Ruby 2.1.5p273(2014-11-13revision48405)

- Main Page
- Modules
- Data Structures
- Files

- File List
- Globals

ossl_ssl.c
Go to the documentation of this file.
1 /*
2 * $Id: ossl_ssl.c 44710 2014-01-27 07:47:11Z naruse $
3 * 'OpenSSL for Ruby' project
4 * Copyright (C) 2000-2002 GOTOU Yuuzou <gotoyuzo@notwork.org>
5 * Copyright (C) 2001-2002 Michal Rokos <m.rokos@sh.cvut.cz>
6 * Copyright (C) 2001-2007 Technorama Ltd. <oss-ruby@technorama.net>
7 * All rights reserved.
8 */
9 /*
10 * This program is licenced under the same licence as Ruby.
11 * (See the file 'LICENCE'.)
12 */
13 #include "ossl.h"
14
15 #if defined(HAVE_UNISTD_H)
16 # include <unistd.h> /* for read(), and write() */
17 #endif
18
19 #define numberof(ary) (int)(sizeof(ary)/sizeof((ary)[0]))
20
21 #ifdef _WIN32
22 # define TO_SOCKET(s) _get_osfhandle(s)
23 #else
24 # define TO_SOCKET(s) (s)
25 #endif
26
27 VALUE mSSL;
28 VALUE eSSLError;
29 VALUE cSSLContext;
30 VALUE cSSLSocket;
31
32 static VALUE eSSLErrorWaitReadable;
33 static VALUE eSSLErrorWaitWritable;
34
35 #define ossl_sslctx_set_cert(o,v) rb_iv_set((o),"@cert",(v))
36 #define ossl_sslctx_set_key(o,v) rb_iv_set((o),"@key",(v))
37 #define ossl_sslctx_set_client_ca(o,v) rb_iv_set((o),"@client_ca",(v))
38 #define ossl_sslctx_set_ca_file(o,v) rb_iv_set((o),"@ca_file",(v))
39 #define ossl_sslctx_set_ca_path(o,v) rb_iv_set((o),"@ca_path",(v))
40 #define ossl_sslctx_set_timeout(o,v) rb_iv_set((o),"@timeout",(v))
41 #define ossl_sslctx_set_verify_mode(o,v) rb_iv_set((o),"@verify_mode",(v))
42 #define ossl_sslctx_set_verify_dep(o,v) rb_iv_set((o),"@verify_depth",(v))
43 #define ossl_sslctx_set_verify_cb(o,v) rb_iv_set((o),"@verify_callback",(v))
44 #define ossl_sslctx_set_options(o,v) rb_iv_set((o),"@options",(v))
45 #define ossl_sslctx_set_cert_store(o,v) rb_iv_set((o),"@cert_store",(v))
46 #define ossl_sslctx_set_extra_cert(o,v) rb_iv_set((o),"@extra_chain_cert",(v))
47 #define ossl_sslctx_set_client_cert_cb(o,v) rb_iv_set((o),"@client_cert_cb",(v))
48 #define ossl_sslctx_set_tmp_dh_cb(o,v) rb_iv_set((o),"@tmp_dh_callback",(v))
49 #define ossl_sslctx_set_sess_id_ctx(o, v) rb_iv_set((o),"@session_id_context",(v))
50
51 #define ossl_sslctx_get_cert(o) rb_iv_get((o),"@cert")
52 #define ossl_sslctx_get_key(o) rb_iv_get((o),"@key")
53 #define ossl_sslctx_get_client_ca(o) rb_iv_get((o),"@client_ca")
54 #define ossl_sslctx_get_ca_file(o) rb_iv_get((o),"@ca_file")
55 #define ossl_sslctx_get_ca_path(o) rb_iv_get((o),"@ca_path")
56 #define ossl_sslctx_get_timeout(o) rb_iv_get((o),"@timeout")
57 #define ossl_sslctx_get_verify_mode(o) rb_iv_get((o),"@verify_mode")
58 #define ossl_sslctx_get_verify_dep(o) rb_iv_get((o),"@verify_depth")
59 #define ossl_sslctx_get_verify_cb(o) rb_iv_get((o),"@verify_callback")
60 #define ossl_sslctx_get_options(o) rb_iv_get((o),"@options")
61 #define ossl_sslctx_get_cert_store(o) rb_iv_get((o),"@cert_store")
62 #define ossl_sslctx_get_extra_cert(o) rb_iv_get((o),"@extra_chain_cert")
63 #define ossl_sslctx_get_client_cert_cb(o) rb_iv_get((o),"@client_cert_cb")
64 #define ossl_sslctx_get_tmp_dh_cb(o) rb_iv_get((o),"@tmp_dh_callback")
65 #define ossl_sslctx_get_sess_id_ctx(o) rb_iv_get((o),"@session_id_context")
66
67 static const char *ossl_sslctx_attrs[] = {
68 "cert", "key", "client_ca", "ca_file", "ca_path",
69 "timeout", "verify_mode", "verify_depth", "renegotiation_cb",
70 "verify_callback", "options", "cert_store", "extra_chain_cert",
71 "client_cert_cb", "tmp_dh_callback", "session_id_context",
72 "session_get_cb", "session_new_cb", "session_remove_cb",
73 #ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME
74 "servername_cb",
75 #endif
76 #ifdef HAVE_OPENSSL_NPN_NEGOTIATED
77 "npn_protocols",
78 "npn_select_cb",
79 #endif
80 };
81
82 #define ossl_ssl_get_io(o) rb_iv_get((o),"@io")
83 #define ossl_ssl_get_ctx(o) rb_iv_get((o),"@context")
84 #define ossl_ssl_get_sync_close(o) rb_iv_get((o),"@sync_close")
85 #define ossl_ssl_get_x509(o) rb_iv_get((o),"@x509")
86 #define ossl_ssl_get_key(o) rb_iv_get((o),"@key")
87 #define ossl_ssl_get_tmp_dh(o) rb_iv_get((o),"@tmp_dh")
88
89 #define ossl_ssl_set_io(o,v) rb_iv_set((o),"@io",(v))
90 #define ossl_ssl_set_ctx(o,v) rb_iv_set((o),"@context",(v))
91 #define ossl_ssl_set_sync_close(o,v) rb_iv_set((o),"@sync_close",(v))
92 #define ossl_ssl_set_x509(o,v) rb_iv_set((o),"@x509",(v))
93 #define ossl_ssl_set_key(o,v) rb_iv_set((o),"@key",(v))
94 #define ossl_ssl_set_tmp_dh(o,v) rb_iv_set((o),"@tmp_dh",(v))
95
96 static const char *ossl_ssl_attr_readers[] = { "io", "context", };
97 static const char *ossl_ssl_attrs[] = {
98 #ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME
99 "hostname",
100 #endif
101 "sync_close",
102 };
103
104 ID ID_callback_state;
105
106 static VALUE sym_exception;
107
108 /*
109 * SSLContext class
110 */
111 struct {
112 const char *name;
113 SSL_METHOD *(*func)(void);
114 } ossl_ssl_method_tab[] = {
115 #define OSSL_SSL_METHOD_ENTRY(name) { #name, (SSL_METHOD *(*)(void))name##_method }
116 OSSL_SSL_METHOD_ENTRY(TLSv1),
117 OSSL_SSL_METHOD_ENTRY(TLSv1_server),
118 OSSL_SSL_METHOD_ENTRY(TLSv1_client),
119 #if defined(HAVE_TLSV1_2_METHOD) && defined(HAVE_TLSV1_2_SERVER_METHOD) && \
120 defined(HAVE_TLSV1_2_CLIENT_METHOD)
121 OSSL_SSL_METHOD_ENTRY(TLSv1_2),
122 OSSL_SSL_METHOD_ENTRY(TLSv1_2_server),
123 OSSL_SSL_METHOD_ENTRY(TLSv1_2_client),
124 #endif
125 #if defined(HAVE_TLSV1_1_METHOD) && defined(HAVE_TLSV1_1_SERVER_METHOD) && \
126 defined(HAVE_TLSV1_1_CLIENT_METHOD)
127 OSSL_SSL_METHOD_ENTRY(TLSv1_1),
128 OSSL_SSL_METHOD_ENTRY(TLSv1_1_server),
129 OSSL_SSL_METHOD_ENTRY(TLSv1_1_client),
130 #endif
131 #if defined(HAVE_SSLV2_METHOD) && defined(HAVE_SSLV2_SERVER_METHOD) && \
132 defined(HAVE_SSLV2_CLIENT_METHOD)
133 OSSL_SSL_METHOD_ENTRY(SSLv2),
134 OSSL_SSL_METHOD_ENTRY(SSLv2_server),
135 OSSL_SSL_METHOD_ENTRY(SSLv2_client),
136 #endif
137 OSSL_SSL_METHOD_ENTRY(SSLv3),
138 OSSL_SSL_METHOD_ENTRY(SSLv3_server),
139 OSSL_SSL_METHOD_ENTRY(SSLv3_client),
140 OSSL_SSL_METHOD_ENTRY(SSLv23),
141 OSSL_SSL_METHOD_ENTRY(SSLv23_server),
142 OSSL_SSL_METHOD_ENTRY(SSLv23_client),
143 #undef OSSL_SSL_METHOD_ENTRY
144 };
145
146 int ossl_ssl_ex_vcb_idx;
147 int ossl_ssl_ex_store_p;
148 int ossl_ssl_ex_ptr_idx;
149 int ossl_ssl_ex_client_cert_cb_idx;
150 int ossl_ssl_ex_tmp_dh_callback_idx;
151
152 static void
153 ossl_sslctx_free(SSL_CTX *ctx)
154 {
155 if(ctx && SSL_CTX_get_ex_data(ctx, ossl_ssl_ex_store_p)== (void*)1)
156 ctx->cert_store = NULL;
157 SSL_CTX_free(ctx);
158 }
159
160 static VALUE
161 ossl_sslctx_s_alloc(VALUE klass)
162 {
163 SSL_CTX *ctx;
164 long mode = SSL_MODE_ENABLE_PARTIAL_WRITE;
165
166 #ifdef SSL_MODE_RELEASE_BUFFERS
167 mode |= SSL_MODE_RELEASE_BUFFERS;
168 #endif
169
170 ctx = SSL_CTX_new(SSLv23_method());
171 if (!ctx) {
172 ossl_raise(eSSLError, "SSL_CTX_new");
173 }
174 SSL_CTX_set_mode(ctx, mode);
175 return Data_Wrap_Struct(klass, 0, ossl_sslctx_free, ctx);
176 }
177
178 /*
179 * call-seq:
180 * ctx.ssl_version = :TLSv1
181 * ctx.ssl_version = "SSLv23_client"
182 *
183 * You can get a list of valid versions with OpenSSL::SSL::SSLContext::METHODS
184 */
185 static VALUE
186 ossl_sslctx_set_ssl_version(VALUE self, VALUE ssl_method)
187 {
188 SSL_METHOD *method = NULL;
189 const char *s;
190 int i;
191
192 SSL_CTX *ctx;
193 if(TYPE(ssl_method) == T_SYMBOL)
194 s = rb_id2name(SYM2ID(ssl_method));
195 else
196 s = StringValuePtr(ssl_method);
197 for (i = 0; i < numberof(ossl_ssl_method_tab); i++) {
198 if (strcmp(ossl_ssl_method_tab[i].name, s) == 0) {
199 method = ossl_ssl_method_tab[i].func();
200 break;
201 }
202 }
203 if (!method) {
204 ossl_raise(rb_eArgError, "unknown SSL method `%s'.", s);
205 }
206 Data_Get_Struct(self, SSL_CTX, ctx);
207 if (SSL_CTX_set_ssl_version(ctx, method) != 1) {
208 ossl_raise(eSSLError, "SSL_CTX_set_ssl_version");
209 }
210
211 return ssl_method;
212 }
213
214 /*
215 * call-seq:
216 * SSLContext.new => ctx
217 * SSLContext.new(:TLSv1) => ctx
218 * SSLContext.new("SSLv23_client") => ctx
219 *
220 * You can get a list of valid methods with OpenSSL::SSL::SSLContext::METHODS
221 */
222 static VALUE
223 ossl_sslctx_initialize(int argc, VALUE *argv, VALUE self)
224 {
225 VALUE ssl_method;
226 int i;
227
228 for(i = 0; i < numberof(ossl_sslctx_attrs); i++){
229 char buf[32];
230 snprintf(buf, sizeof(buf), "@%s", ossl_sslctx_attrs[i]);
231 rb_iv_set(self, buf, Qnil);
232 }
233 if (rb_scan_args(argc, argv, "01", &ssl_method) == 0){
234 return self;
235 }
236 ossl_sslctx_set_ssl_version(self, ssl_method);
237
238 return self;
239 }
240
241 static VALUE
242 ossl_call_client_cert_cb(VALUE obj)
243 {
244 VALUE cb, ary, cert, key;
245 SSL *ssl;
246
247 Data_Get_Struct(obj, SSL, ssl);
248 cb = (VALUE)SSL_get_ex_data(ssl, ossl_ssl_ex_client_cert_cb_idx);
249 if (NIL_P(cb)) return Qfalse;
250 ary = rb_funcall(cb, rb_intern("call"), 1, obj);
251 Check_Type(ary, T_ARRAY);
252 GetX509CertPtr(cert = rb_ary_entry(ary, 0));
253 GetPKeyPtr(key = rb_ary_entry(ary, 1));
254 ossl_ssl_set_x509(obj, cert);
255 ossl_ssl_set_key(obj, key);
256
257 return Qtrue;
258 }
259
260 static int
261 ossl_client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
262 {
263 VALUE obj, success;
264
265 obj = (VALUE)SSL_get_ex_data(ssl, ossl_ssl_ex_ptr_idx);
266 success = rb_protect((VALUE(*)_((VALUE)))ossl_call_client_cert_cb,
267 obj, NULL);
268 if (!RTEST(success)) return 0;
269 *x509 = DupX509CertPtr(ossl_ssl_get_x509(obj));
270 *pkey = DupPKeyPtr(ossl_ssl_get_key(obj));
271
272 return 1;
273 }
274
275 #if !defined(OPENSSL_NO_DH)
276 static VALUE
277 ossl_call_tmp_dh_callback(VALUE *args)
278 {
279 SSL *ssl;
280 VALUE cb, dh;
281 EVP_PKEY *pkey;
282
283 Data_Get_Struct(args[0], SSL, ssl);
284 cb = (VALUE)SSL_get_ex_data(ssl, ossl_ssl_ex_tmp_dh_callback_idx);
285 if (NIL_P(cb)) return Qfalse;
286 dh = rb_funcall(cb, rb_intern("call"), 3, args[0], args[1], args[2]);
287 pkey = GetPKeyPtr(dh);
288 if (EVP_PKEY_type(pkey->type) != EVP_PKEY_DH) return Qfalse;
289 ossl_ssl_set_tmp_dh(args[0], dh);
290
291 return Qtrue;
292 }
293
294 static DH*
295 ossl_tmp_dh_callback(SSL *ssl, int is_export, int keylength)
296 {
297 VALUE args[3], success;
298
299 args[0] = (VALUE)SSL_get_ex_data(ssl, ossl_ssl_ex_ptr_idx);
300 args[1] = INT2FIX(is_export);
301 args[2] = INT2FIX(keylength);
302 success = rb_protect((VALUE(*)_((VALUE)))ossl_call_tmp_dh_callback,
303 (VALUE)args, NULL);
304 if (!RTEST(success)) return NULL;
305
306 return GetPKeyPtr(ossl_ssl_get_tmp_dh(args[0]))->pkey.dh;
307 }
308
309 static DH*
