summaryrefslogtreecommitdiff
path: root/ext
diff options
context:
space:
mode:
authorKazuki Yamaguchi <k@rhe.jp>2020-03-09 18:26:19 +0900
committerKazuki Yamaguchi <k@rhe.jp>2020-03-10 17:41:01 +0900
commite4a26cd4f8e74e5d29de10a3a0ce5829829301b0 (patch)
tree3e2ca67325456a954d6f0f898594453b13119a0d /ext
parent61cfd6da84e9cbf02c2e3ff5fae476fec92a1cec (diff)
openssl: sync with upstream repository
Import current master (2c43241dc0ed) of ruby/openssl.git. Below are the commits that were made since the last batch at commit b99775b163ce (ruby/openssl.git commit f49e7110ca1e). Note that some of them have been applied already. ---------------------------------------------------------------- Benoit Daloze (1): Remove redundant and ignored workflow file DBL-Lee (1): add support for SHA512_256/SHA512_224 Hiroshi SHIBATA (2): Guard for OpenSSL::PKey::EC::Group::Error with unsupported platforms Fixed inconsistency directory structure with ruby/ruby repo Jeremy Evans (2): Fix keyword argument separation issues in OpenSSL::SSL::SSLSocket#sys{read,write}_nonblock Remove taint support Kazuki Yamaguchi (26): config: support .include directive random: make OpenSSL::Random.pseudo_bytes alias of .random_bytes extconf.rb: get rid of -Werror=deprecated-declarations test/openssl/test_ssl: skip test_fallback_scsv if necessary ts: simplify OpenSSL::Timestamp::Request#algorithm History.md: add missing references to GitHub issues config: deprecate OpenSSL::Config#add_value and #[]= test/openssl/test_ssl: remove sleep from test_finished_messages test/openssl/test_ssl: fix random failure in SSLSocket.open test test/openssl/test_ssl: avoid explicitly-sized private keys test/openssl/test_ssl: remove commented-out test case test/openssl/test_ssl: allow kRSA tests to fail ssl: avoid declarations after statements engine: revert OpenSSL::Engine.load changes for cloudhsm engine: remove really outdated static engines engine: do not check for ENGINE_load_builtin_engines() engine: fix guards for 'dynamic' and 'cryptodev' engines lib/openssl.rb: require openssl/version.rb x509: add error code and verify flags constants ssl: set verify error code in the case of verify_hostname failure .github/workflows: merge CI jobs into a single workflow .github/workflows: test against different OpenSSL versions .travis.yml: fully migrate to GitHub Actions ssl: suppress test failure with SSLContext#add_certificate_chain_file ssl: remove test case test_puts_meta from test_pair Revert "Use version.rb in gemspec" MSP-Greg (2): .travis.yml - remove 2.3/1.0.2, 2.5/1.1.1, head/1.0.2 Use version.rb in gemspec Samuel Williams (1): Restore compatibility with older versions of Ruby. Yusuke Endoh (1): Make OpenSSL::OSSL#test_memcmp_timing robust
Diffstat (limited to 'ext')
-rw-r--r--ext/openssl/History.md43
-rw-r--r--ext/openssl/deprecation.rb27
-rw-r--r--ext/openssl/extconf.rb23
-rw-r--r--ext/openssl/lib/openssl.rb1
-rw-r--r--ext/openssl/lib/openssl/config.rb72
-rw-r--r--ext/openssl/lib/openssl/digest.rb2
-rw-r--r--ext/openssl/lib/openssl/version.rb2
-rw-r--r--ext/openssl/ossl_engine.c17
-rw-r--r--ext/openssl/ossl_rand.c34
-rw-r--r--ext/openssl/ossl_ssl.c43
-rw-r--r--ext/openssl/ossl_x509.c91
11 files changed, 216 insertions, 139 deletions
diff --git a/ext/openssl/History.md b/ext/openssl/History.md
index cdb44b1..929d919 100644
--- a/ext/openssl/History.md
+++ b/ext/openssl/History.md
@@ -1,34 +1,55 @@
Version 2.2.0 (not yet released)
=============
+Compatibility notes
+-------------------
+
+* Remove unsupported MDC2, DSS, DSS1, and SHA algorithms.
+* Remove `OpenSSL::PKCS7::SignerInfo#name` alias for `#issuer`.
+ [[GitHub #266]](https://github.com/ruby/openssl/pull/266)
+* Deprecate `OpenSSL::Config#add_value` and `#[]=` for future removal.
