openssl 2.0.9 → 2.1.0.beta1

data/ext/openssl/ossl_asn1.h

@@ -14,15 +14,11 @@
  * ASN1_DATE conversions
  */
 VALUE asn1time_to_time(const ASN1_TIME *);
-#if defined(HAVE_ASN1_TIME_ADJ)
 /* Splits VALUE to seconds and offset days. VALUE is typically a Time or an
  * Integer. This is used when updating ASN1_*TIME with ASN1_TIME_adj() or
  * X509_time_adj_ex(). We can't use ASN1_TIME_set() and X509_time_adj() because
  * they have the Year 2038 issue on sizeof(time_t) == 4 environment */
 void ossl_time_split(VALUE, time_t *, int *);
-#else
-time_t time_to_time_t(VALUE);
-#endif
 
 /*
  * ASN1_STRING conversions

data/ext/openssl/ossl_bio.c

@@ -26,32 +26,17 @@ ossl_obj2bio(volatile VALUE *pobj)
 }
 
 VALUE
-ossl_membio2str0(BIO *bio)
+ossl_membio2str(BIO *bio)
 {
     VALUE ret;
+    int state;
     BUF_MEM *buf;
 
     BIO_get_mem_ptr(bio, &buf);
-    ret = rb_str_new(buf->data, buf->length);
-
-    return ret;
-}
-
-VALUE
-ossl_protect_membio2str(BIO *bio, int *status)
-{
-    return rb_protect((VALUE (*)(VALUE))ossl_membio2str0, (VALUE)bio, status);
-}
-
-VALUE
-ossl_membio2str(BIO *bio)
-{
-    VALUE ret;
-    int status = 0;
-
-    ret = ossl_protect_membio2str(bio, &status);
+    ret = ossl_str_new(buf->data, buf->length, &state);
     BIO_free(bio);
-    if(status) rb_jump_tag(status);
+    if (state)
+	rb_jump_tag(state);
 
     return ret;
 }

data/ext/openssl/ossl_bio.h

@@ -11,8 +11,6 @@
 #define _OSSL_BIO_H_
 
 BIO *ossl_obj2bio(volatile VALUE *);
-VALUE ossl_membio2str0(BIO*);
 VALUE ossl_membio2str(BIO*);
-VALUE ossl_protect_membio2str(BIO*,int*);
 
 #endif

data/ext/openssl/ossl_bn.c

@@ -26,11 +26,6 @@
   } \
 } while (0)
 
-#define SafeGetBN(obj, bn) do { \
-  OSSL_Check_Kind((obj), cBN); \
-  GetBN((obj), (bn)); \
-} while (0)
-
 static void
 ossl_bn_free(void *ptr)
 {
@@ -176,8 +171,7 @@ ossl_bn_alloc(VALUE klass)
     return obj;
 }
 
-/* Document-method: OpenSSL::BN.new
- *
+/*
  * call-seq:
  *    OpenSSL::BN.new => aBN
  *    OpenSSL::BN.new(bn) => aBN
@@ -185,7 +179,7 @@ ossl_bn_alloc(VALUE klass)
  *    OpenSSL::BN.new(string) => aBN
  *    OpenSSL::BN.new(string, 0 | 2 | 10 | 16) => aBN
  *
- * Construct a new OpenSSL BigNum object.
+ * Construct a new OpenSSL BIGNUM object.
  */
 static VALUE
 ossl_bn_initialize(int argc, VALUE *argv, VALUE self)
@@ -250,7 +244,7 @@ ossl_bn_initialize(int argc, VALUE *argv, VALUE self)
  *    bn.to_s(base) => string
  *
  * === Parameters
- * * +base+ - integer
+ * * _base_ - Integer
  *   Valid values:
  *   * 0 - MPI
  *   * 2 - binary
@@ -377,6 +371,21 @@ BIGNUM_BOOL1(is_one)
  */
 BIGNUM_BOOL1(is_odd)
 
