aboutsummaryrefslogtreecommitdiff
path: root/openssl
diff options
context:
space:
mode:
Diffstat (limited to 'openssl')
-rw-r--r--openssl/Cargo.toml9
-rw-r--r--openssl/src/bn/mod.rs169
-rw-r--r--openssl/src/crypto/hash.rs48
-rw-r--r--openssl/src/crypto/hmac.rs3
-rw-r--r--openssl/src/crypto/mod.rs8
-rw-r--r--openssl/src/crypto/pkey.rs73
-rw-r--r--openssl/src/crypto/rsa.rs272
-rw-r--r--openssl/src/crypto/util.rs58
-rw-r--r--openssl/src/lib.rs2
-rw-r--r--openssl/src/nid.rs6
-rw-r--r--openssl/src/ssl/bio.rs31
-rw-r--r--openssl/src/ssl/mod.rs54
-rw-r--r--openssl/src/ssl/tests/mod.rs26
-rw-r--r--openssl/src/version.rs3
-rw-r--r--openssl/src/x509/mod.rs46
-rw-r--r--openssl/src/x509/tests.rs29
-rw-r--r--openssl/test/rsa-encrypted.pem30
-rwxr-xr-xopenssl/test/run.sh2
18 files changed, 642 insertions, 227 deletions
diff --git a/openssl/Cargo.toml b/openssl/Cargo.toml
index 3f5a4388..218969eb 100644
--- a/openssl/Cargo.toml
+++ b/openssl/Cargo.toml
@@ -1,11 +1,11 @@
[package]
name = "openssl"
-version = "0.7.11"
+version = "0.7.14"
authors = ["Steven Fackler <[email protected]>"]
license = "Apache-2.0"
description = "OpenSSL bindings"
repository = "https://github.com/sfackler/rust-openssl"
-documentation = "https://sfackler.github.io/rust-openssl/doc/v0.7.11/openssl"
+documentation = "https://sfackler.github.io/rust-openssl/doc/v0.7.14/openssl"
readme = "../README.md"
keywords = ["crypto", "tls", "ssl", "dtls"]
build = "build.rs"
@@ -27,13 +27,14 @@ ecdh_auto = ["openssl-sys-extras/ecdh_auto"]
pkcs5_pbkdf2_hmac = ["openssl-sys/pkcs5_pbkdf2_hmac"]
nightly = []
+catch_unwind = []
[dependencies]
bitflags = ">= 0.5.0, < 0.8.0"
lazy_static = "0.2"
libc = "0.2"
-openssl-sys = { version = "0.7.11", path = "../openssl-sys" }
-openssl-sys-extras = { version = "0.7.11", path = "../openssl-sys-extras" }
+openssl-sys = { version = "0.7.14", path = "../openssl-sys" }
+openssl-sys-extras = { version = "0.7.14", path = "../openssl-sys-extras" }
[build-dependencies]
gcc = "0.3"
diff --git a/openssl/src/bn/mod.rs b/openssl/src/bn/mod.rs
index d548e9ef..5054f0ab 100644
--- a/openssl/src/bn/mod.rs
+++ b/openssl/src/bn/mod.rs
@@ -6,13 +6,23 @@ use std::{fmt, ptr, mem};
use ffi;
use ssl::error::SslError;
+/// A signed arbitrary-precision integer.
+///
+/// `BigNum` provides wrappers around OpenSSL's checked arithmetic functions. Additionally, it
+/// implements the standard operators (`std::ops`), which perform unchecked arithmetic, unwrapping
+/// the returned `Result` of the checked operations.
pub struct BigNum(*mut ffi::BIGNUM);
+/// Specifies the desired properties of a randomly generated `BigNum`.
#[derive(Copy, Clone)]
#[repr(C)]
pub enum RNGProperty {
+ /// The most significant bit of the number is allowed to be 0.
MsbMaybeZero = -1,
+ /// The MSB should be set to 1.
MsbOne = 0,
+ /// The two most significant bits of the number will be set to 1, so that the product of two
+ /// such random numbers will always have `2 * bits` length.
TwoMsbOne = 1,
}
@@ -70,6 +80,7 @@ macro_rules! with_bn_in_ctx(
);
impl BigNum {
+ /// Creates a new `BigNum` with the value 0.
pub fn new() -> Result<BigNum, SslError> {
unsafe {
ffi::init();
@@ -79,6 +90,7 @@ impl BigNum {
}
}
+ /// Creates a new `BigNum` with the given value.
pub fn new_from(n: u64) -> Result<BigNum, SslError> {
BigNum::new().and_then(|v| unsafe {
try_ssl!(ffi::BN_set_word(v.raw(), n as c_ulong));
@@ -86,6 +98,7 @@ impl BigNum {
})
}
+ /// Creates a `BigNum` from a decimal string.
pub fn from_dec_str(s: &str) -> Result<BigNum, SslError> {
BigNum::new().and_then(|v| unsafe {
let c_str = CString::new(s.as_bytes()).unwrap();
@@ -94,6 +107,7 @@ impl BigNum {
})
}
+ /// Creates a `BigNum` from a hexadecimal string.
pub fn from_hex_str(s: &str) -> Result<BigNum, SslError> {
BigNum::new().and_then(|v| unsafe {
let c_str = CString::new(s.as_bytes()).unwrap();
@@ -114,6 +128,14 @@ impl BigNum {
}
}
+ /// Creates a new `BigNum` from an unsigned, big-endian encoded number of arbitrary length.
+ ///
+ /// ```
+ /// # use openssl::bn::BigNum;
+ /// let bignum = BigNum::new_from_slice(&[0x12, 0x00, 0x34]).unwrap();
+ ///
+ /// assert_eq!(bignum, BigNum::new_from(0x120034).unwrap());
+ /// ```
pub fn new_from_slice(n: &[u8]) -> Result<BigNum, SslError> {
BigNum::new().and_then(|v| unsafe {
try_ssl_null!(ffi::BN_bin2bn(n.as_ptr(), n.len() as c_int, v.raw()));
@@ -121,6 +143,16 @@ impl BigNum {
})
}
+ /// Returns the square of `self`.
+ ///
+ /// ```
+ /// # use openssl::bn::BigNum;
+ /// let ref n = BigNum::new_from(10).unwrap();
+ /// let squared = BigNum::new_from(100).unwrap();
+ ///
+ /// assert_eq!(n.checked_sqr().unwrap(), squared);
+ /// assert_eq!(n * n, squared);
+ /// ```
pub fn checked_sqr(&self) -> Result<BigNum, SslError> {
unsafe {
with_bn_in_ctx!(r, ctx, {
@@ -129,6 +161,7 @@ impl BigNum {
}
}
+ /// Returns the unsigned remainder of the division `self / n`.
pub fn checked_nnmod(&self, n: &BigNum) -> Result<BigNum, SslError> {
unsafe {
with_bn_in_ctx!(r, ctx, {
@@ -137,6 +170,17 @@ impl BigNum {
}
}
+ /// Equivalent to `(self + a) mod n`.
+ ///
+ /// ```
+ /// # use openssl::bn::BigNum;
+ /// let ref s = BigNum::new_from(10).unwrap();
+ /// let ref a = BigNum::new_from(20).unwrap();
+ /// let ref n = BigNum::new_from(29).unwrap();
+ /// let result = BigNum::new_from(1).unwrap();
+ ///
+ /// assert_eq!(s.checked_mod_add(a, n).unwrap(), result);
+ /// ```
pub fn checked_mod_add(&self, a: &BigNum, n: &BigNum) -> Result<BigNum, SslError> {
unsafe {
with_bn_in_ctx!(r, ctx, {
@@ -145,6 +189,7 @@ impl BigNum {
}
}
+ /// Equivalent to `(self - a) mod n`.
pub fn checked_mod_sub(&self, a: &BigNum, n: &BigNum) -> Result<BigNum, SslError> {
unsafe {
with_bn_in_ctx!(r, ctx, {
@@ -153,6 +198,7 @@ impl BigNum {
}
}
+ /// Equivalent to `(self * a) mod n`.
pub fn checked_mod_mul(&self, a: &BigNum, n: &BigNum) -> Result<BigNum, SslError> {
unsafe {
with_bn_in_ctx!(r, ctx, {
@@ -161,6 +207,7 @@ impl BigNum {
}
}
+ /// Equivalent to `self² mod n`.
pub fn checked_mod_sqr(&self, n: &BigNum) -> Result<BigNum, SslError> {
unsafe {
with_bn_in_ctx!(r, ctx, {
@@ -169,6 +216,7 @@ impl BigNum {
}
}
+ /// Raises `self` to the `p`th power.
pub fn checked_exp(&self, p: &BigNum) -> Result<BigNum, SslError> {
unsafe {
with_bn_in_ctx!(r, ctx, {
@@ -177,6 +225,7 @@ impl BigNum {
}
}
+ /// Equivalent to `self.checked_exp(p) mod n`.
pub fn checked_mod_exp(&self, p: &BigNum, n: &BigNum) -> Result<BigNum, SslError> {
unsafe {
with_bn_in_ctx!(r, ctx, {
@@ -185,6 +234,8 @@ impl BigNum {
}
}
+ /// Calculates the modular multiplicative inverse of `self` modulo `n`, that is, an integer `r`
+ /// such that `(self * r) % n == 1`.
pub fn checked_mod_inv(&self, n: &BigNum) -> Result<BigNum, SslError> {
unsafe {
with_bn_in_ctx!(r, ctx, {
@@ -193,6 +244,7 @@ impl BigNum {
}
}
+ /// Add an `unsigned long` to `self`. This is more efficient than adding a `BigNum`.
pub fn add_word(&mut self, w: c_ulong) -> Result<(), SslError> {
unsafe {
if ffi::BN_add_word(self.raw(), w) == 1 {
@@ -245,6 +297,7 @@ impl BigNum {
}
}
+ /// Computes the greatest common denominator of `self` and `a`.
pub fn checked_gcd(&self, a: &BigNum) -> Result<BigNum, SslError> {
unsafe {
with_bn_in_ctx!(r, ctx, {
@@ -253,6 +306,14 @@ impl BigNum {
}
}
+ /// Generates a prime number.
