||||||
|
tag: cryptobyte_asn1.PrintableString,
|
||||||
|
value: []byte{1, 2, 3},
|
||||||
|
expectedErr: "invalid PrintableString",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "UTF8String",
|
||||||
|
tag: cryptobyte_asn1.UTF8String,
|
||||||
|
value: []byte{80, 81, 82},
|
||||||
|
expected: string("PQR"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "UTF8String (invalid)",
|
||||||
|
tag: cryptobyte_asn1.UTF8String,
|
||||||
|
value: []byte{255},
|
||||||
|
expectedErr: "invalid UTF-8 string",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "BMPString",
|
||||||
|
tag: cryptobyte_asn1.Tag(asn1.TagBMPString),
|
||||||
|
value: []byte{80, 81},
|
||||||
|
expected: string("偑"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "BMPString (invalid length)",
|
||||||
|
tag: cryptobyte_asn1.Tag(asn1.TagBMPString),
|
||||||
|
value: []byte{255},
|
||||||
|
expectedErr: "invalid BMPString",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "IA5String",
|
||||||
|
tag: cryptobyte_asn1.IA5String,
|
||||||
|
value: []byte{80, 81},
|
||||||
|
expected: string("PQ"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "IA5String (invalid)",
|
||||||
|
tag: cryptobyte_asn1.IA5String,
|
||||||
|
value: []byte{255},
|
||||||
|
expectedErr: "invalid IA5String",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "NumericString",
|
||||||
|
tag: cryptobyte_asn1.Tag(asn1.TagNumericString),
|
||||||
|
value: []byte{49, 50},
|
||||||
|
expected: string("12"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "NumericString (invalid)",
|
||||||
|
tag: cryptobyte_asn1.Tag(asn1.TagNumericString),
|
||||||
|
value: []byte{80},
|
||||||
|
expectedErr: "invalid NumericString",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range tests {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
out, err := parseASN1String(tc.tag, tc.value)
|
||||||
|
if err != nil && err.Error() != tc.expectedErr {
|
||||||
|
t.Fatalf("parseASN1String returned unexpected error: got %q, want %q", err, tc.expectedErr)
|
||||||
|
} else if err == nil && tc.expectedErr != "" {
|
||||||
|
t.Fatalf("parseASN1String didn't fail, expected: %s", tc.expectedErr)
|
||||||
|
}
|
||||||
|
if out != tc.expected {
|
||||||
|
t.Fatalf("parseASN1String returned unexpected value: got %q, want %q", out, tc.expected)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -3,6 +3,7 @@ package smx509
|
|||||||
import (
|
import (
|
||||||
"bytes"
|
"bytes"
|
||||||
"crypto"
|
"crypto"
|
||||||
|
"crypto/dsa"
|
||||||
"crypto/ecdsa"
|
"crypto/ecdsa"
|
||||||
"crypto/ed25519"
|
"crypto/ed25519"
|
||||||
"crypto/elliptic"
|
"crypto/elliptic"
|
||||||
@ -216,6 +217,105 @@ var rsaPrivateKey = &rsa.PrivateKey{
|
|||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
||||||
|
type matchHostnamesTest struct {
|
||||||
|
pattern, host string
|
||||||
|
ok bool
|
||||||
|
}
|
||||||
|
|
||||||
|
var matchHostnamesTests = []matchHostnamesTest{
|
||||||
|
{"a.b.c", "a.b.c", true},
|
||||||
|
{"a.b.c", "b.b.c", false},
|
||||||
|
{"", "b.b.c", false},
|
||||||
|
{"a.b.c", "", false},
|
||||||
|
{"example.com", "example.com", true},
|
||||||
|
{"example.com", "www.example.com", false},
|
||||||
|
{"*.example.com", "example.com", false},
|
||||||
|
{"*.example.com", "www.example.com", true},
|
||||||
|
{"*.example.com", "www.example.com.", true},
|
||||||
|
{"*.example.com", "xyz.www.example.com", false},
|
||||||
|
{"*.example.com", "https://www.example.com", false}, // Issue 27591
|
||||||
|
{"*.example..com", "www.example..com", false},
|
||||||
|
{"www.example..com", "www.example..com", true},
|
||||||
|
{"*.*.example.com", "xyz.www.example.com", false},
|
||||||
|
{"*.www.*.com", "xyz.www.example.com", false},
|
||||||
|
{"*bar.example.com", "foobar.example.com", false},
|
||||||
|
{"f*.example.com", "foobar.example.com", false},
|
||||||
|
{"www.example.com", "*.example.com", false},
|
||||||
|
{"", ".", false},
|
||||||
|
{".", "", false},
|
||||||
|
{".", ".", false},
|
||||||
|
{"example.com", "example.com.", true},
|
||||||
|
{"example.com.", "example.com", false},
|
||||||
|
{"example.com.", "example.com.", true}, // perfect matches allow trailing dots in patterns
|
||||||
|
{"*.com.", "example.com.", false},
|
||||||
|
{"*.com.", "example.com", false},
|
||||||
|
{"*.com", "example.com", true},
|
||||||
|
{"*.com", "example.com.", true},
|
||||||
|
{"foo:bar", "foo:bar", true},
|
||||||
|
{"*.foo:bar", "xxx.foo:bar", false},
|
||||||
|
{"*.2.3.4", "1.2.3.4", false},
|
||||||
|
{"*.2.3.4", "[1.2.3.4]", false},
|
||||||
|
{"*:4860:4860::8888", "2001:4860:4860::8888", false},
|
||||||
|
{"*:4860:4860::8888", "[2001:4860:4860::8888]", false},
|
||||||
|
{"2001:4860:4860::8888", "2001:4860:4860::8888", false},
|
||||||
|
{"2001:4860:4860::8888", "[2001:4860:4860::8888]", false},
|
||||||
|
{"[2001:4860:4860::8888]", "2001:4860:4860::8888", false},
|
||||||
|
{"[2001:4860:4860::8888]", "[2001:4860:4860::8888]", false},
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestMatchHostnames(t *testing.T) {
|
||||||
|
for i, test := range matchHostnamesTests {
|
||||||
|
c := &Certificate{DNSNames: []string{test.pattern}}
|
||||||
|
r := c.VerifyHostname(test.host) == nil
|
||||||
|
if r != test.ok {
|
||||||
|
t.Errorf("#%d mismatch got: %t want: %t when matching '%s' against '%s'", i, r, test.ok, test.host, test.pattern)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestMatchIP(t *testing.T) {
|
||||||
|
// Check that pattern matching is working.