+/*
+ * call-seq:
+ *   bn.negative? => true | false
+ */
+static VALUE
+ossl_bn_is_negative(VALUE self)
+{
+    BIGNUM *bn;
+
+    GetBN(self, bn);
+    if (BN_is_zero(bn))
+	return Qfalse;
+    return BN_is_negative(bn) ? Qtrue : Qfalse;
+}
+
 #define BIGNUM_1c(func)					\
     static VALUE					\
     ossl_bn_##func(VALUE self)				\
@@ -498,7 +507,6 @@ BIGNUM_2c(mod_sqr)
 BIGNUM_2c(mod_inverse)
 
 /*
- * Document-method: OpenSSL::BN#/
  * call-seq:
  *    bn1 / bn2 => [result, remainder]
  *
@@ -614,12 +622,11 @@ BIGNUM_BIT(clear_bit)
  */
 BIGNUM_BIT(mask_bits)
 
-/* Document-method: OpenSSL::BN#bit_set?
+/*
  * call-seq:
  *   bn.bit_set?(bit) => true | false
  *
- * Returns boolean of whether +bit+ is set.
- * Bitwise operations for openssl BIGNUMs.
+ * Tests bit _bit_ in _bn_ and returns +true+ if set, +false+ if not set.
  */
 static VALUE
 ossl_bn_is_bit_set(VALUE self, VALUE bit)
@@ -774,15 +781,15 @@ BIGNUM_RAND_RANGE(pseudo_rand)
  * call-seq:
  *    BN.generate_prime(bits, [, safe [, add [, rem]]]) => bn
  *
- * Generates a random prime number of bit length +bits+. If +safe+ is true,
- * generates a safe prime. If +add+ is specified, generates a prime that
+ * Generates a random prime number of bit length _bits_. If _safe_ is set to
+ * +true+, generates a safe prime. If _add_ is specified, generates a prime that
  * fulfills condition <tt>p % add = rem</tt>.
  *
  * === Parameters
- * * +bits+ - integer
- * * +safe+ - boolean
- * * +add+ - BN
- * * +rem+ - BN
+ * * _bits_ - integer
+ * * _safe_ - boolean
+ * * _add_ - BN
+ * * _rem_ - BN
  */
 static VALUE
 ossl_bn_s_generate_prime(int argc, VALUE *argv, VALUE klass)
@@ -856,6 +863,37 @@ ossl_bn_copy(VALUE self, VALUE other)
     return self;
 }
 
+/*
+ * call-seq:
+ *   +bn -> aBN
+ */
+static VALUE
+ossl_bn_uplus(VALUE self)
+{
+    return self;
+}
+
+/*
+ * call-seq:
+ *   -bn -> aBN
+ */
+static VALUE
+ossl_bn_uminus(VALUE self)
+{
+    VALUE obj;
+    BIGNUM *bn1, *bn2;
+
+    GetBN(self, bn1);
+    obj = NewBN(cBN);
+    bn2 = BN_dup(bn1);
+    if (!bn2)
+	ossl_raise(eBNError, "BN_dup");
+    SetBN(obj, bn2);
+    BN_set_negative(bn2, !BN_is_negative(bn2));
+
+    return obj;
+}
+
 #define BIGNUM_CMP(func)				\
     static VALUE					\
     ossl_bn_##func(VALUE self, VALUE other)		\
@@ -888,7 +926,7 @@ BIGNUM_CMP(ucmp)
  *  call-seq:
  *     bn == obj => true or false
  *
- *  Returns +true+ only if +obj+ has the same value as +bn+. Contrast this
+ *  Returns +true+ only if _obj_ has the same value as _bn_. Contrast this
  *  with OpenSSL::BN#eql?, which requires obj to be OpenSSL::BN.
  */
 static VALUE
@@ -913,7 +951,7 @@ ossl_bn_eq(VALUE self, VALUE other)
  *     bn.eql?(obj) => true or false
  *
  *  Returns <code>true</code> only if <i>obj</i> is a
- *  <code>OpenSSL::BN</code> with the same value as <i>big</i>. Contrast this
+ *  <code>OpenSSL::BN</code> with the same value as <i>bn</i>. Contrast this
  *  with OpenSSL::BN#==, which performs type conversions.
  */
 static VALUE
@@ -953,7 +991,7 @@ ossl_bn_hash(VALUE self)
 	ossl_raise(eBNError, NULL);
     }
 
