aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* test/openssl/test_pkey_ec.rb: embed invalid key exampleky/pkey-fixtures-cleanupKazuki Yamaguchi10 days3-15/+8
| | | | | | | | | | test/openssl/fixtures/pkey/p256_too_large.pem and p384_invalid.pem are invalid PEM encoding whether the encoded public key doesn't match the private key. They are only useful for testing OpenSSL::PKey::EC#check_key. To improve clarity, let's directly include the PEM encoding as a heredoc. p384_invalid.pem is simply dropped because it was redundant.
* test/openssl/test_x509cert.rb: simplify test cases for .load_fileKazuki Yamaguchi10 days6-73/+36
| | | | | | | Remove files from test/openssl/fixtures/pkey that are not pkeys. The test cases for Certificate.load_file don't require a static fixtures. Use tempfile to make them self-contained.
* Merge pull request #771 from lwoggardner/readbyteKazuki Yamaguchi11 days4-0/+44
|\ | | | | Add SSLSocket#readbyte
| * Add SSLSocket#readbyteGrant Gardner14 days4-0/+44
|/ | | | | Companion to getbyte but raise EOFError Similar to https://github.com/ruby/openssl/pull/438
* Merge pull request #740 from HoneyryderChuck/asn1-in-rubyKazuki Yamaguchi2024-06-284-216/+213
|\ | | | | rewriting most of the asn1 init code in ruby
| * rewriting most of the asn1 init code in rubyHoneyryderChuck2024-06-174-216/+213
|/ | | | to have as much of the lib in ruby as possible
* Merge branch 'maint-3.2'HEADmasterKazuki Yamaguchi2024-06-131-2/+0
|\ | | | | | | | | * maint-3.2: Remove "gemspec" from Gemfile
| * Merge branch 'maint-3.1' into maint-3.2maint-3.2Kazuki Yamaguchi2024-06-131-2/+0
| |\ | | | | | | | | | | | | * maint-3.1: Remove "gemspec" from Gemfile
| | * Merge branch 'maint-3.0' into maint-3.1maint-3.1Kazuki Yamaguchi2024-06-131-2/+0
| | |\ | | | | | | | | | | | | | | | | * maint-3.0: Remove "gemspec" from Gemfile
| | | * Merge pull request #768 from rhenium/ky/gemfile-skip-gemspecmaint-3.0Kazuki Yamaguchi2024-06-131-2/+0
| | | |\ | | | | | | | | | | Remove "gemspec" from Gemfile
| | | | * Remove "gemspec" from Gemfileky/gemfile-skip-gemspecKazuki Yamaguchi2024-06-131-2/+0
| | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | The local lib directory may contain an incomplete openssl library. The "gemspec" line in Gemfile causes "bundle exec" to put the lib directory in the load path. Although our Rakefile does not use openssl itself, it still indirectly tries to load it as a RubyGems dependency.
