Module: Falcon::Environment::TLS

Defined in:
lib/falcon/environment/tls.rb

Overview

Provides an environment that exposes a TLS context for hosting a secure web application.

Instance Method Summary collapse

Instance Method Details

#ssl_certificate ⇒ Object

The main certificate.



39
40
41
 
# File 'lib/falcon/environment/tls.rb', line 39

def ssl_certificate
  ssl_certificates[0]
end

#ssl_certificate_chain ⇒ Object

The certificate chain.



45
46
47
 
# File 'lib/falcon/environment/tls.rb', line 45

def ssl_certificate_chain
  ssl_certificates[1..-1]
end

#ssl_certificate_path ⇒ Object

The public certificate path.



27
28
29
 
# File 'lib/falcon/environment/tls.rb', line 27

def ssl_certificate_path
  File.expand_path("ssl/certificate.pem", root)
end

#ssl_certificates ⇒ Object

The list of certificates loaded from that path.



33
34
35
 
# File 'lib/falcon/environment/tls.rb', line 33

def ssl_certificates
  OpenSSL::X509::Certificate.load_file(ssl_certificate_path)
end

#ssl_ciphers ⇒ Object

The supported ciphers.



21
22
23
 
# File 'lib/falcon/environment/tls.rb', line 21

def ssl_ciphers
  Falcon::TLS::SERVER_CIPHERS
end

#ssl_context ⇒ Object

The SSL context to use for incoming connections.



63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
 
# File 'lib/falcon/environment/tls.rb', line 63

def ssl_context
  OpenSSL::SSL::SSLContext.new.tap do |context|
    context.add_certificate(ssl_certificate, ssl_private_key, ssl_certificate_chain)
    
    context.session_cache_mode = OpenSSL::SSL::SSLContext::SESSION_CACHE_CLIENT
    context.session_id_context = ssl_session_id
    
    context.alpn_select_cb = lambda do |protocols|
      if protocols.include? "h2"
        return "h2"
      elsif protocols.include? "http/1.1"
        return "http/1.1"
      elsif protocols.include? "http/1.0"
        return "http/1.0"
      else
        return nil
      end
    end
    
    # TODO Ruby 2.4 requires using ssl_version.
    context.ssl_version = :TLSv1_2_server
    
    context.set_params(
      ciphers: ssl_ciphers,
      verify_mode: OpenSSL::SSL::VERIFY_NONE,
    )
    
    context.setup
  end
end

#ssl_private_key ⇒ Object

The private key.



57
58
59
 
# File 'lib/falcon/environment/tls.rb', line 57

def ssl_private_key
  OpenSSL::PKey::RSA.new(File.read(ssl_private_key_path))
end

#ssl_private_key_path ⇒ Object

The private key path.



51
52
53
 
# File 'lib/falcon/environment/tls.rb', line 51

def ssl_private_key_path
  File.expand_path("ssl/private.key", root)
end

#ssl_session_id ⇒ Object

The default session identifier for the session cache.



15
16
17
 
# File 'lib/falcon/environment/tls.rb', line 15

def ssl_session_id
  "falcon"
end