aboutsummaryrefslogtreecommitdiffstats
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* lib/openssl.rb: require openssl/version.rbky/fix-openssl-version-constantKazuki Yamaguchi2020-02-222-1/+2
| | | | | | | | The OpenSSL::VERSION constant is now defined by lib/openssl/version.rb instead of by the extension. Add missing require statement. Fixes: 0cddb0b736c8 ("Simplify handling of version constant.", 2019-10-31) Reference: https://github.com/ruby/openssl/issues/347
* config: deprecate OpenSSL::Config#add_value and #[]=ky/config-deprecate-modifyKazuki Yamaguchi2020-02-191-4/+14
| | | | | | | | | | | | | | OpenSSL::Config is currently implemented in Ruby, but we plan to revert back to use OpenSSL API, just as it did before r28632 (in ruby_1_8; r29048 in trunk). It's not clear what was the issue with Windows, but the CONF library should work on Windows too. Modifying a CONF object is not possible in OpenSSL API. Actually, it was possible in previous versions of OpenSSL, but we used their internal functions that are not exposed in shared libraries anymore. Accordingly, OpenSSL::Config#add_value and #[]= have to be removed. As a first step towards the change, let's deprecate those methods.
* Ensure that binary buffer is used at all times.Samuel Williams2020-02-061-4/+27
|
* Prefer `frozen_string_literal: true`.Samuel Williams2020-02-0610-17/+16
|
* Simplify handling of version constant.Samuel Williams2019-12-291-0/+5
|
* Don't use require_relative to load `openssl.so`.Samuel Williams2019-11-271-1/+1
| | | | It breaks when compiled in ruby source tree.
* check AIA extension is criticalthekuwayama2019-11-191-5/+1
|
* clean parse_aia_asn1() private instance methodthekuwayama2019-11-191-9/+10
|
* add/update document about AuthorityInfoAccessthekuwayama2019-11-191-0/+9
| | | | add ca_issuer_uris and ocsp_uris description to the changelog
* add helper to retrieve OCSP URIs from Certificatethekuwayama2019-11-191-0/+44
| | | | add helper to access information and services for the issuer of the Certificate
* raise ASN1Error using an idiomatic syntaxthekuwayama2019-11-111-3/+3
|
* call ASN1Error.new when certificati extension format is invalidthekuwayama2019-11-111-3/+3
|
* modify SSLServer#listen default argument value; Socket::SOMAXCONNthekuwayama2019-11-041-1/+2
|
* Make OpenSSL::HMAC#== compare in constant time instead of returning falseBart de Water2019-11-042-0/+14
|
* Add helper to retrieve CRL URIs from a certificateBart de Water2019-11-011-0/+34
|
* Remove MDC2.Samuel Williams2019-11-011-1/+1
|
* Add support for BLAKE digest.Samuel Williams2019-11-011-1/+1
|
* Remove unsupported DSS, DSS1 & SHA algorithms.Samuel Williams2019-11-011-4/+3
|
* Add support for SHA3. Resolves #272.Samuel Williams2019-11-011-7/+17
|
* Prefer `require_relative`.Samuel Williams2019-10-311-9/+9
|
* modify document of SSLSocket.openthekuwayama2019-10-311-2/+2
|
* update SSLSocket.open to match TCPSocket.open method signaturethekuwayama2019-10-311-7/+17
|
* add SSLSocket.openthekuwayama2019-10-311-3/+19
|
* add `SSLSocket.open` as alias of `SSLSocket.new`thekuwayama2019-10-311-0/+6
|
* Add Marshal support to X509 objectsBart de Water2019-10-291-0/+26
| | | | | | This allows for example to use Rails' cache to store these objects. Without this patch you'd get errors like "TypeError (no _dump_data is defined for class OpenSSL::X509::Certificate)" Note that the X509::Revoked class doesn't need the newly introduced modules as the DER output of X509::CRL already includes these.
