1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

* ext/openssl/lib/ssl.rb: Enable insertion of empty fragments as a

Browse Source 
countermeasure for the BEAST attack by default. The default options
  of OpenSSL::SSL:SSLContext are now:
  OpenSSL::SSL::OP_ALL & ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS
  [Bug #5353] [ruby-core:39673]

* test/openssl/test_ssl.rb: Adapt tests to new SSLContext default.

* NEWS: Announce the new default.



git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@38433 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
emboss 2012-12-18 02:02:43 +00:00
parent f5a32acb97
commit 84f1dae9d6
4 changed files with 30 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ChangeLog
View File

@ -1,3 +1,15 @@
Tue Dec 18 11:52:34 2012 Martin Bosslet <Martin.Bosslet@gmail.com>
* ext/openssl/lib/ssl.rb: Enable insertion of empty fragments as a
countermeasure for the BEAST attack by default. The default options
of OpenSSL::SSL:SSLContext are now:
OpenSSL::SSL::OP_ALL & ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS
[Bug #5353] [ruby-core:39673]
* test/openssl/test_ssl.rb: Adapt tests to new SSLContext default.
* NEWS: Announce the new default.
Tue Dec 18 06:36:12 2012 Koichi Sasada <ko1@atdot.net> Tue Dec 18 06:36:12 2012 Koichi Sasada <ko1@atdot.net>
* method.h: remove `VM_METHOD_TYPE_CFUNC_FRAMELESS' method type. * method.h: remove `VM_METHOD_TYPE_CFUNC_FRAMELESS' method type.

6
NEWS
View File

@ -256,7 +256,11 @@ with all sufficient information, see the ChangeLog file.
with OpenSSL 1.0.1 and higher. with OpenSSL 1.0.1 and higher.
* OpenSSL::OPENSSL_FIPS allows client applications to detect whether OpenSSL * OpenSSL::OPENSSL_FIPS allows client applications to detect whether OpenSSL
is running in FIPS mode and to react to the special requirements this is running in FIPS mode and to react to the special requirements this
might impy. might imply.
* The default options for OpenSSL::SSL::SSLContext have changed to
OpenSSL::SSL::OP_ALL & ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS
instead of OpenSSL::SSL::OP_ALL only. This enables the countermeasure for
the BEAST attack by default.
* ostruct * ostruct
* new methods: * new methods:

4
ext/openssl/lib/openssl/ssl.rb
View File

@ -24,7 +24,9 @@ module OpenSSL
:ssl_version => "SSLv23", :ssl_version => "SSLv23",
:verify_mode => OpenSSL::SSL::VERIFY_PEER, :verify_mode => OpenSSL::SSL::VERIFY_PEER,
:ciphers => "ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW", :ciphers => "ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW",
:options => OpenSSL::SSL::OP_ALL, :options => defined?(OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS) ?
OpenSSL::SSL::OP_ALL & ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS :
OpenSSL::SSL::OP_ALL,
} }
DEFAULT_CERT_STORE = OpenSSL::X509::Store.new DEFAULT_CERT_STORE = OpenSSL::X509::Store.new

12
test/openssl/test_ssl.rb
View File

@ -3,6 +3,11 @@ require_relative "utils"
if defined?(OpenSSL) if defined?(OpenSSL)
class OpenSSL::TestSSL < OpenSSL::SSLTestCase class OpenSSL::TestSSL < OpenSSL::SSLTestCase
TLS_DEFAULT_OPS = defined?(OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS) ?
OpenSSL::SSL::OP_ALL & ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS :
OpenSSL::SSL::OP_ALL
def test_ctx_setup def test_ctx_setup
ctx = OpenSSL::SSL::SSLContext.new ctx = OpenSSL::SSL::SSLContext.new
assert_equal(ctx.setup, true) assert_equal(ctx.setup, true)
@ -257,7 +262,7 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase
ctx = OpenSSL::SSL::SSLContext.new ctx = OpenSSL::SSL::SSLContext.new
ctx.set_params ctx.set_params
assert_equal(OpenSSL::SSL::VERIFY_PEER, ctx.verify_mode) assert_equal(OpenSSL::SSL::VERIFY_PEER, ctx.verify_mode)
assert_equal(OpenSSL::SSL::OP_ALL, ctx.options) assert_equal(TLS_DEFAULT_OPS, ctx.options)
ciphers = ctx.ciphers ciphers = ctx.ciphers
ciphers_versions = ciphers.collect{|_, v, _, _| v } ciphers_versions = ciphers.collect{|_, v, _, _| v }
ciphers_names = ciphers.collect{|v, _, _, _| v } ciphers_names = ciphers.collect{|v, _, _, _| v }
@ -398,7 +403,10 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase
def test_unset_OP_ALL def test_unset_OP_ALL
ctx_proc = Proc.new { |ctx| ctx_proc = Proc.new { |ctx|
ctx.options = OpenSSL::SSL::OP_ALL & ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS # If OP_DONT_INSERT_EMPTY_FRAGMENTS is not defined, this test is
# redundant because the default options already are equal to OP_ALL.
# But it also degrades gracefully, so keep it
ctx.options = OpenSSL::SSL::OP_ALL
} }
start_server(PORT, OpenSSL::SSL::VERIFY_NONE, true, :ctx_proc => ctx_proc){|server, port| start_server(PORT, OpenSSL::SSL::VERIFY_NONE, true, :ctx_proc => ctx_proc){|server, port|
server_connect(port) { |ssl| server_connect(port) { |ssl|