aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* asn1: check error return from i2d_ASN1_TYPE()ky/asn1-check-i2d-errorKazuki Yamaguchi2024-05-021-2/+5
| | | | | i2d_ASN1_TYPE() is not expected to fail, but the return value should be checked.
* Merge pull request #750 from ruby/pz-trailing-spacePeter Zhu2024-04-301-1/+1
|\ | | | | Remove trailing space in test_ssl.rb
| * Remove trailing space in test_ssl.rbPeter Zhu2024-04-301-1/+1
|/
* Merge pull request #726 from bdewater/digestsKazuki Yamaguchi2024-05-013-11/+46
|\ | | | | Add OpenSSL::Digest.digests to get a list of available digests
| * Update Cipher#name to match Digest#name explanationBart de Water2024-03-151-2/+2
| |
| * Add OpenSSL::Digest.digests to get a list of available digestsBart de Water2024-03-152-9/+44
| |
* | Merge pull request #748 from larskanis/patch-2Kazuki Yamaguchi2024-05-011-9/+0
|\ \ | | | | | | CI: Remove workaround for Ruby-3.2 and 3.3 on Windows
| * | CI: Remove workaround for Ruby-3.2 and 3.3 on WindowsLars Kanis2024-04-261-9/+0
| | | | | | | | | The issue https://github.com/oneclick/rubyinstaller2/issues/365 was fixed with the 3.2.4 and 3.3.1 releases.
* | | Merge pull request #743 from ruby/close-read-writeKazuki Yamaguchi2024-04-302-0/+50
|\ \ \ | | | | | | | | Introduce basic support for `close_read` and `close_write`.
| * | | Further clarification of documentation.Samuel Williams2024-04-281-6/+6
| | | |
| * | | More documentation.Samuel Williams2024-04-281-1/+16
| | | |
| * | | Introduce basic support for `close_read` and `close_write`.Samuel Williams2024-04-272-0/+35
|/ / /
* | | Merge pull request #747 from botovq/csr-versionKazuki Yamaguchi2024-04-271-6/+1
|\ \ \ | |/ / |/| | Only CSR version 1 (encoded as 0) is allowed by PKIX standards
| * | Only CSR version 1 (encoded as 0) is allowed by PKIX standardsJob Snijders2024-04-261-6/+1
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RFC 2986, section 4.1 only defines version 1 for CSRs. This version is encoded as a 0. Starting with OpenSSL 3.3, setting the CSR version to anything but 1 fails. Do not attempt to generate a CSR with invalid version (which now fails) and invalidate the CSR in test_sign_and_verify_rsa_sha1 by changing its subject rather than using an invalid version. This commit fixes the following error. ``` 2) Error: test_version(OpenSSL::TestX509Request): OpenSSL::X509::RequestError: X509_REQ_set_version: passed invalid argument /home/runner/work/openssl/openssl/test/openssl/test_x509req.rb:18:in `version=' /home/runner/work/openssl/openssl/test/openssl/test_x509req.rb:18:in `issue_csr' /home/runner/work/openssl/openssl/test/openssl/test_x509req.rb:43:in `test_version' 40: req = OpenSSL::X509::Request.new(req.to_der) 41: assert_equal(0, req.version) 42: => 43: req = issue_csr(1, @dn, @rsa1024, OpenSSL::Digest.new('SHA256')) 44: assert_equal(1, req.version) 45: req = OpenSSL::X509::Request.new(req.to_der) 46: assert_equal(1, req.version) ```
* | Merge pull request #745 from junaruga/wip/ci-upgrade-versionsJun Aruga2024-04-241-3/+6
|\ \ | | | | | | CI: Upgrade OpenSSL and LibreSSL versions.
| * | CI: Upgrade OpenSSL and LibreSSL versions.Jun Aruga2024-04-241-3/+6
|/ /
* | Merge pull request #737 from ruby/update-rfc-referenceHiroshi SHIBATA2024-03-283-8/+8
|\ \ | | | | | | Use www.rfc-editor.org for RFC text.
| * | Use www.rfc-editor.org for RFC text.Hiroshi SHIBATA2024-03-283-8/+8
|/ / | | | | | | | | | | | | | | | | | | | | | | | | We use the following site for that now: * https://tools.ietf.org/ or http * https://datatracker.ietf.org or http Today, IETF said the official site of RFC is www.rfc-editor.org. FYI: https://authors.ietf.org/en/references-in-rfcxml I replaced them to www.rfc-editor.org.
