diff options
| author | Kazuki Yamaguchi <[email protected]> | 2025-01-22 03:22:22 +0900 |
|---|---|---|
| committer | Kazuki Yamaguchi <[email protected]> | 2025-01-23 01:45:52 +0900 |
| commit | 495b1cad042b30c40b62b5ecea5a728ea3c2f4ac (patch) | |
| tree | d73daa96220df790bf8c572ae1004bce14da70c0 /ext/openssl/ossl_ts.c | |
| parent | 87316d58faa2d57e9f1c1df2f76584a129a60bcc (diff) | |
[ruby/openssl] ts: use TS_VERIFY_CTX_set0_{store,certs}() on OpenSSL 3.4
In OpenSSL 3.4, TS_VERIFY_CTX_set_certs() and TS_VERIFY_CTX_set_store()
are deprecated in favor of the new functions with "set0" in the names.
The new functions have a slightly different behavior. They will free the
previous value automatically. Increment the reference counter of
X509_STORE before setting it to TS_VERIFY_CTX, and do not try to
manually unset it.
We avoided doing this to work around a bug that was present in older
versions of OpenSSL, which has now been fixed in OpenSSL 1.0.2 by commit
https://github.com/openssl/openssl/commit/bff9ce4db38b.
https://github.com/ruby/openssl/commit/ce37f7d93a
Diffstat (limited to 'ext/openssl/ossl_ts.c')
| -rw-r--r-- | ext/openssl/ossl_ts.c | 22 |
1 files changed, 16 insertions, 6 deletions
diff --git a/ext/openssl/ossl_ts.c b/ext/openssl/ossl_ts.c index 3aabcc013b..c7d2bd271b 100644 --- a/ext/openssl/ossl_ts.c +++ b/ext/openssl/ossl_ts.c @@ -855,16 +855,26 @@ ossl_ts_resp_verify(int argc, VALUE *argv, VALUE self) X509_up_ref(cert); } + if (!X509_STORE_up_ref(x509st)) { + sk_X509_pop_free(x509inter, X509_free); + TS_VERIFY_CTX_free(ctx); + ossl_raise(eTimestampError, "X509_STORE_up_ref"); + } + +#ifdef HAVE_TS_VERIFY_CTX_SET0_CERTS + TS_VERIFY_CTX_set0_certs(ctx, x509inter); + TS_VERIFY_CTX_set0_store(ctx, x509st); +#else +# if OSSL_OPENSSL_PREREQ(3, 0, 0) || OSSL_IS_LIBRESSL TS_VERIFY_CTX_set_certs(ctx, x509inter); - TS_VERIFY_CTX_add_flags(ctx, TS_VFY_SIGNATURE); +# else + TS_VERIFY_CTS_set_certs(ctx, x509inter); +# endif TS_VERIFY_CTX_set_store(ctx, x509st); +#endif + TS_VERIFY_CTX_add_flags(ctx, TS_VFY_SIGNATURE); ok = TS_RESP_verify_response(ctx, resp); - /* - * TS_VERIFY_CTX_set_store() call above does not increment the reference - * counter, so it must be unset before TS_VERIFY_CTX_free() is called. - */ - TS_VERIFY_CTX_set_store(ctx, NULL); TS_VERIFY_CTX_free(ctx); if (!ok) |