From ac346b5abcfa6253bd792091e5fb011774c40d49 Mon Sep 17 00:00:00 2001 From: Eric Wong Date: Wed, 7 Sep 2011 00:36:58 +0000 Subject: add preliminary SSL support This will also be the foundation of SSL support in Rainbows! and Zbatery. Some users may also want to use this in Unicorn on LANs to meet certain security/auditing requirements. Of course, Nightmare! (in whatever form) should also be able to use it. --- lib/unicorn/ssl_server.rb | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 lib/unicorn/ssl_server.rb (limited to 'lib/unicorn/ssl_server.rb') diff --git a/lib/unicorn/ssl_server.rb b/lib/unicorn/ssl_server.rb new file mode 100644 index 0000000..c00c3ae --- /dev/null +++ b/lib/unicorn/ssl_server.rb @@ -0,0 +1,42 @@ +# -*- encoding: binary -*- +# :stopdoc: +# this module is meant to be included in Unicorn::HttpServer +# It is an implementation detail and NOT meant for users. +module Unicorn::SSLServer + attr_accessor :ssl_engine + + def ssl_enable! + sni_hostnames = rack_sni_hostnames(@app) + seen = {} # we map a single SSLContext to multiple listeners + listener_ctx = {} + @listener_opts.each do |address, address_opts| + ssl_opts = address_opts[:ssl_opts] or next + listener_ctx[address] = seen[ssl_opts.object_id] ||= begin + unless sni_hostnames.empty? + ssl_opts = ssl_opts.dup + ssl_opts[:sni_hostnames] = sni_hostnames + end + ctx = Flipper.ssl_context(ssl_opts) + # FIXME: make configurable + ctx.session_cache_mode = OpenSSL::SSL::SSLContext::SESSION_CACHE_OFF + ctx + end + end + Unicorn::HttpServer::LISTENERS.each do |listener| + ctx = listener_ctx[sock_name(listener)] or next + listener.extend(Kgio::SSLServer) + listener.ssl_ctx = ctx + listener.kgio_ssl_class = Unicorn::SSLClient + end + end + + # ugh, this depends on Rack internals... + def rack_sni_hostnames(rack_app) # :nodoc: + hostnames = {} + if Rack::URLMap === rack_app + mapping = rack_app.instance_variable_get(:@mapping) + mapping.each { |hostname,_,_,_| hostnames[hostname] = true } + end + hostnames.keys + end +end -- cgit v1.2.3-24-ge0c7