|
||||||
|
c := &Certificate{
|
||||||
|
DNSNames: []string{"*.foo.bar.baz"},
|
||||||
|
Subject: pkix.Name{
|
||||||
|
CommonName: "*.foo.bar.baz",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
err := c.VerifyHostname("quux.foo.bar.baz")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("VerifyHostname(quux.foo.bar.baz): %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// But check that if we change it to be matching against an IP address,
|
||||||
|
// it is rejected.
|
||||||
|
c = &Certificate{
|
||||||
|
DNSNames: []string{"*.2.3.4"},
|
||||||
|
Subject: pkix.Name{
|
||||||
|
CommonName: "*.2.3.4",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
err = c.VerifyHostname("1.2.3.4")
|
||||||
|
if err == nil {
|
||||||
|
t.Fatalf("VerifyHostname(1.2.3.4) should have failed, did not")
|
||||||
|
}
|
||||||
|
|
||||||
|
c = &Certificate{
|
||||||
|
IPAddresses: []net.IP{net.ParseIP("127.0.0.1"), net.ParseIP("::1")},
|
||||||
|
}
|
||||||
|
err = c.VerifyHostname("127.0.0.1")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("VerifyHostname(127.0.0.1): %v", err)
|
||||||
|
}
|
||||||
|
err = c.VerifyHostname("::1")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("VerifyHostname(::1): %v", err)
|
||||||
|
}
|
||||||
|
err = c.VerifyHostname("[::1]")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("VerifyHostname([::1]): %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
func getPublicKey(pemContent []byte) (interface{}, error) {
|
func getPublicKey(pemContent []byte) (interface{}, error) {
|
||||||
block, _ := pem.Decode(pemContent)
|
block, _ := pem.Decode(pemContent)
|
||||||
if block == nil {
|
if block == nil {
|
||||||
@ -232,6 +332,224 @@ func parseAndCheckCsr(csrPem []byte) error {
|
|||||||
return csr.CheckSignature()
|
return csr.CheckSignature()
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func TestCertificateParse(t *testing.T) {
|
||||||
|
s, _ := base64.StdEncoding.DecodeString(certBytes)
|
||||||
|
certs, err := ParseCertificates(s)
|
||||||
|
if err != nil {
|
||||||
|
t.Error(err)
|
||||||
|
}
|
||||||
|
if len(certs) != 2 {
|
||||||
|
t.Errorf("Wrong number of certs: got %d want 2", len(certs))
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
err = certs[0].CheckSignatureFrom(certs[1])
|
||||||
|
if err != nil {
|
||||||
|
t.Error(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := certs[0].VerifyHostname("mail.google.com"); err != nil {
|
||||||
|
t.Error(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
const expectedExtensions = 10
|
||||||
|
if n := len(certs[0].Extensions); n != expectedExtensions {
|
||||||
|
t.Errorf("want %d extensions, got %d", expectedExtensions, n)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestCertificateEqualOnNil(t *testing.T) {
|
||||||
|
cNonNil := new(Certificate)
|
||||||
|
var cNil1, cNil2 *Certificate
|
||||||
|
if !cNil1.Equal(cNil2) {
|
||||||
|
t.Error("Nil certificates: cNil1 is not equal to cNil2")
|
||||||
|
}
|
||||||
|
if !cNil2.Equal(cNil1) {
|
||||||
|
t.Error("Nil certificates: cNil2 is not equal to cNil1")
|
||||||
|
}
|
||||||
|
if cNil1.Equal(cNonNil) {
|
||||||
|
t.Error("Unexpectedly cNil1 is equal to cNonNil")
|
||||||
|
}
|
||||||
|
if cNonNil.Equal(cNil1) {
|
||||||
|
t.Error("Unexpectedly cNonNil is equal to cNil1")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestMismatchedSignatureAlgorithm(t *testing.T) {
|
||||||
|
der, _ := pem.Decode([]byte(rsaPSSSelfSignedPEM))
|
||||||
|
if der == nil {
|
||||||
|
t.Fatal("Failed to find PEM block")
|
||||||
|
}
|
||||||
|
|
||||||
|
cert, err := ParseCertificate(der.Bytes)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err = cert.CheckSignature(ECDSAWithSHA256, nil, nil); err == nil {