-    hash = ST2FIX(rb_memhash(buf, len));
+    hash = INT2FIX(rb_memhash(buf, len));
     xfree(buf);
 
     return hash;
@@ -964,12 +1002,12 @@ ossl_bn_hash(VALUE self)
  *    bn.prime? => true | false
  *    bn.prime?(checks) => true | false
  *
- * Performs a Miller-Rabin probabilistic primality test with +checks+
- * iterations. If +nchecks+ is not specified, a number of iterations is used
+ * Performs a Miller-Rabin probabilistic primality test with _checks_
+ * iterations. If _checks_ is not specified, a number of iterations is used
  * that yields a false positive rate of at most 2^-80 for random input.
  *
  * === Parameters
- * * +checks+ - integer
+ * * _checks_ - integer
  */
 static VALUE
 ossl_bn_is_prime(int argc, VALUE *argv, VALUE self)
@@ -1004,8 +1042,8 @@ ossl_bn_is_prime(int argc, VALUE *argv, VALUE self)
  * first attempts trial divisions with some small primes.
  *
  * === Parameters
- * * +checks+ - integer
- * * +trial_div+ - boolean
+ * * _checks_ - integer
+ * * _trial_div_ - boolean
  */
 static VALUE
 ossl_bn_is_prime_fasttest(int argc, VALUE *argv, VALUE self)
@@ -1059,7 +1097,7 @@ Init_ossl_bn(void)
     rb_define_alloc_func(cBN, ossl_bn_alloc);
     rb_define_method(cBN, "initialize", ossl_bn_initialize, -1);
 
-    rb_define_copy_func(cBN, ossl_bn_copy);
+    rb_define_method(cBN, "initialize_copy", ossl_bn_copy, 1);
     rb_define_method(cBN, "copy", ossl_bn_copy, 1);
 
     /* swap (=coerce?) */
@@ -1068,6 +1106,9 @@ Init_ossl_bn(void)
     rb_define_method(cBN, "num_bits", ossl_bn_num_bits, 0);
     /* num_bits_word */
 
+    rb_define_method(cBN, "+@", ossl_bn_uplus, 0);
+    rb_define_method(cBN, "-@", ossl_bn_uminus, 0);
+
     rb_define_method(cBN, "+", ossl_bn_add, 1);
     rb_define_method(cBN, "-", ossl_bn_sub, 1);
     rb_define_method(cBN, "*", ossl_bn_mul, 1);
@@ -1101,6 +1142,7 @@ Init_ossl_bn(void)
     rb_define_method(cBN, "one?", ossl_bn_is_one, 0);
     /* is_word */
     rb_define_method(cBN, "odd?", ossl_bn_is_odd, 0);
+    rb_define_method(cBN, "negative?", ossl_bn_is_negative, 0);
 
     /* zero
      * one

data/ext/openssl/ossl_cipher.c

@@ -26,10 +26,6 @@
 	ossl_raise(rb_eRuntimeError, "Cipher not initialized!"); \
     } \
 } while (0)
-#define SafeGetCipher(obj, ctx) do { \
-    OSSL_Check_Kind((obj), cCipher); \
-    GetCipher((obj), (ctx)); \
-} while (0)
 
 /*
  * Classes
@@ -53,7 +49,7 @@ static const rb_data_type_t ossl_cipher_type = {
  * PUBLIC
  */
 const EVP_CIPHER *
-GetCipherPtr(VALUE obj)
+ossl_evp_get_cipherbyname(VALUE obj)
 {
     if (rb_obj_is_kind_of(obj, cCipher)) {
 	EVP_CIPHER_CTX *ctx;
@@ -108,7 +104,7 @@ ossl_cipher_alloc(VALUE klass)
  *  call-seq:
  *     Cipher.new(string) -> cipher
  *
- *  The string must contain a valid cipher name like "AES-128-CBC" or "3DES".
+ *  The string must be a valid cipher name like "AES-128-CBC" or "3DES".
  *
  *  A list of cipher names is available by calling OpenSSL::Cipher.ciphers.
  */
@@ -146,7 +142,7 @@ ossl_cipher_copy(VALUE self, VALUE other)
     if (!ctx1) {
 	AllocCipher(self, ctx1);
     }
-    SafeGetCipher(other, ctx2);
+    GetCipher(other, ctx2);
     if (EVP_CIPHER_CTX_copy(ctx1, ctx2) != 1)
 	ossl_raise(eCipherError, NULL);
 
