Class: Mongo::Socket::SSL Private

# File 'lib/mongo/socket/ssl.rb', line 124

attr_reader :host

# File 'lib/mongo/socket/ssl.rb', line 127

attr_reader :host_name

# File 'lib/mongo/socket/ssl.rb', line 130

attr_reader :port

# File 'lib/mongo/socket/ssl.rb', line 280

def verify_certificate?
  # If ssl_verify_certificate is not present, disable only if
  # ssl_verify is explicitly set to false.
  if options[:ssl_verify_certificate].nil?
    options[:ssl_verify] != false
  # If ssl_verify_certificate is present, enable or disable based on its value.
  else
    !!options[:ssl_verify_certificate]
  end
end

# File 'lib/mongo/socket/ssl.rb', line 291

def verify_hostname?
  # If ssl_verify_hostname is not present, disable only if ssl_verify is
  # explicitly set to false.
  if options[:ssl_verify_hostname].nil?
    options[:ssl_verify] != false
  # If ssl_verify_hostname is present, enable or disable based on its value.
  else
    !!options[:ssl_verify_hostname]
  end
end

# File 'lib/mongo/socket/ssl.rb', line 302

def verify_ocsp_endpoint?
  if !options[:ssl_verify_ocsp_endpoint].nil?
    options[:ssl_verify_ocsp_endpoint] != false
  elsif !options[:ssl_verify_certificate].nil?
    options[:ssl_verify_certificate] != false
  else
    options[:ssl_verify] != false
  end
end

# File 'lib/mongo/socket/ssl.rb', line 221

def connect_tcp_socket_with_timeout(sockaddr, deadline, connect_timeout)
  if deadline <= Utils.monotonic_time
    raise Error::SocketTimeoutError, "The socket took over #{connect_timeout} seconds to connect"
  end

  begin
    @tcp_socket.connect_nonblock(sockaddr)
  rescue IO::WaitWritable
    with_select_timeout(deadline, connect_timeout) do |select_timeout|
      IO.select(nil, [ @tcp_socket ], nil, select_timeout)
    end
    retry
  rescue Errno::EISCONN
    # Socket is connected, nothing to do.
  end
end

# File 'lib/mongo/socket/ssl.rb', line 211

def connect_with_timeout(sockaddr, connect_timeout)
  if connect_timeout <= 0
    raise Error::SocketTimeoutError, "The socket took over #{connect_timeout} seconds to connect"
  end

  deadline = Utils.monotonic_time + connect_timeout
  connect_tcp_socket_with_timeout(sockaddr, deadline, connect_timeout)
  connnect_ssl_socket_with_timeout(deadline, connect_timeout)
end

# File 'lib/mongo/socket/ssl.rb', line 199

def connect_without_timeout(sockaddr)
  @tcp_socket.connect(sockaddr)
  @socket = OpenSSL::SSL::SSLSocket.new(@tcp_socket, context)
  @socket.hostname = @host_name
  @socket.sync_close = true
  @socket.connect
end

# File 'lib/mongo/socket/ssl.rb', line 238

def connnect_ssl_socket_with_timeout(deadline, connect_timeout)
  if deadline <= Utils.monotonic_time
    raise Error::SocketTimeoutError, "The socket took over #{connect_timeout} seconds to connect"
  end

  @socket = OpenSSL::SSL::SSLSocket.new(@tcp_socket, context)
  @socket.hostname = @host_name
  @socket.sync_close = true

  # We still have time, connecting ssl socket.
  begin
    @socket.connect_nonblock
  rescue IO::WaitReadable, OpenSSL::SSL::SSLErrorWaitReadable
    with_select_timeout(deadline, connect_timeout) do |select_timeout|
      IO.select([ @socket ], nil, nil, select_timeout)
    end
    retry
  rescue IO::WaitWritable, OpenSSL::SSL::SSLErrorWaitWritable
    with_select_timeout(deadline, connect_timeout) do |select_timeout|
      IO.select(nil, [ @socket ], nil, select_timeout)
    end
    retry
  rescue Errno::EISCONN
    # Socket is connected, nothing to do
  end
end

