diff options
| author | Kazuki Yamaguchi <k@rhe.jp> | 2017-09-02 18:09:37 +0900 |
|---|---|---|
| committer | Kazuki Yamaguchi <k@rhe.jp> | 2017-09-02 18:09:37 +0900 |
| commit | a98152afa41685f92ad867576cb44bda36b228d6 (patch) | |
| tree | fb13a4b99709e7405e6d68b11f0124181b34df43 | |
| parent | 4d6a3b911df844dfe97d19482900261745d4a061 (diff) | |
| download | ruby-openssl-a98152afa41685f92ad867576cb44bda36b228d6.tar.gz | |
ssl: use 2048-bit group in the default tmp_dh_cb
The 'keylen' parameter of the tmp_dh_callback is only meaningful when
'is_export' is non-zero. Ignore them and just return the default
2048-bit DH group.
| -rw-r--r-- | lib/openssl/ssl.rb | 15 |
1 files changed, 1 insertions, 14 deletions
diff --git a/lib/openssl/ssl.rb b/lib/openssl/ssl.rb index ec0a4537..d74b7d54 100644 --- a/lib/openssl/ssl.rb +++ b/lib/openssl/ssl.rb @@ -30,15 +30,6 @@ module OpenSSL } if defined?(OpenSSL::PKey::DH) - DEFAULT_1024 = OpenSSL::PKey::DH.new <<-_end_of_pem_ ------BEGIN DH PARAMETERS----- -MIGHAoGBAJ0lOVy0VIr/JebWn0zDwY2h+rqITFOpdNr6ugsgvkDXuucdcChhYExJ -AV/ZD2AWPbrTqV76mGRgJg4EddgT1zG0jq3rnFdMj2XzkBYx3BVvfR0Arnby0RHR -T4h7KZ/2zmjvV+eF8kBUHBJAojUlzxKj4QeO2x20FP9X5xmNUXeDAgEC ------END DH PARAMETERS----- - _end_of_pem_ - private_constant :DEFAULT_1024 - DEFAULT_2048 = OpenSSL::PKey::DH.new <<-_end_of_pem_ -----BEGIN DH PARAMETERS----- MIIBCAKCAQEA7E6kBrYiyvmKAMzQ7i8WvwVk9Y/+f8S7sCTN712KkK3cqd1jhJDY @@ -53,11 +44,7 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3 DEFAULT_TMP_DH_CALLBACK = lambda { |ctx, is_export, keylen| # :nodoc: warn "using default DH parameters." if $VERBOSE - case keylen - when 1024 then DEFAULT_1024 - when 2048 then DEFAULT_2048 - else nil - end + DEFAULT_2048 } end |