aboutsummaryrefslogtreecommitdiffstats
path: root/ext/openssl
Commit message (Collapse)AuthorAgeFilesLines
* bn: optimize try_convert_to_bnptr() for non-BN objectstopic/argument-conversionKazuki Yamaguchi2016-08-221-46/+55
| | | | | | | | | | | Use the same logic as BN#initialize. It is used through GetBNPtr(). For example, with this change, the following code will be about 7x faster: puts Benchmark.measure { a = 0.to_bn b = 2 ** 2048 i = 0; a + b while (i += 1) <= 1_000_000 }
* Avoid using *2FIX() where we don't know if it really fits in FixnumKazuki Yamaguchi2016-08-229-31/+28
|
* pkey: allow non-BN object as the multiplier in PKey::EC::Point#mulKazuki Yamaguchi2016-08-221-7/+6
|
* cipher: allow cipher name in GetCipherPtr()Kazuki Yamaguchi2016-08-221-3/+16
| | | | | | | | | | | | The function GetCipherPtr() is used when we want a const EVP_CIPHER that represents a cipher algorithm. This change allows users to write a code that exports a PKey encrypted without creating an OpenSSL::Cipher instance: pkey = OpenSSL::PKey.read(...) pkey.export("aes-128-cbc") { password } This is the same as what happened to GetDigestPtr() in r12128.
* Merge pull request #59 from ruby/topic/doc-workKazuki Yamaguchi2016-08-221-14/+0
|\ | | | | [WIP] Add NEWS and update CONTRIBUTING.md
| * Merge branch 'master' into topic/doc-workKazuki Yamaguchi2016-08-0920-143/+355
| |\
| * | Remove Install section from rdocKazuki Yamaguchi2016-07-281-14/+0
| | |
* | | x509store: fixup documentationtopic/fixup-docsKazuki Yamaguchi2016-08-222-32/+243
| | |
* | | pkey: fixup documentKazuki Yamaguchi2016-08-225-111/+243
| | |
* | | hmac: fixup documentationKazuki Yamaguchi2016-08-221-0/+28
| | |
* | | digest: cleanup documentationKazuki Yamaguchi2016-08-221-6/+5
| | |
* | | cipher: fixup documentationKazuki Yamaguchi2016-08-221-21/+27
| | |
* | | random: fix document styleKazuki Yamaguchi2016-08-221-7/+7
| | |
* | | ssl: fixup documentationKazuki Yamaguchi2016-08-222-61/+59
| | |
* | | Merge branch 'topic/cipher-doc-aead'Kazuki Yamaguchi2016-08-181-6/+8
|\ \ \ | | | | | | | | | | | | | | | | * topic/cipher-doc-aead: cipher: follow up for the previous documentation update
| * | | cipher: follow up for the previous documentation updatetopic/cipher-doc-aeadKazuki Yamaguchi2016-08-161-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | Add some explaination about the associated data. Also fix the description of the AES-GCM example: the IV (nonce) doesn't need to be unpredictable.
* | | | pkey: clear OpenSSL error queue on PKey::PKey#verify failuretopic/pkey-rsa-verify-error-queueKazuki Yamaguchi2016-08-171-0/+1
| | | | | | | | | | | | | | | | | | | | Similar to 0789643d7333 or 9af69abcec15, EVP_VerifyFinal() may put an error to the error queue when the verification failed.
* | | | x509ext: remove unnecessary DupX509ExtPtr()Kazuki Yamaguchi2016-08-165-33/+8
| | | | | | | | | | | | | | | | All usages can be replaced with GetX509ExtPtr().
* | | | ocsp: fix memory leak in Response#add_cerid on error pathKazuki Yamaguchi2016-08-161-3/+8
| | | | | | | | | | | | | | | | OCSP_CERTID can leak in case OCSP_request_add0_id() fails.
* | | | x509crl: fix memory leak on error pathKazuki Yamaguchi2016-08-161-2/+4
| | | | | | | | | | | | | | | | X509_REVOKED can leak when X509_CRL_add0_revoked() fails.
* | | | pkcs7: fix a memory leak in PKCS7#add_dataKazuki Yamaguchi2016-08-161-2/+2
| | | | | | | | | | | | | | | | | | | | The BIO returned by PKCS7_dataInit() must be free'd using BIO_free_all().
* | | | pkcs7: fix a memory leak in PKCS7#verifyKazuki Yamaguchi2016-08-161-4/+4
| | | | | | | | | | | | | | | | | | | | ossl_obj2bio() must be called after other functions that may raise. Also, the variable `x509s` is not free'd when PKCS7_verify() fails.
* | | | pkey: fix memory leak in PKey::EC#exportKazuki Yamaguchi2016-08-161-5/+6
| | | | | | | | | | | | | | | | | | | | It leaks when invalid value is passed as the `cipher` or `pass` argument.
