summaryrefslogtreecommitdiff
path: root/ext/openssl/ossl_pkey_ec.c
AgeCommit message (Collapse)Author
2026-01-04[ruby/openssl] Improve Argument Error Message in EC:Group.newAugustin Gottlieb
Before, passing the wrong number of arguments (e.g., 2) to OpenSSL::PKey::EC::Group.new raised a generic "wrong number of arguments" error. This change updates it to show the actual argument count and the expected options (1 or 4), making debugging easier for the user. Example: ArgumentError: wrong number of arguments (given 2, expected 1 or 4) I hope it helps! https://github.com/ruby/openssl/commit/783c99e6c7
2025-12-04[ruby/openssl] Expand tabs in C source filesKazuki Yamaguchi
Since around 2018, we have been using spaces for indentation for newly added code[1]. The mixed use of tabs and spaces has repeatedly confused new contributors who configured their editors to use a different tab size than 8. Since git blame can now skip specific commits, ruby/ruby did a mass reformatting of tabs in 2022[2]. Do the same in ruby/openssl. While at it, fix a few indentation issues, mainly in switch-case labels and in ossl_ssl_session.c, which used doubled indentation size. This patch contains white-space changes only. git diff -w output should be empty. [1] https://bugs.ruby-lang.org/issues/14246 [2] https://bugs.ruby-lang.org/issues/18891 https://github.com/ruby/openssl/commit/4d6214f507
2025-11-29[ruby/openssl] Remove dummy declarations for mOSSL and eOSSLErrorKazuki Yamaguchi
These declarations were added to every source file because older versions of RDoc did not resolve ancestor tree across files. Since RDoc 6.9.0 supports this, this workaround is no longer needed. https://redirect.github.com/ruby/rdoc/pull/1217 https://github.com/ruby/openssl/commit/6491ce63be
2025-11-22[ruby/openssl] pkey/ec: fix OpenSSL::PKey::EC::Group#curve_name for unknown ↵Kazuki Yamaguchi
curves EC_GROUP_get_curve_name() returns NID_undef when OpenSSL does not recognize the curve and there is no associated OID. Handle this case explicitly and return nil instead of the string "UNDEF", which should not be exposed outside the extension. https://github.com/ruby/openssl/commit/2c16821c07
2025-11-06[ruby/openssl] pkey: unify error classes into PKeyErrorKazuki Yamaguchi
Remove the following subclasses of OpenSSL::PKey::PKeyError and make them aliases of it. - OpenSSL::PKey::DHError - OpenSSL::PKey::DSAError - OpenSSL::PKey::ECError - OpenSSL::PKey::RSAError Historically, methods defined on OpenSSL::PKey and OpenSSL::PKey::PKey raise OpenSSL::PKey::PKeyError, while methods on the subclasses raise their respective exception classes. However, this distinction is not particularly useful since all those exception classes represent the same kind of errors from the underlying EVP_PKEY API. I think this convention comes from the fact that OpenSSL::PKey::{DH, DSA,RSA} originally wrapped the corresponding OpenSSL structs DH, DSA, and RSA, before they were unified to wrap EVP_PKEY, way back in 2002. OpenSSL::PKey::EC::Group::Error and OpenSSL::PKey::EC::Point::Error are out of scope of this change, as they are not subclasses of OpenSSL::PKey::PKeyError and do not represent errors from the EVP_PKEY API. https://github.com/ruby/openssl/commit/e74ff3e272
2025-10-27[ruby/openssl] Check NULL values for deprecated EVP_PKEY_get0() functionsStan Hu
In OpenSSL <= 1.1.1, EVP_PKEY_get0() always returned a valid object, so a NULL check was not necessary. In OpenSSL 3.0, the function can return NULL (https://docs.openssl.org/3.0/man7/migration_guide/#deprecated-function-mappings), so guard against this issue. https://github.com/ruby/openssl/commit/dc90b9c51e
2025-09-30[ruby/openssl] pkey: disallow {DH,DSA,EC,RSA}.new without arguments with ↵Kazuki Yamaguchi
