Closed gmallard closed 9 years ago
Current thinking is:
Allow the gem user to (indirectly, through SSLParams) do, for example:
ctx.options = OpenSSL::SSL::OP_EPHEMERAL_RSA | OpenSSL::SSL::OP_NO_SSLv2
A gem user would initialize SSLParams something like:
ssl_parms = Stomp::SSLParams.new(:ctx_opts =>
OpenSSL::SSL::OP_EPHEMERAL_RSA | OpenSSL::SSL::OP_NO_SSLv2. ....
After what is described above, gem code would have:
ctx.options = @ssl.ctx_opts if @ssl.ctx_opts && ctx.respond_to? :options=
Another possible gem user scenario:
opts = OpenSSL::SSL::OP_ALL
opts &= ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS if defined?(Open
SSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS)
opts |= OpenSSL::SSL::OP_NO_COMPRESSION if defined?(OpenSSL::SSL::OP_NO_COMPRESSION)
opts |= OpenSSL::SSL::OP_NO_SSLv2 if defined?(OpenSSL::SSL::OP_NO_SSLv2)
opts |= OpenSSL::SSL::OP_NO_SSLv3 if defined?(OpenSSL::SSL::OP_NO_SSLv3)
ssl_parms = Stomp::SSLParams.new(:ctx_opts => opts, ..........
Closing, see:
73a654d
Provide a general way for a gem SSL user to manipulate the ssl context, immediately prior to the connection logic.