moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-11-17 23:15:08 -05:00
Code Issues Releases Wiki Activity
7f4a9a9b2a
curl/lib/vtls/sectransp.c

3465 lines
124 KiB
C
Raw Normal View History

darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/***************************************************************************
* _ _ ____ _
* Project ___| | | | _ \| |
* / __| | | | |_) | |
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
lib: pass in 'struct Curl_easy *' to most functions ... in most cases instead of 'struct connectdata *' but in some cases in addition to. - We mostly operate on transfers and not connections. - We need the transfer handle to log, store data and more. Everything in libcurl is driven by a transfer (the CURL * in the public API). - This work clarifies and separates the transfers from the connections better. - We should avoid "conn->data". Since individual connections can be used by many transfers when multiplexing, making sure that conn->data points to the current and correct transfer at all times is difficult and has been notoriously error-prone over the years. The goal is to ultimately remove the conn->data pointer for this reason. Closes #6425
2021-01-08 11:58:15 -05:00
* Copyright (C) 2012 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
* Copyright (C) 2012 - 2017, Nick Zitzmann, <nickzman@gmail.com>.
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
curl.se: new home Closes #6172
2020-11-04 08:02:01 -05:00
* are also available at https://curl.se/docs/copyright.html.
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
*
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
* copies of the Software, and permit persons to whom the Software is
* furnished to do so, under the terms of the COPYING file.
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
* KIND, either express or implied.
*
***************************************************************************/
/*
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
* Source file for all iOS and macOS SecureTransport-specific code for the
vtls: Updated comments referencing sslgen.c and ssluse.c
2013-12-25 05:30:51 -05:00
* TLS/SSL layer. No code but vtls.c should ever call or use these functions.
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
*/
build: fix circular header inclusion with other packages This commit renames lib/setup.h to lib/curl_setup.h and renames lib/setup_once.h to lib/curl_setup_once.h. Removes the need and usage of a header inclusion guard foreign to libcurl. [1] Removes the need and presence of an alarming notice we carried in old setup_once.h [2] ---------------------------------------- 1 - lib/setup_once.h used __SETUP_ONCE_H macro as header inclusion guard up to commit ec691ca3 which changed this to HEADER_CURL_SETUP_ONCE_H, this single inclusion guard is enough to ensure that inclusion of lib/setup_once.h done from lib/setup.h is only done once. Additionally lib/setup.h has always used __SETUP_ONCE_H macro to protect inclusion of setup_once.h even after commit ec691ca3, this was to avoid a circular header inclusion triggered when building a c-ares enabled version with c-ares sources available which also has a setup_once.h header. Commit ec691ca3 exposes the real nature of __SETUP_ONCE_H usage in lib/setup.h, it is a header inclusion guard foreign to libcurl belonging to c-ares's setup_once.h The renaming this commit does, fixes the circular header inclusion, and as such removes the need and usage of a header inclusion guard foreign to libcurl. Macro __SETUP_ONCE_H no longer used in libcurl. 2 - Due to the circular interdependency of old lib/setup_once.h and the c-ares setup_once.h header, old file lib/setup_once.h has carried back from 2006 up to now days an alarming and prominent notice about the need of keeping libcurl's and c-ares's setup_once.h in sync. Given that this commit fixes the circular interdependency, the need and presence of mentioned notice is removed. All mentioned interdependencies come back from now old days when the c-ares project lived inside a curl subdirectory. This commit removes last traces of such fact.
2013-01-06 13:06:49 -05:00
#include "curl_setup.h"
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
internals: rename the SessionHandle struct to Curl_easy
2016-06-21 09:47:12 -04:00
#include "urldata.h" /* for the Curl_easy definition */
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
#include "curl_base64.h"
darwinssl: don't use strtok() The GetDarwinVersionNumber() function uses strtok, which is not thread-safe.
2014-08-05 02:58:49 -04:00
#include "strtok.h"
multi: provide Curl_multiuse_state to update information As soon as a TLS backend gets ALPN conformation about the specific HTTP version it can now set the multiplex situation for the "bundle" and trigger moving potentially queued up transfers to the CONNECT state.
2019-04-30 05:14:38 -04:00
#include "multiif.h"
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef USE_SECTRANSP
build: add our standard includes to curl_darwinssl.c and curl_multibyte.c
2012-06-27 11:13:16 -04:00
darwin: silence compiler warnings With a clang pragma and three type fixes Fixes #1722
2017-08-03 18:04:39 -04:00
#ifdef __clang__
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wtautological-pointer-compare"
darwinssl: fix compiler warning clang complains: vtls/darwinssl.c:40:8: error: extra tokens at end of #endif directive [-Werror,-Wextra-tokens] This breaks the darwinssl build on Travis. Fix it by making this token a comment. Closes https://github.com/curl/curl/pull/1734
2017-08-04 16:47:16 -04:00
#endif /* __clang__ */
darwin: silence compiler warnings With a clang pragma and three type fixes Fixes #1722
2017-08-03 18:04:39 -04:00
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
#include <limits.h>
#include <Security/Security.h>
vtls: encapsulate SSL backend-specific data So far, all of the SSL backends' private data has been declared as part of the ssl_connect_data struct, in one big #if .. #elif .. #endif block. This can only work as long as the SSL backend is a compile-time option, something we want to change in the next commits. Therefore, let's encapsulate the exact data needed by each SSL backend into a private struct, and let's avoid bleeding any SSL backend-specific information into urldata.h. This is also necessary to allow multiple SSL backends to be compiled in at the same time, as e.g. OpenSSL's and CyaSSL's headers cannot be included in the same .c file. To avoid too many malloc() calls, we simply append the private structs to the connectdata struct in allocate_conn(). This requires us to take extra care of alignment issues: struct fields often need to be aligned on certain boundaries e.g. 32-bit values need to be stored at addresses that divide evenly by 4 (= 32 bit / 8 bit-per-byte). We do that by assuming that no SSL backend's private data contains any fields that need to be aligned on boundaries larger than `long long` (typically 64-bit) would need. Under this assumption, we simply add a dummy field of type `long long` to the `struct connectdata` struct. This field will never be accessed but acts as a placeholder for the four instances of ssl_backend_data instead. the size of each ssl_backend_data struct is stored in the SSL backend-specific metadata, to allow allocate_conn() to know how much extra space to allocate, and how to initialize the ssl[sockindex]->backend and proxy_ssl[sockindex]->backend pointers. This would appear to be a little complicated at first, but is really necessary to encapsulate the private data of each SSL backend correctly. And we need to encapsulate thusly if we ever want to allow selecting CyaSSL and OpenSSL at runtime, as their headers cannot be included within the same .c file (there are just too many conflicting definitions and declarations for that). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-07-28 16:09:35 -04:00
/* For some reason, when building for iOS, the omnibus header above does
* not include SecureTransport.h as of iOS SDK 5.1. */
DarwinSSL: several adjustments - Renamed st_ function prefix to darwinssl_ - Renamed Curl_st_ function prefix to Curl_darwinssl_ - Moved the duplicated ssl_connect_done out of the #ifdef in lib/urldata.h - Fixed a teensy little bug that made non-blocking connection attempts block - Made it so that it builds cleanly against the iOS 5.1 SDK
2012-06-26 15:39:48 -04:00
#include <Security/SecureTransport.h>
#include <CoreFoundation/CoreFoundation.h>
DarwinSSL: allow using NTLM authentication Allow NTLM authentication when building using SecureTransport (Darwin) for SSL. This uses CommonCrypto, a cryptography library that ships with all versions of iOS and Mac OS X. It's like OpenSSL's libcrypto, except that it's missing a few less-common cyphers and doesn't have a big number data structure.
2012-06-27 05:57:31 -04:00
#include <CommonCrypto/CommonDigest.h>
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
/* The Security framework has changed greatly between iOS and different macOS
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
versions, and we will try to support as many of them as we can (back to
Leopard and iOS 5) by using macros and weak-linking.
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
In general, you want to build this using the most recent OS SDK, since some
features require curl to be built against the latest SDK. TLS 1.1 and 1.2
support, for instance, require the macOS 10.8 SDK or later. TLS 1.3
requires the macOS 10.13 or iOS 11 SDK or later. */
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
#if (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE))
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if MAC_OS_X_VERSION_MAX_ALLOWED < 1050
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#error "The Secure Transport back-end requires Leopard or later."
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* MAC_OS_X_VERSION_MAX_ALLOWED < 1050 */
#define CURL_BUILD_IOS 0
darwinssl: enable BEAST workaround on iOS 7 & later iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 and a CBC cipher, so we now always turn that on unless the user manually turns it off using CURLSSLOPT_ALLOW_BEAST. It appears Apple also added some new PSK ciphers, but no interface to use them yet, so we at least support printing them if we find them.
2013-09-19 18:28:54 -04:00
#define CURL_BUILD_IOS_7 0
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
#define CURL_BUILD_IOS_9 0
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
#define CURL_BUILD_IOS_11 0
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
#define CURL_BUILD_IOS_13 0
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#define CURL_BUILD_MAC 1
/* This is the maximum API level we are allowed to use when building: */
#define CURL_BUILD_MAC_10_5 MAC_OS_X_VERSION_MAX_ALLOWED >= 1050
#define CURL_BUILD_MAC_10_6 MAC_OS_X_VERSION_MAX_ALLOWED >= 1060
#define CURL_BUILD_MAC_10_7 MAC_OS_X_VERSION_MAX_ALLOWED >= 1070
#define CURL_BUILD_MAC_10_8 MAC_OS_X_VERSION_MAX_ALLOWED >= 1080
darwinssl: enable BEAST workaround on iOS 7 & later iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 and a CBC cipher, so we now always turn that on unless the user manually turns it off using CURLSSLOPT_ALLOW_BEAST. It appears Apple also added some new PSK ciphers, but no interface to use them yet, so we at least support printing them if we find them.
2013-09-19 18:28:54 -04:00
#define CURL_BUILD_MAC_10_9 MAC_OS_X_VERSION_MAX_ALLOWED >= 1090
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
#define CURL_BUILD_MAC_10_11 MAC_OS_X_VERSION_MAX_ALLOWED >= 101100
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
#define CURL_BUILD_MAC_10_13 MAC_OS_X_VERSION_MAX_ALLOWED >= 101300
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
#define CURL_BUILD_MAC_10_15 MAC_OS_X_VERSION_MAX_ALLOWED >= 101500
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
/* These macros mean "the following code is present to allow runtime backward
compatibility with at least this cat or earlier":
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
(You set this at build-time using the compiler command line option
vtls: Fix comment typo about macosx-version-min compiler flag Closes https://github.com/curl/curl/pull/4425
2019-09-25 21:24:01 -04:00
"-mmacosx-version-min.") */
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#define CURL_SUPPORT_MAC_10_5 MAC_OS_X_VERSION_MIN_REQUIRED <= 1050
#define CURL_SUPPORT_MAC_10_6 MAC_OS_X_VERSION_MIN_REQUIRED <= 1060
#define CURL_SUPPORT_MAC_10_7 MAC_OS_X_VERSION_MIN_REQUIRED <= 1070
#define CURL_SUPPORT_MAC_10_8 MAC_OS_X_VERSION_MIN_REQUIRED <= 1080
darwinssl: enable BEAST workaround on iOS 7 & later iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 and a CBC cipher, so we now always turn that on unless the user manually turns it off using CURLSSLOPT_ALLOW_BEAST. It appears Apple also added some new PSK ciphers, but no interface to use them yet, so we at least support printing them if we find them.
2013-09-19 18:28:54 -04:00
#define CURL_SUPPORT_MAC_10_9 MAC_OS_X_VERSION_MIN_REQUIRED <= 1090
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#elif TARGET_OS_EMBEDDED || TARGET_OS_IPHONE
#define CURL_BUILD_IOS 1
darwinssl: enable BEAST workaround on iOS 7 & later iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 and a CBC cipher, so we now always turn that on unless the user manually turns it off using CURLSSLOPT_ALLOW_BEAST. It appears Apple also added some new PSK ciphers, but no interface to use them yet, so we at least support printing them if we find them.
2013-09-19 18:28:54 -04:00
#define CURL_BUILD_IOS_7 __IPHONE_OS_VERSION_MAX_ALLOWED >= 70000
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
#define CURL_BUILD_IOS_9 __IPHONE_OS_VERSION_MAX_ALLOWED >= 90000
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
#define CURL_BUILD_IOS_11 __IPHONE_OS_VERSION_MAX_ALLOWED >= 110000
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
#define CURL_BUILD_IOS_13 __IPHONE_OS_VERSION_MAX_ALLOWED >= 130000
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#define CURL_BUILD_MAC 0
#define CURL_BUILD_MAC_10_5 0
#define CURL_BUILD_MAC_10_6 0
#define CURL_BUILD_MAC_10_7 0
#define CURL_BUILD_MAC_10_8 0
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
#define CURL_BUILD_MAC_10_9 0
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
#define CURL_BUILD_MAC_10_11 0
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
#define CURL_BUILD_MAC_10_13 0
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
#define CURL_BUILD_MAC_10_15 0
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#define CURL_SUPPORT_MAC_10_5 0
#define CURL_SUPPORT_MAC_10_6 0
#define CURL_SUPPORT_MAC_10_7 0
#define CURL_SUPPORT_MAC_10_8 0
darwinssl: detect possible future removal of SSLv3 from the framework If Apple ever drops SSLv3 support from the Security framework, we'll fail with an error if the user insists on using SSLv3.
2014-10-24 19:59:13 -04:00
#define CURL_SUPPORT_MAC_10_9 0
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#else
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#error "The Secure Transport back-end requires iOS or macOS."
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE)) */
#if CURL_BUILD_MAC
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
#include <sys/sysctl.h>
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC */
build: add our standard includes to curl_darwinssl.c and curl_multibyte.c
2012-06-27 11:13:16 -04:00
Revert changes relative to lib/*.[ch] recent renaming This reverts renaming and usage of lib/*.h header files done 28-12-2012, reverting 2 commits: f871de0... build: make use of 76 lib/*.h renamed files ffd8e12... build: rename 76 lib/*.h files This also reverts removal of redundant include guard (redundant thanks to changes in above commits) done 2-12-2013, reverting 1 commit: c087374... curl_setup.h: remove redundant include guard This also reverts renaming and usage of lib/*.c source files done 3-12-2013, reverting 3 commits: 13606bb... build: make use of 93 lib/*.c renamed files 5b6e792... build: rename 93 lib/*.c files 7d83dff... build: commit 13606bbfde follow-up 1 Start of related discussion thread: http://curl.haxx.se/mail/lib-2013-01/0012.html Asking for confirmation on pushing this revertion commit: http://curl.haxx.se/mail/lib-2013-01/0048.html Confirmation summary: http://curl.haxx.se/mail/lib-2013-01/0079.html NOTICE: The list of 2 files that have been modified by other intermixed commits, while renamed, and also by at least one of the 6 commits this one reverts follows below. These 2 files will exhibit a hole in history unless git's '--follow' option is used when viewing logs. lib/curl_imap.h lib/curl_smtp.h
2013-01-03 20:50:28 -05:00
#include "urldata.h"
#include "sendf.h"
#include "inet_pton.h"
#include "connect.h"
#include "select.h"
vtls: Fixed up include of vtls.h
2013-12-25 05:20:39 -05:00
#include "vtls.h"
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#include "sectransp.h"
vtls: use curl_printf.h all over No need to use _MPRINTF_REPLACE internally.
2015-03-03 17:17:43 -05:00
#include "curl_printf.h"
darwinssl: Fix realloc memleak The reallocation was using the input pointer for the return value, which leads to a memory leak on reallication failure. Fix by instead use the safe internal API call Curl_saferealloc(). Closes #3005 Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Nick Zitzmann <nickzman@gmail.com>
2018-09-18 03:06:07 -04:00
#include "strdup.h"
build: add our standard includes to curl_darwinssl.c and curl_multibyte.c
2012-06-27 11:13:16 -04:00
#include "curl_memory.h"
/* The last #include file should be: */
Revert changes relative to lib/*.[ch] recent renaming This reverts renaming and usage of lib/*.h header files done 28-12-2012, reverting 2 commits: f871de0... build: make use of 76 lib/*.h renamed files ffd8e12... build: rename 76 lib/*.h files This also reverts removal of redundant include guard (redundant thanks to changes in above commits) done 2-12-2013, reverting 1 commit: c087374... curl_setup.h: remove redundant include guard This also reverts renaming and usage of lib/*.c source files done 3-12-2013, reverting 3 commits: 13606bb... build: make use of 93 lib/*.c renamed files 5b6e792... build: rename 93 lib/*.c files 7d83dff... build: commit 13606bbfde follow-up 1 Start of related discussion thread: http://curl.haxx.se/mail/lib-2013-01/0012.html Asking for confirmation on pushing this revertion commit: http://curl.haxx.se/mail/lib-2013-01/0048.html Confirmation summary: http://curl.haxx.se/mail/lib-2013-01/0079.html NOTICE: The list of 2 files that have been modified by other intermixed commits, while renamed, and also by at least one of the 6 commits this one reverts follows below. These 2 files will exhibit a hole in history unless git's '--follow' option is used when viewing logs. lib/curl_imap.h lib/curl_smtp.h
2013-01-03 20:50:28 -05:00
#include "memdebug.h"
build: add our standard includes to curl_darwinssl.c and curl_multibyte.c
2012-06-27 11:13:16 -04:00
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* From MacTypes.h (which we can't include because it isn't present in iOS: */
#define ioErr -36
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
#define paramErr -50
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
vtls: encapsulate SSL backend-specific data So far, all of the SSL backends' private data has been declared as part of the ssl_connect_data struct, in one big #if .. #elif .. #endif block. This can only work as long as the SSL backend is a compile-time option, something we want to change in the next commits. Therefore, let's encapsulate the exact data needed by each SSL backend into a private struct, and let's avoid bleeding any SSL backend-specific information into urldata.h. This is also necessary to allow multiple SSL backends to be compiled in at the same time, as e.g. OpenSSL's and CyaSSL's headers cannot be included in the same .c file. To avoid too many malloc() calls, we simply append the private structs to the connectdata struct in allocate_conn(). This requires us to take extra care of alignment issues: struct fields often need to be aligned on certain boundaries e.g. 32-bit values need to be stored at addresses that divide evenly by 4 (= 32 bit / 8 bit-per-byte). We do that by assuming that no SSL backend's private data contains any fields that need to be aligned on boundaries larger than `long long` (typically 64-bit) would need. Under this assumption, we simply add a dummy field of type `long long` to the `struct connectdata` struct. This field will never be accessed but acts as a placeholder for the four instances of ssl_backend_data instead. the size of each ssl_backend_data struct is stored in the SSL backend-specific metadata, to allow allocate_conn() to know how much extra space to allocate, and how to initialize the ssl[sockindex]->backend and proxy_ssl[sockindex]->backend pointers. This would appear to be a little complicated at first, but is really necessary to encapsulate the private data of each SSL backend correctly. And we need to encapsulate thusly if we ever want to allow selecting CyaSSL and OpenSSL at runtime, as their headers cannot be included within the same .c file (there are just too many conflicting definitions and declarations for that). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-07-28 16:09:35 -04:00
struct ssl_backend_data {
SSLContextRef ssl_ctx;
curl_socket_t ssl_sockfd;
bool ssl_direction; /* true if writing, false if reading */
size_t ssl_write_buffered_length;
};
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
struct st_cipher {
const char *name; /* Cipher suite IANA name. It starts with "TLS_" prefix */
const char *alias_name; /* Alias name is the same as OpenSSL cipher name */
SSLCipherSuite num; /* Cipher suite code/number defined in IANA registry */
bool weak; /* Flag to mark cipher as weak based on previous implementation
of Secure Transport back-end by CURL */
};
/* Macro to initialize st_cipher data structure: stringify id to name, cipher
number/id, 'weak' suite flag
*/
#define CIPHER_DEF(num, alias, weak) \
{ #num, alias, num, weak }
/*
Macro to initialize st_cipher data structure with name, code (IANA cipher
number/id value), and 'weak' suite flag. The first 28 cipher suite numbers
have the same IANA code for both SSL and TLS standards: numbers 0x0000 to
0x001B. They have different names though. The first 4 letters of the cipher
suite name are the protocol name: "SSL_" or "TLS_", rest of the IANA name is
the same for both SSL and TLS cipher suite name.
The second part of the problem is that macOS/iOS SDKs don't define all TLS
codes but only 12 of them. The SDK defines all SSL codes though, i.e. SSL_NUM
constant is always defined for those 28 ciphers while TLS_NUM is defined only
for 12 of the first 28 ciphers. Those 12 TLS cipher codes match to
corresponding SSL enum value and represent the same cipher suite. Therefore
we'll use the SSL enum value for those cipher suites because it is defined
for all 28 of them.
We make internal data consistent and based on TLS names, i.e. all st_cipher
item names start with the "TLS_" prefix.
Summarizing all the above, those 28 first ciphers are presented in our table
with both TLS and SSL names. Their cipher numbers are assigned based on the
SDK enum value for the SSL cipher, which matches to IANA TLS number.
*/
#define CIPHER_DEF_SSLTLS(num_wo_prefix, alias, weak) \
{ "TLS_" #num_wo_prefix, alias, SSL_##num_wo_prefix, weak }
/*
Cipher suites were marked as weak based on the following:
RC4 encryption - rfc7465, the document contains a list of deprecated ciphers.
Marked in the code below as weak.
RC2 encryption - many mentions, was found vulnerable to a relatively easy
attack https://link.springer.com/chapter/10.1007%2F3-540-69710-1_14
Marked in the code below as weak.
DES and IDEA encryption - rfc5469, has a list of deprecated ciphers.
Marked in the code below as weak.
Anonymous Diffie-Hellman authentication and anonymous elliptic curve
Diffie-Hellman - vulnerable to a man-in-the-middle attack. Deprecated by
RFC 4346 aka TLS 1.1 (section A.5, page 60)
Null bulk encryption suites - not encrypted communication
Export ciphers, i.e. ciphers with restrictions to be used outside the US for
software exported to some countries, they were excluded from TLS 1.1
version. More precisely, they were noted as ciphers which MUST NOT be
negotiated in RFC 4346 aka TLS 1.1 (section A.5, pages 60 and 61).
All of those filters were considered weak because they contain a weak
algorithm like DES, RC2 or RC4, and already considered weak by other
criteria.
3DES - NIST deprecated it and is going to retire it by 2023
https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA
OpenSSL https://www.openssl.org/blog/blog/2016/08/24/sweet32/ also
deprecated those ciphers. Some other libraries also consider it
vulnerable or at least not strong enough.
CBC ciphers are vulnerable with SSL3.0 and TLS1.0:
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance
/118518-technote-esa-00.html
We don't take care of this issue because it is resolved by later TLS
versions and for us, it requires more complicated checks, we need to
check a protocol version also. Vulnerability doesn't look very critical
and we do not filter out those cipher suites.
*/
#define CIPHER_WEAK_NOT_ENCRYPTED TRUE
#define CIPHER_WEAK_RC_ENCRYPTION TRUE
#define CIPHER_WEAK_DES_ENCRYPTION TRUE
#define CIPHER_WEAK_IDEA_ENCRYPTION TRUE
#define CIPHER_WEAK_ANON_AUTH TRUE
#define CIPHER_WEAK_3DES_ENCRYPTION TRUE
#define CIPHER_STRONG_ENOUGH FALSE
/* Please do not change the order of the first ciphers available for SSL.
Do not insert and do not delete any of them. Code below
depends on their order and continuity.
If you add a new cipher, please maintain order by number, i.e.
insert in between existing items to appropriate place based on
cipher suite IANA number
*/
const static struct st_cipher ciphertable[] = {
/* SSL version 3.0 and initial TLS 1.0 cipher suites.
