GitHub/openssl
1
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2026-06-06 20:18:09 +00:00
Code Issues Packages Projects Releases Wiki Activity
39,917 Commits 39 Branches 433 Tags
master
Commit Graph
124 Commits
Author SHA1 Message Date
OpenSSL Machine 4c62468c95 Reject CR/LF in HTTP request components 
Reject CR and LF characters before serializing request lines and HTTP
headers. This prevents malformed URL or caller supplied components
from altering the generated HTTP request.

Resolves: https://github.com/openssl/openssl/issues/31099

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Mon May 11 07:44:19 2026
(Merged from https://github.com/openssl/openssl/pull/31100)
 2026-05-11 09:42:58 +02:00
andrei2308 c9fdd8a28a Add check for empty server host in http_lib.c 
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
MergeDate: Wed Apr 29 15:25:32 2026
(Merged from https://github.com/openssl/openssl/pull/30848)
 2026-04-29 17:25:22 +02:00
Peter Zhang b721a59fef Fix CONNECT request for IPv6 targets in OSSL_HTTP_proxy_connect 
When server contains a bare IPv6 address, OSSL_HTTP_proxy_connect() must
wrap it in square brackets for the CONNECT request line (e.g.,
CONNECT [::1]:443 HTTP/1.0).  Also handle the case where the server
string already includes brackets (as returned by OSSL_HTTP_parse_url).

Fixes: 29f178bddf ("Generalize the HTTP client so far implemented mostly in crypto/ocsp/ocsp_ht.c")

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Tue Mar 24 17:32:06 2026
(Merged from https://github.com/openssl/openssl/pull/30384)
 2026-03-24 18:31:58 +01:00
1seal 7aedbb34d0 Fix OSSL_parse_url userinfo scan past authority 
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Mar 11 10:22:54 2026
(Merged from https://github.com/openssl/openssl/pull/30319)
 2026-03-11 11:22:46 +01:00
openssl-machine c721580653 Copyright year updates 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 10 14:37:54 2026
Release: yes
 2026-03-10 14:37:52 +00:00
Tom Gautot 465fd32d33 OSSL_HTTP_REQ_CTX_nbio(): check for clear Content-Type mismatch 
Fixes #29748

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Thu Mar  5 18:04:24 2026
(Merged from https://github.com/openssl/openssl/pull/29829)
 2026-03-05 19:04:13 +01:00
Bob Beck 2fab90bb5e 4.0-POST-CLANG-FORMAT-WEBKIT 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29242)
 2025-12-09 00:28:19 -07:00
Dr. David von Oheimb 5aaf9746f6 http_client.c: make sure to raise error 404 (also in case of further errors like content type mismatch) 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28895)
 2025-10-15 14:52:09 +02:00
Tomas Mraz 6bca15039e use_proxy(): Add missing terminating NUL byte 
Fixes CVE-2025-9232

There is a missing terminating NUL byte after strncpy() call.
Issue and a proposed fix reported by Stanislav Fort (Aisle Research).

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
 2025-09-29 12:03:56 +02:00
Bob Beck e70d3b1886 Add util/codespell-check.sh and run it 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28639)
 2025-09-26 07:58:44 -04:00
Tomas Mraz bb86c43fa8 libapps + libcrypto: Silence warnings on Win64 builds 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27806)
 2025-07-02 17:26:26 +02:00
olszomal 56910e7211 Fix URL parsing to handle missing ports and ISO 8601 timestamps in paths 
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26303)
 2025-04-23 11:27:01 +02:00
openssl-machine 0c679f5566 Copyright year updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes
 2025-03-12 13:35:59 +00:00
Ivan Stanković e599893a9f x509: allow SAN URIs to contain userinfo 
The way we're currently handling SAN URIs does not allow for userinfo,
meaning the name constraint check on such URIs will fail. Fix this by
skipping over the userinfo component:

      authority   = [ userinfo "@" ] host [ ":" port ]

(per RFC 3986).

