Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix SSL protocols supported by curb adapter #201

Closed
wants to merge 1 commit into from
Closed

Fix SSL protocols supported by curb adapter #201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,5 @@ tmp
Gemfile.lock
.idea/*
.rbx/
.ruby-version
.ruby-gemset
14 changes: 8 additions & 6 deletions lib/httpi/adapter/curb.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,12 +121,14 @@ def setup_ssl_auth
end

@client.ssl_version = case ssl.ssl_version
when :TLSv1_2 then 1
when :TLSv1_1 then 1
when :TLSv1 then 1
when :SSLv2 then 2
when :SSLv23 then 2
when :SSLv3 then 3
when :TLSv1_2 then ::Curl::CURL_SSLVERSION_TLSv1_2
when :TLSv1_1 then ::Curl::CURL_SSLVERSION_TLSv1_1
when :TLSv1_0 then ::Curl::CURL_SSLVERSION_TLSv1_0
when :TLSv1 then ::Curl::CURL_SSLVERSION_TLSv1
when :SSLv2 then ::Curl::CURL_SSLVERSION_SSLv2
when :SSLv23 then ::Curl::CURL_SSLVERSION_SSLv2
when :SSLv3 then ::Curl::CURL_SSLVERSION_SSLv3
else ::Curl::CURL_SSLVERSION_DEFAULT
end
end

Expand Down
25 changes: 16 additions & 9 deletions lib/httpi/auth/ssl.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,14 +11,21 @@ class SSL
VERIFY_MODES = [:none, :peer, :fail_if_no_peer_cert, :client_once]
CERT_TYPES = [:pem, :der]

# Fix for
# httpi/auth/ssl.rb:13: warning: constant OpenSSL::SSL::SSLContext::METHODS is deprecated
ssl_context = OpenSSL::SSL::SSLContext
SSL_VERSIONS = if ssl_context.const_defined? :METHODS_MAP
ssl_context.const_get(:METHODS_MAP).keys
else
ssl_context::METHODS.reject { |method| method.match(/server|client/) }
end.sort.reverse
# A default set of possible SSL protocols httpi should try to have support for.
# Note: Not all adapters may support all listed versions.
SSL_VERSIONS = [:SSLv23, :SSLv2, :SSLv3, :TLSv1, :TLSv1_0, :TLSv1_1, :TLSv1_2]

# All supported OpenSSL protocols.
# Used in case of OpenSSL support unexpected protocol which is not listed in SSL_VERSIONS.
OPENSSL_ALL_VERSIONS = begin
ssl_context = OpenSSL::SSL::SSLContext
# Avoid "warning: constant OpenSSL::SSL::SSLContext::METHODS is deprecated" message
if ssl_context.const_defined? :METHODS_MAP
ssl_context.const_get(:METHODS_MAP).keys
else
ssl_context::METHODS.reject { |method| method.match(/server|client/) }
end
end

# Returns whether SSL configuration is present.
def present?
Expand Down Expand Up @@ -82,7 +89,7 @@ def ssl_version

# Sets the SSL version number. Expects one of <tt>HTTPI::Auth::SSL::SSL_VERSIONS</tt>.
def ssl_version=(version)
unless SSL_VERSIONS.include? version
unless SSL_VERSIONS.include?(version) || OPENSSL_ALL_VERSIONS.include?(version)
raise ArgumentError, "Invalid SSL version #{version.inspect}\n" +
"Please specify one of #{SSL_VERSIONS.inspect}"
end
Expand Down
23 changes: 19 additions & 4 deletions spec/httpi/adapter/curb_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,30 +251,45 @@
end

context 'sets ssl_version' do
it 'defaults to nil when no ssl_version is specified' do
curb.expects(:ssl_version=).with(nil)
it 'defaults to 0 when no ssl_version is specified' do
curb.expects(:ssl_version=).with(0)
adapter.request(:get)
end

it 'to 1 when ssl_version is specified as TLSv1' do
request.auth.ssl.ssl_version = :TLSv1
curb.expects(:ssl_version=).with(1)

adapter.request(:get)
end

it 'to 2 when ssl_version is specified as SSLv2/SSLv23' do
version = HTTPI::Auth::SSL::SSL_VERSIONS.select { |method| method.to_s.match(/SSLv2|SSLv23/) }.first
request.auth.ssl.ssl_version = version
curb.expects(:ssl_version=).with(2)

adapter.request(:get)
end

it 'to 3 when ssl_version is specified as SSLv3' do
request.auth.ssl.ssl_version = :SSLv3
curb.expects(:ssl_version=).with(3)
adapter.request(:get)
end

it 'to 4 when ssl_version is specified as TLSv1_0' do
request.auth.ssl.ssl_version = :TLSv1_0
curb.expects(:ssl_version=).with(4)
adapter.request(:get)
end

it 'to 5 when ssl_version is specified as TLSv1_1' do
request.auth.ssl.ssl_version = :TLSv1_1
curb.expects(:ssl_version=).with(5)
adapter.request(:get)
end

it 'to 6 when ssl_version is specified as TLSv1_2' do
request.auth.ssl.ssl_version = :TLSv1_2
curb.expects(:ssl_version=).with(6)
adapter.request(:get)
end
end
Expand Down