Defined since SDK 10.2.8 */
CIPHER_DEF_SSLTLS(NULL_WITH_NULL_NULL, /* 0x0000 */
NULL,
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF_SSLTLS(RSA_WITH_NULL_MD5, /* 0x0001 */
"NULL-MD5",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF_SSLTLS(RSA_WITH_NULL_SHA, /* 0x0002 */
"NULL-SHA",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF_SSLTLS(RSA_EXPORT_WITH_RC4_40_MD5, /* 0x0003 */
"EXP-RC4-MD5",
CIPHER_WEAK_RC_ENCRYPTION),
CIPHER_DEF_SSLTLS(RSA_WITH_RC4_128_MD5, /* 0x0004 */
"RC4-MD5",
CIPHER_WEAK_RC_ENCRYPTION),
CIPHER_DEF_SSLTLS(RSA_WITH_RC4_128_SHA, /* 0x0005 */
"RC4-SHA",
CIPHER_WEAK_RC_ENCRYPTION),
CIPHER_DEF_SSLTLS(RSA_EXPORT_WITH_RC2_CBC_40_MD5, /* 0x0006 */
"EXP-RC2-CBC-MD5",
CIPHER_WEAK_RC_ENCRYPTION),
CIPHER_DEF_SSLTLS(RSA_WITH_IDEA_CBC_SHA, /* 0x0007 */
"IDEA-CBC-SHA",
CIPHER_WEAK_IDEA_ENCRYPTION),
CIPHER_DEF_SSLTLS(RSA_EXPORT_WITH_DES40_CBC_SHA, /* 0x0008 */
"EXP-DES-CBC-SHA",
CIPHER_WEAK_DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(RSA_WITH_DES_CBC_SHA, /* 0x0009 */
"DES-CBC-SHA",
CIPHER_WEAK_DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(RSA_WITH_3DES_EDE_CBC_SHA, /* 0x000A */
"DES-CBC3-SHA",
CIPHER_WEAK_3DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(DH_DSS_EXPORT_WITH_DES40_CBC_SHA, /* 0x000B */
"EXP-DH-DSS-DES-CBC-SHA",
CIPHER_WEAK_DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(DH_DSS_WITH_DES_CBC_SHA, /* 0x000C */
"DH-DSS-DES-CBC-SHA",
CIPHER_WEAK_DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(DH_DSS_WITH_3DES_EDE_CBC_SHA, /* 0x000D */
"DH-DSS-DES-CBC3-SHA",
CIPHER_WEAK_3DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(DH_RSA_EXPORT_WITH_DES40_CBC_SHA, /* 0x000E */
"EXP-DH-RSA-DES-CBC-SHA",
CIPHER_WEAK_DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(DH_RSA_WITH_DES_CBC_SHA, /* 0x000F */
"DH-RSA-DES-CBC-SHA",
CIPHER_WEAK_DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(DH_RSA_WITH_3DES_EDE_CBC_SHA, /* 0x0010 */
"DH-RSA-DES-CBC3-SHA",
CIPHER_WEAK_3DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, /* 0x0011 */
"EXP-EDH-DSS-DES-CBC-SHA",
CIPHER_WEAK_DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(DHE_DSS_WITH_DES_CBC_SHA, /* 0x0012 */
"EDH-DSS-CBC-SHA",
CIPHER_WEAK_DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(DHE_DSS_WITH_3DES_EDE_CBC_SHA, /* 0x0013 */
"DHE-DSS-DES-CBC3-SHA",
CIPHER_WEAK_3DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, /* 0x0014 */
"EXP-EDH-RSA-DES-CBC-SHA",
CIPHER_WEAK_DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(DHE_RSA_WITH_DES_CBC_SHA, /* 0x0015 */
"EDH-RSA-DES-CBC-SHA",
CIPHER_WEAK_DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(DHE_RSA_WITH_3DES_EDE_CBC_SHA, /* 0x0016 */
"DHE-RSA-DES-CBC3-SHA",
CIPHER_WEAK_3DES_ENCRYPTION),
CIPHER_DEF_SSLTLS(DH_anon_EXPORT_WITH_RC4_40_MD5, /* 0x0017 */
"EXP-ADH-RC4-MD5",
CIPHER_WEAK_ANON_AUTH),
CIPHER_DEF_SSLTLS(DH_anon_WITH_RC4_128_MD5, /* 0x0018 */
"ADH-RC4-MD5",
CIPHER_WEAK_ANON_AUTH),
CIPHER_DEF_SSLTLS(DH_anon_EXPORT_WITH_DES40_CBC_SHA, /* 0x0019 */
"EXP-ADH-DES-CBC-SHA",
CIPHER_WEAK_ANON_AUTH),
CIPHER_DEF_SSLTLS(DH_anon_WITH_DES_CBC_SHA, /* 0x001A */
"ADH-DES-CBC-SHA",
CIPHER_WEAK_ANON_AUTH),
CIPHER_DEF_SSLTLS(DH_anon_WITH_3DES_EDE_CBC_SHA, /* 0x001B */
"ADH-DES-CBC3-SHA",
CIPHER_WEAK_3DES_ENCRYPTION),
CIPHER_DEF(SSL_FORTEZZA_DMS_WITH_NULL_SHA, /* 0x001C */
NULL,
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF(SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA, /* 0x001D */
NULL,
CIPHER_STRONG_ENOUGH),
#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
/* RFC 4785 - Pre-Shared Key (PSK) Ciphersuites with NULL Encryption */
CIPHER_DEF(TLS_PSK_WITH_NULL_SHA, /* 0x002C */
"PSK-NULL-SHA",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF(TLS_DHE_PSK_WITH_NULL_SHA, /* 0x002D */
"DHE-PSK-NULL-SHA",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF(TLS_RSA_PSK_WITH_NULL_SHA, /* 0x002E */
"RSA-PSK-NULL-SHA",
CIPHER_WEAK_NOT_ENCRYPTED),
#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
/* TLS addenda using AES, per RFC 3268. Defined since SDK 10.4u */
CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA, /* 0x002F */
"AES128-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_DSS_WITH_AES_128_CBC_SHA, /* 0x0030 */
"DH-DSS-AES128-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_RSA_WITH_AES_128_CBC_SHA, /* 0x0031 */
"DH-RSA-AES128-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_DSS_WITH_AES_128_CBC_SHA, /* 0x0032 */
"DHE-DSS-AES128-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_RSA_WITH_AES_128_CBC_SHA, /* 0x0033 */
"DHE-RSA-AES128-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_anon_WITH_AES_128_CBC_SHA, /* 0x0034 */
"ADH-AES128-SHA",
CIPHER_WEAK_ANON_AUTH),
CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA, /* 0x0035 */
"AES256-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_DSS_WITH_AES_256_CBC_SHA, /* 0x0036 */
"DH-DSS-AES256-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_RSA_WITH_AES_256_CBC_SHA, /* 0x0037 */
"DH-RSA-AES256-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_DSS_WITH_AES_256_CBC_SHA, /* 0x0038 */
"DHE-DSS-AES256-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_RSA_WITH_AES_256_CBC_SHA, /* 0x0039 */
"DHE-RSA-AES256-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_anon_WITH_AES_256_CBC_SHA, /* 0x003A */
"ADH-AES256-SHA",
CIPHER_WEAK_ANON_AUTH),
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
/* TLS 1.2 addenda, RFC 5246 */
/* Server provided RSA certificate for key exchange. */
CIPHER_DEF(TLS_RSA_WITH_NULL_SHA256, /* 0x003B */
"NULL-SHA256",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA256, /* 0x003C */
"AES128-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA256, /* 0x003D */
"AES256-SHA256",
CIPHER_STRONG_ENOUGH),
/* Server-authenticated (and optionally client-authenticated)
Diffie-Hellman. */
CIPHER_DEF(TLS_DH_DSS_WITH_AES_128_CBC_SHA256, /* 0x003E */
"DH-DSS-AES128-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_RSA_WITH_AES_128_CBC_SHA256, /* 0x003F */
"DH-RSA-AES128-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, /* 0x0040 */
"DHE-DSS-AES128-SHA256",
CIPHER_STRONG_ENOUGH),
/* TLS 1.2 addenda, RFC 5246 */
CIPHER_DEF(TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, /* 0x0067 */
"DHE-RSA-AES128-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_DSS_WITH_AES_256_CBC_SHA256, /* 0x0068 */
"DH-DSS-AES256-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_RSA_WITH_AES_256_CBC_SHA256, /* 0x0069 */
"DH-RSA-AES256-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, /* 0x006A */
"DHE-DSS-AES256-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, /* 0x006B */
"DHE-RSA-AES256-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_anon_WITH_AES_128_CBC_SHA256, /* 0x006C */
"ADH-AES128-SHA256",
CIPHER_WEAK_ANON_AUTH),
CIPHER_DEF(TLS_DH_anon_WITH_AES_256_CBC_SHA256, /* 0x006D */
"ADH-AES256-SHA256",
CIPHER_WEAK_ANON_AUTH),
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
/* Addendum from RFC 4279, TLS PSK */
CIPHER_DEF(TLS_PSK_WITH_RC4_128_SHA, /* 0x008A */
"PSK-RC4-SHA",
CIPHER_WEAK_RC_ENCRYPTION),
CIPHER_DEF(TLS_PSK_WITH_3DES_EDE_CBC_SHA, /* 0x008B */
"PSK-3DES-EDE-CBC-SHA",
CIPHER_WEAK_3DES_ENCRYPTION),
CIPHER_DEF(TLS_PSK_WITH_AES_128_CBC_SHA, /* 0x008C */
"PSK-AES128-CBC-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_PSK_WITH_AES_256_CBC_SHA, /* 0x008D */
"PSK-AES256-CBC-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_PSK_WITH_RC4_128_SHA, /* 0x008E */
"DHE-PSK-RC4-SHA",
CIPHER_WEAK_RC_ENCRYPTION),
CIPHER_DEF(TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA, /* 0x008F */
"DHE-PSK-3DES-EDE-CBC-SHA",
CIPHER_WEAK_3DES_ENCRYPTION),
CIPHER_DEF(TLS_DHE_PSK_WITH_AES_128_CBC_SHA, /* 0x0090 */
"DHE-PSK-AES128-CBC-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_PSK_WITH_AES_256_CBC_SHA, /* 0x0091 */
"DHE-PSK-AES256-CBC-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_RSA_PSK_WITH_RC4_128_SHA, /* 0x0092 */
"RSA-PSK-RC4-SHA",
CIPHER_WEAK_RC_ENCRYPTION),
CIPHER_DEF(TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA, /* 0x0093 */
"RSA-PSK-3DES-EDE-CBC-SHA",
CIPHER_WEAK_3DES_ENCRYPTION),
CIPHER_DEF(TLS_RSA_PSK_WITH_AES_128_CBC_SHA, /* 0x0094 */
"RSA-PSK-AES128-CBC-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_RSA_PSK_WITH_AES_256_CBC_SHA, /* 0x0095 */
"RSA-PSK-AES256-CBC-SHA",
CIPHER_STRONG_ENOUGH),
#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
/* Addenda from rfc 5288 AES Galois Counter Mode (GCM) Cipher Suites
for TLS. */
CIPHER_DEF(TLS_RSA_WITH_AES_128_GCM_SHA256, /* 0x009C */
"AES128-GCM-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_RSA_WITH_AES_256_GCM_SHA384, /* 0x009D */
"AES256-GCM-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, /* 0x009E */
"DHE-RSA-AES128-GCM-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, /* 0x009F */
"DHE-RSA-AES256-GCM-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_RSA_WITH_AES_128_GCM_SHA256, /* 0x00A0 */
"DH-RSA-AES128-GCM-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_RSA_WITH_AES_256_GCM_SHA384, /* 0x00A1 */
"DH-RSA-AES256-GCM-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, /* 0x00A2 */
"DHE-DSS-AES128-GCM-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, /* 0x00A3 */
"DHE-DSS-AES256-GCM-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_DSS_WITH_AES_128_GCM_SHA256, /* 0x00A4 */
"DH-DSS-AES128-GCM-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_DSS_WITH_AES_256_GCM_SHA384, /* 0x00A5 */
"DH-DSS-AES256-GCM-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DH_anon_WITH_AES_128_GCM_SHA256, /* 0x00A6 */
"ADH-AES128-GCM-SHA256",
CIPHER_WEAK_ANON_AUTH),
CIPHER_DEF(TLS_DH_anon_WITH_AES_256_GCM_SHA384, /* 0x00A7 */
"ADH-AES256-GCM-SHA384",
CIPHER_WEAK_ANON_AUTH),
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
/* RFC 5487 - PSK with SHA-256/384 and AES GCM */
CIPHER_DEF(TLS_PSK_WITH_AES_128_GCM_SHA256, /* 0x00A8 */
"PSK-AES128-GCM-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_PSK_WITH_AES_256_GCM_SHA384, /* 0x00A9 */
"PSK-AES256-GCM-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_PSK_WITH_AES_128_GCM_SHA256, /* 0x00AA */
"DHE-PSK-AES128-GCM-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_PSK_WITH_AES_256_GCM_SHA384, /* 0x00AB */
"DHE-PSK-AES256-GCM-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_RSA_PSK_WITH_AES_128_GCM_SHA256, /* 0x00AC */
"RSA-PSK-AES128-GCM-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_RSA_PSK_WITH_AES_256_GCM_SHA384, /* 0x00AD */
"RSA-PSK-AES256-GCM-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_PSK_WITH_AES_128_CBC_SHA256, /* 0x00AE */
"PSK-AES128-CBC-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_PSK_WITH_AES_256_CBC_SHA384, /* 0x00AF */
"PSK-AES256-CBC-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_PSK_WITH_NULL_SHA256, /* 0x00B0 */
"PSK-NULL-SHA256",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF(TLS_PSK_WITH_NULL_SHA384, /* 0x00B1 */
"PSK-NULL-SHA384",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF(TLS_DHE_PSK_WITH_AES_128_CBC_SHA256, /* 0x00B2 */
"DHE-PSK-AES128-CBC-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_PSK_WITH_AES_256_CBC_SHA384, /* 0x00B3 */
"DHE-PSK-AES256-CBC-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_DHE_PSK_WITH_NULL_SHA256, /* 0x00B4 */
"DHE-PSK-NULL-SHA256",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF(TLS_DHE_PSK_WITH_NULL_SHA384, /* 0x00B5 */
"DHE-PSK-NULL-SHA384",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF(TLS_RSA_PSK_WITH_AES_128_CBC_SHA256, /* 0x00B6 */
"RSA-PSK-AES128-CBC-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_RSA_PSK_WITH_AES_256_CBC_SHA384, /* 0x00B7 */
"RSA-PSK-AES256-CBC-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_RSA_PSK_WITH_NULL_SHA256, /* 0x00B8 */
"RSA-PSK-NULL-SHA256",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF(TLS_RSA_PSK_WITH_NULL_SHA384, /* 0x00B9 */
"RSA-PSK-NULL-SHA384",
CIPHER_WEAK_NOT_ENCRYPTED),
#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
/* RFC 5746 - Secure Renegotiation. This is not a real suite,
it is a response to initiate negotiation again */
CIPHER_DEF(TLS_EMPTY_RENEGOTIATION_INFO_SCSV, /* 0x00FF */
NULL,
CIPHER_STRONG_ENOUGH),
#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11
/* TLS 1.3 standard cipher suites for ChaCha20+Poly1305.
Note: TLS 1.3 ciphersuites do not specify the key exchange
algorithm -- they only specify the symmetric ciphers.
Cipher alias name matches to OpenSSL cipher name, and for
TLS 1.3 ciphers */
CIPHER_DEF(TLS_AES_128_GCM_SHA256, /* 0x1301 */
NULL, /* The OpenSSL cipher name matches to the IANA name */
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_AES_256_GCM_SHA384, /* 0x1302 */
NULL, /* The OpenSSL cipher name matches to the IANA name */
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_CHACHA20_POLY1305_SHA256, /* 0x1303 */
NULL, /* The OpenSSL cipher name matches to the IANA name */
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_AES_128_CCM_SHA256, /* 0x1304 */
NULL, /* The OpenSSL cipher name matches to the IANA name */
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_AES_128_CCM_8_SHA256, /* 0x1305 */
NULL, /* The OpenSSL cipher name matches to the IANA name */
CIPHER_STRONG_ENOUGH),
#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */
#if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS
/* ECDSA addenda, RFC 4492 */
CIPHER_DEF(TLS_ECDH_ECDSA_WITH_NULL_SHA, /* 0xC001 */
"ECDH-ECDSA-NULL-SHA",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF(TLS_ECDH_ECDSA_WITH_RC4_128_SHA, /* 0xC002 */
"ECDH-ECDSA-RC4-SHA",
CIPHER_WEAK_RC_ENCRYPTION),
CIPHER_DEF(TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, /* 0xC003 */
"ECDH-ECDSA-DES-CBC3-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, /* 0xC004 */
"ECDH-ECDSA-AES128-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, /* 0xC005 */
"ECDH-ECDSA-AES256-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_NULL_SHA, /* 0xC006 */
"ECDHE-ECDSA-NULL-SHA",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, /* 0xC007 */
"ECDHE-ECDSA-RC4-SHA",
CIPHER_WEAK_RC_ENCRYPTION),
CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, /* 0xC008 */
"ECDHE-ECDSA-DES-CBC3-SHA",
CIPHER_WEAK_3DES_ENCRYPTION),
CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, /* 0xC009 */
"ECDHE-ECDSA-AES128-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, /* 0xC00A */
"ECDHE-ECDSA-AES256-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDH_RSA_WITH_NULL_SHA, /* 0xC00B */
"ECDH-RSA-NULL-SHA",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF(TLS_ECDH_RSA_WITH_RC4_128_SHA, /* 0xC00C */
"ECDH-RSA-RC4-SHA",
CIPHER_WEAK_RC_ENCRYPTION),
CIPHER_DEF(TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, /* 0xC00D */
"ECDH-RSA-DES-CBC3-SHA",
CIPHER_WEAK_3DES_ENCRYPTION),
CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, /* 0xC00E */
"ECDH-RSA-AES128-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, /* 0xC00F */
"ECDH-RSA-AES256-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDHE_RSA_WITH_NULL_SHA, /* 0xC010 */
"ECDHE-RSA-NULL-SHA",
CIPHER_WEAK_NOT_ENCRYPTED),
CIPHER_DEF(TLS_ECDHE_RSA_WITH_RC4_128_SHA, /* 0xC011 */
"ECDHE-RSA-RC4-SHA",
CIPHER_WEAK_RC_ENCRYPTION),
CIPHER_DEF(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, /* 0xC012 */
"ECDHE-RSA-DES-CBC3-SHA",
CIPHER_WEAK_3DES_ENCRYPTION),
CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, /* 0xC013 */
"ECDHE-RSA-AES128-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, /* 0xC014 */
"ECDHE-RSA-AES256-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDH_anon_WITH_NULL_SHA, /* 0xC015 */
"AECDH-NULL-SHA",
CIPHER_WEAK_ANON_AUTH),
CIPHER_DEF(TLS_ECDH_anon_WITH_RC4_128_SHA, /* 0xC016 */
"AECDH-RC4-SHA",
CIPHER_WEAK_ANON_AUTH),
CIPHER_DEF(TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA, /* 0xC017 */
"AECDH-DES-CBC3-SHA",
CIPHER_WEAK_3DES_ENCRYPTION),
CIPHER_DEF(TLS_ECDH_anon_WITH_AES_128_CBC_SHA, /* 0xC018 */
"AECDH-AES128-SHA",
CIPHER_WEAK_ANON_AUTH),
CIPHER_DEF(TLS_ECDH_anon_WITH_AES_256_CBC_SHA, /* 0xC019 */
"AECDH-AES256-SHA",
CIPHER_WEAK_ANON_AUTH),
#endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
/* Addenda from rfc 5289 Elliptic Curve Cipher Suites with
HMAC SHA-256/384. */
CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, /* 0xC023 */
"ECDHE-ECDSA-AES128-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, /* 0xC024 */
"ECDHE-ECDSA-AES256-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, /* 0xC025 */
"ECDH-ECDSA-AES128-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, /* 0xC026 */
"ECDH-ECDSA-AES256-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, /* 0xC027 */
"ECDHE-RSA-AES128-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, /* 0xC028 */
"ECDHE-RSA-AES256-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, /* 0xC029 */
"ECDH-RSA-AES128-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, /* 0xC02A */
"ECDH-RSA-AES256-SHA384",
CIPHER_STRONG_ENOUGH),
/* Addenda from rfc 5289 Elliptic Curve Cipher Suites with
SHA-256/384 and AES Galois Counter Mode (GCM) */
CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, /* 0xC02B */
"ECDHE-ECDSA-AES128-GCM-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, /* 0xC02C */
"ECDHE-ECDSA-AES256-GCM-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, /* 0xC02D */
"ECDH-ECDSA-AES128-GCM-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, /* 0xC02E */
"ECDH-ECDSA-AES256-GCM-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, /* 0xC02F */
"ECDHE-RSA-AES128-GCM-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, /* 0xC030 */
"ECDHE-RSA-AES256-GCM-SHA384",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, /* 0xC031 */
"ECDH-RSA-AES128-GCM-SHA256",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, /* 0xC032 */
"ECDH-RSA-AES256-GCM-SHA384",
CIPHER_STRONG_ENOUGH),
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
#if CURL_BUILD_MAC_10_15 || CURL_BUILD_IOS_13
/* ECDHE_PSK Cipher Suites for Transport Layer Security (TLS), RFC 5489 */
CIPHER_DEF(TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA, /* 0xC035 */
"ECDHE-PSK-AES128-CBC-SHA",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA, /* 0xC036 */
"ECDHE-PSK-AES256-CBC-SHA",
CIPHER_STRONG_ENOUGH),
#endif /* CURL_BUILD_MAC_10_15 || CURL_BUILD_IOS_13 */
#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11
/* Addenda from rfc 7905 ChaCha20-Poly1305 Cipher Suites for
Transport Layer Security (TLS). */
CIPHER_DEF(TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, /* 0xCCA8 */
"ECDHE-RSA-CHACHA20-POLY1305",
CIPHER_STRONG_ENOUGH),
CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, /* 0xCCA9 */
"ECDHE-ECDSA-CHACHA20-POLY1305",
CIPHER_STRONG_ENOUGH),
#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */
#if CURL_BUILD_MAC_10_15 || CURL_BUILD_IOS_13
/* ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS),
RFC 7905 */
CIPHER_DEF(TLS_PSK_WITH_CHACHA20_POLY1305_SHA256, /* 0xCCAB */
"PSK-CHACHA20-POLY1305",
CIPHER_STRONG_ENOUGH),
#endif /* CURL_BUILD_MAC_10_15 || CURL_BUILD_IOS_13 */
/* Tags for SSL 2 cipher kinds which are not specified for SSL 3.
Defined since SDK 10.2.8 */
CIPHER_DEF(SSL_RSA_WITH_RC2_CBC_MD5, /* 0xFF80 */
NULL,
CIPHER_WEAK_RC_ENCRYPTION),
CIPHER_DEF(SSL_RSA_WITH_IDEA_CBC_MD5, /* 0xFF81 */
NULL,
CIPHER_WEAK_IDEA_ENCRYPTION),
CIPHER_DEF(SSL_RSA_WITH_DES_CBC_MD5, /* 0xFF82 */
NULL,
CIPHER_WEAK_DES_ENCRYPTION),
CIPHER_DEF(SSL_RSA_WITH_3DES_EDE_CBC_MD5, /* 0xFF83 */
NULL,
CIPHER_WEAK_3DES_ENCRYPTION),
};
#define NUM_OF_CIPHERS sizeof(ciphertable)/sizeof(ciphertable[0])
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
/* pinned public key support tests */
/* version 1 supports macOS 10.12+ and iOS 10+ */
#if ((TARGET_OS_IPHONE && __IPHONE_OS_VERSION_MIN_REQUIRED >= 100000) || \
(!TARGET_OS_IPHONE && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101200))
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#define SECTRANSP_PINNEDPUBKEY_V1 1
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
#endif
/* version 2 supports MacOSX 10.7+ */
#if (!TARGET_OS_IPHONE && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070)
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#define SECTRANSP_PINNEDPUBKEY_V2 1
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
#endif
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#if defined(SECTRANSP_PINNEDPUBKEY_V1) || defined(SECTRANSP_PINNEDPUBKEY_V2)
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
/* this backend supports CURLOPT_PINNEDPUBLICKEY */
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#define SECTRANSP_PINNEDPUBKEY 1
#endif /* SECTRANSP_PINNEDPUBKEY */
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
/* both new and old APIs return rsa keys missing the spki header (not DER) */
static const unsigned char rsa4096SpkiHeader[] = {
0x30, 0x82, 0x02, 0x22, 0x30, 0x0d,
0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05,
0x00, 0x03, 0x82, 0x02, 0x0f, 0x00};
static const unsigned char rsa2048SpkiHeader[] = {
0x30, 0x82, 0x01, 0x22, 0x30, 0x0d,
0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05,
0x00, 0x03, 0x82, 0x01, 0x0f, 0x00};
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY_V1
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
/* the *new* version doesn't return DER encoded ecdsa certs like the old... */
static const unsigned char ecDsaSecp256r1SpkiHeader[] = {
0x30, 0x59, 0x30, 0x13, 0x06, 0x07,
0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
0x01, 0x06, 0x08, 0x2a, 0x86, 0x48,
0xce, 0x3d, 0x03, 0x01, 0x07, 0x03,
0x42, 0x00};
static const unsigned char ecDsaSecp384r1SpkiHeader[] = {
0x30, 0x76, 0x30, 0x10, 0x06, 0x07,
0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
0x01, 0x06, 0x05, 0x2b, 0x81, 0x04,
0x00, 0x22, 0x03, 0x62, 0x00};
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* SECTRANSP_PINNEDPUBKEY_V1 */
#endif /* SECTRANSP_PINNEDPUBKEY */
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* The following two functions were ripped from Apple sample code,
* with some modifications: */
static OSStatus SocketRead(SSLConnectionRef connection,
void *data, /* owned by
* caller, data
* RETURNED */
size_t *dataLength) /* IN/OUT */
{
darwinssl: Fix implicit conversion compiler warnings The Clang compiler found a few implicit conversion problems that have now been fixed.
