aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * asn1: fix docsKazuki Yamaguchi2017-12-141-2/+2
| | | | | | | | | | | | | | The value of 'value' attribute of OpenSSL::ASN1::{Integer,Enumerated} should be an instance of OpenSSL::BN. Reference: https://github.com/ruby/openssl/issues/176
| * ssl: remove unreachable codeKazuki Yamaguchi2017-12-081-9/+0
| | | | | | | | GetSSLCTX() never returns NULL.
* | Merge pull request #177 from rhenium/ky/pkey-ec-point-octet-stringKazuki Yamaguchi2017-12-143-101/+131
|\ \ | | | | | | pkey/ec: add support for octet string encoding of EC point
| * | pkey/ec: add support for octet string encoding of EC pointky/pkey-ec-point-octet-stringKazuki Yamaguchi2017-12-143-58/+108
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new method named PKey::EC#to_octet_string that returns the octet string representation of the curve point. PKey::EC::Point#to_bn, which have already existed and is similar except that an instance of OpenSSL::BN is returned, is rewritten in Ruby. PKey::EC::Point#initialize now takes String as the second argument in the PKey::EC::Point.new(group, encoded_point) form. Also, update the tests to use #to_octet_string instead of #to_bn for better readability.
| * | pkey/ec: rearrange PKey::EC::Point#initializeKazuki Yamaguchi2017-12-071-44/+24
| | |
* | | Merge branch 'ky/fix-ssl-test-internal-encoding'Kazuki Yamaguchi2017-12-141-4/+6
|\ \ \ | | | | | | | | | | | | | | | | * ky/fix-ssl-test-internal-encoding: Fix test-all tests to avoid creating report_on_exception warnings
| * | | Fix test-all tests to avoid creating report_on_exception warningsky/fix-ssl-test-internal-encodingeregon2017-12-141-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * The warnings are shown by Thread.report_on_exception defaulting to true. [Feature #14143] [ruby-core:83979] * Improves tests by narrowing down the scope where an exception is expected. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61188 b2dd03c8-39d4-4d8f-98ff-823fe69b080e [ky: this effectively reverts commit 01445af367ec ("test/test_ssl: prevent changing default internal encoding", 2017-11-26). This is OK since EnvUtil.with_default_internal has been made thread-safe.] Sync-with-trunk: r61188
* | | | ssl: remove a misleading commentKazuki Yamaguchi2017-11-261-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The function ossl_sslctx_session_get_cb(), which is passed to SSL_CTX_sess_set_get_cb(), will never be called on the client-side since it is for the server-side session caching. Reference: https://github.com/ruby/openssl/issues/170
* | | | Merge branch 'ky/fix-ssl-test-internal-encoding'Kazuki Yamaguchi2017-11-261-9/+6
|\| | | | | | | | | | | | | | | | | | | * ky/fix-ssl-test-internal-encoding: test/test_ssl: prevent changing default internal encoding
| * | | test/test_ssl: prevent changing default internal encodingKazuki Yamaguchi2017-11-261-9/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In Ruby tree (not in this tree), assert_raise_with_message uses EnvUtil.with_default_internal which cannot be called simultaneously. The patch was suggested by Yusuke Endoh (mame).
* | | | Ruby/OpenSSL 2.1.0.beta2v2.1.0.beta2ky/release-2.1.0.beta2Kazuki Yamaguchi2017-11-252-6/+29
| | | |
* | | | Merge branch 'maint'Kazuki Yamaguchi2017-11-2512-48/+92
|\ \ \ \ | | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint: History.md: fix a typo x509cert, x509crl, x509req, ns_spki: check sanity of public key pkey: make pkey_check_public_key() non-static test/test_cipher: fix test_non_aead_cipher_set_auth_data failure cipher: disallow setting AAD for non-AEAD ciphers test/test_ssl_session: skip tests for session_remove_cb appveyor.yml: remove 'openssl version' line
| * | | History.md: fix a typoKazuki Yamaguchi2017-11-251-1/+1
| | | |
| * | | Merge pull request #168 from rhenium/ky/pkey-check-sanityKazuki Yamaguchi2017-11-146-28/+38
| |\ \ \ | | | | | | | | | | [Bug #14087] x509cert, x509crl, x509req, ns_spki: check sanity of public key
| | * | | x509cert, x509crl, x509req, ns_spki: check sanity of public keyky/pkey-check-sanityKazuki Yamaguchi2017-11-134-24/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pub_encode routine of an EVP_PKEY_ASN1_METHOD seems to assume the parameters and public key component(s) to be set properly. Calling that, for example, through X509_set_pubkey(), with an incomplete object may cause segfault. Use ossl_pkey_check_public_key() to check that. It doesn't look pretty, but unfortunately there isn't a generic way to do that with the EVP API. Something similar applies to the verify routine of an EVP_PKEY_METHOD. Do the same check before calling *_verify(). Reference: http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/83688 Reference: https://bugs.ruby-lang.org/issues/14087
| | * | | pkey: make pkey_check_public_key() non-staticKazuki Yamaguchi2017-11-112-4/+6
| |/ / / | | | | | | | | | | | | Also make it take const pointer as it never modifies the pkey.
