ruby-tls 2.1.0 → 2.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: acce3678093f001d9085b46b4c163c4036a6dee0
-  data.tar.gz: 1f7ab340aa973063db130f597334ccf7505d45a8
+  metadata.gz: a60db39059fb7d735d7aa9201631628a65cf1291
+  data.tar.gz: dd41be2f38c92d9fedf92aec30620bead91c5c9d
 SHA512:
-  metadata.gz: edbee0e101783904e9fdadf6fdc1fccfc7785b3b69a798223ba36656ed71af5e475407a04a72a1c195688b3f6a6909a3e1ef20fd931db46309a4622e77fc56cb
-  data.tar.gz: 43dd6bb0b6a323bb282cdbdef4a2b81623cf01dfdc88ea28cb2df1cb66fc27d3caf8b8cf8c4659f51e8b574f60968b2a27fd03cd672472df853817864b94f33e
+  metadata.gz: f088fbbd7c397ec37dd60efd2a8722b933673b0e21a31003dc67e6f159567e964af3f0fcd568930be60da39546120de6dd8195c59ad3be7ff35f07eaf495260b
+  data.tar.gz: b9293b184946062a3eef3a778c65d269bf28cd7ead8b4e1fe8fca9bfac1aa213adef0c8e20e1d7370e7d2a5036bb54c735697066bc1da45baedf68425bbfb1bc

data/README.md

@@ -2,7 +2,7 @@
 
 Ruby-TLS decouples the management of encrypted communications, putting you in charge of the transport layer. It can be used as an alternative to Ruby's SSLSocket.
 
-[![Build Status](https://travis-ci.org/cotag/ruby-tls.png?branch=master)](https://travis-ci.org/cotag/ruby-tls)
+[![Build Status](https://travis-ci.org/cotag/ruby-tls.svg?branch=master)](https://travis-ci.org/cotag/ruby-tls)
 
 
 ## Install the gem
@@ -35,7 +35,8 @@ class transport
       cert_chain: '/file/path.crt',
       ciphers: 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA:@STRENGTH' # (default)
       # protocols: ["h2", "http/1.1"], # Can be used where OpenSSL >= 1.0.2 (Application Level Protocol negotiation)
-      # fallback: "http/1.1" # Optional fallback to a default protocol when either client or server doesn't support ALPN
+      # fallback: "http/1.1", # Optional fallback to a default protocol when either client or server doesn't support ALPN
+      # client_ca: '/file/path.pem'
     }
     @ssl_layer = RubyTls::SSL::Box.new(is_server, callback_obj, options)
   end
@@ -99,4 +100,3 @@ connection.send('client request')
 ## License and copyright
 
 MIT
-

data/lib/ruby-tls/ssl.rb

@@ -139,13 +139,15 @@ module RubyTls
             SSL_CTX_ctrl(ssl_ctx, SSL_CTRL_SET_SESS_CACHE_SIZE, op, nil)
         end
 
-        attach_function :SSL_CTX_use_PrivateKey_file, [:ssl_ctx, :string, :int], :int
+        attach_function :SSL_CTX_use_PrivateKey_file, [:ssl_ctx, :string, :int], :int, :blocking => true
         attach_function :SSL_CTX_use_PrivateKey, [:ssl_ctx, :pointer], :int
         attach_function :ERR_print_errors_fp, [:pointer], :void     # Pointer == File Handle
-        attach_function :SSL_CTX_use_certificate_chain_file, [:ssl_ctx, :string], :int
+        attach_function :SSL_CTX_use_certificate_chain_file, [:ssl_ctx, :string], :int, :blocking => true
         attach_function :SSL_CTX_use_certificate, [:ssl_ctx, :x509], :int
         attach_function :SSL_CTX_set_cipher_list, [:ssl_ctx, :string], :int
         attach_function :SSL_CTX_set_session_id_context, [:ssl_ctx, :string, :buffer_length], :int
+        attach_function :SSL_load_client_CA_file, [:string], :pointer
+        attach_function :SSL_CTX_set_client_CA_list, [:ssl_ctx, :pointer], :void
 
         # OpenSSL before 1.0.2 do not have these methods
         begin
@@ -286,7 +288,8 @@ keystr
         SSL_FILETYPE_PEM = 1
 
         class Context
-            CIPHERS = 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA:@STRENGTH'.freeze
+            # Based on information from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
+            CIPHERS = 'EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4'.freeze
             SESSION = 'ruby-tls'.freeze
 
 
@@ -321,6 +324,7 @@ keystr
                 if @is_server
                     set_private_key(options[:private_key] || SSL::DEFAULT_PRIVATE)
                     set_certificate(options[:cert_chain]  || SSL::DEFAULT_CERT)
+                    set_client_ca(options[:client_ca])
                 end
 
                 SSL.SSL_CTX_set_cipher_list(@ssl_ctx, options[:ciphers] || CIPHERS)
@@ -405,6 +409,18 @@ keystr
                     raise 'invalid certificate or file not found'
                 end
             end
+
+            def set_client_ca(ca)
+                return unless ca
+
+                if File.file?(ca) && (ca_ptr = SSL.SSL_load_client_CA_file(ca))
+                    # there is no error checking provided by SSL_CTX_set_client_CA_list
+                    SSL.SSL_CTX_set_client_CA_list(@ssl_ctx, ca_ptr)
+                else
+                    cleanup
+                    raise 'invalid ca certificate or file not found'
+                end
+            end
         end
 
 

data/lib/ruby-tls/version.rb

@@ -1,3 +1,3 @@
 module RubyTls
-    VERSION = "2.1.0"
+    VERSION = "2.1.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ruby-tls
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.1.2
 platform: ruby
 authors:
 - Stephen von Takach
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-03-24 00:00:00.000000000 Z
+date: 2016-06-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi-compiler
@@ -66,8 +66,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: |2
-          Allows transport layers outside Ruby TCP be secured.
+description: "        Allows transport layers outside Ruby TCP be secured.\n"
 email:
 - steve@cotag.me
 executables: []
@@ -105,7 +104,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: Abstract TLS for Ruby