aboutsummaryrefslogtreecommitdiffstats
path: root/ext/openssl/ossl_ocsp.c
Commit message (Collapse)AuthorAgeFilesLines
* Fix typos [ci skip]Nobuyoshi Nakada2021-11-031-1/+1
|
* Fix some typos [ci skip]Ryuta Kamizono2021-04-261-2/+2
|
* require OpenSSL >= 1.0.2 and LibreSSL >= 3.1Kazuki Yamaguchi2021-04-041-48/+0
| | | | | | | | | | | | | | | | | | | | Clean up old version guards in preparation for the upcoming OpenSSL 3.0 support. OpenSSL 1.0.1 reached its EOL on 2016-12-31. At that time, we decided to keep 1.0.1 support because many major Linux distributions were still shipped with 1.0.1. Now, nearly 4 years later, most Linux distributions are reaching their EOL and it should be safe to assume nobody uses them anymore. Major ones that were using 1.0.1: - Ubuntu 14.04 is EOL since 2019-04-30 - RHEL 6 will reach EOL on 2020-11-30 LibreSSL 3.0 and older versions are no longer supported by the LibreSSL team as of October 2020. Note that OpenSSL 1.0.2 also reached EOL on 2019-12-31 and 1.1.0 also did on 2018-08-31.
* Look up digest by name instead of constantBart de Water2020-04-211-1/+1
|
* modify the document about `CertificateId.new`thekuwayama2019-12-021-1/+3
|
* add/update document about AuthorityInfoAccessthekuwayama2019-11-191-9/+2
| | | | add ca_issuer_uris and ocsp_uris description to the changelog
* Merge branch 'topic/asn1-overhaul'Kazuki Yamaguchi2017-07-231-1/+7
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * topic/asn1-overhaul: asn1: do not treat EOC octets as part of content octets asn1: prevent EOC octets from being in the middle of the content asn1: harmonize OpenSSL::ASN1::*#to_der asn1: clean up OpenSSL::ASN1::Constructive#to_der asn1: use ossl_asn1_tag() asn1: allow tag number to be >= 32 for universal tag class asn1: prohibit indefinite length form for primitive encoding asn1: allow constructed encoding with definite length form asn1: avoid truncating OID in OpenSSL::ASN1::ObjectId#oid asn1: disallow NULL to be passed to asn1time_to_time() asn1: check for illegal 'unused_bits' value of BitString asn1: initialize 'unused_bits' attribute of BitString with 0 asn1: require tag information when instantiating generic type asn1: remove an unnecessary function prototype asn1: rearrange tests asn1: infinite length -> indefinite length
| * asn1: disallow NULL to be passed to asn1time_to_time()Kazuki Yamaguchi2017-07-231-1/+7
| | | | | | | | Let the callers check the validity of the ASN1_TIME.
* | ocsp: add OpenSSL::OCSP::Request#signed?topic/ocsp-request-is-signedKazuki Yamaguchi2017-06-191-0/+20
|/ | | | | | Add a method to check whether the OpenSSL::OCSP::Request is signed or not. Currently there is no way to distinguish them except inspecting DER encoding or parsing verification error message.
* digest: rename GetDigestPtr() to ossl_evp_get_digestbyname()Kazuki Yamaguchi2017-05-021-3/+3
| | | | | Similar to the previous one for GetCipherPtr(), GetDigest() and GetDigestPtr() have been completely different. Let's disambiguate them.
* Remove SafeGet*() macrosKazuki Yamaguchi2017-05-021-31/+11
| | | | | | They are no longer useful since we use the TypedData_Get_Struct() which also performs type checking (based on the rb_data_type_t) for the non-safe Get*() macros. Just use them instead.
* Merge branch 'topic/expand-ruby-missing-h'Kazuki Yamaguchi2017-04-281-5/+5
|\ | | | | | | | | | | * topic/expand-ruby-missing-h: Expand FPTR_TO_FD() macro Expand rb_define_copy_func() macro
| * Expand rb_define_copy_func() macroKazuki Yamaguchi2017-04-281-5/+5
| | | | | | | | | | It's not really "missing". Let's expand that, as it does not improve the readability so much.
* | Fix RDoc markuptopic/fix-rdoc-markupKazuki Yamaguchi2017-02-241-40/+39
|/ | | | | Ruby core uses _str_ for emphasizing argument names and +str+ for codes. Match with the rule for better rendering.
