1#ifndef HEADER_CURL_VTLS_INT_H
2#define HEADER_CURL_VTLS_INT_H
3/***************************************************************************
4 * _ _ ____ _
5 * Project ___| | | | _ \| |
6 * / __| | | | |_) | |
7 * | (__| |_| | _ <| |___
8 * \___|\___/|_| \_\_____|
9 *
10 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
11 *
12 * This software is licensed as described in the file COPYING, which
13 * you should have received as part of this distribution. The terms
14 * are also available at https://curl.se/docs/copyright.html.
15 *
16 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
17 * copies of the Software, and permit persons to whom the Software is
18 * furnished to do so, under the terms of the COPYING file.
19 *
20 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
21 * KIND, either express or implied.
22 *
23 * SPDX-License-Identifier: curl
24 *
25 ***************************************************************************/
26#include "curl_setup.h"
27#include "cfilters.h"
28#include "urldata.h"
29
30#ifdef USE_SSL
31
32/* see https://www.iana.org/assignments/tls-extensiontype-values/ */
33#define ALPN_HTTP_1_1_LENGTH 8
34#define ALPN_HTTP_1_1 "http/1.1"
35#define ALPN_HTTP_1_0_LENGTH 8
36#define ALPN_HTTP_1_0 "http/1.0"
37#define ALPN_H2_LENGTH 2
38#define ALPN_H2 "h2"
39#define ALPN_H3_LENGTH 2
40#define ALPN_H3 "h3"
41
42/* conservative sizes on the ALPN entries and count we are handling,
43 * we can increase these if we ever feel the need or have to accommodate
44 * ALPN strings from the "outside". */
45#define ALPN_NAME_MAX 10
46#define ALPN_ENTRIES_MAX 3
47#define ALPN_PROTO_BUF_MAX (ALPN_ENTRIES_MAX * (ALPN_NAME_MAX + 1))
48
49struct alpn_spec {
50 const char entries[ALPN_ENTRIES_MAX][ALPN_NAME_MAX];
51 size_t count; /* number of entries */
52};
53
54struct alpn_proto_buf {
55 unsigned char data[ALPN_PROTO_BUF_MAX];
56 int len;
57};
58
59CURLcode Curl_alpn_to_proto_buf(struct alpn_proto_buf *buf,
60 const struct alpn_spec *spec);
61CURLcode Curl_alpn_to_proto_str(struct alpn_proto_buf *buf,
62 const struct alpn_spec *spec);
63
64CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
65 struct Curl_easy *data,
66 const unsigned char *proto,
67 size_t proto_len);
68
69/* Information in each SSL cfilter context: cf->ctx */
70struct ssl_connect_data {
71 ssl_connection_state state;
72 ssl_connect_state connecting_state;
73 char *hostname; /* hostname for verification */
74 char *dispname; /* display version of hostname */
75 const struct alpn_spec *alpn; /* ALPN to use or NULL for none */
76 void *backend; /* vtls backend specific props */
77 struct cf_call_data call_data; /* data handle used in current call */
78 struct curltime handshake_done; /* time when handshake finished */
79 int port; /* remote port at origin */
80 BIT(use_alpn); /* if ALPN shall be used in handshake */
81};
82
83
84#undef CF_CTX_CALL_DATA
85#define CF_CTX_CALL_DATA(cf) \
86 ((struct ssl_connect_data *)(cf)->ctx)->call_data
87
88
89/* Definitions for SSL Implementations */
90
91struct Curl_ssl {
92 /*
93 * This *must* be the first entry to allow returning the list of available
94 * backends in curl_global_sslset().
95 */
96 curl_ssl_backend info;
97 unsigned int supports; /* bitfield, see above */
98 size_t sizeof_ssl_backend_data;
99
100 int (*init)(void);
101 void (*cleanup)(void);
102
103 size_t (*version)(char *buffer, size_t size);
104 int (*check_cxn)(struct Curl_cfilter *cf, struct Curl_easy *data);
105 int (*shut_down)(struct Curl_cfilter *cf,
106 struct Curl_easy *data);
107 bool (*data_pending)(struct Curl_cfilter *cf,
108 const struct Curl_easy *data);
109
110 /* return 0 if a find random is filled in */
111 CURLcode (*random)(struct Curl_easy *data, unsigned char *entropy,
112 size_t length);
113 bool (*cert_status_request)(void);
114
115 CURLcode (*connect_blocking)(struct Curl_cfilter *cf,
116 struct Curl_easy *data);
117 CURLcode (*connect_nonblocking)(struct Curl_cfilter *cf,
118 struct Curl_easy *data,
119 bool *done);
