aboutsummaryrefslogtreecommitdiffstats
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* Remove trailing spaces [ci skip]Nobuyoshi Nakada2020-12-142-2/+2
|
* ssl: initialize verify_mode and verify_hostname with default valuesky/ssl-attr-default-valuesKazuki Yamaguchi2020-07-181-0/+2
| | | | | | | | | | | | | | | SSLContext's verify_mode expects an SSL_VERIFY_* constant (an integer) and verify_hostname expects either true or false. However, they are set to nil after calling OpenSSL::SSL::SSLContext.new, which is surprising. Set a proper value to them by default: verify_mode is set to OpenSSL::SSL::VERIFY_NONE and verify_hostname is set to false by default. Note that this does not change the default behavior. The certificate verification was never performed unless verify_mode is set to OpenSSL::SSL::VERIFY_PEER by a user. The same applies to verify_hostname.
* hmac: implement base64digest methodsky/hmac-base64Kazuki Yamaguchi2020-06-301-0/+25
| | | | | OpenSSL::HMAC implements the similar interface as ::Digest. Let's add base64digest methods to OpenSSL::HMAC, too, for feature parity.
* hmac: migrate from the low-level HMAC API to the EVP APIky/hmac-evpKazuki Yamaguchi2020-06-301-0/+40
| | | | | | | | | Use the EVP API instead of the low-level HMAC API. Use of the HMAC API has been discouraged and is being marked as deprecated starting from OpenSSL 3.0.0. The two singleton methods OpenSSL::HMAC, HMAC.digest and HMAC.hexdigest are now in lib/openssl/hmac.rb.
* Merge pull request #329 from rhenium/ky/pkey-generic-operationsKazuki Yamaguchi2020-05-131-0/+33
|\ | | | | pkey: add more support for 'generic' pkey types
| * pkey: reimplement PKey::DH#compute_key and PKey::EC#dh_compute_keyky/pkey-generic-operationsKazuki Yamaguchi2020-05-131-0/+33
| | | | | | | | | | Use the new OpenSSL::PKey::PKey#derive instead of the raw {EC,}DH_compute_key(), mainly to reduce amount of the C code.
* | config: revert to C implementation of OpenSSL::ConfigKazuki Yamaguchi2020-05-132-412/+0
| | | | | | | | | | | | | | | | | | | | Revert OpenSSL::Config to using the OpenSSL API and remove our own parser implementation for the config file syntax. OpenSSL::Config now wraps a CONF object. Accessor methods deal with the object directly rather than Ruby-level internal state. This work is based on the old C code we used before 2010.
* | config: remove deprecated methodsKazuki Yamaguchi2020-05-131-90/+0
|/ | | | | | | | | | | | | | | | Remove 4 deprecated methods. The following two methods have been marked as deprecated since 2003, by r4531 (ruby.git commit 78ff3833fb67c8005a9b851037e74b3eea940aa3). - OpenSSL::Config#value - OpenSSL::Config#section Other two methods are removed because the corresponding functions disappeared in OpenSSL 1.1.0. - OpenSSL::Config#add_value - OpenSSL::Config#[]=
* Look up digest by name instead of constantBart de Water2020-04-212-15/+4
|
* Add Marshal support to PKey objectsBart de Water2020-04-193-22/+55
|
* Merge branch 'maint'Kazuki Yamaguchi2020-03-091-18/+36
|\ | | | | | | | | | | | | | | | | | | * maint: ssl: set verify error code in the case of verify_hostname failure x509: add error code and verify flags constants Remove taint support Restore compatibility with older versions of Ruby. Fix keyword argument separation issues in OpenSSL::SSL::SSLSocket#sys{read,write}_nonblock config: support .include directive
| * Merge branch 'maint-2.0' into maintKazuki Yamaguchi2020-03-091-18/+36
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | * maint-2.0: ssl: set verify error code in the case of verify_hostname failure x509: add error code and verify flags constants Remove taint support Restore compatibility with older versions of Ruby. Fix keyword argument separation issues in OpenSSL::SSL::SSLSocket#sys{read,write}_nonblock config: support .include directive