|
||||||
|
t.Fatal("CheckSignature unexpectedly return no error")
|
||||||
|
}
|
||||||
|
|
||||||
|
const expectedSubstring = " but have public key of type "
|
||||||
|
if !strings.Contains(err.Error(), expectedSubstring) {
|
||||||
|
t.Errorf("Expected error containing %q, but got %q", expectedSubstring, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestRSAPSSSelfSigned(t *testing.T) {
|
||||||
|
for i, pemBlock := range []string{rsaPSSSelfSignedPEM, rsaPSSSelfSignedOpenSSL110PEM} {
|
||||||
|
der, _ := pem.Decode([]byte(pemBlock))
|
||||||
|
if der == nil {
|
||||||
|
t.Errorf("#%d: failed to find PEM block", i)
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
cert, err := ParseCertificate(der.Bytes)
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("#%d: failed to parse: %s", i, err)
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
if err = cert.CheckSignatureFrom(cert); err != nil {
|
||||||
|
t.Errorf("#%d: signature check failed: %s", i, err)
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
var rsaPSSSelfSignedPEM = `-----BEGIN CERTIFICATE-----
|
||||||
|
MIIGHjCCA9KgAwIBAgIBdjBBBgkqhkiG9w0BAQowNKAPMA0GCWCGSAFlAwQCAQUA
|
||||||
|
oRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAQUAogMCASAwbjELMAkGA1UEBhMC
|
||||||
|
SlAxHDAaBgNVBAoME0phcGFuZXNlIEdvdmVybm1lbnQxKDAmBgNVBAsMH1RoZSBN
|
||||||
|
aW5pc3RyeSBvZiBGb3JlaWduIEFmZmFpcnMxFzAVBgNVBAMMDmUtcGFzc3BvcnRD
|
||||||
|
U0NBMB4XDTEzMDUxNDA1MDczMFoXDTI5MDUxNDA1MDczMFowbjELMAkGA1UEBhMC
|
||||||
|
SlAxHDAaBgNVBAoME0phcGFuZXNlIEdvdmVybm1lbnQxKDAmBgNVBAsMH1RoZSBN
|
||||||
|
aW5pc3RyeSBvZiBGb3JlaWduIEFmZmFpcnMxFzAVBgNVBAMMDmUtcGFzc3BvcnRD
|
||||||
|
U0NBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAx/E3WRVxcCDXhoST
|
||||||
|
8nVSLjW6hwM4Ni99AegWzcGtfGFo0zjFA1Cl5URqxauvYu3gQgQHBGA1CovWeGrl
|
||||||
|
yVSRzOL1imcYsSgLOcnhVYB3Xcrof4ebv9+W+TwNdc9YzAwcj8rNd5nP6PKXIQ+W
|
||||||
|
PCkEOXdyb80YEnxuT+NPjkVfFSPBS7QYZpvT2fwy4fZ0eh48253+7VleSmTO0mqj
|
||||||
|
7TlzaG56q150SLZbhpOd8jD8bM/wACnLCPR88wj4hCcDLEwoLyY85HJCTIQQMnoT
|
||||||
|
UpqyzEeupPREIm6yi4d8C9YqIWFn2YTnRcWcmMaJLzq+kYwKoudfnoC6RW2vzZXn
|
||||||
|
defQs68IZuK+uALu9G3JWGPgu0CQGj0JNDT8zkiDV++4eNrZczWKjr1YnAL+VbLK
|
||||||
|
bApwL2u19l2WDpfUklimhWfraqHNIUKU6CjZOG31RzXcplIj0mtqs0E1r7r357Es
|
||||||
|
yFoB28iNo4cz1lCulh0E4WJzWzLZcT4ZspHHRCFyvYnXoibXEV1nULq8ByKKG0FS
|
||||||
|
7nn4SseoV+8PvjHLPhmHGMvi4mxkbcXdV3wthHT1/HXdqY84A4xHWt1+sB/TpTek
|
||||||
|
tDhFlEfcUygvTu58UtOnysomOVVeERmi7WSujfzKsGJAJYeetiA5R+zX7BxeyFVE
|
||||||
|
qW0zh1Tkwh0S8LRe5diJh4+6FG0CAwEAAaNfMF0wHQYDVR0OBBYEFD+oahaikBTV
|
||||||
|
Urk81Uz7kRS2sx0aMA4GA1UdDwEB/wQEAwIBBjAYBgNVHSAEETAPMA0GCyqDCIaP
|
||||||
|
fgYFAQEBMBIGA1UdEwEB/wQIMAYBAf8CAQAwQQYJKoZIhvcNAQEKMDSgDzANBglg
|
||||||
|
hkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIDAgEgA4IC
|
||||||
|
AQAaxWBQn5CZuNBfyzL57mn31ukHUFd61OMROSX3PT7oCv1Dy+C2AdRlxOcbN3/n
|
||||||
|
li0yfXUUqiY3COlLAHKRlkr97mLtxEFoJ0R8nVN2IQdChNQM/XSCzSGyY8NVa1OR
|
||||||
|
TTpEWLnexJ9kvIdbFXwUqdTnAkOI0m7Rg8j+E+lRRHg1xDAA1qKttrtUj3HRQWf3
|
||||||
|
kNTu628SiMvap6aIdncburaK56MP7gkR1Wr/ichOfjIA3Jgw2PapI31i0GqeMd66
|
||||||
|
U1+lC9FeyMAJpuSVp/SoiYzYo+79SFcVoM2yw3yAnIKg7q9GLYYqzncdykT6C06c
|
||||||
|
15gWFI6igmReAsD9ITSvYh0jLrLHfEYcPTOD3ZXJ4EwwHtWSoO3gq1EAtOYKu/Lv
|
||||||
|
C8zfBsZcFdsHvsSiYeBU8Oioe42mguky3Ax9O7D805Ek6R68ra07MW/G4YxvV7IN
|
||||||
|
2BfSaYy8MX9IG0ZMIOcoc0FeF5xkFmJ7kdrlTaJzC0IE9PNxNaH5QnOAFB8vxHcO
|
||||||
|
FioUxb6UKdHcPLR1VZtAdTdTMjSJxUqD/35Cdfqs7oDJXz8f6TXO2Tdy6G++YUs9
|
||||||
|
qsGZWxzFvvkXUkQSl0dQQ5jO/FtUJcAVXVVp20LxPemfatAHpW31WdJYeWSQWky2
|
||||||
|
+f9b5TXKXVyjlUL7uHxowWrT2AtTchDH22wTEtqLEF9Z3Q==
|
||||||
|
-----END CERTIFICATE-----`
|
||||||
|
|
||||||
|
// openssl req -newkey rsa:2048 -keyout test.key -sha256 -sigopt \
