moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-11-17 15:05:02 -05:00
Code Issues Releases Wiki Activity
d37b0936d1
curl/lib/vtls/sectransp.c

3264 lines
108 KiB
C
Raw Normal View History

darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/***************************************************************************
* _ _ ____ _
* Project ___| | | | _ \| |
* / __| | | | |_) | |
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
* Copyright (C) 2012 - 2017, Nick Zitzmann, <nickzman@gmail.com>.
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
* Copyright (C) 2012 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
URLs: change all http:// URLs to https://
2016-02-02 18:19:02 -05:00
* are also available at https://curl.haxx.se/docs/copyright.html.
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
*
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
* copies of the Software, and permit persons to whom the Software is
* furnished to do so, under the terms of the COPYING file.
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
* KIND, either express or implied.
*
***************************************************************************/
/*
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
* Source file for all iOS and macOS SecureTransport-specific code for the
vtls: Updated comments referencing sslgen.c and ssluse.c
2013-12-25 05:30:51 -05:00
* TLS/SSL layer. No code but vtls.c should ever call or use these functions.
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
*/
build: fix circular header inclusion with other packages This commit renames lib/setup.h to lib/curl_setup.h and renames lib/setup_once.h to lib/curl_setup_once.h. Removes the need and usage of a header inclusion guard foreign to libcurl. [1] Removes the need and presence of an alarming notice we carried in old setup_once.h [2] ---------------------------------------- 1 - lib/setup_once.h used __SETUP_ONCE_H macro as header inclusion guard up to commit ec691ca3 which changed this to HEADER_CURL_SETUP_ONCE_H, this single inclusion guard is enough to ensure that inclusion of lib/setup_once.h done from lib/setup.h is only done once. Additionally lib/setup.h has always used __SETUP_ONCE_H macro to protect inclusion of setup_once.h even after commit ec691ca3, this was to avoid a circular header inclusion triggered when building a c-ares enabled version with c-ares sources available which also has a setup_once.h header. Commit ec691ca3 exposes the real nature of __SETUP_ONCE_H usage in lib/setup.h, it is a header inclusion guard foreign to libcurl belonging to c-ares's setup_once.h The renaming this commit does, fixes the circular header inclusion, and as such removes the need and usage of a header inclusion guard foreign to libcurl. Macro __SETUP_ONCE_H no longer used in libcurl. 2 - Due to the circular interdependency of old lib/setup_once.h and the c-ares setup_once.h header, old file lib/setup_once.h has carried back from 2006 up to now days an alarming and prominent notice about the need of keeping libcurl's and c-ares's setup_once.h in sync. Given that this commit fixes the circular interdependency, the need and presence of mentioned notice is removed. All mentioned interdependencies come back from now old days when the c-ares project lived inside a curl subdirectory. This commit removes last traces of such fact.
2013-01-06 13:06:49 -05:00
#include "curl_setup.h"
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
internals: rename the SessionHandle struct to Curl_easy
2016-06-21 09:47:12 -04:00
#include "urldata.h" /* for the Curl_easy definition */
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
#include "curl_base64.h"
darwinssl: don't use strtok() The GetDarwinVersionNumber() function uses strtok, which is not thread-safe.
2014-08-05 02:58:49 -04:00
#include "strtok.h"
multi: provide Curl_multiuse_state to update information As soon as a TLS backend gets ALPN conformation about the specific HTTP version it can now set the multiplex situation for the "bundle" and trigger moving potentially queued up transfers to the CONNECT state.
2019-04-30 05:14:38 -04:00
#include "multiif.h"
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef USE_SECTRANSP
build: add our standard includes to curl_darwinssl.c and curl_multibyte.c
2012-06-27 11:13:16 -04:00
darwin: silence compiler warnings With a clang pragma and three type fixes Fixes #1722
2017-08-03 18:04:39 -04:00
#ifdef __clang__
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wtautological-pointer-compare"
darwinssl: fix compiler warning clang complains: vtls/darwinssl.c:40:8: error: extra tokens at end of #endif directive [-Werror,-Wextra-tokens] This breaks the darwinssl build on Travis. Fix it by making this token a comment. Closes https://github.com/curl/curl/pull/1734
2017-08-04 16:47:16 -04:00
#endif /* __clang__ */
darwin: silence compiler warnings With a clang pragma and three type fixes Fixes #1722
2017-08-03 18:04:39 -04:00
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
#include <limits.h>
#include <Security/Security.h>
vtls: encapsulate SSL backend-specific data So far, all of the SSL backends' private data has been declared as part of the ssl_connect_data struct, in one big #if .. #elif .. #endif block. This can only work as long as the SSL backend is a compile-time option, something we want to change in the next commits. Therefore, let's encapsulate the exact data needed by each SSL backend into a private struct, and let's avoid bleeding any SSL backend-specific information into urldata.h. This is also necessary to allow multiple SSL backends to be compiled in at the same time, as e.g. OpenSSL's and CyaSSL's headers cannot be included in the same .c file. To avoid too many malloc() calls, we simply append the private structs to the connectdata struct in allocate_conn(). This requires us to take extra care of alignment issues: struct fields often need to be aligned on certain boundaries e.g. 32-bit values need to be stored at addresses that divide evenly by 4 (= 32 bit / 8 bit-per-byte). We do that by assuming that no SSL backend's private data contains any fields that need to be aligned on boundaries larger than `long long` (typically 64-bit) would need. Under this assumption, we simply add a dummy field of type `long long` to the `struct connectdata` struct. This field will never be accessed but acts as a placeholder for the four instances of ssl_backend_data instead. the size of each ssl_backend_data struct is stored in the SSL backend-specific metadata, to allow allocate_conn() to know how much extra space to allocate, and how to initialize the ssl[sockindex]->backend and proxy_ssl[sockindex]->backend pointers. This would appear to be a little complicated at first, but is really necessary to encapsulate the private data of each SSL backend correctly. And we need to encapsulate thusly if we ever want to allow selecting CyaSSL and OpenSSL at runtime, as their headers cannot be included within the same .c file (there are just too many conflicting definitions and declarations for that). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-07-28 16:09:35 -04:00
/* For some reason, when building for iOS, the omnibus header above does
* not include SecureTransport.h as of iOS SDK 5.1. */
DarwinSSL: several adjustments - Renamed st_ function prefix to darwinssl_ - Renamed Curl_st_ function prefix to Curl_darwinssl_ - Moved the duplicated ssl_connect_done out of the #ifdef in lib/urldata.h - Fixed a teensy little bug that made non-blocking connection attempts block - Made it so that it builds cleanly against the iOS 5.1 SDK
2012-06-26 15:39:48 -04:00
#include <Security/SecureTransport.h>
#include <CoreFoundation/CoreFoundation.h>
DarwinSSL: allow using NTLM authentication Allow NTLM authentication when building using SecureTransport (Darwin) for SSL. This uses CommonCrypto, a cryptography library that ships with all versions of iOS and Mac OS X. It's like OpenSSL's libcrypto, except that it's missing a few less-common cyphers and doesn't have a big number data structure.
2012-06-27 05:57:31 -04:00
#include <CommonCrypto/CommonDigest.h>
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
/* The Security framework has changed greatly between iOS and different macOS
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
versions, and we will try to support as many of them as we can (back to
Leopard and iOS 5) by using macros and weak-linking.
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
In general, you want to build this using the most recent OS SDK, since some
features require curl to be built against the latest SDK. TLS 1.1 and 1.2
support, for instance, require the macOS 10.8 SDK or later. TLS 1.3
requires the macOS 10.13 or iOS 11 SDK or later. */
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
#if (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE))
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if MAC_OS_X_VERSION_MAX_ALLOWED < 1050
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#error "The Secure Transport back-end requires Leopard or later."
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* MAC_OS_X_VERSION_MAX_ALLOWED < 1050 */
#define CURL_BUILD_IOS 0
darwinssl: enable BEAST workaround on iOS 7 & later iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 and a CBC cipher, so we now always turn that on unless the user manually turns it off using CURLSSLOPT_ALLOW_BEAST. It appears Apple also added some new PSK ciphers, but no interface to use them yet, so we at least support printing them if we find them.
2013-09-19 18:28:54 -04:00
#define CURL_BUILD_IOS_7 0
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
#define CURL_BUILD_IOS_9 0
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
#define CURL_BUILD_IOS_11 0
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#define CURL_BUILD_MAC 1
/* This is the maximum API level we are allowed to use when building: */
#define CURL_BUILD_MAC_10_5 MAC_OS_X_VERSION_MAX_ALLOWED >= 1050
#define CURL_BUILD_MAC_10_6 MAC_OS_X_VERSION_MAX_ALLOWED >= 1060
#define CURL_BUILD_MAC_10_7 MAC_OS_X_VERSION_MAX_ALLOWED >= 1070
#define CURL_BUILD_MAC_10_8 MAC_OS_X_VERSION_MAX_ALLOWED >= 1080
darwinssl: enable BEAST workaround on iOS 7 & later iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 and a CBC cipher, so we now always turn that on unless the user manually turns it off using CURLSSLOPT_ALLOW_BEAST. It appears Apple also added some new PSK ciphers, but no interface to use them yet, so we at least support printing them if we find them.
2013-09-19 18:28:54 -04:00
#define CURL_BUILD_MAC_10_9 MAC_OS_X_VERSION_MAX_ALLOWED >= 1090
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
#define CURL_BUILD_MAC_10_11 MAC_OS_X_VERSION_MAX_ALLOWED >= 101100
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
#define CURL_BUILD_MAC_10_13 MAC_OS_X_VERSION_MAX_ALLOWED >= 101300
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
/* These macros mean "the following code is present to allow runtime backward
compatibility with at least this cat or earlier":
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
(You set this at build-time using the compiler command line option
"-mmacos-version-min.") */
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#define CURL_SUPPORT_MAC_10_5 MAC_OS_X_VERSION_MIN_REQUIRED <= 1050
#define CURL_SUPPORT_MAC_10_6 MAC_OS_X_VERSION_MIN_REQUIRED <= 1060
#define CURL_SUPPORT_MAC_10_7 MAC_OS_X_VERSION_MIN_REQUIRED <= 1070
#define CURL_SUPPORT_MAC_10_8 MAC_OS_X_VERSION_MIN_REQUIRED <= 1080
darwinssl: enable BEAST workaround on iOS 7 & later iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 and a CBC cipher, so we now always turn that on unless the user manually turns it off using CURLSSLOPT_ALLOW_BEAST. It appears Apple also added some new PSK ciphers, but no interface to use them yet, so we at least support printing them if we find them.
2013-09-19 18:28:54 -04:00
#define CURL_SUPPORT_MAC_10_9 MAC_OS_X_VERSION_MIN_REQUIRED <= 1090
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#elif TARGET_OS_EMBEDDED || TARGET_OS_IPHONE
#define CURL_BUILD_IOS 1
darwinssl: enable BEAST workaround on iOS 7 & later iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 and a CBC cipher, so we now always turn that on unless the user manually turns it off using CURLSSLOPT_ALLOW_BEAST. It appears Apple also added some new PSK ciphers, but no interface to use them yet, so we at least support printing them if we find them.
2013-09-19 18:28:54 -04:00
#define CURL_BUILD_IOS_7 __IPHONE_OS_VERSION_MAX_ALLOWED >= 70000
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
#define CURL_BUILD_IOS_9 __IPHONE_OS_VERSION_MAX_ALLOWED >= 90000
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
#define CURL_BUILD_IOS_11 __IPHONE_OS_VERSION_MAX_ALLOWED >= 110000
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#define CURL_BUILD_MAC 0
#define CURL_BUILD_MAC_10_5 0
#define CURL_BUILD_MAC_10_6 0
#define CURL_BUILD_MAC_10_7 0
#define CURL_BUILD_MAC_10_8 0
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
#define CURL_BUILD_MAC_10_9 0
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
#define CURL_BUILD_MAC_10_11 0
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
#define CURL_BUILD_MAC_10_13 0
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#define CURL_SUPPORT_MAC_10_5 0
#define CURL_SUPPORT_MAC_10_6 0
#define CURL_SUPPORT_MAC_10_7 0
#define CURL_SUPPORT_MAC_10_8 0
darwinssl: detect possible future removal of SSLv3 from the framework If Apple ever drops SSLv3 support from the Security framework, we'll fail with an error if the user insists on using SSLv3.
2014-10-24 19:59:13 -04:00
#define CURL_SUPPORT_MAC_10_9 0
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#else
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#error "The Secure Transport back-end requires iOS or macOS."
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE)) */
#if CURL_BUILD_MAC
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
#include <sys/sysctl.h>
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC */
build: add our standard includes to curl_darwinssl.c and curl_multibyte.c
2012-06-27 11:13:16 -04:00
Revert changes relative to lib/*.[ch] recent renaming This reverts renaming and usage of lib/*.h header files done 28-12-2012, reverting 2 commits: f871de0... build: make use of 76 lib/*.h renamed files ffd8e12... build: rename 76 lib/*.h files This also reverts removal of redundant include guard (redundant thanks to changes in above commits) done 2-12-2013, reverting 1 commit: c087374... curl_setup.h: remove redundant include guard This also reverts renaming and usage of lib/*.c source files done 3-12-2013, reverting 3 commits: 13606bb... build: make use of 93 lib/*.c renamed files 5b6e792... build: rename 93 lib/*.c files 7d83dff... build: commit 13606bbfde follow-up 1 Start of related discussion thread: http://curl.haxx.se/mail/lib-2013-01/0012.html Asking for confirmation on pushing this revertion commit: http://curl.haxx.se/mail/lib-2013-01/0048.html Confirmation summary: http://curl.haxx.se/mail/lib-2013-01/0079.html NOTICE: The list of 2 files that have been modified by other intermixed commits, while renamed, and also by at least one of the 6 commits this one reverts follows below. These 2 files will exhibit a hole in history unless git's '--follow' option is used when viewing logs. lib/curl_imap.h lib/curl_smtp.h
2013-01-03 20:50:28 -05:00
#include "urldata.h"
#include "sendf.h"
#include "inet_pton.h"
#include "connect.h"
#include "select.h"
vtls: Fixed up include of vtls.h
2013-12-25 05:20:39 -05:00
#include "vtls.h"
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#include "sectransp.h"
vtls: use curl_printf.h all over No need to use _MPRINTF_REPLACE internally.