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25861)
 2025-03-04 17:30:34 +01:00
Dr. David von Oheimb c8932aa94f http_client.c: fix error and default case handling in OSSL_HTTP_REQ_CTX_nbio() state machine 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:11:03 +01:00
Dr. David von Oheimb 64b478419a http_client.c: fix OSSL_HTTP_REQ_CTX_nbio() to return content on non-fatal HTTP status code >=400 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:10:43 +01:00
Dr. David von Oheimb 6de09ebe13 http_client.c: fix redirection in OSSL_HTTP_REQ_CTX_nbio() when non-ASN.1 content is expected 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:10:43 +01:00
Dr. David von Oheimb efb621941a http_client.c: distinguish better between request/response header and body, in particular when tracing 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:10:41 +01:00
Dr. David von Oheimb 91114d53b0 http_client.c,OSSL_HTTP_REQ_CTX.pod,http.h: fixups for PR #23781 on max_response_hdr_lines 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25541)
 2025-02-11 22:09:40 +01:00
Richard Levitte 6a2472fb3e Fix the use of OPENSSL_HTTP_PROXY / OPENSSL_HTTPS_PROXY 
Fixes #26337

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26340)
 2025-01-09 12:03:52 +01:00
David von Oheimb fe004a09ac OSSL_HTTP_adapt_proxy(): fix handling of escaped IPv6 host addresses and of whitespace in no_proxy 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:50 +02:00
David von Oheimb 1c90d36ab1 OSSL_HTTP_open(): fix completion with default port for IPv6 host addresses 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25010)
 2024-09-23 22:15:49 +02:00
Richard Levitte b646179229 Copyright year updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Release: yes
(cherry picked from commit 0ce7d1f355)

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24034)
 2024-04-09 13:43:26 +02:00
Alexandr Nedvedicky 7f8aba2f44 Limit the number of http headers when receiving the http response 
Change introduces a default limit on HTTP headers we expect to receive
from server to 256. If limit is exceeded http client library indicates
HTTP_R_RESPONSE_TOO_MANY_HDRLINES error. Application can use
OSSL_HTTP_REQ_CTX_set_max_response_hdr_lines() to change default.
Setting limit to 0 implies no limit (current behavior).

Fixes #22264

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23781)
 2024-03-12 19:35:41 +01:00
Matt Caswell 322517d817 Fix some invalid use of sscanf 
sscanf can return -1 on an empty input string. We need to appropriately
handle such an invalid case.

The instance in OSSL_HTTP_parse_url could cause an uninitialised read of
sizeof(unsigned int) bytes (typically 4). In many cases this uninit read
will immediately fail on the following check (i.e. if the read value
>65535).

If the top 2 bytes of a 4 byte unsigned int are zero then the value will
be <=65535 and the uninitialised value will be returned to the caller and
could represent arbitrary data on the application stack.

The OpenSSL security team has assessed this issue and consider it to be
a bug only (i.e. not a CVE).

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/22961)
 2023-12-12 16:12:32 +00:00
Alexey Fofanov e2f69d435b return 0 if an error occurred 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22504)

(cherry picked from commit f0d88b4d07)
 2023-10-26 15:21:16 +01:00
Dimitri Papadopoulos ad31628cfe Remove repeated words 
Found by running the checkpatch.pl Linux script to enforce coding style.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21468)
 2023-09-11 10:15:30 +02:00
Matt Caswell da1c088f59 Copyright year updates 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Release: yes
 2023-09-07 09:59:15 +01:00
Dr. David von Oheimb 45c02183c6 OSSL_HTTP_{REQ_CTX_set_request_line(),_set1_request()}: backward compat w.r.t. path parameter 
Fixes #17923

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21690)
 2023-08-10 17:29:07 +02:00
Randall S. Becker ba189e0a4b Modified OSSL_parse_url to initialize pport_num to 0. 
This change is intended to provide some safety for uninitialized stack failures
that have appeared in 80-test_cmp_http on NonStop x86 when run in a complex
CI/CD Jenkins environment. This change also adds init_pint() to handle the
initialization of a pointer to int value.

