Use openssl-verify to check certificate + hostname

Fixes #4954.

components/net/Cargo.toml

@@ -28,6 +28,7 @@ matches = "0.1"
 mime = "0.2.0"
 mime_guess = "1.6.0"
 openssl = "0.7.6"
+openssl-verify = "0.1"
 rustc-serialize = "0.3"
 threadpool = "1.0"
 time = "0.1.17"

components/net/connector.rs

@@ -3,12 +3,13 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 use hyper::client::Pool;
-use hyper::net::{HttpsConnector, Openssl};
+use hyper::net::{HttpStream, HttpsConnector, SslClient};
-use openssl::ssl::{SSL_OP_NO_SSLV2, SSL_OP_NO_SSLV3, SSL_VERIFY_PEER, SslContext, SslMethod};
+use openssl::ssl::{SSL_OP_NO_SSLV2, SSL_OP_NO_SSLV3, SSL_VERIFY_PEER};
+use openssl::ssl::{Ssl, SslContext, SslMethod, SslStream};
 use std::sync::Arc;
 use util::resource_files::resources_dir_path;
 
-pub type Connector = HttpsConnector<Openssl>;
+pub type Connector = HttpsConnector<ServoSslClient>;
 
 // The basic logic here is to prefer ciphers with ECDSA certificates, Forward
 // Secrecy, AES GCM ciphers, AES ciphers, and finally 3DES ciphers.
@@ -28,13 +29,30 @@ const DEFAULT_CIPHERS: &'static str = concat!(
 
 pub fn create_http_connector() -> Arc<Pool<Connector>> {
     let mut context = SslContext::new(SslMethod::Sslv23).unwrap();
-    context.set_verify(SSL_VERIFY_PEER, None);
     context.set_CA_file(&resources_dir_path().join("certs")).unwrap();
     context.set_cipher_list(DEFAULT_CIPHERS).unwrap();
     context.set_options(SSL_OP_NO_SSLV2 | SSL_OP_NO_SSLV3);
-    let connector = HttpsConnector::new(Openssl {
+    let connector = HttpsConnector::new(ServoSslClient {
         context: Arc::new(context)
     });
 
     Arc::new(Pool::with_connector(Default::default(), connector))
 }
+
+pub struct ServoSslClient {
+    context: Arc<SslContext>,
+}
+
+impl SslClient for ServoSslClient {
+    type Stream = SslStream<HttpStream>;
+
+    fn wrap_client(&self, stream: HttpStream, host: &str) -> Result<Self::Stream, ::hyper::Error> {
+        let mut ssl = try!(Ssl::new(&self.context));
+        try!(ssl.set_hostname(host));
+        let host = host.to_owned();
+        ssl.set_verify_callback(SSL_VERIFY_PEER, move |p, x| {
+            ::openssl_verify::verify_callback(&host, p, x)
+        });
+        SslStream::connect(ssl, stream).map_err(From::from)
+    }
+}

components/net/lib.rs

@@ -29,6 +29,7 @@ extern crate mime_guess;
 extern crate msg;
 extern crate net_traits;
 extern crate openssl;
+extern crate openssl_verify;
 extern crate rustc_serialize;
 extern crate threadpool;
 extern crate time;

components/servo/Cargo.lock

@@ -1346,6 +1346,7 @@ dependencies = [
  "msg 0.0.1",
  "net_traits 0.0.1",
  "openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
+ "openssl-verify 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "plugins 0.0.1",
  "rustc-serialize 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)",
  "threadpool 1.0.1 (registry+https://github.com/rust-lang/crates.io-index)",
@@ -1581,6 +1582,14 @@ dependencies = [
  "openssl-sys 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
+[[package]]
+name = "openssl-verify"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
 [[package]]
 name = "osmesa-sys"
 version = "0.0.5"

ports/cef/Cargo.lock

@@ -1260,6 +1260,7 @@ dependencies = [
  "msg 0.0.1",
  "net_traits 0.0.1",
  "openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
+ "openssl-verify 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "plugins 0.0.1",
  "rustc-serialize 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)",
  "threadpool 1.0.1 (registry+https://github.com/rust-lang/crates.io-index)",
@@ -1469,6 +1470,14 @@ dependencies = [
  "openssl-sys 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
+[[package]]
+name = "openssl-verify"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
 [[package]]
 name = "osmesa-sys"
 version = "0.0.5"

ports/gonk/Cargo.lock

@@ -1243,6 +1243,7 @@ dependencies = [
  "msg 0.0.1",
  "net_traits 0.0.1",
  "openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
+ "openssl-verify 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "plugins 0.0.1",
  "rustc-serialize 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)",
  "threadpool 1.0.1 (registry+https://github.com/rust-lang/crates.io-index)",
@@ -1452,6 +1453,14 @@ dependencies = [
  "openssl-sys 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
+[[package]]
+name = "openssl-verify"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+dependencies = [
+ "openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
 [[package]]
 name = "osmesa-sys"
 version = "0.0.5"