aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* test/test_ssl_session: skip tests for session_remove_cbky/skip-session-remove-cb-testsKazuki Yamaguchi2017-10-102-18/+44
| | | | | | | | | | | | | | | | | In OpenSSL < 1.1.0, the session_remove_cb callback is called inside the global lock for CRYPTO_LOCK_SSL_CTX which is shared across the entire process, not just for the specific SSL_CTX object. It is possible that the callback releases GVL while the lock for CRYPTO_LOCK_SSL_CTX is held, causing another thread calling an OpenSSL function that tries to acquire the same lock stuck forever. Add a note about the possible deadlock to the docs for SSLContext#session_remove_cb=, and skip the relevant test cases unless the OSSL_TEST_ALL environment variable is set to 1. A deadlock due to this issue is observed: http://ci.rvm.jp/results/trunk-test@frontier/104428
* Ruby/OpenSSL 2.0.6v2.0.6ky/release-2.0.6Kazuki Yamaguchi2017-09-243-2/+22
|
* Merge pull request #155 from rhenium/ky/fix-legacy-locking-callback-relockKazuki Yamaguchi2017-09-241-26/+40
|\ | | | | ossl.c: make legacy locking callbacks reentrant
| * ossl.c: make legacy locking callbacks reentrantky/fix-legacy-locking-callback-relockKazuki Yamaguchi2017-09-241-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | Although it's not documented explicitly that the locking callbacks must provide reentrant mutexes, it seems to be required. Specifically, the session_remove_cb callback function of an SSL_CTX is called in a critical section for CRYPTO_LOCK_SSL_CTX, which is shared across the library. This leads, if the callback function calls another OpenSSL function that will attempt to lock CRYPTO_LOCK_SSL_CTX, to deadlock. SSL_CTX_free() is one example of such a function. http://ci.rvm.jp/results/trunk@P895/64001
| * ossl.c: use struct CRYPTO_dynlock_value for non-dynamic locksKazuki Yamaguchi2017-09-241-26/+28
| | | | | | | | | | In preparation for making the mutexes reentrant. It is common to the non-dynamic and the dynamic locking callbacks.
* | Merge pull request #153 from rhenium/ky/ssl-read-fix-leak-uninitializedKazuki Yamaguchi2017-09-242-11/+39
|\ \ | | | | | | ssl: prevent SSLSocket#sysread* from leaking uninitialized data
| * | ssl: prevent SSLSocket#sysread* from leaking uninitialized dataky/ssl-read-fix-leak-uninitializedKazuki Yamaguchi2017-09-232-9/+37
| | | | | | | | | | | | | | | | | | Set the length of the buffer string to 0 first, and adjust to the size successfully read by the SSL_read() call later. This is needed because the buffer string may be provided by the caller.
| * | test/test_pair: replace sleep with IO.selectKazuki Yamaguchi2017-09-231-2/+2
| |/ | | | | | | | | The sleep was to ensure that the SSLSocket#read_nonblock will get close_notify alert. A simple IO.select will suffice.
* | test/test_engine: check if RC4 is supportedKazuki Yamaguchi2017-09-241-1/+7
| | | | | | | | | | | | | | Skip test_openssl_engine_cipher_rc4 which will fail without RC4 support. It may be disabled by 'no-rc4' configure option of the OpenSSL library. Reference: https://github.com/ruby/openssl/issues/154
* | test/test_engine: suppress stderrKazuki Yamaguchi2017-09-241-20/+10
|/ | | | | | | Use ignore_stderr option of assert_separately instead of $stderr.reopen which may not work if the OpenSSL library uses a different stdio. Reference: https://github.com/ruby/openssl/issues/154
* tool/ruby-openssl-docker: updateky/maint-libressl-2.6Kazuki Yamaguchi2017-09-152-21/+22
| | | | | | | - Upgrade to latest Ubuntu LTS. - Remove unnecessary packages. - Update OpenSSL, LibreSSL, and Ruby versions. Notably, LibreSSL 2.6 is added. Accordingly, .travis.yml is also updated to use that.
