aboutsummaryrefslogtreecommitdiffstats
path: root/ext/openssl/ossl_x509crl.c
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'maint'Kazuki Yamaguchi2017-11-251-1/+4
|\ | | | | | | | | | | | | | | | | | | | | * maint: History.md: fix a typo x509cert, x509crl, x509req, ns_spki: check sanity of public key pkey: make pkey_check_public_key() non-static test/test_cipher: fix test_non_aead_cipher_set_auth_data failure cipher: disallow setting AAD for non-AEAD ciphers test/test_ssl_session: skip tests for session_remove_cb appveyor.yml: remove 'openssl version' line
| * x509cert, x509crl, x509req, ns_spki: check sanity of public keyky/pkey-check-sanityKazuki Yamaguchi2017-11-131-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pub_encode routine of an EVP_PKEY_ASN1_METHOD seems to assume the parameters and public key component(s) to be set properly. Calling that, for example, through X509_set_pubkey(), with an incomplete object may cause segfault. Use ossl_pkey_check_public_key() to check that. It doesn't look pretty, but unfortunately there isn't a generic way to do that with the EVP API. Something similar applies to the verify routine of an EVP_PKEY_METHOD. Do the same check before calling *_verify(). Reference: http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/83688 Reference: https://bugs.ruby-lang.org/issues/14087
* | Fix build failure against OpenSSL 1.1 built with no-deprecatedMark Wright2017-11-041-2/+2
| | | | | | | | Thanks rhenium for the code review and fixes.
* | Merge branch 'maint'Kazuki Yamaguchi2017-08-081-1/+1
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint: Ruby/OpenSSL 2.0.5 ssl: fix compile error with OpenSSL 1.0.0 ssl: remove unsupported TLS versions from SSLContext::METHODS Add msys2 library dependency tag in gem metadata ossl_pem_passwd_cb: handle nil from the block explicitly ossl_pem_passwd_cb: do not check for taintedness ossl_pem_passwd_cb: relax passphrase length constraint appveyor.yml: test against Ruby 2.4 Rakefile: install_dependencies: install only when needed bio: do not use the FILE BIO method in ossl_obj2bio() bio: prevent possible GC issue in ossl_obj2bio() test/test_ssl: allow 3DES cipher suites in test_sslctx_set_params
| * bio: prevent possible GC issue in ossl_obj2bio()Kazuki Yamaguchi2017-07-111-1/+1
| | | | | | | | | | | | | | | | | | | | Prevent the new object created by StringValue() from being GCed. Luckily, as none of the callers of ossl_obj2bio() reads from the returned BIO after possible triggering GC, this has not been a real problem. As a bonus, ossl_protect_obj2bio() function which is no longer used anywhere is removed.
* | asn1: disallow NULL to be passed to asn1time_to_time()Kazuki Yamaguchi2017-07-231-2/+10
| | | | | | | | Let the callers check the validity of the ASN1_TIME.
* | Remove unused functions and macrosKazuki Yamaguchi2017-05-221-11/+0
| |
* | digest: rename GetDigestPtr() to ossl_evp_get_digestbyname()Kazuki Yamaguchi2017-05-021-1/+1
| | | | | | | | | | Similar to the previous one for GetCipherPtr(), GetDigest() and GetDigestPtr() have been completely different. Let's disambiguate them.
* | Remove SafeGet*() macrosKazuki Yamaguchi2017-05-021-7/+3
| | | | | | | | | | | | They are no longer useful since we use the TypedData_Get_Struct() which also performs type checking (based on the rb_data_type_t) for the non-safe Get*() macros. Just use them instead.
* | Expand rb_define_copy_func() macroKazuki Yamaguchi2017-04-281-1/+1
|/ | | | | It's not really "missing". Let's expand that, as it does not improve the readability so much.
* Avoid memory leak on rb_str_new()Kazuki Yamaguchi2016-10-031-24/+5
| | | | | Use ossl_membio2str() to convert a mem BIO to Ruby String. This fixes possible memory leak on rb_str_new() failure, and also reduces code.
* Adapt to OpenSSL changes after the 1.1.0-pre6Kazuki Yamaguchi2016-08-261-18/+17
| | | | | | | Fix compiler errors and warnings. The order of parameters of X509_{CRL,REQ}_get0_signature() has been changed, and certificate and CRL time accessors have been reorganized: *_get_* functions are deprecated and replaced by *_get0_* that return a const pointer.
* x509ext: remove unnecessary DupX509ExtPtr()Kazuki Yamaguchi2016-08-161-8/+4
| | | | All usages can be replaced with GetX509ExtPtr().
* x509crl: fix memory leak on error pathKazuki Yamaguchi2016-08-161-2/+4
| | | | X509_REVOKED can leak when X509_CRL_add0_revoked() fails.
* x509crl: fix CRL#revoked=Kazuki Yamaguchi2016-08-091-1/+5
| | | | | Fixes cad3226a06a1 (openssl: adapt to OpenSSL 1.1.0 opaque structs, 2016-06-05).
