aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| | * Remove taint supportJeremy Evans2020-02-243-11/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 2.0 branch. ] Ruby 2.7 deprecates taint and it no longer has an effect. The lack of taint support should not cause a problem in previous Ruby versions. (cherry picked from commit e7ed01b580a139ad0fb320ad5f29bbb40ef2ddc2)
| | * Restore compatibility with older versions of Ruby.Samuel Williams2020-02-241-9/+21
| | | | | | | | | | | | | | | | | | | | | [ Originally landed on as commit b4e96fc4abc3. This is a backport to the 2.0 branch. ] `RB_PASS_KEYWORDS` is not always available.
| | * Fix keyword argument separation issues in ↵Jeremy Evans2020-02-241-4/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL::SSL::SSLSocket#sys{read,write}_nonblock [ Originally landed on ruby.git as commit 3959469f240e, then was merged into ruby/openssl.git as commit b4e96fc4abc3. This is a backport to the 2.0 branch. ] It's unlikely anyone would actually hit these. The methods are private, you only hit this code path if calling these methods before performing the SSL connection, and there is already a verbose warning issued.
| | * Merge pull request #216 from rhenium/ky/config-include-directiveKazuki Yamaguchi2020-02-172-18/+90
| | |\ | | | | | | | | config: support .include directive
| | | * config: support .include directiveky/config-include-directiveKazuki Yamaguchi2019-12-132-18/+90
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 1.1.1 introduces a new '.include' directive. Update our config parser to support that. As mentioned in the referenced GitHub issue, we should use the OpenSSL API instead of implementing the parsing logic ourselves, but it will need backwards-incompatible changes which we can't backport to stable versions. So continue to use the Ruby implementation for now. Squashed in additional changes by Vít Ondruch to support '.include = ' syntax. Reference: https://github.com/ruby/openssl/issues/208
* | | | ssl: remove test case test_puts_meta from test_pairKazuki Yamaguchi2020-03-091-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove it as it does not make sense. Also, it produces deprecation warning on the current master of Ruby (2.8). It is a test case to check that changing $/ will not affect OpenSSL::Buffering#puts. However, $/ is the input record separator and should be completely irrelevant to it.
* | | | ssl: suppress test failure with SSLContext#add_certificate_chain_fileKazuki Yamaguchi2020-03-096-48/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The feature is currently premature and will be rewritten. However, it is causing test failures on RubyCI. Make it happy for now. Reference: https://github.com/ruby/openssl/issues/334
* | | | Merge pull request #352 from DBL-Lee/masterKazuki Yamaguchi2020-02-292-1/+13
|\ \ \ \ | | | | | | | | | | Add support for SHA512/256 and SHA512/224
| * | | | add support for SHA512_256/SHA512_224DBL-Lee2020-02-272-1/+13
|/ / / /
* | | | Merge pull request #351 from rhenium/ky/actions-updateKazuki Yamaguchi2020-02-265-103/+138
|\ \ \ \ | | | | | | | | | | .github/workflows: test against different OpenSSL versions
| * | | | .travis.yml: fully migrate to GitHub Actionsky/actions-updateKazuki Yamaguchi2020-02-262-23/+1
| | | | | | | | | | | | | | | | | | | | | | | | | The GitHub Actions workflow now covers all patterns we currently test using Travis CI. .travis.yml can be removed.
| * | | | .github/workflows: test against different OpenSSL versionsKazuki Yamaguchi2020-02-261-0/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Compile OpenSSL and LibreSSL on-the-fly and run our test suite against the OpenSSL installation. Compiling OpenSSL or LibreSSL takes about 1.5 - 2 minutes on a GitHub- hosted runner.
| * | | | .github/workflows: merge CI jobs into a single workflowKazuki Yamaguchi2020-02-262-39/+32
|/ / / / | | | | | | | | | | | | | | | | The "Ubuntu-macOS" and "Windows" workflows are both for the same purpose. Merge them into a single workflow for clarity.
