aboutsummaryrefslogtreecommitdiffstats
path: root/ext/openssl
Commit message (Collapse)AuthorAgeFilesLines
* pkcs12: fix .new to handle strucuture with no keys or no certstopic/pkcs12-read-no-private-keyKazuki Yamaguchi2016-09-051-9/+11
| | | | | | | | | | It's possible that a PKCS #12 strucuture holds zero private keys. At such a time PKCS12_parse() returns NULL as the private key. Likewise, when the strucuture does not contain the corresponding certificate to the private key, PKCS12_parse() returns NULL as the certificate. Reported and fix suggested by Masahiro Tomita <tommy@tmtm.org>. [ruby-dev:49776] [Bug #12726]
* ssl: eliminate SSLContext::INIT_VARStopic/ssl-eliminate-init-varsKazuki Yamaguchi2016-09-021-100/+110
| | | | | | | | | | | | Use rb_attr_get() instead of rb_iv_get() so that we can remove SSLContext::INIT_VARS. SSLContext::INIT_VARS contains the names of the instance variables used in SSLContext. SSLContext#initialize sets nil for those variables. It is necessary to suppress "instance variable @foo not initialized" warnings emitted by rb_iv_get(). The warnings can be avoided by using rb_attr_get() that does not check the existence of the variable. So use it.
* ssl: hide callback_state from RubyKazuki Yamaguchi2016-09-021-1/+1
| | | | | | | | | Remove '@' prefix from the variable name to hide it from Ruby. Currently a SSLSocket instance allows modifying the value of @callback_state if an user use Object#instance_variable_set. This is dangerous because the variable is used for storing the tag jump state - modifying it from Ruby can crash the process.
* ssl: don't store selected {EC,}DH parameter in an instance variableKazuki Yamaguchi2016-09-021-4/+0
| | | | | | | | The OpenSSL::PKey::{DH,EC} object is stored in an instance variable to prevent the object from being GC'd (cf. r51460). However it turned out to be unnecessary. The underlying object, DH and EC_KEY, have a reference counter and OpenSSL increments it for the object returned by the callback functions.
* ssl: check return value of SSL_CTX_set_alpn_protos()Kazuki Yamaguchi2016-08-301-1/+5
| | | | | | The function can fail on memory allocation error. Note that the function returns 0 on success unlike other almost all functions in OpenSSL.
* ssl: catch exceptions raised in ALPN/NPN callbacksKazuki Yamaguchi2016-08-301-15/+47
| | | | | | | | | | | | | | | They aren't exception safe - they are called during parsing the Client/Server Hello from OpenSSL code. An exception raised in the callbacks escapes directly from OpenSSL code so it can break internal status of OpenSSL. We have a procedure for handling such exceptions raised during an handshake: catch them and store the state number in the SSLSocket object, and then check it in ossl_ssl_start() and re-raise after the control turned back to our side. This fixes the instability of TestSSL::test_alpn_protocol_selection_cancel.
* * remove trailing spaces.svn2016-08-291-3/+3
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56028 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Ruby/OpenSSL 2.0.0.beta.1v2.0.0.beta.1Kazuki Yamaguchi2016-08-291-1/+1
|
* pkey: use rb_attr_get() instead of rb_iv_get() in ossl_pkey_ec.cKazuki Yamaguchi2016-08-281-24/+29
| | | | | This suppresses runtime warning of "instance variable @group not initialized".
* x509ext: fix X509::ExtensionFactory#create_ext with configKazuki Yamaguchi2016-08-281-0/+2
| | | | | | | The assumption in commit 1b1d520818e0 ("x509ext: fix memory leak in X509::ExtensionFactory#config=") was wrong. The uninitialized X509V3_CTX::db can be referred through "r2i" functions when creating certain types of extension that use them.
* Avoid unnecessary memory allocation in string2hex()Kazuki Yamaguchi2016-08-264-87/+56
| | | | | | | Remove string2hex() and replace with newly added ossl_bin2hex(). Since the output hex string is always returned to users as a String, we can avoid the memory allocation by writing directly to the String buffer. This also reduces some lines of code.
* Merge branch 'topic/cipher-auth-tag-len'Kazuki Yamaguchi2016-08-261-3/+45
|\ | | | | | | | | * topic/cipher-auth-tag-len: cipher: add Cipher#auth_tag_len=
| * cipher: add Cipher#auth_tag_len=topic/cipher-auth-tag-lenKazuki Yamaguchi2016-08-141-3/+45
| | | | | | | | | | | | Add a method to set the authentication tag length to be generate by an AEAD ciphers. In particular, OCB mode which is implemented in OpenSSL 1.1.0 requires this.