| * | | test/test_cipher: fix test_non_aead_cipher_set_auth_data failureky/cipher-non-aead-auth-dataKazuki Yamaguchi2017-10-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | A follow-up to commit bb10767b0570 ("cipher: disallow setting AAD for non-AEAD ciphers", 2017-10-18). Cipher#auth_data= raises NotImplementedError if built with OpenSSL < 1.0.1.
| * | | cipher: disallow setting AAD for non-AEAD ciphersKazuki Yamaguchi2017-10-182-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | EVP_CipherUpdate() must not be call with the output parameter set to NULL when the cipher does not support AEAD. Check the flag of EVP_CIPHER, and raise an exception as necessary. Reference: http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/83337 Reference: https://bugs.ruby-lang.org/issues/14024
| * | | Merge pull request #159 from rhenium/ky/skip-session-remove-cb-testsKazuki Yamaguchi2017-10-102-18/+44
| |\ \ \ | | | | | | | | | | test/test_ssl_session: skip tests for session_remove_cb
| | * | | test/test_ssl_session: skip tests for session_remove_cbky/skip-session-remove-cb-testsKazuki Yamaguchi2017-10-102-18/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In OpenSSL < 1.1.0, the session_remove_cb callback is called inside the global lock for CRYPTO_LOCK_SSL_CTX which is shared across the entire process, not just for the specific SSL_CTX object. It is possible that the callback releases GVL while the lock for CRYPTO_LOCK_SSL_CTX is held, causing another thread calling an OpenSSL function that tries to acquire the same lock stuck forever. Add a note about the possible deadlock to the docs for SSLContext#session_remove_cb=, and skip the relevant test cases unless the OSSL_TEST_ALL environment variable is set to 1. A deadlock due to this issue is observed: http://ci.rvm.jp/results/trunk-test@frontier/104428
| * | | | appveyor.yml: remove 'openssl version' lineKazuki Yamaguchi2017-10-081-1/+0
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It runs the 'openssl' command line tool that is not of the version used to compile and run the test suite. Thanks to MSP-Greg for pointing this out. Fixes: https://github.com/ruby/openssl/issues/157
* | | | Merge pull request #173 from rhenium/ky/kdf-hkdfKazuki Yamaguchi2017-11-252-0/+140
|\ \ \ \ | | | | | | | | | | kdf: add HKDF support
| * | | | kdf: add HKDF supportky/kdf-hkdfKazuki Yamaguchi2017-11-222-0/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 1.1.0 supports HKDF through the EVP API. Add OpenSSL::KDF.hkdf as a wrapper around that. Reference: https://github.com/ruby/openssl/issues/172
* | | | | Merge branch 'ky/x509-implement-eq'Kazuki Yamaguchi2017-11-222-8/+16
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * ky/x509-implement-eq: test/test_x509crl: fix random failure test/test_x509cert: fix flaky test
| * | | | | test/test_x509crl: fix random failureky/x509-implement-eqKazuki Yamaguchi2017-11-221-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Similarly to the previous one, avoid querying the current time multiple times. Fixes: e4727829837a ("x509crl, x509revoked: implement X509::{CRL,Revoked}#==", 2017-10-12)
| * | | | | test/test_x509cert: fix flaky testKazuki Yamaguchi2017-11-221-5/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specify the notBefore and notAfter fields explicitly to prevent occasional failure. Fixes: 432a9f3455f5 ("x509cert: implement X509::Certificate#==", 2017-10-12)
* | | | | | Merge branch 'ky/ssl-add-certificate'Kazuki Yamaguchi2017-11-224-6/+241
|\ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Merge GitHub Pull Request #167. * ky/ssl-add-certificate: test/test_ssl: fix test_security_level ssl: add SSLContext#add_certificate test/utils: remove a pointless .public_key call in issue_cert test/envutil: port assert_warning from Ruby trunk
| * | | | | | test/test_ssl: fix test_security_levelky/ssl-add-certificateKazuki Yamaguchi2017-11-221-5/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix test_security_level using SSLContext#add_certificate. It immediately sets the certificate to the SSL_CTX, so it is affected by the security level setting.
| * | | | | | ssl: add SSLContext#add_certificateKazuki Yamaguchi2017-11-222-0/+199
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new method to add a certificate, a corresponding private key, and extra CA certificates at once. This has two advantages over the existing {cert,key,extra_cert_chain} attributes: 1. We can notice the problem with the certificate and/or the private key. Since the existing attributes are simple instance variables, they aren't set to the SSL_CTX until #setup which usually happens on the first connection. 2. For the same reason, existing attributes allowed only one certificate for a context, even though OpenSSL itself is capable of handling multiple certificates and selecting the most appropriate one according to the cipher suite selected. The documentation for the existing attributes are updated to recommend using #add_certificate.
| * | | | | | test/utils: remove a pointless .public_key call in issue_certKazuki Yamaguchi2017-11-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | PKey::EC#public_key works differently from other PKey types, making TestUtils.issue_cert unusable for creating ECDSA certificates. Actually, the #public_key does not have any effect on any other PKey types. So just remove it.
| * | | | | | test/envutil: port assert_warning from Ruby trunkKazuki Yamaguchi2017-11-221-0/+23
| | |/ / / / | |/| | | | | | | | | | | | | | | | EnvUtil.verbose_warning used by assert_warning is also ported.