* | | | pkcs12: fix memory leak in PKCS12.createKazuki Yamaguchi2016-08-161-1/+1
| | | | | | | | | | | | | | | | | | | | ossl_*_ary2sk() function must be called after any other functions that may raise.
* | | | x509revoked: fix memory leaks in #set_extensions and #add_extensionKazuki Yamaguchi2016-08-161-2/+2
| | | | | | | | | | | | | | | | X509_REVOKED_add_ext() dups the X509_EXTENSION.
* | | | x509req: fix memory leaks in #set_attributes and #add_attributeKazuki Yamaguchi2016-08-163-9/+6
| | | | | | | | | | | | | | | | | | | | X509_REQ_add1_attr() dups the X509_ATTRIBUTE given as the argument, so we don't need to duplicate beforehand.
* | | | x509attr: fix memory leak in X509::Attribute#oid=Kazuki Yamaguchi2016-08-161-3/+6
| | | | | | | | | | | | | | | | ASN1_OBJECT returned by OBJ_txt2obj() must be free'd.
* | | | x509ext: fix memory leak in X509::Extension#value=Kazuki Yamaguchi2016-08-161-8/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | X509_EXTENSION_set_data() dups the ASN1_OCTET_STRING, so we must free the temporary ASN1_OCTET_STRING object. However we can retrieve the current ASN1_OCTET_STRING object by X509_EXTENSION_get_data() and modify it directly.
* | | | x509ext: fix memory leak in X509::Extension#oid=Kazuki Yamaguchi2016-08-161-6/+8
| | | | | | | | | | | | | | | | | | | | X509_EXTENSION_set_object() dups the ASN1_OBJECT passed via the argument so we need to free.
* | | | x509ext: fix memory leak in X509::ExtensionFactory#config=Kazuki Yamaguchi2016-08-141-16/+1
| | | | | | | | | | | | | | | | | | | | | | | | X509V3_set_nconf() sets the CONF passed via the argument to X509V3_CTX, but it doesn't free CONF. However we don't actually need it so replace with a simple Ruby-level attribute.
* | | | x509ext: fix a memory leak in X509::ExtensionFactory#create_extKazuki Yamaguchi2016-08-141-0/+1
| | | | | | | | | | | | | | | | The CONF returned by DupConfigPtr() must be free'd by the caller.
* | | | config: rename GetConfigPtr() to DupConfigPtr()Kazuki Yamaguchi2016-08-143-8/+8
|/ / / | | | | | | | | | | | | | | | | | | Make it follow the convention. Other Get*Ptr() functions return a pointer to OpenSSL object that the caller doesn't need to free. Indeed DupConfigPtr() is not the best name (OpenSSL::Config does not actually wrap a CONF object), but should be better than GetConfigPtr().
* | | cipher: update documentationKazuki Yamaguchi2016-08-141-22/+33
| | | | | | | | | | | | | | | Add a note about GCM mode - warn of the risk of reusing nonce and authentication tag truncation. [GH ruby/openssl#63]
* | | ssl: fix memory leak in SSLContext#ecdh_curves=Kazuki Yamaguchi2016-08-131-1/+5
| | | | | | | | | | | | | | | | | | | | | SSL_CTX_set_tmp_ecdh() increments the reference counter of EC_KEY so we must decrement with EC_KEY_free(). Fixes: fcb9b4a6b5c6 (openssl: add SSLContext#ecdh_curves=)
* | | Don't turn on/off OpenSSL's mem check in OpenSSL.debug=Kazuki Yamaguchi2016-08-131-14/+4
| | | | | | | | | | | | | | | Since openssl.so itself doesn't have the funtionality of memory leak check, there is no point doing it.
* | | x509crl: fix CRL#revoked=Kazuki Yamaguchi2016-08-091-1/+5
| | | | | | | | | | | | | | | Fixes cad3226a06a1 (openssl: adapt to OpenSSL 1.1.0 opaque structs, 2016-06-05).
* | | x509req: fix integer conversion in Request#version, #version=Kazuki Yamaguchi2016-08-091-3/+3
| |/ |/| | | | | The input may not be a Fixnum.
* | digest: check return value of EVP_Digest{Update,Final_ex}Kazuki Yamaguchi2016-08-091-6/+10
| | | | | | | | Their return type was void in ancient versions of OpenSSL but no longer.
