Skip to content

Commit 5cb3bfb

Browse files
rheniumrhenium
committed
Merge branch 'maint-3.0'
* maint-3.0: Ruby/OpenSSL 3.0.2 Fix build with LibreSSL 3.5 Fix operator precedence in OSSL_OPENSSL_PREREQ and OSSL_LIBRESSL_PREREQ Ruby/OpenSSL 2.2.3 ts: use TS_VERIFY_CTX_set_certs instead of TS_VERIFY_CTS_set_certs ocsp: disable OCSP_basic_verify() workaround on LibreSSL 3.5 test/openssl/test_pkey.rb: allow failures in test_s_generate_parameters pkey/ec: check private key validity with OpenSSL 3 Actions - update workflow to use OpenSSL 1.1.1, actions/checkout@v3 pkey/ec: fix ossl_raise() calls using cEC_POINT instead of eEC_POINT raise when EC_POINT_cmp or EC_GROUP_cmp error instead of returning true
2 parents 75bbc8a + 466d1be commit 5cb3bfb

File tree

6 files changed

+85
-17
lines changed

6 files changed

+85
-17
lines changed

‎History.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,17 @@
1+
Version 3.0.2
2+
=============
3+
4+
Merged changes in 2.2.3. Additionally, the following issues are fixed by this
5+
release.
6+
7+
Bug fixes
8+
---------
9+
10+
* Fix OpenSSL::PKey::EC#check_key not working correctly on OpenSSL 3.0.
11+
[[GitHub #563]](https://github.com/ruby/openssl/issues/563)
12+
[[GitHub #580]](https://github.com/ruby/openssl/pull/580)
13+
14+
115
Version 3.0.1
216
=============
317

@@ -124,6 +138,21 @@ Notable changes
124138
[[GitHub #342]](https://github.com/ruby/openssl/issues/342)
125139

126140

141+
Version 2.2.3
142+
=============
143+
144+
Bug fixes
145+
---------
146+
147+
* Fix serveral methods in OpenSSL::PKey::EC::Point attempting to raise an error
148+
with an incorrect class, which would end up with a TypeError.
149+
[[GitHub #570]](https://github.com/ruby/openssl/pull/570)
150+
* Fix OpenSSL::PKey::EC::Point#eql? and OpenSSL::PKey::EC::Group#eql?
151+
incorrectly treated OpenSSL's internal errors as "not equal".
152+
[[GitHub #564]](https://github.com/ruby/openssl/pull/564)
153+
* Fix build with LibreSSL 3.5 or later.
154+
155+
127156
Version 2.2.2
128157
=============
129158

‎ext/openssl/ossl_pkey_ec.c

Lines changed: 33 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -483,16 +483,28 @@ static VALUE ossl_ec_key_check_key(VALUE self)
483483
#ifdef HAVE_EVP_PKEY_CHECK
484484
EVP_PKEY *pkey;
485485
EVP_PKEY_CTX *pctx;
486-
int ret;
486+
EC_KEY *ec;
487487

488488
GetPKey(self, pkey);
489+
GetEC(self, ec);
489490
pctx = EVP_PKEY_CTX_new(pkey, /* engine */NULL);
490491
if (!pctx)
491-
ossl_raise(eDHError, "EVP_PKEY_CTX_new");
492-
ret = EVP_PKEY_public_check(pctx);
492+
ossl_raise(eECError, "EVP_PKEY_CTX_new");
493+
494+
if (EC_KEY_get0_private_key(ec) != NULL) {
495+
if (EVP_PKEY_check(pctx) != 1) {
496+
EVP_PKEY_CTX_free(pctx);
497+
ossl_raise(eECError, "EVP_PKEY_check");
498+
}
499+
}
500+
else {
501+
if (EVP_PKEY_public_check(pctx) != 1) {
502+
EVP_PKEY_CTX_free(pctx);
503+
ossl_raise(eECError, "EVP_PKEY_public_check");
504+
}
505+
}
506+
493507
EVP_PKEY_CTX_free(pctx);
494-
if (ret != 1)
495-
ossl_raise(eECError, "EVP_PKEY_public_check");
496508
#else
497509
EC_KEY *ec;
498510

@@ -668,10 +680,11 @@ static VALUE ossl_ec_group_eql(VALUE a, VALUE b)
668680
GetECGroup(a, group1);
669681
GetECGroup(b, group2);
670682

671-
if (EC_GROUP_cmp(group1, group2, ossl_bn_ctx) == 1)
672-
return Qfalse;
673-
674-
return Qtrue;
683+
switch (EC_GROUP_cmp(group1, group2, ossl_bn_ctx)) {
684+
case 0: return Qtrue;
685+
case 1: return Qfalse;
686+
default: ossl_raise(eEC_GROUP, "EC_GROUP_cmp");
687+
}
675688
}
676689

677690
/*
@@ -1232,10 +1245,13 @@ static VALUE ossl_ec_point_eql(VALUE a, VALUE b)
12321245
GetECPoint(b, point2);
12331246
GetECGroup(group_v1, group);
12341247

1235-
if (EC_POINT_cmp(group, point1, point2, ossl_bn_ctx) == 1)
1236-
return Qfalse;
1248+
switch (EC_POINT_cmp(group, point1, point2, ossl_bn_ctx)) {
1249+
case 0: return Qtrue;
1250+
case 1: return Qfalse;
1251+
default: ossl_raise(eEC_POINT, "EC_POINT_cmp");
1252+
}
12371253

