open-uri + OpenSSL

M

Matthew Lagace

Hello,

I am usring open-uri to open an https:// link and when it tries to read
it, I get the 'connect' : certificate verify failed error. How can I
bypass this SSL verification?

Thanks,
M
 
D

dusty

Hello,

I am usring open-uri to open an https:// link and when it tries to read
it, I get the 'connect' : certificate verify failed error. How can I
bypass this SSL verification?

Thanks,
M
Click to expand...

Set the verify_mode to OpenSSL::SSL::VERIFY_NONE

eg:

http = Net::HTTP.new(host,port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
 
D

dusty

Ok when I do that, it says:

ssl value changed, but session already started
Click to expand...

Sorry, I guess you can't do it with open-uri. Here is a patch:

add this ssl_verify option to the top of the file.

FROM:

module OpenURI
Options = {
:proxy => true,
:progress_proc => true,
:content_length_proc => true,
:http_basic_authentication => true,
}

TO:

module OpenURI
Options = {
:proxy => true,
:progress_proc => true,
:content_length_proc => true,
:http_basic_authentication => true,
:ssl_verify => true
}

Change the part where it enables verification

FROM:

if target.class == URI::HTTPS
require 'net/https'
http.use_ssl = true
http.enable_post_connection_check = true
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
store = OpenSSL::X509::Store.new
store.set_default_paths
http.cert_store = store
end

TO:
if target.class == URI::HTTPS
require 'net/https'
http.use_ssl = true
http.enable_post_connection_check = true
if options[:ssl_verify] == false
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
else
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
end
store = OpenSSL::X509::Store.new
store.set_default_paths
http.cert_store = store
end

run it like this:

open("https://someurl", :ssl_verify => false) {|f|
print f.read
}
 
D

dusty

Ok when I do that, it says:
Click to expand...
ssl value changed, but session already started
Click to expand...

Sorry, I guess you can't do it with open-uri. Here is a patch:

add this ssl_verify option to the top of the file.

FROM:

module OpenURI
Options = {
:proxy => true,
:progress_proc => true,
:content_length_proc => true,
:http_basic_authentication => true,
}

TO:

module OpenURI
Options = {
:proxy => true,
:progress_proc => true,
:content_length_proc => true,
:http_basic_authentication => true,
:ssl_verify => true
}

Change the part where it enables verification

FROM:

if target.class == URI::HTTPS
require 'net/https'
http.use_ssl = true
http.enable_post_connection_check = true
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
store = OpenSSL::X509::Store.new
store.set_default_paths
http.cert_store = store
end

TO:
if target.class == URI::HTTPS
require 'net/https'
http.use_ssl = true
http.enable_post_connection_check = true
if options[:ssl_verify] == false
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
else
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
end
store = OpenSSL::X509::Store.new
store.set_default_paths
http.cert_store = store
end

run it like this:

open("https://someurl", :ssl_verify => false) {|f|
print f.read

}
Click to expand...


Sorry, this all goes in open-uri.rb in your ruby base dir, eg:

/usr/lib/ruby/1.8/open-uri.rb
or
/opt/local/lib/ruby/1.8/open-uri.rb

or wherever it may be on your distro.
 
M

mortee

dusty said:
Ok when I do that, it says:
ssl value changed, but session already started
dusty wrote:
Hello,
I am usring open-uri to open an https:// link and when it tries to read
it, I get the 'connect' : certificate verify failed error. How can I
bypass this SSL verification?
Thanks,
M
--
Posted viahttp://www.ruby-forum.com/.
Set the verify_mode to OpenSSL::SSL::VERIFY_NONE
eg:
http = Net::HTTP.new(host,port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
Click to expand...
Sorry, I guess you can't do it with open-uri. Here is a patch:

add this ssl_verify option to the top of the file.

FROM:

module OpenURI
Options = {
:proxy => true,
:progress_proc => true,
:content_length_proc => true,
:http_basic_authentication => true,
}

TO:

module OpenURI
Options = {
:proxy => true,
:progress_proc => true,
:content_length_proc => true,
:http_basic_authentication => true,
:ssl_verify => true
}

Change the part where it enables verification

FROM:

if target.class == URI::HTTPS
require 'net/https'
http.use_ssl = true
http.enable_post_connection_check = true
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
store = OpenSSL::X509::Store.new
store.set_default_paths
http.cert_store = store
end

TO:
if target.class == URI::HTTPS
require 'net/https'
http.use_ssl = true
http.enable_post_connection_check = true
if options[:ssl_verify] == false
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
else
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
end
store = OpenSSL::X509::Store.new
store.set_default_paths
http.cert_store = store
end

run it like this:

open("https://someurl", :ssl_verify => false) {|f|
print f.read

}
Click to expand...


Sorry, this all goes in open-uri.rb in your ruby base dir, eg:

/usr/lib/ruby/1.8/open-uri.rb
or
/opt/local/lib/ruby/1.8/open-uri.rb

or wherever it may be on your distro.
Click to expand...