+ ///
+ /// # Parameters
+ ///
+ /// * `bits`: The length of the prime in bits (lower bound).
+ /// * `safe`: If true, returns a "safe" prime `p` so that `(p-1)/2` is also prime.
+ /// * `add`/`rem`: If `add` is set to `Some(add)`, `p % add == rem` will hold, where `p` is the
+ /// generated prime and `rem` is `1` if not specified (`None`).
pub fn checked_generate_prime(bits: i32,
safe: bool,
add: Option<&BigNum>,
@@ -273,6 +334,13 @@ impl BigNum {
}
}
+ /// Checks whether `self` is prime.
+ ///
+ /// Performs a Miller-Rabin probabilistic primality test with `checks` iterations.
+ ///
+ /// # Return Value
+ ///
+ /// Returns `true` if `self` is prime with an error probability of less than `0.25 ^ checks`.
pub fn is_prime(&self, checks: i32) -> Result<bool, SslError> {
unsafe {
with_ctx!(ctx, {
@@ -281,6 +349,15 @@ impl BigNum {
}
}
+ /// Checks whether `self` is prime with optional trial division.
+ ///
+ /// If `do_trial_division` is `true`, first performs trial division by a number of small primes.
+ /// Then, like `is_prime`, performs a Miller-Rabin probabilistic primality test with `checks`
+ /// iterations.
+ ///
+ /// # Return Value
+ ///
+ /// Returns `true` if `self` is prime with an error probability of less than `0.25 ^ checks`.
pub fn is_prime_fast(&self, checks: i32, do_trial_division: bool) -> Result<bool, SslError> {
unsafe {
with_ctx!(ctx, {
@@ -293,6 +370,13 @@ impl BigNum {
}
}
+ /// Generates a cryptographically strong pseudo-random `BigNum`.
+ ///
+ /// # Parameters
+ ///
+ /// * `bits`: Length of the number in bits.
+ /// * `prop`: The desired properties of the number.
+ /// * `odd`: If `true`, the generated number will be odd.
pub fn checked_new_random(bits: i32, prop: RNGProperty, odd: bool) -> Result<BigNum, SslError> {
unsafe {
with_bn_in_ctx!(r, ctx, {
@@ -301,6 +385,7 @@ impl BigNum {
}
}
+ /// The cryptographically weak counterpart to `checked_new_random`.
pub fn checked_new_pseudo_random(bits: i32,
prop: RNGProperty,
odd: bool)
@@ -312,6 +397,8 @@ impl BigNum {
}
}
+ /// Generates a cryptographically strong pseudo-random `BigNum` `r` in the range
+ /// `0 <= r < self`.
pub fn checked_rand_in_range(&self) -> Result<BigNum, SslError> {
unsafe {
with_bn_in_ctx!(r, ctx, {
@@ -320,6 +407,7 @@ impl BigNum {
}
}
+ /// The cryptographically weak counterpart to `checked_rand_in_range`.
pub fn checked_pseudo_rand_in_range(&self) -> Result<BigNum, SslError> {
unsafe {
with_bn_in_ctx!(r, ctx, {
@@ -328,6 +416,9 @@ impl BigNum {
}
}
+ /// Sets bit `n`. Equivalent to `self |= (1 << n)`.
+ ///
+ /// When setting a bit outside of `self`, it is expanded.
pub fn set_bit(&mut self, n: i32) -> Result<(), SslError> {
unsafe {
if ffi::BN_set_bit(self.raw(), n as c_int) == 1 {
@@ -338,6 +429,9 @@ impl BigNum {
}
}
+ /// Clears bit `n`, setting it to 0. Equivalent to `self &= ~(1 << n)`.
+ ///
+ /// When clearing a bit outside of `self`, an error is returned.
pub fn clear_bit(&mut self, n: i32) -> Result<(), SslError> {
unsafe {
if ffi::BN_clear_bit(self.raw(), n as c_int) == 1 {
@@ -348,10 +442,14 @@ impl BigNum {
}
}
+ /// Returns `true` if the `n`th bit of `self` is set to 1, `false` otherwise.
pub fn is_bit_set(&self, n: i32) -> bool {
unsafe { ffi::BN_is_bit_set(self.raw(), n as c_int) == 1 }
}
+ /// Truncates `self` to the lowest `n` bits.
+ ///
+ /// An error occurs if `self` is already shorter than `n` bits.
pub fn mask_bits(&mut self, n: i32) -> Result<(), SslError> {
unsafe {
if ffi::BN_mask_bits(self.raw(), n as c_int) == 1 {
@@ -362,6 +460,24 @@ impl BigNum {
}
}
+ /// Returns `self`, shifted left by 1 bit. `self` may be negative.
+ ///
+ /// ```
+ /// # use openssl::bn::BigNum;
+ /// let ref s = BigNum::new_from(0b0100).unwrap();
+ /// let result = BigNum::new_from(0b1000).unwrap();
+ ///
+ /// assert_eq!(s.checked_shl1().unwrap(), result);
+ /// ```
+ ///
+ /// ```
+ /// # use openssl::bn::BigNum;
+ /// let ref s = -BigNum::new_from(8).unwrap();
+ /// let result = -BigNum::new_from(16).unwrap();
+ ///
+ /// // (-8) << 1 == -16
+ /// assert_eq!(s.checked_shl1().unwrap(), result);
+ /// ```
pub fn checked_shl1(&self) -> Result<BigNum, SslError> {
unsafe {
with_bn!(r, {
@@ -370,6 +486,7 @@ impl BigNum {
}
}
+ /// Returns `self`, shifted right by 1 bit. `self` may be negative.
pub fn checked_shr1(&self) -> Result<BigNum, SslError> {
unsafe {
with_bn!(r, {
@@ -434,10 +551,31 @@ impl BigNum {
}
}
+ /// Inverts the sign of `self`.
+ ///
+ /// ```
+ /// # use openssl::bn::BigNum;
+ /// let mut s = BigNum::new_from(8).unwrap();
+ ///
+ /// s.negate();
+ /// assert_eq!(s, -BigNum::new_from(8).unwrap());
+ /// s.negate();
+ /// assert_eq!(s, BigNum::new_from(8).unwrap());
+ /// ```
pub fn negate(&mut self) {
unsafe { ffi::BN_set_negative(self.raw(), !self.is_negative() as c_int) }
}
+ /// Compare the absolute values of `self` and `oth`.
+ ///
+ /// ```
+ /// # use openssl::bn::BigNum;
+ /// # use std::cmp::Ordering;
+ /// let s = -BigNum::new_from(8).unwrap();
+ /// let o = BigNum::new_from(8).unwrap();
+ ///
+ /// assert_eq!(s.abs_cmp(o), Ordering::Equal);
+ /// ```
pub fn abs_cmp(&self, oth: BigNum) -> Ordering {
unsafe {
let res = ffi::BN_ucmp(self.raw(), oth.raw()) as i32;
@@ -455,10 +593,12 @@ impl BigNum {
unsafe { (*self.raw()).neg == 1 }
}
+ /// Returns the number of significant bits in `self`.
pub fn num_bits(&self) -> i32 {
unsafe { ffi::BN_num_bits(self.raw()) as i32 }
}
+ /// Returns the size of `self` in bytes.
pub fn num_bytes(&self) -> i32 {
(self.num_bits() + 7) / 8
}
@@ -478,6 +618,18 @@ impl BigNum {
mem::replace(&mut me.0, ptr::null_mut())
}
+ /// Returns a big-endian byte vector representation of the absolute value of `self`.
+ ///
+ /// `self` can be recreated by using `new_from_slice`.
+ ///
+ /// ```
+ /// # use openssl::bn::BigNum;
+ /// let s = -BigNum::new_from(4543).unwrap();
+ /// let r = BigNum::new_from(4543).unwrap();
+ ///
+ /// let s_vec = s.to_vec();
+ /// assert_eq!(BigNum::new_from_slice(&s_vec).unwrap(), r);
+ /// ```
pub fn to_vec(&self) -> Vec<u8> {
let size = self.num_bytes() as usize;
let mut v = Vec::with_capacity(size);
@@ -488,6 +640,14 @@ impl BigNum {
v
}
+ /// Returns a decimal string representation of `self`.
+ ///
+ /// ```
+ /// # use openssl::bn::BigNum;
+ /// let s = -BigNum::new_from(12345).unwrap();
+ ///
+ /// assert_eq!(s.to_dec_str(), "-12345");
+ /// ```
pub fn to_dec_str(&self) -> String {
unsafe {
let buf = ffi::BN_bn2dec(self.raw());
@@ -499,6 +659,14 @@ impl BigNum {
}
}
+ /// Returns a hexadecimal string representation of `self`.
