aboutsummaryrefslogtreecommitdiffstats
path: root/ext/openssl/ossl_pkey.c
Commit message (Collapse)AuthorAgeFilesLines
* pkey: remove unused ossl_generate_cb_2() helper functionky/pkey-refactor-generateKazuki Yamaguchi2021-04-051-58/+15
| | | | | | The previous series of commits re-implemented key generation with the low level API with the EVP API. The BN_GENCB-based callback function is no longer used.
* pkey: fix interrupt handling in OpenSSL::PKey.generate_keyKazuki Yamaguchi2021-04-051-5/+13
| | | | | | rb_thread_call_without_gvl() can be interrupted, but it may be able to resume the operation. Call rb_thread_check_ints() to see if it raises an exception or not.
* [DOC] Fix RDoc markupNobuhiro IMAI2020-07-291-1/+1
|
* Add compare? method to OpenSSL::PKey that wraps EVP_PKEY_cmp.Colton Jenkins2020-07-141-0/+39
| | | | | | Explicitly check for type given some conflicting statements within openssl's documentation around EVP_PKEY_cmp and EVP_PKEY_ASN1_METHOD(3). Add documentation with an example for compare?
* Merge pull request #329 from rhenium/ky/pkey-generic-operationsKazuki Yamaguchi2020-05-131-43/+366
|\ | | | | pkey: add more support for 'generic' pkey types
| * pkey: add PKey::PKey#deriveKazuki Yamaguchi2020-05-131-0/+52
| | | | | | | | | | | | Add OpenSSL::PKey::PKey#derive as the wrapper for EVP_PKEY_CTX_derive(). This is useful for pkey types that we don't have dedicated classes, such as X25519.
| * pkey: support 'one-shot' signing and verificationKazuki Yamaguchi2020-05-131-0/+30
| | | | | | | | | | | | OpenSSL 1.1.1 added EVP_DigestSign() and EVP_DigestVerify() functions to the interface. Some EVP_PKEY methods such as PureEdDSA algorithms do not support the streaming mechanism and require us to use them.
| * pkey: port PKey::PKey#sign and #verify to the EVP_Digest* interfaceKazuki Yamaguchi2020-05-131-39/+51
| | | | | | | | | | | | | | | | | | Use EVP_DigestSign*() and EVP_DigestVerify*() interface instead of the old EVP_Sign*() and EVP_Verify*() functions. They were added in OpenSSL 1.0.0. Also, allow the digest to be specified as nil, as certain EVP_PKEY types don't expect a digest algorithm.
| * pkey: add PKey.generate_parameters and .generate_keyKazuki Yamaguchi2020-05-131-0/+222
| | | | | | | | | | Add two methods to create a PKey using the generic EVP interface. This is useful for the PKey types we don't have a dedicated class.
| * pkey: assume generic PKeys contain private componentsKazuki Yamaguchi2020-05-131-4/+11
| | | | | | | | | | | | The EVP interface cannot tell whether if a pkey contains the private components or not. Assume it does if it does not respond to #private?. This fixes the NoMethodError on calling #sign on a generic PKey.
* | pkey: refactor #export/#to_pem and #to_derky/pkey-refactor-serializationKazuki Yamaguchi2020-05-131-4/+50
| | | | | | | | | | Add ossl_pkey_export_traditional() and ossl_pkey_export_spki() helper functions, and use them. This reduces code duplication.
* | pkey: refactor DER/PEM-encoded string parsing codeKazuki Yamaguchi2020-05-131-25/+32
| | | | | | | | | | Export the flow used by OpenSSL::PKey.read and let the subclasses call it before attempting other formats.
* | pkey: have PKey.read parse PEM-encoded DHParameterKazuki Yamaguchi2020-05-131-0/+3
| | | | | | | | | | Try PEM_read_bio_Parameters(). Only PEM format is supported at the moment since corresponding d2i_* functions are not provided by OpenSSL.
* | pkey: simplify ossl_pkey_new()Kazuki Yamaguchi2020-05-131-13/+9
|/ | | | | | ossl_{rsa,dsa,dh,ec}_new() called from this function are not used anywhere else. Inline them into pkey_new0() and reduce code duplication.
