8000 Merge pull request #12 from github/dbussink/update_ssl_cipher_setup_f… · github/ruby@f08d508 · GitHub
[go: up one dir, main page]
Skip to content

Commit f08d508

Browse files
dbussinkdbussink
committed
Merge pull request #12 from github/dbussink/update_ssl_cipher_setup_from_upstream
Update SSL cipher setup with upstream changes
2 parents 165576c + dc5a643 commit f08d508

File tree

3 files changed

+56
-15
lines changed

3 files changed

+56
-15
lines changed

‎ChangeLog

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,16 @@
1+
Fri Mar 7 12:06:19 2014 Martin Bosslet <Martin.Bosslet@gmail.com>
2+
3+
* test/openssl/test_ssl.rb: Reuse TLS default options from
4+
OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.
5+
6+
Thu Mar 6 10:33:31 2014 Martin Bosslet <Martin.Bosslet@gmail.com>
7+
8+
* lib/openssl/ssl.rb: Explicitly whitelist the default
9+
SSL/TLS ciphers. Forbid SSLv2 and SSLv3, disable
10+
compression by default.
11+
Reported by Jeff Hodges.
12+
[ruby-core:59829] [Bug #9424]
13+
114
Tue Jan 14 02:20:00 2014 Kenta Murata <mrkn@mrkn.jp>
215

316
* ext/bigdecimal/bigdecimal.c (BigDecimal_divide): Add an additional

‎ext/openssl/lib/openssl/ssl.rb

Lines changed: 42 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -20,19 +20,51 @@
2020
module OpenSSL
2121
module SSL
2222
class SSLContext
23-
options = OpenSSL::SSL::OP_ALL
24-
if defined?(OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS)
25-
options &= ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS
26-
end
27-
if defined?(OpenSSL::SSL::OP_NO_COMPRESSION)
28-
options |= OpenSSL::SSL::OP_NO_COMPRESSION
29-
end
30-
3123
DEFAULT_PARAMS = {
3224
:ssl_version => "SSLv23",
3325
:verify_mode => OpenSSL::SSL::VERIFY_PEER,
34-
:ciphers => "DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2:!ADH",
35-
:options => options,
26+
:ciphers => %w{
27+
ECDHE-ECDSA-AES128-GCM-SHA256
28+
ECDHE-RSA-AES128-GCM-SHA256
29+
ECDHE-ECDSA-AES256-GCM-SHA384
30+
ECDHE-RSA-AES256-GCM-SHA384
31+
DHE-RSA-AES128-GCM-SHA256
32+
DHE-DSS-AES128-GCM-SHA256
33+
DHE-RSA-AES256-GCM-SHA384
34+
DHE-DSS-AES256-GCM-SHA384
35+
ECDHE-ECDSA-AES128-SHA256
36+
ECDHE-RSA-AES128-SHA256
37+
ECDHE-ECDSA-AES128-SHA
38+
ECDHE-RSA-AES128-SHA
39+
ECDHE-ECDSA-AES256-SHA384
40+
ECDHE-RSA-AES256-SHA384
41+
ECDHE-ECDSA-AES256-SHA
42+
ECDHE-RSA-AES256-SHA
43+
DHE-RSA-AES128-SHA256
44+
DHE-RSA-AES256-SHA256
45+
DHE-RSA-AES128-SHA
46+
DHE-RSA-AES256-SHA
47+
DHE-DSS-AES128-SHA256
48+
DHE-DSS-AES256-SHA256
49+
DHE-DSS-AES128-SHA
50+
DHE-DSS-AES256-SHA
51+
AES128-GCM-SHA256
52+
AES256-GCM-SHA384
53+
AES128-SHA256
54+
AES256-SHA256
55+
AES128-SHA
56+
AES256-SHA
57+
ECDHE-ECDSA-RC4-SHA
58+
ECDHE-RSA-RC4-SHA
59+
RC4-SHA
60+
}.join(":"),
61+
:options => -> {
62+
opts = OpenSSL::SSL::OP_ALL
63+
opts &= ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS if defined?(OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS)
64+
opts |= OpenSSL::SSL::OP_NO_COMPRESSION if defined?(OpenSSL::SSL::OP_NO_COMPRESSION)
65+
opts |= OpenSSL::SSL::OP_NO_SSLv2 if defined?(OpenSSL::SSL::OP_NO_SSLv2)
66+
opts |= OpenSSL::SSL::OP_NO_SSLv3 if defined?(OpenSSL::SSL::OP_NO_SSLv3)
67+
}.call
3668
}
3769

3870
DEFAULT_CERT_STORE = OpenSSL::X509::Store.new

‎test/openssl/test_ssl.rb

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,6 @@
44

55
class OpenSSL::TestSSL < OpenSSL::SSLTestCase
66

7-
TLS_DEFAULT_OPS = defined?(OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS) ?
8-
OpenSSL::SSL::OP_ALL & ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS :
9-
OpenSSL::SSL::OP_ALL
10-
117
def test_ctx_setup
128
ctx = OpenSSL::SSL::SSLContext.new
139
assert_equal(ctx.setup, true)
@@ -276,7 +272,7 @@ def test_sslctx_set_params
276272
ctx = OpenSSL::SSL::SSLContext.new
277273
ctx.set_params
278274
assert_equal(OpenSSL::SSL::VERIFY_PEER, ctx.verify_mode)
279-
assert_equal(TLS_DEFAULT_OPS, ctx.options)
275+
assert_equal(OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:options], ctx.options)
280276
ciphers = ctx.ciphers
281277
ciphers_versions = ciphers.collect{|_, v, _, _| v }
282278
ciphers_names = ciphers.collect{|v, _, _, _| v }

0 commit comments

Comments
 (0)
0