← Commit list

ee2959a98e

Stefan Eissing
Stefan Eissing
2026-09-25
SUCCESS Duration: 392s

Subject

httpsrr+ech: check target and port

Binary

No binary (build failed)

Architecture & Compiler Flags

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

Build Log

(log yok)

Commit Diff GitHub →

lib/vdns/httpsrr.c +10 -2lib/vdns/httpsrr.h +4 -0lib/vtls/openssl.c +1 -1lib/vtls/rustls.c +2 -1lib/vtls/wolfssl.c +1 -1
lib/vdns/httpsrr.c+10 -2
@@ -239,11 +239,19 @@ void Curl_httpsrr_destroy(struct Curl_https_rrinfo *rrinfo)
bool Curl_httpsrr_applicable(struct Curl_easy *data,
const struct Curl_https_rrinfo *rr)
{
- if(!data->conn || !rr)
+ if(!data->conn)
+ return FALSE;
+ return Curl_httpsrr_is_for_peer(data->conn->origin, rr);
+}
+
+bool Curl_httpsrr_is_for_peer(struct Curl_peer *peer,
+ const struct Curl_https_rrinfo *rr)
+{
+ if(!peer || !rr)
return FALSE;
return (!rr->target || !rr->target[0] ||
(rr->target[0] == '.' && !rr->target[1])) &&
- (!rr->port_set || rr->port == data->conn->origin->port);
+ (!rr->port_set || rr->port == peer->port);
}
#ifdef USE_ARES
lib/vdns/httpsrr.h+4 -0
@@ -67,6 +67,10 @@ void Curl_httpsrr_destroy(struct Curl_https_rrinfo *rrinfo);
bool Curl_httpsrr_applicable(struct Curl_easy *data,
const struct Curl_https_rrinfo *rr);
+/* TRUE if the record is applicable to the given peer. */
+bool Curl_httpsrr_is_for_peer(struct Curl_peer *peer,
+ const struct Curl_https_rrinfo *rr);
+
/*
* Code points for DNS wire format SvcParams as per RFC 9460
*/
lib/vtls/openssl.c+1 -1
@@ -3527,7 +3527,7 @@ static CURLcode ossl_init_ech(struct ossl_ctx *octx,
const struct Curl_https_rrinfo *rinfo =
Curl_conn_dns_get_https(data, cf->sockindex, peer->origin);
- if(rinfo && rinfo->echconfiglist) {
+ if(Curl_httpsrr_is_for_peer(peer->origin, rinfo) && rinfo->echconfiglist) {
const unsigned char *ecl = rinfo->echconfiglist;
size_t elen = rinfo->echconfiglist_len;
lib/vtls/rustls.c+2 -1
@@ -984,7 +984,8 @@ init_config_builder_ech(struct Curl_easy *data,
const struct Curl_https_rrinfo *rinfo =
Curl_conn_dns_get_https(data, cf->sockindex, connssl->peer.origin);
- if(!rinfo || !rinfo->echconfiglist) {
+ if(!Curl_httpsrr_is_for_peer(connssl->peer.origin, rinfo) ||
+ !rinfo->echconfiglist) {
failf(data, "rustls: ECH requested but no ECHConfig available");
result = CURLE_SSL_CONNECT_ERROR;
goto cleanup;
lib/vtls/wolfssl.c+1 -1
@@ -1277,7 +1277,7 @@ static CURLcode wssl_init_ech(struct wssl_ctx *wctx,
const struct Curl_https_rrinfo *rinfo =
Curl_conn_dns_get_https(data, cf->sockindex, peer->origin);
- if(rinfo && rinfo->echconfiglist) {
+ if(Curl_httpsrr_is_for_peer(peer->origin, rinfo) && rinfo->echconfiglist) {
const unsigned char *ecl = rinfo->echconfiglist;
size_t elen = rinfo->echconfiglist_len;