1 | /*************************************************************************** |
2 | * _ _ ____ _ |
3 | * Project ___| | | | _ \| | |
4 | * / __| | | | |_) | | |
5 | * | (__| |_| | _ <| |___ |
6 | * \___|\___/|_| \_\_____| |
7 | * |
8 | * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al. |
9 | * |
10 | * This software is licensed as described in the file COPYING, which |
11 | * you should have received as part of this distribution. The terms |
12 | * are also available at https://curl.haxx.se/docs/copyright.html. |
13 | * |
14 | * You may opt to use, copy, modify, merge, publish, distribute and/or sell |
15 | * copies of the Software, and permit persons to whom the Software is |
16 | * furnished to do so, under the terms of the COPYING file. |
17 | * |
18 | * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY |
19 | * KIND, either express or implied. |
20 | * |
21 | ***************************************************************************/ |
22 | |
23 | /* This file is for implementing all "generic" SSL functions that all libcurl |
24 | internals should use. It is then responsible for calling the proper |
25 | "backend" function. |
26 | |
27 | SSL-functions in libcurl should call functions in this source file, and not |
28 | to any specific SSL-layer. |
29 | |
30 | Curl_ssl_ - prefix for generic ones |
31 | |
32 | Note that this source code uses the functions of the configured SSL |
33 | backend via the global Curl_ssl instance. |
34 | |
35 | "SSL/TLS Strong Encryption: An Introduction" |
36 | https://httpd.apache.org/docs/2.0/ssl/ssl_intro.html |
37 | */ |
38 | |
39 | #include "curl_setup.h" |
40 | |
41 | #ifdef HAVE_SYS_TYPES_H |
42 | #include <sys/types.h> |
43 | #endif |
44 | #ifdef HAVE_SYS_STAT_H |
45 | #include <sys/stat.h> |
46 | #endif |
47 | #ifdef HAVE_FCNTL_H |
48 | #include <fcntl.h> |
49 | #endif |
50 | |
51 | #include "urldata.h" |
52 | |
53 | #include "vtls.h" /* generic SSL protos etc */ |
54 | #include "slist.h" |
55 | #include "sendf.h" |
56 | #include "strcase.h" |
57 | #include "url.h" |
58 | #include "progress.h" |
59 | #include "share.h" |
60 | #include "multiif.h" |
61 | #include "timeval.h" |
62 | #include "curl_md5.h" |
63 | #include "warnless.h" |
64 | #include "curl_base64.h" |
65 | #include "curl_printf.h" |
66 | |
67 | /* The last #include files should be: */ |
68 | #include "curl_memory.h" |
69 | #include "memdebug.h" |
70 | |
71 | /* convenience macro to check if this handle is using a shared SSL session */ |
72 | #define SSLSESSION_SHARED(data) (data->share && \ |
73 | (data->share->specifier & \ |
74 | (1<<CURL_LOCK_DATA_SSL_SESSION))) |
75 | |
76 | #define CLONE_STRING(var) \ |
77 | if(source->var) { \ |
78 | dest->var = strdup(source->var); \ |
79 | if(!dest->var) \ |
80 | return FALSE; \ |
81 | } \ |
82 | else \ |
83 | dest->var = NULL; |
84 | |
85 | bool |
86 | Curl_ssl_config_matches(struct ssl_primary_config* data, |
87 | struct ssl_primary_config* needle) |
88 | { |
89 | if((data->version == needle->version) && |
90 | (data->version_max == needle->version_max) && |
91 | (data->verifypeer == needle->verifypeer) && |
92 | (data->verifyhost == needle->verifyhost) && |
93 | (data->verifystatus == needle->verifystatus) && |
94 | Curl_safe_strcasecompare(data->CApath, needle->CApath) && |
95 | Curl_safe_strcasecompare(data->CAfile, needle->CAfile) && |
96 | Curl_safe_strcasecompare(data->clientcert, needle->clientcert) && |
97 | Curl_safe_strcasecompare(data->random_file, needle->random_file) && |
98 | Curl_safe_strcasecompare(data->egdsocket, needle->egdsocket) && |
99 | Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) && |
100 | Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13) && |
101 | Curl_safe_strcasecompare(data->pinned_key, needle->pinned_key)) |
102 | return TRUE; |
103 | |
104 | return FALSE; |
105 | } |
106 | |
107 | bool |
108 | Curl_clone_primary_ssl_config(struct ssl_primary_config *source, |
109 | struct ssl_primary_config *dest) |
110 | { |
111 | dest->version = source->version; |
112 | dest->version_max = source->version_max; |
113 | dest->verifypeer = source->verifypeer; |
114 | dest->verifyhost = source->verifyhost; |
115 | dest->verifystatus = source->verifystatus; |
116 | dest->sessionid = source->sessionid; |
117 | |
118 | CLONE_STRING(CApath); |
119 | CLONE_STRING(CAfile); |
120 | CLONE_STRING(clientcert); |
121 | CLONE_STRING(random_file); |
122 | CLONE_STRING(egdsocket); |
123 | CLONE_STRING(cipher_list); |
124 | CLONE_STRING(cipher_list13); |
125 | CLONE_STRING(pinned_key); |
126 | |
127 | return TRUE; |
128 | } |
129 | |
130 | void Curl_free_primary_ssl_config(struct ssl_primary_config* sslc) |
131 | { |
132 | Curl_safefree(sslc->CApath); |
133 | Curl_safefree(sslc->CAfile); |
134 | Curl_safefree(sslc->clientcert); |
135 | Curl_safefree(sslc->random_file); |
136 | Curl_safefree(sslc->egdsocket); |
137 | Curl_safefree(sslc->cipher_list); |
138 | Curl_safefree(sslc->cipher_list13); |
139 | Curl_safefree(sslc->pinned_key); |
140 | } |
141 | |
142 | #ifdef USE_SSL |
143 | static int multissl_init(const struct Curl_ssl *backend); |
144 | #endif |
145 | |
146 | int Curl_ssl_backend(void) |
147 | { |
148 | #ifdef USE_SSL |
149 | multissl_init(NULL); |
150 | return Curl_ssl->info.id; |
151 | #else |
152 | return (int)CURLSSLBACKEND_NONE; |
153 | #endif |
154 | } |
155 | |
156 | #ifdef USE_SSL |
