Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updates and backports to 4-3-stable #2829

Merged
merged 4 commits into from
Feb 16, 2022
Merged

Updates and backports to 4-3-stable #2829

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
845e539
Actions - add Ruby 3.0 and 3.1
MSP-Greg Feb 13, 2022
9b8adbd
.gitignore - add entry for local use
MSP-Greg Feb 13, 2022
7362834
test_puma_server_ssl.rb - backport fix
MSP-Greg Feb 13, 2022
22b4b61
minissl.c and extconf.rb - backport fixes
MSP-Greg Feb 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
minissl.c and extconf.rb - backport fixes 
Fixes from PR's:
#2535
#2633
#2642
  • Loading branch information
@MSP-Greg
MSP-Greg committed Feb 13, 2022
commit 22b4b61116ade2d04eb0fc15dfd45d4063a4cbe6
8 changes: 8 additions & 0 deletions ext/puma_http11/extconf.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,14 @@
# with versions after 1.1.1
have_func "TLS_server_method" , "openssl/ssl.h"
have_macro "SSL_CTX_set_min_proto_version", "openssl/ssl.h"

# Random.bytes available in Ruby 2.5 and later, Random::DEFAULT deprecated in 3.0
if Random.respond_to?(:bytes)
$defs.push("-DHAVE_RANDOM_BYTES")
puts "checking for Random.bytes... yes"
else
puts "checking for Random.bytes... no"
end
end
end

Expand Down
129 changes: 82 additions & 47 deletions ext/puma_http11/mini_ssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,44 +62,65 @@ ms_conn* engine_alloc(VALUE klass, VALUE* obj) {
return conn;
}

