aboutsummaryrefslogtreecommitdiffstats
path: root/ext/openssl/ossl_pkey_ec.c
Commit message (Collapse)AuthorAgeFilesLines
* require Ruby 2.6 or laterky/require-ruby-2.6Kazuki Yamaguchi2021-10-161-3/+0
| | | | | | | | Drop support for Ruby 2.3, 2.4, and 2.5. As of 2021-10, Ruby 2.6 is the oldest version that still receives security fixes from the Ruby core team, so it doesn't make much sense to keep code for those ancient versions.
* Merge pull request #456 from ruby/compilation-warningsKazuki Yamaguchi2021-09-121-0/+2
|\ | | | | Suppress compilation warnings
| * Add fallthrough commentsNobuyoshi Nakada2021-09-121-0/+2
| |
* | Suppress printf format warningsNobuyoshi Nakada2021-09-121-2/+4
|/ | | | | | * Add `printf` format attribute to `ossl_raise`. * Fix a format specifier in `config_load_bio`. * Use `ASSUME` for the unreachable condition.
* Fix -Wundef warnings in core extensionsBenoit Daloze2021-05-251-1/+1
| | | | | | * See [Feature #17752] (cherry picked from commit ruby/ruby@59a92a84c8145c3dffd9f2a0e570dbc61211c86c)
* pkey/ec: refactor EC#dsa_{sign,verify}_asn1 with PKey#{sign,verify}_rawKazuki Yamaguchi2021-05-251-55/+0
| | | | | | With the newly added OpenSSL::PKey::PKey#{sign,verify}_raw, OpenSSL::PKey::EC's low level signing operation methods can be implemented in Ruby. The definitions are now in lib/openssl/pkey.rb.
* pkey/dh, pkey/ec: use EVP_PKEY_check() familyky/pkey-generic-evp-moreKazuki Yamaguchi2021-04-151-4/+19
| | | | | | | | | Use EVP_PKEY_param_check() instead of DH_check() if available. Also, use EVP_PKEY_public_check() instead of EC_KEY_check_key(). EVP_PKEY_*check() is part of the EVP API and is meant to replace those low-level functions. They were added by OpenSSL 1.1.1. It is currently not provided by LibreSSL.
* pkey: implement #to_text using EVP APIKazuki Yamaguchi2021-04-151-27/+0
| | | | | | | | | | | | | | | | Use EVP_PKEY_print_private() instead of the low-level API *_print() functions, such as RSA_print(). EVP_PKEY_print_*() family was added in OpenSSL 1.0.0. Note that it falls back to EVP_PKEY_print_public() and EVP_PKEY_print_params() as necessary. This is required for EVP_PKEY_DH type for which _private() fails if the private component is not set in the pkey object. Since the new API works in the same way for all key types, we now implement #to_text in the base class OpenSSL::PKey::PKey rather than in each subclass.
* pkey/ec: remove OpenSSL::PKey::EC::Group.new(ec_method) formky/pkey-remove-ec-group-from-raw-methodKazuki Yamaguchi2020-08-211-42/+2
| | | | | | | | | | | | | | | | | The form created an empty EC_GROUP object with the specified EC_METHOD. However, the feature was unfinished and not useful in any way because OpenSSL::PKey::EC::Group did not implement wrappers for necessary functions to set actual parameters for the group, namely EC_GROUP_set_curve() family. EC_GROUP object creation with EC_METHOD explicitly specified is deprecated in OpenSSL 3.0, as it was apparently not intended for use outside OpenSSL. It is still possible to create EC_GROUP, but without EC_METHOD explicitly specified - OpenSSL chooses the appropriate EC_METHOD for the curve type. The OpenSSL::PKey::EC::Group.new(<:GFp|:GF2m>, p, a, b) form will continue to work.
* pkey/ec: deprecate OpenSSL::PKey::EC::Point#mul(ary, ary [, bn])ky/pkey-ec-point-deprecate-mul-aryKazuki Yamaguchi2020-06-291-0/+8
| | | | | | | | | | | | | Deprecate it for future removal. However, I do not expect any application is affected by this. The other form of calling it, PKey::EC::Point#mul(bn [, bn]) remains untouched. PKey::EC::Point#mul calls EC_POINTs_mul(3) when multiple BNs are given as an array. LibreSSL 2.8.0 released on 2018-08 removed the feature and OpenSSL 3.0 which is planned to be released in 2020 will also deprecate the function as there is no real use-case.
* Merge pull request #329 from rhenium/ky/pkey-generic-operationsKazuki Yamaguchi2020-05-131-32/+0
|\ | | | | pkey: add more support for 'generic' pkey types
| * pkey: reimplement PKey::DH#compute_key and PKey::EC#dh_compute_keyky/pkey-generic-operationsKazuki Yamaguchi2020-05-131-32/+0
| | | | | | | | | | Use the new OpenSSL::PKey::PKey#derive instead of the raw {EC,}DH_compute_key(), mainly to reduce amount of the C code.
