aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| | | | * | cipher: fix buffer overflow in Cipher#updateky/cipher-update-fix-buffer-sizeKazuki Yamaguchi2024-05-012-3/+31
| | | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL::Cipher#update currently allocates the output buffer with size (input data length)+(the block size of the cipher). This is insufficient for the id-aes{128,192,256}-wrap-pad (AES keywrap with padding) ciphers. They have a block size of 8 bytes, but the output may be up to 15 bytes larger than the input. Use (input data length)+EVP_MAX_BLOCK_LENGTH (== 32) as the output buffer size, instead. OpenSSL doesn't provide a generic way to tell the maximum required buffer size for ciphers, but this is large enough for all algorithms implemented in current versions of OpenSSL. Fixes: https://bugs.ruby-lang.org/issues/20236
| | | * | ssl: allow failure on test_connect_certificate_verify_failed_exception_messageky/maint-3.0-backportsKazuki Yamaguchi2024-05-011-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ This patch only applies to the 3.0 and 3.1 branch. ] It is a test case for SSLSocket generating an informative error message on a certificate verification failure. A change in OpenSSL 3.1 broke it and a generic error message is currently generated. This is fixed in the 3.2 branch by commit 5113777e8271, but I decided not to backport the commit to the 3.0 branch because the diff doesn't apply cleanly.
| | | * | .github/workflows/test.yml: synchronize with masterKazuki Yamaguchi2024-05-011-47/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 3.0 branch. ] Backport changes made to .github/workflows/test.yml in master branch, except: - Minimum version is Ruby 2.6 - FIPS-mode related changes are excluded (as it's not supported) This includes the following commits: fcf53d5d6e88 CI: Remove workaround for Ruby-3.2 and 3.3 on Windows 567b412612c3 CI: Upgrade OpenSSL and LibreSSL versions. 405f1eee3dcf CI: Add OpenSSL no-legacy case. 9a995837ba7b CI: Upgrade OpenSSL and LibreSSL versions. 6feeeb821592 CI: Add the rubyinstaller2 issue link that legacy provider is not loaded. 7aed35ac969d Windows Ruby 3.3: Workaround: Set OPENSSL_MODULES to find providers. adfb6bb9e5b7 CI: Add OpenSSL 3.2.0. fafe1af4a96e CI: Change the openssl_fips.cnf.tmpl and openssl_fips.cnf directories. f07e6f5ff2e7 CI: Upgrade OpenSSL and LibreSSL versions. 0dda88d44811 Merge pull request #682 from ruby/dependabot/github_actions/actions/checkout-4 0b83eed154de Rakefile: Add test_fips task for convenience. b94314f7165f Bump actions/checkout from 3 to 4 8c7a6a17e2bd Remove OSSL_DEBUG compile-time option e35f19076aac CI: Replace "mode" in "FIPS mode" with "module". 61434f66d6a4 Rakefile: Print FIPS information in the `rake debug`. 7ec8024b1e9a CI: Add OpenSSL master branch head non-FIPS and FIPS cases. 24d8addd2ac9 CI: Upgrade OpenSSL versions. fddfc5585482 CI: Add OpenSSL 3.1 FIPS case. 58ce7fa4b90c .github/workflows/test.yml: add provider load path for Windows f6e57e1b9088 CI: Fix a typo in the comment. [ci skip] 52402f6a1cad CI: Check compiler warnings. f6ba75e51e05 Drop support for Ruby 2.6 3456770a4219 CI: Upgrade OpenSSL and LibreSSL versions. 79786cab6f77 CI: Rename the key name "foo_bar" (underscore) to "foo-bar" (hyphen). 8149cdf6e874 CI: Add the test/openssl/test_pkey.rb on the FIPS mode case. 08e19817b5d0 CI: Enable the verbose mode in the mkmf.rb by env MAKEFLAGS. 