Skip to content

Commit 864956d

Browse files
postmodernpostmodern
committed
No longer use OpenSSL::SSL::SSLContext#ssl_version= (closes #498).
* Set both `OpenSSL::SSL::SSLContext#min_version=` and `OpenSSL::SSL::SSLContext#max_version=` when a specific version is requested. * Use `OpenSSL::SSL::TLS1*_VERSION` constants instead of symbols. * Map TLS version `1` to `OpenSSL::SSL::TLS1_VERSION`. * Map TLS version `1.1` to `OpenSSL::SSL::TLS1_1_VERSION`. * Map TLS version `1.2` to `OpenSSL::SSL::TLS1_2_VERSION`. * Still support legacy `:TLSv1*` symbols: * Map the legacy `:TLSv1` symbol to ``OpenSSL::SSL::TLS1_VERSION`. * Map the legacy `:TLSv1_1` symbol to ``OpenSSL::SSL::TLS1_1_VERSION`. * Map the legacy `:TLSv1_2` symbol to ``OpenSSL::SSL::TLS1_2_VERSION`. * Drop support for accept String versions (ex: `"SSLv23"`).
1 parent fbe9f9e commit 864956d

File tree

9 files changed

+244
-111
lines changed

9 files changed

+244
-111
lines changed

‎lib/ronin/support/network/http.rb

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -365,7 +365,13 @@ def initialize_ssl(ca_bundle: nil,
365365
@http.key = key if key
366366

367367
@http.ssl_timeout = timeout if timeout
368-
@http.ssl_version = SSL::VERSIONS.fetch(version,version) if version
368+
369+
if version
370+
version = SSL::VERSIONS.fetch(version,version)
371+
372+
@http.min_version = @http.max_version = version
373+
end
374+
369375
@http.min_version = min_version if min_version
370376
@http.max_version = max_version if max_version
371377

‎lib/ronin/support/network/ssl.rb

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,14 @@ module Network
3232
module SSL
3333
# SSL/TLS versions
3434
VERSIONS = {
35-
1 => :TLSv1,
36-
1.1 => :TLSv1_1,
37-
1.2 => :TLSv1_2
35+
1 => OpenSSL::SSL::TLS1_VERSION,
36+
1.1 => OpenSSL::SSL::TLS1_1_VERSION,
37+
1.2 => OpenSSL::SSL::TLS1_2_VERSION,
38+
39+
# deprecated TLS version symbols
40+
:TLSv1 => OpenSSL::SSL::TLS1_VERSION,
41+
:TLSv1_1 => OpenSSL::SSL::TLS1_1_VERSION,
42+
:TLSv1_2 => OpenSSL::SSL::TLS1_2_VERSION
3843
}
3944

4045
# SSL verify modes
@@ -96,7 +101,7 @@ def self.cert=(new_cert)
96101
#
97102
# Creates a new SSL Context.
98103
#
99-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
104+
# @param [1, 1.1, 1.2, Symbol, nil] version
100105
# The SSL version to use.
101106
#
102107
# @param [Symbol, Boolean] verify
@@ -144,7 +149,9 @@ def self.context(version: nil,
144149
context = OpenSSL::SSL::SSLContext.new
145150

146151
if version
147-
context.ssl_version = VERSIONS.fetch(version,version)
152+
version = VERSIONS.fetch(version,version)
153+
154+
context.min_version = context.max_version = version
148155
end
149156

150157
context.verify_mode = VERIFY[verify]

‎lib/ronin/support/network/ssl/mixin.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ module Mixin
3232
# @param [Hash{Symbol => Object}] kwargs
3333
# Additional keyword arguments.
3434
#
35-
# @option kwargs [1, 1.1, 1.2, String, Symbol, nil] :version
35+
# @option kwargs [1, 1.1, 1.2, Symbol, nil] :version
3636
# The SSL version to use.
3737
#
3838
# @option kwargs [Symbol, Boolean] :verify