|
||||||
|
// rsa_padding_mode:pss -sigopt rsa_pss_saltlen:32 -sigopt rsa_mgf1_md:sha256 \
|
||||||
|
// -x509 -days 3650 -nodes -subj '/C=US/ST=CA/L=SF/O=Test/CN=Test' -out \
|
||||||
|
// test.pem
|
||||||
|
var rsaPSSSelfSignedOpenSSL110PEM = `-----BEGIN CERTIFICATE-----
|
||||||
|
MIIDwDCCAnigAwIBAgIJAM9LAMHTE5xpMD0GCSqGSIb3DQEBCjAwoA0wCwYJYIZI
|
||||||
|
AWUDBAIBoRowGAYJKoZIhvcNAQEIMAsGCWCGSAFlAwQCAaIDAgEgMEUxCzAJBgNV
|
||||||
|
BAYTAlVTMQswCQYDVQQIDAJDQTELMAkGA1UEBwwCU0YxDTALBgNVBAoMBFRlc3Qx
|
||||||
|
DTALBgNVBAMMBFRlc3QwHhcNMTgwMjIyMjIxMzE4WhcNMjgwMjIwMjIxMzE4WjBF
|
||||||
|
MQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExCzAJBgNVBAcMAlNGMQ0wCwYDVQQK
|
||||||
|
DARUZXN0MQ0wCwYDVQQDDARUZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
|
||||||
|
CgKCAQEA4Zrsydod+GoTAJLLutWNF87qhhVPBsK1zB1Gj+NAAe4+VbrZ1E41H1wp
|
||||||
|
qITx7DA8DRtJEf+NqrTAnAdZWBG/tAOA5LfXVax0ZSQtLnYLSeylLoMtDyY3eFAj
|
||||||
|
TmuTOoyVy6raktowCnHCh01NsstqqTfrx6SbmzOmDmKTkq/I+7K0MCVsn41xRDVM
|
||||||
|
+ShD0WGFGioEGoiWnFSWupxJDA3Q6jIDEygVwNKHwnhv/2NgG2kqZzrZSQA67en0
|
||||||
|
iKAXtoDNPpmyD5oS9YbEJ+2Nbm7oLeON30i6kZvXKIzJXx+UWViazHZqnsi5rQ8G
|
||||||
|
RHF+iVFXsqd0MzDKmkKOT5FDhrsbKQIDAQABo1MwUTAdBgNVHQ4EFgQU9uFY/nlg
|
||||||
|
gLH00NBnr/o7QvpN9ugwHwYDVR0jBBgwFoAU9uFY/nlggLH00NBnr/o7QvpN9ugw
|
||||||
|
DwYDVR0TAQH/BAUwAwEB/zA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAaEa
|
||||||
|
MBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgGiAwIBIAOCAQEAhJzpwxBNGKvzKWDe
|
||||||
|
WLqv6RMrl/q4GcH3b7M9wjxe0yOm4F+Tb2zJ7re4h+D39YkJf8cX1NV9UQVu6z4s
|
||||||
|
Fvo2kmlR0qZOXAg5augmCQ1xS0WHFoF6B52anNzHkZQbAIYJ3kGoFsUHzs7Sz7F/
|
||||||
|
656FsRpHA9UzJQ3avPPMrA4Y4aoJ7ANJ6XIwTrdWrhULOVuvYRLCl4CdTVztVFX6
|
||||||
|
wxX8nS1ISYd8jXPUMgsBKVbWufvLoIymMJW8CZbpprVZel5zFn0bmPrON8IHS30w
|
||||||
|
Gs+ITJjKEnZgXmAQ25SLKVzkZkBcGANs2GsdHNJ370Puisy0FIPD2NXR5uASAf7J
|
||||||
|
+w9fjQ==
|
||||||
|
-----END CERTIFICATE-----`
|
||||||
|
|
||||||
|
const ed25519Certificate = `
|
||||||
|
Certificate:
|
||||||
|
Data:
|
||||||
|
Version: 3 (0x2)
|
||||||
|
Serial Number:
|
||||||
|
0c:83:d8:21:2b:82:cb:23:98:23:63:e2:f7:97:8a:43:5b:f3:bd:92
|
||||||
|
Signature Algorithm: ED25519
|
||||||
|
Issuer: CN = Ed25519 test certificate
|
||||||
|
Validity
|
||||||
|
Not Before: May 6 17:27:16 2019 GMT
|
||||||
|
Not After : Jun 5 17:27:16 2019 GMT
|
||||||
|
Subject: CN = Ed25519 test certificate
|
||||||
|
Subject Public Key Info:
|
||||||
|
Public Key Algorithm: ED25519
|
||||||
|
ED25519 Public-Key:
|
||||||
|
pub:
|
||||||
|
36:29:c5:6c:0d:4f:14:6c:81:d0:ff:75:d3:6a:70:
|
||||||
|
5f:69:cd:0f:4d:66:d5:da:98:7e:82:49:89:a3:8a:
|
||||||
|
3c:fa
|
||||||
|
X509v3 extensions:
|
||||||
|
X509v3 Subject Key Identifier:
|
||||||
|
09:3B:3A:9D:4A:29:D8:95:FF:68:BE:7B:43:54:72:E0:AD:A2:E3:AE
|
||||||
|
X509v3 Authority Key Identifier:
|
||||||
|
keyid:09:3B:3A:9D:4A:29:D8:95:FF:68:BE:7B:43:54:72:E0:AD:A2:E3:AE
|
||||||
|
X509v3 Basic Constraints: critical
|
||||||
|
CA:TRUE
|
||||||
|
Signature Algorithm: ED25519
|
||||||
|
53:a5:58:1c:2c:3b:2a:9e:ac:9d:4e:a5:1d:5f:5d:6d:a6:b5:
|
||||||
|
08:de:12:82:f3:97:20:ae:fa:d8:98:f4:1a:83:32:6b:91:f5:
|
||||||
|
24:1d:c4:20:7f:2c:e2:4d:da:13:3b:6d:54:1a:d2:a8:28:dc:
|
||||||
|
60:b9:d4:f4:78:4b:3c:1c:91:00
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIBWzCCAQ2gAwIBAgIUDIPYISuCyyOYI2Pi95eKQ1vzvZIwBQYDK2VwMCMxITAf
|
||||||
|
BgNVBAMMGEVkMjU1MTkgdGVzdCBjZXJ0aWZpY2F0ZTAeFw0xOTA1MDYxNzI3MTZa
|
||||||
|
Fw0xOTA2MDUxNzI3MTZaMCMxITAfBgNVBAMMGEVkMjU1MTkgdGVzdCBjZXJ0aWZp
|
||||||
|
Y2F0ZTAqMAUGAytlcAMhADYpxWwNTxRsgdD/ddNqcF9pzQ9NZtXamH6CSYmjijz6
|
||||||
|
o1MwUTAdBgNVHQ4EFgQUCTs6nUop2JX/aL57Q1Ry4K2i464wHwYDVR0jBBgwFoAU
|
||||||
|