121b3b2a35ca Revert "CI: Enable the verbose mode in the mkmf.rb." a832f5cb98ee CI: Enable the verbose mode in the mkmf.rb. 18b017218ca8 CI: Add OpenSSL FIPS mode case. af27f509a147 .github/workflows/test.yml: Update OpenSSL versions d277123cb7bb skip failing test with truffleruby and ubuntu-22.04 25352f4f6c08 Exclude truffleruby with macos-latest d7f90c7c03b7 Fix missing needs call 064066437607 Try to run with TruffleRuby aeee125a7b3d Use ruby/actions/.github/workflows/ruby_versions.yml@master fd4074235877 .github/workflows/test.yml: update LibreSSL versions ff2fe4b4c5b3 Strip trailing spaces [ci skip] 9c24dccf5436 Actions - Use Ubuntu 20.04 for 1.1.1 CI, misc fixes cc876f58532c [CI] test.yml - test-openssls - use 1.1.1q, 3.0.5 0fb8d1b43aa5 [CI] add Ubuntu-22.04 and update mswin, all are OpenSSL 3 158868649532 Merge pull request #505 from ruby/update-actions 9f901dc05ce5 Test on LibreSSL 3.4 and 3.5 f2d072cad504 Use actions/checkout@v3 699e2749f525 Added 3.1 b28df9025f12 Install openssl with vcpkg on mswin
| | | * | Only CSR version 1 (encoded as 0) is allowed by PKIX standardsJob Snijders2024-05-011-6/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 3.0 branch. ] RFC 2986, section 4.1 only defines version 1 for CSRs. This version is encoded as a 0. Starting with OpenSSL 3.3, setting the CSR version to anything but 1 fails. Do not attempt to generate a CSR with invalid version (which now fails) and invalidate the CSR in test_sign_and_verify_rsa_sha1 by changing its subject rather than using an invalid version. This commit fixes the following error. ``` 2) Error: test_version(OpenSSL::TestX509Request): OpenSSL::X509::RequestError: X509_REQ_set_version: passed invalid argument /home/runner/work/openssl/openssl/test/openssl/test_x509req.rb:18:in `version=' /home/runner/work/openssl/openssl/test/openssl/test_x509req.rb:18:in `issue_csr' /home/runner/work/openssl/openssl/test/openssl/test_x509req.rb:43:in `test_version' 40: req = OpenSSL::X509::Request.new(req.to_der) 41: assert_equal(0, req.version) 42: => 43: req = issue_csr(1, @dn, @rsa1024, OpenSSL::Digest.new('SHA256')) 44: assert_equal(1, req.version) 45: req = OpenSSL::X509::Request.new(req.to_der) 46: assert_equal(1, req.version) ``` (cherry picked from commit c06fdeb0912221d9a2888369bbf9c10704af021e)
| | | * | test_asn1.rb: Remove the assertions of the time string format without second.Jun Aruga2024-05-011-8/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 3.0 branch. ] This commit fixes the following errors in the tests. Because the OpenSSL project changed the code to make the time string format without second invalid. So, we drop the assertions. ``` 1) Error: test_generalizedtime(OpenSSL::TestASN1): OpenSSL::ASN1::ASN1Error: generalizedtime is too short /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:698:in `decode' /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:698:in `decode_test' /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:433:in `test_generalizedtime' 430: OpenSSL::ASN1::GeneralizedTime.new(Time.utc(9999, 9, 8, 23, 43, 39)) 431: # LibreSSL 3.6.0 requires the seconds element 432: return if libressl? => 433: decode_test B(%w{ 18 0D }) + "201612081934Z".b, 434: OpenSSL::ASN1::GeneralizedTime.new(Time.utc(2016, 12, 8, 19, 34, 0)) 435: # not implemented 436: # decode_test B(%w{ 18 13 }) + "20161208193439+0930".b, 2) Error: test_utctime(OpenSSL::TestASN1): OpenSSL::ASN1::ASN1Error: utctime is too short /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:698:in `decode' /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:698:in `decode_test' /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:411:in `test_utctime' 408: end 409: # Seconds is omitted. LibreSSL 3.6.0 requires it 410: return if libressl? => 411: decode_test B(%w{ 17 0B }) + "1609082343Z".b, 412: OpenSSL::ASN1::UTCTime.new(Time.utc(2016, 9, 8, 23, 43, 0)) 413: # not implemented 414: # decode_test B(%w{ 17 11 }) + "500908234339+0930".b, ``` (cherry picked from commit 2e826d571546cdc3beaa884f9e522a102d531641)