‎lib/ronin/support/network/tls.rb

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ module TLS
3131
#
3232
# Creates a new SSL Context.
3333
#
34-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
34+
# @param [1, 1.1, 1.2, Symbol, nil] version
3535
# The SSL version to use.
3636
#
3737
# @param [Hash{Symbol => Object}] kwargs
@@ -52,7 +52,7 @@ def self.context(version: 1.2, **kwargs)
5252
# @param [TCPSocket] socket
5353
# The existing TCP socket.
5454
#
55-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
55+
# @param [1, 1.1, 1.2, Symbol, nil] version
5656
# The TLS version to use.
5757
#
5858
# @param [Hash{Symbol => Object}] kwargs
@@ -105,7 +105,7 @@ def self.socket(socket, version: 1.2, **kwargs)
105105
# @param [Integer] port
106106
# The port to connect to.
107107
#
108-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
108+
# @param [1, 1.1, 1.2, Symbol, nil] version
109109
# The TLS version to use.
110110
#
111111
# @param [Hash{Symbol => Object}] kwargs
@@ -175,7 +175,7 @@ def self.open?(host,port, version: 1.2, **kwargs)
175175
# @param [Integer] port
176176
# The port to connect to.
177177
#
178-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
178+
# @param [1, 1.1, 1.2, Symbol, nil] version
179179
# The TLS version to use.
180180
#
181181
# @param [Hash{Symbol => Object}] kwargs
@@ -257,7 +257,7 @@ def self.connect(host,port, version: 1.2, **kwargs, &block)
257257
# @param [Integer] port
258258
# The port to connect to.
259259
#
260-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
260+
# @param [1, 1.1, 1.2, Symbol, nil] version
261261
# The TLS version to use.
262262
#
263263
# @param [Hash{Symbol => Object}] kwargs
@@ -319,7 +319,7 @@ def self.connect_and_send(data,host,port, version: 1.2, **kwargs, &block)
319319
# @param [Integer] port
320320
# The port to connect to.
321321
#
322-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
322+
# @param [1, 1.1, 1.2, Symbol, nil] version
323323
# The TLS version to use.
324324
#
325325
# @param [Hash{Symbol => Object}] kwargs
@@ -380,7 +380,7 @@ def self.get_cert(host,port, version: 1.2, **kwargs)
380380
# @param [Integer] port
381381
# The port to connect to.
382382
#
383-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
383+
# @param [1, 1.1, 1.2, Symbol, nil] version
384384
# The TLS version to use.
385385
#
386386
# @param [Hash{Symbol => Object}] kwargs
@@ -453,7 +453,7 @@ def self.banner(host,port, version: 1.2, **kwargs, &block)
453453
# @param [Integer] port
454454
# The port to connect to.
455455
#
456-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
456+
# @param [1, 1.1, 1.2, Symbol, nil] version
457457
# The TLS version to use.
458458
#
459459
# @param [Hash{Symbol => Object}] kwargs
@@ -514,7 +514,7 @@ def self.send(data,host,port, version: 1.2, **kwargs)
514514
# @param [TCPSocket] socket
515515
# The existing TCP socket.
516516
#
517-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
517+
# @param [1, 1.1, 1.2, Symbol, nil] version
518518
# The TLS version to use.
519519
#
520520
# @param [Hash{Symbol => Object}] kwargs
@@ -543,7 +543,7 @@ def self.server_socket(socket, version: 1.2, **kwargs)
543543
#
544544
# Creates a new TLS server listening on a given host and port.
545545
#
546-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
546+
# @param [1, 1.1, 1.2, Symbol, nil] version
547547
# The TLS version to use.
548548
#
549549
# @param [Hash{Symbol => Object}] kwargs
@@ -602,7 +602,7 @@ def self.server(version: 1.2, **kwargs, &block)
602602
#
603603
# Creates a new temporary TLS server listening on a given host and port.
604604
#
605-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
605+
# @param [1, 1.1, 1.2, Symbol, nil] version
606606
# The TLS version to use.
607607
#
608608
# @param [Hash{Symbol => Object}] kwargs
@@ -663,7 +663,7 @@ def self.server_session(version: 1.2, **kwargs, &block)
663663
# Creates a new SSL socket listening on a given host and port,
664664
# accepting clients in a loop.
665665
#
666-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
666+
# @param [1, 1.1, 1.2, Symbol, nil] version
667667
# The TLS version to use.
668668
#
669669
# @param [Hash{Symbol => Object}] kwargs
@@ -732,7 +732,7 @@ def self.server_loop(version: 1.2, **kwargs, &block)
732732
# Creates a new SSL socket listening on a given host and port,
733733
# accepts only one client and then stops listening.
734734
#
735-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
735+
# @param [1, 1.1, 1.2, Symbol, nil] version
736736
# The TLS version to use.
737737
#
738738
# @param [Hash{Symbol => Object}] kwargs

‎lib/ronin/support/network/tls/mixin.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ module Mixin
3232
#
3333
# Creates a new TLS Context.
3434
#
35-
# @param [1, 1.1, 1.2, String, Symbol, nil] version
35+
# @param [1, 1.1, 1.2, Symbol, nil] version
3636
# The TLS version to use.
3737
#
3838
# @param [Hash{Symbol => Object}] kwargs

‎spec/network/ssl/mixin_spec.rb

Lines changed: 42 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -49,56 +49,81 @@
4949
let(:context) { double(OpenSSL::SSL::SSLContext) }
5050

5151
context "and it's 1" do
52-
it "must call OpenSSL::SSL::SSLContext#ssl_version= with :TLSv1" do
52+
it "must call OpenSSL::SSL::SSLContext#min_version= and #max_version= with OpenSSL::SSL::TLS1_VERSION" do
5353
expect(OpenSSL::SSL::SSLContext).to receive(:new).and_return(context)
54-
expect(context).to receive(:ssl_version=).with(:TLSv1)
54+
expect(context).to receive(:min_version=).with(OpenSSL::SSL::TLS1_VERSION)
55+
expect(context).to receive(:max_version=).with(OpenSSL::SSL::TLS1_VERSION)
5556
allow(context).to receive(:verify_mode=).with(0)
5657

