aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Ruby/OpenSSL 2.1.0.beta1v2.1.0.beta1ky/release-2.1.0.beta1Kazuki Yamaguchi2017-09-032-20/+26
|
* Merge pull request #144 from rhenium/ky/x509name-fix-parse-opensslKazuki Yamaguchi2017-09-032-21/+22
|\ | | | | x509name: update regexp in OpenSSL::X509::Name.parse
| * x509name: update regexp in OpenSSL::X509::Name.parseky/x509name-fix-parse-opensslKazuki Yamaguchi2017-09-032-21/+22
| | | | | | | | | | | | | | Allow the attribute value to contain ',', just as the openssl utility's parse_name() function does. Fixes: https://github.com/ruby/openssl/issues/39
* | Merge pull request #143 from rhenium/ky/x509name-to-utf-8Kazuki Yamaguchi2017-09-032-17/+83
|\ \ | |/ |/| Add X509::Name#to_utf8 and #inspect
| * x509name: add OpenSSL::X509::Name#inspectky/x509name-to-utf-8Kazuki Yamaguchi2017-09-031-0/+9
| |
| * x509name: add OpenSSL::X509::Name#to_utf8Kazuki Yamaguchi2017-09-032-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | The existing #to_s does not interact well with distinguished names containing multi-byte UTF-8 characters since the OpenSSL function X509_NAME_print_ex() escapes bytes with MSB set by default. Unfortunately we can't fix it without breaking backwards compatibility. It takes options as a bit field that is directly passed to X509_NAME_print_ex(). Let's add a new method instead. Fixes: https://github.com/ruby/openssl/issues/26
| * x509name: refactor OpenSSL::X509::Name#to_sKazuki Yamaguchi2017-09-031-18/+22
| | | | | | | | | | | | | | Extract the body into a function in preparation for adding #to_utf8. Also a potential memory leak is fixed: the GetX509Name() macro can raise TypeError.
| * test/test_x509name: change script encoding to ASCII-8BITKazuki Yamaguchi2017-09-031-1/+1
| | | | | | | | Allow string literals containing UTF-8 characters.
* | Merge pull request #142 from rhenium/ky/ssl-version-min-maxKazuki Yamaguchi2017-09-035-204/+460
|\ \ | | | | | | ssl: add SSLContext#min_version= and #max_version=
| * | ssl: rework SSLContext#ssl_version=Kazuki Yamaguchi2017-09-034-100/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reimplement SSLContext#ssl_version= as a wrapper around SSLContext#min_version= and #max_version=. SSLContext#ssl_version= used to call SSL_CTX_set_ssl_version() which replaces the SSL method used for the connections created from the SSL context. This is mainly used for forcing a specific SSL/TLS protocol version. As of OpenSSL 1.1.0, however, use of the version-specific SSL methods such as TLSv1_method() is deprecated. Follow the current recommendation -- to use the generic SSL method always and to control the supported version range by SSL_CTX_set_{min,max}_proto_version(). Actually, we have already started doing a similar thing when the extension is compiled with OpenSSL 1.1.0. OpenSSL::SSL::SSLContext::METHODS, which contained the possible names of SSL methods, is not useful anymore. It is now deprecate_constant-ed.
| * | ssl: add SSLContext#min_version= and #max_version=Kazuki Yamaguchi2017-09-034-83/+332
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add methods that set the minimum and maximum supported protocol versions for the SSL context. If the OpenSSL library supports, use SSL_CTX_set_{min,max}_proto_version() that do the exact thing. Otherwise, simulate by combining SSL_OP_NO_{SSL,TLS}v* flags. The new methods are meant to replace the deprecated #ssl_version= that cannot support multiple protocol versions. SSLContext::DEFAULT_PARAMS is also updated to use the new SSLContext#min_version=.
| * | ssl: prefer TLS_method() over SSLv23_method()Kazuki Yamaguchi2017-09-021-0/+4
| | | | | | | | | | | | | | | | | | OpenSSL 1.1.0 replaced SSLv23_method() with TLS_method(). SSLv23_method which still exists in 1.1.0, as a macro around TLS_method, will eventually be removed. Use the new name if possible.
| * | ssl: update OpenSSL::SSL::OP_* flagsKazuki Yamaguchi2017-09-021-38/+81
| | | | | | | | | | | | | | | Reorder, expand ossl_ssl_def_const() macro so RDoc can parse and render better, and add new flags that are in recent versions of OpenSSL.
| * | ssl: ensure that SSL option flags are non-negativeKazuki Yamaguchi2017-09-021-3/+7
|/ / | | | | | | | | | | SSL_CTX_{get,set,clear}_options() are made separate functions and they now treat flags as unsigned long. Fix possible RangeError on platforms with sizeof(long)==4.
