search

elastic / ruby-lumberjack

Ruby lumberjack protocol, contains both client and server
Other
4 stars 17 forks source link

Enforcing `VERIFY_PEER` on the client #5

Closed ph closed 9 years ago

ph commented 9 years ago

The ruby client did not enforce the validation of the certificate, opening possible man in the middle attacks on the client. This PR make sure that the verify_mode is set to VERIFY_PEER and add the certificate to the store for this specific connection. An integration test was added to validate this change.

This change makes the ruby client handling of connection closer to the logstash-forwarder behavior, which does the verify peer per default.

Fixes #4

ph commented 9 years ago

Small cleanups in the dependencies and how we specify the files in the gemspec.

ph commented 9 years ago

Thanks @jsvd for the comment, I'll do a bit more thinking.

jordansissel commented 9 years ago

Added some inline comments. Tests pass (bundle exec rspec) once the lib/ part is removed as I commented.

Let's get expected-rejection cases added also (client connects to a server that is not trusted, etc)

ph commented 9 years ago

@jordansissel I have added another test to cover a not trusted server. This PR requires a new release of ruby-flores with https://github.com/jordansissel/ruby-flores/pull/3

ph commented 9 years ago

updated with @jordansissel comments.

jordansissel commented 9 years ago

Tests passing.