aboutsummaryrefslogtreecommitdiffstats
path: root/ext/openssl
Commit message (Collapse)AuthorAgeFilesLines
* [ruby/openssl] History.md: Escape Markdown syntax Italic "*". [ci skip]Jun Aruga2023-11-251-1/+1
| | | | https://github.com/ruby/openssl/commit/dc26433ae5
* [ruby/openssl] Ruby/OpenSSL 3.2.0Kazuki Yamaguchi2023-09-213-2/+42
| | | | https://github.com/ruby/openssl/commit/6b3dd6a372
* [ruby/openssl] Update README and gemspec descriptionKazuki Yamaguchi2023-09-211-2/+2
| | | | | | | | | | | | * Reword the description in README for more clarity. * Add a compatibility matrix of our stable branches and explain the maintenance policy. * Remove the obsolete paragraph for how to use the gem in Ruby 2.3, which is no longer supported. https://github.com/ruby/openssl/commit/7691034fcb
* [ruby/openssl] x509ext: let X509::ExtensionFactory#create_ext take a dotted ↵Michael Richardson2023-09-061-5/+11
| | | | | | | | | | | | | OID string instead of looking of NIDs and then using X509V3_EXT_nconf_nid, instead just pass strings to X509V3_EXT_nconf, which has all the logic for processing dealing with generic extensions also process the oid through ln2nid() to retain compatibility. [rhe: tweaked commit message and added a test case] https://github.com/ruby/openssl/commit/9f15741331
* [ruby/openssl] Fix OCSP documentationPetrik2023-09-061-1/+1
| | | | | | | `port` should be called on the `ocsp_uri` URI instead of `ocsp`, which is just a string. https://github.com/ruby/openssl/commit/89a1c82dd0
* [ruby/openssl] Prefer String#unpack1Mau Magnaguagno2023-09-061-1/+1
| | | | | | | | | | (https://github.com/ruby/openssl/pull/586) String#unpack1 avoids the intermediate array created by String#unpack for single elements, while also making a call to Array#first/[0] unnecessary. https://github.com/ruby/openssl/commit/8eb0715a42
* [ruby/openssl] ssl: use ffdhe2048 from RFC 7919 as the default DH group ↵Kazuki Yamaguchi2023-09-061-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | parameters In TLS 1.2 or before, if DH group parameters for DHE are not supplied with SSLContext#tmp_dh= or #tmp_dh_callback=, we currently use the self-generated parameters added in commit https://github.com/ruby/openssl/commit/bb3399a61c03 ("support 2048 bit length DH-key", 2016-01-15) as the fallback. While there is no known weakness in the current parameters, it would be a good idea to switch to pre-defined, more well audited parameters. This also allows the fallback to work in the FIPS mode. The PEM encoding was derived with: # RFC 7919 Appendix A.1. ffdhe2048 print OpenSSL::PKey.read(OpenSSL::ASN1::Sequence([OpenSSL::ASN1::Integer((<<-END).split.join.to_i(16)), OpenSSL::ASN1::Integer(2)]).to_der).to_pem FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1 D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9 7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561 2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935 984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735 30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19 0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61 9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73 3BB5FCBC 2EC22005 C58EF183 7D1683B2 C6F34A26 C1B2EFFA 886B4238 61285C97 FFFFFFFF FFFFFFFF END https://github.com/ruby/openssl/commit/a5527cb4f4
* [ruby/openssl] Refactor Buffering consume_rbuff and getbyte methodsMau Magnaguagno2023-09-061-5/+2
| | | | | | Prefer ``slice!`` for ``Buffering#consume_rbuff`` and safe navigation with ``ord`` for ``Buffering#getbyte``, similar to ``each_byte``. https://github.com/ruby/openssl/commit/5f6abff178
* [ruby/openssl] Remove OSSL_DEBUG compile-time optionKazuki Yamaguchi2023-09-062-112/+0
