aboutsummaryrefslogtreecommitdiffstats
path: root/ext/openssl/ossl_pkcs7.c
Commit message (Collapse)AuthorAgeFilesLines
* x509, ssl, pkcs7: try to parse as DER-encoding firstky/parse-der-then-pemKazuki Yamaguchi2021-05-191-11/+9
| | | | | | | | | | | | | | | | | | | Methods that take both PEM-encoding and DER-encoding have not been consistent in the order in which encoding to attempt to parse. A DER-encoding may contain a valid PEM block ("\n-----BEGIN ..-----" to "-----END ...-----") embedded within it. Also, the PEM-encoding parser allows arbitrary data around the PEM block and silently skips it. As a result, attempting to parse data in DER-encoding as PEM-encoding first can incorrectly finds the embedded PEM block instead. This commit ensures that DER encoding will always be attempted before PEM encoding. OpenSSL::X509::Certificate is one of the updated classes. With this, the following will always be true: # obj is an OpenSSL::X509::Certificate obj == OpenSSL::X509::Certificate.new(obj.to_der) obj == OpenSSL::X509::Certificate.new(obj.to_pem)
* pkcs7: keep private key when duplicating PKCS7_SIGNER_INFOky/pkcs7-add-signer-keep-pkey-ptrKazuki Yamaguchi2021-03-241-48/+33
| | | | | | | | | | | | | ASN1_dup() will not copy the 'pkey' field of a PKCS7_SIGNER_INFO object by design; it is a temporary field kept until the PKCS7 structure is finalized. Let's bump reference counter of the pkey in the original object and use it in the new object, too. This commit also removes PKCS7#add_signer's routine to add the content-type attribute as a signed attribute automatically. This behavior was not documented or tested. This change should not break any working user code since the method was completely useless without the change above.
* ts: get tests running/passingBen Toews2019-10-011-16/+1
| | | | | | | A number of conventions seem to have changed, causing a fair bit of breakage: - `Data_*` was deprecated in favor of `TypedData_*` - `ossl_obj2bio` takes a `VALUE*` instead of `VALUE` now - `time_to_time_t()` was removed
* Remove OpenSSL::PKCS7::SignerInfo#nameJeremy Evans2019-08-101-1/+0
| | | | | | | | | | This method name is misleading, because it returns the name of the signer's issuer, not the name of the signing certificate. It is just an alias of issuer, which is more accurate. The "name" method is historical, it was replaced by the "issuer" method in 2005, and since then has been alias for backwards compatibility. Fixes Ruby Bug 8178.
* Merge branch 'maint'Kazuki Yamaguchi2018-08-081-0/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint: x509name: fix handling of X509_NAME_{oneline,print_ex}() return value x509name: refactor OpenSSL::X509::Name#to_s test/test_x509name: change script encoding to ASCII-8BIT reduce LibreSSL warnings openssl_missing.h: constified openssl: search winsock search winsock libraries explicitly no ID cache in Init functions test/test_ssl: fix test failure with TLS 1.3 tool/ruby-openssl-docker: update to latest versions pkey: resume key generation after interrupt
| * Merge branch 'maint-2.0' into maintKazuki Yamaguchi2018-08-081-0/+1
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fix made in 6fcc6c0efc42 ("test/test_ssl: fix test failure with TLS 1.3", 2018-08-06) is applied to the new test cases. * maint-2.0: reduce LibreSSL warnings openssl_missing.h: constified openssl: search winsock search winsock libraries explicitly no ID cache in Init functions test/test_ssl: fix test failure with TLS 1.3 tool/ruby-openssl-docker: update to latest versions pkey: resume key generation after interrupt
| | * no ID cache in Init functionsnobu2018-08-081-0/+1
| | | | | | | | | | | | | | | | | | | | | Init functions are called only once, cache is useless. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62429 b2dd03c8-39d4-4d8f-98ff-823fe69b080e Sync-with-trunk: r62429
* | | pkcs7: allow recipient's certificate to be omitted for PKCS7#decryptky/pkcs7-decrypt-without-recipients-certificateKazuki Yamaguchi2018-01-041-2/+2
|/ / | | | | | | | | | | | | | | The recipient's certificate is not mandatory for PKCS7_decrypt(). Make it possible to call OpenSSL::PKCS7#decrypt with only the private key to match the functionality. Reference: https://github.com/ruby/openssl/issues/182
* | Merge branch 'maint'Kazuki Yamaguchi2017-08-081-7/+7
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint: Ruby/OpenSSL 2.0.5 ssl: fix compile error with OpenSSL 1.0.0 ssl: remove unsupported TLS versions from SSLContext::METHODS Add msys2 library dependency tag in gem metadata ossl_pem_passwd_cb: handle nil from the block explicitly ossl_pem_passwd_cb: do not check for taintedness ossl_pem_passwd_cb: relax passphrase length constraint appveyor.yml: test against Ruby 2.4 Rakefile: install_dependencies: install only when needed bio: do not use the FILE BIO method in ossl_obj2bio() bio: prevent possible GC issue in ossl_obj2bio() test/test_ssl: allow 3DES cipher suites in test_sslctx_set_params
| * bio: prevent possible GC issue in ossl_obj2bio()Kazuki Yamaguchi2017-07-111-7/+7
| | | | | | | | | | | | | | | | | | | | Prevent the new object created by StringValue() from being GCed. Luckily, as none of the callers of ossl_obj2bio() reads from the returned BIO after possible triggering GC, this has not been a real problem. As a bonus, ossl_protect_obj2bio() function which is no longer used anywhere is removed.
