| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* test/openssl/test_ssl.rb: Simple tests for this.
Client-side renegotiation is still considered problematic, even
when used in the context of secure renegotiation (RI, RFC 5746).
The changes allow users to either completely disable client
renegotiation on the server, or to specify a maximum number of
handshakes allowed in total. The number of total handshakes is
counted in a callback set as SSL_set_info_callback. If the
maximum number of handshakes is exceeded an error will be raised
We do not support renegotiation in the OpenSSL extension, therefore
this feature can only be tested externally.
The feature is opt-in, the default setting will be to allow
unlimited client renegotiation, as was the case before.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35797 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
| |
* test/openssl/test_ssl.rb: Handle ECONNRESET in code instead to avoid
the test failing in Ruby CI [1]
[1] http://u64.rubyci.org/~chkbuild/ruby-trunk/log/20120507T190102Z.log.html.gz#test-all
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35795 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
| |
* ext/zlib/extconf.rb: ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35705 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
| |
OpenSSL issue.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35686 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
| |
* ext/openssl/extconf.rb: Use exception raising instead of message
and/or abort. We want to display error message to console _and_
logging into mkmf.log.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35685 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
| |
before ossl_raise. this cause a test failure on Linux.
http://u64.rubyci.org/~chkbuild/ruby-trunk/log/20120507T190102Z.log.html.gz
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35583 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
OpenSSL::SSL::OP_NO_TLSv1_1
OpenSSL::SSL::OP_NO_TLSv1_2
to allow blocking specific TLS versions. Thanks to Justin Guyett for
pointing this out to me.
* test/openssl/test_ssl.rb: add tests to assert correct behavior when
blocking certain versions of TLS/SSL both on server and client side.
Also refactored tests to reduce boilerplate code a little.
* test/openssl/utils.rb: rescue Errno::ECONNRESET for tests where
client rejects the connection because a forbidden protocol version
was used.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35567 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
|
|
| |
SSLContext#version to inspect the version that was negotiated for
a given connection.
* ext/openssl/extconf.rb: detect TLS 1.1 & 1.2 support.
* test/openssl/test_ssl.rb: add tests for TLS 1.1 & 1.2 given they
are supported by the native OpenSSL being used.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35549 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
| |
available for macro compatibility.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35507 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
| |
openssl. [ruby-core:44755][Bug #6379]
* ext/openssl/deprecation.rb: extract check for broken Apple OpenSSL.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35504 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
| |
match server cert." error.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35494 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
| |
* ext/openssl/extconf.rb: add --with-broken-apple-openssl option.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35443 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
| |
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35428 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
| |
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35427 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
| |
CPPFLAGS.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35426 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
reached.
* variable.c (rb_obj_remove_instance_variable): Replaced "not reached"
comment with the UNREACHABLE macro.
* variable.c (rb_mod_const_missing): ditto.
* variable.c (rb_mod_remove_cvar): ditto.
* enum.c (first_i): ditto.
* string.c (rb_str_aref): ditto.
* string.c (str_byte_aref): ditto.
* string.c (rb_to_id): ditto.
* io.c (rb_io_fmode_modestr): ditto.
* io.c (rb_io_oflags_modestr): ditto.
* pack.c (num2i32): ditto.
* vm_eval.c (rb_method_missing): ditto.
* vm_eval.c (rb_f_throw): ditto.
* dir.c (dir_read): ditto.
* win32/win32.c (child_result): ditto.
* struct.c (rb_struct_getmember): ditto.
* struct.c (rb_struct_set): ditto.
* struct.c (rb_struct_aref_id): ditto.
* eval.c (rb_f_raise): ditto.
* process.c (rb_f_exit_bang): ditto.
* process.c (rb_f_exit): ditto.
* process.c (rb_f_abort): ditto.
* ext/-test-/iter/break.c (iter_break_value): ditto.
* ext/pty/pty.c (pty_check): ditto.
* ext/openssl/ossl_pkey.c (ossl_pkey_new): ditto.
* ext/readline/readline.c (rb_remove_history): ditto.
* ext/stringio/stringio.c (strio_unimpl): ditto.
* numeric.c (num_sadded): ditto.
* numeric.c (num_init_copy): ditto.
* numeric.c (rb_num2ll): ditto.
* numeric.c (rb_num2ull): ditto.
* vm_insnhelper.c (call_cfunc): ditto.
* ruby.c (opt_W_getter): ditto.
* bignum.c (rb_big_coerce): ditto.
* file.c (rb_f_test): ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35322 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
reaches end of non-void function" warnings. [ruby-trunk - Bug #6066]
* re.c (name_to_backref_number): ditto.
* object.c (rb_Float): ditto.
* io.c (io_readpartial): ditto.
* io.c (io_read_nonblock): ditto.
