diff options
| author | Jeremy Evans <code@jeremyevans.net> | 2022-01-04 10:22:37 -0800 |
|---|---|---|
| committer | git <svn-admin@ruby-lang.org> | 2022-02-03 05:10:21 +0900 |
| commit | 7529c538915cd1765b0a362ca64e8f8ff439d7fc (patch) | |
| tree | 8a7a3b2f0d49866a52fea9cde1650f9b2ddd3e19 /test/net | |
| parent | 3ca244a29a6a3b76d446de2ff45b09c1b5a1ac30 (diff) | |
[ruby/net-http] Do not set SNI hostname if connecting to IP address
RFC 6066, section 3, explicitly disallows the use of an IP address
as an SNI server name. So check if the connection is being made
to an IP address using the resolv regexps, and do not set an SNI
hostname in that case.
Recent changes to LibreSSL make it more strictly follow RFC 6066,
resulting an s.hostname= raising an error if passed an IP address.
When such verions of LibreSSL are used, this change not only fixes
the net/http tests, it also fixes tests for webrick and open-uri,
which both make SSL connections to 127.0.0.1 using net/http in
their tests.
Avoid warning in the openssl extension by unsetting
@ssl_context.verify_hostname if connecting to an IP address.
Make changes so that the post_connection_check still happens
when connecting to an IP address, which is necessary to keep
checking that the certificate returned includes the IP address,
which one of the tests depends on.
Revert the previous change that modified the regexp used for
checking the error message.
https://github.com/ruby/net-http/commit/fa68e64bee
Diffstat (limited to 'test/net')
| -rw-r--r-- | test/net/http/test_https.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/test/net/http/test_https.rb b/test/net/http/test_https.rb index 603d6ecc1a..f4f1959a0e 100644 --- a/test/net/http/test_https.rb +++ b/test/net/http/test_https.rb @@ -255,7 +255,7 @@ class TestNetHTTPS < Test::Unit::TestCase ex = assert_raise(OpenSSL::SSL::SSLError){ http.request_get("/") {|res| } } - re_msg = /certificate verify failed|hostname \"#{HOST_IP}\" does not match|ssl3 ext invalid servername/ + re_msg = /certificate verify failed|hostname \"#{HOST_IP}\" does not match/ assert_match(re_msg, ex.message) end |