Skip to content

Commit ed15e4c

Browse files
rheniumrhenium
committed
Merge branch 'maint'
* maint: History.md: fix a typo x509cert, x509crl, x509req, ns_spki: check sanity of public key pkey: make pkey_check_public_key() non-static test/test_cipher: fix test_non_aead_cipher_set_auth_data failure cipher: disallow setting AAD for non-AEAD ciphers test/test_ssl_session: skip tests for session_remove_cb appveyor.yml: remove 'openssl version' line
2 parents 4e53940 + f3b596e commit ed15e4c

File tree

12 files changed

+92
-48
lines changed

12 files changed

+92
-48
lines changed

‎History.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ Notable changes
201201
- A new option 'verify_hostname' is added to OpenSSL::SSL::SSLContext. When it
202202
is enabled, and the SNI hostname is also set, the hostname verification on
203203
the server certificate is automatically performed. It is now enabled by
204-
OpenSSL::SSL::Context#set_params.
204+
OpenSSL::SSL::SSLContext#set_params.
205205
[[GH ruby/openssl#60]](https://github.com/ruby/openssl/pull/60)
206206

207207
Removals

‎appveyor.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ install:
1414
$Env:openssl_dir = "C:\msys64\mingw64"
1515
}
1616
- ruby -v
17-
- openssl version
1817
- rake install_dependencies
1918
build_script:
2019
- rake -rdevkit compile -- --with-openssl-dir=%openssl_dir% --enable-debug

‎ext/openssl/ossl_cipher.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -569,6 +569,8 @@ ossl_cipher_set_auth_data(VALUE self, VALUE data)
569569
in_len = RSTRING_LEN(data);
570570

571571
GetCipher(self, ctx);
572+
if (!(EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx)) & EVP_CIPH_FLAG_AEAD_CIPHER))
573+
ossl_raise(eCipherError, "AEAD not supported by this cipher");
572574

573575
if (!ossl_cipher_update_long(ctx, NULL, &out_len, in, in_len))
574576
ossl_raise(eCipherError, "couldn't set additional authenticated data");

‎ext/openssl/ossl_ns_spki.c‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -208,12 +208,13 @@ static VALUE
208208
ossl_spki_set_public_key(VALUE self, VALUE key)
209209
{
210210
NETSCAPE_SPKI *spki;
211+
EVP_PKEY *pkey;
211212

212213
GetSPKI(self, spki);
213-
if (!NETSCAPE_SPKI_set_pubkey(spki, GetPKeyPtr(key))) { /* NO NEED TO DUP */
214-
ossl_raise(eSPKIError, NULL);
215-
}
216-
214+
pkey = GetPKeyPtr(key);
215+
ossl_pkey_check_public_key(pkey);
216+
if (!NETSCAPE_SPKI_set_pubkey(spki, pkey))
217+
ossl_raise(eSPKIError, "NETSCAPE_SPKI_set_pubkey");
217218
return key;
218219
}
219220

@@ -307,17 +308,20 @@ static VALUE
307308
ossl_spki_verify(VALUE self, VALUE key)
308309
{
309310
NETSCAPE_SPKI *spki;
311+
EVP_PKEY *pkey;
310312

311313
GetSPKI(self, spki);
312-
switch (NETSCAPE_SPKI_verify(spki, GetPKeyPtr(key))) { /* NO NEED TO DUP */
313-
case 0:
314+
pkey = GetPKeyPtr(key);
315+
ossl_pkey_check_public_key(pkey);
316+
switch (NETSCAPE_SPKI_verify(spki, pkey)) {
317+
case 0:
318+
ossl_clear_error();
314319
return Qfalse;
315-
case 1:
320+
case 1:
316321
return Qtrue;
317-
default:
318-
ossl_raise(eSPKIError, NULL);
322+
default:
323+
ossl_raise(eSPKIError, "NETSCAPE_SPKI_verify");
319324
}
320-
return Qnil; /* dummy */
321325
}
322326

323327
/* Document-class: OpenSSL::Netscape::SPKI

‎ext/openssl/ossl_pkey.c‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -163,16 +163,17 @@ ossl_pkey_new_from_data(int argc, VALUE *argv, VALUE self)
163163
return ossl_pkey_new(pkey);
164164
}
165165

166-
static void
167-
pkey_check_public_key(EVP_PKEY *pkey)
166+
void
167+
ossl_pkey_check_public_key(const EVP_PKEY *pkey)
168168
{
169169
void *ptr;
170170
const BIGNUM *n, *e, *pubkey;
171171

172172
if (EVP_PKEY_missing_parameters(pkey))
173173
ossl_raise(ePKeyError, "parameters missing");
174174

175-
ptr = EVP_PKEY_get0(pkey);
175+
/* OpenSSL < 1.1.0 takes non-const pointer */
176+
ptr = EVP_PKEY_get0((EVP_PKEY *)pkey);
176177
switch (EVP_PKEY_base_id(pkey)) {
177178
case EVP_PKEY_RSA:
178179
RSA_get0_key(ptr, &n, &e, NULL);
@@ -352,7 +353,7 @@ ossl_pkey_verify(VALUE self, VALUE digest, VALUE sig, VALUE data)
352353
int siglen, result;
353354

