aboutsummaryrefslogtreecommitdiffstats
path: root/ext/openssl
Commit message (Collapse)AuthorAgeFilesLines
* ssl: remove useless call to rb_thread_wait_fd()ky/ssl-sysread-dont-check-ssl-pendingKazuki Yamaguchi2017-08-251-2/+0
| | | | | | That there is no immediately readable data in the SSL instance does not imply it has to read more bytes from the underlying socket. Just call SSL_read() and check the return value.
* cipher: update the documentation for Cipher#auth_tag=ky/cipher-aead-set-aead-tag-documentation-fixKazuki Yamaguchi2017-08-241-7/+5
| | | | | | | The authentication tag can be set after starting the decryption, if only it is before Cipher#final is called. Fixes: https://github.com/ruby/openssl/issues/74
* ssl: do not call session_remove_cb during GCKazuki Yamaguchi2017-08-231-0/+7
| | | | | | | As noted in the SSL_CTX_sess_set_remove_cb(3) manpage, SSL_CTX_free() will call the callback function for each session in the internal session store. We can't call the callback Proc since it may do a new object allocation which is prohibited during GC.
* Ruby/OpenSSL 2.0.5v2.0.5Kazuki Yamaguchi2017-08-081-1/+1
|
* ssl: fix compile error with OpenSSL 1.0.0Kazuki Yamaguchi2017-08-082-2/+4
| | | | | | | OpenSSL <= 1.0.0 did not support TLS 1.1/1.2, and thus we must still check the existence of the symbols. This fixes the previous commit, 3e5a009966bd ("ssl: remove unsupported TLS versions from SSLContext::METHODS", 2017-08-08).
* ssl: remove unsupported TLS versions from SSLContext::METHODSKazuki Yamaguchi2017-08-082-14/+10
| | | | | | | | | | | | | | | Check for all version-specific SSL methods. We do check for existence of TLSv1_1_method() and TLSv1_2_method(), but not for TLSv1_method(). This fixes compile error when OpenSSL is configured with no-tls1-method. Also check the OPENSSL_NO_TLS{1,1_1,1_2} macros for whether OpenSSL supports the corresponding versions or not. This prevents :TLSv1 from being in SSLContext::METHODS when OpenSSL is compiled with no-tls1. In particular, Debian sid has disabled TLS 1.0/1.1 support recently. The changes in ext/openssl are partial backport of 4eb4b3297a92 ("Remove support for OpenSSL 0.9.8 and 1.0.0", 2016-11-30).
* ossl_pem_passwd_cb: handle nil from the block explicitlyky/pem-passwd-cb-get-rid-of-minlenKazuki Yamaguchi2017-07-221-4/+5
| | | | | | | | | | | There is code that returns nil in the passphrase block on purpose (to prevent OpenSSL from prompting on stdin): OpenSSL::PKey.read(File.read("file.pem")) { nil } This is working just by chance because the TypeError from StringValue() is silently ignored. Let's short circuit in that case and save raising a needless exception, as this pattern has become too common.
* ossl_pem_passwd_cb: do not check for taintednessKazuki Yamaguchi2017-07-221-1/+1
| | | | It is perfectly permissible to take passwords from an untrusted source.
* ossl_pem_passwd_cb: relax passphrase length constraintKazuki Yamaguchi2017-07-221-14/+1
| | | | | | The minimum passphrase length of 4 bytes is only a limitation of PEM_def_callback() which isn't relevant here. Commit f38501249f33 introduced this bug.
* bio: do not use the FILE BIO method in ossl_obj2bio()Kazuki Yamaguchi2017-07-111-26/+6
| | | | | | | | | | | | | | | Read everything from an IO object into a String first and use the memory buffer BIO method just as we do for String inputs. For MSVC builds, the FILE BIO method uses the "UPLINK" interface that requires the application to provide OPENSSL_Applink() function. For us, the "application" means ruby.exe, in which we can't do anything. As a workaround, avoid using the FILE BIO method at all. Usually private keys or X.509 certificates aren't that large and the temporarily increased memory usage hopefully won't be an issue. Fixes: https://github.com/ruby/openssl/issues/128
* bio: prevent possible GC issue in ossl_obj2bio()Kazuki Yamaguchi2017-07-1114-32/+24
| | | | | | | | | | Prevent the new object created by StringValue() from being GCed. Luckily, as none of the callers of ossl_obj2bio() reads from the returned BIO after possible triggering GC, this has not been a real problem. As a bonus, ossl_protect_obj2bio() function which is no longer used anywhere is removed.
