blocks|key|2959990|text|可以在您的系统上安装多个版本的OpenSSL。这两个测试告诉您，如果进行构建，哪个版本将链接到您的Ruby，以及您当前使用的Ruby中实际链接的版本。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2959991|例如，假设您仍在使用Ruby+1.9.3，并在去年安装/编译了它。它将链接到您当时安装的OpenSSL版本。在此期间，您更新了您的OpenSSL版本(例如，使用Homebrew+)，以响应心脏出血问题。|offset|length|2959992|如果您运行第一个测试，您将得到OpenSSL+1.0.1g，这是您刚刚升级的当前链接版本。|2959993|如果您运行第二个测试，它将显示您的Ruby副本可能仍然链接到较旧的、易受攻击的OpenSSL副本。|2959994|作为示例，我将使用我自己的系统(Mac+OSX+10.9)的输出：|2959995|Ruby+(2.0.0)系统上的结果：|style|BOLD|2959996|[~]+$+ruby+-v+-ropenssl+-rfiddle+-e+'puts+Fiddle::Function.new(Fiddle.dlopen(nil+["SSLeay_version"],+[Fiddle::TYPE_INT],+Fiddle::TYPE_VOIDP).call(0)'`+

ruby+2.0.0p247+(2013-06-27+revision+41674)+[universal.x86_64-darwin13]
/System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/ruby/2.0.0/openssl/ssl.rb:10++++1:+warning:+assigned+but+unused+variable+-+id
OpenSSL+0.9.8y+5+Feb+2013


[~]+$+ruby+-ropenssl+-e+'puts+OpenSSL::OPENSSL_VERSION'
OpenSSL+0.9.8y+5+Feb+2013|code-block|syntax|javascript|2959997|Ruby2.1.1p76上的结果(由rbenv管理，但可以是RVM或其他)：|2959998|[~]+$+ruby+-v+-ropenssl+-rfiddle+-e+'puts+Fiddle::Function.new(Fiddle.dlopen(nil)["SSLeay_version"],+[Fiddle::TYPE_INT],+Fiddle::TYPE_VOIDP).call(0)'
ruby+2.1.1p76+(2014-02-24+revision+45161)+[x86_64-darwin13.0]
OpenSSL+1.0.1g+7+Apr+2014
[~]+$+ruby+-ropenssl+-e+'puts+OpenSSL::OPENSSL_VERSION'
OpenSSL+1.0.1g+7+Apr+2014|2959999|正如您所看到的，系统ruby与OS附带的OpenSSL链接在一起，而苹果尚未对其进行修补。在使用Homebrew升级我安装的OpenSSL之后，我重新构建了Ruby2.1.1。|CODE|2960000|[~]+$+brew+list+openssl
/usr/local/Cellar/openssl/1.0.1g/bin/openssl
/usr/local/Cellar/openssl/1.0.1g/bin/c_rehash
/usr/local/Cellar/openssl/1.0.1g/include/openssl/+(75+files)
/usr/local/Cellar/openssl/1.0.1g/lib/libcrypto.1.0.0.dylib
/usr/local/Cellar/openssl/1.0.1g/lib/libssl.1.0.0.dylib
/usr/local/Cellar/openssl/1.0.1g/lib/engines/+(12+files)
/usr/local/Cellar/openssl/1.0.1g/lib/pkgconfig/+(3+files)
/usr/local/Cellar/openssl/1.0.1g/lib/+(4+other+files)
/usr/local/Cellar/openssl/1.0.1g/share/man/+(1126+files)|2960001|首先确保您拥有最新的OpenSSL，如果您使用的是Homebrew，只需使用：|2960002|brew+upgrade+openssl。|2960003|此外，请确保使用brew+cleanup+openssl删除较旧版本的OpenSSL|2960004|我不建议对系统Ruby打补丁，最好使用Ruby版本管理器，如rbenv或RVM。在更新SSL之后，按照版本管理器的正常构建/安装说明删除并重新构建您使用的Ruby版本。|2960005|entityMap|0|LINK|mutability|MUTABLE|url|http://brew.sh/|1|2|http://rbenv.org/|3|https://rvm.io/^0|0|28|8|0|0|0|0|0|G|3|0|0|E|O|0|0|K|7|1C|8|1Q|7|0|0|P|8|1|0|0|K|0|8|K|0|U|5|2|10|3|3|0^^$0|@$1|2|3|4|5|6|7|1O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1P|8|@]|9|@$D|1Q|E|1R|1|1S]]|A|$]]|$1|F|3|G|5|6|7|1T|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|1U|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|1V|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|1W|8|@$D|1X|E|1Y|N|O]]|9|@]|A|$]]|$1|P|3|Q|5|R|7|1Z|8|@]|9|@]|A|$S|T]]|$1|U|3|V|5|6|7|20|8|@$D|21|E|22|N|O]]|9|@]|A|$]]|$1|W|3|X|5|R|7|23|8|@]|9|@]|A|$S|T]]|$1|Y|3|Z|5|6|7|24|8|@$D|25|E|26|N|10]|$D|27|E|28|N|10]|$D|29|E|2A|N|10]]|9|@]|A|$]]|$1|11|3|12|5|R|7|2B|8|@]|9|@]|A|$S|T]]|$1|13|3|14|5|6|7|2C|8|@]|9|@$D|2D|E|2E|1|2F]]|A|$]]|$1|15|3|16|5|6|7|2G|8|@$D|2H|E|2I|N|10]]|9|@]|A|$]]|$1|17|3|18|5|6|7|2J|8|@$D|2K|E|2L|N|10]]|9|@]|A|$]]|$1|19|3|1A|5|6|7|2M|8|@]|9|@$D|2N|E|2O|1|2P]|$D|2Q|E|2R|1|2S]]|A|$]]|$1|1B|3|-4|5|6|7|2T|8|@]|9|@]|A|$]]]|1C|$1D|$5|1E|1F|1G|A|$1H|1I]]|1J|$5|1E|1F|1G|A|$1H|1I]]|1K|$5|1E|1F|1G|A|$1H|1L]]|1M|$5|1E|1F|1G|A|$1H|1N]]]]