CTs6nUop2JX/aL57Q1Ry4K2i464wDwYDVR0TAQH/BAUwAwEB/zAFBgMrZXADQQBT
|
||||||
|
pVgcLDsqnqydTqUdX11tprUI3hKC85cgrvrYmPQagzJrkfUkHcQgfyziTdoTO21U
|
||||||
|
GtKoKNxgudT0eEs8HJEA
|
||||||
|
-----END CERTIFICATE-----`
|
||||||
|
|
||||||
|
func TestEd25519SelfSigned(t *testing.T) {
|
||||||
|
der, _ := pem.Decode([]byte(ed25519Certificate))
|
||||||
|
if der == nil {
|
||||||
|
t.Fatalf("Failed to find PEM block")
|
||||||
|
}
|
||||||
|
|
||||||
|
cert, err := ParseCertificate(der.Bytes)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("Failed to parse: %s", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if cert.PublicKeyAlgorithm != Ed25519 {
|
||||||
|
t.Fatalf("Parsed key algorithm was not Ed25519")
|
||||||
|
}
|
||||||
|
parsedKey, ok := cert.PublicKey.(ed25519.PublicKey)
|
||||||
|
if !ok {
|
||||||
|
t.Fatalf("Parsed key was not an Ed25519 key: %s", err)
|
||||||
|
}
|
||||||
|
if len(parsedKey) != ed25519.PublicKeySize {
|
||||||
|
t.Fatalf("Invalid Ed25519 key")
|
||||||
|
}
|
||||||
|
|
||||||
|
if err = cert.CheckSignatureFrom(cert); err != nil {
|
||||||
|
t.Fatalf("Signature check failed: %s", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
func Test_ParseCertificate(t *testing.T) {
|
func Test_ParseCertificate(t *testing.T) {
|
||||||
cert, err := ParseCertificatePEM([]byte(sm2Certificate))
|
cert, err := ParseCertificatePEM([]byte(sm2Certificate))
|
||||||
if err != nil {
|
if err != nil {
|
||||||
@ -313,6 +631,59 @@ func TestParsePEMCRL(t *testing.T) {
|
|||||||
// Can't check the signature here without a package cycle.
|
// Can't check the signature here without a package cycle.
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func testParsePKIXPublicKey(t *testing.T, pemBytes string) (pub interface{}) {
|
||||||
|
block, _ := pem.Decode([]byte(pemBytes))
|
||||||
|
pub, err := ParsePKIXPublicKey(block.Bytes)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("Failed to parse public key: %s", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
pubBytes2, err := MarshalPKIXPublicKey(pub)
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("Failed to marshal public key for the second time: %s", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if !bytes.Equal(pubBytes2, block.Bytes) {
|
||||||
|
t.Errorf("Reserialization of public key didn't match. got %x, want %x", pubBytes2, block.Bytes)
|
||||||
|
}
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestParsePKIXPublicKey(t *testing.T) {
|
||||||
|
t.Run("RSA", func(t *testing.T) {
|
||||||
|
pub := testParsePKIXPublicKey(t, pemPublicKey)
|
||||||
|
_, ok := pub.(*rsa.PublicKey)
|
||||||
|
if !ok {
|
||||||
|
t.Errorf("Value returned from ParsePKIXPublicKey was not an RSA public key")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
t.Run("Ed25519", func(t *testing.T) {
|
||||||
|
pub := testParsePKIXPublicKey(t, pemEd25519Key)
|
||||||
|
_, ok := pub.(ed25519.PublicKey)
|
||||||
|
if !ok {
|
||||||
|
t.Errorf("Value returned from ParsePKIXPublicKey was not an Ed25519 public key")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
var pemPublicKey = `-----BEGIN PUBLIC KEY-----
|
||||||
|
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3VoPN9PKUjKFLMwOge6+
|
||||||
|
wnDi8sbETGIx2FKXGgqtAKpzmem53kRGEQg8WeqRmp12wgp74TGpkEXsGae7RS1k
|
||||||
|
enJCnma4fii+noGH7R0qKgHvPrI2Bwa9hzsH8tHxpyM3qrXslOmD45EH9SxIDUBJ
|
||||||
|
FehNdaPbLP1gFyahKMsdfxFJLUvbUycuZSJ2ZnIgeVxwm4qbSvZInL9Iu4FzuPtg
|
||||||
|
fINKcbbovy1qq4KvPIrXzhbY3PWDc6btxCf3SE0JdE1MCPThntB62/bLMSQ7xdDR
|
||||||
|
FF53oIpvxe/SCOymfWq/LW849Ytv3Xwod0+wzAP8STXG4HSELS4UedPYeHJJJYcZ
|
||||||
|
+QIDAQAB
|
||||||
|
-----END PUBLIC KEY-----
|
||||||
|
`
|
||||||
|
|
||||||
|
// pemEd25519Key is the example from RFC 8410, Secrion 4.