* Ruby/OpenSSL 2.0.4v2.0.4Kazuki Yamaguchi2017-06-141-1/+1
|
* extconf.rb: simplify searching libraries logicKazuki Yamaguchi2017-06-141-31/+33
| | | | | Clarify what it's doing. For non-Windows and MinGW platforms we can just give "crypto" and "ssl" to have_library.
* Merge changes from Ruby trunk r56953..r58742Kazuki Yamaguchi2017-06-142-7/+47
|\ | | | | | | | | | | | | | | | | | | | | Commits that went to master are excluded. * ruby-trunk r56953..r58742: (3 commits) (r58742) Search SSL libraries by testing various filename patterns (r57592) openssl: fix broken openssl check (r57591) openssl: fix broken openssl check Sync-with-trunk: r58742
| * Search SSL libraries by testing various filename patternsusa2017-06-141-5/+45
| | | | | | | | | | | | | | | | * ext/openssl/extconf.rb (find_openssl_library): should search by more flexible method, especially for LibreSSL on Windows. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58742 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
| * openssl: fix broken openssl checknobu2017-06-141-1/+1
| | | | | | | | | | | | | | * ext/openssl/deprecation.rb: check for broken OpenSSL only on mac OS. [ruby-core:79475] [Bug #13200] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57592 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
| * openssl: fix broken openssl checknobu2017-06-141-1/+1
| | | | | | | | | | | | | | * ext/openssl/extconf.rb: check for broken OpenSSL only on mac OS. [ruby-core:79475] [Bug #13200] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57591 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* | x509store: clear error queue after calling X509_LOOKUP_load_file()Kazuki Yamaguchi2017-06-141-0/+9
| | | | | | | | | | | | | | | | | | | | | | X509_LOOKUP_load_file(), which ends up calling X509_load_cert_crl_file() internally, may leave error entries in the queue even when it returns non-zero value (which indicates success). This will be fixed by OpenSSL 1.1.1, but can be worked around by clearing the error queue ourselves. Fixes: https://bugs.ruby-lang.org/issues/11033
* | Fix documentation for OpenSSL::Cipher#finalVladimir Rybas2017-04-211-1/+1
| | | | | | | | | | "after after having fed the entire plaintext..." is changed to "after having fed the entire plaintext..."
* | Fix typosKazuki Yamaguchi2017-04-205-7/+7
| |
* | ssl: check return value of SSL_set_fd()Kazuki Yamaguchi2017-03-311-1/+2
| | | | | | | | | | SSL_set_fd() may fail with 0 return if malloc() fails. Check that and raise an exception to avoid potential crash.
* | Fix typosSHIBATA Hiroshi2017-02-142-3/+3
|/
* Ruby/OpenSSL 2.0.3v2.0.3Kazuki Yamaguchi2017-01-311-1/+1
|
* x509: fix OpenSSL::X509::Name#eql?Kazuki Yamaguchi2017-01-281-1/+1
| | | | | | | | Commit 34e7fe34ee32 ("Use rb_obj_class() instead of CLASS_OF()", 2016-09-08) incorrectly inverted the result. Fix it, and add a test case for this. Fixes: 34e7fe34ee32 ("Use rb_obj_class() instead of CLASS_OF()")
* Merge branch 'topic/windows-static-linking-without-pkg-config' into maintKazuki Yamaguchi2017-01-051-0/+6
|\ | | | | | | | | * topic/windows-static-linking-without-pkg-config: Fix build with static OpenSSL libraries on Windows
| * Fix build with static OpenSSL libraries on Windowstopic/windows-static-linking-without-pkg-configKazuki Yamaguchi2016-12-301-0/+6
| | | | | | | | | | | | | | | | | | OpenSSL <= 1.0.2 requires gdi32 for RAND_screen(). OpenSSL >= 1.1.0 no longer has RAND_screen() but it now requires crypt32. If pkg-config is usable, they are automatically linked, but if it is not, configuring Ruby/OpenSSL fails. Fixes: https://bugs.ruby-lang.org/issues/13080
* | Fix for ASN1::Constructive 'each' implementationCorey Bonnell2016-12-291-1/+1
|/
* Ruby/OpenSSL 2.0.2v2.0.2Kazuki Yamaguchi2016-12-211-1/+1
|
* pkey: allow instantiating OpenSSL::PKey::PKey with unsupported key typeKazuki Yamaguchi2016-12-211-5/+10
| | | | | | | | | | Fix 'unsupported key type' error if OpenSSL::SSL::SSLSocket#tmp_key is called when X25519 is used for key exchange. EVP_PKEY may have a key type that we don't have have a dedicated subclass. Let's allow instantiating OpenSSL::PKey::PKey with such an EVP_PKEY, although the resulting instance is not so useful because it can't be exported at the moment.