* | | | Pass through nil as digest when signing certificates (#761)gartens2024-06-122-1/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to sign certificates with Ed25519 keys, NULL must be passed as md to X509_sign. This NULL is then passed (via ASN1_item_sign_ex) as type to EVP_DigestSignInit. The documentation[1] of EVP_DigestSignInit states that type must be NULL for various key types, including Ed25519. [1]: https://www.openssl.org/docs/manmaster/man3/EVP_DigestSignInit.html
* | | | Merge pull request #766 from olleolleolle/ci-avoid-double-installKazuki Yamaguchi2024-06-101-2/+1
|\ \ \ \ | | | | | | | | | | CI: Rely on setup-ruby to install Bundler gems
| * | | | CI: Rely on setup-ruby to install Bundler gemsOlle Jonsson2024-06-091-2/+1
|/ / / /
* | | | Merge branch 'maint-3.2'Kazuki Yamaguchi2024-06-080-0/+0
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint-3.2: Don't download OpenSSL from ftp.openssl.org anyomre Fix test_pkey_dh.rb in FIPS. History.md: Escape Markdown syntax Italic "*". [ci skip] CI: Change the openssl_fips.cnf.tmpl and openssl_fips.cnf directories. Exact checks with `assert_include` Exact checks with `assert_include`
| * | | Merge branch 'maint-3.1' into maint-3.2Kazuki Yamaguchi2024-06-081-3/+3
| |\| | | | | | | | | | | | | | | | | | * maint-3.1: Don't download OpenSSL from ftp.openssl.org anyomre
| | * | Merge branch 'maint-3.0' into maint-3.1Kazuki Yamaguchi2024-06-081-1/+1
| | |\| | | | | | | | | | | | | | | | | * maint-3.0: Don't download OpenSSL from ftp.openssl.org anyomre
| | | * Don't download OpenSSL from ftp.openssl.org anyomreKJ Tsanaktsidis2024-06-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 3.0 branch. ] OpenSSL announced that they're changing how they handle releases in this blog post: https://openssl.org/blog/blog/2024/04/30/releases-distribution-changes/ The tl;dr is that: * ftp.openssl.org is being shut down (even for HTTP access) * The releases at openssl.org/source will redirect to github * git.openssl.org is also shut down (the git repo is on github) This commit just changes over to using openss.org/source instead of ftp.openssl.org. We might also need to switch to downloading directly from Github... let's see. It also changes to cloning the head of openssl from github too. (cherry picked from commit 64c50112b60e2cdcc447620a1bd73380f7186600)
| * | | Fix test_pkey_dh.rb in FIPS.Jun Aruga2024-05-065-26/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 3.2 branch. ] We use dh2048_ffdhe2048.pem file (DH 2048 bits) instead of dh1024.pem file in both non-FIPS and FIPS cases. Because the following command fails to generate the pem file with 1024 bits. And the OpenSSL FIPS 140-2 security policy document explains the DH public keys are allowed from 2048 bits.[1] ``` $ OPENSSL_CONF=/home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/ssl/openssl_fips.cnf \ /home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/bin/openssl \ dhparam -out dh1024.pem 1024 Generating DH parameters, 1024 bit long safe prime dhparam: Generating DH key parameters failed ``` The dh2048_ffdhe2048.pem file was created by the following command with the OpenSSL FIPS configuration file. The logic to generate the DH pem file is different between non-FIPS and FIPS cases. In FIPS, it seems that the command always returns the text defined as ffdhe2048 in the FFDHE groups in RFC 7919 unlike non-FIPS.[2] As the generated pem file is a normal and valid PKCS#3-style group parameter, we use the file for the non-FIPS case too. ``` $ OPENSSL_CONF=/home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/ssl/openssl_fips.cnf \ /home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/bin/openssl \ dhparam -out dh2048_ffdhe2048.pem 2048 ``` Note that the hard-coded PEM-encoded string in the `test_DHparams` is intentional to avoid modifying the content unintentionally. * [1] https://www.openssl.org/source/ - OpenSSL 3.0.8 FIPS 140-2 security policy document page 25, Table 10 – Public Keys - DH Public - DH (2048/3072/4096/6144/8192) public key agreement key * [2] RFC7919 - Appendix A.1: ffdhe2048 https://www.rfc-editor.org/rfc/rfc7919#appendix-A.1 (cherry picked from commit 6a4ff26475adbbd70a1df430f314f03544172b15)
| * | | History.md: Escape Markdown syntax Italic "*". [ci skip]Jun Aruga2024-05-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 3.2 branch. ] (cherry picked from commit dc26433ae5705a0e040b2b79e09675308d53ab9f)
| * | | CI: Change the openssl_fips.cnf.tmpl and openssl_fips.cnf directories.Jun Aruga2024-05-062-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 3.2 branch. ] (cherry picked from commit fafe1af4a96e498ec49d3b0ad1998950f953d802)
| * | | Exact checks with `assert_include`Nobuyoshi Nakada2024-05-061-8/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 3.2 branch. ] Where `assert_match` converts string matcher argument to regexp first with escaping, `assert_include` does the same thing simpler. (cherry picked from commit 81007e0a49990afb752f0eac6badb3a6e84a432d)
| * | | Exact checks with `assert_include`Nobuyoshi Nakada2024-05-061-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 3.2 branch. ] (cherry picked from commit 9a6e24daafd09c34a6aaef2626438c800d1fc86a)
* | | | Merge pull request #764 from rhenium/ky/actions-github-pagesKazuki Yamaguchi2024-06-082-22/+37
|\ \ \ \ | | | | | | | | | | Automatically update GitHub Pages from master branch
| * | | | Automatically update GitHub Pages from master branchky/actions-github-pagesKazuki Yamaguchi2024-06-082-22/+37
|/ / / / | | | | | | | | | | | | Remove tool/update-gh-pages as it is no longer necessary.