2015-03-03 17:17:43 -05:00
#include "curl_printf.h"
darwinssl: Fix realloc memleak The reallocation was using the input pointer for the return value, which leads to a memory leak on reallication failure. Fix by instead use the safe internal API call Curl_saferealloc(). Closes #3005 Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Nick Zitzmann <nickzman@gmail.com>
2018-09-18 03:06:07 -04:00
#include "strdup.h"
build: add our standard includes to curl_darwinssl.c and curl_multibyte.c
2012-06-27 11:13:16 -04:00
#include "curl_memory.h"
/* The last #include file should be: */
Revert changes relative to lib/*.[ch] recent renaming This reverts renaming and usage of lib/*.h header files done 28-12-2012, reverting 2 commits: f871de0... build: make use of 76 lib/*.h renamed files ffd8e12... build: rename 76 lib/*.h files This also reverts removal of redundant include guard (redundant thanks to changes in above commits) done 2-12-2013, reverting 1 commit: c087374... curl_setup.h: remove redundant include guard This also reverts renaming and usage of lib/*.c source files done 3-12-2013, reverting 3 commits: 13606bb... build: make use of 93 lib/*.c renamed files 5b6e792... build: rename 93 lib/*.c files 7d83dff... build: commit 13606bbfde follow-up 1 Start of related discussion thread: http://curl.haxx.se/mail/lib-2013-01/0012.html Asking for confirmation on pushing this revertion commit: http://curl.haxx.se/mail/lib-2013-01/0048.html Confirmation summary: http://curl.haxx.se/mail/lib-2013-01/0079.html NOTICE: The list of 2 files that have been modified by other intermixed commits, while renamed, and also by at least one of the 6 commits this one reverts follows below. These 2 files will exhibit a hole in history unless git's '--follow' option is used when viewing logs. lib/curl_imap.h lib/curl_smtp.h
2013-01-03 20:50:28 -05:00
#include "memdebug.h"
build: add our standard includes to curl_darwinssl.c and curl_multibyte.c
2012-06-27 11:13:16 -04:00
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* From MacTypes.h (which we can't include because it isn't present in iOS: */
#define ioErr -36
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
#define paramErr -50
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
vtls: encapsulate SSL backend-specific data So far, all of the SSL backends' private data has been declared as part of the ssl_connect_data struct, in one big #if .. #elif .. #endif block. This can only work as long as the SSL backend is a compile-time option, something we want to change in the next commits. Therefore, let's encapsulate the exact data needed by each SSL backend into a private struct, and let's avoid bleeding any SSL backend-specific information into urldata.h. This is also necessary to allow multiple SSL backends to be compiled in at the same time, as e.g. OpenSSL's and CyaSSL's headers cannot be included in the same .c file. To avoid too many malloc() calls, we simply append the private structs to the connectdata struct in allocate_conn(). This requires us to take extra care of alignment issues: struct fields often need to be aligned on certain boundaries e.g. 32-bit values need to be stored at addresses that divide evenly by 4 (= 32 bit / 8 bit-per-byte). We do that by assuming that no SSL backend's private data contains any fields that need to be aligned on boundaries larger than `long long` (typically 64-bit) would need. Under this assumption, we simply add a dummy field of type `long long` to the `struct connectdata` struct. This field will never be accessed but acts as a placeholder for the four instances of ssl_backend_data instead. the size of each ssl_backend_data struct is stored in the SSL backend-specific metadata, to allow allocate_conn() to know how much extra space to allocate, and how to initialize the ssl[sockindex]->backend and proxy_ssl[sockindex]->backend pointers. This would appear to be a little complicated at first, but is really necessary to encapsulate the private data of each SSL backend correctly. And we need to encapsulate thusly if we ever want to allow selecting CyaSSL and OpenSSL at runtime, as their headers cannot be included within the same .c file (there are just too many conflicting definitions and declarations for that). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-07-28 16:09:35 -04:00
struct ssl_backend_data {
SSLContextRef ssl_ctx;
curl_socket_t ssl_sockfd;
bool ssl_direction; /* true if writing, false if reading */
size_t ssl_write_buffered_length;
};
#define BACKEND connssl->backend
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
/* pinned public key support tests */
/* version 1 supports macOS 10.12+ and iOS 10+ */
#if ((TARGET_OS_IPHONE && __IPHONE_OS_VERSION_MIN_REQUIRED >= 100000) || \
(!TARGET_OS_IPHONE && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101200))
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#define SECTRANSP_PINNEDPUBKEY_V1 1
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
#endif
/* version 2 supports MacOSX 10.7+ */
#if (!TARGET_OS_IPHONE && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070)
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#define SECTRANSP_PINNEDPUBKEY_V2 1
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
#endif
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#if defined(SECTRANSP_PINNEDPUBKEY_V1) || defined(SECTRANSP_PINNEDPUBKEY_V2)
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
/* this backend supports CURLOPT_PINNEDPUBLICKEY */
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#define SECTRANSP_PINNEDPUBKEY 1
#endif /* SECTRANSP_PINNEDPUBKEY */
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
/* both new and old APIs return rsa keys missing the spki header (not DER) */
static const unsigned char rsa4096SpkiHeader[] = {
0x30, 0x82, 0x02, 0x22, 0x30, 0x0d,
0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05,
0x00, 0x03, 0x82, 0x02, 0x0f, 0x00};
static const unsigned char rsa2048SpkiHeader[] = {
0x30, 0x82, 0x01, 0x22, 0x30, 0x0d,
0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05,
0x00, 0x03, 0x82, 0x01, 0x0f, 0x00};
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY_V1
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
/* the *new* version doesn't return DER encoded ecdsa certs like the old... */
static const unsigned char ecDsaSecp256r1SpkiHeader[] = {
0x30, 0x59, 0x30, 0x13, 0x06, 0x07,
0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
0x01, 0x06, 0x08, 0x2a, 0x86, 0x48,
0xce, 0x3d, 0x03, 0x01, 0x07, 0x03,
0x42, 0x00};
static const unsigned char ecDsaSecp384r1SpkiHeader[] = {
0x30, 0x76, 0x30, 0x10, 0x06, 0x07,
0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02,
0x01, 0x06, 0x05, 0x2b, 0x81, 0x04,
0x00, 0x22, 0x03, 0x62, 0x00};
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* SECTRANSP_PINNEDPUBKEY_V1 */
#endif /* SECTRANSP_PINNEDPUBKEY */
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* The following two functions were ripped from Apple sample code,
* with some modifications: */
static OSStatus SocketRead(SSLConnectionRef connection,
void *data, /* owned by
* caller, data
* RETURNED */
size_t *dataLength) /* IN/OUT */
{
darwinssl: Fix implicit conversion compiler warnings The Clang compiler found a few implicit conversion problems that have now been fixed.
2012-12-11 23:43:48 -05:00
size_t bytesToGo = *dataLength;
size_t initLen = bytesToGo;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
UInt8 *currData = (UInt8 *)data;
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
/*int sock = *(int *)connection;*/
struct ssl_connect_data *connssl = (struct ssl_connect_data *)connection;
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
int sock = BACKEND->ssl_sockfd;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
OSStatus rtn = noErr;
darwinssl: Fix implicit conversion compiler warnings The Clang compiler found a few implicit conversion problems that have now been fixed.
2012-12-11 23:43:48 -05:00
size_t bytesRead;
ssize_t rrtn;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
int theErr;
*dataLength = 0;
for(;;) {
bytesRead = 0;
rrtn = read(sock, currData, bytesToGo);
if(rrtn <= 0) {
/* this is guesswork... */
theErr = errno;
darwinssl: fix infinite loop if server disconnected abruptly If the server hung up the connection without sending a closure alert, then we'd keep probing the socket for data even though it's dead. Now we're ready for this situation. Bug: http://curl.haxx.se/mail/lib-2013-03/0014.html Reported by: Aki Koskinen
2013-03-04 00:11:10 -05:00
if(rrtn == 0) { /* EOF = server hung up */
/* the framework will turn this into errSSLClosedNoNotify */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
rtn = errSSLClosedGraceful;
}
else /* do the switch */
switch(theErr) {
case ENOENT:
/* connection closed */
rtn = errSSLClosedGraceful;
break;
case ECONNRESET:
rtn = errSSLClosedAbort;
break;
case EAGAIN:
rtn = errSSLWouldBlock;
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
BACKEND->ssl_direction = false;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
break;
default:
rtn = ioErr;
break;
}
break;
}
else {
bytesRead = rrtn;
}
bytesToGo -= bytesRead;
currData += bytesRead;
if(bytesToGo == 0) {
/* filled buffer with incoming data, done */
break;
}
}
*dataLength = initLen - bytesToGo;
return rtn;
}
static OSStatus SocketWrite(SSLConnectionRef connection,
const void *data,
size_t *dataLength) /* IN/OUT */
{
darwinssl: Fix implicit conversion compiler warnings The Clang compiler found a few implicit conversion problems that have now been fixed.
2012-12-11 23:43:48 -05:00
size_t bytesSent = 0;
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
/*int sock = *(int *)connection;*/
struct ssl_connect_data *connssl = (struct ssl_connect_data *)connection;
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
int sock = BACKEND->ssl_sockfd;
darwinssl: Fix implicit conversion compiler warnings The Clang compiler found a few implicit conversion problems that have now been fixed.
2012-12-11 23:43:48 -05:00
ssize_t length;
size_t dataLen = *dataLength;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
const UInt8 *dataPtr = (UInt8 *)data;
OSStatus ortn;
int theErr;
*dataLength = 0;
do {
length = write(sock,
checksrc: white space edits to comply to stricter checksrc
2016-11-23 02:30:18 -05:00
(char *)dataPtr + bytesSent,
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
dataLen - bytesSent);
} while((length > 0) &&
( (bytesSent += length) < dataLen) );
if(length <= 0) {
theErr = errno;
if(theErr == EAGAIN) {
ortn = errSSLWouldBlock;
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
BACKEND->ssl_direction = true;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
else {
ortn = ioErr;
}
}
else {
ortn = noErr;
}
*dataLength = bytesSent;
return ortn;
}
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
#ifndef CURL_DISABLE_VERBOSE_STRINGS
checksrc: move open braces to comply with function declaration style
2016-11-23 02:49:04 -05:00
CF_INLINE const char *SSLCipherNameForNumber(SSLCipherSuite cipher)
{
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(cipher) {
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
/* SSL version 3.0 */
darwinssl: output cipher with text, remove SNI warning The code was printing a warning when SNI was set up successfully. Oops. Printing the cipher number in verbose mode was something only TLS/SSL programmers might understand, so I had it print the name of the cipher, just like in the OpenSSL code. That'll be at least a little bit easier to understand. The SecureTransport API doesn't have a method of getting a string from a cipher like OpenSSL does, so I had to generate the strings manually.
2012-07-07 16:37:52 -04:00
case SSL_RSA_WITH_NULL_MD5:
return "SSL_RSA_WITH_NULL_MD5";
break;
case SSL_RSA_WITH_NULL_SHA:
return "SSL_RSA_WITH_NULL_SHA";
break;
case SSL_RSA_EXPORT_WITH_RC4_40_MD5:
return "SSL_RSA_EXPORT_WITH_RC4_40_MD5";
break;
case SSL_RSA_WITH_RC4_128_MD5:
return "SSL_RSA_WITH_RC4_128_MD5";
break;
case SSL_RSA_WITH_RC4_128_SHA:
return "SSL_RSA_WITH_RC4_128_SHA";
break;
case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5:
return "SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5";
break;
case SSL_RSA_WITH_IDEA_CBC_SHA:
return "SSL_RSA_WITH_IDEA_CBC_SHA";
break;
case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA:
return "SSL_RSA_EXPORT_WITH_DES40_CBC_SHA";
break;
case SSL_RSA_WITH_DES_CBC_SHA:
return "SSL_RSA_WITH_DES_CBC_SHA";
break;
case SSL_RSA_WITH_3DES_EDE_CBC_SHA:
return "SSL_RSA_WITH_3DES_EDE_CBC_SHA";
break;
case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA:
return "SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA";
break;
case SSL_DH_DSS_WITH_DES_CBC_SHA:
return "SSL_DH_DSS_WITH_DES_CBC_SHA";
break;
case SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA:
return "SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA";
break;
case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA:
return "SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA";
break;
case SSL_DH_RSA_WITH_DES_CBC_SHA:
return "SSL_DH_RSA_WITH_DES_CBC_SHA";
break;
case SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA:
return "SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA";
break;
case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA:
return "SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA";
break;
case SSL_DHE_DSS_WITH_DES_CBC_SHA:
return "SSL_DHE_DSS_WITH_DES_CBC_SHA";
break;
case SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA:
return "SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA";
break;
case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA:
return "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA";
break;
case SSL_DHE_RSA_WITH_DES_CBC_SHA:
return "SSL_DHE_RSA_WITH_DES_CBC_SHA";
break;
case SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA:
return "SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA";
break;
case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5:
return "SSL_DH_anon_EXPORT_WITH_RC4_40_MD5";
break;
case SSL_DH_anon_WITH_RC4_128_MD5:
return "SSL_DH_anon_WITH_RC4_128_MD5";
break;
case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA:
return "SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA";
break;
case SSL_DH_anon_WITH_DES_CBC_SHA:
return "SSL_DH_anon_WITH_DES_CBC_SHA";
break;
case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA:
return "SSL_DH_anon_WITH_3DES_EDE_CBC_SHA";
break;
case SSL_FORTEZZA_DMS_WITH_NULL_SHA:
return "SSL_FORTEZZA_DMS_WITH_NULL_SHA";
break;
case SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA:
return "SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA";
break;
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
/* TLS 1.0 with AES (RFC 3268)
(Apparently these are used in SSLv3 implementations as well.) */
case TLS_RSA_WITH_AES_128_CBC_SHA:
return "TLS_RSA_WITH_AES_128_CBC_SHA";
break;
case TLS_DH_DSS_WITH_AES_128_CBC_SHA:
return "TLS_DH_DSS_WITH_AES_128_CBC_SHA";
break;
case TLS_DH_RSA_WITH_AES_128_CBC_SHA:
return "TLS_DH_RSA_WITH_AES_128_CBC_SHA";
break;
case TLS_DHE_DSS_WITH_AES_128_CBC_SHA:
return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA";
break;
case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA";
break;
case TLS_DH_anon_WITH_AES_128_CBC_SHA:
return "TLS_DH_anon_WITH_AES_128_CBC_SHA";
break;
case TLS_RSA_WITH_AES_256_CBC_SHA:
return "TLS_RSA_WITH_AES_256_CBC_SHA";
break;
case TLS_DH_DSS_WITH_AES_256_CBC_SHA:
return "TLS_DH_DSS_WITH_AES_256_CBC_SHA";
break;
case TLS_DH_RSA_WITH_AES_256_CBC_SHA:
return "TLS_DH_RSA_WITH_AES_256_CBC_SHA";
break;
case TLS_DHE_DSS_WITH_AES_256_CBC_SHA:
return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA";
break;
case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA";
break;
case TLS_DH_anon_WITH_AES_256_CBC_SHA:
return "TLS_DH_anon_WITH_AES_256_CBC_SHA";
break;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
/* SSL version 2.0 */
case SSL_RSA_WITH_RC2_CBC_MD5:
return "SSL_RSA_WITH_RC2_CBC_MD5";
break;
case SSL_RSA_WITH_IDEA_CBC_MD5:
return "SSL_RSA_WITH_IDEA_CBC_MD5";
break;
case SSL_RSA_WITH_DES_CBC_MD5:
return "SSL_RSA_WITH_DES_CBC_MD5";
break;
case SSL_RSA_WITH_3DES_EDE_CBC_MD5:
return "SSL_RSA_WITH_3DES_EDE_CBC_MD5";
break;
}
return "SSL_NULL_WITH_NULL_NULL";
}
checksrc: move open braces to comply with function declaration style
2016-11-23 02:49:04 -05:00
CF_INLINE const char *TLSCipherNameForNumber(SSLCipherSuite cipher)
{
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
switch(cipher) {
/* TLS 1.0 with AES (RFC 3268) */
darwinssl: output cipher with text, remove SNI warning The code was printing a warning when SNI was set up successfully. Oops. Printing the cipher number in verbose mode was something only TLS/SSL programmers might understand, so I had it print the name of the cipher, just like in the OpenSSL code. That'll be at least a little bit easier to understand. The SecureTransport API doesn't have a method of getting a string from a cipher like OpenSSL does, so I had to generate the strings manually.
2012-07-07 16:37:52 -04:00
case TLS_RSA_WITH_AES_128_CBC_SHA:
return "TLS_RSA_WITH_AES_128_CBC_SHA";
break;
case TLS_DH_DSS_WITH_AES_128_CBC_SHA:
return "TLS_DH_DSS_WITH_AES_128_CBC_SHA";
break;
case TLS_DH_RSA_WITH_AES_128_CBC_SHA:
return "TLS_DH_RSA_WITH_AES_128_CBC_SHA";
break;
case TLS_DHE_DSS_WITH_AES_128_CBC_SHA:
return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA";
break;
case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA";
break;
case TLS_DH_anon_WITH_AES_128_CBC_SHA:
return "TLS_DH_anon_WITH_AES_128_CBC_SHA";
break;
case TLS_RSA_WITH_AES_256_CBC_SHA:
return "TLS_RSA_WITH_AES_256_CBC_SHA";
break;
case TLS_DH_DSS_WITH_AES_256_CBC_SHA:
return "TLS_DH_DSS_WITH_AES_256_CBC_SHA";
break;
case TLS_DH_RSA_WITH_AES_256_CBC_SHA:
return "TLS_DH_RSA_WITH_AES_256_CBC_SHA";
break;
case TLS_DHE_DSS_WITH_AES_256_CBC_SHA:
return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA";
break;
case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA";
break;
case TLS_DH_anon_WITH_AES_256_CBC_SHA:
return "TLS_DH_anon_WITH_AES_256_CBC_SHA";
break;
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
/* TLS 1.0 with ECDSA (RFC 4492) */
darwinssl: output cipher with text, remove SNI warning The code was printing a warning when SNI was set up successfully. Oops. Printing the cipher number in verbose mode was something only TLS/SSL programmers might understand, so I had it print the name of the cipher, just like in the OpenSSL code. That'll be at least a little bit easier to understand. The SecureTransport API doesn't have a method of getting a string from a cipher like OpenSSL does, so I had to generate the strings manually.