* | ssl: use 2048-bit group in the default tmp_dh_cbKazuki Yamaguchi2017-09-021-14/+1
| | | | | | | | | | | | The 'keylen' parameter of the tmp_dh_callback is only meaningful when 'is_export' is non-zero. Ignore them and just return the default 2048-bit DH group.
* | ssl: mark OpenSSL::SSL::SSLContext::DEFAULT_{1024,2048} as privateKazuki Yamaguchi2017-08-291-4/+3
| | | | | | | | | | | | Follow-up commit eaffc69e40ab ("ssl: move default DH parameters from OpenSSL::PKey::DH", 2017-01-23). Those constants shouldn't be used directly.
* | ssl: fix NPN supportKazuki Yamaguchi2017-08-261-6/+6
|/ | | | | | | | | As of commit 4eb4b3297a92 ("Remove support for OpenSSL 0.9.8 and 1.0.0", 2016-11-30), ext/openssl/extconf.rb don't check for existence of SSL_CTX_set_next_proto_select_cb() function, but the code still refers to the HAVE_SSL_CTX_SET_NEXT_PROTO_SELECT_CB macro. NPN is available in all supported versions of OpenSSL and LibreSSL, unless it's disabled by their configure options. Check OPENSSL_NO_NEXTPROTONEG macro instead.
* Merge branch 'maint'Kazuki Yamaguchi2017-08-2634-680/+746
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This also restores 'if defined?(OpenSSL)-end' wrapping the test code. They have been removed erroneously by commit 4eb4b3297a92 ("Remove support for OpenSSL 0.9.8 and 1.0.0", 2016-11-30). * maint: test/test_ssl: explicitly accept TLS 1.1 in corresponding test ssl: remove useless call to rb_thread_wait_fd() test/test_pair, test/test_ssl: fix for TLS 1.3 test/test_ssl_session: rearrange tests test/test_ssl: move test_multibyte_read_write to test_pair test/test_ssl: remove test_invalid_shutdown_by_gc test/utils: do not use DSA certificates in SSL tests test/utils: add OpenSSL::TestUtils.openssl? and .libressl? test/utils: improve error handling in start_server test/utils: let server_loop close socket test/utils: do not set ecdh_curves in start_server test/utils: have start_server yield only the port number test/utils: add SSLTestCase#tls12_supported? test/utils: remove OpenSSL::TestUtils.silent test: fix formatting Rakefile: let sync:to_ruby know about test/openssl/fixtures cipher: update the documentation for Cipher#auth_tag= Backport "Merge branch 'topic/test-memory-leak'" to maint ssl: do not call session_remove_cb during GC
| * Merge pull request #140 from terceiro/tls1.1Kazuki Yamaguchi2017-08-261-1/+2
| |\ | | | | | | test/test_ssl: explicitly accept TLS 1.1 in corresponding test
| | * test/test_ssl: explicitly accept TLS 1.1 in corresponding testAntonio Terceiro2017-08-261-1/+2
| |/ | | | | | | | | | | OpenSSL in Debian sid has recently disabled TLS < 1.2 by default, so in order to test that TLS 1.1 works, we need to explicitly make our test client accept it.
| * Merge pull request #139 from rhenium/ky/ssl-sysread-dont-check-ssl-pendingKazuki Yamaguchi2017-08-251-2/+0
| |\ | | | | | | ssl: remove useless call to rb_thread_wait_fd()
| | * ssl: remove useless call to rb_thread_wait_fd()ky/ssl-sysread-dont-check-ssl-pendingKazuki Yamaguchi2017-08-251-2/+0
| | | | | | | | | | | | | | | | | | That there is no immediately readable data in the SSL instance does not imply it has to read more bytes from the underlying socket. Just call SSL_read() and check the return value.
| * | Merge pull request #138 from rhenium/ky/maint-fix-test-with-tls13Kazuki Yamaguchi2017-08-2537-1030/+1064
| |\ \ | | |/ | |/| Fix test failures with TLS 1.3-capable OpenSSL
| | * test/test_pair, test/test_ssl: fix for TLS 1.3ky/maint-fix-test-with-tls13Kazuki Yamaguchi2017-08-242-176/+135
| | | | | | | | | | | | Fix test cases failing with TLS 1.3-enabled OpenSSL master.
| | * test/test_ssl_session: rearrange testsKazuki Yamaguchi2017-08-241-201/+196
| | | | | | | | | | | | | | | Use TLS 1.2 explicitly where needed, since TLS 1.3 will remove session ID based session resumption.