| | | | | | | | | | | | Remove the OSSL_DEBUG flag and OpenSSL.mem_check_start which is only compiled when the flag is given. They are meant purely for development of Ruby/OpenSSL. OpenSSL.mem_check_start helped us find memory leak bugs in past, but it is no longer working with the recent OpenSSL versions. Let's just remove it now. https://github.com/ruby/openssl/commit/8c7a6a17e2
* [ruby/openssl] ossl_pkey.c: Workaround: Decode with non-zero selections.Jun Aruga2023-08-281-52/+59
| | | | | | | | | | | This is a workaround for the decoding issue in ossl_pkey_read_generic(). The issue happens in the case that a key management provider is different from a decoding provider. Try all the non-zero selections in order, instead of selection 0 for OpenSSL 3 to avoid the issue. https://github.com/ruby/openssl/commit/db688fa739
* [ruby/openssl] Fix LIBRESSL_VERSION_NUMBER document mistake.Jun Aruga2023-08-251-2/+2
| | | | | | | | | | | | | | | | | | | | * Fix the wrong man reference. * According to the LIBRESSL_VERSION_NUMBER(3), the value always ends with 00f. ``` $ man -M /home/jaruga/.local/libressl-6650dce/share/man/ 3 LIBRESSL_VERSION_NUMBER ... DESCRIPTION OPENSSL_VERSION_NUMBER and LIBRESSL_VERSION_NUMBER are numeric release version identifiers. The first two digits contain the major release number, the third and fourth digits the minor release number, and the fifth and sixth digits the fix re‐ lease number. For OpenSSL, the seventh and eight digits contain the patch release number and the final digit is 0 for development, 1 to e for betas 1 to 14, or f for release. For LibreSSL, OPENSSL_VERSION_NUMBER is always 0x020000000, and LIBRESSL_VERSION_NUMBER always ends with 00f. ``` https://github.com/ruby/openssl/commit/296c859d18
* [ruby/openssl] Enhance printing OpenSSL versions.Jun Aruga2023-08-161-1/+18
| | | | | | | | | | | * Updated the `OpenSSL::OPENSSL_VERSION_NUMBER` comment explaining the format. * Added the `OpenSSL::LIBRESSL_VERSION_NUMBER` to print LibreSSL version number, in the case that Ruby OpenSSL binding is compiled with LibreSSL. Note `test/openssl/utils.rb#libressl?` is not using this value in it for now. * Update `rake debug` to print the values in a readable way, adding `OpenSSL::OPENSSL_VERSION_NUMBER` and `OpenSSL::LIBRESSL_VERSION_NUMBER`. https://github.com/ruby/openssl/commit/d19e6360ed
* [ruby/openssl] Include "additional data" message in OpenSSL errorsKazuki Yamaguchi2023-08-161-12/+17
| | | | | | | | | | | | | | | | | Error entries in the OpenSSL error queue may contain additional contextual information associated with the error, which can be helpful when debugging. This "additional data" is currently only printed to stderr when OpenSSL.debug is enabled. Let's include this in the exception messages raised with ossl_raise(), too. $ ruby -Ilib -ropenssl -e'OpenSSL.debug=true; OpenSSL::SSL::SSLContext.new.ecdh_curves="P-256:not-a-curve"' -e:1: warning: error on stack: error:0A080106:SSL routines:gid_cb:passed invalid argument (group 'not-a-curve' cannot be set) -e:1:in `ecdh_curves=': passed invalid argument (group 'not-a-curve' cannot be set) (OpenSSL::SSL::SSLError) from -e:1:in `<main>' https://github.com/ruby/openssl/commit/1c5bbdd68e
