diff --git a/scripts/generate_ssl_server_defaults.cr b/scripts/generate_ssl_server_defaults.cr index 7383faefd2b3..7e49e7795abd 100755 --- a/scripts/generate_ssl_server_defaults.cr +++ b/scripts/generate_ssl_server_defaults.cr @@ -56,6 +56,7 @@ File.open(DEFAULTS_FILE, "w") do |file| # available at #{guidelines.href}. # # See https://wiki.mozilla.org/Security/Server_Side_TLS for details. + @[Deprecated("Deprecated with no replacement. Prefer setting a security level, global system configuration, or build your own from https://ssl-config.mozilla.org")] CIPHERS_#{level.upcase} = "#{all_ciphers.join(":")}" # The list of secure ciphersuites on **#{level}** compatibility level as per Mozilla @@ -68,6 +69,7 @@ File.open(DEFAULTS_FILE, "w") do |file| # available at #{guidelines.href}. # # See https://wiki.mozilla.org/Security/Server_Side_TLS for details. + @[Deprecated("Deprecated with no replacement. Prefer setting a security level, global system configuration, or build your own from https://ssl-config.mozilla.org")] CIPHER_SUITES_#{level.upcase} = "#{ciphersuites.join(":")}" CRYSTAL end diff --git a/src/openssl/ssl/context.cr b/src/openssl/ssl/context.cr index d49310b0ec5a..c7d5b5a0de2a 100644 --- a/src/openssl/ssl/context.cr +++ b/src/openssl/ssl/context.cr @@ -320,36 +320,30 @@ abstract class OpenSSL::SSL::Context end # Sets the current ciphers and ciphers suites to **modern** compatibility level as per Mozilla - # recommendations. See `CIPHERS_MODERN` and `CIPHER_SUITES_MODERN`. See `#security_level=` for some - # sensible system configuration. + # recommendations. See `#security_level=` for some sensible system configuration. + # + # WARNING: Does nothing as of Crystal 1.13. + # WARNING: Didn't work as expected as of OpenSSL 1.1 (didn't configure TLSv1.2 and below). + @[Deprecated("Deprecated with no replacement. Prefer #security_level, global system configuration or build your own from https://wiki.mozilla.org/Security/Server_Side_TLS")] def set_modern_ciphers - {% if LibSSL.has_method?(:ssl_ctx_set_ciphersuites) %} - self.cipher_suites = CIPHER_SUITES_MODERN - {% else %} - self.ciphers = CIPHERS_MODERN - {% end %} end # Sets the current ciphers and ciphers suites to **intermediate** compatibility level as per Mozilla - # recommendations. See `CIPHERS_INTERMEDIATE` and `CIPHER_SUITES_INTERMEDIATE`. See `#security_level=` for some - # sensible system configuration. + # recommendations. See `#security_level=` for some sensible system configuration. + # + # WARNING: Does nothing as of Crystal 1.13. + # WARNING: Didn't work as expected as of OpenSSL 1.1 (didn't configure TLSv1.2 and below). + @[Deprecated("Deprecated with no replacement. Prefer #security_level, global system configuration or build your own from https://wiki.mozilla.org/Security/Server_Side_TLS")] def set_intermediate_ciphers - {% if LibSSL.has_method?(:ssl_ctx_set_ciphersuites) %} - self.cipher_suites = CIPHER_SUITES_INTERMEDIATE - {% else %} - self.ciphers = CIPHERS_INTERMEDIATE - {% end %} end # Sets the current ciphers and ciphers suites to **old** compatibility level as per Mozilla - # recommendations. See `CIPHERS_OLD` and `CIPHER_SUITES_OLD`. See `#security_level=` for some - # sensible system configuration. + # recommendations. See `#security_level=` for some sensible system configuration. + # + # WARNING: Does nothing as of Crystal 1.13. + # WARNING: Didn't work as expected as of OpenSSL 1.1 (didn't configure TLSv1.2 and below). + @[Deprecated("Deprecated with no replacement. Prefer #security_level, global system configuration or build your own from https://wiki.mozilla.org/Security/Server_Side_TLS")] def set_old_ciphers - {% if LibSSL.has_method?