rubysl-openssl 1.0.2 → 2.0.0

data/ext/rubysl/openssl/ossl_pkcs7.c

@@ -1,5 +1,5 @@
 /*
- * $Id: ossl_pkcs7.c 28367 2010-06-21 09:18:59Z shyouhei $
+ * $Id$
  * 'OpenSSL for Ruby' project
  * Copyright (C) 2001-2002  Michal Rokos <m.rokos@sh.cvut.cz>
  * All rights reserved.
@@ -11,64 +11,64 @@
 #include "ossl.h"
 
 #define WrapPKCS7(klass, obj, pkcs7) do { \
-    if (!pkcs7) { \
+    if (!(pkcs7)) { \
 	ossl_raise(rb_eRuntimeError, "PKCS7 wasn't initialized."); \
     } \
-    obj = Data_Wrap_Struct(klass, 0, PKCS7_free, pkcs7); \
+    (obj) = Data_Wrap_Struct((klass), 0, PKCS7_free, (pkcs7)); \
 } while (0)
 #define GetPKCS7(obj, pkcs7) do { \
-    Data_Get_Struct(obj, PKCS7, pkcs7); \
-    if (!pkcs7) { \
+    Data_Get_Struct((obj), PKCS7, (pkcs7)); \
+    if (!(pkcs7)) { \
 	ossl_raise(rb_eRuntimeError, "PKCS7 wasn't initialized."); \
     } \
 } while (0)
 #define SafeGetPKCS7(obj, pkcs7) do { \
-    OSSL_Check_Kind(obj, cPKCS7); \
-    GetPKCS7(obj, pkcs7); \
+    OSSL_Check_Kind((obj), cPKCS7); \
+    GetPKCS7((obj), (pkcs7)); \
 } while (0)
 
 #define WrapPKCS7si(klass, obj, p7si) do { \
-    if (!p7si) { \
+    if (!(p7si)) { \
 	ossl_raise(rb_eRuntimeError, "PKCS7si wasn't initialized."); \
     } \
-    obj = Data_Wrap_Struct(klass, 0, PKCS7_SIGNER_INFO_free, p7si); \
+    (obj) = Data_Wrap_Struct((klass), 0, PKCS7_SIGNER_INFO_free, (p7si)); \
 } while (0)
 #define GetPKCS7si(obj, p7si) do { \
-    Data_Get_Struct(obj, PKCS7_SIGNER_INFO, p7si); \
-    if (!p7si) { \
+    Data_Get_Struct((obj), PKCS7_SIGNER_INFO, (p7si)); \
+    if (!(p7si)) { \
 	ossl_raise(rb_eRuntimeError, "PKCS7si wasn't initialized."); \
     } \
 } while (0)
 #define SafeGetPKCS7si(obj, p7si) do { \
-    OSSL_Check_Kind(obj, cPKCS7Signer); \
-    GetPKCS7si(obj, p7si); \
+    OSSL_Check_Kind((obj), cPKCS7Signer); \
+    GetPKCS7si((obj), (p7si)); \
 } while (0)
 
 #define WrapPKCS7ri(klass, obj, p7ri) do { \
-    if (!p7ri) { \
+    if (!(p7ri)) { \
 	ossl_raise(rb_eRuntimeError, "PKCS7ri wasn't initialized."); \
     } \
-    obj = Data_Wrap_Struct(klass, 0, PKCS7_RECIP_INFO_free, p7ri); \
+    (obj) = Data_Wrap_Struct((klass), 0, PKCS7_RECIP_INFO_free, (p7ri)); \
 } while (0)
 #define GetPKCS7ri(obj, p7ri) do { \
-    Data_Get_Struct(obj, PKCS7_RECIP_INFO, p7ri); \
-    if (!p7ri) { \
+    Data_Get_Struct((obj), PKCS7_RECIP_INFO, (p7ri)); \
+    if (!(p7ri)) { \
 	ossl_raise(rb_eRuntimeError, "PKCS7ri wasn't initialized."); \
     } \
 } while (0)
 #define SafeGetPKCS7ri(obj, p7ri) do { \
-    OSSL_Check_Kind(obj, cPKCS7Recipient); \
-    GetPKCS7ri(obj, p7ri); \
+    OSSL_Check_Kind((obj), cPKCS7Recipient); \
+    GetPKCS7ri((obj), (p7ri)); \
 } while (0)
 