* test/test_ssl: do not run NPN tests for LibreSSL >= 2.6.1Kazuki Yamaguchi2017-09-091-0/+5
| | | | | | Similar to the previous one, LibreSSL 2.6.1 has relevant functions such as SSL_CTX_set_next_proto_select_cb(), but they are broken and do nothing.
* test/test_ssl: skip tmp_ecdh_callback test for LibreSSL >= 2.6.1Kazuki Yamaguchi2017-09-091-0/+2
| | | | | LibreSSL 2.6.1 has SSL_CTX_set_tmp_ecdh_callback() function, but it does not work.
* test/test_pair: disable compressionKazuki Yamaguchi2017-09-081-0/+1
| | | | | | | The test cases added by commit 8ed81ff4b0a8 ("test/test_pair: fix test_write_nonblock{,_no_exceptions}", 2017-09-04) can consume much memory and time if the OpenSSL supports SSL/TLS compression. Disable it explicitly.
* test/test_ssl: suppress warning in test_alpn_protocol_selection_cancelKazuki Yamaguchi2017-09-081-0/+1
| | | | Suppress "using default DH parameters" message.
* ruby.h: unnormalized Fixnum valuenobu2017-09-083-3/+10
| | | | | | | | | | * include/ruby/ruby.h (ST2FIX): fix unnormalized Fixnum value bug on mingw/mswin. [ruby-core:82687] [Bug #13877] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59765 b2dd03c8-39d4-4d8f-98ff-823fe69b080e [ky: add ST2FIX() definition to ext/openssl/ruby_missing.h, and adapt the test case to the 2.0 branch.] Sync-with-trunk: r59765
* test/test_pair: fix test_write_nonblock{,_no_exceptions}ky/fix-test-pair-write-nonblockKazuki Yamaguchi2017-09-041-30/+28
| | | | | | | | | When the previous SSLSocket#write_nonblock call does not finish writing the complete contents, SSL_shutdown() which is called through SSLSocket#close will not send a close_notify alert. As of commit e3a305063675 ssl_pair no longer uses the sync_close feature. Do not expect that SSL_read() would get ECONNRESET.
* Merge pull request #140 from terceiro/tls1.1Kazuki Yamaguchi2017-08-261-1/+2
|\ | | | | test/test_ssl: explicitly accept TLS 1.1 in corresponding test
| * test/test_ssl: explicitly accept TLS 1.1 in corresponding testAntonio Terceiro2017-08-261-1/+2
|/ | | | | | OpenSSL in Debian sid has recently disabled TLS < 1.2 by default, so in order to test that TLS 1.1 works, we need to explicitly make our test client accept it.
* Merge pull request #139 from rhenium/ky/ssl-sysread-dont-check-ssl-pendingKazuki Yamaguchi2017-08-251-2/+0
|\ | | | | ssl: remove useless call to rb_thread_wait_fd()
| * ssl: remove useless call to rb_thread_wait_fd()ky/ssl-sysread-dont-check-ssl-pendingKazuki Yamaguchi2017-08-251-2/+0
| | | | | | | | | | | | That there is no immediately readable data in the SSL instance does not imply it has to read more bytes from the underlying socket. Just call SSL_read() and check the return value.
* | Merge pull request #138 from rhenium/ky/maint-fix-test-with-tls13Kazuki Yamaguchi2017-08-2537-1030/+1064
|\ \ | |/ |/| Fix test failures with TLS 1.3-capable OpenSSL
| * test/test_pair, test/test_ssl: fix for TLS 1.3ky/maint-fix-test-with-tls13Kazuki Yamaguchi2017-08-242-176/+135
| | | | | | | | Fix test cases failing with TLS 1.3-enabled OpenSSL master.
| * test/test_ssl_session: rearrange testsKazuki Yamaguchi2017-08-241-201/+196
| | | | | | | | | | Use TLS 1.2 explicitly where needed, since TLS 1.3 will remove session ID based session resumption.
| * test/test_ssl: move test_multibyte_read_write to test_pairKazuki Yamaguchi2017-08-242-24/+21
| |
| * test/test_ssl: remove test_invalid_shutdown_by_gcKazuki Yamaguchi2017-08-241-14/+0
| | | | | | | | | | | | | | | | | | The very patch that added this test case made the dfree function not send close_notify alert when an SSLSocket is being GCed. Anyway, the new OSSL_GC_STRESS option added by 6ee4b285036e ("test: run test cases under GC.stress if OSSL_GC_STRESS is specified", 2016-12-04) will cover this kind of issues.