* [ruby/openssl] ssl: raise SSLError if loading ca_file or ca_path failsKazuki Yamaguchi2023-08-161-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When compiled with OpenSSL <= 1.1.1, OpenSSL::SSL::SSLContext#setup does not raise an exception on an error return from SSL_CTX_load_verify_locations(), but instead only prints a verbose-mode warning. This is not helpful since it very likely indicates an actual error, such as the specified file not being readable. Also, OpenSSL's error queue is not correctly cleared: $ ruby -w -ropenssl -e'OpenSSL.debug=true; ctx=OpenSSL::SSL::SSLContext.new; ctx.ca_file="bad-path"; ctx.setup; pp OpenSSL.errors' -e:1: warning: can't set verify locations ["error:02001002:system library:fopen:No such file or directory", "error:2006D080:BIO routines:BIO_new_file:no such file", "error:0B084002:x509 certificate routines:X509_load_cert_crl_file: system lib"] The behavior is currently different when compiled with OpenSSL >= 3.0: SSLError is raised if SSL_CTX_load_verify_file() or SSL_CTX_load_verify_dir() fails. This inconsistency was unintentionally introduced by commit https://github.com/ruby/openssl/commit/5375a55ffc35 ("ssl: use SSL_CTX_load_verify_{file,dir}() if available", 2020-02-22). However, raising SSLError seems more appropriate in this situation. Let's adjust the OpenSSL <= 1.1.1 code so that it behaves the same way as the OpenSSL >= 3.0 code currently does. Fixes: https://github.com/ruby/openssl/issues/649 https://github.com/ruby/openssl/commit/7eb10f7b75
* [ruby/openssl] Raise an error when the specified OpenSSL library directory ↵Jun Aruga2023-08-161-2/+22
| | | | | | | | | | | | | doesn't exist. OpenSSL built from the source creates the library directory to the `/path/to/openssl_dir/lib64` as a default. In the case, the `bundle exec rake compile -- --with-openssl-dir=<openssl_dir>` cannot compile with the lib64 directory, and may compile with system OpenSSL's libraries unintentionally. This commit is to check this case to avoid linking with an unintentional library directory. https://github.com/ruby/openssl/commit/ca54087462
* [ruby/openssl] [DOC] enhance RDoc for exporting pkeysKazuki Yamaguchi2023-08-165-26/+219
| | | | | | | | | | | | Describe the behavior of OpenSSL::PKey::{DH,DSA,EC,RSA}#to_pem and #to_der more clearly. They return a different result depending on whether the pkey is a public or private key. This was not documented adequately. Also, suggest the use of OpenSSL::PKey::PKey#private_to_pem and #public_to_pem instead, if possible. https://github.com/ruby/openssl/commit/d22769af8f
* [ruby/openssl] [DOC] prefer PKey#private_to_pem and #public_to_pem in RDocKazuki Yamaguchi2023-08-161-8/+6
| | | | | | | | | | | | | | | | | | | Suggest the use of OpenSSL::PKey::PKey#private_to_pem and #public_to_pem in the top-level documentation. For new programs, these are recommended over OpenSSL::PKey::RSA#export (also aliased as #to_s and #to_pem) unless there is a specific reason to use it, i.e., unless the PKCS#1 output format specifically is required. The output format of OpenSSL::PKey::RSA#export depends on whether the key is a public key or a private key, which is very counter-intuitive. Additionally, when called with arguments to encrypt a private key, as in this example, OpenSSL's own, non-standard format is used. The man page of PEM_write_bio_PrivateKey_traditional(3) in OpenSSL 1.1.1 or later states that it "should only be used for compatibility with legacy programs". https://github.com/ruby/openssl/commit/56312038d6
* [ruby/openssl] [DOC] prefer "password" to "passphrase"Kazuki Yamaguchi2023-08-163-21/+21
| | | | | | | | | | Let's consistently use the word "password". Although they are considered synonymous, the mixed usage in the rdoc can cause confusion. OpenSSL::KDF.scrypt is an exception. This is because RFC 7914 refers to the input parameter as "passphrase". https://github.com/ruby/openssl/commit/06d67640e9
* [ruby/openssl] ssl: adjust "certificate verify failed" error on ↵Kazuki Yamaguchi2023-08-161-25/+25
