aboutsummaryrefslogtreecommitdiff
path: root/openssl
diff options
context:
space:
mode:
Diffstat (limited to 'openssl')
-rw-r--r--openssl/Cargo.toml4
-rw-r--r--openssl/src/lib.rs2
-rw-r--r--openssl/src/ssl/connector.rs16
-rw-r--r--openssl/src/ssl/error.rs9
-rw-r--r--openssl/src/ssl/test.rs5
-rw-r--r--openssl/src/x509/mod.rs23
-rw-r--r--openssl/src/x509/tests.rs16
-rw-r--r--openssl/test/alt_name_cert.pem43
8 files changed, 81 insertions, 37 deletions
diff --git a/openssl/Cargo.toml b/openssl/Cargo.toml
index 3a4614a9..10129021 100644
--- a/openssl/Cargo.toml
+++ b/openssl/Cargo.toml
@@ -1,6 +1,6 @@
[package]
name = "openssl"
-version = "0.9.23"
+version = "0.10.2"
authors = ["Steven Fackler <[email protected]>"]
license = "Apache-2.0"
description = "OpenSSL bindings"
@@ -23,7 +23,7 @@ bitflags = "1.0"
foreign-types = "0.3.1"
lazy_static = "1"
libc = "0.2"
-openssl-sys = { version = "0.9.23", path = "../openssl-sys" }
+openssl-sys = { version = "0.9.24", path = "../openssl-sys" }
[dev-dependencies]
tempdir = "0.3"
diff --git a/openssl/src/lib.rs b/openssl/src/lib.rs
index 7c366aba..321a301f 100644
--- a/openssl/src/lib.rs
+++ b/openssl/src/lib.rs
@@ -1,4 +1,4 @@
-#![doc(html_root_url = "https://docs.rs/openssl/0.9")]
+#![doc(html_root_url = "https://docs.rs/openssl/0.10")]
#[macro_use]
extern crate bitflags;
diff --git a/openssl/src/ssl/connector.rs b/openssl/src/ssl/connector.rs
index 54910733..9e485ab9 100644
--- a/openssl/src/ssl/connector.rs
+++ b/openssl/src/ssl/connector.rs
@@ -124,11 +124,22 @@ pub struct ConnectConfiguration {
}
impl ConnectConfiguration {
+ /// A builder-style version of `set_use_server_name_indication`.
+ pub fn use_server_name_indication(mut self, use_sni: bool) -> ConnectConfiguration {
+ self.set_use_server_name_indication(use_sni);
+ self
+ }
+
/// Configures the use of Server Name Indication (SNI) when connecting.
///
/// Defaults to `true`.
- pub fn use_server_name_indication(mut self, use_sni: bool) -> ConnectConfiguration {
+ pub fn set_use_server_name_indication(&mut self, use_sni: bool) {
self.sni = use_sni;
+ }
+
+ /// A builder-style version of `set_verify_hostname`.
+ pub fn verify_hostname(mut self, verify_hostname: bool) -> ConnectConfiguration {
+ self.set_verify_hostname(verify_hostname);
self
}
@@ -141,9 +152,8 @@ impl ConnectConfiguration {
/// You should think very carefully before you use this method. If hostname verification is not
/// used, *any* valid certificate for *any* site will be trusted for use from any other. This
/// introduces a significant vulnerability to man-in-the-middle attacks.