-#define numberof(ary) (sizeof(ary)/sizeof(ary[0]))
+#define numberof(ary) (int)(sizeof(ary)/sizeof((ary)[0]))
 
 #define ossl_pkcs7_set_data(o,v)       rb_iv_set((o), "@data", (v))
 #define ossl_pkcs7_get_data(o)         rb_iv_get((o), "@data")
 #define ossl_pkcs7_set_err_string(o,v) rb_iv_set((o), "@error_string", (v))
 #define ossl_pkcs7_get_err_string(o)   rb_iv_get((o), "@error_string")
 
-/* 
+/*
  * Classes
  */
 VALUE cPKCS7;
@@ -97,7 +97,7 @@ static PKCS7_SIGNER_INFO *
 DupPKCS7SignerPtr(VALUE obj)
 {
     PKCS7_SIGNER_INFO *p7si, *pkcs7;
-	
+
     SafeGetPKCS7si(obj, p7si);
     if (!(pkcs7 = PKCS7_SIGNER_INFO_dup(p7si))) {
 	ossl_raise(ePKCS7Error, NULL);
@@ -123,7 +123,7 @@ static PKCS7_RECIP_INFO *
 DupPKCS7RecipientPtr(VALUE obj)
 {
     PKCS7_RECIP_INFO *p7ri, *pkcs7;
-	
+
     SafeGetPKCS7ri(obj, p7ri);
     if (!(pkcs7 = PKCS7_RECIP_INFO_dup(p7ri))) {
 	ossl_raise(ePKCS7Error, NULL);
@@ -295,7 +295,7 @@ ossl_pkcs7_alloc(VALUE klass)
 	ossl_raise(ePKCS7Error, NULL);
     }
     WrapPKCS7(klass, obj, pkcs7);
-    
+
     return obj;
 }
 
@@ -309,7 +309,7 @@ ossl_pkcs7_alloc(VALUE klass)
 static VALUE
 ossl_pkcs7_initialize(int argc, VALUE *argv, VALUE self)
 {
-    PKCS7 *p7;
+    PKCS7 *p7, *pkcs = DATA_PTR(self);
     BIO *in;
     VALUE arg;
 
@@ -317,11 +317,18 @@ ossl_pkcs7_initialize(int argc, VALUE *argv, VALUE self)
 	return self;
     arg = ossl_to_der_if_possible(arg);
     in = ossl_obj2bio(arg);
-    p7 = PEM_read_bio_PKCS7(in, (PKCS7 **)&DATA_PTR(self), NULL, NULL);
+    p7 = PEM_read_bio_PKCS7(in, &pkcs, NULL, NULL);
     if (!p7) {
-	BIO_reset(in);
-        p7 = d2i_PKCS7_bio(in, (PKCS7 **)&DATA_PTR(self));
+	OSSL_BIO_reset(in);
+        p7 = d2i_PKCS7_bio(in, &pkcs);
+	if (!p7) {
+	    BIO_free(in);
+	    PKCS7_free(pkcs);
+	    DATA_PTR(self) = NULL;
+	    ossl_raise(rb_eArgError, "Could not parse the PKCS7");
+	}
     }
+    DATA_PTR(self) = pkcs;
     BIO_free(in);
     ossl_pkcs7_set_data(self, Qnil);
     ossl_pkcs7_set_err_string(self, Qnil);
@@ -493,7 +500,7 @@ ossl_pkcs7_get_signer(VALUE self)
     PKCS7_SIGNER_INFO *si;
     int num, i;
     VALUE ary;
-    
+
     GetPKCS7(self, pkcs7);
     if (!(sk = PKCS7_get_signer_info(pkcs7))) {
 	OSSL_Debug("OpenSSL::PKCS7#get_signer_info == NULL!");
@@ -535,7 +542,7 @@ ossl_pkcs7_get_recipient(VALUE self)
     PKCS7_RECIP_INFO *si;
     int num, i;
     VALUE ary;
-    
+
     GetPKCS7(self, pkcs7);
     if (PKCS7_type_is_enveloped(pkcs7))
 	sk = pkcs7->d.enveloped->recipientinfo;
@@ -775,7 +782,7 @@ ossl_pkcs7_add_data(VALUE self, VALUE data)
     }
     if(!PKCS7_dataFinal(pkcs7, out)) goto err;
     ossl_pkcs7_set_data(self, Qnil);
-    
+
  err:
     BIO_free(out);
     BIO_free(in);
@@ -798,7 +805,7 @@ ossl_pkcs7_to_der(VALUE self)
     if((len = i2d_PKCS7(pkcs7, NULL)) <= 0)
 	ossl_raise(ePKCS7Error, NULL);
     str = rb_str_new(0, len);
-    p = RSTRING_PTR(str);
+    p = (unsigned char *)RSTRING_PTR(str);
     if(i2d_PKCS7(pkcs7, &p) <= 0)
 	ossl_raise(ePKCS7Error, NULL);
     ossl_str_adjust(str, p);
@@ -812,7 +819,7 @@ ossl_pkcs7_to_pem(VALUE self)
     PKCS7 *pkcs7;
     BIO *out;
     VALUE str;
-	
+
     GetPKCS7(self, pkcs7);
     if (!(out = BIO_new(BIO_s_mem()))) {
 	ossl_raise(ePKCS7Error, NULL);
@@ -887,9 +894,9 @@ ossl_pkcs7si_get_signed_time(VALUE self)
 {
     PKCS7_SIGNER_INFO *p7si;
     ASN1_TYPE *asn1obj;
-	
+
     GetPKCS7si(self, p7si);
-	
+
     if (!(asn1obj = PKCS7_get_signed_attribute(p7si, NID_pkcs9_signingTime))) {
 	ossl_raise(ePKCS7Error, NULL);
     }
@@ -1019,10 +1026,10 @@ Init_ossl_pkcs7()
 