1238-
return Qtrue;
1254+
UNREACHABLE;
12391255
}
12401256

12411257
/*
@@ -1253,7 +1269,7 @@ static VALUE ossl_ec_point_is_at_infinity(VALUE self)
12531269
switch (EC_POINT_is_at_infinity(group, point)) {
12541270
case 1: return Qtrue;
12551271
case 0: return Qfalse;
1256-
default: ossl_raise(cEC_POINT, "EC_POINT_is_at_infinity");
1272+
default: ossl_raise(eEC_POINT, "EC_POINT_is_at_infinity");
12571273
}
12581274

12591275
UNREACHABLE;
@@ -1274,7 +1290,7 @@ static VALUE ossl_ec_point_is_on_curve(VALUE self)
12741290
switch (EC_POINT_is_on_curve(group, point, ossl_bn_ctx)) {
12751291
case 1: return Qtrue;
12761292
case 0: return Qfalse;
1277-
default: ossl_raise(cEC_POINT, "EC_POINT_is_on_curve");
1293+
default: ossl_raise(eEC_POINT, "EC_POINT_is_on_curve");
12781294
}
12791295

12801296
UNREACHABLE;
@@ -1297,7 +1313,7 @@ static VALUE ossl_ec_point_make_affine(VALUE self)
12971313
rb_warn("OpenSSL::PKey::EC::Point#make_affine! is deprecated");
12981314
#if !OSSL_OPENSSL_PREREQ(3, 0, 0)
12991315
if (EC_POINT_make_affine(group, point, ossl_bn_ctx) != 1)
1300-
ossl_raise(cEC_POINT, "EC_POINT_make_affine");
1316+
ossl_raise(eEC_POINT, "EC_POINT_make_affine");
13011317
#endif
13021318

13031319
return self;
@@ -1316,7 +1332,7 @@ static VALUE ossl_ec_point_invert(VALUE self)
13161332
GetECPointGroup(self, group);
13171333

13181334
if (EC_POINT_invert(group, point, ossl_bn_ctx) != 1)
1319-
ossl_raise(cEC_POINT, "EC_POINT_invert");
1335+
ossl_raise(eEC_POINT, "EC_POINT_invert");
13201336

13211337
return self;
13221338
}
@@ -1334,7 +1350,7 @@ static VALUE ossl_ec_point_set_to_infinity(VALUE self)
13341350
GetECPointGroup(self, group);
13351351

13361352
if (EC_POINT_set_to_infinity(group, point) != 1)
1337-
ossl_raise(cEC_POINT, "EC_POINT_set_to_infinity");
1353+
ossl_raise(eEC_POINT, "EC_POINT_set_to_infinity");
13381354

13391355
return self;
13401356
}

‎test/openssl/fixtures/pkey/p256_too_large.pem

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN EC PRIVATE KEY-----
2+
MHcCAQEEIP+TT0V8Fndsnacji9tyf6hmhHywcOWTee9XkiBeJoVloAoGCCqGSM49
3+
AwEHoUQDQgAEBkhhJIU/2/YdPSlY2I1k25xjK4trr5OXSgXvBC21PtY0HQ7lor7A
4+
jzT0giJITqmcd81fwGw5+96zLcdxTF1hVQ==
5+
-----END EC PRIVATE KEY-----

‎test/openssl/fixtures/pkey/p384_invalid.pem

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
-----BEGIN EC PRIVATE KEY-----
2+
MIGkAgEBBDDA1Tm0m7YhkfeVpFuarAJYVlHp2tQj+1fOBiLa10t9E8TiQO/hVfxB
3+
vGaVEQwOheWgBwYFK4EEACKhZANiAASyGqmryZGqdpsq5gEDIfNvgC3AwSJxiBCL
4+
XKHBTFRp+tCezLDOK/6V8KK/vVGBJlGFW6/I7ahyXprxS7xs7hPA9iz5YiuqXlu+
5+
lbrIpZOz7b73hyQQCkvbBO/Avg+hPAk=
6+
-----END EC PRIVATE KEY-----

‎test/openssl/test_pkey.rb

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,11 @@ def test_s_generate_parameters
4747
raise "exit!" if cb_called.size == 3
4848
}
4949
}
50+
if !cb_called && openssl?(3, 0, 0) && !openssl?(3, 0, 6)
51+
# Errors in BN_GENCB were not properly handled. This special pend is to
52+
# suppress failures on Ubuntu 22.04, which uses OpenSSL 3.0.2.
53+
pend "unstable test on OpenSSL 3.0.[0-5]"
54+
end
5055
assert_not_empty cb_called
5156
end
5257

‎test/openssl/test_pkey_ec.rb

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,13 @@ def test_check_key
9090
assert_equal(true, key2.public?)
9191
assert_equal(true, key2.check_key)
9292

93+
# Behavior of EVP_PKEY_public_check changes between OpenSSL 1.1.1 and 3.0
94+
key4 = Fixtures.pkey("p256_too_large")
95+
assert_raise(OpenSSL::PKey::ECError) { key4.check_key }
96+
97+
key5 = Fixtures.pkey("p384_invalid")
98+
assert_raise(OpenSSL::PKey::ECError) { key5.check_key }
99+
93100
# EC#private_key= is deprecated in 3.0 and won't work on OpenSSL 3.0
94101
if !openssl?(3, 0, 0)
95102
key2.private_key += 1

0 commit comments

Comments
 (0)