Open
Conversation
OpenSSL's master branch is changing functions to return const pointers where the returned objects are not meant to be modified by the caller. Update ossl_*_new() to take const pointers accordingly. Unfortunately, *_dup() in older versions of OpenSSL and in LibreSSL/AWS-LC take non-const pointers, so const casts are required.
ossl_ec_new() was removed in commit 94aeab2 (pkey: simplify ossl_pkey_new(), 2017-03-16), but it forgot to remove the declaration while doing so.
ASN1_STRING has been made opaque in OpenSSL's master branch. Use the new accessor functions instead of accessing fields directly. Other uses of ASN1_STRING fields were already updated in <ruby#978>. This patch converts the remaining ones, which require the new functions added in OpenSSL 4.0 and were not available at that time.
OpenSSL master added support for RFC 7919 groups in TLS 1.2. They are preferred over SSLContext#tmp_dh= or #tmp_dh_callback= values if the client advertises them in the supported_groups extension.
Member
Author
|
Here is the error. https://github.com/ruby/openssl/actions/runs/23562768731/job/68606686661?pr=1019#step:11:590 |
Member
Author
|
I got the following CI log when I ran without the 5th commit (my commit) now. Interestingly there is no error about https://github.com/junaruga/ruby-openssl/actions/runs/23566877802/job/68620449742 |
Member
Author
|
There are differences between my local and GitHub Actions openssl-master environment. The differences may make the GitHub Actions specific test failure. My localOS: Fedora Linux 43 Ruby version GitHub Actions openssl-masterOS: Ubuntu 24.04.4 LTS Ruby version: |
Member
Author
|
Oh I just noticed the https://github.com/ruby/openssl/actions/runs/23562768731/job/68606686661?pr=1019#step:11:600 |
Use AES-256-CBC for OpenSSL to avoid errors on the error stack in teardown with OpenSSL 4.0. Use AES-256-CBC for LibreSSL and AWS-LC, as they don't support AES-256-CBC well. This commit fixes the following test failures. https://github.com/ruby/openssl/actions/runs/23093927984/job/67083113067?pr=1005 ``` 2) Failure: test_create_no_pass(OpenSSL::TestPKCS12) /home/runner/work/openssl/openssl/test/openssl/utils.rb:140:in `teardown' <[]> expected but was <["error:0308010C:digital envelope routines::unsupported"]> diff: ? ["error:0308010C:digital envelope routines::unsupported"] ```
junaruga
changed the title
Member
Author
|
For the It seems the test failed because the length of the password ( The stack trace is below. |
…FIPS. OpenSSL 4.0.0 added a check for Password-Based Key Derivation Function 2 (PBKDF2) to require the minimal password length 8 in FIPS by the following commit. openssl/openssl@71ed0fc This commit fixes the following test failure in OpenSSL 4.0 FIPS by changing testing password length from 6 to 8.. ``` 1) Error: test_private_encoding_encrypted(OpenSSL::TestPKeyRSA): OpenSSL::PKey::PKeyError: i2d_PKCS8PrivateKey_bio: encrypt error /home/runner/work/openssl/openssl/test/openssl/test_pkey_rsa.rb:465:in `private_to_der' /home/runner/work/openssl/openssl/test/openssl/test_pkey_rsa.rb:465:in `test_private_encoding_encrypted' 462: 463: def test_private_encoding_encrypted 464: rsa = Fixtures.pkey("rsa2048") => 465: encoded = rsa.private_to_der("aes-128-cbc", "abcdef") 466: asn1 = OpenSSL::ASN1.decode(encoded) # PKCS ruby#8 EncryptedPrivateKeyInfo 467: assert_kind_of OpenSSL::ASN1::Sequence, asn1 468: assert_equal 2, asn1.value.size Error: OpenSSL::PKey::PKeyError: i2d_PKCS8PrivateKey_bio: encrypt error ```
junaruga
force-pushed
the
wip/openssl-4.0-compatibility
branch
from
528c991 to
f909fd5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is based on the #1005, fixing the following test failures with OpenSSL master case. I don't intend to merge this PR. It's just show the result of the CI. I added the 5th commit on the #1005.
Use AES-256-CBC for OpenSSL to avoid errors on the error stack with OpenSSL 4.0. LibreSSL and AWS-LC don't support AES-256-CBC well, so use PBE-SHA1-3DES for them.
I haven't checked which commit of the openssl/openssl master branch caused the error.
This commit fixes the following test failures.
https://github.com/ruby/openssl/actions/runs/23093927984/job/67083113067?pr=1005
However, I see other kind of test failure. I cannot reproduce this failure on my local, even when using the same commit of the OpenSSL openssl/openssl@5f084f8.
https://github.com/junaruga/ruby-openssl/actions/runs/23562223843/job/68604792678#step:11:590