157 | |
158 | /* "global" init done? */ |
159 | static bool init_ssl = FALSE; |
160 | |
161 | /** |
162 | * Global SSL init |
163 | * |
164 | * @retval 0 error initializing SSL |
165 | * @retval 1 SSL initialized successfully |
166 | */ |
167 | int Curl_ssl_init(void) |
168 | { |
169 | /* make sure this is only done once */ |
170 | if(init_ssl) |
171 | return 1; |
172 | init_ssl = TRUE; /* never again */ |
173 | |
174 | return Curl_ssl->init(); |
175 | } |
176 | |
177 | |
178 | /* Global cleanup */ |
179 | void Curl_ssl_cleanup(void) |
180 | { |
181 | if(init_ssl) { |
182 | /* only cleanup if we did a previous init */ |
183 | Curl_ssl->cleanup(); |
184 | init_ssl = FALSE; |
185 | } |
186 | } |
187 | |
188 | static bool ssl_prefs_check(struct Curl_easy *data) |
189 | { |
190 | /* check for CURLOPT_SSLVERSION invalid parameter value */ |
191 | const long sslver = data->set.ssl.primary.version; |
192 | if((sslver < 0) || (sslver >= CURL_SSLVERSION_LAST)) { |
193 | failf(data, "Unrecognized parameter value passed via CURLOPT_SSLVERSION" ); |
194 | return FALSE; |
195 | } |
196 | |
197 | switch(data->set.ssl.primary.version_max) { |
198 | case CURL_SSLVERSION_MAX_NONE: |
199 | case CURL_SSLVERSION_MAX_DEFAULT: |
200 | break; |
201 | |
202 | default: |
203 | if((data->set.ssl.primary.version_max >> 16) < sslver) { |
204 | failf(data, "CURL_SSLVERSION_MAX incompatible with CURL_SSLVERSION" ); |
205 | return FALSE; |
206 | } |
207 | } |
208 | |
209 | return TRUE; |
210 | } |
211 | |
212 | static CURLcode |
213 | ssl_connect_init_proxy(struct connectdata *conn, int sockindex) |
214 | { |
215 | DEBUGASSERT(conn->bits.proxy_ssl_connected[sockindex]); |
216 | if(ssl_connection_complete == conn->ssl[sockindex].state && |
217 | !conn->proxy_ssl[sockindex].use) { |
218 | struct ssl_backend_data *pbdata; |
219 | |
220 | if(!(Curl_ssl->supports & SSLSUPP_HTTPS_PROXY)) |
221 | return CURLE_NOT_BUILT_IN; |
222 | |
223 | /* The pointers to the ssl backend data, which is opaque here, are swapped |
224 | rather than move the contents. */ |
225 | pbdata = conn->proxy_ssl[sockindex].backend; |
226 | conn->proxy_ssl[sockindex] = conn->ssl[sockindex]; |
227 | |
228 | memset(&conn->ssl[sockindex], 0, sizeof(conn->ssl[sockindex])); |
229 | memset(pbdata, 0, Curl_ssl->sizeof_ssl_backend_data); |
230 | |
231 | conn->ssl[sockindex].backend = pbdata; |
232 | } |
233 | return CURLE_OK; |
234 | } |
235 | |
236 | CURLcode |
237 | Curl_ssl_connect(struct connectdata *conn, int sockindex) |
238 | { |
239 | CURLcode result; |
240 | |
241 | if(conn->bits.proxy_ssl_connected[sockindex]) { |
242 | result = ssl_connect_init_proxy(conn, sockindex); |
243 | if(result) |
244 | return result; |
245 | } |
246 | |
247 | if(!ssl_prefs_check(conn->data)) |
248 | return CURLE_SSL_CONNECT_ERROR; |
249 | |
250 | /* mark this is being ssl-enabled from here on. */ |
251 | conn->ssl[sockindex].use = TRUE; |
252 | conn->ssl[sockindex].state = ssl_connection_negotiating; |
253 | |
254 | result = Curl_ssl->connect_blocking(conn, sockindex); |
255 | |
256 | if(!result) |
257 | Curl_pgrsTime(conn->data, TIMER_APPCONNECT); /* SSL is connected */ |
258 | |
259 | return result; |
260 | } |
261 | |
262 | CURLcode |
263 | Curl_ssl_connect_nonblocking(struct connectdata *conn, int sockindex, |
264 | bool *done) |
265 | { |
266 | CURLcode result; |
267 | if(conn->bits.proxy_ssl_connected[sockindex]) { |
268 | result = ssl_connect_init_proxy(conn, sockindex); |
269 | if(result) |
270 | return result; |
271 | } |
272 | |
273 | if(!ssl_prefs_check(conn->data)) |
274 | return CURLE_SSL_CONNECT_ERROR; |
275 | |
276 | /* mark this is being ssl requested from here on. */ |
277 | conn->ssl[sockindex].use = TRUE; |
278 | result = Curl_ssl->connect_nonblocking(conn, sockindex, done); |
279 | if(!result && *done) |
280 | Curl_pgrsTime(conn->data, TIMER_APPCONNECT); /* SSL is connected */ |
281 | return result; |
282 | } |
283 | |
284 | /* |
285 | * Lock shared SSL session data |
286 | */ |
287 | void Curl_ssl_sessionid_lock(struct connectdata *conn) |
288 | { |
289 | if(SSLSESSION_SHARED(conn->data)) |
290 | Curl_share_lock(conn->data, |
291 | CURL_LOCK_DATA_SSL_SESSION, CURL_LOCK_ACCESS_SINGLE); |
292 | } |
293 | |
294 | /* |
295 | * Unlock shared SSL session data |
296 | */ |
297 | void Curl_ssl_sessionid_unlock(struct connectdata *conn) |
298 | { |
299 | if(SSLSESSION_SHARED(conn->data)) |
300 | Curl_share_unlock(conn->data, CURL_LOCK_DATA_SSL_SESSION); |
301 | } |
302 | |
303 | /* |
304 | * Check if there's a session ID for the given connection in the cache, and if |
305 | * there's one suitable, it is provided. Returns TRUE when no entry matched. |
306 | */ |
307 | bool Curl_ssl_getsessionid(struct connectdata *conn, |
308 | void **ssl_sessionid, |
309 | size_t *idsize, /* set 0 if unknown */ |
310 | int sockindex) |
311 | { |
312 | struct curl_ssl_session *check; |
313 | struct Curl_easy *data = conn->data; |
314 | size_t i; |
315 | long *general_age; |
316 | bool no_match = TRUE; |
317 | |
318 | const bool isProxy = CONNECT_PROXY_SSL(); |
319 | struct ssl_primary_config * const ssl_config = isProxy ? |
320 | &conn->proxy_ssl_config : |
321 | &conn->ssl_config; |
322 | const char * const name = isProxy ? conn->http_proxy.host.name : |
323 | conn->host.name; |
324 | int port = isProxy ? (int)conn->port : conn->remote_port; |