* Avoid unnecessary memory allocation in string2hex()Kazuki Yamaguchi2016-08-261-8/+8
| | | | | | | Remove string2hex() and replace with newly added ossl_bin2hex(). Since the output hex string is always returned to users as a String, we can avoid the memory allocation by writing directly to the String buffer. This also reduces some lines of code.
* ocsp: fix error queue leak on OCSP::{BasicResponse,Request}#verifyKazuki Yamaguchi2016-08-261-2/+2
| | | | | OCSP_{basic,request}_verify() can return a negative value for verification failure.
* ocsp: set properly OCSP_NOCERTS flag in OCSP::Request#signKazuki Yamaguchi2016-08-261-7/+9
| | | | | | The variable names 'flg' and 'flags' are mixed up and it doesn't set OCSP_NOCERTS flag correctly when the 'certs' argument is not given. [Bug #12704] [ruby-core:77061]
* Adapt to OpenSSL changes after the 1.1.0-pre6Kazuki Yamaguchi2016-08-261-2/+2
| | | | | | | Fix compiler errors and warnings. The order of parameters of X509_{CRL,REQ}_get0_signature() has been changed, and certificate and CRL time accessors have been reorganized: *_get_* functions are deprecated and replaced by *_get0_* that return a const pointer.
* x509ext: remove unnecessary DupX509ExtPtr()Kazuki Yamaguchi2016-08-161-3/+1
| | | | All usages can be replaced with GetX509ExtPtr().
* ocsp: fix memory leak in Response#add_cerid on error pathKazuki Yamaguchi2016-08-161-3/+8
| | | | OCSP_CERTID can leak in case OCSP_request_add0_id() fails.
* Merge branch 'topic/rdoc-fixes'Kazuki Yamaguchi2016-07-091-0/+5
|\ | | | | | | | | | | | | * topic/rdoc-fixes: Fix RDoc style Update .gitignore Add RDoc task to Rakefile
| * Fix RDoc styletopic/rdoc-fixesKazuki Yamaguchi2016-07-091-0/+5
| |
* | ocsp: add workaround for OCSP_basic_verify() bugtopic/ocsp-basic-verify-bugKazuki Yamaguchi2016-07-081-0/+48
|/ | | | | | | | | | | | | | | | | | | | | | Older versions of OpenSSL have a bug that it doesn't use the certificates passed to OCSP_basic_verify() for verifying the chain. This can be a problem when the response is signed by a certificate issued by an intermediate CA. root_ca | intermediate_ca |-------------| end_entity ocsp_signer When the certificate hierarchy is like this, and the response contains only ocsp_signer certificate, the following code wrongly fails. store = OpenSSL::X509::Store.new; store.add_cert(root_ca) basic_response.verify([intermediate_ca], store) So duplicate the OCSP_BASICRESP and add the certificates to the embedded list first.
* openssl: fix for OpenSSL 1.0.0trhe2016-06-291-24/+34
| | | | | | | * ext/openssl/ossl_ocsp.c: The "reuse" behavior of d2i_ functions does not work well with OpenSSL 1.0.0t. So avoid it. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55538 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: add OpenSSL::OCSP::SingleResponserhe2016-06-191-19/+426
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * ext/openssl/ossl_ocsp.c: Add OCSP::SingleResponse that represents an OCSP SingleResponse structure. Also add two new methods #responses and #find_response to OCSP::BasicResponse. A BasicResponse has one or more SingleResponse. We have OCSP::BasicResponse#status that returns them as an array of arrays, each containing the content of a SingleResponse, but this is not useful. When validating an OCSP response, we need to look into the each SingleResponse and check their validity but it is not simple. For example, when validating for a certificate 'cert', the code would be like: # certid_target is an OpenSSL::OCSP::CertificateId for cert basic = res.basic result = basic.status.any? do |ary| ary[0].cmp(certid_target) && ary[4] <= Time.now && (!ary[5] || Time.now <= ary[5]) end Adding OCSP::SingleResponse at the same time allows exposing OCSP_check_validity(). With this, the code above can be rewritten as: basic = res.basic single = basic.find_response(certid_target) result = single.check_validity * test/openssl/test_ocsp.rb: Test this. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55457 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: allow passing absolute times in OCSP::BasicResponse#add_statusrhe2016-06-191-31/+58
