aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* pkcs12: fix .new to handle strucuture with no keys or no certstopic/pkcs12-read-no-private-keyKazuki Yamaguchi2016-09-052-9/+117
| | | | | | | | | | It's possible that a PKCS #12 strucuture holds zero private keys. At such a time PKCS12_parse() returns NULL as the private key. Likewise, when the strucuture does not contain the corresponding certificate to the private key, PKCS12_parse() returns NULL as the certificate. Reported and fix suggested by Masahiro Tomita <tommy@tmtm.org>. [ruby-dev:49776] [Bug #12726]
* Merge branch 'topic/ssl-eliminate-init-vars'Kazuki Yamaguchi2016-09-022-119/+113
|\ | | | | | | | | | | | | * topic/ssl-eliminate-init-vars: ssl: eliminate SSLContext::INIT_VARS ssl: hide callback_state from Ruby ssl: don't store selected {EC,}DH parameter in an instance variable
| * ssl: eliminate SSLContext::INIT_VARStopic/ssl-eliminate-init-varsKazuki Yamaguchi2016-09-022-114/+112
| | | | | | | | | | | | | | | | | | | | | | | | Use rb_attr_get() instead of rb_iv_get() so that we can remove SSLContext::INIT_VARS. SSLContext::INIT_VARS contains the names of the instance variables used in SSLContext. SSLContext#initialize sets nil for those variables. It is necessary to suppress "instance variable @foo not initialized" warnings emitted by rb_iv_get(). The warnings can be avoided by using rb_attr_get() that does not check the existence of the variable. So use it.
| * ssl: hide callback_state from RubyKazuki Yamaguchi2016-09-021-1/+1
| | | | | | | | | | | | | | | | | | Remove '@' prefix from the variable name to hide it from Ruby. Currently a SSLSocket instance allows modifying the value of @callback_state if an user use Object#instance_variable_set. This is dangerous because the variable is used for storing the tag jump state - modifying it from Ruby can crash the process.
| * ssl: don't store selected {EC,}DH parameter in an instance variableKazuki Yamaguchi2016-09-021-4/+0
|/ | | | | | | | The OpenSSL::PKey::{DH,EC} object is stored in an instance variable to prevent the object from being GC'd (cf. r51460). However it turned out to be unnecessary. The underlying object, DH and EC_KEY, have a reference counter and OpenSSL increments it for the object returned by the callback functions.
* test/test_ssl: fix test_alpn_protocol_selection_cancel againKazuki Yamaguchi2016-08-301-2/+2
| | | | | | | | | 's2.connect' can block indefinitely depending on the version of OpenSSL. Since the point of the test case is to check the failure path on ALPN protocol selection callback, that is called on the server side, just avoid blocking with SSLSocket#connect_nonblock on the client side. The callback is called just after receiving the Client Hello so calling SSLSocket#connect_nonblock once should be sufficient.
* ssl: check return value of SSL_CTX_set_alpn_protos()Kazuki Yamaguchi2016-08-301-1/+5
| | | | | | The function can fail on memory allocation error. Note that the function returns 0 on success unlike other almost all functions in OpenSSL.
* ssl: catch exceptions raised in ALPN/NPN callbacksKazuki Yamaguchi2016-08-302-15/+48
| | | | | | | | | | | | | | | They aren't exception safe - they are called during parsing the Client/Server Hello from OpenSSL code. An exception raised in the callbacks escapes directly from OpenSSL code so it can break internal status of OpenSSL. We have a procedure for handling such exceptions raised during an handshake: catch them and store the state number in the SSLSocket object, and then check it in ossl_ssl_start() and re-raise after the control turned back to our side. This fixes the instability of TestSSL::test_alpn_protocol_selection_cancel.