120
121 /* If the SSL backend wants to read or write on this connection during a
122 handshake, set socks[0] to the connection's FIRSTSOCKET, and return
123 a bitmap indicating read or write with GETSOCK_WRITESOCK(0) or
124 GETSOCK_READSOCK(0). Otherwise return GETSOCK_BLANK.
125 Mandatory. */
126 int (*get_select_socks)(struct Curl_cfilter *cf, struct Curl_easy *data,
127 curl_socket_t *socks);
128
129 void *(*get_internals)(struct ssl_connect_data *connssl, CURLINFO info);
130 void (*close)(struct Curl_cfilter *cf, struct Curl_easy *data);
131 void (*close_all)(struct Curl_easy *data);
132 void (*session_free)(void *ptr);
133
134 CURLcode (*set_engine)(struct Curl_easy *data, const char *engine);
135 CURLcode (*set_engine_default)(struct Curl_easy *data);
136 struct curl_slist *(*engines_list)(struct Curl_easy *data);
137
138 bool (*false_start)(void);
139 CURLcode (*sha256sum)(const unsigned char *input, size_t inputlen,
140 unsigned char *sha256sum, size_t sha256sumlen);
141
142 bool (*attach_data)(struct Curl_cfilter *cf, struct Curl_easy *data);
143 void (*detach_data)(struct Curl_cfilter *cf, struct Curl_easy *data);
144
145 void (*free_multi_ssl_backend_data)(struct multi_ssl_backend_data *mbackend);
146
147 ssize_t (*recv_plain)(struct Curl_cfilter *cf, struct Curl_easy *data,
148 char *buf, size_t len, CURLcode *code);
149 ssize_t (*send_plain)(struct Curl_cfilter *cf, struct Curl_easy *data,
150 const void *mem, size_t len, CURLcode *code);
151
152};
153
154extern const struct Curl_ssl *Curl_ssl;
155
156
157int Curl_none_init(void);
158void Curl_none_cleanup(void);
159int Curl_none_shutdown(struct Curl_cfilter *cf, struct Curl_easy *data);
160int Curl_none_check_cxn(struct Curl_cfilter *cf, struct Curl_easy *data);
161CURLcode Curl_none_random(struct Curl_easy *data, unsigned char *entropy,
162 size_t length);
163void Curl_none_close_all(struct Curl_easy *data);
164void Curl_none_session_free(void *ptr);
165bool Curl_none_data_pending(struct Curl_cfilter *cf,
166 const struct Curl_easy *data);
167bool Curl_none_cert_status_request(void);
168CURLcode Curl_none_set_engine(struct Curl_easy *data, const char *engine);
169CURLcode Curl_none_set_engine_default(struct Curl_easy *data);
170struct curl_slist *Curl_none_engines_list(struct Curl_easy *data);
171bool Curl_none_false_start(void);
172int Curl_ssl_get_select_socks(struct Curl_cfilter *cf, struct Curl_easy *data,
173 curl_socket_t *socks);
174
175/**
176 * Get the ssl_config_data in `data` that is relevant for cfilter `cf`.
177 */
178struct ssl_config_data *Curl_ssl_cf_get_config(struct Curl_cfilter *cf,
179 struct Curl_easy *data);
180
181/**
182 * Get the primary config relevant for the filter from its connection.
183 */
184struct ssl_primary_config *
185 Curl_ssl_cf_get_primary_config(struct Curl_cfilter *cf);
186
187/**
188 * Get the first SSL filter in the chain starting with `cf`, or NULL.
189 */
190struct Curl_cfilter *Curl_ssl_cf_get_ssl(struct Curl_cfilter *cf);
191
192/**
193 * Get the SSL filter below the given one or NULL if there is none.
194 */
195bool Curl_ssl_cf_is_proxy(struct Curl_cfilter *cf);
196
197/* extract a session ID
198 * Sessionid mutex must be locked (see Curl_ssl_sessionid_lock).
199 * Caller must make sure that the ownership of returned sessionid object
200 * is properly taken (e.g. its refcount is incremented
201 * under sessionid mutex).
202 */
203bool Curl_ssl_getsessionid(struct Curl_cfilter *cf,
204 struct Curl_easy *data,
205 void **ssl_sessionid,
206 size_t *idsize); /* set 0 if unknown */
207/* add a new session ID
208 * Sessionid mutex must be locked (see Curl_ssl_sessionid_lock).
209 * Caller must ensure that it has properly shared ownership of this sessionid
210 * object with cache (e.g. incrementing refcount on success)
211 */
212CURLcode Curl_ssl_addsessionid(struct Curl_cfilter *cf,
213 struct Curl_easy *data,
214 void *ssl_sessionid,
215 size_t idsize,
216 bool *added);
217
218#include "openssl.h" /* OpenSSL versions */
219#include "gtls.h" /* GnuTLS versions */
220#include "wolfssl.h" /* wolfSSL versions */
221#include "schannel.h" /* Schannel SSPI version */
222#include "sectransp.h" /* SecureTransport (Darwin) version */
223#include "mbedtls.h" /* mbedTLS versions */
224#include "bearssl.h" /* BearSSL versions */
225#include "rustls.h" /* rustls versions */
226
227#endif /* USE_SSL */
228
229#endif /* HEADER_CURL_VTLS_INT_H */
230