diff options
Diffstat (limited to 'crypto/http/http_client.c')
| -rw-r--r-- | crypto/http/http_client.c | 26 |
1 files changed, 21 insertions, 5 deletions
diff --git a/crypto/http/http_client.c b/crypto/http/http_client.c index cc12545fc447..1e603d870c03 100644 --- a/crypto/http/http_client.c +++ b/crypto/http/http_client.c @@ -1,5 +1,5 @@ /* - * Copyright 2001-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2001-2026 The OpenSSL Project Authors. All Rights Reserved. * Copyright Siemens AG 2018-2020 * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -551,6 +551,7 @@ static int may_still_retry(time_t max_time, int *ptimeout) int OSSL_HTTP_REQ_CTX_nbio(OSSL_HTTP_REQ_CTX *rctx) { int i, found_expected_ct = 0, found_keep_alive = 0; + int status_code = 0; int got_text = 1; long n; size_t resp_len = 0; @@ -751,8 +752,8 @@ next_io: /* First line in response header */ if (rctx->state == OHS_FIRSTLINE) { - i = parse_http_line1(buf, &found_keep_alive); - switch (i) { + status_code = parse_http_line1(buf, &found_keep_alive); + switch (status_code) { case HTTP_STATUS_CODE_OK: rctx->state = OHS_HEADERS; goto next_line; @@ -767,7 +768,7 @@ next_io: /* fall through */ default: /* must return content if status >= 400 */ - rctx->state = i < HTTP_STATUS_CODES_NONFATAL_ERROR + rctx->state = status_code < HTTP_STATUS_CODES_NONFATAL_ERROR ? OHS_HEADERS_ERROR : OHS_HEADERS; goto next_line; /* continue parsing, also on HTTP error */ @@ -797,6 +798,17 @@ next_io: } if (OPENSSL_strcasecmp(key, "Content-Type") == 0) { got_text = HAS_CASE_PREFIX(value, "text/"); + if (got_text + && rctx->state == OHS_HEADERS + && rctx->expect_asn1 + && (status_code >= HTTP_STATUS_CODES_NONFATAL_ERROR + || status_code == HTTP_STATUS_CODE_OK)) { + ERR_raise_data(ERR_LIB_HTTP, HTTP_R_CONTENT_TYPE_MISMATCH, + "expected ASN.1 content but got http code %d with Content-Type: %s", + status_code, value); + rctx->state = OHS_HEADERS_ERROR; + goto next_line; + } if (rctx->state == OHS_HEADERS && rctx->expected_ct != NULL) { const char *semicolon; @@ -1452,7 +1464,11 @@ int OSSL_HTTP_proxy_connect(BIO *bio, const char *server, const char *port, } BIO_push(fbio, bio); - BIO_printf(fbio, "CONNECT %s:%s " HTTP_1_0 "\r\n", server, port); + /* Add square brackets around a naked IPv6 address */ + if (server[0] != '[' && strchr(server, ':') != NULL) + BIO_printf(fbio, "CONNECT [%s]:%s " HTTP_1_0 "\r\n", server, port); + else + BIO_printf(fbio, "CONNECT %s:%s " HTTP_1_0 "\r\n", server, port); /* * Workaround for broken proxies which would otherwise close |