2012-12-11 23:43:48 -05:00
size_t bytesToGo = *dataLength;
size_t initLen = bytesToGo;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
UInt8 *currData = (UInt8 *)data;
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
/*int sock = *(int *)connection;*/
struct ssl_connect_data *connssl = (struct ssl_connect_data *)connection;
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
struct ssl_backend_data *backend = connssl->backend;
int sock = backend->ssl_sockfd;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
OSStatus rtn = noErr;
darwinssl: Fix implicit conversion compiler warnings The Clang compiler found a few implicit conversion problems that have now been fixed.
2012-12-11 23:43:48 -05:00
size_t bytesRead;
ssize_t rrtn;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
int theErr;
*dataLength = 0;
for(;;) {
bytesRead = 0;
rrtn = read(sock, currData, bytesToGo);
if(rrtn <= 0) {
/* this is guesswork... */
theErr = errno;
darwinssl: fix infinite loop if server disconnected abruptly If the server hung up the connection without sending a closure alert, then we'd keep probing the socket for data even though it's dead. Now we're ready for this situation. Bug: http://curl.haxx.se/mail/lib-2013-03/0014.html Reported by: Aki Koskinen
2013-03-04 00:11:10 -05:00
if(rrtn == 0) { /* EOF = server hung up */
/* the framework will turn this into errSSLClosedNoNotify */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
rtn = errSSLClosedGraceful;
}
else /* do the switch */
switch(theErr) {
case ENOENT:
/* connection closed */
rtn = errSSLClosedGraceful;
break;
case ECONNRESET:
rtn = errSSLClosedAbort;
break;
case EAGAIN:
rtn = errSSLWouldBlock;
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
backend->ssl_direction = false;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
break;
default:
rtn = ioErr;
break;
}
break;
}
else {
bytesRead = rrtn;
}
bytesToGo -= bytesRead;
currData += bytesRead;
if(bytesToGo == 0) {
/* filled buffer with incoming data, done */
break;
}
}
*dataLength = initLen - bytesToGo;
return rtn;
}
static OSStatus SocketWrite(SSLConnectionRef connection,
const void *data,
size_t *dataLength) /* IN/OUT */
{
darwinssl: Fix implicit conversion compiler warnings The Clang compiler found a few implicit conversion problems that have now been fixed.
2012-12-11 23:43:48 -05:00
size_t bytesSent = 0;
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
/*int sock = *(int *)connection;*/
struct ssl_connect_data *connssl = (struct ssl_connect_data *)connection;
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
struct ssl_backend_data *backend = connssl->backend;
int sock = backend->ssl_sockfd;
darwinssl: Fix implicit conversion compiler warnings The Clang compiler found a few implicit conversion problems that have now been fixed.
2012-12-11 23:43:48 -05:00
ssize_t length;
size_t dataLen = *dataLength;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
const UInt8 *dataPtr = (UInt8 *)data;
OSStatus ortn;
int theErr;
*dataLength = 0;
do {
length = write(sock,
checksrc: white space edits to comply to stricter checksrc
2016-11-23 02:30:18 -05:00
(char *)dataPtr + bytesSent,
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
dataLen - bytesSent);
} while((length > 0) &&
( (bytesSent += length) < dataLen) );
if(length <= 0) {
theErr = errno;
if(theErr == EAGAIN) {
ortn = errSSLWouldBlock;
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
backend->ssl_direction = true;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
else {
ortn = ioErr;
}
}
else {
ortn = noErr;
}
*dataLength = bytesSent;
return ortn;
}
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
#ifndef CURL_DISABLE_VERBOSE_STRINGS
checksrc: move open braces to comply with function declaration style
2016-11-23 02:49:04 -05:00
CF_INLINE const char *TLSCipherNameForNumber(SSLCipherSuite cipher)
{
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
/* The first ciphers in the ciphertable are continuos. Here we do small
optimization and instead of loop directly get SSL name by cipher number.
*/
if(cipher <= SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA) {
return ciphertable[cipher].name;
darwinssl: output cipher with text, remove SNI warning The code was printing a warning when SNI was set up successfully. Oops. Printing the cipher number in verbose mode was something only TLS/SSL programmers might understand, so I had it print the name of the cipher, just like in the OpenSSL code. That'll be at least a little bit easier to understand. The SecureTransport API doesn't have a method of getting a string from a cipher like OpenSSL does, so I had to generate the strings manually.
2012-07-07 16:37:52 -04:00
}
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
/* Iterate through the rest of the ciphers */
for(size_t i = SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA + 1;
i < NUM_OF_CIPHERS;
++i) {
if(ciphertable[i].num == cipher) {
return ciphertable[i].name;
}
}
return ciphertable[SSL_NULL_WITH_NULL_NULL].name;
darwinssl: output cipher with text, remove SNI warning The code was printing a warning when SNI was set up successfully. Oops. Printing the cipher number in verbose mode was something only TLS/SSL programmers might understand, so I had it print the name of the cipher, just like in the OpenSSL code. That'll be at least a little bit easier to understand. The SecureTransport API doesn't have a method of getting a string from a cipher like OpenSSL does, so I had to generate the strings manually.
2012-07-07 16:37:52 -04:00
}
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
darwinssl: output cipher with text, remove SNI warning The code was printing a warning when SNI was set up successfully. Oops. Printing the cipher number in verbose mode was something only TLS/SSL programmers might understand, so I had it print the name of the cipher, just like in the OpenSSL code. That'll be at least a little bit easier to understand. The SecureTransport API doesn't have a method of getting a string from a cipher like OpenSSL does, so I had to generate the strings manually.
2012-07-07 16:37:52 -04:00
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
CF_INLINE void GetDarwinVersionNumber(int *major, int *minor)
{
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
int mib[2];
char *os_version;
size_t os_version_len;
darwinssl: removed commented out code
2016-04-19 02:32:14 -04:00
char *os_version_major, *os_version_minor;
darwinssl: don't use strtok() The GetDarwinVersionNumber() function uses strtok, which is not thread-safe.
2014-08-05 02:58:49 -04:00
char *tok_buf;
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
/* Get the Darwin kernel version from the kernel using sysctl(): */
mib[0] = CTL_KERN;
mib[1] = KERN_OSRELEASE;
if(sysctl(mib, 2, NULL, &os_version_len, NULL, 0) == -1)
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
return;
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
os_version = malloc(os_version_len*sizeof(char));
if(!os_version)
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
return;
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
if(sysctl(mib, 2, os_version, &os_version_len, NULL, 0) == -1) {
free(os_version);
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
return;
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
}
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
/* Parse the version: */
darwinssl: don't use strtok() The GetDarwinVersionNumber() function uses strtok, which is not thread-safe.
2014-08-05 02:58:49 -04:00
os_version_major = strtok_r(os_version, ".", &tok_buf);
os_version_minor = strtok_r(NULL, ".", &tok_buf);
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
*major = atoi(os_version_major);
*minor = atoi(os_version_minor);
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
free(os_version);
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC */
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
/* Apple provides a myriad of ways of getting information about a certificate
into a string. Some aren't available under iOS or newer cats. So here's
a unified function for getting a string describing the certificate that
ought to work in all cats starting with Leopard. */
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
CF_INLINE CFStringRef getsubject(SecCertificateRef cert)
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
{
CFStringRef server_cert_summary = CFSTR("(null)");
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_IOS
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
/* iOS: There's only one way to do this. */
server_cert_summary = SecCertificateCopySubjectSummary(cert);
#else
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_7
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
/* Lion & later: Get the long description if we can. */
if(SecCertificateCopyLongDescription != NULL)
server_cert_summary =
SecCertificateCopyLongDescription(NULL, cert, NULL);
else
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_7 */
#if CURL_BUILD_MAC_10_6
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
/* Snow Leopard: Get the certificate summary. */
if(SecCertificateCopySubjectSummary != NULL)
server_cert_summary = SecCertificateCopySubjectSummary(cert);
else
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_6 */
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
/* Leopard is as far back as we go... */
(void)SecCertificateCopyCommonName(cert, &server_cert_summary);
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_IOS */
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
return server_cert_summary;
}
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
static CURLcode CopyCertSubject(struct Curl_easy *data,
SecCertificateRef cert, char **certp)
{
CFStringRef c = getsubject(cert);
CURLcode result = CURLE_OK;
darwinssl: handle long strings in TLS certs (follow-up) - Fix handling certificate subjects that are already UTF-8 encoded. Follow-up to b3b75d1 from two days ago. Since then a copy would be skipped if the subject was already UTF-8, possibly resulting in a NULL deref later on. Ref: https://github.com/curl/curl/issues/1823 Ref: https://github.com/curl/curl/pull/1831 Closes https://github.com/curl/curl/pull/1836
2017-08-27 23:37:02 -04:00
const char *direct;
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
char *cbuf = NULL;
*certp = NULL;
darwinssl: handle long strings in TLS certs (follow-up) - Fix handling certificate subjects that are already UTF-8 encoded. Follow-up to b3b75d1 from two days ago. Since then a copy would be skipped if the subject was already UTF-8, possibly resulting in a NULL deref later on. Ref: https://github.com/curl/curl/issues/1823 Ref: https://github.com/curl/curl/pull/1831 Closes https://github.com/curl/curl/pull/1836
2017-08-27 23:37:02 -04:00
if(!c) {
failf(data, "SSL: invalid CA certificate subject");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: handle long strings in TLS certs (follow-up) - Fix handling certificate subjects that are already UTF-8 encoded. Follow-up to b3b75d1 from two days ago. Since then a copy would be skipped if the subject was already UTF-8, possibly resulting in a NULL deref later on. Ref: https://github.com/curl/curl/issues/1823 Ref: https://github.com/curl/curl/pull/1831 Closes https://github.com/curl/curl/pull/1836
2017-08-27 23:37:02 -04:00
}
/* If the subject is already available as UTF-8 encoded (ie 'direct') then
use that, else convert it. */
direct = CFStringGetCStringPtr(c, kCFStringEncodingUTF8);
if(direct) {
*certp = strdup(direct);
if(!*certp) {
failf(data, "SSL: out of memory");
result = CURLE_OUT_OF_MEMORY;
}
}
else {
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
size_t cbuf_size = ((size_t)CFStringGetLength(c) * 4) + 1;
cbuf = calloc(cbuf_size, 1);
if(cbuf) {
if(!CFStringGetCString(c, cbuf, cbuf_size,
kCFStringEncodingUTF8)) {
failf(data, "SSL: invalid CA certificate subject");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
result = CURLE_PEER_FAILED_VERIFICATION;
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
}
else
/* pass back the buffer */
*certp = cbuf;
}
else {
failf(data, "SSL: couldn't allocate %zu bytes of memory", cbuf_size);
result = CURLE_OUT_OF_MEMORY;
}
}
if(result)
free(cbuf);
CFRelease(c);
return result;
}
darwinssl: Fix #if 10.6.0 for SecKeychainSearch The comment here says that SecKeychainSearch causes a deprecation warning when used with a minimum Mac OS X SDK version of 10.7.0, which is correct. However, the #if guard did not match. It was intended to only use the code if 10.6.0 support was enabled, but it had 10.7.0 instead. This caused a warning if the minimum was exactly 10.7.0.
2013-12-03 19:07:32 -05:00
#if CURL_SUPPORT_MAC_10_6
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
/* The SecKeychainSearch API was deprecated in Lion, and using it will raise
deprecation warnings, so let's not compile this unless it's necessary: */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
static OSStatus CopyIdentityWithLabelOldSchool(char *label,
SecIdentityRef *out_c_a_k)
{
OSStatus status = errSecItemNotFound;
SecKeychainAttributeList attr_list;
SecKeychainAttribute attr;
SecKeychainSearchRef search = NULL;
SecCertificateRef cert = NULL;
/* Set up the attribute list: */
attr_list.count = 1L;
attr_list.attr = &attr;
/* Set up our lone search criterion: */
attr.tag = kSecLabelItemAttr;
attr.data = label;
attr.length = (UInt32)strlen(label);
/* Start searching: */
status = SecKeychainSearchCreateFromAttributes(NULL,
kSecCertificateItemClass,
&attr_list,
&search);
if(status == noErr) {
status = SecKeychainSearchCopyNext(search,
(SecKeychainItemRef *)&cert);
if(status == noErr && cert) {
/* If we found a certificate, does it have a private key? */
status = SecIdentityCreateWithCertificate(NULL, cert, out_c_a_k);
CFRelease(cert);
}
}
if(search)
CFRelease(search);
return status;
}
darwinssl: Fix #if 10.6.0 for SecKeychainSearch The comment here says that SecKeychainSearch causes a deprecation warning when used with a minimum Mac OS X SDK version of 10.7.0, which is correct. However, the #if guard did not match. It was intended to only use the code if 10.6.0 support was enabled, but it had 10.7.0 instead. This caused a warning if the minimum was exactly 10.7.0.
2013-12-03 19:07:32 -05:00
#endif /* CURL_SUPPORT_MAC_10_6 */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
static OSStatus CopyIdentityWithLabel(char *label,
SecIdentityRef *out_cert_and_key)
{
OSStatus status = errSecItemNotFound;
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
CFArrayRef keys_list;
CFIndex keys_list_count;
CFIndex i;
CFStringRef common_name;
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
darwinssl: fix build error in crypto authentication under Snow Leopard It turns out Snow Leopard not only has SecItemCopyMatching() defined in a header not included by the omnibus header, but it won't work for our purposes, because searching for SecIdentityRef objects wasn't added to that API until Lion. So we now use the old SecKeychainSearch API instead if the user is building under, or running under, Snow Leopard. Bug: http://sourceforge.net/p/curl/bugs/1255/ Reported by: Edward Rudd
2013-07-30 22:25:38 -04:00
/* SecItemCopyMatching() was introduced in iOS and Snow Leopard.
kSecClassIdentity was introduced in Lion. If both exist, let's use them
to find the certificate. */
if(SecItemCopyMatching != NULL && kSecClassIdentity != NULL) {
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
CFTypeRef keys[5];
CFTypeRef values[5];
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
CFDictionaryRef query_dict;
CFStringRef label_cf = CFStringCreateWithCString(NULL, label,
kCFStringEncodingUTF8);
/* Set up our search criteria and expected results: */
values[0] = kSecClassIdentity; /* we want a certificate and a key */
keys[0] = kSecClass;
values[1] = kCFBooleanTrue; /* we want a reference */
keys[1] = kSecReturnRef;
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
values[2] = kSecMatchLimitAll; /* kSecMatchLimitOne would be better if the
* label matching below worked correctly */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
keys[2] = kSecMatchLimit;
/* identity searches need a SecPolicyRef in order to work */
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
values[3] = SecPolicyCreateSSL(false, NULL);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
keys[3] = kSecMatchPolicy;
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
/* match the name of the certificate (doesn't work in macOS 10.12.1) */
values[4] = label_cf;
keys[4] = kSecAttrLabel;
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
query_dict = CFDictionaryCreate(NULL, (const void **)keys,
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
(const void **)values, 5L,
&kCFCopyStringDictionaryKeyCallBacks,
&kCFTypeDictionaryValueCallBacks);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
CFRelease(values[3]);
/* Do we have a match? */
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
status = SecItemCopyMatching(query_dict, (CFTypeRef *) &keys_list);
/* Because kSecAttrLabel matching doesn't work with kSecClassIdentity,
* we need to find the correct identity ourselves */
if(status == noErr) {
keys_list_count = CFArrayGetCount(keys_list);
*out_cert_and_key = NULL;
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
status = 1;
code style: use spaces around equals signs
2017-09-09 17:09:06 -04:00
for(i = 0; i<keys_list_count; i++) {
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
OSStatus err = noErr;
SecCertificateRef cert = NULL;
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
SecIdentityRef identity =
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
(SecIdentityRef) CFArrayGetValueAtIndex(keys_list, i);
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
err = SecIdentityCopyCertificate(identity, &cert);
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
if(err == noErr) {
darwinssl: fix iOS build Reviewed-by: Nick Zitzmann Fixes #1172
2016-12-22 21:27:17 -05:00
#if CURL_BUILD_IOS
common_name = SecCertificateCopySubjectSummary(cert);
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
#elif CURL_BUILD_MAC_10_7
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
SecCertificateCopyCommonName(cert, &common_name);
darwinssl: fix iOS build Reviewed-by: Nick Zitzmann Fixes #1172
2016-12-22 21:27:17 -05:00
#endif
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
if(CFStringCompare(common_name, label_cf, 0) == kCFCompareEqualTo) {
CFRelease(cert);
CFRelease(common_name);
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
CFRetain(identity);
*out_cert_and_key = identity;
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
status = noErr;
break;
}
CFRelease(common_name);
}
CFRelease(cert);
}
}
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
if(keys_list)
CFRelease(keys_list);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
CFRelease(query_dict);
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
CFRelease(label_cf);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
}
else {
darwinssl: Fix #if 10.6.0 for SecKeychainSearch The comment here says that SecKeychainSearch causes a deprecation warning when used with a minimum Mac OS X SDK version of 10.7.0, which is correct. However, the #if guard did not match. It was intended to only use the code if 10.6.0 support was enabled, but it had 10.7.0 instead. This caused a warning if the minimum was exactly 10.7.0.
2013-12-03 19:07:32 -05:00
#if CURL_SUPPORT_MAC_10_6
darwinssl: fix build error in crypto authentication under Snow Leopard It turns out Snow Leopard not only has SecItemCopyMatching() defined in a header not included by the omnibus header, but it won't work for our purposes, because searching for SecIdentityRef objects wasn't added to that API until Lion. So we now use the old SecKeychainSearch API instead if the user is building under, or running under, Snow Leopard. Bug: http://sourceforge.net/p/curl/bugs/1255/ Reported by: Edward Rudd
2013-07-30 22:25:38 -04:00
/* On Leopard and Snow Leopard, fall back to SecKeychainSearch. */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key);
darwinssl: Fix typo in comment Closes https://github.com/curl/curl/pull/1028
2016-09-19 15:32:48 -04:00
#endif /* CURL_SUPPORT_MAC_10_6 */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
}
darwinssl: Fix #if 10.6.0 for SecKeychainSearch The comment here says that SecKeychainSearch causes a deprecation warning when used with a minimum Mac OS X SDK version of 10.7.0, which is correct. However, the #if guard did not match. It was intended to only use the code if 10.6.0 support was enabled, but it had 10.7.0 instead. This caused a warning if the minimum was exactly 10.7.0.
2013-12-03 19:07:32 -05:00
#elif CURL_SUPPORT_MAC_10_6
darwinssl: fix build error in crypto authentication under Snow Leopard It turns out Snow Leopard not only has SecItemCopyMatching() defined in a header not included by the omnibus header, but it won't work for our purposes, because searching for SecIdentityRef objects wasn't added to that API until Lion. So we now use the old SecKeychainSearch API instead if the user is building under, or running under, Snow Leopard. Bug: http://sourceforge.net/p/curl/bugs/1255/ Reported by: Edward Rudd
2013-07-30 22:25:38 -04:00
/* For developers building on older cats, we have no choice but to fall back
to SecKeychainSearch. */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key);
darwinssl: fix build error in crypto authentication under Snow Leopard It turns out Snow Leopard not only has SecItemCopyMatching() defined in a header not included by the omnibus header, but it won't work for our purposes, because searching for SecIdentityRef objects wasn't added to that API until Lion. So we now use the old SecKeychainSearch API instead if the user is building under, or running under, Snow Leopard. Bug: http://sourceforge.net/p/curl/bugs/1255/ Reported by: Edward Rudd
2013-07-30 22:25:38 -04:00
#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
return status;
}
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
static OSStatus CopyIdentityFromPKCS12File(const char *cPath,
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
const struct curl_blob *blob,
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
const char *cPassword,
SecIdentityRef *out_cert_and_key)
{
OSStatus status = errSecItemNotFound;
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
CFURLRef pkcs_url = NULL;
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
CFStringRef password = cPassword ? CFStringCreateWithCString(NULL,
cPassword, kCFStringEncodingUTF8) : NULL;
CFDataRef pkcs_data = NULL;
darwinssl: PKCS#12 import feature now requires Lion or later It turns out that some of the constants necessary to make this feature work are missing from Snow Leopard's Security framework even though they are defined in the headers. Bug: http://curl.haxx.se/mail/lib-2013-11/0076.html Reported by: myriachan
2013-11-12 21:18:04 -05:00
/* We can import P12 files on iOS or OS X 10.7 or later: */
/* These constants are documented as having first appeared in 10.6 but they
raise linker errors when used on that cat for some reason. */
#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
bool resource_imported;
if(blob) {
pkcs_data = CFDataCreate(kCFAllocatorDefault,
(const unsigned char *)blob->data, blob->len);
status = (pkcs_data != NULL) ? errSecSuccess : errSecAllocate;
resource_imported = (pkcs_data != NULL);
}
else {
pkcs_url =
CFURLCreateFromFileSystemRepresentation(NULL,
(const UInt8 *)cPath,
strlen(cPath), false);
resource_imported =
CFURLCreateDataAndPropertiesFromResource(NULL,
pkcs_url, &pkcs_data,
NULL, NULL, &status);
}
if(resource_imported) {
darwinssl: Don't import client certificates into Keychain on macOS Closes #2085
2017-11-15 16:30:58 -05:00
CFArrayRef items = NULL;
/* On iOS SecPKCS12Import will never add the client certificate to the
* Keychain.
*
* It gives us back a SecIdentityRef that we can use directly. */
#if CURL_BUILD_IOS
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
const void *cKeys[] = {kSecImportExportPassphrase};
const void *cValues[] = {password};
CFDictionaryRef options = CFDictionaryCreate(NULL, cKeys, cValues,
password ? 1L : 0L, NULL, NULL);
darwinssl: Don't import client certificates into Keychain on macOS Closes #2085
2017-11-15 16:30:58 -05:00
if(options != NULL) {
status = SecPKCS12Import(pkcs_data, options, &items);
CFRelease(options);
}
/* On macOS SecPKCS12Import will always add the client certificate to
* the Keychain.
*
* As this doesn't match iOS, and apps may not want to see their client
cleanup: fix typos and wording in docs and comments Closes #4869 Reviewed-by: Emil Engler and Daniel Gustafsson
2020-02-02 03:49:28 -05:00
* certificate saved in the user's keychain, we use SecItemImport
darwinssl: Don't import client certificates into Keychain on macOS Closes #2085
2017-11-15 16:30:58 -05:00
* with a NULL keychain to avoid importing it.
*
* This returns a SecCertificateRef from which we can construct a
* SecIdentityRef.
