These test failures first appeared on irrelevant changes. It probably
came from changes in GitHub Actions instead of CRuby's.
Until we figure out how to fix these tests, let's skip them to make the
CI usable.
On some environments that uses OpenSSL 1.1.1h, the two tests now fail.
http://rubyci.s3.amazonaws.com/android29-x86_64/ruby-master/log/20200924T062352Z.fail.html.gzhttps://github.com/ruby/ruby/runs/1159288773?check_suite_focus=true
```
1) Failure:
TestNetHTTPS#test_get [/data/data/com.termux/files/home/cb/tmp/build/20200924T062352Z/ruby/test/net/http/test_https.rb:47]:
<"0\x82\x03\xED0\x82\x02\xD5\xA0\x03..."> expected but was
<"0\x82\x03\xE30\x82\x02\xCB\xA0\x03...">.
```
Not sure why, but verify_callback now seems to receive only SERVER_CERT
but not CA_CERT.
It would be good to investigate the issue furthermore, but tentatively,
I want to stop the failures.
invalid_servername is not a valid name in an SSL request due to
the use of the underscore, and LibreSSL 3.2.0 will raise an
exception for this. These tests are not testing the allowed
characters in the server name, but how net/http handles cases where
the server name provided does not match the IP address you are
trying to connect to, so I think it's better to just modify the
tests to use a correct format.
While here, fix a typo in a test name, and use better code in the
ensure block so the same test doesn't issue both a failure and an
error.
https://github.com/ruby/net-http/commit/0e8dc91120
According to https://github.com/ruby/openssl/pull/60,
> Currently an user who wants to do the hostname verification needs to
call SSLSocket#post_connection_check explicitly after the TLS connection
is established.
if an user who wants to skip the hostname verification,
SSLSocket#post_connection_check doesn't need to be called
https://bugs.ruby-lang.org/issues/16555
Because the test fails under HTTP proxy settings.
https://rubyci.org/logs/rubyci.s3.amazonaws.com/solaris10-gcc/ruby-master/log/20191210T000004Z.fail.html.gz
```
1) Failure:
TestNetHTTPS#test_get_SNI_failure [/export/home/users/chkbuild/cb-gcc/tmp/build/20191210T000004Z/ruby/test/net/http/test_https.rb:81]:
[OpenSSL::SSL::SSLError] exception expected, not #<Net::HTTPServerException: 403 "Forbidden">.
```
The new SNI feature introduced at 54072e329c may need to be improved for
HTTP proxy environment.
to replace the address for TCP/IP connection [Feature #5180]
There're 3 layers of hostname:
* host address for TCP/IP
* TLS server name
* HTTP Host header value
To test DNS round robin or check server certificate from server local,
people sometimes want to connect server with given IP address but keep
TLS server name and HTTP Host header value.
closes [Feature #15215]
closes https://github.com/ruby/ruby/pull/1893
closes https://github.com/ruby/ruby/pull/1977
Due to a bug in OpenSSL 1.1.0h[1] (it's only in this specific version;
it was introduced just before the release and is already fixed in their
stable branch), the callback set by SSLContext#session_new_cb= does not
get called for clients, making net/http and net/ftp not attempt session
resumption.
Let's disable the affected test cases for now. Another option would be
to fallback to using SSLSocket#session as we did before r64234. But
since only a single version is affected and hopefully a new stable
version containing the fix will be released in near future, I chose not
to add such workaround code to lib/.
[1] https://github.com/openssl/openssl/pull/5967
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@64252 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
When TLS 1.3 is in use, the session ticket may not have been sent yet
even though a handshake has finished. Also, the ticket could change if
multiple session ticket messages are sent by the server. Use
SSLContext#session_new_cb instead of calling SSLSocket#session
immediately after a handshake. This way also works with earlier protocol
versions.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@64234 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
And adapt a net/http test to their old behavior. [ruby-core:83491]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60906 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Make test code independent of test/openssl/utils.rb. The development of
openssl library has moved to a separate repository and
OpenSSL::TestUtils may be modified at any time.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56934 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
When you change this to true, you may need to add more tests.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@53141 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* test/net/http/test_https.rb (TestNetHTTPS): also depends on
test/openssl/utils.rb
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@48824 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
(TestNetHTTPS#test_certificate_verify_failure): on Windows,
Errno::ECONNRESET will be raised when the verify is failure at the
client side, and it'll be eaten by WEBrick.
* test/open-uri/test_ssl.rb (TestOpenURISSL#test_validation_failure):
ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@48751 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
single instance to speed up connection. [Feature #5341]
* NEWS: ditto
* test/net/http/test_https.rb: Tests for #5341
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@36528 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
If you connect to localhost, you should listen localhost.
* test/net/http/test_https.rb (TestNetHTTPS#test_timeout_during_SSL_handshake):
ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@32806 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
guaranteed to be resolved as 127.0.0.1. But a SSL
certificate needs a socket to listen on a specific address
where a CN resolves to. On situations where localhost is
not 127.0.0.1, these tests are not possible.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@29350 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
MSP-Greg