Attachment 339459 Details for Bug 185139 – PATCH

[patch] PATCH

185139.diff (text/plain), 10.15 KB, created by Basuke Suzuki on 2018-05-03 13:59:19 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Basuke Suzuki

Created: 2018-05-03 13:59:19 PDT

Size: 10.15 KB

patch

obsolete

>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 84d3e7f8978..ab718a4e3e6 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,35 @@
>+2018-05-03  Basuke Suzuki  <Basuke.Suzuki@sony.com>
>+
>+        [Curl] Make the cipher suites, the signing algorithms and the curve lists configurable.
>+        https://bugs.webkit.org/show_bug.cgi?id=185139
>+
>+        Add interface to configure the cipher suites, the signing algorithms and the curve lists 
>+        used by OpenSSL and libcurl to exchange, to sign or to verify keys.
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        No new tests in public. Have tested internally.
>+
>+        * platform/network/curl/CurlContext.cpp:
>+        (WebCore::CurlHandle::setSslCipherList):
>+        * platform/network/curl/CurlContext.h:
>+        * platform/network/curl/CurlRequest.cpp:
>+        (WebCore::CurlRequest::setupTransfer):
>+        (WebCore::CurlRequest::willSetupSslCtx):
>+        * platform/network/curl/CurlSSLHandle.cpp:
>+        (WebCore::CurlSSLHandle::getCACertPathEnv):
>+        * platform/network/curl/CurlSSLHandle.h:
>+        (WebCore::CurlSSLHandle::getCipherList const):
>+        (WebCore::CurlSSLHandle::getSignatureAlgorithmsList const):
>+        (WebCore::CurlSSLHandle::getCurvesList const):
>+        (WebCore::CurlSSLHandle::setCipherList):
>+        (WebCore::CurlSSLHandle::setSignatureAlgorithmsList):
>+        (WebCore::CurlSSLHandle::setCurvesList):
>+        (WebCore::CurlSSLHandle::getCACertPath const):
>+        (WebCore::CurlSSLHandle::setCACertPath):
>+        * platform/network/curl/CurlSSLVerifier.cpp:
>+        (WebCore::CurlSSLVerifier::CurlSSLVerifier):
>+
> 2018-05-03  Zalan Bujtas  <zalan@apple.com>
> 
>         [LFC] Box invalidation logic should go to dedicated classes.
>diff --git a/Source/WebCore/platform/network/curl/CurlContext.cpp b/Source/WebCore/platform/network/curl/CurlContext.cpp
>index 24095c78f66..ef132974aeb 100644
>--- a/Source/WebCore/platform/network/curl/CurlContext.cpp
>+++ b/Source/WebCore/platform/network/curl/CurlContext.cpp
>@@ -482,6 +482,11 @@ void CurlHandle::setSslKeyPassword(const char* password)
>     curl_easy_setopt(m_handle, CURLOPT_KEYPASSWD, password);
> }
> 
>+void CurlHandle::setSslCipherList(const char* cipherList)
>+{
>+    curl_easy_setopt(m_handle, CURLOPT_SSL_CIPHER_LIST, cipherList);
>+}
>+
> void CurlHandle::enableProxyIfExists()
> {
>     auto& proxy = CurlContext::singleton().proxySettings();
>diff --git a/Source/WebCore/platform/network/curl/CurlContext.h b/Source/WebCore/platform/network/curl/CurlContext.h
>index 0e63de8cf6c..9677e0a31f8 100644
>--- a/Source/WebCore/platform/network/curl/CurlContext.h
>+++ b/Source/WebCore/platform/network/curl/CurlContext.h
>@@ -252,6 +252,7 @@ public:
>     void setSslCert(const char*);
>     void setSslCertType(const char*);
>     void setSslKeyPassword(const char*);
>+    void setSslCipherList(const char*);
> 
>     void enableProxyIfExists();
> 
>diff --git a/Source/WebCore/platform/network/curl/CurlRequest.cpp b/Source/WebCore/platform/network/curl/CurlRequest.cpp
>index 0335a67b958..4ea9152318d 100644
>--- a/Source/WebCore/platform/network/curl/CurlRequest.cpp
>+++ b/Source/WebCore/platform/network/curl/CurlRequest.cpp
>@@ -192,6 +192,7 @@ CURL* CurlRequest::setupTransfer()
>         m_curlHandle->setHttpAuthUserPass(m_user, m_password);