310 ossl_default_tmp_dh_callback(SSL *ssl, int is_export, int keylength)
311 {
312 rb_warning("using default DH parameters.");
313
314 switch(keylength){
315 case 512:
316 return OSSL_DEFAULT_DH_512;
317 case 1024:
318 return OSSL_DEFAULT_DH_1024;
319 }
320 return NULL;
321 }
322 #endif /* OPENSSL_NO_DH */
323
324 static int
325 ossl_ssl_verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
326 {
327 VALUE cb;
328 SSL *ssl;
329
330 ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());
331 cb = (VALUE)SSL_get_ex_data(ssl, ossl_ssl_ex_vcb_idx);
332 X509_STORE_CTX_set_ex_data(ctx, ossl_verify_cb_idx, (void*)cb);
333 return ossl_verify_cb(preverify_ok, ctx);
334 }
335
336 static VALUE
337 ossl_call_session_get_cb(VALUE ary)
338 {
339 VALUE ssl_obj, sslctx_obj, cb;
340
341 Check_Type(ary, T_ARRAY);
342 ssl_obj = rb_ary_entry(ary, 0);
343
344 sslctx_obj = rb_iv_get(ssl_obj, "@context");
345 if (NIL_P(sslctx_obj)) return Qnil;
346 cb = rb_iv_get(sslctx_obj, "@session_get_cb");
347 if (NIL_P(cb)) return Qnil;
348
349 return rb_funcall(cb, rb_intern("call"), 1, ary);
350 }
351
352 /* this method is currently only called for servers (in OpenSSL <= 0.9.8e) */
353 static SSL_SESSION *
354 ossl_sslctx_session_get_cb(SSL *ssl, unsigned char *buf, int len, int *copy)
355 {
356 VALUE ary, ssl_obj, ret_obj;
357 SSL_SESSION *sess;
358 void *ptr;
359 int state = 0;
360
361 OSSL_Debug("SSL SESSION get callback entered");
362 if ((ptr = SSL_get_ex_data(ssl, ossl_ssl_ex_ptr_idx)) == NULL)
363 return NULL;
364 ssl_obj = (VALUE)ptr;
365 ary = rb_ary_new2(2);
366 rb_ary_push(ary, ssl_obj);
367 rb_ary_push(ary, rb_str_new((const char *)buf, len));
368
369 ret_obj = rb_protect((VALUE(*)_((VALUE)))ossl_call_session_get_cb, ary, &state);
370 if (state) {
371 rb_ivar_set(ssl_obj, ID_callback_state, INT2NUM(state));
372 return NULL;
373 }
374 if (!rb_obj_is_instance_of(ret_obj, cSSLSession))
375 return NULL;
376
377 SafeGetSSLSession(ret_obj, sess);
378 *copy = 1;
379
380 return sess;
381 }
382
383 static VALUE
384 ossl_call_session_new_cb(VALUE ary)
385 {
386 VALUE ssl_obj, sslctx_obj, cb;
387
388 Check_Type(ary, T_ARRAY);
389 ssl_obj = rb_ary_entry(ary, 0);
390
391 sslctx_obj = rb_iv_get(ssl_obj, "@context");
392 if (NIL_P(sslctx_obj)) return Qnil;
393 cb = rb_iv_get(sslctx_obj, "@session_new_cb");
394 if (NIL_P(cb)) return Qnil;
395
396 return rb_funcall(cb, rb_intern("call"), 1, ary);
397 }
398
399 /* return 1 normal. return 0 removes the session */
400 static int
401 ossl_sslctx_session_new_cb(SSL *ssl, SSL_SESSION *sess)
402 {
403 VALUE ary, ssl_obj, sess_obj;
404 void *ptr;
405 int state = 0;
406
407 OSSL_Debug("SSL SESSION new callback entered");
408
409 if ((ptr = SSL_get_ex_data(ssl, ossl_ssl_ex_ptr_idx)) == NULL)
410 return 1;
411 ssl_obj = (VALUE)ptr;
412 sess_obj = rb_obj_alloc(cSSLSession);
413 CRYPTO_add(&sess->references, 1, CRYPTO_LOCK_SSL_SESSION);
414 DATA_PTR(sess_obj) = sess;
415
416 ary = rb_ary_new2(2);
417 rb_ary_push(ary, ssl_obj);
418 rb_ary_push(ary, sess_obj);
419
420 rb_protect((VALUE(*)_((VALUE)))ossl_call_session_new_cb, ary, &state);
421 if (state) {
422 rb_ivar_set(ssl_obj, ID_callback_state, INT2NUM(state));
423 }
424
425 /*
426 * return 0 which means to OpenSSL that the session is still
427 * valid (since we created Ruby Session object) and was not freed by us
428 * with SSL_SESSION_free(). Call SSLContext#remove_session(sess) in
429 * session_get_cb block if you don't want OpenSSL to cache the session
430 * internally.
431 */
432 return 0;
433 }
434
435 static VALUE
436 ossl_call_session_remove_cb(VALUE ary)
437 {
438 VALUE sslctx_obj, cb;
439
440 Check_Type(ary, T_ARRAY);
441 sslctx_obj = rb_ary_entry(ary, 0);
442
443 cb = rb_iv_get(sslctx_obj, "@session_remove_cb");
444 if (NIL_P(cb)) return Qnil;
445
446 return rb_funcall(cb, rb_intern("call"), 1, ary);
447 }
448
449 static void
450 ossl_sslctx_session_remove_cb(SSL_CTX *ctx, SSL_SESSION *sess)
451 {
452 VALUE ary, sslctx_obj, sess_obj;
453 void *ptr;
454 int state = 0;
455
456 OSSL_Debug("SSL SESSION remove callback entered");
457
458 if ((ptr = SSL_CTX_get_ex_data(ctx, ossl_ssl_ex_ptr_idx)) == NULL)
459 return;
460 sslctx_obj = (VALUE)ptr;
461 sess_obj = rb_obj_alloc(cSSLSession);
462 CRYPTO_add(&sess->references, 1, CRYPTO_LOCK_SSL_SESSION);
463 DATA_PTR(sess_obj) = sess;
464
465 ary = rb_ary_new2(2);
466 rb_ary_push(ary, sslctx_obj);
467 rb_ary_push(ary, sess_obj);
468
469 rb_protect((VALUE(*)_((VALUE)))ossl_call_session_remove_cb, ary, &state);
470 if (state) {
471 /*
472 the SSL_CTX is frozen, nowhere to save state.
473 there is no common accessor method to check it either.
474 rb_ivar_set(sslctx_obj, ID_callback_state, INT2NUM(state));
475 */
476 }
477 }
478
479 static VALUE
480 ossl_sslctx_add_extra_chain_cert_i(RB_BLOCK_CALL_FUNC_ARGLIST(i, arg))
481 {
482 X509 *x509;
483 SSL_CTX *ctx;
484
485 Data_Get_Struct(arg, SSL_CTX, ctx);
486 x509 = DupX509CertPtr(i);
487 if(!SSL_CTX_add_extra_chain_cert(ctx, x509)){
488 ossl_raise(eSSLError, NULL);
489 }
490
491 return i;
492 }
493
494 static VALUE ossl_sslctx_setup(VALUE self);
495
496 #ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME
497 static VALUE
498 ossl_call_servername_cb(VALUE ary)
499 {
500 VALUE ssl_obj, sslctx_obj, cb, ret_obj;
501
502 Check_Type(ary, T_ARRAY);
503 ssl_obj = rb_ary_entry(ary, 0);
504
505 sslctx_obj = rb_iv_get(ssl_obj, "@context");
506 if (NIL_P(sslctx_obj)) return Qnil;
507 cb = rb_iv_get(sslctx_obj, "@servername_cb");
508 if (NIL_P(cb)) return Qnil;
509
510 ret_obj = rb_funcall(cb, rb_intern("call"), 1, ary);
511 if (rb_obj_is_kind_of(ret_obj, cSSLContext)) {
512 SSL *ssl;
513 SSL_CTX *ctx2;
514
515 ossl_sslctx_setup(ret_obj);
516 Data_Get_Struct(ssl_obj, SSL, ssl);
517 Data_Get_Struct(ret_obj, SSL_CTX, ctx2);
518 SSL_set_SSL_CTX(ssl, ctx2);
519 } else if (!NIL_P(ret_obj)) {
520 ossl_raise(rb_eArgError, "servername_cb must return an OpenSSL::SSL::SSLContext object or nil");
521 }
522
523 return ret_obj;
524 }
525
526 static int
527 ssl_servername_cb(SSL *ssl, int *ad, void *arg)
528 {
529 VALUE ary, ssl_obj;
530 void *ptr;
531 int state = 0;
532 const char *servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);
533
534 if (!servername)
535 return SSL_TLSEXT_ERR_OK;
536
537 if ((ptr = SSL_get_ex_data(ssl, ossl_ssl_ex_ptr_idx)) == NULL)
538 return SSL_TLSEXT_ERR_ALERT_FATAL;
539 ssl_obj = (VALUE)ptr;
540 ary = rb_ary_new2(2);
541 rb_ary_push(ary, ssl_obj);
542 rb_ary_push(ary, rb_str_new2(servername));
543
544 rb_protect((VALUE(*)_((VALUE)))ossl_call_servername_cb, ary, &state);
545 if (state) {
546 rb_ivar_set(ssl_obj, ID_callback_state, INT2NUM(state));
547 return SSL_TLSEXT_ERR_ALERT_FATAL;
548 }
549
550 return SSL_TLSEXT_ERR_OK;
551 }
552 #endif
553
554 static void
555 ssl_renegotiation_cb(const SSL *ssl)
556 {
557 VALUE ssl_obj, sslctx_obj, cb;
558 void *ptr;
559
560 if ((ptr = SSL_get_ex_data(ssl, ossl_ssl_ex_ptr_idx)) == NULL)
561 ossl_raise(eSSLError, "SSL object could not be retrieved");
562 ssl_obj = (VALUE)ptr;
563
564 sslctx_obj = rb_iv_get(ssl_obj, "@context");
565 if (NIL_P(sslctx_obj)) return;
566 cb = rb_iv_get(sslctx_obj, "@renegotiation_cb");
567 if (NIL_P(cb)) return;
568
569 (void) rb_funcall(cb, rb_intern("call"), 1, ssl_obj);
570 }
571
572 #ifdef HAVE_OPENSSL_NPN_NEGOTIATED
573 static VALUE
574 ssl_npn_encode_protocol_i(VALUE cur, VALUE encoded)
575 {
576 int len = RSTRING_LENINT(cur);
577 char len_byte;
578 if (len < 1 || len > 255)
579 ossl_raise(eSSLError, "Advertised protocol must have length 1..255");
580 /* Encode the length byte */
581 len_byte = len;
582 rb_str_buf_cat(encoded, &len_byte, 1);
583 rb_str_buf_cat(encoded, RSTRING_PTR(cur), len);
584 return Qnil;
585 }
586
587 static void
588 ssl_npn_encode_protocols(VALUE sslctx, VALUE protocols)
589 {
590 VALUE encoded = rb_str_new2("");
591 rb_iterate(rb_each, protocols, ssl_npn_encode_protocol_i, encoded);
592 StringValueCStr(encoded);
593 rb_iv_set(sslctx, "@_protocols", encoded);
594 }
595
596 static int
597 ssl_npn_advertise_cb(SSL *ssl, const unsigned char **out, unsigned int *outlen, void *arg)
598 {
599 VALUE sslctx_obj = (VALUE) arg;
600 VALUE protocols = rb_iv_get(sslctx_obj, "@_protocols");
601
602 *out = (const unsigned char *) RSTRING_PTR(protocols);
603 *outlen = RSTRING_LENINT(protocols);
604
605 return SSL_TLSEXT_ERR_OK;
606 }
607
608 static int
609 ssl_npn_select_cb(SSL *s, unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg)
610 {
611 int i = 0;
612 VALUE sslctx_obj, cb, protocols, selected;
613
614 sslctx_obj = (VALUE) arg;
615 cb = rb_iv_get(sslctx_obj, "@npn_select_cb");
616 protocols = rb_ary_new();
617
618 /* The format is len_1|proto_1|...|len_n|proto_n\0 */
619 while (in[i]) {
620 VALUE protocol = rb_str_new((const char *) &in[i + 1], in[i]);
621 rb_ary_push(protocols, protocol);
622 i += in[i] + 1;
623 }
624
625 selected = rb_funcall(cb, rb_intern("call"), 1, protocols);
626 StringValue(selected);
627 *out = (unsigned char *) StringValuePtr(selected);
628 *outlen = RSTRING_LENINT(selected);
629
630 return SSL_TLSEXT_ERR_OK;
631 }
632 #endif
633
634 /* This function may serve as the entry point to support further
635 * callbacks. */
636 static void
637 ssl_info_cb(const SSL *ssl, int where, int val)
638 {
639 int state = SSL_state(ssl);
640
641 if ((where & SSL_CB_HANDSHAKE_START) &&
642 (state & SSL_ST_ACCEPT)) {
643 ssl_renegotiation_cb(ssl);
644 }
645 }
646
647 /*
648 * call-seq:
649 * ctx.setup => Qtrue # first time
650 * ctx.setup => nil # thereafter
651 *
652 * This method is called automatically when a new SSLSocket is created.
653 * Normally you do not need to call this method (unless you are writing an
654 * extension in C).
655 */
656 static VALUE
657 ossl_sslctx_setup(VALUE self)
658 {
659 SSL_CTX *ctx;
660 X509 *cert = NULL, *client_ca = NULL;
661 X509_STORE *store;
662 EVP_PKEY *key = NULL;
663 char *ca_path = NULL, *ca_file = NULL;
664 int i, verify_mode;
665 VALUE val;
666
667 if(OBJ_FROZEN(self)) return Qnil;
668 Data_Get_Struct(self, SSL_CTX, ctx);
669
670 #if !defined(OPENSSL_NO_DH)
671 if (RTEST(ossl_sslctx_get_tmp_dh_cb(self))){
672 SSL_CTX_set_tmp_dh_callback(ctx, ossl_tmp_dh_callback);
673 }
674 else{
675 SSL_CTX_set_tmp_dh_callback(ctx, ossl_default_tmp_dh_callback);
676 }
677 #endif
678 SSL_CTX_set_ex_data(ctx, ossl_ssl_ex_ptr_idx, (void*)self);
679
680 val = ossl_sslctx_get_cert_store(self);
681 if(!NIL_P(val)){
682 /*
683 * WORKAROUND:
684 * X509_STORE can count references, but
685 * X509_STORE_free() doesn't care it.
686 * So we won't increment it but mark it by ex_data.
