2015-12-16 00:07:31 -05:00
|
|
|
# frozen_string_literal: false
|
2003-08-19 02:00:36 -04:00
|
|
|
#
|
|
|
|
# ssl.rb -- SSL/TLS enhancement for GenericServer
|
|
|
|
#
|
|
|
|
# Copyright (c) 2003 GOTOU Yuuzou All rights reserved.
|
2009-03-05 22:56:38 -05:00
|
|
|
#
|
2003-08-19 02:00:36 -04:00
|
|
|
# $Id$
|
|
|
|
|
|
|
|
require 'webrick'
|
|
|
|
require 'openssl'
|
|
|
|
|
|
|
|
module WEBrick
|
|
|
|
module Config
|
|
|
|
svrsoft = General[:ServerSoftware]
|
|
|
|
osslv = ::OpenSSL::OPENSSL_VERSION.split[1]
|
2013-01-25 20:12:54 -05:00
|
|
|
|
|
|
|
##
|
|
|
|
# Default SSL server configuration.
|
|
|
|
#
|
|
|
|
# WEBrick can automatically create a self-signed certificate if
|
|
|
|
# <code>:SSLCertName</code> is set. For more information on the various
|
|
|
|
# SSL options see OpenSSL::SSL::SSLContext.
|
|
|
|
#
|
|
|
|
# :ServerSoftware ::
|
|
|
|
# The server software name used in the Server: header.
|
|
|
|
# :SSLEnable :: false,
|
|
|
|
# Enable SSL for this server. Defaults to false.
|
|
|
|
# :SSLCertificate ::
|
|
|
|
# The SSL certificate for the server.
|
|
|
|
# :SSLPrivateKey ::
|
|
|
|
# The SSL private key for the server certificate.
|
|
|
|
# :SSLClientCA :: nil,
|
|
|
|
# Array of certificates that will be sent to the client.
|
|
|
|
# :SSLExtraChainCert :: nil,
|
2013-12-25 00:10:12 -05:00
|
|
|
# Array of certificates that will be added to the certificate chain
|
2013-01-25 20:12:54 -05:00
|
|
|
# :SSLCACertificateFile :: nil,
|
|
|
|
# Path to a CA certificate file
|
|
|
|
# :SSLCACertificatePath :: nil,
|
|
|
|
# Path to a directory containing CA certificates
|
|
|
|
# :SSLCertificateStore :: nil,
|
|
|
|
# OpenSSL::X509::Store used for certificate validation of the client
|
|
|
|
# :SSLTmpDhCallback :: nil,
|
|
|
|
# Callback invoked when DH parameters are required.
|
|
|
|
# :SSLVerifyClient ::
|
|
|
|
# Sets whether the client is verified. This defaults to VERIFY_NONE
|
|
|
|
# which is typical for an HTTPS server.
|
|
|
|
# :SSLVerifyDepth ::
|
|
|
|
# Number of CA certificates to walk when verifying a certificate chain
|
|
|
|
# :SSLVerifyCallback ::
|
|
|
|
# Custom certificate verification callback
|
2017-07-07 13:09:39 -04:00
|
|
|
# :SSLServerNameCallback::
|
|
|
|
# Custom servername indication callback
|
2013-01-25 20:12:54 -05:00
|
|
|
# :SSLTimeout ::
|
|
|
|
# Maximum session lifetime
|
|
|
|
# :SSLOptions ::
|
|
|
|
# Various SSL options
|
2016-04-21 21:51:18 -04:00
|
|
|
# :SSLCiphers ::
|
|
|
|
# Ciphers to be used
|
2013-01-25 20:12:54 -05:00
|
|
|
# :SSLStartImmediately ::
|
|
|
|
# Immediately start SSL upon connection? Defaults to true
|
|
|
|
# :SSLCertName ::
|
|
|
|
# SSL certificate name. Must be set to enable automatic certificate
|
|
|
|
# creation.
|
|
|
|
# :SSLCertComment ::
|
|
|
|
# Comment used during automatic certificate creation.
|
|
|
|
|
2003-08-19 02:00:36 -04:00
|
|
|
SSL = {
|
|
|
|
:ServerSoftware => "#{svrsoft} OpenSSL/#{osslv}",
|
2005-01-10 01:29:58 -05:00
|
|
|
:SSLEnable => false,
|
2003-08-19 02:00:36 -04:00
|
|
|
:SSLCertificate => nil,
|
|
|
|
:SSLPrivateKey => nil,
|
|
|
|
:SSLClientCA => nil,
|
2003-11-01 12:30:40 -05:00
|
|
|
:SSLExtraChainCert => nil,
|
2003-08-19 02:00:36 -04:00
|
|
|
:SSLCACertificateFile => nil,
|
|
|
|
:SSLCACertificatePath => nil,
|
|
|
|
:SSLCertificateStore => nil,
|