>     }
> 
>+    m_curlHandle->setSslCtxCallbackFunction(willSetupSslCtxCallback, this);
>     m_curlHandle->setHeaderCallbackFunction(didReceiveHeaderCallback, this);
>     m_curlHandle->setWriteCallbackFunction(didReceiveDataCallback, this);
> 
>@@ -205,8 +206,17 @@ CURL* CurlRequest::setupTransfer()
> 
>     m_curlHandle->enableProxyIfExists();
> 
>-    m_curlHandle->setSslVerifyPeer(CurlHandle::VerifyPeer::Enable);
>-    m_curlHandle->setSslVerifyHost(CurlHandle::VerifyHost::StrictNameCheck);
>+    if (!sslHandle.shouldIgnoreSSLErrors()) {
>+        m_curlHandle->setSslVerifyPeer(CurlHandle::VerifyPeer::Enable);
>+        m_curlHandle->setSslVerifyHost(CurlHandle::VerifyHost::StrictNameCheck);
>+    } else {
>+        m_curlHandle->setSslVerifyPeer(CurlHandle::VerifyPeer::Disable);
>+        m_curlHandle->setSslVerifyHost(CurlHandle::VerifyHost::LooseNameCheck);
>+    }
>+
>+    const auto& cipherList = sslHandle.getCipherList();
>+    if (cipherList)
>+        m_curlHandle->setSslCipherList(cipherList->utf8().data());
> 
>     auto sslClientCertificate = sslHandle.getSSLClientCertificate(m_request.url().host());
>     if (sslClientCertificate) {
>@@ -215,12 +225,7 @@ CURL* CurlRequest::setupTransfer()
>         m_curlHandle->setSslKeyPassword(sslClientCertificate->second.utf8().data());
>     }
> 
>-    if (sslHandle.shouldIgnoreSSLErrors())
>-        m_curlHandle->setSslVerifyPeer(CurlHandle::VerifyPeer::Disable);
>-    else
>-        m_curlHandle->setSslCtxCallbackFunction(willSetupSslCtxCallback, this);
>-
>-    m_curlHandle->setCACertPath(sslHandle.getCACertPath());
>+    m_curlHandle->setCACertPath(sslHandle.getCACertPath().utf8().data());
> 
>     if (m_shouldSuspend)
>         suspend();
>@@ -235,8 +240,10 @@ CURL* CurlRequest::setupTransfer()
> 
> CURLcode CurlRequest::willSetupSslCtx(void* sslCtx)
> {
>-    m_sslVerifier = std::make_unique<CurlSSLVerifier>(m_curlHandle.get(), m_request.url().host(), sslCtx);
>+    if (!sslCtx)
>+        return CURLE_ABORTED_BY_CALLBACK;
> 
>+    m_sslVerifier = std::make_unique<CurlSSLVerifier>(m_curlHandle.get(), m_request.url().host(), sslCtx);
>     return CURLE_OK;
> }
> 
>diff --git a/Source/WebCore/platform/network/curl/CurlSSLHandle.cpp b/Source/WebCore/platform/network/curl/CurlSSLHandle.cpp
>index f4ea372f563..e84f776cce3 100644
>--- a/Source/WebCore/platform/network/curl/CurlSSLHandle.cpp
>+++ b/Source/WebCore/platform/network/curl/CurlSSLHandle.cpp
>@@ -55,11 +55,11 @@ CurlSSLHandle::CurlSSLHandle()
> #endif
> }
> 
>-CString CurlSSLHandle::getCACertPathEnv()
>+String CurlSSLHandle::getCACertPathEnv()
> {
>     char* envPath = getenv("CURL_CA_BUNDLE_PATH");
>     if (envPath)
>-        return envPath;
>+        return String(envPath);
> 
> #if USE(CF)
>     CFBundleRef webKitBundleRef = webKitBundle();
>@@ -68,12 +68,12 @@ CString CurlSSLHandle::getCACertPathEnv()
>         if (certURLRef) {
>             char path[MAX_PATH];
>             CFURLGetFileSystemRepresentation(certURLRef.get(), false, reinterpret_cast<UInt8*>(path), MAX_PATH);
>-            return path;
>+            return String(path);
>         }
>     }
> #endif
> 
>-    return CString();
>+    return String();
> }
> 
> void CurlSSLHandle::setHostAllowsAnyHTTPSCertificate(const String& hostName)
>diff --git a/Source/WebCore/platform/network/curl/CurlSSLHandle.h b/Source/WebCore/platform/network/curl/CurlSSLHandle.h
>index 2afbc155eff..ae3bc392116 100644
>--- a/Source/WebCore/platform/network/curl/CurlSSLHandle.h
>+++ b/Source/WebCore/platform/network/curl/CurlSSLHandle.h
>@@ -45,14 +45,34 @@ namespace WebCore {
> class CurlSSLHandle {
>     WTF_MAKE_NONCOPYABLE(CurlSSLHandle);
