1#ifndef HEADER_CURL_VTLS_H
2#define HEADER_CURL_VTLS_H
3/***************************************************************************
4 * _ _ ____ _
5 * Project ___| | | | _ \| |
6 * / __| | | | |_) | |
7 * | (__| |_| | _ <| |___
8 * \___|\___/|_| \_\_____|
9 *
10 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
11 *
12 * This software is licensed as described in the file COPYING, which
13 * you should have received as part of this distribution. The terms
14 * are also available at https://curl.se/docs/copyright.html.
15 *
16 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
17 * copies of the Software, and permit persons to whom the Software is
18 * furnished to do so, under the terms of the COPYING file.
19 *
20 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
21 * KIND, either express or implied.
22 *
23 * SPDX-License-Identifier: curl
24 *
25 ***************************************************************************/
26#include "curl_setup.h"
27
28struct connectdata;
29struct ssl_config_data;
30struct ssl_primary_config;
31struct Curl_ssl_session;
32
33#define SSLSUPP_CA_PATH (1<<0) /* supports CAPATH */
34#define SSLSUPP_CERTINFO (1<<1) /* supports CURLOPT_CERTINFO */
35#define SSLSUPP_PINNEDPUBKEY (1<<2) /* supports CURLOPT_PINNEDPUBLICKEY */
36#define SSLSUPP_SSL_CTX (1<<3) /* supports CURLOPT_SSL_CTX */
37#define SSLSUPP_HTTPS_PROXY (1<<4) /* supports access via HTTPS proxies */
38#define SSLSUPP_TLS13_CIPHERSUITES (1<<5) /* supports TLS 1.3 ciphersuites */
39#define SSLSUPP_CAINFO_BLOB (1<<6)
40
41#define ALPN_ACCEPTED "ALPN: server accepted "
42
43#define VTLS_INFOF_NO_ALPN \
44 "ALPN: server did not agree on a protocol. Uses default."
45#define VTLS_INFOF_ALPN_OFFER_1STR \
46 "ALPN: curl offers %s"
47#define VTLS_INFOF_ALPN_ACCEPTED_1STR \
48 ALPN_ACCEPTED "%s"
49#define VTLS_INFOF_ALPN_ACCEPTED_LEN_1STR \
50 ALPN_ACCEPTED "%.*s"
51
52/* Curl_multi SSL backend-specific data; declared differently by each SSL
53 backend */
54struct multi_ssl_backend_data;
55struct Curl_cfilter;
56
57CURLsslset Curl_init_sslset_nolock(curl_sslbackend id, const char *name,
58 const curl_ssl_backend ***avail);
59
60#ifndef MAX_PINNED_PUBKEY_SIZE
61#define MAX_PINNED_PUBKEY_SIZE 1048576 /* 1MB */
62#endif
63
64#ifndef CURL_SHA256_DIGEST_LENGTH
65#define CURL_SHA256_DIGEST_LENGTH 32 /* fixed size */
66#endif
67
68char *Curl_ssl_snihost(struct Curl_easy *data, const char *host, size_t *olen);
69bool Curl_ssl_config_matches(struct ssl_primary_config *data,
70 struct ssl_primary_config *needle);
71bool Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
72 struct ssl_primary_config *dest);
73void Curl_free_primary_ssl_config(struct ssl_primary_config *sslc);
74
75curl_sslbackend Curl_ssl_backend(void);
76
77#ifdef USE_SSL
78int Curl_ssl_init(void);
79void Curl_ssl_cleanup(void);
80/* tell the SSL stuff to close down all open information regarding
81 connections (and thus session ID caching etc) */
82void Curl_ssl_close_all(struct Curl_easy *data);
83CURLcode Curl_ssl_set_engine(struct Curl_easy *data, const char *engine);
84/* Sets engine as default for all SSL operations */
85CURLcode Curl_ssl_set_engine_default(struct Curl_easy *data);
86struct curl_slist *Curl_ssl_engines_list(struct Curl_easy *data);
87
88/* init the SSL session ID cache */
89CURLcode Curl_ssl_initsessions(struct Curl_easy *, size_t);
90void Curl_ssl_version(char *buffer, size_t size);
91
92/* Certificate information list handling. */
93
94void Curl_ssl_free_certinfo(struct Curl_easy *data);
95CURLcode Curl_ssl_init_certinfo(struct Curl_easy *data, int num);
96CURLcode Curl_ssl_push_certinfo_len(struct Curl_easy *data, int certnum,
97 const char *label, const char *value,
98 size_t valuelen);
99CURLcode Curl_ssl_push_certinfo(struct Curl_easy *data, int certnum,
100 const char *label, const char *value);
101
102/* Functions to be used by SSL library adaptation functions */
103
104/* Lock session cache mutex.
105 * Call this before calling other Curl_ssl_*session* functions
106 * Caller should unlock this mutex as soon as possible, as it may block
107 * other SSL connection from making progress.
108 * The purpose of explicitly locking SSL session cache data is to allow
109 * individual SSL engines to manage session lifetime in their specific way.
