kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity
ruby--ruby/ext/openssl/History.md
rhe df94c66f71 openssl: import v2.0.5 
Import Ruby/OpenSSL 2.0.5. The full commit history since v2.0.4
(imported at r59081) can be found at:

	https://github.com/ruby/openssl/compare/v2.0.4...v2.0.5

This will fix the test failure on latest Debian sid and the "no
OPENSSL_Applink" issue on mswin.

----------------------------------------------------------------
Kazuki Yamaguchi (11):
      test/test_ssl: allow 3DES cipher suites in test_sslctx_set_params
      bio: prevent possible GC issue in ossl_obj2bio()
      bio: do not use the FILE BIO method in ossl_obj2bio()
      Rakefile: install_dependencies: install only when needed
      appveyor.yml: test against Ruby 2.4
      ossl_pem_passwd_cb: relax passphrase length constraint
      ossl_pem_passwd_cb: do not check for taintedness
      ossl_pem_passwd_cb: handle nil from the block explicitly
      ssl: remove unsupported TLS versions from SSLContext::METHODS
      ssl: fix compile error with OpenSSL 1.0.0
      Ruby/OpenSSL 2.0.5

Lars Kanis (1):
      Add msys2 library dependency tag in gem metadata

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59567 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
2017-08-10 09:23:45 +00:00

6.6 KiB
Raw Blame History

Version 2.0.5

Bug fixes

  • Reading a PEM/DER-encoded private key or certificate from an IO object did not work properly on mswin platforms. [ruby/openssl#128]
  • Broken length check in the PEM passphrase callback is fixed.
  • It failed to compile when OpenSSL is configured without TLS 1.0 support.

Version 2.0.4

Bug fixes

  • It now compiles with LibreSSL without renaming on Windows (mswin).
  • A workaround for the error queue leak of X509_load_cert_crl_file() that causes random errors is added. [Bug #11033]

Version 2.0.3

Bug fixes

  • OpenSSL::ASN1::Constructive#each which was broken by 2.0.0 is fixed. [ruby/openssl#96]
  • Fixed build with static OpenSSL libraries on Windows. [Bug #13080]
  • OpenSSL::X509::Name#eql? which was broken by 2.0.0 is fixed.

Version 2.0.2

Bug fixes

  • Fix build with early 0.9.8 series which did not have SSL_CTX_clear_options(). [ruby-core:78693]

Version 2.0.1

Bug fixes

Version 2.0.0

This is the first release of openssl gem, formerly a standard library of Ruby, ext/openssl. This is the successor of the version included in Ruby 2.3.

Compatibility notes

  • Support for OpenSSL version 0.9.6 and 0.9.7 is completely removed. openssl gem still works with OpenSSL 0.9.8, but users are strongly encouraged to upgrade to at least 1.0.1, as OpenSSL < 1.0.1 will not receive any security fixes from the OpenSSL development team.

Supported platforms

  • OpenSSL 1.0.0, 1.0.1, 1.0.2, 1.1.0
  • OpenSSL < 0.9.8 is no longer supported.
  • LibreSSL 2.3, 2.4, 2.5
  • Ruby 2.3, 2.4

Notable changes

  • Add support for OpenSSL 1.1.0. [Feature #12324]

  • Add support for LibreSSL

  • OpenSSL::Cipher

    • OpenSSL::Cipher#key= and #iv= reject too long inputs. They used to truncate silently. [Bug #12561]

    • OpenSSL::Cipher#iv_len= is added. It allows changing IV (nonce) length if using AEAD ciphers. [Bug #8667], [Bug #10420], [GH ruby/ruby#569], [GH ruby/openssl#58]

    • OpenSSL::Cipher#auth_tag_len= is added. This sets the authentication tag length to be generated by an AEAD cipher.

  • OpenSSL::OCSP

    • Accessor methods are added to OpenSSL::OCSP::CertificateId. [Feature #7181]

    • OpenSSL::OCSP::Request and BasicResponse can be signed with non-SHA-1 hash algorithm. [Feature #11552]

    • OpenSSL::OCSP::CertificateId and BasicResponse can be encoded into DER.

    • A new class OpenSSL::OCSP::SingleResponse is added for convenience.

    • OpenSSL::OCSP::BasicResponse#add_status accepts absolute times. They used to accept only relative seconds from the current time.

  • OpenSSL::PKey

    • OpenSSL::PKey::EC follows the general PKey interface. [Bug #6567]

    • OpenSSL::PKey.read raises OpenSSL::PKey::PKeyError instead of ArgumentError for consistency with OpenSSL::PKey::{DH,DSA,RSA,EC}#new. [Bug #11774], [GH ruby/openssl#55]

    • OpenSSL::PKey::EC::Group retrieved by OpenSSL::PKey::EC#group is no longer linked with the EC key. Modifications to the EC::Group have no effect on the key. [GH ruby/openssl#71]

    • OpenSSL::PKey::EC::Point#to_bn allows specifying the point conversion form by the optional argument.

  • OpenSSL::SSL

    • OpenSSL::SSL::SSLSocket#tmp_key is added. A client can call it after the connection is established to retrieve the ephemeral key. [GH ruby/ruby#1318]

    • The automatic ephemeral ECDH curve selection is enabled by default when built with OpenSSL >= 1.0.2 or LibreSSL.

    • OpenSSL::SSL::SSLContext#security_level= is added. You can set the "security level" of the SSL context. This is effective only when built with OpenSSL 1.1.0.

    • A new option 'verify_hostname' is added to OpenSSL::SSL::SSLContext. When it is enabled, and the SNI hostname is also set, the hostname verification on the server certificate is automatically performed. It is now enabled by OpenSSL::SSL::Context#set_params. [GH ruby/openssl#60]

Removals

  • OpenSSL::Engine

    • OpenSSL::Engine.cleanup does nothing when built with OpenSSL 1.1.0.

  • OpenSSL::SSL

    • OpenSSL::PKey::DH::DEFAULT_512 is removed. Hence servers no longer use 512-bit DH group by default. It is considered too weak nowadays. [Bug #11968], [GH ruby/ruby#1196]

    • RC4 cipher suites are removed from OpenSSL::SSL::SSLContext::DEFAULT_PARAMS. RC4 is now considered to be weak. [GH ruby/openssl#50]

Deprecations

  • OpenSSL::PKey

    • OpenSSL::PKey::RSA#n=, #e=, #d=, #p=, #q=, #dmp1=, #dmq1=, #iqmp=, OpenSSL::PKey::DSA#p=, #q=, #g=, #priv_key=, #pub_key=, OpenSSL::PKey::DH#p=, #g=, #priv_key= and #pub_key= are deprecated. They are disabled when built with OpenSSL 1.1.0, due to its API change. Instead, OpenSSL::PKey::RSA#set_key, #set_factors, #set_crt_params, OpenSSL::PKey::DSA#set_pqg, #set_key, OpenSSL::PKey::DH#set_pqg and #set_key are added.

  • OpenSSL::Random

    • OpenSSL::Random.pseudo_bytes is deprecated, and not defined when built with OpenSSL 1.1.0. Use OpenSSL::Random.random_bytes instead.

  • OpenSSL::SSL

    • OpenSSL::SSL::SSLContext#tmp_ecdh_callback is deprecated, as the underlying API SSL_CTX_set_tmp_ecdh_callback() is removed in OpenSSL 1.1.0. It was first added in Ruby 2.3.0. To specify the curve to be used in ephemeral ECDH, use OpenSSL::SSL::SSLContext#ecdh_curves=. The automatic curve selection is also now enabled by default when built with a capable OpenSSL.