325 | *ssl_sessionid = NULL; |
326 | |
327 | DEBUGASSERT(SSL_SET_OPTION(primary.sessionid)); |
328 | |
329 | if(!SSL_SET_OPTION(primary.sessionid)) |
330 | /* session ID re-use is disabled */ |
331 | return TRUE; |
332 | |
333 | /* Lock if shared */ |
334 | if(SSLSESSION_SHARED(data)) |
335 | general_age = &data->share->sessionage; |
336 | else |
337 | general_age = &data->state.sessionage; |
338 | |
339 | for(i = 0; i < data->set.general_ssl.max_ssl_sessions; i++) { |
340 | check = &data->state.session[i]; |
341 | if(!check->sessionid) |
342 | /* not session ID means blank entry */ |
343 | continue; |
344 | if(strcasecompare(name, check->name) && |
345 | ((!conn->bits.conn_to_host && !check->conn_to_host) || |
346 | (conn->bits.conn_to_host && check->conn_to_host && |
347 | strcasecompare(conn->conn_to_host.name, check->conn_to_host))) && |
348 | ((!conn->bits.conn_to_port && check->conn_to_port == -1) || |
349 | (conn->bits.conn_to_port && check->conn_to_port != -1 && |
350 | conn->conn_to_port == check->conn_to_port)) && |
351 | (port == check->remote_port) && |
352 | strcasecompare(conn->handler->scheme, check->scheme) && |
353 | Curl_ssl_config_matches(ssl_config, &check->ssl_config)) { |
354 | /* yes, we have a session ID! */ |
355 | (*general_age)++; /* increase general age */ |
356 | check->age = *general_age; /* set this as used in this age */ |
357 | *ssl_sessionid = check->sessionid; |
358 | if(idsize) |
359 | *idsize = check->idsize; |
360 | no_match = FALSE; |
361 | break; |
362 | } |
363 | } |
364 | |
365 | return no_match; |
366 | } |
367 | |
368 | /* |
369 | * Kill a single session ID entry in the cache. |
370 | */ |
371 | void Curl_ssl_kill_session(struct curl_ssl_session *session) |
372 | { |
373 | if(session->sessionid) { |
374 | /* defensive check */ |
375 | |
376 | /* free the ID the SSL-layer specific way */ |
377 | Curl_ssl->session_free(session->sessionid); |
378 | |
379 | session->sessionid = NULL; |
380 | session->age = 0; /* fresh */ |
381 | |
382 | Curl_free_primary_ssl_config(&session->ssl_config); |
383 | |
384 | Curl_safefree(session->name); |
385 | Curl_safefree(session->conn_to_host); |
386 | } |
387 | } |
388 | |
389 | /* |
390 | * Delete the given session ID from the cache. |
391 | */ |
392 | void Curl_ssl_delsessionid(struct connectdata *conn, void *ssl_sessionid) |
393 | { |
394 | size_t i; |
395 | struct Curl_easy *data = conn->data; |
396 | |
397 | for(i = 0; i < data->set.general_ssl.max_ssl_sessions; i++) { |
398 | struct curl_ssl_session *check = &data->state.session[i]; |
399 | |
400 | if(check->sessionid == ssl_sessionid) { |
401 | Curl_ssl_kill_session(check); |
402 | break; |
403 | } |
404 | } |
405 | } |
406 | |
407 | /* |
408 | * Store session id in the session cache. The ID passed on to this function |
409 | * must already have been extracted and allocated the proper way for the SSL |
410 | * layer. Curl_XXXX_session_free() will be called to free/kill the session ID |
411 | * later on. |
412 | */ |
413 | CURLcode Curl_ssl_addsessionid(struct connectdata *conn, |
414 | void *ssl_sessionid, |
415 | size_t idsize, |
416 | int sockindex) |
417 | { |
418 | size_t i; |
419 | struct Curl_easy *data = conn->data; /* the mother of all structs */ |
420 | struct curl_ssl_session *store = &data->state.session[0]; |
421 | long oldest_age = data->state.session[0].age; /* zero if unused */ |
422 | char *clone_host; |
423 | char *clone_conn_to_host; |
424 | int conn_to_port; |
425 | long *general_age; |
426 | const bool isProxy = CONNECT_PROXY_SSL(); |
427 | struct ssl_primary_config * const ssl_config = isProxy ? |
428 | &conn->proxy_ssl_config : |
429 | &conn->ssl_config; |
430 | |
431 | DEBUGASSERT(SSL_SET_OPTION(primary.sessionid)); |
432 | |
433 | clone_host = strdup(isProxy ? conn->http_proxy.host.name : conn->host.name); |
434 | if(!clone_host) |
435 | return CURLE_OUT_OF_MEMORY; /* bail out */ |
436 | |
437 | if(conn->bits.conn_to_host) { |
438 | clone_conn_to_host = strdup(conn->conn_to_host.name); |
439 | if(!clone_conn_to_host) { |
440 | free(clone_host); |
441 | return CURLE_OUT_OF_MEMORY; /* bail out */ |
442 | } |
443 | } |
444 | else |
445 | clone_conn_to_host = NULL; |
446 | |
447 | if(conn->bits.conn_to_port) |
448 | conn_to_port = conn->conn_to_port; |
449 | else |
450 | conn_to_port = -1; |
451 | |
452 | /* Now we should add the session ID and the host name to the cache, (remove |
453 | the oldest if necessary) */ |
454 | |
455 | /* If using shared SSL session, lock! */ |
456 | if(SSLSESSION_SHARED(data)) { |
457 | general_age = &data->share->sessionage; |
458 | } |
459 | else { |
460 | general_age = &data->state.sessionage; |
461 | } |
462 | |
463 | /* find an empty slot for us, or find the oldest */ |
464 | for(i = 1; (i < data->set.general_ssl.max_ssl_sessions) && |
465 | data->state.session[i].sessionid; i++) { |
466 | if(data->state.session[i].age < oldest_age) { |
467 | oldest_age = data->state.session[i].age; |
468 | store = &data->state.session[i]; |
469 | } |
470 | } |
471 | if(i == data->set.general_ssl.max_ssl_sessions) |
472 | /* cache is full, we must "kill" the oldest entry! */ |
473 | Curl_ssl_kill_session(store); |
474 | else |
475 | store = &data->state.session[i]; /* use this slot */ |
476 | |
477 | /* now init the session struct wisely */ |
478 | store->sessionid = ssl_sessionid; |
479 | store->idsize = idsize; |
