summaryrefslogtreecommitdiff
path: root/ext/openssl/lib
AgeCommit message (Collapse)Author
2025-02-03[ruby/openssl] ssl: separate SSLContext#min_version= and #max_version=Kazuki Yamaguchi
Make these methods simple wrappers around SSL_CTX_set_{min,max}_proto_version(). When we introduced these methods in commit https://github.com/ruby/openssl/commit/18603949d316 [1], which went to v2.1.0, we added a private method to SSLContext that set both the minimum and maximum protocol versions at the same time. This was to allow emulating the behavior using SSL options on older OpenSSL versions that lack SSL_CTX_set_{min,max}_proto_version(). Since we no longer support OpenSSL 1.0.2, the related code has already been removed. In OpenSSL 1.1.1 or later, setting the minimum or maximum version to 0 is not equivalent to leaving it unset. Similar to SSL options, which we avoid overwriting as of commit https://github.com/ruby/openssl/commit/00bec0d905d5 and commit https://github.com/ruby/openssl/commit/77c3db2d6587 [2], a system-wide configuration file may define a default protocol version bounds. Setting the minimum version should not unset the maximum version, and vice versa. [1] https://github.com/ruby/openssl/pull/142 [2] https://github.com/ruby/openssl/pull/767 https://github.com/ruby/openssl/commit/5766386321
2025-01-23[ruby/openssl] pkey: change PKey::{RSA,DSA,DH}#params to use nil for missing ↵Kazuki Yamaguchi
parameters The returned Hash from these methods contain 0 in place of a missing parameter in the key, for example: pkey = OpenSSL::PKey.read(OpenSSL::PKey::RSA.new(2048).public_to_pem) pp pkey.params #=> # {"n"=>#<OpenSSL::BN https://github.com/ruby/openssl/commit/286934673421[...snip]>, # "e"=>#<OpenSSL::BN 65537>, # "d"=>#<OpenSSL::BN 0>, # "p"=>#<OpenSSL::BN 0>, # "q"=>#<OpenSSL::BN 0>, # "dmp1"=>#<OpenSSL::BN 0>, # "dmq1"=>#<OpenSSL::BN 0>, # "iqmp"=>#<OpenSSL::BN 0>} Let's use nil instead, which is more appropriate for indicating a missing value. https://github.com/ruby/openssl/commit/f247ec3dec
2025-01-23[ruby/openssl] pkey: implement PKey::{RSA,DSA,DH}#params in RubyKazuki Yamaguchi
Move the definitions to lib/openssl/pkey.rb. They need not to be in the extension and can be implemented using existing methods. This reduces direct usage of the now-deprecated OpenSSL APIs around the low-level structs such as DH, DSA, or RSA. https://github.com/ruby/openssl/commit/c14178f387
2025-01-20[ruby/openssl] Require OpenSSL 1.1.0 or laterKazuki Yamaguchi
Drop support for OpenSSL 1.0.2. It has reached upstream EOL in 2019-12. Most distributions that shipped with OpenSSL 1.0.2 have also reached EOL, or provide a newer version in the package repository: - RHEL 7 (EOL 2024-06) - Ubuntu 16.04 LTS (EOL 2021-04) - Amazon Linux 2 (EOL 2026-06, but OpenSSL 1.1.1 can be installed via the openssl11{,-devel} package) https://github.com/ruby/openssl/commit/38ec6fd50e
2025-01-14[ruby/openssl] Refactor buffer usage to only use `append_as_bytes`Jean Boussier
https://github.com/ruby/openssl/commit/28f2901c48
2025-01-14[ruby/openssl] Reduce OpenSSL::Buffering#do_write overheadJean Boussier
[Bug #20972] The `rb_str_new_freeze` was added in https://github.com/ruby/openssl/issues/452 to better handle concurrent use of a Socket, but SSL sockets can't be used concurrently AFAIK, so we might as well just error cleanly. By using `rb_str_locktmp` we can ensure attempts at concurrent write will raise an error, be we avoid causing a copy of the bytes. We also use the newer `String#append_as_bytes` method when available to save on some more copies. https://github.com/ruby/openssl/commit/0d8c17aa85 Co-Authored-By: [email protected]
2024-12-22[ruby/openssl] Ruby/OpenSSL 3.3.0Kazuki Yamaguchi
https://github.com/ruby/openssl/commit/e5153dbbb4 Notes: Merged: https://github.com/ruby/ruby/pull/12421