* ssl: use SSL_SESSION_get_protocol_version()Kazuki Yamaguchi2016-12-213-5/+9
| | | | | | | | Restore the old behavior of OpenSSL::SSL::Session#==. SSL_SESSION_get_protocol_version() was missing in OpenSSL master at the time r55287 (cad3226a06a1, "openssl: adapt to OpenSSL 1.1.0 opaque structs", 2016-06-05).
* Rename functions in openssl_missing.cKazuki Yamaguchi2016-12-212-20/+29
| | | | | To avoid symbol conflict that would occur if two versions of OpenSSL are loaded at the same time.
* ssl: check for SSL_CTX_clear_options()Kazuki Yamaguchi2016-12-182-0/+5
| | | | | | | SSL_CTX_clear_options() first appeared in OpenSSL 0.9.8m. Add alternative macro definition for ancient versions of OpenSSL. http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/78693
* Ruby/OpenSSL 2.0.1v2.0.1Kazuki Yamaguchi2016-12-101-1/+1
|
* Merge changes from Ruby trunk r56927..r56953Kazuki Yamaguchi2016-12-101-1/+1
|\ | | | | | | | | | | | | | | | | * ruby-trunk r56927..r56953: (3 commits) (r56953) openssl: import fixes from upstream (r56948) ossl.c: cast (r56946) openssl: import v2.0.0 Sync-with-trunk: r56953
| * openssl: import fixes from upstreamrhe2016-12-102-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Import the following two commits from upstream: commit 72126d6c8b88abd69c3565fc3bbbd5ed1e401611 Author: Kazuki Yamaguchi <k@rhe.jp> Date: Thu Dec 1 22:27:03 2016 +0900 pkey: check existence of EVP_PKEY_get0() EVP_PKEY_get0() did not exist in early OpenSSL 0.9.8 series. So define ourselves if needed. commit 94a1c4e0c5705ad1e9a4ca08cacaa6cba8b1e6f5 Author: Kazuki Yamaguchi <k@rhe.jp> Date: Thu Dec 1 22:13:22 2016 +0900 test/test_cipher: fix test with OpenSSL 1.0.1 before 1.0.1d Set the authentication tag before the AAD when decrypting. Before OpenSSL commit 96f7fafa2431 ("Don't require tag before ciphertext in AESGCM mode", 2012-10-16, at OpenSSL_1_0_1-stable branch, included in OpenSSL 1.0.1d), the authentication tag must be set before any calls of EVP_CipherUpdate(). They should fix build on CentOS 5 and Ubuntu 12.04 respectively. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56953 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
| * ossl.c: castnobu2016-12-101-1/+1
| | | | | | | | | | | | | | * ext/openssl/ossl.c (ossl_pem_passwd_cb): cast to int. it's safe because len does not exceed int max_len. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56948 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* | Merge pull request #88 from yogo1212/generalizedtime_formatKazuki Yamaguchi2016-12-101-3/+9
|\ \ | | | | | | asn1: handle GENERALIZEDTIME without seconds
| * | asn1: more output on error 'bad GENERALIZEDTIME'Leon M. George2016-12-091-1/+2
| | |
| * | asn1: handle GENERALIZEDTIME without secondsLeon M. George2016-12-091-2/+7
| |/
* | Merge pull request #89 from koic/fix_typo_in_ossl_engineKazuki Yamaguchi2016-12-091-1/+1
|\ \ | | | | | | Fix a typo in ossl_engine.c
| * | Fix a typo in ossl_engine.cKoichi ITO2016-12-091-1/+1
| |/
* | ssl: prevent encoded NPN advertised protocol list from being GCedKazuki Yamaguchi2016-12-051-1/+4
| | | | | | | | | | | | | | | | | | SSLContext#setup encodes the protocol list set in @npn_protocols into a String. The String is passed to SSL_CTX_set_next_protos_advertised_cb() and OpenSSL invokes the callback function with the String. However since Ruby's GC can't find the reference to the String from the inside of OpenSSL, it can be free'd before the callback is invoked. So store the String in an instance variable to prevent this.
