rubysl-openssl 2.10 → 2.11

data/ext/rubysl/openssl/ossl_ssl.h

@@ -12,6 +12,9 @@
 
 #define GetSSL(obj, ssl) do { \
 	TypedData_Get_Struct((obj), SSL, &ossl_ssl_type, (ssl)); \
+	if (!(ssl)) { \
+		ossl_raise(rb_eRuntimeError, "SSL is not initialized"); \
+	} \
 } while (0)
 
 #define GetSSLSession(obj, sess) do { \

data/ext/rubysl/openssl/ossl_ssl_session.c

@@ -28,12 +28,12 @@ static VALUE ossl_ssl_session_alloc(VALUE klass)
 
 /*
  * call-seq:
- *    Session.new(SSLSocket | string) => session
+ *   Session.new(ssl_socket) -> Session
+ *   Session.new(string) -> Session
  *
- * === Parameters
- * +SSLSocket+ is an OpenSSL::SSL::SSLSocket
- * +string+ must be a DER or PEM encoded Session.
-*/
+ * Creates a new Session object from an instance of SSLSocket or DER/PEM encoded
+ * String.
+ */
 static VALUE ossl_ssl_session_initialize(VALUE self, VALUE arg1)
 {
 	SSL_SESSION *ctx = NULL;
@@ -46,10 +46,10 @@ static VALUE ossl_ssl_session_initialize(VALUE self, VALUE arg1)
 
 		GetSSL(arg1, ssl);
 
-		if (!ssl || (ctx = SSL_get1_session(ssl)) == NULL)
+		if ((ctx = SSL_get1_session(ssl)) == NULL)
 			ossl_raise(eSSLSession, "no session available");
 	} else {
-		BIO *in = ossl_obj2bio(arg1);
+		BIO *in = ossl_obj2bio(&arg1);
 
 		ctx = PEM_read_bio_SSL_SESSION(in, NULL, NULL, NULL);
 
@@ -73,25 +73,50 @@ static VALUE ossl_ssl_session_initialize(VALUE self, VALUE arg1)
 	return self;
 }
 
-#if HAVE_SSL_SESSION_CMP == 0
-int SSL_SESSION_cmp(const SSL_SESSION *a,const SSL_SESSION *b)
+static VALUE
+ossl_ssl_session_initialize_copy(VALUE self, VALUE other)
+{
+    SSL_SESSION *sess, *sess_other, *sess_new;
+
+    rb_check_frozen(self);
+    sess = RTYPEDDATA_DATA(self); /* XXX */
+    SafeGetSSLSession(other, sess_other);
+
+    sess_new = ASN1_dup((i2d_of_void *)i2d_SSL_SESSION, (d2i_of_void *)d2i_SSL_SESSION,
+			(char *)sess_other);
+    if (!sess_new)
+	ossl_raise(eSSLSession, "ASN1_dup");
+
+    RTYPEDDATA_DATA(self) = sess_new;
+    SSL_SESSION_free(sess);
+
+    return self;
+}
+
+#if !defined(HAVE_SSL_SESSION_CMP)
+int ossl_SSL_SESSION_cmp(const SSL_SESSION *a, const SSL_SESSION *b)
 {
-    if (a->ssl_version != b->ssl_version ||
-	a->session_id_length != b->session_id_length)
+    unsigned int a_len;
+    const unsigned char *a_sid = SSL_SESSION_get_id(a, &a_len);
+    unsigned int b_len;
+    const unsigned char *b_sid = SSL_SESSION_get_id(b, &b_len);
+
+    if (SSL_SESSION_get_protocol_version(a) != SSL_SESSION_get_protocol_version(b))
 	return 1;
-#if defined(_WIN32)
-    return memcmp(a->session_id, b->session_id, a->session_id_length);
-#else
-    return CRYPTO_memcmp(a->session_id, b->session_id, a->session_id_length);
-#endif
+    if (a_len != b_len)
+	return 1;
+
+    return CRYPTO_memcmp(a_sid, b_sid, a_len);
 }
+#define SSL_SESSION_cmp(a, b) ossl_SSL_SESSION_cmp(a, b)
 #endif
 
