[#55853] ruby 1.9.3 p448 breaks ABI — V咜 Ondruch <v.ondruch@...>

Hi,

13 messages 2013/07/08

[#55951] [ruby-trunk - Bug #8625][Open] IO#read(len, buf) shortens buf even if data is not read actually — "no6v (Nobuhiro IMAI)" <nov@...>

10 messages 2013/07/11

[#55976] [ruby-trunk - Feature #8629][Open] Method#parameters should include the default value — "rosenfeld (Rodrigo Rosenfeld Rosas)" <rr.rosas@...>

13 messages 2013/07/12

[#55985] [ruby-trunk - Feature #8631][Open] Add a new method to ERB to allow assigning the local variables from a hash — "rosenfeld (Rodrigo Rosenfeld Rosas)" <rr.rosas@...>

19 messages 2013/07/12

[#56004] [ruby-trunk - Feature #8636][Open] Documentation hosting on ruby-lang.org — "zzak (Zachary Scott)" <e@...>

18 messages 2013/07/15

[#56019] [ruby-trunk - Feature #8639][Open] Add Queue#each — "avdi (Avdi Grimm)" <avdi@...>

15 messages 2013/07/15

[#56027] [CommonRuby - Feature #8640][Open] Add Time#elapsed to return nanoseconds since creation — "tenderlovemaking (Aaron Patterson)" <aaron@...>

24 messages 2013/07/15

[#56041] [CommonRuby - Feature #8643][Open] Add Binding.from_hash — "rosenfeld (Rodrigo Rosenfeld Rosas)" <rr.rosas@...>

26 messages 2013/07/16

[#56087] [ruby-trunk - Feature #8658][Open] Process.clock_gettime — "akr (Akira Tanaka)" <akr@...>

23 messages 2013/07/19

[#56096] [CommonRuby - Feature #8661][Open] Add option to print backstrace in reverse order(stack frames first & error last) — "gary4gar (Gaurish Sharma)" <gary4gar@...>

18 messages 2013/07/20

[#56193] [ruby-trunk - Bug #8693][Open] lambda invoked by yield acts as a proc with respect to return — "rits (First Last)" <redmine@...>

33 messages 2013/07/26

[#56274] [ruby-trunk - Bug #8709][Open] Dir.glob should return sorted file list — "tommorris (Tom Morris)" <tom@...>

19 messages 2013/07/30

[ruby-core:55794] how to run ruby tests (backporting fix for cve-2013-4073)

From: Jordi Massaguer Pla <jmassaguerpla@...>
Date: 2013-07-04 11:19:49 UTC
List: ruby-core #55794
Hi ruby core developers,

I am trying to backport fix for cve-2013-4073 (hostname check bypassing
vulnerability in SSL client) to ruby-1.8.6.

By reading the code, I've been able to write a patch (see attachment)
but I don't known how to run the test suite, so that I can think of
adding a new test and check there is no regressions.

So far I tried:

ruby test/runner.rb

but I get the error message:

test/runner.rb:4: private method `scan' called for nil:NilClass
(NoMethodError)

I think the trouble is in the 3rd line:

rcsid = %w$Id$

$Id$ resolts to nil.

Thus, what am I missing? ruby version?

thanks

Attachments (1)

fix-cve-2013-4073.ruby.1.8.6.patch (1.43 KB, text/x-diff)
diff --git a/ext/openssl/lib/openssl/ssl.rb b/ext/openssl/lib/openssl/ssl.rb
index 9e9a944..b3d8e37 100644
--- a/ext/openssl/lib/openssl/ssl.rb
+++ b/ext/openssl/lib/openssl/ssl.rb
@@ -69,14 +69,22 @@ module OpenSSL
         cert = peer_cert
         cert.extensions.each{|ext|
           next if ext.oid != "subjectAltName"
-          ext.value.split(/,\s+/).each{|general_name|
-            if /\ADNS:(.*)/ =~ general_name
+          id, ostr = OpenSSL::ASN1.decode(ext.to_der).value
+          sequence = OpenSSL::ASN1.decode(ostr.value)
+          sequence.value.each{|san|
+          case san.tag
+            when 2 # dNSName in GeneralName (RFC5280)
               check_common_name = false
-              reg = Regexp.escape($1).gsub(/\\\*/, "[^.]+")
+              reg = Regexp.escape(san.value).gsub(/\\\*/, "[^.]+")
               return true if /\A#{reg}\z/i =~ hostname
-            elsif /\AIP Address:(.*)/ =~ general_name
+            when 7 # iPAddress in GeneralName (RFC5280)
               check_common_name = false
-              return true if $1 == hostname
+              # follows GENERAL_NAME_print() in x509v3/v3_alt.c
+              if san.value.size == 4
+                return true if san.value.unpack('C*').join('.') == hostname
+              elsif san.value.size == 16
+                return true if san.value.unpack('n*').map { |e| sprintf("%X", e) }.join(':') == hostname
+              end
             end
           }
         }

In This Thread

Prev Next