romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-28 19:03:06 +03:00
Code Issues Projects Releases Packages Wiki Activity

hsts: duplicate live HSTS data in curl_easy_duphandle

Browse source 
Verified by test 1922

Closes #21809
This commit is contained in:
A Johnston 2026-06-01 14:52:23 -07:00 • committed by Daniel Stenberg
parent 4ead4285a6
commit 084ceb6601
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
8 changed files with 244 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/Makefile.am
View file

@ -231,7 +231,7 @@ test1800 test1801 test1802 test1847 test1848 test1849 test1850 test1851 \
\
test1900 test1901 test1902 test1903 test1904 test1905 test1906 test1907 \
test1908 test1909 test1910 test1911 test1912 test1913 test1914 test1915 \
test1916 test1917 test1918 test1919 test1920 test1921 \
test1916 test1917 test1918 test1919 test1920 test1921 test1922 \
\
test1933 test1934 test1935 test1936 test1937 test1938 test1939 test1940 \
test1941 test1942 test1943 test1944 test1945 test1946 test1947 test1948 \

91
tests/data/test1922 Normal file
View file

@ -0,0 +1,91 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
HTTP
HTTP proxy
HSTS
curl_easy_duphandle
</keywords>
</info>
<reply>
<!-- Response to the original handle's direct HTTP request.
Strict-Transport-Security header populates the live HSTS cache. -->
<data nocheck="yes" crlf="headers">
HTTP/1.1 200 OK
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Content-Type: text/plain
Content-Length: 5
Strict-Transport-Security: max-age=31536000
Hello
</data>
<!-- Response to the dup handle's proxy CONNECT attempt.
The CONNECT to port 443 proves the copied
HSTS cache upgraded the dup's HTTP URL to HTTPS. -->
<connect crlf="headers">
HTTP/1.1 403 Forbidden
Content-Length: 0
Connection: close
</connect>
</reply>
<client>
<features>
HSTS
https
Debug
proxy
</features>
<server>
http
http-proxy
</server>
<setenv>
CURL_HSTS_HTTP=yes
</setenv>
<name>
curl_easy_duphandle copies HSTS cache, auto upgrading HTTP to HTTPS.
</name>
<tool>
lib%TESTNUMBER
</tool>
<command>
- %HOSTIP %HTTPPORT %PROXYPORT
</command>
</client>
<verify>
# First request: original handle GETs from the http server; the response
# carries Strict-Transport-Security, populating the live HSTS cache that
# the dup inherits.
<protocol crlf="headers">
GET /%TESTNUMBER HTTP/1.1
Host: hsts.example.com:%HTTPPORT
Accept: */*
</protocol>
# Second request: dup handle upgraded HTTP to HTTPS by copied HSTS cache,
# proxy receives CONNECT to port 443 proving the upgrade happened
<proxy crlf="headers">
CONNECT hsts.example.com:443 HTTP/1.1
Host: hsts.example.com:443
Proxy-Connection: Keep-Alive
</proxy>
<stdout>
First request: HTTPS cache populated
Dup effective URL: https://hsts.example.com/%TESTNUMBER
</stdout>
# CURLE_COULDNT_CONNECT (7) is intentional: The proxy rejects the CONNECT
# to port 443, collapsing the tunnel. All that is being validated is the
# CONNECT to port 443 itself.
<errorcode>
7
</errorcode>
</verify>
</testcase>