2012-09-02 01:06:35 -04:00
|
|
|
:SSLTmpDhCallback => nil,
|
2003-08-19 02:00:36 -04:00
|
|
|
:SSLVerifyClient => ::OpenSSL::SSL::VERIFY_NONE,
|
|
|
|
:SSLVerifyDepth => nil,
|
|
|
|
:SSLVerifyCallback => nil, # custom verification
|
|
|
|
:SSLTimeout => nil,
|
|
|
|
:SSLOptions => nil,
|
2016-04-21 21:51:18 -04:00
|
|
|
:SSLCiphers => nil,
|
2003-08-19 02:00:36 -04:00
|
|
|
:SSLStartImmediately => true,
|
|
|
|
# Must specify if you use auto generated certificate.
|
|
|
|
:SSLCertName => nil,
|
|
|
|
:SSLCertComment => "Generated by Ruby/OpenSSL"
|
|
|
|
}
|
|
|
|
General.update(SSL)
|
|
|
|
end
|
|
|
|
|
|
|
|
module Utils
|
2013-01-25 20:12:54 -05:00
|
|
|
##
|
|
|
|
# Creates a self-signed certificate with the given number of +bits+,
|
|
|
|
# the issuer +cn+ and a +comment+ to be stored in the certificate.
|
|
|
|
|
2003-08-19 02:00:36 -04:00
|
|
|
def create_self_signed_cert(bits, cn, comment)
|
|
|
|
rsa = OpenSSL::PKey::RSA.new(bits){|p, n|
|
|
|
|
case p
|
|
|
|
when 0; $stderr.putc "." # BN_generate_prime
|
|
|
|
when 1; $stderr.putc "+" # BN_generate_prime
|
2009-03-05 22:56:38 -05:00
|
|
|
when 2; $stderr.putc "*" # searching good prime,
|
2003-08-19 02:00:36 -04:00
|
|
|
# n = #of try,
|
|
|
|
# but also data from BN_generate_prime
|
|
|
|
when 3; $stderr.putc "\n" # found good prime, n==0 - p, n==1 - q,
|
|
|
|
# but also data from BN_generate_prime
|
|
|
|
else; $stderr.putc "*" # BN_generate_prime
|
|
|
|
end
|
|
|
|
}
|
|
|
|
cert = OpenSSL::X509::Certificate.new
|
2010-07-30 19:26:53 -04:00
|
|
|
cert.version = 2
|
|
|
|
cert.serial = 1
|
2016-05-07 09:37:18 -04:00
|
|
|
name = (cn.kind_of? String) ? OpenSSL::X509::Name.parse(cn)
|
|
|
|
: OpenSSL::X509::Name.new(cn)
|
2003-08-19 02:00:36 -04:00
|
|
|
cert.subject = name
|
|
|
|
cert.issuer = name
|
|
|
|
cert.not_before = Time.now
|
|
|
|
cert.not_after = Time.now + (365*24*60*60)
|
|
|
|
cert.public_key = rsa.public_key
|
|
|
|
|
|
|
|
ef = OpenSSL::X509::ExtensionFactory.new(nil,cert)
|
|
|
|
ef.issuer_certificate = cert
|
|
|
|
cert.extensions = [
|
|
|
|
ef.create_extension("basicConstraints","CA:FALSE"),
|
2020-04-02 11:49:12 -04:00
|
|
|
ef.create_extension("keyUsage", "keyEncipherment, digitalSignature, keyAgreement, dataEncipherment"),
|
2003-08-19 02:00:36 -04:00
|
|
|
ef.create_extension("subjectKeyIdentifier", "hash"),
|
|
|
|
ef.create_extension("extendedKeyUsage", "serverAuth"),
|
|
|
|
ef.create_extension("nsComment", comment),
|
|
|
|
]
|
|
|
|
aki = ef.create_extension("authorityKeyIdentifier",
|
|
|
|
"keyid:always,issuer:always")
|
|
|
|
cert.add_extension(aki)
|
2018-12-02 23:51:08 -05:00
|
|
|
cert.sign(rsa, OpenSSL::Digest::SHA256.new)
|
2003-08-19 02:00:36 -04:00
|
|
|
|
|
|
|
return [ cert, rsa ]
|
|
|
|
end
|
|
|
|
module_function :create_self_signed_cert
|
|
|
|
end
|
|
|
|
|
2013-01-25 20:12:54 -05:00
|
|
|
##
|
|
|
|
#--
|
|
|
|
# Updates WEBrick::GenericServer with SSL functionality
|
|
|
|
|
2003-08-19 02:00:36 -04:00
|
|
|
class GenericServer
|
2013-01-25 20:12:54 -05:00
|
|
|
|
|
|
|
##
|
|
|
|
# SSL context for the server when run in SSL mode
|
|
|
|
|
|
|
|
def ssl_context # :nodoc:
|
2017-07-17 21:59:28 -04:00
|
|
|
@ssl_context ||= begin
|
|
|
|
if @config[:SSLEnable]
|
|
|
|
ssl_context = setup_ssl_context(@config)
|
|
|
|
@logger.info("\n" + @config[:SSLCertificate].to_text)
