nats-pure 0.2.4 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 44273223e517bfe16e454408baba484fb3a80d8c
-  data.tar.gz: 2cfa6aaae35c049279ae72d637c58aeabdd7e035
+SHA256:
+  metadata.gz: 6511a5fc9c87e5a783322e9fe0b02f66a2b36d47c1ea806208877ec2c63c6a23
+  data.tar.gz: bfdc75088d4a39cf5e020248664d72e3ae2cdc774a26a69fcc15ddf67727e531
 SHA512:
-  metadata.gz: f816d3cef57c6527ceae6e7dea24ec1ffd99f097ba97a8292ae1db20e3718d417f12661471830806038d0a2018deb9844c5dc57513c0c2482c1501795edfc605
-  data.tar.gz: 9304d8711e83748d065f9ab1eddca0528b97f11d84aaec870726d6907c51343898da7656983d402e0c6ec723b41e5246bb504896332008ba0a304bc153bd27e9
+  metadata.gz: 300ab49335e50800e0dc0c5971dd5b96682a7e0a5be9c9f09edf10f0a1c97a3c3f10749d1b87276cd4a709d724c8e3c627ef239a5fc49ff3cfff9f2e32ac71f7
+  data.tar.gz: 49a3618d2dc8ab3fd7844d4e7d98035c9fbfdb68e0f336e94437edeec0572197437cc02d14f136b006b52a641a8f588cd4abaec688f1b6252efb8e361391b9a5

data/lib/nats/io/client.rb

@@ -148,6 +148,10 @@ module NATS
 
         # Secure TLS options
         @tls = nil
+
+        # Hostname of current server; used for when TLS host
+        # verification is enabled.
+        @hostname = nil
       end
 
       # Establishes connection to NATS
@@ -175,7 +179,16 @@ module NATS
         uris = opts[:servers] || [DEFAULT_URI]
         uris.shuffle! unless @options[:dont_randomize_servers]
         uris.each do |u|
-          @server_pool << { :uri => u.is_a?(URI) ? u.dup : URI.parse(u) }
+          nats_uri = case u
+                     when URI
+                       u.dup
+                     else
+                       URI.parse(u)
+                     end
+          @server_pool << {
+            :uri => nats_uri,
+            :hostname => nats_uri.host
+          }
         end
 
         # Check for TLS usage
@@ -196,6 +209,9 @@ module NATS
           # Connection established and now in process of sending CONNECT to NATS
           @status = CONNECTING
 
+          # Use the hostname from the server for TLS hostname verification.
+          @hostname = srv[:hostname]
+
           # Established TCP connection successfully so can start connect
           process_connect_init
 
@@ -507,7 +523,8 @@ module NATS
                   u.password ||= @uri.password if @uri.password
                 end
 
-                srv = { :uri => u, :reconnect_attempts => 0, :discovered => true }
+                # NOTE: Auto discovery won't work here when TLS host verification is enabled.
+                srv = { :uri => u, :reconnect_attempts => 0, :discovered => true, :hostname => u.host }
                 srvs << srv
               end
             end
@@ -798,11 +815,26 @@ module NATS
           else
             # Defaults
             tls_context = OpenSSL::SSL::SSLContext.new
-            tls_context.ssl_version = :TLSv1_2
+
+            # Use the default verification options from Ruby:
+            # https://github.com/ruby/ruby/blob/96db72ce38b27799dd8e80ca00696e41234db6ba/ext/openssl/lib/openssl/ssl.rb#L19-L29
+            #
+            # Insecure TLS versions not supported already:
+            # https://github.com/ruby/openssl/commit/3e5a009966bd7f806f7180d82cf830a04be28986
+            #
+            tls_context.set_params
           end
 
           # Setup TLS connection by rewrapping the socket
           tls_socket = OpenSSL::SSL::SSLSocket.new(@io.socket, tls_context)
+
+          # Close TCP socket after closing TLS socket as well.
+          tls_socket.sync_close = true
+
+          # Required to enable hostname verification if Ruby runtime supports it (>= 2.4):
+          # https://github.com/ruby/openssl/commit/028e495734e9e6aa5dba1a2e130b08f66cf31a21
+          tls_socket.hostname = @hostname
+
           tls_socket.connect
           @io.socket = tls_socket
         when (server_using_secure_connection? and !client_using_secure_connection?)
@@ -857,6 +889,9 @@ module NATS
           @io.connect
           @stats[:reconnects] += 1
 
+          # Set hostname to use for TLS hostname verification
+          @hostname = srv[:hostname]
+
           # Established TCP connection successfully so can start connect
           process_connect_init
 
@@ -873,7 +908,7 @@ module NATS
           # to see whether need to take it out from rotation
           srv[:auth_required] ||= true if @server_info[:auth_required]
           server_pool << srv if can_reuse_server?(srv)
-          
+
           @last_err = e
 
           # Trigger async error handler

data/lib/nats/io/version.rb

@@ -1,7 +1,7 @@
 module NATS
   module IO
     # NOTE: These are all announced to the server on CONNECT
-    VERSION  = "0.2.4"
+    VERSION  = "0.3.0"
     LANG     = "#{RUBY_ENGINE}2".freeze
     PROTOCOL = 1
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: nats-pure
 version: !ruby/object:Gem::Version
-  version: 0.2.4
+  version: 0.3.0
 platform: ruby
 authors:
 - Waldemar Quevedo
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-03-30 00:00:00.000000000 Z
+date: 2018-02-24 00:00:00.000000000 Z
 dependencies: []
 description: NATS is an open-source, high-performance, lightweight cloud messaging
   system.
@@ -41,7 +41,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2
+rubygems_version: 2.7.3
 signing_key: 
 specification_version: 4
 summary: NATS is an open-source, high-performance, lightweight cloud messaging system.