*/
#elif CURL_BUILD_MAC_10_7
SecItemImportExportKeyParameters keyParams;
SecExternalFormat inputFormat = kSecFormatPKCS12;
SecExternalItemType inputType = kSecItemTypeCertificate;
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
darwinssl: Don't import client certificates into Keychain on macOS Closes #2085
2017-11-15 16:30:58 -05:00
memset(&keyParams, 0x00, sizeof(keyParams));
keyParams.version = SEC_KEY_IMPORT_EXPORT_PARAMS_VERSION;
keyParams.passphrase = password;
status = SecItemImport(pkcs_data, NULL, &inputFormat, &inputType,
0, &keyParams, NULL, &items);
#endif
/* Extract the SecIdentityRef */
if(status == errSecSuccess && items && CFArrayGetCount(items)) {
CFIndex i, count;
count = CFArrayGetCount(items);
for(i = 0; i < count; i++) {
CFTypeRef item = (CFTypeRef) CFArrayGetValueAtIndex(items, i);
CFTypeID itemID = CFGetTypeID(item);
if(itemID == CFDictionaryGetTypeID()) {
CFTypeRef identity = (CFTypeRef) CFDictionaryGetValue(
(CFDictionaryRef) item,
kSecImportItemIdentity);
CFRetain(identity);
*out_cert_and_key = (SecIdentityRef) identity;
break;
}
darwinssl: fix iOS build
2018-03-17 16:49:27 -04:00
#if CURL_BUILD_MAC_10_7
darwinssl: Don't import client certificates into Keychain on macOS Closes #2085
2017-11-15 16:30:58 -05:00
else if(itemID == SecCertificateGetTypeID()) {
status = SecIdentityCreateWithCertificate(NULL,
(SecCertificateRef) item,
out_cert_and_key);
break;
}
darwinssl: fix iOS build
2018-03-17 16:49:27 -04:00
#endif
darwinssl: Don't import client certificates into Keychain on macOS Closes #2085
2017-11-15 16:30:58 -05:00
}
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
}
darwinssl: fix potential crash when attempting to copy an identity from a P12 file This could've happened if SecPKCS12Import() returned noErr _and_ no identity.
2014-05-14 18:48:14 -04:00
if(items)
CFRelease(items);
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
CFRelease(pkcs_data);
}
darwinssl: PKCS#12 import feature now requires Lion or later It turns out that some of the constants necessary to make this feature work are missing from Snow Leopard's Security framework even though they are defined in the headers. Bug: http://curl.haxx.se/mail/lib-2013-11/0076.html Reported by: myriachan
2013-11-12 21:18:04 -05:00
#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
if(password)
CFRelease(password);
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
if(pkcs_url)
CFRelease(pkcs_url);
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
return status;
}
/* This code was borrowed from nss.c, with some modifications:
* Determine whether the nickname passed in is a filename that needs to
* be loaded as a PEM or a regular NSS nickname.
*
* returns 1 for a file
* returns 0 for not a file
*/
CF_INLINE bool is_file(const char *filename)
{
struct_stat st;
tidy-up: make conditional checks more consistent ... remove '== NULL' and '!= 0' Closes #6912
2021-04-19 04:46:11 -04:00
if(!filename)
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
return false;
if(stat(filename, &st) == 0)
return S_ISREG(st.st_mode);
return false;
}
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static CURLcode sectransp_version_from_curl(SSLProtocol *darwinver,
darwinssl: fix variable type mistake (regression) ... which made --tlsv1.2 not work because it would blank the max tls version variable. Reported-by: Nick Miyake Bug: #1703
2017-07-27 12:30:11 -04:00
long ssl_version)
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
{
switch(ssl_version) {
case CURL_SSLVERSION_TLSv1_0:
*darwinver = kTLSProtocol1;
return CURLE_OK;
case CURL_SSLVERSION_TLSv1_1:
*darwinver = kTLSProtocol11;
return CURLE_OK;
case CURL_SSLVERSION_TLSv1_2:
*darwinver = kTLSProtocol12;
return CURLE_OK;
case CURL_SSLVERSION_TLSv1_3:
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
/* TLS 1.3 support first appeared in iOS 11 and macOS 10.13 */
darwinssl: allow High Sierra users to build the code using GCC ...but GCC users lose out on TLS 1.3 support, since we can't weak-link enumeration constants. Fixes #2656 Closes #2703
2018-07-01 15:05:50 -04:00
#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
*darwinver = kTLSProtocol13;
return CURLE_OK;
}
darwinssl: allow High Sierra users to build the code using GCC ...but GCC users lose out on TLS 1.3 support, since we can't weak-link enumeration constants. Fixes #2656 Closes #2703
2018-07-01 15:05:50 -04:00
#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
HAVE_BUILTIN_AVAILABLE == 1 */
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
break;
}
return CURLE_SSL_CONNECT_ERROR;
}
#endif
static CURLcode
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
set_ssl_version_min_max(struct Curl_easy *data, struct connectdata *conn,
int sockindex)
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
struct ssl_backend_data *backend = connssl->backend;
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
long ssl_version = SSL_CONN_CONFIG(version);
long ssl_version_max = SSL_CONN_CONFIG(version_max);
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
long max_supported_version_by_os;
/* macOS 10.5-10.7 supported TLS 1.0 only.
macOS 10.8 and later, and iOS 5 and later, added TLS 1.1 and 1.2.
macOS 10.13 and later, and iOS 11 and later, added TLS 1.3. */
darwinssl: allow High Sierra users to build the code using GCC ...but GCC users lose out on TLS 1.3 support, since we can't weak-link enumeration constants. Fixes #2656 Closes #2703
2018-07-01 15:05:50 -04:00
#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_3;
}
else {
max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_2;
}
#else
max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_2;
darwinssl: allow High Sierra users to build the code using GCC ...but GCC users lose out on TLS 1.3 support, since we can't weak-link enumeration constants. Fixes #2656 Closes #2703
2018-07-01 15:05:50 -04:00
#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
HAVE_BUILTIN_AVAILABLE == 1 */
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
switch(ssl_version) {
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
ssl_version = CURL_SSLVERSION_TLSv1_0;
break;
}
switch(ssl_version_max) {
case CURL_SSLVERSION_MAX_NONE:
case CURL_SSLVERSION_MAX_DEFAULT:
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
ssl_version_max = max_supported_version_by_os;
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
break;
}
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
if(SSLSetProtocolVersionMax != NULL) {
SSLProtocol darwin_ver_min = kTLSProtocol1;
SSLProtocol darwin_ver_max = kTLSProtocol1;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
CURLcode result = sectransp_version_from_curl(&darwin_ver_min,
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
ssl_version);
if(result) {
failf(data, "unsupported min version passed via CURLOPT_SSLVERSION");
return result;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
result = sectransp_version_from_curl(&darwin_ver_max,
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
ssl_version_max >> 16);
if(result) {
failf(data, "unsupported max version passed via CURLOPT_SSLVERSION");
return result;
}
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionMin(backend->ssl_ctx, darwin_ver_min);
(void)SSLSetProtocolVersionMax(backend->ssl_ctx, darwin_ver_max);
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
return result;
}
else {
#if CURL_SUPPORT_MAC_10_8
long i = ssl_version;
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
kSSLProtocolAll,
false);
for(; i <= (ssl_version_max >> 16); i++) {
switch(i) {
case CURL_SSLVERSION_TLSv1_0:
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
kTLSProtocol1,
true);
break;
case CURL_SSLVERSION_TLSv1_1:
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
kTLSProtocol11,
true);
break;
case CURL_SSLVERSION_TLSv1_2:
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
kTLSProtocol12,
true);
break;
case CURL_SSLVERSION_TLSv1_3:
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
failf(data, "Your version of the OS does not support TLSv1.3");
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
return CURLE_SSL_CONNECT_ERROR;
}
}
return CURLE_OK;
#endif /* CURL_SUPPORT_MAC_10_8 */
}
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
failf(data, "Secure Transport: cannot set SSL protocol");
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
return CURLE_SSL_CONNECT_ERROR;
}
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
static bool is_cipher_suite_strong(SSLCipherSuite suite_num)
{
for(size_t i = 0; i < NUM_OF_CIPHERS; ++i) {
if(ciphertable[i].num == suite_num) {
return !ciphertable[i].weak;
}
}
/* If the cipher is not in our list, assume it is a new one
and therefore strong. Previous implementation was the same,
if cipher suite is not in the list, it was considered strong enough */
return true;
}
static bool is_separator(char c)
{
/* Return whether character is a cipher list separator. */
switch(c) {
case ' ':
case '\t':
case ':':
case ',':
case ';':
return true;
}
return false;
}
static CURLcode sectransp_set_default_ciphers(struct Curl_easy *data,
SSLContextRef ssl_ctx)
{
size_t all_ciphers_count = 0UL, allowed_ciphers_count = 0UL, i;
SSLCipherSuite *all_ciphers = NULL, *allowed_ciphers = NULL;
OSStatus err = noErr;
#if CURL_BUILD_MAC
int darwinver_maj = 0, darwinver_min = 0;
GetDarwinVersionNumber(&darwinver_maj, &darwinver_min);
#endif /* CURL_BUILD_MAC */
/* Disable cipher suites that ST supports but are not safe. These ciphers
are unlikely to be used in any case since ST gives other ciphers a much
higher priority, but it's probably better that we not connect at all than
to give the user a false sense of security if the server only supports
insecure ciphers. (Note: We don't care about SSLv2-only ciphers.) */
err = SSLGetNumberSupportedCiphers(ssl_ctx, &all_ciphers_count);
if(err != noErr) {
failf(data, "SSL: SSLGetNumberSupportedCiphers() failed: OSStatus %d",
err);
return CURLE_SSL_CIPHER;
}
all_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite));
if(!all_ciphers) {
failf(data, "SSL: Failed to allocate memory for all ciphers");
return CURLE_OUT_OF_MEMORY;
}
allowed_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite));
if(!allowed_ciphers) {
Curl_safefree(all_ciphers);
failf(data, "SSL: Failed to allocate memory for allowed ciphers");
return CURLE_OUT_OF_MEMORY;
}
err = SSLGetSupportedCiphers(ssl_ctx, all_ciphers,
&all_ciphers_count);
if(err != noErr) {
Curl_safefree(all_ciphers);
Curl_safefree(allowed_ciphers);
return CURLE_SSL_CIPHER;
}
for(i = 0UL ; i < all_ciphers_count ; i++) {
#if CURL_BUILD_MAC
/* There's a known bug in early versions of Mountain Lion where ST's ECC
ciphers (cipher suite 0xC001 through 0xC032) simply do not work.
Work around the problem here by disabling those ciphers if we are
running in an affected version of OS X. */
if(darwinver_maj == 12 && darwinver_min <= 3 &&
all_ciphers[i] >= 0xC001 && all_ciphers[i] <= 0xC032) {
continue;
}
#endif /* CURL_BUILD_MAC */
if(is_cipher_suite_strong(all_ciphers[i])) {
allowed_ciphers[allowed_ciphers_count++] = all_ciphers[i];
}
}
err = SSLSetEnabledCiphers(ssl_ctx, allowed_ciphers,
allowed_ciphers_count);
Curl_safefree(all_ciphers);
Curl_safefree(allowed_ciphers);
if(err != noErr) {
failf(data, "SSL: SSLSetEnabledCiphers() failed: OSStatus %d", err);
return CURLE_SSL_CIPHER;
}
return CURLE_OK;
}
static CURLcode sectransp_set_selected_ciphers(struct Curl_easy *data,
SSLContextRef ssl_ctx,
const char *ciphers)
{
size_t ciphers_count = 0;
const char *cipher_start = ciphers;
OSStatus err = noErr;
SSLCipherSuite selected_ciphers[NUM_OF_CIPHERS];
if(!ciphers)
return CURLE_OK;
while(is_separator(*ciphers)) /* Skip initial separators. */
ciphers++;
if(!*ciphers)
return CURLE_OK;
cipher_start = ciphers;
while(*cipher_start && ciphers_count < NUM_OF_CIPHERS) {
bool cipher_found = FALSE;
size_t cipher_len = 0;
const char *cipher_end = NULL;
bool tls_name = FALSE;
/* Skip separators */
while(is_separator(*cipher_start))
cipher_start++;
if(*cipher_start == '\0') {
break;
}
/* Find last position of a cipher in the ciphers string */
cipher_end = cipher_start;
while (*cipher_end != '\0' && !is_separator(*cipher_end)) {
++cipher_end;
}
/* IANA cipher names start with the TLS_ or SSL_ prefix.
If the 4th symbol of the cipher is '_' we look for a cipher in the
table by its (TLS) name.
Otherwise, we try to match cipher by an alias. */
if(cipher_start[3] == '_') {
tls_name = TRUE;
}
/* Iterate through the cipher table and look for the cipher, starting
the cipher number 0x01 because the 0x00 is not the real cipher */
cipher_len = cipher_end - cipher_start;
for(size_t i = 1; i < NUM_OF_CIPHERS; ++i) {
const char *table_cipher_name = NULL;
if(tls_name) {
table_cipher_name = ciphertable[i].name;
}
else if(ciphertable[i].alias_name != NULL) {
table_cipher_name = ciphertable[i].alias_name;
}
else {
continue;
}
/* Compare a part of the string between separators with a cipher name
in the table and make sure we matched the whole cipher name */
if(strncmp(cipher_start, table_cipher_name, cipher_len) == 0
&& table_cipher_name[cipher_len] == '\0') {
selected_ciphers[ciphers_count] = ciphertable[i].num;
++ciphers_count;
cipher_found = TRUE;
break;
}
}
if(!cipher_found) {
/* It would be more human-readable if we print the wrong cipher name
but we don't want to allocate any additional memory and copy the name
into it, then add it into logs.
Also, we do not modify an original cipher list string. We just point
to positions where cipher starts and ends in the cipher list string.
The message is a bit cryptic and longer than necessary but can be
understood by humans. */
failf(data, "SSL: cipher string \"%s\" contains unsupported cipher name"
" starting position %d and ending position %d",
ciphers,
cipher_start - ciphers,
cipher_end - ciphers);
return CURLE_SSL_CIPHER;
}
if(*cipher_end) {
cipher_start = cipher_end + 1;
}
else {
break;
}
}
/* All cipher suites in the list are found. Report to logs as-is */
infof(data, "SSL: Setting cipher suites list \"%s\"\n", ciphers);
err = SSLSetEnabledCiphers(ssl_ctx, selected_ciphers, ciphers_count);
if(err != noErr) {
failf(data, "SSL: SSLSetEnabledCiphers() failed: OSStatus %d", err);
return CURLE_SSL_CIPHER;
}
return CURLE_OK;
}
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
static CURLcode sectransp_connect_step1(struct Curl_easy *data,
struct connectdata *conn,
DarwinSSL: several adjustments - Renamed st_ function prefix to darwinssl_ - Renamed Curl_st_ function prefix to Curl_darwinssl_ - Moved the duplicated ssl_connect_done out of the #ifdef in lib/urldata.h - Fixed a teensy little bug that made non-blocking connection attempts block - Made it so that it builds cleanly against the iOS 5.1 SDK
2012-06-26 15:39:48 -04:00
int sockindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
curl_socket_t sockfd = conn->sock[sockindex];
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
struct ssl_backend_data *backend = connssl->backend;
SSL: support in-memory CA certs for some backends - New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to specify in-memory PEM certificates for OpenSSL, Schannel (Windows) and Secure Transport (Apple) SSL backends. Prior to this change PEM certificates could only be imported from a file and not from memory. Co-authored-by: moparisthebest@users.noreply.github.com Ref: https://github.com/curl/curl/pull/4679 Ref: https://github.com/curl/curl/pull/5677 Ref: https://github.com/curl/curl/pull/6109 Closes https://github.com/curl/curl/pull/6662
2020-07-12 21:17:56 -04:00
const struct curl_blob *ssl_cablob = SSL_CONN_CONFIG(ca_info_blob);
const char * const ssl_cafile =
/* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
(ssl_cablob ? NULL : SSL_CONN_CONFIG(CAfile));
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
const bool verifypeer = SSL_CONN_CONFIG(verifypeer);
vtls: deduplicate client certificates in ssl_config_data Closes #5629
2020-06-29 14:07:37 -04:00
char * const ssl_cert = SSL_SET_OPTION(primary.clientcert);
const struct curl_blob *ssl_cert_blob = SSL_SET_OPTION(primary.cert_blob);
vtls: add 'isproxy' argument to Curl_ssl_get/addsessionid() To make sure we set and extract the correct session. Reported-by: Mingtao Yang Bug: https://curl.se/docs/CVE-2021-22890.html CVE-2021-22890
2021-03-19 07:38:49 -04:00
bool isproxy = SSL_IS_PROXY();
vtls: deduplicate some DISABLE_PROXY ifdefs continue from #5735 - using SSL_HOST_NAME, SSL_HOST_DISPNAME, SSL_PINNED_PUB_KEY for other tls backend - create SSL_HOST_PORT Closes #6660
2021-02-25 14:47:35 -05:00
const char * const hostname = SSL_HOST_NAME();
const long int port = SSL_HOST_PORT();
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
#ifdef ENABLE_IPV6
struct in6_addr addr;
#else
struct in_addr addr;
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* ENABLE_IPV6 */
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
char *ciphers;
darwinssl: disable insecure ciphers by default I noticed that aria2's SecureTransport code disables insecure ciphers such as NULL, anonymous, IDEA, and weak-key ciphers used by SSLv3 and later. That's a good idea, and now we do the same thing in order to prevent curl from accessing a "secure" site that only negotiates insecure ciphersuites.
2013-04-08 19:07:20 -04:00
OSStatus err = noErr;
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
int darwinver_maj = 0, darwinver_min = 0;
GetDarwinVersionNumber(&darwinver_maj, &darwinver_min);
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
cleanup: misc typos in strings and comments Found via `codespell` Closes #2389
2018-03-15 22:51:03 -04:00
if(SSLCreateContext != NULL) { /* use the newer API if available */
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
if(backend->ssl_ctx)
CFRelease(backend->ssl_ctx);
backend->ssl_ctx = SSLCreateContext(NULL, kSSLClientSide, kSSLStreamType);
if(!backend->ssl_ctx) {
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
failf(data, "SSL: couldn't create a context!");
return CURLE_OUT_OF_MEMORY;
}
}
else {
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
/* The old ST API does not exist under iOS, so don't compile it: */
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_SUPPORT_MAC_10_8
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
if(backend->ssl_ctx)
(void)SSLDisposeContext(backend->ssl_ctx);
err = SSLNewContext(false, &(backend->ssl_ctx));
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
if(err != noErr) {
failf(data, "SSL: couldn't create a context: OSStatus %d", err);
return CURLE_OUT_OF_MEMORY;
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_SUPPORT_MAC_10_8 */
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
}
#else
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
if(backend->ssl_ctx)
(void)SSLDisposeContext(backend->ssl_ctx);
err = SSLNewContext(false, &(backend->ssl_ctx));
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
failf(data, "SSL: couldn't create a context: OSStatus %d", err);
return CURLE_OUT_OF_MEMORY;
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
backend->ssl_write_buffered_length = 0UL; /* reset buffered write length */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* check to see if we've been told to use an explicit SSL/TLS version */
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
if(SSLSetProtocolVersionMax != NULL) {
proxy: Support HTTPS proxy and SOCKS+HTTP(s) * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-16 12:49:15 -05:00
switch(conn->ssl_config.version) {
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
case CURL_SSLVERSION_TLSv1:
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionMin(backend->ssl_ctx, kTLSProtocol1);
darwinssl: allow High Sierra users to build the code using GCC ...but GCC users lose out on TLS 1.3 support, since we can't weak-link enumeration constants. Fixes #2656 Closes #2703
2018-07-01 15:05:50 -04:00
#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionMax(backend->ssl_ctx, kTLSProtocol13);
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
}
else {
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionMax(backend->ssl_ctx, kTLSProtocol12);
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
}
#else
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionMax(backend->ssl_ctx, kTLSProtocol12);
darwinssl: allow High Sierra users to build the code using GCC ...but GCC users lose out on TLS 1.3 support, since we can't weak-link enumeration constants. Fixes #2656 Closes #2703
2018-07-01 15:05:50 -04:00
#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
HAVE_BUILTIN_AVAILABLE == 1 */
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
darwinssl: accept setting max-tls with default min-tls Reported-by: Andrei Neculau Fixes #3367 Closes #3373
2018-12-13 03:09:28 -05:00
case CURL_SSLVERSION_DEFAULT:
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
case CURL_SSLVERSION_TLSv1_0:
case CURL_SSLVERSION_TLSv1_1:
case CURL_SSLVERSION_TLSv1_2:
case CURL_SSLVERSION_TLSv1_3:
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
{
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
CURLcode result = set_ssl_version_min_max(data, conn, sockindex);
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
if(result != CURLE_OK)
return result;
break;
}
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
case CURL_SSLVERSION_SSLv3:
case CURL_SSLVERSION_SSLv2:
vtls: refuse setting any SSL version ... previously they were supported if a TLS library would (unexpectedly) still support them, but from this change they will be refused already in curl_easy_setopt(). SSLv2 and SSLv3 have been known to be insecure for many years now. Closes #6773
2021-03-22 08:39:37 -04:00
failf(data, "SSL versions not supported");
return CURLE_NOT_BUILT_IN;
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
default:
failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
return CURLE_SSL_CONNECT_ERROR;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
}
}
else {
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_SUPPORT_MAC_10_8
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
kSSLProtocolAll,
false);
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(conn->ssl_config.version) {
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
kTLSProtocol1,
true);
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
kTLSProtocol11,
true);
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
kTLSProtocol12,
true);
break;
SSL: protocol version can be specified more precisely CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, CURL_SSLVERSION_TLSv1_2 enum values are added to force exact TLS version (CURL_SSLVERSION_TLSv1 means TLS 1.x). axTLS: axTLS only supports TLS 1.0 and 1.1 but it cannot be set that only one of these should be used, so we don't allow the new enum values. darwinssl: Added support for the new enum values. SChannel: Added support for the new enum values. CyaSSL: Added support for the new enum values. Bug: The original CURL_SSLVERSION_TLSv1 value enables only TLS 1.0 (it did the same before this commit), because CyaSSL cannot be configured to use TLS 1.0-1.2. GSKit: GSKit doesn't seem to support TLS 1.1 and TLS 1.2, so we do not allow those values. Bugfix: There was a typo that caused wrong SSL versions to be passed to GSKit. NSS: TLS minor version cannot be set, so we don't allow the new enum values. QsoSSL: TLS minor version cannot be set, so we don't allow the new enum values. OpenSSL: Added support for the new enum values. Bugfix: The original CURL_SSLVERSION_TLSv1 value enabled only TLS 1.0, now it enables 1.0-1.2. Command-line tool: Added command line options for the new values.
