Skip to content

Use File.exist?, restoring TLS certificate verification - #177

Open
nabramovitz wants to merge 1 commit into
stompgem:devfrom
nabramovitz:use-file-exist
Open

Use File.exist?, restoring TLS certificate verification#177
nabramovitz wants to merge 1 commit into
stompgem:devfrom
nabramovitz:use-file-exist

Conversation

@nabramovitz

Copy link
Copy Markdown

Fixes #176.

File.exists? is not present on current Ruby, so the three guards in
Connection#open_ssl_socket raise NoMethodError before a socket is
opened.

The first of them is the only path that sets VERIFY_PEER — everything
else in open_ssl_socket runs with the ctx.verify_mode = VERIFY_NONE set
at the top — so on current Ruby, passing a trust store through
SSLParams(:ts_files) does not merely fail to verify, it raises, and the
only reachable option is an unverified TLS connection. The other two guards
affect cert_file and key_file the same way.

exist? has been the spelling since 1.9 and exists? was only ever an
alias, so this changes nothing on older Rubies.

Verified

Two RabbitMQ 4.2.9 brokers, both holding certificates from the same
throwaway CA — one issued to localhost, one to wrong.example.invalid:

before:  SSLParams(ts_files: ca) -> NoMethodError, both brokers

after:   SSLParams(ts_files: ca) -> connects to localhost
                                    refuses wrong.example.invalid
                                    (hostname does not match)
         ssl: true               -> accepts both, unchanged and as documented

Ruby 3.3.11, stomp 1.4.10.

File.exists? is not present on current Ruby, so the three guards in
open_ssl_socket raise NoMethodError before a socket is opened.

The first of them is the only path that sets VERIFY_PEER - everything
else in open_ssl_socket runs with the ctx.verify_mode = VERIFY_NONE set
at the top - so on current Ruby, passing a trust store through
SSLParams(:ts_files) does not merely fail to verify, it raises, and the
only reachable option is an unverified TLS connection. The other two
guards affect cert_file and key_file the same way.

exist? has been the spelling since 1.9 and exists? was only ever an
alias, so this changes nothing on older Rubies.

Verified against two RabbitMQ 4.2.9 brokers, both holding certificates
from the same throwaway CA - one issued to localhost, one to
wrong.example.invalid:

  before: SSLParams(ts_files: ca) -> NoMethodError, both brokers
  after:  SSLParams(ts_files: ca) -> connects to localhost,
                                     refuses wrong.example.invalid
                                     (hostname does not match)
  ssl: true is unchanged - it accepts both, as documented.

Refs stompgem#176
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SSLParams ts_files raises NoMethodError on current Ruby (File.exists? removed), leaving TLS unverifiable

2 participants