aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* | Fix signing example to not use Digest instanceBart de Water2020-04-211-4/+2
| |
* | Look up cipher by name instead of constantBart de Water2020-04-212-24/+8
| |
* | Remove 'mapping between Digest class and sn/ln'Bart de Water2020-04-211-37/+0
| | | | | | | | This is not present in the referenced files anymore, and not useful to most users
* | Look up digest by name instead of constantBart de Water2020-04-2131-171/+161
| |
* | Merge pull request #363 from bdewater/marshal-pkeyKazuki Yamaguchi2020-04-218-23/+85
|\ \ | | | | | | Add Marshal support to PKey objects
| * | Add Marshal support to PKey objectsBart de Water2020-04-198-23/+85
|/ /
* | Merge pull request #354 from MSP-Greg/setup-ruby-pkgsKazuki Yamaguchi2020-03-311-18/+6
|\ \ | | | | | | Use setup-ruby-pkgs for Windows
| * | Use setup-ruby-pkgs for WindowsMSP-Greg2020-03-161-18/+6
| |/ | | | | | | | | | | 1. Using correct MSYS compiler for Windows Ruby 2.3, previous CI used MSYS2 2. Ruby installation is done via a fork of setup-ruby
* | Merge pull request #357 from mame/ignore-SSLError-when-socket-is-forcibly-closedKazuki Yamaguchi2020-03-311-1/+6
|\ \ | |/ |/| test/openssl/test_ssl.rb: ignore SSLError when the connection is closed
| * test/openssl/test_ssl.rb: ignore SSLError when the connection is closedYusuke Endoh2020-03-211-1/+6
|/ | | | | | | | | | | | | | | | | | "test_close_after_socket_close" checks if ssl.close is no-op even after the wrapped socket is closed. The test itself is fair, but the other endpoint that is reading the SSL connection may fail with SSLError: "SSL_read: unexpected eof while reading" in some environments: https://github.com/ruby/ruby/actions/runs/60085389 (MinGW) https://rubyci.org/logs/rubyci.s3.amazonaws.com/android28-x86_64/ruby-master/log/20200321T034442Z.fail.html.gz ``` 1) Failure: OpenSSL::TestSSL#test_close_after_socket_close [D:/a/ruby/ruby/src/test/openssl/utils.rb:299]: exceptions on 1 threads: SSL_read: unexpected eof while reading ``` This changeset rescues and ignores the SSLError in the test.
* Revert "Use version.rb in gemspec"Kazuki Yamaguchi2020-03-101-3/+1
| | | | | | | | | | | This reverts commit 55cfee6edbc5c663cbe73323852b93292cf94a3f. Unfortunately, this doesn't work well in some places because RubyGems depends on openssl in some code paths. This ends up with defining OpenSSL::VERSION twice and producing warning: /work/ruby/ext/openssl/lib/openssl/version.rb:4: warning: already initialized constant OpenSSL::VERSION /work/ruby/.x86_64-linux/.ext/common/openssl/version.rb:5: warning: previous definition of VERSION was here
* Merge branch 'maint'Kazuki Yamaguchi2020-03-095-19/+229
|\ | | | | | | | | | | | | | | | | | | * maint: ssl: set verify error code in the case of verify_hostname failure x509: add error code and verify flags constants Remove taint support Restore compatibility with older versions of Ruby. Fix keyword argument separation issues in OpenSSL::SSL::SSLSocket#sys{read,write}_nonblock config: support .include directive
| * Merge branch 'maint-2.0' into maintKazuki Yamaguchi2020-03-097-42/+262
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint-2.0: ssl: set verify error code in the case of verify_hostname failure x509: add error code and verify flags constants Remove taint support Restore compatibility with older versions of Ruby. Fix keyword argument separation issues in OpenSSL::SSL::SSLSocket#sys{read,write}_nonblock config: support .include directive
| | * Merge pull request #350 from rhenium/ky/ssl-fix-verify-hostname-set-error-codemaint-2.0Kazuki Yamaguchi2020-02-262-1/+48
| | |\ | | | | | | | | ssl: set verify error code in the case of verify_hostname failure
| | | * ssl: set verify error code in the case of verify_hostname failureky/ssl-fix-verify-hostname-set-error-codeKazuki Yamaguchi2020-02-242-1/+48
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the verify_hostname option is enabled, the hostname verification is done before calling verify_callback provided by the user. The callback should be notified of the hostname verification failure. OpenSSL::X509::StoreContext's error code must be set to an appropriate value rather than OpenSSL::X509::V_OK. If the constant X509_V_ERR_HOSTNAME_MISMATCH is available (OpenSSL >= 1.0.2), use it. Otherwise use the generic X509_V_ERR_CERT_REJECTED. Reference: https://github.com/ruby/openssl/issues/244 Fixes: 028e495734e9 ("ssl: add verify_hostname option to SSLContext", 2016-06-27)
| | * x509: add error code and verify flags constantsKazuki Yamaguchi2020-02-241-0/+91
| | | | | | | | | | | | | | | Add missing constant declarations for certificate verification flags and the error codes, to match with OpenSSL 1.1.1.
