ftw 0.0.41 → 0.0.42

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1ceb0fdc8f63693a96433f7417afb19330140af2
-  data.tar.gz: e037a78814a02848e72c92da450b338d0d190737
+  metadata.gz: 33fab2173e9d5a55d01c5be096be99b4a6e4c9b6
+  data.tar.gz: 2d5d057c20fc4bec7705143ba4010d9162623d1f
 SHA512:
-  metadata.gz: a683de29fb0919b548d7162198943bc164fc35b66d8f8ec6d750fbe51808c3cf8078591ae3e2ccc256b0cc80d2a07153f933b9e73e66f819b1908d15337399e3
-  data.tar.gz: 5b210be8cfd33f284b5355cc2832b5ccdc1fbe464f081710c5e90f813424e1844eaddb2b3f1f5832ae74eee2a37c5c9c34c5ff4d13f21511a4b32a5b97439335
+  metadata.gz: 1cd81a35b4289d5c5f3c7aa566d4de5e4192ad2ac8343d7c74d3a13fc695ad6c719254395375448262da6ee13697ce2a066f63eaab32c069e185a4b7d8ee2c9c
+  data.tar.gz: 437f27db19fd9616dcec6db39d97f02e336ab0d5edeaebff14e785a70d85988a41a8a72bbd2075ccbbd2f4ce9532321277b49730a49894bd1e87681ca5c6eedd

data/lib/ftw/agent.rb

@@ -445,8 +445,9 @@ class FTW::Agent
           @logger.error("Error in certificate_verify call", :exception => e)
         end
       end
-      connection.secure(:certificate_store => certificate_store,
-                        :verify_callback => verify_callback)
+      ciphers = SSL_CIPHER_MAP[configuration[SSL_CIPHERS]] || configuration[SSL_CIPHERS]
+      connection.secure(:certificate_store => certificate_store, :verify_callback => verify_callback,
+                        :ciphers => ciphers, :version => configuration[SSL_VERSION])
     end # if secure
 
     return connection, nil

data/lib/ftw/agent/configuration.rb

@@ -12,6 +12,20 @@ module FTW::Agent::Configuration
   # SSL: Use the system's global default certs?
   SSL_USE_DEFAULT_CERTS = "ssl.use-default-certs".freeze
 
+  # SSL cipher strings
+  SSL_CIPHERS = "ssl.ciphers".freeze
+
+  SSL_CIPHER_MAP = {
+    # https://wiki.mozilla.org/Security/Server_Side_TLS
+    "MOZILLA_MODERN" => "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK",
+    "MOZILLA_INTERMEDIATE" => "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA",
+    "MOZILLA_OLD" => "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
+  }
+
+  SSL_CIPHER_DEFAULT = SSL_CIPHER_MAP["MOZILLA_MODERN"]
+
+  SSL_VERSION = "ssl.version"
+
   private
 
   # Get the configuration hash
@@ -27,6 +41,8 @@ module FTW::Agent::Configuration
       REDIRECTION_LIMIT => 20,
       SSL_TRUST_STORE => File.join(home, "ssl-trust.db"),
       SSL_USE_DEFAULT_CERTS => true,
+      SSL_CIPHERS => SSL_CIPHER_DEFAULT,
+      SSL_VERSION => "TLSv1.1",
     }
   end # def default_configuration
 

data/lib/ftw/connection.rb

@@ -40,6 +40,9 @@ class FTW::Connection
   # Secure setup timed out
   class SecureHandshakeTimeout < StandardError; end
 
+  # Invalid connection configuration
+  class InvalidConfiguration < StandardError; end
+
   private
 
   # A new network connection.
@@ -315,13 +318,20 @@ class FTW::Connection
   #
   # * :certificate_store, an OpenSSL::X509::Store
   # * :timeout, a timeout threshold in seconds.
+  # * :ciphers, an OpenSSL ciphers string, see `openssl ciphers` manual for details.
+  # * :version, any of: SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2
+  #
+  # Notes:
+  # * Version may depend on your platform (openssl compilation settings, JVM
+  #   version, export restrictions, etc) 
   def secure(options=nil)
     # Skip this if we're already secure.
     return if secured?
 
     defaults = {
       :timeout => nil,
-      #:certificate_store => OpenSSL::SSL::SSLContext::DEFAULT_CERT_STORE
+      :ciphers => FTW::Agent::Configuration::SSL_CIPHER_MAP["MOZILLA_MODERN"],
+      :version => "TLSv1.1"
     }
     settings = defaults.merge(options) unless options.nil?
 
