ssl_allow_cname 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 94970aaf1f5def94d7513dd3cfc75a629b62bc37
-  data.tar.gz: 1231561a89078951f38f22a70c69cba9d1cde2e4
+  metadata.gz: cd9a1a0a538978860ac3c85759c5b63e123353e1
+  data.tar.gz: 38374a3700d5292652387643fcc9ad404faed984
 SHA512:
-  metadata.gz: 219e861ce7dd2a7f71998eaa62b7f387e66b123c4d23c0bd0dca6b8da248b4747dd40ad9f3713928602e1152a230b7892d0bf6b58efa2d9b8aff4b4f960f6b98
-  data.tar.gz: 01d586e2c6c20c9a804a9f8db3a0baca695e6b9869fccfdc49b4615f247f4e78d60fe6a283c2bc8a3e7d9a7550fa3eabfe8687a62b95ba97dcfd8ddc95253331
+  metadata.gz: cbaa6fd49e2bd2d432e021726a31601e3a31d1e4c993784370230ce228142f2ed39c99120df3e8ef6ccc1bad93b370f654b8d70e1e0d37ae23de3550b5949aa1
+  data.tar.gz: 651865332f539e2aa1db220ff46eb45d58dc7eb9326bb8f92c5e55f961505d5e2608dcd8a68e67349f2ff88a65dd16681f3010e69609a3f10061332225a267cd

data/lib/ssl_allow_cname.rb

@@ -2,33 +2,43 @@ require "ssl_allow_cname/version"
 require 'openssl'
 
 module SslAllowCname
-  module MonkeyPatch
+  module SSLContext
+    attr_accessor :allow_cname
+  end
 
-    module_function
-    def verify_hostname(hostname, san)
-      return @allow_cname ? verify_allow_cname(hostname, san)
-                          : super
-    end
+  module SSLSocket
+    def post_connection_check(hostname)
+      return super if context.allow_cname.nil?
+
+      cname = peer_cert.subject.to_a.map do |oid, value|
+        oid == 'CN' ? value : nil
+      end.compact.first
 
-    def verify_allow_cname(hostname, san)
-      Array(@allow_cname).each do |test|
+      passed = Array(context.allow_cname).any? do |test|
         case test
-          when String
-            return true if san == test
-          when Regexp
-            return true if test.match(san)
-          when Proc
-            result = (test.arity == 1) ? test.call(san)
-                                       : test.call(san, hostname)
-            return true if result
+        when String, Regexp
+          test === cname
+        when Proc
+          (test.arity == 1) ? test.call(cname)
+                            : test.call(cname, hostname)
+        when :match
+          begin
+            super
+            true
+          rescue SSLError
+            false
+          end
         end
       end
-      return false
+
+      unless passed
+        fail OpenSSL::SSL::SSLError, "Peer certificate did not match any " +
+                                     "predicate in :allow_cname.  Use :match " +
+                                     "to get normal CommonName/Host validation"
+      end
     end
   end
 end
 
-class OpenSSL::SSL::SSLContext
-  attr_accessor :allow_cname
-  prepend SslAllowCname::MonkeyPatch
-end
+OpenSSL::SSL::SSLContext.prepend(SslAllowCname::SSLContext)
+OpenSSL::SSL::SSLSocket.prepend(SslAllowCname::SSLSocket)

data/lib/ssl_allow_cname/version.rb

@@ -1,3 +1,3 @@
 module SslAllowCname
-  VERSION = "0.1.2"
+  VERSION = "0.1.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ssl_allow_cname
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - Mike A. Owens