| | | | | | | | | | | | | | | SSL_ERROR_SYSCALL Enrich SSLError's message with the low-level certificate verification result, even if SSL_get_error() returns SSL_ERROR_SYSCALL. This is currently done on SSL_ERROR_SSL only. According to the man page of SSL_get_error(), SSL_ERROR_SYSCALL may be returned for "other errors, check the error queue for details". This apparently means we have to treat SSL_ERROR_SYSCALL, if errno is not set, as equivalent to SSL_ERROR_SSL. https://github.com/ruby/openssl/commit/5113777e82
* [ruby/openssl] ssl: adjust styles of ossl_start_ssl()Kazuki Yamaguchi2023-08-161-36/+36
| | | | | | | Expand tabs, insert some spaces, and adjust indentation of switch-case to match Ruby's style. https://github.com/ruby/openssl/commit/10833aa8f6
* [ruby/openssl] Always respect the openssl prefix chosen by ↵Benoit Daloze2023-07-241-1/+8
| | | | | | | | truffle/openssl-prefix on TruffleRuby * See https://github.com/ruby/openssl/issues/650#issuecomment-1645699608 https://github.com/ruby/openssl/commit/ca738e7e13
* [ruby/openssl] [DOC] remove top-level example forKazuki Yamaguchi2023-07-121-39/+0
| | | | | | | | | | | | | | | | | | | OpenSSL::Cipher#pkcs5_keyivgen (https://github.com/ruby/openssl/pull/647) OpenSSL::Cipher#pkcs5_keyivgen should only be used when it is absolutely necessary for compatibility with ancient applications. Having an example can be misleading. We already have another example for OpenSSL::Cipher in which PBKDF2 is used to derive a key. As described in the rdoc of OpenSSL::Cipher#pkcs5_keyivgen, it is compatible with PKCS#5 PBES1 (PKCS#5 v1.5) only when used in combination of a hash function MD2, MD5, or SHA-1, and a cipher DES-CBC or RC2-CBC. This example uses MD5 as the hash function and combines it with AES. This is considered insecure and also using a non-standard technique to derive longer keys. https://github.com/ruby/openssl/commit/e379cc0cca
* [ruby/openssl] Add support for raw private/public keysRyo Kajiwara2023-07-121-0/+132
| | | | | | | | | | | | | | | (https://github.com/ruby/openssl/pull/646) Add OpenSSL::PKey.new_raw_private_key, #raw_private_key and public equivalents. These methods are useful for importing and exporting keys that support "raw private/public key". Currently, OpenSSL implements X25519/X448 and Ed25519/Ed448 keys. [rhe: rewrote commit message] https://github.com/ruby/openssl/commit/3f29525618 Co-authored-by: Bart de Water <bartdewater@gmail.com>
* [ruby/openssl] add OpenSSL Provider supportqwyng2023-06-195-0/+448
| | | | | https://github.com/ruby/openssl/commit/189c167e40 [rhe: tool/update-deps --fix to update ext/openssl/depend]
* [ruby/openssl] pkey: use unsigned type for bit fieldsKazuki Yamaguchi2023-06-191-3/+3
| | | | | | | | | | | clang generates a warning: ../../../../ext/openssl/ossl_pkey.c:326:22: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion] arg->interrupted = 1; ^ ~ 1 error generated. https://github.com/ruby/openssl/commit/4b2ba7b022
* [ruby/openssl] Drop support for Ruby 2.6Kazuki Yamaguchi2023-06-193-23/+1
| | | | | | | Ruby 2.6 has reached EOL on 2022-03. Requiring Ruby 2.7 allows us to use C99 syntax. https://github.com/ruby/openssl/commit/f6ba75e51e
* [ruby/openssl] extconf.rb: apply RUBY_OPENSSL_EXT{C,LD}FLAGS after checking ↵Kazuki Yamaguchi2023-06-191-6/+6
| | | | | | | | | | | | | | features RUBY_OPENSSL_EXTCFLAGS and RUBY_OPENSSL_EXTLDFLAGS have been added for the primary purpose of appending custom warning flags during development and CI. Since checking programs generated by mkmf may not be completely warning-free, we don't want to apply -Werror that may be supplied from those environment variables. https://github.com/ruby/openssl/commit/2a95b971d5
