8000 Add #verify_hostname= and #verify_hostname to skip hostname verification · ganmacs/ruby@883693c · GitHub
[go: up one dir, main page]
Skip to content

Commit 883693c

Browse files
ganmacsganmacs
committed
Add #verify_hostname= and #verify_hostname to skip hostname verification
According to ruby/openssl#60, > Currently an user who wants to do the hostname verification needs to call SSLSocket#post_connection_check explicitly after the TLS connection is established. if an user who wants to skip the hostname verification, SSLSocket#post_connection_check doesn't need to be called
1 parent 890200e commit 883693c

File tree

2 files changed

+34
-3
lines changed

2 files changed

+34
-3
lines changed

‎lib/net/http.rb‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -844,6 +844,7 @@ def use_ssl=(flag)
844844
:@verify_callback,
845845
:@verify_depth,
846846
:@verify_mode,
847+
:@verify_hostname,
847848
]
848849
SSL_ATTRIBUTES = [
849850
:ca_file,
@@ -859,6 +860,7 @@ def use_ssl=(flag)
859860
:verify_callback,
860861
:verify_depth,
861862
:verify_mode,
863+
:verify_hostname,
862864
]
863865

864866
# Sets path of a CA certification file in PEM format.
@@ -908,6 +910,10 @@ def use_ssl=(flag)
908910
# OpenSSL::SSL::VERIFY_NONE or OpenSSL::SSL::VERIFY_PEER are acceptable.
909911
attr_accessor :verify_mode
910912

913+
# Sets to check the server certificate is valid for the hostname.
914+
# See OpenSSL::SSL::SSLContext#verify_hostname=
915+
attr_accessor :verify_hostname
916+
911917
# Returns the X.509 certificates the server presented.
912918
def peer_cert
913919
if not use_ssl? or not @socket
@@ -986,9 +992,11 @@ def connect
986992
ssl_parameters = Hash.new
987993
iv_list = instance_variables
988994
SSL_IVNAMES.each_with_index do |ivname, i|
989-
if iv_list.include?(ivname) and
995+
if iv_list.include?(ivname)
990996
value = instance_variable_get(ivname)
991-
ssl_parameters[SSL_ATTRIBUTES[i]] = value if value
997+
unless value.nil?
998+
ssl_parameters[SSL_ATTRIBUTES[i]] = value
999+
end
9921000
end
9931001
end
9941002
@ssl_context = OpenSSL::SSL::SSLContext.new
@@ -1007,7 +1015,7 @@ def connect
10071015
s.session = @ssl_session
10081016
end
10091017
ssl_socket_connect(s, @open_timeout)
1010-
if @ssl_context.verify_mode != OpenSSL::SSL::VERIFY_NONE
1018+
if (@ssl_context.verify_mode != OpenSSL::SSL::VERIFY_NONE) && @ssl_context.verify_hostname
10111019
s.post_connection_check(@address)
10121020
end
10131021
D "SSL established, protocol: #{s.ssl_version}, cipher: #{s.cipher[0]}"

‎test/net/http/test_https.rb‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,29 @@ def test_verify_none
204204
skip $!
205205
end
206206

207+
def test_skip_hostname_verfiction
208+
TestNetHTTPUtils.clean_http_proxy_env do
209+
http = Net::HTTP.new('invalid_servername', config('port'))
210+
http.ipaddr = config('host')
211+
http.use_ssl = true
212+
http.cert_store = TEST_STORE
213+
http.verify_hostname = false
214+
assert_nothing_raised { http.start }
215+
end
216+
end
217+
218+
def test_fail_if_verify_hostname_is_true
219+
TestNetHTTPUtils.clean_http_proxy_env do
220+
http = Net::HTTP.new('invalid_servername', config('port'))
221+
http.ipaddr = config('host')
222+
http.use_ssl = true
223+
http.cert_store = TEST_STORE
224+
http.verify_hostname = true
225+
@log_tester = lambda { |_| }
226+
assert_raise(OpenSSL::SSL::SSLError) { http.start }
227+
end
228+
end
229+
207230
def test_certificate_verify_failure
208231
http = Net::HTTP.new("localhost", config("port"))
209232
http.use_ssl = true

0 commit comments

Comments
 (0)
0