* | | | Merge pull request #754 from rhenium/ky/clarify-licenseKazuki Yamaguchi2024-06-0861-61/+61
|\ \ \ \ | | | | | | | | | | Clarify license
| * | | | Fix references to the license textky/clarify-licenseKazuki Yamaguchi2024-05-0159-59/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update the references to the file "LICENCE" with "COPYING". The file LICENCE doesn't exist in ruby/ruby nor ruby/openssl. This has been always the case since OpenSSL for Ruby 2 was merged to the ruby tree as a standard library in 2003. In OpenSSL for Ruby 2's CVS repository[1], the LICENCE file contained an old version of the Ruby License, identical to the COPYING file that was in Ruby's tree at that time (r4128[2]). [1] http://cvs.savannah.gnu.org/viewvc/rubypki/ossl2/LICENCE?revision=1.1.1.1&view=markup [2] https://github.com/ruby/ruby/blob/231247c010acba191b78ed2d1310c935e63ad919/COPYING
| * | | | Rename LICENSE.txt to COPYINGKazuki Yamaguchi2024-05-012-1/+1
| | | | | | | | | | | | | | | | | | | | This is for consistency with ruby/ruby.
| * | | | openssl.gemspec: add BSD-2-Clause to the list of licensesKazuki Yamaguchi2024-05-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ruby/openssl is licensed under the terms of either the Ruby License or the 2-Clause BSD License. The git repository and built .gem files always contained the license text for both license, but the metadata in the gemspec only specified the Ruby License. Let's include both.
* | | | | Merge pull request #753 from segiddins/segiddins/add-x509-certificate-tbs_bytesKazuki Yamaguchi2024-06-083-0/+47
|\ \ \ \ \ | | | | | | | | | | | | Add X509::Certificate#tbs_bytes
| * | | | | Add X509::Certificate#tbs_bytesSamuel Giddins2024-06-083-0/+47
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ref https://github.com/ruby/openssl/issues/519 This makes verifying embedded certificate transparency signatures significantly easier, as otherwise the alternative was manipulating the ASN1 sequence, as in https://github.com/segiddins/sigstore-cosign-verify/pull/2/commits/656d992fa816613fd9936f53ce30972c2f2f4957
* | | | | Merge pull request #762 from KJTsanaktsidis/ktsanaktsidis/fix_asan_errorKJ Tsanaktsidis2024-06-052-1/+38
|\ \ \ \ \ | | | | | | | | | | | | Fix test_create_with_mac_iter accidently setting keytype not maciter
| * | | | | Fix test_create_with_mac_iter accidently setting keytype not maciterKJ Tsanaktsidis2024-06-052-1/+38
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This test was accidentally passing the value 2048 into the keytype parameter of PKCS12_create, not the mac_iter parameter (because it had one too many `nil`s in the call). This value is invalid, and will make OpenSSL perform an out-of-bounds read which is caught when compiling with ASAN. This commit fixes the tests, and also adds some validation to PKCS12.create to make sure any keytype passed is actually valid. Since there only two valid keytype constants, and the whole feature is an export-grade crypto era thing only ever supported by old MSIE, it seems far more likely that code in the whild is using keytype similarly by mistake rather than as intended. So this validation might catch that.
