summaryrefslogtreecommitdiff
path: root/ext/openssl
AgeCommit message (Collapse)Author
2022-12-26Apply the accidental commits again before Ruby 3.2.Hiroshi SHIBATA
Reverts the following commits: eb8d4d7b5145849325985c00b810b8d75661d86e edb83dc3a2c374e880e8eb488152872152790e92 d40064d1846b5835dff81e3f168c0c3a6c85e814
2022-12-23Revert the additional change from openssl-3.1.0Hiroshi SHIBATA
Revert "[ruby/openssl] pkey/ec: constify" This reverts commit d2cd903c85f38f42c6aefc6d97a1558f74d8d9db.
2022-12-23[ruby/openssl] pkey/ec: constifyNobuyoshi Nakada
https://github.com/ruby/openssl/commit/6fb3499a7b
2022-12-23[ruby/openssl] Ruby/OpenSSL 3.1.0Kazuki Yamaguchi
https://github.com/ruby/openssl/commit/c2f7d775c6
2022-12-23[ruby/openssl] Ruby/OpenSSL 3.0.2Kazuki Yamaguchi
https://github.com/ruby/openssl/commit/48b79333e0
2022-12-23[ruby/openssl] Ruby/OpenSSL 2.2.3Kazuki Yamaguchi
https://github.com/ruby/openssl/commit/04acccd692
2022-12-23[ruby/openssl] pkey/ec: check private key validity with OpenSSL 3Joe Truba
The behavior of EVP_PKEY_public_check changed between OpenSSL 1.1.1 and 3.0 so that it no longer validates the private key. Instead, private keys can be validated through EVP_PKEY_private_check and EVP_PKEY_pairwise_check. [ky: simplified condition to use either EVP_PKEY_check() or EVP_PKEY_public_check().] https://github.com/ruby/openssl/commit/e38a63ab3d
2022-12-23[ruby/openssl] Undefine `OpenSSL::SSL` for no socket platformsYuta Saito
This fixes a linkage error about `ossl_ssl_type` on platforms which do not have socket, like WASI. Even before this patch, some items are disabled under `OPENSSL_NO_SOCK` since https://github.com/ruby/ruby/commit/ee22fad45d394818690c4a7586d7bb576ba67c56 However, due to some new use of OpenSSL::SSL::Socket over the past few years, the build under `OPENSSL_NO_SOCK` had been broken. This patch guards whole `OpenSSL::SSL` items by `OPENSSL_NO_SOCK`. [ky: adjusted to apply on top of my previous commit that removed the OpenSSL::ExtConfig, and added a guard to lib/openssl/ssl.rb.] https://github.com/ruby/openssl/commit/b0cfac6a96
2022-12-23[ruby/openssl] ssl: remove OpenSSL::ExtConfigKazuki Yamaguchi
This module was introduced in 2015 for internal use within this library. Neither of the two constants in it is used anymore. I don't think we will be adding a new constant in the foreseeable future, either. OPENSSL_NO_SOCK is unused since commit https://github.com/ruby/openssl/commit/998d66712a78 (r55191). HAVE_TLSEXT_HOST_NAME is unused since commit https://github.com/ruby/openssl/commit/4eb4b3297a92. https://github.com/ruby/openssl/commit/eed3894bda
2022-12-23[ruby/openssl] ssl: disable NPN support on LibreSSLKazuki Yamaguchi
As noted in commit https://github.com/ruby/openssl/commit/a2ed156cc9f1 ("test/test_ssl: do not run NPN tests for LibreSSL >= 2.6.1", 2017-08-13), NPN is known not to work properly on LibreSSL. Disable NPN support on LibreSSL, whether OPENSSL_NO_NEXTPROTONEG is defined or not. NPN is less relevant today anyway. Let's also silence test suite when it's not available. https://github.com/ruby/openssl/commit/289f6e0e1f
2022-12-23[ruby/openssl] ssl: update TLS1_3_VERSION workaround for older LibreSSL versionsKazuki Yamaguchi
The macro is now defined by default in LibreSSL 3.4+. Let's document it for future readers. https://github.com/ruby/openssl/commit/935698e9f9
2022-12-23[ruby/openssl] Suppress deprecation warnings by OpenSSL 3Nobuyoshi Nakada
https://github.com/ruby/openssl/commit/91657a7924
2022-12-23[ruby/openssl] Constify when building with OpenSSL 3Nobuyoshi Nakada
https://github.com/ruby/openssl/commit/c0023822fe
2022-12-23[ruby/openssl] Check for functions with argumentsNobuyoshi Nakada
https://github.com/ruby/openssl/commit/b67aaf925d
