aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* pkey/ec: remove OpenSSL::PKey::EC::Group.new(ec_method) formky/pkey-remove-ec-group-from-raw-methodKazuki Yamaguchi2020-08-211-42/+2
| | | | | | | | | | | | | | | | | The form created an empty EC_GROUP object with the specified EC_METHOD. However, the feature was unfinished and not useful in any way because OpenSSL::PKey::EC::Group did not implement wrappers for necessary functions to set actual parameters for the group, namely EC_GROUP_set_curve() family. EC_GROUP object creation with EC_METHOD explicitly specified is deprecated in OpenSSL 3.0, as it was apparently not intended for use outside OpenSSL. It is still possible to create EC_GROUP, but without EC_METHOD explicitly specified - OpenSSL chooses the appropriate EC_METHOD for the curve type. The OpenSSL::PKey::EC::Group.new(<:GFp|:GF2m>, p, a, b) form will continue to work.
* Merge pull request #394 from rhenium/ky/ssl-remove-tmp-ecdh-callbackKazuki Yamaguchi2020-08-213-94/+3
|\ | | | | ssl: remove SSL::SSLContext#tmp_ecdh_callback
| * ssl: remove SSL::SSLContext#tmp_ecdh_callbackky/ssl-remove-tmp-ecdh-callbackKazuki Yamaguchi2020-08-133-94/+3
| | | | | | | | | | | | | | | | | | | | The underlying API SSL_CTX_set_tmp_ecdh_callback() was removed by LibreSSL >= 2.6.1 and OpenSSL >= 1.1.0, in other words, it is not supported by any non-EOL versions of OpenSSL. The wrapper was initially implemented in Ruby 2.3 and has been deprecated since Ruby/OpenSSL 2.0 (bundled with Ruby 2.4) with explicit warning with rb_warn().
* | Merge pull request #392 from rhenium/ky/x509store-reviewKazuki Yamaguchi2020-08-212-207/+417
|\ \ | |/ |/| Review OpenSSL::X509::Store
| * test/openssl/test_x509store: tidy up tests for X509::Store#add_certky/x509store-reviewKazuki Yamaguchi2020-08-121-17/+9
| | | | | | | | | | Rename the test case to test_add_cert_duplicate to clarify what it is actually testing.
| * test/openssl/test_x509store: break up test_verifyKazuki Yamaguchi2020-08-121-112/+227
| | | | | | | | | | The test case is huge and too complex. Break it up into separate test cases for better documentation.
| * x509store: update rdoc for X509::Store and X509::StoreContextKazuki Yamaguchi2020-08-121-13/+113
| | | | | | | | | | Add more details about each method, and add reference to OpenSSL man pages.
| * x509store: avoid ossl_raise() calls with NULL messageKazuki Yamaguchi2020-08-121-19/+14
| | | | | | | | | | Use the OpenSSL function name that caused the error to generate a better error message.
| * x509store: refactor X509::StoreContext#chainKazuki Yamaguchi2020-08-121-18/+5
| | | | | | | | | | Use ossl_x509_sk2ary() to create an array of OpenSSL::X509::Certificate from STACK_OF(X509).
| * x509store: emit warning if arguments are given to X509::Store.newKazuki Yamaguchi2020-08-122-9/+15
| | | | | | | | | | Anything passed to OpenSSL::X509::Store.new was always ignored. Let's emit an explicit warning to not confuse users.
| * x509store: let X509::Store#add_file raise TypeError if nil is givenKazuki Yamaguchi2020-08-122-20/+35
| | | | | | | | | | | | | | | | Undo special treatment of nil and simply pass the value to StringValueCStr(). nil was never a valid argument for the method; OpenSSL::X509::StoreError with an unhelpful error message "system lib" was raised in that case.
