ruby-tls 2.3.0 → 2.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b85f5f85aa66d137ff1ff2bd3894adaf81d07679
-  data.tar.gz: e0034106218aaa3d0ecc11ff067363a364eababa
+  metadata.gz: f08d99c470a03da9d3932d21d4fdc896ea6cfb06
+  data.tar.gz: 6500436dbffa39098612cbb5de54b0e14c9344a0
 SHA512:
-  metadata.gz: a4b103bd35d4eeb0f6e88ec95d03cdde3d282256567ac8ae6b6e2a714b8d81d16cc049475499bdca85aa4971ecfdc1f43caeafb73ef5a03509e3f93f125ac813
-  data.tar.gz: 5b50ebc3041e80fdba1fb24bcb55e3a3fc013e22e6ce23b5bb873badff8fa23b79c2e65818955a893081963367da21bf6c266159e02300da04dc1d254d209833
+  metadata.gz: b97ed2ad8a534ac1516e011a7b1f3e0aca9077653bd590d303cda1775434f8e9f91bea2eabd41dd75cd227424fcdcd39be29257f5cdcafdbf2a2def8f088ad9c
+  data.tar.gz: 3b6cf4dde116a5728c4bb29f297415a28c22a846f4dc66efb50538fbef738473acf2d803445d8c6e92104687f4f6dac7752999af2109a69f3c7236a4a296101d

data/lib/ruby-tls/ssl.rb

@@ -89,9 +89,6 @@ module RubyTls
         # PutCiphertext
         attach_function :BIO_write, [:bio, :buffer_in, :buffer_length], :int
 
-        # SelectALPNCallback
-        # TODO:: SSL_select_next_proto
-
         # Deconstructor
         attach_function :SSL_get_shutdown, [:ssl], :int
         attach_function :SSL_shutdown, [:ssl], :int
@@ -106,9 +103,6 @@ module RubyTls
                                              # r,   w
         attach_function :SSL_set_bio, [:ssl, :bio, :bio], :void
 
-        # TODO:: SSL_CTX_set_alpn_select_cb
-        # Will have to put a try catch around these and support when available
-
         attach_function :SSL_set_ex_data, [:ssl, :int, :string], :int
         callback :verify_callback, [:int, :x509], :int
         attach_function :SSL_set_verify, [:ssl, :int, :verify_callback], :void
@@ -120,11 +114,33 @@ module RubyTls
         attach_function :X509_STORE_CTX_get_ex_data, [:pointer, :int], :ssl
         attach_function :PEM_write_bio_X509, [:bio, :x509], :int
 
-
         # SSL Context Class
-        # Constructor
-        attach_function :SSLv23_server_method, [], :pointer
-        attach_function :SSLv23_client_method, [], :pointer
+        # OpenSSL before 1.1.0 do not have these methods
+        # https://www.openssl.org/docs/man1.1.0/ssl/TLSv1_2_server_method.html
+        begin
+            attach_function :TLS_server_method, [], :pointer
+            attach_function :TLS_client_method, [], :pointer
+
+            VERSION_SUPPORTED = true
+
+            SSL3_VERSION    = 0x0300
+            TLS1_VERSION    = 0x0301
+            TLS1_1_VERSION  = 0x0302
+            TLS1_2_VERSION  = 0x0303
+            TLS1_3_VERSION  = 0x0304
+            TLS_MAX_VERSION = TLS1_3_VERSION
+            ANY_VERSION     = 0
+            attach_function :SSL_CTX_set_min_proto_version, [:ssl_ctx, :int], :int
+            attach_function :SSL_CTX_set_max_proto_version, [:ssl_ctx, :int], :int
+        rescue FFI::NotFoundError
+            attach_function :SSLv23_server_method, [], :pointer
+            attach_function :SSLv23_client_method, [], :pointer
+
+            def self.TLS_server_method; self.SSLv23_server_method; end
+            def self.TLS_client_method; self.SSLv23_client_method; end
+
+            VERSION_SUPPORTED = false
+        end
         attach_function :SSL_CTX_new, [:pointer], :ssl_ctx
 
         attach_function :SSL_CTX_ctrl, [:ssl_ctx, :int, :ulong, :pointer], :long
@@ -176,6 +192,7 @@ module RubyTls
         attach_function :SSL_CTX_set_session_id_context, [:ssl_ctx, :string, :buffer_length], :int
         attach_function :SSL_load_client_CA_file, [:string], :pointer
         attach_function :SSL_CTX_set_client_CA_list, [:ssl_ctx, :pointer], :void
+        attach_function :SSL_CTX_load_verify_locations, [:ssl_ctx, :pointer], :int, :blocking => true
 