2012-07-07 16:37:52 -04:00
case TLS_ECDH_ECDSA_WITH_NULL_SHA:
return "TLS_ECDH_ECDSA_WITH_NULL_SHA";
break;
case TLS_ECDH_ECDSA_WITH_RC4_128_SHA:
return "TLS_ECDH_ECDSA_WITH_RC4_128_SHA";
break;
case TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA:
return "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA:
return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA";
break;
case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA:
return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA";
break;
case TLS_ECDHE_ECDSA_WITH_NULL_SHA:
return "TLS_ECDHE_ECDSA_WITH_NULL_SHA";
break;
case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA:
return "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA";
break;
case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:
return "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA";
break;
case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA";
break;
case TLS_ECDH_RSA_WITH_NULL_SHA:
return "TLS_ECDH_RSA_WITH_NULL_SHA";
break;
case TLS_ECDH_RSA_WITH_RC4_128_SHA:
return "TLS_ECDH_RSA_WITH_RC4_128_SHA";
break;
case TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA:
return "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA:
return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA";
break;
case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA:
return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA";
break;
case TLS_ECDHE_RSA_WITH_NULL_SHA:
return "TLS_ECDHE_RSA_WITH_NULL_SHA";
break;
case TLS_ECDHE_RSA_WITH_RC4_128_SHA:
return "TLS_ECDHE_RSA_WITH_RC4_128_SHA";
break;
case TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:
return "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA";
break;
case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA";
break;
case TLS_ECDH_anon_WITH_NULL_SHA:
return "TLS_ECDH_anon_WITH_NULL_SHA";
break;
case TLS_ECDH_anon_WITH_RC4_128_SHA:
return "TLS_ECDH_anon_WITH_RC4_128_SHA";
break;
case TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA:
return "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_ECDH_anon_WITH_AES_128_CBC_SHA:
return "TLS_ECDH_anon_WITH_AES_128_CBC_SHA";
break;
case TLS_ECDH_anon_WITH_AES_256_CBC_SHA:
return "TLS_ECDH_anon_WITH_AES_256_CBC_SHA";
break;
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
/* TLS 1.2 (RFC 5246) */
case TLS_RSA_WITH_NULL_MD5:
return "TLS_RSA_WITH_NULL_MD5";
darwinssl: output cipher with text, remove SNI warning The code was printing a warning when SNI was set up successfully. Oops. Printing the cipher number in verbose mode was something only TLS/SSL programmers might understand, so I had it print the name of the cipher, just like in the OpenSSL code. That'll be at least a little bit easier to understand. The SecureTransport API doesn't have a method of getting a string from a cipher like OpenSSL does, so I had to generate the strings manually.
2012-07-07 16:37:52 -04:00
break;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
case TLS_RSA_WITH_NULL_SHA:
return "TLS_RSA_WITH_NULL_SHA";
darwinssl: output cipher with text, remove SNI warning The code was printing a warning when SNI was set up successfully. Oops. Printing the cipher number in verbose mode was something only TLS/SSL programmers might understand, so I had it print the name of the cipher, just like in the OpenSSL code. That'll be at least a little bit easier to understand. The SecureTransport API doesn't have a method of getting a string from a cipher like OpenSSL does, so I had to generate the strings manually.
2012-07-07 16:37:52 -04:00
break;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
case TLS_RSA_WITH_RC4_128_MD5:
return "TLS_RSA_WITH_RC4_128_MD5";
darwinssl: output cipher with text, remove SNI warning The code was printing a warning when SNI was set up successfully. Oops. Printing the cipher number in verbose mode was something only TLS/SSL programmers might understand, so I had it print the name of the cipher, just like in the OpenSSL code. That'll be at least a little bit easier to understand. The SecureTransport API doesn't have a method of getting a string from a cipher like OpenSSL does, so I had to generate the strings manually.
2012-07-07 16:37:52 -04:00
break;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
case TLS_RSA_WITH_RC4_128_SHA:
return "TLS_RSA_WITH_RC4_128_SHA";
break;
case TLS_RSA_WITH_3DES_EDE_CBC_SHA:
return "TLS_RSA_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_RSA_WITH_NULL_SHA256:
return "TLS_RSA_WITH_NULL_SHA256";
break;
case TLS_RSA_WITH_AES_128_CBC_SHA256:
return "TLS_RSA_WITH_AES_128_CBC_SHA256";
break;
case TLS_RSA_WITH_AES_256_CBC_SHA256:
return "TLS_RSA_WITH_AES_256_CBC_SHA256";
break;
case TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA:
return "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA:
return "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA:
return "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA:
return "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_DH_DSS_WITH_AES_128_CBC_SHA256:
return "TLS_DH_DSS_WITH_AES_128_CBC_SHA256";
break;
case TLS_DH_RSA_WITH_AES_128_CBC_SHA256:
return "TLS_DH_RSA_WITH_AES_128_CBC_SHA256";
break;
case TLS_DHE_DSS_WITH_AES_128_CBC_SHA256:
return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256";
break;
case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256";
break;
case TLS_DH_DSS_WITH_AES_256_CBC_SHA256:
return "TLS_DH_DSS_WITH_AES_256_CBC_SHA256";
break;
case TLS_DH_RSA_WITH_AES_256_CBC_SHA256:
return "TLS_DH_RSA_WITH_AES_256_CBC_SHA256";
break;
case TLS_DHE_DSS_WITH_AES_256_CBC_SHA256:
return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256";
break;
case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256";
break;
case TLS_DH_anon_WITH_RC4_128_MD5:
return "TLS_DH_anon_WITH_RC4_128_MD5";
break;
case TLS_DH_anon_WITH_3DES_EDE_CBC_SHA:
return "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_DH_anon_WITH_AES_128_CBC_SHA256:
return "TLS_DH_anon_WITH_AES_128_CBC_SHA256";
break;
case TLS_DH_anon_WITH_AES_256_CBC_SHA256:
return "TLS_DH_anon_WITH_AES_256_CBC_SHA256";
break;
/* TLS 1.2 with AES GCM (RFC 5288) */
case TLS_RSA_WITH_AES_128_GCM_SHA256:
return "TLS_RSA_WITH_AES_128_GCM_SHA256";
break;
case TLS_RSA_WITH_AES_256_GCM_SHA384:
return "TLS_RSA_WITH_AES_256_GCM_SHA384";
break;
case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
return "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256";
break;
case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
return "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384";
break;
case TLS_DH_RSA_WITH_AES_128_GCM_SHA256:
return "TLS_DH_RSA_WITH_AES_128_GCM_SHA256";
break;
case TLS_DH_RSA_WITH_AES_256_GCM_SHA384:
return "TLS_DH_RSA_WITH_AES_256_GCM_SHA384";
break;
case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256:
return "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256";
break;
case TLS_DHE_DSS_WITH_AES_256_GCM_SHA384:
return "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384";
break;
case TLS_DH_DSS_WITH_AES_128_GCM_SHA256:
return "TLS_DH_DSS_WITH_AES_128_GCM_SHA256";
break;
case TLS_DH_DSS_WITH_AES_256_GCM_SHA384:
return "TLS_DH_DSS_WITH_AES_256_GCM_SHA384";
break;
case TLS_DH_anon_WITH_AES_128_GCM_SHA256:
return "TLS_DH_anon_WITH_AES_128_GCM_SHA256";
break;
case TLS_DH_anon_WITH_AES_256_GCM_SHA384:
return "TLS_DH_anon_WITH_AES_256_GCM_SHA384";
break;
/* TLS 1.2 with elliptic curve ciphers (RFC 5289) */
case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256";
darwinssl: output cipher with text, remove SNI warning The code was printing a warning when SNI was set up successfully. Oops. Printing the cipher number in verbose mode was something only TLS/SSL programmers might understand, so I had it print the name of the cipher, just like in the OpenSSL code. That'll be at least a little bit easier to understand. The SecureTransport API doesn't have a method of getting a string from a cipher like OpenSSL does, so I had to generate the strings manually.
2012-07-07 16:37:52 -04:00
break;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384";
break;
case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256:
return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256";
break;
case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384:
return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384";
break;
case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256";
break;
case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384:
return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384";
break;
case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256:
return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256";
break;
case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384:
return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384";
break;
case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
return "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256";
break;
case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
return "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384";
break;
case TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256:
return "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256";
break;
case TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384:
return "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384";
break;
case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
return "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256";
break;
case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
return "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384";
break;
case TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256:
return "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256";
break;
case TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384:
return "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384";
break;
case TLS_EMPTY_RENEGOTIATION_INFO_SCSV:
return "TLS_EMPTY_RENEGOTIATION_INFO_SCSV";
break;
darwinssl: Bugfix for previous commit for older cats I accidentally broke functionality for versions of OS X prior to Mountain Lion in the previous commit. This commit fixes the problems.
2012-08-20 22:22:51 -04:00
#else
case SSL_RSA_WITH_NULL_MD5:
return "TLS_RSA_WITH_NULL_MD5";
break;
case SSL_RSA_WITH_NULL_SHA:
return "TLS_RSA_WITH_NULL_SHA";
break;
case SSL_RSA_WITH_RC4_128_MD5:
return "TLS_RSA_WITH_RC4_128_MD5";
break;
case SSL_RSA_WITH_RC4_128_SHA:
return "TLS_RSA_WITH_RC4_128_SHA";
break;
case SSL_RSA_WITH_3DES_EDE_CBC_SHA:
return "TLS_RSA_WITH_3DES_EDE_CBC_SHA";
break;
case SSL_DH_anon_WITH_RC4_128_MD5:
return "TLS_DH_anon_WITH_RC4_128_MD5";
break;
case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA:
return "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA";
break;
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
darwinssl: enable BEAST workaround on iOS 7 & later iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 and a CBC cipher, so we now always turn that on unless the user manually turns it off using CURLSSLOPT_ALLOW_BEAST. It appears Apple also added some new PSK ciphers, but no interface to use them yet, so we at least support printing them if we find them.
2013-09-19 18:28:54 -04:00
#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
/* TLS PSK (RFC 4279): */
case TLS_PSK_WITH_RC4_128_SHA:
return "TLS_PSK_WITH_RC4_128_SHA";
break;
case TLS_PSK_WITH_3DES_EDE_CBC_SHA:
return "TLS_PSK_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_PSK_WITH_AES_128_CBC_SHA:
return "TLS_PSK_WITH_AES_128_CBC_SHA";
break;
case TLS_PSK_WITH_AES_256_CBC_SHA:
return "TLS_PSK_WITH_AES_256_CBC_SHA";
break;
case TLS_DHE_PSK_WITH_RC4_128_SHA:
return "TLS_DHE_PSK_WITH_RC4_128_SHA";
break;
case TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA:
return "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_DHE_PSK_WITH_AES_128_CBC_SHA:
return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA";
break;
case TLS_DHE_PSK_WITH_AES_256_CBC_SHA:
return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA";
break;
case TLS_RSA_PSK_WITH_RC4_128_SHA:
return "TLS_RSA_PSK_WITH_RC4_128_SHA";
break;
case TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA:
return "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA";
break;
case TLS_RSA_PSK_WITH_AES_128_CBC_SHA:
return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA";
break;
case TLS_RSA_PSK_WITH_AES_256_CBC_SHA:
return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA";
break;
/* More TLS PSK (RFC 4785): */
case TLS_PSK_WITH_NULL_SHA:
return "TLS_PSK_WITH_NULL_SHA";
break;
case TLS_DHE_PSK_WITH_NULL_SHA:
return "TLS_DHE_PSK_WITH_NULL_SHA";
break;
case TLS_RSA_PSK_WITH_NULL_SHA:
return "TLS_RSA_PSK_WITH_NULL_SHA";
break;
/* Even more TLS PSK (RFC 5487): */
case TLS_PSK_WITH_AES_128_GCM_SHA256:
return "TLS_PSK_WITH_AES_128_GCM_SHA256";
break;
case TLS_PSK_WITH_AES_256_GCM_SHA384:
return "TLS_PSK_WITH_AES_256_GCM_SHA384";
break;
case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256:
return "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256";
break;
case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384:
return "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384";
break;
case TLS_RSA_PSK_WITH_AES_128_GCM_SHA256:
return "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256";
break;
case TLS_RSA_PSK_WITH_AES_256_GCM_SHA384:
return "TLS_PSK_WITH_AES_256_GCM_SHA384";
break;
case TLS_PSK_WITH_AES_128_CBC_SHA256:
return "TLS_PSK_WITH_AES_128_CBC_SHA256";
break;
case TLS_PSK_WITH_AES_256_CBC_SHA384:
return "TLS_PSK_WITH_AES_256_CBC_SHA384";
break;
case TLS_PSK_WITH_NULL_SHA256:
return "TLS_PSK_WITH_NULL_SHA256";
break;
case TLS_PSK_WITH_NULL_SHA384:
return "TLS_PSK_WITH_NULL_SHA384";
break;
case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256:
return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256";
break;
case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384:
return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384";
break;
case TLS_DHE_PSK_WITH_NULL_SHA256:
return "TLS_DHE_PSK_WITH_NULL_SHA256";
break;
case TLS_DHE_PSK_WITH_NULL_SHA384:
return "TLS_RSA_PSK_WITH_NULL_SHA384";
break;
case TLS_RSA_PSK_WITH_AES_128_CBC_SHA256:
return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256";
break;
case TLS_RSA_PSK_WITH_AES_256_CBC_SHA384:
return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384";
break;
case TLS_RSA_PSK_WITH_NULL_SHA256:
return "TLS_RSA_PSK_WITH_NULL_SHA256";
break;
case TLS_RSA_PSK_WITH_NULL_SHA384:
return "TLS_RSA_PSK_WITH_NULL_SHA384";
break;
#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11
/* New ChaCha20+Poly1305 cipher-suites used by TLS 1.3: */
case TLS_AES_128_GCM_SHA256:
return "TLS_AES_128_GCM_SHA256";
break;
case TLS_AES_256_GCM_SHA384:
return "TLS_AES_256_GCM_SHA384";
break;
case TLS_CHACHA20_POLY1305_SHA256:
return "TLS_CHACHA20_POLY1305_SHA256";
break;
case TLS_AES_128_CCM_SHA256:
return "TLS_AES_128_CCM_SHA256";
break;
case TLS_AES_128_CCM_8_SHA256:
return "TLS_AES_128_CCM_8_SHA256";
break;
case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
return "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256";
break;
case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
return "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256";
break;
#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */
darwinssl: output cipher with text, remove SNI warning The code was printing a warning when SNI was set up successfully. Oops. Printing the cipher number in verbose mode was something only TLS/SSL programmers might understand, so I had it print the name of the cipher, just like in the OpenSSL code. That'll be at least a little bit easier to understand. The SecureTransport API doesn't have a method of getting a string from a cipher like OpenSSL does, so I had to generate the strings manually.
2012-07-07 16:37:52 -04:00
}
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
return "TLS_NULL_WITH_NULL_NULL";
darwinssl: output cipher with text, remove SNI warning The code was printing a warning when SNI was set up successfully. Oops. Printing the cipher number in verbose mode was something only TLS/SSL programmers might understand, so I had it print the name of the cipher, just like in the OpenSSL code. That'll be at least a little bit easier to understand. The SecureTransport API doesn't have a method of getting a string from a cipher like OpenSSL does, so I had to generate the strings manually.
