pcp-client 0.3.1 → 0.4.0

data/lib/pcp/client.rb

@@ -3,6 +3,52 @@ require 'faye/websocket'
 require 'pcp/message'
 require 'logger'
 
+# So EventMachine when you specify :verify_peer => true in the TLS
+# options decides what that means is it should just fire off a
+# #ssl_verify_peer(cert) on the Connection object; which is expected
+# to be user-supplied.  In this case the user is
+# Faye::Websocket::Client::Connection, so we monkey-patch it to have a
+# #ssl_verify_peer method.
+
+module Faye
+  class WebSocket
+    class Client
+      module Connection
+        def ssl_verify_peer(cert)
+          # The :@socket_tls instance variable of
+          # Faye::Websocket::Client is passed to tls_start, so we can
+          # get parameters from there.
+          start_tls_options = parent.instance_variable_get(:@socket_tls)
+          logger = start_tls_options[:xxx_logger]
+          logger.debug { [:ssl_verify_peer] }
+
+          peer_cert = OpenSSL::X509::Certificate.new cert
+
+          hostname = start_tls_options[:xxx_hostname]
+          if !OpenSSL::SSL.verify_certificate_identity(peer_cert, hostname)
+            logger.error { [:ssl_verify_peer, :fail,
+                           "Certificate presented does not match '#{hostname}'"] }
+            return false
+          end
+
+          ssl_ca_cert = start_tls_options[:xxx_ssl_ca_cert]
+          cert_store = OpenSSL::X509::Store.new
+          cert_store.add_file ssl_ca_cert
+
+          if !cert_store.verify(peer_cert)
+            logger.error { [:ssl_verify_peer, :ca_verify_failed,
+                            "Peer certificate not verified by ca"] }
+            return false
+          end
+
+          logger.debug { [:ssl_verify_peer, :success] }
+          return true
+        end
+      end
+    end
+  end
+end
+
 module PCP
   # Manages a client connection to a pcp broker
   class Client
@@ -27,6 +73,7 @@ module PCP
       @server = params[:server] || 'wss://localhost:8142/pcp'
       @ssl_key = params[:ssl_key]
       @ssl_cert = params[:ssl_cert]
+      @ssl_ca_cert = params[:ssl_ca_cert]
       @logger = params[:logger] || Logger.new(STDOUT)
       @logger.level = params[:loglevel] || Logger::WARN
       @connection = nil
@@ -53,9 +100,21 @@ module PCP
       @logger.debug { [:connect, :scheduling] }
       EM.next_tick do
         @logger.debug { [:connect, @server] }
-        @connection = Faye::WebSocket::Client.new(@server, nil, {:tls => {:private_key_file => @ssl_key,
-                                                                          :cert_chain_file => @ssl_cert,
-                                                                          :ssl_version => ["TLSv1", "TLSv1_1", "TLSv1_2"]}})
+
+        start_tls_options = {
+          :ssl_version => ["TLSv1", "TLSv1_1", "TLSv1_2"],
+          :private_key_file => @ssl_key,
+          :cert_chain_file => @ssl_cert,
+          :verify_peer => true,
+          :fail_if_no_peer_cert => true,
+          # side-channeled properties we want around during ssl
+          # verification are prefixed with xxx_.
+          :xxx_logger => @logger,
+          :xxx_ssl_ca_cert => @ssl_ca_cert,
+          :xxx_hostname => URI.parse(@server).host,
+        }
+
+        @connection = Faye::WebSocket::Client.new(@server, nil, {:tls => start_tls_options})
 
         @connection.on :open do |event|
           begin

metadata

@@ -1,55 +1,62 @@
 --- !ruby/object:Gem::Specification
 name: pcp-client
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.0
+  prerelease: 
 platform: ruby
 authors:
 - Puppet Labs
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-04-06 00:00:00.000000000 Z
+date: 2016-04-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: eventmachine
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.2'
 - !ruby/object:Gem::Dependency
   name: faye-websocket
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.10'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.10'
 - !ruby/object:Gem::Dependency
   name: rschema
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '1.3'
 description: See https://github.com/puppetlabs/pcp-specifications
@@ -58,34 +65,34 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- lib/pcp.rb
 - lib/pcp/client.rb
 - lib/pcp/message.rb
 - lib/pcp/protocol.rb
 - lib/pcp/simple_logger.rb
+- lib/pcp.rb
 homepage: https://github.com/puppetlabs/ruby-pcp-client
 licenses:
 - ASL 2.0
-metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
-  - - ">="
+  - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
-  - - ">="
+  - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.5
+rubygems_version: 1.8.23.2
 signing_key: 
-specification_version: 4
+specification_version: 3
 summary: Client library for PCP
 test_files: []
-has_rdoc: 

checksums.yaml

@@ -1,7 +0,0 @@
----
-SHA1:
-  metadata.gz: 8e54ff97949557ad0a4e596e76413517081ccd81
-  data.tar.gz: a0cea4f3e5409621326c214867455342bb268a55
-SHA512:
-  metadata.gz: 90899dbd9a381d8e9fcdc43a679fb17667c60e354e7a8b8f2b1d0e31e565c5454b9d3d5b4243bea3df85d706e15798afc33c4326b2bedc995d050b7e9f556e2f
-  data.tar.gz: 43ed81721fbfd41efefd81c7c929b5da7ac464fbe174b2b19ef4f9ad1ae8433cd6e6d2c7133f30d6d1fab660227e20f799f07d5b4e9c700f850881032da41eef