* | pkey: refactor #export/#to_pem and #to_derky/pkey-refactor-serializationKazuki Yamaguchi2020-05-131-67/+19
| | | | | | | | | | Add ossl_pkey_export_traditional() and ossl_pkey_export_spki() helper functions, and use them. This reduces code duplication.
* | pkey: refactor DER/PEM-encoded string parsing codeKazuki Yamaguchi2020-05-131-18/+11
| | | | | | | | | | Export the flow used by OpenSSL::PKey.read and let the subclasses call it before attempting other formats.
* | pkey: inline {rsa,dsa,dh,ec}_instance()Kazuki Yamaguchi2020-05-131-27/+7
| | | | | | | | | | | | | | Merge the code into the callers so that the wrapping Ruby object is allocated before the raw key object is allocated. This prevents possible memory leak on Ruby object allocation failure, and also reduces the lines of code.
* | pkey: simplify ossl_pkey_new()Kazuki Yamaguchi2020-05-131-20/+0
|/ | | | | | ossl_{rsa,dsa,dh,ec}_new() called from this function are not used anywhere else. Inline them into pkey_new0() and reduce code duplication.
* Add EC_POINT_add supportJ.D. Hollis2019-07-031-0/+29
|
* Merge branch 'maint-2.0' into maintKazuki Yamaguchi2018-08-081-0/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fix made in 6fcc6c0efc42 ("test/test_ssl: fix test failure with TLS 1.3", 2018-08-06) is applied to the new test cases. * maint-2.0: reduce LibreSSL warnings openssl_missing.h: constified openssl: search winsock search winsock libraries explicitly no ID cache in Init functions test/test_ssl: fix test failure with TLS 1.3 tool/ruby-openssl-docker: update to latest versions pkey: resume key generation after interrupt
| * no ID cache in Init functionsnobu2018-08-081-0/+1
| | | | | | | | | | | | | | Init functions are called only once, cache is useless. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62429 b2dd03c8-39d4-4d8f-98ff-823fe69b080e Sync-with-trunk: r62429
* | pkey/ec: add support for octet string encoding of EC pointky/pkey-ec-point-octet-stringKazuki Yamaguchi2017-12-141-35/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | Add a new method named PKey::EC#to_octet_string that returns the octet string representation of the curve point. PKey::EC::Point#to_bn, which have already existed and is similar except that an instance of OpenSSL::BN is returned, is rewritten in Ruby. PKey::EC::Point#initialize now takes String as the second argument in the PKey::EC::Point.new(group, encoded_point) form. Also, update the tests to use #to_octet_string instead of #to_bn for better readability.
* | pkey/ec: rearrange PKey::EC::Point#initializeKazuki Yamaguchi2017-12-071-44/+24
| |
* | Merge branch 'maint'Kazuki Yamaguchi2017-08-081-3/+3
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint: Ruby/OpenSSL 2.0.5 ssl: fix compile error with OpenSSL 1.0.0 ssl: remove unsupported TLS versions from SSLContext::METHODS Add msys2 library dependency tag in gem metadata ossl_pem_passwd_cb: handle nil from the block explicitly ossl_pem_passwd_cb: do not check for taintedness ossl_pem_passwd_cb: relax passphrase length constraint appveyor.yml: test against Ruby 2.4 Rakefile: install_dependencies: install only when needed bio: do not use the FILE BIO method in ossl_obj2bio() bio: prevent possible GC issue in ossl_obj2bio() test/test_ssl: allow 3DES cipher suites in test_sslctx_set_params
| * bio: prevent possible GC issue in ossl_obj2bio()Kazuki Yamaguchi2017-07-111-3/+3
| | | | | | | | | | | | | | | | | | | | Prevent the new object created by StringValue() from being GCed. Luckily, as none of the callers of ossl_obj2bio() reads from the returned BIO after possible triggering GC, this has not been a real problem. As a bonus, ossl_protect_obj2bio() function which is no longer used anywhere is removed.