* pkey: add PKey#inspect and #oidKazuki Yamaguchi2020-04-211-0/+38
| | | | | | | | | | | Implement OpenSSL::PKey::PKey#oid as a wrapper around EVP_PKEY_id(). This allows user code to check the type of a PKey object. EVP_PKEY can have a pkey type for which we do not provide a dedicated subclass. In other words, an EVP_PKEY that is not any of {RSA,DSA,DH,EC} can exist. It is currently not possible to distinguish such a pkey. Also, implement PKey#inspect to include the key type for convenience.
* Look up digest by name instead of constantBart de Water2020-04-211-2/+2
|
* pkey: add support for PKCS #8 key serializationKazuki Yamaguchi2019-11-251-12/+140
| | | | | | | | | | | | OpenSSL::PKey::PKey#private_to_der, #private_to_pem are added to the generic PKey class. They serialize the private key to PKCS #8 {Encrypted,}PrivateKeyInfo format, in DER- and PEM- encoding, respectively. For symmetry, also add #public_to_der and #public_to_pem that serialize the public key into X.509 SubjectPublicKeyInfo format. OpenSSL::PKey.read now reads DER-encoded PKCS #8 keys as well as the "raw" private keys. PEM-encoded PKCS #8 keys have been already handled by PEM_read_bio_PrivateKey().
* Merge branch 'maint-2.0' into maintKazuki Yamaguchi2018-08-081-3/+26
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fix made in 6fcc6c0efc42 ("test/test_ssl: fix test failure with TLS 1.3", 2018-08-06) is applied to the new test cases. * maint-2.0: reduce LibreSSL warnings openssl_missing.h: constified openssl: search winsock search winsock libraries explicitly no ID cache in Init functions test/test_ssl: fix test failure with TLS 1.3 tool/ruby-openssl-docker: update to latest versions pkey: resume key generation after interrupt
| * Merge pull request #205 from rhenium/ky/pkey-generate-interrupt-resumeKazuki Yamaguchi2018-08-081-3/+25
| |\ | | | | | | pkey: resume key generation after interrupt [Bug #14882]
| | * pkey: resume key generation after interruptky/pkey-generate-interrupt-resumeKazuki Yamaguchi2018-07-271-3/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Key/parameter generation (OpenSSL::PKey::*.{new,generate}) immediately aborts when it is done with GVL released (in other words, no block is given) and the thread is interrupted (e.g., by a signal) during the operation. Have ossl_generate_cb_2() acquire GVL and call rb_thread_check_ints() if needed to process the pending interrupt rather than abort the operation completely by returning 0. Reference: https://bugs.ruby-lang.org/issues/14882
| * | no ID cache in Init functionsnobu2018-08-081-0/+1
| |/ | | | | | | | | | | | | Init functions are called only once, cache is useless. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62429 b2dd03c8-39d4-4d8f-98ff-823fe69b080e Sync-with-trunk: r62429
* | Merge branch 'maint'Kazuki Yamaguchi2017-11-251-4/+5
|\| | | | | | | | | | | | | | | | | | | | | * maint: History.md: fix a typo x509cert, x509crl, x509req, ns_spki: check sanity of public key pkey: make pkey_check_public_key() non-static test/test_cipher: fix test_non_aead_cipher_set_auth_data failure cipher: disallow setting AAD for non-AEAD ciphers test/test_ssl_session: skip tests for session_remove_cb appveyor.yml: remove 'openssl version' line
| * pkey: make pkey_check_public_key() non-staticKazuki Yamaguchi2017-11-111-4/+5
| | | | | | | | Also make it take const pointer as it never modifies the pkey.