687 */
688 store = GetX509StorePtr(val); /* NO NEED TO DUP */
689 SSL_CTX_set_cert_store(ctx, store);
690 SSL_CTX_set_ex_data(ctx, ossl_ssl_ex_store_p, (void*)1);
691 }
692
693 val = ossl_sslctx_get_extra_cert(self);
694 if(!NIL_P(val)){
695 rb_block_call(val, rb_intern("each"), 0, 0, ossl_sslctx_add_extra_chain_cert_i, self);
696 }
697
698 /* private key may be bundled in certificate file. */
699 val = ossl_sslctx_get_cert(self);
700 cert = NIL_P(val) ? NULL : GetX509CertPtr(val); /* NO DUP NEEDED */
701 val = ossl_sslctx_get_key(self);
702 key = NIL_P(val) ? NULL : GetPKeyPtr(val); /* NO DUP NEEDED */
703 if (cert && key) {
704 if (!SSL_CTX_use_certificate(ctx, cert)) {
705 /* Adds a ref => Safe to FREE */
706 ossl_raise(eSSLError, "SSL_CTX_use_certificate");
707 }
708 if (!SSL_CTX_use_PrivateKey(ctx, key)) {
709 /* Adds a ref => Safe to FREE */
710 ossl_raise(eSSLError, "SSL_CTX_use_PrivateKey");
711 }
712 if (!SSL_CTX_check_private_key(ctx)) {
713 ossl_raise(eSSLError, "SSL_CTX_check_private_key");
714 }
715 }
716
717 val = ossl_sslctx_get_client_ca(self);
718 if(!NIL_P(val)){
719 if(TYPE(val) == T_ARRAY){
720 for(i = 0; i < RARRAY_LEN(val); i++){
721 client_ca = GetX509CertPtr(RARRAY_PTR(val)[i]);
722 if (!SSL_CTX_add_client_CA(ctx, client_ca)){
723 /* Copies X509_NAME => FREE it. */
724 ossl_raise(eSSLError, "SSL_CTX_add_client_CA");
725 }
726 }
727 }
728 else{
729 client_ca = GetX509CertPtr(val); /* NO DUP NEEDED. */
730 if (!SSL_CTX_add_client_CA(ctx, client_ca)){
731 /* Copies X509_NAME => FREE it. */
732 ossl_raise(eSSLError, "SSL_CTX_add_client_CA");
733 }
734 }
735 }
736
737 val = ossl_sslctx_get_ca_file(self);
738 ca_file = NIL_P(val) ? NULL : StringValuePtr(val);
739 val = ossl_sslctx_get_ca_path(self);
740 ca_path = NIL_P(val) ? NULL : StringValuePtr(val);
741 if(ca_file || ca_path){
742 if (!SSL_CTX_load_verify_locations(ctx, ca_file, ca_path))
743 rb_warning("can't set verify locations");
744 }
745
746 val = ossl_sslctx_get_verify_mode(self);
747 verify_mode = NIL_P(val) ? SSL_VERIFY_NONE : NUM2INT(val);
748 SSL_CTX_set_verify(ctx, verify_mode, ossl_ssl_verify_callback);
749 if (RTEST(ossl_sslctx_get_client_cert_cb(self)))
750 SSL_CTX_set_client_cert_cb(ctx, ossl_client_cert_cb);
751
752 val = ossl_sslctx_get_timeout(self);
753 if(!NIL_P(val)) SSL_CTX_set_timeout(ctx, NUM2LONG(val));
754
755 val = ossl_sslctx_get_verify_dep(self);
756 if(!NIL_P(val)) SSL_CTX_set_verify_depth(ctx, NUM2INT(val));
757
758 val = ossl_sslctx_get_options(self);
759 if(!NIL_P(val)) {
760 SSL_CTX_set_options(ctx, NUM2LONG(val));
761 } else {
762 SSL_CTX_set_options(ctx, SSL_OP_ALL);
763 }
764
765 #ifdef HAVE_OPENSSL_NPN_NEGOTIATED
766 val = rb_iv_get(self, "@npn_protocols");
767 if (!NIL_P(val)) {
768 ssl_npn_encode_protocols(self, val);
769 SSL_CTX_set_next_protos_advertised_cb(ctx, ssl_npn_advertise_cb, (void *) self);
770 OSSL_Debug("SSL NPN advertise callback added");
771 }
772 if (RTEST(rb_iv_get(self, "@npn_select_cb"))) {
773 SSL_CTX_set_next_proto_select_cb(ctx, ssl_npn_select_cb, (void *) self);
774 OSSL_Debug("SSL NPN select callback added");
775 }
776 #endif
777
778 rb_obj_freeze(self);
779
780 val = ossl_sslctx_get_sess_id_ctx(self);
781 if (!NIL_P(val)){
782 StringValue(val);
783 if (!SSL_CTX_set_session_id_context(ctx, (unsigned char *)RSTRING_PTR(val),
784 RSTRING_LENINT(val))){
785 ossl_raise(eSSLError, "SSL_CTX_set_session_id_context");
786 }
787 }
788
789 if (RTEST(rb_iv_get(self, "@session_get_cb"))) {
790 SSL_CTX_sess_set_get_cb(ctx, ossl_sslctx_session_get_cb);
791 OSSL_Debug("SSL SESSION get callback added");
792 }
793 if (RTEST(rb_iv_get(self, "@session_new_cb"))) {
794 SSL_CTX_sess_set_new_cb(ctx, ossl_sslctx_session_new_cb);
795 OSSL_Debug("SSL SESSION new callback added");
796 }
797 if (RTEST(rb_iv_get(self, "@session_remove_cb"))) {
798 SSL_CTX_sess_set_remove_cb(ctx, ossl_sslctx_session_remove_cb);
799 OSSL_Debug("SSL SESSION remove callback added");
800 }
801
802 #ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME
803 val = rb_iv_get(self, "@servername_cb");
804 if (!NIL_P(val)) {
805 SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);
806 OSSL_Debug("SSL TLSEXT servername callback added");
807 }
808 #endif
809
810 return Qtrue;
811 }
812
813 static VALUE
814 ossl_ssl_cipher_to_ary(SSL_CIPHER *cipher)
815 {
816 VALUE ary;
817 int bits, alg_bits;
818
819 ary = rb_ary_new2(4);
820 rb_ary_push(ary, rb_str_new2(SSL_CIPHER_get_name(cipher)));
821 rb_ary_push(ary, rb_str_new2(SSL_CIPHER_get_version(cipher)));
822 bits = SSL_CIPHER_get_bits(cipher, &alg_bits);
823 rb_ary_push(ary, INT2FIX(bits));
824 rb_ary_push(ary, INT2FIX(alg_bits));
825
826 return ary;
827 }
828
829 /*
830 * call-seq:
831 * ctx.ciphers => [[name, version, bits, alg_bits], ...]
832 *
833 * The list of ciphers configured for this context.
834 */
835 static VALUE
836 ossl_sslctx_get_ciphers(VALUE self)
837 {
838 SSL_CTX *ctx;
839 STACK_OF(SSL_CIPHER) *ciphers;
840 SSL_CIPHER *cipher;
841 VALUE ary;
842 int i, num;
843
844 Data_Get_Struct(self, SSL_CTX, ctx);
845 if(!ctx){
846 rb_warning("SSL_CTX is not initialized.");
847 return Qnil;
848 }
849 ciphers = ctx->cipher_list;
850
851 if (!ciphers)
852 return rb_ary_new();
853
854 num = sk_SSL_CIPHER_num(ciphers);
855 ary = rb_ary_new2(num);
856 for(i = 0; i < num; i++){
857 cipher = sk_SSL_CIPHER_value(ciphers, i);
858 rb_ary_push(ary, ossl_ssl_cipher_to_ary(cipher));
859 }
860 return ary;
861 }
862
863 /*
864 * call-seq:
865 * ctx.ciphers = "cipher1:cipher2:..."
866 * ctx.ciphers = [name, ...]
867 * ctx.ciphers = [[name, version, bits, alg_bits], ...]
868 *
869 * Sets the list of available ciphers for this context. Note in a server
870 * context some ciphers require the appropriate certificates. For example, an
871 * RSA cipher can only be chosen when an RSA certificate is available.
872 *
873 * See also OpenSSL::Cipher and OpenSSL::Cipher::ciphers
874 */
875 static VALUE
876 ossl_sslctx_set_ciphers(VALUE self, VALUE v)
877 {
878 SSL_CTX *ctx;
879 VALUE str, elem;
880 int i;
881
882 rb_check_frozen(self);
883 if (NIL_P(v))
884 return v;
885 else if (TYPE(v) == T_ARRAY) {
886 str = rb_str_new(0, 0);
887 for (i = 0; i < RARRAY_LEN(v); i++) {
888 elem = rb_ary_entry(v, i);
889 if (TYPE(elem) == T_ARRAY) elem = rb_ary_entry(elem, 0);
890 elem = rb_String(elem);
891 rb_str_append(str, elem);
892 if (i < RARRAY_LEN(v)-1) rb_str_cat2(str, ":");
893 }
894 } else {
895 str = v;
896 StringValue(str);
897 }
898
899 Data_Get_Struct(self, SSL_CTX, ctx);
900 if(!ctx){
901 ossl_raise(eSSLError, "SSL_CTX is not initialized.");
902 return Qnil;
903 }
904 if (!SSL_CTX_set_cipher_list(ctx, RSTRING_PTR(str))) {
905 ossl_raise(eSSLError, "SSL_CTX_set_cipher_list");
906 }
907
908 return v;
909 }
910
911 /*
912 * call-seq:
913 * ctx.session_add(session) -> true | false
914 *
915 * Adds +session+ to the session cache
916 */
917 static VALUE
918 ossl_sslctx_session_add(VALUE self, VALUE arg)
919 {
920 SSL_CTX *ctx;
921 SSL_SESSION *sess;
922
923 Data_Get_Struct(self, SSL_CTX, ctx);
924 SafeGetSSLSession(arg, sess);
925
926 return SSL_CTX_add_session(ctx, sess) == 1 ? Qtrue : Qfalse;
927 }
928
929 /*
930 * call-seq:
931 * ctx.session_remove(session) -> true | false
932 *
933 * Removes +session+ from the session cache
934 */
935 static VALUE
936 ossl_sslctx_session_remove(VALUE self, VALUE arg)
937 {
938 SSL_CTX *ctx;
939 SSL_SESSION *sess;
940
941 Data_Get_Struct(self, SSL_CTX, ctx);
942 SafeGetSSLSession(arg, sess);
943
944 return SSL_CTX_remove_session(ctx, sess) == 1 ? Qtrue : Qfalse;
945 }
946
947 /*
948 * call-seq:
949 * ctx.session_cache_mode -> Integer
950 *
951 * The current session cache mode.
952 */
953 static VALUE
954 ossl_sslctx_get_session_cache_mode(VALUE self)
955 {
956 SSL_CTX *ctx;
957
958 Data_Get_Struct(self, SSL_CTX, ctx);
959
960 return LONG2NUM(SSL_CTX_get_session_cache_mode(ctx));
961 }
962
963 /*
964 * call-seq:
965 * ctx.session_cache_mode=(integer) -> Integer
966 *
967 * Sets the SSL session cache mode. Bitwise-or together the desired
968 * SESSION_CACHE_* constants to set. See SSL_CTX_set_session_cache_mode(3) for
969 * details.
970 */
971 static VALUE
972 ossl_sslctx_set_session_cache_mode(VALUE self, VALUE arg)
973 {
974 SSL_CTX *ctx;
975
976 Data_Get_Struct(self, SSL_CTX, ctx);
977
978 SSL_CTX_set_session_cache_mode(ctx, NUM2LONG(arg));
979
980 return arg;
981 }
982
983 /*
984 * call-seq:
985 * ctx.session_cache_size -> Integer
986 *
987 * Returns the current session cache size. Zero is used to represent an
988 * unlimited cache size.
989 */
990 static VALUE
991 ossl_sslctx_get_session_cache_size(VALUE self)
992 {
993 SSL_CTX *ctx;
994
995 Data_Get_Struct(self, SSL_CTX, ctx);
996
997 return LONG2NUM(SSL_CTX_sess_get_cache_size(ctx));
998 }
999
1000 /*
1001 * call-seq:
1002 * ctx.session_cache_size=(integer) -> Integer
1003 *
1004 * Sets the session cache size. Returns the previously valid session cache
1005 * size. Zero is used to represent an unlimited session cache size.
1006 */
1007 static VALUE
1008 ossl_sslctx_set_session_cache_size(VALUE self, VALUE arg)
1009 {
1010 SSL_CTX *ctx;
1011
1012 Data_Get_Struct(self, SSL_CTX, ctx);
1013
1014 SSL_CTX_sess_set_cache_size(ctx, NUM2LONG(arg));
1015
1016 return arg;
1017 }
1018
1019 /*
1020 * call-seq:
1021 * ctx.session_cache_stats -> Hash
1022 *
1023 * Returns a Hash containing the following keys:
1024 *
1025 * :accept:: Number of started SSL/TLS handshakes in server mode
1026 * :accept_good:: Number of established SSL/TLS sessions in server mode
1027 * :accept_renegotiate:: Number of start renegotiations in server mode
1028 * :cache_full:: Number of sessions that were removed due to cache overflow
1029 * :cache_hits:: Number of successfully reused connections
1030 * :cache_misses:: Number of sessions proposed by clients that were not found
1031 * in the cache
1032 * :cache_num:: Number of sessions in the internal session cache
1033 * :cb_hits:: Number of sessions retrieved from the external cache in server
1034 * mode
1035 * :connect:: Number of started SSL/TLS handshakes in client mode
1036 * :connect_good:: Number of established SSL/TLS sessions in client mode
1037 * :connect_renegotiate:: Number of start renegotiations in client mode
1038 * :timeouts:: Number of sessions proposed by clients that were found in the
1039 * cache but had expired due to timeouts
1040 */
1041 static VALUE
1042 ossl_sslctx_get_session_cache_stats(VALUE self)
1043 {
1044 SSL_CTX *ctx;
1045 VALUE hash;
1046
1047 Data_Get_Struct(self, SSL_CTX, ctx);
1048
1049 hash = rb_hash_new();
1050 rb_hash_aset(hash, ID2SYM(rb_intern("cache_num")), LONG2NUM(SSL_CTX_sess_number(ctx)));
1051 rb_hash_aset(hash, ID2SYM(rb_intern("connect")), LONG2NUM(SSL_CTX_sess_connect(ctx)));
1052 rb_hash_aset(hash, ID2SYM(rb_intern("connect_good")), LONG2NUM(SSL_CTX_sess_connect_good(ctx)));
1053 rb_hash_aset(hash, ID2SYM(rb_intern("connect_renegotiate")), LONG2NUM(SSL_CTX_sess_connect_renegotiate(ctx)));
1054 rb_hash_aset(hash, ID2SYM(rb_intern("accept")), LONG2NUM(SSL_CTX_sess_accept(ctx)));
1055 rb_hash_aset(hash, ID2SYM(rb_intern("accept_good")), LONG2NUM(SSL_CTX_sess_accept_good(ctx)));
1056 rb_hash_aset(hash, ID2SYM(rb_intern("accept_renegotiate")), LONG2NUM(SSL_CTX_sess_accept_renegotiate(ctx)));
1057 rb_hash_aset(hash, ID2SYM(rb_intern("cache_hits")), LONG2NUM(SSL_CTX_sess_hits(ctx)));
1058 rb_hash_aset(hash, ID2SYM(rb_intern("cb_hits")), LONG2NUM(SSL_CTX_sess_cb_hits(ctx)));
1059 rb_hash_aset(hash, ID2SYM(rb_intern("cache_misses")), LONG2NUM(SSL_CTX_sess_misses(ctx)));
1060 rb_hash_aset(hash, ID2SYM(rb_intern("cache_full")), LONG2NUM(SSL_CTX_sess_cache_full(ctx)));
1061 rb_hash_aset(hash, ID2SYM(rb_intern("timeouts")), LONG2NUM(SSL_CTX_sess_timeouts(ctx)));
1062
1063 return hash;
1064 }
1065
1066
1067 /*
1068 * call-seq:
1069 * ctx.flush_sessions(time | nil) -> self
1070 *
1071 * Removes sessions in the internal cache that have expired at +time+.
