romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 23:43:40 +03:00
Code Issues Projects Releases Packages Wiki Activity

openssl: test and fix for forward proxy handling (non-tunneling).

Browse source 
- adding pytest test_10 cases for proxy httpd setup tests
- fixing openssl bug in https: proxy hostname verification that
  used the hostname of the request and not the proxy name.

Closes #10498
This commit is contained in:
Stefan Eissing 2023-02-13 16:15:20 +01:00 • committed by Daniel Stenberg
parent 17153e173d
commit ce0cad713d
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 133 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

28
lib/vtls/openssl.c
View file

@ -2122,6 +2122,22 @@ static bool subj_alt_hostcheck(struct Curl_easy *data,
return FALSE;
}
static CURLcode
ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
X509 *server_cert, const char *hostname,
const char *dispname);
CURLcode Curl_ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
X509 *server_cert)
{
const char *hostname, *dispname;
int port;
(void)conn;
Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &dispname, &port);
return ossl_verifyhost(data, conn, server_cert, hostname, dispname);
}
/* Quote from RFC2818 section 3.1 "Server Identity"
If a subjectAltName extension of type dNSName is present, that MUST
@ -2144,8 +2160,10 @@ static bool subj_alt_hostcheck(struct Curl_easy *data,
This function is now used from ngtcp2 (QUIC) as well.
*/
CURLcode Curl_ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
X509 *server_cert)
static CURLcode
ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
X509 *server_cert, const char *hostname,
const char *dispname)
{
bool matched = FALSE;
int target = GEN_DNS; /* target type, GEN_DNS or GEN_IPADD */
@ -2159,12 +2177,9 @@ CURLcode Curl_ossl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
CURLcode result = CURLE_OK;
bool dNSName = FALSE; /* if a dNSName field exists in the cert */
bool iPAddress = FALSE; /* if a iPAddress field exists in the cert */
const char *hostname, *dispname;
int port;
size_t hostlen;
(void)conn;
Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &dispname, &port);
hostlen = strlen(hostname);
#ifndef ENABLE_IPV6
@ -4129,7 +4144,8 @@ static CURLcode servercert(struct Curl_cfilter *cf,
BIO_free(mem);
if(conn_config->verifyhost) {
result = Curl_ossl_verifyhost(data, conn, backend->server_cert);
result = ossl_verifyhost(data, conn, backend->server_cert,
connssl->hostname, connssl->dispname);
if(result) {
X509_free(backend->server_cert);
backend->server_cert = NULL;