| | | * | test/openssl/test_asn1.rb: skip failing tests on LibreSSL 3.6.0Kazuki Yamaguchi2024-05-011-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 3.0 branch. ] LibreSSL 3.6.0 expects the seconds part in UTCTime and GeneralizedTime to be always present. LibreSSL 3.6.0 release note [1] says: > - The ASN.1 time parser has been refactored and rewritten using CBS. > It has been made stricter in that it now enforces the rules from > RFC 5280. [1] https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.0-relnotes.txt (cherry picked from commit bbc540fe83195e2a54cf40fab448cea2afe4df1d)
| | | * | Use EVP_Digest{Sign,Verify} when availableTheo Buehler2024-05-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 3.0 branch. ] LibreSSL 3.4 added EVP_DigestSign() and EVP_DigestVerify(). Use them when available to prepare for the addition of Ed25519 support in LibreSSL 3.7. (cherry picked from commit 475b2bf766d6093370e49abd5dce5436cc0034ca)
| | | * | Merge pull request #706 from jaymzjulian/fix-large-buffered-write-regressionKazuki Yamaguchi2024-03-211-6/+11
| | | |\ \ | | | | | | | | | | | | Fix regression in do_write(s) causing significant performance issues when using large (>10meg) writes
| | | | * | Fix performance regression in do_write(s)Jaymz Julian2024-02-051-6/+11
| | | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This causes significant performance issues when using large (>10meg) writes Fix by adjusting the buffer write function to clear the buffer once, rather than piece by piece, avoiding a case where a large write (in our case, around 70mbytes) will consume 100% of CPU. This takes a webrick GET request via SSL from around 200kbyts/sec and consuming 100% of a core, to line speed on gigabit ethernet and 6% cpu utlization.
* | | | | Merge pull request #755 from rhenium/ky/asn1-check-i2d-errorKazuki Yamaguchi2024-05-021-2/+5
|\ \ \ \ \ | |_|_|_|/ |/| | | | asn1: check error return from i2d_ASN1_TYPE()
| * | | | asn1: check error return from i2d_ASN1_TYPE()ky/asn1-check-i2d-errorKazuki Yamaguchi2024-05-021-2/+5
|/ / / / | | | | | | | | | | | | | | | | i2d_ASN1_TYPE() is not expected to fail, but the return value should be checked.
* | | | Merge pull request #750 from ruby/pz-trailing-spacePeter Zhu2024-04-301-1/+1
|\ \ \ \ | | | | | | | | | | Remove trailing space in test_ssl.rb
| * | | | Remove trailing space in test_ssl.rbPeter Zhu2024-04-301-1/+1
|/ / / /
* | | | Merge pull request #726 from bdewater/digestsKazuki Yamaguchi2024-05-013-11/+46
|\ \ \ \ | | | | | | | | | | Add OpenSSL::Digest.digests to get a list of available digests
| * | | | Update Cipher#name to match Digest#name explanationBart de Water2024-03-151-2/+2
| | | | |
| * | | | Add OpenSSL::Digest.digests to get a list of available digestsBart de Water2024-03-152-9/+44
| | | | |
* | | | | Merge pull request #748 from larskanis/patch-2Kazuki Yamaguchi2024-05-011-9/+0
|\ \ \ \ \ | | | | | | | | | | | | CI: Remove workaround for Ruby-3.2 and 3.3 on Windows
| * | | | | CI: Remove workaround for Ruby-3.2 and 3.3 on WindowsLars Kanis2024-04-261-9/+0
| | | | | | | | | | | | | | | | | | The issue https://github.com/oneclick/rubyinstaller2/issues/365 was fixed with the 3.2.4 and 3.3.1 releases.