354355
GetPKey(self, pkey);
355-
pkey_check_public_key(pkey);
356+
ossl_pkey_check_public_key(pkey);
356357
md = ossl_evp_get_digestbyname(digest);
357358
StringValue(sig);
358359
siglen = RSTRING_LENINT(sig);

‎ext/openssl/ossl_pkey.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ int ossl_generate_cb_2(int p, int n, BN_GENCB *cb);
4444
void ossl_generate_cb_stop(void *ptr);
4545

4646
VALUE ossl_pkey_new(EVP_PKEY *);
47+
void ossl_pkey_check_public_key(const EVP_PKEY *);
4748
EVP_PKEY *GetPKeyPtr(VALUE);
4849
EVP_PKEY *DupPKeyPtr(VALUE);
4950
EVP_PKEY *GetPrivPKeyPtr(VALUE);

‎ext/openssl/ossl_ssl.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2595,6 +2595,10 @@ Init_ossl_ssl(void)
25952595
* A callback invoked when a session is removed from the internal cache.
25962596
*
25972597
* The callback is invoked with an SSLContext and a Session.
2598+
*
2599+
* IMPORTANT NOTE: It is currently not possible to use this safely in a
2600+
* multi-threaded application. The callback is called inside a global lock
2601+
* and it can randomly cause deadlock on Ruby thread switching.
25982602
*/
25992603
rb_attr(cSSLContext, rb_intern("session_remove_cb"), 1, 1, Qfalse);
26002604

‎ext/openssl/ossl_x509cert.c‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -508,18 +508,19 @@ ossl_x509_get_public_key(VALUE self)
508508

509509
/*
510510
* call-seq:
511-
* cert.public_key = key => key
511+
* cert.public_key = key
512512
*/
513513
static VALUE
514514
ossl_x509_set_public_key(VALUE self, VALUE key)
515515
{
516516
X509 *x509;
517+
EVP_PKEY *pkey;
517518

518519
GetX509(self, x509);
519-
if (!X509_set_pubkey(x509, GetPKeyPtr(key))) { /* DUPs pkey */
520-
ossl_raise(eX509CertError, NULL);
521-
}
522-
520+
pkey = GetPKeyPtr(key);
521+
ossl_pkey_check_public_key(pkey);
522+
if (!X509_set_pubkey(x509, pkey))
523+
ossl_raise(eX509CertError, "X509_set_pubkey");
523524
return key;
524525
}
525526

@@ -557,9 +558,9 @@ ossl_x509_verify(VALUE self, VALUE key)
557558
X509 *x509;
558559
EVP_PKEY *pkey;
559560

560-
pkey = GetPKeyPtr(key); /* NO NEED TO DUP */
561561
GetX509(self, x509);
562-
562+
pkey = GetPKeyPtr(key);
563+
ossl_pkey_check_public_key(pkey);
563564
switch (X509_verify(x509, pkey)) {
564565
case 1:
565566
return Qtrue;

‎ext/openssl/ossl_x509crl.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -359,9 +359,12 @@ static VALUE
359359
ossl_x509crl_verify(VALUE self, VALUE key)
360360
{
361361
X509_CRL *crl;
362+
EVP_PKEY *pkey;
362363

363364
GetX509CRL(self, crl);
364-
switch (X509_CRL_verify(crl, GetPKeyPtr(key))) {
365+
pkey = GetPKeyPtr(key);
366+
ossl_pkey_check_public_key(pkey);
367+
switch (X509_CRL_verify(crl, pkey)) {
365368
case 1:
366369
return Qtrue;
367370
case 0:

‎ext/openssl/ossl_x509req.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -293,11 +293,10 @@ ossl_x509req_set_public_key(VALUE self, VALUE key)
293293
EVP_PKEY *pkey;
294294

295295
GetX509Req(self, req);
296-
pkey = GetPKeyPtr(key); /* NO NEED TO DUP */
297-
if (!X509_REQ_set_pubkey(req, pkey)) {
298-
ossl_raise(eX509ReqError, NULL);
299-
}
300-
296+
pkey = GetPKeyPtr(key);
297+
ossl_pkey_check_public_key(pkey);
298+
if (!X509_REQ_set_pubkey(req, pkey))
299+
ossl_raise(eX509ReqError, "X509_REQ_set_pubkey");
301300
return key;
302301
}
303302

@@ -328,7 +327,8 @@ ossl_x509req_verify(VALUE self, VALUE key)
328327
EVP_PKEY *pkey;
329328

330329
GetX509Req(self, req);
331-
pkey = GetPKeyPtr(key); /* NO NEED TO DUP */
330+
pkey = GetPKeyPtr(key);
331+
ossl_pkey_check_public_key(pkey);
332332
switch (X509_REQ_verify(req, pkey)) {
333333
case 1:
334334
return Qtrue;

0 commit comments

Comments
 (0)