* | Merge branch 'maint'bpointKazuki Yamaguchi2017-06-141-3/+3
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint: Ruby/OpenSSL 2.0.4 History.md: add entries for 2.0.1-2.0.3 History.md: wrap at 80 characters extconf.rb: simplify searching libraries logic Search SSL libraries by testing various filename patterns openssl: fix broken openssl check openssl: fix broken openssl check x509store: clear error queue after calling X509_LOOKUP_load_file() tool/sync-with-trunk: 'LASY' -> 'LAST' Update .travis.yml and Dockerfile test/test_x509store: skip OpenSSL::TestX509Store#test_set_errors Fix documentation for OpenSSL::Cipher#final Fix typos ssl: check return value of SSL_set_fd() test/test_ssl: fix typo in test_sysread_and_syswrite Fix typos test/test_pkey_ec: do not use dummy 0 order
| * Fix typosKazuki Yamaguchi2017-04-201-1/+1
| |
| * Fix typosSHIBATA Hiroshi2017-02-141-2/+2
| |
* | cipher: rename GetCipherPtr() to ossl_evp_get_cipherbyname()Kazuki Yamaguchi2017-05-021-1/+1
| | | | | | | | | | | | | | | | While GetCipherPtr() function gets a const EVP_CIPHER * from algorithm name, GetCipher() macro that is locally defined in ext/openssl/ossl_cipher.c gets the EVP_CIPHER_CTX from an OpenSSL::Cipher object. They are completely different things. Rename GetCipherPtr() for disambiguation.
* | Remove SafeGet*() macrosKazuki Yamaguchi2017-05-021-33/+21
| | | | | | | | | | | | They are no longer useful since we use the TypedData_Get_Struct() which also performs type checking (based on the rb_data_type_t) for the non-safe Get*() macros. Just use them instead.
* | Merge branch 'topic/expand-ruby-missing-h'Kazuki Yamaguchi2017-04-281-3/+3
|\ \ | | | | | | | | | | | | | | | * topic/expand-ruby-missing-h: Expand FPTR_TO_FD() macro Expand rb_define_copy_func() macro
| * | Expand rb_define_copy_func() macroKazuki Yamaguchi2017-04-281-3/+3
| |/ | | | | | | | | It's not really "missing". Let's expand that, as it does not improve the readability so much.
* | Fix RDoc markuptopic/fix-rdoc-markupKazuki Yamaguchi2017-02-241-17/+17
| | | | | | | | | | Ruby core uses _str_ for emphasizing argument names and +str+ for codes. Match with the rule for better rendering.
* | Remove support for OpenSSL 0.9.8 and 1.0.0topic/drop-openssl-098-and-100Kazuki Yamaguchi2016-12-221-1/+1
|/ | | | | | | | | | They are no longer receiving security updates from the OpenSSL development team since 2015-12. We have kept basic compatibility until now because RHEL 5 still uses an (heavily modified) OpenSSL 0.9.8e. The RHEL 5 will reach EOL on 2017-03, thus it is now safe to assume nobody is still using such old versions of OpenSSL.
* bn: keep reference to temporary OpenSSL::BN object created by GetBNPtr()Kazuki Yamaguchi2016-12-041-3/+7
| | | | | | | | | GetBNPtr() accepts both OpenSSL::BN and Ruby integers. In the latter case, it creates a temporary OpenSSL::BN internally. The OpenSSL::BN object immediately disappears from the stack and is not protected from GC. Fixes: https://github.com/ruby/openssl/issues/87
* Merge changes from Ruby trunk r56225..r56492Kazuki Yamaguchi2016-10-281-1/+1
|\ | | | | | | | | | | | | * ruby-trunk r56225..r56492: (1 commits) (r56492) [DOC] replace Fixnum with Integer [ci skip] Sync-with-trunk: r56492
| * [DOC] replace Fixnum with Integer [ci skip]nobu2016-10-281-1/+1
| | | | | | | | | | | | * numeric.c: [DOC] update document for Integer class. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56492 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* | pkey: tighten buffer size for signatureKazuki Yamaguchi2016-10-141-4/+3
| | | | | | | | | | | | | | We allocate too large buffer for the generated signature. The resulting signature, or the RSA encryption result, should not be larger than the size returned by EVP_PKEY_size() (or, DSA_size(), RSA_size(), and ECDSA_size()).
* | pkey: allow specifying conversion form in EC::Point#to_bntopic/pkey-ec-conversion-formKazuki Yamaguchi2016-09-281-20/+35
|/ | | | | | | | | | | | | | | | | Currently, when we want to convert a point data into an octet string with non-default conversion form, we have to set the desirable form to the associated EC::Group beforehand. This is inconvenient and counterintuitive because the conversion form is not actually related to the EC group. point = ... point.group.point_conversion_form = :compressed point.to_bn So, allow specifying the form as an optional parameter, like this: point = ... point.to_bn(:compressed)
* pkey: make OpenSSL::PKey::EC::Group wrap an EC_GROUP directlytopic/pkey-ec-unlinkKazuki Yamaguchi2016-09-071-101/+42
| | | | | | | | | | | | | | | | | | | | | As done for EC::Point, remove ossl_ec_group struct. This contains a breaking change. Modifications to an EC::Group returned by EC#group no longer affects the EC object unless set to the key explicitly using EC#group=. This is the common behavior in Ruby/OpenSSL, including other getter methods of EC such as EC#public_key. EC#group currently returns a EC::Group linked with the key, i.e. the EC::Group object holds a reference to an EC_GROUP that the EC_KEY owns. We use some ugly workaround - the ossl_ec_group struct has a flag 'dont_free' that indicates we must not free the EC_GROUP. But it is still not possible to control OpenSSL of free'ing the EC_GROUP, so, for example, the following code behaves strangely: ec = OpenSSL::PKey::EC.generate("prime256v1") group = ec.group p group.curve_name #=> "prime256v1" ec.group = OpenSSL::PKey::EC::Group.new("prime256v1") p group.curve_name #=> nil
* pkey: make OpenSSL::PKey::EC::Point wrap an EC_POINT directlyKazuki Yamaguchi2016-09-071-64/+55
| | | | | | | Currently an OpenSSL::PKey::EC::Point wraps an ossl_ec_point struct which has a pointer for EC_POINT. This commit make EC::Point wrap an EC_POINT directly in order to simplify the source code. There should be no changes on behavior seen from Ruby.
