|
Link Here
|
| 0 |
- |
1 |
From 1c52af3a7cc168cec089a810c32e861ab988840c Mon Sep 17 00:00:00 2001 |
|
|
2 |
From: Leon Klingele <git@leonklingele.de> |
| 3 |
Date: Wed, 13 Mar 2024 22:12:25 +0100 |
| 4 |
Subject: [PATCH] fix(apple): ignore malformed HTTP headers |
| 5 |
|
| 6 |
See also https://github.com/golang/go/issues/21290. |
| 7 |
|
| 8 |
Fixes https://github.com/freswa/dovecot-xaps-daemon/issues/24. |
| 9 |
--- |
| 10 |
pkg/apple_xserver_certs/http.go | 51 ++++++++++++++++++++++++++++++--- |
| 11 |
1 file changed, 47 insertions(+), 4 deletions(-) |
| 12 |
|
| 13 |
diff --git a/pkg/apple_xserver_certs/http.go b/pkg/apple_xserver_certs/http.go |
| 14 |
index d39a6fc..939fcf0 100644 |
| 15 |
--- a/pkg/apple_xserver_certs/http.go |
| 16 |
+++ b/pkg/apple_xserver_certs/http.go |
| 17 |
@@ -1,11 +1,16 @@ |
| 18 |
package apple_xserver_certs |
| 19 |
|
| 20 |
import ( |
| 21 |
+ "bufio" |
| 22 |
"bytes" |
| 23 |
+ "context" |
| 24 |
+ "crypto/tls" |
| 25 |
"encoding/pem" |
| 26 |
+ "io" |
| 27 |
"io/ioutil" |
| 28 |
"log" |
| 29 |
"net/http" |
| 30 |
+ "time" |
| 31 |
) |
| 32 |
|
| 33 |
func NewCerts(username string, passwordhash string) *Certificates { |
| 34 |
@@ -50,7 +55,6 @@ func handleResponse(certs *Certificates, response []byte) *Certificates { |
| 35 |
} |
| 36 |
|
| 37 |
func sendRequest(reqBody []byte, newCerts bool) (respBody []byte) { |
| 38 |
- client := &http.Client{} |
| 39 |
r := bytes.NewReader(reqBody) |
| 40 |
url := "https://identity.apple.com/pushcert/caservice/renew" |
| 41 |
if newCerts { |
| 42 |
@@ -67,12 +71,51 @@ func sendRequest(reqBody []byte, newCerts bool) (respBody []byte) { |
| 43 |
req.Header.Set("Accept", "*/*") |
| 44 |
req.Header.Set("Accept-Language", "en-us") |
| 45 |
|
| 46 |
- resp, err := client.Do(req) |
| 47 |
+ req.Close = true |
| 48 |
+ |
| 49 |
+ ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) |
| 50 |
+ defer cancel() |
| 51 |
+ |
| 52 |
+ conn, err := new(tls.Dialer).DialContext( |
| 53 |
+ ctx, |
| 54 |
+ "tcp", |
| 55 |
+ req.URL.Host+":443", |
| 56 |
+ ) |
| 57 |
if err != nil { |
| 58 |
- log.Fatalln(err) |
| 59 |
+ log.Fatalln(err) // TODO: Handle error properly |
| 60 |
+ } |
| 61 |
+ defer func() { |
| 62 |
+ _ = conn.Close() //nolint:errcheck,gosec // Ignored on purpose |
| 63 |
+ }() |
| 64 |
+ |
| 65 |
+ if err := req.Write(conn); err != nil { |
| 66 |
+ log.Fatalln(err) // TODO: Handle error properly |
| 67 |
+ } |
| 68 |
+ |
| 69 |
+ buf, err := io.ReadAll(io.LimitReader(conn, 1<<10)) |
| 70 |
+ if err != nil { |
| 71 |
+ log.Fatalln(err) // TODO: Handle error properly |
| 72 |
+ } |
| 73 |
+ |
| 74 |
+ const ( |
| 75 |
+ cr = "\r" |
| 76 |
+ nl = "\n" |
| 77 |
+ ) |
| 78 |
+ for _, ign := range []string{ |
| 79 |
+ "1;: mode=block", |
| 80 |
+ "max-age=31536000;: includeSubdomains", |
| 81 |
+ } { |
| 82 |
+ buf = bytes.Replace(buf, []byte(nl+ign+cr+nl), []byte(nl), 1) |
| 83 |
+ } |
| 84 |
+ |
| 85 |
+ resp, err := http.ReadResponse(bufio.NewReader(bytes.NewReader(buf)), req) |
| 86 |
+ if err != nil { |
| 87 |
+ log.Fatalln(err) // TODO: Handle error properly |
| 88 |
} |
| 89 |
+ defer func() { |
| 90 |
+ _ = resp.Body.Close() //nolint:errcheck,gosec // Ignored on purpose |
| 91 |
+ }() |
| 92 |
|
| 93 |
- defer resp.Body.Close() |
| 94 |
respBody, err = ioutil.ReadAll(resp.Body) |
| 95 |
if err != nil { |
| 96 |
log.Fatalln(err) |
| 97 |
-- |
| 98 |
2.34.1 |
| 99 |
|