* | | | Merge pull request #349 from MSP-Greg/gemspec-versionKazuki Yamaguchi2020-02-251-1/+3
|\ \ \ \ | | | | | | | | | | Use version.rb in gemspec
| * | | | Use version.rb in gemspecMSP-Greg2020-02-241-1/+3
|/ / / / | | | | | | | | | | | | Use version.rb in gemspec so version string exists in one location
* | | | Remove redundant and ignored workflow fileBenoit Daloze2020-02-221-43/+0
| | | | | | | | | | | | | | | | * .github/workflows/ubuntu-macos.yml already tests those.
* | | | Merge pull request #348 from rhenium/ky/fix-openssl-version-constantKazuki Yamaguchi2020-02-222-1/+2
|\ \ \ \ | | | | | | | | | | lib/openssl.rb: require openssl/version.rb
| * | | | lib/openssl.rb: require openssl/version.rbky/fix-openssl-version-constantKazuki Yamaguchi2020-02-222-1/+2
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | The OpenSSL::VERSION constant is now defined by lib/openssl/version.rb instead of by the extension. Add missing require statement. Fixes: 0cddb0b736c8 ("Simplify handling of version constant.", 2019-10-31) Reference: https://github.com/ruby/openssl/issues/347
* | | | Merge pull request #322 from rhenium/ky/config-deprecate-modifyKazuki Yamaguchi2020-02-213-49/+77
|\ \ \ \ | | | | | | | | | | config: deprecate OpenSSL::Config#add_value and #[]=
| * | | | config: deprecate OpenSSL::Config#add_value and #[]=ky/config-deprecate-modifyKazuki Yamaguchi2020-02-193-49/+77
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL::Config is currently implemented in Ruby, but we plan to revert back to use OpenSSL API, just as it did before r28632 (in ruby_1_8; r29048 in trunk). It's not clear what was the issue with Windows, but the CONF library should work on Windows too. Modifying a CONF object is not possible in OpenSSL API. Actually, it was possible in previous versions of OpenSSL, but we used their internal functions that are not exposed in shared libraries anymore. Accordingly, OpenSSL::Config#add_value and #[]= have to be removed. As a first step towards the change, let's deprecate those methods.
* | | | | Merge pull request #346 from rhenium/ky/engine-load-updatesKazuki Yamaguchi2020-02-212-14/+4
|\ \ \ \ \ | | | | | | | | | | | | engine: small cleanups on OpenSSL::Engine.load
| * | | | | engine: fix guards for 'dynamic' and 'cryptodev' enginesky/engine-load-updatesKazuki Yamaguchi2020-02-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Those two engines exist as builtin engines even if static engines are disabled with OPENSSL_NO_STATIC_ENGINE. This is the default with recent OpenSSL. This has prevented Engine.load("dynamic") from working and required the user to call OpenSSL::Engine.load with no arguments, which loads all builtin engines including 'dynamic'. Note that OpenSSL 1.1.0 and newer calls (the equivalent of) ENGINE_load_builtin_engines() on its initialization. This includes 'dynamic' and 'cryptodev' engines (if available).
| * | | | | engine: do not check for ENGINE_load_builtin_engines()Kazuki Yamaguchi2020-02-212-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove dead code. The function, or a macro in OpenSSL 1.1.0 and newer, always exists unless the whole engine code is disabled with OPENSSL_NO_ENGINE.
| * | | | | engine: remove really outdated static enginesKazuki Yamaguchi2020-02-212-8/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | They no longer exists in OpenSSL 1.0.1, which is the oldest version Ruby/OpenSSL currently compiles with. Note that OpenSSL 1.0.2 and older is already in EOL state. The following engines should also be removed when we completely drop support for those versions as they were removed in OpenSSL 1.1.0. - 4758cca - aep - atalla - chil - cswift - nuron - sureware - ubsec - gmp - gost
* | | | | | Merge pull request #345 from rhenium/ky/engine-load-revert-cloudhsmKazuki Yamaguchi2020-02-212-5/+1
|\| | | | | | | | | | | | | | | | | engine: revert OpenSSL::Engine.load changes for cloudhsm
| * | | | | engine: revert OpenSSL::Engine.load changes for cloudhsmky/engine-load-revert-cloudhsmKazuki Yamaguchi2020-02-202-5/+1
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Revert two commits: - ea49ccc82aa4 Add cloudhsm to extconf.rb - 33ed3ba10424 Add cloudhsm to ossl_engine.c OpenSSL::Engine.load is a binding for ENGINE_load_*() functions which are provided by OpenSSL itself, so-called "static engines". Since the AWS CloudHSM engine is a dynamic engine, which is provided as a shared library, this change is not a correct solution for the issue. Reference: https://github.com/ruby/openssl/issues/189 Reference: https://github.com/ruby/openssl/pull/190
* | | | | Merge pull request #344 from rhenium/ky/ssl-test-fixupsKazuki Yamaguchi2020-02-191-20/+18
|\ \ \ \ \ | | | | | | | | | | | | test/openssl/test_ssl: test fixes
| * | | | | test/openssl/test_ssl: allow kRSA tests to failky/ssl-test-fixupsKazuki Yamaguchi2020-02-191-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Non-forward-secrecy cipher suites may be disabled when OpenSSL's security level is set to 3 or higher.
