1 #ifndef HEADER_CURL_VTLS_H 2 #define HEADER_CURL_VTLS_H 3 /*************************************************************************** 4 * _ _ ____ _ 5 * Project ___| | | | _ \| | 6 * / __| | | | |_) | | 7 * | (__| |_| | _ <| |___ 8 * \___|\___/|_| \_\_____| 9 * 10 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. 11 * 12 * This software is licensed as described in the file COPYING, which 13 * you should have received as part of this distribution. The terms 14 * are also available at https://curl.se/docs/copyright.html. 15 * 16 * You may opt to use, copy, modify, merge, publish, distribute and/or sell 17 * copies of the Software, and permit persons to whom the Software is 18 * furnished to do so, under the terms of the COPYING file. 19 * 20 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY 21 * KIND, either express or implied. 22 * 23 * SPDX-License-Identifier: curl 24 * 25 ***************************************************************************/ 26 #include "curl_setup.h" 27 28 struct connectdata; 29 struct ssl_config_data; 30 struct ssl_primary_config; 31 struct Curl_cfilter; 32 struct Curl_easy; 33 struct dynbuf; 34 35 #define SSLSUPP_CA_PATH (1<<0) /* supports CAPATH */ 36 #define SSLSUPP_CERTINFO (1<<1) /* supports CURLOPT_CERTINFO */ 37 #define SSLSUPP_PINNEDPUBKEY (1<<2) /* supports CURLOPT_PINNEDPUBLICKEY */ 38 #define SSLSUPP_SSL_CTX (1<<3) /* supports CURLOPT_SSL_CTX */ 39 #define SSLSUPP_HTTPS_PROXY (1<<4) /* supports access via HTTPS proxies */ 40 #define SSLSUPP_TLS13_CIPHERSUITES (1<<5) /* supports TLS 1.3 ciphersuites */ 41 #define SSLSUPP_CAINFO_BLOB (1<<6) 42 #define SSLSUPP_ECH (1<<7) 43 #define SSLSUPP_CA_CACHE (1<<8) 44 #define SSLSUPP_CIPHER_LIST (1<<9) /* supports TLS 1.0-1.2 ciphersuites */ 45 46 #ifdef USE_ECH 47 # include "curl_base64.h" 48 # define ECH_ENABLED(__data__) \ 49 (__data__->set.tls_ech && \ 50 !(__data__->set.tls_ech & CURLECH_DISABLE)\ 51 ) 52 #endif /* USE_ECH */ 53 54 #define ALPN_ACCEPTED "ALPN: server accepted " 55 56 #define VTLS_INFOF_NO_ALPN \ 57 "ALPN: server did not agree on a protocol. Uses default." 58 #define VTLS_INFOF_ALPN_OFFER_1STR \ 59 "ALPN: curl offers %s" 60 #define VTLS_INFOF_ALPN_ACCEPTED \ 61 ALPN_ACCEPTED "%.*s" 62 63 #define VTLS_INFOF_NO_ALPN_DEFERRED \ 64 "ALPN: deferred handshake for early data without specific protocol." 65 #define VTLS_INFOF_ALPN_DEFERRED \ 66 "ALPN: deferred handshake for early data using '%.*s'." 67 68 /* IETF defined version numbers used in TLS protocol negotiation */ 69 #define CURL_IETF_PROTO_UNKNOWN 0x0 70 #define CURL_IETF_PROTO_SSL3 0x0300 71 #define CURL_IETF_PROTO_TLS1 0x0301 72 #define CURL_IETF_PROTO_TLS1_1 0x0302 73 #define CURL_IETF_PROTO_TLS1_2 0x0303 74 #define CURL_IETF_PROTO_TLS1_3 0x0304 75 #define CURL_IETF_PROTO_DTLS1 0xFEFF 76 #define CURL_IETF_PROTO_DTLS1_2 0xFEFD 77 78 typedef enum { 79 CURL_SSL_PEER_DNS, 80 CURL_SSL_PEER_IPV4, 81 CURL_SSL_PEER_IPV6 82 } ssl_peer_type; 83 84 struct ssl_peer { 85 char *hostname; /* hostname for verification */ 86 char *dispname; /* display version of hostname */ 87 char *sni; /* SNI version of hostname or NULL if not usable */ 88 char *scache_key; /* for lookups in session cache */ 89 ssl_peer_type type; /* type of the peer information */ 90 int port; /* port we are talking to */ 91 int transport; /* one of TRNSPRT_* defines */ 92 }; 93 94 CURLsslset Curl_init_sslset_nolock(curl_sslbackend id, const char *name, 95 const curl_ssl_backend ***avail); 96 97 #ifndef MAX_PINNED_PUBKEY_SIZE 98 #define MAX_PINNED_PUBKEY_SIZE 1048576 /* 1MB */ 99 #endif 100 101 #ifndef CURL_SHA256_DIGEST_LENGTH 102 #define CURL_SHA256_DIGEST_LENGTH 32 /* fixed size */ 103 #endif 104 105 curl_sslbackend Curl_ssl_backend(void); 106 107 /** 108 * Init ssl config for a new easy handle. 