2022-12-23[ruby/openssl] pkey/ec: fix ossl_raise() calls using cEC_POINT instead of ↵Joe Truba
eEC_POINT https://github.com/ruby/openssl/commit/b2e9f5e132
2022-12-23[ruby/openssl] raise when EC_POINT_cmp or EC_GROUP_cmp error instead of ↵Joe Truba
returning true https://github.com/ruby/openssl/commit/e1e8f3cebe
2022-12-13[ruby/openssl] [DOC] Remove duplicate docNobuyoshi Nakada
RDoc does not consider preprocessor conditionals, but equally uses both documents of `#if` and `#else` sides. https://github.com/ruby/openssl/commit/ea0a112a0c
2022-12-13We should apply https://github.com/ruby/openssl/pull/576 instead of them:Hiroshi SHIBATA
https://github.com/ruby/ruby/commit/6d8f396f37350b7aa9c85a097929f54a0939448b https://github.com/ruby/ruby/commit/c8b3bd45cc3cae93ae701333202416838ee6a00c
2022-12-13[ruby/openssl] Fixes OPENSSL_LIBRARY_VERSION description onHenrique Bontempo
documentation (https://github.com/ruby/openssl/pull/559) Adds back missing constant description on the documentation.
2022-12-13[ruby/openssl] Enable HKDF support for LibreSSL 3.6 and laterTheo Buehler
LibreSSL 3.6 added support for HKDF in EVP. Enable this in ossl_kdf.c. https://github.com/ruby/openssl/commit/9bdd39a7e2
2022-12-13[ruby/openssl] Allow empty string to OpenSSL::Cipher#updateYusuke Nakamura
For some reasons, plaintext may be empty string. ref https://www.rfc-editor.org/rfc/rfc9001.html#section-5.8 https://github.com/ruby/openssl/commit/953592a29e
2022-12-13[ruby/openssl] Use EVP_Digest{Sign,Verify} when availableTheo Buehler
LibreSSL 3.4 added EVP_DigestSign() and EVP_DigestVerify(). Use them when available to prepare for the addition of Ed25519 support in LibreSSL 3.7. https://github.com/ruby/openssl/commit/475b2bf766
2022-10-17[ruby/openssl] add document-method for BN#mod_inverseBen Toews
https://github.com/ruby/openssl/commit/5befde7519
2022-10-17[ruby/openssl] add BN#mod_sqrtBen Toews
https://github.com/ruby/openssl/commit/4619ab3e76
2022-10-17[ruby/openssl] define BIGNUM_2cr macro for BN function that takes context andBen Toews
returns a BN https://github.com/ruby/openssl/commit/4d0971c51c
2022-10-17[ruby/openssl] Call out insecure PKCS #1 v1.5 default padding for RSABart de Water
https://github.com/ruby/openssl/commit/fd5eaa6dfc
2022-10-17[ruby/openssl] Use default `IO#timeout` if possible.Samuel Williams
https://github.com/ruby/openssl/commit/471340f612
2022-10-17[ruby/openssl] Add support to SSL_CTX_set_keylog_callbackChristophe De La Fuente
- This callback is invoked when TLS key material is generated or received, in order to allow applications to store this keying material for debugging purposes. - It is invoked with an `SSLSocket` and a string containing the key material in the format used by NSS for its SSLKEYLOGFILE debugging output. - This commit adds the Ruby binding `keylog_cb` and the related tests - It is only compatible with OpenSSL >= 1.1.1. Even if LibreSSL implements `SSL_CTX_set_keylog_callback()` from v3.4.2, it does nothing (see https://github.com/libressl-portable/openbsd/commit/648d39f0f035835d0653342d139883b9661e9cb6) https://github.com/ruby/openssl/commit/3b63232cf1
2022-10-17[ruby/openssl] ssl: fix "warning: ‘ctx’ may be used uninitialized"Kazuki Yamaguchi
The code was introduced by https://github.com/ruby/openssl/commit/65530b887e54 ("ssl: enable generating keying material from SSL sessions", 2022-08-03). This is harmless, but we should avoid it. https://github.com/ruby/openssl/commit/f5b82e814b
2022-10-17[ruby/openssl] bump version number to 3.1.0.preKazuki Yamaguchi
https://github.com/ruby/openssl/commit/fceb978a5d
2022-10-17[ruby/openssl] Ruby/OpenSSL 3.0.1Kazuki Yamaguchi
https://github.com/ruby/openssl/commit/e5bbd015dc
2022-10-17[ruby/openssl] Ruby/OpenSSL 2.2.2Kazuki Yamaguchi