5758
subject.ssl_context(version: 1)
5859
end
5960
end
6061

6162
context "and it's 1.1" do
62-
it "must call OpenSSL::SSL::SSLContext#ssl_version= with :TLSv1_1" do
63+
it "must call OpenSSL::SSL::SSLContext#min_version= and #max_version= with OpenSSL::SSL::TLS1_1_VERSION" do
6364
expect(OpenSSL::SSL::SSLContext).to receive(:new).and_return(context)
64-
expect(context).to receive(:ssl_version=).with(:TLSv1_1)
65+
expect(context).to receive(:min_version=).with(OpenSSL::SSL::TLS1_1_VERSION)
66+
expect(context).to receive(:max_version=).with(OpenSSL::SSL::TLS1_1_VERSION)
6567
allow(context).to receive(:verify_mode=).with(0)
6668

6769
subject.ssl_context(version: 1.1)
6870
end
6971
end
7072

7173
context "and it's 1_2" do
72-
it "must call OpenSSL::SSL::SSLContext#ssl_version= with :TLSv1_2" do
74+
it "must call OpenSSL::SSL::SSLContext#min_version= and #max_version= with OpenSSL::SSL::TLS1_2_VERSION" do
7375
expect(OpenSSL::SSL::SSLContext).to receive(:new).and_return(context)
74-
expect(context).to receive(:ssl_version=).with(:TLSv1_2)
76+
expect(context).to receive(:min_version=).with(OpenSSL::SSL::TLS1_2_VERSION)
77+
expect(context).to receive(:max_version=).with(OpenSSL::SSL::TLS1_2_VERSION)
7578
allow(context).to receive(:verify_mode=).with(0)
7679

7780
subject.ssl_context(version: 1.2)
7881
end
7982
end
8083

8184
context "and it's a Symbol" do
82-
let(:symbol) { :TLSv1 }
85+
let(:symbol) { :TLS1 }
8386

84-
it "must call OpenSSL::SSL::SSLContext#ssl_version= with the Symbol" do
87+
it "must call OpenSSL::SSL::SSLContext#min_version= and #max_version= with the Symbol" do
8588
expect(OpenSSL::SSL::SSLContext).to receive(:new).and_return(context)
86-
expect(context).to receive(:ssl_version=).with(symbol)
89+
expect(context).to receive(:min_version=).with(symbol)
90+
expect(context).to receive(:max_version=).with(symbol)
8791
allow(context).to receive(:verify_mode=).with(0)
8892

8993
subject.ssl_context(version: symbol)
9094
end
91-
end
9295

93-
context "and it's a String" do
94-
let(:string) { "SSLv23" }
96+
context "but it's :TLSv1" do
97+
it "must call OpenSSL::SSL::SSLContext#min_version= and #max_version= with OpenSSL::SSL::TLS1_VERSION" do
98+
expect(OpenSSL::SSL::SSLContext).to receive(:new).and_return(context)
99+
expect(context).to receive(:min_version=).with(OpenSSL::SSL::TLS1_VERSION)
100+
expect(context).to receive(:max_version=).with(OpenSSL::SSL::TLS1_VERSION)
101+
allow(context).to receive(:verify_mode=).with(0)
95102

96-
it "must call OpenSSL::SSL::SSLContext#ssl_version= with the String" do
97-
expect(OpenSSL::SSL::SSLContext).to receive(:new).and_return(context)
98-
expect(context).to receive(:ssl_version=).with(string)
99-
allow(context).to receive(:verify_mode=).with(0)
103+
subject.ssl_context(version: :TLSv1)
104+
end
105+
end
106+
107+
context "but it's :TLSv1_1" do
108+
it "must call OpenSSL::SSL::SSLContext#min_version= and #max_version= with OpenSSL::SSL::TLS1_1_VERSION" do
109+
expect(OpenSSL::SSL::SSLContext).to receive(:new).and_return(context)
110+
expect(context).to receive(:min_version=).with(OpenSSL::SSL::TLS1_1_VERSION)
111+
expect(context).to receive(:max_version=).with(OpenSSL::SSL::TLS1_1_VERSION)
112+
allow(context).to receive(:verify_mode=).with(0)
100113

101-
subject.ssl_context(version: string)
114+
subject.ssl_context(version: :TLSv1_1)
115+
end
116+
end
117+
118+
context "but it's :TLSv1_2" do
119+
it "must call OpenSSL::SSL::SSLContext#min_version= and #max_version= with OpenSSL::SSL::TLS1_2_VERSION" do
120+
expect(OpenSSL::SSL::SSLContext).to receive(:new).and_return(context)
121+
expect(context).to receive(:min_version=).with(OpenSSL::SSL::TLS1_2_VERSION)
122+
expect(context).to receive(:max_version=).with(OpenSSL::SSL::TLS1_2_VERSION)
123+
allow(context).to receive(:verify_mode=).with(0)
124+
125+
subject.ssl_context(version: :TLSv1_2)
126+
end
102127
end
103128
end
104129
end

0 commit comments

Comments
 (0)