diff options
| author | Thom May <thom@may.lt> | 2016-07-19 18:16:05 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2016-07-19 18:16:05 +0100 |
| commit | 080959ccd4e9ffb075f74486a010e0310ac54a9f (patch) | |
| tree | 9fbe0c4e5f53ecc6dc97c66bf5598ed4f789e6d0 | |
| parent | dc14c7f2c362b538b85dff3c5f0f5451d100da62 (diff) | |
| parent | c3ba7bd3ee1c7226381cbaf3f7ff54bb5f60491a (diff) | |
| download | chef-zero-080959ccd4e9ffb075f74486a010e0310ac54a9f.tar.gz | |
Merge pull request #106 from higanworks/disable_sslv3
disable sslv3 and few unsecure options
| -rw-r--r-- | lib/chef_zero/server.rb | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/lib/chef_zero/server.rb b/lib/chef_zero/server.rb index 31c8baa..9c92652 100644 --- a/lib/chef_zero/server.rb +++ b/lib/chef_zero/server.rb @@ -285,6 +285,7 @@ module ChefZero :AccessLog => [], :Logger => WEBrick::Log.new(StringIO.new, 7), :SSLEnable => options[:ssl], + :SSLOptions => ssl_opts, :SSLCertName => [ [ 'CN', WEBrick::Utils::getservername ] ], :StartCallback => proc { @running = true @@ -708,5 +709,16 @@ module ChefZero end value end + + ## Disable unsecure ssl + ## Ref: https://www.ruby-lang.org/en/news/2014/10/27/changing-default-settings-of-ext-openssl/ + def ssl_opts + ssl_opts = OpenSSL::SSL::OP_ALL + ssl_opts &= ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS if defined?(OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS) + ssl_opts |= OpenSSL::SSL::OP_NO_COMPRESSION if defined?(OpenSSL::SSL::OP_NO_COMPRESSION) + ssl_opts |= OpenSSL::SSL::OP_NO_SSLv2 if defined?(OpenSSL::SSL::OP_NO_SSLv2) + ssl_opts |= OpenSSL::SSL::OP_NO_SSLv3 if defined?(OpenSSL::SSL::OP_NO_SSLv3) + ssl_opts + end end end |