Module: EmHttpSslPatch

Defined in:
lib/puppet/feature/faraday/adapter/em_http_ssl_patch.rb

Instance Method Summary collapse

Instance Method Details

#certificate_store ⇒ Object 



45
46
47
48
49
50
51
52
53
 
# File 'lib/puppet/feature/faraday/adapter/em_http_ssl_patch.rb', line 45

def certificate_store
  @certificate_store ||= begin
    store = OpenSSL::X509::Store.new
    store.set_default_paths
    ca_file = parent.connopts.tls[:cert_chain_file]
    store.add_file(ca_file) if ca_file
    store
  end
end

#host ⇒ Object 



41
42
43
 
# File 'lib/puppet/feature/faraday/adapter/em_http_ssl_patch.rb', line 41

def host
  parent.connopts.host
end

#ssl_handshake_completed ⇒ Object 



27
28
29
30
31
32
33
34
35
 
# File 'lib/puppet/feature/faraday/adapter/em_http_ssl_patch.rb', line 27

def ssl_handshake_completed
  return true unless verify_peer?

  unless OpenSSL::SSL.verify_certificate_identity(@last_seen_cert, host)
    raise OpenSSL::SSL::SSLError.new(%(host "#{host}" does not match the server certificate))
  else
    true
  end
end

#ssl_verify_peer(cert_string) ⇒ Object 



5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
 
# File 'lib/puppet/feature/faraday/adapter/em_http_ssl_patch.rb', line 5

def ssl_verify_peer(cert_string)
  cert = nil
  begin
    cert = OpenSSL::X509::Certificate.new(cert_string)
  rescue OpenSSL::X509::CertificateError
    return false
  end

  @last_seen_cert = cert

  if certificate_store.verify(@last_seen_cert)
    begin
      certificate_store.add_cert(@last_seen_cert)
    rescue OpenSSL::X509::StoreError => e
      raise e unless e.message == 'cert already in hash table'
    end
    true
  else
    raise OpenSSL::SSL::SSLError.new(%(unable to verify the server certificate for "#{host}"))
  end
end

#verify_peer? ⇒ Boolean

Returns:

  • (Boolean) 


37
38
39
 
# File 'lib/puppet/feature/faraday/adapter/em_http_ssl_patch.rb', line 37

def verify_peer?
  parent.connopts.tls[:verify_peer]
end