+ [[GitHub #322]](https://github.com/ruby/openssl/pull/322)
+
+
+Notable changes
+---------------
+
* Change default `OpenSSL::SSL::SSLServer#listen` backlog argument from
5 to `Socket::SOMAXCONN`.
+ [[GitHub #286]](https://github.com/ruby/openssl/issues/286)
* Make `OpenSSL::HMAC#==` use a timing safe string comparison.
-* Remove unsupported MDC2, DSS, DSS1, and SHA algorithms.
+ [[GitHub #284]](https://github.com/ruby/openssl/pull/284)
* Add support for SHA3 and BLAKE digests.
+ [[GitHub #282]](https://github.com/ruby/openssl/pull/282)
* Add `OpenSSL::SSL::SSLSocket.open` for opening a `TCPSocket` and
returning an `OpenSSL::SSL::SSLSocket` for it.
+ [[GitHub #225]](https://github.com/ruby/openssl/issues/225)
* Support marshalling of `OpenSSL::X509` objects.
+ [[GitHub #281]](https://github.com/ruby/openssl/pull/281)
* Add `OpenSSL.secure_compare` for timing safe string comparison for
strings of possibly unequal length.
+ [[GitHub #280]](https://github.com/ruby/openssl/pull/280)
* Add `OpenSSL.fixed_length_secure_compare` for timing safe string
comparison for strings of equal length.
+ [[GitHub #269]](https://github.com/ruby/openssl/pull/269)
* Add `OpenSSL::SSL::SSLSocket#{finished_message,peer_finished_message}`
for last finished message sent and received.
+ [[GitHub #250]](https://github.com/ruby/openssl/pull/250)
* Add `OpenSSL::Timestamp` module for handing timestamp requests and
responses.
+ [[GitHub #204]](https://github.com/ruby/openssl/pull/204)
* Add helper methods for `OpenSSL::X509::Certificate`:
`find_extension`, `subject_key_identifier`,
`authority_key_identifier`, `crl_uris`, `ca_issuer_uris` and
- `ocsp_uris`.
-* Add helper methods for `OpenSSL::X509::CRL`:
+ `ocsp_uris`, and for `OpenSSL::X509::CRL`:
`find_extension` and `subject_key_identifier`.
-* Remove `OpenSSL::PKCS7::SignerInfo#name` alias for `#issuer`.
-* Add `OpenSSL::ECPoint#add` for adding points to an elliptic curve
- group.
+ [[GitHub #260]](https://github.com/ruby/openssl/pull/260)
+ [[GitHub #275]](https://github.com/ruby/openssl/pull/275)
+ [[GitHub #293]](https://github.com/ruby/openssl/pull/293)
+* Add `OpenSSL::ECPoint#add` for performing elliptic curve point addition.
[[GitHub #261]](https://github.com/ruby/openssl/pull/261)
-* Make `OpenSSL::PKey::RSA#{export,to_der}` correctly check `key`,
- `factors`, and `crt_params`.
+* Make `OpenSSL::PKey::RSA#{export,to_der}` check `key`, `factors`, and
+ `crt_params` to do proper private key serialization.
[[GitHub #258]](https://github.com/ruby/openssl/pull/258)
* Add `OpenSSL::SSL::{SSLSocket,SSLServer}#fileno`, returning the
underlying socket file descriptor number.
@@ -40,16 +61,18 @@ Version 2.2.0 (not yet released)
* Add `OpenSSL::X509::Extension#value_der` for the raw value of
the extension.
[[GitHub #234]](https://github.com/ruby/openssl/pull/234)
-* Signficantly reduce allocated memory in `OpenSSL::Buffering#do_write`.
+* Significantly reduce allocated memory in `OpenSSL::Buffering#do_write`.
[[GitHub #212]](https://github.com/ruby/openssl/pull/212)
* Ensure all valid IPv6 addresses are considered valid as elements
of subjectAlternativeName in certificates.
[[GitHub #185]](https://github.com/ruby/openssl/pull/185)
* Allow recipient's certificate to be omitted in PCKS7#decrypt.
[[GitHub #183]](https://github.com/ruby/openssl/pull/183)
-* Add support for reading keys in PKCS8 format and export via instance methods
+* Add support for reading keys in PKCS #8 format and export via instance methods
added to `OpenSSL::PKey` classes: `private_to_der`, `private_to_pem`,
`public_to_der` and `public_to_pem`.
