From c6bba3752e94199018af95347221c83e27ee4687 Mon Sep 17 00:00:00 2001 From: Marco Castelluccio Date: Tue, 1 Oct 2019 00:29:18 +0000 Subject: [PATCH] servo: Merge #11115 - Use openssl-verify to check certificate + hostname (from mbrubeck:openssl-verify); r=jdm Fixes #4954. r? jdm This is based on hyperium/hyper#472, though it doesn't re-use that code directly because Servo configures its own OpenSSL context. Source-Repo: https://github.com/servo/servo Source-Revision: 40be84df26ce3ce80851e751374154c015506921 UltraBlame original commit: 4403e83bbb8e763bb0f0e8509051a286eb73ec41 --- servo/components/net/Cargo.toml | 1 + servo/components/net/connector.rs | 58 +++++++++++++++++++++++++ servo/components/net/fetch/methods.rs | 3 +- servo/components/net/http_loader.rs | 36 +-------------- servo/components/net/lib.rs | 2 + servo/components/net/resource_thread.rs | 3 +- servo/components/servo/Cargo.lock | 9 ++++ servo/ports/cef/Cargo.lock | 9 ++++ servo/ports/gonk/Cargo.lock | 9 ++++ 9 files changed, 94 insertions(+), 36 deletions(-) create mode 100644 servo/components/net/connector.rs diff --git a/servo/components/net/Cargo.toml b/servo/components/net/Cargo.toml index 14b9914d51fde..aea1f11e5bc38 100644 --- a/servo/components/net/Cargo.toml +++ b/servo/components/net/Cargo.toml @@ -28,6 +28,7 @@ matches = "0.1" mime = "0.2.0" mime_guess = "1.6.0" openssl = "0.7.6" +openssl-verify = "0.1" rustc-serialize = "0.3" threadpool = "1.0" time = "0.1.17" diff --git a/servo/components/net/connector.rs b/servo/components/net/connector.rs new file mode 100644 index 0000000000000..7e52d3b25a426 --- /dev/null +++ b/servo/components/net/connector.rs @@ -0,0 +1,58 @@ + + + + +use hyper::client::Pool; +use hyper::net::{HttpStream, HttpsConnector, SslClient}; +use openssl::ssl::{SSL_OP_NO_SSLV2, SSL_OP_NO_SSLV3, SSL_VERIFY_PEER}; +use openssl::ssl::{Ssl, SslContext, SslMethod, SslStream}; +use std::sync::Arc; +use util::resource_files::resources_dir_path; + +pub type Connector = HttpsConnector; + + + + + +const DEFAULT_CIPHERS: &'static str = concat!( + "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:", + "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:", + "DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:", + "ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:", + "ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:", + "ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:", + "DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:", + "ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:", + "AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA" +); + +pub fn create_http_connector() -> Arc> { + let mut context = SslContext::new(SslMethod::Sslv23).unwrap(); + context.set_CA_file(&resources_dir_path().join("certs")).unwrap(); + context.set_cipher_list(DEFAULT_CIPHERS).unwrap(); + context.set_options(SSL_OP_NO_SSLV2 | SSL_OP_NO_SSLV3); + let connector = HttpsConnector::new(ServoSslClient { + context: Arc::new(context) + }); + + Arc::new(Pool::with_connector(Default::default(), connector)) +} + +pub struct ServoSslClient { + context: Arc, +} + +impl SslClient for ServoSslClient { + type Stream = SslStream; + + fn wrap_client(&self, stream: HttpStream, host: &str) -> Result { + let mut ssl = try!(Ssl::new(&self.context)); + try!(ssl.set_hostname(host)); + let host = host.to_owned(); + ssl.set_verify_callback(SSL_VERIFY_PEER, move |p, x| { + ::openssl_verify::verify_callback(&host, p, x) + }); + SslStream::connect(ssl, stream).map_err(From::from) + } +} diff --git a/servo/components/net/fetch/methods.rs b/servo/components/net/fetch/methods.rs index 34c1cdf622497..02e22acc51b7b 100644 --- a/servo/components/net/fetch/methods.rs +++ b/servo/components/net/fetch/methods.rs @@ -2,9 +2,10 @@ +use connector::create_http_connector; use data_loader::decode; use fetch::cors_cache::CORSCache; -use http_loader::{NetworkHttpRequestFactory, create_http_connector, obtain_response}; +use http_loader::{NetworkHttpRequestFactory, obtain_response}; use hyper::header::{Accept, AcceptLanguage, Authorization, AccessControlAllowCredentials}; use hyper::header::{AccessControlAllowOrigin, AccessControlAllowHeaders, AccessControlAllowMethods}; use hyper::header::{AccessControlRequestHeaders, AccessControlMaxAge, AccessControlRequestMethod, Basic}; diff --git a/servo/components/net/http_loader.rs b/servo/components/net/http_loader.rs index d319a5d720161..57d8f5eca328e 100644 --- a/servo/components/net/http_loader.rs +++ b/servo/components/net/http_loader.rs @@ -4,6 +4,7 @@ use brotli::Decompressor; +use connector::Connector; use cookie; use cookie_storage::CookieStorage; use devtools_traits::{ChromeToDevtoolsControlMsg, DevtoolsControlMsg, HttpRequest as DevtoolsHttpRequest}; @@ -19,7 +20,7 @@ use hyper::header::{Location, SetCookie, StrictTransportSecurity, UserAgent, qit use hyper::http::RawStatus; use hyper::method::Method; use hyper::mime::{Mime, SubLevel, TopLevel}; -use hyper::net::{Fresh, HttpsConnector, Openssl}; +use hyper::net::Fresh; use hyper::status::{StatusClass, StatusCode}; use log; use mime_classifier::MIMEClassifier; @@ -30,7 +31,6 @@ use net_traits::response::HttpsState; use net_traits::{CookieSource, IncludeSubdomains, LoadConsumer, LoadContext, LoadData}; use net_traits::{Metadata, NetworkError}; use openssl::ssl::error::{SslError, OpensslError}; -use openssl::ssl::{SSL_OP_NO_SSLV2, SSL_OP_NO_SSLV3, SSL_VERIFY_PEER, SslContext, SslMethod}; use resource_thread::{CancellationListener, send_error, start_sending_sniffed_opt, AuthCache, AuthCacheEntry}; use std::borrow::ToOwned; use std::boxed::FnBox; @@ -46,41 +46,9 @@ use time::Tm; use tinyfiledialogs; use url::{Url, Position}; use util::prefs; -use util::resource_files::resources_dir_path; use util::thread::spawn_named; use uuid; -pub type Connector = HttpsConnector; - - - - - -const DEFAULT_CIPHERS: &'static str = concat!