http: client should use tls functions to verify server certs, purpose and hostname
MODIFY
include/re_http.h
include/re_http.h
@@ -125,6 +125,8 @@ typedef void (http_conn_h)(struct tcp_conn *tc, struct tls_conn *sc,
void *arg);
int http_client_alloc(struct http_cli **clip, struct dnsc *dnsc);
+int http_client_add_ca(struct http_cli *cli, const char *tls_ca);
+int http_client_set_tls_hostname(struct http_cli *cli, const struct pl *hostname);
int http_request(struct http_req **reqp, struct http_cli *cli, const char *met,
const char *uri, http_resp_h *resph, http_data_h *datah,
void *arg, const char *fmt, ...);

MODIFY
src/http/client.c
src/http/client.c
@@ -35,6 +35,7 @@ struct http_cli {
struct hash *ht_conn;
struct dnsc *dnsc;
struct tls *tls;
+ char *tls_hostname;
};
struct conn;
@@ -97,6 +98,7 @@ static void cli_destructor(void *arg)
mem_deref(cli->ht_conn);
mem_deref(cli->dnsc);
mem_deref(cli->tls);
+ mem_deref(cli->tls_hostname);
}
@@ -683,11 +685,15 @@ int http_client_alloc(struct http_cli **clip, struct dnsc *dnsc)
#ifdef USE_TLS
err = tls_alloc(&cli->tls, TLS_METHOD_SSLV23, NULL, NULL);
+ if (err)
+ goto out;
+
+ err = tls_set_verify_purpose(cli->tls, "sslserver");
+ if (err)
+ goto out;
#else
err = 0;
#endif
- if (err)
- goto out;
cli->dnsc = mem_ref(dnsc);
@@ -699,3 +705,39 @@ int http_client_alloc(struct http_cli **clip, struct dnsc *dnsc)
return err;
}
+
+
+#ifdef USE_TLS
+/**
+ * Add trusted CA certificates
+ *
+ * @param cli HTTP client
+ * @param capath Path to CA certificates
+ *
+ * @return 0 if success, otherwise errorcode
+ */
+int http_client_add_ca(struct http_cli *cli, const char *tls_ca)
+{
+ if (!cli || !tls_ca)
+ return EINVAL;
+
+ return tls_add_ca(cli->tls, tls_ca);
+}
+
+
+/**
+ * Set verify host name
+ *
+ * @param cli HTTP client
+ * @param hostname String for alternative name validation.
+ *
+ * @return 0 if success, otherwise errorcode
+ */
+int http_client_set_tls_hostname(struct http_cli *cli, const struct pl *hostname)
+{
+ if (!cli || !hostname)
+ return EINVAL;
+
+ return tls_set_hostname(cli->tls_hostname, hostname);
+}
+#endif

http: client should use tls functions to verify server certs, purpose and hostname