* | Merge pull request #729 from junaruga/wip/fips-test-pkey-dsaKazuki Yamaguchi2024-03-213-15/+41
|\ \ | | | | | | Fix test_pkey_dsa.rb in FIPS.
| * | Fix test_pkey_dsa.rb in FIPS.Jun Aruga2024-03-153-15/+41
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Note that I created the `dsa2048.pem` and signature text (`signature_encoded.txt`), that is used as a text to create the `signature0` in the `test_sign_verify` by the following steps with the `openssl` CLI on FIPS module. ``` $ OPENSSL_DIR="${HOME}/.local/openssl-3.3.0-dev-fips-debug-1f03d33ef5" $ export OPENSSL_CONF="${OPENSSL_DIR}/ssl/openssl_fips.cnf" $ "${OPENSSL_DIR}/bin/openssl" dsaparam -out dsaparam2048.pem 2048 $ "${OPENSSL_DIR}/bin/openssl" gendsa -out dsa2048.pem dsaparam2048.pem $ echo -n "Sign me!" > data.txt $ "${OPENSSL_DIR}/bin/openssl" dgst -sha256 -sign dsa2048.pem data.txt > signature.txt $ cat signature.txt | base64 > signature_encoded.txt ``` Skip the `test_DSAPrivateKey_encrypted` on FIPS because AES-128-CBC, the password based encryption used in the PEM format uses MD5 for deriving the encryption key from the password, and MD5 is not FIPS-approved. See also the comment on the `test/openssl/utils.rb#omit_on_fips`.
* | Merge pull request #705 from eregon/remove-truffleruby-workardoundBenoit Daloze2024-03-201-8/+1
|\ \ | |/ |/| Revert openssl dir workaround on TruffleRuby
| * Revert "Always respect the openssl prefix chosen by truffle/openssl-prefix ↵Benoit Daloze2023-12-011-8/+1
| | | | | | | | | | | | | | on TruffleRuby" * This reverts commit ca738e7e13570e88eaa9892cbb3dffb330320706. * No longer needed since https://github.com/oracle/truffleruby/issues/3170 was fixed.
* | Merge pull request #721 from junaruga/wip/conditional-legacy-provider-testKazuki Yamaguchi2024-03-142-9/+11
|\ \ | | | | | | test_provider.rb: Make a legacy provider test optional.
| * | test_provider.rb: Make a legacy provider test optional.Jun Aruga2024-02-211-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In some cases such as OpenSSL package in FreeBSD[1], the legacy provider is not installed intentionally. So, we omit a test depending the legacy provider if the legacy provider is not loadable. For the test_openssl_provider_names test, we use base provider[2] instead of legacy provider, because we would expect the base provider is always loadable in OpenSSL 3 for now. * [1] https://www.freshports.org/security/openssl/ * [2] https://wiki.openssl.org/index.php/OpenSSL_3.0#Providers
| * | CI: Add OpenSSL no-legacy case.Jun Aruga2024-02-211-0/+1
| | | | | | | | | | | | Add the case of the OpenSSL that doesn't install the legacy provider.
| * | Revert "omit tests related legacy provider"Jun Aruga2024-02-211-4/+0
| | | | | | | | | | | | | | | | | | | | | This reverts commit 9b7543d58869ae359eb745d7feafbb522ad1fd1e. The case not providing the legacy provider can happen not only in FreeBSD but also in other platforms. The fix is addressed in the next commit.
* | | Merge pull request #728 from junaruga/wip/test-asn1-remove-no-seconds-assertionsKazuki Yamaguchi2024-03-141-8/+0
|\ \ \ | |/ / |/| | test_asn1.rb: Remove the assertions of the time string format without second.