109 */ 110 void Curl_ssl_easy_config_init(struct Curl_easy *data); 111 112 /** 113 * Init the `data->set.ssl` and `data->set.proxy_ssl` for 114 * connection matching use. 115 */ 116 CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data); 117 118 /** 119 * Init SSL configs (main + proxy) for a new connection from the easy handle. 120 */ 121 CURLcode Curl_ssl_conn_config_init(struct Curl_easy *data, 122 struct connectdata *conn); 123 124 /** 125 * Free allocated resources in SSL configs (main + proxy) for 126 * the given connection. 127 */ 128 void Curl_ssl_conn_config_cleanup(struct connectdata *conn); 129 130 /** 131 * Return TRUE iff SSL configuration from `data` is functionally the 132 * same as the one on `candidate`. 133 * @param proxy match the proxy SSL config or the main one 134 */ 135 bool Curl_ssl_conn_config_match(struct Curl_easy *data, 136 struct connectdata *candidate, 137 bool proxy); 138 139 /* Update certain connection SSL config flags after they have 140 * been changed on the easy handle. Will work for `verifypeer`, 141 * `verifyhost` and `verifystatus`. */ 142 void Curl_ssl_conn_config_update(struct Curl_easy *data, bool for_proxy); 143 144 /** 145 * Init SSL peer information for filter. Can be called repeatedly. 146 */ 147 CURLcode Curl_ssl_peer_init(struct ssl_peer *peer, 148 struct Curl_cfilter *cf, 149 const char *tls_id, 150 int transport); 151 /** 152 * Free all allocated data and reset peer information. 153 */ 154 void Curl_ssl_peer_cleanup(struct ssl_peer *peer); 155 156 #ifdef USE_SSL 157 int Curl_ssl_init(void); 158 void Curl_ssl_cleanup(void); 159 /* tell the SSL stuff to close down all open information regarding 160 connections (and thus session ID caching etc) */ 161 void Curl_ssl_close_all(struct Curl_easy *data); 162 CURLcode Curl_ssl_set_engine(struct Curl_easy *data, const char *engine); 163 /* Sets engine as default for all SSL operations */ 164 CURLcode Curl_ssl_set_engine_default(struct Curl_easy *data); 165 struct curl_slist *Curl_ssl_engines_list(struct Curl_easy *data); 166 167 void Curl_ssl_version(char *buffer, size_t size); 168 169 /* Certificate information list handling. */ 170 #define CURL_X509_STR_MAX 100000 171 172 void Curl_ssl_free_certinfo(struct Curl_easy *data); 173 CURLcode Curl_ssl_init_certinfo(struct Curl_easy *data, int num); 174 CURLcode Curl_ssl_push_certinfo_len(struct Curl_easy *data, int certnum, 175 const char *label, const char *value, 176 size_t valuelen); 177 CURLcode Curl_ssl_push_certinfo(struct Curl_easy *data, int certnum, 178 const char *label, const char *value); 179 180 /* Functions to be used by SSL library adaptation functions */ 181 182 /* get N random bytes into the buffer */ 183 CURLcode Curl_ssl_random(struct Curl_easy *data, unsigned char *buffer, 184 size_t length); 185 /* Check pinned public key. */ 186 CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data, 187 const char *pinnedpubkey, 188 const unsigned char *pubkey, size_t pubkeylen); 189 190 bool Curl_ssl_cert_status_request(void); 191 192 bool Curl_ssl_false_start(void); 193 194 /* The maximum size of the SSL channel binding is 85 bytes, as defined in 195 * RFC 5929, Section 4.1. The 'tls-server-end-point:' prefix is 21 bytes long, 196 * and SHA-512 is the longest supported hash algorithm, with a digest length of 197 * 64 bytes. 