ruby.git/test/openssl/test_ssl.rb, branch v3_4_9 The Ruby Programming Language Update openssl gem to 3.3.1 for Ruby 3.4 (#14792) 2025-10-09T14:32:47+00:00 Bo Anderson mail@boanderson.me 2025-10-09T14:32:47+00:00 fce44db5eb7baf1ddd2238254c3cf617fcfd1112 Update openssl gem to 3.3.1 [Backport #21631] 
Update openssl gem to 3.3.1

[Backport #21631]
 [ruby/openssl] ssl: do not clear existing SSL options in SSLContext#set_params 2024-12-07T08:15:08+00:00 Kazuki Yamaguchi k@rhe.jp 2024-06-11T18:01:54+00:00 c9bbf7e3eba9d42983d89b07273f4f31e9ca8d0e Apply SSL options set in DEFAULT_PARAMS without clearing existing options. It currently clears options in order to avoid setting one of the options included in OpenSSL::SSL::OP_ALL unless explicitly specified, namely OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS. Now that OpenSSL::SSL::OP_ALL has been removed from SSLContext#initialize, it is no longer necessary. https://github.com/ruby/openssl/commit/77c3db2d65 
Apply SSL options set in DEFAULT_PARAMS without clearing existing
options.

It currently clears options in order to avoid setting one of the
options included in OpenSSL::SSL::OP_ALL unless explicitly specified,
namely OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS. Now that
OpenSSL::SSL::OP_ALL has been removed from SSLContext#initialize, it is
no longer necessary.

https://github.com/ruby/openssl/commit/77c3db2d65
[ruby/openssl] ssl: do not enable OpenSSL::SSL::OP_ALL by default 2024-12-07T08:15:08+00:00 Kazuki Yamaguchi k@rhe.jp 2024-06-11T17:29:46+00:00 510c190739b83cfa4fdb56e9d9c0578af25c9c6a Respect the SSL options set by default by SSL_CTX() and by the system-wide OpenSSL configuration file. OpenSSL::SSL::SSLContext#initialize currently adds OpenSSL::SSL::OP_ALL on top of the default SSL options. Let's stop doing it. OpenSSL::SSL::OP_ALL is a set of options that changes OpenSSL's behavior to workaround various TLS implementation bugs. Using it is considered usually safe, but is not completely harmless. https://github.com/ruby/openssl/commit/00bec0d905 
Respect the SSL options set by default by SSL_CTX() and by the
system-wide OpenSSL configuration file.

OpenSSL::SSL::SSLContext#initialize currently adds OpenSSL::SSL::OP_ALL
on top of the default SSL options. Let's stop doing it.

OpenSSL::SSL::OP_ALL is a set of options that changes OpenSSL's behavior
to workaround various TLS implementation bugs. Using it is considered
usually safe, but is not completely harmless.

https://github.com/ruby/openssl/commit/00bec0d905
[ruby/openssl] Add SSLSocket#readbyte 2024-07-03T08:54:18+00:00 Grant Gardner grant@lastweekend.com.au 2024-06-30T14:25:45+00:00 4d4ac00123aa21d3027bcd0aa0242c1bc129837e Companion to getbyte but raise EOFError Similar to https://github.com/ruby/openssl/pull/438 https://github.com/ruby/openssl/commit/c40f70711a 
Companion to getbyte but raise EOFError
Similar to https://github.com/ruby/openssl/pull/438

https://github.com/ruby/openssl/commit/c40f70711a
[ruby/openssl] Remove trailing space in test_ssl.rb 2024-04-30T15:23:15+00:00 Peter Zhu peter@peterzhu.ca 2024-04-30T15:17:43+00:00 e0949c3f7cbf32d46ee276d69343b7cb8da4325f https://github.com/ruby/openssl/commit/911a31335f 
https://github.com/ruby/openssl/commit/911a31335f
[ruby/openssl] Introduce basic support for `close_read` and `close_write`. 2024-04-30T14:51:58+00:00 Samuel Williams samuel.williams@oriontransfer.co.nz 2024-04-22T08:48:40+00:00 1699772ac4e62d783aab6e820f978c04a215a612 https://github.com/ruby/openssl/commit/c99d24cee9 
https://github.com/ruby/openssl/commit/c99d24cee9
Use www.rfc-editor.org for RFC text. 2024-03-28T02:44:45+00:00 Hiroshi SHIBATA hsbt@ruby-lang.org 2024-03-28T00:45:01+00:00 7630a89a4bf352e1310b5323e3e2ee976eecddca We use the following site for that now: * https://tools.ietf.org/ or http * https://datatracker.ietf.org or http Today, IETF said the official site of RFC is www.rfc-editor.org. FYI: https://authors.ietf.org/en/references-in-rfcxml I replaced them to www.rfc-editor.org. 
We use the following site for that now:

* https://tools.ietf.org/ or http
* https://datatracker.ietf.org or http

Today, IETF said the official site of RFC is www.rfc-editor.org.

