aboutsummaryrefslogtreecommitdiffstats
path: root/ext/openssl
diff options
context:
space:
mode:
Diffstat (limited to 'ext/openssl')
-rw-r--r--ext/openssl/extconf.rb58
-rw-r--r--ext/openssl/ossl_bn.c2
-rw-r--r--ext/openssl/ossl_cipher.c8
-rw-r--r--ext/openssl/ossl_ns_spki.c4
-rw-r--r--ext/openssl/ossl_pkey_ec.c6
-rw-r--r--ext/openssl/ossl_pkey_rsa.c2
-rw-r--r--ext/openssl/ossl_ssl.c3
-rw-r--r--ext/openssl/ossl_x509store.c9
8 files changed, 71 insertions, 21 deletions
diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb
index b887d922..0f099fc3 100644
--- a/ext/openssl/extconf.rb
+++ b/ext/openssl/extconf.rb
@@ -36,25 +36,65 @@ have_library("socket", "socket")
Logging::message "=== Checking for required stuff... ===\n"
result = pkg_config("openssl") && have_header("openssl/ssl.h")
-unless result
+
+def find_openssl_library
if $mswin || $mingw
# required for static OpenSSL libraries
have_library("gdi32") # OpenSSL <= 1.0.2 (for RAND_screen())
have_library("crypt32")
end
- result = %w[crypto libeay32].any? {|lib| have_library(lib, "CRYPTO_malloc")}
- result &&= %w[ssl ssleay32].any? {|lib| have_library(lib, "SSL_new")}
- unless result
+ return false unless have_header("openssl/ssl.h")
+
+ ret = have_library("crypto", "CRYPTO_malloc") &&
+ have_library("ssl", "SSL_new")
+ return ret if ret
+
+ if $mswin
+ # OpenSSL >= 1.1.0: libcrypto.lib and libssl.lib.
+ if have_library("libcrypto", "CRYPTO_malloc") &&
+ have_library("libssl", "SSL_new")
+ return true
+ end
+
+ # OpenSSL <= 1.0.2: libeay32.lib and ssleay32.lib.
+ if have_library("libeay32", "CRYPTO_malloc") &&
+ have_library("ssleay32", "SSL_new")
+ return true
+ end
+
+ # LibreSSL: libcrypto-##.lib and libssl-##.lib, where ## is the ABI version
+ # number. We have to find the version number out by scanning libpath.
+ libpath = $LIBPATH.dup
+ libpath |= ENV["LIB"].split(File::PATH_SEPARATOR)
+ libpath.map! { |d| d.tr(File::ALT_SEPARATOR, File::SEPARATOR) }
+
+ ret = [
+ ["crypto", "CRYPTO_malloc"],
+ ["ssl", "SSL_new"]
+ ].all? do |base, func|
+ result = false
+ libs = ["lib#{base}-[0-9][0-9]", "lib#{base}-[0-9][0-9][0-9]"]
+ libs = Dir.glob(libs.map{|l| libpath.map{|d| File.join(d, l + ".*")}}.flatten).map{|path| File.basename(path, ".*")}.uniq
+ libs.each do |lib|
+ result = have_library(lib, func)
+ break if result
+ end
+ result
+ end
+ return ret if ret
+ end
+ return false
+end
+
+unless result
+ unless find_openssl_library
+ Logging::message "=== Checking for required stuff failed. ===\n"
+ Logging::message "Makefile wasn't created. Fix the errors above.\n"
raise "OpenSSL library could not be found. You might want to use " \
"--with-openssl-dir=<dir> option to specify the prefix where OpenSSL " \
"is installed."
end
- unless have_header("openssl/ssl.h")
- raise "OpenSSL library itself was found, but the necessary header files " \
- "are missing. Installing \"development package\" of OpenSSL on your " \
- "system might help."
