mongo 2.13.3 → 2.14.0.rc1

data/lib/mongo/socket/ssl.rb

@@ -15,15 +15,15 @@
 module Mongo
   class Socket
 
-    # Wrapper for SSL sockets.
+    # Wrapper for TLS sockets.
     #
     # @since 2.0.0
     class SSL < Socket
       include OpenSSL
 
-      # Initializes a new SSL socket.
+      # Initializes a new TLS socket.
       #
-      # @example Create the SSL socket.
+      # @example Create the TLS socket.
       #   SSL.new('::1', 27017, 30)
       #
       # @param [ String ] host The hostname or IP address.
@@ -113,7 +113,7 @@ module Mongo
         end
       end
 
-      # @return [ SSLContext ] context The ssl context.
+      # @return [ SSLContext ] context The TLS context.
       attr_reader :context
 
       # @return [ String ] host The host to connect to.
@@ -149,6 +149,7 @@ module Mongo
               @socket.connect
             end
             verify_certificate!(@socket)
+            verify_ocsp_endpoint!(@socket)
           rescue
             @socket.close
             @socket = nil
@@ -177,29 +178,36 @@ module Mongo
       private
 
       def verify_certificate?
-        @verify_certificate ||=
-          # If ssl_verify_certificate is not present, disable only if ssl_verify is
-          # explicitly set to false.
-          if options[:ssl_verify_certificate].nil?
-            options[:ssl_verify] != false
-          # If ssl_verify_certificate is present, enable or disable based on its value.
-          else
-            !!options[:ssl_verify_certificate]
-          end
+        # If ssl_verify_certificate is not present, disable only if
+        # ssl_verify is explicitly set to false.
+        if options[:ssl_verify_certificate].nil?
+          options[:ssl_verify] != false
+        # If ssl_verify_certificate is present, enable or disable based on its value.
+        else
+          !!options[:ssl_verify_certificate]
+        end
       end
 
       def verify_hostname?
-        @verify_hostname ||=
-          # If ssl_verify_hostname is not present, disable only if ssl_verify is
-          # explicitly set to false.
-          if options[:ssl_verify_hostname].nil?
-            options[:ssl_verify] != false
-          # If ssl_verify_hostname is present, enable or disable based on its value.
-          else
-            !!options[:ssl_verify_hostname]
-          end
+        # If ssl_verify_hostname is not present, disable only if ssl_verify is
+        # explicitly set to false.
+        if options[:ssl_verify_hostname].nil?
+          options[:ssl_verify] != false
+        # If ssl_verify_hostname is present, enable or disable based on its value.
+        else
+          !!options[:ssl_verify_hostname]
+        end
       end
 
+      def verify_ocsp_endpoint?
+        if !options[:ssl_verify_ocsp_endpoint].nil?
+          options[:ssl_verify_ocsp_endpoint] != false
+        elsif !options[:ssl_verify_certificate].nil?
+          options[:ssl_verify_certificate] != false
+        else
+          options[:ssl_verify] != false
+        end
+      end
 
       def create_context(options)
         OpenSSL::SSL::SSLContext.new.tap do |context|
@@ -344,13 +352,26 @@ module Mongo
       def verify_certificate!(socket)
         if verify_hostname?
           unless OpenSSL::SSL.verify_certificate_identity(socket.peer_cert, host_name)
-            raise Error::SocketError, 'SSL handshake failed due to a hostname mismatch.'
+            raise Error::SocketError, 'TLS handshake failed due to a hostname mismatch.'
           end
         end
       end
 
+      def verify_ocsp_endpoint!(socket)
+        unless verify_ocsp_endpoint?
+          return
+        end
+
+        cert = socket.peer_cert
+        ca_cert = socket.peer_cert_chain.last
+
+        verifier = OcspVerifier.new(@host_name, cert, ca_cert, context.cert_store,
+          **Utils.shallow_symbolize_keys(options))
+        verifier.verify_with_cache
+      end
+
       def read_buffer_size
-        # Buffer size for SSL reads.
+        # Buffer size for TLS reads.
         # Capped at 16k due to https://linux.die.net/man/3/ssl_read
         16384
       end

data/lib/mongo/socket.rb

@@ -15,6 +15,8 @@
 require 'mongo/socket/ssl'
 require 'mongo/socket/tcp'
 require 'mongo/socket/unix'
+require 'mongo/socket/ocsp_verifier'
+require 'mongo/socket/ocsp_cache'
 
 module Mongo
 
@@ -25,10 +27,10 @@ module Mongo
   class Socket
     include ::Socket::Constants
 