OpenSSL 3.0 Raise ArgumentError if this is attempted when the extension is compiled with OpenSSL 3.0 or later. The form will be fully removed when we drop support for OpenSSL 1.1.1. When OpenSSL::PKey::{DH,DSA,EC,RSA}.new is called without any arguments, it sets up an empty corresponding low-level struct and wraps it in an EVP_PKEY. This is useful when the user later fills the missing fields using low-level setter methods such as OpenSSL::PKey::RSA#set_key. Such setter methods are not compatible with OpenSSL 3.0 or later, where EVP_PKEY is immutable once created. This means that the ability to create an empty instance is useless. https://github.com/ruby/openssl/commit/affd569f78
2025-09-30[ruby/openssl] pkey: define and use OSSL_HAVE_IMMUTABLE_PKEY macroKazuki Yamaguchi
Introduce a useful macro indicating that the low-level struct wrapped in an EVP_PKEY cannot be modified. Currently, the macro is defined for OpenSSL 3.0 or later only. LibreSSL and AWS-LC can follow suit in the future. https://github.com/ruby/openssl/commit/032ed63096
2025-07-27[ruby/openssl] bn: avoid ossl_bn_new(NULL)Kazuki Yamaguchi
Currently, calling ossl_bn_new() with a NULL argument allocates a new OpenSSL::BN instance representing 0. This behavior is confusing. Raise an exception if this is attempted, instead. https://github.com/ruby/openssl/commit/6fa793d997
2025-07-05[ruby/openssl] pkey/ec: avoid calling SYM2ID() on user-supplied objectsKazuki Yamaguchi
Compare by the VALUE value instead of ID. Calling SYM2ID() on a dynamic symbol will pin a permanent ID. These methods only accept known static symbols, and passing anything else is an incorrect usage that results in an exception. Nonetheless, avoiding SYM2ID() seems to be a good idea since there is no runtime cost. https://github.com/ruby/openssl/commit/0d66296cdc
2025-03-12[ruby/openssl] mark `initialize_copy` as :nodoc:Sarun Rattanasiri
https://github.com/ruby/openssl/commit/17f87d2cf0
2025-02-11[ruby/openssl] Add build support for AWS-LCSamuel Chiang
CI Changes 1. I've split the original patch up to make it easier to digest, but that forces my hand to turn off testing in the AWS-LC CI for the time being. However, do let me know if you would prefer to review the test adjustments in the same PR and I can remove the temporary CI workaround. 2. AWS-LC has a few no-op functions and we use -Wdeprecated-declarations to alert the consuming application of these. I've leveraged the skip-warnings CI option so that the build doesn't fail. Build Adjustments 1. AWS-LC FIPS mode is decided at compile time. This is different from OpenSSL's togglable FIPS switch, so I've adjusted the build to account for this. 2. AWS-LC does not support for the two KEY_SIG or KEY_EX flags that were only ever supported by old MSIE. 3. AWS-LC has no current support for post handshake authentication in TLS 1.3. 4. EC_GROUP structures for named curves in AWS-LC are constant, static, and immutable by default. This means that the EC_GROUP_set_* functions are essentially no-ops due to the immutability of the structure. We've introduced a new API for consumers that depend on the OpenSSL's default mutability of the EC_GROUP structure called EC_GROUP_new_by_curve_name_mutable. Since Ruby has a bit of functionality that's dependent on the mutability of these structures, I've made the corresponding adjustments to allow things to work as expected. https://github.com/ruby/openssl/commit/e53ec5a101
2025-02-03[ruby/openssl] pkey/ec: remove deprecated PKey::EC::Point#mul(ary, ary [, ↵Kazuki Yamaguchi
bn]) form The method has two forms, each corresponding to EC_POINT_mul() and EC_POINTs_mul(). The latter form does not work with any OpenSSL or LibreSSL versions that are still supported by upstream. The latter form has an extremely confusing behavior, too, and using it would print a deprecation warning since commit https://github.com/ruby/openssl/commit/812de4253d25 in 2020, which went to 3.0.0. Let's remove it. https://github.com/ruby/openssl/commit/7343d3c559