* Add OpenSSL.secure_compare with same semantics as Active Support >= 5.2Bart de Water2019-10-281-0/+14
| | | | secure_compare is for user input, fixed_length_secure_compare for already processed data that is known to have the same length
* simplify AKI parsing to only return keyIdentifier fieldBen Toews2019-09-271-60/+10
|
* helpers for accessing AKI/SKI extensions of certs/crlsBen Toews2019-09-271-0/+108
|
* Prefer generic implementatio in `SocketForwarder`.Samuel Williams2019-03-311-10/+5
|
* Add `SSLSocket#fileno` and `SSLServer#fileno`. Fixes #198.Samuel Williams2019-03-311-0/+10
|
* Reduce memory allocation when writing to SSLSocketjm/buffering-reduce-memory-allocationJanko Marohnić2018-08-081-9/+4
| | | | | | | | | | | | | At the moment OpenSSL::Buffering#do_write allocates some additional strings, and in my profiling writing 5MB of data allocates additional 7.7MB of strings. This patch greatly reduces memory allocations, and now writing 5MB of data allocates only additional 0.2MB of strings. This means that large file uploads would effectively not allocate additional memory anymore. Reference: https://bugs.ruby-lang.org/issues/14426 Reference: https://github.com/ruby/ruby/pull/1924
* openssl/buffering.rb: no RS when outputnobu2018-08-081-5/+3
| | | | | | | | * ext/openssl/lib/openssl/buffering.rb (do_write, puts): output methods should not be affected by the input record separator. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62038 b2dd03c8-39d4-4d8f-98ff-823fe69b080e Sync-with-trunk: r62038
* Correctly verify abbreviated IPv6 SANsBrian Cunnie2018-02-061-5/+6
| | | | | | | | | | | | | | | | | | | IPv6 SAN-verification accommodates ["zero-compression"](https://tools.ietf.org/html/rfc5952#section-2.2). It also accommodates non-compressed addresses. Previously the verification of IPv6 addresses would fail unless the address syntax matched a specific format (no zero-compression, no leading zeroes). As an example, the IPv6 loopback address, if represented as `::1`, would not verify. Nor would it verify if represented as `0000:0000:0000:0000:0000:0000:0000:0001`; however, both representations are valid, RFC-compliant representations. The library would only accept a very specific representation (i.e. `0:0:0:0:0:0:0:1`). This commit addresses that shortcoming, and ensures that any valid IPv6 representation will correctly verify.
* Merge pull request #177 from rhenium/ky/pkey-ec-point-octet-stringKazuki Yamaguchi2017-12-141-1/+23
|\ | | | | pkey/ec: add support for octet string encoding of EC point
| * pkey/ec: add support for octet string encoding of EC pointky/pkey-ec-point-octet-stringKazuki Yamaguchi2017-12-141-1/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | Add a new method named PKey::EC#to_octet_string that returns the octet string representation of the curve point. PKey::EC::Point#to_bn, which have already existed and is similar except that an instance of OpenSSL::BN is returned, is rewritten in Ruby. PKey::EC::Point#initialize now takes String as the second argument in the PKey::EC::Point.new(group, encoded_point) form. Also, update the tests to use #to_octet_string instead of #to_bn for better readability.