| | * Remove taint supportJeremy Evans2020-02-243-11/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ This is a backport to the 2.0 branch. ] Ruby 2.7 deprecates taint and it no longer has an effect. The lack of taint support should not cause a problem in previous Ruby versions. (cherry picked from commit e7ed01b580a139ad0fb320ad5f29bbb40ef2ddc2)
| | * Restore compatibility with older versions of Ruby.Samuel Williams2020-02-241-9/+21
| | | | | | | | | | | | | | | | | | | | | [ Originally landed on as commit b4e96fc4abc3. This is a backport to the 2.0 branch. ] `RB_PASS_KEYWORDS` is not always available.
| | * Fix keyword argument separation issues in ↵Jeremy Evans2020-02-241-4/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL::SSL::SSLSocket#sys{read,write}_nonblock [ Originally landed on ruby.git as commit 3959469f240e, then was merged into ruby/openssl.git as commit b4e96fc4abc3. This is a backport to the 2.0 branch. ] It's unlikely anyone would actually hit these. The methods are private, you only hit this code path if calling these methods before performing the SSL connection, and there is already a verbose warning issued.
| | * Merge pull request #216 from rhenium/ky/config-include-directiveKazuki Yamaguchi2020-02-172-18/+90
| | |\ | | | | | | | | config: support .include directive
| | | * config: support .include directiveky/config-include-directiveKazuki Yamaguchi2019-12-132-18/+90
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 1.1.1 introduces a new '.include' directive. Update our config parser to support that. As mentioned in the referenced GitHub issue, we should use the OpenSSL API instead of implementing the parsing logic ourselves, but it will need backwards-incompatible changes which we can't backport to stable versions. So continue to use the Ruby implementation for now. Squashed in additional changes by Vít Ondruch to support '.include = ' syntax. Reference: https://github.com/ruby/openssl/issues/208
* | | | ssl: remove test case test_puts_meta from test_pairKazuki Yamaguchi2020-03-091-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove it as it does not make sense. Also, it produces deprecation warning on the current master of Ruby (2.8). It is a test case to check that changing $/ will not affect OpenSSL::Buffering#puts. However, $/ is the input record separator and should be completely irrelevant to it.
* | | | ssl: suppress test failure with SSLContext#add_certificate_chain_fileKazuki Yamaguchi2020-03-096-48/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The feature is currently premature and will be rewritten. However, it is causing test failures on RubyCI. Make it happy for now. Reference: https://github.com/ruby/openssl/issues/334
* | | | Merge pull request #352 from DBL-Lee/masterKazuki Yamaguchi2020-02-292-1/+13
|\ \ \ \ | | | | | | | | | | Add support for SHA512/256 and SHA512/224
| * | | | add support for SHA512_256/SHA512_224DBL-Lee2020-02-272-1/+13
|/ / / /
* | | | Merge pull request #351 from rhenium/ky/actions-updateKazuki Yamaguchi2020-02-265-103/+138
|\ \ \ \ | | | | | | | | | | .github/workflows: test against different OpenSSL versions
| * | | | .travis.yml: fully migrate to GitHub Actionsky/actions-updateKazuki Yamaguchi2020-02-262-23/+1
| | | | | | | | | | | | | | | | | | | | | | | | | The GitHub Actions workflow now covers all patterns we currently test using Travis CI. .travis.yml can be removed.