2025-01-20[ruby/openssl] Require OpenSSL 1.1.0 or laterKazuki Yamaguchi
Drop support for OpenSSL 1.0.2. It has reached upstream EOL in 2019-12. Most distributions that shipped with OpenSSL 1.0.2 have also reached EOL, or provide a newer version in the package repository: - RHEL 7 (EOL 2024-06) - Ubuntu 16.04 LTS (EOL 2021-04) - Amazon Linux 2 (EOL 2026-06, but OpenSSL 1.1.1 can be installed via the openssl11{,-devel} package) https://github.com/ruby/openssl/commit/38ec6fd50e
2024-12-07[ruby/openssl] Mark variables and functions as static whenever possibleKazuki Yamaguchi
https://github.com/ruby/openssl/commit/85d6b7f192
2024-12-07[ruby/openssl] pkey/ec: fix exception class in OpenSSL::PKey::EC.newKazuki Yamaguchi
Fix a copy-and-paste error introduced in commit https://github.com/ruby/openssl/commit/74f6c6175688 (pkey: allocate EVP_PKEY on #initialize, 2021-04-12). It should raise OpenSSL::PKey::ECError instead of OpenSSL::PKey::DSAError. https://github.com/ruby/openssl/commit/b1f6a04abf
2023-08-16[ruby/openssl] [DOC] enhance RDoc for exporting pkeysKazuki Yamaguchi
Describe the behavior of OpenSSL::PKey::{DH,DSA,EC,RSA}#to_pem and #to_der more clearly. They return a different result depending on whether the pkey is a public or private key. This was not documented adequately. Also, suggest the use of OpenSSL::PKey::PKey#private_to_pem and #public_to_pem instead, if possible. https://github.com/ruby/openssl/commit/d22769af8f
2023-06-19[ruby/openssl] Implement Write Barrier for all OpenSSL typesJean Boussier
The vast majority have no reference so it's just a matter of setting the flags. For the couple exception, they have very little references so it's easy. https://github.com/ruby/openssl/commit/2c7c6de69e
2022-12-26Apply the accidental commits again before Ruby 3.2.Hiroshi SHIBATA
Reverts the following commits: eb8d4d7b5145849325985c00b810b8d75661d86e edb83dc3a2c374e880e8eb488152872152790e92 d40064d1846b5835dff81e3f168c0c3a6c85e814
2022-12-23Revert the additional change from openssl-3.1.0Hiroshi SHIBATA
Revert "[ruby/openssl] pkey/ec: constify" This reverts commit d2cd903c85f38f42c6aefc6d97a1558f74d8d9db.
2022-12-23[ruby/openssl] pkey/ec: constifyNobuyoshi Nakada
https://github.com/ruby/openssl/commit/6fb3499a7b
2022-12-23[ruby/openssl] pkey/ec: check private key validity with OpenSSL 3Joe Truba
The behavior of EVP_PKEY_public_check changed between OpenSSL 1.1.1 and 3.0 so that it no longer validates the private key. Instead, private keys can be validated through EVP_PKEY_private_check and EVP_PKEY_pairwise_check. [ky: simplified condition to use either EVP_PKEY_check() or EVP_PKEY_public_check().] https://github.com/ruby/openssl/commit/e38a63ab3d
2022-12-23[ruby/openssl] Constify when building with OpenSSL 3Nobuyoshi Nakada
https://github.com/ruby/openssl/commit/c0023822fe
2022-12-23[ruby/openssl] pkey/ec: fix ossl_raise() calls using cEC_POINT instead of ↵Joe Truba
eEC_POINT https://github.com/ruby/openssl/commit/b2e9f5e132
2022-12-23[ruby/openssl] raise when EC_POINT_cmp or EC_GROUP_cmp error instead of ↵Joe Truba
returning true https://github.com/ruby/openssl/commit/e1e8f3cebe
2022-10-17[ruby/openssl] pkey/ec: check existence of public key component before exportingKazuki Yamaguchi
i2d_PUBKEY_bio() against an EC_KEY without the public key component trggers a null dereference. This is a regression introduced by commit https://github.com/ruby/openssl/commit/56f0d34d63fb ("pkey: refactor #export/#to_pem and #to_der", 2017-06-14). Fixes https://github.com/ruby/openssl/pull/527#issuecomment-1220504524 Fixes https://github.com/ruby/openssl/issues/369#issuecomment-1221554057 https://github.com/ruby/openssl/commit/f6ee0fa4de
2022-10-17openssl: use the old rb_ary_tmp_new() aliasKazuki Yamaguchi
openssl has to support older versions of Ruby. Undo the change in ext/openssl/ossl_pkey_ec.c by commit efb91ff19b73 ("Rename rb_ary_tmp_new to rb_ary_hidden_new", 2022-07-25).