1072 */
1073 static VALUE
1074 ossl_sslctx_flush_sessions(int argc, VALUE *argv, VALUE self)
1075 {
1076 VALUE arg1;
1077 SSL_CTX *ctx;
1078 time_t tm = 0;
1079
1080 rb_scan_args(argc, argv, "01", &arg1);
1081
1082 Data_Get_Struct(self, SSL_CTX, ctx);
1083
1084 if (NIL_P(arg1)) {
1085 tm = time(0);
1086 } else if (rb_obj_is_instance_of(arg1, rb_cTime)) {
1087 tm = NUM2LONG(rb_funcall(arg1, rb_intern("to_i"), 0));
1088 } else {
1089 ossl_raise(rb_eArgError, "arg must be Time or nil");
1090 }
1091
1092 SSL_CTX_flush_sessions(ctx, (long)tm);
1093
1094 return self;
1095 }
1096
1097 /*
1098 * SSLSocket class
1099 */
1100 #ifndef OPENSSL_NO_SOCK
1101 static void
1102 ossl_ssl_shutdown(SSL *ssl)
1103 {
1104 int i, rc;
1105
1106 if (ssl) {
1107 /* 4 is from SSL_smart_shutdown() of mod_ssl.c (v2.2.19) */
1108 /* It says max 2x pending + 2x data = 4 */
1109 for (i = 0; i < 4; ++i) {
1110 /*
1111 * Ignore the case SSL_shutdown returns -1. Empty handshake_func
1112 * must not happen.
1113 */
1114 if (rc = SSL_shutdown(ssl))
1115 break;
1116 }
1117 SSL_clear(ssl);
1118 ERR_clear_error();
1119 }
1120 }
1121
1122 static void
1123 ossl_ssl_free(SSL *ssl)
1124 {
1125 SSL_free(ssl);
1126 }
1127
1128 static VALUE
1129 ossl_ssl_s_alloc(VALUE klass)
1130 {
1131 return Data_Wrap_Struct(klass, 0, ossl_ssl_free, NULL);
1132 }
1133
1134 /*
1135 * call-seq:
1136 * SSLSocket.new(io) => aSSLSocket
1137 * SSLSocket.new(io, ctx) => aSSLSocket
1138 *
1139 * Creates a new SSL socket from +io+ which must be a real ruby object (not an
1140 * IO-like object that responds to read/write).
1141 *
1142 * If +ctx+ is provided the SSL Sockets initial params will be taken from
1143 * the context.
1144 *
1145 * The OpenSSL::Buffering module provides additional IO methods.
1146 *
1147 * This method will freeze the SSLContext if one is provided;
1148 * however, session management is still allowed in the frozen SSLContext.
1149 */
1150 static VALUE
1151 ossl_ssl_initialize(int argc, VALUE *argv, VALUE self)
1152 {
1153 VALUE io, ctx;
1154
1155 if (rb_scan_args(argc, argv, "11", &io, &ctx) == 1) {
1156 ctx = rb_funcall(cSSLContext, rb_intern("new"), 0);
1157 }
1158 OSSL_Check_Kind(ctx, cSSLContext);
1159 Check_Type(io, T_FILE);
1160 ossl_ssl_set_io(self, io);
1161 ossl_ssl_set_ctx(self, ctx);
1162 ossl_ssl_set_sync_close(self, Qfalse);
1163 ossl_sslctx_setup(ctx);
1164
1165 rb_iv_set(self, "@hostname", Qnil);
1166
1167 rb_call_super(0, 0);
1168
1169 return self;
1170 }
1171
1172 static VALUE
1173 ossl_ssl_setup(VALUE self)
1174 {
1175 VALUE io, v_ctx, cb;
1176 SSL_CTX *ctx;
1177 SSL *ssl;
1178 rb_io_t *fptr;
1179
1180 Data_Get_Struct(self, SSL, ssl);
1181 if(!ssl){
1182 #ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME
1183 VALUE hostname = rb_iv_get(self, "@hostname");
1184 #endif
1185
1186 v_ctx = ossl_ssl_get_ctx(self);
1187 Data_Get_Struct(v_ctx, SSL_CTX, ctx);
1188
1189 ssl = SSL_new(ctx);
1190 if (!ssl) {
1191 ossl_raise(eSSLError, "SSL_new");
1192 }
1193 DATA_PTR(self) = ssl;
1194
1195 #ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME
1196 if (!NIL_P(hostname)) {
1197 if (SSL_set_tlsext_host_name(ssl, StringValuePtr(hostname)) != 1)
1198 ossl_raise(eSSLError, "SSL_set_tlsext_host_name");
1199 }
1200 #endif
1201 io = ossl_ssl_get_io(self);
1202 GetOpenFile(io, fptr);
1203 rb_io_check_readable(fptr);
1204 rb_io_check_writable(fptr);
1205 SSL_set_fd(ssl, TO_SOCKET(FPTR_TO_FD(fptr)));
1206 SSL_set_ex_data(ssl, ossl_ssl_ex_ptr_idx, (void*)self);
1207 cb = ossl_sslctx_get_verify_cb(v_ctx);
1208 SSL_set_ex_data(ssl, ossl_ssl_ex_vcb_idx, (void*)cb);
1209 cb = ossl_sslctx_get_client_cert_cb(v_ctx);
1210 SSL_set_ex_data(ssl, ossl_ssl_ex_client_cert_cb_idx, (void*)cb);
1211 cb = ossl_sslctx_get_tmp_dh_cb(v_ctx);
1212 SSL_set_ex_data(ssl, ossl_ssl_ex_tmp_dh_callback_idx, (void*)cb);
1213 SSL_set_info_callback(ssl, ssl_info_cb);
1214 }
1215
1216 return Qtrue;
1217 }
1218
1219 #ifdef _WIN32
1220 #define ssl_get_error(ssl, ret) (errno = rb_w32_map_errno(WSAGetLastError()), SSL_get_error((ssl), (ret)))
1221 #else
1222 #define ssl_get_error(ssl, ret) SSL_get_error((ssl), (ret))
1223 #endif
1224
1225 #define ossl_ssl_data_get_struct(v, ssl) \
1226 do { \
1227 Data_Get_Struct((v), SSL, (ssl)); \
1228 if (!(ssl)) { \
1229 rb_warning("SSL session is not started yet."); \
1230 return Qnil; \
1231 } \
1232 } while (0)
1233
1234 static void
1235 write_would_block(int nonblock)
1236 {
1237 if (nonblock) {
1238 VALUE exc = ossl_exc_new(eSSLErrorWaitWritable, "write would block");
1239 rb_exc_raise(exc);
1240 }
1241 }
1242
1243 static void
1244 read_would_block(int nonblock)
1245 {
1246 if (nonblock) {
1247 VALUE exc = ossl_exc_new(eSSLErrorWaitReadable, "read would block");
1248 rb_exc_raise(exc);
1249 }
1250 }
1251
1252 static VALUE
1253 ossl_start_ssl(VALUE self, int (*func)(), const char *funcname, int nonblock)
1254 {
1255 SSL *ssl;
1256 rb_io_t *fptr;
1257 int ret, ret2;
1258 VALUE cb_state;
1259
1260 rb_ivar_set(self, ID_callback_state, Qnil);
1261
1262 ossl_ssl_data_get_struct(self, ssl);
1263
1264 GetOpenFile(ossl_ssl_get_io(self), fptr);
1265 for(;;){
1266 ret = func(ssl);
1267
1268 cb_state = rb_ivar_get(self, ID_callback_state);
1269 if (!NIL_P(cb_state))
1270 rb_jump_tag(NUM2INT(cb_state));
1271
1272 if (ret > 0)
1273 break;
1274
1275 switch((ret2 = ssl_get_error(ssl, ret))){
1276 case SSL_ERROR_WANT_WRITE:
1277 write_would_block(nonblock);
1278 rb_io_wait_writable(FPTR_TO_FD(fptr));
1279 continue;
1280 case SSL_ERROR_WANT_READ:
1281 read_would_block(nonblock);
1282 rb_io_wait_readable(FPTR_TO_FD(fptr));
1283 continue;
1284 case SSL_ERROR_SYSCALL:
1285 if (errno) rb_sys_fail(funcname);
1286 ossl_raise(eSSLError, "%s SYSCALL returned=%d errno=%d state=%s", funcname, ret2, errno, SSL_state_string_long(ssl));
1287 default:
1288 ossl_raise(eSSLError, "%s returned=%d errno=%d state=%s", funcname, ret2, errno, SSL_state_string_long(ssl));
1289 }
1290 }
1291
1292 return self;
1293 }
1294
1295 /*
1296 * call-seq:
1297 * ssl.connect => self
1298 *
1299 * Initiates an SSL/TLS handshake with a server. The handshake may be started
1300 * after unencrypted data has been sent over the socket.
1301 */
1302 static VALUE
1303 ossl_ssl_connect(VALUE self)
1304 {
1305 ossl_ssl_setup(self);
1306 return ossl_start_ssl(self, SSL_connect, "SSL_connect", 0);
1307 }
1308
1309 /*
1310 * call-seq:
1311 * ssl.connect_nonblock => self
1312 *
1313 * Initiates the SSL/TLS handshake as a client in non-blocking manner.
1314 *
1315 * # emulates blocking connect
1316 * begin
1317 * ssl.connect_nonblock
1318 * rescue IO::WaitReadable
1319 * IO.select([s2])
1320 * retry
1321 * rescue IO::WaitWritable
1322 * IO.select(nil, [s2])
1323 * retry
1324 * end
1325 *
1326 */
1327 static VALUE
1328 ossl_ssl_connect_nonblock(VALUE self)
1329 {
1330 ossl_ssl_setup(self);
1331 return ossl_start_ssl(self, SSL_connect, "SSL_connect", 1);
1332 }
1333
1334 /*
1335 * call-seq:
1336 * ssl.accept => self
1337 *
1338 * Waits for a SSL/TLS client to initiate a handshake. The handshake may be
1339 * started after unencrypted data has been sent over the socket.
1340 */
1341 static VALUE
1342 ossl_ssl_accept(VALUE self)
1343 {
1344 ossl_ssl_setup(self);
1345 return ossl_start_ssl(self, SSL_accept, "SSL_accept", 0);
1346 }
1347
1348 /*
1349 * call-seq:
1350 * ssl.accept_nonblock => self
1351 *
1352 * Initiates the SSL/TLS handshake as a server in non-blocking manner.
1353 *
1354 * # emulates blocking accept
1355 * begin
1356 * ssl.accept_nonblock
1357 * rescue IO::WaitReadable
1358 * IO.select([s2])
1359 * retry
1360 * rescue IO::WaitWritable
1361 * IO.select(nil, [s2])
1362 * retry
1363 * end
1364 *
1365 */
1366 static VALUE
1367 ossl_ssl_accept_nonblock(VALUE self)
1368 {
1369 ossl_ssl_setup(self);
1370 return ossl_start_ssl(self, SSL_accept, "SSL_accept", 1);
1371 }
1372
1373 static VALUE
1374 ossl_ssl_read_internal(int argc, VALUE *argv, VALUE self, int nonblock)
1375 {
1376 SSL *ssl;
1377 int ilen, nread = 0;
1378 int no_exception = 0;
1379 VALUE len, str;
1380 rb_io_t *fptr;
1381 VALUE opts = Qnil;
1382
1383 rb_scan_args(argc, argv, "11:", &len, &str, &opts);
1384
1385 if (!NIL_P(opts) && Qfalse == rb_hash_aref(opts, sym_exception))
1386 no_exception = 1;
1387
1388 ilen = NUM2INT(len);
1389 if(NIL_P(str)) str = rb_str_new(0, ilen);
1390 else{
1391 StringValue(str);
1392 rb_str_modify(str);
1393 rb_str_resize(str, ilen);
1394 }
1395 if(ilen == 0) return str;
1396
1397 Data_Get_Struct(self, SSL, ssl);
1398 GetOpenFile(ossl_ssl_get_io(self), fptr);
1399 if (ssl) {
1400 if(!nonblock && SSL_pending(ssl) <= 0)
1401 rb_thread_wait_fd(FPTR_TO_FD(fptr));
1402 for (;;){
1403 nread = SSL_read(ssl, RSTRING_PTR(str), RSTRING_LENINT(str));
1404 switch(ssl_get_error(ssl, nread)){
1405 case SSL_ERROR_NONE:
1406 goto end;
1407 case SSL_ERROR_ZERO_RETURN:
1408 if (no_exception) { return Qnil; }
1409 rb_eof_error();
1410 case SSL_ERROR_WANT_WRITE:
1411 if (no_exception) { return ID2SYM(rb_intern("wait_writable")); }
1412 write_would_block(nonblock);
1413 rb_io_wait_writable(FPTR_TO_FD(fptr));
1414 continue;
1415 case SSL_ERROR_WANT_READ:
1416 if (no_exception) { return ID2SYM(rb_intern("wait_readable")); }
1417 read_would_block(nonblock);
1418 rb_io_wait_readable(FPTR_TO_FD(fptr));
1419 continue;
1420 case SSL_ERROR_SYSCALL:
1421 if(ERR_peek_error() == 0 && nread == 0) {
1422 if (no_exception) { return Qnil; }
1423 rb_eof_error();
1424 }
1425 rb_sys_fail(0);
1426 default:
1427 ossl_raise(eSSLError, "SSL_read");
1428 }
1429 }
1430 }
1431 else {
1432 ID meth = nonblock ? rb_intern("read_nonblock") : rb_intern("sysread");
1433 rb_warning("SSL session is not started yet.");
1434 return rb_funcall(ossl_ssl_get_io(self), meth, 2, len, str);
1435 }
1436
1437 end:
1438 rb_str_set_len(str, nread);
1439 OBJ_TAINT(str);
1440
1441 return str;
1442 }
1443
1444 /*
1445 * call-seq:
1446 * ssl.sysread(length) => string
1447 * ssl.sysread(length, buffer) => buffer
1448 *
1449 * Reads +length+ bytes from the SSL connection. If a pre-allocated +buffer+
1450 * is provided the data will be written into it.
1451 */
1452 static VALUE
1453 ossl_ssl_read(int argc, VALUE *argv, VALUE self)
1454 {
1455 return ossl_ssl_read_internal(argc, argv, self, 0);
1456 }
1457
1458 /*
1459 * call-seq:
1460 * ssl.sysread_nonblock(length) => string
1461 * ssl.sysread_nonblock(length, buffer) => buffer
1462 * ssl.sysread_nonblock(length[, buffer [, opts]) => buffer
1463 *
1464 * A non-blocking version of #sysread. Raises an SSLError if reading would
1465 * block. If "exception: false" is passed, this method returns a symbol of
1466 * :wait_readable, :wait_writable, or nil, rather than raising an exception.
1467 *
1468 * Reads +length+ bytes from the SSL connection. If a pre-allocated +buffer+
1469 * is provided the data will be written into it.