* | Merge pull request #386 from rhenium/ky/ssl-attr-default-valuesKazuki Yamaguchi2020-08-122-11/+59
|\ \ | | | | | | ssl: initialize verify_mode and verify_hostname with default values
| * | ssl: initialize verify_mode and verify_hostname with default valuesky/ssl-attr-default-valuesKazuki Yamaguchi2020-07-182-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SSLContext's verify_mode expects an SSL_VERIFY_* constant (an integer) and verify_hostname expects either true or false. However, they are set to nil after calling OpenSSL::SSL::SSLContext.new, which is surprising. Set a proper value to them by default: verify_mode is set to OpenSSL::SSL::VERIFY_NONE and verify_hostname is set to false by default. Note that this does not change the default behavior. The certificate verification was never performed unless verify_mode is set to OpenSSL::SSL::VERIFY_PEER by a user. The same applies to verify_hostname.
| * | test/openssl/test_ssl: revise verify_mode test casesKazuki Yamaguchi2020-07-181-1/+45
| | | | | | | | | | | | | | | | | | Add explicit test cases for the behaviors with different verify_mode. If we made a bug in verify_mode, we would notice it by failures of other test cases, but there were no dedicated test cases for verify_mode.
| * | test/openssl/test_ssl: revise a test case for client_cert_cbKazuki Yamaguchi2020-07-181-10/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current test_client_auth_public_key test case checks that supplying a PKey containing only public components through client_cert_cb will cause handshake to fail. While this is a correct behavior as a whole, the assertions are misleading in the sense that giving a public key is causing the failure. Actually, the handshake fails because a client certificate is not supplied at all, as a result of ArgumentError that is silently ignored. Rename the test case to test_client_cert_cb_ignore_error and simplify it to clarify what it is testing.
* | | Merge pull request #388 from no6v/patch-1Kazuki Yamaguchi2020-07-291-1/+1
|\ \ \ | | |/ | |/| [DOC] Fix RDoc markup
| * | [DOC] Fix RDoc markupNobuhiro IMAI2020-07-291-1/+1
|/ /
* / Fix typo in documentationClaus Lensbøl2020-07-241-3/+3
|/ | | | The socket is called ssl_connection, not connection
* Merge pull request #383 from cwjenkins/add_rsa_keys_eqlKazuki Yamaguchi2020-07-162-0/+57
|\ | | | | Add wrapper method for EVP_PKEY_cmp to compare same type keys
| * Add compare? method to OpenSSL::PKey that wraps EVP_PKEY_cmp.Colton Jenkins2020-07-142-0/+57
| | | | | | | | | | | | Explicitly check for type given some conflicting statements within openssl's documentation around EVP_PKEY_cmp and EVP_PKEY_ASN1_METHOD(3). Add documentation with an example for compare?
* | Merge pull request #381 from rhenium/ky/hmac-base64Kazuki Yamaguchi2020-07-102-0/+29
|\ \ | | | | | | hmac: implement base64digest methods
| * | hmac: implement base64digest methodsky/hmac-base64Kazuki Yamaguchi2020-06-302-0/+29
| | | | | | | | | | | | | | | OpenSSL::HMAC implements the similar interface as ::Digest. Let's add base64digest methods to OpenSSL::HMAC, too, for feature parity.
* | | Merge pull request #384 from bdewater/lower-case-cipherKazuki Yamaguchi2020-07-083-17/+17
|\ \ \ | |_|/ |/| | User lower case cipher names for maximum compatibility
| * | User lower case cipher names for maximum compatibilityBart de Water2020-07-073-17/+17
|/ / | | | | | | We ran into some Linux-based systems not accepting the upper case variant
* | Merge pull request #371 from rhenium/ky/hmac-evpKazuki Yamaguchi2020-06-307-170/+98
|\| | | | | hmac: migrate from the low-level HMAC API to the EVP API
| * hmac: migrate from the low-level HMAC API to the EVP APIky/hmac-evpKazuki Yamaguchi2020-06-306-170/+89
| | | | | | | | | | | | | | | | | | Use the EVP API instead of the low-level HMAC API. Use of the HMAC API has been discouraged and is being marked as deprecated starting from OpenSSL 3.0.0. The two singleton methods OpenSSL::HMAC, HMAC.digest and HMAC.hexdigest are now in lib/openssl/hmac.rb.
