Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for TLS SNI #440

Closed
cknowles opened this issue Oct 27, 2016 · 6 comments
Closed

Support for TLS SNI #440

cknowles opened this issue Oct 27, 2016 · 6 comments

Comments

@cknowles
Copy link

cknowles commented Oct 27, 2016

The compose.io implementation of RabbitMQ needs SNI on the TLS connection in order to verify correctly, at least on their very latest implementation. I was looking through the bunny docs and code but didn't spot any support for it. Is there any? If not I may submit the change for review.

The openssl equivalent would be along the lines of adding servername:
openssl s_client -connect HOST:PORT -servername HOST

It's undocumented but Ruby seems to support this via hostname on the SSL socket:

socket = OpenSSL::SSL::SSLSocket.new(tcp_client, ssl_context)
socket.hostname = 'HOST'
socket.connect
@michaelklishin
Copy link
Member

@c-knowles thanks. Do you know what's the earliest Ruby version to provide OpenSSL::SSL::SSLSocket#hostname?

@michaelklishin
Copy link
Member

Three Bunny classes that are relevant if you are to consider a PR:

Thank you.

@cknowles
Copy link
Author

Not sure about the versions yet, I do know it seems to have been in there since at least 2015. So if there is no support yet or planned I will likely have a go at a pull request soon, doesn't look like the changes would be that big.

@michaelklishin
Copy link
Member

We can always set that field only if the socket object responds to :hostname.

@cknowles
Copy link
Author

According to ruby/openssl#81 on the hostname setting:

Yes, it is part of the public API, since Ruby 1.9.2 (note it requires OpenSSL >= 0.9.8f).

RDoc comment was fixed some time ago, and OpenSSL::SSL::SSLSocket#hostname= 
now shows up in the latest HTML generated from the master branch:

http://ruby.github.io/openssl/OpenSSL/SSL/SSLSocket.html#method-i-hostname-3D

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants
@michaelklishin @cknowles and others