|
||||||
|
var pemEd25519Key = `
|
||||||
|
-----BEGIN PUBLIC KEY-----
|
||||||
|
MCowBQYDK2VwAyEAGb9ECWmEzf6FQbrBZ9w7lshQhqowtrbLDFw4rXAxZuE=
|
||||||
|
-----END PUBLIC KEY-----
|
||||||
|
`
|
||||||
|
|
||||||
func TestParsePKIXPublicKeyFromExternal(t *testing.T) {
|
func TestParsePKIXPublicKeyFromExternal(t *testing.T) {
|
||||||
tests := []struct {
|
tests := []struct {
|
||||||
name string
|
name string
|
||||||
@ -698,6 +1069,174 @@ func TestCreateSelfSignedCertificate(t *testing.T) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Self-signed certificate using ECDSA with SHA256 & secp256r1
|
||||||
|
var ecdsaSHA256p256CertPem = `
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIICDzCCAbYCCQDlsuMWvgQzhTAKBggqhkjOPQQDAjCBjzELMAkGA1UEBhMCVVMx
|
||||||
|
EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxFTAT
|
||||||
|
BgNVBAoMDEdvb2dsZSwgSW5jLjEXMBUGA1UEAwwOd3d3Lmdvb2dsZS5jb20xIzAh
|
||||||
|
BgkqhkiG9w0BCQEWFGdvbGFuZy1kZXZAZ21haWwuY29tMB4XDTEyMDUyMTAwMTkx
|
||||||
|
NloXDTIyMDUxOTAwMTkxNlowgY8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxp
|
||||||
|
Zm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBWaWV3MRUwEwYDVQQKDAxHb29nbGUs
|
||||||
|
IEluYy4xFzAVBgNVBAMMDnd3dy5nb29nbGUuY29tMSMwIQYJKoZIhvcNAQkBFhRn
|
||||||
|
b2xhbmctZGV2QGdtYWlsLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABPMt
|
||||||
|
2ErhxAty5EJRu9yM+MTy+hUXm3pdW1ensAv382KoGExSXAFWP7pjJnNtHO+XSwVm
|
||||||
|
YNtqjcAGFKpweoN//kQwCgYIKoZIzj0EAwIDRwAwRAIgIYSaUA/IB81gjbIw/hUV
|
||||||
|
70twxJr5EcgOo0hLp3Jm+EYCIFDO3NNcgmURbJ1kfoS3N/0O+irUtoPw38YoNkqJ
|
||||||
|
h5wi
|
||||||
|
-----END CERTIFICATE-----
|
||||||
|
`
|
||||||
|
|
||||||
|
// Self-signed certificate using ECDSA with SHA256 & secp384r1
|
||||||
|
var ecdsaSHA256p384CertPem = `
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIICSjCCAdECCQDje/no7mXkVzAKBggqhkjOPQQDAjCBjjELMAkGA1UEBhMCVVMx
|
||||||
|
EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxFDAS
|
||||||
|
BgNVBAoMC0dvb2dsZSwgSW5jMRcwFQYDVQQDDA53d3cuZ29vZ2xlLmNvbTEjMCEG
|
||||||
|
CSqGSIb3DQEJARYUZ29sYW5nLWRldkBnbWFpbC5jb20wHhcNMTIwNTIxMDYxMDM0
|
||||||
|
WhcNMjIwNTE5MDYxMDM0WjCBjjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlm
|
||||||
|
b3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxFDASBgNVBAoMC0dvb2dsZSwg
|
||||||
|
SW5jMRcwFQYDVQQDDA53d3cuZ29vZ2xlLmNvbTEjMCEGCSqGSIb3DQEJARYUZ29s
|
||||||
|
YW5nLWRldkBnbWFpbC5jb20wdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARRuzRNIKRK
|
||||||
|
jIktEmXanNmrTR/q/FaHXLhWRZ6nHWe26Fw7Rsrbk+VjGy4vfWtNn7xSFKrOu5ze
|
||||||
|
qxKnmE0h5E480MNgrUiRkaGO2GMJJVmxx20aqkXOk59U8yGA4CghE6MwCgYIKoZI
|
||||||
|
zj0EAwIDZwAwZAIwBZEN8gvmRmfeP/9C1PRLzODIY4JqWub2PLRT4mv9GU+yw3Gr
|
||||||
|
PU9A3CHMdEcdw/MEAjBBO1lId8KOCh9UZunsSMfqXiVurpzmhWd6VYZ/32G+M+Mh
|
||||||
|
3yILeYQzllt/g0rKVRk=
|
||||||
|
-----END CERTIFICATE-----
|
||||||
|
`
|
||||||
|
|
||||||
|
// Self-signed certificate using ECDSA with SHA384 & secp521r1
|
||||||
|
var ecdsaSHA384p521CertPem = `
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIICljCCAfcCCQDhp1AFD/ahKjAKBggqhkjOPQQDAzCBjjELMAkGA1UEBhMCVVMx
|
||||||
|
EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxFDAS
|
||||||
|
BgNVBAoMC0dvb2dsZSwgSW5jMRcwFQYDVQQDDA53d3cuZ29vZ2xlLmNvbTEjMCEG
|
||||||
|
CSqGSIb3DQEJARYUZ29sYW5nLWRldkBnbWFpbC5jb20wHhcNMTIwNTIxMTUwNDI5
|
||||||
|
WhcNMjIwNTE5MTUwNDI5WjCBjjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlm
|
||||||
|
b3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxFDASBgNVBAoMC0dvb2dsZSwg
|
||||||
|
SW5jMRcwFQYDVQQDDA53d3cuZ29vZ2xlLmNvbTEjMCEGCSqGSIb3DQEJARYUZ29s
|
||||||
|
YW5nLWRldkBnbWFpbC5jb20wgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABACqx9Rv
|
||||||
|
IssRs1LWYcNN+WffwlHw4Tv3y8/LIAA9MF1ZScIonU9nRMxt4a2uGJVCPDw6JHpz
|
||||||
|