2022-07-26Rename rb_ary_tmp_new to rb_ary_hidden_newPeter Zhu
rb_ary_tmp_new suggests that the array is temporary in some way, but that's not true, it just creates an array that's hidden and not on the transient heap. This commit renames it to rb_ary_hidden_new. Notes: Merged: https://github.com/ruby/ruby/pull/6180
2021-12-20[ruby/openssl] pkey: deprecate PKey#set_* methodsKazuki Yamaguchi
OpenSSL 3.0 made EVP_PKEY immutable. This means we can only have a const pointer of the low level struct and the following methods can no longer be provided when linked against OpenSSL 3.0: - OpenSSL::PKey::RSA#set_key - OpenSSL::PKey::RSA#set_factors - OpenSSL::PKey::RSA#set_crt_params - OpenSSL::PKey::DSA#set_pqg - OpenSSL::PKey::DSA#set_key - OpenSSL::PKey::DH#set_pqg - OpenSSL::PKey::DH#set_key - OpenSSL::PKey::EC#group= - OpenSSL::PKey::EC#private_key= - OpenSSL::PKey::EC#public_key= There is no direct replacement for this functionality at the moment. I plan to introduce a wrapper around EVP_PKEY_fromdata(), which takes all key components at once to construct an EVP_PKEY. https://github.com/ruby/openssl/commit/6848d2d969
2021-12-20[ruby/openssl] pkey/ec: deprecate OpenSSL::PKey::EC#generate_key!Kazuki Yamaguchi
OpenSSL::PKey::EC#generate_key! will not work on OpenSSL 3.0 because keys are made immutable. Users should use OpenSSL::PKey.generate_key instead. https://github.com/ruby/openssl/commit/5e2e66cce8
2021-12-20[ruby/openssl] pkey: use EVP_PKEY_dup() if availableKazuki Yamaguchi
We can use it to implement OpenSSL::PKey::PKey#initialize_copy. This should work on all key types, not just DH/DSA/EC/RSA types. https://github.com/ruby/openssl/commit/66cd8cbaaf
2021-12-20[ruby/openssl] pkey: allocate EVP_PKEY on #initializeKazuki Yamaguchi
Allocate an EVP_PKEY when the content is ready: when #initialize or #initialize_copy is called, rather than when a T_DATA is allocated. This is more natural because the lower level API has been deprecated and an EVP_PKEY is becoming the minimum unit of handling keys. https://github.com/ruby/openssl/commit/74f6c61756
2021-10-25[ruby/openssl] pkey/ec: use EC_GROUP_free() instead of EC_GROUP_clear_free()Kazuki Yamaguchi
EC_GROUP_clear_free() is deprecated in OpenSSL 3.0. EC_GROUP does not include any sensitive data, so we can safely use EC_GROUP_free() instead. https://github.com/ruby/openssl/commit/e93a5fdffc
2021-10-25[ruby/openssl] pkey/ec: deprecate PKey::EC::Point#make_affine! and make it a ↵Kazuki Yamaguchi
no-op It converts the internal representation of the point object to the affine coordinate system. However, it had no real use case because the difference in the internal representation has not been visible from Ruby/OpenSSL at all. EC_POINT_make_affine() is marked as deprecated in OpenSSL 3.0. https://github.com/ruby/openssl/commit/e2cc81fef7
2021-10-16[ruby/openssl] require Ruby 2.6 or laterKazuki Yamaguchi
Drop support for Ruby 2.3, 2.4, and 2.5. As of 2021-10, Ruby 2.6 is the oldest version that still receives security fixes from the Ruby core team, so it doesn't make much sense to keep code for those ancient versions. https://github.com/ruby/openssl/commit/3436bd040d
2021-09-12[ruby/openssl] Add fallthrough commentsNobuyoshi Nakada
https://github.com/ruby/openssl/commit/258e30b640
2021-09-12[ruby/openssl] Suppress printf format warningsNobuyoshi Nakada
* Add `printf` format attribute to `ossl_raise`. * Fix a format specifier in `config_load_bio`. * Use `ASSUME` for the unreachable condition. https://github.com/ruby/openssl/commit/41da2955db
2021-07-18[ruby/openssl] pkey/ec: refactor EC#dsa_{sign,verify}_asn1 with ↵Kazuki Yamaguchi
PKey#{sign,verify}_raw With the newly added OpenSSL::PKey::PKey#{sign,verify}_raw, OpenSSL::PKey::EC's low level signing operation methods can be implemented in Ruby. The definitions are now in lib/openssl/pkey.rb. https://github.com/ruby/openssl/commit/1f9da0cd9d
2021-07-18[ruby/openssl] pkey/dh, pkey/ec: use EVP_PKEY_check() familyKazuki Yamaguchi
Use EVP_PKEY_param_check() instead of DH_check() if available. Also, use EVP_PKEY_public_check() instead of EC_KEY_check_key(). EVP_PKEY_*check() is part of the EVP API and is meant to replace those low-level functions. They were added by OpenSSL 1.1.1. It is currently not provided by LibreSSL. https://github.com/ruby/openssl/commit/797e9f8e08
