Skip to content

Commit ec65428

Browse files
rheniumrhenium
committed
Merge branch 'maint-2.0' into maint
* maint-2.0: ssl: set verify error code in the case of verify_hostname failure x509: add error code and verify flags constants Remove taint support Restore compatibility with older versions of Ruby. Fix keyword argument separation issues in OpenSSL::SSL::SSLSocket#sys{read,write}_nonblock config: support .include directive
2 parents 08e12dd + 035a04e commit ec65428

File tree

7 files changed

+262
-42
lines changed

7 files changed

+262
-42
lines changed

‎ext/openssl/ossl_rand.c‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,6 @@ ossl_rand_add(VALUE self, VALUE str, VALUE entropy)
6767
static VALUE
6868
ossl_rand_load_file(VALUE self, VALUE filename)
6969
{
70-
rb_check_safe_obj(filename);
71-
7270
if(!RAND_load_file(StringValueCStr(filename), -1)) {
7371
ossl_raise(eRandomError, NULL);
7472
}
@@ -86,8 +84,6 @@ ossl_rand_load_file(VALUE self, VALUE filename)
8684
static VALUE
8785
ossl_rand_write_file(VALUE self, VALUE filename)
8886
{
89-
rb_check_safe_obj(filename);
90-
9187
if (RAND_write_file(StringValueCStr(filename)) == -1) {
9288
ossl_raise(eRandomError, NULL);
9389
}
@@ -164,8 +160,6 @@ ossl_rand_pseudo_bytes(VALUE self, VALUE len)
164160
static VALUE
165161
ossl_rand_egd(VALUE self, VALUE filename)
166162
{
167-
rb_check_safe_obj(filename);
168-
169163
if (RAND_egd(StringValueCStr(filename)) == -1) {
170164
ossl_raise(eRandomError, NULL);
171165
}
@@ -186,8 +180,6 @@ ossl_rand_egd_bytes(VALUE self, VALUE filename, VALUE len)
186180
{
187181
int n = NUM2INT(len);
188182

189-
rb_check_safe_obj(filename);
190-
191183
if (RAND_egd_bytes(StringValueCStr(filename), n) == -1) {
192184
ossl_raise(eRandomError, NULL);
193185
}

‎ext/openssl/ossl_ssl.c‎

Lines changed: 41 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -357,7 +357,14 @@ ossl_ssl_verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
357357
rb_ivar_set(ssl_obj, ID_callback_state, INT2NUM(status));
358358
return 0;
359359
}
360-
preverify_ok = ret == Qtrue;
360+
if (ret != Qtrue) {
361+
preverify_ok = 0;
362+
#if defined(X509_V_ERR_HOSTNAME_MISMATCH)
363+
X509_STORE_CTX_set_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH);
364+
#else
365+
X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REJECTED);
366+
#endif
367+
}
361368
}
362369

363370
return ossl_verify_cb_call(cb, preverify_ok, ctx);
@@ -1826,7 +1833,6 @@ ossl_ssl_read_internal(int argc, VALUE *argv, VALUE self, int nonblock)
18261833
else
18271834
rb_str_modify_expand(str, ilen - RSTRING_LEN(str));
18281835
}
1829-
OBJ_TAINT(str);
18301836
rb_str_set_len(str, 0);
18311837
if (ilen == 0)
18321838
return str;
@@ -1875,13 +1881,24 @@ ossl_ssl_read_internal(int argc, VALUE *argv, VALUE self, int nonblock)
18751881
}
18761882
}
18771883
else {
1878-
ID meth = nonblock ? rb_intern("read_nonblock") : rb_intern("sysread");
1879-
1880-
rb_warning("SSL session is not started yet.");
1881-
if (nonblock)
1882-
return rb_funcall(io, meth, 3, len, str, opts);
1883-
else
1884-
return rb_funcall(io, meth, 2, len, str);
1884+
ID meth = nonblock ? rb_intern("read_nonblock") : rb_intern("sysread");
1885+
1886+
rb_warning("SSL session is not started yet.");
1887+
#if defined(RB_PASS_KEYWORDS)
1888+
if (nonblock) {
1889+
VALUE argv[3];
1890+
argv[0] = len;
1891+
argv[1] = str;
1892+
argv[2] = opts;
1893+
return rb_funcallv_kw(io, meth, 3, argv, RB_PASS_KEYWORDS);
1894+
}
1895+
#else
1896+
if (nonblock) {
1897+
return rb_funcall(io, meth, 3, len, str, opts);
1898+
}
1899+
#endif
1900+
else
1901+
return rb_funcall(io, meth, 2, len, str);
18851902
}
18861903