* | ocsp: fix error queue leak on OCSP::{BasicResponse,Request}#verifyKazuki Yamaguchi2016-08-261-2/+2
| | | | | | | | | | OCSP_{basic,request}_verify() can return a negative value for verification failure.
* | ocsp: set properly OCSP_NOCERTS flag in OCSP::Request#signKazuki Yamaguchi2016-08-261-7/+9
| | | | | | | | | | | | The variable names 'flg' and 'flags' are mixed up and it doesn't set OCSP_NOCERTS flag correctly when the 'certs' argument is not given. [Bug #12704] [ruby-core:77061]
* | Adapt to OpenSSL changes after the 1.1.0-pre6Kazuki Yamaguchi2016-08-268-39/+67
| | | | | | | | | | | | | | Fix compiler errors and warnings. The order of parameters of X509_{CRL,REQ}_get0_signature() has been changed, and certificate and CRL time accessors have been reorganized: *_get_* functions are deprecated and replaced by *_get0_* that return a const pointer.
* | asn1: constify functionsKazuki Yamaguchi2016-08-264-11/+12
| | | | | | | | In order to avoid compiler warnings when build with OpenSSL 1.1.0.
* | bn: optimize try_convert_to_bnptr() for non-BN objectstopic/argument-conversionKazuki Yamaguchi2016-08-221-46/+55
| | | | | | | | | | | | | | | | | | | | | | Use the same logic as BN#initialize. It is used through GetBNPtr(). For example, with this change, the following code will be about 7x faster: puts Benchmark.measure { a = 0.to_bn b = 2 ** 2048 i = 0; a + b while (i += 1) <= 1_000_000 }
* | Avoid using *2FIX() where we don't know if it really fits in FixnumKazuki Yamaguchi2016-08-229-31/+28
| |
* | pkey: allow non-BN object as the multiplier in PKey::EC::Point#mulKazuki Yamaguchi2016-08-221-7/+6
| |
* | cipher: allow cipher name in GetCipherPtr()Kazuki Yamaguchi2016-08-221-3/+16
| | | | | | | | | | | | | | | | | | | | | | | | The function GetCipherPtr() is used when we want a const EVP_CIPHER that represents a cipher algorithm. This change allows users to write a code that exports a PKey encrypted without creating an OpenSSL::Cipher instance: pkey = OpenSSL::PKey.read(...) pkey.export("aes-128-cbc") { password } This is the same as what happened to GetDigestPtr() in r12128.
* | Merge pull request #59 from ruby/topic/doc-workKazuki Yamaguchi2016-08-221-14/+0
|\ \ | | | | | | [WIP] Add NEWS and update CONTRIBUTING.md
| * \ Merge branch 'master' into topic/doc-workKazuki Yamaguchi2016-08-0920-143/+355
| |\ \
| * | | Remove Install section from rdocKazuki Yamaguchi2016-07-281-14/+0
| | | |
* | | | x509store: fixup documentationtopic/fixup-docsKazuki Yamaguchi2016-08-222-32/+243
| | | |
* | | | pkey: fixup documentKazuki Yamaguchi2016-08-225-111/+243
| | | |
* | | | hmac: fixup documentationKazuki Yamaguchi2016-08-221-0/+28
| | | |
* | | | digest: cleanup documentationKazuki Yamaguchi2016-08-221-6/+5
| | | |
* | | | cipher: fixup documentationKazuki Yamaguchi2016-08-221-21/+27
| | | |
* | | | random: fix document styleKazuki Yamaguchi2016-08-221-7/+7
| | | |
* | | | ssl: fixup documentationKazuki Yamaguchi2016-08-222-61/+59
| | | |
* | | | Merge branch 'topic/cipher-doc-aead'Kazuki Yamaguchi2016-08-181-6/+8
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | * topic/cipher-doc-aead: cipher: follow up for the previous documentation update
| * | | | cipher: follow up for the previous documentation updatetopic/cipher-doc-aeadKazuki Yamaguchi2016-08-161-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add some explaination about the associated data. Also fix the description of the AES-GCM example: the IV (nonce) doesn't need to be unpredictable.