2013-09-19 09:17:13 -04:00
case CURL_SSLVERSION_TLSv1_0:
case CURL_SSLVERSION_TLSv1_1:
case CURL_SSLVERSION_TLSv1_2:
vtls: support TLS 1.3 via CURL_SSLVERSION_TLSv1_3 Fully implemented with the NSS backend only for now. Reviewed-by: Ray Satiro
2016-10-27 08:57:11 -04:00
case CURL_SSLVERSION_TLSv1_3:
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
{
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
CURLcode result = set_ssl_version_min_max(data, conn, sockindex);
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
if(result != CURLE_OK)
return result;
break;
}
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
case CURL_SSLVERSION_SSLv3:
case CURL_SSLVERSION_SSLv2:
vtls: refuse setting any SSL version ... previously they were supported if a TLS library would (unexpectedly) still support them, but from this change they will be refused already in curl_easy_setopt(). SSLv2 and SSLv3 have been known to be insecure for many years now. Closes #6773
2021-03-22 08:39:37 -04:00
failf(data, "SSL versions not supported");
return CURLE_NOT_BUILT_IN;
vtls: Fail on unrecognized param for CURLOPT_SSLVERSION - Fix GnuTLS code for CURL_SSLVERSION_TLSv1_2 that broke when the TLS 1.3 support was added in 6ad3add. - Homogenize across code for all backends the error message when TLS 1.3 is not available to "<backend>: TLS 1.3 is not yet supported". - Return an error when a user-specified ssl version is unrecognized. --- Prior to this change our code for some of the backends used the 'default' label in the switch statement (ie ver unrecognized) for ssl.version and treated it the same as CURL_SSLVERSION_DEFAULT. Bug: https://curl.haxx.se/mail/lib-2016-11/0048.html Reported-by: Kamil Dudka
2016-11-07 21:51:27 -05:00
default:
failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
return CURLE_SSL_CONNECT_ERROR;
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
}
#endif /* CURL_SUPPORT_MAC_10_8 */
}
#else
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
if(conn->ssl_config.version_max != CURL_SSLVERSION_MAX_NONE) {
failf(data, "Your version of the OS does not support to set maximum"
" SSL/TLS version");
return CURLE_SSL_CONNECT_ERROR;
}
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionEnabled(backend->ssl_ctx, kSSLProtocolAll, false);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
switch(conn->ssl_config.version) {
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
case CURL_SSLVERSION_TLSv1_0:
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLSetProtocolVersionEnabled(backend->ssl_ctx,
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
kTLSProtocol1,
true);
break;
case CURL_SSLVERSION_TLSv1_1:
failf(data, "Your version of the OS does not support TLSv1.1");
return CURLE_SSL_CONNECT_ERROR;
case CURL_SSLVERSION_TLSv1_2:
failf(data, "Your version of the OS does not support TLSv1.2");
return CURLE_SSL_CONNECT_ERROR;
case CURL_SSLVERSION_TLSv1_3:
failf(data, "Your version of the OS does not support TLSv1.3");
return CURLE_SSL_CONNECT_ERROR;
case CURL_SSLVERSION_SSLv2:
case CURL_SSLVERSION_SSLv3:
vtls: refuse setting any SSL version ... previously they were supported if a TLS library would (unexpectedly) still support them, but from this change they will be refused already in curl_easy_setopt(). SSLv2 and SSLv3 have been known to be insecure for many years now. Closes #6773
2021-03-22 08:39:37 -04:00
failf(data, "SSL versions not supported");
return CURLE_NOT_BUILT_IN;
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
default:
failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
return CURLE_SSL_CONNECT_ERROR;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
if(conn->bits.tls_enable_alpn) {
sectransp: tvOS 11 is required for ALPN support Reported-by: nianxuejie on github Assisted-by: Nick Zitzmann Assisted-by: Jay Satiro Fixes #3689 Closes #3690
2019-03-19 05:19:40 -04:00
if(__builtin_available(macOS 10.13.4, iOS 11, tvOS 11, *)) {
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
CFMutableArrayRef alpnArr = CFArrayCreateMutable(NULL, 0,
&kCFTypeArrayCallBacks);
tls: add USE_HTTP2 define This abstracts across the two HTTP/2 backends: nghttp2 and Hyper. Add our own define for the "h2" ALPN protocol, so TLS backends can use it without depending on a specific HTTP backend. Closes #6959
2021-04-24 21:05:15 -04:00
#ifdef USE_HTTP2
TLS: fix HTTP/2 selection for GnuTLS, BearSSL, mbedTLS, NSS, SChannnel, Secure Transport and wolfSSL... Regression since 88dd1a8a115b1f5ece (shipped in 7.76.0) Reported-by: Kenneth Davidson Reported-by: romamik om github Fixes #6825 Closes #6827
2021-04-01 10:25:19 -04:00
if(data->state.httpwant >= CURL_HTTP_VERSION_2
sectransp: make it build with --disable-proxy Follow-up from #5466 and f3d501dc678d80 Reported-by: Javier Navarro Fixes #6025 Closes #6026
2020-09-30 03:12:49 -04:00
#ifndef CURL_DISABLE_PROXY
vtls: add 'isproxy' argument to Curl_ssl_get/addsessionid() To make sure we set and extract the correct session. Reported-by: Mingtao Yang Bug: https://curl.se/docs/CVE-2021-22890.html CVE-2021-22890
2021-03-19 07:38:49 -04:00
&& (!isproxy || !conn->bits.tunnel_proxy)
sectransp: make it build with --disable-proxy Follow-up from #5466 and f3d501dc678d80 Reported-by: Javier Navarro Fixes #6025 Closes #6026
2020-09-30 03:12:49 -04:00
#endif
) {
tls: add USE_HTTP2 define This abstracts across the two HTTP/2 backends: nghttp2 and Hyper. Add our own define for the "h2" ALPN protocol, so TLS backends can use it without depending on a specific HTTP backend. Closes #6959
2021-04-24 21:05:15 -04:00
CFArrayAppendValue(alpnArr, CFSTR(ALPN_H2));
infof(data, "ALPN, offering %s\n", ALPN_H2);
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
}
#endif
CFArrayAppendValue(alpnArr, CFSTR(ALPN_HTTP_1_1));
infof(data, "ALPN, offering %s\n", ALPN_HTTP_1_1);
/* expects length prefixed preference ordered list of protocols in wire
* format
*/
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLSetALPNProtocols(backend->ssl_ctx, alpnArr);
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
if(err != noErr)
infof(data, "WARNING: failed to set ALPN protocols; OSStatus %d\n",
err);
CFRelease(alpnArr);
}
}
#endif
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
if(SSL_SET_OPTION(key)) {
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
infof(data, "WARNING: SSL: CURLOPT_SSLKEY is ignored by Secure "
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
"Transport. The private key must be in the Keychain.\n");
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
}
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
if(ssl_cert || ssl_cert_blob) {
bool is_cert_data = ssl_cert_blob != NULL;
bool is_cert_file = (!is_cert_data) && is_file(ssl_cert);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
SecIdentityRef cert_and_key = NULL;
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
/* User wants to authenticate with a client cert. Look for it:
If we detect that this is a file on disk, then let's load it.
Otherwise, assume that the user wants to use an identity loaded
from the Keychain. */
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
if(is_cert_file || is_cert_data) {
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
if(!SSL_SET_OPTION(cert_type))
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
infof(data, "WARNING: SSL: Certificate type not set, assuming "
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
"PKCS#12 format.\n");
else if(strncmp(SSL_SET_OPTION(cert_type), "P12",
strlen(SSL_SET_OPTION(cert_type))) != 0)
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
infof(data, "WARNING: SSL: The Security framework only supports "
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
"loading identities that are in PKCS#12 format.\n");
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
err = CopyIdentityFromPKCS12File(ssl_cert, ssl_cert_blob,
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
SSL_SET_OPTION(key_passwd), &cert_and_key);
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
}
else
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
err = CopyIdentityWithLabel(ssl_cert, &cert_and_key);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
darwinssl: Fix exception when processing a client-side certificate file if no error was raised by the API but the SecIdentityRef was null Fixes #1450
2017-05-16 20:21:12 -04:00
if(err == noErr && cert_and_key) {
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
SecCertificateRef cert = NULL;
CFTypeRef certs_c[1];
CFArrayRef certs;
/* If we found one, print it out: */
err = SecIdentityCopyCertificate(cert_and_key, &cert);
if(err == noErr) {
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
char *certp;
CURLcode result = CopyCertSubject(data, cert, &certp);
if(!result) {
infof(data, "Client certificate: %s\n", certp);
free(certp);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
}
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
CFRelease(cert);
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
if(result == CURLE_PEER_FAILED_VERIFICATION)
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_SSL_CERTPROBLEM;
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
if(result)
return result;
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
}
certs_c[0] = cert_and_key;
certs = CFArrayCreate(NULL, (const void **)certs_c, 1L,
&kCFTypeArrayCallBacks);
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLSetCertificate(backend->ssl_ctx, certs);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
if(certs)
CFRelease(certs);
if(err != noErr) {
failf(data, "SSL: SSLSetCertificate() failed: OSStatus %d", err);
return CURLE_SSL_CERTPROBLEM;
}
CFRelease(cert_and_key);
}
else {
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
const char *cert_showfilename_error =
is_cert_data ? "(memory blob)" : ssl_cert;
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
switch(err) {
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
case errSecAuthFailed: case -25264: /* errSecPkcs12VerifyFailure */
failf(data, "SSL: Incorrect password for the certificate \"%s\" "
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
"and its private key.", cert_showfilename_error);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
case -26275: /* errSecDecode */ case -25257: /* errSecUnknownFormat */
failf(data, "SSL: Couldn't make sense of the data in the "
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
"certificate \"%s\" and its private key.",
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
cert_showfilename_error);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
case -25260: /* errSecPassphraseRequired */
failf(data, "SSL The certificate \"%s\" requires a password.",
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
cert_showfilename_error);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
case errSecItemNotFound:
failf(data, "SSL: Can't find the certificate \"%s\" and its private "
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
"key in the Keychain.", cert_showfilename_error);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
default:
failf(data, "SSL: Can't load the certificate \"%s\" and its private "
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
"key: OSStatus %d", cert_showfilename_error, err);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
}
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
return CURLE_SSL_CERTPROBLEM;
}
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* SSL always tries to verify the peer, this only says whether it should
* fail to connect if the verification fails, or if it should continue
* anyway. In the latter case the result of the verification is checked with
* SSL_get_verify_result() below. */
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
/* Snow Leopard introduced the SSLSetSessionOption() function, but due to
a library bug with the way the kSSLSessionOptionBreakOnServerAuth flag
darwinssl: fix certificate verification disable on OS X 10.8 The new way of disabling certificate verification doesn't work on Mountain Lion (OS X 10.8) so we need to use the old way in that version too. I've tested this solution on versions 10.7.5, 10.8, 10.9, 10.10.2 and 10.11. Closes #802
2016-05-12 06:16:16 -04:00
works, it doesn't work as expected under Snow Leopard, Lion or
Mountain Lion.
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
So we need to call SSLSetEnableCertVerify() on those older cats in order
to disable certificate validation if the user turned that off.
(SecureTransport will always validate the certificate chain by
darwinssl: fix certificate verification disable on OS X 10.8 The new way of disabling certificate verification doesn't work on Mountain Lion (OS X 10.8) so we need to use the old way in that version too. I've tested this solution on versions 10.7.5, 10.8, 10.9, 10.10.2 and 10.11. Closes #802
2016-05-12 06:16:16 -04:00
default.)
Note:
Darwin 11.x.x is Lion (10.7)
Darwin 12.x.x is Mountain Lion (10.8)
darwinssl.c: fix OS X codename typo in comment
2016-05-13 03:25:54 -04:00
Darwin 13.x.x is Mavericks (10.9)
darwinssl: fix certificate verification disable on OS X 10.8 The new way of disabling certificate verification doesn't work on Mountain Lion (OS X 10.8) so we need to use the old way in that version too. I've tested this solution on versions 10.7.5, 10.8, 10.9, 10.10.2 and 10.11. Closes #802
2016-05-12 06:16:16 -04:00
Darwin 14.x.x is Yosemite (10.10)
Darwin 15.x.x is El Capitan (10.11)
*/
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC
darwinssl: fix certificate verification disable on OS X 10.8 The new way of disabling certificate verification doesn't work on Mountain Lion (OS X 10.8) so we need to use the old way in that version too. I've tested this solution on versions 10.7.5, 10.8, 10.9, 10.10.2 and 10.11. Closes #802
2016-05-12 06:16:16 -04:00
if(SSLSetSessionOption != NULL && darwinver_maj >= 13) {
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
#else
if(SSLSetSessionOption != NULL) {
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC */
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
bool break_on_auth = !conn->ssl_config.verifypeer ||
ssl_cafile || ssl_cablob;
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLSetSessionOption(backend->ssl_ctx,
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
kSSLSessionOptionBreakOnServerAuth,
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
break_on_auth);
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
if(err != noErr) {
failf(data, "SSL: SSLSetSessionOption() failed: OSStatus %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
}
else {
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_SUPPORT_MAC_10_8
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLSetEnableCertVerify(backend->ssl_ctx,
proxy: Support HTTPS proxy and SOCKS+HTTP(s) * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-16 12:49:15 -05:00
conn->ssl_config.verifypeer?true:false);
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
if(err != noErr) {
failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_SUPPORT_MAC_10_8 */
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
}
#else
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLSetEnableCertVerify(backend->ssl_ctx,
proxy: Support HTTPS proxy and SOCKS+HTTP(s) * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-16 12:49:15 -05:00
conn->ssl_config.verifypeer?true:false);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
if((ssl_cafile || ssl_cablob) && verifypeer) {
bool is_cert_data = ssl_cablob != NULL;
bool is_cert_file = (!is_cert_data) && is_file(ssl_cafile);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
setopt: support certificate options in memory with struct curl_blob This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
2020-05-15 04:47:46 -04:00
if(!(is_cert_file || is_cert_data)) {
SSL: support in-memory CA certs for some backends - New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to specify in-memory PEM certificates for OpenSSL, Schannel (Windows) and Secure Transport (Apple) SSL backends. Prior to this change PEM certificates could only be imported from a file and not from memory. Co-authored-by: moparisthebest@users.noreply.github.com Ref: https://github.com/curl/curl/pull/4679 Ref: https://github.com/curl/curl/pull/5677 Ref: https://github.com/curl/curl/pull/6109 Closes https://github.com/curl/curl/pull/6662
2020-07-12 21:17:56 -04:00
failf(data, "SSL: can't load CA certificate file %s",
ssl_cafile ? ssl_cafile : "(blob memory)");
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return CURLE_SSL_CACERT_BADFILE;
}
}
Don't omit CN verification in DarwinSSL when an IP address is used.
2014-02-23 10:35:30 -05:00
/* Configure hostname check. SNI is used if available.
* Both hostname check and SNI require SSLSetPeerDomainName().
SSL: Several SSL-backend related fixes axTLS: This will make the axTLS backend perform the RFC2818 checks, honoring the VERIFYHOST setting similar to the OpenSSL backend. Generic for OpenSSL and axTLS: Move the hostcheck and cert_hostcheck functions from the lib/ssluse.c files to make them genericly available for both the OpenSSL, axTLS and other SSL backends. They are now in the new lib/hostcheck.c file. CyaSSL: CyaSSL now also has the RFC2818 checks enabled by default. There is a limitation that the verifyhost can not be enabled exclusively on the Subject CN field comparison. This SSL backend will thus behave like the NSS and the GnuTLS (meaning: RFC2818 ok, or bust). In other words: setting verifyhost to 0 or 1 will disable the Subject Alt Names checks too. Schannel: Updated the schannel information messages: Split the IP address usage message from the verifyhost setting and changed the message about disabling SNI (Server Name Indication, used in HTTP virtual hosting) into a message stating that the Subject Alternative Names checks are being disabled when verifyhost is set to 0 or 1. As a side effect of switching off the RFC2818 related servername checks with SCH_CRED_NO_SERVERNAME_CHECK (http://msdn.microsoft.com/en-us/library/aa923430.aspx) the SNI feature is being disabled. This effect is not documented in MSDN, but Wireshark output clearly shows the effect (details on the libcurl maillist). PolarSSL: Fix the prototype change in PolarSSL of ssl_set_session() and the move of the peer_cert from the ssl_context to the ssl_session. Found this change in the PolarSSL SVN between r1316 and r1317 where the POLARSSL_VERSION_NUMBER was at 0x01010100. But to accommodate the Ubuntu PolarSSL version 1.1.4 the check is to discriminate between lower then PolarSSL version 1.2.0 and 1.2.0 and higher. Note: The PolarSSL SVN trunk jumped from version 1.1.1 to 1.2.0. Generic: All the SSL backends are fixed and checked to work with the ssl.verifyhost as a boolean, which is an internal API change.
2012-11-02 21:06:51 -04:00
* Also: the verifyhost setting influences SNI usage */
proxy: Support HTTPS proxy and SOCKS+HTTP(s) * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-16 12:49:15 -05:00
if(conn->ssl_config.verifyhost) {
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLSetPeerDomainName(backend->ssl_ctx, hostname,
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
strlen(hostname));
Don't omit CN verification in DarwinSSL when an IP address is used.
2014-02-23 10:35:30 -05:00
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
darwinssl: added LFs to some strings passed into infof() (This doesn't need to appear in the release notes.) I noticed a few places where infof() was called, and there should've been an LF at the end of the string, but there wasn't.
2013-07-30 22:32:18 -04:00
infof(data, "WARNING: SSL: SSLSetPeerDomainName() failed: OSStatus %d\n",
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
err);
}
Don't omit CN verification in DarwinSSL when an IP address is used.
2014-02-23 10:35:30 -05:00
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
if((Curl_inet_pton(AF_INET, hostname, &addr))
Don't omit CN verification in DarwinSSL when an IP address is used.
2014-02-23 10:35:30 -05:00
#ifdef ENABLE_IPV6
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
|| (Curl_inet_pton(AF_INET6, hostname, &addr))
Don't omit CN verification in DarwinSSL when an IP address is used.
2014-02-23 10:35:30 -05:00
#endif
) {
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
infof(data, "WARNING: using IP address, SNI is being disabled by "
"the OS.\n");
Don't omit CN verification in DarwinSSL when an IP address is used.
2014-02-23 10:35:30 -05:00
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
darwinssl: Warn that disabling host verify also disables SNI In DarwinSSL the SSLSetPeerDomainName function is used to enable both sending SNI and verifying the host. When host verification is disabled the function cannot be called, therefore SNI is disabled as well. Closes https://github.com/curl/curl/pull/1240
2017-02-02 16:40:16 -05:00
else {
infof(data, "WARNING: disabling hostname validation also disables SNI.\n");
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
ciphers = SSL_CONN_CONFIG(cipher_list);
if(ciphers) {
err = sectransp_set_selected_ciphers(data, backend->ssl_ctx, ciphers);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
}
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
else {
err = sectransp_set_default_ciphers(data, backend->ssl_ctx);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
}
if(err != noErr) {
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
failf(data, "SSL: Unable to set ciphers for SSL/TLS handshake. "
"Error code: %d", err);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_SSL_CIPHER;
}
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
darwinssl: enable BEAST workaround on iOS 7 & later iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 and a CBC cipher, so we now always turn that on unless the user manually turns it off using CURLSSLOPT_ALLOW_BEAST. It appears Apple also added some new PSK ciphers, but no interface to use them yet, so we at least support printing them if we find them.
2013-09-19 18:28:54 -04:00
#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
/* We want to enable 1/n-1 when using a CBC cipher unless the user
specifically doesn't want us doing that: */
darwinsssl: add support for TLS False Start TLS False Start support requires iOS 7.0 or later, or OS X 10.9 or later.
2015-03-21 13:22:56 -04:00
if(SSLSetSessionOption != NULL) {
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
SSLSetSessionOption(backend->ssl_ctx, kSSLSessionOptionSendOneByteRecord,
schannel: Evaluate CURLOPT_SSL_OPTIONS via SSL_SET_OPTION macro - Change use of those options from CURLOPT_SSL_OPTIONS that are not already evaluated via SSL_SET_OPTION in schannel and secure transport to use that instead of data->set.ssl.optname. Example: Evaluate SSL_SET_OPTION(no_revoke) instead of data->set.ssl.no_revoke. This change is because options set via CURLOPT_SSL_OPTIONS (data->set.ssl.optname) are separate from those set for HTTPS proxy via CURLOPT_PROXY_SSL_OPTIONS (data->set.proxy_ssl.optname). The SSL_SET_OPTION macro determines whether the connection is for HTTPS proxy and based on that which option to evaluate. Since neither Schannel nor Secure Transport backends currently support HTTPS proxy in libcurl, this change is for posterity and has no other effect. Closes https://github.com/curl/curl/pull/6690
2021-03-04 03:02:38 -05:00
!SSL_SET_OPTION(enable_beast));
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
SSLSetSessionOption(backend->ssl_ctx, kSSLSessionOptionFalseStart,
darwinsssl: add support for TLS False Start TLS False Start support requires iOS 7.0 or later, or OS X 10.9 or later.
2015-03-21 13:22:56 -04:00
data->set.ssl.falsestart); /* false start support */
}
darwinssl: enable BEAST workaround on iOS 7 & later iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 and a CBC cipher, so we now always turn that on unless the user manually turns it off using CURLSSLOPT_ALLOW_BEAST. It appears Apple also added some new PSK ciphers, but no interface to use them yet, so we at least support printing them if we find them.
2013-09-19 18:28:54 -04:00
#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
darwinssl: add TLS session resumption This ought to speed up additional TLS handshakes, at least in theory.
2013-04-12 14:20:10 -04:00
/* Check if there's a cached ID we can/should use here! */
TLS: Fix switching off SSL session id when client cert is used Move the sessionid flag to ssl_primary_config so that ssl and proxy_ssl will each have their own sessionid flag. Regression since HTTPS-Proxy support was added in cb4e2be. Prior to that this issue had been fixed in 247d890, CVE-2016-5419. Bug: https://github.com/curl/curl/issues/1341 Reported-by: lijian996@users.noreply.github.com The new incarnation of this bug is called CVE-2017-7468 and is documented here: https://curl.haxx.se/docs/adv_20170419.html
2017-03-22 01:59:49 -04:00
if(SSL_SET_OPTION(primary.sessionid)) {
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
char *ssl_sessionid;
size_t ssl_sessionid_len;
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
Curl_ssl_sessionid_lock(data);
vtls: add 'isproxy' argument to Curl_ssl_get/addsessionid() To make sure we set and extract the correct session. Reported-by: Mingtao Yang Bug: https://curl.se/docs/CVE-2021-22890.html CVE-2021-22890
2021-03-19 07:38:49 -04:00
if(!Curl_ssl_getsessionid(data, conn, isproxy, (void **)&ssl_sessionid,
proxy: Support HTTPS proxy and SOCKS+HTTP(s) * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-16 12:49:15 -05:00
&ssl_sessionid_len, sockindex)) {
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
/* we got a session id, use it! */
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLSetPeerID(backend->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
Curl_ssl_sessionid_unlock(data);
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
if(err != noErr) {
failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
/* Informational message */
infof(data, "SSL re-using session ID\n");
darwinssl: add TLS session resumption This ought to speed up additional TLS handshakes, at least in theory.
2013-04-12 14:20:10 -04:00
}
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
/* If there isn't one, then let's make one up! This has to be done prior
to starting the handshake. */
else {
CURLcode result;
ssl_sessionid =
SSL: support in-memory CA certs for some backends - New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to specify in-memory PEM certificates for OpenSSL, Schannel (Windows) and Secure Transport (Apple) SSL backends. Prior to this change PEM certificates could only be imported from a file and not from memory. Co-authored-by: moparisthebest@users.noreply.github.com Ref: https://github.com/curl/curl/pull/4679 Ref: https://github.com/curl/curl/pull/5677 Ref: https://github.com/curl/curl/pull/6109 Closes https://github.com/curl/curl/pull/6662
2020-07-12 21:17:56 -04:00
aprintf("%s:%d:%d:%s:%ld",
ssl_cafile ? ssl_cafile : "(blob memory)",
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
verifypeer, SSL_CONN_CONFIG(verifyhost), hostname, port);
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
ssl_sessionid_len = strlen(ssl_sessionid);
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLSetPeerID(backend->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
if(err != noErr) {
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
Curl_ssl_sessionid_unlock(data);
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
vtls: add 'isproxy' argument to Curl_ssl_get/addsessionid() To make sure we set and extract the correct session. Reported-by: Mingtao Yang Bug: https://curl.se/docs/CVE-2021-22890.html CVE-2021-22890
2021-03-19 07:38:49 -04:00
result = Curl_ssl_addsessionid(data, conn, isproxy, ssl_sessionid,
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
ssl_sessionid_len, sockindex);
Curl_ssl_sessionid_unlock(data);
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
if(result) {
failf(data, "failed to store ssl session");
return result;
}
darwinssl: add TLS session resumption This ought to speed up additional TLS handshakes, at least in theory.
