From 4e29ca0c4093133838eda852879b23ed4fad56b5 Mon Sep 17 00:00:00 2001 From: Kazuki Yamaguchi Date: Sat, 8 Oct 2022 01:54:35 +0900 Subject: Add :ssl_min_version and :ssl_max_version options Replace :ssl_version option with these two new options. These provide access to OpenSSL::SSL::SSLContext#{min,max}_version=, which is the recommended way to specify SSL/TLS protocol versions. --- lib/open-uri.rb | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) (limited to 'lib/open-uri.rb') diff --git a/lib/open-uri.rb b/lib/open-uri.rb index 2f73710392..93e8cfcdb7 100644 --- a/lib/open-uri.rb +++ b/lib/open-uri.rb @@ -99,7 +99,8 @@ module OpenURI :open_timeout => true, :ssl_ca_cert => nil, :ssl_verify_mode => nil, - :ssl_version => nil, + :ssl_min_version => nil, + :ssl_max_version => nil, :ftp_active_mode => false, :redirect => true, :encoding => nil, @@ -299,8 +300,8 @@ module OpenURI require 'net/https' http.use_ssl = true http.verify_mode = options[:ssl_verify_mode] || OpenSSL::SSL::VERIFY_PEER - http.ssl_version = options[:ssl_version] if options[:ssl_version] && - OpenSSL::SSL::SSLContext::METHODS.include?(options[:ssl_version]) + http.min_version = options[:ssl_min_version] + http.max_version = options[:ssl_max_version] store = OpenSSL::X509::Store.new if options[:ssl_ca_cert] Array(options[:ssl_ca_cert]).each do |cert| @@ -702,6 +703,20 @@ module OpenURI # # :ssl_verify_mode is used to specify openssl verify mode. # + # [:ssl_min_version] + # Synopsis: + # :ssl_min_version=>:TLS1_2 + # + # :ssl_min_version option specifies the minimum allowed SSL/TLS protocol + # version. See also OpenSSL::SSL::SSLContext#min_version=. + # + # [:ssl_max_version] + # Synopsis: + # :ssl_max_version=>:TLS1_2 + # + # :ssl_max_version option specifies the maximum allowed SSL/TLS protocol + # version. See also OpenSSL::SSL::SSLContext#max_version=. + # # [:ftp_active_mode] # Synopsis: # :ftp_active_mode=>bool -- cgit v1.2.3