Open aetherknight opened 9 years ago
kares
commented
9 years ago thanks, we need someone to "match" with OpenSSL's matching as that code has not seem to have been updated/touched since the initial working version ... mentioned that here as well
jordansissel
commented
9 years ago I found this while investigating a similar problem with EXPORT ciphers. Reading the code for jruby-openssl 0.9.6 finds that !EXPORT is part of the defaults, but the defaults aren't used by default - hah!
[1] pry(main)> OpenSSL::SSL::SSLContext.new.tap { |c| x = c.ciphers.clone; c.ciphers = "ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW"; p x - c.ciphers }
[["EXP-DES-CBC-SHA", "TLSv1/SSLv3", 40, 56], ["EXP-EDH-RSA-DES-CBC-SHA", "TLSv1/SSLv3", 40, 56], ["EXP-EDH-DSS-DES-CBC-SHA", "TLSv1/SSLv3", 40, 56], ["EXP-RC4-MD5", "TLSv1/SSLv3", 40, 128]]^^ The above showing export ciphers are indeed included by default, but are removed if I explicitly set what I thought was the default cipher selection. I can confirm @kares' report that SSLContext#set_params call will kind of resolve this.
Here's what JRuby says about the defaults:
[3] pry(main)> OpenSSL::SSL::SSLContext::DEFAULT_PARAMS
=> {:ssl_version=>"SSLv23", :verify_mode=>1, :ciphers=>"ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW", :options=>4095}Strange indeed that the defaults aren't used until set_params is invoked. The 'set_params' affects me because I never actually call it; I have historically always used accessor methods directly SSLContext#ciphers=, SSLContext#version=, etc.
delwaterman
commented
8 years ago Hey there any update on this?
Out of the box, without calling
set_params, jruby-openssl's SSLContext supports EXPORT cipher suites, and it prefers them over better cipher suites. Admittedly, MRI requires you to callset_paramsto remove all the cruft from the complete list of cipher suites (to get the Ruby defaults, not that this is well documented anywhere outside of https://www.ruby-lang.org/en/news/2014/10/27/changing-default-settings-of-ext-openssl/), but MRI no longer includes EXPORT cipher suites in the default cipher suite list (or perhaps this is due to newer OpenSSL versions).I performed all of my MRI testing against openssl-1.0.1o.
JRuby 1.7.20.1 and jruby-openssl 0.9.7
To verify the cipher suite ordering, I ran the following command:
And I monitored my network traffic with wireshark:
This matches the order shown by
OpenSSL::SSL::SSLContext.new.ciphers. It shows that it prefers export ciphers first, then single DES, then finally ECDHE cipher suites. In fact, the default ordering does not seem to follow any general guidelines for cipher suite ordering.Expected Behavior
MRI 2.2.2
MRI unfortunately still supports bad cipher suites out of the box. However, it does not support EXPORT ciphers, and it prefers some good cipher suites before it gets into any older/bad cipher suites.
Final thoughts
Admittedly, the actual defaults that Ruby uses are only applied if you explicitly call
set_paramsat some point. Neither MRI nor JRuby initialize the SSLContext with the defaults untilset_paramsis called.JRuby with set_params
Note that it removes the ECDHE cipher suites that it supports. I will file another ticket to track this.
MRI 2.2 (and 2.0-p645) with set_params
Want to see this issue fixed? Post a bounty on it! We accept bounties via Bountysource.