* | | | | pkey: clear OpenSSL error queue on PKey::PKey#verify failuretopic/pkey-rsa-verify-error-queueKazuki Yamaguchi2016-08-171-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Similar to 0789643d7333 or 9af69abcec15, EVP_VerifyFinal() may put an error to the error queue when the verification failed.
* | | | | x509ext: remove unnecessary DupX509ExtPtr()Kazuki Yamaguchi2016-08-165-33/+8
| | | | | | | | | | | | | | | | | | | | All usages can be replaced with GetX509ExtPtr().
* | | | | ocsp: fix memory leak in Response#add_cerid on error pathKazuki Yamaguchi2016-08-161-3/+8
| | | | | | | | | | | | | | | | | | | | OCSP_CERTID can leak in case OCSP_request_add0_id() fails.
* | | | | x509crl: fix memory leak on error pathKazuki Yamaguchi2016-08-161-2/+4
| | | | | | | | | | | | | | | | | | | | X509_REVOKED can leak when X509_CRL_add0_revoked() fails.
* | | | | pkcs7: fix a memory leak in PKCS7#add_dataKazuki Yamaguchi2016-08-161-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | The BIO returned by PKCS7_dataInit() must be free'd using BIO_free_all().
* | | | | pkcs7: fix a memory leak in PKCS7#verifyKazuki Yamaguchi2016-08-161-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | ossl_obj2bio() must be called after other functions that may raise. Also, the variable `x509s` is not free'd when PKCS7_verify() fails.
* | | | | pkey: fix memory leak in PKey::EC#exportKazuki Yamaguchi2016-08-161-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | It leaks when invalid value is passed as the `cipher` or `pass` argument.
* | | | | pkcs12: fix memory leak in PKCS12.createKazuki Yamaguchi2016-08-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | ossl_*_ary2sk() function must be called after any other functions that may raise.
* | | | | x509revoked: fix memory leaks in #set_extensions and #add_extensionKazuki Yamaguchi2016-08-161-2/+2
| | | | | | | | | | | | | | | | | | | | X509_REVOKED_add_ext() dups the X509_EXTENSION.
* | | | | x509req: fix memory leaks in #set_attributes and #add_attributeKazuki Yamaguchi2016-08-163-9/+6
| | | | | | | | | | | | | | | | | | | | | | | | | X509_REQ_add1_attr() dups the X509_ATTRIBUTE given as the argument, so we don't need to duplicate beforehand.
* | | | | x509attr: fix memory leak in X509::Attribute#oid=Kazuki Yamaguchi2016-08-161-3/+6
| | | | | | | | | | | | | | | | | | | | ASN1_OBJECT returned by OBJ_txt2obj() must be free'd.
* | | | | x509ext: fix memory leak in X509::Extension#value=Kazuki Yamaguchi2016-08-161-8/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | X509_EXTENSION_set_data() dups the ASN1_OCTET_STRING, so we must free the temporary ASN1_OCTET_STRING object. However we can retrieve the current ASN1_OCTET_STRING object by X509_EXTENSION_get_data() and modify it directly.
* | | | | x509ext: fix memory leak in X509::Extension#oid=Kazuki Yamaguchi2016-08-161-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | X509_EXTENSION_set_object() dups the ASN1_OBJECT passed via the argument so we need to free.
* | | | | x509ext: fix memory leak in X509::ExtensionFactory#config=Kazuki Yamaguchi2016-08-141-16/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | X509V3_set_nconf() sets the CONF passed via the argument to X509V3_CTX, but it doesn't free CONF. However we don't actually need it so replace with a simple Ruby-level attribute.
* | | | | x509ext: fix a memory leak in X509::ExtensionFactory#create_extKazuki Yamaguchi2016-08-141-0/+1
| | | | | | | | | | | | | | | | | | | | The CONF returned by DupConfigPtr() must be free'd by the caller.
* | | | | config: rename GetConfigPtr() to DupConfigPtr()Kazuki Yamaguchi2016-08-143-8/+8
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | Make it follow the convention. Other Get*Ptr() functions return a pointer to OpenSSL object that the caller doesn't need to free. Indeed DupConfigPtr() is not the best name (OpenSSL::Config does not actually wrap a CONF object), but should be better than GetConfigPtr().
* | | / cipher: update documentationKazuki Yamaguchi2016-08-141-22/+33
| |_|/ |/| | | | | | | | | | | Add a note about GCM mode - warn of the risk of reusing nonce and authentication tag truncation. [GH ruby/openssl#63]
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-29 22:22:49 +0000