Net::HTTP doesn't allow to set SSL options
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Quiet
- Tech stack
- ruby
- Domain
- networking, security
Research direction
Start by reading Net::HTTP's SSL configuration path and the SSLContext fields it currently exposes. Compare that interface with the reported SSLContext options requirement and review the seven-comment discussion for API expectations. Done means a decided, scoped way to configure SSL options for an individual Net::HTTP connection without changing global defaults.
Written by the indexing model from the issue text.
Description
Context
Since OpenSSL 3.x, when a server close the TCP connection without first calling SSL_shutdown, the SSL client now error with SSL_read: unexpected eof while reading.
In OpenSSL 1.x, the client wouldn't mind and would behave like if the connection was cleanly closed.
To restore the 1.x behavior, you can set a specific options:
ssl_context = OpenSSL::SSL::SSLContext.new
ssl_context.options |= OpenSSL::SSL::OP_IGNORE_UNEXPECTED_EOF
Problem
The issue is that Net::HTTP only allow to set specific fields on the SSLContext object, and options is not one of them.
Workaround
The issue can be worked around by changing the default options globally:
if OpenSSL::SSL.const_defined?(:OP_IGNORE_UNEXPECTED_EOF)
OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:options] |= OpenSSL::SSL::OP_IGNORE_UNEXPECTED_EOF
end
However this impact all SSL connections, not just the ones that need it.
Solution
Not sure what the best API would be. But it would be great if we could directly pass a SSLContext instance to Net::HTTP, so that we're not limited on the SSL configuration.
- Dominant language
- Ruby
- Stars
- 148
- Forks
- 95
- Avg merge
- 10h 54m
- Merged PRs (30d)
- 4
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ruby/net-http
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
-
Difficulty 5/5 Over a week Newbie friendliness 38/100
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
Similar issues
-
user-reported
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Kong/developer.konghq.com#7316 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
TheOdinProject/curriculum#31408 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
bensheldon/good_job#1816 · 5 comments ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
notch8/utk_knapsack#148 ·