* [ruby/openssl] Workaround: Fix OpenSSL::PKey.read that cannot parse PKey in ↵Jun Aruga2023-06-191-5/+21
| | | | | | | | | | | | | | | | | | | | | | | | | the FIPS mode. This commit is a workaround to avoid the error below that the `OpenSSL::PKey.read` fails with the OpenSSL 3.0 FIPS mode. ``` $ openssl genrsa -out key.pem 4096 $ ruby -e "require 'openssl'; OpenSSL::PKey.read(File.read('key.pem'))" -e:1:in `read': Could not parse PKey (OpenSSL::PKey::PKeyError) from -e:1:in `<main>' ``` The root cause is on the OpenSSL side. The `OSSL_DECODER_CTX_set_selection` doesn't apply the selection value properly if there are multiple providers, and a provider (e.g. "base" provider) handles the decoder implementation, and another provider (e.g. "fips" provider) handles the keys. The workaround is to create `OSSL_DECODER_CTX` variable each time without using the `OSSL_DECODER_CTX_set_selection`. https://github.com/ruby/openssl/commit/5ff4a31621
* [ruby/openssl] Implement Write Barrier for all OpenSSL typesJean Boussier2023-06-1923-38/+51
| | | | | | | | | The vast majority have no reference so it's just a matter of setting the flags. For the couple exception, they have very little references so it's easy. https://github.com/ruby/openssl/commit/2c7c6de69e
* [ruby/openssl] Append flags from environment variables.Jun Aruga2023-06-191-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to the `mkmf.rb#init_mkmf`, there are command line options below. * `--with-cflags` to set the `cflags` * `--with-ldflags` to set the `ldflags` For example the following command compiles with the specified flags. Note that `MAKEFLAGS` is to print the compiler command lines. ``` $ MAKEFLAGS="V=1" \ bundle exec rake compile -- \ --with-cflags="-Wundef -Werror" \ --with-ldflags="-fstack-protector" ``` However, I couldn't find command line options to append the flags. And this commit is to append the `cflags` and `ldflags` by the environment variables. ``` $ MAKEFLAGS="V=1" \ RUBY_OPENSSL_EXTCFLAGS="-Wundef -Werror" \ RUBY_OPENSSL_EXTLDFLAGS="-fstack-protector" \ bundle exec rake compile ``` https://github.com/ruby/openssl/commit/b551eb86f6
* [ruby/openssl] Remove usage of IO internals.Samuel Williams2023-05-292-20/+33
|
* [ruby/openssl] Fix warnings about the OPENSSL_FIPS macro in OpenSSL 1.1.Jun Aruga2023-05-191-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The commit <https://github.com/ruby/openssl/commit/c5b2bc1268bc> made the warnings below in the case of OpenSSL 1.1 where the `OPENSSL_FIPS` macro is not defined. ``` $ bundle install --standalone $ bundle exec rake compile -- \ --with-openssl-dir=$HOME/.local/openssl-1.1.1t-debug \ --with-cflags="-Wundef" mkdir -p tmp/x86_64-linux/openssl/3.2.1 cd tmp/x86_64-linux/openssl/3.2.1 /usr/local/ruby-3.2.1/bin/ruby -I. -r.rake-compiler-siteconf.rb ../../../../ext/openssl/extconf.rb -- --with-openssl-dir=/home/jaruga/.local/openssl-1.1.1t-debug --with-cflags=-Wundef ... gcc -I. -I/usr/local/ruby-3.2.1/include/ruby-3.2.0/x86_64-linux -I/usr/local/ruby-3.2.1/include/ruby-3.2.0/ruby/backward -I/usr/local/ruby-3.2.1/include/ruby-3.2.0 -I../../../../ext/openssl -DRUBY_EXTCONF_H=\"extconf.h\" -I/home/jaruga/.local/openssl-1.1.1t-debug/include -fPIC -Wundef -o ossl.o -c ../../../../ext/openssl/ossl.c ../../../../ext/openssl/ossl.c: In function ‘ossl_fips_mode_get’: ../../../../ext/openssl/ossl.c:425:7: warning: "OPENSSL_FIPS" is not defined, evaluates to 0 [-Wundef] 425 | #elif OPENSSL_FIPS | ^~~~~~~~~~~~ ../../../../ext/openssl/ossl.c: In function ‘ossl_fips_mode_set’: ../../../../ext/openssl/ossl.c:460:7: warning: "OPENSSL_FIPS" is not defined, evaluates to 0 [-Wundef] 460 | #elif OPENSSL_FIPS | ^~~~~~~~~~~~ ../../../../ext/openssl/ossl.c: In function ‘Init_openssl’: ../../../../ext/openssl/ossl.c:1218:7: warning: "OPENSSL_FIPS" is not defined, evaluates to 0 [-Wundef] 1218 | #elif OPENSSL_FIPS | ^~~~~~~~~~~~ ... cp tmp/x86_64-linux/openssl/3.2.1/openssl.so tmp/x86_64-linux/stage/lib/openssl.so ``` https://github.com/ruby/openssl/commit/b4228cbcd6
