ruby-changes:36040
From: usa <ko1@a...>
Date: Fri, 24 Oct 2014 12:06:54 +0900 (JST)
Subject: [ruby-changes:36040] usa:r48121 (ruby_1_9_3): merge revision(s) 45274, 45278, 45280, 48097: [Backport #9424]
usa 2014-10-24 12:06:36 +0900 (Fri, 24 Oct 2014) New Revision: 48121 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=48121 Log: merge revision(s) 45274,45278,45280,48097: [Backport #9424] * ext/openssl/lib/openssl/ssl-internal.rb (DEFAULT_PARAMS): override options even if OpenSSL::SSL::OP_NO_SSLv3 is not defined. this is pointed out by Stephen Touset. [ruby-core:65711] [Bug #9424] * test/openssl/test_ssl.rb: Reuse TLS default options from OpenSSL::SSL::SSLContext::DEFAULT_PARAMS. * lib/openssl/ssl-internal.rb: Explicitly whitelist the default SSL/TLS ciphers. Forbid SSLv2 and SSLv3, disable compression by default. Reported by Jeff Hodges. [ruby-core:59829] [Bug #9424] Modified files: branches/ruby_1_9_3/ChangeLog branches/ruby_1_9_3/ext/openssl/lib/openssl/ssl-internal.rb branches/ruby_1_9_3/test/openssl/test_ssl.rb branches/ruby_1_9_3/version.h Index: ruby_1_9_3/ChangeLog =================================================================== --- ruby_1_9_3/ChangeLog (revision 48120) +++ ruby_1_9_3/ChangeLog (revision 48121) @@ -1,3 +1,22 @@ https://github.com/ruby/ruby/blob/trunk/ruby_1_9_3/ChangeLog#L1 +Thu Oct 24 12:00:55 2014 CHIKANAGA Tomoyuki <nagachika@r...> + + * ext/openssl/lib/openssl/ssl-internal.rb (DEFAULT_PARAMS): override + options even if OpenSSL::SSL::OP_NO_SSLv3 is not defined. + this is pointed out by Stephen Touset. [ruby-core:65711] [Bug #9424] + +Thu Oct 24 12:00:55 2014 Martin Bosslet <Martin.Bosslet@g...> + + * test/openssl/test_ssl.rb: Reuse TLS default options from + OpenSSL::SSL::SSLContext::DEFAULT_PARAMS. + +Thu Oct 24 12:00:55 2014 Martin Bosslet <Martin.Bosslet@g...> + + * lib/openssl/ssl-internal.rb: Explicitly whitelist the default + SSL/TLS ciphers. Forbid SSLv2 and SSLv3, disable + compression by default. + Reported by Jeff Hodges. + [ruby-core:59829] [Bug #9424] + Sat Sep 6 09:13:55 2014 Zachary Scott <e@z...> * lib/rdoc/generator/template/darkfish/js/jquery.js: Backport Index: ruby_1_9_3/ext/openssl/lib/openssl/ssl-internal.rb =================================================================== --- ruby_1_9_3/ext/openssl/lib/openssl/ssl-internal.rb (revision 48120) +++ ruby_1_9_3/ext/openssl/lib/openssl/ssl-internal.rb (revision 48121) @@ -23,8 +23,49 @@ module OpenSSL https://github.com/ruby/ruby/blob/trunk/ruby_1_9_3/ext/openssl/lib/openssl/ssl-internal.rb#L23 DEFAULT_PARAMS = { :ssl_version => "SSLv23", :verify_mode => OpenSSL::SSL::VERIFY_PEER, - :ciphers => "ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW", - :options => OpenSSL::SSL::OP_ALL, + :ciphers => %w{ + ECDHE-ECDSA-AES128-GCM-SHA256 + ECDHE-RSA-AES128-GCM-SHA256 + ECDHE-ECDSA-AES256-GCM-SHA384 + ECDHE-RSA-AES256-GCM-SHA384 + DHE-RSA-AES128-GCM-SHA256 + DHE-DSS-AES128-GCM-SHA256 + DHE-RSA-AES256-GCM-SHA384 + DHE-DSS-AES256-GCM-SHA384 + ECDHE-ECDSA-AES128-SHA256 + ECDHE-RSA-AES128-SHA256 + ECDHE-ECDSA-AES128-SHA + ECDHE-RSA-AES128-SHA + ECDHE-ECDSA-AES256-SHA384 + ECDHE-RSA-AES256-SHA384 + ECDHE-ECDSA-AES256-SHA + ECDHE-RSA-AES256-SHA + DHE-RSA-AES128-SHA256 + DHE-RSA-AES256-SHA256 + DHE-RSA-AES128-SHA + DHE-RSA-AES256-SHA + DHE-DSS-AES128-SHA256 + DHE-DSS-AES256-SHA256 + DHE-DSS-AES128-SHA + DHE-DSS-AES256-SHA + AES128-GCM-SHA256 + AES256-GCM-SHA384 + AES128-SHA256 + AES256-SHA256 + AES128-SHA + AES256-SHA + ECDHE-ECDSA-RC4-SHA + ECDHE-RSA-RC4-SHA + RC4-SHA + }.join(":"), + :options => -> { + opts = OpenSSL::SSL::OP_ALL + opts &= ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS if defined?(OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS) + opts |= OpenSSL::SSL::OP_NO_COMPRESSION if defined?(OpenSSL::SSL::OP_NO_COMPRESSION) + opts |= OpenSSL::SSL::OP_NO_SSLv2 if defined?(OpenSSL::SSL::OP_NO_SSLv2) + opts |= OpenSSL::SSL::OP_NO_SSLv3 if defined?(OpenSSL::SSL::OP_NO_SSLv3) + opts + }.call } DEFAULT_CERT_STORE = OpenSSL::X509::Store.new Index: ruby_1_9_3/version.h =================================================================== --- ruby_1_9_3/version.h (revision 48120) +++ ruby_1_9_3/version.h (revision 48121) @@ -1,10 +1,10 @@ https://github.com/ruby/ruby/blob/trunk/ruby_1_9_3/version.h#L1 #define RUBY_VERSION "1.9.3" -#define RUBY_PATCHLEVEL 548 +#define RUBY_PATCHLEVEL 549 -#define RUBY_RELEASE_DATE "2014-09-06" +#define RUBY_RELEASE_DATE "2014-10-24" #define RUBY_RELEASE_YEAR 2014 -#define RUBY_RELEASE_MONTH 9 -#define RUBY_RELEASE_DAY 6 +#define RUBY_RELEASE_MONTH 10 +#define RUBY_RELEASE_DAY 24 #include "ruby/version.h" Index: ruby_1_9_3/test/openssl/test_ssl.rb =================================================================== --- ruby_1_9_3/test/openssl/test_ssl.rb (revision 48120) +++ ruby_1_9_3/test/openssl/test_ssl.rb (revision 48121) @@ -273,7 +273,7 @@ class OpenSSL::TestSSL < OpenSSL::SSLTes https://github.com/ruby/ruby/blob/trunk/ruby_1_9_3/test/openssl/test_ssl.rb#L273 ctx = OpenSSL::SSL::SSLContext.new ctx.set_params assert_equal(OpenSSL::SSL::VERIFY_PEER, ctx.verify_mode) - assert_equal(OpenSSL::SSL::OP_ALL, ctx.options) + assert_equal(OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:options], ctx.options) ciphers = ctx.ciphers ciphers_versions = ciphers.collect{|_, v, _, _| v } ciphers_names = ciphers.collect{|v, _, _, _| v } -- ML: ruby-changes@q... Info: http://www.atdot.net/~ko1/quickml/