* Fix RDoc styletopic/rdoc-fixesKazuki Yamaguchi2016-07-091-0/+6
|
* openssl: adapt to OpenSSL 1.1.0 opaque structsrhe2016-06-091-8/+19
| | | | | | | | | | | | | | | * ext/openssl/extconf.rb: Check existence of accessor functions that don't exist in OpenSSL 0.9.8. OpenSSL 1.1.0 made most of its structures opaque and requires use of these accessor functions. [ruby-core:75225] [Feature #12324] * ext/openssl/openssl_missing.[ch]: Implement them if missing. * ext/openssl/ossl*.c: Use these accessor functions. * test/openssl/test_hmac.rb: Add missing test for HMAC#reset. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55287 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: support OpenSSL 1.1.0's new multi-threading APIrhe2016-06-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | * ext/openssl/extconf.rb: Check absence of CRYPTO_lock() to see if the OpenSSL has the new threading API. In OpenSSL <= 1.0.2, an application had to set locking callbacks to use OpenSSL in a multi-threaded environment. OpenSSL 1.1.0 now finds pthreads or Windows threads so we don't need to do something special. [ruby-core:75225] [Feature #12324] Also check existence of *_up_ref(). Some structures in OpenSSL have a reference counter. We used to increment it with CRYPTO_add() which is a part of the old API. * ext/openssl/openssl_missing.h: Implement *_up_ref() if missing. * ext/openssl/ossl.c: Don't set locking callbacks if unneeded. * ext/openssl/ossl_pkey.c, ext/openssl/ossl_ssl.c, ext/openssl/ossl_x509cert.c, ext/openssl/ossl_x509crl.c, ext/openssl/ossl_x509store.c: Use *_up_ref() instead of CRYPTO_add(). git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55283 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: fix the Year 2038 problemrhe2016-06-091-9/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | r55219 didn't fix the entire issue. It only fixed the issue on environment with sizeof(time_t) == 8 && sizeof(long) == 4. * ext/openssl/extconf.rb: Check existence of ASN1_TIME_adj(). The old ASN1_TIME_set() is not Year 2038 ready on sizeof(time_t) == 4 environment. This function was added in OpenSSL 1.0.0. [ruby-core:45552] [Bug #6571] * ext/openssl/ossl_asn1.c (ossl_time_split): Added. Split the argument (Time) into the number of days elapsed since the epoch and the remainder seconds to conform to ASN1_TIME_adj(). (obj_to_asn1utime, obj_to_asn1gtime): Use ossl_time_split() and ASN1_*TIME_adj(). * ext/openssl/ossl_asn1.h: Add the function prototype for ossl_time_split(). * ext/openssl/ossl_x509.[ch]: Add ossl_x509_time_adjust(). Similarly to obj_to_asn1*time(), use X509_time_adj_ex() instead of X509_time_adj(). * ext/openssl/ossl_x509cert.c, ext/openssl/ossl_x509crl.c, ext/openssl/ossl_x509revoked.c: Use ossl_x509_time_adjust(). git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55249 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* openssl: clear OpenSSL error queue before return to Rubyrhe2016-05-311-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * ext/openssl/ossl_x509cert.c (ossl_x509_verify): X509_verify() family may put errors on 0 return (0 means verification failure). Clear OpenSSL error queue before return to Ruby. Since the queue is thread global, remaining errors in the queue can cause an unexpected error in the next OpenSSL operation. [ruby-core:48284] [Bug #7215] * ext/openssl/ossl_x509crl.c (ossl_x509crl_verify): ditto. * ext/openssl/ossl_x509req.c (ossl_x509req_verify): ditto. * ext/openssl/ossl_x509store.c (ossl_x509stctx_verify): ditto. * ext/openssl/ossl_pkey_dh.c (dh_generate): clear the OpenSSL error queue before re-raising exception. * ext/openssl/ossl_pkey_dsa.c (dsa_generate): ditto. * ext/openssl/ossl_pkey_rsa.c (rsa_generate): ditto. * ext/openssl/ossl_ssl.c (ossl_start_ssl): ditto. * test/openssl: check that OpenSSL.errors is empty every time after running a test case. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55051 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Merge trunk upstreamZachary Scott2015-11-131-6/+6
|
* Sync with ruby trunkZachary Scott2015-09-231-2/+0
|
* Upstream ruby/ruby@451fe26 from r50673Zachary Scott2015-06-031-4/+8
|
* Apply ruby/ruby@325a50fc572516a171d640765d6ddf9b20be14dc to fix typosZachary Scott2015-05-041-1/+1
| | | | See also r50351 from ruby/ruby#876
* Sync with ruby trunkZachary Scott2015-01-051-2/+16
|
* import ruby trunkSHIBATA Hiroshi2014-10-271-0/+537
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-10 15:16:13 +0000