+ [[GitHub #297]](https://github.com/ruby/openssl/pull/297)
+
Version 2.1.2
=============
diff --git a/ext/openssl/deprecation.rb b/ext/openssl/deprecation.rb
deleted file mode 100644
index fdf2d30..0000000
--- a/ext/openssl/deprecation.rb
+++ /dev/null
@@ -1,27 +0,0 @@
-# frozen_string_literal: true
-module OpenSSL
- def self.deprecated_warning_flag
- unless flag = (@deprecated_warning_flag ||= nil)
- if try_compile("", flag = "-Werror=deprecated-declarations")
- $warnflags << " #{flag}"
- else
- flag = ""
- end
- @deprecated_warning_flag = flag
- end
- flag
- end
-
- def self.restore_warning_flag
- $warnflags = @warnflags
- end
-
- def self.check_func(func, header)
- have_func(func, header, deprecated_warning_flag)
- end
-
- def self.check_func_or_macro(func, header)
- check_func(func, header) or
- have_macro(func, header) && $defs.push("-DHAVE_#{func.upcase}")
- end
-end
diff --git a/ext/openssl/extconf.rb b/ext/openssl/extconf.rb
index 87a682b..693e55c 100644
--- a/ext/openssl/extconf.rb
+++ b/ext/openssl/extconf.rb
@@ -12,16 +12,12 @@
=end
require "mkmf"
-require File.expand_path('../deprecation', __FILE__)
dir_config("openssl")
dir_config("kerberos")
Logging::message "=== OpenSSL for Ruby configurator ===\n"
-# Check with -Werror=deprecated-declarations if available
-OpenSSL.deprecated_warning_flag
-
##
# Adds -DOSSL_DEBUG for compilation and some more targets when GCC is used
# To turn it on, use: --with-debug or --enable-debug
@@ -114,11 +110,10 @@ end
Logging::message "=== Checking for OpenSSL features... ===\n"
# compile options
have_func("RAND_egd")
-engines = %w{builtin_engines openbsd_dev_crypto dynamic 4758cca aep atalla chil
- cswift nuron sureware ubsec padlock capi gmp gost cryptodev aesni
- cloudhsm}
+engines = %w{dynamic 4758cca aep atalla chil
+ cswift nuron sureware ubsec padlock capi gmp gost cryptodev}
engines.each { |name|
- OpenSSL.check_func_or_macro("ENGINE_load_#{name}", "openssl/engine.h")
+ have_func("ENGINE_load_#{name}()", "openssl/engine.h")
}
if ($mswin || $mingw) && have_macro("LIBRESSL_VERSION_NUMBER", "openssl/opensslv.h")
@@ -130,9 +125,9 @@ have_func("EC_curve_nist2nid")
have_func("X509_REVOKED_dup")
have_func("X509_STORE_CTX_get0_store")
have_func("SSL_CTX_set_alpn_select_cb")
-OpenSSL.check_func_or_macro("SSL_CTX_set1_curves_list", "openssl/ssl.h")
-OpenSSL.check_func_or_macro("SSL_CTX_set_ecdh_auto", "openssl/ssl.h")
-OpenSSL.check_func_or_macro("SSL_get_server_tmp_key", "openssl/ssl.h")
+have_func("SSL_CTX_set1_curves_list(NULL, NULL)", "openssl/ssl.h")
+have_func("SSL_CTX_set_ecdh_auto(NULL, 0)", "openssl/ssl.h")
+have_func("SSL_get_server_tmp_key(NULL, NULL)", "openssl/ssl.h")
have_func("SSL_is_server")
# added in 1.1.0
@@ -148,7 +143,6 @@ have_func("EVP_MD_CTX_new")
have_func("EVP_MD_CTX_free")
have_func("HMAC_CTX_new")
have_func("HMAC_CTX_free")
-OpenSSL.check_func("RAND_pseudo_bytes", "openssl/rand.h") # deprecated
have_func("X509_STORE_get_ex_data")
have_func("X509_STORE_set_ex_data")
have_func("X509_STORE_get_ex_new_index")
@@ -167,8 +161,8 @@ have_func("X509_CRL_up_ref")
have_func("X509_STORE_up_ref")
have_func("SSL_SESSION_up_ref")
have_func("EVP_PKEY_up_ref")
-OpenSSL.check_func_or_macro("SSL_CTX_set_tmp_ecdh_callback", "openssl/ssl.h") # removed
-OpenSSL.check_func_or_macro("SSL_CTX_set_min_proto_version", "openssl/ssl.h")