* pack.c (rb_uv_to_utf8): ditto.
* proc.c (rb_method_entry_arity): ditto.
* vm_method.c (rb_f_notimplement): ditto.
* struct.c (rb_struct_aset_id): ditto.
* class.c (rb_scan_args): ditto.
* process.c (rlimit_resource_type): ditto.
* process.c (rlimit_resource_value): ditto.
* process.c (p_uid_switch): ditto.
* process.c (p_gid_switch): ditto.
* ext/digest/digest.c (rb_digest_instance_update): ditto.
* ext/digest/digest.c (rb_digest_instance_finish): ditto.
* ext/digest/digest.c (rb_digest_instance_reset): ditto.
* ext/digest/digest.c (rb_digest_instance_block_length): ditto.
* ext/bigdecimal/bigdecimal.c (BigDecimalCmp): ditto.
* ext/dl/handle.c (rb_dlhandle_close): ditto.
* ext/tk/tcltklib.c (pending_exception_check0): ditto.
* ext/tk/tcltklib.c (pending_exception_check1): ditto.
* ext/tk/tcltklib.c (ip_cancel_eval_core): ditto.
* ext/tk/tcltklib.c (lib_get_reltype_name): ditto.
* ext/tk/tcltklib.c (create_dummy_encoding_for_tk_core): ditto.
* ext/tk/tkutil/tkutil.c (tk_hash_kv): ditto.
* ext/openssl/ossl_ssl.c (ossl_ssl_session_reused): ditto.
* ext/openssl/ossl_pkey_ec.c (ossl_ec_key_dsa_verify_asn1): ditto.
* ext/openssl/ossl_pkey_ec.c (ossl_ec_point_is_at_infinit): ditto.
* ext/openssl/ossl_pkey_ec.c (ossl_ec_point_is_on_curve): ditto.
* ext/fiddle/conversions.c (generic_to_value): ditto.
* ext/socket/raddrinfo.c (rsock_io_socket_addrinfo): ditto.
* ext/socket/socket.c (sock_s_getnameinfo): ditto.
* ext/ripper/eventids2.c (ripper_token2eventid): ditto.
* cont.c (return_fiber): ditto.
* dmydln.c (dln_load): ditto.
* vm_insnhelper.c (vm_search_normal_superclass): ditto.
* bignum.c (big_fdiv): ditto.
* marshal.c (r_symlink): ditto.
* marshal.c (r_symbol): ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35321 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
| |
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35190 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
| |
* test/openssl/test_pkcs7.rb: assert correct behavior for it.
Thanks to Matt Venables for reporting the issue.
[ruby-core:43250][Bug #6134]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35167 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
values for Primitive instances.
* test/openssl/test_asn1.rb: Assert consistent behavior when
encoding nil values: Primitives raise TypeError, Constructives
raise NoMethodError.
Fixes [ruby-core:43009][Bug #6102]
-This line, and those below, will be ignored--
M test/openssl/test_asn1.rb
M ext/openssl/ossl_asn1.c
M ChangeLog
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35159 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
| |
* ext/openssl/ossl_pkey_rsa.c (rsa_generate): fix argument type.
[Bug #6094]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35117 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This reverts commit r35102.
It breaks tests on FreeBSD.
6) Failure:
test_new_with_exponent(OpenSSL::TestPKeyRSA)
[/usr/home/chkbuild/build/ruby-trunk/20120323T010301Z/ruby/test/openssl/test_pkey_rsa.rb:59]:
<3> expected but was
<12884901891>.
7) Failure:
test_new_exponent_default(OpenSSL::TestPKeyRSA)
[/usr/home/chkbuild/build/ruby-trunk/20120323T010301Z/ruby/test/openssl/test_pkey_rsa.rb:52]:
<65537> expected but was
<281479271743489>.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35116 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
| |
[Bug #6094]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@35102 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
| |
from OpenSSL added by Apple.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@34823 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
| |
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@34816 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
| |
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@34505 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
option to prevent BEAST attack. See [Bug #5353].
In OpenSSL, OP_DONT_INSERT_EMPTY_FRAGMENTS is used to prevent
TLS-CBC-IV vulunerability described at
http://www.openssl.org/~bodo/tls-cbc.txt
It's known issue of TLSv1/SSLv3 but it attracts lots of attention
these days as BEAST attack. (CVE-2011-3389)
Until now ossl sets OP_ALL at SSLContext allocation and call
SSL_CTX_set_options at connection. SSL_CTX_set_options updates the
value by using |= so bits set by OP_ALL cannot be unset afterwards.
This commit changes to call SSL_CTX_set_options only 1 time for each
SSLContext. It sets the specified value if SSLContext#options= are
called and sets OP_ALL if not.