* | Merge branch 'maint'Kazuki Yamaguchi2017-08-081-1/+1
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint: Ruby/OpenSSL 2.0.5 ssl: fix compile error with OpenSSL 1.0.0 ssl: remove unsupported TLS versions from SSLContext::METHODS Add msys2 library dependency tag in gem metadata ossl_pem_passwd_cb: handle nil from the block explicitly ossl_pem_passwd_cb: do not check for taintedness ossl_pem_passwd_cb: relax passphrase length constraint appveyor.yml: test against Ruby 2.4 Rakefile: install_dependencies: install only when needed bio: do not use the FILE BIO method in ossl_obj2bio() bio: prevent possible GC issue in ossl_obj2bio() test/test_ssl: allow 3DES cipher suites in test_sslctx_set_params
| * bio: prevent possible GC issue in ossl_obj2bio()Kazuki Yamaguchi2017-07-111-1/+1
| | | | | | | | | | | | | | | | | | | | Prevent the new object created by StringValue() from being GCed. Luckily, as none of the callers of ossl_obj2bio() reads from the returned BIO after possible triggering GC, this has not been a real problem. As a bonus, ossl_protect_obj2bio() function which is no longer used anywhere is removed.
* | digest: rename GetDigestPtr() to ossl_evp_get_digestbyname()Kazuki Yamaguchi2017-05-021-2/+2
| | | | | | | | | | Similar to the previous one for GetCipherPtr(), GetDigest() and GetDigestPtr() have been completely different. Let's disambiguate them.
* | Remove SafeGet*() macrosKazuki Yamaguchi2017-05-021-3/+3
| | | | | | | | | | | | They are no longer useful since we use the TypedData_Get_Struct() which also performs type checking (based on the rb_data_type_t) for the non-safe Get*() macros. Just use them instead.
* | Fix RDoc markuptopic/fix-rdoc-markupKazuki Yamaguchi2017-02-241-11/+11
| | | | | | | | | | Ruby core uses _str_ for emphasizing argument names and +str+ for codes. Match with the rule for better rendering.
* | Remove support for OpenSSL 0.9.8 and 1.0.0topic/drop-openssl-098-and-100Kazuki Yamaguchi2016-12-221-1/+1
|/ | | | | | | | | | They are no longer receiving security updates from the OpenSSL development team since 2015-12. We have kept basic compatibility until now because RHEL 5 still uses an (heavily modified) OpenSSL 0.9.8e. The RHEL 5 will reach EOL on 2017-03, thus it is now safe to assume nobody is still using such old versions of OpenSSL.
* pkey: allow instantiating OpenSSL::PKey::PKey with unsupported key typeKazuki Yamaguchi2016-12-211-5/+10
| | | | | | | | | | Fix 'unsupported key type' error if OpenSSL::SSL::SSLSocket#tmp_key is called when X25519 is used for key exchange. EVP_PKEY may have a key type that we don't have have a dedicated subclass. Let's allow instantiating OpenSSL::PKey::PKey with such an EVP_PKEY, although the resulting instance is not so useful because it can't be exported at the moment.
* pkey: fix possible memory leak in ossl_pkey_new()Kazuki Yamaguchi2016-10-161-6/+19
| | | | | | The ownership of the EVP_PKEY object given as the argument is moved to ossl_pkey_new(). So, the function must not raise an exception without freeing it on failure.
* pkey: remove unused ossl_pkey_new_from_file() functionKazuki Yamaguchi2016-10-161-21/+0
| | | | | | The function was added by e10f4de2aeec ("for compatibility with old SSLSocket", 2001-11-16) and is no longer used since 902312feaae7 (2002-12-22).
* pkey: fix possible memory leak in PKey#verifyKazuki Yamaguchi2016-10-151-2/+3
| | | | | | Fix a possible memory leak that happens when the given signature is too long for int. Check that the signature length can be represented in int before allocating EVP_MD_CTX.
* pkey: add missing return value check in PKey#{sign,verify}Kazuki Yamaguchi2016-10-141-8/+18
| | | | | | | We are currently not checking the return value of EVP_{Sign,Verify}*() functions, but of course, this is a bad habit. So do check. Calls for EVP_{Sign,Verify}Init() are replaced by *_ex() functions as they does not return error but just ignore.
* pkey: tighten buffer size for signatureKazuki Yamaguchi2016-10-141-1/+1
| | | | | | | We allocate too large buffer for the generated signature. The resulting signature, or the RSA encryption result, should not be larger than the size returned by EVP_PKEY_size() (or, DSA_size(), RSA_size(), and ECDSA_size()).