+have_func("SSL_CTX_set_tmp_ecdh_callback(NULL, NULL)", "openssl/ssl.h") # removed
+have_func("SSL_CTX_set_min_proto_version(NULL, 0)", "openssl/ssl.h")
have_func("SSL_CTX_get_security_level")
have_func("X509_get0_notBefore")
have_func("SSL_SESSION_get_protocol_version")
@@ -185,6 +179,5 @@ have_func("SSL_CTX_set_post_handshake_auth")
Logging::message "=== Checking done. ===\n"
create_header
-OpenSSL.restore_warning_flag
create_makefile("openssl")
Logging::message "Done.\n"
diff --git a/ext/openssl/lib/openssl.rb b/ext/openssl/lib/openssl.rb
index 7ba2229..00e2db1 100644
--- a/ext/openssl/lib/openssl.rb
+++ b/ext/openssl/lib/openssl.rb
@@ -21,6 +21,7 @@ require_relative 'openssl/hmac'
require_relative 'openssl/x509'
require_relative 'openssl/ssl'
require_relative 'openssl/pkcs5'
+require_relative 'openssl/version'
module OpenSSL
# call-seq:
diff --git a/ext/openssl/lib/openssl/config.rb b/ext/openssl/lib/openssl/config.rb
index ef83c57..9a0b787 100644
--- a/ext/openssl/lib/openssl/config.rb
+++ b/ext/openssl/lib/openssl/config.rb
@@ -37,7 +37,7 @@ module OpenSSL
def parse(string)
c = new()
parse_config(StringIO.new(string)).each do |section, hash|
- c[section] = hash
+ c.set_section(section, hash)
end
c
end
@@ -76,29 +76,44 @@ module OpenSSL
def parse_config_lines(io)
section = 'default'
data = {section => {}}
- while definition = get_definition(io)
+ io_stack = [io]
+ while definition = get_definition(io_stack)
definition = clear_comments(definition)
next if definition.empty?
- if definition[0] == ?[
+ case definition
+ when /\A\[/
if /\[([^\]]*)\]/ =~ definition
section = $1.strip
data[section] ||= {}
else
raise ConfigError, "missing close square bracket"
end
- else
- if /\A([^:\s]*)(?:::([^:\s]*))?\s*=(.*)\z/ =~ definition
- if $2
- section = $1
- key = $2
- else
- key = $1
+ when /\A\.include (\s*=\s*)?(.+)\z/
+ path = $2
+ if File.directory?(path)
+ files = Dir.glob(File.join(path, "*.{cnf,conf}"), File::FNM_EXTGLOB)
+ else
+ files = [path]
+ end
+
+ files.each do |filename|
+ begin
+ io_stack << StringIO.new(File.read(filename))
+ rescue
+ raise ConfigError, "could not include file '%s'" % filename
end
- value = unescape_value(data, section, $3)
- (data[section] ||= {})[key] = value.strip
+ end
+ when /\A([^:\s]*)(?:::([^:\s]*))?\s*=(.*)\z/
+ if $2
+ section = $1
+ key = $2
else
- raise ConfigError, "missing equal sign"
+ key = $1
end
+ value = unescape_value(data, section, $3)
+ (data[section] ||= {})[key] = value.strip
+ else
+ raise ConfigError, "missing equal sign"
end
end
data
@@ -211,10 +226,10 @@ module OpenSSL
scanned.join
end
- def get_definition(io)
- if line = get_line(io)
+ def get_definition(io_stack)
+ if line = get_line(io_stack)
while /[^\\]\\\z/ =~ line
- if extra = get_line(io)
+ if extra = get_line(io_stack)
line += extra
else
break
@@ -224,9 +239,12 @@ module OpenSSL
end
end
- def get_line(io)
- if line = io.gets
- line.gsub(/[\r\n]*/, '')
+ def get_line(io_stack)
+ while io = io_stack.last
+ if line = io.gets
+ return line.gsub(/[\r\n]*/, '')
+ end
+ io_stack.pop
end
end
end
@@ -248,7 +266,7 @@ module OpenSSL
if filename
File.open(filename.to_s) do |file|
Config.parse_config(file).each do |section, hash|
- self[section] = hash
+ set_section(section, hash)
end
end
end
@@ -297,6 +315,8 @@ module OpenSSL
end
##
+ # *Deprecated in v2.2.0*. This method will be removed in a future release.