* | | | | Merge pull request #763 from KJTsanaktsidis/ktsanaktsidis/fix_openssl_downloadsHiroshi SHIBATA2024-06-051-4/+4
|\ \ \ \ \ | | | | | | | | | | | | Don't download OpenSSL from ftp.openssl.org anyomre
| * | | | | Don't download OpenSSL from ftp.openssl.org anyomreKJ Tsanaktsidis2024-06-041-4/+4
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL announced that they're changing how they handle releases in this blog post: https://openssl.org/blog/blog/2024/04/30/releases-distribution-changes/ The tl;dr is that: * ftp.openssl.org is being shut down (even for HTTP access) * The releases at openssl.org/source will redirect to github * git.openssl.org is also shut down (the git repo is on github) This commit just changes over to using openss.org/source instead of ftp.openssl.org. We might also need to switch to downloading directly from Github... let's see. It also changes to cloning the head of openssl from github too.
* | | | | Merge pull request #758 from MSP-Greg/00-ci-windowsKazuki Yamaguchi2024-05-101-7/+3
|\ \ \ \ \ | | | | | | | | | | | | [CI] test.yml - use `bundle exec`, use setup-ruby bundler-cache, fixes Windows issue
| * | | | | [CI] test.yml - use `bundle exec`, use setup-ruby bundler-cacheMSP-Greg2024-05-081-7/+3
|/ / / / /
* | | | | Merge pull request #756 from ↵Kazuki Yamaguchi2024-05-084-0/+88
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | segiddins/segiddins/add-to_text-for-pkcs7-and-timestamp-response Add to_text for PKCS7 and Timestamp::Response
| * | | | | Add to_text for PKCS7 and Timestamp::ResponseSamuel Giddins2024-05-064-0/+88
| | | | | |
* | | | | | Merge pull request #739 from casperisfine/read-clear-bufferKazuki Yamaguchi2024-05-052-5/+12
|\ \ \ \ \ \ | |/ / / / / |/| | | | | read: don't clear buffer when nothing can be read
| * | | | | read: don't clear buffer when nothing can be readJean Boussier2024-05-022-5/+12
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To be consistent with regular Ruby IOs: ```ruby r, _ = IO.pipe buf = "garbage".b r.read_nonblock(10, buf, exception: false) # => :wait_readable p buf # => "garbage" ``` Ref: https://github.com/redis-rb/redis-client/commit/98b8944460a11f8508217bda71cfc10cb2190d4d
* | | | | README: update support matrixKazuki Yamaguchi2024-05-021-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ruby 3.0 is EOL by 2024-04. Also, update the OpenSSL compatibility list to include OpenSSL 3.2-3.3, which are ABI-compatible with 3.1.