# File 'lib/mongo/socket/ssl.rb', line 312

def create_context(options)
  OpenSSL::SSL::SSLContext.new.tap do |context|
    if OpenSSL::SSL.const_defined?(:OP_NO_RENEGOTIATION)
      context.options = context.options | OpenSSL::SSL::OP_NO_RENEGOTIATION
    end

    if context.respond_to?(:renegotiation_cb=)
      # Disable renegotiation for older Ruby versions per the sample code at
      # https://rubydocs.org/d/ruby-2-6-0/classes/OpenSSL/SSL/SSLContext.html
      # In JRuby we must allow one call as this callback is invoked for
      # the initial connection also, not just for renegotiations -
      # https://github.com/jruby/jruby-openssl/issues/180
      allowed_calls = if BSON::Environment.jruby?
                        1
                      else
                        0
                      end
      context.renegotiation_cb = lambda do |_ssl|
        raise 'Client renegotiation disabled' if allowed_calls <= 0

        allowed_calls -= 1
      end
    end

    set_cert(context, options)
    set_key(context, options)

    if verify_certificate?
      context.verify_mode = OpenSSL::SSL::VERIFY_PEER
      set_cert_verification(context, options)
    else
      context.verify_mode = OpenSSL::SSL::VERIFY_NONE
    end

    if context.respond_to?(:verify_hostname=)
      # We manually check the hostname after the connection is established if necessary, so
      # we disable it here in order to give consistent errors across Ruby versions which
      # don't support hostname verification at the time of the handshake.
      context.verify_hostname = OpenSSL::SSL::VERIFY_NONE
    end
  end
end

# File 'lib/mongo/socket/ssl.rb', line 496

def extract_certs(text)
  [].tap do |list|
    pos = 0

    while (begin_idx = text.index(BEGIN_CERT, pos))
      end_idx = text.index(END_CERT, begin_idx)
      break unless end_idx

      end_idx += END_CERT.length
      list.push(text[begin_idx...end_idx])

      pos = end_idx
    end
  end
end

# File 'lib/mongo/socket/ssl.rb', line 513

def find_issuer(cert, cert_chain)
  cert_chain.find { |c| c.subject == cert.issuer }
end

# File 'lib/mongo/socket/ssl.rb', line 481

def human_address
  "#{host}:#{port} (#{host_name}:#{port}, TLS)"
end

# File 'lib/mongo/socket/ssl.rb', line 414

def load_private_key(text, passphrase)
  args = if passphrase
           [ text, passphrase ]
         else
           [ text ]
         end
  # On JRuby, PKey.read does not grok cert+key bundles.
  # https://github.com/jruby/jruby-openssl/issues/176
  if BSON::Environment.jruby?
    [ OpenSSL::PKey::RSA, OpenSSL::PKey::DSA ].each do |cls|
      return cls.send(:new, *args)
    rescue OpenSSL::PKey::PKeyError
      # ignore
    end
    # Neither RSA nor DSA worked, fall through to trying PKey
  end
  OpenSSL::PKey.send(:read, *args)
end

# File 'lib/mongo/socket/ssl.rb', line 475

def read_buffer_size
  # Buffer size for TLS reads.
  # Capped at 16k due to https://linux.die.net/man/3/ssl_read
  16_384
end

# File 'lib/mongo/socket/ssl.rb', line 187

def readbyte
  map_exceptions do
    byte = socket.read(1).bytes.to_a[0]
    byte.nil? ? raise(EOFError) : byte
  end
end

# File 'lib/mongo/socket/ssl.rb', line 485

def run_tls_context_hooks
  Mongo.tls_context_hooks.each do |hook|
    hook.call(@context)
  end
end

# File 'lib/mongo/socket/ssl.rb', line 355

def set_cert(context, options)
  # Since we clear cert_text during processing, we need to examine
  # ssl_cert_object here to avoid considering it if we have also
  # processed the text.
  if options[:ssl_cert]
    cert_text = File.read(options[:ssl_cert])
    cert_object = nil
  elsif cert_text = options[:ssl_cert_string]
    cert_object = nil
  else
    cert_object = options[:ssl_cert_object]
  end