- end
end
unless checking_for("OpenSSL version is 1.0.1 or later") {
diff --git a/ext/openssl/ossl_bn.c b/ext/openssl/ossl_bn.c
index b3c86d72..94ef6fd6 100644
--- a/ext/openssl/ossl_bn.c
+++ b/ext/openssl/ossl_bn.c
@@ -124,7 +124,7 @@ try_convert_to_bn(VALUE obj)
if (rb_obj_is_kind_of(obj, cBN))
return obj;
if (RB_INTEGER_TYPE_P(obj)) {
- newobj = NewBN(cBN); /* Handle potencial mem leaks */
+ newobj = NewBN(cBN); /* Handle potential mem leaks */
bn = integer_to_bnptr(obj, NULL);
SetBN(newobj, bn);
}
diff --git a/ext/openssl/ossl_cipher.c b/ext/openssl/ossl_cipher.c
index e7801f7e..21fcb1b6 100644
--- a/ext/openssl/ossl_cipher.c
+++ b/ext/openssl/ossl_cipher.c
@@ -23,7 +23,7 @@
#define GetCipher(obj, ctx) do { \
GetCipherInit((obj), (ctx)); \
if (!(ctx)) { \
- ossl_raise(rb_eRuntimeError, "Cipher not inititalized!"); \
+ ossl_raise(rb_eRuntimeError, "Cipher not initialized!"); \
} \
} while (0)
@@ -118,7 +118,7 @@ ossl_cipher_initialize(VALUE self, VALUE str)
name = StringValueCStr(str);
GetCipherInit(self, ctx);
if (ctx) {
- ossl_raise(rb_eRuntimeError, "Cipher already inititalized!");
+ ossl_raise(rb_eRuntimeError, "Cipher already initialized!");
}
AllocCipher(self, ctx);
if (!(cipher = EVP_get_cipherbyname(name))) {
@@ -414,7 +414,7 @@ ossl_cipher_update(int argc, VALUE *argv, VALUE self)
* Returns the remaining data held in the cipher object. Further calls to
* Cipher#update or Cipher#final will return garbage. This call should always
* be made as the last call of an encryption or decryption operation, after
- * after having fed the entire plaintext or ciphertext to the Cipher instance.
+ * having fed the entire plaintext or ciphertext to the Cipher instance.
*
* If an authenticated cipher was used, a CipherError is raised if the tag
* could not be authenticated successfully. Only call this method after
@@ -1003,7 +1003,7 @@ Init_ossl_cipher(void)
* An example using the GCM (Galois/Counter Mode). You have 16 bytes _key_,
* 12 bytes (96 bits) _nonce_ and the associated data _auth_data_. Be sure
* not to reuse the _key_ and _nonce_ pair. Reusing an nonce ruins the
- * security gurantees of GCM mode.
+ * security guarantees of GCM mode.
*
* cipher = OpenSSL::Cipher::AES.new(128, :GCM).encrypt
* cipher.key = key
diff --git a/ext/openssl/ossl_ns_spki.c b/ext/openssl/ossl_ns_spki.c
index 15d40810..f17b9509 100644
--- a/ext/openssl/ossl_ns_spki.c
+++ b/ext/openssl/ossl_ns_spki.c
@@ -322,7 +322,7 @@ ossl_spki_verify(VALUE self, VALUE key)
/* Document-class: OpenSSL::Netscape::SPKI
*
- * A Simple Public Key Infrastructure implementation (pronounced "spookey").
+ * A Simple Public Key Infrastructure implementation (pronounced "spooky").
* The structure is defined as
* PublicKeyAndChallenge ::= SEQUENCE {
* spki SubjectPublicKeyInfo,
@@ -348,7 +348,7 @@ ossl_spki_verify(VALUE self, VALUE key)
* spki.public_key = key.public_key
* spki.sign(key, OpenSSL::Digest::SHA256.new)
* #send a request containing this to a server generating a certificate
- * === Verifiying an SPKI request
+ * === Verifying an SPKI request
* request = #...
* spki = OpenSSL::Netscape::SPKI.new request
* unless spki.verify(spki.public_key)
diff --git a/ext/openssl/ossl_pkey_ec.c b/ext/openssl/ossl_pkey_ec.c
index eb841fb7..d1515306 100644
--- a/ext/openssl/ossl_pkey_ec.c
+++ b/ext/openssl/ossl_pkey_ec.c
@@ -284,7 +284,7 @@ ossl_ec_key_get_group(VALUE self)
* key.group = group
*
* Sets the EC::Group for the key. The group structure is internally copied so
- * modifition to _group_ after assigning to a key has no effect on the key.