| * | test_asn1.rb: Remove the assertions of the time string format without second.Jun Aruga2024-03-121-8/+0
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit fixes the following errors in the tests. Because the OpenSSL project changed the code to make the time string format without second invalid. So, we drop the assertions. ``` 1) Error: test_generalizedtime(OpenSSL::TestASN1): OpenSSL::ASN1::ASN1Error: generalizedtime is too short /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:698:in `decode' /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:698:in `decode_test' /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:433:in `test_generalizedtime' 430: OpenSSL::ASN1::GeneralizedTime.new(Time.utc(9999, 9, 8, 23, 43, 39)) 431: # LibreSSL 3.6.0 requires the seconds element 432: return if libressl? => 433: decode_test B(%w{ 18 0D }) + "201612081934Z".b, 434: OpenSSL::ASN1::GeneralizedTime.new(Time.utc(2016, 12, 8, 19, 34, 0)) 435: # not implemented 436: # decode_test B(%w{ 18 13 }) + "20161208193439+0930".b, 2) Error: test_utctime(OpenSSL::TestASN1): OpenSSL::ASN1::ASN1Error: utctime is too short /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:698:in `decode' /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:698:in `decode_test' /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:411:in `test_utctime' 408: end 409: # Seconds is omitted. LibreSSL 3.6.0 requires it 410: return if libressl? => 411: decode_test B(%w{ 17 0B }) + "1609082343Z".b, 412: OpenSSL::ASN1::UTCTime.new(Time.utc(2016, 9, 8, 23, 43, 0)) 413: # not implemented 414: # decode_test B(%w{ 17 11 }) + "500908234339+0930".b, ```
* | Merge pull request #718 from ruby/omit-legacy-providerHiroshi SHIBATA2024-02-211-0/+4
|\ \ | | | | | | omit tests related legacy provider
| * | Fix accidentally changed to rename test method at ↵Hiroshi SHIBATA2024-02-211-1/+1
| | | | | | | | | | | | d95d3484a90a985b971ef4c55762847d92b6c81a
| * | omit tests related legacy providerHiroshi SHIBATA2024-02-071-1/+5
| | | | | | | | | | | | | | | | | | It failed with recent update of FreeBSD https://rubyci.s3.amazonaws.com/freebsd13/ruby-master/log/20240207T023002Z.fail.html.gz
* | | Merge pull request #720 from junaruga/wip/ci-upgrade-versionsJun Aruga2024-02-081-7/+7
|\ \ \ | |/ / |/| | CI: Upgrade OpenSSL and LibreSSL versions.
| * | CI: Upgrade OpenSSL and LibreSSL versions.Jun Aruga2024-02-081-7/+7
|/ /
* | Merge pull request #702 from rhenium/ky/ocsp-test-fix-random-failuresKazuki Yamaguchi2024-01-181-1/+1
|\ \ | | | | | | test/openssl/test_ocsp.rb: fix flaky test
| * | test/openssl/test_ocsp.rb: fix flaky testky/ocsp-test-fix-random-failuresKazuki Yamaguchi2023-11-251-1/+1
| |/ | | | | | | Fixes: https://github.com/ruby/openssl/issues/695
* | Add support for IO#timeout. (#714)Samuel Williams2024-01-184-2/+42
| | | | | | | | * Add support for IO#timeout.
* | Merge pull request #710 from ekohl/dont-set-min_version-by-defaultKazuki Yamaguchi2024-01-181-1/+1
|\ \ | | | | | | Only set min_version on OpenSSL < 1.1.0
| * | Only set min_version on OpenSSL < 1.1.0Ewoud Kohl van Wijngaarden2024-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both Red Hat and Debian-like systems configure the minimum TLS version to be 1.2 by default, but allow users to change this via configs. On Red Hat and derivatives this happens via crypto-policies[1], which in writes settings in /etc/crypto-policies/back-ends/opensslcnf.config. Most notably, it sets TLS.MinProtocol there. For Debian there's MinProtocol in /etc/ssl/openssl.cnf. Both default to TLSv1.2, which is considered a secure default. In constrast, the SSLContext has a hard coded OpenSSL::SSL::TLS1_VERSION for min_version. TLS 1.0 and 1.1 are considered insecure. By always setting this in the default parameters, the system wide default can't be respected, even if a developer wants to. This takes the approach that's also done for ciphers: it's only set for OpenSSL < 1.1.0. [1]: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening
* | | Add support for `gets(chomp: true)`.Samuel Williams2024-01-132-2/+17
| | |
* | | Add more methods to `SocketForwarder`.Samuel Williams2024-01-131-0/+28
|/ /
* | Merge pull request #713 from junaruga/wip/win-3.3-legacy-provider-docJun Aruga2024-01-111-2/+5
|\ \ | | | | | | CI: Added the rubyinstaller2 issue link that legacy provider is not loaded.
| * | CI: Add the rubyinstaller2 issue link that legacy provider is not loaded.Jun Aruga2024-01-111-2/+5
|/ / | | | | | | | | | | | | * Add the upstream rubyinstaller2 issue link as a comment. The issue is that the legacy provider (legacy.dll) is not loaded in Windows MSYS2 OpenSSL 3 environment. * Polish the text on the comment.