| | * test/test_ssl: move test_multibyte_read_write to test_pairKazuki Yamaguchi2017-08-242-24/+21
| | |
| | * test/test_ssl: remove test_invalid_shutdown_by_gcKazuki Yamaguchi2017-08-241-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | The very patch that added this test case made the dfree function not send close_notify alert when an SSLSocket is being GCed. Anyway, the new OSSL_GC_STRESS option added by 6ee4b285036e ("test: run test cases under GC.stress if OSSL_GC_STRESS is specified", 2016-12-04) will cover this kind of issues.
| | * test/utils: do not use DSA certificates in SSL testsKazuki Yamaguchi2017-08-241-1/+1
| | | | | | | | | | | | | | | | | | LibreSSL 2.6.1 removed DSA support from its SSL code. Also, TLS 1.3 will not support DSA certificates. Use an RSA certificate as the client certificate in the tests, too.
| | * test/utils: add OpenSSL::TestUtils.openssl? and .libressl?Kazuki Yamaguchi2017-08-248-59/+49
| | | | | | | | | | | | | | | | | | Add methods that check whether the running OpenSSL is an OpenSSL or a LibreSSL, and optionally check whether the version is newer or equal to the given version number.
| | * test/utils: improve error handling in start_serverKazuki Yamaguchi2017-08-241-37/+39
| | | | | | | | | | | | | | | | | | start_server can hang if the given block exits before closing sockets that the block opens. While this is a carelessness of the caller, we can do a better job.
| | * test/utils: let server_loop close socketKazuki Yamaguchi2017-08-242-24/+15
| | | | | | | | | | | | | | | Close the socket by server_loop rather than by server_proc. This reduces code duplication.
| | * test/utils: do not set ecdh_curves in start_serverKazuki Yamaguchi2017-08-242-27/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | An assumption in OpenSSL::TestSSL#test_get_ephemeral_key is that the ephemeral key type is always EVP_PKEY_EC when negotiated with an ECDHE cipher suite. This is not true if X25519 is chosen. The test is passing because we happen to fix the group to P-256 in start_server, but let's make it explicit.
| | * test/utils: have start_server yield only the port numberKazuki Yamaguchi2017-08-243-54/+54
| | | | | | | | | | | | | | | | | | | | | The block passed to start_server is invoked with two arguments, the running thread object for the server and the automatically-selected port number. The first argument is completely useless and actually is not used anywhere.
| | * test/utils: add SSLTestCase#tls12_supported?Kazuki Yamaguchi2017-08-241-0/+4
| | | | | | | | | | | | | | | Add a method that returns whether the OpenSSL supports TLS 1.2 or not. This will be useful for test cases that are specific to TLS ~1.2.
| | * test/utils: remove OpenSSL::TestUtils.silentKazuki Yamaguchi2017-08-243-14/+5
| | | | | | | | | | | | | | | Use EnvUtil.suppress_warning instead. We have started to use it already, and the name 'suppress_warning' expresses what it does more clearly.
| | * test: fix formattingKazuki Yamaguchi2017-08-2412-164/+185
| | | | | | | | | | | | | | | | | | Fix wrong nesting in test/utils.rb. Remove unnecessary requires. Wrap the code with 'if defined?(OpenSSL::TestUtils) ~ end' and avoid class definition with modifier if.
| | * Rakefile: let sync:to_ruby know about test/openssl/fixturesKazuki Yamaguchi2017-08-241-2/+3
| | |
| | * Backport "Merge branch 'topic/test-memory-leak'" to maintKazuki Yamaguchi2017-08-2426-309/+386
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * topic/test-memory-leak: Enable OSSL_MDEBUG on CI builds Add OpenSSL.print_mem_leaks test: prepare test PKey instances on demand test: let OpenSSL::TestCase include OpenSSL::TestUtils Don't define main() when built with --enable-debug (cherry picked from commit 5c586acc387834ab4e09260937dc21064fc59de4) Note that fix for new test cases that use the old constants removed by this is squashed in.
| * | cipher: update the documentation for Cipher#auth_tag=ky/cipher-aead-set-aead-tag-documentation-fixKazuki Yamaguchi2017-08-241-7/+5
| |/ | | | | | | | | | | | | The authentication tag can be set after starting the decryption, if only it is before Cipher#final is called. Fixes: https://github.com/ruby/openssl/issues/74
| * ssl: do not call session_remove_cb during GCKazuki Yamaguchi2017-08-231-0/+7
| | | | | | | | | | | | | | As noted in the SSL_CTX_sess_set_remove_cb(3) manpage, SSL_CTX_free() will call the callback function for each session in the internal session store. We can't call the callback Proc since it may do a new object allocation which is prohibited during GC.
