ruby-changes:10228
From: technorama <ko1@a...>
Date: Mon, 26 Jan 2009 05:38:05 +0900 (JST)
Subject: [ruby-changes:10228] Ruby:r21772 (ruby_1_8): * ext/openssl/ossl_ssl.c: Server Name Indication support.
technorama 2009-01-26 05:37:52 +0900 (Mon, 26 Jan 2009) New Revision: 21772 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=21772 Log: * ext/openssl/ossl_ssl.c: Server Name Indication support. new methods SSLContext#server_name_cb=, SSLSocket#hostname=. * test/openssl/test_ssl.rb: Tests for above. Modified files: branches/ruby_1_8/ChangeLog branches/ruby_1_8/ext/openssl/extconf.rb branches/ruby_1_8/ext/openssl/ossl_ssl.c branches/ruby_1_8/ext/openssl/ossl_x509ext.c branches/ruby_1_8/test/openssl/test_ssl.rb Index: ruby_1_8/ext/openssl/ossl_ssl.c =================================================================== --- ruby_1_8/ext/openssl/ossl_ssl.c (revision 21771) +++ ruby_1_8/ext/openssl/ossl_ssl.c (revision 21772) @@ -75,6 +75,9 @@ "verify_callback", "options", "cert_store", "extra_chain_cert", "client_cert_cb", "tmp_dh_callback", "session_id_context", "session_get_cb", "session_new_cb", "session_remove_cb", +#ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME + "servername_cb", +#endif }; #define ossl_ssl_get_io(o) rb_iv_get((o),"@io") @@ -92,7 +95,12 @@ #define ossl_ssl_set_tmp_dh(o,v) rb_iv_set((o),"@tmp_dh",(v)) static const char *ossl_ssl_attr_readers[] = { "io", "context", }; -static const char *ossl_ssl_attrs[] = { "sync_close", }; +static const char *ossl_ssl_attrs[] = { +#ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME + "hostname", +#endif + "sync_close", +}; ID ID_callback_state; @@ -454,6 +462,66 @@ return i; } +static VALUE ossl_sslctx_setup(VALUE self); + +#ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME +static VALUE +ossl_call_servername_cb(VALUE ary) +{ + VALUE ssl_obj, sslctx_obj, cb, ret_obj; + + Check_Type(ary, T_ARRAY); + ssl_obj = rb_ary_entry(ary, 0); + + sslctx_obj = rb_iv_get(ssl_obj, "@context"); + if (NIL_P(sslctx_obj)) return Qnil; + cb = rb_iv_get(sslctx_obj, "@servername_cb"); + if (NIL_P(cb)) return Qnil; + + ret_obj = rb_funcall(cb, rb_intern("call"), 1, ary); + if (rb_obj_is_kind_of(ret_obj, cSSLContext)) { + SSL *ssl; + SSL_CTX *ctx2; + + ossl_sslctx_setup(ret_obj); + Data_Get_Struct(ssl_obj, SSL, ssl); + Data_Get_Struct(ret_obj, SSL_CTX, ctx2); + SSL_set_SSL_CTX(ssl, ctx2); + } else if (!NIL_P(ret_obj)) { + rb_raise(rb_eArgError, "servername_cb must return an OpenSSL::SSL::SSLContext object or nil"); + } + + return ret_obj; +} + +static int +ssl_servername_cb(SSL *ssl, int *ad, void *arg) +{ + VALUE ary, ssl_obj, ret_obj; + void *ptr; + int state = 0; + const char *servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name); + + if (!servername) + return SSL_TLSEXT_ERR_OK; + + if ((ptr = SSL_get_ex_data(ssl, ossl_ssl_ex_ptr_idx)) == NULL) + return SSL_TLSEXT_ERR_ALERT_FATAL; + ssl_obj = (VALUE)ptr; + ary = rb_ary_new2(2); + rb_ary_push(ary, ssl_obj); + rb_ary_push(ary, rb_str_new2(servername)); + + ret_obj = rb_protect((VALUE(*)_((VALUE)))ossl_call_servername_cb, ary, &state); + if (state) { + rb_ivar_set(ssl_obj, ID_callback_state, INT2NUM(state)); + return SSL_TLSEXT_ERR_ALERT_FATAL; + } + + return SSL_TLSEXT_ERR_OK; +} +#endif + /* * call-seq: * ctx.setup => Qtrue # first time @@ -589,6 +657,15 @@ SSL_CTX_sess_set_remove_cb(ctx, ossl_sslctx_session_remove_cb); OSSL_Debug("SSL SESSION remove callback added"); } + +#ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME + val = rb_iv_get(self, "@servername_cb"); + if (!NIL_P(val)) { + SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb); + OSSL_Debug("SSL TLSEXT servername callback added"); + } +#endif + return Qtrue; } @@ -894,6 +971,9 @@ ossl_ssl_set_ctx(self, ctx); ossl_ssl_set_sync_close(self, Qfalse); ossl_sslctx_setup(ctx); + + rb_iv_set(self, "@hostname", Qnil); + rb_call_super(0, 0); return self; @@ -909,6 +989,10 @@ Data_Get_Struct(self, SSL, ssl); if(!ssl){ +#ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME + VALUE hostname = rb_iv_get(self, "@hostname"); +#endif + v_ctx = ossl_ssl_get_ctx(self); Data_Get_Struct(v_ctx, SSL_CTX, ctx); @@ -918,6 +1002,12 @@ } DATA_PTR(self) = ssl; +#ifdef HAVE_SSL_SET_TLSEXT_HOST_NAME + if (!NIL_P(hostname)) { + if (SSL_set_tlsext_host_name(ssl, StringValuePtr(hostname)) != 1) + ossl_raise(eSSLError, "SSL_set_tlsext_host_name:"); + } +#endif io = ossl_ssl_get_io(self); GetOpenFile(io, fptr); rb_io_check_readable(fptr); @@ -954,7 +1044,15 @@ Data_Get_Struct(self, SSL, ssl); GetOpenFile(ossl_ssl_get_io(self), fptr); for(;;){ - if((ret = func(ssl)) > 0) break; + ret = func(ssl); + + cb_state = rb_ivar_get(self, ID_callback_state); + if (!NIL_P(cb_state)) + rb_jump_tag(NUM2INT(cb_state)); + + if (ret > 0) + break; + switch((ret2 = ssl_get_error(ssl, ret))){ case SSL_ERROR_WANT_WRITE: rb_io_wait_writable(FPTR_TO_FD(fptr)); @@ -970,10 +1068,6 @@ } } - cb_state = rb_ivar_get(self, ID_callback_state); - if (!NIL_P(cb_state)) - rb_jump_tag(NUM2INT(cb_state)); - return self; } Index: ruby_1_8/ext/openssl/ossl_x509ext.c =================================================================== --- ruby_1_8/ext/openssl/ossl_x509ext.c (revision 21771) +++ ruby_1_8/ext/openssl/ossl_x509ext.c (revision 21772) @@ -110,6 +110,7 @@ VALUE obj; MakeX509ExtFactory(klass, obj, ctx); + rb_iv_set(obj, "@config", Qnil); return obj; } Index: ruby_1_8/ext/openssl/extconf.rb =================================================================== --- ruby_1_8/ext/openssl/extconf.rb (revision 21771) +++ ruby_1_8/ext/openssl/extconf.rb (revision 21772) @@ -96,6 +96,9 @@ have_func("OBJ_NAME_do_all_sorted") have_func("SSL_SESSION_get_id") have_func("OPENSSL_cleanse") +unless have_func("SSL_set_tlsext_host_name", ['openssl/ssl.h']) + have_macro("SSL_set_tlsext_host_name", ['openssl/ssl.h']) && $defs.push("-DHAVE_SSL_SET_TLSEXT_HOST_NAME") +end if try_compile("#define FOO(a, ...) foo(a, ##__VA_ARGS__)\n int x(){FOO(1);FOO(1,2);FOO(1,2,3);}\n") $defs.push("-DHAVE_VA_ARGS_MACRO") end Index: ruby_1_8/ChangeLog =================================================================== --- ruby_1_8/ChangeLog (revision 21771) +++ ruby_1_8/ChangeLog (revision 21772) @@ -1,3 +1,10 @@ +Mon Jan 26 05:36:55 2009 Technorama Ltd. <oss-ruby@t...> + + * ext/openssl/ossl_ssl.c: Server Name Indication support. + new methods SSLContext#server_name_cb=, SSLSocket#hostname=. + + * test/openssl/test_ssl.rb: Tests for above. + Fri Jan 23 15:12:52 2009 Nobuyoshi Nakada <nobu@r...> * lib/mkmf.rb (mkintpath): new function which converts native path Index: ruby_1_8/test/openssl/test_ssl.rb =================================================================== --- ruby_1_8/test/openssl/test_ssl.rb (revision 21771) +++ ruby_1_8/test/openssl/test_ssl.rb (revision 21772) @@ -544,6 +544,50 @@ end end end + + def test_tlsext_hostname + return unless OpenSSL::SSL::SSLSocket.instance_methods.include?("hostname") + + ctx_proc = Proc.new do |ctx, ssl| + foo_ctx = ctx.dup + + ctx.servername_cb = Proc.new do |ssl, hostname| + case hostname + when 'foo.example.com' + foo_ctx + when 'bar.example.com' + nil + else + raise "unknown hostname #{hostname.inspect}" + end + end + end + + server_proc = Proc.new do |ctx, ssl| + readwrite_loop(ctx, ssl) + end + + start_server(PORT, OpenSSL::SSL::VERIFY_NONE, true, :ctx_proc => ctx_proc, :server_proc => server_proc) do |server, port| + 2.times do |i| + sock = TCPSocket.new("127.0.0.1", port) + ctx = OpenSSL::SSL::SSLContext.new + if defined?(OpenSSL::SSL::OP_NO_TICKET) + # disable RFC4507 support + ctx.options = OpenSSL::SSL::OP_NO_TICKET + end + ssl = OpenSSL::SSL::SSLSocket.new(sock, ctx) + ssl.sync_close = true + ssl.hostname = (i & 1 == 0) ? 'foo.example.com' : 'bar.example.com' + ssl.connect + + str = "x" * 100 + "\n" + ssl.puts(str) + assert_equal(str, ssl.gets) + + ssl.close + end + end + end end end -- ML: ruby-changes@q... Info: http://www.atdot.net/~ko1/quickml/