* Merge changes from Ruby trunk r55822..r56028Kazuki Yamaguchi2016-08-291-3/+3
|\ | | | | | | | | | | | | * ruby-trunk r55822..r56028: (1 commits) (r56028) * remove trailing spaces. Sync-with-trunk: r56028
| * * remove trailing spaces.svn2016-08-291-3/+3
|/ | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56028 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Merge pull request #69 from ruby/linkify-historyKazuki Yamaguchi2016-08-291-11/+21
|\ | | | | Linkify History.md for release 2.0.0 [ci skip]
| * Revert "Add #18 to History"Zachary Scott2016-08-291-2/+0
| | | | | | | | This reverts commit 59b22d480400e77109fe5c380f5e057ab857b4fb.
| * Add #18 to HistoryZachary Scott2016-08-291-0/+2
| | | | | | | | /cc #61
| * Missed 2 more links! :bomb: [ci skip]Zachary Scott2016-08-291-2/+4
| |
| * Missed 2 links, and :nail_care: [ci skip]Zachary Scott2016-08-291-15/+16
| |
| * commas [ci skip]Zachary Scott2016-08-291-5/+5
| |
| * Linkify History.md for release 2.0.0 [ci skip]Zachary Scott2016-08-291-7/+14
|/
* Ruby/OpenSSL 2.0.0.beta.1v2.0.0.beta.1Kazuki Yamaguchi2016-08-293-3/+3
|
* test: move test_partial_record_read into test_pair.rbKazuki Yamaguchi2016-08-282-35/+10
| | | | It can make use of ssl_pair. This allows removing 6 secs sleep.
* pkey: use rb_attr_get() instead of rb_iv_get() in ossl_pkey_ec.cKazuki Yamaguchi2016-08-281-24/+29
| | | | | This suppresses runtime warning of "instance variable @group not initialized".
* x509ext: fix X509::ExtensionFactory#create_ext with configKazuki Yamaguchi2016-08-282-9/+17
| | | | | | | The assumption in commit 1b1d520818e0 ("x509ext: fix memory leak in X509::ExtensionFactory#config=") was wrong. The uninitialized X509V3_CTX::db can be referred through "r2i" functions when creating certain types of extension that use them.
* Avoid unnecessary memory allocation in string2hex()Kazuki Yamaguchi2016-08-264-87/+56
| | | | | | | Remove string2hex() and replace with newly added ossl_bin2hex(). Since the output hex string is always returned to users as a String, we can avoid the memory allocation by writing directly to the String buffer. This also reduces some lines of code.
* Fix History link in CONTRIBUTING.mdKazuki Yamaguchi2016-08-261-2/+2
| | | | Follow up commit 7fbfed8cf97b.
* Remove test/mdebugKazuki Yamaguchi2016-08-264-124/+0
| | | | | It was not implemented in a good way - for example it doesn't compile on Windows and causes 'rake compile' to fail... So remove for now.
* Merge branch 'topic/cipher-auth-tag-len'Kazuki Yamaguchi2016-08-263-3/+81
|\ | | | | | | | | * topic/cipher-auth-tag-len: cipher: add Cipher#auth_tag_len=
| * cipher: add Cipher#auth_tag_len=topic/cipher-auth-tag-lenKazuki Yamaguchi2016-08-143-3/+81
| | | | | | | | | | | | Add a method to set the authentication tag length to be generate by an AEAD ciphers. In particular, OCB mode which is implemented in OpenSSL 1.1.0 requires this.
* | test/test_pkey: fix merge conflict errorKazuki Yamaguchi2016-08-261-2/+2
| |
* | Update openssl.gemspecKazuki Yamaguchi2016-08-261-9/+7
| | | | | | | | Add me to authors and cleanup files.
* | Rename History.rdoc to History.mdKazuki Yamaguchi2016-08-261-0/+0
| | | | | | | | It's written in rather Markdown.
* | ocsp: fix error queue leak on OCSP::{BasicResponse,Request}#verifyKazuki Yamaguchi2016-08-261-2/+2
| | | | | | | | | | OCSP_{basic,request}_verify() can return a negative value for verification failure.
* | test/test_ocsp: ignore test failure due to a bug in old OpenSSLKazuki Yamaguchi2016-08-261-1/+11
| | | | | | | | Reference: https://rt.openssl.org/Ticket/Display.html?id=2560
* | test/test_ocsp: cleanupKazuki Yamaguchi2016-08-261-44/+50
| | | | | | | | Remove unnecessary or duplicate assertions, and merge test cases.