2024-12-07[ruby/openssl] ssl: do not clear existing SSL options in SSLContext#set_paramsKazuki Yamaguchi
Apply SSL options set in DEFAULT_PARAMS without clearing existing options. It currently clears options in order to avoid setting one of the options included in OpenSSL::SSL::OP_ALL unless explicitly specified, namely OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS. Now that OpenSSL::SSL::OP_ALL has been removed from SSLContext#initialize, it is no longer necessary. https://github.com/ruby/openssl/commit/77c3db2d65
2024-12-07[ruby/openssl] ssl: do not enable OpenSSL::SSL::OP_ALL by defaultKazuki Yamaguchi
Respect the SSL options set by default by SSL_CTX() and by the system-wide OpenSSL configuration file. OpenSSL::SSL::SSLContext#initialize currently adds OpenSSL::SSL::OP_ALL on top of the default SSL options. Let's stop doing it. OpenSSL::SSL::OP_ALL is a set of options that changes OpenSSL's behavior to workaround various TLS implementation bugs. Using it is considered usually safe, but is not completely harmless. https://github.com/ruby/openssl/commit/00bec0d905
2024-11-14[ruby/openssl] x509: fix handling of multiple URIs in Certificate#crl_urisKazuki Yamaguchi
The implementation of OpenSSL::X509::Certificate#crl_uris makes the assumption that each DistributionPoint in the CRL distribution points extension contains a single general name of type URI. This is not guaranteed by RFC 5280. A DistributionPoint may contain zero or more than one URIs. Let's include all URIs found in the extension. If only non-URI pointers are found, return nil. Fixes: https://github.com/ruby/openssl/issues/775 https://github.com/ruby/openssl/commit/71f4fef2fa
2024-07-03[ruby/openssl] Add SSLSocket#readbyteGrant Gardner
Companion to getbyte but raise EOFError Similar to https://github.com/ruby/openssl/pull/438 https://github.com/ruby/openssl/commit/c40f70711a
2024-06-27[ruby/openssl] rewriting most of the asn1 init code in rubyHoneyryderChuck
to have as much of the lib in ruby as possible https://github.com/ruby/openssl/commit/8305051728
2024-06-08[ruby/openssl] Fix references to the license textKazuki Yamaguchi
Update the references to the file "LICENCE" with "COPYING". The file LICENCE doesn't exist in ruby/ruby nor ruby/openssl. This has been always the case since OpenSSL for Ruby 2 was merged to the ruby tree as a standard library in 2003. In OpenSSL for Ruby 2's CVS repository[1], the LICENCE file contained an old version of the Ruby License, identical to the COPYING file that was in Ruby's tree at that time (r4128[2]). [1] http://cvs.savannah.gnu.org/viewvc/rubypki/ossl2/LICENCE?revision=1.1.1.1&view=markup [2] https://github.com/ruby/ruby/blob/231247c010acba191b78ed2d1310c935e63ad919/COPYING https://github.com/ruby/openssl/commit/5bccf07d04
2024-05-02[ruby/openssl] Fix performance regression in do_write(s)Jaymz Julian
This causes significant performance issues when using large (>10meg) writes Fix by adjusting the buffer write function to clear the buffer once, rather than piece by piece, avoiding a case where a large write (in our case, around 70mbytes) will consume 100% of CPU. This takes a webrick GET request via SSL from around 200kbyts/sec and consuming 100% of a core, to line speed on gigabit ethernet and 6% cpu utlization. https://github.com/ruby/openssl/commit/d4389b425d
2024-04-30[ruby/openssl] Further clarification of documentation.Samuel Williams
https://github.com/ruby/openssl/commit/0697f2f8b4
2024-04-30[ruby/openssl] More documentation.Samuel Williams
https://github.com/ruby/openssl/commit/c8377eaf8d
2024-04-30[ruby/openssl] Introduce basic support for `close_read` and `close_write`.Samuel Williams
https://github.com/ruby/openssl/commit/c99d24cee9
2024-01-17[ruby/openssl] Add support for IO#timeout.Samuel Williams
