Class: Neo4j::Driver::Bolt::TlsConfig

Inherits:
Object
  • Object
show all
Defined in:
lib/neo4j/driver/bolt/tls_config.rb

Overview

Resolves the driver's URI scheme + user options into an OpenSSL::SSL::SSLContext, or nil for plaintext. Mirrors Java's TrustStrategy modes:

:system_certificates  — verify cert chain against system roots
                       + verify hostname. Default for +s schemes.
:all_certificates     — encrypted but skip both checks. Default
                       for +ssc schemes. Useful for self-signed
                       dev servers; not for production.
:custom_certificates  — verify against an explicit CA bundle.

Hostname verification rides along with peer verification — turning peer verification off (:all_certificates) implicitly turns off hostname check too, which is why +ssc exists.

Constant Summary collapse

ENCRYPTED_SCHEMES =

+s / +ssc are scheme-level encryption opt-in (mirrors Driver::ENCRYPTED_SCHEMES). +ssc additionally implies trust-all — the whole point of the "self-signed" suffix.

Driver::ENCRYPTED_SCHEMES
TRUST_ALL_SCHEMES = 
%w[bolt+ssc neo4j+ssc].freeze

Instance Method Summary collapse

Constructor Details

#initialize(uri:, options:) ⇒ TlsConfig

Returns a new instance of TlsConfig.



27
28
29
30
 
# File 'lib/neo4j/driver/bolt/tls_config.rb', line 27

def initialize(uri:, options:)
  @uri = uri
  @options = options
end

Instance Method Details

#encrypted? ⇒ Boolean

Returns:

  • (Boolean) 


43
44
45
 
# File 'lib/neo4j/driver/bolt/tls_config.rb', line 43

def encrypted?
  ENCRYPTED_SCHEMES.include?(@uri.scheme) || @options[:encryption] == true
end

#ssl_context ⇒ Object

nil ⇒ plaintext socket; SSLContext ⇒ wrap.



33
34
35
36
37
38
39
40
41
 
# File 'lib/neo4j/driver/bolt/tls_config.rb', line 33

def ssl_context
  return nil unless encrypted?

  ctx = OpenSSL::SSL::SSLContext.new
  ctx.min_version = OpenSSL::SSL::TLS1_2_VERSION
  apply_trust(ctx)
  apply_client_certificate(ctx)
  ctx
end

#verify_hostname? ⇒ Boolean

Whether the SSLSocket should verify the server hostname after the TLS handshake. False for the trust-all path; true otherwise.

Returns:

  • (Boolean) 


49
50
51
 
# File 'lib/neo4j/driver/bolt/tls_config.rb', line 49

def verify_hostname?
  encrypted? && resolved_strategy != :all_certificates
end