2012-07-07 16:37:52 -04:00
}
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
darwinssl: output cipher with text, remove SNI warning The code was printing a warning when SNI was set up successfully. Oops. Printing the cipher number in verbose mode was something only TLS/SSL programmers might understand, so I had it print the name of the cipher, just like in the OpenSSL code. That'll be at least a little bit easier to understand. The SecureTransport API doesn't have a method of getting a string from a cipher like OpenSSL does, so I had to generate the strings manually.
2012-07-07 16:37:52 -04:00
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
CF_INLINE void GetDarwinVersionNumber(int *major, int *minor)
{
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
int mib[2];
char *os_version;
size_t os_version_len;
darwinssl: removed commented out code
2016-04-19 02:32:14 -04:00
char *os_version_major, *os_version_minor;
darwinssl: don't use strtok() The GetDarwinVersionNumber() function uses strtok, which is not thread-safe.
2014-08-05 02:58:49 -04:00
char *tok_buf;
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
/* Get the Darwin kernel version from the kernel using sysctl(): */
mib[0] = CTL_KERN;
mib[1] = KERN_OSRELEASE;
if(sysctl(mib, 2, NULL, &os_version_len, NULL, 0) == -1)
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
return;
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
os_version = malloc(os_version_len*sizeof(char));
if(!os_version)
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
return;
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
if(sysctl(mib, 2, os_version, &os_version_len, NULL, 0) == -1) {
free(os_version);
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
return;
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
}
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
/* Parse the version: */
darwinssl: don't use strtok() The GetDarwinVersionNumber() function uses strtok, which is not thread-safe.
2014-08-05 02:58:49 -04:00
os_version_major = strtok_r(os_version, ".", &tok_buf);
os_version_minor = strtok_r(NULL, ".", &tok_buf);
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
*major = atoi(os_version_major);
*minor = atoi(os_version_minor);
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
free(os_version);
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC */
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
/* Apple provides a myriad of ways of getting information about a certificate
into a string. Some aren't available under iOS or newer cats. So here's
a unified function for getting a string describing the certificate that
ought to work in all cats starting with Leopard. */
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
CF_INLINE CFStringRef getsubject(SecCertificateRef cert)
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
{
CFStringRef server_cert_summary = CFSTR("(null)");
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_IOS
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
/* iOS: There's only one way to do this. */
server_cert_summary = SecCertificateCopySubjectSummary(cert);
#else
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_7
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
/* Lion & later: Get the long description if we can. */
if(SecCertificateCopyLongDescription != NULL)
server_cert_summary =
SecCertificateCopyLongDescription(NULL, cert, NULL);
else
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_7 */
#if CURL_BUILD_MAC_10_6
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
/* Snow Leopard: Get the certificate summary. */
if(SecCertificateCopySubjectSummary != NULL)
server_cert_summary = SecCertificateCopySubjectSummary(cert);
else
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_6 */
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
/* Leopard is as far back as we go... */
(void)SecCertificateCopyCommonName(cert, &server_cert_summary);
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_IOS */
darwinssl: Fix build under Leopard It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07 20:45:07 -05:00
return server_cert_summary;
}
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
static CURLcode CopyCertSubject(struct Curl_easy *data,
SecCertificateRef cert, char **certp)
{
CFStringRef c = getsubject(cert);
CURLcode result = CURLE_OK;
darwinssl: handle long strings in TLS certs (follow-up) - Fix handling certificate subjects that are already UTF-8 encoded. Follow-up to b3b75d1 from two days ago. Since then a copy would be skipped if the subject was already UTF-8, possibly resulting in a NULL deref later on. Ref: https://github.com/curl/curl/issues/1823 Ref: https://github.com/curl/curl/pull/1831 Closes https://github.com/curl/curl/pull/1836
2017-08-27 23:37:02 -04:00
const char *direct;
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
char *cbuf = NULL;
*certp = NULL;
darwinssl: handle long strings in TLS certs (follow-up) - Fix handling certificate subjects that are already UTF-8 encoded. Follow-up to b3b75d1 from two days ago. Since then a copy would be skipped if the subject was already UTF-8, possibly resulting in a NULL deref later on. Ref: https://github.com/curl/curl/issues/1823 Ref: https://github.com/curl/curl/pull/1831 Closes https://github.com/curl/curl/pull/1836
2017-08-27 23:37:02 -04:00
if(!c) {
failf(data, "SSL: invalid CA certificate subject");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: handle long strings in TLS certs (follow-up) - Fix handling certificate subjects that are already UTF-8 encoded. Follow-up to b3b75d1 from two days ago. Since then a copy would be skipped if the subject was already UTF-8, possibly resulting in a NULL deref later on. Ref: https://github.com/curl/curl/issues/1823 Ref: https://github.com/curl/curl/pull/1831 Closes https://github.com/curl/curl/pull/1836
2017-08-27 23:37:02 -04:00
}
/* If the subject is already available as UTF-8 encoded (ie 'direct') then
use that, else convert it. */
direct = CFStringGetCStringPtr(c, kCFStringEncodingUTF8);
if(direct) {
*certp = strdup(direct);
if(!*certp) {
failf(data, "SSL: out of memory");
result = CURLE_OUT_OF_MEMORY;
}
}
else {
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
size_t cbuf_size = ((size_t)CFStringGetLength(c) * 4) + 1;
cbuf = calloc(cbuf_size, 1);
if(cbuf) {
if(!CFStringGetCString(c, cbuf, cbuf_size,
kCFStringEncodingUTF8)) {
failf(data, "SSL: invalid CA certificate subject");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
result = CURLE_PEER_FAILED_VERIFICATION;
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
}
else
/* pass back the buffer */
*certp = cbuf;
}
else {
failf(data, "SSL: couldn't allocate %zu bytes of memory", cbuf_size);
result = CURLE_OUT_OF_MEMORY;
}
}
if(result)
free(cbuf);
CFRelease(c);
return result;
}
darwinssl: Fix #if 10.6.0 for SecKeychainSearch The comment here says that SecKeychainSearch causes a deprecation warning when used with a minimum Mac OS X SDK version of 10.7.0, which is correct. However, the #if guard did not match. It was intended to only use the code if 10.6.0 support was enabled, but it had 10.7.0 instead. This caused a warning if the minimum was exactly 10.7.0.
2013-12-03 19:07:32 -05:00
#if CURL_SUPPORT_MAC_10_6
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
/* The SecKeychainSearch API was deprecated in Lion, and using it will raise
deprecation warnings, so let's not compile this unless it's necessary: */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
static OSStatus CopyIdentityWithLabelOldSchool(char *label,
SecIdentityRef *out_c_a_k)
{
OSStatus status = errSecItemNotFound;
SecKeychainAttributeList attr_list;
SecKeychainAttribute attr;
SecKeychainSearchRef search = NULL;
SecCertificateRef cert = NULL;
/* Set up the attribute list: */
attr_list.count = 1L;
attr_list.attr = &attr;
/* Set up our lone search criterion: */
attr.tag = kSecLabelItemAttr;
attr.data = label;
attr.length = (UInt32)strlen(label);
/* Start searching: */
status = SecKeychainSearchCreateFromAttributes(NULL,
kSecCertificateItemClass,
&attr_list,
&search);
if(status == noErr) {
status = SecKeychainSearchCopyNext(search,
(SecKeychainItemRef *)&cert);
if(status == noErr && cert) {
/* If we found a certificate, does it have a private key? */
status = SecIdentityCreateWithCertificate(NULL, cert, out_c_a_k);
CFRelease(cert);
}
}
if(search)
CFRelease(search);
return status;
}
darwinssl: Fix #if 10.6.0 for SecKeychainSearch The comment here says that SecKeychainSearch causes a deprecation warning when used with a minimum Mac OS X SDK version of 10.7.0, which is correct. However, the #if guard did not match. It was intended to only use the code if 10.6.0 support was enabled, but it had 10.7.0 instead. This caused a warning if the minimum was exactly 10.7.0.
2013-12-03 19:07:32 -05:00
#endif /* CURL_SUPPORT_MAC_10_6 */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
static OSStatus CopyIdentityWithLabel(char *label,
SecIdentityRef *out_cert_and_key)
{
OSStatus status = errSecItemNotFound;
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
CFArrayRef keys_list;
CFIndex keys_list_count;
CFIndex i;
CFStringRef common_name;
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
darwinssl: fix build error in crypto authentication under Snow Leopard It turns out Snow Leopard not only has SecItemCopyMatching() defined in a header not included by the omnibus header, but it won't work for our purposes, because searching for SecIdentityRef objects wasn't added to that API until Lion. So we now use the old SecKeychainSearch API instead if the user is building under, or running under, Snow Leopard. Bug: http://sourceforge.net/p/curl/bugs/1255/ Reported by: Edward Rudd
2013-07-30 22:25:38 -04:00
/* SecItemCopyMatching() was introduced in iOS and Snow Leopard.
kSecClassIdentity was introduced in Lion. If both exist, let's use them
to find the certificate. */
if(SecItemCopyMatching != NULL && kSecClassIdentity != NULL) {
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
CFTypeRef keys[5];
CFTypeRef values[5];
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
CFDictionaryRef query_dict;
CFStringRef label_cf = CFStringCreateWithCString(NULL, label,
kCFStringEncodingUTF8);
/* Set up our search criteria and expected results: */
values[0] = kSecClassIdentity; /* we want a certificate and a key */
keys[0] = kSecClass;
values[1] = kCFBooleanTrue; /* we want a reference */
keys[1] = kSecReturnRef;
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
values[2] = kSecMatchLimitAll; /* kSecMatchLimitOne would be better if the
* label matching below worked correctly */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
keys[2] = kSecMatchLimit;
/* identity searches need a SecPolicyRef in order to work */
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
values[3] = SecPolicyCreateSSL(false, NULL);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
keys[3] = kSecMatchPolicy;
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
/* match the name of the certificate (doesn't work in macOS 10.12.1) */
values[4] = label_cf;
keys[4] = kSecAttrLabel;
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
query_dict = CFDictionaryCreate(NULL, (const void **)keys,
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
(const void **)values, 5L,
&kCFCopyStringDictionaryKeyCallBacks,
&kCFTypeDictionaryValueCallBacks);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
CFRelease(values[3]);
/* Do we have a match? */
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
status = SecItemCopyMatching(query_dict, (CFTypeRef *) &keys_list);
/* Because kSecAttrLabel matching doesn't work with kSecClassIdentity,
* we need to find the correct identity ourselves */
if(status == noErr) {
keys_list_count = CFArrayGetCount(keys_list);
*out_cert_and_key = NULL;
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
status = 1;
code style: use spaces around equals signs
2017-09-09 17:09:06 -04:00
for(i = 0; i<keys_list_count; i++) {
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
OSStatus err = noErr;
SecCertificateRef cert = NULL;
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
SecIdentityRef identity =
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
(SecIdentityRef) CFArrayGetValueAtIndex(keys_list, i);
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
err = SecIdentityCopyCertificate(identity, &cert);
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
if(err == noErr) {
darwinssl: fix iOS build Reviewed-by: Nick Zitzmann Fixes #1172
2016-12-22 21:27:17 -05:00
#if CURL_BUILD_IOS
common_name = SecCertificateCopySubjectSummary(cert);
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
#elif CURL_BUILD_MAC_10_7
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
SecCertificateCopyCommonName(cert, &common_name);
darwinssl: fix iOS build Reviewed-by: Nick Zitzmann Fixes #1172
2016-12-22 21:27:17 -05:00
#endif
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
if(CFStringCompare(common_name, label_cf, 0) == kCFCompareEqualTo) {
CFRelease(cert);
CFRelease(common_name);
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
CFRetain(identity);
*out_cert_and_key = identity;
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
status = noErr;
break;
}
CFRelease(common_name);
}
CFRelease(cert);
}
}
darwinssl: fix CFArrayRef leak Reviewed-by: Nick Zitzmann Closes #1173
2016-12-22 21:50:31 -05:00
if(keys_list)
CFRelease(keys_list);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
CFRelease(query_dict);
darwinssl: fix SSL client certificate not found on MacOS Sierra Reviewed-by: Nick Zitzmann Closes #1105
2016-11-04 10:18:16 -04:00
CFRelease(label_cf);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
}
else {
darwinssl: Fix #if 10.6.0 for SecKeychainSearch The comment here says that SecKeychainSearch causes a deprecation warning when used with a minimum Mac OS X SDK version of 10.7.0, which is correct. However, the #if guard did not match. It was intended to only use the code if 10.6.0 support was enabled, but it had 10.7.0 instead. This caused a warning if the minimum was exactly 10.7.0.
2013-12-03 19:07:32 -05:00
#if CURL_SUPPORT_MAC_10_6
darwinssl: fix build error in crypto authentication under Snow Leopard It turns out Snow Leopard not only has SecItemCopyMatching() defined in a header not included by the omnibus header, but it won't work for our purposes, because searching for SecIdentityRef objects wasn't added to that API until Lion. So we now use the old SecKeychainSearch API instead if the user is building under, or running under, Snow Leopard. Bug: http://sourceforge.net/p/curl/bugs/1255/ Reported by: Edward Rudd
2013-07-30 22:25:38 -04:00
/* On Leopard and Snow Leopard, fall back to SecKeychainSearch. */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key);
darwinssl: Fix typo in comment Closes https://github.com/curl/curl/pull/1028
2016-09-19 15:32:48 -04:00
#endif /* CURL_SUPPORT_MAC_10_6 */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
}
darwinssl: Fix #if 10.6.0 for SecKeychainSearch The comment here says that SecKeychainSearch causes a deprecation warning when used with a minimum Mac OS X SDK version of 10.7.0, which is correct. However, the #if guard did not match. It was intended to only use the code if 10.6.0 support was enabled, but it had 10.7.0 instead. This caused a warning if the minimum was exactly 10.7.0.
2013-12-03 19:07:32 -05:00
#elif CURL_SUPPORT_MAC_10_6
darwinssl: fix build error in crypto authentication under Snow Leopard It turns out Snow Leopard not only has SecItemCopyMatching() defined in a header not included by the omnibus header, but it won't work for our purposes, because searching for SecIdentityRef objects wasn't added to that API until Lion. So we now use the old SecKeychainSearch API instead if the user is building under, or running under, Snow Leopard. Bug: http://sourceforge.net/p/curl/bugs/1255/ Reported by: Edward Rudd
2013-07-30 22:25:38 -04:00
/* For developers building on older cats, we have no choice but to fall back
to SecKeychainSearch. */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key);
darwinssl: fix build error in crypto authentication under Snow Leopard It turns out Snow Leopard not only has SecItemCopyMatching() defined in a header not included by the omnibus header, but it won't work for our purposes, because searching for SecIdentityRef objects wasn't added to that API until Lion. So we now use the old SecKeychainSearch API instead if the user is building under, or running under, Snow Leopard. Bug: http://sourceforge.net/p/curl/bugs/1255/ Reported by: Edward Rudd
2013-07-30 22:25:38 -04:00
#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
return status;
}
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
static OSStatus CopyIdentityFromPKCS12File(const char *cPath,
const char *cPassword,
SecIdentityRef *out_cert_and_key)
{
OSStatus status = errSecItemNotFound;
CFURLRef pkcs_url = CFURLCreateFromFileSystemRepresentation(NULL,
(const UInt8 *)cPath, strlen(cPath), false);
CFStringRef password = cPassword ? CFStringCreateWithCString(NULL,
cPassword, kCFStringEncodingUTF8) : NULL;
CFDataRef pkcs_data = NULL;
darwinssl: PKCS#12 import feature now requires Lion or later It turns out that some of the constants necessary to make this feature work are missing from Snow Leopard's Security framework even though they are defined in the headers. Bug: http://curl.haxx.se/mail/lib-2013-11/0076.html Reported by: myriachan
2013-11-12 21:18:04 -05:00
/* We can import P12 files on iOS or OS X 10.7 or later: */
/* These constants are documented as having first appeared in 10.6 but they
raise linker errors when used on that cat for some reason. */
#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
if(CFURLCreateDataAndPropertiesFromResource(NULL, pkcs_url, &pkcs_data,
darwinssl: Don't import client certificates into Keychain on macOS Closes #2085
2017-11-15 16:30:58 -05:00
NULL, NULL, &status)) {
CFArrayRef items = NULL;
/* On iOS SecPKCS12Import will never add the client certificate to the
* Keychain.
