Skip to content

Commit

Permalink
Handle invalid use of IP addresses in SNI
Browse files Browse the repository at this point in the history
Server Name Indication does not allow IP addresses (RFC 6066, section 3:
`Literal IPv4 and IPv6 addresses are not permitted in "HostName".`).

Recent versions of LibreSSL enforce this restriction, which raises
when setting the hostname to an IP address (s.hostname=), before
attempting to setup the SSL connection.

Since the certificate used in the test is already for localhost,
we cannot connect to localhost.  However, as all the test does is
check for a specific exception, just modify the regexp used so it
handles both cases.
  • Loading branch information
jeremyevans committed Jan 3, 2022
1 parent 0e29d6e commit 6ab399d
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion test/net/http/test_https.rb
Original file line number Diff line number Diff line change
Expand Up @@ -255,7 +255,7 @@ def test_identity_verify_failure
ex = assert_raise(OpenSSL::SSL::SSLError){
http.request_get("/") {|res| }
}
re_msg = /certificate verify failed|hostname \"#{HOST_IP}\" does not match/
re_msg = /certificate verify failed|hostname \"#{HOST_IP}\" does not match|ssl3 ext invalid servername/
assert_match(re_msg, ex.message)
end

Expand Down

0 comments on commit 6ab399d

Please sign in to comment.