From: Patrick Higgins Date: 2011-04-16T09:21:23+09:00 Subject: [ruby-core:35781] Patch to Net::HTTP to allow overriding SSL certificate hostname verification --0-1763820894-1302912785=:77274 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable I have a need to connect to an https server using Net::HTTP which=0A(incorr= ectly) returns a wildcard certificate that matches close enough=0Afor me th= at I wish to allow it without completely disabling peer=0Averification, whi= ch is too insecure for my needs. I would really like=0Ato see the server fi= x their problem, but as a client my hands are=0Atied.=0A=0AThe attached pat= ch to Net::HTTP against the ruby_1_9_2 branch allows=0Ame to override the h= ostname verification in the way that I need. See=0Ahttps://gist.github.com/= 922585 for an example usage.=0A=0AI removed @enable_post_connection_check i= n my patch because it=A0appears=0Ato be unused.=0A=0AIs there a chance of g= etting this into the Ruby 1.9.x and perhaps Ruby=0A1.8.x?=0A=0AWithout this= patch, the only way I have found to do this is a nasty=0Amonkey-patch to O= penSSL::SSL.verify_certificate_identity, which=0Achanges the behavior for t= he entire process, not just the connections=0AI am interested in.=0A=0AThe = monkey patch can be found at https://gist.github.com/922579=0A=0AChangeLog = entry:=0A=0AFri Apr 14 16:35:00 2011 =A0Patrick Higgins =A0=0A=0A=A0 =A0 =A0 =A0 * lib/net/http.rb: Added Net::HTTP#ssl_hostnam= e_verify attribute to=0A=A0 =A0 =A0 =A0 =A0 allow customized certificate ho= stname validation.=0A --0-1763820894-1302912785=:77274 Content-Type: application/octet-stream; name="net_http_ssl_hostname_verify.patch" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="net_http_ssl_hostname_verify.patch" SW5kZXg6IGxpYi9uZXQvaHR0cC5yYgo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBsaWIvbmV0L2h0dHAucmIJKHJldmlzaW9uIDMxMjkxKQorKysgbGli L25ldC9odHRwLnJiCSh3b3JraW5nIGNvcHkpCkBAIC01MjAsNyArNTIwLDYg QEAKICAgICAgIEBkZWJ1Z19vdXRwdXQgPSBuaWwKICAgICAgIEB1c2Vfc3Ns ID0gZmFsc2UKICAgICAgIEBzc2xfY29udGV4dCA9IG5pbAotICAgICAgQGVu YWJsZV9wb3N0X2Nvbm5lY3Rpb25fY2hlY2sgPSB0cnVlCiAgICAgICBAY29t cHJlc3Npb24gPSBuaWwKICAgICAgIEBzc3BpX2VuYWJsZWQgPSBmYWxzZQog ICAgICAgaWYgZGVmaW5lZD8oU1NMX0FUVFJJQlVURVMpCkBAIC01MzAsNiAr NTI5LDExIEBACiAgICAgICBlbmQKICAgICBlbmQKIAorICAgICMgc2V0IHRo aXMgdG8gYSBmdW5jdGlvbiB0YWtpbmcgdGhlIHBlZXIgY2VydGlmaWNhdGUg YW5kIGhvc3RuYW1lIGFuZAorICAgICMgcmV0dXJuaW5nIHRydWUgaWYgdGhl IGhvc3RuYW1lIHNob3VsZCBiZSBhbGxvd2VkIGZvciB0aGUgY2VydGlmaWNh dGUKKyAgICAjIGFuZCByYWlzZXMgYW4gT3BlblNTTDo6U1NMOjpTU0xFcnJv ciBpZiBub3QuCisgICAgYXR0cl9hY2Nlc3NvciA6c3NsX2hvc3RuYW1lX3Zl cmlmeQorCiAgICAgZGVmIGluc3BlY3QKICAgICAgICIjPCN7c2VsZi5jbGFz c30gI3tAYWRkcmVzc306I3tAcG9ydH0gb3Blbj0je3N0YXJ0ZWQ/fT4iCiAg ICAgZW5kCkBAIC02NzcsNyArNjgxLDExIEBACiAgICAgICAgICAgZW5kCiAg ICAgICAgICAgdGltZW91dChAb3Blbl90aW1lb3V0KSB7IHMuY29ubmVjdCB9 CiAgICAgICAgICAgaWYgQHNzbF9jb250ZXh0LnZlcmlmeV9tb2RlICE9IE9w ZW5TU0w6OlNTTDo6VkVSSUZZX05PTkUKLSAgICAgICAgICAgIHMucG9zdF9j b25uZWN0aW9uX2NoZWNrKEBhZGRyZXNzKQorICAgICAgICAgICAgaWYgQHNz bF9ob3N0bmFtZV92ZXJpZnkKKyAgICAgICAgICAgICAgQHNzbF9ob3N0bmFt ZV92ZXJpZnkuY2FsbChzLnBlZXJfY2VydCwgQGFkZHJlc3MpCisgICAgICAg ICAgICBlbHNlCisgICAgICAgICAgICAgIHMucG9zdF9jb25uZWN0aW9uX2No ZWNrKEBhZGRyZXNzKQorICAgICAgICAgICAgZW5kCiAgICAgICAgICAgZW5k CiAgICAgICAgIHJlc2N1ZSA9PiBleGNlcHRpb24KICAgICAgICAgICBEICJD b25uIGNsb3NlIGJlY2F1c2Ugb2YgY29ubmVjdCBlcnJvciAje2V4Y2VwdGlv bn0iCg== --0-1763820894-1302912785=:77274--