>     friend NeverDestroyed<CurlSSLHandle>;
>+    using ClientCertificate = std::pair<String, String>;
> 
> public:
>     CurlSSLHandle();
> 
>-    using ClientCertificate = std::pair<String, String>;
>+    std::optional<String> getCipherList() const
>+    {
>+        return !m_cipherList.isEmpty() ? m_cipherList : std::optional<String>(std::nullopt);
>+    }
>+
>+    std::optional<String> getSignatureAlgorithmsList() const
>+    {
>+        return !m_signatureAlgorithmsList.isEmpty() ? m_signatureAlgorithmsList : std::optional<String>(std::nullopt);
>+    }
>+
>+    std::optional<String> getCurvesList() const
>+    {
>+        return !m_curvesList.isEmpty() ? m_curvesList : std::optional<String>(std::nullopt);
>+    }
>+
>+    void setCipherList(const String& cipherList) { m_cipherList = cipherList.isolatedCopy(); }
>+    void setSignatureAlgorithmsList(const String& signatureAlgorithmsList) { m_signatureAlgorithmsList = signatureAlgorithmsList.isolatedCopy(); }
>+    void setCurvesList(const String& curvesList) { m_curvesList = curvesList.isolatedCopy(); }
> 
>     bool shouldIgnoreSSLErrors() const { return m_ignoreSSLErrors; }
>-    const char* getCACertPath() const { return m_caCertPath.data(); }
>+
>+    const String& getCACertPath() const { return m_caCertPath; }
>+    void setCACertPath(const String& caCertPath) { m_caCertPath = caCertPath; }
> 
>     WEBCORE_EXPORT void setHostAllowsAnyHTTPSCertificate(const String&);
>     bool isAllowedHTTPSCertificateHost(const String&);
>@@ -62,8 +82,6 @@ public:
>     std::optional<ClientCertificate> getSSLClientCertificate(const String&);
> 
> private:
>-    CString getCACertPathEnv();
>-
> #if NEED_OPENSSL_THREAD_SUPPORT
>     class ThreadSupport {
>         friend NeverDestroyed<CurlSSLHandle::ThreadSupport>;
>@@ -91,8 +109,15 @@ private:
>     };
> #endif
> 
>+    String getCACertPathEnv();
>+
>     bool m_ignoreSSLErrors { false };
>-    CString m_caCertPath;
>+
>+    String m_cipherList;
>+    String m_signatureAlgorithmsList;
>+    String m_curvesList;
>+
>+    String m_caCertPath;
> 
>     Lock m_mutex;
>     HashMap<String, ListHashSet<String>, ASCIICaseInsensitiveHash> m_allowedHosts;
>diff --git a/Source/WebCore/platform/network/curl/CurlSSLVerifier.cpp b/Source/WebCore/platform/network/curl/CurlSSLVerifier.cpp
>index 34d6c975c5d..81c22859a37 100644
>--- a/Source/WebCore/platform/network/curl/CurlSSLVerifier.cpp
>+++ b/Source/WebCore/platform/network/curl/CurlSSLVerifier.cpp
>@@ -38,10 +38,21 @@ CurlSSLVerifier::CurlSSLVerifier(CurlHandle* curlHandle, const String& hostName,
>     : m_curlHandle(curlHandle)
>     , m_hostName(hostName)
> {
>-    if (sslCtx) {
>-        SSL_CTX_set_app_data(static_cast<SSL_CTX*>(sslCtx), this);
>-        SSL_CTX_set_verify(static_cast<SSL_CTX*>(sslCtx), SSL_VERIFY_PEER, certVerifyCallback);
>-    }
>+    auto ctx = static_cast<SSL_CTX*>(sslCtx);
>+    auto& sslHandle = CurlContext::singleton().sslHandle();
>+
>+    SSL_CTX_set_app_data(ctx, this);
>+    SSL_CTX_set_verify(ctx, SSL_CTX_get_verify_mode(ctx), certVerifyCallback);
>+
>+#if (!defined(LIBRESSL_VERSION_NUMBER))
>+    const auto& signatureAlgorithmsList = sslHandle.getSignatureAlgorithmsList();
>+    if (signatureAlgorithmsList)
>+        SSL_CTX_set1_sigalgs_list(ctx, signatureAlgorithmsList->utf8().data());
>+#endif
>+
>+    const auto& curvesList = sslHandle.getCurvesList();
>+    if (curvesList)
>+        SSL_CTX_set1_curves_list(ctx, curvesList->utf8().data());
> }
> 
> int CurlSSLVerifier::certVerifyCallback(int ok, X509_STORE_CTX* storeCtx)

Actions: View | Formatted Diff | Diff

Attachments on bug 185139: 339459 | 339474 | 340139