How to set TLS context options in Ruby (like OpenSSL::SSL::SSL_OP_NO_SSLv2)

by

In the Ruby OpenSSL library the option constants aren’t prefixed with ‘SSL_’. You can see a list of the option constants by running something like this in irb/console: OpenSSL::SSL.constants.grep(/OP_/). Here is the relevant ruby C source where they are defined: https://github.com/ruby/ruby/blob/trunk/ext/openssl/ossl_ssl.c#L2225.

Edit:
There doesn’t appear to be a way, out of the box, to set the SSL options for net http.
See https://bugs.ruby-lang.org/issues/9450.

However for the time being you can use this little hack:

(Net::HTTP::SSL_IVNAMES << :@ssl_options).uniq!
(Net::HTTP::SSL_ATTRIBUTES << :options).uniq!

Net::HTTP.class_eval do
  attr_accessor :ssl_options
end

Now just set the ssl_options accessor on the instance of Net::HTTP. Example usage:

uri = URI('https://google.com:443')

options_mask = OpenSSL::SSL::OP_NO_SSLv2 + OpenSSL::SSL::OP_NO_SSLv3 +
  OpenSSL::SSL::OP_NO_COMPRESSION

http = Net::HTTP.new(uri.host, uri.port)
request = Net::HTTP::Get.new(uri.request_uri)

if uri.scheme == "https"
  http.use_ssl = true
  http.verify_mode = OpenSSL::SSL::VERIFY_PEER
  http.ssl_options = options_mask
end

response = http.request request

# To Test
ssl_context = http.instance_variable_get(:@ssl_context)
ssl_context.options == options_mask # => true

I was testing with ruby 2.1.2 so your mileage on other versions of ruby may vary. Let me know if it doesn’t work on your preferred version.

For those interested, the relevant part of the ruby code I looked at to create this hack: https://github.com/ruby/ruby/blob/e9dce8d1b482200685996f64cc2c3bd6ba790110/lib/net/http.rb#L886

More Related Contents:

  1. Office 365 Rest API – Daemon week authentication
  2. Library not loaded: /opt/local/lib/libssl.1.0.0.dylib (LoadError)
  3. gem eventmachine fatal error: ‘openssl/ssl.h’ file not found
  4. troubles with RVM and OpenSSL
  5. How to make Sinatra work over HTTPS/SSL?
  6. Can’t output currency in ruby with money-gem [closed]
  7. Very Basic Ruby puts and gets
  8. The authorization mechanism you have provided is not supported. Please use AWS4-HMAC-SHA256
  9. What does the (unary) * operator do in this Ruby code?
  10. How to debug Ruby scripts [closed]
  11. Ruby obfuscator [duplicate]
  12. What does send() do in Ruby?
  13. Adding a directory to $LOAD_PATH (Ruby)
  14. Why does Ruby seem to hoist variable declarations from inside a case statement even if that code path is not executed? [duplicate]
  15. Where is Ruby’s string literal juxtaposition feature officially documented?
  16. Which style of Ruby string quoting do you favour?
  17. Ruby – net/http – following redirects
  18. Why does Ruby have both private and protected methods?
  19. Access variables programmatically by name in Ruby
  20. OpenSSL: unable to verify the first certificate for Experian URL
  21. How do I redirect stderr and stdout to file for a Ruby script?
  22. Convert array of 2-element arrays into a hash, where duplicate keys append additional values
  23. How to use “RVM –default” on MacOSX
  24. Why does “compass watch” say it cannot load sass/script/node (LoadError)?
  25. When to use `require`, `load` or `autoload` in Ruby?
  26. Natural Language Processing in Ruby [closed]
  27. How can I get the absolute URL when extracting links using Nokogiri?
  28. How to turn a string into a method call? [duplicate]
  29. OpenSSL hangs during PKCS12 export with “Loading ‘screen’ into random state”
  30. What is the behavior when using both positional and keyword arguments in Ruby?

Leave a Comment