Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-07-23 07:13:52 +01:00
Code Issues Projects Releases Packages Wiki Activity

Use openssl-verify to check certificate + hostname

Browse source 
Fixes #4954.
This commit is contained in:
Matt Brubeck 2016-05-10 11:19:00 -07:00
parent c344461017
commit 5695da0c38
6 changed files with 52 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

1
components/net/Cargo.toml
View file

@ -28,6 +28,7 @@ matches = "0.1"
mime = "0.2.0"
mime_guess = "1.6.0"
openssl = "0.7.6"
openssl-verify = "0.1"
rustc-serialize = "0.3"
threadpool = "1.0"
time = "0.1.17"

28
components/net/connector.rs
View file

@ -3,12 +3,13 @@
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
use hyper::client::Pool;
use hyper::net::{HttpsConnector, Openssl};
use openssl::ssl::{SSL_OP_NO_SSLV2, SSL_OP_NO_SSLV3, SSL_VERIFY_PEER, SslContext, SslMethod};
use hyper::net::{HttpStream, HttpsConnector, SslClient};
use openssl::ssl::{SSL_OP_NO_SSLV2, SSL_OP_NO_SSLV3, SSL_VERIFY_PEER};
use openssl::ssl::{Ssl, SslContext, SslMethod, SslStream};
use std::sync::Arc;
use util::resource_files::resources_dir_path;
pub type Connector = HttpsConnector<Openssl>;
pub type Connector = HttpsConnector<ServoSslClient>;
// The basic logic here is to prefer ciphers with ECDSA certificates, Forward
// Secrecy, AES GCM ciphers, AES ciphers, and finally 3DES ciphers.
@ -28,13 +29,30 @@ const DEFAULT_CIPHERS: &'static str = concat!(
pub fn create_http_connector() -> Arc<Pool<Connector>> {
let mut context = SslContext::new(SslMethod::Sslv23).unwrap();
context.set_verify(SSL_VERIFY_PEER, None);
context.set_CA_file(&resources_dir_path().join("certs")).unwrap();
context.set_cipher_list(DEFAULT_CIPHERS).unwrap();
context.set_options(SSL_OP_NO_SSLV2 | SSL_OP_NO_SSLV3);
let connector = HttpsConnector::new(Openssl {
let connector = HttpsConnector::new(ServoSslClient {
context: Arc::new(context)
});
Arc::new(Pool::with_connector(Default::default(), connector))
}
pub struct ServoSslClient {
context: Arc<SslContext>,
}
impl SslClient for ServoSslClient {
type Stream = SslStream<HttpStream>;
fn wrap_client(&self, stream: HttpStream, host: &str) -> Result<Self::Stream, ::hyper::Error> {
let mut ssl = try!(Ssl::new(&self.context));
try!(ssl.set_hostname(host));
let host = host.to_owned();
ssl.set_verify_callback(SSL_VERIFY_PEER, move |p, x| {
::openssl_verify::verify_callback(&host, p, x)
});
SslStream::connect(ssl, stream).map_err(From::from)
}
}

1
components/net/lib.rs
View file

@ -29,6 +29,7 @@ extern crate mime_guess;
extern crate msg;
extern crate net_traits;
extern crate openssl;
extern crate openssl_verify;
extern crate rustc_serialize;
extern crate threadpool;
extern crate time;

9
components/servo/Cargo.lock generated
View file

@ -1346,6 +1346,7 @@ dependencies = [
"msg 0.0.1",
"net_traits 0.0.1",
"openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
"openssl-verify 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
"plugins 0.0.1",
"rustc-serialize 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)",
"threadpool 1.0.1 (registry+https://github.com/rust-lang/crates.io-index)",
@ -1581,6 +1582,14 @@ dependencies = [
"openssl-sys 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
]
[[package]]
name = "openssl-verify"
version = "0.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
dependencies = [
"openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
]
[[package]]
name = "osmesa-sys"
version = "0.0.5"

9
ports/cef/Cargo.lock generated
View file

@ -1260,6 +1260,7 @@ dependencies = [
"msg 0.0.1",
"net_traits 0.0.1",
"openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
"openssl-verify 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
"plugins 0.0.1",
"rustc-serialize 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)",
"threadpool 1.0.1 (registry+https://github.com/rust-lang/crates.io-index)",
@ -1469,6 +1470,14 @@ dependencies = [
"openssl-sys 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
]
[[package]]
name = "openssl-verify"
version = "0.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
dependencies = [
"openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
]
[[package]]
name = "osmesa-sys"
version = "0.0.5"

9
ports/gonk/Cargo.lock generated
View file

@ -1243,6 +1243,7 @@ dependencies = [
"msg 0.0.1",
"net_traits 0.0.1",
"openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
"openssl-verify 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
"plugins 0.0.1",
"rustc-serialize 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)",
"threadpool 1.0.1 (registry+https://github.com/rust-lang/crates.io-index)",
@ -1452,6 +1453,14 @@ dependencies = [
"openssl-sys 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
]
[[package]]
name = "openssl-verify"
version = "0.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
dependencies = [
"openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)",
]
[[package]]
name = "osmesa-sys"
version = "0.0.5"