https://github.com/ruby/openssl/commit/de8a644bc4
2022-10-17[ruby/openssl] Ruby/OpenSSL 2.1.4Kazuki Yamaguchi
https://github.com/ruby/openssl/commit/5316241e61
2022-10-17[ruby/openssl] pkey/ec: check existence of public key component before exportingKazuki Yamaguchi
i2d_PUBKEY_bio() against an EC_KEY without the public key component trggers a null dereference. This is a regression introduced by commit https://github.com/ruby/openssl/commit/56f0d34d63fb ("pkey: refactor #export/#to_pem and #to_der", 2017-06-14). Fixes https://github.com/ruby/openssl/pull/527#issuecomment-1220504524 Fixes https://github.com/ruby/openssl/issues/369#issuecomment-1221554057 https://github.com/ruby/openssl/commit/f6ee0fa4de
2022-10-17[ruby/openssl] pkey: restore support for decoding "openssl ecparam -genkey" ↵Kazuki Yamaguchi
output Scan through the input for a private key, then fallback to generic decoder. OpenSSL 3.0's OSSL_DECODER supports encoded key parameters. The PEM header "-----BEGIN EC PARAMETERS-----" is used by one of such encoding formats. While this is useful for OpenSSL::PKey::PKey, an edge case has been discovered. The openssl CLI command line "openssl ecparam -genkey" prints two PEM blocks in a row, one for EC parameters and another for the private key. Feeding the whole output into OSSL_DECODER results in only the first PEM block, the key parameters, being decoded. Previously, ruby/openssl did not support decoding key parameters and it would decode the private key PEM block instead. While the new behavior is technically correct, "openssl ecparam -genkey" is so widely used that ruby/openssl does not want to break existing applications. Fixes https://github.com/ruby/openssl/pull/535 https://github.com/ruby/openssl/commit/d486c82833
2022-10-17[ruby/openssl] pkey: clear error queue before each OSSL_DECODER_from_bio() callKazuki Yamaguchi
Fix potential error queue leak. https://github.com/ruby/openssl/commit/3992b6f208
2022-10-17[ruby/openssl] pkey/dsa: let PKey::DSA.generate choose appropriate q sizeKazuki Yamaguchi
DSA parameters generation via EVP_PKEY_paramgen() will not automatically adjust the size of q value but uses 224 bits by default unless specified explicitly. This behavior is different from the now-deprecated DSA_generate_parameters_ex(), which PKey::DSA.generate used to call. Fixes https://github.com/ruby/openssl/issues/483 Fixes: https://github.com/ruby/openssl/commit/1800a8d5ebaf ("pkey/dsa: use high level EVP interface to generate parameters and keys", 2020-05-17) https://github.com/ruby/openssl/commit/0105975a0b
2022-10-17[ruby/openssl] hmac: use EVP_PKEY_new_raw_private_key() if availableKazuki Yamaguchi
Current OpenSSL 3.0.x release has a regression with zero-length MAC keys. While this issue should be fixed in a future release of OpenSSL, we can use EVP_PKEY_new_raw_private_key() in place of the problematic EVP_PKEY_new_mac_key() to avoid the issue. OpenSSL 3.0's man page recommends using it regardless: > EVP_PKEY_new_mac_key() works in the same way as > EVP_PKEY_new_raw_private_key(). New applications should use > EVP_PKEY_new_raw_private_key() instead. Fixes https://github.com/ruby/openssl/issues/369#issuecomment-1224912710 https://github.com/ruby/openssl/commit/4293f18b1f
2022-10-17[ruby/openssl] x509*: fix error queue leak in #extensions= and #attributes= ↵Kazuki Yamaguchi
methods X509at_delete_attr() in OpenSSL master puts an error queue entry if there is no attribute left to delete. We must either clear the error queue, or try not to call it when the list is already empty. https://github.com/ruby/openssl/commit/a0c878481f
2022-10-17[ruby/openssl] ssl: enable generating keying material from SSL sessionsmadblobfish