FYI: https://authors.ietf.org/en/references-in-rfcxml

I replaced them to www.rfc-editor.org.
[ruby/openssl] Add support for IO#timeout. 2024-01-17T17:09:03+00:00 Samuel Williams samuel.williams@oriontransfer.co.nz 2024-01-17T17:08:59+00:00 4f634d3c85ca45b5995c1f37619784c99f2be62c (https://github.com/ruby/openssl/pull/714) * Add support for IO#timeout. https://github.com/ruby/openssl/commit/3bbf5178a9 
(https://github.com/ruby/openssl/pull/714)

* Add support for IO#timeout.

https://github.com/ruby/openssl/commit/3bbf5178a9
[ruby/openssl] ssl: raise SSLError if loading ca_file or ca_path fails 2023-08-16T05:48:41+00:00 Kazuki Yamaguchi k@rhe.jp 2023-08-09T17:45:15+00:00 01d368e7b06ccf34f92c535a117a2856956d2bcb When compiled with OpenSSL <= 1.1.1, OpenSSL::SSL::SSLContext#setup does not raise an exception on an error return from SSL_CTX_load_verify_locations(), but instead only prints a verbose-mode warning. This is not helpful since it very likely indicates an actual error, such as the specified file not being readable. Also, OpenSSL's error queue is not correctly cleared: $ ruby -w -ropenssl -e'OpenSSL.debug=true; ctx=OpenSSL::SSL::SSLContext.new; ctx.ca_file="bad-path"; ctx.setup; pp OpenSSL.errors' -e:1: warning: can't set verify locations ["error:02001002:system library:fopen:No such file or directory", "error:2006D080:BIO routines:BIO_new_file:no such file", "error:0B084002:x509 certificate routines:X509_load_cert_crl_file: system lib"] The behavior is currently different when compiled with OpenSSL >= 3.0: SSLError is raised if SSL_CTX_load_verify_file() or SSL_CTX_load_verify_dir() fails. This inconsistency was unintentionally introduced by commit https://github.com/ruby/openssl/commit/5375a55ffc35 ("ssl: use SSL_CTX_load_verify_{file,dir}() if available", 2020-02-22). However, raising SSLError seems more appropriate in this situation. Let's adjust the OpenSSL <= 1.1.1 code so that it behaves the same way as the OpenSSL >= 3.0 code currently does. Fixes: https://github.com/ruby/openssl/issues/649 https://github.com/ruby/openssl/commit/7eb10f7b75 
When compiled with OpenSSL <= 1.1.1, OpenSSL::SSL::SSLContext#setup
does not raise an exception on an error return from
SSL_CTX_load_verify_locations(), but instead only prints a verbose-mode
warning. This is not helpful since it very likely indicates an actual
error, such as the specified file not being readable.

Also, OpenSSL's error queue is not correctly cleared:

	$ ruby -w -ropenssl -e'OpenSSL.debug=true; ctx=OpenSSL::SSL::SSLContext.new; ctx.ca_file="bad-path"; ctx.setup; pp OpenSSL.errors'
	-e:1: warning: can't set verify locations
	["error:02001002:system library:fopen:No such file or directory",
	 "error:2006D080:BIO routines:BIO_new_file:no such file",
	 "error:0B084002:x509 certificate routines:X509_load_cert_crl_file: system lib"]

The behavior is currently different when compiled with OpenSSL >= 3.0:
SSLError is raised if SSL_CTX_load_verify_file() or
SSL_CTX_load_verify_dir() fails.

This inconsistency was unintentionally introduced by commit https://github.com/ruby/openssl/commit/5375a55ffc35
("ssl: use SSL_CTX_load_verify_{file,dir}() if available", 2020-02-22).
However, raising SSLError seems more appropriate in this situation.
Let's adjust the OpenSSL <= 1.1.1 code so that it behaves the same way
as the OpenSSL >= 3.0 code currently does.

Fixes: https://github.com/ruby/openssl/issues/649

https://github.com/ruby/openssl/commit/7eb10f7b75
[ruby/openssl] Revert "Relax error message check for OpenSSL 3.1" 2023-08-16T05:48:39+00:00 Kazuki Yamaguchi k@rhe.jp 2023-06-07T07:15:29+00:00 4465941e68e076d3198a071600f1047b7a382e0b This reverts commit https://github.com/ruby/openssl/commit/fc4629d246f2. The test case "test_connect_certificate_verify_failed_exception_message" does want to check the reason behind a certificate verification failure to be included in the exception message. https://github.com/ruby/openssl/commit/c309745eb8 
This reverts commit https://github.com/ruby/openssl/commit/fc4629d246f2.

The test case "test_connect_certificate_verify_failed_exception_message"
does want to check the reason behind a certificate verification failure
to be included in the exception message.

https://github.com/ruby/openssl/commit/c309745eb8