Respect the SSL context's verify_hostname value #632
Conversation
Yeah, it's a big mess. OpenSSL itself didn't implement hostname verification at all until quite recently, leaving all users of it to reimplement it poorly themselves (and as it were, I ended up rewriting the hostname verification code used by Ruby itself due to numerous problems). Anyway, approved! Thanks for the fix. |
|
Per #633 CI is broken (thanks Travis), but I'm going to go ahead and merge this. |
|
Seems like this PR broke jRuby:
|
|
@ixti aah, unfortunate. Sorry about that. Seems like it can at least be worked around with reflection. |
|
jRuby has older version of OpenSSL gem bundled in. |
|
I was suggesting something like: if ssl_context.respond_to?(:verify_hostname) && ssl_context.verify_hostname
@socket.post_connection_check(host)
end |
|
@tarcieri 👍 Will do so! |
jRuby is using outdated openssl gem bundled in, which don't have validate_hostname getter on SSLContext.
* Switch to GitHub Actions * Use GitHub Actions for CI * Update Coveralls integration: generate lcov report with SimpleCov and send it after the test suite using coveralls GitHub Actions plugin * Update and cleanup RSpec config * Cleanup Rakefile * Remove active_model dependency (certificate_authority was fixed) PS: GH Actions syntax is ugly. Should we switch to Cirlce CI or GitLab CI? XD Resolves: #633 * Disable SSL related specs Specs are failing due to some misconfiguration caused by new OpenSSL. TODO: #627 * Remove windows and macos from test matrix We were not testing those on Travis-CI, thus to simplify migration I've deicded to disable those. Once everything is fixed and stabilized we will add those too. * Bump min version of CA and rspec Just to make sure we're using expected ones * Make stubbed client in spec more predictable - use stub_const - consistently normalize URIs * Add OpenSSL requirement details for jRuby /cc @tarcieri Probably we should just add dependency on gem itself? * Revert "Add OpenSSL requirement details for jRuby" This reverts commit f8dfb38. * Fix jRuby regression introduced in #632 jRuby is using outdated openssl gem bundled in, which don't have validate_hostname getter on SSLContext. * Fix jRuby coverage abilities
I stumbled upon an issue where http.rb wouldn't respect the
verify_hostnamevalue of the current OpenSSL::SSL::SSLContext.Previously we would unconditionally call post_connection_check, whose only purpose is to verify hostnames, regardless of what
verify_hostnamewas set to. This results in quite a bit of user confusion since one expects hostname verification to be handled by OpenSSL itself rather than by the HTTP library.Digging through the blames, it looks like this was never implemented properly. Ruby's Net::HTTP fixed the same issue with this pull in January.
This simple change fixes the issue for me and brings http.rb in line with the other Ruby HTTP libraries.