Skip to content
This repository was archived by the owner on Jan 23, 2023. It is now read-only.

Commit 7fb7439

Browse files
author
Lakshmi Priya Sekar
committed
Check for openssl version before setting cert callback.
1 parent 249bebc commit 7fb7439

File tree

1 file changed

+68
-35
lines changed

1 file changed

+68
-35
lines changed

‎src/System.Net.Http/src/System/Net/Http/Unix/CurlHandler.SslProvider.cs‎

Lines changed: 68 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -48,47 +48,80 @@ internal static void SetSslOptions(EasyRequest easy, ClientCertificateOption cli
4848
// Register the callback with libcurl. We need to register even if there's no user-provided
4949
// server callback and even if there are no client certificates, because we support verifying
5050
// server certificates against more than those known to OpenSSL.
51-
CURLcode answer = easy.SetSslCtxCallback(s_sslCtxCallback, userPointer);
52-
switch (answer)
51+
if (CurlSslVersionDescription.IndexOf("openssl/1.0", StringComparison.OrdinalIgnoreCase) != -1)
5352
{
54-
case CURLcode.CURLE_OK:
55-
// We successfully registered. If we'll be invoking a user-provided callback to verify the server
56-
// certificate as part of that, disable libcurl's verification of the host name. The user's callback
57-
// needs to be given the opportunity to examine the cert, and our logic will determine whether
58-
// the host name matches and will inform the callback of that.
59-
if (easy._handler.ServerCertificateValidationCallback != null)
60-
{
61-
easy.SetCurlOption(Interop.Http.CURLoption.CURLOPT_SSL_VERIFYHOST, 0); // don't verify the peer cert's hostname
62-
// We don't change the SSL_VERIFYPEER setting, as setting it to 0 will cause
63-
// SSL and libcurl to ignore the result of the server callback.
64-
}
53+
CURLcode answer = easy.SetSslCtxCallback(s_sslCtxCallback, userPointer);
54+
switch (answer)
55+
{
56+
case CURLcode.CURLE_OK:
57+
// We successfully registered. If we'll be invoking a user-provided callback to verify the server
58+
// certificate as part of that, disable libcurl's verification of the host name. The user's callback
59+
// needs to be given the opportunity to examine the cert, and our logic will determine whether
60+
// the host name matches and will inform the callback of that.
61+
if (easy._handler.ServerCertificateValidationCallback != null)
62+
{
63+
easy.SetCurlOption(Interop.Http.CURLoption.CURLOPT_SSL_VERIFYHOST, 0); // don't verify the peer cert's hostname
64+
// We don't change the SSL_VERIFYPEER setting, as setting it to 0 will cause
65+
// SSL and libcurl to ignore the result of the server callback.
66+
}
6567

66-
// The allowed SSL protocols will be set in the configuration callback.
67-
break;
68+
// The allowed SSL protocols will be set in the configuration callback.
69+
break;
70+
71+
case CURLcode.CURLE_UNKNOWN_OPTION: // Curl 7.38 and prior
72+
case CURLcode.CURLE_NOT_BUILT_IN: // Curl 7.39 and later
73+
// It's ok if we failed to register the callback if all of the defaults are in play
74+
// with relation to handling of certificates. But if that's not the case, failing to
75+
// register the callback will result in those options not being factored in, which is
76+
// a significant enough error that we need to fail.
77+
EventSourceTrace("CURLOPT_SSL_CTX_FUNCTION not supported: {0}", answer, easy: easy);
78+
if (certProvider != null ||
79+
easy._handler.ServerCertificateValidationCallback != null ||
80+
easy._handler.CheckCertificateRevocationList)
81+
{
82+
throw new PlatformNotSupportedException(
83+
SR.Format(SR.net_http_unix_invalid_certcallback_option, CurlVersionDescription, CurlSslVersionDescription));
84+
}
6885

69-
case CURLcode.CURLE_UNKNOWN_OPTION: // Curl 7.38 and prior
70-
case CURLcode.CURLE_NOT_BUILT_IN: // Curl 7.39 and later
71-
// It's ok if we failed to register the callback if all of the defaults are in play
72-
// with relation to handling of certificates. But if that's not the case, failing to
73-
// register the callback will result in those options not being factored in, which is
74-
// a significant enough error that we need to fail.
75-
EventSourceTrace("CURLOPT_SSL_CTX_FUNCTION not supported: {0}", answer, easy: easy);
76-
if (certProvider != null ||
77-
easy._handler.ServerCertificateValidationCallback != null ||
78-
easy._handler.CheckCertificateRevocationList)
79-
{
80-
throw new PlatformNotSupportedException(
81-
SR.Format(SR.net_http_unix_invalid_certcallback_option, CurlVersionDescription, CurlSslVersionDescription));
82-
}
86+
// Since there won't be a callback to configure the allowed SSL protocols, configure them here.
87+
SetSslVersion(easy);
8388

84-
// Since there won't be a callback to configure the allowed SSL protocols, configure them here.
85-
SetSslVersion(easy);
89+
break;
8690

87-
break;
91+
default:
92+
ThrowIfCURLEError(answer);
93+
break;
94+
}
95+
}
96+
else
97+
{
98+
// For newer versions of openssl throw PNSE, if default not used.
99+
if (certProvider != null)
100+
{
101+
throw new PlatformNotSupportedException(
102+
SR.Format(
103+
SR.net_http_libcurl_clientcerts_notsupported,
104+
CurlVersionDescription, CurlSslVersionDescription));
105+
}
88106

89-
default:
90-
ThrowIfCURLEError(answer);
91-
break;
107+
if (easy._handler.ServerCertificateValidationCallback != null)
108+
{
109+
throw new PlatformNotSupportedException(
110+
SR.Format(
111+
SR.net_http_libcurl_callback_notsupported,
112+
CurlVersionDescription, CurlSslVersionDescription));
113+
}
114+
115+
if (easy._handler.CheckCertificateRevocationList)
116+
{
117+
throw new PlatformNotSupportedException(
118+
SR.Format(
119+
SR.net_http_libcurl_revocation_notsupported,
120+
CurlVersionDescription, CurlSslVersionDescription));
121+
}
122+
123+
// In case of defaults configure the allowed SSL protocols.
124+
SetSslVersion(easy);
92125
}
93126
}
94127

0 commit comments

Comments
 (0)