+ ///
+ /// ```
+ /// # use openssl::bn::BigNum;
+ /// let s = -BigNum::new_from(0x99ff).unwrap();
+ ///
+ /// assert_eq!(s.to_hex_str(), "-99FF");
+ /// ```
pub fn to_hex_str(&self) -> String {
unsafe {
let buf = ffi::BN_bn2hex(self.raw());
@@ -556,6 +724,7 @@ impl Drop for BigNum {
}
}
+#[doc(hidden)] // This module only contains impls, so it's empty when generating docs
pub mod unchecked {
use std::ops::{Add, Div, Mul, Neg, Rem, Shl, Shr, Sub};
use ffi;
diff --git a/openssl/src/crypto/hash.rs b/openssl/src/crypto/hash.rs
index 78465851..69d3a350 100644
--- a/openssl/src/crypto/hash.rs
+++ b/openssl/src/crypto/hash.rs
@@ -2,9 +2,11 @@ use libc::c_uint;
use std::iter::repeat;
use std::io::prelude::*;
use std::io;
-
use ffi;
+use crypto::HashTypeInternals;
+use nid::Nid;
+
/// Message digest (hash) type.
#[derive(Copy, Clone)]
pub enum Type {
@@ -17,19 +19,32 @@ pub enum Type {
RIPEMD160,
}
+impl HashTypeInternals for Type {
+ fn as_nid(&self) -> Nid {
+ match *self {
+ Type::MD5 => Nid::MD5,
+ Type::SHA1 => Nid::SHA1,
+ Type::SHA224 => Nid::SHA224,
+ Type::SHA256 => Nid::SHA256,
+ Type::SHA384 => Nid::SHA384,
+ Type::SHA512 => Nid::SHA512,
+ Type::RIPEMD160 => Nid::RIPEMD160,
+ }
+ }
+}
+
impl Type {
/// Returns the length of the message digest.
#[inline]
pub fn md_len(&self) -> usize {
- use self::Type::*;
match *self {
- MD5 => 16,
- SHA1 => 20,
- SHA224 => 28,
- SHA256 => 32,
- SHA384 => 48,
- SHA512 => 64,
- RIPEMD160 => 20,
+ Type::MD5 => 16,
+ Type::SHA1 => 20,
+ Type::SHA224 => 28,
+ Type::SHA256 => 32,
+ Type::SHA384 => 48,
+ Type::SHA512 => 64,
+ Type::RIPEMD160 => 20,
}
}
@@ -37,15 +52,14 @@ impl Type {
#[inline]
pub fn evp_md(&self) -> *const ffi::EVP_MD {
unsafe {
- use self::Type::*;
match *self {
- MD5 => ffi::EVP_md5(),
- SHA1 => ffi::EVP_sha1(),
- SHA224 => ffi::EVP_sha224(),
- SHA256 => ffi::EVP_sha256(),
- SHA384 => ffi::EVP_sha384(),
- SHA512 => ffi::EVP_sha512(),
- RIPEMD160 => ffi::EVP_ripemd160(),
+ Type::MD5 => ffi::EVP_md5(),
+ Type::SHA1 => ffi::EVP_sha1(),
+ Type::SHA224 => ffi::EVP_sha224(),
+ Type::SHA256 => ffi::EVP_sha256(),
+ Type::SHA384 => ffi::EVP_sha384(),
+ Type::SHA512 => ffi::EVP_sha512(),
+ Type::RIPEMD160 => ffi::EVP_ripemd160(),
}
}
}
diff --git a/openssl/src/crypto/hmac.rs b/openssl/src/crypto/hmac.rs
index 866087b0..143c7b75 100644
--- a/openssl/src/crypto/hmac.rs
+++ b/openssl/src/crypto/hmac.rs
@@ -387,8 +387,7 @@ mod tests {
let tests: [(Vec<u8>, Vec<u8>); 6] =
[(repeat(0xb_u8).take(20).collect(), b"Hi There".to_vec()),
(b"Jefe".to_vec(), b"what do ya want for nothing?".to_vec()),
- (repeat(0xaa_u8).take(20).collect(),
- repeat(0xdd_u8).take(50).collect()),
+ (repeat(0xaa_u8).take(20).collect(), repeat(0xdd_u8).take(50).collect()),
("0102030405060708090a0b0c0d0e0f10111213141516171819".from_hex().unwrap(),
repeat(0xcd_u8).take(50).collect()),
(repeat(0xaa_u8).take(131).collect(),
diff --git a/openssl/src/crypto/mod.rs b/openssl/src/crypto/mod.rs
index bb77453f..481eb05c 100644
--- a/openssl/src/crypto/mod.rs
+++ b/openssl/src/crypto/mod.rs
@@ -14,6 +14,8 @@
// limitations under the License.
//
+use nid::Nid;
+
pub mod hash;
pub mod hmac;
pub mod pkcs5;
@@ -22,5 +24,11 @@ pub mod rand;
pub mod symm;
pub mod memcmp;
pub mod rsa;
+#[cfg(feature = "catch_unwind")]
+mod util;
mod symm_internal;
+
+trait HashTypeInternals {
+ fn as_nid(&self) -> Nid;
+}
diff --git a/openssl/src/crypto/pkey.rs b/openssl/src/crypto/pkey.rs
index ba0a16b6..15744047 100644
--- a/openssl/src/crypto/pkey.rs
+++ b/openssl/src/crypto/pkey.rs
@@ -5,12 +5,19 @@ use std::iter::repeat;
use std::mem;
use std::ptr;
use bio::MemBio;
+
+use crypto::HashTypeInternals;
use crypto::hash;
use crypto::hash::Type as HashType;
use ffi;
use ssl::error::{SslError, StreamError};
use crypto::rsa::RSA;
+#[cfg(feature = "catch_unwind")]
+use libc::{c_void, c_char};
+#[cfg(feature = "catch_unwind")]
+use crypto::util::{CallbackState, invoke_passwd_cb};
+
#[derive(Copy, Clone)]
pub enum Parts {
Neither,
@@ -41,18 +48,6 @@ fn openssl_padding_code(padding: EncryptionPadding) -> c_int {
}
}
-fn openssl_hash_nid(hash: HashType) -> c_int {
- match hash {
- HashType::MD5 => 4, // NID_md5,
- HashType::SHA1 => 64, // NID_sha1
- HashType::SHA224 => 675, // NID_sha224
- HashType::SHA256 => 672, // NID_sha256
- HashType::SHA384 => 673, // NID_sha384
- HashType::SHA512 => 674, // NID_sha512
- HashType::RIPEMD160 => 117, // NID_ripemd160
- }
-}
-
pub struct PKey {
evp: *mut ffi::EVP_PKEY,
parts: Parts,
@@ -103,6 +98,35 @@ impl PKey {
}
}
+ /// Read a private key from PEM, supplying a password callback to be invoked if the private key
+ /// is encrypted.
+ ///
+ /// The callback will be passed the password buffer and should return the number of characters
+ /// placed into the buffer.
+ ///
+ /// Requires the `catch_unwind` feature.