* | ocsp: set properly OCSP_NOCERTS flag in OCSP::Request#signKazuki Yamaguchi2016-08-261-7/+9
| | | | | | | | | | | | The variable names 'flg' and 'flags' are mixed up and it doesn't set OCSP_NOCERTS flag correctly when the 'certs' argument is not given. [Bug #12704] [ruby-core:77061]
* | test/test_ocsp: remove broken assertionsKazuki Yamaguchi2016-08-261-2/+0
| | | | | | | | | | The removed assertions are wrong and testing a bug - the verification must fail because OpenSSL shouldn't find the signer's certificate.
* | ruby-openssl-docker: use OpenSSL 1.1.0Kazuki Yamaguchi2016-08-261-2/+2
| |
* | Adapt to OpenSSL changes after the 1.1.0-pre6Kazuki Yamaguchi2016-08-268-39/+67
| | | | | | | | | | | | | | Fix compiler errors and warnings. The order of parameters of X509_{CRL,REQ}_get0_signature() has been changed, and certificate and CRL time accessors have been reorganized: *_get_* functions are deprecated and replaced by *_get0_* that return a const pointer.
* | asn1: constify functionsKazuki Yamaguchi2016-08-264-11/+12
| | | | | | | | In order to avoid compiler warnings when build with OpenSSL 1.1.0.
* | Merge branch 'topic/argument-conversion'Kazuki Yamaguchi2016-08-2211-94/+113
|\ \ | | | | | | | | | | | | | | | | | | | | | * topic/argument-conversion: bn: optimize try_convert_to_bnptr() for non-BN objects Avoid using *2FIX() where we don't know if it really fits in Fixnum pkey: allow non-BN object as the multiplier in PKey::EC::Point#mul cipher: allow cipher name in GetCipherPtr()
| * | bn: optimize try_convert_to_bnptr() for non-BN objectstopic/argument-conversionKazuki Yamaguchi2016-08-221-46/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use the same logic as BN#initialize. It is used through GetBNPtr(). For example, with this change, the following code will be about 7x faster: puts Benchmark.measure { a = 0.to_bn b = 2 ** 2048 i = 0; a + b while (i += 1) <= 1_000_000 }
| * | Avoid using *2FIX() where we don't know if it really fits in FixnumKazuki Yamaguchi2016-08-229-31/+28
| | |
| * | pkey: allow non-BN object as the multiplier in PKey::EC::Point#mulKazuki Yamaguchi2016-08-222-14/+14
| | |
| * | cipher: allow cipher name in GetCipherPtr()Kazuki Yamaguchi2016-08-221-3/+16
|/ / | | | | | | | | | | | | | | | | | | | | | | The function GetCipherPtr() is used when we want a const EVP_CIPHER that represents a cipher algorithm. This change allows users to write a code that exports a PKey encrypted without creating an OpenSSL::Cipher instance: pkey = OpenSSL::PKey.read(...) pkey.export("aes-128-cbc") { password } This is the same as what happened to GetDigestPtr() in r12128.
* | Merge pull request #59 from ruby/topic/doc-workKazuki Yamaguchi2016-08-224-121/+219
|\ \ | | | | | | [WIP] Add NEWS and update CONTRIBUTING.md
| * \ Merge pull request #68 from ruby/contrib-docker-teststopic/doc-workKazuki Yamaguchi2016-08-221-7/+33
| |\ \ | | | | | | | | Fixup Docker and Testing docs
| | * | Varify docker-compose configuration and location of DockerfileZachary Scott2016-08-191-0/+10
| | | |
| | * | Fixup Docker and Testing docsZachary Scott2016-08-191-7/+23
| |/ /
| * | Add instructions for running tests under Docker in CONTRIBUTING.mdKazuki Yamaguchi2016-08-181-2/+20
| | |
| * | Merge pull request #67 from zzak/readme-contrib-docsKazuki Yamaguchi2016-08-172-28/+53
| |\ \ | | | | | | | | Readme contrib docs
| | * | :nail_care: [ci skip]Zachary Scott2016-08-171-2/+2
| | | |
| | * | Fix CONTRIBUTING link [ci skip]Zachary Scott2016-08-171-2/+2
| | | |
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-08 16:24:52 +0000