Commit aa255991 authored by jan.koester's avatar jan.koester
Browse files

test

parent 6139e49d

src/http.cpp

+7 −0
Original line number Diff line number Diff line
@@ -284,6 +284,11 @@ bool libhttppp::HttpClient::tryHttp3First(){ 
  }

  try {

    auto q = std::make_unique<netplus::quic>();

    // Without this, QUIC ignores _trustPolicy entirely and falls back to

    // netplus::TlsTrustPolicy's own (secure-by-default) verifyPeer=true --

    // unlike the ssl (H1/H2) path below, which already copies it (see

    // resetConnection()).

    q->setTrustPolicy(_trustPolicy);

    q->connect(_url.getHost(), _url.getPort(), false);

    q->setNonBlock();
@@ -337,6 +342,8 @@ void libhttppp::HttpClient::resetConnection(){ 
  // fallback. Only take the QUIC path when HTTP/3 is still what we want.

  if (_url.getProtocol() == HttpUrl::HTTP3 && _vers == 3) {

    auto q = std::make_unique<netplus::quic>();

    // See tryHttp3First()'s identical call for why this is needed.

    q->setTrustPolicy(_trustPolicy);

    q->connect(_url.getHost(), _url.getPort(), false);

    q->setNonBlock();

    // Wait for QUIC handshake to complete before returning

src/http.h

+17 −5
Original line number Diff line number Diff line
@@ -94,19 +94,31 @@ namespace libhttppp { 


  class HttpResponse;



  // HttpClient's documented opt-in default (see its ctor's trustPolicy parameter below) --

  // a bare netplus::TlsTrustPolicy() is secure-by-default (verifyPeer=true) for its other

  // callers, so this pins HttpClient's default to "verify nothing" independently of that.

  inline netplus::TlsTrustPolicy noVerifyTrustPolicy() {

      netplus::TlsTrustPolicy p;

      p.verifyPeer = false;

      return p;

  }



  class HttpClient{

  public:

      // timeoutSec bounds the constructor's own eager connection attempt

      // (see resetConnection()) in addition to being the initial value

      // setTimeout() would otherwise set afterward -- too late to affect

      // that first connect.

      // trustPolicy is opt-in (default-constructed = verify nothing, the pre-existing

      // behavior every caller got before this parameter existed): pass one with

      // verifyPeer=true to get real hostname/CA-chain/pinned-fingerprint verification of the

      // upstream's TLS certificate (see netplus::TlsTrustPolicy in <netplus/crypto/cert_verify.h>).

      // trustPolicy is opt-in (default = verify nothing, the pre-existing behavior every

      // caller got before this parameter existed): pass one with verifyPeer=true to get real

      // hostname/CA-chain/pinned-fingerprint verification of the upstream's TLS certificate

      // (see netplus::TlsTrustPolicy in <netplus/crypto/cert_verify.h>). Note this can't just

      // default to a bare netplus::TlsTrustPolicy() -- that struct is secure-by-default

      // (verifyPeer=true) for its other callers (e.g. proxyplus's own TLS client), so HttpClient

      // needs its own explicitly-relaxed default to keep its documented opt-in contract.

      // If trustPolicy.expectedHostname is left empty, it defaults to desturl's host.

      HttpClient( const HttpUrl &desturl, int vers = 2, int timeoutSec = 60,

                  const netplus::TlsTrustPolicy &trustPolicy = netplus::TlsTrustPolicy());

                  const netplus::TlsTrustPolicy &trustPolicy = noVerifyTrustPolicy());

      ~HttpClient()=default;

      void reconnect();

      void setTimeout(int timeout_sec);

test/http3_control_streams_test.cpp

+8 −0
Original line number Diff line number Diff line
@@ -166,6 +166,14 @@ int main() { 
        // ---- Drive a real client-side handshake (mirrors HttpClient::

        // tryHttp3First()'s pattern in http.cpp) ----

        libhttppp::Http3QuicSocket client;

        // This test's server presents a self-signed (mkcert) leaf, not a

        // CA-chain-verifiable one -- netplus::TlsTrustPolicy defaults to

        // verifyPeer=true (secure by default, see cert_verify.h), so a real

        // client against a real cert needs to opt out explicitly here, same

        // as any other direct netplus::quic consumer would.

        netplus::TlsTrustPolicy noVerify;

        noVerify.verifyPeer = false;

        client.setTrustPolicy(noVerify);

        client.connect("127.0.0.1", kPort, true /*nonblock*/);

        client.setNonBlock();