It is possible to have multiple versions of OpenSSL installed on your system. These two tests tell you which version would be linked to your Ruby if you were to do a build, and also which version is actually linked in the Ruby you are currently using.

As an example, let's say you are still using Ruby 1.9.3, and installed/compiled it last year. It would have been linked against the version of OpenSSL you had installed at the time. In the meantime you updated your version of OpenSSL (using <a href="http://brew.sh" rel="noreferrer">Homebrew</a>, for example), in response to the Heartbleed problem.

If you ran the first test you would get back OpenSSL 1.0.1g, the current version linked that you just upgraded.

If you ran the second test, it would reveal that your copy of Ruby is probably still linked to the older, vulnerable copy of OpenSSL.

By way of example, I'll use output from my own system (Mac OSX 10.9):

Results on the system Ruby (2.0.0):

<pre><code>[~] $ ruby -v -ropenssl -rfiddle -e 'puts Fiddle::Function.new(Fiddle.dlopen(nil ["SSLeay_version"], [Fiddle::TYPE_INT], Fiddle::TYPE_VOIDP).call(0)'` 

ruby 2.0.0p247 (2013-06-27 revision 41674) [universal.x86_64-darwin13]
/System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/ruby/2.0.0/openssl/ssl.rb:10 1: warning: assigned but unused variable - id
OpenSSL 0.9.8y 5 Feb 2013


[~] $ ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
OpenSSL 0.9.8y 5 Feb 2013
</code></pre>

Results on Ruby 2.1.1p76 (managed by rbenv, but could be RVM or other):

<pre><code>[~] $ ruby -v -ropenssl -rfiddle -e 'puts Fiddle::Function.new(Fiddle.dlopen(nil)["SSLeay_version"], [Fiddle::TYPE_INT], Fiddle::TYPE_VOIDP).call(0)'
ruby 2.1.1p76 (2014-02-24 revision 45161) [x86_64-darwin13.0]
OpenSSL 1.0.1g 7 Apr 2014
[~] $ ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
OpenSSL 1.0.1g 7 Apr 2014
</code></pre>

As you can see the system ruby is linked against the <code>OpenSSL</code> included with OS X, and not yet patched by Apple. Ruby 2.1.1 I re-built after after using <code>Homebrew</code> to upgrade my install of <code>OpenSSL</code>.

<pre><code>[~] $ brew list openssl
/usr/local/Cellar/openssl/1.0.1g/bin/openssl
/usr/local/Cellar/openssl/1.0.1g/bin/c_rehash
/usr/local/Cellar/openssl/1.0.1g/include/openssl/ (75 files)
/usr/local/Cellar/openssl/1.0.1g/lib/libcrypto.1.0.0.dylib
/usr/local/Cellar/openssl/1.0.1g/lib/libssl.1.0.0.dylib
/usr/local/Cellar/openssl/1.0.1g/lib/engines/ (12 files)
/usr/local/Cellar/openssl/1.0.1g/lib/pkgconfig/ (3 files)
/usr/local/Cellar/openssl/1.0.1g/lib/ (4 other files)
/usr/local/Cellar/openssl/1.0.1g/share/man/ (1126 files)
</code></pre>

First make sure that you have the most current OpenSSL, if you are using <a href="http://brew.sh" rel="noreferrer">Homebrew</a>, just use:

<code>brew upgrade openssl</code>. 

