Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OpenSSL::SSL::SSLContext::METHODS in MRI vs JRuby #1874

Closed
jordansissel opened this issue Jul 30, 2014 · 2 comments
Closed

OpenSSL::SSL::SSLContext::METHODS in MRI vs JRuby #1874

jordansissel opened this issue Jul 30, 2014 · 2 comments
Labels
openssl
Milestone
Invalid or Duplicate

Comments

@jordansissel
Copy link
Contributor

Hello! While debugging some TLS stuff, I noticed a few oddities. Specifically, MRI's openssl supports different protocol methods than JRuby does.

I tested with MRI 2.1.2, MRI 1.9.3, and JRuby 1.7.13. Differences:

# Comparing OpenSSL::SSL::SSLContext::METHODS
>> mri212 - jruby
=> [:TLSv1_2, :TLSv1_2_server, :TLSv1_2_client, :TLSv1_1, :TLSv1_1_server, :TLSv1_1_client]
>> jruby - mri212
=> [:SSLv2, :SSLv2_server, :SSLv2_client, :TLS, :"TLSv1.1"]
>> mri193 - jruby
=> []
>> jruby - mri193
=> [:SSLv2, :SSLv2_server, :SSLv2_client, :TLS, :"TLSv1.1"]

Curiosities and concerns:

  • JRuby still supports SSLv2, which might be on purpose, but v2 is pretty broken security-wise.
  • JRuby has a symbol with a dot TLSv1.1 where MRI does not. MRI uses TLSv1_1
  • JRuby doesn't have TLS v1.2 or (or TLSv1.3, but neither does MRI on my system)

Data:

% rvm 1.9.3,2.1.2,1.7.13 do ruby -ropenssl -e 'p [RUBY_PLATFORM,RUBY_ENGINE,RUBY_VERSION] => OpenSSL::SSL::SSLContext::METHODS'
{["x86_64-linux", "ruby", "1.9.3"]=>[:TLSv1, :TLSv1_server, :TLSv1_client, :SSLv3, :SSLv3_server, :SSLv3_client, :SSLv23, :SSLv23_server, :SSLv23_client]}
{["x86_64-linux", "ruby", "2.1.2"]=>[:TLSv1, :TLSv1_server, :TLSv1_client, :TLSv1_2, :TLSv1_2_server, :TLSv1_2_client, :TLSv1_1, :TLSv1_1_server, :TLSv1_1_client, :SSLv3, :SSLv3_server, :SSLv3_client, :SSLv23, :SSLv23_server, :SSLv23_client]}
{["java", "jruby", "1.9.3"]=>[:TLSv1, :TLSv1_server, :TLSv1_client, :SSLv2, :SSLv2_server, :SSLv2_client, :SSLv3, :SSLv3_server, :SSLv3_client, :SSLv23, :SSLv23_server, :SSLv23_client, :TLS, :"TLSv1.1"]}
@jordansissel
Copy link
Contributor Author

This is possibly a dup of, or related to, #1735, #1733, and #1737.

@jordansissel
Copy link
Contributor Author

Workaround:

def protocol(text)
  OpenSSL::SSL::SSLContext::METHODS.find { |x| x.to_s.gsub("_",".") == text }
end

ctx.version = protocol("TLSv1.1")

@rtyler rtyler added the openssl label Jan 15, 2015
@headius headius mentioned this issue Jan 26, 2015
Closed
@enebo enebo added this to the Invalid or Duplicate milestone Apr 28, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
openssl
Projects
None yet
Milestone
Invalid or Duplicate
Development

No branches or pull requests
3 participants
@enebo @rtyler @jordansissel