1470 */
1471 static VALUE
1472 ossl_ssl_read_nonblock(int argc, VALUE *argv, VALUE self)
1473 {
1474 return ossl_ssl_read_internal(argc, argv, self, 1);
1475 }
1476
1477 static VALUE
1478 ossl_ssl_write_internal(VALUE self, VALUE str, int nonblock, int no_exception)
1479 {
1480 SSL *ssl;
1481 int nwrite = 0;
1482 rb_io_t *fptr;
1483
1484 StringValue(str);
1485 Data_Get_Struct(self, SSL, ssl);
1486 GetOpenFile(ossl_ssl_get_io(self), fptr);
1487
1488 if (ssl) {
1489 for (;;){
1490 nwrite = SSL_write(ssl, RSTRING_PTR(str), RSTRING_LENINT(str));
1491 switch(ssl_get_error(ssl, nwrite)){
1492 case SSL_ERROR_NONE:
1493 goto end;
1494 case SSL_ERROR_WANT_WRITE:
1495 if (no_exception) { return ID2SYM(rb_intern("wait_writable")); }
1496 write_would_block(nonblock);
1497 rb_io_wait_writable(FPTR_TO_FD(fptr));
1498 continue;
1499 case SSL_ERROR_WANT_READ:
1500 if (no_exception) { return ID2SYM(rb_intern("wait_readable")); }
1501 read_would_block(nonblock);
1502 rb_io_wait_readable(FPTR_TO_FD(fptr));
1503 continue;
1504 case SSL_ERROR_SYSCALL:
1505 if (errno) rb_sys_fail(0);
1506 default:
1507 ossl_raise(eSSLError, "SSL_write");
1508 }
1509 }
1510 }
1511 else {
1512 ID id_syswrite = rb_intern("syswrite");
1513 rb_warning("SSL session is not started yet.");
1514 return rb_funcall(ossl_ssl_get_io(self), id_syswrite, 1, str);
1515 }
1516
1517 end:
1518 return INT2NUM(nwrite);
1519 }
1520
1521 /*
1522 * call-seq:
1523 * ssl.syswrite(string) => Integer
1524 *
1525 * Writes +string+ to the SSL connection.
1526 */
1527 static VALUE
1528 ossl_ssl_write(VALUE self, VALUE str)
1529 {
1530 return ossl_ssl_write_internal(self, str, 0, 0);
1531 }
1532
1533 /*
1534 * call-seq:
1535 * ssl.syswrite_nonblock(string) => Integer
1536 *
1537 * Writes +string+ to the SSL connection in a non-blocking manner. Raises an
1538 * SSLError if writing would block.
1539 */
1540 static VALUE
1541 ossl_ssl_write_nonblock(int argc, VALUE *argv, VALUE self)
1542 {
1543 VALUE str;
1544 VALUE opts = Qnil;
1545 int no_exception = 0;
1546
1547 rb_scan_args(argc, argv, "1:", &str, &opts);
1548
1549 if (!NIL_P(opts) && Qfalse == rb_hash_aref(opts, sym_exception))
1550 no_exception = 1;
1551
1552 return ossl_ssl_write_internal(self, str, 1, no_exception);
1553 }
1554
1555 /*
1556 * call-seq:
1557 * ssl.sysclose => nil
1558 *
1559 * Shuts down the SSL connection and prepares it for another connection.
1560 */
1561 static VALUE
1562 ossl_ssl_close(VALUE self)
1563 {
1564 SSL *ssl;
1565
1566 ossl_ssl_data_get_struct(self, ssl);
1567
1568 if (ssl) {
1569 VALUE io = ossl_ssl_get_io(self);
1570 if (!RTEST(rb_funcall(io, rb_intern("closed?"), 0))) {
1571 ossl_ssl_shutdown(ssl);
1572 SSL_free(ssl);
1573 DATA_PTR(self) = NULL;
1574 if (RTEST(ossl_ssl_get_sync_close(self)))
1575 rb_funcall(io, rb_intern("close"), 0);
1576 }
1577 }
1578
1579 return Qnil;
1580 }
1581
1582 /*
1583 * call-seq:
1584 * ssl.cert => cert or nil
1585 *
1586 * The X509 certificate for this socket endpoint.
1587 */
1588 static VALUE
1589 ossl_ssl_get_cert(VALUE self)
1590 {
1591 SSL *ssl;
1592 X509 *cert = NULL;
1593
1594 ossl_ssl_data_get_struct(self, ssl);
1595
1596 /*
1597 * Is this OpenSSL bug? Should add a ref?
1598 * TODO: Ask for.
1599 */
1600 cert = SSL_get_certificate(ssl); /* NO DUPs => DON'T FREE. */
1601
1602 if (!cert) {
1603 return Qnil;
1604 }
1605 return ossl_x509_new(cert);
1606 }
1607
1608 /*
1609 * call-seq:
1610 * ssl.peer_cert => cert or nil
1611 *
1612 * The X509 certificate for this socket's peer.
1613 */
1614 static VALUE
1615 ossl_ssl_get_peer_cert(VALUE self)
1616 {
1617 SSL *ssl;
1618 X509 *cert = NULL;
1619 VALUE obj;
1620
1621 ossl_ssl_data_get_struct(self, ssl);
1622
1623 cert = SSL_get_peer_certificate(ssl); /* Adds a ref => Safe to FREE. */
1624
1625 if (!cert) {
1626 return Qnil;
1627 }
1628 obj = ossl_x509_new(cert);
1629 X509_free(cert);
1630
1631 return obj;
1632 }
1633
1634 /*
1635 * call-seq:
1636 * ssl.peer_cert_chain => [cert, ...] or nil
1637 *
1638 * The X509 certificate chain for this socket's peer.
1639 */
1640 static VALUE
1641 ossl_ssl_get_peer_cert_chain(VALUE self)
1642 {
1643 SSL *ssl;
1644 STACK_OF(X509) *chain;
1645 X509 *cert;
1646 VALUE ary;
1647 int i, num;
1648
1649 ossl_ssl_data_get_struct(self, ssl);
1650
1651 chain = SSL_get_peer_cert_chain(ssl);
1652 if(!chain) return Qnil;
1653 num = sk_X509_num(chain);
1654 ary = rb_ary_new2(num);
1655 for (i = 0; i < num; i++){
1656 cert = sk_X509_value(chain, i);
1657 rb_ary_push(ary, ossl_x509_new(cert));
1658 }
1659
1660 return ary;
1661 }
1662
1663 /*
1664 * call-seq:
1665 * ssl.ssl_version => String
1666 *
1667 * Returns a String representing the SSL/TLS version that was negotiated
1668 * for the connection, for example "TLSv1.2".
1669 */
1670 static VALUE
1671 ossl_ssl_get_version(VALUE self)
1672 {
1673 SSL *ssl;
1674
1675 ossl_ssl_data_get_struct(self, ssl);
1676
1677 return rb_str_new2(SSL_get_version(ssl));
1678 }
1679
1680 /*
1681 * call-seq:
1682 * ssl.cipher => [name, version, bits, alg_bits]
1683 *
1684 * The cipher being used for the current connection
1685 */
1686 static VALUE
1687 ossl_ssl_get_cipher(VALUE self)
1688 {
1689 SSL *ssl;
1690 SSL_CIPHER *cipher;
1691
1692 ossl_ssl_data_get_struct(self, ssl);
1693
1694 cipher = (SSL_CIPHER *)SSL_get_current_cipher(ssl);
1695
1696 return ossl_ssl_cipher_to_ary(cipher);
1697 }
1698
1699 /*
1700 * call-seq:
1701 * ssl.state => string
1702 *
1703 * A description of the current connection state.
1704 */
1705 static VALUE
1706 ossl_ssl_get_state(VALUE self)
1707 {
1708 SSL *ssl;
1709 VALUE ret;
1710
1711 ossl_ssl_data_get_struct(self, ssl);
1712
1713 ret = rb_str_new2(SSL_state_string(ssl));
1714 if (ruby_verbose) {
1715 rb_str_cat2(ret, ": ");
1716 rb_str_cat2(ret, SSL_state_string_long(ssl));
1717 }
1718 return ret;
1719 }
1720
1721 /*
1722 * call-seq:
1723 * ssl.pending => Integer
1724 *
1725 * The number of bytes that are immediately available for reading
1726 */
1727 static VALUE
1728 ossl_ssl_pending(VALUE self)
1729 {
1730 SSL *ssl;
1731
1732 ossl_ssl_data_get_struct(self, ssl);
1733
1734 return INT2NUM(SSL_pending(ssl));
1735 }
1736
1737 /*
1738 * call-seq:
1739 * ssl.session_reused? -> true | false
1740 *
1741 * Returns true if a reused session was negotiated during the handshake.
1742 */
1743 static VALUE
1744 ossl_ssl_session_reused(VALUE self)
1745 {
1746 SSL *ssl;
1747
1748 ossl_ssl_data_get_struct(self, ssl);
1749
1750 switch(SSL_session_reused(ssl)) {
1751 case 1: return Qtrue;
1752 case 0: return Qfalse;
1753 default: ossl_raise(eSSLError, "SSL_session_reused");
1754 }
1755
1756 UNREACHABLE;
1757 }
1758
1759 /*
1760 * call-seq:
1761 * ssl.session = session -> session
1762 *
1763 * Sets the Session to be used when the connection is established.
1764 */
1765 static VALUE
1766 ossl_ssl_set_session(VALUE self, VALUE arg1)
1767 {
1768 SSL *ssl;
1769 SSL_SESSION *sess;
1770
1771 /* why is ossl_ssl_setup delayed? */
1772 ossl_ssl_setup(self);
1773
1774 ossl_ssl_data_get_struct(self, ssl);
1775
1776 SafeGetSSLSession(arg1, sess);
1777
1778 if (SSL_set_session(ssl, sess) != 1)
1779 ossl_raise(eSSLError, "SSL_set_session");
1780
1781 return arg1;
1782 }
1783
1784 /*
1785 * call-seq:
1786 * ssl.verify_result => Integer
1787 *
1788 * Returns the result of the peer certificates verification. See verify(1)
1789 * for error values and descriptions.
1790 *
1791 * If no peer certificate was presented X509_V_OK is returned.
1792 */
1793 static VALUE
1794 ossl_ssl_get_verify_result(VALUE self)
1795 {
1796 SSL *ssl;
1797
1798 ossl_ssl_data_get_struct(self, ssl);
1799
1800 return INT2FIX(SSL_get_verify_result(ssl));
1801 }
1802
1803 /*
1804 * call-seq:
1805 * ssl.client_ca => [x509name, ...]
1806 *
1807 * Returns the list of client CAs. Please note that in contrast to
1808 * SSLContext#client_ca= no array of X509::Certificate is returned but
1809 * X509::Name instances of the CA's subject distinguished name.
1810 *
1811 * In server mode, returns the list set by SSLContext#client_ca=.
1812 * In client mode, returns the list of client CAs sent from the server.
1813 */
1814 static VALUE
1815 ossl_ssl_get_client_ca_list(VALUE self)
1816 {
1817 SSL *ssl;
1818 STACK_OF(X509_NAME) *ca;
1819
1820 ossl_ssl_data_get_struct(self, ssl);
1821
1822 ca = SSL_get_client_CA_list(ssl);
1823 return ossl_x509name_sk2ary(ca);
1824 }
1825
1826 # ifdef HAVE_OPENSSL_NPN_NEGOTIATED
1827 /*
1828 * call-seq:
1829 * ssl.npn_protocol => String
1830 *
1831 * Returns the protocol string that was finally selected by the client
1832 * during the handshake.
1833 */
1834 static VALUE
1835 ossl_ssl_npn_protocol(VALUE self)
1836 {
1837 SSL *ssl;
1838 const unsigned char *out;
1839 unsigned int outlen;
1840
1841 ossl_ssl_data_get_struct(self, ssl);
1842
1843 SSL_get0_next_proto_negotiated(ssl, &out, &outlen);
1844 if (!outlen)
1845 return Qnil;
1846 else
1847 return rb_str_new((const char *) out, outlen);
1848 }
1849 # endif
1850 #endif /* !defined(OPENSSL_NO_SOCK) */
1851
1852 void
1853 Init_ossl_ssl()
1854 {
1855 int i;
1856 VALUE ary;
1857
1858 #if 0
1859 mOSSL = rb_define_module("OpenSSL"); /* let rdoc know about mOSSL */
1860 #endif
1861
1862 ID_callback_state = rb_intern("@callback_state");
1863
1864 ossl_ssl_ex_vcb_idx = SSL_get_ex_new_index(0,(void *)"ossl_ssl_ex_vcb_idx",0,0,0);
1865 ossl_ssl_ex_store_p = SSL_get_ex_new_index(0,(void *)"ossl_ssl_ex_store_p",0,0,0);
1866 ossl_ssl_ex_ptr_idx = SSL_get_ex_new_index(0,(void *)"ossl_ssl_ex_ptr_idx",0,0,0);
1867 ossl_ssl_ex_client_cert_cb_idx =
1868 SSL_get_ex_new_index(0,(void *)"ossl_ssl_ex_client_cert_cb_idx",0,0,0);
1869 ossl_ssl_ex_tmp_dh_callback_idx =
1870 SSL_get_ex_new_index(0,(void *)"ossl_ssl_ex_tmp_dh_callback_idx",0,0,0);
1871
1872 /* Document-module: OpenSSL::SSL
1873 *
1874 * Use SSLContext to set up the parameters for a TLS (former SSL)
1875 * connection. Both client and server TLS connections are supported,
1876 * SSLSocket and SSLServer may be used in conjunction with an instance
1877 * of SSLContext to set up connections.
1878 */
1879 mSSL = rb_define_module_under(mOSSL, "SSL");
1880 /* Document-class: OpenSSL::SSL::SSLError
1881 *
1882 * Generic error class raised by SSLSocket and SSLContext.
1883 */
1884 eSSLError = rb_define_class_under(mSSL, "SSLError", eOSSLError);
1885 eSSLErrorWaitReadable = rb_define_class_under(mSSL, "SSLErrorWaitReadable", eSSLError);
1886 rb_include_module(eSSLErrorWaitReadable, rb_mWaitReadable);
1887 eSSLErrorWaitWritable = rb_define_class_under(mSSL, "SSLErrorWaitWritable", eSSLError);
1888 rb_include_module(eSSLErrorWaitWritable, rb_mWaitWritable);
1889
1890 Init_ossl_ssl_session();
1891
1892 /* Document-class: OpenSSL::SSL::SSLContext
1893 *
1894 * An SSLContext is used to set various options regarding certificates,
1895 * algorithms, verification, session caching, etc. The SSLContext is
1896 * used to create an SSLSocket.
1897 *
1898 * All attributes must be set before creating an SSLSocket as the
1899 * SSLContext will be frozen afterward.
1900 *
1901 * The following attributes are available but don't show up in rdoc:
1902 * * ssl_version, cert, key, client_ca, ca_file, ca_path, timeout,
1903 * * verify_mode, verify_depth client_cert_cb, tmp_dh_callback,
1904 * * session_id_context, session_add_cb, session_new_cb, session_remove_cb
1905 */
1906 cSSLContext = rb_define_class_under(mSSL, "SSLContext", rb_cObject);
1907 rb_define_alloc_func(cSSLContext, ossl_sslctx_s_alloc);
1908
1909 /*
1910 * Context certificate
1911 */
1912 rb_attr(cSSLContext, rb_intern("cert"), 1, 1, Qfalse);
1913
1914 /*
1915 * Context private key
1916 */
1917 rb_attr(cSSLContext, rb_intern("key"), 1, 1, Qfalse);
1918
1919 /*
1920 * A certificate or Array of certificates that will be sent to the client.
