Skip to content

Commit fce44db

Browse files
Bo98Bo98
authored
Update openssl gem to 3.3.1 for Ruby 3.4 (ruby#14792)
Update openssl gem to 3.3.1 [Backport #21631]
1 parent 17877eb commit fce44db

File tree

11 files changed

+91
-43
lines changed

11 files changed

+91
-43
lines changed

‎ext/openssl/History.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
Version 3.3.1
2+
=============
3+
4+
Merged changes in 3.1.2 and 3.2.2.
5+
6+
17
Version 3.3.0
28
=============
39

@@ -74,6 +80,12 @@ And various non-user-visible changes and bug fixes. Please see the commit
7480
history for more details.
7581

7682

83+
Version 3.2.2
84+
=============
85+
86+
Merged changes in 3.1.2.
87+
88+
7789
Version 3.2.1
7890
=============
7991

@@ -120,6 +132,23 @@ Notable changes
120132
[[GitHub #141]](https://github.com/ruby/openssl/pull/141)
121133

122134

135+
Version 3.1.2
136+
=============
137+
138+
Bug fixes
139+
---------
140+
141+
* Fix crash when attempting to export an incomplete `OpenSSL::PKey::DSA` key.
142+
[[GitHub #845]](https://github.com/ruby/openssl/issues/845)
143+
[[GitHub #847]](https://github.com/ruby/openssl/pull/847)
144+
* Remove the `OpenSSL::X509::V_FLAG_CRL_CHECK_ALL` flag from the default store
145+
used by `OpenSSL::SSL::SSLContext#set_params`. It causes certificate
146+
verification to fail with OpenSSL 3.6.0. It has no effect with any other
147+
OpenSSL versions.
148+
[[GitHub #949]](https://github.com/ruby/openssl/issues/949)
149+
[[GitHub #950]](https://github.com/ruby/openssl/pull/950)
150+
151+
123152
Version 3.1.1
124153
=============
125154

‎ext/openssl/extconf.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040

4141
$defs.push("-D""OPENSSL_SUPPRESS_DEPRECATED")
4242

43-
have_func("rb_io_descriptor", "ruby/io.h")
43+
have_func("rb_io_descriptor")
4444
have_func("rb_io_maybe_wait(0, Qnil, Qnil, Qnil)", "ruby/io.h") # Ruby 3.1
4545
have_func("rb_io_timeout", "ruby/io.h")
4646

‎ext/openssl/lib/openssl/ssl.rb‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,6 @@ class SSLContext
9292

9393
DEFAULT_CERT_STORE = OpenSSL::X509::Store.new # :nodoc:
9494
DEFAULT_CERT_STORE.set_default_paths
95-
DEFAULT_CERT_STORE.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
9695

9796
# A callback invoked when DH parameters are required for ephemeral DH key
9897
# exchange.

‎ext/openssl/lib/openssl/version.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# frozen_string_literal: true
22

33
module OpenSSL
4-
VERSION = "3.3.0"
4+
VERSION = "3.3.1"
55
end

‎ext/openssl/openssl.gemspec‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Gem::Specification.new do |spec|
22
spec.name = "openssl"
3-
spec.version = "3.3.0"
3+
spec.version = "3.3.1"
44
spec.authors = ["Martin Bosslet", "SHIBATA Hiroshi", "Zachary Scott", "Kazuki Yamaguchi"]
55
spec.email = ["[email protected]"]
66
spec.summary = %q{SSL/TLS and general-purpose cryptography for Ruby}

‎ext/openssl/ossl_pkey.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -937,6 +937,7 @@ ossl_pkey_export_spki(VALUE self, int to_der)
937937
BIO *bio;
938938

939939
GetPKey(self, pkey);
940+
ossl_pkey_check_public_key(pkey);
940941
bio = BIO_new(BIO_s_mem());
941942
if (!bio)
942943
ossl_raise(ePKeyError, "BIO_new");

‎ext/openssl/ossl_ssl.c‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1959,9 +1959,10 @@ ossl_ssl_read_internal(int argc, VALUE *argv, VALUE self, int nonblock)
19591959

19601960
VALUE io = rb_attr_get(self, id_i_io);
19611961

1962-
rb_str_locktmp(str);
19631962
for (;;) {
1963+
rb_str_locktmp(str);
19641964
int nread = SSL_read(ssl, RSTRING_PTR(str), ilen);
1965+
rb_str_unlocktmp(str);
19651966