* | digest: rename GetDigestPtr() to ossl_evp_get_digestbyname()Kazuki Yamaguchi2017-05-021-1/+1
| | | | | | | | | | Similar to the previous one for GetCipherPtr(), GetDigest() and GetDigestPtr() have been completely different. Let's disambiguate them.
* | cipher: rename GetCipherPtr() to ossl_evp_get_cipherbyname()Kazuki Yamaguchi2017-05-021-2/+2
| | | | | | | | | | | | | | | | While GetCipherPtr() function gets a const EVP_CIPHER * from algorithm name, GetCipher() macro that is locally defined in ext/openssl/ossl_cipher.c gets the EVP_CIPHER_CTX from an OpenSSL::Cipher object. They are completely different things. Rename GetCipherPtr() for disambiguation.
* | Remove SafeGet*() macrosKazuki Yamaguchi2017-05-021-16/+4
| | | | | | | | | | | | They are no longer useful since we use the TypedData_Get_Struct() which also performs type checking (based on the rb_data_type_t) for the non-safe Get*() macros. Just use them instead.
* | Expand rb_define_copy_func() macroKazuki Yamaguchi2017-04-281-1/+1
|/ | | | | It's not really "missing". Let's expand that, as it does not improve the readability so much.
* Avoid using ERR_get_error()Kazuki Yamaguchi2016-10-271-1/+1
| | | | | | | Use ERR_peek_error() which does not remove the fetched error from the queue instead, then clear the queue explicitly with the dedicated function ossl_clear_error(). OpenSSL may put multiple error items to the queue in one function call.
* pkcs7: fix a memory leak in PKCS7#add_dataKazuki Yamaguchi2016-08-161-2/+2
| | | | | The BIO returned by PKCS7_dataInit() must be free'd using BIO_free_all().
* pkcs7: fix a memory leak in PKCS7#verifyKazuki Yamaguchi2016-08-161-4/+4
| | | | | ossl_obj2bio() must be called after other functions that may raise. Also, the variable `x509s` is not free'd when PKCS7_verify() fails.
* Fix RDoc styletopic/rdoc-fixesKazuki Yamaguchi2016-07-091-0/+5
|
* openssl: drop OpenSSL 0.9.6/0.9.7 supportrhe2016-05-311-4/+20
| | | | | | * ext/openssl, test/openssl: Drop OpenSSL < 0.9.8 support. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55162 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: use StringValueCStr() where NUL-terminated string is expectedrhe2016-05-311-2/+3
| | | | | | | | | | | | | | * ext/openssl/ossl_asn1.c, ext/openssl/ossl_bn.c, ext/openssl/ossl_cipher.c, ext/openssl/ossl_digest.c ext/openssl/ossl_engine.c, ext/openssl/ossl_ns_spki.c ext/openssl/ossl_pkcs12.c, ext/openssl/ossl_pkcs7.c ext/openssl/ossl_pkey.c, ext/openssl/ossl_pkey_ec.c ext/openssl/ossl_rand.c, ext/openssl/ossl_ssl.c ext/openssl/ossl_x509attr.c, ext/openssl/ossl_x509cert.c ext/openssl/ossl_x509ext.c, ext/openssl/ossl_x509store.c: Use StringValueCStr() where NUL-terminated string is expected. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55134 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: report errors in OpenSSL error queue when clear itrhe2016-05-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | * ext/openssl/ossl.c (ossl_clear_error): Extracted from ossl_make_error(). This prints errors in the OpenSSL error queue if OpenSSL.debug is true, and clears the queue. (ossl_make_error): use ossl_clear_error(). * ext/openssl/ossl.h: add prototype declaration of ossl_make_error(). (OSSL_BIO_reset) use ossl_clear_error() to clear the queue. Clearing silently makes debugging difficult. * ext/openssl/ossl_engine.c (ossl_engine_s_by_id): ditto. * ext/openssl/ossl_ns_spki.c (ossl_spki_initialize): ditto. * ext/openssl/ossl_pkcs7.c (ossl_pkcs7_verify): ditto. * ext/openssl/ossl_pkey_dsa.c (ossl_dsa_initialize): ditto. * ext/openssl/ossl_pkey_ec.c (ossl_ec_key_initialize): ditto. (ossl_ec_group_initialize): ditto. * ext/openssl/ossl_ssl.c (ossl_ssl_shutdown): ditto. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55050 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Sync with ruby trunkZachary Scott2015-09-231-1/+0
|
* Upstream ruby/ruby@451fe26 from r50673Zachary Scott2015-06-031-14/+28
|
* Apply ruby/ruby@325a50fc572516a171d640765d6ddf9b20be14dc to fix typosZachary Scott2015-05-041-1/+1
| | | | See also r50351 from ruby/ruby#876
* Sync with ruby trunkZachary Scott2015-01-051-6/+48
|
* import ruby trunkSHIBATA Hiroshi2014-10-271-0/+1048
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-24 19:37:34 +0000