+ #
# Set the target _key_ with a given _value_ under a specific _section_.
#
# Given the following configurating file being loaded:
@@ -351,6 +371,8 @@ module OpenSSL
end
##
+ # *Deprecated in v2.2.0*. This method will be removed in a future release.
+ #
# Sets a specific _section_ name with a Hash _pairs_.
#
# Given the following configuration being created:
@@ -376,9 +398,13 @@ module OpenSSL
#
def []=(section, pairs)
check_modify
- @data[section] ||= {}
+ set_section(section, pairs)
+ end
+
+ def set_section(section, pairs) # :nodoc:
+ hash = @data[section] ||= {}
pairs.each do |key, value|
- self.add_value(section, key, value)
+ hash[key] = value
end
end
@@ -463,6 +489,8 @@ module OpenSSL
end
def check_modify
+ warn "#{caller(2, 1)[0]}: warning: do not modify OpenSSL::Config; this " \
+ "method is deprecated and will be removed in a future release."
raise TypeError.new("Insecure: can't modify OpenSSL config") if frozen?
end
diff --git a/ext/openssl/lib/openssl/digest.rb b/ext/openssl/lib/openssl/digest.rb
index c953911..92d358d 100644
--- a/ext/openssl/lib/openssl/digest.rb
+++ b/ext/openssl/lib/openssl/digest.rb
@@ -21,7 +21,7 @@ module OpenSSL
ALGORITHMS = %w(MD4 MD5 RIPEMD160 SHA1 SHA224 SHA256 SHA384 SHA512)
if !OPENSSL_VERSION.include?("LibreSSL") && OPENSSL_VERSION_NUMBER > 0x10101000
- ALGORITHMS.concat %w(BLAKE2b512 BLAKE2s256 SHA3-224 SHA3-256 SHA3-384 SHA3-512)
+ ALGORITHMS.concat %w(BLAKE2b512 BLAKE2s256 SHA3-224 SHA3-256 SHA3-384 SHA3-512 SHA512-224 SHA512-256)
end
ALGORITHMS.freeze
diff --git a/ext/openssl/lib/openssl/version.rb b/ext/openssl/lib/openssl/version.rb
index b07bb33..9c7515b 100644
--- a/ext/openssl/lib/openssl/version.rb
+++ b/ext/openssl/lib/openssl/version.rb
@@ -1,5 +1,5 @@
# frozen_string_literal: true
module OpenSSL
- VERSION = "2.2.0" unless defined?(VERSION)
+ VERSION = "2.2.0"
end
diff --git a/ext/openssl/ossl_engine.c b/ext/openssl/ossl_engine.c
index f90bf06..9054693 100644
--- a/ext/openssl/ossl_engine.c
+++ b/ext/openssl/ossl_engine.c
@@ -93,9 +93,6 @@ static const rb_data_type_t ossl_engine_type = {
static VALUE
ossl_engine_s_load(int argc, VALUE *argv, VALUE klass)
{
-#if !defined(HAVE_ENGINE_LOAD_BUILTIN_ENGINES)
- return Qnil;
-#else
VALUE name;
rb_scan_args(argc, argv, "01", &name);
@@ -104,10 +101,10 @@ ossl_engine_s_load(int argc, VALUE *argv, VALUE klass)
return Qtrue;
}
StringValueCStr(name);
-#ifndef OPENSSL_NO_STATIC_ENGINE
#if HAVE_ENGINE_LOAD_DYNAMIC
OSSL_ENGINE_LOAD_IF_MATCH(dynamic, DYNAMIC);
#endif
+#ifndef OPENSSL_NO_STATIC_ENGINE
#if HAVE_ENGINE_LOAD_4758CCA
OSSL_ENGINE_LOAD_IF_MATCH(4758cca, 4758CCA);
#endif
@@ -144,23 +141,13 @@ ossl_engine_s_load(int argc, VALUE *argv, VALUE klass)
#if HAVE_ENGINE_LOAD_GOST
OSSL_ENGINE_LOAD_IF_MATCH(gost, GOST);
#endif
+#endif
#if HAVE_ENGINE_LOAD_CRYPTODEV
OSSL_ENGINE_LOAD_IF_MATCH(cryptodev, CRYPTODEV);
#endif
-#if HAVE_ENGINE_LOAD_AESNI
- OSSL_ENGINE_LOAD_IF_MATCH(aesni, AESNI);
