| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
| | |
| | |
| | |
| | |
| | |
| | | |
LibreSSL 2.6.1 removed DSA support from its SSL code. Also, TLS 1.3 will
not support DSA certificates. Use an RSA certificate as the client
certificate in the tests, too.
|
| | |
| | |
| | |
| | |
| | |
| | | |
Add methods that check whether the running OpenSSL is an OpenSSL or a
LibreSSL, and optionally check whether the version is newer or equal to
the given version number.
|
| | |
| | |
| | |
| | |
| | |
| | | |
start_server can hang if the given block exits before closing sockets
that the block opens. While this is a carelessness of the caller, we
can do a better job.
|
| | |
| | |
| | |
| | |
| | | |
Close the socket by server_loop rather than by server_proc. This reduces
code duplication.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
An assumption in OpenSSL::TestSSL#test_get_ephemeral_key is that the
ephemeral key type is always EVP_PKEY_EC when negotiated with an ECDHE
cipher suite. This is not true if X25519 is chosen.
The test is passing because we happen to fix the group to P-256 in
start_server, but let's make it explicit.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
The block passed to start_server is invoked with two arguments, the
running thread object for the server and the automatically-selected port
number. The first argument is completely useless and actually is not
used anywhere.
|
| | |
| | |
| | |
| | |
| | | |
Add a method that returns whether the OpenSSL supports TLS 1.2 or not.
This will be useful for test cases that are specific to TLS ~1.2.
|
| | |
| | |
| | |
| | |
| | | |
Use EnvUtil.suppress_warning instead. We have started to use it already,
and the name 'suppress_warning' expresses what it does more clearly.
|
| | |
| | |
| | |
| | |
| | |
| | | |
Fix wrong nesting in test/utils.rb. Remove unnecessary requires. Wrap
the code with 'if defined?(OpenSSL::TestUtils) ~ end' and avoid class
definition with modifier if.
|
| | | |
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
* topic/test-memory-leak:
Enable OSSL_MDEBUG on CI builds
Add OpenSSL.print_mem_leaks
test: prepare test PKey instances on demand
test: let OpenSSL::TestCase include OpenSSL::TestUtils
Don't define main() when built with --enable-debug
(cherry picked from commit 5c586acc387834ab4e09260937dc21064fc59de4)
Note that fix for new test cases that use the old constants removed by
this is squashed in.
|
| |/
| |
| |
| |
| |
| |
| | |
The authentication tag can be set after starting the decryption, if
only it is before Cipher#final is called.
Fixes: https://github.com/ruby/openssl/issues/74
|
| |
| |
| |
| |
| |
| |
| | |
As noted in the SSL_CTX_sess_set_remove_cb(3) manpage, SSL_CTX_free()
will call the callback function for each session in the internal session
store. We can't call the callback Proc since it may do a new object
allocation which is prohibited during GC.
|
|\|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* maint:
Ruby/OpenSSL 2.0.5
ssl: fix compile error with OpenSSL 1.0.0
ssl: remove unsupported TLS versions from SSLContext::METHODS
Add msys2 library dependency tag in gem metadata
ossl_pem_passwd_cb: handle nil from the block explicitly
ossl_pem_passwd_cb: do not check for taintedness
ossl_pem_passwd_cb: relax passphrase length constraint
appveyor.yml: test against Ruby 2.4
Rakefile: install_dependencies: install only when needed
bio: do not use the FILE BIO method in ossl_obj2bio()
bio: prevent possible GC issue in ossl_obj2bio()
test/test_ssl: allow 3DES cipher suites in test_sslctx_set_params
|
| | |
|
| |
| |
| |
| |
| |
| |
| | |
OpenSSL <= 1.0.0 did not support TLS 1.1/1.2, and thus we must still
check the existence of the symbols. This fixes the previous commit,
3e5a009966bd ("ssl: remove unsupported TLS versions from
SSLContext::METHODS", 2017-08-08).
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Check for all version-specific SSL methods. We do check for existence of
TLSv1_1_method() and TLSv1_2_method(), but not for TLSv1_method(). This
fixes compile error when OpenSSL is configured with no-tls1-method.
Also check the OPENSSL_NO_TLS{1,1_1,1_2} macros for whether OpenSSL
supports the corresponding versions or not. This prevents :TLSv1 from
being in SSLContext::METHODS when OpenSSL is compiled with no-tls1.