     cPKCS7Recipient = rb_define_class_under(cPKCS7,"RecipientInfo",rb_cObject);
     rb_define_alloc_func(cPKCS7Recipient, ossl_pkcs7ri_alloc);
-    rb_define_method(cPKCS7Recipient, "initialize", ossl_pkcs7ri_initialize,1); 
+    rb_define_method(cPKCS7Recipient, "initialize", ossl_pkcs7ri_initialize,1);
     rb_define_method(cPKCS7Recipient, "issuer", ossl_pkcs7ri_get_issuer,0);
     rb_define_method(cPKCS7Recipient, "serial", ossl_pkcs7ri_get_serial,0);
-    rb_define_method(cPKCS7Recipient, "enc_key", ossl_pkcs7ri_get_enc_key,0); 
+    rb_define_method(cPKCS7Recipient, "enc_key", ossl_pkcs7ri_get_enc_key,0);
 
 #define DefPKCS7Const(x) rb_define_const(cPKCS7, #x, INT2NUM(PKCS7_##x))
 

data/ext/rubysl/openssl/ossl_pkcs7.h

@@ -1,5 +1,5 @@
 /*
- * $Id: ossl_pkcs7.h 12496 2007-06-08 15:02:04Z technorama $
+ * $Id$
  * 'OpenSSL for Ruby' project
  * Copyright (C) 2001-2002  Michal Rokos <m.rokos@sh.cvut.cz>
  * All rights reserved.

data/ext/rubysl/openssl/ossl_pkey.c

@@ -1,5 +1,5 @@
 /*
- * $Id: ossl_pkey.c 28004 2010-05-24 23:58:49Z shyouhei $
+ * $Id$
  * 'OpenSSL for Ruby' project
  * Copyright (C) 2001-2002  Michal Rokos <m.rokos@sh.cvut.cz>
  * All rights reserved.
@@ -33,6 +33,42 @@ ossl_generate_cb(int p, int n, void *arg)
     rb_yield(ary);
 }
 