* pkey: make PKey#verify check the existence of the public keyKazuki Yamaguchi2016-09-231-0/+40
| | | | | | | | | | | | Check existence of the public key in the PKey object before starting verifying a signature. For RSA keys, EVP_VerifyFinal() internally calls RSA_size(), which requires the existence of RSA::n. Since we allow instatiating PKey::RSA without any key materials, calling PKey#verify against an empty PKey::RSA causes segfault. Reference: https://bugs.ruby-lang.org/issues/12783
* pkey: fixup documentKazuki Yamaguchi2016-08-221-3/+6
|
* pkey: clear OpenSSL error queue on PKey::PKey#verify failuretopic/pkey-rsa-verify-error-queueKazuki Yamaguchi2016-08-171-0/+1
| | | | | Similar to 0789643d7333 or 9af69abcec15, EVP_VerifyFinal() may put an error to the error queue when the verification failed.
* Merge branch 'topic/ssl-check-pkey-private'Kazuki Yamaguchi2016-07-201-18/+2
|\ | | | | | | | | | | | | * topic/ssl-check-pkey-private: ssl: reject keys without private components ssl: remove unneeded instance variable x509 and key from SSL::SSLSocket pkey: remove unused things
| * pkey: remove unused thingsKazuki Yamaguchi2016-07-031-18/+2
| | | | | | | | | | Make id_private_q local to ossl_pkey.c, and remove unused DupPrivPKeyPtr() function.
* | Merge pull request #55 from rhenium/topic/pkey-read-pkey-errorKazuki Yamaguchi2016-07-101-1/+2
|\ \ | | | | | | Make PKey.read raise PKey::PKeyError rather than ArgumentError
| * | pkey: make PKey.read raise PKey::PKeyError rather than ArgumentErrortopic/pkey-read-pkey-errorKazuki Yamaguchi2016-07-091-1/+2
| |/ | | | | | | | | | | | | | | PKey.read is a generic method to load an arbitrary PKey structure from a PEM or DER encoded String. Each PKey classes's constructor also can load from a String, but the behavior on error is different. While they raises its own exception (are subclasses of PKey::PKeyError), PKey.read raises ArgumentError. [Bug #11774]
* / Fix RDoc styletopic/rdoc-fixesKazuki Yamaguchi2016-07-091-4/+5
|/
* openssl: adapt to OpenSSL 1.1.0 opaque structsrhe2016-06-091-13/+24
| | | | | | | | | | | | | | | * ext/openssl/extconf.rb: Check existence of accessor functions that don't exist in OpenSSL 0.9.8. OpenSSL 1.1.0 made most of its structures opaque and requires use of these accessor functions. [ruby-core:75225] [Feature #12324] * ext/openssl/openssl_missing.[ch]: Implement them if missing. * ext/openssl/ossl*.c: Use these accessor functions. * test/openssl/test_hmac.rb: Add missing test for HMAC#reset. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55287 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: adapt OpenSSL::PKey to OpenSSL 1.1.0 opaque structsrhe2016-06-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | * ext/openssl/openssl_missing.[ch]: Implement EVP_PKEY_get0_*() and {RSA,DSA,EC_KEY,DH}_get0_*() functions. OpenSSL 1.1.0 makes EVP_PKEY/RSA/DSA/DH opaque. We used to provide setter methods for each parameter of each PKey type, for example PKey::RSA#e=, but this is no longer possible because the new API RSA_set0_key() requires the 'n' at the same time. This commit adds deprecation warning to them and adds PKey::*#set_* methods as direct wrapper for those new APIs. For example, 'rsa.e = 3' now needs to be rewritten as 'rsa.set_key(rsa.n, 3, rsa.d)'. [ruby-core:75225] [Feature #12324] * ext/openssl/ossl_pkey*.