* | | | | Merge branch 'maint-3.2'Kazuki Yamaguchi2024-05-025-10/+64
|\ \ \ \ \ | | |/ / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint-3.2: Fix modular square root test with LibreSSL >= 3.8 pkcs7: raise PKCS7Error for PKCS7 without content in PKCS7.read_smime pkcs7: raise ArgumentError for PKCS7 with no content in PKCS7.new cipher: fix buffer overflow in Cipher#update ssl: allow failure on test_connect_certificate_verify_failed_exception_message .github/workflows/test.yml: synchronize with master Only CSR version 1 (encoded as 0) is allowed by PKIX standards test_asn1.rb: Remove the assertions of the time string format without second. test/openssl/test_asn1.rb: skip failing tests on LibreSSL 3.6.0 Use EVP_Digest{Sign,Verify} when available Fix performance regression in do_write(s)
| * | | | Merge branch 'maint-3.1' into maint-3.2Kazuki Yamaguchi2024-05-028-36/+74
| |\ \ \ \ | | | |/ / | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint-3.1: Fix modular square root test with LibreSSL >= 3.8 pkcs7: raise PKCS7Error for PKCS7 without content in PKCS7.read_smime pkcs7: raise ArgumentError for PKCS7 with no content in PKCS7.new cipher: fix buffer overflow in Cipher#update ssl: allow failure on test_connect_certificate_verify_failed_exception_message .github/workflows/test.yml: synchronize with master Only CSR version 1 (encoded as 0) is allowed by PKIX standards test_asn1.rb: Remove the assertions of the time string format without second. test/openssl/test_asn1.rb: skip failing tests on LibreSSL 3.6.0 Use EVP_Digest{Sign,Verify} when available Fix performance regression in do_write(s)
| | * | | Fix modular square root test with LibreSSL >= 3.8Theo Buehler2024-05-021-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 3.1 branch. ] If x is a modular square root of a (mod p) then so is (p - x). Both answers are valid. In particular, both 2 and 3 are valid square roots of 4 (mod 5). Do not assume that a particular square root is chosen by the algorithm. Indeed, the algorithm in OpenSSL and LibreSSL <= 3.7 returns a non-deterministic answer in many cases. LibreSSL 3.8 and later will always return the smaller of the two possible answers. This breaks the current test case. Instead of checking for a particular square root, check that the square of the claimed square root is the given value. This is always true. Add the simplest test case where the answer is indeed non-deterministic. (cherry picked from commit 93548ae9597ba40d3f8b564f6a948ce55b432e30)
| | * | | Merge branch 'maint-3.0' into maint-3.1Kazuki Yamaguchi2024-05-029-40/+127
| | |\ \ \ | | | | |/ | | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint-3.0: pkcs7: raise PKCS7Error for PKCS7 without content in PKCS7.read_smime pkcs7: raise ArgumentError for PKCS7 with no content in PKCS7.new cipher: fix buffer overflow in Cipher#update ssl: allow failure on test_connect_certificate_verify_failed_exception_message .github/workflows/test.yml: synchronize with master Only CSR version 1 (encoded as 0) is allowed by PKIX standards test_asn1.rb: Remove the assertions of the time string format without second. test/openssl/test_asn1.rb: skip failing tests on LibreSSL 3.6.0 Use EVP_Digest{Sign,Verify} when available Fix performance regression in do_write(s)
| | | * | Merge pull request #752 from rhenium/pkcs7-empty-signed-data-19974Kazuki Yamaguchi2024-05-022-1/+22
| | | |\ \ | | | | | | | | | | | | Handle missing content in PKCS7
| | | | * | pkcs7: raise PKCS7Error for PKCS7 without content in PKCS7.read_smimepkcs7-empty-signed-data-19974Jeremy Evans2024-05-012-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [pkuzco: expanded the fix for other content types] [ky: adjusted formatting and the exception type] Co-authored-by: pkuzco <b.naamneh@gmail.com> Co-authored-by: Kazuki Yamaguchi <k@rhe.jp>
| | | | * | pkcs7: raise ArgumentError for PKCS7 with no content in PKCS7.newJeremy Evans2024-05-012-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes [Bug #19974] [pkuzco: expanded the fix for other content types] [ky: adjusted formatting and the exception type] Co-authored-by: pkuzco <b.naamneh@gmail.com> Co-authored-by: Kazuki Yamaguchi <k@rhe.jp>
| | | * | | Merge pull request #717 from rhenium/ky/cipher-update-fix-buffer-sizeKazuki Yamaguchi2024-05-012-3/+31
| | | |\ \ \ | | | | |/ / | | | |/| | cipher: fix buffer overflow in Cipher#update
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-14 07:39:26 +0000