2013-04-12 14:20:10 -04:00
}
}
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLSetIOFuncs(backend->ssl_ctx, SocketRead, SocketWrite);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
failf(data, "SSL: SSLSetIOFuncs() failed: OSStatus %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
/* pass the raw socket into the SSL layers */
/* We need to store the FD in a constant memory address, because
* SSLSetConnection() will not copy that address. I've found that
* conn->sock[sockindex] may change on its own. */
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
backend->ssl_sockfd = sockfd;
err = SSLSetConnection(backend->ssl_ctx, connssl);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
failf(data, "SSL: SSLSetConnection() failed: %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
connssl->connecting_state = ssl_connect_2;
return CURLE_OK;
}
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
static long pem_to_der(const char *in, unsigned char **out, size_t *outlen)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
{
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
char *sep_start, *sep_end, *cert_start, *cert_end;
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
size_t i, j, err;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
size_t len;
unsigned char *b64;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
/* Jump through the separators at the beginning of the certificate. */
sep_start = strstr(in, "-----");
tidy-up: make conditional checks more consistent ... remove '== NULL' and '!= 0' Closes #6912
2021-04-19 04:46:11 -04:00
if(!sep_start)
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
return 0;
cert_start = strstr(sep_start + 1, "-----");
tidy-up: make conditional checks more consistent ... remove '== NULL' and '!= 0' Closes #6912
2021-04-19 04:46:11 -04:00
if(!cert_start)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return -1;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
cert_start += 5;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
/* Find separator after the end of the certificate. */
cert_end = strstr(cert_start, "-----");
tidy-up: make conditional checks more consistent ... remove '== NULL' and '!= 0' Closes #6912
2021-04-19 04:46:11 -04:00
if(!cert_end)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return -1;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
sep_end = strstr(cert_end + 1, "-----");
tidy-up: make conditional checks more consistent ... remove '== NULL' and '!= 0' Closes #6912
2021-04-19 04:46:11 -04:00
if(!sep_end)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return -1;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
sep_end += 5;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
len = cert_end - cert_start;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
b64 = malloc(len + 1);
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
if(!b64)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return -1;
/* Create base64 string without linefeeds. */
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
for(i = 0, j = 0; i < len; i++) {
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
if(cert_start[i] != '\r' && cert_start[i] != '\n')
b64[j++] = cert_start[i];
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
b64[j] = '\0';
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
err = Curl_base64_decode((const char *)b64, out, outlen);
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
free(b64);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(err) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
free(*out);
return -1;
}
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
return sep_end - in;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
static int read_cert(const char *file, unsigned char **out, size_t *outlen)
{
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
int fd;
ssize_t n, len = 0, cap = 512;
darwinssi: fix error: variable length array used
2017-08-16 01:58:44 -04:00
unsigned char buf[512], *data;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
fd = open(file, 0);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(fd < 0)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return -1;
data = malloc(cap);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(!data) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
close(fd);
return -1;
}
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
for(;;) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
n = read(fd, buf, sizeof(buf));
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(n < 0) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
close(fd);
free(data);
return -1;
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
}
else if(n == 0) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
close(fd);
break;
}
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(len + n >= cap) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
cap *= 2;
darwinssl: Fix realloc memleak The reallocation was using the input pointer for the return value, which leads to a memory leak on reallication failure. Fix by instead use the safe internal API call Curl_saferealloc(). Closes #3005 Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Nick Zitzmann <nickzman@gmail.com>
2018-09-18 03:06:07 -04:00
data = Curl_saferealloc(data, cap);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(!data) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
close(fd);
return -1;
}
}
memcpy(data + len, buf, n);
len += n;
}
data[len] = '\0';
*out = data;
*outlen = len;
return 0;
}
internals: rename the SessionHandle struct to Curl_easy
2016-06-21 09:47:12 -04:00
static int append_cert_to_array(struct Curl_easy *data,
SSL: support in-memory CA certs for some backends - New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to specify in-memory PEM certificates for OpenSSL, Schannel (Windows) and Secure Transport (Apple) SSL backends. Prior to this change PEM certificates could only be imported from a file and not from memory. Co-authored-by: moparisthebest@users.noreply.github.com Ref: https://github.com/curl/curl/pull/4679 Ref: https://github.com/curl/curl/pull/5677 Ref: https://github.com/curl/curl/pull/6109 Closes https://github.com/curl/curl/pull/6662
2020-07-12 21:17:56 -04:00
const unsigned char *buf, size_t buflen,
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
CFMutableArrayRef array)
{
CFDataRef certdata = CFDataCreate(kCFAllocatorDefault, buf, buflen);
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
char *certp;
CURLcode result;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
if(!certdata) {
failf(data, "SSL: failed to allocate array for CA certificate");
return CURLE_OUT_OF_MEMORY;
}
SecCertificateRef cacert =
SecCertificateCreateWithData(kCFAllocatorDefault, certdata);
CFRelease(certdata);
if(!cacert) {
failf(data, "SSL: failed to create SecCertificate from CA certificate");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_SSL_CACERT_BADFILE;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
}
Check CA certificate in curl_darwinssl.c. SecCertificateCreateWithData() returns a non-NULL SecCertificateRef even if the buffer holds an invalid or corrupt certificate. Call SecCertificateCopyPublicKey() to make sure cacert is a valid certificate.
2014-08-31 18:17:25 -04:00
/* Check if cacert is valid. */
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
result = CopyCertSubject(data, cacert, &certp);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
switch(result) {
case CURLE_OK:
break;
ssl: deprecate CURLE_SSL_CACERT in favour of a unified error code Long live CURLE_PEER_FAILED_VERIFICATION
2018-08-22 14:13:32 -04:00
case CURLE_PEER_FAILED_VERIFICATION:
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_SSL_CACERT_BADFILE;
case CURLE_OUT_OF_MEMORY:
default:
return result;
}
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
free(certp);
Check CA certificate in curl_darwinssl.c. SecCertificateCreateWithData() returns a non-NULL SecCertificateRef even if the buffer holds an invalid or corrupt certificate. Call SecCertificateCopyPublicKey() to make sure cacert is a valid certificate.
2014-08-31 18:17:25 -04:00
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
CFArrayAppendValue(array, cacert);
CFRelease(cacert);
return CURLE_OK;
}
SSL: support in-memory CA certs for some backends - New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to specify in-memory PEM certificates for OpenSSL, Schannel (Windows) and Secure Transport (Apple) SSL backends. Prior to this change PEM certificates could only be imported from a file and not from memory. Co-authored-by: moparisthebest@users.noreply.github.com Ref: https://github.com/curl/curl/pull/4679 Ref: https://github.com/curl/curl/pull/5677 Ref: https://github.com/curl/curl/pull/6109 Closes https://github.com/curl/curl/pull/6662
2020-07-12 21:17:56 -04:00
static CURLcode verify_cert_buf(struct Curl_easy *data,
const unsigned char *certbuf, size_t buflen,
SSLContextRef ctx)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
{
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
int n = 0, rc;
long res;
SSL: support in-memory CA certs for some backends - New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to specify in-memory PEM certificates for OpenSSL, Schannel (Windows) and Secure Transport (Apple) SSL backends. Prior to this change PEM certificates could only be imported from a file and not from memory. Co-authored-by: moparisthebest@users.noreply.github.com Ref: https://github.com/curl/curl/pull/4679 Ref: https://github.com/curl/curl/pull/5677 Ref: https://github.com/curl/curl/pull/6109 Closes https://github.com/curl/curl/pull/6662
2020-07-12 21:17:56 -04:00
unsigned char *der;
size_t derlen, offset = 0;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
/*
* Certbuf now contains the contents of the certificate file, which can be
* - a single DER certificate,
* - a single PEM certificate or
* - a bunch of PEM certificates (certificate bundle).
*
* Go through certbuf, and convert any PEM certificate in it into DER
* format.
*/
CFMutableArrayRef array = CFArrayCreateMutable(kCFAllocatorDefault, 0,
&kCFTypeArrayCallBacks);
tidy-up: make conditional checks more consistent ... remove '== NULL' and '!= 0' Closes #6912
2021-04-19 04:46:11 -04:00
if(!array) {
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
failf(data, "SSL: out of memory creating CA certificate array");
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return CURLE_OUT_OF_MEMORY;
}
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
while(offset < buflen) {
n++;
/*
* Check if the certificate is in PEM format, and convert it to DER. If
* this fails, we assume the certificate is in DER format.
*/
res = pem_to_der((const char *)certbuf + offset, &der, &derlen);
if(res < 0) {
CFRelease(array);
infof/failf calls: fix format specifiers Update a few format specifiers to match what is being printed. Closes #6241
2020-11-23 16:42:07 -05:00
failf(data, "SSL: invalid CA certificate #%d (offset %zu) in bundle",
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
n, offset);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_SSL_CACERT_BADFILE;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
}
offset += res;
if(res == 0 && offset == 0) {
/* This is not a PEM file, probably a certificate in DER format. */
rc = append_cert_to_array(data, certbuf, buflen, array);
if(rc != CURLE_OK) {
CFRelease(array);
return rc;
}
break;
}
else if(res == 0) {
/* No more certificates in the bundle. */
break;
}
rc = append_cert_to_array(data, der, derlen, array);
free(der);
if(rc != CURLE_OK) {
CFRelease(array);
return rc;
}
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
SecTrustRef trust;
OSStatus ret = SSLCopyPeerTrust(ctx, &trust);
tidy-up: make conditional checks more consistent ... remove '== NULL' and '!= 0' Closes #6912
2021-04-19 04:46:11 -04:00
if(!trust) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
failf(data, "SSL: error getting certificate chain");
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
CFRelease(array);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
}
else if(ret != noErr) {
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
CFRelease(array);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
failf(data, "SSLCopyPeerTrust() returned error %d", ret);
return CURLE_PEER_FAILED_VERIFICATION;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
ret = SecTrustSetAnchorCertificates(trust, array);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(ret != noErr) {
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
CFRelease(array);
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
CFRelease(trust);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
failf(data, "SecTrustSetAnchorCertificates() returned error %d", ret);
return CURLE_PEER_FAILED_VERIFICATION;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
ret = SecTrustSetAnchorCertificatesOnly(trust, true);
if(ret != noErr) {
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
CFRelease(array);
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
CFRelease(trust);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
failf(data, "SecTrustSetAnchorCertificatesOnly() returned error %d", ret);
return CURLE_PEER_FAILED_VERIFICATION;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
}
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
SecTrustResultType trust_eval = 0;
ret = SecTrustEvaluate(trust, &trust_eval);
CFRelease(array);
CFRelease(trust);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(ret != noErr) {
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
failf(data, "SecTrustEvaluate() returned error %d", ret);
return CURLE_PEER_FAILED_VERIFICATION;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(trust_eval) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
case kSecTrustResultUnspecified:
case kSecTrustResultProceed:
return CURLE_OK;
case kSecTrustResultRecoverableTrustFailure:
case kSecTrustResultDeny:
default:
failf(data, "SSL: certificate verification failed (result: %d)",
trust_eval);
return CURLE_PEER_FAILED_VERIFICATION;
}
}
SSL: support in-memory CA certs for some backends - New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to specify in-memory PEM certificates for OpenSSL, Schannel (Windows) and Secure Transport (Apple) SSL backends. Prior to this change PEM certificates could only be imported from a file and not from memory. Co-authored-by: moparisthebest@users.noreply.github.com Ref: https://github.com/curl/curl/pull/4679 Ref: https://github.com/curl/curl/pull/5677 Ref: https://github.com/curl/curl/pull/6109 Closes https://github.com/curl/curl/pull/6662
2020-07-12 21:17:56 -04:00
static CURLcode verify_cert(struct Curl_easy *data, const char *cafile,
const struct curl_blob *ca_info_blob,
SSLContextRef ctx)
{
int result;
unsigned char *certbuf;
size_t buflen;
if(ca_info_blob) {
certbuf = (unsigned char *)malloc(ca_info_blob->len + 1);
if(!certbuf) {
return CURLE_OUT_OF_MEMORY;
}
buflen = ca_info_blob->len;
memcpy(certbuf, ca_info_blob->data, ca_info_blob->len);
certbuf[ca_info_blob->len]='\0';
}
else if(cafile) {
if(read_cert(cafile, &certbuf, &buflen) < 0) {
failf(data, "SSL: failed to read or invalid CA certificate");
return CURLE_SSL_CACERT_BADFILE;
}
}
else
return CURLE_SSL_CACERT_BADFILE;
result = verify_cert_buf(data, certbuf, buflen, ctx);
free(certbuf);
return result;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY
darwinssl: fix pinnedpubkey build error - s/SessionHandle/Curl_easy/ Bug: https://github.com/curl/curl/commit/eb16305#commitcomment-23035670 Reported-by: Gisle Vanem
2017-07-17 02:46:07 -04:00
static CURLcode pkp_pin_peer_pubkey(struct Curl_easy *data,
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
SSLContextRef ctx,
const char *pinnedpubkey)
{ /* Scratch */
size_t pubkeylen, realpubkeylen, spkiHeaderLength = 24;
darwin: silence compiler warnings With a clang pragma and three type fixes Fixes #1722
2017-08-03 18:04:39 -04:00
unsigned char *pubkey = NULL, *realpubkey = NULL;
const unsigned char *spkiHeader = NULL;
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
CFDataRef publicKeyBits = NULL;
/* Result is returned to caller */
CURLcode result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
/* if a path wasn't specified, don't pin */
if(!pinnedpubkey)
return CURLE_OK;
if(!ctx)
return result;
do {
SecTrustRef trust;
OSStatus ret = SSLCopyPeerTrust(ctx, &trust);
tidy-up: make conditional checks more consistent ... remove '== NULL' and '!= 0' Closes #6912
2021-04-19 04:46:11 -04:00
if(ret != noErr || !trust)
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
break;
SecKeyRef keyRef = SecTrustCopyPublicKey(trust);
CFRelease(trust);
tidy-up: make conditional checks more consistent ... remove '== NULL' and '!= 0' Closes #6912
2021-04-19 04:46:11 -04:00
if(!keyRef)
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
break;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY_V1
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
publicKeyBits = SecKeyCopyExternalRepresentation(keyRef, NULL);
CFRelease(keyRef);
tidy-up: make conditional checks more consistent ... remove '== NULL' and '!= 0' Closes #6912
2021-04-19 04:46:11 -04:00
if(!publicKeyBits)
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
break;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#elif SECTRANSP_PINNEDPUBKEY_V2
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
OSStatus success = SecItemExport(keyRef, kSecFormatOpenSSL, 0, NULL,
&publicKeyBits);
CFRelease(keyRef);
tidy-up: make conditional checks more consistent ... remove '== NULL' and '!= 0' Closes #6912
2021-04-19 04:46:11 -04:00
if(success != errSecSuccess || !publicKeyBits)
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
break;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* SECTRANSP_PINNEDPUBKEY_V2 */
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
pubkeylen = CFDataGetLength(publicKeyBits);
darwin: silence compiler warnings With a clang pragma and three type fixes Fixes #1722
2017-08-03 18:04:39 -04:00
pubkey = (unsigned char *)CFDataGetBytePtr(publicKeyBits);
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
switch(pubkeylen) {
case 526:
/* 4096 bit RSA pubkeylen == 526 */
spkiHeader = rsa4096SpkiHeader;
break;
case 270:
/* 2048 bit RSA pubkeylen == 270 */
spkiHeader = rsa2048SpkiHeader;
break;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY_V1
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
case 65:
/* ecDSA secp256r1 pubkeylen == 65 */
spkiHeader = ecDsaSecp256r1SpkiHeader;
spkiHeaderLength = 26;
break;
case 97:
/* ecDSA secp384r1 pubkeylen == 97 */
spkiHeader = ecDsaSecp384r1SpkiHeader;
spkiHeaderLength = 23;
break;
default:
infof(data, "SSL: unhandled public key length: %d\n", pubkeylen);
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#elif SECTRANSP_PINNEDPUBKEY_V2
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
default:
/* ecDSA secp256r1 pubkeylen == 91 header already included?
* ecDSA secp384r1 header already included too
* we assume rest of algorithms do same, so do nothing
*/
result = Curl_pin_peer_pubkey(data, pinnedpubkey, pubkey,
pubkeylen);
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* SECTRANSP_PINNEDPUBKEY_V2 */
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
continue; /* break from loop */
}
realpubkeylen = pubkeylen + spkiHeaderLength;
realpubkey = malloc(realpubkeylen);
if(!realpubkey)
break;
memcpy(realpubkey, spkiHeader, spkiHeaderLength);
memcpy(realpubkey + spkiHeaderLength, pubkey, pubkeylen);
result = Curl_pin_peer_pubkey(data, pinnedpubkey, realpubkey,
realpubkeylen);
} while(0);
Curl_safefree(realpubkey);
if(publicKeyBits != NULL)
CFRelease(publicKeyBits);
return result;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* SECTRANSP_PINNEDPUBKEY */
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
static CURLcode
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
sectransp_connect_step2(struct Curl_easy *data, struct connectdata *conn,
int sockindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
struct ssl_backend_data *backend = connssl->backend;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
OSStatus err;
SSLCipherSuite cipher;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
SSLProtocol protocol = 0;
vtls: deduplicate some DISABLE_PROXY ifdefs continue from #5735 - using SSL_HOST_NAME, SSL_HOST_DISPNAME, SSL_PINNED_PUB_KEY for other tls backend - create SSL_HOST_PORT Closes #6660
2021-02-25 14:47:35 -05:00
const char * const hostname = SSL_HOST_NAME();
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
DEBUGASSERT(ssl_connect_2 == connssl->connecting_state
|| ssl_connect_2_reading == connssl->connecting_state
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
|| ssl_connect_2_writing == connssl->connecting_state);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* Here goes nothing: */
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLHandshake(backend->ssl_ctx);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(err) {
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
case errSSLWouldBlock: /* they're not done with us yet */
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
connssl->connecting_state = backend->ssl_direction ?
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
ssl_connect_2_writing : ssl_connect_2_reading;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
return CURLE_OK;
darwinssl: Make certificate errors less techy Previously if a problem was found with one of the server's certificates, we'd log an OSStatus for the end user to look up. Now we explain what was wrong with the site's certificate chain. Also un-did part of the previous commit where the code wouldn't catch errSSLServerAuthCompleted if built under Leopard.
2013-02-08 20:34:11 -05:00
/* The below is errSSLServerAuthCompleted; it's not defined in
Leopard's headers */
case -9841:
SSL: support in-memory CA certs for some backends - New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to specify in-memory PEM certificates for OpenSSL, Schannel (Windows) and Secure Transport (Apple) SSL backends. Prior to this change PEM certificates could only be imported from a file and not from memory. Co-authored-by: moparisthebest@users.noreply.github.com Ref: https://github.com/curl/curl/pull/4679 Ref: https://github.com/curl/curl/pull/5677 Ref: https://github.com/curl/curl/pull/6109 Closes https://github.com/curl/curl/pull/6662
2020-07-12 21:17:56 -04:00
if((SSL_CONN_CONFIG(CAfile) || SSL_CONN_CONFIG(ca_info_blob)) &&
SSL_CONN_CONFIG(verifypeer)) {
CURLcode result = verify_cert(data, SSL_CONN_CONFIG(CAfile),
SSL_CONN_CONFIG(ca_info_blob),
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
backend->ssl_ctx);
sectransp: handle errSSLPeerAuthCompleted from SSLRead() Reported-by: smuellerDD on github Fixes #3932 Closes #3933
2019-05-23 11:16:02 -04:00
if(result)
return result;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* the documentation says we need to call SSLHandshake() again */
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
return sectransp_connect_step2(data, conn, sockindex);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
/* Problem with encrypt / decrypt */
case errSSLPeerDecodeError:
failf(data, "Decode failed");
break;
case errSSLDecryptionFail:
case errSSLPeerDecryptionFail:
failf(data, "Decryption failed");
break;
case errSSLPeerDecryptError:
failf(data, "A decryption error occurred");
break;
case errSSLBadCipherSuite:
failf(data, "A bad SSL cipher suite was encountered");
break;
case errSSLCrypto:
failf(data, "An underlying cryptographic error was encountered");
break;
#if CURL_BUILD_MAC_10_11 || CURL_BUILD_IOS_9
case errSSLWeakPeerEphemeralDHKey:
failf(data, "Indicates a weak ephemeral Diffie-Hellman key");
break;
#endif
/* Problem with the message record validation */
case errSSLBadRecordMac:
case errSSLPeerBadRecordMac:
failf(data, "A record with a bad message authentication code (MAC) "
"was encountered");
break;
case errSSLRecordOverflow:
case errSSLPeerRecordOverflow:
failf(data, "A record overflow occurred");
break;
/* Problem with zlib decompression */
case errSSLPeerDecompressFail:
failf(data, "Decompression failed");
break;
/* Problem with access */
case errSSLPeerAccessDenied:
failf(data, "Access was denied");
break;
case errSSLPeerInsufficientSecurity:
failf(data, "There is insufficient security for this operation");
break;
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
/* These are all certificate problems with the server: */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
case errSSLXCertChainInvalid:
darwinssl: Make certificate errors less techy Previously if a problem was found with one of the server's certificates, we'd log an OSStatus for the end user to look up. Now we explain what was wrong with the site's certificate chain. Also un-did part of the previous commit where the code wouldn't catch errSSLServerAuthCompleted if built under Leopard.
2013-02-08 20:34:11 -05:00
failf(data, "SSL certificate problem: Invalid certificate chain");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
case errSSLUnknownRootCert:
darwinssl: Make certificate errors less techy Previously if a problem was found with one of the server's certificates, we'd log an OSStatus for the end user to look up. Now we explain what was wrong with the site's certificate chain. Also un-did part of the previous commit where the code wouldn't catch errSSLServerAuthCompleted if built under Leopard.
2013-02-08 20:34:11 -05:00
failf(data, "SSL certificate problem: Untrusted root certificate");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
case errSSLNoRootCert:
darwinssl: Make certificate errors less techy Previously if a problem was found with one of the server's certificates, we'd log an OSStatus for the end user to look up. Now we explain what was wrong with the site's certificate chain. Also un-did part of the previous commit where the code wouldn't catch errSSLServerAuthCompleted if built under Leopard.
2013-02-08 20:34:11 -05:00
failf(data, "SSL certificate problem: No root certificate");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case errSSLCertNotYetValid:
failf(data, "SSL certificate problem: The certificate chain had a "
"certificate that is not yet valid");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
case errSSLCertExpired:
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case errSSLPeerCertExpired:
darwinssl: Make certificate errors less techy Previously if a problem was found with one of the server's certificates, we'd log an OSStatus for the end user to look up. Now we explain what was wrong with the site's certificate chain. Also un-did part of the previous commit where the code wouldn't catch errSSLServerAuthCompleted if built under Leopard.
2013-02-08 20:34:11 -05:00
failf(data, "SSL certificate problem: Certificate chain had an "
"expired certificate");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: additional descriptive messages of SSL handshake errors (This doesn't need to appear in the release notes.)
2013-04-01 20:24:32 -04:00
case errSSLBadCert:
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case errSSLPeerBadCert:
darwinssl: additional descriptive messages of SSL handshake errors (This doesn't need to appear in the release notes.)
2013-04-01 20:24:32 -04:00
failf(data, "SSL certificate problem: Couldn't understand the server "
"certificate format");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case errSSLPeerUnsupportedCert:
failf(data, "SSL certificate problem: An unsupported certificate "
"format was encountered");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case errSSLPeerCertRevoked:
failf(data, "SSL certificate problem: The certificate was revoked");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case errSSLPeerCertUnknown:
failf(data, "SSL certificate problem: The certificate is unknown");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
SSL: Several SSL-backend related fixes axTLS: This will make the axTLS backend perform the RFC2818 checks, honoring the VERIFYHOST setting similar to the OpenSSL backend. Generic for OpenSSL and axTLS: Move the hostcheck and cert_hostcheck functions from the lib/ssluse.c files to make them genericly available for both the OpenSSL, axTLS and other SSL backends. They are now in the new lib/hostcheck.c file. CyaSSL: CyaSSL now also has the RFC2818 checks enabled by default. There is a limitation that the verifyhost can not be enabled exclusively on the Subject CN field comparison. This SSL backend will thus behave like the NSS and the GnuTLS (meaning: RFC2818 ok, or bust). In other words: setting verifyhost to 0 or 1 will disable the Subject Alt Names checks too. Schannel: Updated the schannel information messages: Split the IP address usage message from the verifyhost setting and changed the message about disabling SNI (Server Name Indication, used in HTTP virtual hosting) into a message stating that the Subject Alternative Names checks are being disabled when verifyhost is set to 0 or 1. As a side effect of switching off the RFC2818 related servername checks with SCH_CRED_NO_SERVERNAME_CHECK (http://msdn.microsoft.com/en-us/library/aa923430.aspx) the SNI feature is being disabled. This effect is not documented in MSDN, but Wireshark output clearly shows the effect (details on the libcurl maillist). PolarSSL: Fix the prototype change in PolarSSL of ssl_set_session() and the move of the peer_cert from the ssl_context to the ssl_session. Found this change in the PolarSSL SVN between r1316 and r1317 where the POLARSSL_VERSION_NUMBER was at 0x01010100. But to accommodate the Ubuntu PolarSSL version 1.1.4 the check is to discriminate between lower then PolarSSL version 1.2.0 and 1.2.0 and higher. Note: The PolarSSL SVN trunk jumped from version 1.1.1 to 1.2.0. Generic: All the SSL backends are fixed and checked to work with the ssl.verifyhost as a boolean, which is an internal API change.