PaYc0E9puLoE9AfKpwFr59Jkot7dBg55SKPEFkddoip/rvmN7NPAWjMBirOwjOkm
|
||||||
|
8FPthvPhGPqsu9AvgVuHu3PosWiHGNrhh379pva8MzAKBggqhkjOPQQDAwOBjAAw
|
||||||
|
gYgCQgEHNmswkUdPpHqrVxp9PvLVl+xxPuHBkT+75z9JizyxtqykHQo9Uh6SWCYH
|
||||||
|
BF9KLolo01wMt8DjoYP5Fb3j5MH7xwJCAbWZzTOp4l4DPkIvAh4LeC4VWbwPPyqh
|
||||||
|
kBg71w/iEcSY3wUKgHGcJJrObZw7wys91I5kENljqw/Samdr3ka+jBJa
|
||||||
|
-----END CERTIFICATE-----
|
||||||
|
`
|
||||||
|
|
||||||
|
var ecdsaTests = []struct {
|
||||||
|
sigAlgo SignatureAlgorithm
|
||||||
|
pemCert string
|
||||||
|
}{
|
||||||
|
{ECDSAWithSHA256, ecdsaSHA256p256CertPem},
|
||||||
|
{ECDSAWithSHA256, ecdsaSHA256p384CertPem},
|
||||||
|
{ECDSAWithSHA384, ecdsaSHA384p521CertPem},
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestECDSA(t *testing.T) {
|
||||||
|
for i, test := range ecdsaTests {
|
||||||
|
pemBlock, _ := pem.Decode([]byte(test.pemCert))
|
||||||
|
cert, err := ParseCertificate(pemBlock.Bytes)
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("%d: failed to parse certificate: %s", i, err)
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
if sa := cert.SignatureAlgorithm; sa != test.sigAlgo {
|
||||||
|
t.Errorf("%d: signature algorithm is %v, want %v", i, sa, test.sigAlgo)
|
||||||
|
}
|
||||||
|
if parsedKey, ok := cert.PublicKey.(*ecdsa.PublicKey); !ok {
|
||||||
|
t.Errorf("%d: wanted an ECDSA public key but found: %#v", i, parsedKey)
|
||||||
|
}
|
||||||
|
if pka := cert.PublicKeyAlgorithm; pka != ECDSA {
|
||||||
|
t.Errorf("%d: public key algorithm is %v, want ECDSA", i, pka)
|
||||||
|
}
|
||||||
|
if err = cert.CheckSignatureFrom(cert); err != nil {
|
||||||
|
t.Errorf("%d: certificate verification failed: %s", i, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Self-signed certificate using DSA with SHA1
|
||||||
|
var dsaCertPem = `-----BEGIN CERTIFICATE-----
|
||||||
|
MIIEDTCCA82gAwIBAgIJALHPghaoxeDhMAkGByqGSM44BAMweTELMAkGA1UEBhMC
|
||||||
|
VVMxCzAJBgNVBAgTAk5DMQ8wDQYDVQQHEwZOZXd0b24xFDASBgNVBAoTC0dvb2ds
|
||||||
|
ZSwgSW5jMRIwEAYDVQQDEwlKb24gQWxsaWUxIjAgBgkqhkiG9w0BCQEWE2pvbmFs
|
||||||
|
bGllQGdvb2dsZS5jb20wHhcNMTEwNTE0MDMwMTQ1WhcNMTEwNjEzMDMwMTQ1WjB5
|
||||||
|
MQswCQYDVQQGEwJVUzELMAkGA1UECBMCTkMxDzANBgNVBAcTBk5ld3RvbjEUMBIG
|
||||||
|
A1UEChMLR29vZ2xlLCBJbmMxEjAQBgNVBAMTCUpvbiBBbGxpZTEiMCAGCSqGSIb3
|
||||||
|
DQEJARYTam9uYWxsaWVAZ29vZ2xlLmNvbTCCAbcwggEsBgcqhkjOOAQBMIIBHwKB
|
||||||
|
gQC8hLUnQ7FpFYu4WXTj6DKvXvz8QrJkNJCVMTpKAT7uBpobk32S5RrPKXocd4gN
|
||||||
|
8lyGB9ggS03EVlEwXvSmO0DH2MQtke2jl9j1HLydClMf4sbx5V6TV9IFw505U1iW
|
||||||
|
jL7awRMgxge+FsudtJK254FjMFo03ZnOQ8ZJJ9E6AEDrlwIVAJpnBn9moyP11Ox5
|
||||||
|
Asc/5dnjb6dPAoGBAJFHd4KVv1iTVCvEG6gGiYop5DJh28hUQcN9kul+2A0yPUSC
|
||||||
|
X93oN00P8Vh3eYgSaCWZsha7zDG53MrVJ0Zf6v/X/CoZNhLldeNOepivTRAzn+Rz
|
||||||
|
kKUYy5l1sxYLHQKF0UGNCXfFKZT0PCmgU+PWhYNBBMn6/cIh44vp85ideo5CA4GE
|
||||||
|
AAKBgFmifCafzeRaohYKXJgMGSEaggCVCRq5xdyDCat+wbOkjC4mfG01/um3G8u5
|
||||||
|
LxasjlWRKTR/tcAL7t0QuokVyQaYdVypZXNaMtx1db7YBuHjj3aP+8JOQRI9xz8c
|
||||||
|
bp5NDJ5pISiFOv4p3GZfqZPcqckDt78AtkQrmnal2txhhjF6o4HeMIHbMB0GA1Ud
|
||||||
|
DgQWBBQVyyr7hO11ZFFpWX50298Sa3V+rzCBqwYDVR0jBIGjMIGggBQVyyr7hO11
|
||||||
|
ZFFpWX50298Sa3V+r6F9pHsweTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk5DMQ8w
|
||||||
|
DQYDVQQHEwZOZXd0b24xFDASBgNVBAoTC0dvb2dsZSwgSW5jMRIwEAYDVQQDEwlK
|
||||||
|
b24gQWxsaWUxIjAgBgkqhkiG9w0BCQEWE2pvbmFsbGllQGdvb2dsZS5jb22CCQCx
|
||||||
|
z4IWqMXg4TAMBgNVHRMEBTADAQH/MAkGByqGSM44BAMDLwAwLAIUPtn/5j8Q1jJI
|
||||||
|
7ggOIsgrhgUdjGQCFCsmDq1H11q9+9Wp9IMeGrTSKHIM
|
||||||
|
-----END CERTIFICATE-----
|
||||||
|
`
|
||||||
|
|
||||||
|
func TestParseCertificateWithDsaPublicKey(t *testing.T) {
|
||||||
|
expectedKey := &dsa.PublicKey{
|
||||||
|
Parameters: dsa.Parameters{
|
||||||
|
