@@ -14,14 +14,16 @@ def self.read_fixture(key)
14
14
File . read ( File . expand_path ( "../fixtures/#{ key } " , __dir__ ) )
15
15
end
16
16
17
+ HOST = 'localhost'
18
+ HOST_IP = '127.0.0.1'
17
19
CA_CERT = OpenSSL ::X509 ::Certificate . new ( read_fixture ( "cacert.pem" ) )
18
20
SERVER_KEY = OpenSSL ::PKey . read ( read_fixture ( "server.key" ) )
19
21
SERVER_CERT = OpenSSL ::X509 ::Certificate . new ( read_fixture ( "server.crt" ) )
20
22
DHPARAMS = OpenSSL ::PKey ::DH . new ( read_fixture ( "dhparams.pem" ) )
21
23
TEST_STORE = OpenSSL ::X509 ::Store . new . tap { |s | s . add_cert ( CA_CERT ) }
22
24
23
25
CONFIG = {
24
- 'host' => '127.0.0.1' ,
26
+ 'host' => HOST ,
25
27
'proxy_host' => nil ,
26
28
'proxy_port' => nil ,
27
29
'ssl_enable' => true ,
@@ -31,7 +33,7 @@ def self.read_fixture(key)
31
33
}
32
34
33
35
def test_get
34
- http = Net ::HTTP . new ( "localhost" , config ( "port" ) )
36
+ http = Net ::HTTP . new ( HOST , config ( "port" ) )
35
37
http . use_ssl = true
36
38
http . cert_store = TEST_STORE
37
39
certs = [ ]
@@ -43,15 +45,13 @@ def test_get
43
45
assert_equal ( $test_net_http_data, res . body )
44
46
}
45
47
# TODO: OpenSSL 1.1.1h seems to yield only SERVER_CERT; need to check the incompatibility
46
- certs . zip ( [ CA_CERT , SERVER_CERT ] [ -certs . size ..] ) do |actual , expected |
48
+ certs . zip ( [ CA_CERT , SERVER_CERT ] [ -certs . size ..- 1 ] ) do |actual , expected |
47
49
assert_equal ( expected . to_der , actual . to_der )
48
50
end
49
- rescue SystemCallError
50
- skip $!
51
51
end
52
52
53
53
def test_get_SNI
54
- http = Net ::HTTP . new ( "localhost" , config ( "port" ) )
54
+ http = Net ::HTTP . new ( HOST , config ( "port" ) )
55
55
http . ipaddr = config ( 'host' )
56
56
http . use_ssl = true
57
57
http . cert_store = TEST_STORE
@@ -64,16 +64,16 @@ def test_get_SNI
64
64
assert_equal ( $test_net_http_data, res . body )
65
65
}
66
66
# TODO: OpenSSL 1.1.1h seems to yield only SERVER_CERT; need to check the incompatibility
67
- certs . zip ( [ CA_CERT , SERVER_CERT ] [ -certs . size ..] ) do |actual , expected |
67
+ certs . zip ( [ CA_CERT , SERVER_CERT ] [ -certs . size ..- 1 ] ) do |actual , expected |
68
68
assert_equal ( expected . to_der , actual . to_der )
69
69
end
70
70
end
71
71
72
72
def test_get_SNI_proxy
73
- TCPServer . open ( "127.0.0.1" , 0 ) { |serv |
73
+ TCPServer . open ( HOST_IP , 0 ) { |serv |
74
74
_ , port , _ , _ = serv . addr
75
75
client_thread = Thread . new {
76
- proxy = Net ::HTTP . Proxy ( "127.0.0.1" , port , 'user' , 'password' )
76
+ proxy = Net ::HTTP . Proxy ( HOST_IP , port , 'user' , 'password' )
77
77
http = proxy . new ( "foo.example.org" , 8000 )
78
78
http . ipaddr = "192.0.2.1"
79
79
http . use_ssl = true
@@ -125,23 +125,21 @@ def test_get_SNI_failure
125
125
end
126
126
127
127
def test_post
128
- http = Net ::HTTP . new ( "localhost" , config ( "port" ) )
128
+ http = Net ::HTTP . new ( HOST , config ( "port" ) )
129
129
http . use_ssl = true
130
130
http . cert_store = TEST_STORE
131
131
data = config ( 'ssl_private_key' ) . to_der
132
132
http . request_post ( "/" , data , { 'content-type' => 'application/x-www-form-urlencoded' } ) { |res |
133
133
assert_equal ( data , res . body )
134
134
}
135
- rescue SystemCallError
136
- skip $!
137
135
end
138
136
139
137
def test_session_reuse
140
138
# FIXME: The new_session_cb is known broken for clients in OpenSSL 1.1.0h.
141
139
# See https://github.com/openssl/openssl/pull/5967 for details.
142
140
skip if OpenSSL ::OPENSSL_LIBRARY_VERSION =~ /OpenSSL 1.1.0h/
143
141
144
- http = Net ::HTTP . new ( "localhost" , config ( "port" ) )
142
+ http = Net ::HTTP . new ( HOST , config ( "port" ) )
145
143
http . use_ssl = true
146
144
http . cert_store = TEST_STORE
147
145
@@ -154,25 +152,21 @@ def test_session_reuse
154
152
end
155
153
156
154
http . start
155
+ assert_equal false , http . instance_variable_get ( :@socket ) . io . session_reused?