(https://github.com/ruby/openssl/pull/714) * Add support for IO#timeout. https://github.com/ruby/openssl/commit/3bbf5178a9
2024-01-17[ruby/openssl] Only set min_version on OpenSSL < 1.1.0Ewoud Kohl van Wijngaarden
Both Red Hat and Debian-like systems configure the minimum TLS version to be 1.2 by default, but allow users to change this via configs. On Red Hat and derivatives this happens via crypto-policies[1], which in writes settings in /etc/crypto-policies/back-ends/opensslcnf.config. Most notably, it sets TLS.MinProtocol there. For Debian there's MinProtocol in /etc/ssl/openssl.cnf. Both default to TLSv1.2, which is considered a secure default. In constrast, the SSLContext has a hard coded OpenSSL::SSL::TLS1_VERSION for min_version. TLS 1.0 and 1.1 are considered insecure. By always setting this in the default parameters, the system wide default can't be respected, even if a developer wants to. This takes the approach that's also done for ciphers: it's only set for OpenSSL < 1.1.0. [1]: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening https://github.com/ruby/openssl/commit/ae215a47ae
2024-01-13[ruby/openssl] Add support for `gets(chomp: true)`.Samuel Williams
https://github.com/ruby/openssl/commit/8aa3849cff
2024-01-13[ruby/openssl] Add more methods to `SocketForwarder`.Samuel Williams
https://github.com/ruby/openssl/commit/39eaa9f677
2023-09-21[ruby/openssl] Ruby/OpenSSL 3.2.0Kazuki Yamaguchi
https://github.com/ruby/openssl/commit/6b3dd6a372
2023-09-06[ruby/openssl] Prefer String#unpack1Mau Magnaguagno
(https://github.com/ruby/openssl/pull/586) String#unpack1 avoids the intermediate array created by String#unpack for single elements, while also making a call to Array#first/[0] unnecessary. https://github.com/ruby/openssl/commit/8eb0715a42
2023-09-06[ruby/openssl] ssl: use ffdhe2048 from RFC 7919 as the default DH group ↵Kazuki Yamaguchi
parameters In TLS 1.2 or before, if DH group parameters for DHE are not supplied with SSLContext#tmp_dh= or #tmp_dh_callback=, we currently use the self-generated parameters added in commit https://github.com/ruby/openssl/commit/bb3399a61c03 ("support 2048 bit length DH-key", 2016-01-15) as the fallback. While there is no known weakness in the current parameters, it would be a good idea to switch to pre-defined, more well audited parameters. This also allows the fallback to work in the FIPS mode. The PEM encoding was derived with: # RFC 7919 Appendix A.1. ffdhe2048 print OpenSSL::PKey.read(OpenSSL::ASN1::Sequence([OpenSSL::ASN1::Integer((<<-END).split.join.to_i(16)), OpenSSL::ASN1::Integer(2)]).to_der).to_pem FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1 D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9 7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561 2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935 984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735 30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19 0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61 9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73 3BB5FCBC 2EC22005 C58EF183 7D1683B2 C6F34A26 C1B2EFFA 886B4238 61285C97 FFFFFFFF FFFFFFFF END https://github.com/ruby/openssl/commit/a5527cb4f4
2023-09-06[ruby/openssl] Refactor Buffering consume_rbuff and getbyte methodsMau Magnaguagno
Prefer ``slice!`` for ``Buffering#consume_rbuff`` and safe navigation with ``ord`` for ``Buffering#getbyte``, similar to ``each_byte``. https://github.com/ruby/openssl/commit/5f6abff178
2023-01-31[ruby/openssl] [DOC] Remove repeated example from DigestMau Magnaguagno
https://github.com/ruby/openssl/commit/5a36cc3cb2
2022-12-23[ruby/openssl] Ruby/OpenSSL 3.1.0Kazuki Yamaguchi
https://github.com/ruby/openssl/commit/c2f7d775c6
2022-12-23[ruby/openssl] Undefine `OpenSSL::SSL` for no socket platformsYuta Saito