* | openssl: avoid undefined behavior on empty SSL_writenormal2016-08-071-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SSL_write(3ssl) manpage has this in the WARNINGS section: When calling SSL_write() with num=0 bytes to be sent the behaviour is undefined. And indeed, the new test case demonstrates failures when empty strings are used. So, match the behavior of IO#write, IO#write_nonblock, and IO#syswrite by returning zero, as the OpenSSL::SSL::SSLSocket API already closely mimics the IO one. * ext/openssl/ossl_ssl.c (ossl_ssl_write_internal): avoid undefined behavior * test/openssl/test_pair.rb (test_write_zero): new test [ruby-core:76751] [Bug #12660] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55822 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* | Include ruby/thread_native.h regardless of the OpenSSL versionKazuki Yamaguchi2016-08-071-1/+1
| | | | | | | | | | A workaround so that the OpenSSL version doesn't affect ext/openssl/depend generated by Ruby's tool/update-deps script.
* | pkey: don't pass a seed to DSA_generate_parameters_ex()Kazuki Yamaguchi2016-08-071-10/+3
| | | | | | | | | | | | | | | | | | | | We currently always pass 20 random bytes generated by RAND_bytes(). It is fine when generating parameters <= 1024 bits, because OpenSSL requires a seed with the same length as the prime q, which is 160 bits. FIPS 186-3 allowed the parameters to be >= 2048 bits. For them, OpenSSL generates a 256 bits long q. We can pass 32 bytes long random bytes instead, but the function is able to generate on its own. So just give NULL.
* | ssl: refactor ssl_npn_advertise_cb()Kazuki Yamaguchi2016-08-051-4/+3
| | | | | | | | This removes unnecessary @_protocols instance variable.
* | Implement missing initialize_copytopic/fix-initialize-copyKazuki Yamaguchi2016-08-049-0/+126
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement initialize_copy for: - OpenSSL::PKCS12 - OpenSSL::SSL::SSLSession - OpenSSL::X509::Attribute - OpenSSL::X509::Extension - OpenSSL::X509::Name - OpenSSL::X509::Revoked Remove initialize_copy from: - OpenSSL::SSL::SSLContext - OpenSSL::SSL::SSLSocket - OpenSSL::Engine - OpenSSL::X509::Store - OpenSSL::X509::StoreContext [Bug #12381]
* | Merge branch 'topic/ssl-verify-hostname'Kazuki Yamaguchi2016-07-284-48/+99
|\ \ | | | | | | | | | | | | | | | | | | * topic/ssl-verify-hostname: ssl: add verify_hostname option to SSLContext test/test_ssl: avoid SSLContext#set_params where not required Refactor common verify callback code
| * | ssl: add verify_hostname option to SSLContexttopic/ssl-verify-hostnameKazuki Yamaguchi2016-07-231-2/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a client sets this to true and enables SNI with SSLSocket#hostname=, the hostname verification on the server certificate is performed automatically during the handshake using OpenSSL::SSL.verify_certificate_identity(). Currently an user who wants to do the hostname verification needs to call SSLSocket#post_connection_check explicitly after the TLS connection is established. This commit also enables the option in SSLContext::DEFAULT_PARAMS. Applications using SSLContext#set_params may be affected by this. [GH ruby/openssl#8]
| * | Refactor common verify callback codeKazuki Yamaguchi2016-07-104-46/+53
| |/ | | | | | | | | | | | | | | | | | | There is a function ossl_verify_cb() that fetches the custom callback Proc from X509_STORE/X509_STORE_CTX and calls it, but it was not very useful for SSL code. It's only used in ossl_x509store.c and ossl_ssl.c so move X509::Store specific code to ossl_x509store.c. Also make struct ossl_verify_cb_args and ossl_call_verify_cb_proc() local to ossl.c.
* | Remove unnecessary usage of _() macroKazuki Yamaguchi2016-07-257-16/+16
| |
* | cipher: avoid -Wshorten-64-to-32 warning in ossl_cipher_update_long()Kazuki Yamaguchi2016-07-241-1/+1
| | | | | | | | Fixes c0548c94e499.
* | cipher: fix handling huge data larger than INT_MAX bytesKazuki Yamaguchi2016-07-241-18/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The function ossl_cipher_update_long() was added to fix this in r48923 (ossl_cipher.c: workaround of OpenSSL API, 2014-12-23), but it didn't work well. [Bug #10633] This can be tested by running: $ fallocate -l 2G data.img $ ruby -ropenssl <<EOF cipher = OpenSSL::Cipher.new("aes-128-ecb").encrypt cipher.key = "\x00" * 16 ct = cipher.update(File.read("data.img")) << cipher.final p ct.bytesize EOF
* | Merge branch 'topic/ssl-check-pkey-private'Kazuki Yamaguchi2016-07-203-36/+16
|\ \ | | | | | | | | | | | | | | | | | | * topic/ssl-check-pkey-private: ssl: reject keys without private components ssl: remove unneeded instance variable x509 and key from SSL::SSLSocket pkey: remove unused things
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-29 22:26:04 +0000