480 | store->age = *general_age; /* set current age */ |
481 | /* free it if there's one already present */ |
482 | free(store->name); |
483 | free(store->conn_to_host); |
484 | store->name = clone_host; /* clone host name */ |
485 | store->conn_to_host = clone_conn_to_host; /* clone connect to host name */ |
486 | store->conn_to_port = conn_to_port; /* connect to port number */ |
487 | /* port number */ |
488 | store->remote_port = isProxy ? (int)conn->port : conn->remote_port; |
489 | store->scheme = conn->handler->scheme; |
490 | |
491 | if(!Curl_clone_primary_ssl_config(ssl_config, &store->ssl_config)) { |
492 | store->sessionid = NULL; /* let caller free sessionid */ |
493 | free(clone_host); |
494 | free(clone_conn_to_host); |
495 | return CURLE_OUT_OF_MEMORY; |
496 | } |
497 | |
498 | return CURLE_OK; |
499 | } |
500 | |
501 | |
502 | void Curl_ssl_close_all(struct Curl_easy *data) |
503 | { |
504 | /* kill the session ID cache if not shared */ |
505 | if(data->state.session && !SSLSESSION_SHARED(data)) { |
506 | size_t i; |
507 | for(i = 0; i < data->set.general_ssl.max_ssl_sessions; i++) |
508 | /* the single-killer function handles empty table slots */ |
509 | Curl_ssl_kill_session(&data->state.session[i]); |
510 | |
511 | /* free the cache data */ |
512 | Curl_safefree(data->state.session); |
513 | } |
514 | |
515 | Curl_ssl->close_all(data); |
516 | } |
517 | |
518 | #if defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \ |
519 | defined(USE_SECTRANSP) || defined(USE_POLARSSL) || defined(USE_NSS) || \ |
520 | defined(USE_MBEDTLS) || defined(USE_WOLFSSL) || defined(USE_BEARSSL) |
521 | int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks) |
522 | { |
523 | struct ssl_connect_data *connssl = &conn->ssl[FIRSTSOCKET]; |
524 | |
525 | if(connssl->connecting_state == ssl_connect_2_writing) { |
526 | /* write mode */ |
527 | socks[0] = conn->sock[FIRSTSOCKET]; |
528 | return GETSOCK_WRITESOCK(0); |
529 | } |
530 | if(connssl->connecting_state == ssl_connect_2_reading) { |
531 | /* read mode */ |
532 | socks[0] = conn->sock[FIRSTSOCKET]; |
533 | return GETSOCK_READSOCK(0); |
534 | } |
535 | |
536 | return GETSOCK_BLANK; |
537 | } |
538 | #else |
539 | int Curl_ssl_getsock(struct connectdata *conn, |
540 | curl_socket_t *socks) |
541 | { |
542 | (void)conn; |
543 | (void)socks; |
544 | return GETSOCK_BLANK; |
545 | } |
546 | /* USE_OPENSSL || USE_GNUTLS || USE_SCHANNEL || USE_SECTRANSP || USE_NSS */ |
547 | #endif |
548 | |
549 | void Curl_ssl_close(struct connectdata *conn, int sockindex) |
550 | { |
551 | DEBUGASSERT((sockindex <= 1) && (sockindex >= -1)); |
552 | Curl_ssl->close_one(conn, sockindex); |
553 | } |
554 | |
555 | CURLcode Curl_ssl_shutdown(struct connectdata *conn, int sockindex) |
556 | { |
557 | if(Curl_ssl->shut_down(conn, sockindex)) |
558 | return CURLE_SSL_SHUTDOWN_FAILED; |
559 | |
560 | conn->ssl[sockindex].use = FALSE; /* get back to ordinary socket usage */ |
561 | conn->ssl[sockindex].state = ssl_connection_none; |
562 | |
563 | conn->recv[sockindex] = Curl_recv_plain; |
564 | conn->send[sockindex] = Curl_send_plain; |
565 | |
566 | return CURLE_OK; |
567 | } |
568 | |
569 | /* Selects an SSL crypto engine |
570 | */ |
571 | CURLcode Curl_ssl_set_engine(struct Curl_easy *data, const char *engine) |
572 | { |
573 | return Curl_ssl->set_engine(data, engine); |
574 | } |
575 | |
576 | /* Selects the default SSL crypto engine |
577 | */ |
578 | CURLcode Curl_ssl_set_engine_default(struct Curl_easy *data) |
579 | { |
580 | return Curl_ssl->set_engine_default(data); |
581 | } |
582 | |
583 | /* Return list of OpenSSL crypto engine names. */ |
584 | struct curl_slist *Curl_ssl_engines_list(struct Curl_easy *data) |
585 | { |
586 | return Curl_ssl->engines_list(data); |
587 | } |
588 | |
589 | /* |
590 | * This sets up a session ID cache to the specified size. Make sure this code |
591 | * is agnostic to what underlying SSL technology we use. |
592 | */ |
593 | CURLcode Curl_ssl_initsessions(struct Curl_easy *data, size_t amount) |
594 | { |
595 | struct curl_ssl_session *session; |
596 | |
597 | if(data->state.session) |
598 | /* this is just a precaution to prevent multiple inits */ |
599 | return CURLE_OK; |
600 | |
601 | session = calloc(amount, sizeof(struct curl_ssl_session)); |
602 | if(!session) |
603 | return CURLE_OUT_OF_MEMORY; |
604 | |
605 | /* store the info in the SSL section */ |
606 | data->set.general_ssl.max_ssl_sessions = amount; |
607 | data->state.session = session; |
608 | data->state.sessionage = 1; /* this is brand new */ |
609 | return CURLE_OK; |
610 | } |
611 | |
612 | static size_t Curl_multissl_version(char *buffer, size_t size); |
613 | |
614 | size_t Curl_ssl_version(char *buffer, size_t size) |
615 | { |
616 | #ifdef CURL_WITH_MULTI_SSL |
617 | return Curl_multissl_version(buffer, size); |
618 | #else |
619 | return Curl_ssl->version(buffer, size); |
620 | #endif |
621 | } |
622 | |
623 | /* |
624 | * This function tries to determine connection status. |
625 | * |
626 | * Return codes: |
627 | * 1 means the connection is still in place |
628 | * 0 means the connection has been closed |
629 | * -1 means the connection status is unknown |
630 | */ |
631 | int Curl_ssl_check_cxn(struct connectdata *conn) |
632 | { |
633 | return Curl_ssl->check_cxn(conn); |
634 | } |
635 | |
