42815870a9
Backport OpenSSL test suite fixes from the C9S branch stream-ruby-3.1-rhel-9.1.0
Patches were backported from commit: 20188a8a3f .
Changes:
Firstly, replace SHA1 with SHA256 and higher in tests.
SHA1 is disabled by default on C9S and RHEL 9.
Secondly, apply ossl_ocsp-use-null patch.
C9S/RHEL9 have SHA1 disabled by default, so using the OCSP with
default arguments on a default C9S/RHEL9 installation will result in an
OpenSSL error. This patch, when OCSP does not receive a digest explicitly, will
let OpenSSL decide which digest to use instead of using a default, thus
preventing usage of disabled digests.
See <https://github.com/ruby/openssl/pull/507>.
OPENSSL_ENABLE_SHA1_SIGNATURES=1 enables SHA1 for
OpenSSL in order to enable tests using SHA1 certificates, at least running
the tests is preferable to not running them at all.
Resolves: rbhz#2107696
32 lines
1.4 KiB
Diff
32 lines
1.4 KiB
Diff
--- ext/openssl/ossl_ocsp.c.orig 2022-04-07 16:40:13.263752886 +0200
|
|
+++ ext/openssl/ossl_ocsp.c 2022-04-07 16:45:56.818971187 +0200
|
|
@@ -382,7 +382,7 @@
|
|
if (!NIL_P(flags))
|
|
flg = NUM2INT(flags);
|
|
if (NIL_P(digest))
|
|
- md = EVP_sha1();
|
|
+ md = NULL;
|
|
else
|
|
md = ossl_evp_get_digestbyname(digest);
|
|
if (NIL_P(certs))
|
|
@@ -1033,7 +1033,7 @@
|
|
if (!NIL_P(flags))
|
|
flg = NUM2INT(flags);
|
|
if (NIL_P(digest))
|
|
- md = EVP_sha1();
|
|
+ md = NULL;
|
|
else
|
|
md = ossl_evp_get_digestbyname(digest);
|
|
if (NIL_P(certs))
|
|
--- test/openssl/test_ocsp.rb.orig 2022-04-08 08:20:31.400739869 +0200
|
|
+++ test/openssl/test_ocsp.rb 2022-04-08 08:20:37.208727488 +0200
|
|
@@ -99,7 +99,7 @@
|
|
request.sign(@cert, @cert_key, [@ca_cert], 0)
|
|
asn1 = OpenSSL::ASN1.decode(request.to_der)
|
|
assert_equal cid.to_der, asn1.value[0].value.find { |a| a.tag_class == :UNIVERSAL }.value[0].value[0].to_der
|
|
- assert_equal OpenSSL::ASN1.ObjectId("sha1WithRSAEncryption").to_der, asn1.value[1].value[0].value[0].value[0].to_der
|
|
+ assert_equal OpenSSL::ASN1.ObjectId("sha256WithRSAEncryption").to_der, asn1.value[1].value[0].value[0].value[0].to_der
|
|
assert_equal @cert.to_der, asn1.value[1].value[0].value[2].value[0].value[0].to_der
|
|
assert_equal @ca_cert.to_der, asn1.value[1].value[0].value[2].value[0].value[1].to_der
|
|
assert_equal asn1.to_der, OpenSSL::OCSP::Request.new(asn1.to_der).to_der
|