* | | | | | Merge pull request #743 from ruby/close-read-writeKazuki Yamaguchi2024-04-302-0/+50
|\ \ \ \ \ \ | | | | | | | | | | | | | | Introduce basic support for `close_read` and `close_write`.
| * | | | | | Further clarification of documentation.Samuel Williams2024-04-281-6/+6
| | | | | | |
| * | | | | | More documentation.Samuel Williams2024-04-281-1/+16
| | | | | | |
| * | | | | | Introduce basic support for `close_read` and `close_write`.Samuel Williams2024-04-272-0/+35
|/ / / / / /
* | | | | | Merge pull request #747 from botovq/csr-versionKazuki Yamaguchi2024-04-271-6/+1
|\ \ \ \ \ \ | |/ / / / / |/| | | | | Only CSR version 1 (encoded as 0) is allowed by PKIX standards
| * | | | | Only CSR version 1 (encoded as 0) is allowed by PKIX standardsJob Snijders2024-04-261-6/+1
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RFC 2986, section 4.1 only defines version 1 for CSRs. This version is encoded as a 0. Starting with OpenSSL 3.3, setting the CSR version to anything but 1 fails. Do not attempt to generate a CSR with invalid version (which now fails) and invalidate the CSR in test_sign_and_verify_rsa_sha1 by changing its subject rather than using an invalid version. This commit fixes the following error. ``` 2) Error: test_version(OpenSSL::TestX509Request): OpenSSL::X509::RequestError: X509_REQ_set_version: passed invalid argument /home/runner/work/openssl/openssl/test/openssl/test_x509req.rb:18:in `version=' /home/runner/work/openssl/openssl/test/openssl/test_x509req.rb:18:in `issue_csr' /home/runner/work/openssl/openssl/test/openssl/test_x509req.rb:43:in `test_version' 40: req = OpenSSL::X509::Request.new(req.to_der) 41: assert_equal(0, req.version) 42: => 43: req = issue_csr(1, @dn, @rsa1024, OpenSSL::Digest.new('SHA256')) 44: assert_equal(1, req.version) 45: req = OpenSSL::X509::Request.new(req.to_der) 46: assert_equal(1, req.version) ```
* | | | | Merge pull request #745 from junaruga/wip/ci-upgrade-versionsJun Aruga2024-04-241-3/+6
|\ \ \ \ \ | | | | | | | | | | | | CI: Upgrade OpenSSL and LibreSSL versions.
| * | | | | CI: Upgrade OpenSSL and LibreSSL versions.Jun Aruga2024-04-241-3/+6
|/ / / / /
* | | | | Merge pull request #737 from ruby/update-rfc-referenceHiroshi SHIBATA2024-03-283-8/+8
|\ \ \ \ \ | | | | | | | | | | | | Use www.rfc-editor.org for RFC text.
| * | | | | Use www.rfc-editor.org for RFC text.Hiroshi SHIBATA2024-03-283-8/+8
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We use the following site for that now: * https://tools.ietf.org/ or http * https://datatracker.ietf.org or http Today, IETF said the official site of RFC is www.rfc-editor.org. FYI: https://authors.ietf.org/en/references-in-rfcxml I replaced them to www.rfc-editor.org.
* | | | | Merge pull request #729 from junaruga/wip/fips-test-pkey-dsaKazuki Yamaguchi2024-03-213-15/+41
|\ \ \ \ \ | | | | | | | | | | | | Fix test_pkey_dsa.rb in FIPS.