DH *get_dh1024() {
/* `openssl dhparam 1024 -C`
DH *get_dh2048(void) {
/* `openssl dhparam -C 2048`
* -----BEGIN DH PARAMETERS-----
* MIGHAoGBALPwcEv0OstmQCZdfHw0N5r+07lmXMxkpQacy1blwj0LUqC+Divp6pBk
* usTJ9W2/dOYr1X7zi6yXNLp4oLzc/31PUL3D9q8CpGS7vPz5gijKSw9BwCTT5z9+
* KF9v46qw8XqT5HHV87sWFlGQcVFq+pEkA2kPikkKZ/X/CCcpCAV7AgEC
* MIIBCAKCAQEAjmh1uQHdTfxOyxEbKAV30fUfzqMDF/ChPzjfyzl2jcrqQMhrk76o
* 2NPNXqxHwsddMZ1RzvU8/jl+uhRuPWjXCFZbhET4N1vrviZM3VJhV8PPHuiVOACO
* y32jFd+Szx4bo2cXSK83hJ6jRd+0asP1awWjz9/06dFkrILCXMIfQLo0D8rqmppn
* EfDDAwuudCpM9kcDmBRAm9JsKbQ6gzZWjkc5+QWSaQofojIHbjvj3xzguaCJn+oQ
* vHWM+hsAnaOgEwCyeZ3xqs+/5lwSbkE/tqJW98cEZGygBUVo9jxZRZx6KOfjpdrb
* yenO9LJr/qtyrZB31WJbqxI0m0AKTAO8UwIBAg==
* -----END DH PARAMETERS-----
*/
static unsigned char dh1024_p[] = {
0xB3,0xF0,0x70,0x4B,0xF4,0x3A,0xCB,0x66,0x40,0x26,0x5D,0x7C,
0x7C,0x34,0x37,0x9A,0xFE,0xD3,0xB9,0x66,0x5C,0xCC,0x64,0xA5,
0x06,0x9C,0xCB,0x56,0xE5,0xC2,0x3D,0x0B,0x52,0xA0,0xBE,0x0E,
0x2B,0xE9,0xEA,0x90,0x64,0xBA,0xC4,0xC9,0xF5,0x6D,0xBF,0x74,
0xE6,0x2B,0xD5,0x7E,0xF3,0x8B,0xAC,0x97,0x34,0xBA,0x78,0xA0,
0xBC,0xDC,0xFF,0x7D,0x4F,0x50,0xBD,0xC3,0xF6,0xAF,0x02,0xA4,
0x64,0xBB,0xBC,0xFC,0xF9,0x82,0x28,0xCA,0x4B,0x0F,0x41,0xC0,
0x24,0xD3,0xE7,0x3F,0x7E,0x28,0x5F,0x6F,0xE3,0xAA,0xB0,0xF1,
0x7A,0x93,0xE4,0x71,0xD5,0xF3,0xBB,0x16,0x16,0x51,0x90,0x71,
0x51,0x6A,0xFA,0x91,0x24,0x03,0x69,0x0F,0x8A,0x49,0x0A,0x67,
0xF5,0xFF,0x08,0x27,0x29,0x08,0x05,0x7B
static unsigned char dh2048_p[] = {
0x8E, 0x68, 0x75, 0xB9, 0x01, 0xDD, 0x4D, 0xFC, 0x4E, 0xCB,
0x11, 0x1B, 0x28, 0x05, 0x77, 0xD1, 0xF5, 0x1F, 0xCE, 0xA3,
0x03, 0x17, 0xF0, 0xA1, 0x3F, 0x38, 0xDF, 0xCB, 0x39, 0x76,
0x8D, 0xCA, 0xEA, 0x40, 0xC8, 0x6B, 0x93, 0xBE, 0xA8, 0xD8,
0xD3, 0xCD, 0x5E, 0xAC, 0x47, 0xC2, 0xC7, 0x5D, 0x31, 0x9D,
0x51, 0xCE, 0xF5, 0x3C, 0xFE, 0x39, 0x7E, 0xBA, 0x14, 0x6E,
0x3D, 0x68, 0xD7, 0x08, 0x56, 0x5B, 0x84, 0x44, 0xF8, 0x37,
0x5B, 0xEB, 0xBE, 0x26, 0x4C, 0xDD, 0x52, 0x61, 0x57, 0xC3,
0xCF, 0x1E, 0xE8, 0x95, 0x38, 0x00, 0x8E, 0xCB, 0x7D, 0xA3,
0x15, 0xDF, 0x92, 0xCF, 0x1E, 0x1B, 0xA3, 0x67, 0x17, 0x48,
0xAF, 0x37, 0x84, 0x9E, 0xA3, 0x45, 0xDF, 0xB4, 0x6A, 0xC3,
0xF5, 0x6B, 0x05, 0xA3, 0xCF, 0xDF, 0xF4, 0xE9, 0xD1, 0x64,
0xAC, 0x82, 0xC2, 0x5C, 0xC2, 0x1F, 0x40, 0xBA, 0x34, 0x0F,
0xCA, 0xEA, 0x9A, 0x9A, 0x67, 0x11, 0xF0, 0xC3, 0x03, 0x0B,
0xAE, 0x74, 0x2A, 0x4C, 0xF6, 0x47, 0x03, 0x98, 0x14, 0x40,
0x9B, 0xD2, 0x6C, 0x29, 0xB4, 0x3A, 0x83, 0x36, 0x56, 0x8E,
0x47, 0x39, 0xF9, 0x05, 0x92, 0x69, 0x0A, 0x1F, 0xA2, 0x32,
0x07, 0x6E, 0x3B, 0xE3, 0xDF, 0x1C, 0xE0, 0xB9, 0xA0, 0x89,
0x9F, 0xEA, 0x10, 0xBC, 0x75, 0x8C, 0xFA, 0x1B, 0x00, 0x9D,
0xA3, 0xA0, 0x13, 0x00, 0xB2, 0x79, 0x9D, 0xF1, 0xAA, 0xCF,
0xBF, 0xE6, 0x5C, 0x12, 0x6E, 0x41, 0x3F, 0xB6, 0xA2, 0x56,
0xF7, 0xC7, 0x04, 0x64, 0x6C, 0xA0, 0x05, 0x45, 0x68, 0xF6,
0x3C, 0x59, 0x45, 0x9C, 0x7A, 0x28, 0xE7, 0xE3, 0xA5, 0xDA,
0xDB, 0xC9, 0xE9, 0xCE, 0xF4, 0xB2, 0x6B, 0xFE, 0xAB, 0x72,
0xAD, 0x90, 0x77, 0xD5, 0x62, 0x5B, 0xAB, 0x12, 0x34, 0x9B,
0x40, 0x0A, 0x4C, 0x03, 0xBC, 0x53
};
static unsigned char dh1024_g[] = { 0x02 };
static unsigned char dh2048_g[] = { 0x02 };

DH *dh;
#if !(OPENSSL_VERSION_NUMBER < 0x10100005L || defined(LIBRESSL_VERSION_NUMBER))
BIGNUM *p, *g;
#endif

dh = DH_new();