The nice thing about Ruby is that if you don't want to modify your
system files (for example I don't like to do it because it's quite hard
to track later), then you can simply patch the modules/classes in
question on the fly, at the beginning of your application. And possibly
file a bug report :)

However, I guess the verification-enabling code would be more versatile
this way:

if options[:ssl_verify]
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
else
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
end

mortee
 
D

dusty

dusty said:
Ok when I do that, it says:
ssl value changed, but session already started
dusty wrote:
Hello,
I am usring open-uri to open an https:// link and when it tries to read
it, I get the 'connect' : certificate verify failed error. How can I
bypass this SSL verification?
Thanks,
M
--
Posted viahttp://www.ruby-forum.com/.
Set the verify_mode to OpenSSL::SSL::VERIFY_NONE
eg:
http = Net::HTTP.new(host,port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
--
Posted viahttp://www.ruby-forum.com/.
Sorry, I guess you can't do it with open-uri. Here is a patch:
add this ssl_verify option to the top of the file.
FROM:
module OpenURI
Options = {
:proxy => true,
:progress_proc => true,
:content_length_proc => true,
:http_basic_authentication => true,
}
TO:
module OpenURI
Options = {
:proxy => true,
:progress_proc => true,
:content_length_proc => true,
:http_basic_authentication => true,
:ssl_verify => true
}
Change the part where it enables verification
FROM:
if target.class == URI::HTTPS
require 'net/https'
http.use_ssl = true
http.enable_post_connection_check = true
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
store = OpenSSL::X509::Store.new
store.set_default_paths
http.cert_store = store
end
TO:
if target.class == URI::HTTPS
require 'net/https'
http.use_ssl = true
http.enable_post_connection_check = true
if options[:ssl_verify] == false
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
else
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
end
store = OpenSSL::X509::Store.new
store.set_default_paths
http.cert_store = store
end
run it like this:
open("https://someurl", :ssl_verify => false) {|f|
print f.read
}
Click to expand...
Click to expand...
Sorry, this all goes in open-uri.rb in your ruby base dir, eg:

or wherever it may be on your distro.
Click to expand...

The nice thing about Ruby is that if you don't want to modify your
system files (for example I don't like to do it because it's quite hard
to track later), then you can simply patch the modules/classes in
question on the fly, at the beginning of your application. And possibly
file a bug report :)

However, I guess the verification-enabling code would be more versatile
this way:

if options[:ssl_verify]
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
else
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
end

mortee
Click to expand...

Good idea. I submitted a patch to rubyforge. This might be useful
and simple enough to add.

http://rubyforge.org/tracker/?group_id=426&atid=1698&func=detail&aid=15390
 
J

Junkone

Any news about the status of this?
Click to expand...

i tried to put the patch into my open-uri.rb and it failed with a new
error
irb(main):007:0* open("https://www.interactivebrokers.com/Universal/
servlet/FlexStatementService.GetStatement?
t=1437758&q=1126698&v=2",:ssl_verify => true){|f|puts f}
NoMethodError: undefined method `enable_post_connection_check=' for
#<Net::HTTP www.interactivebrokers.com:443 open=false>
from e:/ruby/lib/ruby/1.8/open-uri.rb:242:in `open_http'
from e:/ruby/lib/ruby/1.8/open-uri.rb:643:in `buffer_open'
from e:/ruby/lib/ruby/1.8/open-uri.rb:170:in `open_loop'
from e:/ruby/lib/ruby/1.8/open-uri.rb:168:in `catch'
from e:/ruby/lib/ruby/1.8/open-uri.rb:168:in `open_loop'
from e:/ruby/lib/ruby/1.8/open-uri.rb:138:in `open_uri'
from e:/ruby/lib/ruby/1.8/open-uri.rb:545:in `open'
from e:/ruby/lib/ruby/1.8/open-uri.rb:30:in `open'
from (irb):7
 
C

Ck Tricky

Junkone said:
i tried to put the patch into my open-uri.rb and it failed with a new
error
irb(main):007:0* open("https://www.interactivebrokers.com/Universal/
servlet/FlexStatementService.GetStatement?
t=1437758&q=1126698&v=2",:ssl_verify => true){|f|puts f}
NoMethodError: undefined method `enable_post_connection_check=' for
#<Net::HTTP www.interactivebrokers.com:443 open=false>
from e:/ruby/lib/ruby/1.8/open-uri.rb:242:in `open_http'
from e:/ruby/lib/ruby/1.8/open-uri.rb:643:in `buffer_open'
from e:/ruby/lib/ruby/1.8/open-uri.rb:170:in `open_loop'
from e:/ruby/lib/ruby/1.8/open-uri.rb:168:in `catch'
from e:/ruby/lib/ruby/1.8/open-uri.rb:168:in `open_loop'
from e:/ruby/lib/ruby/1.8/open-uri.rb:138:in `open_uri'
from e:/ruby/lib/ruby/1.8/open-uri.rb:545:in `open'
from e:/ruby/lib/ruby/1.8/open-uri.rb:30:in `open'
from (irb):7
Click to expand...

So basically if you are using ruby 1.8.6 (for me I'm using it on
BackTrack3) you simply omit the 'http.enable_post_connection_check =
true' from the code mentioned above and also remove
'sock.post_connection_check(target_host)'
that's it! I am using the open-uri just fine now to push thru multiple
URLs from an input file out to my local proxy in order to built a site
map via BurpSuite.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Validation crisis 12
HTTPClient problem with SSL and ruby 1.8.7 3
EXP(ORT) ciphers and M2Crypto/OpenSSL 0
I want to have a button in a web page with action for open new phone contact page and fill it with some date 1
OpenSSL Ruby 1.9? "Certificate verify failed" 3
OpenSSL / Persistent connection 1
HttpClienbt SSL Errors - OS Specific (RHEL 4 versus CentOS 5.4) 1
How to use PDF-lib and how to center each line of texts on the page? 1

Members online

Total: 1,755 (members: 2, guests: 1,753)
Robots: 557

Forum statistics

Threads
474,175
Messages
2,570,942
Members
47,476
Latest member
blackwatermelon

Latest Threads

Top