From b471f094c2a2e25cbe0797653758f586fa381751 Mon Sep 17 00:00:00 2001 From: zzak Date: Thu, 8 Oct 2015 05:26:44 +0000 Subject: * ext/openssl/lib/openssl/ssl.rb: Default to TLSv1.2 and drop TLS v1 Patch provided by @claudijd [Fixes GH-873] [Feature #11524]: https://github.com/ruby/ruby/pull/873 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@52082 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- ChangeLog | 6 ++++++ NEWS | 2 ++ ext/openssl/lib/openssl/ssl.rb | 9 +++++---- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index ee30615eb7..a8f2e627a9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +Thu Oct 8 14:10:45 2015 Zachary Scott + + * ext/openssl/lib/openssl/ssl.rb: Default to TLSv1.2 and drop TLS v1 + Patch provided by @claudijd [Fixes GH-873] [Feature #11524]: + https://github.com/ruby/ruby/pull/873 + Wed Oct 7 22:55:02 2015 Nobuyoshi Nakada * test/minitest/metametameta.rb (with_output): restore output to diff --git a/NEWS b/NEWS index 8a4141e198..16c4a2b62b 100644 --- a/NEWS +++ b/NEWS @@ -129,6 +129,8 @@ with all sufficient information, see the ChangeLog file. * OpenSSL * OpenSSL::SSL::SSLSocket#accept_nonblock and OpenSSL::SSL::SSLSocket#connect_nonblock supports `exception: false`. + * OpenSSL::SSL::SSLContext defaults to TLS v1.2. + Please use `ctx.ssl_version = :TLSv1` or `:SSLv23` at your own risk. * Pathname * Pathname#descend and Pathname#ascend supported blockless form. diff --git a/ext/openssl/lib/openssl/ssl.rb b/ext/openssl/lib/openssl/ssl.rb index d3ae155a2a..308152e5d2 100644 --- a/ext/openssl/lib/openssl/ssl.rb +++ b/ext/openssl/lib/openssl/ssl.rb @@ -16,7 +16,7 @@ module OpenSSL module SSL class SSLContext DEFAULT_PARAMS = { - :ssl_version => "SSLv23", + :ssl_version => "TLSv1_2", :verify_mode => OpenSSL::SSL::VERIFY_PEER, :ciphers => %w{ ECDHE-ECDSA-AES128-GCM-SHA256 @@ -59,6 +59,7 @@ module OpenSSL opts |= OpenSSL::SSL::OP_NO_COMPRESSION if defined?(OpenSSL::SSL::OP_NO_COMPRESSION) opts |= OpenSSL::SSL::OP_NO_SSLv2 if defined?(OpenSSL::SSL::OP_NO_SSLv2) opts |= OpenSSL::SSL::OP_NO_SSLv3 if defined?(OpenSSL::SSL::OP_NO_SSLv3) + opts |= OpenSSL::SSL::OP_NO_TLSv1 if defined?(OpenSSL::SSL::OP_NO_TLSv1) opts }.call } @@ -89,7 +90,7 @@ module OpenSSL attr_accessor :tmp_dh_callback - if ExtConfig::HAVE_TLSEXT_HOST_NAME + if OpenSSL::ExtConfig::HAVE_TLSEXT_HOST_NAME # A callback invoked at connect time to distinguish between multiple # server names. # @@ -249,10 +250,10 @@ module OpenSSL include Buffering include SocketForwarder - if ExtConfig::OPENSSL_NO_SOCK + if OpenSSL::ExtConfig::OPENSSL_NO_SOCK def initialize(io, ctx = nil); raise NotImplmentedError; end else - if ExtConfig::HAVE_TLSEXT_HOST_NAME + if OpenSSL::ExtConfig::HAVE_TLSEXT_HOST_NAME attr_accessor :hostname end -- cgit v1.2.3