| * | | | .github/workflows: test against different OpenSSL versionsKazuki Yamaguchi2020-02-261-0/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Compile OpenSSL and LibreSSL on-the-fly and run our test suite against the OpenSSL installation. Compiling OpenSSL or LibreSSL takes about 1.5 - 2 minutes on a GitHub- hosted runner.
| * | | | .github/workflows: merge CI jobs into a single workflowKazuki Yamaguchi2020-02-262-39/+32
|/ / / / | | | | | | | | | | | | | | | | The "Ubuntu-macOS" and "Windows" workflows are both for the same purpose. Merge them into a single workflow for clarity.
* | | | Merge pull request #349 from MSP-Greg/gemspec-versionKazuki Yamaguchi2020-02-251-1/+3
|\ \ \ \ | | | | | | | | | | Use version.rb in gemspec
| * | | | Use version.rb in gemspecMSP-Greg2020-02-241-1/+3
|/ / / / | | | | | | | | | | | | Use version.rb in gemspec so version string exists in one location
* | | | Remove redundant and ignored workflow fileBenoit Daloze2020-02-221-43/+0
| | | | | | | | | | | | | | | | * .github/workflows/ubuntu-macos.yml already tests those.
* | | | Merge pull request #348 from rhenium/ky/fix-openssl-version-constantKazuki Yamaguchi2020-02-222-1/+2
|\ \ \ \ | | | | | | | | | | lib/openssl.rb: require openssl/version.rb
| * | | | lib/openssl.rb: require openssl/version.rbky/fix-openssl-version-constantKazuki Yamaguchi2020-02-222-1/+2
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | The OpenSSL::VERSION constant is now defined by lib/openssl/version.rb instead of by the extension. Add missing require statement. Fixes: 0cddb0b736c8 ("Simplify handling of version constant.", 2019-10-31) Reference: https://github.com/ruby/openssl/issues/347
* | | | Merge pull request #322 from rhenium/ky/config-deprecate-modifyKazuki Yamaguchi2020-02-213-49/+77
|\ \ \ \ | | | | | | | | | | config: deprecate OpenSSL::Config#add_value and #[]=
| * | | | config: deprecate OpenSSL::Config#add_value and #[]=ky/config-deprecate-modifyKazuki Yamaguchi2020-02-193-49/+77
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL::Config is currently implemented in Ruby, but we plan to revert back to use OpenSSL API, just as it did before r28632 (in ruby_1_8; r29048 in trunk). It's not clear what was the issue with Windows, but the CONF library should work on Windows too. Modifying a CONF object is not possible in OpenSSL API. Actually, it was possible in previous versions of OpenSSL, but we used their internal functions that are not exposed in shared libraries anymore. Accordingly, OpenSSL::Config#add_value and #[]= have to be removed. As a first step towards the change, let's deprecate those methods.
* | | | | Merge pull request #346 from rhenium/ky/engine-load-updatesKazuki Yamaguchi2020-02-212-14/+4
|\ \ \ \ \ | | | | | | | | | | | | engine: small cleanups on OpenSSL::Engine.load
| * | | | | engine: fix guards for 'dynamic' and 'cryptodev' enginesky/engine-load-updatesKazuki Yamaguchi2020-02-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Those two engines exist as builtin engines even if static engines are disabled with OPENSSL_NO_STATIC_ENGINE. This is the default with recent OpenSSL. This has prevented Engine.load("dynamic") from working and required the user to call OpenSSL::Engine.load with no arguments, which loads all builtin engines including 'dynamic'. Note that OpenSSL 1.1.0 and newer calls (the equivalent of) ENGINE_load_builtin_engines() on its initialization. This includes 'dynamic' and 'cryptodev' engines (if available).
