Merge branch 'maint'

This also restores 'if defined?(OpenSSL)-end' wrapping the test code.
They have been removed erroneously by commit 4eb4b3297a92 ("Remove
support for OpenSSL 0.9.8 and 1.0.0", 2016-11-30).

* maint:
  test/test_ssl: explicitly accept TLS 1.1 in corresponding test
  ssl: remove useless call to rb_thread_wait_fd()
  test/test_pair, test/test_ssl: fix for TLS 1.3
  test/test_ssl_session: rearrange tests
  test/test_ssl: move test_multibyte_read_write to test_pair
  test/test_ssl: remove test_invalid_shutdown_by_gc
  test/utils: do not use DSA certificates in SSL tests
  test/utils: add OpenSSL::TestUtils.openssl? and .libressl?
  test/utils: improve error handling in start_server
  test/utils: let server_loop close socket
  test/utils: do not set ecdh_curves in start_server
  test/utils: have start_server yield only the port number
  test/utils: add SSLTestCase#tls12_supported?
  test/utils: remove OpenSSL::TestUtils.silent
  test: fix formatting
  Rakefile: let sync:to_ruby know about test/openssl/fixtures
  cipher: update the documentation for Cipher#auth_tag=
  Backport "Merge branch 'topic/test-memory-leak'" to maint
  ssl: do not call session_remove_cb during GC

2 files changed, 12 insertions, 9 deletions

diff --git a/ext/openssl/ossl_cipher.c b/ext/openssl/ossl_cipher.c
index 21fcb1b6..bfa76c1a 100644
--- a/ext/openssl/ossl_cipher.c
+++ b/ext/openssl/ossl_cipher.c
@@ -620,13 +620,11 @@ ossl_cipher_get_auth_tag(int argc, VALUE *argv, VALUE self)
  *  call-seq:
  *     cipher.auth_tag = string -> string
  *
- *  Sets the authentication tag to verify the contents of the
- *  ciphertext. The tag must be set after calling Cipher#decrypt,
- *  Cipher#key= and Cipher#iv=, but before assigning the associated
- *  authenticated data using Cipher#auth_data= and of course, before
- *  decrypting any of the ciphertext. After all decryption is
- *  performed, the tag is verified automatically in the call to
- *  Cipher#final.
+ *  Sets the authentication tag to verify the integrity of the ciphertext.
+ *  This can be called only when the cipher supports AE. The tag must be set
+ *  after calling Cipher#decrypt, Cipher#key= and Cipher#iv=, but before
+ *  calling Cipher#final. After all decryption is performed, the tag is
+ *  verified automatically in the call to Cipher#final.
  *
  *  For OCB mode, the tag length must be supplied with #auth_tag_len=
  *  beforehand.
diff --git a/ext/openssl/ossl_ssl.c b/ext/openssl/ossl_ssl.c
index 51418410..cd575a13 100644
--- a/ext/openssl/ossl_ssl.c
+++ b/ext/openssl/ossl_ssl.c
@@ -470,6 +470,13 @@ ossl_sslctx_session_remove_cb(SSL_CTX *ctx, SSL_SESSION *sess)
     VALUE ary, sslctx_obj, sess_obj;
     int state = 0;
 
+    /*
+     * This callback is also called for all sessions in the internal store
+     * when SSL_CTX_free() is called.
+     */
+    if (rb_during_gc())
+	return;
+
     OSSL_Debug("SSL SESSION remove callback entered");
 
     sslctx_obj = (VALUE)SSL_CTX_get_ex_data(ctx, ossl_sslctx_ex_ptr_idx);
@@ -1689,8 +1696,6 @@ ossl_ssl_read_internal(int argc, VALUE *argv, VALUE self, int nonblock)
     io = rb_attr_get(self, id_i_io);
     GetOpenFile(io, fptr);
     if (ssl_started(ssl)) {
-	if(!nonblock && SSL_pending(ssl) <= 0)
-	    rb_thread_wait_fd(fptr->fd);
 	for (;;){
 	    nread = SSL_read(ssl, RSTRING_PTR(str), RSTRING_LENINT(str));
 	    switch(ssl_get_error(ssl, nread)){