archive/ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2025-09-15 08:33:58 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

[ruby/openssl] ssl: add SSLContext#tmp_dh=

Browse source 
Provide a wrapper of SSL_set0_tmp_dh_pkey()/SSL_CTX_set_tmp_dh(), which
sets the DH parameters used for ephemeral DH key exchange.

SSLContext#tmp_dh_callback= already exists for this purpose, as a
wrapper around SSL_CTX_set_tmp_dh_callback(), but it is considered
obsolete and the OpenSSL API is deprecated for future removal. There is
no practical use case where an application needs to use different DH
parameters nowadays. This was originally introduced to support export
grade ciphers.

RDoc for #tmp_dh_callback= is updated to recommend the new #tmp_dh=.

Note that current versions of OpenSSL support automatic ECDHE curve
selection which is enabled by default. SSLContext#tmp_dh= should only be
necessary if you must allow ancient clients which don't support ECDHE.

aa43da4f04
This commit is contained in:
Kazuki Yamaguchi 2021-03-18 20:04:59 +09:00
parent 49217086ad
commit 6105ef7629
4 changed files with 74 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

24
test/openssl/test_ssl.rb
View file

@ -1583,13 +1583,11 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase
end
end
def test_dh_callback
pend "TLS 1.2 is not supported" unless tls12_supported?
def test_tmp_dh_callback
dh = Fixtures.pkey("dh-1")
called = false
ctx_proc = -> ctx {
ctx.ssl_version = :TLSv1_2
ctx.max_version = :TLS1_2
ctx.ciphers = "DH:!NULL"
ctx.tmp_dh_callback = ->(*args) {
called = true
@ -1605,10 +1603,8 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase
end
def test_connect_works_when_setting_dh_callback_to_nil
pend "TLS 1.2 is not supported" unless tls12_supported?
ctx_proc = -> ctx {
ctx.ssl_version = :TLSv1_2
ctx.max_version = :TLS1_2
ctx.ciphers = "DH:!NULL" # use DH
ctx.tmp_dh_callback = nil
}
@ -1621,6 +1617,20 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase
end
end
def test_tmp_dh
dh = Fixtures.pkey("dh-1")
ctx_proc = -> ctx {
ctx.max_version = :TLS1_2
ctx.ciphers = "DH:!NULL" # use DH
ctx.tmp_dh = dh
}
start_server(ctx_proc: ctx_proc) do |port|
server_connect(port) { |ssl|
assert_equal dh.to_der, ssl.tmp_key.to_der
}
end
end
def test_ecdh_curves_tls12
pend "EC is disabled" unless defined?(OpenSSL::PKey::EC)