+ #[cfg(feature = "catch_unwind")]
+ pub fn private_key_from_pem_cb<R, F>(reader: &mut R, pass_cb: F) -> Result<PKey, SslError>
+ where R: Read, F: FnOnce(&mut [c_char]) -> usize
+ {
+ let mut cb = CallbackState::new(pass_cb);
+
+ let mut mem_bio = try!(MemBio::new());
+ try!(io::copy(reader, &mut mem_bio).map_err(StreamError));
+
+ unsafe {
+ let evp = try_ssl_null!(ffi::PEM_read_bio_PrivateKey(mem_bio.get_handle(),
+ ptr::null_mut(),
+ Some(invoke_passwd_cb::<F>),
+ &mut cb as *mut _ as *mut c_void));
+
+ Ok(PKey {
+ evp: evp as *mut ffi::EVP_PKEY,
+ parts: Parts::Both,
+ })
+ }
+ }
+
/// Reads public key from PEM, takes ownership of handle
pub fn public_key_from_pem<R>(reader: &mut R) -> Result<PKey, SslError>
where R: Read
@@ -124,7 +148,7 @@ impl PKey {
/// Reads an RSA private key from PEM, takes ownership of handle
pub fn private_rsa_key_from_pem<R>(reader: &mut R) -> Result<PKey, SslError>
- where R: Read
+ where R: Read
{
let rsa = try!(RSA::private_key_from_pem(reader));
unsafe {
@@ -140,7 +164,7 @@ impl PKey {
/// Reads an RSA public key from PEM, takes ownership of handle
pub fn public_rsa_key_from_pem<R>(reader: &mut R) -> Result<PKey, SslError>
- where R: Read
+ where R: Read
{
let rsa = try!(RSA::public_key_from_pem(reader));
unsafe {
@@ -556,7 +580,7 @@ impl PKey {
let mut r = repeat(0u8).take(len as usize + 1).collect::<Vec<_>>();
let mut len = 0;
- let rv = ffi::RSA_sign(openssl_hash_nid(hash),
+ let rv = ffi::RSA_sign(hash.as_nid() as c_int,
s.as_ptr(),
s.len() as c_uint,
r.as_mut_ptr(),
@@ -579,7 +603,7 @@ impl PKey {
panic!("Could not get RSA key for verification");
}
- let rv = ffi::RSA_verify(openssl_hash_nid(hash),
+ let rv = ffi::RSA_verify(hash.as_nid() as c_int,
h.as_ptr(),
h.len() as c_uint,
s.as_ptr(),
@@ -610,16 +634,15 @@ impl Drop for PKey {
impl Clone for PKey {
fn clone(&self) -> Self {
let mut pkey = PKey::from_handle(unsafe { ffi::EVP_PKEY_new() }, self.parts);
- // copy by encoding to DER and back
+ // copy by encoding to DER and back
match self.parts {
Parts::Public => {
pkey.load_pub(&self.save_pub()[..]);
- },
+ }
Parts::Both => {
pkey.load_priv(&self.save_priv()[..]);
- },
- Parts::Neither => {
- },
+ }
+ Parts::Neither => {}
}
pkey
}
@@ -694,8 +717,8 @@ mod tests {
fn test_private_rsa_key_from_pem() {
let key_path = Path::new("test/key.pem");
let mut file = File::open(&key_path)
- .ok()
- .expect("Failed to open `test/key.pem`");
+ .ok()
+ .expect("Failed to open `test/key.pem`");
super::PKey::private_rsa_key_from_pem(&mut file).unwrap();
}
@@ -704,8 +727,8 @@ mod tests {
fn test_public_rsa_key_from_pem() {
let key_path = Path::new("test/key.pem.pub");
let mut file = File::open(&key_path)
- .ok()
- .expect("Failed to open `test/key.pem.pub`");
+ .ok()
+ .expect("Failed to open `test/key.pem.pub`");
super::PKey::public_rsa_key_from_pem(&mut file).unwrap();
}
diff --git a/openssl/src/crypto/rsa.rs b/openssl/src/crypto/rsa.rs
index 021d450b..3b420fbc 100644
--- a/openssl/src/crypto/rsa.rs
+++ b/openssl/src/crypto/rsa.rs
@@ -3,10 +3,17 @@ use std::fmt;
use ssl::error::{SslError, StreamError};
use std::ptr;
use std::io::{self, Read, Write};
+use libc::c_int;
use bn::BigNum;
use bio::MemBio;
-use nid::Nid;
+use crypto::HashTypeInternals;
+use crypto::hash;
+
+#[cfg(feature = "catch_unwind")]
+use libc::{c_void, c_char};
+#[cfg(feature = "catch_unwind")]
+use crypto::util::{CallbackState, invoke_passwd_cb};
pub struct RSA(*mut ffi::RSA);
@@ -29,8 +36,16 @@ impl RSA {
Ok(RSA(rsa))
}
}
-
- pub fn from_private_components(n: BigNum, e: BigNum, d: BigNum, p: BigNum, q: BigNum, dp: BigNum, dq: BigNum, qi: BigNum) -> Result<RSA, SslError> {
+
+ pub fn from_private_components(n: BigNum,
+ e: BigNum,
+ d: BigNum,
+ p: BigNum,
+ q: BigNum,
+ dp: BigNum,
+ dq: BigNum,
+ qi: BigNum)
+ -> Result<RSA, SslError> {
unsafe {
let rsa = try_ssl_null!(ffi::RSA_new());
(*rsa).n = n.into_raw();
@@ -52,7 +67,7 @@ impl RSA {
/// Reads an RSA private key from PEM formatted data.
pub fn private_key_from_pem<R>(reader: &mut R) -> Result<RSA, SslError>
- where R: Read
+ where R: Read
{
let mut mem_bio = try!(MemBio::new());
try!(io::copy(reader, &mut mem_bio).map_err(StreamError));
@@ -65,29 +80,58 @@ impl RSA {
Ok(RSA(rsa))
}
}
-
+
+ /// Reads an RSA private key from PEM formatted data and supplies a password callback.
+ ///
+ /// Requires the `catch_unwind` feature.
+ #[cfg(feature = "catch_unwind")]
+ pub fn private_key_from_pem_cb<R, F>(reader: &mut R, pass_cb: F) -> Result<RSA, SslError>
+ where R: Read, F: FnOnce(&mut [c_char]) -> usize
+ {
+ let mut cb = CallbackState::new(pass_cb);
+
+ let mut mem_bio = try!(MemBio::new());
+ try!(io::copy(reader, &mut mem_bio).map_err(StreamError));
+
+ unsafe {
+ let cb_ptr = &mut cb as *mut _ as *mut c_void;
+ let rsa = try_ssl_null!(ffi::PEM_read_bio_RSAPrivateKey(mem_bio.get_handle(),
+ ptr::null_mut(),
+ Some(invoke_passwd_cb::<F>),
+ cb_ptr));
+
+ Ok(RSA(rsa))
+ }
+ }
+
/// Writes an RSA private key as unencrypted PEM formatted data
pub fn private_key_to_pem<W>(&self, writer: &mut W) -> Result<(), SslError>
- where W: Write
+ where W: Write
{
- let mut mem_bio = try!(MemBio::new());
-
- let result = unsafe {
- ffi::PEM_write_bio_RSAPrivateKey(mem_bio.get_handle(), self.0, ptr::null(), ptr::null_mut(), 0, None, ptr::null_mut())
- };
-
- if result == 1 {
- try!(io::copy(&mut mem_bio, writer).map_err(StreamError));
-
- Ok(())
- } else {
- Err(SslError::OpenSslErrors(vec![]))
- }
+ let mut mem_bio = try!(MemBio::new());
+
+ let result = unsafe {
+ ffi::PEM_write_bio_RSAPrivateKey(mem_bio.get_handle(),
+ self.0,
+ ptr::null(),
+ ptr::null_mut(),
+ 0,
+ None,
+ ptr::null_mut())
+ };
+
+ if result == 1 {
+ try!(io::copy(&mut mem_bio, writer).map_err(StreamError));
+
+ Ok(())
+ } else {
+ Err(SslError::OpenSslErrors(vec![]))
+ }
}
/// Reads an RSA public key from PEM formatted data.
pub fn public_key_from_pem<R>(reader: &mut R) -> Result<RSA, SslError>
- where R: Read
+ where R: Read
{
let mut mem_bio = try!(MemBio::new());
try!(io::copy(reader, &mut mem_bio).map_err(StreamError));
@@ -100,45 +144,46 @@ impl RSA {
Ok(RSA(rsa))
}
}
-
+
/// Writes an RSA public key as PEM formatted data
pub fn public_key_to_pem<W>(&self, writer: &mut W) -> Result<(), SslError>
- where W: Write
+ where W: Write
{
- let mut mem_bio = try!(MemBio::new());
-
- let result = unsafe {
- ffi::PEM_write_bio_RSA_PUBKEY(mem_bio.get_handle(), self.0)
- };
-
- if result == 1 {
- try!(io::copy(&mut mem_bio, writer).map_err(StreamError));
-
- Ok(())
- } else {
- Err(SslError::OpenSslErrors(vec![]))
- }
+ let mut mem_bio = try!(MemBio::new());
+
+ let result = unsafe { ffi::PEM_write_bio_RSA_PUBKEY(mem_bio.get_handle(), self.0) };
+
+ if result == 1 {
+ try!(io::copy(&mut mem_bio, writer).map_err(StreamError));
+
+ Ok(())
+ } else {
+ Err(SslError::OpenSslErrors(vec![]))
+ }
}
-
+
pub fn size(&self) -> Result<u32, SslError> {
if self.has_n() {
- unsafe {
- Ok(ffi::RSA_size(self.0) as u32)
- }
+ unsafe { Ok(ffi::RSA_size(self.0) as u32) }
} else {
Err(SslError::OpenSslErrors(vec![]))
}
}
-
- pub fn sign(&self, hash_id: Nid, message: &[u8]) -> Result<Vec<u8>, SslError> {
+
+ pub fn sign(&self, hash: hash::Type, message: &[u8]) -> Result<Vec<u8>, SslError> {
let k_len = try!(self.size());
let mut sig = vec![0;k_len as usize];
let mut sig_len = k_len;
-
+
unsafe {
- let result = ffi::RSA_sign(hash_id as i32, message.as_ptr(), message.len() as u32, sig.as_mut_ptr(), &mut sig_len, self.0);