This fixes a linkage error about `ossl_ssl_type` on platforms which do not have socket, like WASI. Even before this patch, some items are disabled under `OPENSSL_NO_SOCK` since https://github.com/ruby/ruby/commit/ee22fad45d394818690c4a7586d7bb576ba67c56 However, due to some new use of OpenSSL::SSL::Socket over the past few years, the build under `OPENSSL_NO_SOCK` had been broken. This patch guards whole `OpenSSL::SSL` items by `OPENSSL_NO_SOCK`. [ky: adjusted to apply on top of my previous commit that removed the OpenSSL::ExtConfig, and added a guard to lib/openssl/ssl.rb.] https://github.com/ruby/openssl/commit/b0cfac6a96
2022-10-17[ruby/openssl] Call out insecure PKCS #1 v1.5 default padding for RSABart de Water
https://github.com/ruby/openssl/commit/fd5eaa6dfc
2022-10-17[ruby/openssl] bump version number to 3.1.0.preKazuki Yamaguchi
https://github.com/ruby/openssl/commit/fceb978a5d
2022-10-17[ruby/openssl] Ruby/OpenSSL 3.0.1Kazuki Yamaguchi
https://github.com/ruby/openssl/commit/e5bbd015dc
2022-10-17[ruby/openssl] pkey/dsa: let PKey::DSA.generate choose appropriate q sizeKazuki Yamaguchi
DSA parameters generation via EVP_PKEY_paramgen() will not automatically adjust the size of q value but uses 224 bits by default unless specified explicitly. This behavior is different from the now-deprecated DSA_generate_parameters_ex(), which PKey::DSA.generate used to call. Fixes https://github.com/ruby/openssl/issues/483 Fixes: https://github.com/ruby/openssl/commit/1800a8d5ebaf ("pkey/dsa: use high level EVP interface to generate parameters and keys", 2020-05-17) https://github.com/ruby/openssl/commit/0105975a0b
2021-12-25[ruby/openssl] Ruby/OpenSSL 3.0.0Kazuki Yamaguchi
https://github.com/ruby/openssl/commit/bff4080091
2021-12-20[ruby/openssl] pkey/dh: deprecate OpenSSL::PKey::DH#generate_key!Kazuki Yamaguchi
OpenSSL::PKey::DH#generate_key! will not work on OpenSSL 3.0 because keys are made immutable. Users should use OpenSSL::PKey.generate_key instead. https://github.com/ruby/openssl/commit/8ee6a582c7
2021-12-20[ruby/openssl] pkey/ec: avoid using EC#public_key= in EC#dh_compute_keyKazuki Yamaguchi
Similarly to DH#compute_key, work around it by constructing a SubjectPublicKeyInfo. This should be considered as a temporary implementation. https://github.com/ruby/openssl/commit/fc9aabc18d
2021-12-20[ruby/openssl] pkey/dh: avoid using DH#set_key in DH#compute_keyKazuki Yamaguchi
DH#set_key will not work on OpenSSL 3.0 because keys are immutable. For now, let's reimplement DH#compute_key by manually constructing a DER-encoded SubjectPublicKeyInfo structure and feeding it to OpenSSL::PKey.read. Eventually, we should implement a new method around EVP_PKEY_fromdata() and use it instead. https://github.com/ruby/openssl/commit/46ca47060c
2021-11-01[ruby/openssl] x509name: improve docs for X509::NameKazuki Yamaguchi
Add docs for X509::Name.parse_openssl and X509::Name.parse_rfc2253, which are currently undocumented despite being widely used. Small changes are also made to #to_s and the class description to recommend using RFC 2253-based methods. Fixes: https://github.com/ruby/openssl/issues/470 https://github.com/ruby/openssl/commit/74041a35d4
2021-10-16[ruby/openssl] require Ruby 2.6 or laterKazuki Yamaguchi
Drop support for Ruby 2.3, 2.4, and 2.5. As of 2021-10, Ruby 2.6 is the oldest version that still receives security fixes from the Ruby core team, so it doesn't make much sense to keep code for those ancient versions. https://github.com/ruby/openssl/commit/3436bd040d
2021-10-16[ruby/openssl] bump version number to 3.0.0.preKazuki Yamaguchi
https://github.com/ruby/openssl/commit/baa83a8a57
2021-10-16[ruby/openssl] Ruby/OpenSSL 2.2.1Kazuki Yamaguchi
https://github.com/ruby/openssl/commit/65e7207a07
2021-10-16[ruby/openssl] ssl: add SSLContext#tmp_dh=Kazuki Yamaguchi