-#endif
-#if HAVE_ENGINE_LOAD_CLOUDHSM
- OSSL_ENGINE_LOAD_IF_MATCH(cloudhsm, CLOUDHSM);
-#endif
-#endif
-#ifdef HAVE_ENGINE_LOAD_OPENBSD_DEV_CRYPTO
- OSSL_ENGINE_LOAD_IF_MATCH(openbsd_dev_crypto, OPENBSD_DEV_CRYPTO);
-#endif
OSSL_ENGINE_LOAD_IF_MATCH(openssl, OPENSSL);
rb_warning("no such builtin loader for `%"PRIsVALUE"'", name);
return Qnil;
-#endif /* HAVE_ENGINE_LOAD_BUILTIN_ENGINES */
}
/*
diff --git a/ext/openssl/ossl_rand.c b/ext/openssl/ossl_rand.c
index 4a4f9dd..659dc81 100644
--- a/ext/openssl/ossl_rand.c
+++ b/ext/openssl/ossl_rand.c
@@ -120,36 +120,6 @@ ossl_rand_bytes(VALUE self, VALUE len)
return str;
}
-#if defined(HAVE_RAND_PSEUDO_BYTES)
-/*
- * call-seq:
- * pseudo_bytes(length) -> string
- *
- * Generates a String with _length_ number of pseudo-random bytes.
- *
- * Pseudo-random byte sequences generated by ::pseudo_bytes will be unique if
- * they are of sufficient length, but are not necessarily unpredictable.
- *
- * === Example
- *
- * OpenSSL::Random.pseudo_bytes(12)
- * #=> "..."
- */
-static VALUE
-ossl_rand_pseudo_bytes(VALUE self, VALUE len)
-{
- VALUE str;
- int n = NUM2INT(len);
-
- str = rb_str_new(0, n);
- if (RAND_pseudo_bytes((unsigned char *)RSTRING_PTR(str), n) < 1) {
- ossl_raise(eRandomError, NULL);
- }
-
- return str;
-}
-#endif
-
#ifdef HAVE_RAND_EGD
/*
* call-seq:
@@ -219,8 +189,8 @@ Init_ossl_rand(void)
rb_define_module_function(mRandom, "load_random_file", ossl_rand_load_file, 1);
rb_define_module_function(mRandom, "write_random_file", ossl_rand_write_file, 1);
rb_define_module_function(mRandom, "random_bytes", ossl_rand_bytes, 1);
-#if defined(HAVE_RAND_PSEUDO_BYTES)
- rb_define_module_function(mRandom, "pseudo_bytes", ossl_rand_pseudo_bytes, 1);
+#if OPENSSL_VERSION_NUMBER < 0x10101000 || defined(LIBRESSL_VERSION_NUMBER)
+ rb_define_alias(rb_singleton_class(mRandom), "pseudo_bytes", "random_bytes");
#endif
#ifdef HAVE_RAND_EGD
rb_define_module_function(mRandom, "egd", ossl_rand_egd, 1);
diff --git a/ext/openssl/ossl_ssl.c b/ext/openssl/ossl_ssl.c
index dfbfbb2..34bb636 100644
--- a/ext/openssl/ossl_ssl.c
+++ b/ext/openssl/ossl_ssl.c
@@ -359,7 +359,14 @@ ossl_ssl_verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
rb_ivar_set(ssl_obj, ID_callback_state, INT2NUM(status));
return 0;
}
- preverify_ok = ret == Qtrue;
+ if (ret != Qtrue) {
+ preverify_ok = 0;
+#if defined(X509_V_ERR_HOSTNAME_MISMATCH)
+ X509_STORE_CTX_set_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH);
+#else
+ X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REJECTED);
+#endif
+ }
}
return ossl_verify_cb_call(cb, preverify_ok, ctx);
@@ -1325,12 +1332,16 @@ ossl_sslctx_add_certificate(int argc, VALUE *argv, VALUE self)
static VALUE
ossl_sslctx_add_certificate_chain_file(VALUE self, VALUE path)
{
- StringValue(path);
- SSL_CTX *ctx = NULL;
+ SSL_CTX *ctx;
+ int ret;
GetSSLCTX(self, ctx);
+ StringValueCStr(path);