-    # Error message for SSL related exceptions.
+    # Error message for TLS related exceptions.
     #
     # @since 2.0.0
-    SSL_ERROR = 'MongoDB may not be configured with SSL support'.freeze
+    SSL_ERROR = 'MongoDB may not be configured with TLS support'.freeze
 
     # Error message for timeouts on socket calls.
     #
@@ -129,7 +131,7 @@ module Mongo
       sock_arr = [ @socket ]
       if Kernel::select(sock_arr, nil, sock_arr, 0)
         # The eof? call is supposed to return immediately since select
-        # indicated the socket is readable. However, if @socket is an SSL
+        # indicated the socket is readable. However, if @socket is a TLS
         # socket, eof? can block anyway - see RUBY-2140.
         begin
           Timeout.timeout(0.1) do
@@ -342,7 +344,7 @@ module Mongo
     end
 
     def read_buffer_size
-      # Buffer size for non-SSL reads
+      # Buffer size for non-TLS reads
       # 64kb
       65536
     end

data/lib/mongo/srv/monitor.rb

@@ -34,24 +34,18 @@ module Mongo
       # Creates the SRV monitor.
       #
       # @param [ Cluster ] cluster The cluster.
-      # @param [ Hash ] options The cluster options.
       #
-      # @option options [ Float ] :timeout The timeout to use for DNS lookups.
-      # @option options [ URI::SRVProtocol ] :srv_uri The SRV URI to monitor.
-      # @option options [ Hash ] :resolv_options For internal driver use only.
+      # @option opts [ Float ] :timeout The timeout to use for DNS lookups.
+      # @option opts [ URI::SRVProtocol ] :srv_uri The SRV URI to monitor.
+      # @option opts [ Hash ] :resolv_options For internal driver use only.
       #   Options to pass through to Resolv::DNS constructor for SRV lookups.
-      def initialize(cluster, options = nil)
-        options = if options
-          options.dup
-        else
-          {}
-        end
+      def initialize(cluster, **opts)
         @cluster = cluster
-        @resolver = Srv::Resolver.new(options)
-        unless @srv_uri = options.delete(:srv_uri)
+        unless @srv_uri = opts.delete(:srv_uri)
           raise ArgumentError, 'SRV URI is required'
         end
-        @options = options.freeze
+        @options = opts.freeze
+        @resolver = Srv::Resolver.new(**opts)
         @last_result = @srv_uri.srv_result
         @stop_semaphore = Semaphore.new
       end

data/lib/mongo/srv/resolver.rb

@@ -28,20 +28,24 @@ module Mongo
 
       # Creates a new Resolver.
       #
-      # @param [ Hash ] options The options for the resolver.
-      #
-      # @option options [ Boolean ] :raise_on_invalid Whether or not to raise
+      # @option opts [ Float ] :timeout The timeout, in seconds, to use for
+      #   each DNS record resolution.
+      # @option opts [ Boolean ] :raise_on_invalid Whether or not to raise
       #   an exception if either a record with a mismatched domain is found
       #   or if no records are found. Defaults to true.
-      # @option options [ Hash ] :resolv_options For internal driver use only.
+      # @option opts [ Hash ] :resolv_options For internal driver use only.
       #   Options to pass through to Resolv::DNS constructor for SRV lookups.
-      def initialize(options = nil)
-        @options = if options
-          options.dup
-        else
-          {}
-        end.freeze
+      def initialize(**opts)
+        @options = opts.freeze
         @resolver = Resolv::DNS.new(@options[:resolv_options])
+        @resolver.timeouts = timeout
+      end
+
+      # @return [ Hash ] Resolver options.
+      attr_reader :options
+
+      def timeout
+        options[:timeout] || Monitor::DEFAULT_TIMEOUT
       end
 
       # Obtains all of the SRV records for a given hostname.

data/lib/mongo/timeout.rb

@@ -13,6 +13,8 @@
 # limitations under the License.
 
 module Mongo
+
+  # @api private
   module Timeout
 
     # A wrapper around Ruby core's Timeout::timeout method that provides