| * | | | | engine: do not check for ENGINE_load_builtin_engines()Kazuki Yamaguchi2020-02-212-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove dead code. The function, or a macro in OpenSSL 1.1.0 and newer, always exists unless the whole engine code is disabled with OPENSSL_NO_ENGINE.
| * | | | | engine: remove really outdated static enginesKazuki Yamaguchi2020-02-212-8/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | They no longer exists in OpenSSL 1.0.1, which is the oldest version Ruby/OpenSSL currently compiles with. Note that OpenSSL 1.0.2 and older is already in EOL state. The following engines should also be removed when we completely drop support for those versions as they were removed in OpenSSL 1.1.0. - 4758cca - aep - atalla - chil - cswift - nuron - sureware - ubsec - gmp - gost
* | | | | | Merge pull request #345 from rhenium/ky/engine-load-revert-cloudhsmKazuki Yamaguchi2020-02-212-5/+1
|\| | | | | | | | | | | | | | | | | engine: revert OpenSSL::Engine.load changes for cloudhsm
| * | | | | engine: revert OpenSSL::Engine.load changes for cloudhsmky/engine-load-revert-cloudhsmKazuki Yamaguchi2020-02-202-5/+1
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Revert two commits: - ea49ccc82aa4 Add cloudhsm to extconf.rb - 33ed3ba10424 Add cloudhsm to ossl_engine.c OpenSSL::Engine.load is a binding for ENGINE_load_*() functions which are provided by OpenSSL itself, so-called "static engines". Since the AWS CloudHSM engine is a dynamic engine, which is provided as a shared library, this change is not a correct solution for the issue. Reference: https://github.com/ruby/openssl/issues/189 Reference: https://github.com/ruby/openssl/pull/190
* | | | | Merge pull request #344 from rhenium/ky/ssl-test-fixupsKazuki Yamaguchi2020-02-191-20/+18
|\ \ \ \ \ | | | | | | | | | | | | test/openssl/test_ssl: test fixes
| * | | | | test/openssl/test_ssl: allow kRSA tests to failky/ssl-test-fixupsKazuki Yamaguchi2020-02-191-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Non-forward-secrecy cipher suites may be disabled when OpenSSL's security level is set to 3 or higher.
| * | | | | test/openssl/test_ssl: remove commented-out test caseKazuki Yamaguchi2020-02-191-13/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reapply commit ca77d5504f0a ("Remove out-of-scope test.", 2019-12-29). Private methods are not to be used by users and the behavior should not be tested.
| * | | | | test/openssl/test_ssl: avoid explicitly-sized private keysKazuki Yamaguchi2020-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix possible test failure in test_add_certificate_multiple_certs. In environment with OpenSSL's security level set to 3, RSA keys with 2048 bits will be rejected. Since the test case does not require the exact size of a key, just use the generic rsa-3 key.
| * | | | | test/openssl/test_ssl: fix random failure in SSLSocket.open testKazuki Yamaguchi2020-02-191-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let test_socket_open_with_local_address_port_context use a random high port number and also ignore Errno::EADDRINUSE in case it is in use.
| * | | | | test/openssl/test_ssl: remove sleep from test_finished_messagesKazuki Yamaguchi2020-02-191-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ensure that the handshake fully completes by sending data each other rather than by inserting 50ms sleep.
* | | | | | Merge pull request #343 from rhenium/ky/ssl-avoid-mixed-declarationsKazuki Yamaguchi2020-02-191-12/+12
|\ \ \ \ \ \ | |_|/ / / / |/| | | | | ssl: avoid declarations after statements
| * | | | | ssl: avoid declarations after statementsky/ssl-avoid-mixed-declarationsKazuki Yamaguchi2020-02-191-12/+12
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | We cannot use C99 features yet, as we still support Ruby 2.6 and older. Fixes: debaca25604c ("Adds support for the 'get_finished' and 'get_peer_finished' functions", 2019-06-25)
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-25 06:48:30 +0000