         # OpenSSL before 1.0.2 do not have these methods
         begin
@@ -342,12 +359,12 @@ keystr
                 @is_server = server
 
                 if @is_server
-                    @ssl_ctx = SSL.SSL_CTX_new(SSL.SSLv23_server_method)
+                    @ssl_ctx = SSL.SSL_CTX_new(SSL.TLS_server_method)
                     set_private_key(options[:private_key] || SSL::DEFAULT_PRIVATE)
                     set_certificate(options[:cert_chain]  || SSL::DEFAULT_CERT)
                     set_client_ca(options[:client_ca])
                 else
-                    @ssl_ctx = SSL.SSL_CTX_new(SSL.SSLv23_client_method)
+                    @ssl_ctx = SSL.SSL_CTX_new(SSL.TLS_client_method)
                 end
 
                 SSL.SSL_CTX_set_options(@ssl_ctx, SSL::SSL_OP_ALL)
@@ -356,6 +373,12 @@ keystr
                 SSL.SSL_CTX_set_cipher_list(@ssl_ctx, options[:ciphers] || CIPHERS)
                 @alpn_set = false
 
+                version = options[:version]
+                if version
+                    vresult = set_min_proto_version(version)
+                    raise "#{version} is unsupported" unless vresult
+                end
+
                 if @is_server
                     SSL.SSL_CTX_sess_set_cache_size(@ssl_ctx, 128)
                     SSL.SSL_CTX_set_session_id_context(@ssl_ctx, SESSION, 8)
@@ -377,6 +400,24 @@ keystr
                 end
             end
 
+            # Version can be one of:
+            # :SSL3, :TLS1, :TLS1_1, :TLS1_2, :TLS1_3, :TLS_MAX
+            def set_min_proto_version(version)
+                return false unless VERSION_SUPPORTED
+                num = SSL.const_get("#{version}_VERSION")
+                SSL.SSL_CTX_set_min_proto_version(@ssl_ctx, num) == 1
+            rescue NameError
+                false
+            end
+
+            def set_max_proto_version(version)
+                return false unless VERSION_SUPPORTED
+                num = SSL.const_get("#{version}_VERSION")
+                SSL.SSL_CTX_set_max_proto_version(@ssl_ctx, num) == 1
+            rescue NameError
+                false
+            end
+
             def cleanup
                 if @ssl_ctx
                     SSL.SSL_CTX_free(@ssl_ctx)

data/lib/ruby-tls/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RubyTls
-    VERSION = '2.3.0'
+    VERSION = '2.3.1'
 end

data/spec/comms_spec.rb

@@ -4,6 +4,18 @@ describe RubyTls do
 
     describe RubyTls::SSL::Box do
 
+        it "fails when passed an unsupported TLS version" do
+            expect {
+                RubyTls::SSL::Box.new(false, nil, version: :TLS1_4)
+            }.to raise_error(/is unsupported/)
+        end
+
+        it "succeeds when passed a supported TLS version" do
+            expect {
+                RubyTls::SSL::Box.new(false, nil, version: :TLS1_2)
+            }.to raise_error(/is unsupported/)
+        end
+
         it "should be able to send and receive encrypted comms" do
             @server_data = []
             @client_data = []

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ruby-tls
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 2.3.1
 platform: ruby
 authors:
 - Stephen von Takach
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-02-06 00:00:00.000000000 Z
+date: 2017-10-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi-compiler
@@ -110,7 +110,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.1
+rubygems_version: 2.6.12
 signing_key: 
 specification_version: 4
 summary: Abstract TLS for Ruby