module Gemini::SSL
Contains specific method to handle SSL
connection
Private Instance Methods
finish()
click to toggle source
Closes the SSL
and TCP connections.
# File lib/net/gemini/ssl.rb, line 49 def finish @ssl_socket.close end
init_sockets()
click to toggle source
# File lib/net/gemini/ssl.rb, line 39 def init_sockets socket = TCPSocket.new(@host, @port) @ssl_socket = OpenSSL::SSL::SSLSocket.new(socket, ssl_context) # Close underlying TCP socket with SSL socket @ssl_socket.sync_close = true @ssl_socket.hostname = @host # SNI @ssl_socket.connect end
ssl_check_existing(new_cert, cert_file)
click to toggle source
# File lib/net/gemini/ssl.rb, line 8 def ssl_check_existing(new_cert, cert_file) raw = File.read cert_file saved_one = OpenSSL::X509::Certificate.new raw return true if saved_one == new_cert # TODO: offer some kind of recuperation warn "#{cert_file} does not match the current host cert!" false end
ssl_context()
click to toggle source
# File lib/net/gemini/ssl.rb, line 26 def ssl_context ssl_context = OpenSSL::SSL::SSLContext.new ssl_context.set_params(verify_mode: OpenSSL::SSL::VERIFY_PEER) ssl_context.min_version = OpenSSL::SSL::TLS1_2_VERSION ssl_context.verify_hostname = true ssl_context.ca_file = '/etc/ssl/certs/ca-certificates.crt' ssl_context.verify_callback = lambda do |preverify_ok, store_context| return true if preverify_ok ssl_verify_cb store_context.current_cert end ssl_context end
ssl_verify_cb(cert)
click to toggle source
# File lib/net/gemini/ssl.rb, line 17 def ssl_verify_cb(cert) return false unless OpenSSL::SSL.verify_certificate_identity(cert, @host) cert_file = File.expand_path("#{@certs_path}/#{@host}.pem") return ssl_check_existing(cert, cert_file) if File.exist?(cert_file) FileUtils.mkdir_p(File.expand_path(@certs_path)) File.open(cert_file, 'wb') { |f| f.print cert.to_pem } true end