*
* It gives us back a SecIdentityRef that we can use directly. */
#if CURL_BUILD_IOS
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
const void *cKeys[] = {kSecImportExportPassphrase};
const void *cValues[] = {password};
CFDictionaryRef options = CFDictionaryCreate(NULL, cKeys, cValues,
password ? 1L : 0L, NULL, NULL);
darwinssl: Don't import client certificates into Keychain on macOS Closes #2085
2017-11-15 16:30:58 -05:00
if(options != NULL) {
status = SecPKCS12Import(pkcs_data, options, &items);
CFRelease(options);
}
/* On macOS SecPKCS12Import will always add the client certificate to
* the Keychain.
*
* As this doesn't match iOS, and apps may not want to see their client
* certificate saved in the the user's keychain, we use SecItemImport
* with a NULL keychain to avoid importing it.
*
* This returns a SecCertificateRef from which we can construct a
* SecIdentityRef.
*/
#elif CURL_BUILD_MAC_10_7
SecItemImportExportKeyParameters keyParams;
SecExternalFormat inputFormat = kSecFormatPKCS12;
SecExternalItemType inputType = kSecItemTypeCertificate;
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
darwinssl: Don't import client certificates into Keychain on macOS Closes #2085
2017-11-15 16:30:58 -05:00
memset(&keyParams, 0x00, sizeof(keyParams));
keyParams.version = SEC_KEY_IMPORT_EXPORT_PARAMS_VERSION;
keyParams.passphrase = password;
status = SecItemImport(pkcs_data, NULL, &inputFormat, &inputType,
0, &keyParams, NULL, &items);
#endif
/* Extract the SecIdentityRef */
if(status == errSecSuccess && items && CFArrayGetCount(items)) {
CFIndex i, count;
count = CFArrayGetCount(items);
for(i = 0; i < count; i++) {
CFTypeRef item = (CFTypeRef) CFArrayGetValueAtIndex(items, i);
CFTypeID itemID = CFGetTypeID(item);
if(itemID == CFDictionaryGetTypeID()) {
CFTypeRef identity = (CFTypeRef) CFDictionaryGetValue(
(CFDictionaryRef) item,
kSecImportItemIdentity);
CFRetain(identity);
*out_cert_and_key = (SecIdentityRef) identity;
break;
}
darwinssl: fix iOS build
2018-03-17 16:49:27 -04:00
#if CURL_BUILD_MAC_10_7
darwinssl: Don't import client certificates into Keychain on macOS Closes #2085
2017-11-15 16:30:58 -05:00
else if(itemID == SecCertificateGetTypeID()) {
status = SecIdentityCreateWithCertificate(NULL,
(SecCertificateRef) item,
out_cert_and_key);
break;
}
darwinssl: fix iOS build
2018-03-17 16:49:27 -04:00
#endif
darwinssl: Don't import client certificates into Keychain on macOS Closes #2085
2017-11-15 16:30:58 -05:00
}
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
}
darwinssl: fix potential crash when attempting to copy an identity from a P12 file This could've happened if SecPKCS12Import() returned noErr _and_ no identity.
2014-05-14 18:48:14 -04:00
if(items)
CFRelease(items);
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
CFRelease(pkcs_data);
}
darwinssl: PKCS#12 import feature now requires Lion or later It turns out that some of the constants necessary to make this feature work are missing from Snow Leopard's Security framework even though they are defined in the headers. Bug: http://curl.haxx.se/mail/lib-2013-11/0076.html Reported by: myriachan
2013-11-12 21:18:04 -05:00
#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
if(password)
CFRelease(password);
CFRelease(pkcs_url);
return status;
}
/* This code was borrowed from nss.c, with some modifications:
* Determine whether the nickname passed in is a filename that needs to
* be loaded as a PEM or a regular NSS nickname.
*
* returns 1 for a file
* returns 0 for not a file
*/
CF_INLINE bool is_file(const char *filename)
{
struct_stat st;
if(filename == NULL)
return false;
if(stat(filename, &st) == 0)
return S_ISREG(st.st_mode);
return false;
}
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static CURLcode sectransp_version_from_curl(SSLProtocol *darwinver,
darwinssl: fix variable type mistake (regression) ... which made --tlsv1.2 not work because it would blank the max tls version variable. Reported-by: Nick Miyake Bug: #1703
2017-07-27 12:30:11 -04:00
long ssl_version)
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
{
switch(ssl_version) {
case CURL_SSLVERSION_TLSv1_0:
*darwinver = kTLSProtocol1;
return CURLE_OK;
case CURL_SSLVERSION_TLSv1_1:
*darwinver = kTLSProtocol11;
return CURLE_OK;
case CURL_SSLVERSION_TLSv1_2:
*darwinver = kTLSProtocol12;
return CURLE_OK;
case CURL_SSLVERSION_TLSv1_3:
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
/* TLS 1.3 support first appeared in iOS 11 and macOS 10.13 */
darwinssl: allow High Sierra users to build the code using GCC ...but GCC users lose out on TLS 1.3 support, since we can't weak-link enumeration constants. Fixes #2656 Closes #2703
2018-07-01 15:05:50 -04:00
#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
*darwinver = kTLSProtocol13;
return CURLE_OK;
}
darwinssl: allow High Sierra users to build the code using GCC ...but GCC users lose out on TLS 1.3 support, since we can't weak-link enumeration constants. Fixes #2656 Closes #2703
2018-07-01 15:05:50 -04:00
#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
HAVE_BUILTIN_AVAILABLE == 1 */
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
break;
}
return CURLE_SSL_CONNECT_ERROR;
}
#endif
static CURLcode
set_ssl_version_min_max(struct connectdata *conn, int sockindex)
{
struct Curl_easy *data = conn->data;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
long ssl_version = SSL_CONN_CONFIG(version);
long ssl_version_max = SSL_CONN_CONFIG(version_max);
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
long max_supported_version_by_os;
/* macOS 10.5-10.7 supported TLS 1.0 only.
macOS 10.8 and later, and iOS 5 and later, added TLS 1.1 and 1.2.
macOS 10.13 and later, and iOS 11 and later, added TLS 1.3. */
darwinssl: allow High Sierra users to build the code using GCC ...but GCC users lose out on TLS 1.3 support, since we can't weak-link enumeration constants. Fixes #2656 Closes #2703
2018-07-01 15:05:50 -04:00
#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_3;
}
else {
max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_2;
}
#else
max_supported_version_by_os = CURL_SSLVERSION_MAX_TLSv1_2;
darwinssl: allow High Sierra users to build the code using GCC ...but GCC users lose out on TLS 1.3 support, since we can't weak-link enumeration constants. Fixes #2656 Closes #2703
2018-07-01 15:05:50 -04:00
#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
HAVE_BUILTIN_AVAILABLE == 1 */
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
switch(ssl_version) {
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
ssl_version = CURL_SSLVERSION_TLSv1_0;
break;
}
switch(ssl_version_max) {
case CURL_SSLVERSION_MAX_NONE:
case CURL_SSLVERSION_MAX_DEFAULT:
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
ssl_version_max = max_supported_version_by_os;
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
break;
}
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
if(SSLSetProtocolVersionMax != NULL) {
SSLProtocol darwin_ver_min = kTLSProtocol1;
SSLProtocol darwin_ver_max = kTLSProtocol1;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
CURLcode result = sectransp_version_from_curl(&darwin_ver_min,
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
ssl_version);
if(result) {
failf(data, "unsupported min version passed via CURLOPT_SSLVERSION");
return result;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
result = sectransp_version_from_curl(&darwin_ver_max,
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
ssl_version_max >> 16);
if(result) {
failf(data, "unsupported max version passed via CURLOPT_SSLVERSION");
return result;
}
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionMin(BACKEND->ssl_ctx, darwin_ver_min);
(void)SSLSetProtocolVersionMax(BACKEND->ssl_ctx, darwin_ver_max);
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
return result;
}
else {
#if CURL_SUPPORT_MAC_10_8
long i = ssl_version;
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx,
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
kSSLProtocolAll,
false);
for(; i <= (ssl_version_max >> 16); i++) {
switch(i) {
case CURL_SSLVERSION_TLSv1_0:
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx,
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
kTLSProtocol1,
true);
break;
case CURL_SSLVERSION_TLSv1_1:
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx,
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
kTLSProtocol11,
true);
break;
case CURL_SSLVERSION_TLSv1_2:
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx,
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
kTLSProtocol12,
true);
break;
case CURL_SSLVERSION_TLSv1_3:
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
failf(data, "Your version of the OS does not support TLSv1.3");
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
return CURLE_SSL_CONNECT_ERROR;
}
}
return CURLE_OK;
#endif /* CURL_SUPPORT_MAC_10_8 */
}
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
failf(data, "Secure Transport: cannot set SSL protocol");
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
return CURLE_SSL_CONNECT_ERROR;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static CURLcode sectransp_connect_step1(struct connectdata *conn,
DarwinSSL: several adjustments - Renamed st_ function prefix to darwinssl_ - Renamed Curl_st_ function prefix to Curl_darwinssl_ - Moved the duplicated ssl_connect_done out of the #ifdef in lib/urldata.h - Fixed a teensy little bug that made non-blocking connection attempts block - Made it so that it builds cleanly against the iOS 5.1 SDK
2012-06-26 15:39:48 -04:00
int sockindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
internals: rename the SessionHandle struct to Curl_easy
2016-06-21 09:47:12 -04:00
struct Curl_easy *data = conn->data;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
curl_socket_t sockfd = conn->sock[sockindex];
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
const char * const ssl_cafile = SSL_CONN_CONFIG(CAfile);
const bool verifypeer = SSL_CONN_CONFIG(verifypeer);
char * const ssl_cert = SSL_SET_OPTION(cert);
const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
conn->host.name;
const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
#ifdef ENABLE_IPV6
struct in6_addr addr;
#else
struct in_addr addr;
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* ENABLE_IPV6 */
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
size_t all_ciphers_count = 0UL, allowed_ciphers_count = 0UL, i;
SSLCipherSuite *all_ciphers = NULL, *allowed_ciphers = NULL;
darwinssl: disable insecure ciphers by default I noticed that aria2's SecureTransport code disables insecure ciphers such as NULL, anonymous, IDEA, and weak-key ciphers used by SSLv3 and later. That's a good idea, and now we do the same thing in order to prevent curl from accessing a "secure" site that only negotiates insecure ciphersuites.
2013-04-08 19:07:20 -04:00
OSStatus err = noErr;
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
int darwinver_maj = 0, darwinver_min = 0;
GetDarwinVersionNumber(&darwinver_maj, &darwinver_min);
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
cleanup: misc typos in strings and comments Found via `codespell` Closes #2389
2018-03-15 22:51:03 -04:00
if(SSLCreateContext != NULL) { /* use the newer API if available */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
if(BACKEND->ssl_ctx)
CFRelease(BACKEND->ssl_ctx);
BACKEND->ssl_ctx = SSLCreateContext(NULL, kSSLClientSide, kSSLStreamType);
if(!BACKEND->ssl_ctx) {
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
failf(data, "SSL: couldn't create a context!");
return CURLE_OUT_OF_MEMORY;
}
}
else {
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
/* The old ST API does not exist under iOS, so don't compile it: */
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_SUPPORT_MAC_10_8
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
if(BACKEND->ssl_ctx)
(void)SSLDisposeContext(BACKEND->ssl_ctx);
err = SSLNewContext(false, &(BACKEND->ssl_ctx));
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
if(err != noErr) {
failf(data, "SSL: couldn't create a context: OSStatus %d", err);
return CURLE_OUT_OF_MEMORY;
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_SUPPORT_MAC_10_8 */
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
}
#else
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
if(BACKEND->ssl_ctx)
(void)SSLDisposeContext(BACKEND->ssl_ctx);
err = SSLNewContext(false, &(BACKEND->ssl_ctx));
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
failf(data, "SSL: couldn't create a context: OSStatus %d", err);
return CURLE_OUT_OF_MEMORY;
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
BACKEND->ssl_write_buffered_length = 0UL; /* reset buffered write length */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* check to see if we've been told to use an explicit SSL/TLS version */
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
if(SSLSetProtocolVersionMax != NULL) {
proxy: Support HTTPS proxy and SOCKS+HTTP(s) * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-16 12:49:15 -05:00
switch(conn->ssl_config.version) {
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
case CURL_SSLVERSION_TLSv1:
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionMin(BACKEND->ssl_ctx, kTLSProtocol1);
darwinssl: allow High Sierra users to build the code using GCC ...but GCC users lose out on TLS 1.3 support, since we can't weak-link enumeration constants. Fixes #2656 Closes #2703
2018-07-01 15:05:50 -04:00
#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
if(__builtin_available(macOS 10.13, iOS 11.0, *)) {
(void)SSLSetProtocolVersionMax(BACKEND->ssl_ctx, kTLSProtocol13);
}
else {
(void)SSLSetProtocolVersionMax(BACKEND->ssl_ctx, kTLSProtocol12);
}
#else
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionMax(BACKEND->ssl_ctx, kTLSProtocol12);
darwinssl: allow High Sierra users to build the code using GCC ...but GCC users lose out on TLS 1.3 support, since we can't weak-link enumeration constants. Fixes #2656 Closes #2703
2018-07-01 15:05:50 -04:00
#endif /* (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) &&
HAVE_BUILTIN_AVAILABLE == 1 */
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
darwinssl: accept setting max-tls with default min-tls Reported-by: Andrei Neculau Fixes #3367 Closes #3373
2018-12-13 03:09:28 -05:00
case CURL_SSLVERSION_DEFAULT:
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
case CURL_SSLVERSION_TLSv1_0:
case CURL_SSLVERSION_TLSv1_1:
case CURL_SSLVERSION_TLSv1_2:
case CURL_SSLVERSION_TLSv1_3:
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
{
CURLcode result = set_ssl_version_min_max(conn, sockindex);
if(result != CURLE_OK)
return result;
break;
}
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
case CURL_SSLVERSION_SSLv3:
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetProtocolVersionMin(BACKEND->ssl_ctx, kSSLProtocol3);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
if(err != noErr) {
failf(data, "Your version of the OS does not support SSLv3");
vtls: support TLS 1.3 via CURL_SSLVERSION_TLSv1_3 Fully implemented with the NSS backend only for now. Reviewed-by: Ray Satiro
2016-10-27 08:57:11 -04:00
return CURLE_SSL_CONNECT_ERROR;
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
}
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionMax(BACKEND->ssl_ctx, kSSLProtocol3);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
case CURL_SSLVERSION_SSLv2:
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetProtocolVersionMin(BACKEND->ssl_ctx, kSSLProtocol2);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
if(err != noErr) {
failf(data, "Your version of the OS does not support SSLv2");
vtls: Fail on unrecognized param for CURLOPT_SSLVERSION - Fix GnuTLS code for CURL_SSLVERSION_TLSv1_2 that broke when the TLS 1.3 support was added in 6ad3add. - Homogenize across code for all backends the error message when TLS 1.3 is not available to "<backend>: TLS 1.3 is not yet supported". - Return an error when a user-specified ssl version is unrecognized. --- Prior to this change our code for some of the backends used the 'default' label in the switch statement (ie ver unrecognized) for ssl.version and treated it the same as CURL_SSLVERSION_DEFAULT. Bug: https://curl.haxx.se/mail/lib-2016-11/0048.html Reported-by: Kamil Dudka
2016-11-07 21:51:27 -05:00
return CURLE_SSL_CONNECT_ERROR;
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
}
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionMax(BACKEND->ssl_ctx, kSSLProtocol2);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
default:
failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
return CURLE_SSL_CONNECT_ERROR;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
}
}
else {
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_SUPPORT_MAC_10_8
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx,
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
kSSLProtocolAll,
false);
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(conn->ssl_config.version) {
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx,
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
kTLSProtocol1,
true);
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx,
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
kTLSProtocol11,
true);
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx,
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
kTLSProtocol12,
true);
break;
SSL: protocol version can be specified more precisely CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, CURL_SSLVERSION_TLSv1_2 enum values are added to force exact TLS version (CURL_SSLVERSION_TLSv1 means TLS 1.x). axTLS: axTLS only supports TLS 1.0 and 1.1 but it cannot be set that only one of these should be used, so we don't allow the new enum values. darwinssl: Added support for the new enum values. SChannel: Added support for the new enum values. CyaSSL: Added support for the new enum values. Bug: The original CURL_SSLVERSION_TLSv1 value enables only TLS 1.0 (it did the same before this commit), because CyaSSL cannot be configured to use TLS 1.0-1.2. GSKit: GSKit doesn't seem to support TLS 1.1 and TLS 1.2, so we do not allow those values. Bugfix: There was a typo that caused wrong SSL versions to be passed to GSKit. NSS: TLS minor version cannot be set, so we don't allow the new enum values. QsoSSL: TLS minor version cannot be set, so we don't allow the new enum values. OpenSSL: Added support for the new enum values. Bugfix: The original CURL_SSLVERSION_TLSv1 value enabled only TLS 1.0, now it enables 1.0-1.2. Command-line tool: Added command line options for the new values.
