Merge pull request #214 from c960657/ssl-ciphers

Implement HTTPI::Auth::SSL#ciphers configuration

Author: olleolleolle

CHANGELOG.md

@@ -1,3 +1,6 @@
+### Unreleased
+* Feature: [#214](https://github.com/savonrb/httpi/pull/214) Add SSL ciphers configuration
+
 ### 2.4.5
 
 * Improvement: [#209](https://github.com/savonrb/httpi/pull/209) Drop Travis CI support for Ruby < 2.3.0 and jruby.

httpi.gemspec

@@ -20,7 +20,7 @@ Gem::Specification.new do |s|
 
   s.add_development_dependency 'rubyntlm', '~> 0.3.2'
   s.add_development_dependency 'rake',     '~> 10.0'
-  s.add_development_dependency 'rspec',    '~> 2.14'
+  s.add_development_dependency 'rspec',    '~> 3.5'
   s.add_development_dependency 'mocha',    '~> 0.13'
   s.add_development_dependency 'puma',     '~> 2.3.2'
   s.add_development_dependency 'webmock'

lib/httpi/adapter/curb.rb

@@ -116,6 +116,7 @@ def setup_ssl_auth
           @client.cert_key = ssl.cert_key_file
           @client.cert = ssl.cert_file
           @client.certpassword = ssl.cert_key_password
+          @client.set(:ssl_cipher_list, ssl.ciphers.join(':')) if ssl.ciphers
 
           @client.ssl_verify_peer = ssl.verify_mode == :peer
         end

lib/httpi/adapter/excon.rb

@@ -73,6 +73,7 @@ def client_opts
           opts[:ssl_verify_peer] = false
         end
 
+        opts[:ciphers] = ssl.ciphers if ssl.ciphers
         opts[:ssl_version] = ssl.ssl_version if ssl.ssl_version
         opts[:ssl_min_version] = ssl.min_version if ssl.min_version
         opts[:ssl_max_version] = ssl.max_version if ssl.max_version

lib/httpi/adapter/http.rb

@@ -61,6 +61,7 @@ def create_client
           context.min_version = @request.auth.ssl.min_version if @request.auth.ssl.min_version != nil
           context.max_version = @request.auth.ssl.max_version if @request.auth.ssl.max_version != nil
           context.verify_mode = @request.auth.ssl.openssl_verify_mode
+          context.ciphers     = @request.auth.ssl.ciphers if @request.auth.ssl.ciphers
 
           client = ::HTTP::Client.new(:ssl_context => context)
         else

lib/httpi/adapter/httpclient.rb

@@ -73,6 +73,7 @@ def setup_ssl_auth
           # Send client-side certificate regardless of state of SSL verify mode
           @client.ssl_config.client_cert = ssl.cert
           @client.ssl_config.client_key = ssl.cert_key
+          @client.ssl_config.ciphers = ssl.ciphers if ssl.ciphers
 
           @client.ssl_config.verify_mode = ssl.openssl_verify_mode
         end

lib/httpi/adapter/net_http.rb

@@ -177,6 +177,7 @@ def setup_ssl_auth
           # Send client-side certificate regardless of state of SSL verify mode
           @client.key = ssl.cert_key
           @client.cert = ssl.cert
+          @client.ciphers = ssl.ciphers if ssl.ciphers
 
           @client.verify_mode = ssl.openssl_verify_mode
         end

lib/httpi/auth/ssl.rb

@@ -25,7 +25,7 @@ class SSL
 
       # Returns whether SSL configuration is present.
       def present?
-        (verify_mode == :none) || (cert && cert_key) || ca_cert_file
+        (verify_mode == :none) || (cert && cert_key) || ca_cert_file || ciphers
       rescue TypeError, Errno::ENOENT
         false
       end
@@ -48,6 +48,24 @@ def present?
       # Certificate store holds trusted CA certificates used to verify peer certificates.
       attr_accessor :cert_store
 
+      # Accessor for the SSL ciphers list.
+      attr_reader :ciphers
+
+      # Sets the available symmetric algorithms for encryption and decryption.
+      # @see OpenSSL::SSL::SSLContext#ciphers
+      # @example
+      #   ssl.ciphers = "cipher1:cipher2:..."
+      #   ssl.ciphers = [name, ...]
+      #   ssl.ciphers = [[name, version, bits, alg_bits], ...]
+      def ciphers=(ciphers)
+        @ciphers =
+          if ciphers
+            context = OpenSSL::SSL::SSLContext.new
+            context.ciphers = ciphers
+            context.ciphers.map(&:first)
+          end
+      end
+
       # Returns the cert type to validate SSL certificates PEM|DER.
       def cert_type
         @cert_type ||= :pem

spec/httpi/adapter/curb_spec.rb

@@ -250,6 +250,13 @@
           request
         end
 
+        it 'sets ssl_cipher_list' do
+          request.auth.ssl.ciphers = ["AES128"]
+          curb.expects(:set).with(any_parameters).at_least(1)
+          curb.expects(:set).with(:ssl_cipher_list, anything)
+          adapter.request(:get)
+        end
+
         context 'sets ssl_version' do
           it 'defaults to nil when no ssl_version is specified' do
             curb.expects(:ssl_version=).with(nil)

spec/httpi/adapter/em_http_spec.rb

@@ -150,7 +150,7 @@
 
         it "raises an error for HTTP digest auth" do
           request.auth.digest "username", "password"
-          expect { adapter.request(:get) }.to raise_error
+          expect { adapter.request(:get) }.to raise_error HTTPI::NotSupportedError
         end
       end