636 | bool Curl_ssl_data_pending(const struct connectdata *conn, |
637 | int connindex) |
638 | { |
639 | return Curl_ssl->data_pending(conn, connindex); |
640 | } |
641 | |
642 | void Curl_ssl_free_certinfo(struct Curl_easy *data) |
643 | { |
644 | struct curl_certinfo *ci = &data->info.certs; |
645 | |
646 | if(ci->num_of_certs) { |
647 | /* free all individual lists used */ |
648 | int i; |
649 | for(i = 0; i<ci->num_of_certs; i++) { |
650 | curl_slist_free_all(ci->certinfo[i]); |
651 | ci->certinfo[i] = NULL; |
652 | } |
653 | |
654 | free(ci->certinfo); /* free the actual array too */ |
655 | ci->certinfo = NULL; |
656 | ci->num_of_certs = 0; |
657 | } |
658 | } |
659 | |
660 | CURLcode Curl_ssl_init_certinfo(struct Curl_easy *data, int num) |
661 | { |
662 | struct curl_certinfo *ci = &data->info.certs; |
663 | struct curl_slist **table; |
664 | |
665 | /* Free any previous certificate information structures */ |
666 | Curl_ssl_free_certinfo(data); |
667 | |
668 | /* Allocate the required certificate information structures */ |
669 | table = calloc((size_t) num, sizeof(struct curl_slist *)); |
670 | if(!table) |
671 | return CURLE_OUT_OF_MEMORY; |
672 | |
673 | ci->num_of_certs = num; |
674 | ci->certinfo = table; |
675 | |
676 | return CURLE_OK; |
677 | } |
678 | |
679 | /* |
680 | * 'value' is NOT a zero terminated string |
681 | */ |
682 | CURLcode Curl_ssl_push_certinfo_len(struct Curl_easy *data, |
683 | int certnum, |
684 | const char *label, |
685 | const char *value, |
686 | size_t valuelen) |
687 | { |
688 | struct curl_certinfo *ci = &data->info.certs; |
689 | char *output; |
690 | struct curl_slist *nl; |
691 | CURLcode result = CURLE_OK; |
692 | size_t labellen = strlen(label); |
693 | size_t outlen = labellen + 1 + valuelen + 1; /* label:value\0 */ |
694 | |
695 | output = malloc(outlen); |
696 | if(!output) |
697 | return CURLE_OUT_OF_MEMORY; |
698 | |
699 | /* sprintf the label and colon */ |
700 | msnprintf(output, outlen, "%s:" , label); |
701 | |
702 | /* memcpy the value (it might not be zero terminated) */ |
703 | memcpy(&output[labellen + 1], value, valuelen); |
704 | |
705 | /* zero terminate the output */ |
706 | output[labellen + 1 + valuelen] = 0; |
707 | |
708 | nl = Curl_slist_append_nodup(ci->certinfo[certnum], output); |
709 | if(!nl) { |
710 | free(output); |
711 | curl_slist_free_all(ci->certinfo[certnum]); |
712 | result = CURLE_OUT_OF_MEMORY; |
713 | } |
714 | |
715 | ci->certinfo[certnum] = nl; |
716 | return result; |
717 | } |
718 | |
719 | /* |
720 | * This is a convenience function for push_certinfo_len that takes a zero |
721 | * terminated value. |
722 | */ |
723 | CURLcode Curl_ssl_push_certinfo(struct Curl_easy *data, |
724 | int certnum, |
725 | const char *label, |
726 | const char *value) |
727 | { |
728 | size_t valuelen = strlen(value); |
729 | |
730 | return Curl_ssl_push_certinfo_len(data, certnum, label, value, valuelen); |
731 | } |
732 | |
733 | CURLcode Curl_ssl_random(struct Curl_easy *data, |
734 | unsigned char *entropy, |
735 | size_t length) |
736 | { |
737 | return Curl_ssl->random(data, entropy, length); |
738 | } |
739 | |
740 | /* |
741 | * Public key pem to der conversion |
742 | */ |
743 | |
744 | static CURLcode pubkey_pem_to_der(const char *pem, |
745 | unsigned char **der, size_t *der_len) |
746 | { |
747 | char *stripped_pem, *begin_pos, *end_pos; |
748 | size_t pem_count, stripped_pem_count = 0, pem_len; |
749 | CURLcode result; |
750 | |
751 | /* if no pem, exit. */ |
752 | if(!pem) |
753 | return CURLE_BAD_CONTENT_ENCODING; |
754 | |
755 | begin_pos = strstr(pem, "-----BEGIN PUBLIC KEY-----" ); |
756 | if(!begin_pos) |
757 | return CURLE_BAD_CONTENT_ENCODING; |
758 | |
759 | pem_count = begin_pos - pem; |
760 | /* Invalid if not at beginning AND not directly following \n */ |
761 | if(0 != pem_count && '\n' != pem[pem_count - 1]) |
762 | return CURLE_BAD_CONTENT_ENCODING; |
763 | |
764 | /* 26 is length of "-----BEGIN PUBLIC KEY-----" */ |
765 | pem_count += 26; |
766 | |
767 | /* Invalid if not directly following \n */ |
768 | end_pos = strstr(pem + pem_count, "\n-----END PUBLIC KEY-----" ); |
769 | if(!end_pos) |
770 | return CURLE_BAD_CONTENT_ENCODING; |
771 | |
772 | pem_len = end_pos - pem; |
773 | |
774 | stripped_pem = malloc(pem_len - pem_count + 1); |
775 | if(!stripped_pem) |
776 | return CURLE_OUT_OF_MEMORY; |
777 | |
778 | /* |
779 | * Here we loop through the pem array one character at a time between the |
780 | * correct indices, and place each character that is not '\n' or '\r' |
781 | * into the stripped_pem array, which should represent the raw base64 string |
782 | */ |
783 | while(pem_count < pem_len) { |
784 | if('\n' != pem[pem_count] && '\r' != pem[pem_count]) |
785 | stripped_pem[stripped_pem_count++] = pem[pem_count]; |
786 | ++pem_count; |
787 | } |
788 | /* Place the null terminator in the correct place */ |
789 | stripped_pem[stripped_pem_count] = '\0'; |
790 | |
791 | result = Curl_base64_decode(stripped_pem, der, der_len); |
792 | |
793 | Curl_safefree(stripped_pem); |
794 | |
795 | return result; |
796 | } |
797 | |
798 | /* |
799 | * Generic pinned public key check. |
800 | */ |
801 | |
802 | CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data, |
803 | const char *pinnedpubkey, |
804 | const unsigned char *pubkey, size_t pubkeylen) |
805 | { |
806 | FILE *fp; |
807 | unsigned char *buf = NULL, *pem_ptr = NULL; |