18871904
end:
@@ -1968,11 +1985,21 @@ ossl_ssl_write_internal(VALUE self, VALUE str, VALUE opts)
19681985
ID meth = nonblock ?
19691986
rb_intern("write_nonblock") : rb_intern("syswrite");
19701987

1971-
rb_warning("SSL session is not started yet.");
1972-
if (nonblock)
1973-
return rb_funcall(io, meth, 2, str, opts);
1974-
else
1975-
return rb_funcall(io, meth, 1, str);
1988+
rb_warning("SSL session is not started yet.");
1989+
#if defined(RB_PASS_KEYWORDS)
1990+
if (nonblock) {
1991+
VALUE argv[2];
1992+
argv[0] = str;
1993+
argv[1] = opts;
1994+
return rb_funcallv_kw(io, meth, 2, argv, RB_PASS_KEYWORDS);
1995+
}
1996+
#else
1997+
if (nonblock) {
1998+
return rb_funcall(io, meth, 2, str, opts);
1999+
}
2000+
#endif
2001+
else
2002+
return rb_funcall(io, meth, 1, str);
19762003
}
19772004

19782005
end:

‎ext/openssl/ossl_x509.c‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,13 @@ Init_ossl_x509(void)
4444
Init_ossl_x509revoked();
4545
Init_ossl_x509store();
4646