+#if HAVE_BN_GENCB
+/* OpenSSL 2nd version of GN generation callback */
+int
+ossl_generate_cb_2(int p, int n, BN_GENCB *cb)
+{
+    VALUE ary;
+    struct ossl_generate_cb_arg *arg;
+    int state;
+
+    arg = (struct ossl_generate_cb_arg *)cb->arg;
+    if (arg->yield) {
+	ary = rb_ary_new2(2);
+	rb_ary_store(ary, 0, INT2NUM(p));
+	rb_ary_store(ary, 1, INT2NUM(n));
+
+	/*
+	* can be break by raising exception or 'break'
+	*/
+	rb_protect(rb_yield, ary, &state);
+	if (state) {
+	    arg->stop = 1;
+	    arg->state = state;
+	}
+    }
+    if (arg->stop) return 0;
+    return 1;
+}
+
+void
+ossl_generate_cb_stop(void *ptr)
+{
+    struct ossl_generate_cb_arg *arg = (struct ossl_generate_cb_arg *)ptr;
+    arg->stop = 1;
+}
+#endif
+
 /*
  * Public
  */
@@ -62,7 +98,8 @@ ossl_pkey_new(EVP_PKEY *pkey)
     default:
 	ossl_raise(ePKeyError, "unsupported key type");
     }
-    return Qnil; /* not reached */
+
+    UNREACHABLE;
 }
 
 VALUE
@@ -75,6 +112,7 @@ ossl_pkey_new_from_file(VALUE filename)
     if (!(fp = fopen(RSTRING_PTR(filename), "r"))) {
 	ossl_raise(ePKeyError, "%s", strerror(errno));
     }
+    rb_update_max_fd(fileno(fp));
 
     pkey = PEM_read_PrivateKey(fp, NULL, ossl_pem_passwd_cb, NULL);
     fclose(fp);
@@ -85,6 +123,53 @@ ossl_pkey_new_from_file(VALUE filename)
     return ossl_pkey_new(pkey);
 }
 
+/*
+ *  call-seq:
+ *     OpenSSL::PKey.read(string [, pwd ] ) -> PKey
+ *     OpenSSL::PKey.read(file [, pwd ]) -> PKey
+ *
+ * === Parameters
+ * * +string+ is a DER- or PEM-encoded string containing an arbitrary private
+ * or public key.
+ * * +file+ is an instance of +File+ containing a DER- or PEM-encoded
+ * arbitrary private or public key.
+ * * +pwd+ is an optional password in case +string+ or +file+ is an encrypted
+ * PEM resource.
+ */
+static VALUE
+ossl_pkey_new_from_data(int argc, VALUE *argv, VALUE self)
+{
+     EVP_PKEY *pkey;
+     BIO *bio;
+     VALUE data, pass;
+     char *passwd = NULL;
+
+     rb_scan_args(argc, argv, "11", &data, &pass);
+
+     bio = ossl_obj2bio(data);
+     if (!(pkey = d2i_PrivateKey_bio(bio, NULL))) {
+	OSSL_BIO_reset(bio);
+	if (!NIL_P(pass)) {
+	    passwd = StringValuePtr(pass);
+	}
+	if (!(pkey = PEM_read_bio_PrivateKey(bio, NULL, ossl_pem_passwd_cb, passwd))) {
+	    OSSL_BIO_reset(bio);
+	    if (!(pkey = d2i_PUBKEY_bio(bio, NULL))) {
+		OSSL_BIO_reset(bio);
+		if (!NIL_P(pass)) {
+		    passwd = StringValuePtr(pass);
+		}
+		pkey = PEM_read_bio_PUBKEY(bio, NULL, ossl_pem_passwd_cb, passwd);
+	    }
+	}
+    }
+
+    BIO_free(bio);
+    if (!pkey)
+	ossl_raise(rb_eArgError, "Could not parse PKey");
+    return ossl_pkey_new(pkey);
+}
+
 EVP_PKEY *
 GetPKeyPtr(VALUE obj)
 {
@@ -99,7 +184,7 @@ EVP_PKEY *
 GetPrivPKeyPtr(VALUE obj)
 {
     EVP_PKEY *pkey;
-	
+
     if (rb_funcall(obj, id_private_q, 0, NULL) != Qtrue) {
 	ossl_raise(rb_eArgError, "Private key is needed.");
     }
@@ -112,7 +197,7 @@ EVP_PKEY *
 DupPKeyPtr(VALUE obj)
 {
     EVP_PKEY *pkey;
-	
+
     SafeGetPKey(obj, pkey);
     CRYPTO_add(&pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);
 
@@ -123,7 +208,7 @@ EVP_PKEY *
 DupPrivPKeyPtr(VALUE obj)
 {
     EVP_PKEY *pkey;
-	
+
     if (rb_funcall(obj, id_private_q, 0, NULL) != Qtrue) {
 	ossl_raise(rb_eArgError, "Private key is needed.");
     }
@@ -150,6 +235,13 @@ ossl_pkey_alloc(VALUE klass)
     return obj;
 }
 
