rapid7/metasploit-framework — pull request #1723 by sempervictus (2013-04-10 18:06:18+00:00)
Title: Override Ruby's net/http to use Rex::Socket::Tcp

This is primarily for framework developers exploring service APIs
with publicly available gems. In a perfect world we would have
Rex::Proto::HTTP handle all of this, but until then we need to be
able to work over meterpreter routes with libraries not written
for Rex. Other protocols are reasonably easy and simple to patch
on a one-off basis since the gems using them are none too complex.
Standard lib net/http is the foundation for the vast majority of
Ruby native API gems. Attacking those APIs over routed sessions
is now easier.

To use, simply require 'net/http_rex' to override the default
Net::HTTP socket behavior. This will turn off SSL validation for
all future net/http sessions created in the VM runtime unless
you work some magic to unload and rebuild the library in the
language tree (something about the SSL validation callback on a
Rex::Socket apparently doesnt work, not digging into it unless
someone requests it).

This is not a "proper implementation" and not required by default
when framework loads. Its a shim and intended to be used as such
when required.