2012-11-02 21:06:51 -04:00
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
/* These are all certificate problems with the client: */
case errSecAuthFailed:
failf(data, "SSL authentication failed");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
case errSSLPeerHandshakeFail:
failf(data, "SSL peer handshake failed, the server most likely "
"requires a client certificate to connect");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
case errSSLPeerUnknownCA:
failf(data, "SSL server rejected the client certificate due to "
"the certificate being signed by an unknown certificate "
"authority");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
/* This error is raised if the server's cert didn't match the server's
host name: */
SSL: Several SSL-backend related fixes axTLS: This will make the axTLS backend perform the RFC2818 checks, honoring the VERIFYHOST setting similar to the OpenSSL backend. Generic for OpenSSL and axTLS: Move the hostcheck and cert_hostcheck functions from the lib/ssluse.c files to make them genericly available for both the OpenSSL, axTLS and other SSL backends. They are now in the new lib/hostcheck.c file. CyaSSL: CyaSSL now also has the RFC2818 checks enabled by default. There is a limitation that the verifyhost can not be enabled exclusively on the Subject CN field comparison. This SSL backend will thus behave like the NSS and the GnuTLS (meaning: RFC2818 ok, or bust). In other words: setting verifyhost to 0 or 1 will disable the Subject Alt Names checks too. Schannel: Updated the schannel information messages: Split the IP address usage message from the verifyhost setting and changed the message about disabling SNI (Server Name Indication, used in HTTP virtual hosting) into a message stating that the Subject Alternative Names checks are being disabled when verifyhost is set to 0 or 1. As a side effect of switching off the RFC2818 related servername checks with SCH_CRED_NO_SERVERNAME_CHECK (http://msdn.microsoft.com/en-us/library/aa923430.aspx) the SNI feature is being disabled. This effect is not documented in MSDN, but Wireshark output clearly shows the effect (details on the libcurl maillist). PolarSSL: Fix the prototype change in PolarSSL of ssl_set_session() and the move of the peer_cert from the ssl_context to the ssl_session. Found this change in the PolarSSL SVN between r1316 and r1317 where the POLARSSL_VERSION_NUMBER was at 0x01010100. But to accommodate the Ubuntu PolarSSL version 1.1.4 the check is to discriminate between lower then PolarSSL version 1.2.0 and 1.2.0 and higher. Note: The PolarSSL SVN trunk jumped from version 1.1.1 to 1.2.0. Generic: All the SSL backends are fixed and checked to work with the ssl.verifyhost as a boolean, which is an internal API change.
2012-11-02 21:06:51 -04:00
case errSSLHostNameMismatch:
failf(data, "SSL certificate peer verification failed, the "
"certificate did not match \"%s\"\n", conn->host.dispname);
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
/* Problem with SSL / TLS negotiation */
case errSSLNegotiation:
failf(data, "Could not negotiate an SSL cipher suite with the server");
break;
case errSSLBadConfiguration:
failf(data, "A configuration error occurred");
break;
case errSSLProtocol:
failf(data, "SSL protocol error");
break;
case errSSLPeerProtocolVersion:
failf(data, "A bad protocol version was encountered");
break;
case errSSLPeerNoRenegotiation:
failf(data, "No renegotiation is allowed");
break;
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
/* Generic handshake errors: */
darwinssl: fix infinite loop if server disconnected abruptly If the server hung up the connection without sending a closure alert, then we'd keep probing the socket for data even though it's dead. Now we're ready for this situation. Bug: http://curl.haxx.se/mail/lib-2013-03/0014.html Reported by: Aki Koskinen
2013-03-04 00:11:10 -05:00
case errSSLConnectionRefused:
failf(data, "Server dropped the connection during the SSL handshake");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
case errSSLClosedAbort:
failf(data, "Server aborted the SSL handshake");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
case errSSLClosedGraceful:
failf(data, "The connection closed gracefully");
break;
case errSSLClosedNoNotify:
failf(data, "The server closed the session with no notification");
break;
darwinssl: additional descriptive messages of SSL handshake errors (This doesn't need to appear in the release notes.)
2013-04-01 20:24:32 -04:00
/* Sometimes paramErr happens with buggy ciphers: */
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case paramErr:
case errSSLInternal:
case errSSLPeerInternalError:
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
failf(data, "Internal SSL engine error encountered during the "
"SSL handshake");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
darwinssl: additional descriptive messages of SSL handshake errors (This doesn't need to appear in the release notes.)
2013-04-01 20:24:32 -04:00
case errSSLFatalAlert:
failf(data, "Fatal SSL engine error encountered during the SSL "
"handshake");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
/* Unclassified error */
case errSSLBufferOverflow:
failf(data, "An insufficient buffer was provided");
break;
case errSSLIllegalParam:
failf(data, "An illegal parameter was encountered");
break;
case errSSLModuleAttach:
failf(data, "Module attach failure");
break;
case errSSLSessionNotFound:
failf(data, "An attempt to restore an unknown session failed");
break;
case errSSLPeerExportRestriction:
failf(data, "An export restriction occurred");
break;
case errSSLPeerUserCancelled:
failf(data, "The user canceled the operation");
break;
case errSSLPeerUnexpectedMsg:
failf(data, "Peer rejected unexpected message");
break;
#if CURL_BUILD_MAC_10_11 || CURL_BUILD_IOS_9
/* Treaing non-fatal error as fatal like before */
case errSSLClientHelloReceived:
failf(data, "A non-fatal result for providing a server name "
"indication");
break;
#endif
/* Error codes defined in the enum but should never be returned.
We list them here just in case. */
#if CURL_BUILD_MAC_10_6
/* Only returned when kSSLSessionOptionBreakOnCertRequested is set */
case errSSLClientCertRequested:
CURLcode: add CURLE_SSL_CLIENTCERT When a TLS server requests a client certificate during handshake and none can be provided, libcurl now returns this new error code CURLE_SSL_CLIENTCERT Only supported by Secure Transport and OpenSSL for TLS 1.3 so far. Closes #6721
2021-03-11 02:50:13 -05:00
failf(data, "Server requested a client certificate during the "
"handshake");
return CURLE_SSL_CLIENTCERT;
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
#endif
#if CURL_BUILD_MAC_10_9
/* Alias for errSSLLast, end of error range */
case errSSLUnexpectedRecord:
failf(data, "Unexpected (skipped) record in DTLS");
break;
#endif
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
default:
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
/* May also return codes listed in Security Framework Result Codes */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
failf(data, "Unknown SSL protocol error in connection to %s:%d",
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
hostname, err);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_SSL_CONNECT_ERROR;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
else {
/* we have been connected fine, we're not waiting for anything else. */
connssl->connecting_state = ssl_connect_3;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY
urldata: remove the _ORIG suffix from string names It doesn't provide any useful info but only makes the names longer. Closes #6624
2021-02-18 04:13:56 -05:00
if(data->set.str[STRING_SSL_PINNEDPUBLICKEY]) {
CURLcode result =
pkp_pin_peer_pubkey(data, backend->ssl_ctx,
data->set.str[STRING_SSL_PINNEDPUBLICKEY]);
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
if(result) {
failf(data, "SSL: public key does not match pinned public key!");
return result;
}
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* SECTRANSP_PINNEDPUBKEY */
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* Informational message */
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLGetNegotiatedCipher(backend->ssl_ctx, &cipher);
(void)SSLGetNegotiatedProtocolVersion(backend->ssl_ctx, &protocol);
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(protocol) {
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
case kSSLProtocol2:
infof(data, "SSL 2.0 connection using %s\n",
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
TLSCipherNameForNumber(cipher));
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
break;
case kSSLProtocol3:
infof(data, "SSL 3.0 connection using %s\n",
sectransp: allow cipher name to be specified Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) back-end. Similar to NSS and GSKit back-ends, new code parses string value and configures ST library to use those ciphers for communication. Create cipher spec data structure and initialize the array of specs with cipher number, name, alias, and 'weak' flag. Mark triple-DES ciphers as 'weak', and exclude them from the default ciphers list. Closes #6464
2021-01-15 15:32:04 -05:00
TLSCipherNameForNumber(cipher));
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
break;
case kTLSProtocol1:
infof(data, "TLS 1.0 connection using %s\n",
TLSCipherNameForNumber(cipher));
break;
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
case kTLSProtocol11:
infof(data, "TLS 1.1 connection using %s\n",
TLSCipherNameForNumber(cipher));
break;
case kTLSProtocol12:
infof(data, "TLS 1.2 connection using %s\n",
TLSCipherNameForNumber(cipher));
break;
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11
case kTLSProtocol13:
infof(data, "TLS 1.3 connection using %s\n",
TLSCipherNameForNumber(cipher));
break;
#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
default:
infof(data, "Unknown protocol connection\n");
break;
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
#if(CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
if(conn->bits.tls_enable_alpn) {
sectransp: tvOS 11 is required for ALPN support Reported-by: nianxuejie on github Assisted-by: Nick Zitzmann Assisted-by: Jay Satiro Fixes #3689 Closes #3690
2019-03-19 05:19:40 -04:00
if(__builtin_available(macOS 10.13.4, iOS 11, tvOS 11, *)) {
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
CFArrayRef alpnArr = NULL;
CFStringRef chosenProtocol = NULL;
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLCopyALPNProtocols(backend->ssl_ctx, &alpnArr);
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
if(err == noErr && alpnArr && CFArrayGetCount(alpnArr) >= 1)
chosenProtocol = CFArrayGetValueAtIndex(alpnArr, 0);
tls: add USE_HTTP2 define This abstracts across the two HTTP/2 backends: nghttp2 and Hyper. Add our own define for the "h2" ALPN protocol, so TLS backends can use it without depending on a specific HTTP backend. Closes #6959
2021-04-24 21:05:15 -04:00
#ifdef USE_HTTP2
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
if(chosenProtocol &&
tls: add USE_HTTP2 define This abstracts across the two HTTP/2 backends: nghttp2 and Hyper. Add our own define for the "h2" ALPN protocol, so TLS backends can use it without depending on a specific HTTP backend. Closes #6959
2021-04-24 21:05:15 -04:00
!CFStringCompare(chosenProtocol, CFSTR(ALPN_H2), 0)) {
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
conn->negnpn = CURL_HTTP_VERSION_2;
}
else
#endif
if(chosenProtocol &&
!CFStringCompare(chosenProtocol, CFSTR(ALPN_HTTP_1_1), 0)) {
conn->negnpn = CURL_HTTP_VERSION_1_1;
}
else
infof(data, "ALPN, server did not agree to a protocol\n");
lib: pass in 'struct Curl_easy *' to most functions ... in most cases instead of 'struct connectdata *' but in some cases in addition to. - We mostly operate on transfers and not connections. - We need the transfer handle to log, store data and more. Everything in libcurl is driven by a transfer (the CURL * in the public API). - This work clarifies and separates the transfers from the connections better. - We should avoid "conn->data". Since individual connections can be used by many transfers when multiplexing, making sure that conn->data points to the current and correct transfer at all times is difficult and has been notoriously error-prone over the years. The goal is to ultimately remove the conn->data pointer for this reason. Closes #6425
2021-01-08 11:58:15 -05:00
Curl_multiuse_state(data, conn->negnpn == CURL_HTTP_VERSION_2 ?
multi: provide Curl_multiuse_state to update information As soon as a TLS backend gets ALPN conformation about the specific HTTP version it can now set the multiplex situation for the "bundle" and trigger moving potentially queued up transfers to the CONNECT state.
2019-04-30 05:14:38 -04:00
BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
/* chosenProtocol is a reference to the string within alpnArr
and doesn't need to be freed separately */
if(alpnArr)
CFRelease(alpnArr);
}
}
#endif
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
return CURLE_OK;
}
}
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
#ifndef CURL_DISABLE_VERBOSE_STRINGS
/* This should be called during step3 of the connection at the earliest */
static void
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
show_verbose_server_cert(struct Curl_easy *data,
struct connectdata *conn,
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
int sockindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
struct ssl_backend_data *backend = connssl->backend;
darwinssl: fix crash that started happening in Lion Something (a recent security update maybe?) changed in Lion, and now it has changed SSLCopyPeerTrust such that it may return noErr but also give us a null trust, which caught us off guard and caused an eventual crash.
2013-06-22 17:13:36 -04:00
CFArrayRef server_certs = NULL;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
SecCertificateRef server_cert;
OSStatus err;
CFIndex i, count;
darwinssl: fix crash that started happening in Lion Something (a recent security update maybe?) changed in Lion, and now it has changed SSLCopyPeerTrust such that it may return noErr but also give us a null trust, which caught us off guard and caused an eventual crash.
2013-06-22 17:13:36 -04:00
SecTrustRef trust = NULL;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
if(!backend->ssl_ctx)
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
return;
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
#if CURL_BUILD_IOS
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
#pragma unused(server_certs)
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLCopyPeerTrust(backend->ssl_ctx, &trust);
darwinssl: fix crash that started happening in Lion Something (a recent security update maybe?) changed in Lion, and now it has changed SSLCopyPeerTrust such that it may return noErr but also give us a null trust, which caught us off guard and caused an eventual crash.
2013-06-22 17:13:36 -04:00
/* For some reason, SSLCopyPeerTrust() can return noErr and yet return
a null trust, so be on guard for that: */
if(err == noErr && trust) {
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
count = SecTrustGetCertificateCount(trust);
for(i = 0L ; i < count ; i++) {
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
CURLcode result;
char *certp;
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
server_cert = SecTrustGetCertificateAtIndex(trust, i);
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
result = CopyCertSubject(data, server_cert, &certp);
if(!result) {
infof(data, "Server certificate: %s\n", certp);
free(certp);
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
}
}
CFRelease(trust);
}
#else
/* SSLCopyPeerCertificates() is deprecated as of Mountain Lion.
The function SecTrustGetCertificateAtIndex() is officially present
in Lion, but it is unfortunately also present in Snow Leopard as
private API and doesn't work as expected. So we have to look for
a different symbol to make sure this code is only executed under
Lion or later. */
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
if(SecTrustEvaluateAsync != NULL) {
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
#pragma unused(server_certs)
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLCopyPeerTrust(backend->ssl_ctx, &trust);
darwinssl: fix crash that started happening in Lion Something (a recent security update maybe?) changed in Lion, and now it has changed SSLCopyPeerTrust such that it may return noErr but also give us a null trust, which caught us off guard and caused an eventual crash.
2013-06-22 17:13:36 -04:00
/* For some reason, SSLCopyPeerTrust() can return noErr and yet return
a null trust, so be on guard for that: */
if(err == noErr && trust) {
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
count = SecTrustGetCertificateCount(trust);
for(i = 0L ; i < count ; i++) {
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
char *certp;
CURLcode result;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
server_cert = SecTrustGetCertificateAtIndex(trust, i);
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
result = CopyCertSubject(data, server_cert, &certp);
if(!result) {
infof(data, "Server certificate: %s\n", certp);
free(certp);
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
}
}
CFRelease(trust);
}
}
else {
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_SUPPORT_MAC_10_8
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLCopyPeerCertificates(backend->ssl_ctx, &server_certs);
darwinssl: fix crash that started happening in Lion Something (a recent security update maybe?) changed in Lion, and now it has changed SSLCopyPeerTrust such that it may return noErr but also give us a null trust, which caught us off guard and caused an eventual crash.
2013-06-22 17:13:36 -04:00
/* Just in case SSLCopyPeerCertificates() returns null too... */
if(err == noErr && server_certs) {
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
count = CFArrayGetCount(server_certs);
for(i = 0L ; i < count ; i++) {
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
char *certp;
CURLcode result;
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs,
i);
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
result = CopyCertSubject(data, server_cert, &certp);
if(!result) {
infof(data, "Server certificate: %s\n", certp);
free(certp);
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
}
}
CFRelease(server_certs);
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_SUPPORT_MAC_10_8 */
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_IOS */
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
#else
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
#pragma unused(trust)
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLCopyPeerCertificates(backend->ssl_ctx, &server_certs);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err == noErr) {
count = CFArrayGetCount(server_certs);
for(i = 0L ; i < count ; i++) {
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
CURLcode result;
char *certp;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs, i);
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
result = CopyCertSubject(data, server_cert, &certp);
if(!result) {
infof(data, "Server certificate: %s\n", certp);
free(certp);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
}
CFRelease(server_certs);
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
}
#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
static CURLcode
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
sectransp_connect_step3(struct Curl_easy *data, struct connectdata *conn,
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
int sockindex)
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
/* There is no step 3!
* Well, okay, if verbose mode is on, let's print the details of the
* server certificates. */
#ifndef CURL_DISABLE_VERBOSE_STRINGS
if(data->set.verbose)
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
show_verbose_server_cert(data, conn, sockindex);
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
#endif
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
connssl->connecting_state = ssl_connect_done;
return CURLE_OK;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static Curl_recv sectransp_recv;
static Curl_send sectransp_send;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
static CURLcode
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
sectransp_connect_common(struct Curl_easy *data,
struct connectdata *conn,
DarwinSSL: several adjustments - Renamed st_ function prefix to darwinssl_ - Renamed Curl_st_ function prefix to Curl_darwinssl_ - Moved the duplicated ssl_connect_done out of the #ifdef in lib/urldata.h - Fixed a teensy little bug that made non-blocking connection attempts block - Made it so that it builds cleanly against the iOS 5.1 SDK
2012-06-26 15:39:48 -04:00
int sockindex,
bool nonblocking,
bool *done)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
CURLcode result;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
curl_socket_t sockfd = conn->sock[sockindex];
int what;
/* check if the connection has already been established */
if(ssl_connection_complete == connssl->state) {
*done = TRUE;
return CURLE_OK;
}
code style: use spaces around equals signs
2017-09-09 17:09:06 -04:00
if(ssl_connect_1 == connssl->connecting_state) {
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* Find out how much more time we're allowed */
timeouts: change millisecond timeouts to timediff_t from time_t For millisecond timers we like timediff_t better. Also, time_t can be unsigned so returning a negative value doesn't work then. Closes #5479
2020-05-28 18:08:03 -04:00
const timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(timeout_ms < 0) {
/* no need to continue if time already is up */
failf(data, "SSL connection timeout");
return CURLE_OPERATION_TIMEDOUT;
}
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
result = sectransp_connect_step1(data, conn, sockindex);
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(result)
return result;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
while(ssl_connect_2 == connssl->connecting_state ||
ssl_connect_2_reading == connssl->connecting_state ||
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
ssl_connect_2_writing == connssl->connecting_state) {
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* check allowed time left */
timeouts: change millisecond timeouts to timediff_t from time_t For millisecond timers we like timediff_t better. Also, time_t can be unsigned so returning a negative value doesn't work then. Closes #5479
2020-05-28 18:08:03 -04:00
const timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(timeout_ms < 0) {
/* no need to continue if time already is up */
failf(data, "SSL connection timeout");
return CURLE_OPERATION_TIMEDOUT;
}
/* if ssl is expecting something, check if it's available. */
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(connssl->connecting_state == ssl_connect_2_reading ||
connssl->connecting_state == ssl_connect_2_writing) {
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
curl_socket_t writefd = ssl_connect_2_writing ==
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
curl_socket_t readfd = ssl_connect_2_reading ==
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
select: switch to macros in uppercase Curl_select_ready() was the former API that was replaced with Curl_select_check() a while back and the former arg setup was provided with a define (in order to leave existing code unmodified). Now we instead offer SOCKET_READABLE and SOCKET_WRITABLE for the most common shortcuts where only one socket is checked. They're also more visibly macros.
2016-10-18 04:58:58 -04:00
what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
timeouts: change millisecond timeouts to timediff_t from time_t For millisecond timers we like timediff_t better. Also, time_t can be unsigned so returning a negative value doesn't work then. Closes #5479
2020-05-28 18:08:03 -04:00
nonblocking ? 0 : timeout_ms);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(what < 0) {
/* fatal error */
failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
return CURLE_SSL_CONNECT_ERROR;
}
else if(0 == what) {
if(nonblocking) {
*done = FALSE;
return CURLE_OK;
}
else {
/* timeout */
failf(data, "SSL connection timeout");
return CURLE_OPERATION_TIMEDOUT;
}
}
/* socket is readable or writable */
}
/* Run transaction, and return to the caller if it failed or if this
* connection is done nonblocking and this loop would execute again. This
* permits the owner of a multi handle to abort a connection attempt
* before step2 has completed while ensuring that a client using select()
* or epoll() will always have a valid fdset to wait on.
*/
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
result = sectransp_connect_step2(data, conn, sockindex);
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(result || (nonblocking &&
(ssl_connect_2 == connssl->connecting_state ||
ssl_connect_2_reading == connssl->connecting_state ||
ssl_connect_2_writing == connssl->connecting_state)))
return result;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
} /* repeat step2 until all transactions are done. */
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(ssl_connect_3 == connssl->connecting_state) {
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
result = sectransp_connect_step3(data, conn, sockindex);
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(result)
return result;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(ssl_connect_done == connssl->connecting_state) {
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
connssl->state = ssl_connection_complete;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
conn->recv[sockindex] = sectransp_recv;
conn->send[sockindex] = sectransp_send;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
*done = TRUE;
}
else
*done = FALSE;
/* Reset our connect state machine */
connssl->connecting_state = ssl_connect_1;
return CURLE_OK;
}
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
static CURLcode sectransp_connect_nonblocking(struct Curl_easy *data,
struct connectdata *conn,
int sockindex, bool *done)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
return sectransp_connect_common(data, conn, sockindex, TRUE, done);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
static CURLcode sectransp_connect(struct Curl_easy *data,
struct connectdata *conn, int sockindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
CURLcode result;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
bool done = FALSE;
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
result = sectransp_connect_common(data, conn, sockindex, FALSE, &done);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(result)
return result;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
DEBUGASSERT(done);
return CURLE_OK;
}
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
static void sectransp_close(struct Curl_easy *data, struct connectdata *conn,
int sockindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
struct ssl_backend_data *backend = connssl->backend;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
(void) data;
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
if(backend->ssl_ctx) {
(void)SSLClose(backend->ssl_ctx);
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
if(SSLCreateContext != NULL)
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
CFRelease(backend->ssl_ctx);
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_SUPPORT_MAC_10_8
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
else
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLDisposeContext(backend->ssl_ctx);
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_SUPPORT_MAC_10_8 */
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
#else
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
(void)SSLDisposeContext(backend->ssl_ctx);
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
backend->ssl_ctx = NULL;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
}
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
backend->ssl_sockfd = 0;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
static int sectransp_shutdown(struct Curl_easy *data,
struct connectdata *conn, int sockindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
struct ssl_backend_data *backend = connssl->backend;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
ssize_t nread;
int what;
int rc;
char buf[120];
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
if(!backend->ssl_ctx)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
return 0;
ftp: move ftp_ccc in under featureflag Commit e91e48161235272ff485ff32bd048c53af731f43 moved ftp_ccc in under the FTP featureflag in the UserDefined struct, but vtls callsites were still using it unprotected. Closes #3912 Fixes: https://curl.haxx.se/dev/log.cgi?id=20190520044705-29865 Reviewed-by: Daniel Stenberg, Marcel Raad
2019-05-21 03:38:11 -04:00
#ifndef CURL_DISABLE_FTP
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(data->set.ftp_ccc != CURLFTPSSL_CCC_ACTIVE)
return 0;
ftp: move ftp_ccc in under featureflag Commit e91e48161235272ff485ff32bd048c53af731f43 moved ftp_ccc in under the FTP featureflag in the UserDefined struct, but vtls callsites were still using it unprotected. Closes #3912 Fixes: https://curl.haxx.se/dev/log.cgi?id=20190520044705-29865 Reviewed-by: Daniel Stenberg, Marcel Raad
2019-05-21 03:38:11 -04:00
#endif
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
sectransp_close(data, conn, sockindex);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
rc = 0;
select: switch to macros in uppercase Curl_select_ready() was the former API that was replaced with Curl_select_check() a while back and the former arg setup was provided with a define (in order to leave existing code unmodified). Now we instead offer SOCKET_READABLE and SOCKET_WRITABLE for the most common shortcuts where only one socket is checked. They're also more visibly macros.
