# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1499454270 -7200
# Node ID 8f82d3cd0631e6ac619ff28776fb3ac3aea92576
# Parent  db82ce3deceee67c889c135b6debbc7033e0cef8
net.http: Validate HTTPS certificates (fixes #659)

diff -r db82ce3decee -r 8f82d3cd0631 net/http.lua
--- a/net/http.lua	Fri Jul 07 20:42:35 2017 +0200
+++ b/net/http.lua	Fri Jul 07 21:04:30 2017 +0200
@@ -11,6 +11,7 @@
 local httpstream_new = require "net.http.parser".new;
 local util_http = require "util.http";
 local events = require "util.events";
+local verify_identity = require"util.x509".verify_identity;
 
 local ssl_available = pcall(require, "ssl");
 
@@ -34,6 +35,26 @@
 
 function listener.onconnect(conn)
 	local req = requests[conn];
+
+	-- Validate certificate
+	if conn:ssl() then
+		local sock = conn:socket();
+		local chain_valid = sock.getpeerverification and sock:getpeerverification();
+		if not chain_valid then
+			req.callback("certificate-chain-invalid", 0, req);
+			req.callback = nil;
+			conn:close();
+			return;
+		end
+		local cert = sock.getpeercertificate and sock:getpeercertificate();
+		if not cert or not verify_identity(req.host, false, cert) then
+			req.callback("certificate-verify-failed", 0, req);
+			req.callback = nil;
+			conn:close();
+			return;
+		end
+	end
+
 	-- Send the request
 	local request_line = { req.method or "GET", " ", req.path, " HTTP/1.1\r\n" };
 	if req.query then