ruby.git/ext/openssl, branch v2_4_0_preview2

openssl: import v2.0.0.beta.2

2016-09-08T01:09:19+00:00

* {ext,test}/openssl: Import Ruby/OpenSSL 2.0.0.beta.2. The full commit
  history since v2.0.0.beta.1 can be found at:
  https://github.com/ruby/openssl/compare/v2.0.0.beta.1...v2.0.0.beta.2

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56098 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* remove trailing spaces.

2016-08-29T05:47:11+00:00

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56028 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

import Ruby/OpenSSL 2.0.0.beta.1

2016-08-29T05:47:09+00:00

* NEWS, {ext,test,sample}/openssl: Import Ruby/OpenSSL 2.0.0.beta.1.
  ext/openssl is now converted into a default gem. The full commit
  history since r55538 can be found at:
  https://github.com/ruby/openssl/compare/08e1881f5663...v2.0.0.beta.1
  [Feature #9612]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56027 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

openssl: avoid undefined behavior on empty SSL_write

2016-08-06T21:50:10+00:00

SSL_write(3ssl) manpage has this in the WARNINGS section:

       When calling SSL_write() with num=0 bytes to be sent the
       behaviour is undefined.

And indeed, the new test case demonstrates failures when
empty strings are used.  So, match the behavior of IO#write,
IO#write_nonblock, and IO#syswrite by returning zero, as the
OpenSSL::SSL::SSLSocket API already closely mimics the IO one.

* ext/openssl/ossl_ssl.c (ossl_ssl_write_internal):
  avoid undefined behavior
* test/openssl/test_pair.rb (test_write_zero): new test
  [ruby-core:76751] [Bug #12660]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55822 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

Update dependencies

2016-07-06T05:48:13+00:00

* common.mk (compile.o, loadpath.o): update dependencies.

* common.mk (vm_call.o): remove stale object dependencies.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55589 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

openssl: fix for OpenSSL 1.0.0t

2016-06-29T13:21:54+00:00

* ext/openssl/ossl_ocsp.c: The "reuse" behavior of d2i_ functions does
  not work well with OpenSSL 1.0.0t. So avoid it.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55538 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* ext/digest/md5/md5ossl.h: Remove excess semicolons.

2016-06-28T09:42:29+00:00

  Suppress warning on Solaris with Oracle Solaris Studio 12.
  [ruby-dev:49692] [Bug #12524]
    
* ext/digest/md5/md5cc.h: ditto.
* ext/digest/sha1/sha1cc.h: ditto.
* ext/digest/sha1/sha1ossl.h: ditto.
* ext/digest/sha2/sha2cc.h: ditto.
* ext/digest/sha2/sha2ossl.h: ditto.
* ext/openssl/ossl_pkey_rsa.c: ditto.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55523 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

openssl: add OpenSSL::OCSP::SingleResponse

2016-06-19T12:26:27+00:00

* ext/openssl/ossl_ocsp.c: Add OCSP::SingleResponse that represents an
  OCSP SingleResponse structure. Also add two new methods #responses
  and #find_response to OCSP::BasicResponse. A BasicResponse has one or
  more SingleResponse. We have OCSP::BasicResponse#status that returns
  them as an array of arrays, each containing the content of a
  SingleResponse, but this is not useful. When validating an OCSP
  response, we need to look into the each SingleResponse and check their
  validity but it is not simple. For example, when validating for a
  certificate 'cert', the code would be like:

    # certid_target is an OpenSSL::OCSP::CertificateId for cert
    basic = res.basic
    result = basic.status.any? do |ary|
      ary[0].cmp(certid_target) &&
        ary[4] <= Time.now && (!ary[5] || Time.now <= ary[5])
    end

  Adding OCSP::SingleResponse at the same time allows exposing
  OCSP_check_validity(). With this, the code above can be rewritten as:

    basic = res.basic
    single = basic.find_response(certid_target)
    result = single.check_validity

* test/openssl/test_ocsp.rb: Test this.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55457 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

openssl: allow passing absolute times in OCSP::BasicResponse#add_status

2016-06-19T09:42:30+00:00

* ext/openssl/ossl_ocsp.c (ossl_ocspbres_add_status): Allow specifying
  the times (thisUpdate, nextUpdate and revocationTime) with Time
  objects. Currently they accepts only relative seconds from the current
  time. This is inconvenience, especially for revocationTime. When
  Integer is passed, they are still treated as relative times. Since the
  type check is currently done with rb_Integer(), this is a slightly
  incompatible change. Hope no one passes a relative time as String or
  Time object...
  Also, allow passing nil as nextUpdate. It is optional.

* ext/openssl/ruby_missing.h: Define RB_INTEGER_TYPE_P() if not defined.
  openssl gem will be released before Ruby 2.4.0.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55456 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

openssl: implement initialize_copy for OpenSSL::OCSP::*

2016-06-19T09:42:29+00:00

* ext/openssl/ossl_ocsp.c: Implement OCSP::{CertificateId,Request,
  BasicResponse,Response}#initialize_copy.
  [ruby-core:75504] [Bug #12381]

* test/openssl/test_ocsp.rb: Test them.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55455 b2dd03c8-39d4-4d8f-98ff-823fe69b080e