+ ret = SSL_CTX_use_certificate_chain_file(ctx, RSTRING_PTR(path));
+ if (ret != 1)
+ ossl_raise(eSSLError, "SSL_CTX_use_certificate_chain_file");
- return SSL_CTX_use_certificate_chain_file(ctx, RSTRING_PTR(path)) == 1 ? Qtrue : Qfalse;
+ return Qtrue;
}
/*
@@ -2327,16 +2338,16 @@ static VALUE
ossl_ssl_get_finished(VALUE self)
{
SSL *ssl;
+ char sizer[1], *buf;
+ size_t len;
GetSSL(self, ssl);
- char sizer[1];
- size_t len = SSL_get_finished(ssl, sizer, 0);
-
- if(len == 0)
- return Qnil;
+ len = SSL_get_finished(ssl, sizer, 0);
+ if (len == 0)
+ return Qnil;
- char* buf = ALLOCA_N(char, len);
+ buf = ALLOCA_N(char, len);
SSL_get_finished(ssl, buf, len);
return rb_str_new(buf, len);
}
@@ -2352,16 +2363,16 @@ static VALUE
ossl_ssl_get_peer_finished(VALUE self)
{
SSL *ssl;
+ char sizer[1], *buf;
+ size_t len;
GetSSL(self, ssl);
- char sizer[1];
- size_t len = SSL_get_peer_finished(ssl, sizer, 0);
-
- if(len == 0)
- return Qnil;
+ len = SSL_get_peer_finished(ssl, sizer, 0);
+ if (len == 0)
+ return Qnil;
- char* buf = ALLOCA_N(char, len);
+ buf = ALLOCA_N(char, len);
SSL_get_peer_finished(ssl, buf, len);
return rb_str_new(buf, len);
}
diff --git a/ext/openssl/ossl_x509.c b/ext/openssl/ossl_x509.c
index 8a061b0..4fc0648 100644
--- a/ext/openssl/ossl_x509.c
+++ b/ext/openssl/ossl_x509.c
@@ -44,7 +44,13 @@ Init_ossl_x509(void)
Init_ossl_x509revoked();
Init_ossl_x509store();
+ /* Constants are up-to-date with 1.1.1. */
+
+ /* Certificate verification error code */
DefX509Const(V_OK);
+#if defined(X509_V_ERR_UNSPECIFIED) /* 1.0.1r, 1.0.2f, 1.1.0 */
+ DefX509Const(V_ERR_UNSPECIFIED);
+#endif
DefX509Const(V_ERR_UNABLE_TO_GET_ISSUER_CERT);
DefX509Const(V_ERR_UNABLE_TO_GET_CRL);
DefX509Const(V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE);
@@ -76,8 +82,73 @@ Init_ossl_x509(void)
DefX509Const(V_ERR_AKID_SKID_MISMATCH);
DefX509Const(V_ERR_AKID_ISSUER_SERIAL_MISMATCH);
DefX509Const(V_ERR_KEYUSAGE_NO_CERTSIGN);
+ DefX509Const(V_ERR_UNABLE_TO_GET_CRL_ISSUER);
+ DefX509Const(V_ERR_UNHANDLED_CRITICAL_EXTENSION);
+ DefX509Const(V_ERR_KEYUSAGE_NO_CRL_SIGN);
+ DefX509Const(V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION);
+ DefX509Const(V_ERR_INVALID_NON_CA);
+ DefX509Const(V_ERR_PROXY_PATH_LENGTH_EXCEEDED);
+ DefX509Const(V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE);
+ DefX509Const(V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED);
+ DefX509Const(V_ERR_INVALID_EXTENSION);
+ DefX509Const(V_ERR_INVALID_POLICY_EXTENSION);
+ DefX509Const(V_ERR_NO_EXPLICIT_POLICY);
+ DefX509Const(V_ERR_DIFFERENT_CRL_SCOPE);
+ DefX509Const(V_ERR_UNSUPPORTED_EXTENSION_FEATURE);
+ DefX509Const(V_ERR_UNNESTED_RESOURCE);
+ DefX509Const(V_ERR_PERMITTED_VIOLATION);
+ DefX509Const(V_ERR_EXCLUDED_VIOLATION);
+ DefX509Const(V_ERR_SUBTREE_MINMAX);
DefX509Const(V_ERR_APPLICATION_VERIFICATION);
+ DefX509Const(V_ERR_UNSUPPORTED_CONSTRAINT_TYPE);
+ DefX509Const(V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX);