808 | CURLcode result = CURLE_SSL_PINNEDPUBKEYNOTMATCH; |
809 | |
810 | /* if a path wasn't specified, don't pin */ |
811 | if(!pinnedpubkey) |
812 | return CURLE_OK; |
813 | if(!pubkey || !pubkeylen) |
814 | return result; |
815 | |
816 | /* only do this if pinnedpubkey starts with "sha256//", length 8 */ |
817 | if(strncmp(pinnedpubkey, "sha256//" , 8) == 0) { |
818 | CURLcode encode; |
819 | size_t encodedlen, pinkeylen; |
820 | char *encoded, *pinkeycopy, *begin_pos, *end_pos; |
821 | unsigned char *sha256sumdigest; |
822 | |
823 | if(!Curl_ssl->sha256sum) { |
824 | /* without sha256 support, this cannot match */ |
825 | return result; |
826 | } |
827 | |
828 | /* compute sha256sum of public key */ |
829 | sha256sumdigest = malloc(CURL_SHA256_DIGEST_LENGTH); |
830 | if(!sha256sumdigest) |
831 | return CURLE_OUT_OF_MEMORY; |
832 | encode = Curl_ssl->sha256sum(pubkey, pubkeylen, |
833 | sha256sumdigest, CURL_SHA256_DIGEST_LENGTH); |
834 | |
835 | if(encode != CURLE_OK) |
836 | return encode; |
837 | |
838 | encode = Curl_base64_encode(data, (char *)sha256sumdigest, |
839 | CURL_SHA256_DIGEST_LENGTH, &encoded, |
840 | &encodedlen); |
841 | Curl_safefree(sha256sumdigest); |
842 | |
843 | if(encode) |
844 | return encode; |
845 | |
846 | infof(data, "\t public key hash: sha256//%s\n" , encoded); |
847 | |
848 | /* it starts with sha256//, copy so we can modify it */ |
849 | pinkeylen = strlen(pinnedpubkey) + 1; |
850 | pinkeycopy = malloc(pinkeylen); |
851 | if(!pinkeycopy) { |
852 | Curl_safefree(encoded); |
853 | return CURLE_OUT_OF_MEMORY; |
854 | } |
855 | memcpy(pinkeycopy, pinnedpubkey, pinkeylen); |
856 | /* point begin_pos to the copy, and start extracting keys */ |
857 | begin_pos = pinkeycopy; |
858 | do { |
859 | end_pos = strstr(begin_pos, ";sha256//" ); |
860 | /* |
861 | * if there is an end_pos, null terminate, |
862 | * otherwise it'll go to the end of the original string |
863 | */ |
864 | if(end_pos) |
865 | end_pos[0] = '\0'; |
866 | |
867 | /* compare base64 sha256 digests, 8 is the length of "sha256//" */ |
868 | if(encodedlen == strlen(begin_pos + 8) && |
869 | !memcmp(encoded, begin_pos + 8, encodedlen)) { |
870 | result = CURLE_OK; |
871 | break; |
872 | } |
873 | |
874 | /* |
875 | * change back the null-terminator we changed earlier, |
876 | * and look for next begin |
877 | */ |
878 | if(end_pos) { |
879 | end_pos[0] = ';'; |
880 | begin_pos = strstr(end_pos, "sha256//" ); |
881 | } |
882 | } while(end_pos && begin_pos); |
883 | Curl_safefree(encoded); |
884 | Curl_safefree(pinkeycopy); |
885 | return result; |
886 | } |
887 | |
888 | fp = fopen(pinnedpubkey, "rb" ); |
889 | if(!fp) |
890 | return result; |
891 | |
892 | do { |
893 | long filesize; |
894 | size_t size, pem_len; |
895 | CURLcode pem_read; |
896 | |
897 | /* Determine the file's size */ |
898 | if(fseek(fp, 0, SEEK_END)) |
899 | break; |
900 | filesize = ftell(fp); |
901 | if(fseek(fp, 0, SEEK_SET)) |
902 | break; |
903 | if(filesize < 0 || filesize > MAX_PINNED_PUBKEY_SIZE) |
904 | break; |
905 | |
906 | /* |
907 | * if the size of our certificate is bigger than the file |
908 | * size then it can't match |
909 | */ |
910 | size = curlx_sotouz((curl_off_t) filesize); |
911 | if(pubkeylen > size) |
912 | break; |
913 | |
914 | /* |
915 | * Allocate buffer for the pinned key |
916 | * With 1 additional byte for null terminator in case of PEM key |
917 | */ |
918 | buf = malloc(size + 1); |
919 | if(!buf) |
920 | break; |
921 | |
922 | /* Returns number of elements read, which should be 1 */ |
923 | if((int) fread(buf, size, 1, fp) != 1) |
924 | break; |
925 | |
926 | /* If the sizes are the same, it can't be base64 encoded, must be der */ |
927 | if(pubkeylen == size) { |
928 | if(!memcmp(pubkey, buf, pubkeylen)) |
929 | result = CURLE_OK; |
930 | break; |
931 | } |
932 | |
933 | /* |
934 | * Otherwise we will assume it's PEM and try to decode it |
935 | * after placing null terminator |
936 | */ |
937 | buf[size] = '\0'; |
938 | pem_read = pubkey_pem_to_der((const char *)buf, &pem_ptr, &pem_len); |
939 | /* if it wasn't read successfully, exit */ |
940 | if(pem_read) |
941 | break; |
942 | |
943 | /* |
944 | * if the size of our certificate doesn't match the size of |
945 | * the decoded file, they can't be the same, otherwise compare |
946 | */ |
947 | if(pubkeylen == pem_len && !memcmp(pubkey, pem_ptr, pubkeylen)) |
948 | result = CURLE_OK; |
949 | } while(0); |
950 | |
951 | Curl_safefree(buf); |
952 | Curl_safefree(pem_ptr); |
953 | fclose(fp); |
954 | |
955 | return result; |
956 | } |
957 | |
958 | #ifndef CURL_DISABLE_CRYPTO_AUTH |
959 | CURLcode Curl_ssl_md5sum(unsigned char *tmp, /* input */ |
960 | size_t tmplen, |
961 | unsigned char *md5sum, /* output */ |
962 | size_t md5len) |
963 | { |
964 | return Curl_ssl->md5sum(tmp, tmplen, md5sum, md5len); |
965 | } |
966 | #endif |
967 | |
968 | /* |
969 | * Check whether the SSL backend supports the status_request extension. |
970 | */ |
971 | bool Curl_ssl_cert_status_request(void) |
972 | { |
973 | return Curl_ssl->cert_status_request(); |
974 | } |
975 | |
976 | /* |
977 | * Check whether the SSL backend supports false start. |
978 | */ |
979 | bool Curl_ssl_false_start(void) |
980 | { |
981 | return Curl_ssl->false_start(); |
982 | } |
983 | |
984 | /* |
985 | * Check whether the SSL backend supports setting TLS 1.3 cipher suites |