+/*
+ *  call-seq:
+ *      PKeyClass.new -> self
+ *
+ * Because PKey is an abstract class, actually calling this method explicitly
+ * will raise a +NotImplementedError+.
+ */
 static VALUE
 ossl_pkey_initialize(VALUE self)
 {
@@ -159,12 +251,29 @@ ossl_pkey_initialize(VALUE self)
     return self;
 }
 
+/*
+ *  call-seq:
+ *      pkey.sign(digest, data) -> String
+ *
+ * To sign the +String+ +data+, +digest+, an instance of OpenSSL::Digest, must
+ * be provided. The return value is again a +String+ containing the signature.
+ * A PKeyError is raised should errors occur.
+ * Any previous state of the +Digest+ instance is irrelevant to the signature
+ * outcome, the digest instance is reset to its initial state during the
+ * operation.
+ *
+ * == Example
+ *   data = 'Sign me!'
+ *   digest = OpenSSL::Digest::SHA256.new
+ *   pkey = OpenSSL::PKey::RSA.new(2048)
+ *   signature = pkey.sign(digest, data)
+ */
 static VALUE
 ossl_pkey_sign(VALUE self, VALUE digest, VALUE data)
 {
     EVP_PKEY *pkey;
     EVP_MD_CTX ctx;
-    int buf_len;
+    unsigned int buf_len;
     VALUE str;
 
     if (rb_funcall(self, id_private_q, 0, NULL) != Qtrue) {
@@ -175,7 +284,7 @@ ossl_pkey_sign(VALUE self, VALUE digest, VALUE data)
     StringValue(data);
     EVP_SignUpdate(&ctx, RSTRING_PTR(data), RSTRING_LEN(data));
     str = rb_str_new(0, EVP_PKEY_size(pkey)+16);
-    if (!EVP_SignFinal(&ctx, RSTRING_PTR(str), &buf_len, pkey))
+    if (!EVP_SignFinal(&ctx, (unsigned char *)RSTRING_PTR(str), &buf_len, pkey))
 	ossl_raise(ePKeyError, NULL);
     assert((long)buf_len <= RSTRING_LEN(str));
     rb_str_set_len(str, buf_len);
@@ -183,6 +292,27 @@ ossl_pkey_sign(VALUE self, VALUE digest, VALUE data)
     return str;
 }
 
