Verify hostname shim #29
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ericmj
reviewed
Apr 21, 2018
src/xhttp_shims.erl
Outdated
| %% Shims for functions introduced in recent Erlang/OTP releases, | ||
| %% to enable use of XHTTP on older releases. The code in this module | ||
| %% was taken directly from the Erlang/OTP project. The original license | ||
| %% follows: |
There was a problem hiding this comment.
👍
Let's include the commit and file we took this from to make it easier to track bugs and knowing when to update.
|
I pushed a fix for the failing tests: b682c18. |
ericmj
approved these changes
Apr 22, 2018
ericmj
reviewed
Apr 22, 2018
| with :verify_peer <- Keyword.get(opts, :verify), | ||
| nil <- Keyword.get(opts, :verify_fun), | ||
| true <- use_pkix_verify_hostname_shim?() do | ||
| Logger.debug("ssl application does not perform hostname verifaction; activating shim") |
There was a problem hiding this comment.
I think we should remove this logger message, but not important right now.
|
I have a bunch of refactoring/stylistic comments but I'll just merge the PR and do the changes after that. Thanks so much @voltone! ❤️ |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This enables HTTPS hostname verification on OTP versions that do not automatically perform the check in the
:sslapplication, by bringing a copy of the OTP 20.3 implementation ofpkix_verify_hostnameand enabling it when:verifyoption is set to:verify_peer, andverify_funis set, and:sslmodule version does not perform hostname verificationIt inherits the bugs and limitations of the OTP 20 implementation, most notably ERL-542