archive/ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2025-08-27 06:56:13 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

* ext/openssl/lib/openssl/ssl.rb (module OpenSSL): raise a more

Browse source 
helpful exception when verifying the peer connection and an
  anonymous cipher has been selected. [ruby-core:68330] [Bug #10910]
  Thanks to Chris Sinjakli <chris@sinjakli.co.uk> for the patch.

* test/openssl/test_ssl.rb (class OpenSSL): test for change

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@51409 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
tenderlove 2015-07-27 18:29:17 +00:00
parent 6d98fba257
commit dc9ca079bb
4 changed files with 41 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
ext/openssl/lib/openssl/ssl.rb
View file

@ -252,6 +252,14 @@ module OpenSSL
# This method MUST be called after calling #connect to ensure that the
# hostname of a remote peer has been verified.
def post_connection_check(hostname)
if peer_cert.nil?
msg = "Peer verification enabled, but no certificate received."
if using_anon_cipher?
msg += " Anonymous cipher suite #{cipher[0]} was negotiated. Anonymous suites must be disabled to use peer verification."
end
raise SSLError, msg
end
unless OpenSSL::SSL.verify_certificate_identity(peer_cert, hostname)
raise SSLError, "hostname \"#{hostname}\" does not match the server certificate"
end
@ -263,6 +271,14 @@ module OpenSSL
rescue SSL::Session::SessionError
nil
end
private
def using_anon_cipher?
ctx = OpenSSL::SSL::SSLContext.new
ctx.ciphers = "aNULL"
ctx.ciphers.include?(cipher)
end
end
##