[ch]: Use the new accessor functions. Implement RSA#set_{key,factors,crt_params}, DSA#set_{key,pqg}, DH#set_{key,pqg}. Emit a warning with rb_warning() when old setter methods are used. * test/drb/ut_array_drbssl.rb, test/drb/ut_drb_drbssl.rb, test/rubygems/test_gem_remote_fetcher.rb: Don't set a priv_key for DH object that are used in tmp_dh_callback. Generating a new key pair every time should be fine - actually the private exponent is ignored in OpenSSL >= 1.0.2f/1.0.1r even if we explicitly set. https://www.openssl.org/news/secadv/20160128.txt git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55285 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: support OpenSSL 1.1.0's new multi-threading APIrhe2016-06-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | * ext/openssl/extconf.rb: Check absence of CRYPTO_lock() to see if the OpenSSL has the new threading API. In OpenSSL <= 1.0.2, an application had to set locking callbacks to use OpenSSL in a multi-threaded environment. OpenSSL 1.1.0 now finds pthreads or Windows threads so we don't need to do something special. [ruby-core:75225] [Feature #12324] Also check existence of *_up_ref(). Some structures in OpenSSL have a reference counter. We used to increment it with CRYPTO_add() which is a part of the old API. * ext/openssl/openssl_missing.h: Implement *_up_ref() if missing. * ext/openssl/ossl.c: Don't set locking callbacks if unneeded. * ext/openssl/ossl_pkey.c, ext/openssl/ossl_ssl.c, ext/openssl/ossl_x509cert.c, ext/openssl/ossl_x509crl.c, ext/openssl/ossl_x509store.c: Use *_up_ref() instead of CRYPTO_add(). git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55283 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: drop OpenSSL 0.9.6/0.9.7 supportrhe2016-05-311-15/+0
| | | | | | * ext/openssl, test/openssl: Drop OpenSSL < 0.9.8 support. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55162 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: use StringValueCStr() where NUL-terminated string is expectedrhe2016-05-311-2/+2
| | | | | | | | | | | | | | * ext/openssl/ossl_asn1.c, ext/openssl/ossl_bn.c, ext/openssl/ossl_cipher.c, ext/openssl/ossl_digest.c ext/openssl/ossl_engine.c, ext/openssl/ossl_ns_spki.c ext/openssl/ossl_pkcs12.c, ext/openssl/ossl_pkcs7.c ext/openssl/ossl_pkey.c, ext/openssl/ossl_pkey_ec.c ext/openssl/ossl_rand.c, ext/openssl/ossl_ssl.c ext/openssl/ossl_x509attr.c, ext/openssl/ossl_x509cert.c ext/openssl/ossl_x509ext.c, ext/openssl/ossl_x509store.c: Use StringValueCStr() where NUL-terminated string is expected. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55134 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: improve handling of password for encrypted PEMrhe2016-05-311-15/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * ext/openssl/ossl.c (ossl_pem_passwd_value): Added. Convert the argument to String with StringValue() and validate the length is in 4..PEM_BUFSIZE. PEM_BUFSIZE is a macro defined in OpenSSL headers. (ossl_pem_passwd_cb): When reading/writing encrypted PEM format, we used to pass the password to PEM_def_callback() directly but it was problematic. It is not NUL character safe. And surprisingly, it silently truncates the password to 1024 bytes. [GH ruby/openssl#51] * ext/openssl/ossl.h: Add function prototype declaration of newly added ossl_pem_passwd_value(). * ext/openssl/ossl_pkey.c (ossl_pkey_new_from_data): Use ossl_pem_passwd_value() to validate the password String. * ext/openssl/ossl_pkey_dsa.c (ossl_dsa_initialize, ossl_dsa_export): ditto. * ext/openssl/ossl_pkey_ec.c (ossl_ec_key_initialize, ossl_ec_key_to_string): ditto. * ext/openssl/ossl_pkey_rsa.c (ossl_rsa_initialize, ossl_rsa_export): ditto. * test/openssl/test_pkey_{dsa,ec,rsa}.rb: test this. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55087 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Fix typo on OpenSSL::PKey doc [ci skip]nobu2016-05-311-1/+1
| | | | | | | * ext/openssl/ossl_pkey.c (Init_ossl_pkey): [DOC] Fix typo "encrypted" to "decrypted". [Fix GH-1235] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@53723 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-01 15:01:31 +0000