- pub fn verify_hostname(mut self, verify_hostname: bool) -> ConnectConfiguration {
+ pub fn set_verify_hostname(&mut self, verify_hostname: bool) {
self.verify_hostname = verify_hostname;
- self
}
/// Initiates a client-side TLS session on a stream.
diff --git a/openssl/src/ssl/error.rs b/openssl/src/ssl/error.rs
index c0bc80ae..18e44cd6 100644
--- a/openssl/src/ssl/error.rs
+++ b/openssl/src/ssl/error.rs
@@ -82,6 +82,15 @@ impl Error {
}
}
+impl From<ErrorStack> for Error {
+ fn from(e: ErrorStack) -> Error {
+ Error {
+ code: ErrorCode::SSL,
+ cause: Some(InnerError::Ssl(e)),
+ }
+ }
+}
+
impl fmt::Display for Error {
fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
match self.code {
diff --git a/openssl/src/ssl/test.rs b/openssl/src/ssl/test.rs
index db478d36..dc58c4fa 100644
--- a/openssl/src/ssl/test.rs
+++ b/openssl/src/ssl/test.rs
@@ -82,11 +82,14 @@ impl Server {
}
fn new_tcp(args: &[&str]) -> (Server, TcpStream) {
- let (server, addr) = Server::spawn(args, None);
+ let (mut server, addr) = Server::spawn(args, None);
for _ in 0..20 {
match TcpStream::connect(&addr) {
Ok(s) => return (server, s),
Err(ref e) if e.kind() == io::ErrorKind::ConnectionRefused => {
+ if let Some(exit_status) = server.p.try_wait().expect("try_wait") {
+ panic!("server exited: {}", exit_status);
+ }
thread::sleep(Duration::from_millis(100));
}
Err(e) => panic!("wut: {}", e),
diff --git a/openssl/src/x509/mod.rs b/openssl/src/x509/mod.rs
index 7c897e31..f3a8b8e6 100644
--- a/openssl/src/x509/mod.rs
+++ b/openssl/src/x509/mod.rs
@@ -1090,10 +1090,10 @@ foreign_type_and_impl_send_sync! {
}
impl GeneralNameRef {
- /// Returns the contents of this `GeneralName` if it is a `dNSName`.
- pub fn dnsname(&self) -> Option<&str> {
+
+ fn ia5_string(&self, ffi_type: c_int) -> Option<&str> {
unsafe {
- if (*self.as_ptr()).type_ != ffi::GEN_DNS {
+ if (*self.as_ptr()).type_ != ffi_type {
return None;
}
@@ -1101,13 +1101,28 @@ impl GeneralNameRef {
let len = ffi::ASN1_STRING_length((*self.as_ptr()).d as *mut _);
let slice = slice::from_raw_parts(ptr as *const u8, len as usize);
- // dNSNames are stated to be ASCII (specifically IA5). Hopefully
+ // IA5Strings are stated to be ASCII (specifically IA5). Hopefully
// OpenSSL checks that when loading a certificate but if not we'll
// use this instead of from_utf8_unchecked just in case.
str::from_utf8(slice).ok()
}
}
+ /// Returns the contents of this `GeneralName` if it is an `rfc822Name`.
+ pub fn email(&self) -> Option<&str> {
+ self.ia5_string(ffi::GEN_EMAIL)
+ }
+
+ /// Returns the contents of this `GeneralName` if it is a `dNSName`.
+ pub fn dnsname(&self) -> Option<&str> {
+ self.ia5_string(ffi::GEN_DNS)
+ }
+
+ /// Returns the contents of this `GeneralName` if it is an `uniformResourceIdentifier`.
+ pub fn uri(&self) -> Option<&str> {
+ self.ia5_string(ffi::GEN_URI)
+ }
+
/// Returns the contents of this `GeneralName` if it is an `iPAddress`.
pub fn ipaddress(&self) -> Option<&[u8]> {
unsafe {
diff --git a/openssl/src/x509/tests.rs b/openssl/src/x509/tests.rs
index 2d9348e8..6f6b430a 100644
--- a/openssl/src/x509/tests.rs
+++ b/openssl/src/x509/tests.rs
@@ -92,13 +92,15 @@ fn test_subject_alt_name() {
let cert = X509::from_pem(cert).unwrap();
let subject_alt_names = cert.subject_alt_names().unwrap();
- assert_eq!(3, subject_alt_names.len());
- assert_eq!(Some("foobar.com"), subject_alt_names[0].dnsname());
+ assert_eq!(5, subject_alt_names.len());
+ assert_eq!(Some("example.com"), subject_alt_names[0].dnsname());
assert_eq!(subject_alt_names[1].ipaddress(), Some(&[127, 0, 0, 1][..]));
assert_eq!(
subject_alt_names[2].ipaddress(),
Some(&b"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01"[..])