47+
/* Constants are up-to-date with 1.1.1. */
48+
49+
/* Certificate verification error code */
4750
DefX509Const(V_OK);
51+
#if defined(X509_V_ERR_UNSPECIFIED) /* 1.0.1r, 1.0.2f, 1.1.0 */
52+
DefX509Const(V_ERR_UNSPECIFIED);
53+
#endif
4854
DefX509Const(V_ERR_UNABLE_TO_GET_ISSUER_CERT);
4955
DefX509Const(V_ERR_UNABLE_TO_GET_CRL);
5056
DefX509Const(V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE);
@@ -76,8 +82,73 @@ Init_ossl_x509(void)
7682
DefX509Const(V_ERR_AKID_SKID_MISMATCH);
7783
DefX509Const(V_ERR_AKID_ISSUER_SERIAL_MISMATCH);
7884
DefX509Const(V_ERR_KEYUSAGE_NO_CERTSIGN);
85+
DefX509Const(V_ERR_UNABLE_TO_GET_CRL_ISSUER);
86+
DefX509Const(V_ERR_UNHANDLED_CRITICAL_EXTENSION);
87+
DefX509Const(V_ERR_KEYUSAGE_NO_CRL_SIGN);
88+
DefX509Const(V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION);
89+
DefX509Const(V_ERR_INVALID_NON_CA);
90+
DefX509Const(V_ERR_PROXY_PATH_LENGTH_EXCEEDED);
91+
DefX509Const(V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE);
92+
DefX509Const(V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED);
93+
DefX509Const(V_ERR_INVALID_EXTENSION);
94+
DefX509Const(V_ERR_INVALID_POLICY_EXTENSION);
95+
DefX509Const(V_ERR_NO_EXPLICIT_POLICY);
96+
DefX509Const(V_ERR_DIFFERENT_CRL_SCOPE);
97+
DefX509Const(V_ERR_UNSUPPORTED_EXTENSION_FEATURE);
98+
DefX509Const(V_ERR_UNNESTED_RESOURCE);
99+
DefX509Const(V_ERR_PERMITTED_VIOLATION);
100+
DefX509Const(V_ERR_EXCLUDED_VIOLATION);
101+
DefX509Const(V_ERR_SUBTREE_MINMAX);
79102
DefX509Const(V_ERR_APPLICATION_VERIFICATION);
103+
DefX509Const(V_ERR_UNSUPPORTED_CONSTRAINT_TYPE);
104+
DefX509Const(V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX);
105+
DefX509Const(V_ERR_UNSUPPORTED_NAME_SYNTAX);
106+
DefX509Const(V_ERR_CRL_PATH_VALIDATION_ERROR);
107+
#if defined(X509_V_ERR_PATH_LOOP)
108+
DefX509Const(V_ERR_PATH_LOOP);
109+
#endif
110+
#if defined(X509_V_ERR_SUITE_B_INVALID_VERSION)
111+
DefX509Const(V_ERR_SUITE_B_INVALID_VERSION);
112+
DefX509Const(V_ERR_SUITE_B_INVALID_ALGORITHM);
113+
DefX509Const(V_ERR_SUITE_B_INVALID_CURVE);
114+
DefX509Const(V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM);
115+
DefX509Const(V_ERR_SUITE_B_LOS_NOT_ALLOWED);
116+
DefX509Const(V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256);
117+
#endif
118+
#if defined(X509_V_ERR_HOSTNAME_MISMATCH)
119+
DefX509Const(V_ERR_HOSTNAME_MISMATCH);
120+
DefX509Const(V_ERR_EMAIL_MISMATCH);
121+
DefX509Const(V_ERR_IP_ADDRESS_MISMATCH);
122+
#endif
123+
#if defined(X509_V_ERR_DANE_NO_MATCH)
124+
DefX509Const(V_ERR_DANE_NO_MATCH);
125+
#endif
126+
#if defined(X509_V_ERR_EE_KEY_TOO_SMALL)
127+
DefX509Const(V_ERR_EE_KEY_TOO_SMALL);
128+
DefX509Const(V_ERR_CA_KEY_TOO_SMALL);
129+
DefX509Const(V_ERR_CA_MD_TOO_WEAK);
130+
#endif
131+
#if defined(X509_V_ERR_INVALID_CALL)
132+
DefX509Const(V_ERR_INVALID_CALL);
133+
#endif
134+
#if defined(X509_V_ERR_STORE_LOOKUP)
135+
DefX509Const(V_ERR_STORE_LOOKUP);
136+
#endif
137+
#if defined(X509_V_ERR_NO_VALID_SCTS)
138+
DefX509Const(V_ERR_NO_VALID_SCTS);
139+
#endif
140+
#if defined(X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION)
141+
DefX509Const(V_ERR_PROXY_SUBJECT_NAME_VIOLATION);
142+
#endif
143+
#if defined(X509_V_ERR_OCSP_VERIFY_NEEDED)
144+
DefX509Const(V_ERR_OCSP_VERIFY_NEEDED);
145+
DefX509Const(V_ERR_OCSP_VERIFY_FAILED);
146+
DefX509Const(V_ERR_OCSP_CERT_UNKNOWN);
147+
#endif
80148

149+
/* Certificate verify flags */
150+
/* Set by Store#flags= and StoreContext#flags=. */
151+
DefX509Const(V_FLAG_USE_CHECK_TIME);
81152
/* Set by Store#flags= and StoreContext#flags=. Enables CRL checking for the
82153
* certificate chain leaf. */
83154
DefX509Const(V_FLAG_CRL_CHECK);
@@ -122,6 +193,26 @@ Init_ossl_x509(void)
122193
* Enabled by default in OpenSSL >= 1.1.0. */
123194
DefX509Const(V_FLAG_TRUSTED_FIRST);
124195
#endif
196+
#if defined(X509_V_FLAG_SUITEB_128_LOS_ONLY)
197+
/* Set by Store#flags= and StoreContext#flags=.
198+
* Enables Suite B 128 bit only mode. */
199+
DefX509Const(V_FLAG_SUITEB_128_LOS_ONLY);
200+
#endif
201+
#if defined(X509_V_FLAG_SUITEB_192_LOS)
202+
/* Set by Store#flags= and StoreContext#flags=.
203+
* Enables Suite B 192 bit only mode. */
204+
DefX509Const(V_FLAG_SUITEB_192_LOS);
205+
#endif
206+
#if defined(X509_V_FLAG_SUITEB_128_LOS)
207+
/* Set by Store#flags= and StoreContext#flags=.
208+
* Enables Suite B 128 bit mode allowing 192 bit algorithms. */
209+
DefX509Const(V_FLAG_SUITEB_128_LOS);
210+
#endif
211+
#if defined(X509_V_FLAG_PARTIAL_CHAIN)
212+
/* Set by Store#flags= and StoreContext#flags=.
213+
* Allows partial chains if at least one certificate is in trusted store. */
214+
DefX509Const(V_FLAG_PARTIAL_CHAIN);
215+
#endif
125216
#if defined(X509_V_FLAG_NO_ALT_CHAINS)
126217
/* Set by Store#flags= and StoreContext#flags=. Suppresses searching for
127218
* a alternative chain. No effect in OpenSSL >= 1.1.0. */