 /*
  * call-seq:
- *    session1 == session2 -> boolean
+ *   session1 == session2 -> boolean
  *
-*/
+ * Returns true if the two Session is the same, false if not.
+ */
 static VALUE ossl_ssl_session_eq(VALUE val1, VALUE val2)
 {
 	SSL_SESSION *ctx1, *ctx2;
@@ -109,51 +134,50 @@ static VALUE ossl_ssl_session_eq(VALUE val1, VALUE val2)
  * call-seq:
  *    session.time -> Time
  *
- * Gets start time of the session.
- *
-*/
-static VALUE ossl_ssl_session_get_time(VALUE self)
+ * Returns the time at which the session was established.
+ */
+static VALUE
+ossl_ssl_session_get_time(VALUE self)
 {
-	SSL_SESSION *ctx;
-	time_t t;
-
-	GetSSLSession(self, ctx);
+    SSL_SESSION *ctx;
+    long t;
 
-	t = SSL_SESSION_get_time(ctx);
+    GetSSLSession(self, ctx);
+    t = SSL_SESSION_get_time(ctx);
+    if (t == 0)
+	return Qnil;
 
-	if (t == 0)
-		return Qnil;
-
-	return rb_funcall(rb_cTime, rb_intern("at"), 1, TIMET2NUM(t));
+    return rb_funcall(rb_cTime, rb_intern("at"), 1, LONG2NUM(t));
 }
 
 /*
  * call-seq:
- *    session.timeout -> integer
+ *    session.timeout -> Integer
  *
- * Gets how long until the session expires in seconds.
+ * Returns the timeout value set for the session, in seconds from the
+ * established time.
  *
-*/
-static VALUE ossl_ssl_session_get_timeout(VALUE self)
+ */
+static VALUE
+ossl_ssl_session_get_timeout(VALUE self)
 {
-	SSL_SESSION *ctx;
-	time_t t;
-
-	GetSSLSession(self, ctx);
+    SSL_SESSION *ctx;
+    long t;
 
-	t = SSL_SESSION_get_timeout(ctx);
+    GetSSLSession(self, ctx);
+    t = SSL_SESSION_get_timeout(ctx);
 
-	return TIMET2NUM(t);
+    return LONG2NUM(t);
 }
 
 /*
  * call-seq:
- *    session.time=(Time) -> Time
- *    session.time=(integer) -> Time
+ *    session.time = time
+ *    session.time = integer
  *
  * Sets start time of the session. Time resolution is in seconds.
  *
-*/
+ */
 static VALUE ossl_ssl_session_set_time(VALUE self, VALUE time_v)
 {
 	SSL_SESSION *ctx;
@@ -170,11 +194,10 @@ static VALUE ossl_ssl_session_set_time(VALUE self, VALUE time_v)
 
 /*
  * call-seq:
- *    session.timeout=(integer) -> integer
+ *    session.timeout = integer
  *
  * Sets how long until the session expires in seconds.
- *
-*/
+ */
 static VALUE ossl_ssl_session_set_timeout(VALUE self, VALUE time_v)
 {
 	SSL_SESSION *ctx;
@@ -186,10 +209,9 @@ static VALUE ossl_ssl_session_set_timeout(VALUE self, VALUE time_v)
 	return ossl_ssl_session_get_timeout(self);
 }
 
-#ifdef HAVE_SSL_SESSION_GET_ID
 /*
  * call-seq:
- *    session.id -> aString
+ *    session.id -> String
  *
  * Returns the Session ID.
 */
@@ -205,14 +227,13 @@ static VALUE ossl_ssl_session_get_id(VALUE self)
 
 	return rb_str_new((const char *) p, i);
 }
-#endif
 
 /*
  * call-seq:
- *    session.to_der -> aString
+ *    session.to_der -> String
  *
  * Returns an ASN1 encoded String that contains the Session object.
-*/
+ */
 static VALUE ossl_ssl_session_to_der(VALUE self)
 {
 	SSL_SESSION *ctx;
@@ -238,14 +259,11 @@ static VALUE ossl_ssl_session_to_der(VALUE self)
  *    session.to_pem -> String
  *
  * Returns a PEM encoded String that contains the Session object.
-*/
+ */
 static VALUE ossl_ssl_session_to_pem(VALUE self)
 {
 	SSL_SESSION *ctx;
 	BIO *out;
-	BUF_MEM *buf;
-	VALUE str;
-	int i;
 