|
|
|
|
ssl_context
|
|
|
|
end
|
|
|
|
end
|
2003-08-19 02:00:36 -04:00
|
|
|
end
|
|
|
|
|
2010-01-17 00:31:52 -05:00
|
|
|
undef listen
|
2013-01-25 20:12:54 -05:00
|
|
|
|
|
|
|
##
|
|
|
|
# Updates +listen+ to enable SSL when the SSL configuration is active.
|
|
|
|
|
|
|
|
def listen(address, port) # :nodoc:
|
2015-01-02 01:53:12 -05:00
|
|
|
listeners = Utils::create_listeners(address, port)
|
2003-08-19 02:00:36 -04:00
|
|
|
if @config[:SSLEnable]
|
|
|
|
listeners.collect!{|svr|
|
|
|
|
ssvr = ::OpenSSL::SSL::SSLServer.new(svr, ssl_context)
|
|
|
|
ssvr.start_immediately = @config[:SSLStartImmediately]
|
|
|
|
ssvr
|
|
|
|
}
|
|
|
|
end
|
|
|
|
@listeners += listeners
|
2014-11-10 06:05:00 -05:00
|
|
|
setup_shutdown_pipe
|
2003-08-19 02:00:36 -04:00
|
|
|
end
|
|
|
|
|
2013-01-25 20:12:54 -05:00
|
|
|
##
|
|
|
|
# Sets up an SSL context for +config+
|
|
|
|
|
|
|
|
def setup_ssl_context(config) # :nodoc:
|
2003-08-19 02:00:36 -04:00
|
|
|
unless config[:SSLCertificate]
|
|
|
|
cn = config[:SSLCertName]
|
|
|
|
comment = config[:SSLCertComment]
|
2018-12-02 23:51:08 -05:00
|
|
|
cert, key = Utils::create_self_signed_cert(2048, cn, comment)
|
2003-08-19 02:00:36 -04:00
|
|
|
config[:SSLCertificate] = cert
|
|
|
|
config[:SSLPrivateKey] = key
|
|
|
|
end
|
|
|
|
ctx = OpenSSL::SSL::SSLContext.new
|
|
|
|
ctx.key = config[:SSLPrivateKey]
|
|
|
|
ctx.cert = config[:SSLCertificate]
|
|
|
|
ctx.client_ca = config[:SSLClientCA]
|
2003-11-01 12:30:40 -05:00
|
|
|
ctx.extra_chain_cert = config[:SSLExtraChainCert]
|
2003-08-19 02:00:36 -04:00
|
|
|
ctx.ca_file = config[:SSLCACertificateFile]
|
|
|
|
ctx.ca_path = config[:SSLCACertificatePath]
|
|
|
|
ctx.cert_store = config[:SSLCertificateStore]
|
2012-09-01 16:46:31 -04:00
|
|
|
ctx.tmp_dh_callback = config[:SSLTmpDhCallback]
|
2003-08-19 02:00:36 -04:00
|
|
|
ctx.verify_mode = config[:SSLVerifyClient]
|
|
|
|
ctx.verify_depth = config[:SSLVerifyDepth]
|
|
|
|
ctx.verify_callback = config[:SSLVerifyCallback]
|
2017-07-07 13:09:39 -04:00
|
|
|
ctx.servername_cb = config[:SSLServerNameCallback] || proc { |args| ssl_servername_callback(*args) }
|
2003-08-19 02:00:36 -04:00
|
|
|
ctx.timeout = config[:SSLTimeout]
|
|
|
|
ctx.options = config[:SSLOptions]
|
2016-04-21 21:51:18 -04:00
|
|
|
ctx.ciphers = config[:SSLCiphers]
|
2003-08-19 02:00:36 -04:00
|
|
|
ctx
|
|
|
|
end
|
2017-07-07 13:09:39 -04:00
|
|
|
|
|
|
|
##
|
|
|
|
# ServerNameIndication callback
|
|
|
|
|
|
|
|
def ssl_servername_callback(sslsocket, hostname = nil)
|
|
|
|
# default
|
|
|
|
end
|
|
|
|
|
2003-08-19 02:00:36 -04:00
|
|
|
end
|
|
|
|
end
|