2013-09-19 09:17:13 -04:00
case CURL_SSLVERSION_TLSv1_0:
case CURL_SSLVERSION_TLSv1_1:
case CURL_SSLVERSION_TLSv1_2:
vtls: support TLS 1.3 via CURL_SSLVERSION_TLSv1_3 Fully implemented with the NSS backend only for now. Reviewed-by: Ray Satiro
2016-10-27 08:57:11 -04:00
case CURL_SSLVERSION_TLSv1_3:
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
{
CURLcode result = set_ssl_version_min_max(conn, sockindex);
if(result != CURLE_OK)
return result;
break;
}
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
case CURL_SSLVERSION_SSLv3:
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx,
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
kSSLProtocol3,
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
true);
darwinssl: SSLv2 connections are aborted if unsupported by the OS I just noticed that OS X no longer supports SSLv2. Other TLS engines return an error if the requested protocol isn't supported by the underlying engine, so we do that now for SSLv2 if the framework returns an error when trying to turn on SSLv2 support. (Note: As always, SSLv2 support is only enabled in curl when starting the app with the -2 argument; it's off by default. SSLv2 is really old and insecure.)
2013-07-02 21:34:54 -04:00
if(err != noErr) {
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
failf(data, "Your version of the OS does not support SSLv3");
darwinssl: SSLv2 connections are aborted if unsupported by the OS I just noticed that OS X no longer supports SSLv2. Other TLS engines return an error if the requested protocol isn't supported by the underlying engine, so we do that now for SSLv2 if the framework returns an error when trying to turn on SSLv2 support. (Note: As always, SSLv2 support is only enabled in curl when starting the app with the -2 argument; it's off by default. SSLv2 is really old and insecure.)
2013-07-02 21:34:54 -04:00
return CURLE_SSL_CONNECT_ERROR;
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
break;
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
case CURL_SSLVERSION_SSLv2:
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx,
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
kSSLProtocol2,
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
true);
darwinssl: detect possible future removal of SSLv3 from the framework If Apple ever drops SSLv3 support from the Security framework, we'll fail with an error if the user insists on using SSLv3.
2014-10-24 19:59:13 -04:00
if(err != noErr) {
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
failf(data, "Your version of the OS does not support SSLv2");
darwinssl: detect possible future removal of SSLv3 from the framework If Apple ever drops SSLv3 support from the Security framework, we'll fail with an error if the user insists on using SSLv3.
2014-10-24 19:59:13 -04:00
return CURLE_SSL_CONNECT_ERROR;
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
break;
vtls: Fail on unrecognized param for CURLOPT_SSLVERSION - Fix GnuTLS code for CURL_SSLVERSION_TLSv1_2 that broke when the TLS 1.3 support was added in 6ad3add. - Homogenize across code for all backends the error message when TLS 1.3 is not available to "<backend>: TLS 1.3 is not yet supported". - Return an error when a user-specified ssl version is unrecognized. --- Prior to this change our code for some of the backends used the 'default' label in the switch statement (ie ver unrecognized) for ssl.version and treated it the same as CURL_SSLVERSION_DEFAULT. Bug: https://curl.haxx.se/mail/lib-2016-11/0048.html Reported-by: Kamil Dudka
2016-11-07 21:51:27 -05:00
default:
failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
return CURLE_SSL_CONNECT_ERROR;
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
}
#endif /* CURL_SUPPORT_MAC_10_8 */
}
#else
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
if(conn->ssl_config.version_max != CURL_SSLVERSION_MAX_NONE) {
failf(data, "Your version of the OS does not support to set maximum"
" SSL/TLS version");
return CURLE_SSL_CONNECT_ERROR;
}
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx, kSSLProtocolAll, false);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
switch(conn->ssl_config.version) {
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
case CURL_SSLVERSION_TLSv1_0:
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx,
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
kTLSProtocol1,
true);
break;
case CURL_SSLVERSION_TLSv1_1:
failf(data, "Your version of the OS does not support TLSv1.1");
return CURLE_SSL_CONNECT_ERROR;
case CURL_SSLVERSION_TLSv1_2:
failf(data, "Your version of the OS does not support TLSv1.2");
return CURLE_SSL_CONNECT_ERROR;
case CURL_SSLVERSION_TLSv1_3:
failf(data, "Your version of the OS does not support TLSv1.3");
return CURLE_SSL_CONNECT_ERROR;
case CURL_SSLVERSION_SSLv2:
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx,
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
kSSLProtocol2,
true);
if(err != noErr) {
failf(data, "Your version of the OS does not support SSLv2");
return CURLE_SSL_CONNECT_ERROR;
}
break;
case CURL_SSLVERSION_SSLv3:
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetProtocolVersionEnabled(BACKEND->ssl_ctx,
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
kSSLProtocol3,
true);
if(err != noErr) {
failf(data, "Your version of the OS does not support SSLv3");
return CURLE_SSL_CONNECT_ERROR;
}
break;
default:
failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
return CURLE_SSL_CONNECT_ERROR;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
#if (CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
if(conn->bits.tls_enable_alpn) {
sectransp: tvOS 11 is required for ALPN support Reported-by: nianxuejie on github Assisted-by: Nick Zitzmann Assisted-by: Jay Satiro Fixes #3689 Closes #3690
2019-03-19 05:19:40 -04:00
if(__builtin_available(macOS 10.13.4, iOS 11, tvOS 11, *)) {
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
CFMutableArrayRef alpnArr = CFArrayCreateMutable(NULL, 0,
&kCFTypeArrayCallBacks);
#ifdef USE_NGHTTP2
if(data->set.httpversion >= CURL_HTTP_VERSION_2 &&
(!SSL_IS_PROXY() || !conn->bits.tunnel_proxy)) {
CFArrayAppendValue(alpnArr, CFSTR(NGHTTP2_PROTO_VERSION_ID));
infof(data, "ALPN, offering %s\n", NGHTTP2_PROTO_VERSION_ID);
}
#endif
CFArrayAppendValue(alpnArr, CFSTR(ALPN_HTTP_1_1));
infof(data, "ALPN, offering %s\n", ALPN_HTTP_1_1);
/* expects length prefixed preference ordered list of protocols in wire
* format
*/
err = SSLSetALPNProtocols(BACKEND->ssl_ctx, alpnArr);
if(err != noErr)
infof(data, "WARNING: failed to set ALPN protocols; OSStatus %d\n",
err);
CFRelease(alpnArr);
}
}
#endif
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
if(SSL_SET_OPTION(key)) {
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
infof(data, "WARNING: SSL: CURLOPT_SSLKEY is ignored by Secure "
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
"Transport. The private key must be in the Keychain.\n");
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
}
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
if(ssl_cert) {
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
SecIdentityRef cert_and_key = NULL;
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
bool is_cert_file = is_file(ssl_cert);
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
/* User wants to authenticate with a client cert. Look for it:
If we detect that this is a file on disk, then let's load it.
Otherwise, assume that the user wants to use an identity loaded
from the Keychain. */
if(is_cert_file) {
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
if(!SSL_SET_OPTION(cert_type))
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
infof(data, "WARNING: SSL: Certificate type not set, assuming "
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
"PKCS#12 format.\n");
else if(strncmp(SSL_SET_OPTION(cert_type), "P12",
strlen(SSL_SET_OPTION(cert_type))) != 0)
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
infof(data, "WARNING: SSL: The Security framework only supports "
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
"loading identities that are in PKCS#12 format.\n");
err = CopyIdentityFromPKCS12File(ssl_cert,
SSL_SET_OPTION(key_passwd), &cert_and_key);
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
}
else
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
err = CopyIdentityWithLabel(ssl_cert, &cert_and_key);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
darwinssl: Fix exception when processing a client-side certificate file if no error was raised by the API but the SecIdentityRef was null Fixes #1450
2017-05-16 20:21:12 -04:00
if(err == noErr && cert_and_key) {
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
SecCertificateRef cert = NULL;
CFTypeRef certs_c[1];
CFArrayRef certs;
/* If we found one, print it out: */
err = SecIdentityCopyCertificate(cert_and_key, &cert);
if(err == noErr) {
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
char *certp;
CURLcode result = CopyCertSubject(data, cert, &certp);
if(!result) {
infof(data, "Client certificate: %s\n", certp);
free(certp);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
}
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
CFRelease(cert);
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
if(result == CURLE_PEER_FAILED_VERIFICATION)
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_SSL_CERTPROBLEM;
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
if(result)
return result;
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
}
certs_c[0] = cert_and_key;
certs = CFArrayCreate(NULL, (const void **)certs_c, 1L,
&kCFTypeArrayCallBacks);
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetCertificate(BACKEND->ssl_ctx, certs);
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
if(certs)
CFRelease(certs);
if(err != noErr) {
failf(data, "SSL: SSLSetCertificate() failed: OSStatus %d", err);
return CURLE_SSL_CERTPROBLEM;
}
CFRelease(cert_and_key);
}
else {
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
switch(err) {
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
case errSecAuthFailed: case -25264: /* errSecPkcs12VerifyFailure */
failf(data, "SSL: Incorrect password for the certificate \"%s\" "
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
"and its private key.", ssl_cert);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
case -26275: /* errSecDecode */ case -25257: /* errSecUnknownFormat */
failf(data, "SSL: Couldn't make sense of the data in the "
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
"certificate \"%s\" and its private key.",
ssl_cert);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
case -25260: /* errSecPassphraseRequired */
failf(data, "SSL The certificate \"%s\" requires a password.",
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
ssl_cert);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
case errSecItemNotFound:
failf(data, "SSL: Can't find the certificate \"%s\" and its private "
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
"key in the Keychain.", ssl_cert);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
default:
failf(data, "SSL: Can't load the certificate \"%s\" and its private "
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
"key: OSStatus %d", ssl_cert, err);
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
break;
darwinssl: add support for PKCS#12 files for client authentication I also documented the fact that the OpenSSL engine also supports them.
2013-09-05 19:57:06 -04:00
}
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
return CURLE_SSL_CERTPROBLEM;
}
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* SSL always tries to verify the peer, this only says whether it should
* fail to connect if the verification fails, or if it should continue
* anyway. In the latter case the result of the verification is checked with
* SSL_get_verify_result() below. */
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
/* Snow Leopard introduced the SSLSetSessionOption() function, but due to
a library bug with the way the kSSLSessionOptionBreakOnServerAuth flag
darwinssl: fix certificate verification disable on OS X 10.8 The new way of disabling certificate verification doesn't work on Mountain Lion (OS X 10.8) so we need to use the old way in that version too. I've tested this solution on versions 10.7.5, 10.8, 10.9, 10.10.2 and 10.11. Closes #802
2016-05-12 06:16:16 -04:00
works, it doesn't work as expected under Snow Leopard, Lion or
Mountain Lion.
darwinssl: Fixed inability to disable peer verification ... on Snow Leopard and Lion Snow Leopard introduced the SSLSetSessionOption() function, but it doesn't disable peer verification as expected on Snow Leopard or Lion (it works as expected in Mountain Lion). So we now use sysctl() to detect whether or not the user is using Snow Leopard or Lion, and if that's the case, then we now use the deprecated SSLSetEnableCertVerify() function instead to disable peer verification.
2012-12-26 20:29:50 -05:00
So we need to call SSLSetEnableCertVerify() on those older cats in order
to disable certificate validation if the user turned that off.
(SecureTransport will always validate the certificate chain by
darwinssl: fix certificate verification disable on OS X 10.8 The new way of disabling certificate verification doesn't work on Mountain Lion (OS X 10.8) so we need to use the old way in that version too. I've tested this solution on versions 10.7.5, 10.8, 10.9, 10.10.2 and 10.11. Closes #802
2016-05-12 06:16:16 -04:00
default.)
Note:
Darwin 11.x.x is Lion (10.7)
Darwin 12.x.x is Mountain Lion (10.8)
darwinssl.c: fix OS X codename typo in comment
2016-05-13 03:25:54 -04:00
Darwin 13.x.x is Mavericks (10.9)
darwinssl: fix certificate verification disable on OS X 10.8 The new way of disabling certificate verification doesn't work on Mountain Lion (OS X 10.8) so we need to use the old way in that version too. I've tested this solution on versions 10.7.5, 10.8, 10.9, 10.10.2 and 10.11. Closes #802
2016-05-12 06:16:16 -04:00
Darwin 14.x.x is Yosemite (10.10)
Darwin 15.x.x is El Capitan (10.11)
*/
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC
darwinssl: fix certificate verification disable on OS X 10.8 The new way of disabling certificate verification doesn't work on Mountain Lion (OS X 10.8) so we need to use the old way in that version too. I've tested this solution on versions 10.7.5, 10.8, 10.9, 10.10.2 and 10.11. Closes #802
2016-05-12 06:16:16 -04:00
if(SSLSetSessionOption != NULL && darwinver_maj >= 13) {
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
#else
if(SSLSetSessionOption != NULL) {
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC */
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
bool break_on_auth = !conn->ssl_config.verifypeer || ssl_cafile;
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetSessionOption(BACKEND->ssl_ctx,
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
kSSLSessionOptionBreakOnServerAuth,
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
break_on_auth);
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
if(err != noErr) {
failf(data, "SSL: SSLSetSessionOption() failed: OSStatus %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
}
else {
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_SUPPORT_MAC_10_8
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetEnableCertVerify(BACKEND->ssl_ctx,
proxy: Support HTTPS proxy and SOCKS+HTTP(s) * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-16 12:49:15 -05:00
conn->ssl_config.verifypeer?true:false);
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
if(err != noErr) {
failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_SUPPORT_MAC_10_8 */
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
}
#else
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetEnableCertVerify(BACKEND->ssl_ctx,
proxy: Support HTTPS proxy and SOCKS+HTTP(s) * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-16 12:49:15 -05:00
conn->ssl_config.verifypeer?true:false);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: --insecure overrides --cacert if both settings are in use Fixes #1184
2017-01-03 18:44:57 -05:00
if(ssl_cafile && verifypeer) {
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
bool is_cert_file = is_file(ssl_cafile);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(!is_cert_file) {
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
failf(data, "SSL: can't load CA certificate file %s", ssl_cafile);
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return CURLE_SSL_CACERT_BADFILE;
}
}
Don't omit CN verification in DarwinSSL when an IP address is used.
2014-02-23 10:35:30 -05:00
/* Configure hostname check. SNI is used if available.
* Both hostname check and SNI require SSLSetPeerDomainName().
