* {ext,test}/openssl: Import Ruby/OpenSSL 2.0.0.beta.2. The full commit
  history since v2.0.0.beta.1 can be found at:
  https://github.com/ruby/openssl/compare/v2.0.0.beta.1...v2.0.0.beta.2

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56098 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* NEWS, {ext,test,sample}/openssl: Import Ruby/OpenSSL 2.0.0.beta.1.
  ext/openssl is now converted into a default gem. The full commit
  history since r55538 can be found at:
  https://github.com/ruby/openssl/compare/08e1881f5663...v2.0.0.beta.1
  [Feature #9612]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56027 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* ext/openssl/extconf.rb: Check for CRYPTO_malloc() and SSL_new().
  OpenSSL_add_all_digests() and SSL_library_init() are deprecated and
  converted to macros in OpenSSL 1.1.0.
  [ruby-core:75225] [Feature #12324]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55335 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* ext/openssl/extconf.rb: Check for SSL_CTX_get_security_level().
  OpenSSL 1.1.0 introduced "security level".
  [ruby-core:75225] [Feature #12324]

* ext/openssl/ossl_ssl.c (ossl_sslctx_{get,set}_security_level): Add
  SSLContext#security_level and #security_level=.

* test/openssl/test_ssl.rb (test_security_level): Add test. ...but this
  doesn't actually test it. Because #security_level= is necessary in
  order to run other tests on OpenSSL 1.1.0, go without tests for now.
  Will fix after converting SSLContext#key= and #cert= to normal methods.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55309 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* ext/openssl/extconf.rb: Check for SSL_CTX_set_min_proto_version()
  macro added in OpenSSL 1.1.0. Version-specific methods, such as
  TLSv1_method(), are deprecated in OpenSSL 1.1.0. We need to use
  version-flexible methods (TLS_*method() or SSLv23_*method()) and
  disable other protocol versions as necessary.
  [ruby-core:75225] [Feature #12324]

* ext/openssl/ossl_ssl.c: Use SSL_CTX_set_{min,max}_proto_version() to
  fix the protocol version.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55304 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* ext/openssl/extconf.rb: Check existence of SSL_is_server(). This
  function was introduced in OpenSSL 1.0.2.
  [ruby-core:75225] [Feature #12324]

* ext/openssl/openssl_missing.h: Implement SSL_is_server() if missing.

* ext/openssl/ossl_ssl.c (ssl_info_cb): Use SSL_is_server() to see if
  the SSL is server. The state machine in OpenSSL was rewritten and
  SSL_get_state() no longer returns SSL_ST_ACCEPT.

  (ossl_ssl_cipher_to_ary, ossl_sslctx_session_get_cb): Add some
  `const`s to suppress warning.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55289 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* ext/openssl/extconf.rb: Check existence of accessor functions that
  don't exist in OpenSSL 0.9.8. OpenSSL 1.1.0 made most of its
  structures opaque and requires use of these accessor functions.
  [ruby-core:75225] [Feature #12324]

* ext/openssl/openssl_missing.[ch]: Implement them if missing.

* ext/openssl/ossl*.c: Use these accessor functions.

* test/openssl/test_hmac.rb: Add missing test for HMAC#reset.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55287 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* ext/openssl/openssl_missing.[ch]: Implement EVP_PKEY_get0_*() and
  {RSA,DSA,EC_KEY,DH}_get0_*() functions.
  OpenSSL 1.1.0 makes EVP_PKEY/RSA/DSA/DH opaque. We used to provide
  setter methods for each parameter of each PKey type, for example
  PKey::RSA#e=, but this is no longer possible because the new API
  RSA_set0_key() requires the 'n' at the same time. This commit adds
  deprecation warning to them and adds PKey::*#set_* methods as direct
  wrapper for those new APIs. For example, 'rsa.e = 3' now needs to be
  rewritten as 'rsa.set_key(rsa.n, 3, rsa.d)'.
  [ruby-core:75225] [Feature #12324]

* ext/openssl/ossl_pkey*.[ch]: Use the new accessor functions. Implement
  RSA#set_{key,factors,crt_params}, DSA#set_{key,pqg}, DH#set_{key,pqg}.
  Emit a warning with rb_warning() when old setter methods are used.

* test/drb/ut_array_drbssl.rb, test/drb/ut_drb_drbssl.rb,
  test/rubygems/test_gem_remote_fetcher.rb: Don't set a priv_key for DH
  object that are used in tmp_dh_callback. Generating a new key pair
  every time should be fine - actually the private exponent is ignored
  in OpenSSL >= 1.0.2f/1.0.1r even if we explicitly set.
  https://www.openssl.org/news/secadv/20160128.txt

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55285 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* ext/openssl/extconf.rb: Check absence of CRYPTO_lock() to see if the
  OpenSSL has the new threading API. In OpenSSL <= 1.0.2, an application
  had to set locking callbacks to use OpenSSL in a multi-threaded
  environment. OpenSSL 1.1.0 now finds pthreads or Windows threads so we
  don't need to do something special.
  [ruby-core:75225] [Feature #12324]

  Also check existence of *_up_ref(). Some structures in OpenSSL have
  a reference counter. We used to increment it with CRYPTO_add() which
  is a part of the old API.

* ext/openssl/openssl_missing.h: Implement *_up_ref() if missing.

* ext/openssl/ossl.c: Don't set locking callbacks if unneeded.

* ext/openssl/ossl_pkey.c, ext/openssl/ossl_ssl.c,
  ext/openssl/ossl_x509cert.c, ext/openssl/ossl_x509crl.c,
  ext/openssl/ossl_x509store.c: Use *_up_ref() instead of CRYPTO_add().

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55283 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* ext/openssl/extconf.rb: Check if RAND_pseudo_bytes() is usable. It is
  marked as deprecated in OpenSSL 1.1.0.
  [ruby-core:75225] [Feature #12324]

* ext/openssl/ossl_rand.c: Disable Random.pseudo_bytes if
  RAND_pseudo_bytes() is unavailable.

* test/openssl/test_random.rb: Don't test Random.pseudo_bytes if not
  defined.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55282 b2dd03c8-39d4-4d8f-98ff-823fe69b080e