);
+ assert_eq!(Some("[email protected]"), subject_alt_names[3].email());
+ assert_eq!(Some("http://www.example.com"), subject_alt_names[4].uri());
}
#[test]
@@ -110,7 +112,7 @@ fn test_subject_alt_name_iter() {
let mut subject_alt_names_iter = subject_alt_names.iter();
assert_eq!(
subject_alt_names_iter.next().unwrap().dnsname(),
- Some("foobar.com")
+ Some("example.com")
);
assert_eq!(
subject_alt_names_iter.next().unwrap().ipaddress(),
@@ -120,6 +122,14 @@ fn test_subject_alt_name_iter() {
subject_alt_names_iter.next().unwrap().ipaddress(),
Some(&b"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01"[..])
);
+ assert_eq!(
+ subject_alt_names_iter.next().unwrap().email(),
+ Some("[email protected]")
+ );
+ assert_eq!(
+ subject_alt_names_iter.next().unwrap().uri(),
+ Some("http://www.example.com")
+ );
assert!(subject_alt_names_iter.next().is_none());
}
diff --git a/openssl/test/alt_name_cert.pem b/openssl/test/alt_name_cert.pem
index 9f75f125..d9e9f90e 100644
--- a/openssl/test/alt_name_cert.pem
+++ b/openssl/test/alt_name_cert.pem
@@ -1,25 +1,22 @@
-----BEGIN CERTIFICATE-----
-MIIEOjCCAyKgAwIBAgIJAJz42fzGUJGeMA0GCSqGSIb3DQEBCwUAMH8xCzAJBgNV
-BAYTAlVTMQswCQYDVQQIDAJOWTERMA8GA1UEBwwITmV3IFlvcmsxFTATBgNVBAoM
-DEV4YW1wbGUsIExMQzEYMBYGA1UEAwwPRXhhbXBsZSBDb21wYW55MR8wHQYJKoZI
-hvcNAQkBFhB0ZXN0QGV4YW1wbGUuY29tMB4XDTE2MDQzMDA0MDg1NloXDTE3MDQz
-MDA0MDg1NlowfzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk5ZMREwDwYDVQQHDAhO
-ZXcgWW9yazEVMBMGA1UECgwMRXhhbXBsZSwgTExDMRgwFgYDVQQDDA9FeGFtcGxl
-IENvbXBhbnkxHzAdBgkqhkiG9w0BCQEWEHRlc3RAZXhhbXBsZS5jb20wggEiMA0G
-CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDggl2TbtO5Ewi/q8kV56xK6HBpwsj9
-wBoqGi6hkKm/8lhLTkuUG6WbEUepi7n9d7tjI9hwYN7MKtppAnS+d+Zh6sKMgLJn
-hONkbQBJkYWwuIxRVXORCdyZDNzXP1rlb6ynmj6mItuPTRVNNMaZP+24fgXtwGk8
-P2nqA1ONbmyaP27txV+Rd8fmQvW3vSmq7iDob661TOtLZRqqVRpnLDGpLXTCptYz
-dLN1nDWKjBUFpPGDxvfcSE3Yf9LaQM2uDHRygSgTFusbwarAGrAk8krsm/Tiaumx
-Ls74MY6OEoLnPbEi5epWLqPmoE1nxrvYLtaWh3TTET3H72yL0+1PZTkpAgMBAAGj
-gbgwgbUwHQYDVR0OBBYEFAIcHhTPUqVdK85u47vo8z0viJGPMB8GA1UdIwQYMBaA
