1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

openssl: avoid deprecated version-specific ssl methods if necessary

Browse Source 
* ext/openssl/extconf.rb: Check for SSL_CTX_set_min_proto_version()
  macro added in OpenSSL 1.1.0. Version-specific methods, such as
  TLSv1_method(), are deprecated in OpenSSL 1.1.0. We need to use
  version-flexible methods (TLS_*method() or SSLv23_*method()) and
  disable other protocol versions as necessary.
  [ruby-core:75225] [Feature #12324]

* ext/openssl/ossl_ssl.c: Use SSL_CTX_set_{min,max}_proto_version() to
  fix the protocol version.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55304 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
rhe 2016-06-07 05:57:25 +00:00
parent 04e1badd38
commit 74c38e5d9c
3 changed files with 53 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ChangeLog
View File

@ -1,3 +1,15 @@
Tue Jun 7 14:57:09 2016 Kazuki Yamaguchi <k@rhe.jp>
* ext/openssl/extconf.rb: Check for SSL_CTX_set_min_proto_version()
macro added in OpenSSL 1.1.0. Version-specific methods, such as
TLSv1_method(), are deprecated in OpenSSL 1.1.0. We need to use
version-flexible methods (TLS_*method() or SSLv23_*method()) and
disable other protocol versions as necessary.
[ruby-core:75225] [Feature #12324]
* ext/openssl/ossl_ssl.c: Use SSL_CTX_set_{min,max}_proto_version() to
fix the protocol version.
Tue Jun 7 12:55:34 2016 Martin Duerst <duerst@it.aoyama.ac.jp> Tue Jun 7 12:55:34 2016 Martin Duerst <duerst@it.aoyama.ac.jp>
* regenc.c (onigenc_not_support_case_map): Move to end of file; * regenc.c (onigenc_not_support_case_map): Move to end of file;

1
ext/openssl/extconf.rb
View File

@ -145,6 +145,7 @@ have_func("X509_STORE_up_ref")
have_func("SSL_SESSION_up_ref") have_func("SSL_SESSION_up_ref")
have_func("EVP_PKEY_up_ref") have_func("EVP_PKEY_up_ref")
OpenSSL.check_func_or_macro("SSL_CTX_set_tmp_ecdh_callback", "openssl/ssl.h") # removed OpenSSL.check_func_or_macro("SSL_CTX_set_tmp_ecdh_callback", "openssl/ssl.h") # removed
OpenSSL.check_func_or_macro("SSL_CTX_set_min_proto_version", "openssl/ssl.h")
Logging::message "=== Checking done. ===\n" Logging::message "=== Checking done. ===\n"

