[#35631] [Ruby 1.9 - Bug #4558][Open] TestSocket#test_closed_read fails after r31230 — Tomoyuki Chikanaga <redmine@...>

23 messages 2011/04/06

[#35632] [Ruby 1.9 - Bug #4559][Open] Proc#== does not match the documented behaviour — Adam Prescott <redmine@...>

13 messages 2011/04/06

[#35637] [Ruby 1.9 - Bug #4561][Open] 1.9.2 requires parentheses around argument of method call in an array, where 1.8.7 did not — Dave Schweisguth <redmine@...>

9 messages 2011/04/07

[#35666] caching of the ancestor chain — Xavier Noria <fxn@...>

Why does Ruby cache the ancestors chain? I mean, not why the implementation implies that, but why it works that way conceptually.

9 messages 2011/04/09

[#35734] [Ruby 1.9 - Feature #4574][Open] Numeric#within — redmine@...

16 messages 2011/04/13

[#35753] [Ruby 1.9 - Bug #4576][Open] Range#step miss the last value, if end-exclusive and has float number — redmine@...

61 messages 2011/04/14
[#39566] [Ruby 1.9 - Bug #4576] Range#step miss the last value, if end-exclusive and has float number — Marc-Andre Lafortune <ruby-core@...> 2011/09/15

[#39590] [Ruby 1.9 - Bug #4576] Range#step miss the last value, if end-exclusive and has float number — Marc-Andre Lafortune <ruby-core@...> 2011/09/16

[#39593] Re: [Ruby 1.9 - Bug #4576] Range#step miss the last value, if end-exclusive and has float number — Tanaka Akira <akr@...> 2011/09/16

2011/9/17 Marc-Andre Lafortune <ruby-core@marc-andre.ca>:

[#39608] Re: [Ruby 1.9 - Bug #4576] Range#step miss the last value, if end-exclusive and has float number — Masahiro TANAKA <masa16.tanaka@...> 2011/09/17

I have not been watching ruby-core, but let me give a comment for this issue.

[#35765] [Ruby 1.9 - Bug #4579][Open] SecureRandom + OpenSSL may repeat with fork — redmine@...

27 messages 2011/04/15

[#35866] [Ruby 1.9 - Bug #4603][Open] lib/csv.rb: when the :encoding parameter is not provided, the encoding of CSV data is treated as ASCII-8BIT — yu nobuoka <nobuoka@...>

13 messages 2011/04/24

[#35879] [Ruby 1.9 - Bug #4610][Open] Proc#curry behavior is inconsistent with lambdas containing default argument values — Joshua Ballanco <jballanc@...>

11 messages 2011/04/25

[#35883] [Ruby 1.9 - Bug #4611][Open] [BUG] Segementation fault reported — Deryl Doucette <me@...>

15 messages 2011/04/25

[#35895] [Ruby 1.9 - Feature #4614][Open] [RFC/PATCH] thread_pthread.c: lower RUBY_STACK_MIN_LIMIT to 64K — Eric Wong <normalperson@...>

10 messages 2011/04/25

[ruby-core:35781] Patch to Net::HTTP to allow overriding SSL certificate hostname verification

From: Patrick Higgins <patrick133t@...>
Date: 2011-04-16 00:21:23 UTC
List: ruby-core #35781
I have a need to connect to an https server using Net::HTTP which
(incorrectly) returns a wildcard certificate that matches close enough
for me that I wish to allow it without completely disabling peer
verification, which is too insecure for my needs. I would really like
to see the server fix their problem, but as a client my hands are
tied.

The attached patch to Net::HTTP against the ruby_1_9_2 branch allows
me to override the hostname verification in the way that I need. See
https://gist.github.com/922585 for an example usage.

I removed @enable_post_connection_check in my patch because itppears
to be unused.

Is there a chance of getting this into the Ruby 1.9.x and perhaps Ruby
1.8.x?

Without this patch, the only way I have found to do this is a nasty
monkey-patch to OpenSSL::SSL.verify_certificate_identity, which
changes the behavior for the entire process, not just the connections
I am interested in.

The monkey patch can be found at https://gist.github.com/922579

ChangeLog entry:

Fri Apr 14 16:35:00 2011 atrick Higgins patrick133t@yahoo.com>

* lib/net/http.rb: Added Net::HTTP#ssl_hostname_verify attribute to
allow customized certificate hostname validation.

Attachments (1)

net_http_ssl_hostname_verify.patch (1.23 KB, text/x-diff)
Index: lib/net/http.rb
===================================================================
--- lib/net/http.rb	(revision 31291)
+++ lib/net/http.rb	(working copy)
@@ -520,7 +520,6 @@
       @debug_output = nil
       @use_ssl = false
       @ssl_context = nil
-      @enable_post_connection_check = true
       @compression = nil
       @sspi_enabled = false
       if defined?(SSL_ATTRIBUTES)
@@ -530,6 +529,11 @@
       end
     end
 
+    # set this to a function taking the peer certificate and hostname and
+    # returning true if the hostname should be allowed for the certificate
+    # and raises an OpenSSL::SSL::SSLError if not.
+    attr_accessor :ssl_hostname_verify
+
     def inspect
       "#<#{self.class} #{@address}:#{@port} open=#{started?}>"
     end
@@ -677,7 +681,11 @@
           end
           timeout(@open_timeout) { s.connect }
           if @ssl_context.verify_mode != OpenSSL::SSL::VERIFY_NONE
-            s.post_connection_check(@address)
+            if @ssl_hostname_verify
+              @ssl_hostname_verify.call(s.peer_cert, @address)
+            else
+              s.post_connection_check(@address)
+            end
           end
         rescue => exception
           D "Conn close because of connect error #{exception}"

In This Thread

Prev Next