romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 15:23:38 +03:00
Code Issues Projects Releases Packages Wiki Activity

httpsrr: DoH with HTTPS, fix response handling

Browse source 
Fix handling of DoH response that only asks for HTTPS records.

Add test 2117 for checking that a HTTPS-RR resolve is processed,
even though the actual answer is invalid.

Closes #22372
This commit is contained in:
Stefan Eissing 2026-07-23 11:20:19 +02:00 • committed by Daniel Stenberg
parent 474ebb5247
commit a954d87f0b
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
9 changed files with 155 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/Makefile.am
View file

@ -254,7 +254,7 @@ test2072 test2073 test2074 test2075 test2076 test2077 test2078 test2079 \
test2080 test2081 test2082 test2083 test2084 test2085 test2086 test2087 \
test2088 test2089 test2090 test2091 test2092 test2093 \
test2100 test2101 test2102 test2103 test2104 test2105 test2106 test2107 \
test2108 test2109 test2110 test2113 test2114 test2115 test2116 \
test2108 test2109 test2110 test2113 test2114 test2115 test2116 test2117 \
\
test2200 test2201 test2202 test2203 test2204 test2205 test2206 test2207 \
test2208 \

102
tests/data/test2117 Normal file
View file

@ -0,0 +1,102 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
HTTP
HTTP GET
DOH
httpsrr
</keywords>
</info>
# Server-side
<reply>
# This is the DoH response for foo.example.com A 127.0.0.1. It will be sent
# for all DoH requests, so the AAAA and HTTPS resolves will fail with wrong
# data. But it does verify that the responses are acted upon.
# This requires that the test server is accessible at that address!
<data1 base64="yes">
SFRUUC8xLjEgMjAwIE9LCkRhdGU6IFRodSwgMDkgTm92IDIwMTAgMTQ6NDk6MDAgR01UClNlcnZl
cjogdGVzdC1zZXJ2ZXIvZmFrZQpDb25uZWN0aW9uOiBjbG9zZQpDb250ZW50LVR5cGU6IGFwcGxp
Y2F0aW9uL2Rucy1tZXNzYWdlCkNvbnRlbnQtTGVuZ3RoOiA0OQoKAAABAAABAAEAAAAAA2Zvbwdl
eGFtcGxlA2NvbQAAAQABwAwAAQABAAAANwAEfwAAAQ==
</data1>
<data>
HTTP/1.1 200 OK
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
ETag: "21025-dc7-39462498"
Accept-Ranges: bytes
Content-Length: 6
Connection: close
Content-Type: text/html
Funny-head: yesyes
-foo-
</data>
</reply>
# Client-side
<client>
<server>
http
https
</server>
# requires Debug so that it can use the DoH server without https
# requires IPv6 so that we can assume and compare both DoH requests
<features>
Debug
DoH
IPv6
ECH
HTTPSRR
</features>
<name>
HTTP GET using DoH with mandatory HTTPS-RR response
</name>
<command>
https://foo.example.com:%HTTPSPORT/%TESTNUMBER --insecure --ech true --connect-timeout 20 --doh-insecure --doh-url https://%HOSTIP:%HTTPSPORT/%TESTNUMBER0001
</command>
</client>
# Verify data after the test has been "shot"
<verify>
# To make the test ignore the order of the two outgoing DoH requests, strip
# the family byte
<strippart>
s/com\x00\x00(\x1c|\x01)/com-00-00!/g;
</strippart>
<protocol crlf="yes">
POST /%TESTNUMBER0001 HTTP/1.1
Host: %HOSTIP:%HTTPSPORT
Accept: */*
Content-Type: application/dns-message
Content-Length: 47
%hex[%00%00%01%00%00%01%00%00%00%00%00%00%06_%HTTPSPORT%06_https%03foo%07example%03com%00%00A%00%01]hex%POST /%TESTNUMBER0001 HTTP/1.1
Host: %HOSTIP:%HTTPSPORT
Accept: */*
Content-Type: application/dns-message
Content-Length: 33
%hex[%00%00%01%00%00%01%00%00%00%00%00%00%03foo%07example%03com-00-00!%00%01]hex%POST /%TESTNUMBER0001 HTTP/1.1
Host: %HOSTIP:%HTTPSPORT
Accept: */*
Content-Type: application/dns-message
Content-Length: 33
%hex[%00%00%01%00%00%01%00%00%00%00%00%00%03foo%07example%03com-00-00!%00%01]hex%GET /%TESTNUMBER HTTP/1.1
Host: foo.example.com:%HTTPSPORT
User-Agent: curl/%VERSION
Accept: */*
</protocol>
</verify>
</testcase>