19661967
cb_state = rb_attr_get(self, ID_callback_state);
19671968
if (!NIL_P(cb_state)) {
@@ -1972,32 +1973,27 @@ ossl_ssl_read_internal(int argc, VALUE *argv, VALUE self, int nonblock)
19721973

19731974
switch (ssl_get_error(ssl, nread)) {
19741975
case SSL_ERROR_NONE:
1975-
rb_str_unlocktmp(str);
19761976
rb_str_set_len(str, nread);
19771977
return str;
19781978
case SSL_ERROR_ZERO_RETURN:
1979-
rb_str_unlocktmp(str);
19801979
if (no_exception_p(opts)) { return Qnil; }
19811980
rb_eof_error();
19821981
case SSL_ERROR_WANT_WRITE:
19831982
if (nonblock) {
1984-
rb_str_unlocktmp(str);
19851983
if (no_exception_p(opts)) { return sym_wait_writable; }
19861984
write_would_block(nonblock);
19871985
}
19881986
io_wait_writable(io);
1989-
continue;
1987+
break;
19901988
case SSL_ERROR_WANT_READ:
19911989
if (nonblock) {
1992-
rb_str_unlocktmp(str);
19931990
if (no_exception_p(opts)) { return sym_wait_readable; }
19941991
read_would_block(nonblock);
19951992
}
19961993
io_wait_readable(io);
1997-
continue;
1994+
break;
19981995
case SSL_ERROR_SYSCALL:
19991996
if (!ERR_peek_error()) {
2000-
rb_str_unlocktmp(str);
20011997
if (errno)
20021998
rb_sys_fail(0);
20031999
else {
@@ -2014,9 +2010,13 @@ ossl_ssl_read_internal(int argc, VALUE *argv, VALUE self, int nonblock)
20142010
}
20152011
/* fall through */
20162012
default:
2017-
rb_str_unlocktmp(str);
20182013
ossl_raise(eSSLError, "SSL_read");
20192014
}
2015+
2016+
// Ensure the buffer is not modified during io_wait_*able()
2017+
rb_str_modify(str);
2018+
if (rb_str_capacity(str) < (size_t)ilen)
2019+
rb_raise(eSSLError, "read buffer was modified");
20202020
}
20212021
}
20222022

‎test/openssl/test_bn.rb‎

Lines changed: 28 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -343,28 +343,36 @@ def test_get_flags_and_set_flags
343343
assert_equal(4, e.get_flags(OpenSSL::BN::CONSTTIME))
344344
end
345345