  # The client certificate may be a single certificate or a bundle
  # (client certificate followed by intermediate certificates).
  # The text may also include private keys for the certificates.
  # OpenSSL supports passing the entire bundle as a certificate chain
  # to the context via SSL_CTX_use_certificate_chain_file, but the
  # Ruby openssl extension does not currently expose this functionality
  # per https://github.com/ruby/openssl/issues/254.
  # Therefore, extract the individual certificates from the certificate
  # text, and if there is more than one certificate provided, use
  # extra_chain_cert option to add the intermediate ones. This
  # implementation is modeled after
  # https://github.com/venuenext/ruby-kafka/commit/9495f5daf254b43bc88062acad9359c5f32cb8b5.
  # Note that the parsing here is not identical to what OpenSSL employs -
  # for instance, if there is no newline between two certificates
  # this code will extract them both but OpenSSL fails in this situation.
  if cert_text
    certs = extract_certs(cert_text)
    if certs.length > 1
      context.cert = OpenSSL::X509::Certificate.new(certs.shift)
      context.extra_chain_cert = certs.map do |cert|
        OpenSSL::X509::Certificate.new(cert)
      end
      # All certificates are already added to the context, skip adding
      # them again below.
      cert_text = nil
    end
  end

  if cert_text
    context.cert = OpenSSL::X509::Certificate.new(cert_text)
  elsif cert_object
    context.cert = cert_object
  end
end

# File 'lib/mongo/socket/ssl.rb', line 433

def set_cert_verification(context, options)
  context.verify_mode = OpenSSL::SSL::VERIFY_PEER
  cert_store = OpenSSL::X509::Store.new
  if options[:ssl_ca_cert]
    cert_store.add_file(options[:ssl_ca_cert])
  elsif options[:ssl_ca_cert_string]
    cert_store.add_cert(OpenSSL::X509::Certificate.new(options[:ssl_ca_cert_string]))
  elsif options[:ssl_ca_cert_object]
    unless options[:ssl_ca_cert_object].is_a? Array
      raise TypeError('Option :ssl_ca_cert_object should be an array of OpenSSL::X509:Certificate objects')
    end

    options[:ssl_ca_cert_object].each { |cert| cert_store.add_cert(cert) }
  else
    cert_store.set_default_paths
  end
  context.cert_store = cert_store
end

# File 'lib/mongo/socket/ssl.rb', line 403

def set_key(context, options)
  passphrase = options[:ssl_key_pass_phrase]
  if options[:ssl_key]
    context.key = load_private_key(File.read(options[:ssl_key]), passphrase)
  elsif options[:ssl_key_string]
    context.key = load_private_key(options[:ssl_key_string], passphrase)
  elsif options[:ssl_key_object]
    context.key = options[:ssl_key_object]
  end
end

# File 'lib/mongo/socket/ssl.rb', line 452

def verify_certificate!(socket)
  return unless verify_hostname?
  return if OpenSSL::SSL.verify_certificate_identity(socket.peer_cert, host_name)

  raise Error::SocketError, 'TLS handshake failed due to a hostname mismatch.'
end

# File 'lib/mongo/socket/ssl.rb', line 459

def verify_ocsp_endpoint!(socket, timeout = nil)
  return unless verify_ocsp_endpoint?

  cert = socket.peer_cert
  ca_cert = find_issuer(cert, socket.peer_cert_chain)

  unless ca_cert
    log_warn("TLS certificate of '#{host_name}' could not be definitively verified via OCSP: issuer certificate not found in the chain.")
    return
  end

  verifier = OcspVerifier.new(@host_name, cert, ca_cert, context.cert_store,
                              **Utils.shallow_symbolize_keys(options), timeout: timeout)
  verifier.verify_with_cache
end

# File 'lib/mongo/socket/ssl.rb', line 268

def with_select_timeout(deadline, connect_timeout)
  select_timeout = deadline - Utils.monotonic_time
  if select_timeout <= 0
    raise Error::SocketTimeoutError, "The socket took over #{connect_timeout} seconds to connect"
  end

  rv = yield(select_timeout)
  return unless rv.nil?

  raise Error::SocketTimeoutError, "The socket took over #{connect_timeout} seconds to connect"
end