httpclient 2.9.0 → 2.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +31 -0
- data/lib/httpclient/cacert.pem +2079 -3015
- data/lib/httpclient/jruby_ssl_socket.rb +9 -0
- data/lib/httpclient/ssl_config.rb +100 -1
- data/lib/httpclient/ssl_socket.rb +3 -0
- data/lib/httpclient/version.rb +1 -1
- data/test/fixtures/emudhra-dv-g3b.pem +47 -0
- data/test/helper.rb +32 -0
- data/test/jruby_ssl_socket/test_socket_timeout.rb +18 -0
- data/test/test_ssl.rb +156 -3
- data/test/test_ssl_config.rb +51 -0
- metadata +6 -7
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 776bb37aba928f5ec039eb09b74682084200ef1fd49132a0a6f43bbcc00ae2ea
|
|
4
|
+
data.tar.gz: 5de606bc3e57a6cac284cd7c680f1ef3e84ca3e8f28eb970581e18445d43a969
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 7ba283f410d4d177819114f3792ac491012ebdae7a67bff29aec379450070998760e615eaf2da299339d18b5918e0e5b6ddcc8b90efcb9d010682e6089af9927
|
|
7
|
+
data.tar.gz: f8e25fd2d3094919879bc2b5ebcc55f8b85f5e0c68191cd1192b3674f859e710bee9faff4fda7217c1566f61bc712b41ad73c8a33884f55d602fc0e5320e2160
|
data/README.md
CHANGED
|
@@ -72,6 +72,37 @@ You can install httpclient via rubygems: `gem install httpclient`
|
|
|
72
72
|
See [HTTPClient](http://www.rubydoc.info/gems/httpclient/frames) for documentation.
|
|
73
73
|
You can also check sample/howto.rb how to use APIs.
|
|
74
74
|
|
|
75
|
+
### TLS certificate restrictions
|
|
76
|
+
|
|
77
|
+
Blocked public keys are identified by their SPKI SHA-256 hashes in
|
|
78
|
+
`HTTPClient::SSLConfig::BLOCKED_SPKI_SHA256`. The list covers eight eMudhra
|
|
79
|
+
intermediate CA public keys whose corresponding private keys were compromised.
|
|
80
|
+
|
|
81
|
+
With peer verification enabled and no custom `verify_callback`, HTTPClient
|
|
82
|
+
rejects a connection before sending an HTTP request if any certificate supplied
|
|
83
|
+
by the server contains a blocked eMudhra public key. This includes cross-signed
|
|
84
|
+
certificates and extra certificates that are not used in the verification path,
|
|
85
|
+
even when another valid path exists.
|
|
86
|
+
|
|
87
|
+
Setting `verify_mode` to `OpenSSL::SSL::VERIFY_NONE` or `nil` disables this check.
|
|
88
|
+
A custom `verify_callback` replaces the default verification policy, including
|
|
89
|
+
the blocked public key check. It receives the underlying verifier's result and
|
|
90
|
+
context. With peer verification enabled, its return value controls certificate
|
|
91
|
+
verification. The caller is responsible for the custom callback's validation
|
|
92
|
+
policy. Hostname verification is unchanged.
|
|
93
|
+
|
|
94
|
+
Note: MRI uses HTTPClient's bundled `cacert.pem` by default, while JRuby uses
|
|
95
|
+
the JVM's CA certificates and certificate validation. Secure operation on JRuby
|
|
96
|
+
depends on keeping the JVM and its CA certificates up to date. HTTPClient's
|
|
97
|
+
additional check may not detect blocked intermediates found only in a local
|
|
98
|
+
trust store or obtained through JVM issuer retrieval (such as AIA when enabled).
|
|
99
|
+
|
|
100
|
+
Remove unused certificates containing blocked public keys from the server's
|
|
101
|
+
certificate chain configuration. If a certificate containing a blocked public key
|
|
102
|
+
is required for validation, replace the affected server certificate and chain
|
|
103
|
+
with ones issued under unaffected CA keys.
|
|
104
|
+
See [#480](https://github.com/nahi/httpclient/issues/480) for background.
|
|
105
|
+
|
|
75
106
|
## Bug report or Feature request
|
|
76
107
|
|
|
77
108
|
Please file a ticket at the project web site.
|