986 | */ |
987 | bool Curl_ssl_tls13_ciphersuites(void) |
988 | { |
989 | return Curl_ssl->supports & SSLSUPP_TLS13_CIPHERSUITES; |
990 | } |
991 | |
992 | /* |
993 | * Default implementations for unsupported functions. |
994 | */ |
995 | |
996 | int Curl_none_init(void) |
997 | { |
998 | return 1; |
999 | } |
1000 | |
1001 | void Curl_none_cleanup(void) |
1002 | { } |
1003 | |
1004 | int Curl_none_shutdown(struct connectdata *conn UNUSED_PARAM, |
1005 | int sockindex UNUSED_PARAM) |
1006 | { |
1007 | (void)conn; |
1008 | (void)sockindex; |
1009 | return 0; |
1010 | } |
1011 | |
1012 | int Curl_none_check_cxn(struct connectdata *conn UNUSED_PARAM) |
1013 | { |
1014 | (void)conn; |
1015 | return -1; |
1016 | } |
1017 | |
1018 | CURLcode Curl_none_random(struct Curl_easy *data UNUSED_PARAM, |
1019 | unsigned char *entropy UNUSED_PARAM, |
1020 | size_t length UNUSED_PARAM) |
1021 | { |
1022 | (void)data; |
1023 | (void)entropy; |
1024 | (void)length; |
1025 | return CURLE_NOT_BUILT_IN; |
1026 | } |
1027 | |
1028 | void Curl_none_close_all(struct Curl_easy *data UNUSED_PARAM) |
1029 | { |
1030 | (void)data; |
1031 | } |
1032 | |
1033 | void Curl_none_session_free(void *ptr UNUSED_PARAM) |
1034 | { |
1035 | (void)ptr; |
1036 | } |
1037 | |
1038 | bool Curl_none_data_pending(const struct connectdata *conn UNUSED_PARAM, |
1039 | int connindex UNUSED_PARAM) |
1040 | { |
1041 | (void)conn; |
1042 | (void)connindex; |
1043 | return 0; |
1044 | } |
1045 | |
1046 | bool Curl_none_cert_status_request(void) |
1047 | { |
1048 | return FALSE; |
1049 | } |
1050 | |
1051 | CURLcode Curl_none_set_engine(struct Curl_easy *data UNUSED_PARAM, |
1052 | const char *engine UNUSED_PARAM) |
1053 | { |
1054 | (void)data; |
1055 | (void)engine; |
1056 | return CURLE_NOT_BUILT_IN; |
1057 | } |
1058 | |
1059 | CURLcode Curl_none_set_engine_default(struct Curl_easy *data UNUSED_PARAM) |
1060 | { |
1061 | (void)data; |
1062 | return CURLE_NOT_BUILT_IN; |
1063 | } |
1064 | |
1065 | struct curl_slist *Curl_none_engines_list(struct Curl_easy *data UNUSED_PARAM) |
1066 | { |
1067 | (void)data; |
1068 | return (struct curl_slist *)NULL; |
1069 | } |
1070 | |
1071 | bool Curl_none_false_start(void) |
1072 | { |
1073 | return FALSE; |
1074 | } |
1075 | |
1076 | #ifndef CURL_DISABLE_CRYPTO_AUTH |
1077 | CURLcode Curl_none_md5sum(unsigned char *input, size_t inputlen, |
1078 | unsigned char *md5sum, size_t md5len UNUSED_PARAM) |
1079 | { |
1080 | MD5_context *MD5pw; |
1081 | |
1082 | (void)md5len; |
1083 | |
1084 | MD5pw = Curl_MD5_init(Curl_DIGEST_MD5); |
1085 | if(!MD5pw) |
1086 | return CURLE_OUT_OF_MEMORY; |
1087 | Curl_MD5_update(MD5pw, input, curlx_uztoui(inputlen)); |
1088 | Curl_MD5_final(MD5pw, md5sum); |
1089 | return CURLE_OK; |
1090 | } |
1091 | #else |
1092 | CURLcode Curl_none_md5sum(unsigned char *input UNUSED_PARAM, |
1093 | size_t inputlen UNUSED_PARAM, |
1094 | unsigned char *md5sum UNUSED_PARAM, |
1095 | size_t md5len UNUSED_PARAM) |
1096 | { |
1097 | (void)input; |
1098 | (void)inputlen; |
1099 | (void)md5sum; |
1100 | (void)md5len; |
1101 | return CURLE_NOT_BUILT_IN; |
1102 | } |
1103 | #endif |
1104 | |
1105 | static int Curl_multissl_init(void) |
1106 | { |
1107 | if(multissl_init(NULL)) |
1108 | return 1; |
1109 | return Curl_ssl->init(); |
1110 | } |
1111 | |
1112 | static CURLcode Curl_multissl_connect(struct connectdata *conn, int sockindex) |
1113 | { |
1114 | if(multissl_init(NULL)) |
1115 | return CURLE_FAILED_INIT; |
1116 | return Curl_ssl->connect_blocking(conn, sockindex); |
1117 | } |
1118 | |
1119 | static CURLcode Curl_multissl_connect_nonblocking(struct connectdata *conn, |
1120 | int sockindex, bool *done) |
1121 | { |
1122 | if(multissl_init(NULL)) |
1123 | return CURLE_FAILED_INIT; |
1124 | return Curl_ssl->connect_nonblocking(conn, sockindex, done); |
1125 | } |
1126 | |
1127 | static void *Curl_multissl_get_internals(struct ssl_connect_data *connssl, |
1128 | CURLINFO info) |
1129 | { |
1130 | if(multissl_init(NULL)) |
1131 | return NULL; |
1132 | return Curl_ssl->get_internals(connssl, info); |
1133 | } |
1134 | |
1135 | static void Curl_multissl_close(struct connectdata *conn, int sockindex) |
1136 | { |
1137 | if(multissl_init(NULL)) |
1138 | return; |
1139 | Curl_ssl->close_one(conn, sockindex); |
1140 | } |
1141 | |
1142 | static const struct Curl_ssl Curl_ssl_multi = { |
1143 | { CURLSSLBACKEND_NONE, "multi" }, /* info */ |
1144 | 0, /* supports nothing */ |
1145 | (size_t)-1, /* something insanely large to be on the safe side */ |
1146 | |
1147 | Curl_multissl_init, /* init */ |
1148 | Curl_none_cleanup, /* cleanup */ |
1149 | Curl_multissl_version, /* version */ |
1150 | Curl_none_check_cxn, /* check_cxn */ |
1151 | Curl_none_shutdown, /* shutdown */ |
1152 | Curl_none_data_pending, /* data_pending */ |
1153 | Curl_none_random, /* random */ |
1154 | Curl_none_cert_status_request, /* cert_status_request */ |
1155 | Curl_multissl_connect, /* connect */ |
1156 | Curl_multissl_connect_nonblocking, /* connect_nonblocking */ |
1157 | Curl_multissl_get_internals, /* get_internals */ |
1158 | Curl_multissl_close, /* close_one */ |
1159 | Curl_none_close_all, /* close_all */ |
1160 | Curl_none_session_free, /* session_free */ |
1161 | Curl_none_set_engine, /* set_engine */ |
1162 | Curl_none_set_engine_default, /* set_engine_default */ |
