class Faye::WebSocket::SslVerifier

Public Class Methods

new(hostname, ssl_opts) click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 29
def initialize(hostname, ssl_opts)
  @hostname   = hostname
  @ssl_opts   = ssl_opts
  @cert_store = OpenSSL::X509::Store.new

  if root = @ssl_opts[:root_cert_file]
    [root].flatten.each { |ca_path| @cert_store.add_file(ca_path) }
  else
    @cert_store.set_default_paths
  end
end

Public Instance Methods

ssl_handshake_completed() click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 56
def ssl_handshake_completed
  return unless should_verify?

  unless @last_cert_verified
    raise SSLError, "Unable to verify the server certificate for '#{ @hostname }'"
  end

  unless identity_verified?
    raise SSLError, "Host '#{ @hostname }' does not match the server certificate"
  end
end
ssl_verify_peer(cert_text) click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 41
def ssl_verify_peer(cert_text)
  return true unless should_verify?

  certificate = parse_cert(cert_text)
  unless certificate
    raise SSLError, "Unable to parse SSL certificate for '#{ @hostname }'"
  end

  @last_cert = certificate
  @last_cert_verified = @cert_store.verify(certificate)
  store_cert(certificate) if @last_cert_verified

  true
end

Private Instance Methods

identity_verified?() click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 86
def identity_verified?
  @last_cert and OpenSSL::SSL.verify_certificate_identity(@last_cert, @hostname)
end
parse_cert(cert_text) click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 74
def parse_cert(cert_text)
  OpenSSL::X509::Certificate.new(cert_text)
rescue OpenSSL::X509::CertificateError
  nil
end
should_verify?() click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 70
def should_verify?
  @ssl_opts[:verify_peer] != false
end
store_cert(certificate) click to toggle source
# File lib/faye/websocket/ssl_verifier.rb, line 80
def store_cert(certificate)
  @cert_store.add_cert(certificate)
rescue OpenSSL::X509::StoreError => error
  raise error unless error.message =~ /cert already in hash table/
end