Skip to content

Commit

Permalink
Issue1431 (yhirose#1926)
Browse files Browse the repository at this point in the history
* Renamed enable_server_host_verification to enable_server_hostname_verification and added Error::SSLServerHostnameVerification

* Add some Open SSL function calls

* Code cleanup

* Fix yhirose#1431
  • Loading branch information
yhirose authored Sep 9, 2024
1 parent 82fcbe3 commit e612154
Showing 1 changed file with 37 additions and 18 deletions.
55 changes: 37 additions & 18 deletions httplib.h
Original file line number Diff line number Diff line change
Expand Up @@ -1452,6 +1452,7 @@ class ClientImpl {
#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
void enable_server_certificate_verification(bool enabled);
void enable_server_hostname_verification(bool enabled);
void set_server_certificate_verifier(std::function<bool(SSL *ssl)> verifier);
#endif

void set_logger(Logger logger);
Expand Down Expand Up @@ -1567,6 +1568,7 @@ class ClientImpl {
#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
bool server_certificate_verification_ = true;
bool server_hostname_verification_ = true;
std::function<bool(SSL *ssl)> server_certificate_verifier_;
#endif

Logger logger_;
Expand Down Expand Up @@ -1873,6 +1875,7 @@ class Client {
#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
void enable_server_certificate_verification(bool enabled);
void enable_server_hostname_verification(bool enabled);
void set_server_certificate_verifier(std::function<bool(SSL *ssl)> verifier);
#endif

void set_logger(Logger logger);
Expand Down Expand Up @@ -7219,6 +7222,7 @@ inline void ClientImpl::copy_settings(const ClientImpl &rhs) {
#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
server_certificate_verification_ = rhs.server_certificate_verification_;
server_hostname_verification_ = rhs.server_hostname_verification_;
server_certificate_verifier_ = rhs.server_certificate_verifier_;
#endif
logger_ = rhs.logger_;
}
Expand Down Expand Up @@ -8700,9 +8704,7 @@ inline X509_STORE *ClientImpl::create_ca_cert_store(const char *ca_cert,
if (!mem) { return nullptr; }

auto inf = PEM_X509_INFO_read_bio(mem, nullptr, nullptr, nullptr);
if (!inf) {
return nullptr;
}
if (!inf) { return nullptr; }

auto cts = X509_STORE_new();
if (cts) {
Expand All @@ -8726,6 +8728,11 @@ inline void ClientImpl::enable_server_certificate_verification(bool enabled) {
inline void ClientImpl::enable_server_hostname_verification(bool enabled) {
server_hostname_verification_ = enabled;
}

inline void ClientImpl::set_server_certificate_verifier(
std::function<bool(SSL *ssl)> verifier) {
server_certificate_verifier_ = verifier;
}
#endif

inline void ClientImpl::set_logger(Logger logger) {
Expand Down Expand Up @@ -9311,26 +9318,33 @@ inline bool SSLClient::initialize_ssl(Socket &socket, Error &error) {
}

if (server_certificate_verification_) {
verify_result_ = SSL_get_verify_result(ssl2);

if (verify_result_ != X509_V_OK) {
error = Error::SSLServerVerification;
return false;
}
if (server_certificate_verifier_) {
if (!server_certificate_verifier_(ssl2)) {
error = Error::SSLServerVerification;
return false;
}
} else {
verify_result_ = SSL_get_verify_result(ssl2);

auto server_cert = SSL_get1_peer_certificate(ssl2);
auto se = detail::scope_exit([&] { X509_free(server_cert); });
if (verify_result_ != X509_V_OK) {
error = Error::SSLServerVerification;
return false;
}

if (server_cert == nullptr) {
error = Error::SSLServerVerification;
return false;
}
auto server_cert = SSL_get1_peer_certificate(ssl2);
auto se = detail::scope_exit([&] { X509_free(server_cert); });

if (server_hostname_verification_) {
if (!verify_host(server_cert)) {
error = Error::SSLServerHostnameVerification;
if (server_cert == nullptr) {
error = Error::SSLServerVerification;
return false;
}

if (server_hostname_verification_) {
if (!verify_host(server_cert)) {
error = Error::SSLServerHostnameVerification;
return false;
}
}
}
}

Expand Down Expand Up @@ -10066,6 +10080,11 @@ inline void Client::enable_server_certificate_verification(bool enabled) {
inline void Client::enable_server_hostname_verification(bool enabled) {
cli_->enable_server_hostname_verification(enabled);
}

inline void Client::set_server_certificate_verifier(
std::function<bool(SSL *ssl)> verifier) {
cli_->set_server_certificate_verifier(verifier);
}
#endif

inline void Client::set_logger(Logger logger) {
Expand Down

0 comments on commit e612154

Please sign in to comment.