From: Evan Webb <evanwebb@...>
Date: 2005-05-21T01:43:15+09:00
Subject: Re: SSL patch for preview 3

This is fine, just as long as the use of random session_id is the
default, as most users of an SSLServer wont want to deal with setting
their own session_id context and if we dont set one by default, they
wont know why they got the error they did (it's a very cryptic one
when you have no session_id set and need one).

Lets merge it!

Evan Webb // evan@fallingsnow.net

On 5/20/05, GOTOU Yuuzou <gotoyuzo@notwork.org> wrote:
> Hi,
> 
> In message <92f5f81d0505191851202f59e0@mail.gmail.com>,
>  `Evan Webb <evanwebb@gmail.com>' wrote:
> > Could the patch attached to [ruby-core:4663] be merged into 1.8 and
> > released with the next preview? The patch is quite important for
> > creating SSL servers that operate correctly.
> 
> Sorry, I overlooked that mail.
> 
> However I dont't want to add new argument to SSLServer.new.
> I added a bit of change to your patch. Do you have any ideas?
> 
> --
> gotoyuzo
> 
> Index: ext/openssl/ossl_ssl.c
> ===================================================================
> RCS file: /var/cvs/src/ruby/ext/openssl/ossl_ssl.c,v
> retrieving revision 1.13.2.6
> diff -u -p -F^[^A-Za-z0-9_+-]*\(class\|module\|def\)[^A-Za-z0-9_+-] -r1.13.2.6 ossl_ssl.c
> --- ext/openssl/ossl_ssl.c      8 Apr 2005 09:26:54 -0000       1.13.2.6
> +++ ext/openssl/ossl_ssl.c      20 May 2005 11:44:56 -0000
> @@ -47,6 +47,7 @@ VALUE cSSLSocket;
>  #define ossl_sslctx_set_extra_cert(o,v)  rb_iv_set((o),"@extra_chain_cert",(v))
>  #define ossl_sslctx_set_client_cert_cb(o,v) rb_iv_set((o),"@client_cert_cb",(v))
>  #define ossl_sslctx_set_tmp_dh_cb(o,v)   rb_iv_set((o),"@tmp_dh_callback",(v))
> +#define ossl_sslctx_set_sess_id_ctx(o, v) rb_iv_get((o),"@session_id_context"(v))
> 
>  #define ossl_sslctx_get_cert(o)          rb_iv_get((o),"@cert")
>  #define ossl_sslctx_get_key(o)           rb_iv_get((o),"@key")
> @@ -62,12 +63,13 @@ VALUE cSSLSocket;
>  #define ossl_sslctx_get_extra_cert(o)    rb_iv_get((o),"@extra_chain_cert")
>  #define ossl_sslctx_get_client_cert_cb(o) rb_iv_get((o),"@client_cert_cb")
>  #define ossl_sslctx_get_tmp_dh_cb(o)     rb_iv_get((o),"@tmp_dh_callback")
> +#define ossl_sslctx_get_sess_id_ctx(o)   rb_iv_get((o),"@session_id_context")
> 
>  static char *ossl_sslctx_attrs[] = {
>      "cert", "key", "client_ca", "ca_file", "ca_path",
>      "timeout", "verify_mode", "verify_depth",
>      "verify_callback", "options", "cert_store", "extra_chain_cert",
> -    "client_cert_cb", "tmp_dh_callback",
> +    "client_cert_cb", "tmp_dh_callback", "session_id_context",
>  };
> 
>  #define ossl_ssl_get_io(o)           rb_iv_get((o),"@io")
> @@ -391,6 +393,15 @@ ossl_sslctx_setup(VALUE self)
>      val = ossl_sslctx_get_options(self);
>      if(!NIL_P(val)) SSL_CTX_set_options(ctx, NUM2LONG(val));
>      rb_obj_freeze(self);
> +
> +    val = ossl_sslctx_get_sess_id_ctx(self);
> +    if (!NIL_P(val)){
> +       StringValue(val);
> +       if (!SSL_CTX_set_session_id_context(ctx, RSTRING(val)->ptr,
> +                                           RSTRING(val)->len)){
> +            ossl_raise(eSSLError, "SSL_CTX_set_session_id_context:");
> +       }
> +    }
> 
>      return Qtrue;
>  }
> Index: ext/openssl/lib/openssl/ssl.rb
> ===================================================================
> RCS file: /var/cvs/src/ruby/ext/openssl/lib/openssl/ssl.rb,v
> retrieving revision 1.5.2.3
> diff -u -p -F^[^A-Za-z0-9_+-]*\(class\|module\|def\)[^A-Za-z0-9_+-] -r1.5.2.3 ssl.rb
> --- ext/openssl/lib/openssl/ssl.rb      7 Mar 2005 12:10:02 -0000       1.5.2.3
> +++ ext/openssl/lib/openssl/ssl.rb      20 May 2005 11:44:56 -0000
> @@ -98,6 +98,10 @@     class SSLServer
>        def initialize(svr, ctx)
>          @svr = svr
>          @ctx = ctx
> +        unless ctx.session_id_context
> +          session_id = OpenSSL::Digest::MD5.hexdigest($0)
> +          @ctx.session_id_context = session_id
> +        end
>          @start_immediately = true
>        end
> 
> 
>