| * test/utils: do not use DSA certificates in SSL testsKazuki Yamaguchi2017-08-241-1/+1
| | | | | | | | | | | | LibreSSL 2.6.1 removed DSA support from its SSL code. Also, TLS 1.3 will not support DSA certificates. Use an RSA certificate as the client certificate in the tests, too.
| * test/utils: add OpenSSL::TestUtils.openssl? and .libressl?Kazuki Yamaguchi2017-08-248-59/+49
| | | | | | | | | | | | Add methods that check whether the running OpenSSL is an OpenSSL or a LibreSSL, and optionally check whether the version is newer or equal to the given version number.
| * test/utils: improve error handling in start_serverKazuki Yamaguchi2017-08-241-37/+39
| | | | | | | | | | | | start_server can hang if the given block exits before closing sockets that the block opens. While this is a carelessness of the caller, we can do a better job.
| * test/utils: let server_loop close socketKazuki Yamaguchi2017-08-242-24/+15
| | | | | | | | | | Close the socket by server_loop rather than by server_proc. This reduces code duplication.
| * test/utils: do not set ecdh_curves in start_serverKazuki Yamaguchi2017-08-242-27/+47
| | | | | | | | | | | | | | | | | | An assumption in OpenSSL::TestSSL#test_get_ephemeral_key is that the ephemeral key type is always EVP_PKEY_EC when negotiated with an ECDHE cipher suite. This is not true if X25519 is chosen. The test is passing because we happen to fix the group to P-256 in start_server, but let's make it explicit.
| * test/utils: have start_server yield only the port numberKazuki Yamaguchi2017-08-243-54/+54
| | | | | | | | | | | | | | The block passed to start_server is invoked with two arguments, the running thread object for the server and the automatically-selected port number. The first argument is completely useless and actually is not used anywhere.
| * test/utils: add SSLTestCase#tls12_supported?Kazuki Yamaguchi2017-08-241-0/+4
| | | | | | | | | | Add a method that returns whether the OpenSSL supports TLS 1.2 or not. This will be useful for test cases that are specific to TLS ~1.2.
| * test/utils: remove OpenSSL::TestUtils.silentKazuki Yamaguchi2017-08-243-14/+5
| | | | | | | | | | Use EnvUtil.suppress_warning instead. We have started to use it already, and the name 'suppress_warning' expresses what it does more clearly.
| * test: fix formattingKazuki Yamaguchi2017-08-2412-164/+185
| | | | | | | | | | | | Fix wrong nesting in test/utils.rb. Remove unnecessary requires. Wrap the code with 'if defined?(OpenSSL::TestUtils) ~ end' and avoid class definition with modifier if.
| * Rakefile: let sync:to_ruby know about test/openssl/fixturesKazuki Yamaguchi2017-08-241-2/+3
| |
| * Backport "Merge branch 'topic/test-memory-leak'" to maintKazuki Yamaguchi2017-08-2426-309/+386
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * topic/test-memory-leak: Enable OSSL_MDEBUG on CI builds Add OpenSSL.print_mem_leaks test: prepare test PKey instances on demand test: let OpenSSL::TestCase include OpenSSL::TestUtils Don't define main() when built with --enable-debug (cherry picked from commit 5c586acc387834ab4e09260937dc21064fc59de4) Note that fix for new test cases that use the old constants removed by this is squashed in.
* | cipher: update the documentation for Cipher#auth_tag=ky/cipher-aead-set-aead-tag-documentation-fixKazuki Yamaguchi2017-08-241-7/+5
|/ | | | | | | The authentication tag can be set after starting the decryption, if only it is before Cipher#final is called. Fixes: https://github.com/ruby/openssl/issues/74
* ssl: do not call session_remove_cb during GCKazuki Yamaguchi2017-08-231-0/+7
| | | | | | | As noted in the SSL_CTX_sess_set_remove_cb(3) manpage, SSL_CTX_free() will call the callback function for each session in the internal session store. We can't call the callback Proc since it may do a new object allocation which is prohibited during GC.