 	GetSSLSession(self, ctx);
 
@@ -253,16 +271,13 @@ static VALUE ossl_ssl_session_to_pem(VALUE self)
 		ossl_raise(eSSLSession, "BIO_s_mem()");
 	}
 
-	if (!(i=PEM_write_bio_SSL_SESSION(out, ctx))) {
+	if (!PEM_write_bio_SSL_SESSION(out, ctx)) {
 		BIO_free(out);
 		ossl_raise(eSSLSession, "SSL_SESSION_print()");
 	}
 
-	BIO_get_mem_ptr(out, &buf);
-	str = rb_str_new(buf->data, buf->length);
-	BIO_free(out);
 
-	return str;
+	return ossl_membio2str(out);
 }
 
 
@@ -270,14 +285,12 @@ static VALUE ossl_ssl_session_to_pem(VALUE self)
  * call-seq:
  *    session.to_text -> String
  *
- * Shows everything in the Session object.
-*/
+ * Shows everything in the Session object. This is for diagnostic purposes.
+ */
 static VALUE ossl_ssl_session_to_text(VALUE self)
 {
 	SSL_SESSION *ctx;
 	BIO *out;
-	BUF_MEM *buf;
-	VALUE str;
 
 	GetSSLSession(self, ctx);
 
@@ -290,25 +303,23 @@ static VALUE ossl_ssl_session_to_text(VALUE self)
 		ossl_raise(eSSLSession, "SSL_SESSION_print()");
 	}
 
-	BIO_get_mem_ptr(out, &buf);
-	str = rb_str_new(buf->data, buf->length);
-	BIO_free(out);
-
-	return str;
+	return ossl_membio2str(out);
 }
 
 
 void Init_ossl_ssl_session(void)
 {
 #if 0
-	mOSSL = rb_define_module("OpenSSL"); /* let rdoc know about mOSSL */
-	mSSL = rb_define_module_under(mOSSL, "SSL");
+    mOSSL = rb_define_module("OpenSSL");
+    mSSL = rb_define_module_under(mOSSL, "SSL");
+    eOSSLError = rb_define_class_under(mOSSL, "OpenSSLError", rb_eStandardError);
 #endif
 	cSSLSession = rb_define_class_under(mSSL, "Session", rb_cObject);
 	eSSLSession = rb_define_class_under(cSSLSession, "SessionError", eOSSLError);
 
 	rb_define_alloc_func(cSSLSession, ossl_ssl_session_alloc);
 	rb_define_method(cSSLSession, "initialize", ossl_ssl_session_initialize, 1);
+	rb_define_copy_func(cSSLSession, ossl_ssl_session_initialize_copy);
 
 	rb_define_method(cSSLSession, "==", ossl_ssl_session_eq, 1);
 
@@ -316,12 +327,7 @@ void Init_ossl_ssl_session(void)
 	rb_define_method(cSSLSession, "time=", ossl_ssl_session_set_time, 1);
 	rb_define_method(cSSLSession, "timeout", ossl_ssl_session_get_timeout, 0);
 	rb_define_method(cSSLSession, "timeout=", ossl_ssl_session_set_timeout, 1);
-
-#ifdef HAVE_SSL_SESSION_GET_ID
 	rb_define_method(cSSLSession, "id", ossl_ssl_session_get_id, 0);
-#else
-	rb_undef_method(cSSLSession, "id");
-#endif
 	rb_define_method(cSSLSession, "to_der", ossl_ssl_session_to_der, 0);
 	rb_define_method(cSSLSession, "to_pem", ossl_ssl_session_to_pem, 0);
 	rb_define_method(cSSLSession, "to_text", ossl_ssl_session_to_text, 0);

data/ext/rubysl/openssl/ossl_version.h

@@ -10,6 +10,6 @@
 #if !defined(_OSSL_VERSION_H_)
 #define _OSSL_VERSION_H_
 
-#define OSSL_VERSION "1.1.0"
+#define OSSL_VERSION "2.0.9"
 