SSL: Several SSL-backend related fixes axTLS: This will make the axTLS backend perform the RFC2818 checks, honoring the VERIFYHOST setting similar to the OpenSSL backend. Generic for OpenSSL and axTLS: Move the hostcheck and cert_hostcheck functions from the lib/ssluse.c files to make them genericly available for both the OpenSSL, axTLS and other SSL backends. They are now in the new lib/hostcheck.c file. CyaSSL: CyaSSL now also has the RFC2818 checks enabled by default. There is a limitation that the verifyhost can not be enabled exclusively on the Subject CN field comparison. This SSL backend will thus behave like the NSS and the GnuTLS (meaning: RFC2818 ok, or bust). In other words: setting verifyhost to 0 or 1 will disable the Subject Alt Names checks too. Schannel: Updated the schannel information messages: Split the IP address usage message from the verifyhost setting and changed the message about disabling SNI (Server Name Indication, used in HTTP virtual hosting) into a message stating that the Subject Alternative Names checks are being disabled when verifyhost is set to 0 or 1. As a side effect of switching off the RFC2818 related servername checks with SCH_CRED_NO_SERVERNAME_CHECK (http://msdn.microsoft.com/en-us/library/aa923430.aspx) the SNI feature is being disabled. This effect is not documented in MSDN, but Wireshark output clearly shows the effect (details on the libcurl maillist). PolarSSL: Fix the prototype change in PolarSSL of ssl_set_session() and the move of the peer_cert from the ssl_context to the ssl_session. Found this change in the PolarSSL SVN between r1316 and r1317 where the POLARSSL_VERSION_NUMBER was at 0x01010100. But to accommodate the Ubuntu PolarSSL version 1.1.4 the check is to discriminate between lower then PolarSSL version 1.2.0 and 1.2.0 and higher. Note: The PolarSSL SVN trunk jumped from version 1.1.1 to 1.2.0. Generic: All the SSL backends are fixed and checked to work with the ssl.verifyhost as a boolean, which is an internal API change.
2012-11-02 21:06:51 -04:00
* Also: the verifyhost setting influences SNI usage */
proxy: Support HTTPS proxy and SOCKS+HTTP(s) * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-16 12:49:15 -05:00
if(conn->ssl_config.verifyhost) {
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetPeerDomainName(BACKEND->ssl_ctx, hostname,
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
strlen(hostname));
Don't omit CN verification in DarwinSSL when an IP address is used.
2014-02-23 10:35:30 -05:00
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
darwinssl: added LFs to some strings passed into infof() (This doesn't need to appear in the release notes.) I noticed a few places where infof() was called, and there should've been an LF at the end of the string, but there wasn't.
2013-07-30 22:32:18 -04:00
infof(data, "WARNING: SSL: SSLSetPeerDomainName() failed: OSStatus %d\n",
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
err);
}
Don't omit CN verification in DarwinSSL when an IP address is used.
2014-02-23 10:35:30 -05:00
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
if((Curl_inet_pton(AF_INET, hostname, &addr))
Don't omit CN verification in DarwinSSL when an IP address is used.
2014-02-23 10:35:30 -05:00
#ifdef ENABLE_IPV6
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
|| (Curl_inet_pton(AF_INET6, hostname, &addr))
Don't omit CN verification in DarwinSSL when an IP address is used.
2014-02-23 10:35:30 -05:00
#endif
) {
darwinssl: adopted to the HTTPS proxy changes It builds and runs all test cases. No adaptations for actual HTTPS proxy support has been made.
2016-11-18 05:40:01 -05:00
infof(data, "WARNING: using IP address, SNI is being disabled by "
"the OS.\n");
Don't omit CN verification in DarwinSSL when an IP address is used.
2014-02-23 10:35:30 -05:00
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
darwinssl: Warn that disabling host verify also disables SNI In DarwinSSL the SSLSetPeerDomainName function is used to enable both sending SNI and verifying the host. When host verification is disabled the function cannot be called, therefore SNI is disabled as well. Closes https://github.com/curl/curl/pull/1240
2017-02-02 16:40:16 -05:00
else {
infof(data, "WARNING: disabling hostname validation also disables SNI.\n");
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: disable insecure ciphers by default I noticed that aria2's SecureTransport code disables insecure ciphers such as NULL, anonymous, IDEA, and weak-key ciphers used by SSLv3 and later. That's a good idea, and now we do the same thing in order to prevent curl from accessing a "secure" site that only negotiates insecure ciphersuites.
2013-04-08 19:07:20 -04:00
/* Disable cipher suites that ST supports but are not safe. These ciphers
are unlikely to be used in any case since ST gives other ciphers a much
higher priority, but it's probably better that we not connect at all than
to give the user a false sense of security if the server only supports
insecure ciphers. (Note: We don't care about SSLv2-only ciphers.) */
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
err = SSLGetNumberSupportedCiphers(BACKEND->ssl_ctx, &all_ciphers_count);
if(err != noErr) {
failf(data, "SSL: SSLGetNumberSupportedCiphers() failed: OSStatus %d",
err);
return CURLE_SSL_CIPHER;
}
darwinssl: disable insecure ciphers by default I noticed that aria2's SecureTransport code disables insecure ciphers such as NULL, anonymous, IDEA, and weak-key ciphers used by SSLv3 and later. That's a good idea, and now we do the same thing in order to prevent curl from accessing a "secure" site that only negotiates insecure ciphersuites.
2013-04-08 19:07:20 -04:00
all_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite));
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
if(!all_ciphers) {
failf(data, "SSL: Failed to allocate memory for all ciphers");
return CURLE_OUT_OF_MEMORY;
darwinssl: disable insecure ciphers by default I noticed that aria2's SecureTransport code disables insecure ciphers such as NULL, anonymous, IDEA, and weak-key ciphers used by SSLv3 and later. That's a good idea, and now we do the same thing in order to prevent curl from accessing a "secure" site that only negotiates insecure ciphersuites.
2013-04-08 19:07:20 -04:00
}
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
allowed_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite));
if(!allowed_ciphers) {
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
Curl_safefree(all_ciphers);
darwinssl: disable insecure ciphers by default I noticed that aria2's SecureTransport code disables insecure ciphers such as NULL, anonymous, IDEA, and weak-key ciphers used by SSLv3 and later. That's a good idea, and now we do the same thing in order to prevent curl from accessing a "secure" site that only negotiates insecure ciphersuites.
2013-04-08 19:07:20 -04:00
failf(data, "SSL: Failed to allocate memory for allowed ciphers");
return CURLE_OUT_OF_MEMORY;
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
}
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
err = SSLGetSupportedCiphers(BACKEND->ssl_ctx, all_ciphers,
&all_ciphers_count);
if(err != noErr) {
Curl_safefree(all_ciphers);
Curl_safefree(allowed_ciphers);
return CURLE_SSL_CIPHER;
}
for(i = 0UL ; i < all_ciphers_count ; i++) {
#if CURL_BUILD_MAC
/* There's a known bug in early versions of Mountain Lion where ST's ECC
ciphers (cipher suite 0xC001 through 0xC032) simply do not work.
Work around the problem here by disabling those ciphers if we are
running in an affected version of OS X. */
if(darwinver_maj == 12 && darwinver_min <= 3 &&
all_ciphers[i] >= 0xC001 && all_ciphers[i] <= 0xC032) {
continue;
}
#endif /* CURL_BUILD_MAC */
switch(all_ciphers[i]) {
/* Disable NULL ciphersuites: */
case SSL_NULL_WITH_NULL_NULL:
case SSL_RSA_WITH_NULL_MD5:
case SSL_RSA_WITH_NULL_SHA:
case 0x003B: /* TLS_RSA_WITH_NULL_SHA256 */
case SSL_FORTEZZA_DMS_WITH_NULL_SHA:
case 0xC001: /* TLS_ECDH_ECDSA_WITH_NULL_SHA */
case 0xC006: /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */
case 0xC00B: /* TLS_ECDH_RSA_WITH_NULL_SHA */
case 0xC010: /* TLS_ECDHE_RSA_WITH_NULL_SHA */
case 0x002C: /* TLS_PSK_WITH_NULL_SHA */
case 0x002D: /* TLS_DHE_PSK_WITH_NULL_SHA */
case 0x002E: /* TLS_RSA_PSK_WITH_NULL_SHA */
case 0x00B0: /* TLS_PSK_WITH_NULL_SHA256 */
case 0x00B1: /* TLS_PSK_WITH_NULL_SHA384 */
case 0x00B4: /* TLS_DHE_PSK_WITH_NULL_SHA256 */
case 0x00B5: /* TLS_DHE_PSK_WITH_NULL_SHA384 */
case 0x00B8: /* TLS_RSA_PSK_WITH_NULL_SHA256 */
case 0x00B9: /* TLS_RSA_PSK_WITH_NULL_SHA384 */
/* Disable anonymous ciphersuites: */
case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5:
case SSL_DH_anon_WITH_RC4_128_MD5:
case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA:
case SSL_DH_anon_WITH_DES_CBC_SHA:
case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA:
case TLS_DH_anon_WITH_AES_128_CBC_SHA:
case TLS_DH_anon_WITH_AES_256_CBC_SHA:
case 0xC015: /* TLS_ECDH_anon_WITH_NULL_SHA */
case 0xC016: /* TLS_ECDH_anon_WITH_RC4_128_SHA */
case 0xC017: /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */
case 0xC018: /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */
case 0xC019: /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */
case 0x006C: /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */
case 0x006D: /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */
case 0x00A6: /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */
case 0x00A7: /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */
/* Disable weak key ciphersuites: */
case SSL_RSA_EXPORT_WITH_RC4_40_MD5:
case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5:
case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA:
case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA:
case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA:
case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA:
case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA:
case SSL_RSA_WITH_DES_CBC_SHA:
case SSL_DH_DSS_WITH_DES_CBC_SHA:
case SSL_DH_RSA_WITH_DES_CBC_SHA:
case SSL_DHE_DSS_WITH_DES_CBC_SHA:
case SSL_DHE_RSA_WITH_DES_CBC_SHA:
/* Disable IDEA: */
case SSL_RSA_WITH_IDEA_CBC_SHA:
case SSL_RSA_WITH_IDEA_CBC_MD5:
/* Disable RC4: */
case SSL_RSA_WITH_RC4_128_MD5:
case SSL_RSA_WITH_RC4_128_SHA:
case 0xC002: /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */
case 0xC007: /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA*/
case 0xC00C: /* TLS_ECDH_RSA_WITH_RC4_128_SHA */
case 0xC011: /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */
case 0x008A: /* TLS_PSK_WITH_RC4_128_SHA */
case 0x008E: /* TLS_DHE_PSK_WITH_RC4_128_SHA */
case 0x0092: /* TLS_RSA_PSK_WITH_RC4_128_SHA */
break;
default: /* enable everything else */
allowed_ciphers[allowed_ciphers_count++] = all_ciphers[i];
break;
}
}
err = SSLSetEnabledCiphers(BACKEND->ssl_ctx, allowed_ciphers,
allowed_ciphers_count);
darwinssl: disable insecure ciphers by default I noticed that aria2's SecureTransport code disables insecure ciphers such as NULL, anonymous, IDEA, and weak-key ciphers used by SSLv3 and later. That's a good idea, and now we do the same thing in order to prevent curl from accessing a "secure" site that only negotiates insecure ciphersuites.
2013-04-08 19:07:20 -04:00
Curl_safefree(all_ciphers);
Curl_safefree(allowed_ciphers);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
if(err != noErr) {
failf(data, "SSL: SSLSetEnabledCiphers() failed: OSStatus %d", err);
return CURLE_SSL_CIPHER;
}
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
darwinssl: enable BEAST workaround on iOS 7 & later iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 and a CBC cipher, so we now always turn that on unless the user manually turns it off using CURLSSLOPT_ALLOW_BEAST. It appears Apple also added some new PSK ciphers, but no interface to use them yet, so we at least support printing them if we find them.
2013-09-19 18:28:54 -04:00
#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
/* We want to enable 1/n-1 when using a CBC cipher unless the user
specifically doesn't want us doing that: */
darwinsssl: add support for TLS False Start TLS False Start support requires iOS 7.0 or later, or OS X 10.9 or later.
2015-03-21 13:22:56 -04:00
if(SSLSetSessionOption != NULL) {
proxy: Support HTTPS proxy and SOCKS+HTTP(s) * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-16 12:49:15 -05:00
/* TODO s/data->set.ssl.enable_beast/SSL_SET_OPTION(enable_beast)/g */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
SSLSetSessionOption(BACKEND->ssl_ctx, kSSLSessionOptionSendOneByteRecord,
proxy: Support HTTPS proxy and SOCKS+HTTP(s) * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-16 12:49:15 -05:00
!data->set.ssl.enable_beast);
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
SSLSetSessionOption(BACKEND->ssl_ctx, kSSLSessionOptionFalseStart,
darwinsssl: add support for TLS False Start TLS False Start support requires iOS 7.0 or later, or OS X 10.9 or later.
2015-03-21 13:22:56 -04:00
data->set.ssl.falsestart); /* false start support */
}
darwinssl: enable BEAST workaround on iOS 7 & later iOS 7 finally added the option to enable 1/n-1 when using TLS 1.0 and a CBC cipher, so we now always turn that on unless the user manually turns it off using CURLSSLOPT_ALLOW_BEAST. It appears Apple also added some new PSK ciphers, but no interface to use them yet, so we at least support printing them if we find them.
2013-09-19 18:28:54 -04:00
#endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
darwinssl: add TLS session resumption This ought to speed up additional TLS handshakes, at least in theory.
2013-04-12 14:20:10 -04:00
/* Check if there's a cached ID we can/should use here! */
TLS: Fix switching off SSL session id when client cert is used Move the sessionid flag to ssl_primary_config so that ssl and proxy_ssl will each have their own sessionid flag. Regression since HTTPS-Proxy support was added in cb4e2be. Prior to that this issue had been fixed in 247d890, CVE-2016-5419. Bug: https://github.com/curl/curl/issues/1341 Reported-by: lijian996@users.noreply.github.com The new incarnation of this bug is called CVE-2017-7468 and is documented here: https://curl.haxx.se/docs/adv_20170419.html
2017-03-22 01:59:49 -04:00
if(SSL_SET_OPTION(primary.sessionid)) {
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
char *ssl_sessionid;
size_t ssl_sessionid_len;
Curl_ssl_sessionid_lock(conn);
if(!Curl_ssl_getsessionid(conn, (void **)&ssl_sessionid,
proxy: Support HTTPS proxy and SOCKS+HTTP(s) * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-16 12:49:15 -05:00
&ssl_sessionid_len, sockindex)) {
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
/* we got a session id, use it! */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetPeerID(BACKEND->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
vtls: fix ssl session cache race condition Sessionid cache management is inseparable from managing individual session lifetimes. E.g. for reference-counted sessions (like those in SChannel and OpenSSL engines) every session addition and removal should be accompanied with refcount increment and decrement respectively. Failing to do so synchronously leads to a race condition that causes symptoms like use-after-free and memory corruption. This commit: - makes existing session cache locking explicit, thus allowing individual engines to manage lock's scope. - fixes OpenSSL and SChannel engines by putting refcount management inside this lock's scope in relevant places. - adds these explicit locking calls to other engines that use sessionid cache to accommodate for this change. Note, however, that it is unknown whether any of these engines could also have this race. Bug: https://github.com/curl/curl/issues/815 Fixes #815 Closes #847
2016-06-01 03:30:03 -04:00
Curl_ssl_sessionid_unlock(conn);
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
if(err != noErr) {
failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
/* Informational message */
infof(data, "SSL re-using session ID\n");
darwinssl: add TLS session resumption This ought to speed up additional TLS handshakes, at least in theory.
2013-04-12 14:20:10 -04:00
}
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
/* If there isn't one, then let's make one up! This has to be done prior
to starting the handshake. */
else {
CURLcode result;
ssl_sessionid =
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
aprintf("%s:%d:%d:%s:%hu", ssl_cafile,
verifypeer, SSL_CONN_CONFIG(verifyhost), hostname, port);
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
ssl_sessionid_len = strlen(ssl_sessionid);
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetPeerID(BACKEND->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
if(err != noErr) {
Curl_ssl_sessionid_unlock(conn);
failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
proxy: Support HTTPS proxy and SOCKS+HTTP(s) * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-16 12:49:15 -05:00
result = Curl_ssl_addsessionid(conn, ssl_sessionid, ssl_sessionid_len,
sockindex);
vtls: Only call add/getsession if session id is enabled Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
2016-06-12 23:47:12 -04:00
Curl_ssl_sessionid_unlock(conn);
if(result) {
failf(data, "failed to store ssl session");
return result;
}
darwinssl: add TLS session resumption This ought to speed up additional TLS handshakes, at least in theory.
