module SslAllowCname::SSLSocket

Public Instance Methods

post_connection_check(hostname) click to toggle source
Calls superclass method
# File lib/ssl_allow_cname.rb, line 10
def post_connection_check(hostname)
  return super if context.allow_cname.nil?

  if peer_cert.nil?
    msg = "allow_cname specified, but peer presented no certificate"
    raise OpenSSL::SSL::SSLError, msg
  end

  cname = peer_cert.subject.to_a.map do |oid, value|
    oid == 'CN' ? value : nil
  end.compact.first

  passed = Array(context.allow_cname).any? do |test|
    case test
    when String, Regexp
      test === cname
    when Proc
      (test.arity == 1) ? test.call(cname)
                        : test.call(cname, hostname)
    when :match
      begin
        super
        true
      rescue SSLError
        false
      end
    end
  end

  unless passed
    fail OpenSSL::SSL::SSLError, "Peer certificate did not match any " +
                                 "predicate in :allow_cname.  Use :match " +
                                 "to get normal CommonName/Host validation"
  end
  true
end