* | Merge pull request #712 from junaruga/wip/win-3.3-legacy-provider-not-loadedJun Aruga2024-01-111-2/+2
|\ \ | |/ |/| Windows Ruby 3.3: Workaround: Set OPENSSL_MODULES to find providers.
| * Windows Ruby 3.3: Workaround: Set OPENSSL_MODULES to find providers.Jun Aruga2024-01-111-2/+2
|/ | | | | | | | | | | | | | | | | | | | This commit is a workaround to avoid the following test failures by loading legacy provider. ``` 2) Error: test_openssl_legacy_provider(OpenSSL::TestProvider): OpenSSL::Provider::ProviderError: Failed to load legacy provider: (null) (name=legacy) D:/a/ruby-openssl/ruby-openssl/test/openssl/test_provider.rb:62:in `load' D:/a/ruby-openssl/ruby-openssl/test/openssl/test_provider.rb:62:in `<main>' D:/a/ruby-openssl/ruby-openssl/test/openssl/test_provider.rb:61:in `with_openssl' D:/a/ruby-openssl/ruby-openssl/test/openssl/test_provider.rb:36:in `test_openssl_legacy_provider' 33: end 34: 35: def test_openssl_legacy_provider => 36: with_openssl(<<-'end;') 37: OpenSSL::Provider.load("legacy") 38: algo = "RC4" 39: data = "a" * 1000 ```
* Merge pull request #694 from junaruga/wip/fips-test-pkey-dhKazuki Yamaguchi2023-11-255-26/+58
|\ | | | | Fix test_pkey_dh.rb in FIPS.
| * Fix test_pkey_dh.rb in FIPS.Jun Aruga2023-11-165-26/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We use dh2048_ffdhe2048.pem file (DH 2048 bits) instead of dh1024.pem file in both non-FIPS and FIPS cases. Because the following command fails to generate the pem file with 1024 bits. And the OpenSSL FIPS 140-2 security policy document explains the DH public keys are allowed from 2048 bits.[1] ``` $ OPENSSL_CONF=/home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/ssl/openssl_fips.cnf \ /home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/bin/openssl \ dhparam -out dh1024.pem 1024 Generating DH parameters, 1024 bit long safe prime dhparam: Generating DH key parameters failed ``` The dh2048_ffdhe2048.pem file was created by the following command with the OpenSSL FIPS configuration file. The logic to generate the DH pem file is different between non-FIPS and FIPS cases. In FIPS, it seems that the command always returns the text defined as ffdhe2048 in the FFDHE groups in RFC 7919 unlike non-FIPS.[2] As the generated pem file is a normal and valid PKCS#3-style group parameter, we use the file for the non-FIPS case too. ``` $ OPENSSL_CONF=/home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/ssl/openssl_fips.cnf \ /home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/bin/openssl \ dhparam -out dh2048_ffdhe2048.pem 2048 ``` Note that the hard-coded PEM-encoded string in the `test_DHparams` is intentional to avoid modifying the content unintentionally. * [1] https://www.openssl.org/source/ - OpenSSL 3.0.8 FIPS 140-2 security policy document page 25, Table 10 – Public Keys - DH Public - DH (2048/3072/4096/6144/8192) public key agreement key * [2] RFC7919 - Appendix A.1: ffdhe2048 https://www.rfc-editor.org/rfc/rfc7919#appendix-A.1
* | Merge pull request #696 from junaruga/wip/doc-markdown-refKazuki Yamaguchi2023-11-252-31/+33
|\ \ | | | | | | Use Markdown reference-style links in documents. [ci skip]
| * | Use Markdown reference-style links in documents. [ci skip]Jun Aruga2023-11-202-31/+33
| |/ | | | | | | | | | | Use Markdown reference-style links due to a better readability. See <https://github.com/adam-p/markdown-here/wiki/Markdown-Cheatsheet#links> for details.
* | Merge pull request #697 from junaruga/wip/doc-escape-markdown-syntaxKazuki Yamaguchi2023-11-251-1/+1
|\ \ | | | | | | History.md: Escape Markdown syntax Italic "*". [ci skip]
| * | History.md: Escape Markdown syntax Italic "*". [ci skip]Jun Aruga2023-11-201-1/+1
| |/
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-08 17:48:08 +0000