| * hmac: add a test case for OpenSSL::HMAC singleton methodsKazuki Yamaguchi2020-06-301-0/+9
| |
* | Merge pull request #372 from rhenium/ky/pkey-ec-point-deprecate-mul-aryKazuki Yamaguchi2020-06-302-15/+27
|\ \ | |/ |/| pkey/ec: deprecate OpenSSL::PKey::EC::Point#mul(ary, ary [, bn])
| * pkey/ec: deprecate OpenSSL::PKey::EC::Point#mul(ary, ary [, bn])ky/pkey-ec-point-deprecate-mul-aryKazuki Yamaguchi2020-06-292-15/+27
|/ | | | | | | | | | | | | Deprecate it for future removal. However, I do not expect any application is affected by this. The other form of calling it, PKey::EC::Point#mul(bn [, bn]) remains untouched. PKey::EC::Point#mul calls EC_POINTs_mul(3) when multiple BNs are given as an array. LibreSSL 2.8.0 released on 2018-08 removed the feature and OpenSSL 3.0 which is planned to be released in 2020 will also deprecate the function as there is no real use-case.
* digest, hmac, ts, x509: use IO.binread in examples where appropriateKazuki Yamaguchi2020-05-134-18/+18
| | | | | | | IO.read may mangle line separator, which will corrupt binary data including DER-encoded X.509 certificates and such. Fixes: https://github.com/ruby/openssl/issues/243
* Merge pull request #329 from rhenium/ky/pkey-generic-operationsKazuki Yamaguchi2020-05-137-110/+554
|\ | | | | pkey: add more support for 'generic' pkey types
| * pkey: reimplement PKey::DH#compute_key and PKey::EC#dh_compute_keyky/pkey-generic-operationsKazuki Yamaguchi2020-05-133-67/+33
| | | | | | | | | | Use the new OpenSSL::PKey::PKey#derive instead of the raw {EC,}DH_compute_key(), mainly to reduce amount of the C code.
| * pkey: add PKey::PKey#deriveKazuki Yamaguchi2020-05-134-0/+107
| | | | | | | | | | | | Add OpenSSL::PKey::PKey#derive as the wrapper for EVP_PKEY_CTX_derive(). This is useful for pkey types that we don't have dedicated classes, such as X25519.
| * pkey: support 'one-shot' signing and verificationKazuki Yamaguchi2020-05-132-0/+75
| | | | | | | | | | | | OpenSSL 1.1.1 added EVP_DigestSign() and EVP_DigestVerify() functions to the interface. Some EVP_PKEY methods such as PureEdDSA algorithms do not support the streaming mechanism and require us to use them.
| * pkey: port PKey::PKey#sign and #verify to the EVP_Digest* interfaceKazuki Yamaguchi2020-05-132-39/+63
| | | | | | | | | | | | | | | | | | Use EVP_DigestSign*() and EVP_DigestVerify*() interface instead of the old EVP_Sign*() and EVP_Verify*() functions. They were added in OpenSSL 1.0.0. Also, allow the digest to be specified as nil, as certain EVP_PKEY types don't expect a digest algorithm.
| * pkey: add PKey.generate_parameters and .generate_keyKazuki Yamaguchi2020-05-132-0/+265
| | | | | | | | | | Add two methods to create a PKey using the generic EVP interface. This is useful for the PKey types we don't have a dedicated class.
| * pkey: assume generic PKeys contain private componentsKazuki Yamaguchi2020-05-131-4/+11
| | | | | | | | | | | | The EVP interface cannot tell whether if a pkey contains the private components or not. Assume it does if it does not respond to #private?. This fixes the NoMethodError on calling #sign on a generic PKey.