In particular, Debian sid has disabled TLS 1.0/1.1 support recently.
The changes in ext/openssl are partial backport of 4eb4b3297a92 ("Remove
support for OpenSSL 0.9.8 and 1.0.0", 2016-11-30).
|
| |\
| | |
| | | |
Add msys2 library dependency tag in gem metadata
|
| |/
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
RubyInstaller2 supports metadata tags for installation of dependent
MSYS2/MINGW libraries. The openssl gem requires the mingw-openssl
package to be installed on the system, which the gem installer takes
care about, when this tag is set.
The feature is documented here:
https://github.com/oneclick/rubyinstaller2/wiki/For-gem-developers#msys2-library-dependency
This fixes issues like
https://github.com/oneclick/rubyinstaller2/issues/54 and
https://github.com/oneclick/rubyinstaller2/issues/53 .
|
| |\
| | |
| | |
| | |
| | |
| | |
| | | |
* ky/pem-passwd-cb-get-rid-of-minlen:
ossl_pem_passwd_cb: handle nil from the block explicitly
ossl_pem_passwd_cb: do not check for taintedness
ossl_pem_passwd_cb: relax passphrase length constraint
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
There is code that returns nil in the passphrase block on purpose (to
prevent OpenSSL from prompting on stdin):
OpenSSL::PKey.read(File.read("file.pem")) { nil }
This is working just by chance because the TypeError from StringValue()
is silently ignored. Let's short circuit in that case and save raising
a needless exception, as this pattern has become too common.
|
| | |
| | |
| | |
| | | |
It is perfectly permissible to take passwords from an untrusted source.
|
| |/
| |
| |
| |
| |
| | |
The minimum passphrase length of 4 bytes is only a limitation of
PEM_def_callback() which isn't relevant here. Commit f38501249f33
introduced this bug.
|
| | |
|
| |
| |
| |
| |
| | |
Emulate the behavior of 'gem install --conservative'. This would prevent
overwriting the existing Rake installation.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Read everything from an IO object into a String first and use the
memory buffer BIO method just as we do for String inputs.
For MSVC builds, the FILE BIO method uses the "UPLINK" interface that
requires the application to provide OPENSSL_Applink() function. For us,
the "application" means ruby.exe, in which we can't do anything. As a
workaround, avoid using the FILE BIO method at all.
Usually private keys or X.509 certificates aren't that large and the
temporarily increased memory usage hopefully won't be an issue.
Fixes: https://github.com/ruby/openssl/issues/128
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Prevent the new object created by StringValue() from being GCed.
Luckily, as none of the callers of ossl_obj2bio() reads from the
returned BIO after possible triggering GC, this has not been a real
problem.
As a bonus, ossl_protect_obj2bio() function which is no longer used
anywhere is removed.
|
| |
| |
| |
| |
| |
| | |
Fedora's OpenSSL seems to enable 3DES cipher suites by DEFAULT.
Fixes: https://github.com/ruby/openssl/issues/127
|
|\ \
| | |
| | |
| | |
| | | |
* ky/x509name-add-entry-options:
x509name: add 'loc' and 'set' kwargs to OpenSSL::X509::Name#add_entry
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Add a way to specify these arguments for X509_NAME_add_entry_by_txt().
We currently always use -1 and 0 respectively, which will result in
appending a new single-valued RDN to the end.
Fixes: https://github.com/ruby/openssl/issues/94
|
|\ \ \
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
* topic/asn1-overhaul:
asn1: do not treat EOC octets as part of content octets
asn1: prevent EOC octets from being in the middle of the content
asn1: harmonize OpenSSL::ASN1::*#to_der
asn1: clean up OpenSSL::ASN1::Constructive#to_der
asn1: use ossl_asn1_tag()
asn1: allow tag number to be >= 32 for universal tag class
asn1: prohibit indefinite length form for primitive encoding
asn1: allow constructed encoding with definite length form
asn1: avoid truncating OID in OpenSSL::ASN1::ObjectId#oid
asn1: disallow NULL to be passed to asn1time_to_time()
asn1: check for illegal 'unused_bits' value of BitString
asn1: initialize 'unused_bits' attribute of BitString with 0
asn1: require tag information when instantiating generic type
asn1: remove an unnecessary function prototype
asn1: rearrange tests
asn1: infinite length -> indefinite length
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
We currently treat end-of-contents octets as a BER encoding of a value
whose tag is universal class and the number is zero, and require users
to put one in the end of 'value' array when encoding using indefinite
length form. However, the end-of-contents are just a marker indicating
the end of the contents and not really part of the contents.