75
ext/openssl/ossl_ssl.c
View File

@ -88,35 +88,34 @@ static VALUE sym_exception, sym_wait_readable, sym_wait_writable;
*/ */
static const struct { static const struct {
const char *name; const char *name;
SSL_METHOD *(*func)(void); SSL_METHOD *(*func)(void); /* FIXME: constify when dropping 0.9.8 */
int version;
} ossl_ssl_method_tab[] = { } ossl_ssl_method_tab[] = {
#define OSSL_SSL_METHOD_ENTRY(name) { #name, (SSL_METHOD *(*)(void))name##_method } #if defined(HAVE_SSL_CTX_SET_MIN_PROTO_VERSION)
OSSL_SSL_METHOD_ENTRY(TLSv1), #define OSSL_SSL_METHOD_ENTRY(name, version) \
OSSL_SSL_METHOD_ENTRY(TLSv1_server), { #name, (SSL_METHOD *(*)(void))TLS_method, version }, \
OSSL_SSL_METHOD_ENTRY(TLSv1_client), { #name"_server", (SSL_METHOD *(*)(void))TLS_server_method, version }, \
#if defined(HAVE_TLSV1_2_METHOD) { #name"_client", (SSL_METHOD *(*)(void))TLS_client_method, version }
OSSL_SSL_METHOD_ENTRY(TLSv1_2), #else
OSSL_SSL_METHOD_ENTRY(TLSv1_2_server), #define OSSL_SSL_METHOD_ENTRY(name, version) \
OSSL_SSL_METHOD_ENTRY(TLSv1_2_client), { #name, (SSL_METHOD *(*)(void))name##_method, version }, \
#endif { #name"_server", (SSL_METHOD *(*)(void))name##_server_method, version }, \
#if defined(HAVE_TLSV1_1_METHOD) { #name"_client", (SSL_METHOD *(*)(void))name##_client_method, version }
OSSL_SSL_METHOD_ENTRY(TLSv1_1),
OSSL_SSL_METHOD_ENTRY(TLSv1_1_server),
OSSL_SSL_METHOD_ENTRY(TLSv1_1_client),
#endif #endif
#if defined(HAVE_SSLV2_METHOD) #if defined(HAVE_SSLV2_METHOD)
OSSL_SSL_METHOD_ENTRY(SSLv2), OSSL_SSL_METHOD_ENTRY(SSLv2, SSL2_VERSION),
OSSL_SSL_METHOD_ENTRY(SSLv2_server),
OSSL_SSL_METHOD_ENTRY(SSLv2_client),
#endif #endif
#if defined(HAVE_SSLV3_METHOD) #if defined(HAVE_SSLV3_METHOD)
OSSL_SSL_METHOD_ENTRY(SSLv3), OSSL_SSL_METHOD_ENTRY(SSLv3, SSL3_VERSION),
OSSL_SSL_METHOD_ENTRY(SSLv3_server),
OSSL_SSL_METHOD_ENTRY(SSLv3_client),
#endif #endif
OSSL_SSL_METHOD_ENTRY(SSLv23), OSSL_SSL_METHOD_ENTRY(TLSv1, TLS1_VERSION),
OSSL_SSL_METHOD_ENTRY(SSLv23_server), #if defined(HAVE_TLSV1_1_METHOD)
OSSL_SSL_METHOD_ENTRY(SSLv23_client), OSSL_SSL_METHOD_ENTRY(TLSv1_1, TLS1_1_VERSION),
#endif
#if defined(HAVE_TLSV1_2_METHOD)
OSSL_SSL_METHOD_ENTRY(TLSv1_2, TLS1_2_VERSION),
#endif
OSSL_SSL_METHOD_ENTRY(SSLv23, 0),
#undef OSSL_SSL_METHOD_ENTRY #undef OSSL_SSL_METHOD_ENTRY
}; };
@ -189,30 +188,36 @@ ossl_sslctx_s_alloc(VALUE klass)
static VALUE static VALUE
ossl_sslctx_set_ssl_version(VALUE self, VALUE ssl_method) ossl_sslctx_set_ssl_version(VALUE self, VALUE ssl_method)
{ {
SSL_METHOD *method = NULL; SSL_CTX *ctx;
const char *s; const char *s;
VALUE m = ssl_method; VALUE m = ssl_method;
int i; int i;
SSL_CTX *ctx; GetSSLCTX(self, ctx);
if (RB_TYPE_P(ssl_method, T_SYMBOL)) if (RB_TYPE_P(ssl_method, T_SYMBOL))
m = rb_sym2str(ssl_method); m = rb_sym2str(ssl_method);
s = StringValueCStr(m); s = StringValueCStr(m);
for (i = 0; i < numberof(ossl_ssl_method_tab); i++) { for (i = 0; i < numberof(ossl_ssl_method_tab); i++) {
if (strcmp(ossl_ssl_method_tab[i].name, s) == 0) { if (strcmp(ossl_ssl_method_tab[i].name, s) == 0) {
method = ossl_ssl_method_tab[i].func(); #if defined(HAVE_SSL_CTX_SET_MIN_PROTO_VERSION)
break; int version = ossl_ssl_method_tab[i].version;
#endif
SSL_METHOD *method = ossl_ssl_method_tab[i].func();
if (SSL_CTX_set_ssl_version(ctx, method) != 1)
ossl_raise(eSSLError, "SSL_CTX_set_ssl_version");
#if defined(HAVE_SSL_CTX_SET_MIN_PROTO_VERSION)
if (!SSL_CTX_set_min_proto_version(ctx, version))
ossl_raise(eSSLError, "SSL_CTX_set_min_proto_version");
if (!SSL_CTX_set_max_proto_version(ctx, version))
ossl_raise(eSSLError, "SSL_CTX_set_max_proto_version");
#endif
return ssl_method;
} }
} }
if (!method) {
ossl_raise(rb_eArgError, "unknown SSL method `%"PRIsVALUE"'.", m);
}
GetSSLCTX(self, ctx);
if (SSL_CTX_set_ssl_version(ctx, method) != 1) {
ossl_raise(eSSLError, "SSL_CTX_set_ssl_version");
}
return ssl_method; ossl_raise(rb_eArgError, "unknown SSL method `%"PRIsVALUE"'.", m);
} }
static VALUE static VALUE