| * | | | | test/openssl/test_ssl: remove commented-out test caseKazuki Yamaguchi2020-02-191-13/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reapply commit ca77d5504f0a ("Remove out-of-scope test.", 2019-12-29). Private methods are not to be used by users and the behavior should not be tested.
| * | | | | test/openssl/test_ssl: avoid explicitly-sized private keysKazuki Yamaguchi2020-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix possible test failure in test_add_certificate_multiple_certs. In environment with OpenSSL's security level set to 3, RSA keys with 2048 bits will be rejected. Since the test case does not require the exact size of a key, just use the generic rsa-3 key.
| * | | | | test/openssl/test_ssl: fix random failure in SSLSocket.open testKazuki Yamaguchi2020-02-191-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let test_socket_open_with_local_address_port_context use a random high port number and also ignore Errno::EADDRINUSE in case it is in use.
| * | | | | test/openssl/test_ssl: remove sleep from test_finished_messagesKazuki Yamaguchi2020-02-191-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ensure that the handshake fully completes by sending data each other rather than by inserting 50ms sleep.
* | | | | | Merge pull request #343 from rhenium/ky/ssl-avoid-mixed-declarationsKazuki Yamaguchi2020-02-191-12/+12
|\ \ \ \ \ \ | |_|/ / / / |/| | | | | ssl: avoid declarations after statements
| * | | | | ssl: avoid declarations after statementsky/ssl-avoid-mixed-declarationsKazuki Yamaguchi2020-02-191-12/+12
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | We cannot use C99 features yet, as we still support Ruby 2.6 and older. Fixes: debaca25604c ("Adds support for the 'get_finished' and 'get_peer_finished' functions", 2019-06-25)
* / / / / History.md: add missing references to GitHub issuesKazuki Yamaguchi2020-02-191-10/+31
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | Add links to GitHub issues or pull requests. Also, move incompatible changes to a separate section for better visibility.
* | | | Merge pull request #333 from rhenium/ky/remove-wdeprecated-declarationsKazuki Yamaguchi2020-02-173-66/+8
|\ \ \ \ | | | | | | | | | | extconf.rb: get rid of -Werror=deprecated-declarations
| * | | | extconf.rb: get rid of -Werror=deprecated-declarationsky/remove-wdeprecated-declarationsKazuki Yamaguchi2020-02-162-33/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No function needs -Werror=deprecated-declarations flag to check availability any more. This also fixes -Werror=deprecated-declarations erroneously carrying on to the actual compilation, resulting in an compilation error on some environment. Fixes: https://github.com/ruby/openssl/pull/331
| * | | | random: make OpenSSL::Random.pseudo_bytes alias of .random_bytesKazuki Yamaguchi2020-02-162-33/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The default implementation of RAND_pseudo_bytes() uses the same routine as RAND_bytes(). Note that OpenSSL::Random.pseudo_bytes has been available only when it is compiled with EOL versions of OpenSSL.