+/*
+ *  call-seq:
+ *      pkey.verify(digest, signature, data) -> String
+ *
+ * To verify the +String+ +signature+, +digest+, an instance of
+ * OpenSSL::Digest, must be provided to re-compute the message digest of the
+ * original +data+, also a +String+. The return value is +true+ if the
+ * signature is valid, +false+ otherwise. A PKeyError is raised should errors
+ * occur.
+ * Any previous state of the +Digest+ instance is irrelevant to the validation
+ * outcome, the digest instance is reset to its initial state during the
+ * operation.
+ *
+ * == Example
+ *   data = 'Sign me!'
+ *   digest = OpenSSL::Digest::SHA256.new
+ *   pkey = OpenSSL::PKey::RSA.new(2048)
+ *   signature = pkey.sign(digest, data)
+ *   pub_key = pkey.public_key
+ *   puts pub_key.verify(digest, signature, data) # => true
+ */
 static VALUE
 ossl_pkey_verify(VALUE self, VALUE digest, VALUE sig, VALUE data)
 {
@@ -194,7 +324,7 @@ ossl_pkey_verify(VALUE self, VALUE digest, VALUE sig, VALUE data)
     StringValue(sig);
     StringValue(data);
     EVP_VerifyUpdate(&ctx, RSTRING_PTR(data), RSTRING_LEN(data));
-    switch (EVP_VerifyFinal(&ctx, RSTRING_PTR(sig), RSTRING_LEN(sig), pkey)) {
+    switch (EVP_VerifyFinal(&ctx, (unsigned char *)RSTRING_PTR(sig), RSTRING_LENINT(sig), pkey)) {
     case 0:
 	return Qfalse;
     case 1:
@@ -211,24 +341,90 @@ ossl_pkey_verify(VALUE self, VALUE digest, VALUE sig, VALUE data)
 void
 Init_ossl_pkey()
 {
-#if 0 /* let rdoc know about mOSSL */
-    mOSSL = rb_define_module("OpenSSL");
+#if 0
+    mOSSL = rb_define_module("OpenSSL"); /* let rdoc know about mOSSL */
 #endif
-        
+
+    /* Document-module: OpenSSL::PKey
+     *
+     * == Asymmetric Public Key Algorithms
+     *
+     * Asymmetric public key algorithms solve the problem of establishing and
+     * sharing secret keys to en-/decrypt messages. The key in such an
+     * algorithm consists of two parts: a public key that may be distributed
+     * to others and a private key that needs to remain secret.
+     *
+     * Messages encrypted with a public key can only be encrypted by
+     * recipients that are in possession of the associated private key.
+     * Since public key algorithms are considerably slower than symmetric
+     * key algorithms (cf. OpenSSL::Cipher) they are often used to establish
+     * a symmetric key shared between two parties that are in possession of
+     * each other's public key.
+     *
+     * Asymmetric algorithms offer a lot of nice features that are used in a
+     * lot of different areas. A very common application is the creation and
+     * validation of digital signatures. To sign a document, the signatory
+     * generally uses a message digest algorithm (cf. OpenSSL::Digest) to
+     * compute a digest of the document that is then encrypted (i.e. signed)
+     * using the private key. Anyone in possession of the public key may then
+     * verify the signature by computing the message digest of the original
+     * document on their own, decrypting the signature using the signatory's
+     * public key and comparing the result to the message digest they
+     * previously computed. The signature is valid if and only if the
+     * decrypted signature is equal to this message digest.
+     *
+     * The PKey module offers support for three popular public/private key
+     * algorithms:
+     * * RSA (OpenSSL::PKey::RSA)
+     * * DSA (OpenSSL::PKey::DSA)
+     * * Elliptic Curve Cryptography (OpenSSL::PKey::EC)
+     * Each of these implementations is in fact a sub-class of the abstract
+     * PKey class which offers the interface for supporting digital signatures
+     * in the form of PKey#sign and PKey#verify.
+     *
+     * == Diffie-Hellman Key Exchange
+     *
+     * Finally PKey also features OpenSSL::PKey::DH, an implementation of
+     * the Diffie-Hellman key exchange protocol based on discrete logarithms
+     * in finite fields, the same basis that DSA is built on.
+     * The Diffie-Hellman protocol can be used to exchange (symmetric) keys
+     * over insecure channels without needing any prior joint knowledge
+     * between the participating parties. As the security of DH demands
+     * relatively long "public keys" (i.e. the part that is overtly
+     * transmitted between participants) DH tends to be quite slow. If
+     * security or speed is your primary concern, OpenSSL::PKey::EC offers
+     * another implementation of the Diffie-Hellman protocol.
+     *
+     */
     mPKey = rb_define_module_under(mOSSL, "PKey");
-	
+
+    /* Document-class: OpenSSL::PKey::PKeyError
+     *
+     *Raised when errors occur during PKey#sign or PKey#verify.
+     */
     ePKeyError = rb_define_class_under(mPKey, "PKeyError", eOSSLError);
 
+    /* Document-class: OpenSSL::PKey::PKey
+     *
+     * An abstract class that bundles signature creation (PKey#sign) and
+     * validation (PKey#verify) that is common to all implementations except
+     * OpenSSL::PKey::DH
+     * * OpenSSL::PKey::RSA
+     * * OpenSSL::PKey::DSA
+     * * OpenSSL::PKey::EC
+     */
     cPKey = rb_define_class_under(mPKey, "PKey", rb_cObject);
-	
+
+    rb_define_module_function(mPKey, "read", ossl_pkey_new_from_data, -1);
+
     rb_define_alloc_func(cPKey, ossl_pkey_alloc);
     rb_define_method(cPKey, "initialize", ossl_pkey_initialize, 0);
 
     rb_define_method(cPKey, "sign", ossl_pkey_sign, 2);
     rb_define_method(cPKey, "verify", ossl_pkey_verify, 3);
-	
+
     id_private_q = rb_intern("private?");
-	
+
     /*
      * INIT rsa, dsa, dh, ec
      */