JOSSL does not need DEFAULT_PARAMS[:ciphers]

also restore SSL_DEFAULT_CIPHER_LIST to 1.0.2 compat

Author: kares

lib/openssl/ssl.rb

@@ -24,43 +24,44 @@ class SSLContext
         :options => OpenSSL::SSL::OP_ALL | OpenSSL::SSL::OP_NO_COMPRESSION
       }
 
-      if !(OpenSSL::OPENSSL_VERSION.start_with?("OpenSSL") &&
-           OpenSSL::OPENSSL_VERSION_NUMBER >= 0x10100000)
-        DEFAULT_PARAMS.merge!(
-          ciphers: %w{
-            ECDHE-ECDSA-AES128-GCM-SHA256
-            ECDHE-RSA-AES128-GCM-SHA256
-            ECDHE-ECDSA-AES256-GCM-SHA384
-            ECDHE-RSA-AES256-GCM-SHA384
-            DHE-RSA-AES128-GCM-SHA256
-            DHE-DSS-AES128-GCM-SHA256
-            DHE-RSA-AES256-GCM-SHA384
-            DHE-DSS-AES256-GCM-SHA384
-            ECDHE-ECDSA-AES128-SHA256
-            ECDHE-RSA-AES128-SHA256
-            ECDHE-ECDSA-AES128-SHA
-            ECDHE-RSA-AES128-SHA
-            ECDHE-ECDSA-AES256-SHA384
-            ECDHE-RSA-AES256-SHA384
-            ECDHE-ECDSA-AES256-SHA
-            ECDHE-RSA-AES256-SHA
-            DHE-RSA-AES128-SHA256
-            DHE-RSA-AES256-SHA256
-            DHE-RSA-AES128-SHA
-            DHE-RSA-AES256-SHA
-            DHE-DSS-AES128-SHA256
-            DHE-DSS-AES256-SHA256
-            DHE-DSS-AES128-SHA
-            DHE-DSS-AES256-SHA
-            AES128-GCM-SHA256
-            AES256-GCM-SHA384
-            AES128-SHA256
-            AES256-SHA256
-            AES128-SHA
-            AES256-SHA
-          }.join(":"),
-        )
-      end
+      # JRuby does not want this non (recent) OpenSSL fallback to happen
+      # if !(OpenSSL::OPENSSL_VERSION.start_with?("OpenSSL") &&
+      #      OpenSSL::OPENSSL_VERSION_NUMBER >= 0x10100000)
+      #   DEFAULT_PARAMS.merge!(
+      #     ciphers: %w{
+      #       ECDHE-ECDSA-AES128-GCM-SHA256
+      #       ECDHE-RSA-AES128-GCM-SHA256
+      #       ECDHE-ECDSA-AES256-GCM-SHA384
+      #       ECDHE-RSA-AES256-GCM-SHA384
+      #       DHE-RSA-AES128-GCM-SHA256
+      #       DHE-DSS-AES128-GCM-SHA256
+      #       DHE-RSA-AES256-GCM-SHA384
+      #       DHE-DSS-AES256-GCM-SHA384
+      #       ECDHE-ECDSA-AES128-SHA256
+      #       ECDHE-RSA-AES128-SHA256
+      #       ECDHE-ECDSA-AES128-SHA
+      #       ECDHE-RSA-AES128-SHA
+      #       ECDHE-ECDSA-AES256-SHA384
+      #       ECDHE-RSA-AES256-SHA384
+      #       ECDHE-ECDSA-AES256-SHA
+      #       ECDHE-RSA-AES256-SHA
+      #       DHE-RSA-AES128-SHA256
+      #       DHE-RSA-AES256-SHA256
+      #       DHE-RSA-AES128-SHA
+      #       DHE-RSA-AES256-SHA
+      #       DHE-DSS-AES128-SHA256
+      #       DHE-DSS-AES256-SHA256
+      #       DHE-DSS-AES128-SHA
+      #       DHE-DSS-AES256-SHA
+      #       AES128-GCM-SHA256
+      #       AES256-GCM-SHA384
+      #       AES128-SHA256
+      #       AES256-SHA256
+      #       AES128-SHA
+      #       AES256-SHA
+      #     }.join(":"),
+      #   )
+      # end
 
       if defined?(OpenSSL::PKey::DH)
         DEFAULT_2048 = OpenSSL::PKey::DH.new <<-_end_of_pem_

src/main/java/org/jruby/ext/openssl/CipherStrings.java

@@ -224,18 +224,22 @@ public class CipherStrings {
     public final static String SSL_TXT_CMPALL = "COMPLEMENTOFALL";
     public final static String SSL_TXT_CMPDEF = "COMPLEMENTOFDEFAULT";
 
-    // "ALL:!aNULL:!eNULL:!SSLv2" is for OpenSSL 1.0.0 GA
-    public final static String SSL_DEFAULT_CIPHER_LIST = "AES:ALL:!aNULL:!eNULL:!SSLv2:+RC4:@STRENGTH";
+    // NOTE: Default list of TLSv1.2 (and earlier) ciphers deprecated in 3.0.0
+    // "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2" in OpenSSL 1.0.2
+    public final static String SSL_DEFAULT_CIPHER_LIST; // = "AES:ALL:!aNULL:!eNULL:!SSLv2:+RC4:@STRENGTH";
     /*
      * The following cipher list is used by default. It also is substituted when
      * an application-defined cipher list string starts with 'DEFAULT'.
      * This applies to ciphersuites for TLSv1.2 and below.
      */
-    //public final static String SSL_DEFAULT_CIPHER_LIST = "ALL:!COMPLEMENTOFDEFAULT:!eNULL";
-    /* This is the default set of TLSv1.3 ciphersuites */ // TODO REVIEW 1.3 cipher matching
+    //public final static String SSL_DEFAULT_CIPHER_LIST = "ALL:!COMPLEMENTOFDEFAULT:!eNULL"; // OpenSSL 1.1.1
+    /* This is the default set of TLSv1.3 ciphersuites */
     public final static String TLS_DEFAULT_CIPHERSUITES = "TLS_AES_256_GCM_SHA384:" +
                                                           "TLS_CHACHA20_POLY1305_SHA256:" +
                                                           "TLS_AES_128_GCM_SHA256";
+    static { // TODO REVIEW 1.3 cipher matching
+        SSL_DEFAULT_CIPHER_LIST = "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2"; // + ':' + TLS_DEFAULT_CIPHERSUITES;
+    }
 
     public final static long SSL_MKEY_MASK = 0x000000FFL;
     /* Bits for algorithm_mkey (key exchange algorithm) */