Also, make sure to remove the older versions of OpenSSL with <code>brew cleanup openssl</code>

I don't recommend patching the system Ruby, best to use a Ruby version manager, like <a href="http://rbenv.org" rel="noreferrer">rbenv</a> or <a href="https://rvm.io" rel="noreferrer">RVM</a>. After updating your SSL, remove and rebuild the versions of Ruby that you use following the normal build/install instructions for your version manager.

blocks|key|156552|text|在问了一些问题elsewhere之后，我目前的理解是：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|156553|Ruby从来不会和out.|156554|ruby+-v+-ropenssl+-rfiddle+-e+'puts+Fiddle::Function.new(Fiddle.dlopen(nil)["SSLeay_version"],+[Fiddle::TYPE_INT],+Fiddle::TYPE_VOIDP).call(0)'一起编译；Ruby只是在编译时被告知在哪里寻找OpenSSL.|unordered-list-item|style|CODE|156555|
|156556|ruby+-r+rbconfig+-e+'puts+RbConfig::CONFIG["configure_args"]'应该告诉你Ruby在哪里寻找各种可执行文件，包括number|156557|156558|OpenSSL::OPENSSL_VERSION+|156559|156560|所有重要的是那个位置的OpenSSL副本是最新的；在那里cd并使用./openssl+version查找openssl+version应该给出与直接运行openssl+version相同的答案，因为它实际上询问了Ruby用来报告其版本number|156561|156562|OpenSSL::OPENSSL_VERSION的OpenSSL副本可能是过时的；它会报告编译时发现的版本。|156563|156564|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/postmodern/ruby-install/issues/140^0|7|9|0|0|0|0|3Z|0|0|0|1P|0|0|0|O|0|0|X|H|1G|F|24|F|0|0|0|O|0|0^^$0|@$1|2|3|4|5|6|7|16|8|@]|9|@$A|17|B|18|1|19]]|C|$]]|$1|D|3|E|5|6|7|1A|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|1B|8|@$A|1C|B|1D|I|J]]|9|@]|C|$]]|$1|K|3|L|5|6|7|1E|8|@]|9|@]|C|$]]|$1|M|3|N|5|H|7|1F|8|@$A|1G|B|1H|I|J]]|9|@]|C|$]]|$1|O|3|L|5|6|7|1I|8|@]|9|@]|C|$]]|$1|P|3|Q|5|H|7|1J|8|@$A|1K|B|1L|I|J]]|9|@]|C|$]]|$1|R|3|L|5|6|7|1M|8|@]|9|@]|C|$]]|$1|S|3|T|5|H|7|1N|8|@$A|1O|B|1P|I|J]|$A|1Q|B|1R|I|J]|$A|1S|B|1T|I|J]]|9|@]|C|$]]|$1|U|3|L|5|6|7|1U|8|@]|9|@]|C|$]]|$1|V|3|W|5|H|7|1V|8|@$A|1W|B|1X|I|J]]|9|@]|C|$]]|$1|X|3|-4|5|6|7|1Y|8|@]|9|@]|C|$]]|$1|Y|3|-4|5|6|7|1Z|8|@]|9|@]|C|$]]]|Z|$10|$5|11|12|13|C|$14|15]]]]

After asking some questions <a href="https://github.com/postmodern/ruby-install/issues/140">elsewhere</a>, my current understanding is this:

<ul>
<li>OpenSSL is never compiled along with Ruby; Ruby is simply told, at compile time, where to look for OpenSSL.</li>
<li><code>ruby -r rbconfig -e 'puts RbConfig::CONFIG["configure_args"]'</code> should tell you where Ruby will look for various executables, including OpenSSL</li>
<li>All that matters is that the copy of OpenSSL at that location is up-to-date; cd there and use <code>./openssl version</code> to find out.</li>
<li><code>ruby -v -ropenssl -rfiddle -e 'puts Fiddle::Function.new(Fiddle.dlopen(nil)["SSLeay_version"], [Fiddle::TYPE_INT], Fiddle::TYPE_VOIDP).call(0)'</code> should give the same answer as running <code>openssl version</code> directly because it actually asks the copy of OpenSSL that Ruby is using to report its version number</li>
<li><code>OpenSSL::OPENSSL_VERSION</code> may be out-of-date; it reports the version it found when it was compiled.</li>
</ul>

Following the Heartbleed bug, <a href="https://www.ruby-lang.org/en/news/2014/04/10/severe-openssl-vulnerability/" rel="noreferrer">this post on ruby-lang.org</a> describes how to check vulnerability and upgrade.

It includes this advice:

<hr>

To verify which version of the OpenSSL library you link to Ruby, use the following:

<pre><code>ruby -v -ropenssl -rfiddle -e 'puts Fiddle::Function.new(Fiddle.dlopen(nil)["SSLeay_version"], [Fiddle::TYPE_INT], Fiddle::TYPE_VOIDP).call(0)'
</code></pre>

To verify the version of OpenSSL currently installed with Ruby, use the following:

<pre><code>ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
</code></pre>

<hr>

What is the difference between these two checks, and what action is recommended if a bad version is returned from either command?

How can I ensure that Ruby uses an OpenSSL not vulnerable to Heartbleed?

在心脏出血漏洞之后，描述了如何检查漏洞和升级。它包括这样的建议：要验证链接到OpenSSL的Ruby库的版本，请使用以下命令：ruby -v -ropenssl -rfiddle -e 'puts Fiddle::Function.new(Fiddle.dlopen(nil)["SSLeay_version"], [F...

问我如何才能确保Ruby使用的OpenSSL不会受到心脏出血的攻击？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问我如何才能确保Ruby使用的OpenSSL不会受到心脏出血的攻击？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问我如何才能确保Ruby使用的OpenSSL不会受到心脏出血的攻击？
EN