P: bigFromHexString("00BC84B52743B169158BB85974E3E832AF5EFCFC42B264349095313A4A013EEE069A1B937D92E51ACF297A1C77880DF25C8607D8204B4DC45651305EF4A63B40C7D8C42D91EDA397D8F51CBC9D0A531FE2C6F1E55E9357D205C39D395358968CBEDAC11320C607BE16CB9DB492B6E78163305A34DD99CE43C64927D13A0040EB97"),
|
||||||
|
Q: bigFromHexString("009A67067F66A323F5D4EC7902C73FE5D9E36FA74F"),
|
||||||
|
G: bigFromHexString("009147778295BF5893542BC41BA806898A29E43261DBC85441C37D92E97ED80D323D44825FDDE8374D0FF15877798812682599B216BBCC31B9DCCAD527465FEAFFD7FC2A193612E575E34E7A98AF4D10339FE47390A518CB9975B3160B1D0285D1418D0977C52994F43C29A053E3D685834104C9FAFDC221E38BE9F3989D7A8E42"),
|
||||||
|
},
|
||||||
|
Y: bigFromHexString("59A27C269FCDE45AA2160A5C980C19211A820095091AB9C5DC8309AB7EC1B3A48C2E267C6D35FEE9B71BCBB92F16AC8E559129347FB5C00BEEDD10BA8915C90698755CA965735A32DC7575BED806E1E38F768FFBC24E41123DC73F1C6E9E4D0C9E692128853AFE29DC665FA993DCA9C903B7BF00B6442B9A76A5DADC6186317A"),
|
||||||
|
}
|
||||||
|
pemBlock, _ := pem.Decode([]byte(dsaCertPem))
|
||||||
|
cert, err := ParseCertificate(pemBlock.Bytes)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("Failed to parse certificate: %s", err)
|
||||||
|
}
|
||||||
|
if cert.PublicKeyAlgorithm != DSA {
|
||||||
|
t.Errorf("Parsed key algorithm was not DSA")
|
||||||
|
}
|
||||||
|
parsedKey, ok := cert.PublicKey.(*dsa.PublicKey)
|
||||||
|
if !ok {
|
||||||
|
t.Fatalf("Parsed key was not a DSA key: %s", err)
|
||||||
|
}
|
||||||
|
if expectedKey.Y.Cmp(parsedKey.Y) != 0 ||
|
||||||
|
expectedKey.P.Cmp(parsedKey.P) != 0 ||
|
||||||
|
expectedKey.Q.Cmp(parsedKey.Q) != 0 ||
|
||||||
|
expectedKey.G.Cmp(parsedKey.G) != 0 {
|
||||||
|
t.Fatal("Parsed key differs from expected key")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestParseCertificateWithDSASignatureAlgorithm(t *testing.T) {
|
||||||
|
pemBlock, _ := pem.Decode([]byte(dsaCertPem))
|
||||||
|
cert, err := ParseCertificate(pemBlock.Bytes)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("Failed to parse certificate: %s", err)
|
||||||
|
}
|
||||||
|
if cert.SignatureAlgorithm != DSAWithSHA1 {
|
||||||
|
t.Errorf("Parsed signature algorithm was not DSAWithSHA1")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestVerifyCertificateWithDSASignature(t *testing.T) {
|
||||||
|
pemBlock, _ := pem.Decode([]byte(dsaCertPem))
|
||||||
|
cert, err := ParseCertificate(pemBlock.Bytes)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("Failed to parse certificate: %s", err)
|
||||||
|
}
|
||||||
|
// test cert is self-signed
|
||||||
|
if err = cert.CheckSignatureFrom(cert); err == nil {
|
||||||
|
t.Fatalf("Expected error verifying DSA certificate")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
func TestCRLCreation(t *testing.T) {
|
func TestCRLCreation(t *testing.T) {
|
||||||
block, _ := pem.Decode([]byte(pemPrivateKey))
|
block, _ := pem.Decode([]byte(pemPrivateKey))
|
||||||
privRSA, _ := x509.ParsePKCS1PrivateKey(block.Bytes)
|
privRSA, _ := x509.ParsePKCS1PrivateKey(block.Bytes)
|
||||||
@ -752,7 +1291,7 @@ func TestCRLCreation(t *testing.T) {
|
|||||||
t.Errorf("%s: error creating CRL: %s", test.name, err)
|
t.Errorf("%s: error creating CRL: %s", test.name, err)
|
||||||
}
|
}
|
||||||
|
|
||||||
parsedCRL, err := x509.ParseDERCRL(crlBytes)
|
parsedCRL, err := ParseDERCRL(crlBytes)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
t.Errorf("%s: error reparsing CRL: %s", test.name, err)
|
t.Errorf("%s: error reparsing CRL: %s", test.name, err)
|
||||||
}
|
}
|
||||||
|
|||||||
@ -1,4 +1,4 @@
|
|||||||
// Package zuc handle shangmi zuc stream cipher, experimental/poc implementation.
|
// Package zuc handle shangmi zuc stream cipher.
|
||||||
package zuc
|
package zuc
|
||||||
|
|
||||||
import (
|
import (
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user