‎ext/openssl/ossl_x509store.c‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -304,7 +304,6 @@ ossl_x509store_add_file(VALUE self, VALUE file)
304304
char *path = NULL;
305305

306306
if(file != Qnil){
307-
rb_check_safe_obj(file);
308307
path = StringValueCStr(file);
309308
}
310309
GetX509Store(self, store);
@@ -340,7 +339,6 @@ ossl_x509store_add_path(VALUE self, VALUE dir)
340339
char *path = NULL;
341340

342341
if(dir != Qnil){
343-
rb_check_safe_obj(dir);
344342
path = StringValueCStr(dir);
345343
}
346344
GetX509Store(self, store);

‎lib/openssl/config.rb‎

Lines changed: 36 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -77,29 +77,44 @@ def get_key_string(data, section, key) # :nodoc:
7777
def parse_config_lines(io)
7878
section = 'default'
7979
data = {section => {}}
80-
while definition = get_definition(io)
80+
io_stack = [io]
81+
while definition = get_definition(io_stack)
8182
definition = clear_comments(definition)
8283
next if definition.empty?
83-
if definition[0] == ?[
84+
case definition
85+
when /\A\[/
8486
if /\[([^\]]*)\]/ =~ definition
8587
section = $1.strip
8688
data[section] ||= {}
8789
else
8890
raise ConfigError, "missing close square bracket"
8991
end
90-
else
91-
if /\A([^:\s]*)(?:::([^:\s]*))?\s*=(.*)\z/ =~ definition
92-
if $2
93-
section = $1
94-
key = $2
95-
else
96-
key = $1
92+
when /\A\.include (\s*=\s*)?(.+)\z/
93+
path = $2
94+
if File.directory?(path)
95+
files = Dir.glob(File.join(path, "*.{cnf,conf}"), File::FNM_EXTGLOB)
96+
else
97+
files = [path]
98+
end
99+
100+
files.each do |filename|
101+
begin
102+
io_stack << StringIO.new(File.read(filename))
103+
rescue
104+
raise ConfigError, "could not include file '%s'" % filename
97105
end
98-
value = unescape_value(data, section, $3)
99-
(data[section] ||= {})[key] = value.strip
106+
end
107+
when /\A([^:\s]*)(?:::([^:\s]*))?\s*=(.*)\z/
108+
if $2
109+
section = $1
110+
key = $2
100111
else
101-
raise ConfigError, "missing equal sign"
112+
key = $1
102113
end
114+
value = unescape_value(data, section, $3)
115+
(data[section] ||= {})[key] = value.strip
116+
else
117+
raise ConfigError, "missing equal sign"
103118
end
104119
end
105120
data
@@ -212,10 +227,10 @@ def clear_comments(line)
212227
scanned.join
213228
end
214229

215-
def get_definition(io)
216-
if line = get_line(io)
230+
def get_definition(io_stack)
231+
if line = get_line(io_stack)
217232
while /[^\\]\\\z/ =~ line
218-
if extra = get_line(io)
233+
if extra = get_line(io_stack)
219234
line += extra
220235
else
221236
break
@@ -225,9 +240,12 @@ def get_definition(io)
225240
end
226241
end
227242

228-
def get_line(io)
229-
if line = io.gets
230-
line.gsub(/[\r\n]*/, '')
243+
def get_line(io_stack)
244+
while io = io_stack.last
245+
if line = io.gets
246+
return line.gsub(/[\r\n]*/, '')
247+
end
248+
io_stack.pop
231249
end
232250
end
233251
end

0 commit comments

Comments
 (0)