Add OpenSSL::SSL::SSLSocket#export_keying_material to support RFC 5705 https://github.com/ruby/openssl/commit/65530b887e
2022-10-17[ruby/openssl] Check if the option is an Hash in `pkey_ctx_apply_options0()`Nobuhiro IMAI
causes SEGV if it is an Array or something like that. https://github.com/ruby/openssl/commit/ef23525210
2022-10-17[ruby/openssl] Pass arguments to check macro presenceAlan Wu
X509_STORE_get_ex_new_index() is a macro, so passing just its name to have_func() doesn't detect it. Pass an example call instead. https://github.com/ruby/openssl/commit/8d264d3e60 Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>
2022-10-17[ruby/openssl] Check for OpenSSL functions in headersAlan Wu
While building with a custom build of OpenSSL, I noticed in mkmf.log that all the feature detection checks are done using a program lacking an OpenSSL header include. `mkmf` retries using a fallback program when this fails, but that means all the `have_func` calls compile twice when compiling once should suffice. Example log without this commit: have_func: checking for X509_STORE_CTX_get0_cert()... -------------------- yes DYLD_FALLBACK_LIBRARY_PATH=.:../.. "clang -o conftest ... conftest.c:14:57: error: use of undeclared identifier 'X509_STORE_CTX_get0_cert' int t(void) { void ((*volatile p)()); p = (void ((*)()))X509_STORE_CTX_get0_cert; return !p; } ^ 1 error generated. checked program was: /* begin */ 1: #include "ruby.h" 2: 3: /*top*/ 4: extern int t(void); 5: int main(int argc, char **argv) 6: { 7: if (argc > 1000000) { 8: int (* volatile tp)(void)=(int (*)(void))&t; 9: printf("%d", (*tp)()); 10: } 11: 12: return !!argv[argc]; 13: } 14: int t(void) { void ((*volatile p)()); p = (void ((*)()))X509_STORE_CTX_get0_cert; return !p; } /* end */ DYLD_FALLBACK_LIBRARY_PATH=.:../.. "clang -o conftest ... checked program was: /* begin */ 1: #include "ruby.h" 2: 3: /*top*/ 4: extern int t(void); 5: int main(int argc, char **argv) 6: { 7: if (argc > 1000000) { 8: int (* volatile tp)(void)=(int (*)(void))&t; 9: printf("%d", (*tp)()); 10: } 11: 12: return !!argv[argc]; 13: } 14: extern void X509_STORE_CTX_get0_cert(); 15: int t(void) { X509_STORE_CTX_get0_cert(); return 0; } /* end */ The second compilation succeeds. Specify the header for each checked function. https://github.com/ruby/openssl/commit/34ae7d92d0
2022-10-17openssl: use the old rb_ary_tmp_new() aliasKazuki Yamaguchi
openssl has to support older versions of Ruby. Undo the change in ext/openssl/ossl_pkey_ec.c by commit efb91ff19b73 ("Rename rb_ary_tmp_new to rb_ary_hidden_new", 2022-07-25).
2022-10-07Simplify default argument specification. (#6507)Samuel Williams
Notes: Merged-By: ioquatix <samuel@codeotaku.com>
2022-10-07Add IO#timeout attribute and use it for blocking IO operations. (#5653)Samuel Williams
Notes: Merged-By: ioquatix <samuel@codeotaku.com>
2022-09-21proper function prototypes for openssl卜部昌平
Just to reroute compiler warnings. Notes: Merged: https://github.com/ruby/ruby/pull/6358
2022-07-26Rename rb_ary_tmp_new to rb_ary_hidden_newPeter Zhu
rb_ary_tmp_new suggests that the array is temporary in some way, but that's not true, it just creates an array that's hidden and not on the transient heap. This commit renames it to rb_ary_hidden_new. Notes: Merged: https://github.com/ruby/ruby/pull/6180
2022-07-08[ruby/openssl] Fix formatting in docsPeter Zhu
The + tag can only be used for single words. For multiple words the <tt> tag has to be used. https://github.com/ruby/openssl/commit/cf2f019c3e
2022-07-08[ruby/openssl] Let OpenSSL choose the digest if digest for ↵Jarek Prokop
Openssl::OCSP::BasicResponse#sign is nil. https://github.com/ruby/openssl/commit/27efcd7e1c
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-24 23:19:05 +0000