* | Merge pull request #328 from rhenium/ky/pkey-refactor-serializationKazuki Yamaguchi2020-05-1314-514/+282
|\ \ | | | | | | pkey: refactor PEM/DER serialization code
| * | pkey: refactor #export/#to_pem and #to_derky/pkey-refactor-serializationKazuki Yamaguchi2020-05-135-173/+114
| | | | | | | | | | | | | | | Add ossl_pkey_export_traditional() and ossl_pkey_export_spki() helper functions, and use them. This reduces code duplication.
| * | pkey: refactor DER/PEM-encoded string parsing codeKazuki Yamaguchi2020-05-135-77/+73
| | | | | | | | | | | | | | | Export the flow used by OpenSSL::PKey.read and let the subclasses call it before attempting other formats.
| * | pkey: prefer PKey.read over PKey::RSA.new in docsKazuki Yamaguchi2020-05-136-8/+8
| | |
| * | pkey: have PKey.read parse PEM-encoded DHParameterKazuki Yamaguchi2020-05-133-3/+5
| | | | | | | | | | | | | | | Try PEM_read_bio_Parameters(). Only PEM format is supported at the moment since corresponding d2i_* functions are not provided by OpenSSL.
| * | pkey: inline {rsa,dsa,dh,ec}_instance()Kazuki Yamaguchi2020-05-134-156/+76
| | | | | | | | | | | | | | | | | | | | | Merge the code into the callers so that the wrapping Ruby object is allocated before the raw key object is allocated. This prevents possible memory leak on Ruby object allocation failure, and also reduces the lines of code.
| * | pkey: simplify ossl_pkey_new()Kazuki Yamaguchi2020-05-136-100/+9
| |/ | | | | | | | | | | ossl_{rsa,dsa,dh,ec}_new() called from this function are not used anywhere else. Inline them into pkey_new0() and reduce code duplication.
* | test/openssl/test_ssl: fix flaky test caseKazuki Yamaguchi2020-05-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | Fix test_socket_open_with_local_address_port_context. Often with MinGW, it seems EACCES is returned on bind when the port number is unavailable. Ignore it just as we do for EADDRINUSE and continue searching free port number. Fixes: 98f8787b4687 ("test/openssl/test_ssl: fix random failure in SSLSocket.open test", 2020-02-17)
* | Merge pull request #342 from rhenium/ky/config-use-openssl-apiKazuki Yamaguchi2020-05-136-668/+450
|\ \ | |/ |/| config: revert to C implementation of OpenSSL::Config
| * config: replace DupConfigPtr() with GetConfig()ky/config-use-openssl-apiKazuki Yamaguchi2020-05-133-40/+3
| | | | | | | | | | | | | | | | Now that OpenSSL::Config wraps a real CONF object, the caller can just borrow it rather than creating a new temporary CONF object. CONF object is usually treated as immutable. DupConfigPtr() is now removed, and GetConfig() is exported instead.
| * config: revert to C implementation of OpenSSL::ConfigKazuki Yamaguchi2020-05-135-445/+441
| | | | | | | | | | | | | | | | | | | | Revert OpenSSL::Config to using the OpenSSL API and remove our own parser implementation for the config file syntax. OpenSSL::Config now wraps a CONF object. Accessor methods deal with the object directly rather than Ruby-level internal state. This work is based on the old C code we used before 2010.
| * test/openssl/test_config: skip test_get_value_ENV on LibreSSLKazuki Yamaguchi2020-05-131-0/+3
| | | | | | | | | | LibreSSL has removed the feature to map environment variables onto the "ENV" section.
| * test/openssl/test_config: fix non-deterministic test caseKazuki Yamaguchi2020-05-131-1/+1
| | | | | | | | | | | | | | Sort keys of a section before comparing. The ordering is not part of the API. This can cause a test failure if we use OpenSSL's C implementation. Fixes: 2ad65b5f673f ("config: support .include directive", 2018-08-16)
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-10 02:26:31 +0000