* | | | | Merge pull request #339 from rhenium/ky/ts-simplify-tsreq-get-algorithmKazuki Yamaguchi2020-02-172-16/+1
|\ \ \ \ \ | | | | | | | | | | | | ts: simplify OpenSSL::Timestamp::Request#algorithm
| * | | | | ts: simplify OpenSSL::Timestamp::Request#algorithmky/ts-simplify-tsreq-get-algorithmKazuki Yamaguchi2020-02-172-16/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Stop the special treatment of invalid hashAlgorithm of the message imprint. Those invalid values can only appear after the object is instantiated, before the user sets an actual message digest algorithm. OpenSSL::Timestamp::TokenInfo#algorithm already does the same. Also, remove the test case "test_create_request" since it does not make much sense. Those fields are to be set by the user after creation of the object and checking the initial value is pointless. Fixes: https://github.com/ruby/openssl/issues/335
* | | | | | Merge pull request #338 from rhenium/ky/ssl-test-fix-fallback-scsvKazuki Yamaguchi2020-02-171-0/+4
|\ \ \ \ \ \ | | | | | | | | | | | | | | test/openssl/test_ssl: skip test_fallback_scsv if necessary
| * | | | | | test/openssl/test_ssl: skip test_fallback_scsv if necessaryky/ssl-test-fix-fallback-scsvKazuki Yamaguchi2020-02-171-0/+4
| |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Run the test case only when the OpenSSL supports both TLS 1.1 and TLS 1.2. Note that the fallback SCSV mechanism is for TLS 1.2 or older and not for 1.3. Fixes: https://github.com/ruby/openssl/issues/336
* | | | | | Merge pull request #326 from MSP-Greg/travis-pruneKazuki Yamaguchi2020-02-171-13/+0
|\ \ \ \ \ \ | |/ / / / / |/| | | | | .travis.yml - remove 2.3/1.0.2, 2.5/1.1.1, head/1.0.2
| * | | | | .travis.yml - remove 2.3/1.0.2, 2.5/1.1.1, head/1.0.2MSP-Greg2020-02-151-13/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two jobs in Travis are duplicates of Actions jobs, and one is unlikely. The below two jobs are running in Actions on all OS's Ruby 2.3 and OpenSSL 1.0.2, Ruby 2.5 and OpenSSL 1.1.1 Ruby head and OpenSSL 1.0.2 - OpenSSL 1.0.2 is EOL, and the CI is running 1.0.2g, last release was 1.0.2u.
* | | | | | Fixed inconsistency directory structure with ruby/ruby repoHiroshi SHIBATA2020-02-1750-1/+2
| | | | | |
* | | | | | Merge pull request #332 from mame/make-fixed_length_secure_compare-test-tolerantKazuki Yamaguchi2020-02-161-4/+7
|\ \ \ \ \ \ | |_|/ / / / |/| | | | | Make OpenSSL::OSSL#test_memcmp_timing robust
| * | | | | Make OpenSSL::OSSL#test_memcmp_timing robustYusuke Endoh2020-02-161-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The test was too fragile. Actually, it fails on one of our CIs immediately after it was merged to ruby/ruby. https://gist.github.com/ko1/7ea4a5826641f79e2f9e041d83e45dba#file-brlog-trunk_clang_40-20200216-101730-L532-L535 https://gist.github.com/ko1/1c657746092b871359d8bf9e0ad28921#file-brlog-trunk-test4-20200216-104518-L473-L476 * Two measurements, a-b and a-c, must be interative instead of sequential; the execution time will be easily affected by disturbance (say, cron job or some external process invoked during measurement) * The comparison of the two results must be relative instead of absolute; slow machine may take several tens of seconds for each execution, and one delta second is too small. The test cases of a, b, and c are very extreme, so if the target method has a bug, the two execution times would be very different. So I think it is enough to check if the difference is less than 10 times.
* | | | | | Merge pull request #330 from ruby/guard-pkey-ec-addHiroshi SHIBATA2020-02-161-6/+11
|\ \ \ \ \ \ | |/ / / / / |/| | | | | Guard for OpenSSL::PKey::EC::Group::Error with unsupported platforms
| * | | | | Guard for OpenSSL::PKey::EC::Group::Error with unsupported platformsHiroshi SHIBATA2020-02-161-6/+11
|/ / / / /
* | | | | Merge pull request #321 from ruby/revert-ref-version-fileHiroshi SHIBATA2020-02-161-8/+1
|\ \ \ \ \ | |/ / / / |/| | | | Drop to reference OpenSSL::VERSION on gemspec
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-07 13:18:16 +0000