mcollective-client 2.6.0 → 2.6.1

data/lib/mcollective/monkey_patches.rb

@@ -119,3 +119,32 @@ class Dir
     File.expand_path(tmp)
   end unless method_defined?(:tmpdir)
 end
+
+# Reject all SSLv2 ciphers and all SSLv2 or SSLv3 handshakes by default
+require 'openssl'
+class OpenSSL::SSL::SSLContext
+  if DEFAULT_PARAMS[:options]
+    DEFAULT_PARAMS[:options] |= OpenSSL::SSL::OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3
+  else
+    DEFAULT_PARAMS[:options] = OpenSSL::SSL::OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3
+  end
+
+  # ruby 1.8.5 doesn't define this constant, but has it on by default
+  if defined?(OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS)
+    DEFAULT_PARAMS[:options] |= OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS
+  end
+
+  DEFAULT_PARAMS[:ciphers] << ':!SSLv2'
+
+  alias __mcollective_original_initialize initialize
+  private :__mcollective_original_initialize
+
+  def initialize(*args)
+    __mcollective_original_initialize(*args)
+    params = {
+      :options => DEFAULT_PARAMS[:options],
+      :ciphers => DEFAULT_PARAMS[:ciphers],
+    }
+    set_params(params)
+  end
+end

data/spec/unit/monkey_patches_spec.rb

@@ -0,0 +1,31 @@
+require 'spec_helper'
+
+require 'mcollective/monkey_patches'
+
+describe OpenSSL::SSL::SSLContext do
+  it 'sets parameters on initialization' do
+    described_class.any_instance.expects(:set_params)
+    subject
+  end
+
+  it 'disables SSLv2 via the SSLContext#options bitmask' do
+    (subject.options & OpenSSL::SSL::OP_NO_SSLv2).should == OpenSSL::SSL::OP_NO_SSLv2
+  end
+
+  it 'explicitly disable SSLv2 ciphers using the ! prefix so they cannot be re-added' do
+    cipher_str = OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:ciphers]
+    cipher_str.split(':').should include('!SSLv2')
+  end
+
+  it 'has no ciphers with version SSLv2 enabled' do
+    ciphers = subject.ciphers.select do |name, version, bits, alg_bits|
+      /SSLv2/.match(version)
+    end
+    ciphers.should be_empty
+  end
+
+  it 'disables SSLv3 via the SSLContext#options bitmask' do
+    (subject.options & OpenSSL::SSL::OP_NO_SSLv3).should == OpenSSL::SSL::OP_NO_SSLv3
+  end
+
+end

data/spec/unit/plugins/mcollective/connector/activemq_spec.rb

@@ -249,6 +249,7 @@ module MCollective
           Activemq.any_instance.stubs(:get_option).with("activemq.pool.1.user").returns("user1")
           Activemq.any_instance.stubs(:get_option).with("activemq.pool.1.password").returns("password1")
           Activemq.any_instance.stubs(:get_bool_option).with("activemq.pool.1.ssl", false).returns(true)
+          Activemq.any_instance.stubs(:get_option).with("activemq.pool.1.ssl.ciphers", false).returns(false)
         end
 
         it "should ensure all settings are provided" do
@@ -292,6 +293,27 @@ module MCollective
 
           expect { connector.ssl_parameters(1, false) }.to raise_error
         end
+
+        context 'ciphers' do
+          before :each do
+            Activemq.any_instance.stubs(:get_option).with("activemq.pool.1.ssl.cert", false).returns("rspec")
+            Activemq.any_instance.stubs(:get_option).with("activemq.pool.1.ssl.key", false).returns('rspec.key')
+            Activemq.any_instance.stubs(:get_option).with("activemq.pool.1.ssl.ca", false).returns('rspec1.ca,rspec2.ca')
+            File.stubs(:exist?).returns(true)
+          end
+
+          it 'should not set ciphers by default' do
+            parameters = connector.ssl_parameters(1, false)
+            parameters.ciphers.should == false
+          end
+
+          it 'should support setting of ciphers' do
+            Activemq.any_instance.stubs(:get_option).with("activemq.pool.1.ssl.ciphers", false).returns('TLSv127:!NUTS')
+            parameters = connector.ssl_parameters(1, false)
+            parameters.ciphers.should == 'TLSv127:!NUTS'
+          end
+        end
+
       end
 
       describe "#get_key_file" do

data/spec/unit/plugins/mcollective/connector/rabbitmq_spec.rb

@@ -248,6 +248,7 @@ module MCollective
           Rabbitmq.any_instance.stubs(:get_option).with("rabbitmq.pool.1.user").returns("user1")
           Rabbitmq.any_instance.stubs(:get_option).with("rabbitmq.pool.1.password").returns("password1")
           Rabbitmq.any_instance.stubs(:get_bool_option).with("rabbitmq.pool.1.ssl", false).returns(true)
+          Rabbitmq.any_instance.stubs(:get_option).with("rabbitmq.pool.1.ssl.ciphers", false).returns(false)
         end
 
         it "should ensure all settings are provided" do
@@ -291,6 +292,26 @@ module MCollective
 
           expect { connector.ssl_parameters(1, false) }.to raise_error
         end
+
+        context 'ciphers' do
+          before :each do
+            Rabbitmq.any_instance.stubs(:get_option).with("rabbitmq.pool.1.ssl.cert", false).returns("rspec")
+            Rabbitmq.any_instance.stubs(:get_option).with("rabbitmq.pool.1.ssl.key", false).returns('rspec.key')
+            Rabbitmq.any_instance.stubs(:get_option).with("rabbitmq.pool.1.ssl.ca", false).returns('rspec1.ca,rspec2.ca')
+            File.stubs(:exist?).returns(true)
+          end
+
+          it 'should not set ciphers by default' do
+            parameters = connector.ssl_parameters(1, false)
+            parameters.ciphers.should == false
+          end
+
+          it 'should support setting of ciphers' do
+            Rabbitmq.any_instance.stubs(:get_option).with("rabbitmq.pool.1.ssl.ciphers", false).returns('TLSv127:!NUTS')
+            parameters = connector.ssl_parameters(1, false)
+            parameters.ciphers.should == 'TLSv127:!NUTS'
+          end
+        end
       end
 
       describe "#get_key_file" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mcollective-client
 version: !ruby/object:Gem::Version
-  version: 2.6.0
+  version: 2.6.1
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-08-21 00:00:00.000000000 Z
+date: 2014-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: systemu
@@ -247,6 +247,7 @@ files:
 - spec/unit/runner_spec.rb
 - spec/unit/util_spec.rb
 - spec/unit/agents_spec.rb
+- spec/unit/monkey_patches_spec.rb
 - spec/unit/unix_daemon_spec.rb
 - spec/unit/rpc_spec.rb
 - spec/unit/facts_spec.rb
@@ -395,6 +396,7 @@ test_files:
 - spec/unit/runner_spec.rb
 - spec/unit/util_spec.rb
 - spec/unit/agents_spec.rb
+- spec/unit/monkey_patches_spec.rb
 - spec/unit/unix_daemon_spec.rb
 - spec/unit/rpc_spec.rb
 - spec/unit/facts_spec.rb