* ext/openssl/lib/openssl/ssl-internal.rb (DEFAULT_PARAMS): override
	  options even if OpenSSL::SSL::OP_NO_SSLv3 is not defined.
	  this is pointed out by Stephen Touset. [ruby-core:65711] [Bug #9424]

	* test/openssl/test_ssl.rb: Reuse TLS default options from
	  OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.

	* lib/openssl/ssl-internal.rb: Explicitly whitelist the default
	  SSL/TLS ciphers. Forbid SSLv2 and SSLv3, disable
	  compression by default.
	  Reported by Jeff Hodges.
	  [ruby-core:59829] [Bug #9424]



git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@48121 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	* test/openssl/test_pkey_ec.rb: Skip tests for "Oakley" curves as
	  they are not suitable for ECDSA.
	  [ruby-core:54881] [Bug #8384]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@43494 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	* ext/openssl/ossl_pkey_ec.c: Ensure compatibility to builds of
	  OpenSSL with OPENSSL_NO_EC2M defined, but OPENSSL_NO_EC not
	  defined.

	* test/openssl/test_pkey_ec.rb: Iterate over built-in curves
	  (and assert their non-emptiness!) instead of hard-coding them, as
	  this may cause problems with respect to the different availability
	  of individual curves in individual OpenSSL builds.
	  [ruby-core:54881] [Bug #8384]
	  Thanks to Vit Ondruch for providing the patch!


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@43486 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	* test/openssl/test_ssl.rb: Fix test for CVE-2013-4073.
	  Patch by Antonio Terceiro. [Bug #8750] [ruby-core:56437]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@42622 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	* ext/openssl/ossl_asn1.c (asn1time_to_time):  Implement YYMMDDhhmmZ
	  format for ASN.1 UTCTime.  [ruby-trunk - Bug #8664]

	* test/openssl/test_asn1.rb:  Test for the above.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@42328 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	* lib/openssl/ssl.rb: Fix SSL client connection crash for SAN marked
	  critical.
	  The patch for CVE-2013-4073 caused SSL crash when a SSL server returns
	  the certificate that has critical SAN value.  X509 extension could
	  include 2 or 3 elements in it:
	  [id, criticality, octet_string] if critical,
	  [id, octet_string] if not.
	  Making sure to pick the last element of X509 extension and use it as
	  SAN value.
	  [ruby-core:55685] [Bug #8575]
	  Thank you @nahi for providing the patch!


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@42016 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* ext/openssl/lib/openssl/ssl-inernal.rb (verify_certificate_identity):
  fix hostname verification. Patched by nahi.

* test/openssl/test_ssl.rb (test_verify_certificate_identity): test for
  above.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@41673 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@41626 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

* gc.c: Fixup around GC by MALLOC.
  Add allocate size to malloc_increase before GC
  for updating limit in after_gc_sweep.
  Reset malloc_increase into garbage_collect()
  for preventing GC again soon.
  this backport patch is written by nari.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@41624 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

	* ext/openssl/ossl_ssl.c: Correct shutdown behavior w.r.t GC.

	* test/openssl/test_ssl.rb: Add tests to verify correct behavior.
	[Bug #8240] Patch provided by Shugo Maeda. Thanks!


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@40717 b2dd03c8-39d4-4d8f-98ff-823fe69b080e