+ let result = ffi::RSA_sign(hash.as_nid() as c_int,
+ message.as_ptr(),
+ message.len() as u32,
+ sig.as_mut_ptr(),
+ &mut sig_len,
+ self.0);
assert!(sig_len == k_len);
-
+
if result == 1 {
Ok(sig)
} else {
@@ -146,14 +191,19 @@ impl RSA {
}
}
}
-
- pub fn verify(&self, hash_id: Nid, message: &[u8], sig: &[u8]) -> Result<bool, SslError> {
+
+ pub fn verify(&self, hash: hash::Type, message: &[u8], sig: &[u8]) -> Result<bool, SslError> {
unsafe {
- let result = ffi::RSA_verify(hash_id as i32, message.as_ptr(), message.len() as u32, sig.as_ptr(), sig.len() as u32, self.0);
-
+ let result = ffi::RSA_verify(hash.as_nid() as c_int,
+ message.as_ptr(),
+ message.len() as u32,
+ sig.as_ptr(),
+ sig.len() as u32,
+ self.0);
+
Ok(result == 1)
}
- }
+ }
pub fn as_ptr(&self) -> *mut ffi::RSA {
self.0
@@ -161,45 +211,31 @@ impl RSA {
// The following getters are unsafe, since BigNum::new_from_ffi fails upon null pointers
pub fn n(&self) -> Result<BigNum, SslError> {
- unsafe {
- BigNum::new_from_ffi((*self.0).n)
- }
+ unsafe { BigNum::new_from_ffi((*self.0).n) }
}
pub fn has_n(&self) -> bool {
- unsafe {
- !(*self.0).n.is_null()
- }
+ unsafe { !(*self.0).n.is_null() }
}
pub fn d(&self) -> Result<BigNum, SslError> {
- unsafe {
- BigNum::new_from_ffi((*self.0).d)
- }
+ unsafe { BigNum::new_from_ffi((*self.0).d) }
}
pub fn e(&self) -> Result<BigNum, SslError> {
- unsafe {
- BigNum::new_from_ffi((*self.0).e)
- }
+ unsafe { BigNum::new_from_ffi((*self.0).e) }
}
pub fn has_e(&self) -> bool {
- unsafe {
- !(*self.0).e.is_null()
- }
+ unsafe { !(*self.0).e.is_null() }
}
pub fn p(&self) -> Result<BigNum, SslError> {
- unsafe {
- BigNum::new_from_ffi((*self.0).p)
- }
+ unsafe { BigNum::new_from_ffi((*self.0).p) }
}
pub fn q(&self) -> Result<BigNum, SslError> {
- unsafe {
- BigNum::new_from_ffi((*self.0).q)
- }
+ unsafe { BigNum::new_from_ffi((*self.0).q) }
}
}
@@ -211,69 +247,81 @@ impl fmt::Debug for RSA {
#[cfg(test)]
mod test {
- use nid;
use std::fs::File;
use std::io::Write;
use super::*;
use crypto::hash::*;
-
+
fn signing_input_rs256() -> Vec<u8> {
- vec![101, 121, 74, 104, 98, 71, 99, 105, 79, 105, 74, 83, 85, 122, 73,
- 49, 78, 105, 74, 57, 46, 101, 121, 74, 112, 99, 51, 77, 105, 79, 105,
- 74, 113, 98, 50, 85, 105, 76, 65, 48, 75, 73, 67, 74, 108, 101, 72,
- 65, 105, 79, 106, 69, 122, 77, 68, 65, 52, 77, 84, 107, 122, 79, 68,
- 65, 115, 68, 81, 111, 103, 73, 109, 104, 48, 100, 72, 65, 54, 76,
- 121, 57, 108, 101, 71, 70, 116, 99, 71, 120, 108, 76, 109, 78, 118,
- 98, 83, 57, 112, 99, 49, 57, 121, 98, 50, 57, 48, 73, 106, 112, 48,
- 99, 110, 86, 108, 102, 81]
+ vec![101, 121, 74, 104, 98, 71, 99, 105, 79, 105, 74, 83, 85, 122, 73, 49, 78, 105, 74, 57,
+ 46, 101, 121, 74, 112, 99, 51, 77, 105, 79, 105, 74, 113, 98, 50, 85, 105, 76, 65, 48,
+ 75, 73, 67, 74, 108, 101, 72, 65, 105, 79, 106, 69, 122, 77, 68, 65, 52, 77, 84, 107,
+ 122, 79, 68, 65, 115, 68, 81, 111, 103, 73, 109, 104, 48, 100, 72, 65, 54, 76, 121,
+ 57, 108, 101, 71, 70, 116, 99, 71, 120, 108, 76, 109, 78, 118, 98, 83, 57, 112, 99,
+ 49, 57, 121, 98, 50, 57, 48, 73, 106, 112, 48, 99, 110, 86, 108, 102, 81]
}
-
+
fn signature_rs256() -> Vec<u8> {
- vec![112, 46, 33, 137, 67, 232, 143, 209, 30, 181, 216, 45, 191, 120, 69,
- 243, 65, 6, 174, 27, 129, 255, 247, 115, 17, 22, 173, 209, 113, 125,
- 131, 101, 109, 66, 10, 253, 60, 150, 238, 221, 115, 162, 102, 62, 81,
- 102, 104, 123, 0, 11, 135, 34, 110, 1, 135, 237, 16, 115, 249, 69,
- 229, 130, 173, 252, 239, 22, 216, 90, 121, 142, 232, 198, 109, 219,
- 61, 184, 151, 91, 23, 208, 148, 2, 190, 237, 213, 217, 217, 112, 7,
- 16, 141, 178, 129, 96, 213, 248, 4, 12, 167, 68, 87, 98, 184, 31,
- 190, 127, 249, 217, 46, 10, 231, 111, 36, 242, 91, 51, 187, 230, 244,
- 74, 230, 30, 177, 4, 10, 203, 32, 4, 77, 62, 249, 18, 142, 212, 1,
- 48, 121, 91, 212, 189, 59, 65, 238, 202, 208, 102, 171, 101, 25, 129,
- 253, 228, 141, 247, 127, 55, 45, 195, 139, 159, 175, 221, 59, 239,
- 177, 139, 93, 163, 204, 60, 46, 176, 47, 158, 58, 65, 214, 18, 202,
- 173, 21, 145, 18, 115, 160, 95, 35, 185, 232, 56, 250, 175, 132, 157,
- 105, 132, 41, 239, 90, 30, 136, 121, 130, 54, 195, 212, 14, 96, 69,
- 34, 165, 68, 200, 242, 122, 122, 45, 184, 6, 99, 209, 108, 247, 202,
- 234, 86, 222, 64, 92, 178, 33, 90, 69, 178, 194, 85, 102, 181, 90,
- 193, 167, 72, 160, 112, 223, 200, 163, 42, 70, 149, 67, 208, 25, 238,
- 251, 71]
- }
-
+ vec![112, 46, 33, 137, 67, 232, 143, 209, 30, 181, 216, 45, 191, 120, 69, 243, 65, 6, 174,
+ 27, 129, 255, 247, 115, 17, 22, 173, 209, 113, 125, 131, 101, 109, 66, 10, 253, 60,
+ 150, 238, 221, 115, 162, 102, 62, 81, 102, 104, 123, 0, 11, 135, 34, 110, 1, 135, 237,
+ 16, 115, 249, 69, 229, 130, 173, 252, 239, 22, 216, 90, 121, 142, 232, 198, 109, 219,
+ 61, 184, 151, 91, 23, 208, 148, 2, 190, 237, 213, 217, 217, 112, 7, 16, 141, 178, 129,
+ 96, 213, 248, 4, 12, 167, 68, 87, 98, 184, 31, 190, 127, 249, 217, 46, 10, 231, 111,
+ 36, 242, 91, 51, 187, 230, 244, 74, 230, 30, 177, 4, 10, 203, 32, 4, 77, 62, 249, 18,
+ 142, 212, 1, 48, 121, 91, 212, 189, 59, 65, 238, 202, 208, 102, 171, 101, 25, 129,
+ 253, 228, 141, 247, 127, 55, 45, 195, 139, 159, 175, 221, 59, 239, 177, 139, 93, 163,
+ 204, 60, 46, 176, 47, 158, 58, 65, 214, 18, 202, 173, 21, 145, 18, 115, 160, 95, 35,
+ 185, 232, 56, 250, 175, 132, 157, 105, 132, 41, 239, 90, 30, 136, 121, 130, 54, 195,
+ 212, 14, 96, 69, 34, 165, 68, 200, 242, 122, 122, 45, 184, 6, 99, 209, 108, 247, 202,
+ 234, 86, 222, 64, 92, 178, 33, 90, 69, 178, 194, 85, 102, 181, 90, 193, 167, 72, 160,
+ 112, 223, 200, 163, 42, 70, 149, 67, 208, 25, 238, 251, 71]
+ }
+
#[test]
pub fn test_sign() {
let mut buffer = File::open("test/rsa.pem").unwrap();
let private_key = RSA::private_key_from_pem(&mut buffer).unwrap();
-
+
let mut sha = Hasher::new(Type::SHA256);
sha.write_all(&signing_input_rs256()).unwrap();
let digest = sha.finish();
-
- let result = private_key.sign(nid::Nid::SHA256, &digest).unwrap();
-
+
+ let result = private_key.sign(Type::SHA256, &digest).unwrap();
+
assert_eq!(result, signature_rs256());
}
-
+
#[test]
- pub fn test_verify() {
+ pub fn test_verify() {
let mut buffer = File::open("test/rsa.pem.pub").unwrap();
let public_key = RSA::public_key_from_pem(&mut buffer).unwrap();
-
+
let mut sha = Hasher::new(Type::SHA256);
sha.write_all(&signing_input_rs256()).unwrap();
let digest = sha.finish();
-
- let result = public_key.verify(nid::Nid::SHA256, &digest, &signature_rs256()).unwrap();
-
+
+ let result = public_key.verify(Type::SHA256, &digest, &signature_rs256()).unwrap();
+
assert!(result);
}
-} \ No newline at end of file
+
+ #[test]
+ #[cfg(feature = "catch_unwind")]
+ pub fn test_password() {
+ let mut password_queried = false;
+ let mut buffer = File::open("test/rsa-encrypted.pem").unwrap();
+ RSA::private_key_from_pem_cb(&mut buffer, |password| {
+ password_queried = true;
+ password[0] = b'm' as _;
+ password[1] = b'y' as _;
+ password[2] = b'p' as _;
+ password[3] = b'a' as _;
+ password[4] = b's' as _;
+ password[5] = b's' as _;
+ 6
+ }).unwrap();
+
+ assert!(password_queried);
+ }
+}
diff --git a/openssl/src/crypto/util.rs b/openssl/src/crypto/util.rs
new file mode 100644
index 00000000..be72aa59
--- /dev/null
+++ b/openssl/src/crypto/util.rs
@@ -0,0 +1,58 @@
+use libc::{c_int, c_char, c_void};
+
+use std::any::Any;
+use std::panic;
+use std::slice;
+
+/// Wraps a user-supplied callback and a slot for panics thrown inside the callback (while FFI
+/// frames are on the stack).