1163 | Curl_none_engines_list, /* engines_list */ |
1164 | Curl_none_false_start, /* false_start */ |
1165 | Curl_none_md5sum, /* md5sum */ |
1166 | NULL /* sha256sum */ |
1167 | }; |
1168 | |
1169 | const struct Curl_ssl *Curl_ssl = |
1170 | #if defined(CURL_WITH_MULTI_SSL) |
1171 | &Curl_ssl_multi; |
1172 | #elif defined(USE_WOLFSSL) |
1173 | &Curl_ssl_wolfssl; |
1174 | #elif defined(USE_SECTRANSP) |
1175 | &Curl_ssl_sectransp; |
1176 | #elif defined(USE_GNUTLS) |
1177 | &Curl_ssl_gnutls; |
1178 | #elif defined(USE_GSKIT) |
1179 | &Curl_ssl_gskit; |
1180 | #elif defined(USE_MBEDTLS) |
1181 | &Curl_ssl_mbedtls; |
1182 | #elif defined(USE_NSS) |
1183 | &Curl_ssl_nss; |
1184 | #elif defined(USE_OPENSSL) |
1185 | &Curl_ssl_openssl; |
1186 | #elif defined(USE_POLARSSL) |
1187 | &Curl_ssl_polarssl; |
1188 | #elif defined(USE_SCHANNEL) |
1189 | &Curl_ssl_schannel; |
1190 | #elif defined(USE_MESALINK) |
1191 | &Curl_ssl_mesalink; |
1192 | #elif defined(USE_BEARSSL) |
1193 | &Curl_ssl_bearssl; |
1194 | #else |
1195 | #error "Missing struct Curl_ssl for selected SSL backend" |
1196 | #endif |
1197 | |
1198 | static const struct Curl_ssl *available_backends[] = { |
1199 | #if defined(USE_WOLFSSL) |
1200 | &Curl_ssl_wolfssl, |
1201 | #endif |
1202 | #if defined(USE_SECTRANSP) |
1203 | &Curl_ssl_sectransp, |
1204 | #endif |
1205 | #if defined(USE_GNUTLS) |
1206 | &Curl_ssl_gnutls, |
1207 | #endif |
1208 | #if defined(USE_GSKIT) |
1209 | &Curl_ssl_gskit, |
1210 | #endif |
1211 | #if defined(USE_MBEDTLS) |
1212 | &Curl_ssl_mbedtls, |
1213 | #endif |
1214 | #if defined(USE_NSS) |
1215 | &Curl_ssl_nss, |
1216 | #endif |
1217 | #if defined(USE_OPENSSL) |
1218 | &Curl_ssl_openssl, |
1219 | #endif |
1220 | #if defined(USE_POLARSSL) |
1221 | &Curl_ssl_polarssl, |
1222 | #endif |
1223 | #if defined(USE_SCHANNEL) |
1224 | &Curl_ssl_schannel, |
1225 | #endif |
1226 | #if defined(USE_MESALINK) |
1227 | &Curl_ssl_mesalink, |
1228 | #endif |
1229 | NULL |
1230 | }; |
1231 | |
1232 | static size_t Curl_multissl_version(char *buffer, size_t size) |
1233 | { |
1234 | static const struct Curl_ssl *selected; |
1235 | static char backends[200]; |
1236 | static size_t total; |
1237 | const struct Curl_ssl *current; |
1238 | |
1239 | current = Curl_ssl == &Curl_ssl_multi ? available_backends[0] : Curl_ssl; |
1240 | |
1241 | if(current != selected) { |
1242 | char *p = backends; |
1243 | char *end = backends + sizeof(backends); |
1244 | int i; |
1245 | |
1246 | selected = current; |
1247 | |
1248 | for(i = 0; available_backends[i] && p < (end - 4); i++) { |
1249 | if(i) |
1250 | *(p++) = ' '; |
1251 | if(selected != available_backends[i]) |
1252 | *(p++) = '('; |
1253 | p += available_backends[i]->version(p, end - p - 2); |
1254 | if(selected != available_backends[i]) |
1255 | *(p++) = ')'; |
1256 | } |
1257 | *p = '\0'; |
1258 | total = p - backends; |
1259 | } |
1260 | |
1261 | if(size > total) |
1262 | memcpy(buffer, backends, total + 1); |
1263 | else { |
1264 | memcpy(buffer, backends, size - 1); |
1265 | buffer[size - 1] = '\0'; |
1266 | } |
1267 | |
1268 | return CURLMIN(size - 1, total); |
1269 | } |
1270 | |
1271 | static int multissl_init(const struct Curl_ssl *backend) |
1272 | { |
1273 | const char *env; |
1274 | char *env_tmp; |
1275 | |
1276 | if(Curl_ssl != &Curl_ssl_multi) |
1277 | return 1; |
1278 | |
1279 | if(backend) { |
1280 | Curl_ssl = backend; |
1281 | return 0; |
1282 | } |
1283 | |
1284 | if(!available_backends[0]) |
1285 | return 1; |
1286 | |
1287 | env = env_tmp = curl_getenv("CURL_SSL_BACKEND" ); |
1288 | #ifdef CURL_DEFAULT_SSL_BACKEND |
1289 | if(!env) |
1290 | env = CURL_DEFAULT_SSL_BACKEND; |
1291 | #endif |
1292 | if(env) { |
1293 | int i; |
1294 | for(i = 0; available_backends[i]; i++) { |
1295 | if(strcasecompare(env, available_backends[i]->info.name)) { |
1296 | Curl_ssl = available_backends[i]; |
1297 | curl_free(env_tmp); |
1298 | return 0; |
1299 | } |
1300 | } |
1301 | } |
1302 | |
1303 | /* Fall back to first available backend */ |
1304 | Curl_ssl = available_backends[0]; |
1305 | curl_free(env_tmp); |
1306 | return 0; |
1307 | } |
1308 | |
1309 | CURLsslset curl_global_sslset(curl_sslbackend id, const char *name, |
1310 | const curl_ssl_backend ***avail) |
1311 | { |
1312 | int i; |
1313 | |
1314 | if(avail) |
1315 | *avail = (const curl_ssl_backend **)&available_backends; |
1316 | |
1317 | if(Curl_ssl != &Curl_ssl_multi) |
1318 | return id == Curl_ssl->info.id || |
1319 | (name && strcasecompare(name, Curl_ssl->info.name)) ? |
1320 | CURLSSLSET_OK : |
1321 | #if defined(CURL_WITH_MULTI_SSL) |
1322 | CURLSSLSET_TOO_LATE; |
1323 | #else |
1324 | CURLSSLSET_UNKNOWN_BACKEND; |
1325 | #endif |
1326 | |
1327 | for(i = 0; available_backends[i]; i++) { |
1328 | if(available_backends[i]->info.id == id || |
1329 | (name && strcasecompare(available_backends[i]->info.name, name))) { |
1330 | multissl_init(available_backends[i]); |
1331 | return CURLSSLSET_OK; |
1332 | } |
1333 | } |
1334 | |
1335 | return CURLSSLSET_UNKNOWN_BACKEND; |
1336 | } |
1337 | |
1338 | #else /* USE_SSL */ |
1339 | CURLsslset curl_global_sslset(curl_sslbackend id, const char *name, |
1340 | const curl_ssl_backend ***avail) |
1341 | { |
1342 | (void)id; |
1343 | (void)name; |
1344 | (void)avail; |
1345 | return CURLSSLSET_NO_BACKENDS; |
1346 | } |
1347 | |
1348 | #endif /* !USE_SSL */ |
1349 | |