{"action":"created","issue":{"url":"https://api.github.com/repos/ruby-ldap/ruby-net-ldap/issues/262","labels_url":"https://api.github.com/repos/ruby-ldap/ruby-net-ldap/issues/262/labels{/name}","comments_url":"https://api.github.com/repos/ruby-ldap/ruby-net-ldap/issues/262/comments","events_url":"https://api.github.com/repos/ruby-ldap/ruby-net-ldap/issues/262/events","html_url":"https://github.com/ruby-ldap/ruby-net-ldap/pull/262","id":128359337,"number":262,"title":"SSL hostname verification support","user":{"login":"tarcieri","id":797,"avatar_url":"https://avatars.githubusercontent.com/u/797?v=3","gravatar_id":"","url":"https://api.github.com/users/tarcieri","html_url":"https://github.com/tarcieri","followers_url":"https://api.github.com/users/tarcieri/followers","following_url":"https://api.github.com/users/tarcieri/following{/other_user}","gists_url":"https://api.github.com/users/tarcieri/gists{/gist_id}","starred_url":"https://api.github.com/users/tarcieri/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tarcieri/subscriptions","organizations_url":"https://api.github.com/users/tarcieri/orgs","repos_url":"https://api.github.com/users/tarcieri/repos","events_url":"https://api.github.com/users/tarcieri/events{/privacy}","received_events_url":"https://api.github.com/users/tarcieri/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-01-23T23:23:14Z","updated_at":"2016-01-28T18:51:01Z","closed_at":"2016-01-28T17:43:04Z","pull_request":{"url":"https://api.github.com/repos/ruby-ldap/ruby-net-ldap/pulls/262","html_url":"https://github.com/ruby-ldap/ruby-net-ldap/pull/262","diff_url":"https://github.com/ruby-ldap/ruby-net-ldap/pull/262.diff","patch_url":"https://github.com/ruby-ldap/ruby-net-ldap/pull/262.patch"},"body":"The current `Net::LDAP::Connection::wrap_with_ssl` verifies the certification paths of SSL certificates correctly, but it does not verify hostnames. This means any service with a certificate issued by the same CA as the LDAP server can impersonate the LDAP server. (Note: this is probably CVE worthy. Let me know if you'd like help getting a CVE assigned)\r\n\r\nThis PR is more of a strawman implementation than anything to get the ball rolling towards a solution. I think it could definitely use some tests to ensure hostname verification works! But to do that we might want to talk about how to issue all of the certificates needed in the tests."},"comment":{"url":"https://api.github.com/repos/ruby-ldap/ruby-net-ldap/issues/comments/176335135","html_url":"https://github.com/ruby-ldap/ruby-net-ldap/pull/262#issuecomment-176335135","issue_url":"https://api.github.com/repos/ruby-ldap/ruby-net-ldap/issues/262","id":176335135,"user":{"login":"JPvRiel","id":9722317,"avatar_url":"https://avatars.githubusercontent.com/u/9722317?v=3","gravatar_id":"","url":"https://api.github.com/users/JPvRiel","html_url":"https://github.com/JPvRiel","followers_url":"https://api.github.com/users/JPvRiel/followers","following_url":"https://api.github.com/users/JPvRiel/following{/other_user}","gists_url":"https://api.github.com/users/JPvRiel/gists{/gist_id}","starred_url":"https://api.github.com/users/JPvRiel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JPvRiel/subscriptions","organizations_url":"https://api.github.com/users/JPvRiel/orgs","repos_url":"https://api.github.com/users/JPvRiel/repos","events_url":"https://api.github.com/users/JPvRiel/events{/privacy}","received_events_url":"https://api.github.com/users/JPvRiel/received_events","type":"User","site_admin":false},"created_at":"2016-01-28T18:51:01Z","updated_at":"2016-01-28T18:51:01Z","body":"@tarcieri I thought your approach was technically neater by passing the host address info through the function calls to `wrap_with_ssl` which is where one would logically expect to perform SSL checks. My fix was just hacked into the most convenient place.\r\n\r\nRegardless, I also saw notes that the connection handling stuff might be refactored..."}}