+ * modification to _group_ after assigning to a key has no effect on the key.
*/
static VALUE
ossl_ec_key_set_group(VALUE self, VALUE group_v)
@@ -1585,11 +1585,11 @@ ossl_ec_point_to_bn(int argc, VALUE *argv, VALUE self)
* Performs elliptic curve point multiplication.
*
* The first form calculates <tt>bn1 * point + bn2 * G</tt>, where +G+ is the
- * generator of the group of _point_. _bn2_ may be ommitted, and in that case,
+ * generator of the group of _point_. _bn2_ may be omitted, and in that case,
* the result is just <tt>bn1 * point</tt>.
*
* The second form calculates <tt>bns[0] * point + bns[1] * points[0] + ...
- * + bns[-1] * points[-1] + bn2 * G</tt>. _bn2_ may be ommitted. _bns_ must be
+ * + bns[-1] * points[-1] + bn2 * G</tt>. _bn2_ may be omitted. _bns_ must be
* an array of OpenSSL::BN. _points_ must be an array of
* OpenSSL::PKey::EC::Point. Please note that <tt>points[0]</tt> is not
* multiplied by <tt>bns[0]</tt>, but <tt>bns[1]</tt>.
diff --git a/ext/openssl/ossl_pkey_rsa.c b/ext/openssl/ossl_pkey_rsa.c
index b3c2915f..5122a77e 100644
--- a/ext/openssl/ossl_pkey_rsa.c
+++ b/ext/openssl/ossl_pkey_rsa.c
@@ -706,7 +706,7 @@ Init_ossl_rsa(void)
/* Document-class: OpenSSL::PKey::RSA
*
* RSA is an asymmetric public key algorithm that has been formalized in
- * RFC 3447. It is in widespread use in public key infrastuctures (PKI)
+ * RFC 3447. It is in widespread use in public key infrastructures (PKI)
* where certificates (cf. OpenSSL::X509::Certificate) often are issued
* on the basis of a public/private RSA key pair. RSA is used in a wide
* field of applications such as secure (symmetric) key exchange, e.g.
diff --git a/ext/openssl/ossl_ssl.c b/ext/openssl/ossl_ssl.c
index 2a7793c2..ae03c164 100644
--- a/ext/openssl/ossl_ssl.c
+++ b/ext/openssl/ossl_ssl.c
@@ -1466,7 +1466,8 @@ ossl_ssl_setup(VALUE self)
GetOpenFile(io, fptr);
rb_io_check_readable(fptr);
rb_io_check_writable(fptr);
- SSL_set_fd(ssl, TO_SOCKET(fptr->fd));
+ if (!SSL_set_fd(ssl, TO_SOCKET(fptr->fd)))
+ ossl_raise(eSSLError, "SSL_set_fd");
return Qtrue;
}
diff --git a/ext/openssl/ossl_x509store.c b/ext/openssl/ossl_x509store.c
index 46d3552f..c6cf67ad 100644
--- a/ext/openssl/ossl_x509store.c
+++ b/ext/openssl/ossl_x509store.c
@@ -313,6 +313,15 @@ ossl_x509store_add_file(VALUE self, VALUE file)
if(X509_LOOKUP_load_file(lookup, path, X509_FILETYPE_PEM) != 1){
ossl_raise(eX509StoreError, NULL);
}
+#if OPENSSL_VERSION_NUMBER < 0x10101000 || defined(LIBRESSL_VERSION_NUMBER)
+ /*
+ * X509_load_cert_crl_file() which is called from X509_LOOKUP_load_file()
+ * did not check the return value of X509_STORE_add_{cert,crl}(), leaking
+ * "cert already in hash table" errors on the error queue, if duplicate
+ * certificates are found. This will be fixed by OpenSSL 1.1.1.
+ */
+ ossl_clear_error();
+#endif
return self;
}
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-15 14:01:42 +0000