@@ -296,9 +292,9 @@ ossl_cipher_decrypt(int argc, VALUE *argv, VALUE self)
  *  OpenSSL::PKCS5 instead.
  *
  *  === Parameters
- *  * +salt+ must be an 8 byte string if provided.
- *  * +iterations+ is an integer with a default of 2048.
- *  * +digest+ is a Digest object that defaults to 'MD5'
+ *  * _salt_ must be an 8 byte string if provided.
+ *  * _iterations_ is an integer with a default of 2048.
+ *  * _digest_ is a Digest object that defaults to 'MD5'
  *
  *  A minimum of 1000 iterations is recommended.
  *
@@ -321,9 +317,7 @@ ossl_cipher_pkcs5_keyivgen(int argc, VALUE *argv, VALUE self)
 	salt = (unsigned char *)RSTRING_PTR(vsalt);
     }
     iter = NIL_P(viter) ? 2048 : NUM2INT(viter);
-    if (iter <= 0)
-	rb_raise(rb_eArgError, "iterations must be a positive integer");
-    digest = NIL_P(vdigest) ? EVP_md5() : GetDigestPtr(vdigest);
+    digest = NIL_P(vdigest) ? EVP_md5() : ossl_evp_get_digestbyname(vdigest);
     GetCipher(self, ctx);
     EVP_BytesToKey(EVP_CIPHER_CTX_cipher(ctx), digest, salt,
 		   (unsigned char *)RSTRING_PTR(vpass), RSTRING_LENINT(vpass), iter, key, iv);
@@ -367,12 +361,12 @@ ossl_cipher_update_long(EVP_CIPHER_CTX *ctx, unsigned char *out, long *out_len_p
  *     cipher.update(data [, buffer]) -> string or buffer
  *
  *  Encrypts data in a streaming fashion. Hand consecutive blocks of data
- *  to the +update+ method in order to encrypt it. Returns the encrypted
+ *  to the #update method in order to encrypt it. Returns the encrypted
  *  data chunk. When done, the output of Cipher#final should be additionally
  *  added to the result.
  *
- *  If +buffer+ is given, the encryption/decryption result will be written to
- *  it. +buffer+ will be resized automatically.
+ *  If _buffer_ is given, the encryption/decryption result will be written to
+ *  it. _buffer_ will be resized automatically.
  */
 static VALUE
 ossl_cipher_update(int argc, VALUE *argv, VALUE self)
@@ -514,10 +508,8 @@ ossl_cipher_set_iv(VALUE self, VALUE iv)
     StringValue(iv);
     GetCipher(self, ctx);
 
-#if defined(HAVE_AUTHENTICATED_ENCRYPTION)
     if (EVP_CIPHER_CTX_flags(ctx) & EVP_CIPH_FLAG_AEAD_CIPHER)
 	iv_len = (int)(VALUE)EVP_CIPHER_CTX_get_app_data(ctx);
-#endif
     if (!iv_len)
 	iv_len = EVP_CIPHER_CTX_iv_length(ctx);
     if (RSTRING_LEN(iv) != iv_len)
@@ -543,14 +535,9 @@ ossl_cipher_is_authenticated(VALUE self)
 
     GetCipher(self, ctx);
 
-#if defined(HAVE_AUTHENTICATED_ENCRYPTION)
     return (EVP_CIPHER_CTX_flags(ctx) & EVP_CIPH_FLAG_AEAD_CIPHER) ? Qtrue : Qfalse;
-#else
-    return Qfalse;
-#endif
 }
 
-#ifdef HAVE_AUTHENTICATED_ENCRYPTION
 /*
  *  call-seq:
  *     cipher.auth_data = string -> string
@@ -582,8 +569,6 @@ ossl_cipher_set_auth_data(VALUE self, VALUE data)
     in_len = RSTRING_LEN(data);
 