@@ -334,7 +344,7 @@ class FTW::Connection
 
     # ruby-core is refusing to patch ruby's default openssl settings to be more
     # secure, so let's fix that here. The next few lines setting options and
-    # ciphers come from jmhodges proposed patch
+    # ciphers come from jmhodges' proposed patch
     ssloptions = OpenSSL::SSL::OP_ALL
     if defined?(OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS)
       ssloptions &= ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS
@@ -342,8 +352,15 @@ class FTW::Connection
     if defined?(OpenSSL::SSL::OP_NO_COMPRESSION)
       ssloptions |= OpenSSL::SSL::OP_NO_COMPRESSION
     end
+    # https://github.com/jruby/jruby/issues/1874
+    version = OpenSSL::SSL::SSLContext::METHODS.find { |x| x.to_s.gsub("_",".") == settings[:version] }
+    raise InvalidConfiguration, "Invalid SSL/TLS version '#{settings[:version]}'" if version.nil?
+    sslcontext.ssl_version = version
+
+    # We have to set ciphers *after* setting ssl_version because setting
+    # ssl_version will reset the cipher set.
     sslcontext.options = ssloptions
-    sslcontext.ciphers = "DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2"
+    sslcontext.ciphers = settings[:ciphers]
 
     sslcontext.verify_callback = proc do |*args| 
       @logger.debug("Verify peer via FTW::Connection#secure", :callback => settings[:verify_callback])
@@ -351,16 +368,17 @@ class FTW::Connection
         settings[:verify_callback].call(*args)
       end
     end
-    sslcontext.cert_store = options[:certificate_store]
+    sslcontext.cert_store = settings[:certificate_store]
+
     @socket = OpenSSL::SSL::SSLSocket.new(@socket, sslcontext)
 
     # TODO(sissel): Set up local certificat/key stuff. This is required for
     # server-side ssl operation, I think.
 
     if client?
-      do_secure(:connect_nonblock, options[:timeout])
+      do_secure(:connect_nonblock, settings[:timeout])
     else
-      do_secure(:accept_nonblock, options[:timeout])
+      do_secure(:accept_nonblock, settings[:timeout])
     end
   end # def secure
 

data/lib/ftw/protocol.rb

@@ -109,7 +109,7 @@ module FTW::Protocol
   def write_all(io, string)
     while string.bytesize > 0
       w = io.write(string)
-      string = string[w..-1]
+      string = string.byteslice(w..-1)
     end
   end # def write_all
 

data/lib/ftw/server.rb

@@ -26,6 +26,7 @@ class FTW::Server
     addresses = [addresses] if !addresses.is_a?(Array)
     dns = FTW::DNS.singleton
 
+    @control_lock = Mutex.new
     @sockets = {}
 
     failures = []
@@ -78,14 +79,23 @@ class FTW::Server
       failures += local_failures
     end
 
+    # This allows us to interrupt the #each_connection's select() later
+    # when anyone calls stop()
+    @stopper = IO.pipe
+
     # Abort if there were failures
     raise ServerSetupFailure.new(failures) if failures.any?
   end # def initialize
 
   # Stop serving.
   def stop
-    @sockets.each do |name, socket|
-      socket.close
+    @stopper[1].syswrite(".")
+    @stopper[1].close()
+    @control_lock.synchronize do
+      @sockets.each do |name, socket|
+        socket.close
+      end
+      @sockets.clear
     end
   end # def stop
 
@@ -93,14 +103,17 @@ class FTW::Server
   def each_connection(&block)
     # TODO(sissel): Select on all sockets
     # TODO(sissel): Accept and yield to the block
+    stopper = @stopper[0]
     while true
-      sockets = @sockets.values
-      read, write, error = IO.select(sockets, nil, nil, nil)
-      read.each do |serversocket|
-        #p serversocket.methods.sort
-        socket, addrinfo = serversocket.accept
-        connection = FTW::Connection.from_io(socket)
-        yield connection
+      @control_lock.synchronize do
+        sockets = @sockets.values + [stopper]
+        read, write, error = IO.select(sockets, nil, nil, nil)
+        break if read.include?(stopper)
+        read.each do |serversocket|
+          socket, addrinfo = serversocket.accept
+          connection = FTW::Connection.from_io(socket)
+          yield connection
+        end
       end
     end
   end # def each_connection

data/lib/ftw/version.rb

@@ -3,5 +3,5 @@ require "ftw/namespace"
 # :nodoc:
 module FTW
   # The version of this library
-  VERSION = "0.0.41"
+  VERSION = "0.0.42"
 end

data/test/ftw/protocol.rb

@@ -76,4 +76,17 @@ describe FTW::Protocol do
     assert_equal( output.io.string, "12\r\nSome example input\r\n0\r\n\r\n")
   end
 
+  test "writing non ascii characters" do
+    protocol = Object.new
+    protocol.extend FTW::Protocol
+
+    output = StringIO.new
+    input  = "è".force_encoding(Encoding::UTF_8)
+
+    protocol.write_http_body(input, output, true)
+
+    output.rewind
+    assert_equal( output.string, "2\r\nè\r\n0\r\n\r\n")
+  end
+
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ftw
 version: !ruby/object:Gem::Version
-  version: 0.0.41
+  version: 0.0.42
 platform: ruby
 authors:
 - Jordan Sissel
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-11-13 00:00:00.000000000 Z
+date: 2014-11-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cabin
@@ -28,16 +28,16 @@ dependencies:
   name: http_parser.rb
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.3
+        version: '0.6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.3
+        version: '0.6'
 - !ruby/object:Gem::Dependency
   name: addressable
   requirement: !ruby/object:Gem::Requirement