Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix HTTPS proxy regressions caused by the MultiSSL patches #1871

Closed
wants to merge 3 commits into from
Closed

Fix HTTPS proxy regressions caused by the MultiSSL patches #1871

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6de62c3
vtls: fix memory corruption
jay Sep 6, 2017
ba37014
OpenSSL: fix erroneous SSL backend encapsulation
dscho Sep 6, 2017
281b30c
OpenSSL: fix yet another mistake while encapsulating SSL backend data
dscho Sep 6, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
8 changes: 5 additions & 3 deletions lib/vtls/openssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2457,10 +2457,10 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
BIO *const bio = BIO_new(BIO_f_ssl());
SSL *handle = conn->proxy_ssl[sockindex].backend->handle;
DEBUGASSERT(ssl_connection_complete == conn->proxy_ssl[sockindex].state);
DEBUGASSERT(BACKEND->handle != NULL);
DEBUGASSERT(handle != NULL);
DEBUGASSERT(bio != NULL);
BIO_set_ssl(bio, handle, FALSE);
SSL_set_bio(handle, bio, bio);
SSL_set_bio(BACKEND->handle, bio, bio);
}
else if(!SSL_set_fd(BACKEND->handle, (int)sockfd)) {
/* pass the raw socket into the SSL layers */
Expand Down Expand Up @@ -3366,10 +3366,12 @@ static bool Curl_ossl_data_pending(const struct connectdata *conn,
int connindex)
{
const struct ssl_connect_data *connssl = &conn->ssl[connindex];
const struct ssl_connect_data *proxyssl = &conn->proxy_ssl[connindex];
if(BACKEND->handle)
/* SSL is in use */
return (0 != SSL_pending(BACKEND->handle) ||
(BACKEND->handle && 0 != SSL_pending(BACKEND->handle))) ?
(proxyssl->backend->handle &&
0 != SSL_pending(proxyssl->backend->handle))) ?
TRUE : FALSE;
return FALSE;
}
Expand Down
10 changes: 10 additions & 0 deletions lib/vtls/vtls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,10 +206,20 @@ ssl_connect_init_proxy(struct connectdata *conn, int sockindex)
DEBUGASSERT(conn->bits.proxy_ssl_connected[sockindex]);
if(ssl_connection_complete == conn->ssl[sockindex].state &&
!conn->proxy_ssl[sockindex].use) {
struct ssl_backend_data *pbdata;

if(!Curl_ssl->support_https_proxy)
return CURLE_NOT_BUILT_IN;

/* The pointers to the ssl backend data, which is opaque here, are swapped
rather than move the contents. */
pbdata = conn->proxy_ssl[sockindex].backend;
conn->proxy_ssl[sockindex] = conn->ssl[sockindex];

memset(&conn->ssl[sockindex], 0, sizeof(conn->ssl[sockindex]));
memset(pbdata, 0, Curl_ssl->sizeof_ssl_backend_data);

conn->ssl[sockindex].backend = pbdata;
}
return CURLE_OK;
}
Expand Down