class Riemann::Tools::TLSCheck::TLSCheckResult

Attributes

address[R]
tls_socket[R]
uri[R]

Public Class Methods

new(uri, address, tls_socket, checker) click to toggle source
# File lib/riemann/tools/tls_check.rb, line 73
def initialize(uri, address, tls_socket, checker)
  @uri = uri
  @address = address
  @tls_socket = tls_socket
  @checker = checker
end

Public Instance Methods

acceptable_identities() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 96
def acceptable_identities
  res = []

  peer_cert.extensions.each do |ext|
    next unless ext.oid == 'subjectAltName'

    ostr = OpenSSL::ASN1.decode(ext.to_der).value.last
    sequence = OpenSSL::ASN1.decode(ostr.value)
    res = sequence.value.map(&:value)
  end

  res << peer_cert.subject.to_s unless res.any?

  res
end
check_ocsp_status() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 180
def check_ocsp_status
  subject = peer_cert
  issuer = peer_cert_chain[1]

  return '' unless issuer

  digest = OpenSSL::Digest.new('SHA1')
  certificate_id = OpenSSL::OCSP::CertificateId.new(subject, issuer, digest)

  request = OpenSSL::OCSP::Request.new
  request.add_certid(certificate_id)

  request.add_nonce

  authority_info_access = subject.extensions.find do |extension|
    extension.oid == 'authorityInfoAccess'
  end

  return '' unless authority_info_access

  descriptions = authority_info_access.value.split("\n")
  ocsp = descriptions.find do |description|
    description.start_with? 'OCSP'
  end

  ocsp_uri = URI(ocsp[/URI:(.*)/, 1])

  http_response = ::Net::HTTP.start(ocsp_uri.hostname, ocsp_uri.port) do |http|
    ocsp_uri.path = '/' if ocsp_uri.path.empty?
    http.post(ocsp_uri.path, request.to_der, 'content-type' => 'application/ocsp-request')
  end

  response = OpenSSL::OCSP::Response.new http_response.body
  response_basic = response.basic

  return '' unless response_basic&.verify([issuer], @checker.store)

  response.status_string
end
exception() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 88
def exception
  tls_socket.exception if tls_socket.respond_to?(:exception)
end
expire_soonish?() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 152
def expire_soonish?
  utcnow + (2 * renewal_duration / 3) > not_after
end
expired?() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 156
def expired?
  utcnow > not_after
end
expired_or_expire_soon?() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 148
def expired_or_expire_soon?
  utcnow + (renewal_duration / 3) > not_after
end
not_after() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 116
def not_after
  peer_cert.not_after
end
not_after_ago() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 120
def not_after_ago
  not_after - utcnow
end
not_after_ago_in_words() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 124
def not_after_ago_in_words
  when_from_utcnow(not_after)
end
not_before() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 128
def not_before
  peer_cert.not_before
end
not_before_away() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 132
def not_before_away
  utcnow - not_before
end
not_before_away_in_words() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 136
def not_before_away_in_words
  when_from_utcnow(not_before)
end
not_valid_yet?() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 112
def not_valid_yet?
  utcnow < not_before
end
ocsp?() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 172
def ocsp?
  !ocsp_status.empty?
end
ocsp_status() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 168
def ocsp_status
  @ocsp_status ||= check_ocsp_status
end
peer_cert() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 80
def peer_cert
  tls_socket.peer_cert
end
peer_cert_chain() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 84
def peer_cert_chain
  tls_socket.peer_cert_chain
end
renewal_duration() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 144
def renewal_duration
  [validity_duration * @checker.opts[:renewal_duration_ratio], @checker.opts[:renewal_duration_days] * 3600 * 24].min
end
trusted?() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 164
def trusted?
  verify_result == OpenSSL::X509::V_OK
end
valid_identity?() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 92
def valid_identity?
  OpenSSL::SSL.verify_certificate_identity(peer_cert, uri.host)
end
valid_ocsp?() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 176
def valid_ocsp?
  ocsp_status == 'successful'
end
validity_duration() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 140
def validity_duration
  not_after - not_before
end
verify_result() click to toggle source
# File lib/riemann/tools/tls_check.rb, line 160
def verify_result
  tls_socket.verify_result
end