* | bn: keep reference to temporary OpenSSL::BN object created by GetBNPtr()Kazuki Yamaguchi2016-12-043-19/+31
| | | | | | | | | | | | | | | | | | GetBNPtr() accepts both OpenSSL::BN and Ruby integers. In the latter case, it creates a temporary OpenSSL::BN internally. The OpenSSL::BN object immediately disappears from the stack and is not protected from GC. Fixes: https://github.com/ruby/openssl/issues/87
* | pkey: check existence of EVP_PKEY_get0()Kazuki Yamaguchi2016-12-012-0/+5
|/ | | | | EVP_PKEY_get0() did not exist in early OpenSSL 0.9.8 series. So define ourselves if needed.
* ssl: follow-up for the workaround for OpenSSL 1.1.0c's SSL_read()Kazuki Yamaguchi2016-11-301-7/+7
| | | | | | | | Remove the comment added by commit 072d53ecf984 ("ssl: workaround for new behavior of SSL_read() in OpenSSL >= 1.1.0c"). The breaking change in OpenSSL 1.1.0c has been reverted in the 1.1.0 branch. However, for the sake of safety, ensure that we never call rb_sys_fail() with errno == 0. So there is no change in the actual code.
* ssl: make OpenSSL::SSL::SSLContext#freeze an alias of #setuptopic/ssl-make-sslctx-freeze-alias-of-setupKazuki Yamaguchi2016-11-291-0/+1
| | | | | | | | | | | | | | | | | | | | SSLSocket#setup uses the frozen state as "SSL_CTX is already set up". If an user manually freeze the context, it misunderstands as if #setup is already called, leading to unexpected behaviors because parameters the user set won't be actually set to the underlying SSL_CTX and thus ignored. Ideally, #setup should go and be replaced with setters. But we don't do this now because it is not that simple: some of them would produce new ordering issues, e.g. 'ca_file' property which loads a file into SSL_CTX::cert_store and 'cert_store' which replaces SSL_CTX::cert_store would conflict. Fixing this properly would require deprecating 'ca_file' first. So, let's take the second best way: make it "just work" instead of break silently. Fixes: https://github.com/ruby/openssl/issues/85
* ssl: fix possible exception from non-protected codeKazuki Yamaguchi2016-11-281-42/+66
| | | | | | | | | | | rb_ary_new_from_args() is called from non-protected callback function which will be directly called from OpenSSL. It may raise NoMemoryError and may corrupt the internal state of SSL object. So, avoid creating Array here and pass raw values to the protected function instead. The same change has been applied to ALPN/NPN selection callbacks in 3a926047a729 ("ssl: catch exceptions raised in ALPN/NPN callbacks", 2016-08-30).
* ssl: inline ossl_ssl_shutdown() into ossl_ssl_stop()Kazuki Yamaguchi2016-11-281-20/+15
| | | | | | | | We call SSL_shutdown() four times at most meaninglessly. Since the underlying socket is in non-blocking mode, if the first call failed because the underlying socket is not write/readable, the subsequent calls would just fail with the same error. Just call once, and give up if it fails.
* engine: undef alloc functionKazuki Yamaguchi2016-11-161-18/+1
| | | | | | This prevents users from allocating OpenSSL::Engine instance using OpenSSL::Engine.allocate. Undef'ing alloc function also allows us to remove explicit undef of OpenSSL::Engine.new and #initialize_copy.
* asn1: fix possible segfault in OpenSSL::ASN1::Constructive#eachKazuki Yamaguchi2016-11-161-2/+6
| | | | | Don't blindy assume that the value which can be modified from Ruby code is always an Array, and just call its #each method.
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-25 16:12:08 +0000