* | | | | | Drop support for LibreSSL 2.4Kazuki Yamaguchi2017-11-222-8/+4
| | | | | | | | | | | | | | | | | | | | | | | | LibreSSL 2.4 reached its EOL in 2017-09.
* | | | | | Merge pull request #169 from rhenium/ky/pkey-rsa-sign-pssKazuki Yamaguchi2017-11-142-0/+225
|\ \ \ \ \ \ | | | | | | | | | | | | | | [v2] Add RSA sign_pss() and verify_pss() methods
| * | | | | | Add RSA sign_pss() and verify_pss() methodsky/pkey-rsa-sign-pssPeter Karman2017-11-132-0/+225
| |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support Probabilistic Signature Scheme for RSA key signing. [ky: the patch was originally submitted as GitHub Pull Request #76. finish keyword arguments handling, update docs, and fix tests.]
* | | | | | Merge pull request #162 from rhenium/ky/ssl-write-multiKazuki Yamaguchi2017-11-132-3/+14
|\ \ \ \ \ \ | | | | | | | | | | | | | | buffering: let #write accept multiple arguments
| * | | | | | buffering: let #write accept multiple argumentsky/ssl-write-multiKazuki Yamaguchi2017-10-232-3/+14
| |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As of Ruby 2.5, IO#write accepts multiple input strings and writes them at once[1]. Follow that. [1] https://bugs.ruby-lang.org/issues/9323
* | | | | | Merge pull request #160 from markwright/masterKazuki Yamaguchi2017-11-048-47/+63
|\ \ \ \ \ \ | | | | | | | | | | | | | | Fix build failure against OpenSSL 1.1 built with no-deprecated
| * | | | | | Fix build failure against OpenSSL 1.1 built with no-deprecatedMark Wright2017-11-048-47/+63
|/ / / / / / | | | | | | | | | | | | | | | | | | Thanks rhenium for the code review and fixes.
* | | | | | Merge pull request #165 from aeris/scsvKazuki Yamaguchi2017-11-042-0/+76
|\ \ \ \ \ \ | | |_|_|/ / | |/| | | | TLS Fallback Signaling Cipher Suite Value
| * | | | | TLS Fallback Signaling Cipher Suite Valueaeris2017-11-032-0/+76
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support for fallback SCSV [RFC 7507](https://tools.ietf.org/html/rfc7507). Expected behaviour is to refuse connection if the client signals a protocol with the fallback flag but the server supports a better one (downgrade attack detection).
* | | | | Merge pull request #161 from rhenium/ky/x509-implement-eqKazuki Yamaguchi2017-10-228-0/+177
|\ \ \ \ \ | | |/ / / | |/| | | x509*: implement ==
| * | | | x509req: implement X509::Request#==Kazuki Yamaguchi2017-10-122-0/+17
| | | | |
| * | | | x509crl, x509revoked: implement X509::{CRL,Revoked}#==Kazuki Yamaguchi2017-10-122-0/+41
| | | | |
| * | | | x509revoked: add missing X509::Revoked#to_derKazuki Yamaguchi2017-10-122-0/+44
| | | | |
| * | | | x509cert: implement X509::Certificate#==Kazuki Yamaguchi2017-10-122-0/+35
| | | | |
| * | | | x509attr: implement X509::Attribute#==Kazuki Yamaguchi2017-10-122-0/+24
| | | | |
| * | | | x509ext: implement X509::Extension#==Kazuki Yamaguchi2017-10-122-0/+16
| |/ / /
* | | | Merge branch 'ky/ssl-version-min-max'Kazuki Yamaguchi2017-10-222-1/+20
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | * ky/ssl-version-min-max: ssl: fix conflict of options in SSLContext#set_params Use caller with length to reduce unused strings
| * | | | ssl: fix conflict of options in SSLContext#set_paramsky/ssl-version-min-maxKazuki Yamaguchi2017-10-222-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make SSLContext#set_params call #options= first. SSLContext#set_params by default disables SSL 2.0 and SSL 3.0 by calling SSLContext#min_version=. After that, it sets the SSL option flags by calling SSLContext#options=. This is problematic when built with OpenSSL before 1.1.0 because SSLContext#min_version= achieves its goal using the SSL_OP_NO_{SSL,TLS}* options. Since the subsequent SSLContext#options= call replaces the flags rather than OR together, this results in effectively disabling min_version setting in SSLContext::DEFAULT_PARAMS. The issue was first fixed in Ruby trunk tree, as part of r60310 ("fix OpenSSL::SSL::SSLContext#min_version doesn't work", 2017-10-21).
| * | | | Use caller with length to reduce unused stringskazu2017-10-221-1/+1
| | | | | | | | | | | | | | | | | | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60288 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-21 06:36:01 +0000