+///
+/// When dropped, checks if the callback has panicked, and resumes unwinding if so.
+pub struct CallbackState<F> {
+ /// The user callback. Taken out of the `Option` when called.
+ cb: Option<F>,
+ /// If the callback panics, we place the panic object here, to be re-thrown once OpenSSL
+ /// returns.
+ panic: Option<Box<Any + Send + 'static>>,
+}
+
+impl<F> CallbackState<F> {
+ pub fn new(callback: F) -> Self {
+ CallbackState {
+ cb: Some(callback),
+ panic: None,
+ }
+ }
+}
+
+impl<F> Drop for CallbackState<F> {
+ fn drop(&mut self) {
+ if let Some(panic) = self.panic.take() {
+ panic::resume_unwind(panic);
+ }
+ }
+}
+
+/// Password callback function, passed to private key loading functions.
+///
+/// `cb_state` is expected to be a pointer to a `CallbackState`.
+pub extern "C" fn invoke_passwd_cb<F>(buf: *mut c_char,
+ size: c_int,
+ _rwflag: c_int,
+ cb_state: *mut c_void)
+ -> c_int
+ where F: FnOnce(&mut [i8]) -> usize {
+ let result = panic::catch_unwind(|| {
+ // build a `i8` slice to pass to the user callback
+ let pass_slice = unsafe { slice::from_raw_parts_mut(buf, size as usize) };
+ let callback = unsafe { &mut *(cb_state as *mut CallbackState<F>) };
+
+ callback.cb.take().unwrap()(pass_slice)
+ });
+
+ if let Ok(len) = result {
+ return len as c_int;
+ } else {
+ return 0;
+ }
+}
diff --git a/openssl/src/lib.rs b/openssl/src/lib.rs
index f3be24b1..690ab32b 100644
--- a/openssl/src/lib.rs
+++ b/openssl/src/lib.rs
@@ -1,4 +1,4 @@
-#![doc(html_root_url="https://sfackler.github.io/rust-openssl/doc/v0.7.11")]
+#![doc(html_root_url="https://sfackler.github.io/rust-openssl/doc/v0.7.14")]
#![cfg_attr(feature = "nightly", feature(const_fn))]
#[macro_use]
diff --git a/openssl/src/nid.rs b/openssl/src/nid.rs
index 21ef18e0..874d4a6f 100644
--- a/openssl/src/nid.rs
+++ b/openssl/src/nid.rs
@@ -184,15 +184,13 @@ pub enum Nid {
OCSP,
CaIssuers,
OCSPSigning, // 180
-
- // 181 and up are from openssl's obj_mac.h
-
+ // 181 and up are from openssl's obj_mac.h
/// Shown as UID in cert subject
UserId = 458,
-
SHA256 = 672,
SHA384,
SHA512,
+ SHA224,
}
diff --git a/openssl/src/ssl/bio.rs b/openssl/src/ssl/bio.rs
index e53545d7..b6f20cf2 100644
--- a/openssl/src/ssl/bio.rs
+++ b/openssl/src/ssl/bio.rs
@@ -23,16 +23,16 @@ pub struct BioMethod(ffi::BIO_METHOD);
impl BioMethod {
pub fn new<S: Read + Write>() -> BioMethod {
BioMethod(ffi::BIO_METHOD {
- type_: BIO_TYPE_NONE,
- name: b"rust\0".as_ptr() as *const _,
- bwrite: Some(bwrite::<S>),
- bread: Some(bread::<S>),
- bputs: Some(bputs::<S>),
- bgets: None,
- ctrl: Some(ctrl::<S>),
- create: Some(create),
- destroy: Some(destroy::<S>),
- callback_ctrl: None,
+ type_: BIO_TYPE_NONE,
+ name: b"rust\0".as_ptr() as *const _,
+ bwrite: Some(bwrite::<S>),
+ bread: Some(bread::<S>),
+ bputs: Some(bputs::<S>),
+ bgets: None,
+ ctrl: Some(ctrl::<S>),
+ create: Some(create),
+ destroy: Some(destroy::<S>),
+ callback_ctrl: None,
})
}
}
@@ -82,12 +82,16 @@ unsafe fn state<'a, S: 'a>(bio: *mut BIO) -> &'a mut StreamState<S> {
}
#[cfg(feature = "nightly")]
-fn catch_unwind<F, T>(f: F) -> Result<T, Box<Any + Send>> where F: FnOnce() -> T {
+fn catch_unwind<F, T>(f: F) -> Result<T, Box<Any + Send>>
+ where F: FnOnce() -> T
+{
::std::panic::catch_unwind(::std::panic::AssertUnwindSafe(f))
}
#[cfg(not(feature = "nightly"))]
-fn catch_unwind<F, T>(f: F) -> Result<T, Box<Any + Send>> where F: FnOnce() -> T {
+fn catch_unwind<F, T>(f: F) -> Result<T, Box<Any + Send>>
+ where F: FnOnce() -> T
+{
Ok(f())
}
@@ -137,7 +141,8 @@ unsafe extern "C" fn bread<S: Read>(bio: *mut BIO, buf: *mut c_char, len: c_int)
fn retriable_error(err: &io::Error) -> bool {
match err.kind() {
- io::ErrorKind::WouldBlock | io::ErrorKind::NotConnected => true,
+ io::ErrorKind::WouldBlock |
+ io::ErrorKind::NotConnected => true,
_ => false,
}
}
diff --git a/openssl/src/ssl/mod.rs b/openssl/src/ssl/mod.rs
index aa785142..0252b114 100644
--- a/openssl/src/ssl/mod.rs
+++ b/openssl/src/ssl/mod.rs
@@ -566,6 +566,9 @@ impl SslContext {
let ctx = SslContext { ctx: ctx };
+ // this is a bit dubious (?)
+ try!(ctx.set_mode(ffi::SSL_MODE_AUTO_RETRY | ffi::SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER));
+
if method.is_dtls() {
ctx.set_read_ahead(1);
}
@@ -648,8 +651,12 @@ impl SslContext {
}
}
+ fn set_mode(&self, mode: c_long) -> Result<(), SslError> {
+ wrap_ssl_result(unsafe { ffi_extras::SSL_CTX_set_mode(self.ctx, mode) as c_int })
+ }
+
pub fn set_tmp_dh(&self, dh: DH) -> Result<(), SslError> {
- wrap_ssl_result(unsafe { ffi_extras::SSL_CTX_set_tmp_dh(self.ctx, dh.raw()) as i32 })
+ wrap_ssl_result(unsafe { ffi_extras::SSL_CTX_set_tmp_dh(self.ctx, dh.raw()) as c_int })
}
/// Use the default locations of trusted certificates for verification.
@@ -850,7 +857,7 @@ pub struct SslCipher<'a> {
ph: PhantomData<&'a ()>,
}
-impl <'a> SslCipher<'a> {
+impl<'a> SslCipher<'a> {
/// Returns the name of cipher.
pub fn name(&self) -> &'static str {
let name = unsafe {
@@ -874,12 +881,18 @@ impl <'a> SslCipher<'a> {
/// Returns the number of bits used for the cipher.
pub fn bits(&self) -> CipherBits {
unsafe {
- let algo_bits : *mut c_int = ptr::null_mut();
+ let algo_bits: *mut c_int = ptr::null_mut();
let secret_bits = ffi::SSL_CIPHER_get_bits(self.cipher, algo_bits);
if !algo_bits.is_null() {
- CipherBits { secret: secret_bits, algorithm: Some(*algo_bits) }
+ CipherBits {
+ secret: secret_bits,
+ algorithm: Some(*algo_bits),
+ }
} else {
- CipherBits { secret: secret_bits, algorithm: None }
+ CipherBits {
+ secret: secret_bits,
+ algorithm: None,
+ }
}
}
}
@@ -987,7 +1000,9 @@ impl Ssl {
{
unsafe {
let verify = Box::new(verify);
- ffi::SSL_set_ex_data(self.ssl, get_ssl_verify_data_idx::<F>(), mem::transmute(verify));
+ ffi::SSL_set_ex_data(self.ssl,
+ get_ssl_verify_data_idx::<F>(),
+ mem::transmute(verify));
ffi::SSL_set_verify(self.ssl, mode.bits as c_int, Some(ssl_raw_verify::<F>));
}
}
@@ -999,7 +1014,10 @@ impl Ssl {
if ptr.is_null() {
None
} else {
- Some(SslCipher{ cipher: ptr, ph: PhantomData })
+ Some(SslCipher {
+ cipher: ptr,
+ ph: PhantomData,
+ })
}
}
}
@@ -1052,8 +1070,8 @@ impl Ssl {
/// Returns the name of the protocol used for the connection, e.g. "TLSv1.2", "SSLv3", etc.