 #endif /* _OSSL_VERSION_H_ */

data/ext/rubysl/openssl/ossl_x509.c

@@ -11,13 +11,33 @@
 
 VALUE mX509;
 
-#define DefX509Const(x) rb_define_const(mX509, #x,INT2FIX(X509_##x))
+#define DefX509Const(x) rb_define_const(mX509, #x, INT2NUM(X509_##x))
 #define DefX509Default(x,i) \
   rb_define_const(mX509, "DEFAULT_" #x, rb_str_new2(X509_get_default_##i()))
 
+ASN1_TIME *
+ossl_x509_time_adjust(ASN1_TIME *s, VALUE time)
+{
+    time_t sec;
+
+#if defined(HAVE_ASN1_TIME_ADJ)
+    int off_days;
+
+    ossl_time_split(time, &sec, &off_days);
+    return X509_time_adj_ex(s, off_days, 0, &sec);
+#else
+    sec = time_to_time_t(time);
+    return X509_time_adj(s, 0, &sec);
+#endif
+}
+
 void
 Init_ossl_x509(void)
 {
+#if 0
+    mOSSL = rb_define_module("OpenSSL");
+#endif
+
     mX509 = rb_define_module_under(mOSSL, "X509");
 
     Init_ossl_x509attr();
@@ -63,22 +83,87 @@ Init_ossl_x509(void)
     DefX509Const(V_ERR_KEYUSAGE_NO_CERTSIGN);
     DefX509Const(V_ERR_APPLICATION_VERIFICATION);
 
