xref: /curl/lib/vtls/openssl.h (revision 6588a7f0)
1 #ifndef HEADER_CURL_SSLUSE_H
2 #define HEADER_CURL_SSLUSE_H
3 /***************************************************************************
4  *                                  _   _ ____  _
5  *  Project                     ___| | | |  _ \| |
6  *                             / __| | | | |_) | |
7  *                            | (__| |_| |  _ <| |___
8  *                             \___|\___/|_| \_\_____|
9  *
10  * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
11  *
12  * This software is licensed as described in the file COPYING, which
13  * you should have received as part of this distribution. The terms
14  * are also available at https://curl.se/docs/copyright.html.
15  *
16  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
17  * copies of the Software, and permit persons to whom the Software is
18  * furnished to do so, under the terms of the COPYING file.
19  *
20  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
21  * KIND, either express or implied.
22  *
23  * SPDX-License-Identifier: curl
24  *
25  ***************************************************************************/
26 
27 #include "curl_setup.h"
28 
29 #ifdef USE_OPENSSL
30 /*
31  * This header should only be needed to get included by vtls.c, openssl.c
32  * and ngtcp2.c
33  */
34 #include <openssl/ossl_typ.h>
35 #include <openssl/ssl.h>
36 
37 #include "urldata.h"
38 
39 /* Struct to hold a Curl OpenSSL instance */
40 struct ossl_ctx {
41   /* these ones requires specific SSL-types */
42   SSL_CTX* ssl_ctx;
43   SSL*     ssl;
44   X509*    server_cert;
45   BIO_METHOD *bio_method;
46   CURLcode io_result;       /* result of last BIO cfilter operation */
47 #ifndef HAVE_KEYLOG_CALLBACK
48   /* Set to true once a valid keylog entry has been created to avoid dupes.
49      This is a bool and not a bitfield because it is passed by address. */
50   bool keylog_done;
51 #endif
52   BIT(x509_store_setup);            /* x509 store has been set up */
53   BIT(reused_session);              /* session-ID was reused for this */
54 };
55 
56 typedef CURLcode Curl_ossl_ctx_setup_cb(struct Curl_cfilter *cf,
57                                         struct Curl_easy *data,
58                                         void *user_data);
59 
60 typedef int Curl_ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid);
61 
62 CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
63                             struct Curl_cfilter *cf,
64                             struct Curl_easy *data,
65                             struct ssl_peer *peer,
66                             int transport, /* TCP or QUIC */
67                             const unsigned char *alpn, size_t alpn_len,
68                             Curl_ossl_ctx_setup_cb *cb_setup,
69                             void *cb_user_data,
70                             Curl_ossl_new_session_cb *cb_new_session,
71                             void *ssl_user_data);
72 
73 #if (OPENSSL_VERSION_NUMBER < 0x30000000L)
74 #define SSL_get1_peer_certificate SSL_get_peer_certificate
75 #endif
76 
77 extern const struct Curl_ssl Curl_ssl_openssl;
78 
79 /**
80  * Setup the OpenSSL X509_STORE in `ssl_ctx` for the cfilter `cf` and
81  * easy handle `data`. Will allow reuse of a shared cache if suitable
82  * and configured.
83  */
84 CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf,
85                                    struct Curl_easy *data,
86                                    SSL_CTX *ssl_ctx);
87 
88 CURLcode Curl_ossl_ctx_configure(struct Curl_cfilter *cf,
89                                  struct Curl_easy *data,
90                                  SSL_CTX *ssl_ctx);
91 
92 /*
93  * Add a new session to the cache. Takes ownership of the session.
94  */
95 CURLcode Curl_ossl_add_session(struct Curl_cfilter *cf,
96                                struct Curl_easy *data,
97                                const struct ssl_peer *peer,
98                                SSL_SESSION *ssl_sessionid);
99 
100 /*
101  * Get the server cert, verify it and show it, etc., only call failf() if
102  * ssl config verifypeer or -host is set. Otherwise all this is for
103  * informational purposes only!
104  */
105 CURLcode Curl_oss_check_peer_cert(struct Curl_cfilter *cf,
106                                   struct Curl_easy *data,
107                                   struct ossl_ctx *octx,
108                                   struct ssl_peer *peer);
109 
110 #endif /* USE_OPENSSL */
111 #endif /* HEADER_CURL_SSLUSE_H */
112