To help users to unset bits in OP_ALL, this commit also adds several
constant to SSL such as
OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS. These constants were
not exposed in Ruby because there's no way to unset bits in OP_ALL
before.
Following is an example to enable 0/n split for BEAST prevention.
ctx.options = OP_ALL & ~OP_DONT_INSERT_EMPTY_FRAGMENTS
* test/openssl/test_ssl.rb: Test above option exists.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@34482 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
|
|
| |
unrecognized OIDs instead of the sn "UNDEF".
* test/openssl/test_x509name.rb: Add tests for the fixed behavior.
Patch provided by Paul Kehrer, thanḱ you!
[ruby-core:41769] [Feature #5787]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@34481 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
| |
Thanks to Mantas Mikulenas for noticing and providing a patch!
[ruby-core:42358] [Bug #5972]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@34469 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
| |
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@34463 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
| |
OpenSSL::X509::Store
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@34423 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
| |
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@34127 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
| |
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@34126 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
| |
b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* ext/openssl/ossl.c (ossl_pem_passwd_cb0, ossl_verify_cb):
pem_passwd_cb and verify_cb ignores the exception raised in a
callback proc so it should clear $! for subsequent execution.
That's said, both subsequent processes for pem_passwd_cb and
verify_cb raises another exception before leaking $! to Ruby world.
We cannot test this fix in Ruby land.
* test/openssl/test_pkey_rsa.rb
(test_read_private_key_pem_pw_exception): Test for pem_passwd_cb +
exception.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@34078 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
| |
* ext/openssl/missing.h: ditto.
Thanks, Tim Mooney for reporting this!
[Bug #5432] [ruby-core:40088]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33843 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
| |
of OpenSSL::SSL::SSLSocket#session.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33842 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
| |
message.
* ext/openssl/ossl_ssl.c: ditto.
* ext/openssl/ossl_pkey_rsa: ditto.
[Bug #5604] [ruby-core:40896]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33821 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
| |
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33763 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
| |
flag.
* ext/openssl/ossl_x509cert.c (rb_fd_fix_cloexec): ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33749 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
| |
Document #set_params.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33695 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
| |
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33634 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
exponent value correctly. Awful bug. This bug caused exponent of
generated key to be always '1'. By default, and regardless of e
given as a parameter.
!!! Keys generated by this code (trunk after 2011-09-01) must be
re-generated !!! (ruby_1_9_3 is safe)
* test/openssl/test_pkey_rsa.rb: Add tests for default exponent and
specifying exponent by a parameter.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33633 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
| |
* ext/openssl/ossl_engine.c: add some missing OpenSSL engines.
Thanks, Yui Naruse, for providing the patch!
[Bug #5548] [ruby-core:40670]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33631 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* io.c (rb_cloexec_dup): new function.
(ruby_dup): use rb_cloexec_dup.
* ext/pty/pty.c (pty_getpty): use rb_cloexec_dup.
* ext/openssl/ossl_bio.c (ossl_obj2bio): ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33553 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
| |
GCC.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33529 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* io.c (rb_fd_set_cloexec): new function.
(ruby_dup): call rb_fd_set_cloexec to set close-on-exec flag.
(rb_sysopen_internal): ditto.
(rb_pipe): ditto.
(io_reopen): ditto.
(io_cntl): ditto.
* process.c (rb_f_exec): change the default :close_others option to
true.
(rb_f_system): ditto.
(move_fds_to_avoid_crash): call rb_fd_set_cloexec to set
close-on-exec flag.
(ruby_setsid): ditto.
(rb_daemon): ditto.
* thread_pthread.c (rb_thread_create_timer_thread): call
rb_fd_set_cloexec to set close-on-exec flag.
* ruby.c (load_file_internal): ditto.
* file.c (rb_file_s_truncate): ditto.
(file_load_ok): ditto.
* random.c (fill_random_seed): ditto.
* ext/pty/pty.c (chfunc): ditto.
(get_device_once): ditto.
* ext/openssl/ossl_bio.c (ossl_obj2bio): ditto.
* ext/socket/init.c (rsock_socket): ditto.
(rsock_s_accept_nonblock): ditto.
(rsock_s_accept): ditto.
* ext/socket/socket.c (rsock_sock_s_socketpair): ditto.
* ext/socket/ancdata.c (discard_cmsg): ditto.
(make_io_for_unix_rights): ditto.
* ext/socket/unixsocket.c (unix_recv_io): ditto.
* ext/io/console/console.c (console_dev): ditto.
[ruby-core:38140] [Feature #5041]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33507 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
| |
* test/openssl/test_ns_spki.rb: Integrate SPKI#to_text.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33497 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
| |
documentation.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33495 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
|
|
|
| |
for Netscape SPKI.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33488 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|