Provide a wrapper of SSL_set0_tmp_dh_pkey()/SSL_CTX_set_tmp_dh(), which sets the DH parameters used for ephemeral DH key exchange. SSLContext#tmp_dh_callback= already exists for this purpose, as a wrapper around SSL_CTX_set_tmp_dh_callback(), but it is considered obsolete and the OpenSSL API is deprecated for future removal. There is no practical use case where an application needs to use different DH parameters nowadays. This was originally introduced to support export grade ciphers. RDoc for #tmp_dh_callback= is updated to recommend the new #tmp_dh=. Note that current versions of OpenSSL support automatic ECDHE curve selection which is enabled by default. SSLContext#tmp_dh= should only be necessary if you must allow ancient clients which don't support ECDHE. https://github.com/ruby/openssl/commit/aa43da4f04
2021-10-16[ruby/openssl] ssl: remove private method SSLSocket#tmp_ecdh_callbackKazuki Yamaguchi
Commit ee037e146037 ("ssl: remove SSL::SSLContext#tmp_ecdh_callback", 2020-08-12) forgot to remove the method. https://github.com/ruby/openssl/commit/bef9ea84e4
2021-07-18[ruby/openssl] Strip trailing spacesKazuki Yamaguchi
https://github.com/ruby/openssl/commit/68fa9c86f1
2021-07-18[ruby/openssl] pkey/dsa: refactor DSA#sys{sign,verify} with ↵Kazuki Yamaguchi
PKey#{sign,verify}_raw With the newly added OpenSSL::PKey::PKey#{sign,verify}_raw, OpenSSL::PKey::DSA's low level signing operation methods can be implemented in Ruby. The definitions are now in lib/openssl/pkey.rb. https://github.com/ruby/openssl/commit/ce805adf0c
2021-07-18[ruby/openssl] pkey/ec: refactor EC#dsa_{sign,verify}_asn1 with ↵Kazuki Yamaguchi
PKey#{sign,verify}_raw With the newly added OpenSSL::PKey::PKey#{sign,verify}_raw, OpenSSL::PKey::EC's low level signing operation methods can be implemented in Ruby. The definitions are now in lib/openssl/pkey.rb. https://github.com/ruby/openssl/commit/1f9da0cd9d
2021-07-18[ruby/openssl] pkey/rsa: port RSA#{private,public}_{encrypt,decrypt} to the ↵Kazuki Yamaguchi
EVP API Implement these methods using the new OpenSSL::PKey::PKey#{encrypt,sign} family. The definitions are now in lib/openssl/pkey.rb. Also, recommend using those generic methods in the documentation. https://github.com/ruby/openssl/commit/2dfc1779d3
2021-07-18[ruby/openssl] Implement `Certificate.load` to load certificate chain. ↵Samuel Williams
(https://github.com/ruby/openssl/pull/441) * Add feature for loading the chained certificate into Certificate array. https://github.com/ruby/openssl/commit/05e1c015d6 Co-authored-by: Sao I Kuan <[email protected]>
2021-07-18[ruby/openssl] Add SSLSocket#getbyteAaron Patterson
Normal sockets respond to `getbyte`, so we should make SSLSocket respond to `getbyte` as well. This way we can substitute SSLSockets for regular sockets. https://github.com/ruby/openssl/commit/ac1490b7c9
2021-07-18[ruby/openssl] pkey: implement {DH,DSA,RSA}#public_key in RubyKazuki Yamaguchi
The low-level API that is used to implement #public_key is deprecated in OpenSSL 3.0. It is actually very simple to implement in another way, using existing methods only, in much shorter code. Let's do it. While we are at it, the documentation is updated to recommend against using #public_key. Now that OpenSSL::PKey::PKey implements public_to_der method, there is no real use case for #public_key in newly written Ruby programs. https://github.com/ruby/openssl/commit/48a6c391ef
2021-07-18[ruby/openssl] pkey/dsa: use high level EVP interface to generate parameters ↵Kazuki Yamaguchi
and keys Implement PKey::DSA.new(size) and PKey::DSA.generate using OpenSSL::PKey.generate_parameters and .generate_key instead of the low level DSA functions. https://github.com/ruby/openssl/commit/1800a8d5eb
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-19 21:35:50 +0000