346-
if respond_to?(:ractor)
346+
if defined?(Ractor) && respond_to?(:ractor)
347+
unless Ractor.method_defined?(:value) # Ruby 3.4 or earlier
348+
using Module.new {
349+
refine Ractor do
350+
alias value take
351+
end
352+
}
353+
end
354+
347355
ractor
348356
def test_ractor
349-
assert_equal(@e1, Ractor.new { OpenSSL::BN.new("999") }.take)
350-
assert_equal(@e3, Ractor.new { OpenSSL::BN.new("\a\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF", 2) }.take)
351-
assert_equal("999", Ractor.new(@e1) { |e1| e1.to_s }.take)
352-
assert_equal("07FFFFFFFFFFFFFFFFFFFFFFFFFF", Ractor.new(@e3) { |e3| e3.to_s(16) }.take)
353-
assert_equal(2**107-1, Ractor.new(@e3) { _1.to_i }.take)
354-
assert_equal([1000, -999], Ractor.new(@e2) { _1.coerce(1000) }.take)
355-
assert_equal(false, Ractor.new { 1.to_bn.zero? }.take)
356-
assert_equal(true, Ractor.new { 1.to_bn.one? }.take)
357-
assert_equal(true, Ractor.new(@e2) { _1.negative? }.take)
358-
assert_equal("-03E7", Ractor.new(@e2) { _1.to_s(16) }.take)
359-
assert_equal(2**107-1, Ractor.new(@e3) { _1.to_i }.take)
360-
assert_equal([1000, -999], Ractor.new(@e2) { _1.coerce(1000) }.take)
361-
assert_equal(true, Ractor.new { 0.to_bn.zero? }.take)
362-
assert_equal(true, Ractor.new { 1.to_bn.one? }.take )
363-
assert_equal(false,Ractor.new { 2.to_bn.odd? }.take)
364-
assert_equal(true, Ractor.new(@e2) { _1.negative? }.take)
365-
assert_include(128..255, Ractor.new { OpenSSL::BN.rand(8)}.take)
366-
assert_include(0...2**32, Ractor.new { OpenSSL::BN.generate_prime(32) }.take)
367-
assert_equal(0, Ractor.new { OpenSSL::BN.new(999).get_flags(OpenSSL::BN::CONSTTIME) }.take)
357+
assert_equal(@e1, Ractor.new { OpenSSL::BN.new("999") }.value)
358+
assert_equal(@e3, Ractor.new { OpenSSL::BN.new("\a\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF", 2) }.value)
359+
assert_equal("999", Ractor.new(@e1) { |e1| e1.to_s }.value)
360+
assert_equal("07FFFFFFFFFFFFFFFFFFFFFFFFFF", Ractor.new(@e3) { |e3| e3.to_s(16) }.value)
361+
assert_equal(2**107-1, Ractor.new(@e3) { _1.to_i }.value)
362+
assert_equal([1000, -999], Ractor.new(@e2) { _1.coerce(1000) }.value)
363+
assert_equal(false, Ractor.new { 1.to_bn.zero? }.value)
364+
assert_equal(true, Ractor.new { 1.to_bn.one? }.value)
365+
assert_equal(true, Ractor.new(@e2) { _1.negative? }.value)
366+
assert_equal("-03E7", Ractor.new(@e2) { _1.to_s(16) }.value)
367+
assert_equal(2**107-1, Ractor.new(@e3) { _1.to_i }.value)
368+
assert_equal([1000, -999], Ractor.new(@e2) { _1.coerce(1000) }.value)
369+
assert_equal(true, Ractor.new { 0.to_bn.zero? }.value)
370+
assert_equal(true, Ractor.new { 1.to_bn.one? }.value )
371+
assert_equal(false,Ractor.new { 2.to_bn.odd? }.value)
372+
assert_equal(true, Ractor.new(@e2) { _1.negative? }.value)
373+
assert_include(128..255, Ractor.new { OpenSSL::BN.rand(8)}.value)
374+
assert_include(0...2**32, Ractor.new { OpenSSL::BN.generate_prime(32) }.value)
375+
assert_equal(0, Ractor.new { OpenSSL::BN.new(999).get_flags(OpenSSL::BN::CONSTTIME) }.value)
368376
# test if shareable when frozen
369377
assert Ractor.shareable?(@e1.freeze)
370378
end

‎test/openssl/test_ossl.rb‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -42,12 +42,6 @@ def test_secure_compare
4242
end
4343

4444
def test_memcmp_timing
45-
begin
46-
require "benchmark"
47-
rescue LoadError
48-
pend "Benchmark is not available in this environment. Please install it with `gem install benchmark`."
49-
end
50-
5145
# Ensure using fixed_length_secure_compare takes almost exactly the same amount of time to compare two different strings.
5246
# Regular string comparison will short-circuit on the first non-matching character, failing this test.
5347
# NOTE: this test may be susceptible to noise if the system running the tests is otherwise under load.
@@ -58,8 +52,14 @@ def test_memcmp_timing
5852

5953
a_b_time = a_c_time = 0
6054
100.times do
61-
a_b_time += Benchmark.measure { 100.times { OpenSSL.fixed_length_secure_compare(a, b) } }.real
62-
a_c_time += Benchmark.measure { 100.times { OpenSSL.fixed_length_secure_compare(a, c) } }.real
55+
t1 = Process.clock_gettime(Process::CLOCK_MONOTONIC)
56+
100.times { OpenSSL.fixed_length_secure_compare(a, b) }
57+
t2 = Process.clock_gettime(Process::CLOCK_MONOTONIC)
58+
100.times { OpenSSL.fixed_length_secure_compare(a, c) }
59+
t3 = Process.clock_gettime(Process::CLOCK_MONOTONIC)
60+
61+
a_b_time += t2 - t1
62+
a_c_time += t3 - t2
6363
end
6464
assert_operator(a_b_time, :<, a_c_time * 10, "fixed_length_secure_compare timing test failed")
6565
assert_operator(a_c_time, :<, a_b_time * 10, "fixed_length_secure_compare timing test failed")

‎test/openssl/test_pkey_dsa.rb‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,12 @@ def test_new_break
3333
end
3434
end
3535

36+
def test_new_empty
37+
key = OpenSSL::PKey::DSA.new
38+
assert_nil(key.p)
39+
assert_raise(OpenSSL::PKey::PKeyError) { key.to_der }
40+
end
41+
3642
def test_generate
3743
# DSA.generate used to call DSA_generate_parameters_ex(), which adjusts the
3844
# size of q according to the size of p

0 commit comments

Comments
 (0)