(:ssl_ctx_set_ciphersuites) %} - self.cipher_suites = CIPHER_SUITES_OLD - {% else %} - self.ciphers = CIPHERS_OLD - {% end %} end # Returns the security level used by this TLS context. diff --git a/src/openssl/ssl/defaults.cr b/src/openssl/ssl/defaults.cr index 0803a1107f46..1a33eb8e1264 100644 --- a/src/openssl/ssl/defaults.cr +++ b/src/openssl/ssl/defaults.cr @@ -1,5 +1,5 @@ # THIS FILE WAS AUTOMATICALLY GENERATED BY scripts/generate_ssl_server_defaults.cr -# on 2023-07-21 10:32:46 UTC. +# on 2024-06-07 09:20:33 UTC. abstract class OpenSSL::SSL::Context # The list of secure ciphers on **modern** compatibility level as per Mozilla @@ -19,6 +19,7 @@ abstract class OpenSSL::SSL::Context # available at https://ssl-config.mozilla.org/guidelines/5.7.json. # # See https://wiki.mozilla.org/Security/Server_Side_TLS for details. + @[Deprecated("Deprecated with no replacement. Prefer setting a security level, global system configuration, or build your own from https://ssl-config.mozilla.org")] CIPHERS_MODERN = "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS" # The list of secure ciphersuites on **modern** compatibility level as per Mozilla @@ -38,6 +39,7 @@ abstract class OpenSSL::SSL::Context # available at https://ssl-config.mozilla.org/guidelines/5.7.json. # # See https://wiki.mozilla.org/Security/Server_Side_TLS for details. + @[Deprecated("Deprecated with no replacement. Prefer setting a security level, global system configuration, or build your own from https://ssl-config.mozilla.org")] CIPHER_SUITES_MODERN = "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256" # The list of secure ciphers on **intermediate** compatibility level as per Mozilla @@ -58,6 +60,7 @@ abstract class OpenSSL::SSL::Context # available at https://ssl-config.mozilla.org/guidelines/5.7.json. # # See https://wiki.mozilla.org/Security/Server_Side_TLS for details. + @[Deprecated("Deprecated with no replacement. Prefer setting a security level, global system configuration, or build your own from https://ssl-config.mozilla.org")] CIPHERS_INTERMEDIATE = "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS" # The list of secure ciphersuites on **intermediate** compatibility level as per Mozilla @@ -78,6 +81,7 @@ abstract class OpenSSL::SSL::Context # available at https://ssl-config.mozilla.org/guidelines/5.7.json. # # See https://wiki.mozilla.org/Security/Server_Side_TLS for details. + @[Deprecated("Deprecated with no replacement. Prefer setting a security level, global system configuration, or build your own from https://ssl-config.mozilla.org")] CIPHER_SUITES_INTERMEDIATE = "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256" # The list of secure ciphers on **old** compatibility level as per Mozilla @@ -98,6 +102,7 @@ abstract class OpenSSL::SSL::Context # available at https://ssl-config.mozilla.org/guidelines/5.7.json. # # See https://wiki.mozilla.org/Security/Server_Side_TLS for details. + @[Deprecated("Deprecated with no replacement. Prefer setting a security level, global system configuration, or build your own from https://ssl-config.mozilla.org")] CIPHERS_OLD = "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS" # The list of secure ciphersuites on **old** compatibility level as per Mozilla @@ -118,5 +123,6 @@ abstract class OpenSSL::SSL::Context # available at https://ssl-config.mozilla.org/guidelines/5.7.json. # # See https://wiki.mozilla.org/Security/Server_Side_TLS for details. + @[Deprecated("Deprecated with no replacement. Prefer setting a security level, global system configuration, or build your own from https://ssl-config.mozilla.org")] CIPHER_SUITES_OLD = "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256" end