| * | | | | Fix test_pkey_dsa.rb in FIPS.Jun Aruga2024-03-153-15/+41
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Note that I created the `dsa2048.pem` and signature text (`signature_encoded.txt`), that is used as a text to create the `signature0` in the `test_sign_verify` by the following steps with the `openssl` CLI on FIPS module. ``` $ OPENSSL_DIR="${HOME}/.local/openssl-3.3.0-dev-fips-debug-1f03d33ef5" $ export OPENSSL_CONF="${OPENSSL_DIR}/ssl/openssl_fips.cnf" $ "${OPENSSL_DIR}/bin/openssl" dsaparam -out dsaparam2048.pem 2048 $ "${OPENSSL_DIR}/bin/openssl" gendsa -out dsa2048.pem dsaparam2048.pem $ echo -n "Sign me!" > data.txt $ "${OPENSSL_DIR}/bin/openssl" dgst -sha256 -sign dsa2048.pem data.txt > signature.txt $ cat signature.txt | base64 > signature_encoded.txt ``` Skip the `test_DSAPrivateKey_encrypted` on FIPS because AES-128-CBC, the password based encryption used in the PEM format uses MD5 for deriving the encryption key from the password, and MD5 is not FIPS-approved. See also the comment on the `test/openssl/utils.rb#omit_on_fips`.
* | | | | Merge pull request #705 from eregon/remove-truffleruby-workardoundBenoit Daloze2024-03-201-8/+1
|\ \ \ \ \ | |/ / / / |/| | | | Revert openssl dir workaround on TruffleRuby
| * | | | Revert "Always respect the openssl prefix chosen by truffle/openssl-prefix ↵Benoit Daloze2023-12-011-8/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | on TruffleRuby" * This reverts commit ca738e7e13570e88eaa9892cbb3dffb330320706. * No longer needed since https://github.com/oracle/truffleruby/issues/3170 was fixed.
* | | | | Merge pull request #721 from junaruga/wip/conditional-legacy-provider-testKazuki Yamaguchi2024-03-142-9/+11
|\ \ \ \ \ | | | | | | | | | | | | test_provider.rb: Make a legacy provider test optional.
| * | | | | test_provider.rb: Make a legacy provider test optional.Jun Aruga2024-02-211-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In some cases such as OpenSSL package in FreeBSD[1], the legacy provider is not installed intentionally. So, we omit a test depending the legacy provider if the legacy provider is not loadable. For the test_openssl_provider_names test, we use base provider[2] instead of legacy provider, because we would expect the base provider is always loadable in OpenSSL 3 for now. * [1] https://www.freshports.org/security/openssl/ * [2] https://wiki.openssl.org/index.php/OpenSSL_3.0#Providers
| * | | | | CI: Add OpenSSL no-legacy case.Jun Aruga2024-02-211-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Add the case of the OpenSSL that doesn't install the legacy provider.
| * | | | | Revert "omit tests related legacy provider"Jun Aruga2024-02-211-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 9b7543d58869ae359eb745d7feafbb522ad1fd1e. The case not providing the legacy provider can happen not only in FreeBSD but also in other platforms. The fix is addressed in the next commit.
* | | | | | Merge pull request #728 from junaruga/wip/test-asn1-remove-no-seconds-assertionsKazuki Yamaguchi2024-03-141-8/+0
|\ \ \ \ \ \ | |/ / / / / |/| | | | | test_asn1.rb: Remove the assertions of the time string format without second.