-FAIcHhTPUqVdK85u47vo8z0viJGPMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgWgMC0G
-A1UdEQQmMCSCCmZvb2Jhci5jb22HBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwLAYJ
-YIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMA0GCSqG
-SIb3DQEBCwUAA4IBAQDeYsuJaxbnxR2wDRSbxMpPp2b6fHPxC1vArKTSrQ/X+5s7
-YcQ29jkzD8FbET8iPsCOn/IECBiDKOpckkO6dBWM05ma9HHzWjQOJ7Lo6gEsvk4d
-+M/jJz5IaJ7hOxp1hGqwNQ+PJQOZMmlruNcOzPU36qaWJ03+NYOKar5VpIrRxCNc
-uehTArmJqDLQPfgETEhMYfpkqf3s/cGb1uyeCpzgIRPpf4Ki1Oys5cV/BqIn7n5g
-7sUrhXboYL4+eYt5V4rcc4rLI5J5IP/a1Z+Z6UVH+Mbiyl0iD8aRr/bo9WvKih3C
-2LBO0Apl0tkXUOMWp7G0UYHVEndwPjZnVoM42f11
+MIIDsDCCApigAwIBAgIBATANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJBVTET
+MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ
+dHkgTHRkMB4XDTE4MDExNTExMDcwM1oXDTI4MDExMzExMDcwM1owfDELMAkGA1UE
+BhMCVVMxCzAJBgNVBAgMAk5ZMREwDwYDVQQHDAhOZXcgWW9yazEVMBMGA1UECgwM
+RXhhbXBsZSwgTExDMTYwNAYDVQQDDC1FeGFtcGxlIENvbXBhbnkvZW1haWxBZGRy
+ZXNzPXRlc3RAZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCo9CWMRLMXo1CF/iORh9B4NhtJF/8tR9PlG95sNvyWuQQ/8jfev+8zErpl
+xfLkt0pJqcoiZG8g9NU0kU6o5T+/1QgZclCAoZaS0Jqxmoo2Yk/1Qsj16pnMBc10
+uSDk6V9aJSX1vKwONVNSwiHA1MhX+i7Wf7/K0niq+k7hOkhleFkWgZtUq41gXh1V
+fOugka7UktYnk9mrBbAMjmaloZNn2pMMAQxVg4ThiLm3zvuWqvXASWzUZc7IAd1G
+bN4AtDuhs252eqE9E4iTHk7F14wAS1JWqv666hReGHrmZJGx0xQTM9vPD1HN5t2U
+3KTfhO/mTlAUWVyg9tCtOzboKgs1AgMBAAGjdDByMAkGA1UdEwQCMAAwCwYDVR0P
+BAQDAgWgMFgGA1UdEQRRME+CC2V4YW1wbGUuY29thwR/AAABhxAAAAAAAAAAAAAA
+AAAAAAABgRB0ZXN0QGV4YW1wbGUuY29thhZodHRwOi8vd3d3LmV4YW1wbGUuY29t
+MA0GCSqGSIb3DQEBCwUAA4IBAQAx14G99z/MnSbs8h5jSos+dgLvhc2IQB/3CChE
+hPyELc7iyw1iteRs7bS1m2NZx6gv6TZ6VydDrK1dnWSatQ7sskXTO+zfC6qjMwXl
+IV+u7T8EREwciniIA82d8GWs60BGyBL3zp2iUOr5ULG4+c/S6OLdlyJv+fDKv+Xo
+fKv1UGDi5rcvUBikeNkpEPTN9UsE9/A8XJfDyq+4RKuDW19EtzOOeVx4xpHOMnAy
+VVAQVMKJzhoXtLF4k2j409na+f6FIcZSBet+plmzfB+WZNIgUUi/7MQIXOFQRkj4
+zH3SnsPm/IYpJzlH2vHhlqIBdaSoTWpGVWPq7D+H8OS3mmXF
-----END CERTIFICATE-----
generated by cgit v1.2.3 (git 2.25.1) at 2026-04-29 19:48:34 +0000