( - "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:", - "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:", - "DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:", - "ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:", - "ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:", - "ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:", - "DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:", - "ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:", - "AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA" -); - -pub fn create_http_connector() -> Arc> { - let mut context = SslContext::new(SslMethod::Sslv23).unwrap(); - context.set_verify(SSL_VERIFY_PEER, None); - context.set_CA_file(&resources_dir_path().join("certs")).unwrap(); - context.set_cipher_list(DEFAULT_CIPHERS).unwrap(); - context.set_options(SSL_OP_NO_SSLV2 | SSL_OP_NO_SSLV3); - let connector = HttpsConnector::new(Openssl { - context: Arc::new(context) - }); - - Arc::new(Pool::with_connector(Default::default(), connector)) -} - pub fn factory(user_agent: String, http_state: HttpState, devtools_chan: Option>, diff --git a/servo/components/net/lib.rs b/servo/components/net/lib.rs index 8b1b5e27b85a1..0895a09fc89c0 100644 --- a/servo/components/net/lib.rs +++ b/servo/components/net/lib.rs @@ -29,6 +29,7 @@ extern crate mime_guess; extern crate msg; extern crate net_traits; extern crate openssl; +extern crate openssl_verify; extern crate rustc_serialize; extern crate threadpool; extern crate time; @@ -44,6 +45,7 @@ extern crate websocket; pub mod about_loader; pub mod bluetooth_thread; pub mod chrome_loader; +pub mod connector; pub mod cookie; pub mod cookie_storage; pub mod data_loader; diff --git a/servo/components/net/resource_thread.rs b/servo/components/net/resource_thread.rs index 4fa7dc3f02890..61f3792e120eb 100644 --- a/servo/components/net/resource_thread.rs +++ b/servo/components/net/resource_thread.rs @@ -5,13 +5,14 @@ use about_loader; use chrome_loader; +use connector::{Connector, create_http_connector}; use cookie; use cookie_storage::CookieStorage; use data_loader; use devtools_traits::{DevtoolsControlMsg}; use file_loader; use hsts::HstsList; -use http_loader::{self, Connector, create_http_connector, HttpState}; +use http_loader::{self, HttpState}; use hyper::client::pool::Pool; use hyper::header::{ContentType, Header, SetCookie}; use hyper::mime::{Mime, SubLevel, TopLevel}; diff --git a/servo/components/servo/Cargo.lock b/servo/components/servo/Cargo.lock index c41be106a9f4b..185b7428af1d6 100644 --- a/servo/components/servo/Cargo.lock +++ b/servo/components/servo/Cargo.lock @@ -1346,6 +1346,7 @@ dependencies = [ "msg 0.0.1", "net_traits 0.0.1", "openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)", + "openssl-verify 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)", "plugins 0.0.1", "rustc-serialize 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)", "threadpool 1.0.1 (registry+https://github.com/rust-lang/crates.io-index)", @@ -1581,6 +1582,14 @@ dependencies = [ "openssl-sys 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)", ] +[[package]] +name = "openssl-verify" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)", +] + [[package]] name = "osmesa-sys" version = "0.0.5" diff --git a/servo/ports/cef/Cargo.lock b/servo/ports/cef/Cargo.lock index d5120a26790fc..0fee2bea10f46 100644 --- a/servo/ports/cef/Cargo.lock +++ b/servo/ports/cef/Cargo.lock @@ -1260,6 +1260,7 @@ dependencies = [ "msg 0.0.1", "net_traits 0.0.1", "openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)", + "openssl-verify 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)", "plugins 0.0.1", "rustc-serialize 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)", "threadpool 1.0.1 (registry+https://github.com/rust-lang/crates.io-index)", @@ -1469,6 +1470,14 @@ dependencies = [ "openssl-sys 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)", ] +[[package]] +name = "openssl-verify" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)", +] + [[package]] name = "osmesa-sys" version = "0.0.5" diff --git a/servo/ports/gonk/Cargo.lock b/servo/ports/gonk/Cargo.lock index d01c6a2814021..d821a84bbb76d 100644 --- a/servo/ports/gonk/Cargo.lock +++ b/servo/ports/gonk/Cargo.lock @@ -1243,6 +1243,7 @@ dependencies = [ "msg 0.0.1", "net_traits 0.0.1", "openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)", + "openssl-verify 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)", "plugins 0.0.1", "rustc-serialize 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)", "threadpool 1.0.1 (registry+https://github.com/rust-lang/crates.io-index)", @@ -1452,6 +1453,14 @@ dependencies = [ "openssl-sys 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)", ] +[[package]] +name = "openssl-verify" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +dependencies = [ + "openssl 0.7.11 (registry+https://github.com/rust-lang/crates.io-index)", +] + [[package]] name = "osmesa-sys" version = "0.0.5"