pub fn version(&self) -> &'static str {
let version = unsafe {
- let ptr = ffi::SSL_get_version(self.ssl);
- CStr::from_ptr(ptr as *const _)
+ let ptr = ffi::SSL_get_version(self.ssl);
+ CStr::from_ptr(ptr as *const _)
};
str::from_utf8(version.to_bytes()).unwrap()
@@ -1224,7 +1242,8 @@ impl<S: Clone + Read + Write> Clone for SslStream<S> {
}
}
-impl<S> fmt::Debug for SslStream<S> where S: fmt::Debug
+impl<S> fmt::Debug for SslStream<S>
+ where S: fmt::Debug
{
fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
fmt.debug_struct("SslStream")
@@ -1385,7 +1404,8 @@ impl<S> SslStream<S> {
}
}
LibSslError::ErrorZeroReturn => Some(SslError::SslSessionClosed),
- LibSslError::ErrorWantWrite | LibSslError::ErrorWantRead => None,
+ LibSslError::ErrorWantWrite |
+ LibSslError::ErrorWantRead => None,
err => {
Some(SslError::StreamError(io::Error::new(io::ErrorKind::Other,
format!("unexpected error {:?}", err))))
@@ -1401,8 +1421,7 @@ impl<S> SslStream<S> {
}
#[cfg(not(feature = "nightly"))]
- fn check_panic(&mut self) {
- }
+ fn check_panic(&mut self) {}
fn get_bio_error(&mut self) -> io::Error {
let error = unsafe { bio::take_error::<S>(self.ssl.get_raw_rbio()) };
@@ -1513,7 +1532,8 @@ pub enum MaybeSslStream<S>
Normal(S),
}
-impl<S> Read for MaybeSslStream<S> where S: Read + Write
+impl<S> Read for MaybeSslStream<S>
+ where S: Read + Write
{
fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
match *self {
@@ -1523,7 +1543,8 @@ impl<S> Read for MaybeSslStream<S> where S: Read + Write
}
}
-impl<S> Write for MaybeSslStream<S> where S: Read + Write
+impl<S> Write for MaybeSslStream<S>
+ where S: Read + Write
{
fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
match *self {
@@ -1540,7 +1561,8 @@ impl<S> Write for MaybeSslStream<S> where S: Read + Write
}
}
-impl<S> MaybeSslStream<S> where S: Read + Write
+impl<S> MaybeSslStream<S>
+ where S: Read + Write
{
/// Returns a reference to the underlying stream.
pub fn get_ref(&self) -> &S {
diff --git a/openssl/src/ssl/tests/mod.rs b/openssl/src/ssl/tests/mod.rs
index ccdc44e4..5339f27e 100644
--- a/openssl/src/ssl/tests/mod.rs
+++ b/openssl/src/ssl/tests/mod.rs
@@ -236,7 +236,7 @@ run_test!(verify_untrusted, |method, stream| {
match SslStream::connect_generic(&ctx, stream) {
Ok(_) => panic!("expected failure"),
- Err(err) => println!("error {:?}", err)
+ Err(err) => println!("error {:?}", err),
}
});
@@ -246,11 +246,11 @@ run_test!(verify_trusted, |method, stream| {
match ctx.set_CA_file(&Path::new("test/cert.pem")) {
Ok(_) => {}
- Err(err) => panic!("Unexpected error {:?}", err)
+ Err(err) => panic!("Unexpected error {:?}", err),
}
match SslStream::connect_generic(&ctx, stream) {
Ok(_) => (),
- Err(err) => panic!("Expected success, got {:?}", err)
+ Err(err) => panic!("Expected success, got {:?}", err),
}
});
@@ -264,7 +264,7 @@ run_test!(verify_untrusted_callback_override_ok, |method, stream| {
match SslStream::connect_generic(&ctx, stream) {
Ok(_) => (),
- Err(err) => panic!("Expected success, got {:?}", err)
+ Err(err) => panic!("Expected success, got {:?}", err),
}
});
@@ -289,11 +289,11 @@ run_test!(verify_trusted_callback_override_ok, |method, stream| {
match ctx.set_CA_file(&Path::new("test/cert.pem")) {
Ok(_) => {}
- Err(err) => panic!("Unexpected error {:?}", err)
+ Err(err) => panic!("Unexpected error {:?}", err),
}
match SslStream::connect_generic(&ctx, stream) {
Ok(_) => (),
- Err(err) => panic!("Expected success, got {:?}", err)
+ Err(err) => panic!("Expected success, got {:?}", err),
}
});
@@ -307,7 +307,7 @@ run_test!(verify_trusted_callback_override_bad, |method, stream| {
match ctx.set_CA_file(&Path::new("test/cert.pem")) {
Ok(_) => {}
- Err(err) => panic!("Unexpected error {:?}", err)
+ Err(err) => panic!("Unexpected error {:?}", err),
}
assert!(SslStream::connect_generic(&ctx, stream).is_err());
});
@@ -335,7 +335,7 @@ run_test!(verify_trusted_get_error_ok, |method, stream| {
match ctx.set_CA_file(&Path::new("test/cert.pem")) {
Ok(_) => {}
- Err(err) => panic!("Unexpected error {:?}", err)
+ Err(err) => panic!("Unexpected error {:?}", err),
}
assert!(SslStream::connect_generic(&ctx, stream).is_ok());
});
@@ -353,8 +353,7 @@ run_test!(verify_trusted_get_error_err, |method, stream| {
});
run_test!(verify_callback_data, |method, stream| {
- fn callback(_preverify_ok: bool, x509_ctx: &X509StoreContext,
- node_id: &Vec<u8>) -> bool {
+ fn callback(_preverify_ok: bool, x509_ctx: &X509StoreContext, node_id: &Vec<u8>) -> bool {
let cert = x509_ctx.get_current_cert();
match cert {
None => false,
@@ -377,7 +376,7 @@ run_test!(verify_callback_data, |method, stream| {
match SslStream::connect_generic(&ctx, stream) {
Ok(_) => (),
- Err(err) => panic!("Expected success, got {:?}", err)
+ Err(err) => panic!("Expected success, got {:?}", err),
}
});
@@ -405,7 +404,7 @@ run_test!(ssl_verify_callback, |method, stream| {
match SslStream::connect_generic(ssl, stream) {
Ok(_) => (),
- Err(err) => panic!("Expected success, got {:?}", err)
+ Err(err) => panic!("Expected success, got {:?}", err),
}
assert_eq!(CHECKED.load(Ordering::SeqCst), 1);
@@ -499,8 +498,7 @@ fn test_write_direct() {
}
run_test!(get_peer_certificate, |method, stream| {
- let stream = SslStream::connect_generic(&SslContext::new(method).unwrap(),
- stream).unwrap();
+ let stream = SslStream::connect_generic(&SslContext::new(method).unwrap(), stream).unwrap();
let cert = stream.ssl().peer_certificate().unwrap();
let fingerprint = cert.fingerprint(SHA1).unwrap();
let node_hash_str = "E19427DAC79FBE758394945276A6E4F15F0BEBE6";
diff --git a/openssl/src/version.rs b/openssl/src/version.rs
index 323cf1e2..0e9f61d8 100644
--- a/openssl/src/version.rs
+++ b/openssl/src/version.rs
@@ -1,4 +1,3 @@
-//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
@@ -86,4 +85,4 @@ fn test_versions() {
assert!(c_flags().starts_with("compiler:"));
assert!(built_on().starts_with("built on:"));
assert!(dir().starts_with("OPENSSLDIR:"));
-} \ No newline at end of file
+}
diff --git a/openssl/src/x509/mod.rs b/openssl/src/x509/mod.rs
index 0a242a15..c9d1772d 100644
--- a/openssl/src/x509/mod.rs
+++ b/openssl/src/x509/mod.rs
@@ -379,7 +379,9 @@ impl X509Generator {
ffi::X509_set_issuer_name(x509.handle, name);
for (exttype, ext) in self.extensions.iter() {
- try!(X509Generator::add_extension_internal(x509.handle, &exttype, &ext.to_string()));
+ try!(X509Generator::add_extension_internal(x509.handle,
+ &exttype,
+ &ext.to_string()));
}
let hash_fn = self.hash_type.evp_md();
@@ -530,6 +532,17 @@ impl<'ctx> X509<'ctx> {
}
io::copy(&mut mem_bio, writer).map_err(StreamError).map(|_| ())
}
+
+ /// Returns a DER serialized form of the certificate
+ pub fn save_der(&self) -> Result<Vec<u8>, SslError> {
+ let mut mem_bio = try!(MemBio::new());
+ unsafe {
+ ffi::i2d_X509_bio(mem_bio.get_handle(), self.handle);
+ }
+ let mut v = Vec::new();
+ try!(io::copy(&mut mem_bio, &mut v).map_err(StreamError));
+ Ok(v)
+ }
}
extern "C" {
@@ -539,9 +552,9 @@ extern "C" {
impl<'ctx> Clone for X509<'ctx> {
fn clone(&self) -> X509<'ctx> {
unsafe { rust_X509_clone(self.handle) }
- /* FIXME: given that we now have refcounting control, 'owned' should be uneeded, the 'ctx
- * is probably also uneeded. We can remove both to condense the x509 api quite a bit
- */
+ // FIXME: given that we now have refcounting control, 'owned' should be uneeded, the 'ctx
+ // is probably also uneeded. We can remove both to condense the x509 api quite a bit
+ //
X509::new(self.handle, true)
}
}
@@ -609,6 +622,10 @@ impl X509Req {
X509Req { handle: handle }
}
+ pub fn get_handle(&self) -> *mut ffi::X509_REQ {
+ self.handle
+ }
+
/// Reads CSR from PEM
pub fn from_pem<R>(reader: &mut R) -> Result<X509Req, SslError>
where R: Read
@@ -635,6 +652,17 @@ impl X509Req {
}
io::copy(&mut mem_bio, writer).map_err(StreamError).map(|_| ())
}
+
+ /// Returns a DER serialized form of the CSR
+ pub fn save_der(&self) -> Result<Vec<u8>, SslError> {
+ let mut mem_bio = try!(MemBio::new());
+ unsafe {
+ ffi::i2d_X509_REQ_bio(mem_bio.get_handle(), self.handle);
+ }
+ let mut v = Vec::new();
+ try!(io::copy(&mut mem_bio, &mut v).map_err(StreamError));
+ Ok(v)
+ }
}
impl Drop for X509Req {
@@ -671,7 +699,7 @@ impl Extensions {
pub fn add(&mut self, ext: Extension) {
let ext_type = ext.get_type();
- if let Some(index) = self.indexes.get(&ext_type) {
+ if let Some(index) = self.indexes.get(&ext_type) {
self.extensions[*index] = ext;
return;
}
@@ -693,7 +721,7 @@ impl Extensions {
/// extension in the collection.
struct ExtensionsIter<'a> {
current: usize,
- extensions: &'a Vec<Extension>
+ extensions: &'a Vec<Extension>,
}
impl<'a> Iterator for ExtensionsIter<'a> {
@@ -798,9 +826,7 @@ pub struct GeneralNames<'a> {
impl<'a> GeneralNames<'a> {
/// Returns the number of `GeneralName`s in this structure.
pub fn len(&self) -> usize {
- unsafe {
- (*self.stack).stack.num as usize
- }
+ unsafe { (*self.stack).stack.num as usize }
}
/// Returns the specified `GeneralName`.