| | * config: support .include directiveky/config-include-directiveKazuki Yamaguchi2019-12-131-18/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 1.1.1 introduces a new '.include' directive. Update our config parser to support that. As mentioned in the referenced GitHub issue, we should use the OpenSSL API instead of implementing the parsing logic ourselves, but it will need backwards-incompatible changes which we can't backport to stable versions. So continue to use the Ruby implementation for now. Squashed in additional changes by Vít Ondruch to support '.include = ' syntax. Reference: https://github.com/ruby/openssl/issues/208
* | | add support for SHA512_256/SHA512_224DBL-Lee2020-02-271-1/+1
| | |
* | | lib/openssl.rb: require openssl/version.rbky/fix-openssl-version-constantKazuki Yamaguchi2020-02-222-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | The OpenSSL::VERSION constant is now defined by lib/openssl/version.rb instead of by the extension. Add missing require statement. Fixes: 0cddb0b736c8 ("Simplify handling of version constant.", 2019-10-31) Reference: https://github.com/ruby/openssl/issues/347
* | | config: deprecate OpenSSL::Config#add_value and #[]=ky/config-deprecate-modifyKazuki Yamaguchi2020-02-191-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL::Config is currently implemented in Ruby, but we plan to revert back to use OpenSSL API, just as it did before r28632 (in ruby_1_8; r29048 in trunk). It's not clear what was the issue with Windows, but the CONF library should work on Windows too. Modifying a CONF object is not possible in OpenSSL API. Actually, it was possible in previous versions of OpenSSL, but we used their internal functions that are not exposed in shared libraries anymore. Accordingly, OpenSSL::Config#add_value and #[]= have to be removed. As a first step towards the change, let's deprecate those methods.
* | | Ensure that binary buffer is used at all times.Samuel Williams2020-02-061-4/+27
| | |
* | | Prefer `frozen_string_literal: true`.Samuel Williams2020-02-0610-17/+16
| | |
* | | Simplify handling of version constant.Samuel Williams2019-12-291-0/+5
| | |
* | | Don't use require_relative to load `openssl.so`.Samuel Williams2019-11-271-1/+1
| | | | | | | | | | | | It breaks when compiled in ruby source tree.
* | | check AIA extension is criticalthekuwayama2019-11-191-5/+1
| | |
* | | clean parse_aia_asn1() private instance methodthekuwayama2019-11-191-9/+10
| | |
* | | add/update document about AuthorityInfoAccessthekuwayama2019-11-191-0/+9
| | | | | | | | | | | | add ca_issuer_uris and ocsp_uris description to the changelog
* | | add helper to retrieve OCSP URIs from Certificatethekuwayama2019-11-191-0/+44
| | | | | | | | | | | | add helper to access information and services for the issuer of the Certificate
* | | raise ASN1Error using an idiomatic syntaxthekuwayama2019-11-111-3/+3
| | |
* | | call ASN1Error.new when certificati extension format is invalidthekuwayama2019-11-111-3/+3
| | |
* | | modify SSLServer#listen default argument value; Socket::SOMAXCONNthekuwayama2019-11-041-1/+2
| | |
* | | Make OpenSSL::HMAC#== compare in constant time instead of returning falseBart de Water2019-11-042-0/+14
| | |
* | | Add helper to retrieve CRL URIs from a certificateBart de Water2019-11-011-0/+34
| | |
* | | Remove MDC2.Samuel Williams2019-11-011-1/+1
| | |
* | | Add support for BLAKE digest.Samuel Williams2019-11-011-1/+1
| | |
* | | Remove unsupported DSS, DSS1 & SHA algorithms.Samuel Williams2019-11-011-4/+3
| | |
* | | Add support for SHA3. Resolves #272.Samuel Williams2019-11-011-7/+17
| | |
* | | Prefer `require_relative`.Samuel Williams2019-10-311-9/+9
| | |
* | | modify document of SSLSocket.openthekuwayama2019-10-311-2/+2
| | |
* | | update SSLSocket.open to match TCPSocket.open method signaturethekuwayama2019-10-311-7/+17
| | |
* | | add SSLSocket.openthekuwayama2019-10-311-3/+19
| | |
* | | add `SSLSocket.open` as alias of `SSLSocket.new`thekuwayama2019-10-311-0/+6
| | |
* | | Add Marshal support to X509 objectsBart de Water2019-10-291-0/+26
| | | | | | | | | | | | | | | | | | This allows for example to use Rails' cache to store these objects. Without this patch you'd get errors like "TypeError (no _dump_data is defined for class OpenSSL::X509::Certificate)" Note that the X509::Revoked class doesn't need the newly introduced modules as the DER output of X509::CRL already includes these.
