1 #ifndef HEADER_CURL_SSLUSE_H 2 #define HEADER_CURL_SSLUSE_H 3 /*************************************************************************** 4 * _ _ ____ _ 5 * Project ___| | | | _ \| | 6 * / __| | | | |_) | | 7 * | (__| |_| | _ <| |___ 8 * \___|\___/|_| \_\_____| 9 * 10 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. 11 * 12 * This software is licensed as described in the file COPYING, which 13 * you should have received as part of this distribution. The terms 14 * are also available at https://curl.se/docs/copyright.html. 15 * 16 * You may opt to use, copy, modify, merge, publish, distribute and/or sell 17 * copies of the Software, and permit persons to whom the Software is 18 * furnished to do so, under the terms of the COPYING file. 19 * 20 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY 21 * KIND, either express or implied. 22 * 23 * SPDX-License-Identifier: curl 24 * 25 ***************************************************************************/ 26 27 #include "curl_setup.h" 28 29 #ifdef USE_OPENSSL 30 /* 31 * This header should only be needed to get included by vtls.c, openssl.c 32 * and ngtcp2.c 33 */ 34 #include <openssl/ossl_typ.h> 35 #include <openssl/ssl.h> 36 37 #include "urldata.h" 38 39 /* Struct to hold a Curl OpenSSL instance */ 40 struct ossl_ctx { 41 /* these ones requires specific SSL-types */ 42 SSL_CTX* ssl_ctx; 43 SSL* ssl; 44 X509* server_cert; 45 BIO_METHOD *bio_method; 46 CURLcode io_result; /* result of last BIO cfilter operation */ 47 #ifndef HAVE_KEYLOG_CALLBACK 48 /* Set to true once a valid keylog entry has been created to avoid dupes. 49 This is a bool and not a bitfield because it is passed by address. */ 50 bool keylog_done; 51 #endif 52 BIT(x509_store_setup); /* x509 store has been set up */ 53 BIT(reused_session); /* session-ID was reused for this */ 54 }; 55 56 typedef CURLcode Curl_ossl_ctx_setup_cb(struct Curl_cfilter *cf, 57 struct Curl_easy *data, 58 void *user_data); 59 60 typedef int Curl_ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid); 61 62 CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx, 63 struct Curl_cfilter *cf, 64 struct Curl_easy *data, 65 struct ssl_peer *peer, 66 int transport, /* TCP or QUIC */ 67 const unsigned char *alpn, size_t alpn_len, 68 Curl_ossl_ctx_setup_cb *cb_setup, 69 void *cb_user_data, 70 Curl_ossl_new_session_cb *cb_new_session, 71 void *ssl_user_data); 72 73 #if (OPENSSL_VERSION_NUMBER < 0x30000000L) 74 #define SSL_get1_peer_certificate SSL_get_peer_certificate 75 #endif 76 77 extern const struct Curl_ssl Curl_ssl_openssl; 78 79 /** 80 * Setup the OpenSSL X509_STORE in `ssl_ctx` for the cfilter `cf` and 81 * easy handle `data`. Will allow reuse of a shared cache if suitable 82 * and configured. 83 */ 84 CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf, 85 struct Curl_easy *data, 86 SSL_CTX *ssl_ctx); 87 88 CURLcode Curl_ossl_ctx_configure(struct Curl_cfilter *cf, 89 struct Curl_easy *data, 90 SSL_CTX *ssl_ctx); 91 92 /* 93 * Add a new session to the cache. Takes ownership of the session. 94 */ 95 CURLcode Curl_ossl_add_session(struct Curl_cfilter *cf, 96 struct Curl_easy *data, 97 const struct ssl_peer *peer, 98 SSL_SESSION *ssl_sessionid); 99 100 /* 101 * Get the server cert, verify it and show it, etc., only call failf() if 102 * ssl config verifypeer or -host is set. Otherwise all this is for 103 * informational purposes only! 104 */ 105 CURLcode Curl_oss_check_peer_cert(struct Curl_cfilter *cf, 106 struct Curl_easy *data, 107 struct ossl_ctx *octx, 108 struct ssl_peer *peer); 109 110 #endif /* USE_OPENSSL */ 111 #endif /* HEADER_CURL_SSLUSE_H */ 112