157
156
http . get ( "/" )
158
157
http . finish
159
158
160
159
http . start
161
- http . get ( "/" )
162
-
163
- socket = http . instance_variable_get ( :@socket ) . io
164
- assert_equal true , socket . session_reused?
165
-
160
+ assert_equal true , http . instance_variable_get ( :@socket ) . io . session_reused?
161
+ assert_equal $test_net_http_data, http . get ( "/" ) . body
166
162
http . finish
167
- rescue SystemCallError
168
- skip $!
169
163
end
170
164
171
165
def test_session_reuse_but_expire
172
166
# FIXME: The new_session_cb is known broken for clients in OpenSSL 1.1.0h.
173
167
skip if OpenSSL ::OPENSSL_LIBRARY_VERSION =~ /OpenSSL 1.1.0h/
174
168
175
- http = Net ::HTTP . new ( "localhost" , config ( "port" ) )
169
+ http = Net ::HTTP . new ( HOST , config ( "port" ) )
176
170
http . use_ssl = true
177
171
http . cert_store = TEST_STORE
178
172
@@ -188,8 +182,6 @@ def test_session_reuse_but_expire
188
182
assert_equal false , socket . session_reused?
189
183
190
184
http . finish
191
- rescue SystemCallError
192
- skip $!
193
185
end
194
186
195
187
if ENV [ "RUBY_OPENSSL_TEST_ALL" ]
@@ -204,14 +196,12 @@ def test_verify
204
196
end
205
197
206
198
def test_verify_none
207
- http = Net ::HTTP . new ( "localhost" , config ( "port" ) )
199
+ http = Net ::HTTP . new ( HOST , config ( "port" ) )
208
200
http . use_ssl = true
209
201
http . verify_mode = OpenSSL ::SSL ::VERIFY_NONE
210
202
http . request_get ( "/" ) { |res |
211
203
assert_equal ( $test_net_http_data, res . body )
212
204
}
213
- rescue SystemCallError
214
- skip $!
215
205
end
216
206
217
207
def test_skip_hostname_verification
@@ -240,14 +230,10 @@ def test_fail_if_verify_hostname_is_true
240
230
end
241
231
242
232
def test_certificate_verify_failure
243
- http = Net ::HTTP . new ( "localhost" , config ( "port" ) )
233
+ http = Net ::HTTP . new ( HOST , config ( "port" ) )
244
234
http . use_ssl = true
245
235
ex = assert_raise ( OpenSSL ::SSL ::SSLError ) {
246
- begin
247
- http . request_get ( "/" ) { |res | }
248
- rescue SystemCallError
249
- skip $!
250
- end
236
+ http . request_get ( "/" ) { |res | }
251
237
}
252
238
assert_match ( /certificate verify failed/ , ex . message )
253
239
unless /mswin|mingw/ =~ RUBY_PLATFORM
@@ -262,25 +248,25 @@ def test_certificate_verify_failure
262
248
263
249
def test_identity_verify_failure
264
250
# the certificate's subject has CN=localhost
265
- http = Net ::HTTP . new ( "127.0.0.1" , config ( "port" ) )
251
+ http = Net ::HTTP . new ( HOST_IP , config ( "port" ) )
266
252
http . use_ssl = true
267
253
http . cert_store = TEST_STORE
268
254
@log_tester = lambda { |_ | }
269
255
ex = assert_raise ( OpenSSL ::SSL ::SSLError ) {
270
256
http . request_get ( "/" ) { |res | }
271
257
}
272
- re_msg = /certificate verify failed|hostname \" 127.0.0.1 \" does not match/
258
+ re_msg = /certificate verify failed|hostname \" #{ HOST_IP } \" does not match/
273
259
assert_match ( re_msg , ex . message )
274
260
end
275
261
276
262
def test_timeout_during_SSL_handshake
277
263
bug4246 = "expected the SSL connection to have timed out but have not. [ruby-core:34203]"
278
264
279
265
# listen for connections... but deliberately do not complete SSL handshake
280
- TCPServer . open ( 'localhost' , 0 ) { |server |
266
+ TCPServer . open ( HOST , 0 ) { |server |
281
267
port = server . addr [ 1 ]
282
268
283
- conn = Net ::HTTP . new ( 'localhost' , port )
269
+ conn = Net ::HTTP . new ( HOST , port )
284
270
conn . use_ssl = true
285
271
conn . read_timeout = 0.01
286
272
conn . open_timeout = 0.01
@@ -295,7 +281,7 @@ def test_timeout_during_SSL_handshake
295
281
end
296
282
297
283
def test_min_version
298
- http = Net ::HTTP . new ( "localhost" , config ( "port" ) )
284
+ http = Net ::HTTP . new ( HOST , config ( "port" ) )
299
285
http . use_ssl = true
300
286
http . min_version = :TLS1
301
287
http . cert_store = TEST_STORE
@@ -305,7 +291,7 @@ def test_min_version
305
291
end
306
292
307
293
def test_max_version
308
- http = Net ::HTTP . new ( "127.0.0.1" , config ( "port" ) )
294
+ http = Net ::HTTP . new ( HOST_IP , config ( "port" ) )
309
295
http . use_ssl = true
310
296
http . max_version = :SSL2
311
297
http . verify_callback = Proc . new do |preverify_ok , store_ctx |
0 commit comments