class Faye::WebSocket::SslVerifier

Public Class Methods

new(hostname, ssl_opts) click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 29
def initialize(hostname, ssl_opts)
  @hostname   = hostname
  @ssl_opts   = ssl_opts
  @cert_store = OpenSSL::X509::Store.new

  if root = @ssl_opts[:root_cert_file]
    [root].flatten.each { |ca_path| @cert_store.add_file(ca_path) }
  else
    @cert_store.set_default_paths
  end
end

Public Instance Methods

ssl_handshake_completed() click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 57
def ssl_handshake_completed
  return unless should_verify?

  unless identity_verified?
    raise SSLError, "Host '#{ @hostname }' does not match the server certificate"
  end
end
ssl_verify_peer(cert_text) click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 41
def ssl_verify_peer(cert_text)
  return true unless should_verify?

  certificate = parse_cert(cert_text)
  return false unless certificate

  unless @cert_store.verify(certificate)
    raise SSLError, "Unable to verify the server certificate for '#{ @hostname }'"
  end

  store_cert(certificate)
  @last_cert = certificate

  true
end

Private Instance Methods

identity_verified?() click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 83
def identity_verified?
  @last_cert and OpenSSL::SSL.verify_certificate_identity(@last_cert, @hostname)
end
parse_cert(cert_text) click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 71
def parse_cert(cert_text)
  OpenSSL::X509::Certificate.new(cert_text)
rescue OpenSSL::X509::CertificateError
  nil
end
should_verify?() click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 67
def should_verify?
  @ssl_opts[:verify_peer] != false
end
store_cert(certificate) click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 77
def store_cert(certificate)
  @cert_store.add_cert(certificate)
rescue OpenSSL::X509::StoreError => error
  raise error unless error.message == 'cert already in hash table'
end