* [ruby/openssl] Implement FIPS functions on OpenSSL 3.Jun Aruga2023-05-191-4/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | This commit is to implement the `OpenSSL::OPENSSL_FIPS`, `ossl_fips_mode_get` and `ossl_fips_mode_set` to pass the test `test/openssl/test_fips.rb`. It seems that the `OPENSSL_FIPS` macro is not used on the FIPS mode case any more, and some FIPS related APIs also were removed in OpenSSL 3. See the document <https://github.com/openssl/openssl/blob/master/doc/man7/migration_guide.pod#removed-fips_mode-and-fips_mode_set> the section OPENSSL 3.0 > Main Changes from OpenSSL 1.1.1 > Other notable deprecations and changes - Removed FIPS_mode() and FIPS_mode_set() . The `OpenSSL::OPENSSL_FIPS` returns always true in OpenSSL 3 because the used functions `EVP_default_properties_enable_fips` and `EVP_default_properties_is_fips_enabled` works with the OpenSSL installed without FIPS option. The `TEST_RUBY_OPENSSL_FIPS_ENABLED` is set on the FIPS mode case on the CI. Because I want to test that the `OpenSSL.fips_mode` returns the `true` or 'false' surely in the CI. You can test the FIPS mode case by setting `TEST_RUBY_OPENSSL_FIPS_ENABLED` on local too. Right now I don't find a better way to get the status of the FIPS mode enabled or disabled for this purpose. I am afraid of the possibility that the FIPS test case is unintentionally skipped. I also replaced the ambiguous "returns" with "should return" in the tests. https://github.com/ruby/openssl/commit/c5b2bc1268
* [ruby/openssl] Register global variables before assignmentNobuyoshi Nakada2023-04-071-2/+2
| | | | https://github.com/ruby/openssl/commit/98099d3796
* Update the depend filesMatt Valentine-House2023-02-281-32/+0
|
* Remove intern/gc.h from Make depsMatt Valentine-House2023-02-271-32/+0
|
* [ruby/openssl] Stub gemspec for JRubyCharles Oliver Nutter2023-02-211-3/+9
| | | | | | | | | | | | | JRuby has its own implementation of the `openssl` library in jruby-openssl. The simplest way for us to allow users to set openssl as a gem dependency is to ship a stub gem that just depends on jruby-openssl. This patch adds that to the gemspec. Additional work may be required to fit this stub gem into the test and release process. See #20 for more details. https://github.com/ruby/openssl/commit/74ccaa5e18
* Extract include/ruby/internal/attr/packed_struct.hNobuyoshi Nakada2023-02-081-0/+32
| | | | | | | | | Split `PACKED_STRUCT` and `PACKED_STRUCT_UNALIGNED` macros into the macros bellow: * `RBIMPL_ATTR_PACKED_STRUCT_BEGIN` * `RBIMPL_ATTR_PACKED_STRUCT_END` * `RBIMPL_ATTR_PACKED_STRUCT_UNALIGNED_BEGIN` * `RBIMPL_ATTR_PACKED_STRUCT_UNALIGNED_END`
* [ruby/openssl] [DOC] Remove repeated example from DigestMau Magnaguagno2023-01-311-5/+1
| | | | https://github.com/ruby/openssl/commit/5a36cc3cb2
* Apply the accidental commits again before Ruby 3.2.Hiroshi SHIBATA2022-12-261-1/+1
| | | | | | | | Reverts the following commits: eb8d4d7b5145849325985c00b810b8d75661d86e edb83dc3a2c374e880e8eb488152872152790e92 d40064d1846b5835dff81e3f168c0c3a6c85e814
* Revert the additional change from openssl-3.1.0Hiroshi SHIBATA2022-12-231-1/+1
| | | | | | Revert "[ruby/openssl] pkey/ec: constify" This reverts commit d2cd903c85f38f42c6aefc6d97a1558f74d8d9db.