1921 */
1922 rb_attr(cSSLContext, rb_intern("client_ca"), 1, 1, Qfalse);
1923
1924 /*
1925 * The path to a file containing a PEM-format CA certificate
1926 */
1927 rb_attr(cSSLContext, rb_intern("ca_file"), 1, 1, Qfalse);
1928
1929 /*
1930 * The path to a directory containing CA certificates in PEM format.
1931 *
1932 * Files are looked up by subject's X509 name's hash value.
1933 */
1934 rb_attr(cSSLContext, rb_intern("ca_path"), 1, 1, Qfalse);
1935
1936 /*
1937 * Maximum session lifetime.
1938 */
1939 rb_attr(cSSLContext, rb_intern("timeout"), 1, 1, Qfalse);
1940
1941 /*
1942 * Session verification mode.
1943 *
1944 * Valid modes are VERIFY_NONE, VERIFY_PEER, VERIFY_CLIENT_ONCE,
1945 * VERIFY_FAIL_IF_NO_PEER_CERT and defined on OpenSSL::SSL
1946 */
1947 rb_attr(cSSLContext, rb_intern("verify_mode"), 1, 1, Qfalse);
1948
1949 /*
1950 * Number of CA certificates to walk when verifying a certificate chain.
1951 */
1952 rb_attr(cSSLContext, rb_intern("verify_depth"), 1, 1, Qfalse);
1953
1954 /*
1955 * A callback for additional certificate verification. The callback is
1956 * invoked for each certificate in the chain.
1957 *
1958 * The callback is invoked with two values. +preverify_ok+ indicates
1959 * indicates if the verification was passed (true) or not (false).
1960 * +store_context+ is an OpenSSL::X509::StoreContext containing the
1961 * context used for certificate verification.
1962 *
1963 * If the callback returns false verification is stopped.
1964 */
1965 rb_attr(cSSLContext, rb_intern("verify_callback"), 1, 1, Qfalse);
1966
1967 /*
1968 * Sets various OpenSSL options.
1969 */
1970 rb_attr(cSSLContext, rb_intern("options"), 1, 1, Qfalse);
1971
1972 /*
1973 * An OpenSSL::X509::Store used for certificate verification
1974 */
1975 rb_attr(cSSLContext, rb_intern("cert_store"), 1, 1, Qfalse);
1976
1977 /*
1978 * An Array of extra X509 certificates to be added to the certificate
1979 * chain.
1980 */
1981 rb_attr(cSSLContext, rb_intern("extra_chain_cert"), 1, 1, Qfalse);
1982
1983 /*
1984 * A callback invoked when a client certificate is requested by a server
1985 * and no certificate has been set.
1986 *
1987 * The callback is invoked with a Session and must return an Array
1988 * containing an OpenSSL::X509::Certificate and an OpenSSL::PKey. If any
1989 * other value is returned the handshake is suspended.
1990 */
1991 rb_attr(cSSLContext, rb_intern("client_cert_cb"), 1, 1, Qfalse);
1992
1993 /*
1994 * A callback invoked when DH parameters are required.
1995 *
1996 * The callback is invoked with the Session for the key exchange, an
1997 * flag indicating the use of an export cipher and the keylength
1998 * required.
1999 *
2000 * The callback must return an OpenSSL::PKey::DH instance of the correct
2001 * key length.
2002 */
2003 rb_attr(cSSLContext, rb_intern("tmp_dh_callback"), 1, 1, Qfalse);
2004
2005 /*
2006 * Sets the context in which a session can be reused. This allows
2007 * sessions for multiple applications to be distinguished, for example, by
2008 * name.
2009 */
2010 rb_attr(cSSLContext, rb_intern("session_id_context"), 1, 1, Qfalse);
2011
2012 /*
2013 * A callback invoked on a server when a session is proposed by the client
2014 * but the session could not be found in the server's internal cache.
2015 *
2016 * The callback is invoked with the SSLSocket and session id. The
2017 * callback may return a Session from an external cache.
2018 */
2019 rb_attr(cSSLContext, rb_intern("session_get_cb"), 1, 1, Qfalse);
2020
2021 /*
2022 * A callback invoked when a new session was negotiatied.
2023 *
2024 * The callback is invoked with an SSLSocket. If false is returned the
2025 * session will be removed from the internal cache.
2026 */
2027 rb_attr(cSSLContext, rb_intern("session_new_cb"), 1, 1, Qfalse);
2028
2029 /*
2030 * A callback invoked when a session is removed from the internal cache.
2031 *
2032 * The callback is invoked with an SSLContext and a Session.
2033 */
2034 rb_attr(cSSLContext, rb_intern("session_remove_cb"), 1, 1, Qfalse);
2035
2036 #ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME
2037 /*
2038 * A callback invoked at connect time to distinguish between multiple
2039 * server names.
2040 *
2041 * The callback is invoked with an SSLSocket and a server name. The
2042 * callback must return an SSLContext for the server name or nil.
2043 */
2044 rb_attr(cSSLContext, rb_intern("servername_cb"), 1, 1, Qfalse);
2045 #endif
2046 /*
2047 * A callback invoked whenever a new handshake is initiated. May be used
2048 * to disable renegotiation entirely.
2049 *
2050 * The callback is invoked with the active SSLSocket. The callback's
2051 * return value is irrelevant, normal return indicates "approval" of the
2052 * renegotiation and will continue the process. To forbid renegotiation
2053 * and to cancel the process, an Error may be raised within the callback.
2054 *
2055 * === Disable client renegotiation
2056 *
2057 * When running a server, it is often desirable to disable client
2058 * renegotiation entirely. You may use a callback as follows to implement
2059 * this feature:
2060 *
2061 * num_handshakes = 0
2062 * ctx.renegotiation_cb = lambda do |ssl|
2063 * num_handshakes += 1
2064 * raise RuntimeError.new("Client renegotiation disabled") if num_handshakes > 1
2065 * end
2066 */
2067 rb_attr(cSSLContext, rb_intern("renegotiation_cb"), 1, 1, Qfalse);
2068 #ifdef HAVE_OPENSSL_NPN_NEGOTIATED
2069 /*
2070 * An Enumerable of Strings. Each String represents a protocol to be
2071 * advertised as the list of supported protocols for Next Protocol
2072 * Negotiation. Supported in OpenSSL 1.0.1 and higher. Has no effect
2073 * on the client side. If not set explicitly, the NPN extension will
2074 * not be sent by the server in the handshake.
2075 *
2076 * === Example
2077 *
2078 * ctx.npn_protocols = ["http/1.1", "spdy/2"]
2079 */
2080 rb_attr(cSSLContext, rb_intern("npn_protocols"), 1, 1, Qfalse);
2081 /*
2082 * A callback invoked on the client side when the client needs to select
2083 * a protocol from the list sent by the server. Supported in OpenSSL 1.0.1
2084 * and higher. The client MUST select a protocol of those advertised by
2085 * the server. If none is acceptable, raising an error in the callback
2086 * will cause the handshake to fail. Not setting this callback explicitly
2087 * means not supporting the NPN extension on the client - any protocols
2088 * advertised by the server will be ignored.
2089 *
2090 * === Example
2091 *
2092 * ctx.npn_select_cb = lambda do |protocols|
2093 * #inspect the protocols and select one
2094 * protocols.first
2095 * end
2096 */
2097 rb_attr(cSSLContext, rb_intern("npn_select_cb"), 1, 1, Qfalse);
2098 #endif
2099
2100 rb_define_alias(cSSLContext, "ssl_timeout", "timeout");
2101 rb_define_alias(cSSLContext, "ssl_timeout=", "timeout=");
2102 rb_define_method(cSSLContext, "initialize", ossl_sslctx_initialize, -1);
2103 rb_define_method(cSSLContext, "ssl_version=", ossl_sslctx_set_ssl_version, 1);
2104 rb_define_method(cSSLContext, "ciphers", ossl_sslctx_get_ciphers, 0);
2105 rb_define_method(cSSLContext, "ciphers=", ossl_sslctx_set_ciphers, 1);
2106
2107 rb_define_method(cSSLContext, "setup", ossl_sslctx_setup, 0);
2108
2109 /*
2110 * No session caching for client or server
2111 */
2112 rb_define_const(cSSLContext, "SESSION_CACHE_OFF", LONG2FIX(SSL_SESS_CACHE_OFF));
2113
2114 /*
2115 * Client sessions are added to the session cache
2116 */
2117 rb_define_const(cSSLContext, "SESSION_CACHE_CLIENT", LONG2FIX(SSL_SESS_CACHE_CLIENT)); /* doesn't actually do anything in 0.9.8e */
2118
2119 /*
2120 * Server sessions are added to the session cache
2121 */
2122 rb_define_const(cSSLContext, "SESSION_CACHE_SERVER", LONG2FIX(SSL_SESS_CACHE_SERVER));
2123
2124 /*
2125 * Both client and server sessions are added to the session cache
2126 */
2127 rb_define_const(cSSLContext, "SESSION_CACHE_BOTH", LONG2FIX(SSL_SESS_CACHE_BOTH)); /* no different than CACHE_SERVER in 0.9.8e */
2128
2129 /*
2130 * Normally the session cache is checked for expired sessions every 255
2131 * connections. Since this may lead to a delay that cannot be controlled,
2132 * the automatic flushing may be disabled and #flush_sessions can be
2133 * called explicitly.
2134 */
2135 rb_define_const(cSSLContext, "SESSION_CACHE_NO_AUTO_CLEAR", LONG2FIX(SSL_SESS_CACHE_NO_AUTO_CLEAR));
2136
2137 /*
2138 * Always perform external lookups of sessions even if they are in the
2139 * internal cache.
2140 *
2141 * This flag has no effect on clients
2142 */
2143 rb_define_const(cSSLContext, "SESSION_CACHE_NO_INTERNAL_LOOKUP", LONG2FIX(SSL_SESS_CACHE_NO_INTERNAL_LOOKUP));
2144
2145 /*
2146 * Never automatically store sessions in the internal store.
2147 */
2148 rb_define_const(cSSLContext, "SESSION_CACHE_NO_INTERNAL_STORE", LONG2FIX(SSL_SESS_CACHE_NO_INTERNAL_STORE));
2149
2150 /*
2151 * Enables both SESSION_CACHE_NO_INTERNAL_LOOKUP and
2152 * SESSION_CACHE_NO_INTERNAL_STORE.
2153 */
2154 rb_define_const(cSSLContext, "SESSION_CACHE_NO_INTERNAL", LONG2FIX(SSL_SESS_CACHE_NO_INTERNAL));
2155
2156 rb_define_method(cSSLContext, "session_add", ossl_sslctx_session_add, 1);
2157 rb_define_method(cSSLContext, "session_remove", ossl_sslctx_session_remove, 1);
2158 rb_define_method(cSSLContext, "session_cache_mode", ossl_sslctx_get_session_cache_mode, 0);
2159 rb_define_method(cSSLContext, "session_cache_mode=", ossl_sslctx_set_session_cache_mode, 1);
2160 rb_define_method(cSSLContext, "session_cache_size", ossl_sslctx_get_session_cache_size, 0);
2161 rb_define_method(cSSLContext, "session_cache_size=", ossl_sslctx_set_session_cache_size, 1);
2162 rb_define_method(cSSLContext, "session_cache_stats", ossl_sslctx_get_session_cache_stats, 0);
2163 rb_define_method(cSSLContext, "flush_sessions", ossl_sslctx_flush_sessions, -1);
2164
2165 ary = rb_ary_new2(numberof(ossl_ssl_method_tab));
2166 for (i = 0; i < numberof(ossl_ssl_method_tab); i++) {
2167 rb_ary_push(ary, ID2SYM(rb_intern(ossl_ssl_method_tab[i].name)));
2168 }
2169 rb_obj_freeze(ary);
2170 /* The list of available SSL/TLS methods */
2171 rb_define_const(cSSLContext, "METHODS", ary);
2172
2173 /*
2174 * Document-class: OpenSSL::SSL::SSLSocket
2175 *
2176 * The following attributes are available but don't show up in rdoc.