198 * The maximum size of the channel binding is therefore 21 + 64 = 85 bytes. 199 */ 200 #define SSL_CB_MAX_SIZE 85 201 202 /* Return the tls-server-end-point channel binding, including the 203 * 'tls-server-end-point:' prefix. 204 * If successful, the data is written to the dynbuf, and CURLE_OK is returned. 205 * The dynbuf MUST HAVE a minimum toobig size of SSL_CB_MAX_SIZE. 206 * If the dynbuf is too small, CURLE_OUT_OF_MEMORY is returned. 207 * If channel binding is not supported, binding stays empty and CURLE_OK is 208 * returned. 209 */ 210 CURLcode Curl_ssl_get_channel_binding(struct Curl_easy *data, int sockindex, 211 struct dynbuf *binding); 212 213 #define SSL_SHUTDOWN_TIMEOUT 10000 /* ms */ 214 215 CURLcode Curl_ssl_cfilter_add(struct Curl_easy *data, 216 struct connectdata *conn, 217 int sockindex); 218 219 CURLcode Curl_cf_ssl_insert_after(struct Curl_cfilter *cf_at, 220 struct Curl_easy *data); 221 222 CURLcode Curl_ssl_cfilter_remove(struct Curl_easy *data, 223 int sockindex, bool send_shutdown); 224 225 #ifndef CURL_DISABLE_PROXY 226 CURLcode Curl_cf_ssl_proxy_insert_after(struct Curl_cfilter *cf_at, 227 struct Curl_easy *data); 228 #endif /* !CURL_DISABLE_PROXY */ 229 230 /** 231 * True iff the underlying SSL implementation supports the option. 232 * Option is one of the defined SSLSUPP_* values. 233 * `data` maybe NULL for the features of the default implementation. 234 */ 235 bool Curl_ssl_supports(struct Curl_easy *data, unsigned int ssl_option); 236 237 /** 238 * Get the internal ssl instance (like OpenSSL's SSL*) from the filter 239 * chain at `sockindex` of type specified by `info`. 240 * For `n` == 0, the first active (top down) instance is returned. 241 * 1 gives the second active, etc. 242 * NULL is returned when no active SSL filter is present. 243 */ 244 void *Curl_ssl_get_internals(struct Curl_easy *data, int sockindex, 245 CURLINFO info, int n); 246 247 /** 248 * Get the ssl_config_data in `data` that is relevant for cfilter `cf`. 249 */ 250 struct ssl_config_data *Curl_ssl_cf_get_config(struct Curl_cfilter *cf, 251 struct Curl_easy *data); 252 253 /** 254 * Get the primary config relevant for the filter from its connection. 255 */ 256 struct ssl_primary_config * 257 Curl_ssl_cf_get_primary_config(struct Curl_cfilter *cf); 258 259 extern struct Curl_cftype Curl_cft_ssl; 260 #ifndef CURL_DISABLE_PROXY 261 extern struct Curl_cftype Curl_cft_ssl_proxy; 262 #endif 263 264 #else /* if not USE_SSL */ 265 266 /* When SSL support is not present, just define away these function calls */ 267 #define Curl_ssl_init() 1 268 #define Curl_ssl_cleanup() Curl_nop_stmt 269 #define Curl_ssl_close_all(x) Curl_nop_stmt 270 #define Curl_ssl_set_engine(x,y) CURLE_NOT_BUILT_IN 271 #define Curl_ssl_set_engine_default(x) CURLE_NOT_BUILT_IN 272 #define Curl_ssl_engines_list(x) NULL 273 #define Curl_ssl_free_certinfo(x) Curl_nop_stmt 274 #define Curl_ssl_random(x,y,z) ((void)x, CURLE_NOT_BUILT_IN) 275 #define Curl_ssl_cert_status_request() FALSE 276 #define Curl_ssl_false_start() FALSE 277 #define Curl_ssl_get_internals(a,b,c,d) NULL 278 #define Curl_ssl_supports(a,b) FALSE 279 #define Curl_ssl_cfilter_add(a,b,c) CURLE_NOT_BUILT_IN 280 #define Curl_ssl_cfilter_remove(a,b,c) CURLE_OK 281 #define Curl_ssl_cf_get_config(a,b) NULL 282 #define Curl_ssl_cf_get_primary_config(a) NULL 283 #endif 284 285 #endif /* HEADER_CURL_VTLS_H */ 286