-#if defined(X509_V_FLAG_CRL_CHECK)
+    /* Set by Store#flags= and StoreContext#flags=. Enables CRL checking for the
+     * certificate chain leaf. */
     DefX509Const(V_FLAG_CRL_CHECK);
-#endif
-#if defined(X509_V_FLAG_CRL_CHECK_ALL)
+    /* Set by Store#flags= and StoreContext#flags=. Enables CRL checking for all
+     * certificates in the certificate chain */
     DefX509Const(V_FLAG_CRL_CHECK_ALL);
+    /* Set by Store#flags= and StoreContext#flags=. Disables critical extension
+     * checking. */
+    DefX509Const(V_FLAG_IGNORE_CRITICAL);
+    /* Set by Store#flags= and StoreContext#flags=. Disables workarounds for
+     * broken certificates. */
+    DefX509Const(V_FLAG_X509_STRICT);
+    /* Set by Store#flags= and StoreContext#flags=. Enables proxy certificate
+     * verification. */
+    DefX509Const(V_FLAG_ALLOW_PROXY_CERTS);
+    /* Set by Store#flags= and StoreContext#flags=. Enables certificate policy
+     * constraints checking. */
+    DefX509Const(V_FLAG_POLICY_CHECK);
+    /* Set by Store#flags= and StoreContext#flags=.
+     * Implies V_FLAG_POLICY_CHECK */
+    DefX509Const(V_FLAG_EXPLICIT_POLICY);
+    /* Set by Store#flags= and StoreContext#flags=.
+     * Implies V_FLAG_POLICY_CHECK */
+    DefX509Const(V_FLAG_INHIBIT_ANY);
+    /* Set by Store#flags= and StoreContext#flags=.
+     * Implies V_FLAG_POLICY_CHECK */
+    DefX509Const(V_FLAG_INHIBIT_MAP);
+    /* Set by Store#flags= and StoreContext#flags=. */
+    DefX509Const(V_FLAG_NOTIFY_POLICY);
+#if defined(X509_V_FLAG_EXTENDED_CRL_SUPPORT)
+    /* Set by Store#flags= and StoreContext#flags=. Enables some additional
+     * features including support for indirect signed CRLs. */
+    DefX509Const(V_FLAG_EXTENDED_CRL_SUPPORT);
+#endif
+#if defined(X509_V_FLAG_USE_DELTAS)
+    /* Set by Store#flags= and StoreContext#flags=. Uses delta CRLs. If not
+     * specified, deltas are ignored. */
+    DefX509Const(V_FLAG_USE_DELTAS);
+#endif
+#if defined(X509_V_FLAG_CHECK_SS_SIGNATURE)
+    /* Set by Store#flags= and StoreContext#flags=. Enables checking of the
+     * signature of the root self-signed CA. */
+    DefX509Const(V_FLAG_CHECK_SS_SIGNATURE);
+#endif
+#if defined(X509_V_FLAG_TRUSTED_FIRST)
+    /* Set by Store#flags= and StoreContext#flags=. When constructing a
+     * certificate chain, search the Store first for the issuer certificate.
+     * Enabled by default in OpenSSL >= 1.1.0. */
+    DefX509Const(V_FLAG_TRUSTED_FIRST);
+#endif
+#if defined(X509_V_FLAG_NO_ALT_CHAINS)
+    /* Set by Store#flags= and StoreContext#flags=. Suppresses searching for
+     * a alternative chain. No effect in OpenSSL >= 1.1.0. */
+    DefX509Const(V_FLAG_NO_ALT_CHAINS);
+#endif
+#if defined(X509_V_FLAG_NO_CHECK_TIME)
+    /* Set by Store#flags= and StoreContext#flags=. Suppresses checking the
+     * validity period of certificates and CRLs. No effect when the current
+     * time is explicitly set by Store#time= or StoreContext#time=. */
+    DefX509Const(V_FLAG_NO_CHECK_TIME);
 #endif
 
+    /* Set by Store#purpose=. SSL/TLS client. */
     DefX509Const(PURPOSE_SSL_CLIENT);
+    /* Set by Store#purpose=. SSL/TLS server. */
     DefX509Const(PURPOSE_SSL_SERVER);
+    /* Set by Store#purpose=. Netscape SSL server. */
     DefX509Const(PURPOSE_NS_SSL_SERVER);
+    /* Set by Store#purpose=. S/MIME signing. */
     DefX509Const(PURPOSE_SMIME_SIGN);
+    /* Set by Store#purpose=. S/MIME encryption. */
     DefX509Const(PURPOSE_SMIME_ENCRYPT);
+    /* Set by Store#purpose=. CRL signing */
     DefX509Const(PURPOSE_CRL_SIGN);
+    /* Set by Store#purpose=. No checks. */
     DefX509Const(PURPOSE_ANY);
-#if defined(X509_PURPOSE_OCSP_HELPER)
+    /* Set by Store#purpose=. OCSP helper. */
     DefX509Const(PURPOSE_OCSP_HELPER);
+#if defined(X509_PURPOSE_TIMESTAMP_SIGN)
+    /* Set by Store#purpose=. Time stamps signer. */
+    DefX509Const(PURPOSE_TIMESTAMP_SIGN);
 #endif
 
     DefX509Const(TRUST_COMPAT);
@@ -86,11 +171,10 @@ Init_ossl_x509(void)
     DefX509Const(TRUST_SSL_SERVER);
     DefX509Const(TRUST_EMAIL);
     DefX509Const(TRUST_OBJECT_SIGN);
-#if defined(X509_TRUST_OCSP_SIGN)
     DefX509Const(TRUST_OCSP_SIGN);
-#endif
-#if defined(X509_TRUST_OCSP_REQUEST)
     DefX509Const(TRUST_OCSP_REQUEST);
+#if defined(X509_TRUST_TSA)
+    DefX509Const(TRUST_TSA);
 #endif
 
     DefX509Default(CERT_AREA, cert_area);