puppetlabs/marionette-collective — pull request #257 by nicklewis (2014-10-24 01:13:38+00:00)
Title: (MCO-489) Disable empty fragments for BEAST attack mitigation

Ruby 2 disables this flag by default (thus enabling empty fragments) for BEAST
attack mitigation. Empty fragments are used when using TLSv1.0 with a CBC mode
cipher. For reasons as-yet unclear, ActiveMQ seems to respond poorly when they
are used, and mcollective can't talk to it.

This is problematic combined with the previous patch to disable SSLv2 and
SSLv3, because versions of openssl < 1.0.1 (which are still common) don't
support TLSv1.1 or TLSv1.2. This leaves only TLSv1.0 as an option, with CBC
mode ciphers preferred. This causes trouble with ActiveMQ.

Because BEAST isn't an attack that affects mcollective (it's a
chosen-plaintext attack against browsers), this commit just reenables the flag
to disable empty fragments. This means mcollective will be able to talk to
ActiveMQ on ruby 2.0 with openssl < 1.0.1.