Fixes: #21083

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21109)

(cherry picked from commit 45cd2554ef)
 2023-07-14 12:04:38 +02:00
Tomas Mraz c71b72acf2 Coverity 1528488: Avoid assignment of unused value rctx 
Also some move redirection_url inside loop
where it is only used.
 2023-06-10 19:23:59 -04:00
Mukesh Bharsakle e7cbb09fdf http proxy handling: Use ossl_safe_getenv() instead of getenv() 
CLA: trivial

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20810)
 2023-04-28 09:55:27 +02:00
Jeeban Sethi 7fed5193d2 Fixes #20278: Fixed double free bug in crypto/http/http_client.c 
CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20351)
 2023-02-23 20:07:35 +11:00
Dr. David von Oheimb 35b76bc818 OSSL_HTTP_REQ_CTX_nbio(): use OSSL_TRACE_STRING() for msg body where it makes sense 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18704)
 2023-01-26 09:16:52 +01:00
FdaSilvaYY c734058309 crypto/*: Fix various typos, repeated words, align some spelling to LDP. 
partially revamped from #16712
- fall thru -> fall through
- time stamp -> timestamp
- host name -> hostname
- ipv6 -> IPv6

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19059)
 2022-10-12 16:55:01 +11:00
Dr. David von Oheimb 52f6169905 OSSL_HTTP_REQ_CTX_nbio: add support for partial content-type string matching 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18675)
 2022-08-23 08:56:07 +02:00
Dr. David von Oheimb 8c65e1f719 http_client.c: 2nd fix for calculation of Content-Length in set1_content() 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18779)
 2022-07-14 10:19:33 +02:00
Dr. David von Oheimb 243465fd55 http_client.c: fix calculation of Content-Length in set1_content() 
Work around an inconsistency in the implementations of BIO_CTRL_INFO.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18701)
 2022-07-11 11:27:46 +02:00
Dr. David von Oheimb 7d5019c15a http_client.c: fix comment and documentation of the memory BIOs used 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18674)
 2022-07-06 08:21:53 +01:00
Dr. David von Oheimb 059a4ad099 OSSL_HTTP_REQ_CTX_nbio(): fix copy&paste glitch calling BIO_should_retry(rctx-rbio) 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18674)
 2022-07-06 08:21:53 +01:00
Dr. David von Oheimb 35750cb9af OSSL_HTTP_open(): improve use of use_ssl and its documentation 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18674)
 2022-07-06 08:21:53 +01:00
Jiasheng Jiang 816d6e578c crypto/http/http_client.c: Add the check for OPENSSL_strdup 
As the potential failure of the OPENSSL_strdup(), it should
be better to check the return value and return error if fails.

Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18624)
 2022-06-23 12:35:09 +02:00
Dr. David von Oheimb e8fdb06035 http_client.c: Dump response on error when tracing is enabled 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18386)
 2022-05-30 22:43:44 +02:00
Matt Caswell fecb3aae22 Update copyright year 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Release: yes
 2022-05-03 13:34:51 +01:00
Dr. David von Oheimb e3477d3e5c http_client.c: check expected content type only if HTTP status code is 200 (OK) 
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18204)
 2022-05-02 08:22:31 +02:00
Dmitry Belyavskiy fba140c735 str[n]casecmp => OPENSSL_strncasecmp 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18069)
 2022-04-22 11:34:41 +02:00
Richard Levitte d5f9166bac Move e_os.h to include/internal 
Including e_os.h with a path from a header file doesn't work well on
certain exotic platform.  It simply fails to build.

Since we don't seem to be able to stop ourselves, the better move is
to move e_os.h to an include directory that's part of the inclusion
path given to the compiler.

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17641)
 2022-02-05 05:31:09 +01:00
Dr. David von Oheimb 068549f8db HTTP client: Work around HTTPS proxy use bug due to callback design flaw 
See discussion in #17088, where the real solution was postponed to 4.0.

This preliminarily fixes the issue that the HTTP(S) proxy environment vars
were neglected when determining whether a proxy should be used for HTTPS.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17310)
 2022-01-04 15:05:32 +01:00
Dr. David von Oheimb cdaf072f90 HTTP client: Fix cleanup of TLS BIO via 'bio_update_fn' callback function 
Make app_http_tls_cb() tidy up on disconnect the SSL BIO it pushes on connect.
Make OSSL_HTTP_close() respect this.

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17318)
 2021-12-22 12:24:24 +01:00
Dr. David von Oheimb 606c79e29b HTTP client: Work around the 'gets' method not being supported by SSL BIOs 
It turned out that loading non-ASN.1 contents using the HTTP client
fails over TLS because SSL BIOs do not support the gets method.

This PR provides a workaround by using the less efficient BIO_get_line() function
in case BIO_gets() returns -2, which means that it is not supported by the BIO.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17317)
 2021-12-21 13:04:14 +01:00