@@ -823,7 +849,7 @@ impl<'a> GeneralNames<'a> {
pub fn iter(&self) -> GeneralNamesIter {
GeneralNamesIter {
names: self,
- idx: 0
+ idx: 0,
}
}
}
diff --git a/openssl/src/x509/tests.rs b/openssl/src/x509/tests.rs
index 744aba9e..5d9b30ab 100644
--- a/openssl/src/x509/tests.rs
+++ b/openssl/src/x509/tests.rs
@@ -56,9 +56,10 @@ fn test_cert_gen_extension_ordering() {
#[test]
fn test_cert_gen_extension_bad_ordering() {
let result = get_generator()
- .add_extension(OtherNid(Nid::AuthorityKeyIdentifier, "keyid:always".to_owned()))
- .add_extension(OtherNid(Nid::SubjectKeyIdentifier, "hash".to_owned()))
- .generate();
+ .add_extension(OtherNid(Nid::AuthorityKeyIdentifier,
+ "keyid:always".to_owned()))
+ .add_extension(OtherNid(Nid::SubjectKeyIdentifier, "hash".to_owned()))
+ .generate();
assert!(result.is_err());
}
@@ -92,6 +93,19 @@ fn test_cert_loading() {
}
#[test]
+fn test_save_der() {
+ let cert_path = Path::new("test/cert.pem");
+ let mut file = File::open(&cert_path)
+ .ok()
+ .expect("Failed to open `test/cert.pem`");
+
+ let cert = X509::from_pem(&mut file).ok().expect("Failed to load PEM");
+
+ let der = cert.save_der().unwrap();
+ assert!(!der.is_empty());
+}
+
+#[test]
fn test_subject_read_cn() {
let cert_path = Path::new("test/cert.pem");
let mut file = File::open(&cert_path)
@@ -162,7 +176,8 @@ fn test_subject_alt_name() {
let subject_alt_names = cert.subject_alt_names().unwrap();
assert_eq!(3, subject_alt_names.len());
assert_eq!(Some("foobar.com"), subject_alt_names.get(0).dnsname());
- assert_eq!(subject_alt_names.get(1).ipaddress(), Some(&[127, 0, 0, 1][..]));
+ assert_eq!(subject_alt_names.get(1).ipaddress(),
+ Some(&[127, 0, 0, 1][..]));
assert_eq!(subject_alt_names.get(2).ipaddress(),
Some(&b"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01"[..]));
}
@@ -174,8 +189,10 @@ fn test_subject_alt_name_iter() {
let subject_alt_names = cert.subject_alt_names().unwrap();
let mut subject_alt_names_iter = subject_alt_names.iter();
- assert_eq!(subject_alt_names_iter.next().unwrap().dnsname(), Some("foobar.com"));
- assert_eq!(subject_alt_names_iter.next().unwrap().ipaddress(), Some(&[127, 0, 0, 1][..]));
+ assert_eq!(subject_alt_names_iter.next().unwrap().dnsname(),
+ Some("foobar.com"));
+ assert_eq!(subject_alt_names_iter.next().unwrap().ipaddress(),
+ Some(&[127, 0, 0, 1][..]));
assert_eq!(subject_alt_names_iter.next().unwrap().ipaddress(),
Some(&b"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01"[..]));
assert!(subject_alt_names_iter.next().is_none());
diff --git a/openssl/test/rsa-encrypted.pem b/openssl/test/rsa-encrypted.pem
new file mode 100644
index 00000000..a6249997
--- /dev/null
+++ b/openssl/test/rsa-encrypted.pem
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,E2F16153E2BA3D617285A68C896BA6AF
+
+vO9SnhtGjGe8pG1pN//vsONnvJr+DjU+lFCiSqGMPT7tezDnbehLfS+9kus2HV7r
+HmI14JvVG9O7NpF7zMyBRlHYdWcCCWED9Yar0NsWN9419e5pMe/bqIXAzAiJbtT4
+OB9U5XF3m+349zjN1dVXPPLGRmMC1pcHAlofeb5nIUFTvUi5xcsbe1itGjgkkvHb
+Bt8NioHTBun8kKrlsFQOuB55ylBU/eWG8DQBtvFOmQ7iWp0RnGQfh8k5e5rcZNpQ
+fD9ygc7UVISl0xTrIG4IH15g34H+nrBauKtIPOpNPuXQPOMHCZv3XH8wnhrWHHwT
+ZFnQBdXbSpQtMsRh0phG2G+VIlyCgSn4+CxjCJ+TgFtsoK/tU0unmRYc59QnTxxb
+qkHYsPs3E0NApQAgH1ENEGl1M+FGLYQH7gftjc3ophBTeRA17sRmD7Y4QBInggsq
+Gv6tImPVBdekAjz/Ls/EyMwjAvvrL5eAokqrIsAarGo+zmbJKHzknw2KUz2En0+k
+YYaxB4oy9u7bzuQlvio6xYHJEb4K197bby4Dldmqv7YCCJBJwhOBAInMD687viKv
+vcUwL8YuS6cW5E8MbvEENlY4+lvKKj3M8Bnyb79cYIPQe92EuCwXU9DZXPRMLwwM
+oFEJpF5E/PmNJzu+B52ahHtDrh83WSx71fWqjdTqwkPZhAYo3ztsfFkb/UqUcq8u
+rBSebeUjZh0XZ9B04eshZQ5vJUcXGtYIe/77beV3Pv89/fw+zTZjpiP9Q3sZALzf
+Qt0YGp0/6qBuqR1tcqdu65AS2hun7yFw7uRavqYKvww4axRiz2do+xWmZFuoCAwD
+EWktaUujltpvAc1lo7lg4C6nByefJB9Xqk22N/vpqOsWr1NbAntT42Qj/HF9BVWR
+osvN3yMnKYWYe6oSTVnNBDM5obWAIHd3I9gcxTOTb1KsEwt2RrDs5EpB5ptS3Fjo
+JfBRhNZQ3cXttrIIhsHgDn9BDNg865/xpIgktKj0gEd60Abx0PqkAIm6IZTh4Efg
+7uZwfzxB+saOcddbrW2gNdzVZMC0s2Ye3sqHhtLbAJ3BlXYTxE4CAvTg54Ny+5hF
+IjvjlOKgXceSG1cSfk21/wyp9RY3Ft0AEYvvp0kZScWZaoA2aSFDUrchXVhgrEbn
+lJ7UptjefwRFIreAlwbKSbIDDNWnyzvIWyHfQ2aYqgnb7W7XqNPSgH9cALCfzirI
+dlRHjha0bMUtrjPCC/YfMXzJBVniy0gG6Pd5uC7vz/Awn6/6HRQVNaTQASphPBQ7
+bJuz+JTfzI9OUVCMRMdnb6b35U4P9tibFmnPvzTIPe+3WUmf8aRsLS3NN3G1Webd
+PMYVZpMycPaAI0Ht87axhsOzlxCWHYWjdHa+WoNNc1J90TxLCmAHquh5BDaWvjMK
+0DySftJZjV7Tf1p2KosmU83LRl39B5NHMbZb1xOEZl9IWwhT/PVKTVZ25xdxWLfb
+hF4l8rfvKehIp5r4t8zW1bvI2Hl6vrUvmcUVWt3BfKjxlgwRVD0vvwonMt1INesF
+204vUBeXbDsUUicLwOyUgaFvJ3XU3dOyvL9MhOgM5OgoFRRhG+4AS8a5JCD8iLtq
+-----END RSA PRIVATE KEY-----
diff --git a/openssl/test/run.sh b/openssl/test/run.sh
index 829f11e9..1c23067f 100755
--- a/openssl/test/run.sh
+++ b/openssl/test/run.sh
@@ -8,7 +8,7 @@ if [ "$TEST_FEATURES" == "true" ]; then
fi
if [ "$TRAVIS_RUST_VERSION" == "nightly" ]; then
- FEATURES="$FEATURES nightly"
+ FEATURES="$FEATURES nightly catch_unwind"
fi
if [ "$TRAVIS_OS_NAME" != "osx" ]; then
generated by cgit v1.2.3 (git 2.25.1) at 2026-04-30 19:24:57 +0000