* [ruby/openssl] pkey/ec: constifyNobuyoshi Nakada2022-12-231-1/+1
| | | | https://github.com/ruby/openssl/commit/6fb3499a7b
* [ruby/openssl] Ruby/OpenSSL 3.1.0Kazuki Yamaguchi2022-12-233-2/+38
| | | | https://github.com/ruby/openssl/commit/c2f7d775c6
* [ruby/openssl] Ruby/OpenSSL 3.0.2Kazuki Yamaguchi2022-12-231-0/+14
| | | | https://github.com/ruby/openssl/commit/48b79333e0
* [ruby/openssl] Ruby/OpenSSL 2.2.3Kazuki Yamaguchi2022-12-231-0/+15
| | | | https://github.com/ruby/openssl/commit/04acccd692
* [ruby/openssl] pkey/ec: check private key validity with OpenSSL 3Joe Truba2022-12-231-5/+17
| | | | | | | | | | | | The behavior of EVP_PKEY_public_check changed between OpenSSL 1.1.1 and 3.0 so that it no longer validates the private key. Instead, private keys can be validated through EVP_PKEY_private_check and EVP_PKEY_pairwise_check. [ky: simplified condition to use either EVP_PKEY_check() or EVP_PKEY_public_check().] https://github.com/ruby/openssl/commit/e38a63ab3d
* [ruby/openssl] Undefine `OpenSSL::SSL` for no socket platformsYuta Saito2022-12-233-5/+12
| | | | | | | | | | | | | | | | | This fixes a linkage error about `ossl_ssl_type` on platforms which do not have socket, like WASI. Even before this patch, some items are disabled under `OPENSSL_NO_SOCK` since https://github.com/ruby/ruby/commit/ee22fad45d394818690c4a7586d7bb576ba67c56 However, due to some new use of OpenSSL::SSL::Socket over the past few years, the build under `OPENSSL_NO_SOCK` had been broken. This patch guards whole `OpenSSL::SSL` items by `OPENSSL_NO_SOCK`. [ky: adjusted to apply on top of my previous commit that removed the OpenSSL::ExtConfig, and added a guard to lib/openssl/ssl.rb.] https://github.com/ruby/openssl/commit/b0cfac6a96
* [ruby/openssl] ssl: remove OpenSSL::ExtConfigKazuki Yamaguchi2022-12-231-15/+0
| | | | | | | | | | | This module was introduced in 2015 for internal use within this library. Neither of the two constants in it is used anymore. I don't think we will be adding a new constant in the foreseeable future, either. OPENSSL_NO_SOCK is unused since commit https://github.com/ruby/openssl/commit/998d66712a78 (r55191). HAVE_TLSEXT_HOST_NAME is unused since commit https://github.com/ruby/openssl/commit/4eb4b3297a92. https://github.com/ruby/openssl/commit/eed3894bda
* [ruby/openssl] ssl: disable NPN support on LibreSSLKazuki Yamaguchi2022-12-231-5/+9
| | | | | | | | | | | | | | As noted in commit https://github.com/ruby/openssl/commit/a2ed156cc9f1 ("test/test_ssl: do not run NPN tests for LibreSSL >= 2.6.1", 2017-08-13), NPN is known not to work properly on LibreSSL. Disable NPN support on LibreSSL, whether OPENSSL_NO_NEXTPROTONEG is defined or not. NPN is less relevant today anyway. Let's also silence test suite when it's not available. https://github.com/ruby/openssl/commit/289f6e0e1f
* [ruby/openssl] ssl: update TLS1_3_VERSION workaround for older LibreSSL versionsKazuki Yamaguchi2022-12-231-2/+1
| | | | | | | The macro is now defined by default in LibreSSL 3.4+. Let's document it for future readers. https://github.com/ruby/openssl/commit/935698e9f9
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-27 02:08:24 +0000