     GetCipher(self, ctx);
-    if (!(EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx)) & EVP_CIPH_FLAG_AEAD_CIPHER))
-	ossl_raise(eCipherError, "AEAD not supported by this cipher");
 
     if (!ossl_cipher_update_long(ctx, NULL, &out_len, in, in_len))
         ossl_raise(eCipherError, "couldn't set additional authenticated data");
@@ -598,8 +583,8 @@ ossl_cipher_set_auth_data(VALUE self, VALUE data)
  *  Gets the authentication tag generated by Authenticated Encryption Cipher
  *  modes (GCM for example). This tag may be stored along with the ciphertext,
  *  then set on the decryption cipher to authenticate the contents of the
- *  ciphertext against changes. If the optional integer parameter +tag_len+ is
- *  given, the returned tag will be +tag_len+ bytes long. If the parameter is
+ *  ciphertext against changes. If the optional integer parameter _tag_len_ is
+ *  given, the returned tag will be _tag_len_ bytes long. If the parameter is
  *  omitted, the default length of 16 bytes or the length previously set by
  *  #auth_tag_len= will be used. For maximum security, the longest possible
  *  should be chosen.
@@ -724,13 +709,6 @@ ossl_cipher_set_iv_length(VALUE self, VALUE iv_length)
 
     return iv_length;
 }
-#else
-#define ossl_cipher_set_auth_data rb_f_notimplement
-#define ossl_cipher_get_auth_tag rb_f_notimplement
-#define ossl_cipher_set_auth_tag rb_f_notimplement
-#define ossl_cipher_set_auth_tag_len rb_f_notimplement
-#define ossl_cipher_set_iv_length rb_f_notimplement
-#endif
 
 /*
  *  call-seq:
@@ -808,10 +786,8 @@ ossl_cipher_iv_length(VALUE self)
     int len = 0;
 
     GetCipher(self, ctx);
-#if defined(HAVE_AUTHENTICATED_ENCRYPTION)
     if (EVP_CIPHER_CTX_flags(ctx) & EVP_CIPH_FLAG_AEAD_CIPHER)
 	len = (int)(VALUE)EVP_CIPHER_CTX_get_app_data(ctx);
-#endif
     if (!len)
 	len = EVP_CIPHER_CTX_iv_length(ctx);
 
@@ -1022,9 +998,9 @@ Init_ossl_cipher(void)
      * encryption and later decryption, the OpenSSL library still requires a
      * value to be set - "" may be used in case none is available.
      *
-     * An example using the GCM (Galois/Counter Mode). You have 16 bytes +key+,
-     * 12 bytes (96 bits) +nonce+ and the associated data +auth_data+. Be sure
-     * not to reuse the +key+ and +nonce+ pair. Reusing an nonce ruins the
+     * An example using the GCM (Galois/Counter Mode). You have 16 bytes _key_,
+     * 12 bytes (96 bits) _nonce_ and the associated data _auth_data_. Be sure
+     * not to reuse the _key_ and _nonce_ pair. Reusing an nonce ruins the
      * security guarantees of GCM mode.
      *
      *   cipher = OpenSSL::Cipher::AES.new(128, :GCM).encrypt
@@ -1035,8 +1011,8 @@ Init_ossl_cipher(void)
      *   encrypted = cipher.update(data) + cipher.final
      *   tag = cipher.auth_tag # produces 16 bytes tag by default
      *
-     * Now you are the receiver. You know the +key+ and have received +nonce+,
-     * +auth_data+, +encrypted+ and +tag+ through an untrusted network. Note
+     * Now you are the receiver. You know the _key_ and have received _nonce_,
+     * _auth_data_, _encrypted_ and _tag_ through an untrusted network. Note
      * that GCM accepts an arbitrary length tag between 1 and 16 bytes. You may
      * additionally need to check that the received tag has the correct length,
      * or you allow attackers to forge a valid single byte tag for the tampered
@@ -1057,7 +1033,7 @@ Init_ossl_cipher(void)
     eCipherError = rb_define_class_under(cCipher, "CipherError", eOSSLError);
 
     rb_define_alloc_func(cCipher, ossl_cipher_alloc);
-    rb_define_copy_func(cCipher, ossl_cipher_copy);
+    rb_define_method(cCipher, "initialize_copy", ossl_cipher_copy, 1);
     rb_define_module_function(cCipher, "ciphers", ossl_s_ciphers, 0);
     rb_define_method(cCipher, "initialize", ossl_cipher_initialize, 1);
     rb_define_method(cCipher, "reset", ossl_cipher_reset, 0);