2016-10-18 04:58:58 -04:00
what = SOCKET_READABLE(conn->sock[sockindex], SSL_SHUTDOWN_TIMEOUT);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
for(;;) {
if(what < 0) {
/* anything that gets here is fatally bad */
failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
rc = -1;
break;
}
if(!what) { /* timeout */
failf(data, "SSL shutdown timeout");
break;
}
/* Something to read, let's do it and hope that it is the close
notify alert from the server. No way to SSL_Read now, so use read(). */
nread = read(conn->sock[sockindex], buf, sizeof(buf));
if(nread < 0) {
failf(data, "read: %s", strerror(errno));
rc = -1;
}
if(nread <= 0)
break;
select: switch to macros in uppercase Curl_select_ready() was the former API that was replaced with Curl_select_check() a while back and the former arg setup was provided with a define (in order to leave existing code unmodified). Now we instead offer SOCKET_READABLE and SOCKET_WRITABLE for the most common shortcuts where only one socket is checked. They're also more visibly macros.
2016-10-18 04:58:58 -04:00
what = SOCKET_READABLE(conn->sock[sockindex], 0);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
return rc;
}
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
static void sectransp_session_free(void *ptr)
darwinssl: add TLS session resumption This ought to speed up additional TLS handshakes, at least in theory.
2013-04-12 14:20:10 -04:00
{
/* ST, as of iOS 5 and Mountain Lion, has no public method of deleting a
cached session ID inside the Security framework. There is a private
function that does this, but I don't want to have to explain to you why I
got your application rejected from the App Store due to the use of a
private API, so the best we can do is free up our own char array that we
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
created way back in sectransp_connect_step1... */
darwinssl: add TLS session resumption This ought to speed up additional TLS handshakes, at least in theory.
2013-04-12 14:20:10 -04:00
Curl_safefree(ptr);
}
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
static size_t sectransp_version(char *buffer, size_t size)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
snprintf: renamed and we now only use msnprintf() The function does not return the same value as snprintf() normally does, so readers may be mislead into thinking the code works differently than it actually does. A different function name makes this easier to detect. Reported-by: Tomas Hoger Assisted-by: Daniel Gustafsson Fixes #3296 Closes #3297
2018-11-22 03:01:24 -05:00
return msnprintf(buffer, size, "SecureTransport");
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
/*
* This function uses SSLGetSessionState to determine connection status.
*
* Return codes:
* 1 means the connection is still in place
* 0 means the connection has been closed
* -1 means the connection status is unknown
*/
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
static int sectransp_check_cxn(struct connectdata *conn)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
struct ssl_connect_data *connssl = &conn->ssl[FIRSTSOCKET];
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
struct ssl_backend_data *backend = connssl->backend;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
OSStatus err;
SSLSessionState state;
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
if(backend->ssl_ctx) {
err = SSLGetSessionState(backend->ssl_ctx, &state);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err == noErr)
return state == kSSLConnected || state == kSSLHandshake;
return -1;
}
return 0;
}
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
static bool sectransp_data_pending(const struct connectdata *conn,
int connindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
const struct ssl_connect_data *connssl = &conn->ssl[connindex];
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
struct ssl_backend_data *backend = connssl->backend;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
OSStatus err;
size_t buffer;
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
if(backend->ssl_ctx) { /* SSL is in use */
err = SSLGetBufferedReadSize(backend->ssl_ctx, &buffer);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err == noErr)
return buffer > 0UL;
return false;
}
else
return false;
}
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
static CURLcode sectransp_random(struct Curl_easy *data UNUSED_PARAM,
unsigned char *entropy, size_t length)
DarwinSSL: allow using NTLM authentication Allow NTLM authentication when building using SecureTransport (Darwin) for SSL. This uses CommonCrypto, a cryptography library that ships with all versions of iOS and Mac OS X. It's like OpenSSL's libcrypto, except that it's missing a few less-common cyphers and doesn't have a big number data structure.
2012-06-27 05:57:31 -04:00
{
darwinssl: don't use arc4random_buf Re-wrote Curl_darwinssl_random() to not use arc4random_buf() because the function is not available prior to iOS 4.3 and OS X 10.7.
2012-07-07 18:03:16 -04:00
/* arc4random_buf() isn't available on cats older than Lion, so let's
do this manually for the benefit of the older cats. */
size_t i;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
u_int32_t random_number = 0;
darwinssl: don't use arc4random_buf Re-wrote Curl_darwinssl_random() to not use arc4random_buf() because the function is not available prior to iOS 4.3 and OS X 10.7.
2012-07-07 18:03:16 -04:00
SSL: fix unused parameter warnings
2017-09-06 15:11:55 -04:00
(void)data;
darwinssl: don't use arc4random_buf Re-wrote Curl_darwinssl_random() to not use arc4random_buf() because the function is not available prior to iOS 4.3 and OS X 10.7.
2012-07-07 18:03:16 -04:00
for(i = 0 ; i < length ; i++) {
if(i % sizeof(u_int32_t) == 0)
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
random_number = arc4random();
entropy[i] = random_number & 0xFF;
random_number >>= 8;
darwinssl: don't use arc4random_buf Re-wrote Curl_darwinssl_random() to not use arc4random_buf() because the function is not available prior to iOS 4.3 and OS X 10.7.
2012-07-07 18:03:16 -04:00
}
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
i = random_number = 0;
rand: make it work without TLS backing Regression introduced in commit f682156a4fc6c4 Reported-by: John Kohl Bug: https://curl.haxx.se/mail/lib-2017-01/0055.html
2017-01-12 11:41:26 -05:00
return CURLE_OK;
DarwinSSL: allow using NTLM authentication Allow NTLM authentication when building using SecureTransport (Darwin) for SSL. This uses CommonCrypto, a cryptography library that ships with all versions of iOS and Mac OS X. It's like OpenSSL's libcrypto, except that it's missing a few less-common cyphers and doesn't have a big number data structure.
2012-06-27 05:57:31 -04:00
}
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
static CURLcode sectransp_sha256sum(const unsigned char *tmp, /* input */
size_t tmplen,
unsigned char *sha256sum, /* output */
size_t sha256len)
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
{
vtls: switch to CURL_SHA256_DIGEST_LENGTH define ... instead of the prefix-less version since WolfSSL 3.12 now uses an enum with that name that causes build failures for us. Fixes #1865 Closes #1867 Reported-by: Gisle Vanem
2017-09-06 03:32:02 -04:00
assert(sha256len >= CURL_SHA256_DIGEST_LENGTH);
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
(void)CC_SHA256(tmp, (CC_LONG)tmplen, sha256sum);
tls: fix mbedTLS 2.7.0 build + handle sha256 failures (mbedtls 2.70 compiled with MBEDTLS_DEPRECATED_REMOVED) Closes #2453
2018-04-02 13:33:00 -04:00
return CURLE_OK;
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
}
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
static bool sectransp_false_start(void)
checksrc: move open braces to comply with function declaration style
2016-11-23 02:49:04 -05:00
{
darwinsssl: add support for TLS False Start TLS False Start support requires iOS 7.0 or later, or OS X 10.9 or later.
2015-03-21 13:22:56 -04:00
#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
if(SSLSetSessionOption != NULL)
return TRUE;
#endif
return FALSE;
}
lib: pass in 'struct Curl_easy *' to most functions ... in most cases instead of 'struct connectdata *' but in some cases in addition to. - We mostly operate on transfers and not connections. - We need the transfer handle to log, store data and more. Everything in libcurl is driven by a transfer (the CURL * in the public API). - This work clarifies and separates the transfers from the connections better. - We should avoid "conn->data". Since individual connections can be used by many transfers when multiplexing, making sure that conn->data points to the current and correct transfer at all times is difficult and has been notoriously error-prone over the years. The goal is to ultimately remove the conn->data pointer for this reason. Closes #6425
2021-01-08 11:58:15 -05:00
static ssize_t sectransp_send(struct Curl_easy *data,
DarwinSSL: several adjustments - Renamed st_ function prefix to darwinssl_ - Renamed Curl_st_ function prefix to Curl_darwinssl_ - Moved the duplicated ssl_connect_done out of the #ifdef in lib/urldata.h - Fixed a teensy little bug that made non-blocking connection attempts block - Made it so that it builds cleanly against the iOS 5.1 SDK
2012-06-26 15:39:48 -04:00
int sockindex,
const void *mem,
size_t len,
CURLcode *curlcode)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
lib: pass in 'struct Curl_easy *' to most functions ... in most cases instead of 'struct connectdata *' but in some cases in addition to. - We mostly operate on transfers and not connections. - We need the transfer handle to log, store data and more. Everything in libcurl is driven by a transfer (the CURL * in the public API). - This work clarifies and separates the transfers from the connections better. - We should avoid "conn->data". Since individual connections can be used by many transfers when multiplexing, making sure that conn->data points to the current and correct transfer at all times is difficult and has been notoriously error-prone over the years. The goal is to ultimately remove the conn->data pointer for this reason. Closes #6425
2021-01-08 11:58:15 -05:00
struct connectdata *conn = data->conn;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
struct ssl_backend_data *backend = connssl->backend;
darwinssl: Fix bug where packets were sometimes transmitted twice There was a bug where, if SSLWrite() returned errSSLWouldBlock but did succeed in transmitting at least something, then we'd incorrectly resend the packet. Now we never take errSSLWouldBlock as a sign that nothing was transferred to/from the server. Bug: http://curl.haxx.se/mail/lib-2013-01/0295.html Reported by: Bruno de Carvalho
2013-01-28 21:34:35 -05:00
size_t processed = 0UL;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
OSStatus err;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
/* The SSLWrite() function works a little differently than expected. The
fourth argument (processed) is currently documented in Apple's
documentation as: "On return, the length, in bytes, of the data actually
written."
Now, one could interpret that as "written to the socket," but actually,
it returns the amount of data that was written to a buffer internal to
the SSLContextRef instead. So it's possible for SSLWrite() to return
errSSLWouldBlock and a number of bytes "written" because those bytes were
encrypted and written to a buffer, not to the socket.
So if this happens, then we need to keep calling SSLWrite() over and
over again with no new data until it quits returning errSSLWouldBlock. */
/* Do we have buffered data to write from the last time we were called? */
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
if(backend->ssl_write_buffered_length) {
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
/* Write the buffered data: */
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLWrite(backend->ssl_ctx, NULL, 0UL, &processed);
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(err) {
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
case noErr:
/* processed is always going to be 0 because we didn't write to
the buffer, so return how much was written to the socket */
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
processed = backend->ssl_write_buffered_length;
backend->ssl_write_buffered_length = 0UL;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
break;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
case errSSLWouldBlock: /* argh, try again */
*curlcode = CURLE_AGAIN;
return -1L;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
default:
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
failf(data, "SSLWrite() returned error %d", err);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
*curlcode = CURLE_SEND_ERROR;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
return -1L;
}
}
else {
/* We've got new data to write: */
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLWrite(backend->ssl_ctx, mem, len, &processed);
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
if(err != noErr) {
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(err) {
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
case errSSLWouldBlock:
/* Data was buffered but not sent, we have to tell the caller
to try sending again, and remember how much was buffered */
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
backend->ssl_write_buffered_length = len;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
*curlcode = CURLE_AGAIN;
return -1L;
default:
lib: pass in 'struct Curl_easy *' to most functions ... in most cases instead of 'struct connectdata *' but in some cases in addition to. - We mostly operate on transfers and not connections. - We need the transfer handle to log, store data and more. Everything in libcurl is driven by a transfer (the CURL * in the public API). - This work clarifies and separates the transfers from the connections better. - We should avoid "conn->data". Since individual connections can be used by many transfers when multiplexing, making sure that conn->data points to the current and correct transfer at all times is difficult and has been notoriously error-prone over the years. The goal is to ultimately remove the conn->data pointer for this reason. Closes #6425
2021-01-08 11:58:15 -05:00
failf(data, "SSLWrite() returned error %d", err);
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
*curlcode = CURLE_SEND_ERROR;
return -1L;
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
}
return (ssize_t)processed;
}
lib: pass in 'struct Curl_easy *' to most functions ... in most cases instead of 'struct connectdata *' but in some cases in addition to. - We mostly operate on transfers and not connections. - We need the transfer handle to log, store data and more. Everything in libcurl is driven by a transfer (the CURL * in the public API). - This work clarifies and separates the transfers from the connections better. - We should avoid "conn->data". Since individual connections can be used by many transfers when multiplexing, making sure that conn->data points to the current and correct transfer at all times is difficult and has been notoriously error-prone over the years. The goal is to ultimately remove the conn->data pointer for this reason. Closes #6425
2021-01-08 11:58:15 -05:00
static ssize_t sectransp_recv(struct Curl_easy *data,
DarwinSSL: several adjustments - Renamed st_ function prefix to darwinssl_ - Renamed Curl_st_ function prefix to Curl_darwinssl_ - Moved the duplicated ssl_connect_done out of the #ifdef in lib/urldata.h - Fixed a teensy little bug that made non-blocking connection attempts block - Made it so that it builds cleanly against the iOS 5.1 SDK
2012-06-26 15:39:48 -04:00
int num,
char *buf,
size_t buffersize,
CURLcode *curlcode)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
lib: pass in 'struct Curl_easy *' to most functions ... in most cases instead of 'struct connectdata *' but in some cases in addition to. - We mostly operate on transfers and not connections. - We need the transfer handle to log, store data and more. Everything in libcurl is driven by a transfer (the CURL * in the public API). - This work clarifies and separates the transfers from the connections better. - We should avoid "conn->data". Since individual connections can be used by many transfers when multiplexing, making sure that conn->data points to the current and correct transfer at all times is difficult and has been notoriously error-prone over the years. The goal is to ultimately remove the conn->data pointer for this reason. Closes #6425
2021-01-08 11:58:15 -05:00
struct connectdata *conn = data->conn;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
struct ssl_connect_data *connssl = &conn->ssl[num];
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
struct ssl_backend_data *backend = connssl->backend;
darwinssl: Fix bug where packets were sometimes transmitted twice There was a bug where, if SSLWrite() returned errSSLWouldBlock but did succeed in transmitting at least something, then we'd incorrectly resend the packet. Now we never take errSSLWouldBlock as a sign that nothing was transferred to/from the server. Bug: http://curl.haxx.se/mail/lib-2013-01/0295.html Reported by: Bruno de Carvalho
2013-01-28 21:34:35 -05:00
size_t processed = 0UL;
sectransp: handle errSSLPeerAuthCompleted from SSLRead() Reported-by: smuellerDD on github Fixes #3932 Closes #3933
2019-05-23 11:16:02 -04:00
OSStatus err;
again:
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
err = SSLRead(backend->ssl_ctx, buf, buffersize, &processed);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(err) {
darwinssl: Fix bug where packets were sometimes transmitted twice There was a bug where, if SSLWrite() returned errSSLWouldBlock but did succeed in transmitting at least something, then we'd incorrectly resend the packet. Now we never take errSSLWouldBlock as a sign that nothing was transferred to/from the server. Bug: http://curl.haxx.se/mail/lib-2013-01/0295.html Reported by: Bruno de Carvalho
2013-01-28 21:34:35 -05:00
case errSSLWouldBlock: /* return how much we read (if anything) */
if(processed)
return (ssize_t)processed;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
*curlcode = CURLE_AGAIN;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
return -1L;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
break;
darwinssl: fix infinite loop if server disconnected abruptly If the server hung up the connection without sending a closure alert, then we'd keep probing the socket for data even though it's dead. Now we're ready for this situation. Bug: http://curl.haxx.se/mail/lib-2013-03/0014.html Reported by: Aki Koskinen
2013-03-04 00:11:10 -05:00
/* errSSLClosedGraceful - server gracefully shut down the SSL session
errSSLClosedNoNotify - server hung up on us instead of sending a
closure alert notice, read() is returning 0
Either way, inform the caller that the server disconnected. */
case errSSLClosedGraceful:
case errSSLClosedNoNotify:
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
*curlcode = CURLE_OK;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
return -1L;
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
break;
sectransp: handle errSSLPeerAuthCompleted from SSLRead() Reported-by: smuellerDD on github Fixes #3932 Closes #3933
2019-05-23 11:16:02 -04:00
/* The below is errSSLPeerAuthCompleted; it's not defined in
Leopard's headers */
case -9841:
SSL: support in-memory CA certs for some backends - New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to specify in-memory PEM certificates for OpenSSL, Schannel (Windows) and Secure Transport (Apple) SSL backends. Prior to this change PEM certificates could only be imported from a file and not from memory. Co-authored-by: moparisthebest@users.noreply.github.com Ref: https://github.com/curl/curl/pull/4679 Ref: https://github.com/curl/curl/pull/5677 Ref: https://github.com/curl/curl/pull/6109 Closes https://github.com/curl/curl/pull/6662
2020-07-12 21:17:56 -04:00
if((SSL_CONN_CONFIG(CAfile) || SSL_CONN_CONFIG(ca_info_blob)) &&
SSL_CONN_CONFIG(verifypeer)) {
CURLcode result = verify_cert(data, SSL_CONN_CONFIG(CAfile),
SSL_CONN_CONFIG(ca_info_blob),
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
backend->ssl_ctx);
sectransp: handle errSSLPeerAuthCompleted from SSLRead() Reported-by: smuellerDD on github Fixes #3932 Closes #3933
2019-05-23 11:16:02 -04:00
if(result)
return result;
}
goto again;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
default:
lib: pass in 'struct Curl_easy *' to most functions ... in most cases instead of 'struct connectdata *' but in some cases in addition to. - We mostly operate on transfers and not connections. - We need the transfer handle to log, store data and more. Everything in libcurl is driven by a transfer (the CURL * in the public API). - This work clarifies and separates the transfers from the connections better. - We should avoid "conn->data". Since individual connections can be used by many transfers when multiplexing, making sure that conn->data points to the current and correct transfer at all times is difficult and has been notoriously error-prone over the years. The goal is to ultimately remove the conn->data pointer for this reason. Closes #6425
2021-01-08 11:58:15 -05:00
failf(data, "SSLRead() return error %d", err);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
*curlcode = CURLE_RECV_ERROR;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
return -1L;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
break;
}
}
return (ssize_t)processed;
}
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
static void *sectransp_get_internals(struct ssl_connect_data *connssl,
CURLINFO info UNUSED_PARAM)
getinfo: access SSL internals via Curl_ssl In the ongoing endeavor to abstract out all SSL backend-specific functionality, this is the next step: Instead of hard-coding how the different SSL backends access their internal data in getinfo.c, let's implement backend-specific functions to do that task. This will also allow for switching SSL backends as a runtime option. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-23 10:05:26 -04:00
{
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
struct ssl_backend_data *backend = connssl->backend;
getinfo: access SSL internals via Curl_ssl In the ongoing endeavor to abstract out all SSL backend-specific functionality, this is the next step: Instead of hard-coding how the different SSL backends access their internal data in getinfo.c, let's implement backend-specific functions to do that task. This will also allow for switching SSL backends as a runtime option. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-23 10:05:26 -04:00
(void)info;
secure transport: remove the BACKEND define kludge Closes #5122
2020-03-18 18:44:25 -04:00
return backend->ssl_ctx;
getinfo: access SSL internals via Curl_ssl In the ongoing endeavor to abstract out all SSL backend-specific functionality, this is the next step: Instead of hard-coding how the different SSL backends access their internal data in getinfo.c, let's implement backend-specific functions to do that task. This will also allow for switching SSL backends as a runtime option. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-23 10:05:26 -04:00
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
const struct Curl_ssl Curl_ssl_sectransp = {
{ CURLSSLBACKEND_SECURETRANSPORT, "secure-transport" }, /* info */
vtls: declare Curl_ssl structs for every SSL backend The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 10:45:34 -04:00
SSL: support in-memory CA certs for some backends - New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to specify in-memory PEM certificates for OpenSSL, Schannel (Windows) and Secure Transport (Apple) SSL backends. Prior to this change PEM certificates could only be imported from a file and not from memory. Co-authored-by: moparisthebest@users.noreply.github.com Ref: https://github.com/curl/curl/pull/4679 Ref: https://github.com/curl/curl/pull/5677 Ref: https://github.com/curl/curl/pull/6109 Closes https://github.com/curl/curl/pull/6662
2020-07-12 21:17:56 -04:00
SSLSUPP_CAINFO_BLOB |
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY
vtls: use unified "supports" bitfield member in backends ... instead of previous separate struct fields, to make it easier to extend and change individual backends without having to modify them all. closes #2547
2018-05-04 06:10:39 -04:00
SSLSUPP_PINNEDPUBKEY,
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
#else
vtls: use unified "supports" bitfield member in backends ... instead of previous separate struct fields, to make it easier to extend and change individual backends without having to modify them all. closes #2547
2018-05-04 06:10:39 -04:00
0,
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* SECTRANSP_PINNEDPUBKEY */
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
vtls: encapsulate SSL backend-specific data So far, all of the SSL backends' private data has been declared as part of the ssl_connect_data struct, in one big #if .. #elif .. #endif block. This can only work as long as the SSL backend is a compile-time option, something we want to change in the next commits. Therefore, let's encapsulate the exact data needed by each SSL backend into a private struct, and let's avoid bleeding any SSL backend-specific information into urldata.h. This is also necessary to allow multiple SSL backends to be compiled in at the same time, as e.g. OpenSSL's and CyaSSL's headers cannot be included in the same .c file. To avoid too many malloc() calls, we simply append the private structs to the connectdata struct in allocate_conn(). This requires us to take extra care of alignment issues: struct fields often need to be aligned on certain boundaries e.g. 32-bit values need to be stored at addresses that divide evenly by 4 (= 32 bit / 8 bit-per-byte). We do that by assuming that no SSL backend's private data contains any fields that need to be aligned on boundaries larger than `long long` (typically 64-bit) would need. Under this assumption, we simply add a dummy field of type `long long` to the `struct connectdata` struct. This field will never be accessed but acts as a placeholder for the four instances of ssl_backend_data instead. the size of each ssl_backend_data struct is stored in the SSL backend-specific metadata, to allow allocate_conn() to know how much extra space to allocate, and how to initialize the ssl[sockindex]->backend and proxy_ssl[sockindex]->backend pointers. This would appear to be a little complicated at first, but is really necessary to encapsulate the private data of each SSL backend correctly. And we need to encapsulate thusly if we ever want to allow selecting CyaSSL and OpenSSL at runtime, as their headers cannot be included within the same .c file (there are just too many conflicting definitions and declarations for that). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-07-28 16:09:35 -04:00
sizeof(struct ssl_backend_data),
vtls: declare Curl_ssl structs for every SSL backend The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 10:45:34 -04:00
Curl_none_init, /* init */
Curl_none_cleanup, /* cleanup */
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
sectransp_version, /* version */
sectransp_check_cxn, /* check_cxn */
sectransp_shutdown, /* shutdown */
sectransp_data_pending, /* data_pending */
sectransp_random, /* random */
vtls: declare Curl_ssl structs for every SSL backend The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 10:45:34 -04:00
Curl_none_cert_status_request, /* cert_status_request */
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
sectransp_connect, /* connect */
sectransp_connect_nonblocking, /* connect_nonblocking */
vtls: factor out Curl_ssl_getsock to field of Curl_ssl Closes #6558
2021-02-02 20:54:52 -05:00
Curl_ssl_getsock, /* getsock */
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
sectransp_get_internals, /* get_internals */
sectransp_close, /* close_one */
vtls: declare Curl_ssl structs for every SSL backend The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 10:45:34 -04:00
Curl_none_close_all, /* close_all */
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
sectransp_session_free, /* session_free */
vtls: declare Curl_ssl structs for every SSL backend The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 10:45:34 -04:00
Curl_none_set_engine, /* set_engine */
Curl_none_set_engine_default, /* set_engine_default */
Curl_none_engines_list, /* engines_list */
vtls: reduce conn->data use Closes #6474
2021-01-13 11:01:31 -05:00
sectransp_false_start, /* false_start */
sectransp_sha256sum /* sha256sum */
openssl: associate/detach the transfer from connection CVE-2021-22901 Bug: https://curl.se/docs/CVE-2021-22901.html
2021-05-05 07:42:26 -04:00
NULL, /* associate_connection */
NULL /* disassociate_connection */
vtls: declare Curl_ssl structs for every SSL backend The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 10:45:34 -04:00
};
darwin: silence compiler warnings With a clang pragma and three type fixes Fixes #1722
2017-08-03 18:04:39 -04:00
#ifdef __clang__
#pragma clang diagnostic pop
#endif
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* USE_SECTRANSP */
Reference in New Issue Copy Permalink