Do not require users to put an EOC object in the content when encoding,
and don't produce an EOC object when decoding an encoding that uses
indefinite length form.
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Encoding with indefinite length form produces an invalid encoding if the
contents array contains an EOC object in the middle. Raise an exception
in that case.
|
| | | |
| | | |
| | | |
| | | | |
Extract the common paths for code reduction.
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Remove a mysterious behavior in Constructive#to_der: if the 'tagging'
attribute is set to :EXPLICIT and it is not an instance of universal
tag class classes, it "searches" the original tag from the first value
whose encoding is primitive.
ary = [
OpenSSL::ASN1.Sequence([
OpenSSL::ASN1.OctetString("abc")
])
]
cons = OpenSSL::ASN1::Constructive.new(ary, 1, :EXPLICIT)
cons.to_der
#=> "\xA1\x09\x24\x07\x30\x05\x04\x03\x61\x62\x63"
# ^
# This 4 comes from the OctetString
This is really confusing and nobody seems to be using this behavior.
Let's make it raise error instead.
|
| | | |
| | | |
| | | |
| | | |
| | | | |
Use ossl_asn1_tag() instead of the combination of ossl_asn1_get_tag()
and NUM2INT().
|
| | | |
| | | |
| | | |
| | | |
| | | | |
There are actually high-tag universal types such as the time-of-day
type.
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The setter method #indefinite_length= for OpenSSL::ASN1::Primitive is
undef-ed, but we can still set 'indefinite_length' to true illegally
when constructing an object with the raw OpenSSL::ASN1::ASN1Data.
Indefinite length form is not possible in primitive encoding. Raise an
exception in OpenSSL::ASN1::ASN1Data#to_der if specified.
|
| | | |
| | | |
| | | |
| | | |
| | | | |
Constructed encoding can use the definite length form as well as the
indefinite length form, regardless of the tag number.
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
OpenSSL::ASN1::ObjectId#oid, which returns the dotted representation of
the OID, is silently truncating the result if it overflows the 128-bytes
buffer. Although it normally won't be more than 127-characters, it'd be
better to avoid. This can be done by checking the return value of
OBJ_obj2txt().
Previous releases of LibreSSL (< 2.5.1) have a bug in OBJ_obj2txt() and
it does not work if the resulting string would be larger than the
buffer. A workaround is added to the test. It should be removed when we
deprecate support for LibreSSL 2.4.
|
| | | |
| | | |
| | | |
| | | | |
Let the callers check the validity of the ASN1_TIME.
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Invalid values such as nil or values not in the range 0 to 7 are
silently coerced into the valid range. This behavior is confusing and
hides user bugs. Raise an exception instead if an illegal value is
specified.
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Fix the initial value of 'unused_bits' attribute of
OpenSSL::ASN1::BitString. The attribute must always contain an Integer
in the range 0 to 7.
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Improve the error message of the exception raised when
OpenSSL::ASN1::Primitive.new or OpenSSL::ASN1::Constructive.new is
called with one argument (which is wrong).
|
| | | | |
|
| | | |
| | | |
| | | |
| | | |
| | | | |
Improve test coverage of OpenSSL::ASN1. Add more BER encode/decode
tests, while reducing redundant assertions.
|
| |/ /
| | |
| | |
| | |
| | |
| | | |
Replace all occurrences of 'infinite' with 'inDEfinite'. Accessor
methods OpenSSL::ASN1::ASN1Data#infinite_length and #infinite_length=
are kept as alias for backwards compatibility.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
SSL_get_current_cipher() returns NULL if no session is established yet.
Return nil in that case rather than an useless value like
["(NONE)", "(NONE)", 0, 32722].
Also, keep the constness of the SSL_CIPHER.
|
| | | |
|
|\ \ \
| | | |
| | | |
| | | |
| | | | |
* topic/ocsp-request-is-signed:
ocsp: add OpenSSL::OCSP::Request#signed?
|