How to set TLS context options in Ruby (like OpenSSL::SSL::SSL_OP_NO_SSLv2)
When using OpenSSL in C, we set options on the context to remove weak and wounded protocols like SSLv2 and SSLv3. From ssl.h, here is a bitmask of some of the options that are useful:
#define SSL_OP_NO_SSLv2 0x01000000L #define SSL_OP_NO_SSLv3 0x02000000L #define SSL_OP_NO_TLSv1 0x04000000L #define SSL_OP_NO_TLSv1_2 0x08000000L #define SSL_OP_NO_TLSv1_1 0x10000000L
However, I'm having trouble setting them in Ruby:
if uri.scheme == "https" http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_PEER http.options = OpenSSL::SSL::SSL_OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3 | OpenSSL::SSL::SSL_OP_NO_COMPRESSION end
$ ./TestCert.rb ./TestCert.rb:12:in `<main>': uninitialized constant OpenSSL::SSL::SSL_OP_SSL2 (NameError)
The Ruby docs for 1.9.3 (and 2.0.0) don't even bother to mention it.
How does one set the TLS context options in Ruby?
Related: setting SSLContext options in ruby. But there's no way to attach the context to an http when http.use_ssl = true.
In the Ruby OpenSSL library the option constants aren't prefixed with 'SSL_'. You can see a list of the option constants by running something like this in irb/console: OpenSSL::SSL.constants.grep(/OP_/). Here is the relevant ruby C source where they are defined: https://github.com/ruby/ruby/blob/trunk/ext/openssl/ossl_ssl.c#L2225.
Edit: There doesn't appear to be a way, out of the box, to set the SSL options for net http. See https://bugs.ruby-lang.org/issues/9450.
However for the time being you can use this little hack:
(Net::HTTP::SSL_IVNAMES << :@ssl_options).uniq! (Net::HTTP::SSL_ATTRIBUTES << :options).uniq! Net::HTTP.class_eval do attr_accessor :ssl_options end
Now just set the ssl_options accessor on the instance of Net::HTTP. Example usage:
uri = URI('https://google.com:443') options_mask = OpenSSL::SSL::OP_NO_SSLv2 + OpenSSL::SSL::OP_NO_SSLv3 + OpenSSL::SSL::OP_NO_COMPRESSION http = Net::HTTP.new(uri.host, uri.port) request = Net::HTTP::Get.new(uri.request_uri) if uri.scheme == "https" http.use_ssl = true http.verify_mode = OpenSSL::SSL::VERIFY_PEER http.ssl_options = options_mask end response = http.request request # To Test ssl_context = http.instance_variable_get(:@ssl_context) ssl_context.options == options_mask # => true
I was testing with ruby 2.1.2 so your mileage on other versions of ruby may vary. Let me know if it doesn't work on your preferred version.
For those interested, the relevant part of the ruby code I looked at to create this hack: https://github.com/ruby/ruby/blob/e9dce8d1b482200685996f64cc2c3bd6ba790110/lib/net/http.rb#L886