Skip to content

Commit

Permalink
test/openssl/test_ssl: revise a test case for client_cert_cb
Browse files Browse the repository at this point in the history
The current test_client_auth_public_key test case checks that supplying
a PKey containing only public components through client_cert_cb will
cause handshake to fail. While this is a correct behavior as a whole,
the assertions are misleading in the sense that giving a public key is
causing the failure. Actually, the handshake fails because a client
certificate is not supplied at all, as a result of ArgumentError that is
silently ignored.

Rename the test case to test_client_cert_cb_ignore_error and simplify it
to clarify what it is testing.
  • Loading branch information
rhenium committed Jul 18, 2020
1 parent 2fc6f94 commit 785b556
Showing 1 changed file with 6 additions and 10 deletions.
16 changes: 6 additions & 10 deletions test/openssl/test_ssl.rb
Original file line number Diff line number Diff line change
Expand Up @@ -282,20 +282,16 @@ def test_client_auth_success
}
end

def test_client_auth_public_key
def test_client_cert_cb_ignore_error
vflag = OpenSSL::SSL::VERIFY_PEER|OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
start_server(verify_mode: vflag, ignore_listener_error: true) do |port|
assert_raise(ArgumentError) {
ctx = OpenSSL::SSL::SSLContext.new
ctx.key = @cli_key.public_key
ctx.cert = @cli_cert
server_connect(port, ctx) { |ssl| ssl.puts("abc"); ssl.gets }
}

ctx = OpenSSL::SSL::SSLContext.new
ctx.client_cert_cb = Proc.new{ |ssl|
[@cli_cert, @cli_key.public_key]
ctx.client_cert_cb = -> ssl {
raise "exception in client_cert_cb must be suppressed"
}
# 1. Exception in client_cert_cb is suppressed
# 2. No client certificate will be sent to the server
# 3. SSL_VERIFY_FAIL_IF_NO_PEER_CERT causes the handshake to fail
assert_handshake_error {
server_connect(port, ctx) { |ssl| ssl.puts("abc"); ssl.gets }
}
Expand Down

0 comments on commit 785b556

Please sign in to comment.