diff options
Diffstat (limited to 'crypto/http')
| -rw-r--r-- | crypto/http/http_client.c | 26 | ||||
| -rw-r--r-- | crypto/http/http_err.c | 4 | ||||
| -rw-r--r-- | crypto/http/http_lib.c | 8 |
3 files changed, 30 insertions, 8 deletions
diff --git a/crypto/http/http_client.c b/crypto/http/http_client.c index cc12545fc447..1e603d870c03 100644 --- a/crypto/http/http_client.c +++ b/crypto/http/http_client.c @@ -1,5 +1,5 @@ /* - * Copyright 2001-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2001-2026 The OpenSSL Project Authors. All Rights Reserved. * Copyright Siemens AG 2018-2020 * * Licensed under the Apache License 2.0 (the "License"). You may not use @@ -551,6 +551,7 @@ static int may_still_retry(time_t max_time, int *ptimeout) int OSSL_HTTP_REQ_CTX_nbio(OSSL_HTTP_REQ_CTX *rctx) { int i, found_expected_ct = 0, found_keep_alive = 0; + int status_code = 0; int got_text = 1; long n; size_t resp_len = 0; @@ -751,8 +752,8 @@ next_io: /* First line in response header */ if (rctx->state == OHS_FIRSTLINE) { - i = parse_http_line1(buf, &found_keep_alive); - switch (i) { + status_code = parse_http_line1(buf, &found_keep_alive); + switch (status_code) { case HTTP_STATUS_CODE_OK: rctx->state = OHS_HEADERS; goto next_line; @@ -767,7 +768,7 @@ next_io: /* fall through */ default: /* must return content if status >= 400 */ - rctx->state = i < HTTP_STATUS_CODES_NONFATAL_ERROR + rctx->state = status_code < HTTP_STATUS_CODES_NONFATAL_ERROR ? OHS_HEADERS_ERROR : OHS_HEADERS; goto next_line; /* continue parsing, also on HTTP error */ @@ -797,6 +798,17 @@ next_io: } if (OPENSSL_strcasecmp(key, "Content-Type") == 0) { got_text = HAS_CASE_PREFIX(value, "text/"); + if (got_text + && rctx->state == OHS_HEADERS + && rctx->expect_asn1 + && (status_code >= HTTP_STATUS_CODES_NONFATAL_ERROR + || status_code == HTTP_STATUS_CODE_OK)) { + ERR_raise_data(ERR_LIB_HTTP, HTTP_R_CONTENT_TYPE_MISMATCH, + "expected ASN.1 content but got http code %d with Content-Type: %s", + status_code, value); + rctx->state = OHS_HEADERS_ERROR; + goto next_line; + } if (rctx->state == OHS_HEADERS && rctx->expected_ct != NULL) { const char *semicolon; @@ -1452,7 +1464,11 @@ int OSSL_HTTP_proxy_connect(BIO *bio, const char *server, const char *port, } BIO_push(fbio, bio); - BIO_printf(fbio, "CONNECT %s:%s " HTTP_1_0 "\r\n", server, port); + /* Add square brackets around a naked IPv6 address */ + if (server[0] != '[' && strchr(server, ':') != NULL) + BIO_printf(fbio, "CONNECT [%s]:%s " HTTP_1_0 "\r\n", server, port); + else + BIO_printf(fbio, "CONNECT %s:%s " HTTP_1_0 "\r\n", server, port); /* * Workaround for broken proxies which would otherwise close diff --git a/crypto/http/http_err.c b/crypto/http/http_err.c index 947a403d6009..8598dd1ff48a 100644 --- a/crypto/http/http_err.c +++ b/crypto/http/http_err.c @@ -1,6 +1,6 @@ /* * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -20,6 +20,8 @@ static const ERR_STRING_DATA HTTP_str_reasons[] = { { ERR_PACK(ERR_LIB_HTTP, 0, HTTP_R_ASN1_LEN_EXCEEDS_MAX_RESP_LEN), "asn1 len exceeds max resp len" }, { ERR_PACK(ERR_LIB_HTTP, 0, HTTP_R_CONNECT_FAILURE), "connect failure" }, + { ERR_PACK(ERR_LIB_HTTP, 0, HTTP_R_CONTENT_TYPE_MISMATCH), + "content type mismatch" }, { ERR_PACK(ERR_LIB_HTTP, 0, HTTP_R_ERROR_PARSING_ASN1_LENGTH), "error parsing asn1 length" }, { ERR_PACK(ERR_LIB_HTTP, 0, HTTP_R_ERROR_PARSING_CONTENT_LENGTH), diff --git a/crypto/http/http_lib.c b/crypto/http/http_lib.c index 54c5c6ec1d8f..c8ffd87c0620 100644 --- a/crypto/http/http_lib.c +++ b/crypto/http/http_lib.c @@ -1,5 +1,5 @@ /* - * Copyright 2001-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2001-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -55,6 +55,7 @@ int OSSL_parse_url(const char *url, char **pscheme, char **puser, char **phost, char **ppath, char **pquery, char **pfrag) { const char *p, *tmp; + const char *authority_end; const char *scheme, *scheme_end; const char *user, *user_end; const char *host, *host_end; @@ -92,7 +93,10 @@ int OSSL_parse_url(const char *url, char **pscheme, char **puser, char **phost, /* parse optional "userinfo@" */ user = user_end = host = p; - host = strchr(p, '@'); + authority_end = strpbrk(p, "/?#"); + if (authority_end == NULL) + authority_end = p + strlen(p); + host = memchr(p, '@', authority_end - p); if (host != NULL) user_end = host++; else |