110 */
111void Curl_ssl_sessionid_lock(struct Curl_easy *data);
112
113/* Unlock session cache mutex */
114void Curl_ssl_sessionid_unlock(struct Curl_easy *data);
115
116/* Kill a single session ID entry in the cache
117 * Sessionid mutex must be locked (see Curl_ssl_sessionid_lock).
118 * This will call engine-specific curlssl_session_free function, which must
119 * take sessionid object ownership from sessionid cache
120 * (e.g. decrement refcount).
121 */
122void Curl_ssl_kill_session(struct Curl_ssl_session *session);
123/* delete a session from the cache
124 * Sessionid mutex must be locked (see Curl_ssl_sessionid_lock).
125 * This will call engine-specific curlssl_session_free function, which must
126 * take sessionid object ownership from sessionid cache
127 * (e.g. decrement refcount).
128 */
129void Curl_ssl_delsessionid(struct Curl_easy *data, void *ssl_sessionid);
130
131/* get N random bytes into the buffer */
132CURLcode Curl_ssl_random(struct Curl_easy *data, unsigned char *buffer,
133 size_t length);
134/* Check pinned public key. */
135CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data,
136 const char *pinnedpubkey,
137 const unsigned char *pubkey, size_t pubkeylen);
138
139bool Curl_ssl_cert_status_request(void);
140
141bool Curl_ssl_false_start(struct Curl_easy *data);
142
143void Curl_free_multi_ssl_backend_data(struct multi_ssl_backend_data *mbackend);
144
145#define SSL_SHUTDOWN_TIMEOUT 10000 /* ms */
146
147CURLcode Curl_ssl_cfilter_add(struct Curl_easy *data,
148 struct connectdata *conn,
149 int sockindex);
150
151CURLcode Curl_cf_ssl_insert_after(struct Curl_cfilter *cf_at,
152 struct Curl_easy *data);
153
154CURLcode Curl_ssl_cfilter_remove(struct Curl_easy *data,
155 int sockindex);
156
157#ifndef CURL_DISABLE_PROXY
158CURLcode Curl_cf_ssl_proxy_insert_after(struct Curl_cfilter *cf_at,
159 struct Curl_easy *data);
160#endif /* !CURL_DISABLE_PROXY */
161
162/**
163 * Get the SSL configuration that is used on the connection.
164 * This returns NULL if no SSL is configured.
165 * Otherwise it returns the config of the first (highest) one that is
166 * either connected, in handshake or about to start
167 * (e.g. all filters below it are connected). If SSL filters are present,
168 * but neither can start operating, return the config of the lowest one
169 * that will first come into effect when connecting.
170 */
171struct ssl_config_data *Curl_ssl_get_config(struct Curl_easy *data,
172 int sockindex);
173
174/**
175 * True iff the underlying SSL implementation supports the option.
176 * Option is one of the defined SSLSUPP_* values.
177 * `data` maybe NULL for the features of the default implementation.
178 */
179bool Curl_ssl_supports(struct Curl_easy *data, int ssl_option);
180
181/**
182 * Get the internal ssl instance (like OpenSSL's SSL*) from the filter
183 * chain at `sockindex` of type specified by `info`.
184 * For `n` == 0, the first active (top down) instance is returned.
185 * 1 gives the second active, etc.
186 * NULL is returned when no active SSL filter is present.
187 */
188void *Curl_ssl_get_internals(struct Curl_easy *data, int sockindex,
189 CURLINFO info, int n);
190
191extern struct Curl_cftype Curl_cft_ssl;
192extern struct Curl_cftype Curl_cft_ssl_proxy;
193
194#else /* if not USE_SSL */
195
196/* When SSL support is not present, just define away these function calls */
197#define Curl_ssl_init() 1
198#define Curl_ssl_cleanup() Curl_nop_stmt
199#define Curl_ssl_close_all(x) Curl_nop_stmt
200#define Curl_ssl_set_engine(x,y) CURLE_NOT_BUILT_IN
201#define Curl_ssl_set_engine_default(x) CURLE_NOT_BUILT_IN
202#define Curl_ssl_engines_list(x) NULL
203#define Curl_ssl_initsessions(x,y) CURLE_OK
204#define Curl_ssl_free_certinfo(x) Curl_nop_stmt
205#define Curl_ssl_kill_session(x) Curl_nop_stmt
206#define Curl_ssl_random(x,y,z) ((void)x, CURLE_NOT_BUILT_IN)
207#define Curl_ssl_cert_status_request() FALSE
208#define Curl_ssl_false_start(a) FALSE
209#define Curl_ssl_get_internals(a,b,c,d) NULL
210#define Curl_ssl_supports(a,b) FALSE
211#define Curl_ssl_cfilter_add(a,b,c) CURLE_NOT_BUILT_IN
212#define Curl_ssl_get_config(a,b) NULL
213#define Curl_ssl_cfilter_remove(a,b) CURLE_OK
214#endif
215
216#endif /* HEADER_CURL_VTLS_H */
217