2177 * * io, context, sync_close
2178 *
2179 */
2180 cSSLSocket = rb_define_class_under(mSSL, "SSLSocket", rb_cObject);
2181 #ifdef OPENSSL_NO_SOCK
2182 rb_define_method(cSSLSocket, "initialize", rb_notimplement, -1);
2183 #else
2184 rb_define_alloc_func(cSSLSocket, ossl_ssl_s_alloc);
2185 for(i = 0; i < numberof(ossl_ssl_attr_readers); i++)
2186 rb_attr(cSSLSocket, rb_intern(ossl_ssl_attr_readers[i]), 1, 0, Qfalse);
2187 for(i = 0; i < numberof(ossl_ssl_attrs); i++)
2188 rb_attr(cSSLSocket, rb_intern(ossl_ssl_attrs[i]), 1, 1, Qfalse);
2189 rb_define_alias(cSSLSocket, "to_io", "io");
2190 rb_define_method(cSSLSocket, "initialize", ossl_ssl_initialize, -1);
2191 rb_define_method(cSSLSocket, "connect", ossl_ssl_connect, 0);
2192 rb_define_method(cSSLSocket, "connect_nonblock", ossl_ssl_connect_nonblock, 0);
2193 rb_define_method(cSSLSocket, "accept", ossl_ssl_accept, 0);
2194 rb_define_method(cSSLSocket, "accept_nonblock", ossl_ssl_accept_nonblock, 0);
2195 rb_define_method(cSSLSocket, "sysread", ossl_ssl_read, -1);
2196 rb_define_private_method(cSSLSocket, "sysread_nonblock", ossl_ssl_read_nonblock, -1);
2197 rb_define_method(cSSLSocket, "syswrite", ossl_ssl_write, 1);
2198 rb_define_private_method(cSSLSocket, "syswrite_nonblock", ossl_ssl_write_nonblock, -1);
2199 rb_define_method(cSSLSocket, "sysclose", ossl_ssl_close, 0);
2200 rb_define_method(cSSLSocket, "cert", ossl_ssl_get_cert, 0);
2201 rb_define_method(cSSLSocket, "peer_cert", ossl_ssl_get_peer_cert, 0);
2202 rb_define_method(cSSLSocket, "peer_cert_chain", ossl_ssl_get_peer_cert_chain, 0);
2203 rb_define_method(cSSLSocket, "ssl_version", ossl_ssl_get_version, 0);
2204 rb_define_method(cSSLSocket, "cipher", ossl_ssl_get_cipher, 0);
2205 rb_define_method(cSSLSocket, "state", ossl_ssl_get_state, 0);
2206 rb_define_method(cSSLSocket, "pending", ossl_ssl_pending, 0);
2207 rb_define_method(cSSLSocket, "session_reused?", ossl_ssl_session_reused, 0);
2208 /* implementation of OpenSSL::SSL::SSLSocket#session is in lib/openssl/ssl.rb */
2209 rb_define_method(cSSLSocket, "session=", ossl_ssl_set_session, 1);
2210 rb_define_method(cSSLSocket, "verify_result", ossl_ssl_get_verify_result, 0);
2211 rb_define_method(cSSLSocket, "client_ca", ossl_ssl_get_client_ca_list, 0);
2212 # ifdef HAVE_OPENSSL_NPN_NEGOTIATED
2213 rb_define_method(cSSLSocket, "npn_protocol", ossl_ssl_npn_protocol, 0);
2214 # endif
2215 #endif
2216
2217 #define ossl_ssl_def_const(x) rb_define_const(mSSL, #x, INT2NUM(SSL_##x))
2218
2219 ossl_ssl_def_const(VERIFY_NONE);
2220 ossl_ssl_def_const(VERIFY_PEER);
2221 ossl_ssl_def_const(VERIFY_FAIL_IF_NO_PEER_CERT);
2222 ossl_ssl_def_const(VERIFY_CLIENT_ONCE);
2223 /* Introduce constants included in OP_ALL. These constants are mostly for
2224 * unset some bits in OP_ALL such as;
2225 * ctx.options = OP_ALL & ~OP_DONT_INSERT_EMPTY_FRAGMENTS
2226 */
2227 ossl_ssl_def_const(OP_MICROSOFT_SESS_ID_BUG);
2228 ossl_ssl_def_const(OP_NETSCAPE_CHALLENGE_BUG);
2229 ossl_ssl_def_const(OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG);
2230 ossl_ssl_def_const(OP_SSLREF2_REUSE_CERT_TYPE_BUG);
2231 ossl_ssl_def_const(OP_MICROSOFT_BIG_SSLV3_BUFFER);
2232 #if defined(SSL_OP_MSIE_SSLV2_RSA_PADDING)
2233 ossl_ssl_def_const(OP_MSIE_SSLV2_RSA_PADDING);
2234 #endif
2235 ossl_ssl_def_const(OP_SSLEAY_080_CLIENT_DH_BUG);
2236 ossl_ssl_def_const(OP_TLS_D5_BUG);
2237 ossl_ssl_def_const(OP_TLS_BLOCK_PADDING_BUG);
2238 ossl_ssl_def_const(OP_DONT_INSERT_EMPTY_FRAGMENTS);
2239 ossl_ssl_def_const(OP_ALL);
2240 #if defined(SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION)
2241 ossl_ssl_def_const(OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION);
2242 #endif
2243 #if defined(SSL_OP_SINGLE_ECDH_USE)
2244 ossl_ssl_def_const(OP_SINGLE_ECDH_USE);
2245 #endif
2246 ossl_ssl_def_const(OP_SINGLE_DH_USE);
2247 ossl_ssl_def_const(OP_EPHEMERAL_RSA);
2248 #if defined(SSL_OP_CIPHER_SERVER_PREFERENCE)
2249 ossl_ssl_def_const(OP_CIPHER_SERVER_PREFERENCE);
2250 #endif
2251 ossl_ssl_def_const(OP_TLS_ROLLBACK_BUG);
2252 ossl_ssl_def_const(OP_NO_SSLv2);
2253 ossl_ssl_def_const(OP_NO_SSLv3);
2254 ossl_ssl_def_const(OP_NO_TLSv1);
2255 #if defined(SSL_OP_NO_TLSv1_1)
2256 ossl_ssl_def_const(OP_NO_TLSv1_1);
2257 #endif
2258 #if defined(SSL_OP_NO_TLSv1_2)
2259 ossl_ssl_def_const(OP_NO_TLSv1_2);
2260 #endif
2261 #if defined(SSL_OP_NO_TICKET)
2262 ossl_ssl_def_const(OP_NO_TICKET);
2263 #endif
2264 #if defined(SSL_OP_NO_COMPRESSION)
2265 ossl_ssl_def_const(OP_NO_COMPRESSION);
2266 #endif
2267 ossl_ssl_def_const(OP_PKCS1_CHECK_1);
2268 ossl_ssl_def_const(OP_PKCS1_CHECK_2);
2269 ossl_ssl_def_const(OP_NETSCAPE_CA_DN_BUG);
2270 ossl_ssl_def_const(OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
2271
2272 sym_exception = ID2SYM(rb_intern("exception"));
2273 }
ossl_ssl_get_cipher
static VALUE ossl_ssl_get_cipher(VALUE self)
Definition: ossl_ssl.c:1687
ID_callback_state
ID ID_callback_state
Definition: ossl_ssl.c:104
T_SYMBOL
#define T_SYMBOL
Definition: ruby.h:494
ossl_sslctx_session_add
static VALUE ossl_sslctx_session_add(VALUE self, VALUE arg)
Definition: ossl_ssl.c:918
ossl_sslctx_get_session_cache_stats
static VALUE ossl_sslctx_get_session_cache_stats(VALUE self)
Definition: ossl_ssl.c:1042
mOSSL
VALUE mOSSL
Definition: ossl.c:259
ossl_tmp_dh_callback
static DH * ossl_tmp_dh_callback(SSL *ssl, int is_export, int keylength)
Definition: ossl_ssl.c:295
rb_ary_entry
VALUE rb_ary_entry(VALUE ary, long offset)
Definition: array.c:1171
RARRAY_LEN
#define RARRAY_LEN(a)
Definition: ruby.h:878
ssl_get_error
#define ssl_get_error(ssl, ret)
Definition: ossl_ssl.c:1222
rb_io_check_readable
void rb_io_check_readable(rb_io_t *)
Definition: io.c:794
ossl_sslctx_get_key
#define ossl_sslctx_get_key(o)
Definition: ossl_ssl.c:52
ossl_ssl_ex_store_p
int ossl_ssl_ex_store_p
Definition: ossl_ssl.c:147
INT2NUM
#define INT2NUM(x)
Definition: ruby.h:1288
rb_String
VALUE rb_String(VALUE)
Definition: object.c:2986
ossl_sslctx_initialize
static VALUE ossl_sslctx_initialize(int argc, VALUE *argv, VALUE self)
Definition: ossl_ssl.c:223
ossl_ssl_get_tmp_dh
#define ossl_ssl_get_tmp_dh(o)
Definition: ossl_ssl.c:87
NUM2INT
#define NUM2INT(x)
Definition: ruby.h:630
ossl_ssl_s_alloc
static VALUE ossl_ssl_s_alloc(VALUE klass)
Definition: ossl_ssl.c:1129
Data_Get_Struct
#define Data_Get_Struct(obj, type, sval)
Definition: ruby.h:1036
ossl_ssl_read
static VALUE ossl_ssl_read(int argc, VALUE *argv, VALUE self)
Definition: ossl_ssl.c:1453
eSSLErrorWaitReadable
static VALUE eSSLErrorWaitReadable
Definition: ossl_ssl.c:32
Qtrue
#define Qtrue
Definition: ruby.h:426
ossl_sslctx_free
static void ossl_sslctx_free(SSL_CTX *ctx)
Definition: ossl_ssl.c:153
rb_io_t
Definition: io.h:61
ossl_ssl_set_key
#define ossl_ssl_set_key(o, v)
Definition: ossl_ssl.c:93
rb_define_private_method
void rb_define_private_method(VALUE klass, const char *name, VALUE(*func)(ANYARGS), int argc)
Definition: class.c:1500
rb_iterate
VALUE rb_iterate(VALUE(*)(VALUE), VALUE, VALUE(*)(ANYARGS), VALUE)
Definition: vm_eval.c:1052
ossl_ssl_ex_tmp_dh_callback_idx
int ossl_ssl_ex_tmp_dh_callback_idx
Definition: ossl_ssl.c:150
ossl_ssl_ex_vcb_idx
int ossl_ssl_ex_vcb_idx
Definition: ossl_ssl.c:146
UNREACHABLE
#define UNREACHABLE
Definition: ruby.h:42
ossl_call_tmp_dh_callback
static VALUE ossl_call_tmp_dh_callback(VALUE *args)
Definition: ossl_ssl.c:277
rb_ary_push
VALUE rb_ary_push(VALUE ary, VALUE item)
Definition: array.c:896
ossl_sslctx_get_client_cert_cb
#define ossl_sslctx_get_client_cert_cb(o)
Definition: ossl_ssl.c:63
ossl_ssl_get_cert
static VALUE ossl_ssl_get_cert(VALUE self)
Definition: ossl_ssl.c:1589
ossl_ssl_ex_ptr_idx
int ossl_ssl_ex_ptr_idx
Definition: ossl_ssl.c:148
SYM2ID
#define SYM2ID(x)
Definition: ruby.h:356
ossl_x509name_sk2ary
VALUE ossl_x509name_sk2ary(STACK_OF(X509_NAME)*names)
rb_funcall
VALUE rb_funcall(VALUE, ID, int,...)
Calls a method.
Definition: vm_eval.c:775
rb_iv_set
VALUE rb_iv_set(VALUE, const char *, VALUE)
Definition: variable.c:2609
rb_str_set_len
void rb_str_set_len(VALUE, long)
Definition: string.c:2008
FPTR_TO_FD
#define FPTR_TO_FD(fptr)
Definition: ruby_missing.h:19
rb_protect
VALUE rb_protect(VALUE(*proc)(VALUE), VALUE data, int *state)
Definition: eval.c:807
rb_iv_get
VALUE rb_iv_get(VALUE, const char *)
Definition: variable.c:2601
rb_define_class_under
VALUE rb_define_class_under(VALUE outer, const char *name, VALUE super)
Defines a class under the namespace of outer.
Definition: class.c:676
Check_Type
#define Check_Type(v, t)
Definition: ruby.h:532
rb_ivar_get
VALUE rb_ivar_get(VALUE, ID)
Definition: variable.c:1115
rb_define_alloc_func
void rb_define_alloc_func(VALUE, rb_alloc_func_t)
rb_obj_is_kind_of
VALUE rb_obj_is_kind_of(VALUE, VALUE)
Definition: object.c:652
DATA_PTR
#define DATA_PTR(dta)
Definition: ruby.h:992
rb_include_module
void rb_include_module(VALUE klass, VALUE module)
Definition: class.c:827
rb_block_call
VALUE rb_block_call(VALUE, ID, int, const VALUE *, rb_block_call_func_t, VALUE)
ossl_ssl_set_tmp_dh
#define ossl_ssl_set_tmp_dh(o, v)
Definition: ossl_ssl.c:94
T_ARRAY
#define T_ARRAY
Definition: ruby.h:484
ossl_sslctx_get_client_ca
#define ossl_sslctx_get_client_ca(o)
Definition: ossl_ssl.c:53
ossl_ssl_connect_nonblock
static VALUE ossl_ssl_connect_nonblock(VALUE self)
Definition: ossl_ssl.c:1328
ossl_ssl_read_nonblock
static VALUE ossl_ssl_read_nonblock(int argc, VALUE *argv, VALUE self)
Definition: ossl_ssl.c:1472
ossl_ssl_close
static VALUE ossl_ssl_close(VALUE self)
Definition: ossl_ssl.c:1562
ossl_verify_cb_idx
int ossl_verify_cb_idx
Definition: ossl.c:201
ossl_ssl_get_io
#define ossl_ssl_get_io(o)
Definition: ossl_ssl.c:82
GetOpenFile
#define GetOpenFile(obj, fp)
Definition: io.h:118
ossl_ssl_shutdown
static void ossl_ssl_shutdown(SSL *ssl)
Definition: ossl_ssl.c:1102
rb_ary_new2
#define rb_ary_new2
Definition: intern.h:90
sym_exception
static VALUE sym_exception
Definition: ossl_ssl.c:106
rb_str_buf_cat
VALUE rb_str_buf_cat(VALUE, const char *, long)
Definition: string.c:2124
ossl_ssl_write
static VALUE ossl_ssl_write(VALUE self, VALUE str)
Definition: ossl_ssl.c:1528
ossl_call_client_cert_cb
static VALUE ossl_call_client_cert_cb(VALUE obj)
Definition: ossl_ssl.c:242
ossl_exc_new
VALUE ossl_exc_new(VALUE exc, const char *fmt,...)
Definition: ossl.c:344
Data_Wrap_Struct
#define Data_Wrap_Struct(klass, mark, free, sval)
Definition: ruby.h:1018
RB_BLOCK_CALL_FUNC_ARGLIST
#define RB_BLOCK_CALL_FUNC_ARGLIST(yielded_arg, callback_arg)
Definition: ruby.h:1511
rb_exc_raise
void rb_exc_raise(VALUE mesg)
Definition: eval.c:567
Init_ossl_ssl_session
void Init_ossl_ssl_session(void)
Definition: ossl_ssl_session.c:296
STACK_OF
STACK_OF(X509)*ossl_x509_ary2sk0(VALUE)
OSSL_DEFAULT_DH_512
DH * OSSL_DEFAULT_DH_512
Definition: ossl_pkey_dh.c:541
mSSL
VALUE mSSL
Definition: ossl_ssl.c:27
GetX509CertPtr
X509 * GetX509CertPtr(VALUE)
Definition: ossl_x509cert.c:92
rb_mWaitReadable
RUBY_EXTERN VALUE rb_mWaitReadable
Definition: ruby.h:1549
ossl_ssl_accept
static VALUE ossl_ssl_accept(VALUE self)
Definition: ossl_ssl.c:1342
ossl_sslctx_get_ciphers
static VALUE ossl_sslctx_get_ciphers(VALUE self)
Definition: ossl_ssl.c:836
numberof
#define numberof(ary)
Definition: ossl_ssl.c:19
rb_hash_aset
VALUE rb_hash_aset(VALUE hash, VALUE key, VALUE val)
Definition: hash.c:1393
Init_ossl_ssl
void Init_ossl_ssl()
Definition: ossl_ssl.c:1853
val
#define val
rb_cObject
RUBY_EXTERN VALUE rb_cObject
Definition: ruby.h:1553
ossl_sslctx_get_cert
#define ossl_sslctx_get_cert(o)
Definition: ossl_ssl.c:51
ossl_ssl_session_reused
static VALUE ossl_ssl_session_reused(VALUE self)
Definition: ossl_ssl.c:1744
ossl_ssl_get_ctx
#define ossl_ssl_get_ctx(o)
Definition: ossl_ssl.c:83
rb_attr
void rb_attr(VALUE, ID, int, int, int)
Definition: vm_method.c:860
ossl_call_session_remove_cb
static VALUE ossl_call_session_remove_cb(VALUE ary)
Definition: ossl_ssl.c:436
ossl_ssl_attrs
static const char * ossl_ssl_attrs[]
Definition: ossl_ssl.c:97
ossl_sslctx_add_extra_chain_cert_i
static VALUE ossl_sslctx_add_extra_chain_cert_i(RB_BLOCK_CALL_FUNC_ARGLIST(i, arg))
Definition: ossl_ssl.c:480
ossl_sslctx_get_extra_cert
#define ossl_sslctx_get_extra_cert(o)
Definition: ossl_ssl.c:62
rb_str_cat2
VALUE rb_str_cat2(VALUE, const char *)
Definition: string.c:2159
rb_ary_new
VALUE rb_ary_new(void)
Definition: array.c:495
snprintf
#define snprintf
Definition: subst.h:6
NIL_P
#define NIL_P(v)
Definition: ruby.h:438
ossl_ssl_accept_nonblock
static VALUE ossl_ssl_accept_nonblock(VALUE self)
Definition: ossl_ssl.c:1367
ossl_sslctx_get_sess_id_ctx
#define ossl_sslctx_get_sess_id_ctx(o)
Definition: ossl_ssl.c:65
ossl_sslctx_attrs
static const char * ossl_sslctx_attrs[]
Definition: ossl_ssl.c:67
ossl_sslctx_get_ca_file
#define ossl_sslctx_get_ca_file(o)
Definition: ossl_ssl.c:54
ossl_ssl_write_internal
static VALUE ossl_ssl_write_internal(VALUE self, VALUE str, int nonblock, int no_exception)
Definition: ossl_ssl.c:1478
rb_define_const
void rb_define_const(VALUE, const char *, VALUE)
Definition: variable.c:2225
rb_io_wait_writable
int rb_io_wait_writable(int)
Definition: io.c:1103
unistd.h
ossl_sslctx_get_verify_dep
#define ossl_sslctx_get_verify_dep(o)
Definition: ossl_ssl.c:58
OBJ_FROZEN
#define OBJ_FROZEN(x)
Definition: ruby.h:1185
eOSSLError
VALUE eOSSLError
Definition: ossl.c:264
ossl_ssl_pending
static VALUE ossl_ssl_pending(VALUE self)
Definition: ossl_ssl.c:1728
ossl_sslctx_setup
static VALUE ossl_sslctx_setup(VALUE self)
Definition: ossl_ssl.c:657
TYPE
#define TYPE(x)
Definition: ruby.h:505
argc
int argc
Definition: ruby.c:131
Qfalse
#define Qfalse
Definition: ruby.h:425
ossl_x509_new
VALUE ossl_x509_new(X509 *)
Definition: ossl_x509cert.c:40
ossl_ssl_read_internal
static VALUE ossl_ssl_read_internal(int argc, VALUE *argv, VALUE self, int nonblock)
Definition: ossl_ssl.c:1374
rb_str_new2
#define rb_str_new2
Definition: intern.h:840
rb_obj_alloc
VALUE rb_obj_alloc(VALUE)
Definition: object.c:1801
ossl_ssl_set_sync_close
#define ossl_ssl_set_sync_close(o, v)
Definition: ossl_ssl.c:91
ossl_ssl_set_session
static VALUE ossl_ssl_set_session(VALUE self, VALUE arg1)
Definition: ossl_ssl.c:1766
ossl_sslctx_get_verify_cb
#define ossl_sslctx_get_verify_cb(o)
Definition: ossl_ssl.c:59
ossl_ssl_get_verify_result
static VALUE ossl_ssl_get_verify_result(VALUE self)
Definition: ossl_ssl.c:1794
ossl_ssl_get_state
static VALUE ossl_ssl_get_state(VALUE self)
Definition: ossl_ssl.c:1706
ossl_sslctx_get_session_cache_mode
static VALUE ossl_sslctx_get_session_cache_mode(VALUE self)
Definition: ossl_ssl.c:954
ossl_sslctx_session_get_cb
static SSL_SESSION * ossl_sslctx_session_get_cb(SSL *ssl, unsigned char *buf, int len, int *copy)
Definition: ossl_ssl.c:354
ossl_sslctx_get_verify_mode
#define ossl_sslctx_get_verify_mode(o)
Definition: ossl_ssl.c:57
rb_str_resize
VALUE rb_str_resize(VALUE, long)
Definition: string.c:2025
TO_SOCKET
#define TO_SOCKET(s)
Definition: ossl_ssl.c:24
rb_define_alias
void rb_define_alias(VALUE klass, const char *name1, const char *name2)
Defines an alias of a method.