#if OPENSSL_VERSION_NUMBER < 0x10100005L || defined(LIBRESSL_VERSION_NUMBER)
dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL);
dh->g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL);
dh->p = BN_bin2bn(dh2048_p, sizeof(dh2048_p), NULL);
dh->g = BN_bin2bn(dh2048_g, sizeof(dh2048_g), NULL);

if ((dh->p == NULL) || (dh->g == NULL)) {
DH_free(dh);
return NULL;
}
#else
BIGNUM *p, *g;
p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL);
g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL);
p = BN_bin2bn(dh2048_p, sizeof(dh2048_p), NULL);
g = BN_bin2bn(dh2048_g, sizeof(dh2048_g), NULL);

if (p == NULL || g == NULL || !DH_set0_pqg(dh, p, NULL, g)) {
DH_free(dh);
Expand Down Expand Up @@ -139,7 +160,7 @@ static int engine_verify_callback(int preverify_ok, X509_STORE_CTX* ctx) {
}

VALUE engine_init_server(VALUE self, VALUE mini_ssl_ctx) {
VALUE obj;
VALUE obj, session_id_bytes;
SSL_CTX* ctx;
SSL* ssl;
int min, ssl_options;
Expand Down Expand Up @@ -198,7 +219,7 @@ VALUE engine_init_server(VALUE self, VALUE mini_ssl_ctx) {
else {
min = TLS1_VERSION;
}

SSL_CTX_set_min_proto_version(ctx, min);

SSL_CTX_set_options(ctx, ssl_options);
Expand Down Expand Up @@ -226,7 +247,21 @@ VALUE engine_init_server(VALUE self, VALUE mini_ssl_ctx) {
SSL_CTX_set_cipher_list(ctx, "HIGH:!aNULL@STRENGTH");
}

DH *dh = get_dh1024();
// Random.bytes available in Ruby 2.5 and later, Random::DEFAULT deprecated in 3.0
session_id_bytes = rb_funcall(
#ifdef HAVE_RANDOM_BYTES
rb_cRandom,
#else
rb_const_get(rb_cRandom, rb_intern_const("DEFAULT")),
#endif
rb_intern_const("bytes"),
1, ULL2NUM(SSL_MAX_SSL_SESSION_ID_LENGTH));

SSL_CTX_set_session_id_context(ctx,
(unsigned char *) RSTRING_PTR(session_id_bytes),
SSL_MAX_SSL_SESSION_ID_LENGTH);

DH *dh = get_dh2048();
SSL_CTX_set_tmp_dh(ctx, dh);

#if OPENSSL_VERSION_NUMBER < 0x10002000L
Expand Down Expand Up @@ -493,27 +528,27 @@ void Init_mini_ssl(VALUE puma) {
#else
rb_define_const(mod, "OPENSSL_LIBRARY_VERSION", rb_str_new2(SSLeay_version(SSLEAY_VERSION)));
#endif
#if defined(OPENSSL_NO_SSL3) || defined(OPENSSL_NO_SSL3_METHOD)
/* True if SSL3 is not available */
rb_define_const(mod, "OPENSSL_NO_SSL3", Qtrue);
#else
rb_define_const(mod, "OPENSSL_NO_SSL3", Qfalse);
#endif

#if defined(OPENSSL_NO_TLS1) || defined(OPENSSL_NO_TLS1_METHOD)
/* True if TLS1 is not available */
rb_define_const(mod, "OPENSSL_NO_TLS1", Qtrue);
#else
rb_define_const(mod, "OPENSSL_NO_TLS1", Qfalse);
#endif

#if defined(OPENSSL_NO_TLS1_1) || defined(OPENSSL_NO_TLS1_1_METHOD)
/* True if TLS1_1 is not available */
rb_define_const(mod, "OPENSSL_NO_TLS1_1", Qtrue);
#else
rb_define_const(mod, "OPENSSL_NO_TLS1_1", Qfalse);
#endif

#if defined(OPENSSL_NO_SSL3) || defined(OPENSSL_NO_SSL3_METHOD)
/* True if SSL3 is not available */
rb_define_const(mod, "OPENSSL_NO_SSL3", Qtrue);
#else
rb_define_const(mod, "OPENSSL_NO_SSL3", Qfalse);
#endif

#if defined(OPENSSL_NO_TLS1) || defined(OPENSSL_NO_TLS1_METHOD)
/* True if TLS1 is not available */
rb_define_const(mod, "OPENSSL_NO_TLS1", Qtrue);
#else
rb_define_const(mod, "OPENSSL_NO_TLS1", Qfalse);
#endif

#if defined(OPENSSL_NO_TLS1_1) || defined(OPENSSL_NO_TLS1_1_METHOD)
/* True if TLS1_1 is not available */
rb_define_const(mod, "OPENSSL_NO_TLS1_1", Qtrue);
#else
rb_define_const(mod, "OPENSSL_NO_TLS1_1", Qfalse);
#endif

rb_define_singleton_method(mod, "check", noop, 0);

Expand Down