| | | | | | | | | | | | | | | | | * ext/openssl/ossl_ocsp.c (ossl_ocspbres_add_status): Allow specifying the times (thisUpdate, nextUpdate and revocationTime) with Time objects. Currently they accepts only relative seconds from the current time. This is inconvenience, especially for revocationTime. When Integer is passed, they are still treated as relative times. Since the type check is currently done with rb_Integer(), this is a slightly incompatible change. Hope no one passes a relative time as String or Time object... Also, allow passing nil as nextUpdate. It is optional. * ext/openssl/ruby_missing.h: Define RB_INTEGER_TYPE_P() if not defined. openssl gem will be released before Ruby 2.4.0. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55456 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: implement initialize_copy for OpenSSL::OCSP::*rhe2016-06-191-0/+80
| | | | | | | | | | * ext/openssl/ossl_ocsp.c: Implement OCSP::{CertificateId,Request, BasicResponse,Response}#initialize_copy. [ruby-core:75504] [Bug #12381] * test/openssl/test_ocsp.rb: Test them. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55455 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: refactor OpenSSL::OCSP::*#verifyrhe2016-06-191-16/+18
| | | | | | | | | | * ext/openssl/ossl_ocsp.c (ossl_ocspreq_verify, ossl_ocspbres_verify): Use ossl_clear_error() so that they don't print warnings to stderr and leak errors in the OpenSSL error queue. Also, check the return value of OCSP_*_verify() correctly. They can return -1 on verification failure. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55423 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: allow specifying hash algorithm in OCSP::*#signrhe2016-06-191-36/+52
| | | | | | | | | | | | * ext/openssl/ossl_ocsp.c (ossl_ocspreq_sign, ossl_ocspbres_sign): Allow specifying hash algorithm used in signing. They are hard coded to use SHA-1. Based on a patch provided by Tim Shirley <tidoublemy@gmail.com>. [ruby-core:70915] [Feature #11552] [GH ruby/openssl#28] * test/openssl/test_ocsp.rb: Test sign-verify works. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55422 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: add some accessor methods for OCSP::CertificateIdrhe2016-06-191-4/+79
| | | | | | | | | | | | | * ext/openssl/ossl_ocsp.c (ossl_ocspcid_get_issuer_name_hash, ossl_ocspcid_get_issuer_key_hash, ossl_ocspcid_get_hash_algorithm): Add accessor methods OCSP::CertificateId#issuer_name_hash, #issuer_key_hash, #hash_algorithm. Based on a patch provided by Paul Kehrer <paul.l.kehrer@gmail.com>. [ruby-core:48062] [Feature #7181] * test/openssl/test_ocsp.rb: Test these new methods. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55411 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: add missing #to_der to OCSP::{CertificateId,BasicResponse}rhe2016-06-191-16/+94
| | | | | | | | | | | | | | | | | | | * ext/openssl/ossl_ocsp.c (ossl_ocspbres_to_der, ossl_ocspcid_to_der): Implement #to_der methods for OCSP::BasicResponse and OCSP::CertificateId. (ossl_ocspreq_initialize, ossl_ocspres_initialize): Use GetOCSP*() instead of raw DATA_PTR(). (ossl_ocspbres_initialize, ossl_ocspcid_initialize): Allow initializing from DER string. (Init_ossl_ocsp): Define new #to_der methods. * test/openssl/test_ocsp.rb: Test these changes. Also add missing tests for OCSP::{Response,Request}#to_der. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55409 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: adapt to OpenSSL 1.1.0 opaque structsrhe2016-06-091-4/+6
| | | | | | | | | | | | | | | * ext/openssl/extconf.rb: Check existence of accessor functions that don't exist in OpenSSL 0.9.8. OpenSSL 1.1.0 made most of its structures opaque and requires use of these accessor functions. [ruby-core:75225] [Feature #12324] * ext/openssl/openssl_missing.[ch]: Implement them if missing. * ext/openssl/ossl*.c: Use these accessor functions. * test/openssl/test_hmac.rb: Add missing test for HMAC#reset. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55287 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: drop OpenSSL 0.9.6/0.9.7 supportrhe2016-05-311-2/+2
| | | | | | * ext/openssl, test/openssl: Drop OpenSSL < 0.9.8 support. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55162 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Merge trunk upstreamZachary Scott2015-11-131-4/+4
|
* Sync with ruby trunkZachary Scott2015-09-231-3/+2
|
* Upstream ruby/ruby@451fe26 from r50673Zachary Scott2015-06-031-17/+32
|
* Apply ruby/ruby@325a50fc572516a171d640765d6ddf9b20be14dc to fix typosZachary Scott2015-05-041-1/+1
| | | | See also r50351 from ruby/ruby#876
* Sync with ruby trunkZachary Scott2015-01-051-8/+64
|
* import ruby trunkSHIBATA Hiroshi2014-10-271-0/+1188
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-27 22:26:49 +0000