| * | | | | test_asn1.rb: Remove the assertions of the time string format without second.Jun Aruga2024-03-121-8/+0
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit fixes the following errors in the tests. Because the OpenSSL project changed the code to make the time string format without second invalid. So, we drop the assertions. ``` 1) Error: test_generalizedtime(OpenSSL::TestASN1): OpenSSL::ASN1::ASN1Error: generalizedtime is too short /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:698:in `decode' /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:698:in `decode_test' /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:433:in `test_generalizedtime' 430: OpenSSL::ASN1::GeneralizedTime.new(Time.utc(9999, 9, 8, 23, 43, 39)) 431: # LibreSSL 3.6.0 requires the seconds element 432: return if libressl? => 433: decode_test B(%w{ 18 0D }) + "201612081934Z".b, 434: OpenSSL::ASN1::GeneralizedTime.new(Time.utc(2016, 12, 8, 19, 34, 0)) 435: # not implemented 436: # decode_test B(%w{ 18 13 }) + "20161208193439+0930".b, 2) Error: test_utctime(OpenSSL::TestASN1): OpenSSL::ASN1::ASN1Error: utctime is too short /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:698:in `decode' /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:698:in `decode_test' /home/runner/work/ruby-openssl/ruby-openssl/test/openssl/test_asn1.rb:411:in `test_utctime' 408: end 409: # Seconds is omitted. LibreSSL 3.6.0 requires it 410: return if libressl? => 411: decode_test B(%w{ 17 0B }) + "1609082343Z".b, 412: OpenSSL::ASN1::UTCTime.new(Time.utc(2016, 9, 8, 23, 43, 0)) 413: # not implemented 414: # decode_test B(%w{ 17 11 }) + "500908234339+0930".b, ```
* | | | | Merge pull request #718 from ruby/omit-legacy-providerHiroshi SHIBATA2024-02-211-0/+4
|\ \ \ \ \ | | | | | | | | | | | | omit tests related legacy provider
| * | | | | Fix accidentally changed to rename test method at ↵Hiroshi SHIBATA2024-02-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | d95d3484a90a985b971ef4c55762847d92b6c81a
| * | | | | omit tests related legacy providerHiroshi SHIBATA2024-02-071-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It failed with recent update of FreeBSD https://rubyci.s3.amazonaws.com/freebsd13/ruby-master/log/20240207T023002Z.fail.html.gz
* | | | | | Merge pull request #720 from junaruga/wip/ci-upgrade-versionsJun Aruga2024-02-081-7/+7
|\ \ \ \ \ \ | |/ / / / / |/| | | | | CI: Upgrade OpenSSL and LibreSSL versions.
| * | | | | CI: Upgrade OpenSSL and LibreSSL versions.Jun Aruga2024-02-081-7/+7
|/ / / / /
* | | | | Merge pull request #702 from rhenium/ky/ocsp-test-fix-random-failuresKazuki Yamaguchi2024-01-181-1/+1
|\ \ \ \ \ | | | | | | | | | | | | test/openssl/test_ocsp.rb: fix flaky test
| * | | | | test/openssl/test_ocsp.rb: fix flaky testky/ocsp-test-fix-random-failuresKazuki Yamaguchi2023-11-251-1/+1
| |/ / / / | | | | | | | | | | | | | | | Fixes: https://github.com/ruby/openssl/issues/695
* | | | | Add support for IO#timeout. (#714)Samuel Williams2024-01-184-2/+42
| | | | | | | | | | | | | | | | | | | | * Add support for IO#timeout.
* | | | | Merge pull request #710 from ekohl/dont-set-min_version-by-defaultKazuki Yamaguchi2024-01-181-1/+1
|\ \ \ \ \ | | | | | | | | | | | | Only set min_version on OpenSSL < 1.1.0
| * | | | | Only set min_version on OpenSSL < 1.1.0Ewoud Kohl van Wijngaarden2024-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both Red Hat and Debian-like systems configure the minimum TLS version to be 1.2 by default, but allow users to change this via configs. On Red Hat and derivatives this happens via crypto-policies[1], which in writes settings in /etc/crypto-policies/back-ends/opensslcnf.config. Most notably, it sets TLS.MinProtocol there. For Debian there's MinProtocol in /etc/ssl/openssl.cnf. Both default to TLSv1.2, which is considered a secure default. In constrast, the SSLContext has a hard coded OpenSSL::SSL::TLS1_VERSION for min_version. TLS 1.0 and 1.1 are considered insecure. By always setting this in the default parameters, the system wide default can't be respected, even if a developer wants to. This takes the approach that's also done for ciphers: it's only set for OpenSSL < 1.1.0. [1]: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening
* | | | | | Add support for `gets(chomp: true)`.Samuel Williams2024-01-132-2/+17
| | | | | |
* | | | | | Add more methods to `SocketForwarder`.Samuel Williams2024-01-131-0/+28
|/ / / / /
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-14 05:18:53 +0000