2021-07-18[ruby/openssl] pkey: implement #to_text using EVP APIKazuki Yamaguchi
Use EVP_PKEY_print_private() instead of the low-level API *_print() functions, such as RSA_print(). EVP_PKEY_print_*() family was added in OpenSSL 1.0.0. Note that it falls back to EVP_PKEY_print_public() and EVP_PKEY_print_params() as necessary. This is required for EVP_PKEY_DH type for which _private() fails if the private component is not set in the pkey object. Since the new API works in the same way for all key types, we now implement #to_text in the base class OpenSSL::PKey::PKey rather than in each subclass. https://github.com/ruby/openssl/commit/e0b4c56956
2021-05-04Fix -Wundef warnings in core extensionsBenoit Daloze
* See [Feature #17752] Notes: Merged: https://github.com/ruby/ruby/pull/4428
2021-03-16[ruby/openssl] pkey/ec: remove OpenSSL::PKey::EC::Group.new(ec_method) formKazuki Yamaguchi
The form created an empty EC_GROUP object with the specified EC_METHOD. However, the feature was unfinished and not useful in any way because OpenSSL::PKey::EC::Group did not implement wrappers for necessary functions to set actual parameters for the group, namely EC_GROUP_set_curve() family. EC_GROUP object creation with EC_METHOD explicitly specified is deprecated in OpenSSL 3.0, as it was apparently not intended for use outside OpenSSL. It is still possible to create EC_GROUP, but without EC_METHOD explicitly specified - OpenSSL chooses the appropriate EC_METHOD for the curve type. The OpenSSL::PKey::EC::Group.new(<:GFp|:GF2m>, p, a, b) form will continue to work. https://github.com/ruby/openssl/commit/df4bec841f Notes: Merged: https://github.com/ruby/ruby/pull/4275
2021-03-16[ruby/openssl] pkey/ec: deprecate OpenSSL::PKey::EC::Point#mul(ary, ary [, bn])Kazuki Yamaguchi
Deprecate it for future removal. However, I do not expect any application is affected by this. The other form of calling it, PKey::EC::Point#mul(bn [, bn]) remains untouched. PKey::EC::Point#mul calls EC_POINTs_mul(3) when multiple BNs are given as an array. LibreSSL 2.8.0 released on 2018-08 removed the feature and OpenSSL 3.0 which is planned to be released in 2020 will also deprecate the function as there is no real use-case. https://github.com/ruby/openssl/commit/812de4253d Notes: Merged: https://github.com/ruby/ruby/pull/4275
2021-03-16[ruby/openssl] pkey: reimplement PKey::DH#compute_key and ↵Kazuki Yamaguchi
PKey::EC#dh_compute_key Use the new OpenSSL::PKey::PKey#derive instead of the raw {EC,}DH_compute_key(), mainly to reduce amount of the C code. https://github.com/ruby/openssl/commit/28edf6bafc Notes: Merged: https://github.com/ruby/ruby/pull/4275
2021-03-16[ruby/openssl] pkey: refactor #export/#to_pem and #to_derKazuki Yamaguchi
Add ossl_pkey_export_traditional() and ossl_pkey_export_spki() helper functions, and use them. This reduces code duplication. https://github.com/ruby/openssl/commit/56f0d34d63 Notes: Merged: https://github.com/ruby/ruby/pull/4275
2021-03-16[ruby/openssl] pkey: refactor DER/PEM-encoded string parsing codeKazuki Yamaguchi
Export the flow used by OpenSSL::PKey.read and let the subclasses call it before attempting other formats. https://github.com/ruby/openssl/commit/d963d4e276 Notes: Merged: https://github.com/ruby/ruby/pull/4275
2021-03-16[ruby/openssl] pkey: inline {rsa,dsa,dh,ec}_instance()Kazuki Yamaguchi
Merge the code into the callers so that the wrapping Ruby object is allocated before the raw key object is allocated. This prevents possible memory leak on Ruby object allocation failure, and also reduces the lines of code. https://github.com/ruby/openssl/commit/1eb1366615 Notes: Merged: https://github.com/ruby/ruby/pull/4275
2021-03-16[ruby/openssl] pkey: simplify ossl_pkey_new()Kazuki Yamaguchi
ossl_{rsa,dsa,dh,ec}_new() called from this function are not used anywhere else. Inline them into pkey_new0() and reduce code duplication. https://github.com/ruby/openssl/commit/94aeab2f26 Notes: Merged: https://github.com/ruby/ruby/pull/4275
2020-02-16Import openssl-2.2.0 (#2693)Hiroshi SHIBATA
Import the master branch of ruby/openssl for preparing to release openssl-2.2.0 Notes: Merged-By: hsbt <hsbt@ruby-lang.org>
2018-02-16no ID cache in Init functionsnobu
Init functions are called only once, cache is useless. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62429 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-29 21:35:55 +0000