* pkey: make ossl_pkey_ec.c follow the common macro namingKazuki Yamaguchi2016-09-071-127/+102
| | | | | | | Make ossl_pkey_ec.c follow the general convension on macro names. Prefer CamelCase to Snake_Case and unify Require_*() and Get_*() macros into Get*() macros. There is nothing wrong with the style itself but it's hard to read if two different styles are mixed.
* * remove trailing spaces.svn2016-08-291-3/+3
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56028 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* pkey: use rb_attr_get() instead of rb_iv_get() in ossl_pkey_ec.cKazuki Yamaguchi2016-08-281-24/+29
| | | | | This suppresses runtime warning of "instance variable @group not initialized".
* Avoid using *2FIX() where we don't know if it really fits in FixnumKazuki Yamaguchi2016-08-221-1/+1
|
* pkey: allow non-BN object as the multiplier in PKey::EC::Point#mulKazuki Yamaguchi2016-08-221-7/+6
|
* pkey: fixup documentKazuki Yamaguchi2016-08-221-104/+178
|
* pkey: fix memory leak in PKey::EC#exportKazuki Yamaguchi2016-08-161-5/+6
| | | | | It leaks when invalid value is passed as the `cipher` or `pass` argument.
* Fix RDoc styletopic/rdoc-fixesKazuki Yamaguchi2016-07-091-8/+8
|
* openssl: implement initialize_copy method for PKey classesrhe2016-06-191-12/+71
| | | | | | | | | | | | | | * ext/openssl/ossl_pkey_dh.c, ext/openssl/ossl_pkey_dsa.c, ext/openssl/ossl_pkey_ec.c, ext/openssl/ossl_pkey_rsa.c: Implement initialize_copy method for OpenSSL::PKey::*. [ruby-core:75504] [Bug #12381] * test/openssl/test_pkey_dh.rb, test/openssl/test_pkey_dsa.rb, test/openssl/test_pkey_ec.rb, test/openssl/test_pkey_rsa.rb: Test they actually copy the OpenSSL objects, and modifications to cloned object don't affect the original object. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55454 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: adapt OpenSSL::PKey to OpenSSL 1.1.0 opaque structsrhe2016-06-091-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | * ext/openssl/openssl_missing.[ch]: Implement EVP_PKEY_get0_*() and {RSA,DSA,EC_KEY,DH}_get0_*() functions. OpenSSL 1.1.0 makes EVP_PKEY/RSA/DSA/DH opaque. We used to provide setter methods for each parameter of each PKey type, for example PKey::RSA#e=, but this is no longer possible because the new API RSA_set0_key() requires the 'n' at the same time. This commit adds deprecation warning to them and adds PKey::*#set_* methods as direct wrapper for those new APIs. For example, 'rsa.e = 3' now needs to be rewritten as 'rsa.set_key(rsa.n, 3, rsa.d)'. [ruby-core:75225] [Feature #12324] * ext/openssl/ossl_pkey*.[ch]: Use the new accessor functions. Implement RSA#set_{key,factors,crt_params}, DSA#set_{key,pqg}, DH#set_{key,pqg}. Emit a warning with rb_warning() when old setter methods are used. * test/drb/ut_array_drbssl.rb, test/drb/ut_drb_drbssl.rb, test/rubygems/test_gem_remote_fetcher.rb: Don't set a priv_key for DH object that are used in tmp_dh_callback. Generating a new key pair every time should be fine - actually the private exponent is ignored in OpenSSL >= 1.0.2f/1.0.1r even if we explicitly set. https://www.openssl.org/news/secadv/20160128.txt git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55285 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: drop OpenSSL 0.9.6/0.9.7 supportrhe2016-05-311-2/+0
| | | | | | * ext/openssl, test/openssl: Drop OpenSSL < 0.9.8 support. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55162 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-27 15:38:36 +0000