Definition: class.c:1697
ossl_ssl_get_client_ca_list
static VALUE ossl_ssl_get_client_ca_list(VALUE self)
Definition: ossl_ssl.c:1815
write_would_block
static void write_would_block(int nonblock)
Definition: ossl_ssl.c:1235
ossl_ssl_setup
static VALUE ossl_ssl_setup(VALUE self)
Definition: ossl_ssl.c:1173
func
SSL_METHOD *(* func)(void)
Definition: ossl_ssl.c:113
errno
int errno
cSSLContext
VALUE cSSLContext
Definition: ossl_ssl.c:29
OSSL_SSL_METHOD_ENTRY
#define OSSL_SSL_METHOD_ENTRY(name)
ossl_ssl_initialize
static VALUE ossl_ssl_initialize(int argc, VALUE *argv, VALUE self)
Definition: ossl_ssl.c:1151
ossl_sslctx_get_cert_store
#define ossl_sslctx_get_cert_store(o)
Definition: ossl_ssl.c:61
cSSLSocket
VALUE cSSLSocket
Definition: ossl_ssl.c:30
rb_mWaitWritable
RUBY_EXTERN VALUE rb_mWaitWritable
Definition: ruby.h:1550
rb_hash_new
VALUE rb_hash_new(void)
Definition: hash.c:298
ossl_ssl_set_x509
#define ossl_ssl_set_x509(o, v)
Definition: ossl_ssl.c:92
ossl_sslctx_get_timeout
#define ossl_sslctx_get_timeout(o)
Definition: ossl_ssl.c:56
ossl_sslctx_session_remove
static VALUE ossl_sslctx_session_remove(VALUE self, VALUE arg)
Definition: ossl_ssl.c:936
rb_scan_args
int rb_scan_args(int argc, const VALUE *argv, const char *fmt,...)
Definition: class.c:1728
rb_ivar_set
VALUE rb_ivar_set(VALUE, ID, VALUE)
Definition: variable.c:1133
buf
unsigned char buf[MIME_BUF_SIZE]
Definition: nkf.c:4308
ID
unsigned long ID
Definition: ruby.h:89
rb_thread_wait_fd
void rb_thread_wait_fd(int)
Definition: thread.c:3519
ossl_ssl_data_get_struct
#define ossl_ssl_data_get_struct(v, ssl)
Definition: ossl_ssl.c:1225
Qnil
#define Qnil
Definition: ruby.h:427
ossl_ssl_write_nonblock
static VALUE ossl_ssl_write_nonblock(int argc, VALUE *argv, VALUE self)
Definition: ossl_ssl.c:1541
ossl_ssl_get_x509
#define ossl_ssl_get_x509(o)
Definition: ossl_ssl.c:85
ossl_sslctx_get_options
#define ossl_sslctx_get_options(o)
Definition: ossl_ssl.c:60
OBJ_TAINT
#define OBJ_TAINT(x)
Definition: ruby.h:1177
VALUE
unsigned long VALUE
Definition: ruby.h:88
ossl_call_session_new_cb
static VALUE ossl_call_session_new_cb(VALUE ary)
Definition: ossl_ssl.c:384
ossl_sslctx_set_ciphers
static VALUE ossl_sslctx_set_ciphers(VALUE self, VALUE v)
Definition: ossl_ssl.c:876
ossl_client_cert_cb
static int ossl_client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
Definition: ossl_ssl.c:261
ossl_sslctx_set_session_cache_mode
static VALUE ossl_sslctx_set_session_cache_mode(VALUE self, VALUE arg)
Definition: ossl_ssl.c:972
ossl_ssl_get_key
#define ossl_ssl_get_key(o)
Definition: ossl_ssl.c:86
rb_call_super
VALUE rb_call_super(int, const VALUE *)
Definition: vm_eval.c:274
eSSLErrorWaitWritable
static VALUE eSSLErrorWaitWritable
Definition: ossl_ssl.c:33
ssl_renegotiation_cb
static void ssl_renegotiation_cb(const SSL *ssl)
Definition: ossl_ssl.c:555
rb_sys_fail
void rb_sys_fail(const char *mesg)
Definition: error.c:1976
OSSL_Debug
#define OSSL_Debug
Definition: ossl.h:211
rb_jump_tag
void rb_jump_tag(int tag)
Definition: eval.c:706
_
#define _(args)
Definition: dln.h:28
GetX509StorePtr
X509_STORE * GetX509StorePtr(VALUE)
Definition: ossl_x509store.c:68
LONG2NUM
#define LONG2NUM(x)
Definition: ruby.h:1309
rb_define_module_under
VALUE rb_define_module_under(VALUE outer, const char *name)
Definition: class.c:766
StringValueCStr
#define StringValueCStr(v)
Definition: ruby.h:541
ossl_sslctx_get_tmp_dh_cb
#define ossl_sslctx_get_tmp_dh_cb(o)
Definition: ossl_ssl.c:64
ossl_sslctx_get_ca_path
#define ossl_sslctx_get_ca_path(o)
Definition: ossl_ssl.c:55
RSTRING_PTR
#define RSTRING_PTR(str)
Definition: ruby.h:845
rb_obj_is_instance_of
VALUE rb_obj_is_instance_of(VALUE, VALUE)
Definition: object.c:615
ossl_ssl_get_peer_cert
static VALUE ossl_ssl_get_peer_cert(VALUE self)
Definition: ossl_ssl.c:1615
rb_str_modify
void rb_str_modify(VALUE)
Definition: string.c:1484
ossl_call_session_get_cb
static VALUE ossl_call_session_get_cb(VALUE ary)
Definition: ossl_ssl.c:337
INT2FIX
#define INT2FIX(i)
Definition: ruby.h:231
rb_hash_aref
VALUE rb_hash_aref(VALUE hash, VALUE key)
Definition: hash.c:697
RARRAY_PTR
#define RARRAY_PTR(a)
Definition: ruby.h:907
ossl_ssl_free
static void ossl_ssl_free(SSL *ssl)
Definition: ossl_ssl.c:1123
OSSL_Check_Kind
#define OSSL_Check_Kind(obj, klass)
Definition: ossl.h:96
key
uint8_t key[16]
Definition: random.c:1250
ssl_info_cb
static void ssl_info_cb(const SSL *ssl, int where, int val)
Definition: ossl_ssl.c:637
LONG2FIX
#define LONG2FIX(i)
Definition: ruby.h:232
RTEST
#define RTEST(v)
Definition: ruby.h:437
ossl_ssl_set_io
#define ossl_ssl_set_io(o, v)
Definition: ossl_ssl.c:89
T_FILE
#define T_FILE
Definition: ruby.h:488
ossl_ssl_def_const
#define ossl_ssl_def_const(x)
rb_each
VALUE rb_each(VALUE)
Definition: vm_eval.c:1175
cSSLSession
VALUE cSSLSession
Definition: ossl_ssl_session.c:20
ossl_raise
void ossl_raise(VALUE exc, const char *fmt,...)
Definition: ossl.c:333
ossl_ssl_verify_callback
static int ossl_ssl_verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
Definition: ossl_ssl.c:325
GetPKeyPtr
EVP_PKEY * GetPKeyPtr(VALUE obj)
Definition: ossl_pkey.c:174
rb_notimplement
void rb_notimplement(void)
Definition: error.c:1903
ossl_ssl_get_version
static VALUE ossl_ssl_get_version(VALUE self)
Definition: ossl_ssl.c:1671
hash
static unsigned int hash(const char *str, unsigned int len)
Definition: lex.c:56
ossl_sslctx_set_session_cache_size
static VALUE ossl_sslctx_set_session_cache_size(VALUE self, VALUE arg)
Definition: ossl_ssl.c:1008
DupPKeyPtr
EVP_PKEY * DupPKeyPtr(VALUE obj)
Definition: ossl_pkey.c:197
DupX509CertPtr
X509 * DupX509CertPtr(VALUE)
Definition: ossl_x509cert.c:102
rb_io_check_writable
void rb_io_check_writable(rb_io_t *)
Definition: io.c:818
eSSLError
VALUE eSSLError
Definition: ossl_ssl.c:28
ID2SYM
#define ID2SYM(x)
Definition: ruby.h:355
ossl_ssl_get_peer_cert_chain
static VALUE ossl_ssl_get_peer_cert_chain(VALUE self)
Definition: ossl_ssl.c:1641
rb_id2name
const char * rb_id2name(ID id)
Definition: ripper.c:17230
ossl.h
ossl_ssl_attr_readers
static const char * ossl_ssl_attr_readers[]
Definition: ossl_ssl.c:96
StringValuePtr
#define StringValuePtr(v)
Definition: ruby.h:540
ossl_sslctx_flush_sessions
static VALUE ossl_sslctx_flush_sessions(int argc, VALUE *argv, VALUE self)
Definition: ossl_ssl.c:1074
rb_warning
void rb_warning(const char *fmt,...)
Definition: error.c:236
RSTRING_LENINT
#define RSTRING_LENINT(str)
Definition: ruby.h:853
SafeGetSSLSession
#define SafeGetSSLSession(obj, sess)
Definition: ossl_ssl.h:21
rb_check_frozen
#define rb_check_frozen(obj)
Definition: intern.h:277
name
const char * name
Definition: ossl_ssl.c:112
rb_obj_freeze
VALUE rb_obj_freeze(VALUE)
Definition: object.c:1076
ossl_sslctx_session_remove_cb
static void ossl_sslctx_session_remove_cb(SSL_CTX *ctx, SSL_SESSION *sess)
Definition: ossl_ssl.c:450
ossl_sslctx_set_ssl_version
static VALUE ossl_sslctx_set_ssl_version(VALUE self, VALUE ssl_method)
Definition: ossl_ssl.c:186
rb_define_module
VALUE rb_define_module(const char *name)
Definition: class.c:746
ossl_sslctx_session_new_cb
static int ossl_sslctx_session_new_cb(SSL *ssl, SSL_SESSION *sess)
Definition: ossl_ssl.c:401
read_would_block
static void read_would_block(int nonblock)
Definition: ossl_ssl.c:1244
rb_intern
#define rb_intern(str)
ossl_ssl_connect
static VALUE ossl_ssl_connect(VALUE self)
Definition: ossl_ssl.c:1303
NULL
#define NULL
Definition: _sdbm.c:103
rb_io_wait_readable
int rb_io_wait_readable(int)
Definition: io.c:1077
rb_cTime
RUBY_EXTERN VALUE rb_cTime
Definition: ruby.h:1587
ossl_sslctx_s_alloc
static VALUE ossl_sslctx_s_alloc(VALUE klass)
Definition: ossl_ssl.c:161
OSSL_DEFAULT_DH_1024
DH * OSSL_DEFAULT_DH_1024
Definition: ossl_pkey_dh.c:569
rb_define_method
void rb_define_method(VALUE klass, const char *name, VALUE(*func)(ANYARGS), int argc)
Definition: class.c:1488
ruby_verbose
#define ruby_verbose
Definition: ruby.h:1475
rb_str_append
VALUE rb_str_append(VALUE, VALUE)
Definition: string.c:2298
ossl_ssl_cipher_to_ary
static VALUE ossl_ssl_cipher_to_ary(SSL_CIPHER *cipher)
Definition: ossl_ssl.c:814
ossl_start_ssl
static VALUE ossl_start_ssl(VALUE self, int(*func)(), const char *funcname, int nonblock)
Definition: ossl_ssl.c:1253
rb_eArgError
VALUE rb_eArgError
Definition: error.c:549
NUM2LONG
#define NUM2LONG(x)
Definition: ruby.h:600
ossl_verify_cb
int ossl_verify_cb(int ok, X509_STORE_CTX *ctx)
Definition: ossl.c:211
ossl_ssl_set_ctx
#define ossl_ssl_set_ctx(o, v)
Definition: ossl_ssl.c:90
ossl_default_tmp_dh_callback
static DH * ossl_default_tmp_dh_callback(SSL *ssl, int is_export, int keylength)
Definition: ossl_ssl.c:310
argv
char ** argv
Definition: ruby.c:132
ossl_sslctx_get_session_cache_size
static VALUE ossl_sslctx_get_session_cache_size(VALUE self)
Definition: ossl_ssl.c:991
StringValue
#define StringValue(v)
Definition: ruby.h:539
ossl_ssl_ex_client_cert_cb_idx
int ossl_ssl_ex_client_cert_cb_idx
Definition: ossl_ssl.c:149
ossl_ssl_get_sync_close
#define ossl_ssl_get_sync_close(o)
Definition: ossl_ssl.c:84
rb_str_new
VALUE rb_str_new(const char *, long)
Definition: string.c:534
ossl_ssl_method_tab
struct @43 ossl_ssl_method_tab[]
rb_eof_error
void rb_eof_error(void)
Definition: io.c:596