* Ruby/OpenSSL 2.0.5v2.0.5Kazuki Yamaguchi2017-08-083-2/+15
|
* ssl: fix compile error with OpenSSL 1.0.0Kazuki Yamaguchi2017-08-082-2/+4
| | | | | | | OpenSSL <= 1.0.0 did not support TLS 1.1/1.2, and thus we must still check the existence of the symbols. This fixes the previous commit, 3e5a009966bd ("ssl: remove unsupported TLS versions from SSLContext::METHODS", 2017-08-08).
* ssl: remove unsupported TLS versions from SSLContext::METHODSKazuki Yamaguchi2017-08-084-20/+14
| | | | | | | | | | | | | | | Check for all version-specific SSL methods. We do check for existence of TLSv1_1_method() and TLSv1_2_method(), but not for TLSv1_method(). This fixes compile error when OpenSSL is configured with no-tls1-method. Also check the OPENSSL_NO_TLS{1,1_1,1_2} macros for whether OpenSSL supports the corresponding versions or not. This prevents :TLSv1 from being in SSLContext::METHODS when OpenSSL is compiled with no-tls1. In particular, Debian sid has disabled TLS 1.0/1.1 support recently. The changes in ext/openssl are partial backport of 4eb4b3297a92 ("Remove support for OpenSSL 0.9.8 and 1.0.0", 2016-11-30).
* Merge pull request #134 from larskanis/patch-1Kazuki Yamaguchi2017-07-271-0/+2
|\ | | | | Add msys2 library dependency tag in gem metadata
| * Add msys2 library dependency tag in gem metadataLars Kanis2017-07-271-0/+2
|/ | | | | | | | | | | | | | RubyInstaller2 supports metadata tags for installation of dependent MSYS2/MINGW libraries. The openssl gem requires the mingw-openssl package to be installed on the system, which the gem installer takes care about, when this tag is set. The feature is documented here: https://github.com/oneclick/rubyinstaller2/wiki/For-gem-developers#msys2-library-dependency This fixes issues like https://github.com/oneclick/rubyinstaller2/issues/54 and https://github.com/oneclick/rubyinstaller2/issues/53 .
* Merge branch 'ky/pem-passwd-cb-get-rid-of-minlen' into maintKazuki Yamaguchi2017-07-222-19/+18
|\ | | | | | | | | | | | | * ky/pem-passwd-cb-get-rid-of-minlen: ossl_pem_passwd_cb: handle nil from the block explicitly ossl_pem_passwd_cb: do not check for taintedness ossl_pem_passwd_cb: relax passphrase length constraint
| * ossl_pem_passwd_cb: handle nil from the block explicitlyky/pem-passwd-cb-get-rid-of-minlenKazuki Yamaguchi2017-07-222-4/+8
| | | | | | | | | | | | | | | | | | | | | | There is code that returns nil in the passphrase block on purpose (to prevent OpenSSL from prompting on stdin): OpenSSL::PKey.read(File.read("file.pem")) { nil } This is working just by chance because the TypeError from StringValue() is silently ignored. Let's short circuit in that case and save raising a needless exception, as this pattern has become too common.
| * ossl_pem_passwd_cb: do not check for taintednessKazuki Yamaguchi2017-07-221-1/+1
| | | | | | | | It is perfectly permissible to take passwords from an untrusted source.
| * ossl_pem_passwd_cb: relax passphrase length constraintKazuki Yamaguchi2017-07-222-14/+9
|/ | | | | | The minimum passphrase length of 4 bytes is only a limitation of PEM_def_callback() which isn't relevant here. Commit f38501249f33 introduced this bug.
* appveyor.yml: test against Ruby 2.4ky/appveyor-update-201707Kazuki Yamaguchi2017-07-111-7/+18
|
* Rakefile: install_dependencies: install only when neededKazuki Yamaguchi2017-07-111-2/+7
| | | | | Emulate the behavior of 'gem install --conservative'. This would prevent overwriting the existing Rake installation.
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-26 18:22:09 +0000