Disable SSLv3?

[renier]

Can we get a configuration option to disable SSLv3?

http://googleonlinesecurity.blogspot.co.uk/2014/10/this-poodle-bites-exploiting-ssl-30.html

[evanphx]

@renier are you using puma ssl in production?

[renier]

@evanphx I'm not, but using in internet-facing servers. I know you can put things behind a web server like nginx, but would rather just be able to configure this in puma for dev/test purposes.

[renier]

@evanphx I think I can work on this patch. Would you prefer for SSLv3 to be enabled or disabled by default in the puma server?

[renier]

@evanphx
There is still a potential problem with this.

If you try to open an SSLv3 socket to test for the POODLE vulnerability:

openssl s_client -connect localhost:443 -ssl3

You will see that the connection hangs. It is not being terminated properly by the server.

In mini_ssl.c#engine_read, I think you need to accept more SSL_get_error() values to send the EOF to.

    e = SSL_get_error(conn->ssl, bytes);
    if(e == SSL_ERROR_ZERO_RETURN || e == SSL_ERROR_SYSCALL || e == SSL_ERROR_SSL) {
        rb_eof_error();
    }

If I test this locally, the connection is closed as I would have expected when I try the test above.

[renier]

Hi, @evanphx. Pinging on the above.