* | Merge branch 'maint'Kazuki Yamaguchi2017-08-0823-84/+102
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint: Ruby/OpenSSL 2.0.5 ssl: fix compile error with OpenSSL 1.0.0 ssl: remove unsupported TLS versions from SSLContext::METHODS Add msys2 library dependency tag in gem metadata ossl_pem_passwd_cb: handle nil from the block explicitly ossl_pem_passwd_cb: do not check for taintedness ossl_pem_passwd_cb: relax passphrase length constraint appveyor.yml: test against Ruby 2.4 Rakefile: install_dependencies: install only when needed bio: do not use the FILE BIO method in ossl_obj2bio() bio: prevent possible GC issue in ossl_obj2bio() test/test_ssl: allow 3DES cipher suites in test_sslctx_set_params
| * Ruby/OpenSSL 2.0.5v2.0.5Kazuki Yamaguchi2017-08-083-2/+15
| |
| * ssl: fix compile error with OpenSSL 1.0.0Kazuki Yamaguchi2017-08-082-2/+4
| | | | | | | | | | | | | | OpenSSL <= 1.0.0 did not support TLS 1.1/1.2, and thus we must still check the existence of the symbols. This fixes the previous commit, 3e5a009966bd ("ssl: remove unsupported TLS versions from SSLContext::METHODS", 2017-08-08).
| * ssl: remove unsupported TLS versions from SSLContext::METHODSKazuki Yamaguchi2017-08-084-20/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Check for all version-specific SSL methods. We do check for existence of TLSv1_1_method() and TLSv1_2_method(), but not for TLSv1_method(). This fixes compile error when OpenSSL is configured with no-tls1-method. Also check the OPENSSL_NO_TLS{1,1_1,1_2} macros for whether OpenSSL supports the corresponding versions or not. This prevents :TLSv1 from being in SSLContext::METHODS when OpenSSL is compiled with no-tls1. In particular, Debian sid has disabled TLS 1.0/1.1 support recently. The changes in ext/openssl are partial backport of 4eb4b3297a92 ("Remove support for OpenSSL 0.9.8 and 1.0.0", 2016-11-30).
| * Merge pull request #134 from larskanis/patch-1Kazuki Yamaguchi2017-07-271-0/+2
| |\ | | | | | | Add msys2 library dependency tag in gem metadata
| | * Add msys2 library dependency tag in gem metadataLars Kanis2017-07-271-0/+2
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | RubyInstaller2 supports metadata tags for installation of dependent MSYS2/MINGW libraries. The openssl gem requires the mingw-openssl package to be installed on the system, which the gem installer takes care about, when this tag is set. The feature is documented here: https://github.com/oneclick/rubyinstaller2/wiki/For-gem-developers#msys2-library-dependency This fixes issues like https://github.com/oneclick/rubyinstaller2/issues/54 and https://github.com/oneclick/rubyinstaller2/issues/53 .
| * Merge branch 'ky/pem-passwd-cb-get-rid-of-minlen' into maintKazuki Yamaguchi2017-07-222-19/+18
| |\ | | | | | | | | | | | | | | | | | | * ky/pem-passwd-cb-get-rid-of-minlen: ossl_pem_passwd_cb: handle nil from the block explicitly ossl_pem_passwd_cb: do not check for taintedness ossl_pem_passwd_cb: relax passphrase length constraint
| | * ossl_pem_passwd_cb: handle nil from the block explicitlyky/pem-passwd-cb-get-rid-of-minlenKazuki Yamaguchi2017-07-222-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is code that returns nil in the passphrase block on purpose (to prevent OpenSSL from prompting on stdin): OpenSSL::PKey.read(File.read("file.pem")) { nil } This is working just by chance because the TypeError from StringValue() is silently ignored. Let's short circuit in that case and save raising a needless exception, as this pattern has become too common.
| | * ossl_pem_passwd_cb: do not check for taintednessKazuki Yamaguchi2017-07-221-1/+1
| | | | | | | | | | | | It is perfectly permissible to take passwords from an untrusted source.
| | * ossl_pem_passwd_cb: relax passphrase length constraintKazuki Yamaguchi2017-07-222-14/+9
| |/ | | | | | | | | | | The minimum passphrase length of 4 bytes is only a limitation of PEM_def_callback() which isn't relevant here. Commit f38501249f33 introduced this bug.
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-17 08:02:32 +0000