* | Merge pull request #162 from rhenium/ky/ssl-write-multiKazuki Yamaguchi2017-11-131-3/+5
|\ \ | | | | | | buffering: let #write accept multiple arguments
| * | buffering: let #write accept multiple argumentsky/ssl-write-multiKazuki Yamaguchi2017-10-231-3/+5
| | | | | | | | | | | | | | | | | | | | | As of Ruby 2.5, IO#write accepts multiple input strings and writes them at once[1]. Follow that. [1] https://bugs.ruby-lang.org/issues/9323
* | | Merge pull request #161 from rhenium/ky/x509-implement-eqKazuki Yamaguchi2017-10-221-0/+33
|\ \ \ | | | | | | | | x509*: implement ==
| * | | x509req: implement X509::Request#==Kazuki Yamaguchi2017-10-121-0/+7
| | | |
| * | | x509crl, x509revoked: implement X509::{CRL,Revoked}#==Kazuki Yamaguchi2017-10-121-0/+14
| | | |
| * | | x509attr: implement X509::Attribute#==Kazuki Yamaguchi2017-10-121-0/+7
| | | |
| * | | x509ext: implement X509::Extension#==Kazuki Yamaguchi2017-10-121-0/+5
| |/ /
* | | Merge branch 'ky/ssl-version-min-max'Kazuki Yamaguchi2017-10-221-1/+2
|\ \ \ | |/ / |/| | | | | | | | | | | * ky/ssl-version-min-max: ssl: fix conflict of options in SSLContext#set_params Use caller with length to reduce unused strings
| * | ssl: fix conflict of options in SSLContext#set_paramsky/ssl-version-min-maxKazuki Yamaguchi2017-10-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make SSLContext#set_params call #options= first. SSLContext#set_params by default disables SSL 2.0 and SSL 3.0 by calling SSLContext#min_version=. After that, it sets the SSL option flags by calling SSLContext#options=. This is problematic when built with OpenSSL before 1.1.0 because SSLContext#min_version= achieves its goal using the SSL_OP_NO_{SSL,TLS}* options. Since the subsequent SSLContext#options= call replaces the flags rather than OR together, this results in effectively disabling min_version setting in SSLContext::DEFAULT_PARAMS. The issue was first fixed in Ruby trunk tree, as part of r60310 ("fix OpenSSL::SSL::SSLContext#min_version doesn't work", 2017-10-21).
| * | Use caller with length to reduce unused stringskazu2017-10-221-1/+1
| | | | | | | | | | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60288 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* | | x509name: update regexp in OpenSSL::X509::Name.parseky/x509name-fix-parse-opensslKazuki Yamaguchi2017-09-031-1/+7
|/ / | | | | | | | | | | | | Allow the attribute value to contain ',', just as the openssl utility's parse_name() function does. Fixes: https://github.com/ruby/openssl/issues/39
* | ssl: rework SSLContext#ssl_version=Kazuki Yamaguchi2017-09-031-0/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reimplement SSLContext#ssl_version= as a wrapper around SSLContext#min_version= and #max_version=. SSLContext#ssl_version= used to call SSL_CTX_set_ssl_version() which replaces the SSL method used for the connections created from the SSL context. This is mainly used for forcing a specific SSL/TLS protocol version. As of OpenSSL 1.1.0, however, use of the version-specific SSL methods such as TLSv1_method() is deprecated. Follow the current recommendation -- to use the generic SSL method always and to control the supported version range by SSL_CTX_set_{min,max}_proto_version(). Actually, we have already started doing a similar thing when the extension is compiled with OpenSSL 1.1.0. OpenSSL::SSL::SSLContext::METHODS, which contained the possible names of SSL methods, is not useful anymore. It is now deprecate_constant-ed.
* | ssl: add SSLContext#min_version= and #max_version=Kazuki Yamaguchi2017-09-031-6/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | Add methods that set the minimum and maximum supported protocol versions for the SSL context. If the OpenSSL library supports, use SSL_CTX_set_{min,max}_proto_version() that do the exact thing. Otherwise, simulate by combining SSL_OP_NO_{SSL,TLS}v* flags. The new methods are meant to replace the deprecated #ssl_version= that cannot support multiple protocol versions. SSLContext::DEFAULT_PARAMS is also updated to use the new SSLContext#min_version=.
* | ssl: use 2048-bit group in the default tmp_dh_cbKazuki Yamaguchi2017-09-021-14/+1
| | | | | | | | | | | | The 'keylen' parameter of the tmp_dh_callback is only meaningful when 'is_export' is non-zero. Ignore them and just return the default 2048-bit DH group.
* | ssl: mark OpenSSL::SSL::SSLContext::DEFAULT_{1024,2048} as privateKazuki Yamaguchi2017-08-291-4/+3
|/ | | | | | Follow-up commit eaffc69e40ab ("ssl: move default DH parameters from OpenSSL::PKey::DH", 2017-01-23). Those constants shouldn't be used directly.
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-01 14:35:36 +0000