class Riemann::Tools::TLSCheck::TLSCheckResult
Attributes
address[R]
tls_socket[R]
uri[R]
Public Class Methods
new(uri, address, tls_socket, checker)
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 73 def initialize(uri, address, tls_socket, checker) @uri = uri @address = address @tls_socket = tls_socket @checker = checker end
Public Instance Methods
acceptable_identities()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 96 def acceptable_identities res = [] peer_cert.extensions.each do |ext| next unless ext.oid == 'subjectAltName' ostr = OpenSSL::ASN1.decode(ext.to_der).value.last sequence = OpenSSL::ASN1.decode(ostr.value) res = sequence.value.map(&:value) end res << peer_cert.subject.to_s unless res.any? res end
check_ocsp_status()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 180 def check_ocsp_status subject = peer_cert issuer = peer_cert_chain[1] return '' unless issuer digest = OpenSSL::Digest.new('SHA1') certificate_id = OpenSSL::OCSP::CertificateId.new(subject, issuer, digest) request = OpenSSL::OCSP::Request.new request.add_certid(certificate_id) request.add_nonce authority_info_access = subject.extensions.find do |extension| extension.oid == 'authorityInfoAccess' end return '' unless authority_info_access descriptions = authority_info_access.value.split("\n") ocsp = descriptions.find do |description| description.start_with? 'OCSP' end ocsp_uri = URI(ocsp[/URI:(.*)/, 1]) http_response = ::Net::HTTP.start(ocsp_uri.hostname, ocsp_uri.port) do |http| ocsp_uri.path = '/' if ocsp_uri.path.empty? http.post(ocsp_uri.path, request.to_der, 'content-type' => 'application/ocsp-request') end response = OpenSSL::OCSP::Response.new http_response.body response_basic = response.basic return '' unless response_basic&.verify([issuer], @checker.store) response.status_string end
exception()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 88 def exception tls_socket.exception if tls_socket.respond_to?(:exception) end
expire_soonish?()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 152 def expire_soonish? utcnow + (2 * renewal_duration / 3) > not_after end
expired?()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 156 def expired? utcnow > not_after end
expired_or_expire_soon?()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 148 def expired_or_expire_soon? utcnow + (renewal_duration / 3) > not_after end
not_after()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 116 def not_after peer_cert.not_after end
not_after_ago()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 120 def not_after_ago not_after - utcnow end
not_after_ago_in_words()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 124 def not_after_ago_in_words when_from_utcnow(not_after) end
not_before()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 128 def not_before peer_cert.not_before end
not_before_away()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 132 def not_before_away utcnow - not_before end
not_before_away_in_words()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 136 def not_before_away_in_words when_from_utcnow(not_before) end
not_valid_yet?()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 112 def not_valid_yet? utcnow < not_before end
ocsp?()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 172 def ocsp? !ocsp_status.empty? end
ocsp_status()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 168 def ocsp_status @ocsp_status ||= check_ocsp_status end
peer_cert()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 80 def peer_cert tls_socket.peer_cert end
peer_cert_chain()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 84 def peer_cert_chain tls_socket.peer_cert_chain end
renewal_duration()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 144 def renewal_duration [validity_duration * @checker.opts[:renewal_duration_ratio], @checker.opts[:renewal_duration_days] * 3600 * 24].min end
trusted?()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 164 def trusted? verify_result == OpenSSL::X509::V_OK end
valid_identity?()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 92 def valid_identity? OpenSSL::SSL.verify_certificate_identity(peer_cert, uri.host) end
valid_ocsp?()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 176 def valid_ocsp? ocsp_status == 'successful' end
validity_duration()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 140 def validity_duration not_after - not_before end
verify_result()
click to toggle source
# File lib/riemann/tools/tls_check.rb, line 160 def verify_result tls_socket.verify_result end