* | | Add OpenSSL.secure_compare with same semantics as Active Support >= 5.2Bart de Water2019-10-281-0/+14
| | | | | | | | | | | | secure_compare is for user input, fixed_length_secure_compare for already processed data that is known to have the same length
* | | simplify AKI parsing to only return keyIdentifier fieldBen Toews2019-09-271-60/+10
| | |
* | | helpers for accessing AKI/SKI extensions of certs/crlsBen Toews2019-09-271-0/+108
| | |
* | | Prefer generic implementatio in `SocketForwarder`.Samuel Williams2019-03-311-10/+5
| | |
* | | Add `SSLSocket#fileno` and `SSLServer#fileno`. Fixes #198.Samuel Williams2019-03-311-0/+10
| | |
* | | Reduce memory allocation when writing to SSLSocketjm/buffering-reduce-memory-allocationJanko Marohnić2018-08-081-9/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At the moment OpenSSL::Buffering#do_write allocates some additional strings, and in my profiling writing 5MB of data allocates additional 7.7MB of strings. This patch greatly reduces memory allocations, and now writing 5MB of data allocates only additional 0.2MB of strings. This means that large file uploads would effectively not allocate additional memory anymore. Reference: https://bugs.ruby-lang.org/issues/14426 Reference: https://github.com/ruby/ruby/pull/1924
* | | openssl/buffering.rb: no RS when outputnobu2018-08-081-5/+3
| | | | | | | | | | | | | | | | | | | | | | | | * ext/openssl/lib/openssl/buffering.rb (do_write, puts): output methods should not be affected by the input record separator. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62038 b2dd03c8-39d4-4d8f-98ff-823fe69b080e Sync-with-trunk: r62038
* | | Correctly verify abbreviated IPv6 SANsBrian Cunnie2018-02-061-5/+6
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPv6 SAN-verification accommodates ["zero-compression"](https://tools.ietf.org/html/rfc5952#section-2.2). It also accommodates non-compressed addresses. Previously the verification of IPv6 addresses would fail unless the address syntax matched a specific format (no zero-compression, no leading zeroes). As an example, the IPv6 loopback address, if represented as `::1`, would not verify. Nor would it verify if represented as `0000:0000:0000:0000:0000:0000:0000:0001`; however, both representations are valid, RFC-compliant representations. The library would only accept a very specific representation (i.e. `0:0:0:0:0:0:0:1`). This commit addresses that shortcoming, and ensures that any valid IPv6 representation will correctly verify.
* | Merge pull request #177 from rhenium/ky/pkey-ec-point-octet-stringKazuki Yamaguchi2017-12-141-1/+23
|\ \ | | | | | | pkey/ec: add support for octet string encoding of EC point
| * | pkey/ec: add support for octet string encoding of EC pointky/pkey-ec-point-octet-stringKazuki Yamaguchi2017-12-141-1/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new method named PKey::EC#to_octet_string that returns the octet string representation of the curve point. PKey::EC::Point#to_bn, which have already existed and is similar except that an instance of OpenSSL::BN is returned, is rewritten in Ruby. PKey::EC::Point#initialize now takes String as the second argument in the PKey::EC::Point.new(group, encoded_point) form. Also, update the tests to use #to_octet_string instead of #to_bn for better readability.
* | | Merge pull request #162 from rhenium/ky/ssl-write-multiKazuki Yamaguchi2017-11-131-3/+5
|\ \ \ | | | | | | | | buffering: let #write accept multiple arguments
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-07 22:12:09 +0000