From 70c32cffd3f43601339813231dc550a7ffe73e72 Mon Sep 17 00:00:00 2001 From: Norman Abramovitz Date: Mon, 24 Aug 2026 08:57:29 -0700 Subject: [PATCH] Use File.exist?, restoring TLS certificate verification File.exists? is not present on current Ruby, so the three guards in open_ssl_socket raise NoMethodError before a socket is opened. The first of them is the only path that sets VERIFY_PEER - everything else in open_ssl_socket runs with the ctx.verify_mode = VERIFY_NONE set at the top - so on current Ruby, passing a trust store through SSLParams(:ts_files) does not merely fail to verify, it raises, and the only reachable option is an unverified TLS connection. The other two guards affect cert_file and key_file the same way. exist? has been the spelling since 1.9 and exists? was only ever an alias, so this changes nothing on older Rubies. Verified against two RabbitMQ 4.2.9 brokers, both holding certificates from the same throwaway CA - one issued to localhost, one to wrong.example.invalid: before: SSLParams(ts_files: ca) -> NoMethodError, both brokers after: SSLParams(ts_files: ca) -> connects to localhost, refuses wrong.example.invalid (hostname does not match) ssl: true is unchanged - it accepts both, as documented. Refs #176 --- lib/connection/netio.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/connection/netio.rb b/lib/connection/netio.rb index 602767d..acb0112 100644 --- a/lib/connection/netio.rb +++ b/lib/connection/netio.rb @@ -368,7 +368,7 @@ def open_ssl_socket() fl = @ssl.ts_files.split(",") fl.each do |fn| # Add next cert file listed - raise Stomp::Error::SSLNoTruststoreFileError if !File::exists?(fn) + raise Stomp::Error::SSLNoTruststoreFileError if !File::exist?(fn) raise Stomp::Error::SSLUnreadableTruststoreFileError if !File::readable?(fn) truststores.add_file(fn) end @@ -386,7 +386,7 @@ def open_ssl_socket() raise Stomp::Error::SSLClientParamsError if !@ssl.cert_file.nil? && @ssl.key_file.nil? && @ssl.key_text.nil? if @ssl.cert_file - raise Stomp::Error::SSLNoCertFileError if !File::exists?(@ssl.cert_file) + raise Stomp::Error::SSLNoCertFileError if !File::exist?(@ssl.cert_file) raise Stomp::Error::SSLUnreadableCertFileError if !File::readable?(@ssl.cert_file) p [ "OSSL51", "old code cert file read" ] if ossdbg usecert = OpenSSL::X509::Certificate.new(File.read(@ssl.cert_file)) @@ -403,7 +403,7 @@ def open_ssl_socket() raise Stomp::Error::SSLClientParamsError if !@ssl.key_text.nil? && !@ssl.key_file.nil? if @ssl.key_file - raise Stomp::Error::SSLNoKeyFileError if !File::exists?(@ssl.key_file) + raise Stomp::Error::SSLNoKeyFileError if !File::exist?(@ssl.key_file) raise Stomp::Error::SSLUnreadableKeyFileError if !File::readable?(@ssl.key_file) p [ "OSSL53", "old code key file read" ] if ossdbg usekey = OpenSSL::PKey::RSA.new(File.read(@ssl.key_file), @ssl.key_password)