+ DefX509Const(V_ERR_UNSUPPORTED_NAME_SYNTAX);
+ DefX509Const(V_ERR_CRL_PATH_VALIDATION_ERROR);
+#if defined(X509_V_ERR_PATH_LOOP)
+ DefX509Const(V_ERR_PATH_LOOP);
+#endif
+#if defined(X509_V_ERR_SUITE_B_INVALID_VERSION)
+ DefX509Const(V_ERR_SUITE_B_INVALID_VERSION);
+ DefX509Const(V_ERR_SUITE_B_INVALID_ALGORITHM);
+ DefX509Const(V_ERR_SUITE_B_INVALID_CURVE);
+ DefX509Const(V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM);
+ DefX509Const(V_ERR_SUITE_B_LOS_NOT_ALLOWED);
+ DefX509Const(V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256);
+#endif
+#if defined(X509_V_ERR_HOSTNAME_MISMATCH)
+ DefX509Const(V_ERR_HOSTNAME_MISMATCH);
+ DefX509Const(V_ERR_EMAIL_MISMATCH);
+ DefX509Const(V_ERR_IP_ADDRESS_MISMATCH);
+#endif
+#if defined(X509_V_ERR_DANE_NO_MATCH)
+ DefX509Const(V_ERR_DANE_NO_MATCH);
+#endif
+#if defined(X509_V_ERR_EE_KEY_TOO_SMALL)
+ DefX509Const(V_ERR_EE_KEY_TOO_SMALL);
+ DefX509Const(V_ERR_CA_KEY_TOO_SMALL);
+ DefX509Const(V_ERR_CA_MD_TOO_WEAK);
+#endif
+#if defined(X509_V_ERR_INVALID_CALL)
+ DefX509Const(V_ERR_INVALID_CALL);
+#endif
+#if defined(X509_V_ERR_STORE_LOOKUP)
+ DefX509Const(V_ERR_STORE_LOOKUP);
+#endif
+#if defined(X509_V_ERR_NO_VALID_SCTS)
+ DefX509Const(V_ERR_NO_VALID_SCTS);
+#endif
+#if defined(X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION)
+ DefX509Const(V_ERR_PROXY_SUBJECT_NAME_VIOLATION);
+#endif
+#if defined(X509_V_ERR_OCSP_VERIFY_NEEDED)
+ DefX509Const(V_ERR_OCSP_VERIFY_NEEDED);
+ DefX509Const(V_ERR_OCSP_VERIFY_FAILED);
+ DefX509Const(V_ERR_OCSP_CERT_UNKNOWN);
+#endif
+ /* Certificate verify flags */
+ /* Set by Store#flags= and StoreContext#flags=. */
+ DefX509Const(V_FLAG_USE_CHECK_TIME);
/* Set by Store#flags= and StoreContext#flags=. Enables CRL checking for the
* certificate chain leaf. */
DefX509Const(V_FLAG_CRL_CHECK);
@@ -122,6 +193,26 @@ Init_ossl_x509(void)
* Enabled by default in OpenSSL >= 1.1.0. */
DefX509Const(V_FLAG_TRUSTED_FIRST);
#endif
+#if defined(X509_V_FLAG_SUITEB_128_LOS_ONLY)
+ /* Set by Store#flags= and StoreContext#flags=.
+ * Enables Suite B 128 bit only mode. */
+ DefX509Const(V_FLAG_SUITEB_128_LOS_ONLY);
+#endif
+#if defined(X509_V_FLAG_SUITEB_192_LOS)
+ /* Set by Store#flags= and StoreContext#flags=.
+ * Enables Suite B 192 bit only mode. */
+ DefX509Const(V_FLAG_SUITEB_192_LOS);
+#endif
+#if defined(X509_V_FLAG_SUITEB_128_LOS)
+ /* Set by Store#flags= and StoreContext#flags=.
+ * Enables Suite B 128 bit mode allowing 192 bit algorithms. */
+ DefX509Const(V_FLAG_SUITEB_128_LOS);
+#endif
+#if defined(X509_V_FLAG_PARTIAL_CHAIN)
+ /* Set by Store#flags= and StoreContext#flags=.
+ * Allows partial chains if at least one certificate is in trusted store. */
+ DefX509Const(V_FLAG_PARTIAL_CHAIN);
+#endif
#if defined(X509_V_FLAG_NO_ALT_CHAINS)
/* Set by Store#flags= and StoreContext#flags=. Suppresses searching for
* a alternative chain. No effect in OpenSSL >= 1.1.0. */