2013-04-12 14:20:10 -04:00
}
}
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLSetIOFuncs(BACKEND->ssl_ctx, SocketRead, SocketWrite);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
failf(data, "SSL: SSLSetIOFuncs() failed: OSStatus %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
/* pass the raw socket into the SSL layers */
/* We need to store the FD in a constant memory address, because
* SSLSetConnection() will not copy that address. I've found that
* conn->sock[sockindex] may change on its own. */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
BACKEND->ssl_sockfd = sockfd;
err = SSLSetConnection(BACKEND->ssl_ctx, connssl);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
failf(data, "SSL: SSLSetConnection() failed: %d", err);
return CURLE_SSL_CONNECT_ERROR;
}
connssl->connecting_state = ssl_connect_2;
return CURLE_OK;
}
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
static long pem_to_der(const char *in, unsigned char **out, size_t *outlen)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
{
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
char *sep_start, *sep_end, *cert_start, *cert_end;
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
size_t i, j, err;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
size_t len;
unsigned char *b64;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
/* Jump through the separators at the beginning of the certificate. */
sep_start = strstr(in, "-----");
if(sep_start == NULL)
return 0;
cert_start = strstr(sep_start + 1, "-----");
if(cert_start == NULL)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return -1;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
cert_start += 5;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
/* Find separator after the end of the certificate. */
cert_end = strstr(cert_start, "-----");
if(cert_end == NULL)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return -1;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
sep_end = strstr(cert_end + 1, "-----");
if(sep_end == NULL)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return -1;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
sep_end += 5;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
len = cert_end - cert_start;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
b64 = malloc(len + 1);
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
if(!b64)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return -1;
/* Create base64 string without linefeeds. */
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
for(i = 0, j = 0; i < len; i++) {
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
if(cert_start[i] != '\r' && cert_start[i] != '\n')
b64[j++] = cert_start[i];
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
b64[j] = '\0';
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
err = Curl_base64_decode((const char *)b64, out, outlen);
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
free(b64);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(err) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
free(*out);
return -1;
}
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
return sep_end - in;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
static int read_cert(const char *file, unsigned char **out, size_t *outlen)
{
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
int fd;
ssize_t n, len = 0, cap = 512;
darwinssi: fix error: variable length array used
2017-08-16 01:58:44 -04:00
unsigned char buf[512], *data;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
fd = open(file, 0);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(fd < 0)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return -1;
data = malloc(cap);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(!data) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
close(fd);
return -1;
}
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
for(;;) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
n = read(fd, buf, sizeof(buf));
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(n < 0) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
close(fd);
free(data);
return -1;
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
}
else if(n == 0) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
close(fd);
break;
}
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(len + n >= cap) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
cap *= 2;
darwinssl: Fix realloc memleak The reallocation was using the input pointer for the return value, which leads to a memory leak on reallication failure. Fix by instead use the safe internal API call Curl_saferealloc(). Closes #3005 Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Nick Zitzmann <nickzman@gmail.com>
2018-09-18 03:06:07 -04:00
data = Curl_saferealloc(data, cap);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(!data) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
close(fd);
return -1;
}
}
memcpy(data + len, buf, n);
len += n;
}
data[len] = '\0';
*out = data;
*outlen = len;
return 0;
}
internals: rename the SessionHandle struct to Curl_easy
2016-06-21 09:47:12 -04:00
static int append_cert_to_array(struct Curl_easy *data,
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
unsigned char *buf, size_t buflen,
CFMutableArrayRef array)
{
CFDataRef certdata = CFDataCreate(kCFAllocatorDefault, buf, buflen);
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
char *certp;
CURLcode result;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
if(!certdata) {
failf(data, "SSL: failed to allocate array for CA certificate");
return CURLE_OUT_OF_MEMORY;
}
SecCertificateRef cacert =
SecCertificateCreateWithData(kCFAllocatorDefault, certdata);
CFRelease(certdata);
if(!cacert) {
failf(data, "SSL: failed to create SecCertificate from CA certificate");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_SSL_CACERT_BADFILE;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
}
Check CA certificate in curl_darwinssl.c. SecCertificateCreateWithData() returns a non-NULL SecCertificateRef even if the buffer holds an invalid or corrupt certificate. Call SecCertificateCopyPublicKey() to make sure cacert is a valid certificate.
2014-08-31 18:17:25 -04:00
/* Check if cacert is valid. */
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
result = CopyCertSubject(data, cacert, &certp);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
switch(result) {
case CURLE_OK:
break;
ssl: deprecate CURLE_SSL_CACERT in favour of a unified error code Long live CURLE_PEER_FAILED_VERIFICATION
2018-08-22 14:13:32 -04:00
case CURLE_PEER_FAILED_VERIFICATION:
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_SSL_CACERT_BADFILE;
case CURLE_OUT_OF_MEMORY:
default:
return result;
}
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
free(certp);
Check CA certificate in curl_darwinssl.c. SecCertificateCreateWithData() returns a non-NULL SecCertificateRef even if the buffer holds an invalid or corrupt certificate. Call SecCertificateCopyPublicKey() to make sure cacert is a valid certificate.
2014-08-31 18:17:25 -04:00
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
CFArrayAppendValue(array, cacert);
CFRelease(cacert);
return CURLE_OK;
}
internals: rename the SessionHandle struct to Curl_easy
2016-06-21 09:47:12 -04:00
static int verify_cert(const char *cafile, struct Curl_easy *data,
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
SSLContextRef ctx)
{
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
int n = 0, rc;
long res;
unsigned char *certbuf, *der;
size_t buflen, derlen, offset = 0;
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(read_cert(cafile, &certbuf, &buflen) < 0) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
failf(data, "SSL: failed to read or invalid CA certificate");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_SSL_CACERT_BADFILE;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
/*
* Certbuf now contains the contents of the certificate file, which can be
* - a single DER certificate,
* - a single PEM certificate or
* - a bunch of PEM certificates (certificate bundle).
*
* Go through certbuf, and convert any PEM certificate in it into DER
* format.
*/
CFMutableArrayRef array = CFArrayCreateMutable(kCFAllocatorDefault, 0,
&kCFTypeArrayCallBacks);
if(array == NULL) {
free(certbuf);
failf(data, "SSL: out of memory creating CA certificate array");
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return CURLE_OUT_OF_MEMORY;
}
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
while(offset < buflen) {
n++;
/*
* Check if the certificate is in PEM format, and convert it to DER. If
* this fails, we assume the certificate is in DER format.
*/
res = pem_to_der((const char *)certbuf + offset, &der, &derlen);
if(res < 0) {
free(certbuf);
CFRelease(array);
failf(data, "SSL: invalid CA certificate #%d (offset %d) in bundle",
n, offset);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_SSL_CACERT_BADFILE;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
}
offset += res;
if(res == 0 && offset == 0) {
/* This is not a PEM file, probably a certificate in DER format. */
rc = append_cert_to_array(data, certbuf, buflen, array);
free(certbuf);
if(rc != CURLE_OK) {
CFRelease(array);
return rc;
}
break;
}
else if(res == 0) {
/* No more certificates in the bundle. */
free(certbuf);
break;
}
rc = append_cert_to_array(data, der, derlen, array);
free(der);
if(rc != CURLE_OK) {
free(certbuf);
CFRelease(array);
return rc;
}
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
SecTrustRef trust;
OSStatus ret = SSLCopyPeerTrust(ctx, &trust);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(trust == NULL) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
failf(data, "SSL: error getting certificate chain");
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
CFRelease(array);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
}
else if(ret != noErr) {
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
CFRelease(array);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
failf(data, "SSLCopyPeerTrust() returned error %d", ret);
return CURLE_PEER_FAILED_VERIFICATION;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
ret = SecTrustSetAnchorCertificates(trust, array);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(ret != noErr) {
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
CFRelease(array);
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
CFRelease(trust);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
failf(data, "SecTrustSetAnchorCertificates() returned error %d", ret);
return CURLE_PEER_FAILED_VERIFICATION;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
ret = SecTrustSetAnchorCertificatesOnly(trust, true);
if(ret != noErr) {
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
CFRelease(array);
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
CFRelease(trust);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
failf(data, "SecTrustSetAnchorCertificatesOnly() returned error %d", ret);
return CURLE_PEER_FAILED_VERIFICATION;
Fix CA certificate bundle handling in darwinssl. If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-28 15:31:17 -04:00
}
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
SecTrustResultType trust_eval = 0;
ret = SecTrustEvaluate(trust, &trust_eval);
CFRelease(array);
CFRelease(trust);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(ret != noErr) {
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
failf(data, "SecTrustEvaluate() returned error %d", ret);
return CURLE_PEER_FAILED_VERIFICATION;
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
}
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(trust_eval) {
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
case kSecTrustResultUnspecified:
case kSecTrustResultProceed:
return CURLE_OK;
case kSecTrustResultRecoverableTrustFailure:
case kSecTrustResultDeny:
default:
failf(data, "SSL: certificate verification failed (result: %d)",
trust_eval);
return CURLE_PEER_FAILED_VERIFICATION;
}
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY
darwinssl: fix pinnedpubkey build error - s/SessionHandle/Curl_easy/ Bug: https://github.com/curl/curl/commit/eb16305#commitcomment-23035670 Reported-by: Gisle Vanem
2017-07-17 02:46:07 -04:00
static CURLcode pkp_pin_peer_pubkey(struct Curl_easy *data,
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
SSLContextRef ctx,
const char *pinnedpubkey)
{ /* Scratch */
size_t pubkeylen, realpubkeylen, spkiHeaderLength = 24;
darwin: silence compiler warnings With a clang pragma and three type fixes Fixes #1722
2017-08-03 18:04:39 -04:00
unsigned char *pubkey = NULL, *realpubkey = NULL;
const unsigned char *spkiHeader = NULL;
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
CFDataRef publicKeyBits = NULL;
/* Result is returned to caller */
CURLcode result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
/* if a path wasn't specified, don't pin */
if(!pinnedpubkey)
return CURLE_OK;
if(!ctx)
return result;
do {
SecTrustRef trust;
OSStatus ret = SSLCopyPeerTrust(ctx, &trust);
if(ret != noErr || trust == NULL)
break;
SecKeyRef keyRef = SecTrustCopyPublicKey(trust);
CFRelease(trust);
if(keyRef == NULL)
break;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY_V1
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
publicKeyBits = SecKeyCopyExternalRepresentation(keyRef, NULL);
CFRelease(keyRef);
if(publicKeyBits == NULL)
break;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#elif SECTRANSP_PINNEDPUBKEY_V2
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
OSStatus success = SecItemExport(keyRef, kSecFormatOpenSSL, 0, NULL,
&publicKeyBits);
CFRelease(keyRef);
if(success != errSecSuccess || publicKeyBits == NULL)
break;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* SECTRANSP_PINNEDPUBKEY_V2 */
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
pubkeylen = CFDataGetLength(publicKeyBits);
darwin: silence compiler warnings With a clang pragma and three type fixes Fixes #1722
2017-08-03 18:04:39 -04:00
pubkey = (unsigned char *)CFDataGetBytePtr(publicKeyBits);
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
switch(pubkeylen) {
case 526:
/* 4096 bit RSA pubkeylen == 526 */
spkiHeader = rsa4096SpkiHeader;
break;
case 270:
/* 2048 bit RSA pubkeylen == 270 */
spkiHeader = rsa2048SpkiHeader;
break;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY_V1
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
case 65:
/* ecDSA secp256r1 pubkeylen == 65 */
spkiHeader = ecDsaSecp256r1SpkiHeader;
spkiHeaderLength = 26;
break;
case 97:
/* ecDSA secp384r1 pubkeylen == 97 */
spkiHeader = ecDsaSecp384r1SpkiHeader;
spkiHeaderLength = 23;
break;
default:
infof(data, "SSL: unhandled public key length: %d\n", pubkeylen);
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#elif SECTRANSP_PINNEDPUBKEY_V2
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
default:
/* ecDSA secp256r1 pubkeylen == 91 header already included?
* ecDSA secp384r1 header already included too
* we assume rest of algorithms do same, so do nothing
*/
result = Curl_pin_peer_pubkey(data, pinnedpubkey, pubkey,
pubkeylen);
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* SECTRANSP_PINNEDPUBKEY_V2 */
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
continue; /* break from loop */
}
realpubkeylen = pubkeylen + spkiHeaderLength;
realpubkey = malloc(realpubkeylen);
if(!realpubkey)
break;
memcpy(realpubkey, spkiHeader, spkiHeaderLength);
memcpy(realpubkey + spkiHeaderLength, pubkey, pubkeylen);
result = Curl_pin_peer_pubkey(data, pinnedpubkey, realpubkey,
realpubkeylen);
} while(0);
Curl_safefree(realpubkey);
if(publicKeyBits != NULL)
CFRelease(publicKeyBits);
return result;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* SECTRANSP_PINNEDPUBKEY */
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
static CURLcode
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
sectransp_connect_step2(struct connectdata *conn, int sockindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
internals: rename the SessionHandle struct to Curl_easy
2016-06-21 09:47:12 -04:00
struct Curl_easy *data = conn->data;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
OSStatus err;
SSLCipherSuite cipher;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
SSLProtocol protocol = 0;
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
conn->host.name;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
DEBUGASSERT(ssl_connect_2 == connssl->connecting_state
|| ssl_connect_2_reading == connssl->connecting_state
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
|| ssl_connect_2_writing == connssl->connecting_state);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* Here goes nothing: */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLHandshake(BACKEND->ssl_ctx);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(err) {
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
case errSSLWouldBlock: /* they're not done with us yet */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
connssl->connecting_state = BACKEND->ssl_direction ?
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
ssl_connect_2_writing : ssl_connect_2_reading;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
return CURLE_OK;
darwinssl: Make certificate errors less techy Previously if a problem was found with one of the server's certificates, we'd log an OSStatus for the end user to look up. Now we explain what was wrong with the site's certificate chain. Also un-did part of the previous commit where the code wouldn't catch errSSLServerAuthCompleted if built under Leopard.
2013-02-08 20:34:11 -05:00
/* The below is errSSLServerAuthCompleted; it's not defined in
Leopard's headers */
case -9841:
darwinssl: --insecure overrides --cacert if both settings are in use Fixes #1184
2017-01-03 18:44:57 -05:00
if(SSL_CONN_CONFIG(CAfile) && SSL_CONN_CONFIG(verifypeer)) {
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
int res = verify_cert(SSL_CONN_CONFIG(CAfile), data,
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
BACKEND->ssl_ctx);
darwinssl: fix lint & build warnings in the previous commit
2014-05-21 20:21:15 -04:00
if(res != CURLE_OK)
Add support for --cacert in DarwinSSL. Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-04-17 10:03:05 -04:00
return res;
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* the documentation says we need to call SSLHandshake() again */
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
return sectransp_connect_step2(conn, sockindex);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
/* Problem with encrypt / decrypt */
case errSSLPeerDecodeError:
failf(data, "Decode failed");
break;
case errSSLDecryptionFail:
case errSSLPeerDecryptionFail:
failf(data, "Decryption failed");
break;
case errSSLPeerDecryptError:
failf(data, "A decryption error occurred");
break;
case errSSLBadCipherSuite:
failf(data, "A bad SSL cipher suite was encountered");
break;
case errSSLCrypto:
failf(data, "An underlying cryptographic error was encountered");
break;
#if CURL_BUILD_MAC_10_11 || CURL_BUILD_IOS_9
case errSSLWeakPeerEphemeralDHKey:
failf(data, "Indicates a weak ephemeral Diffie-Hellman key");
break;
#endif
/* Problem with the message record validation */
case errSSLBadRecordMac:
case errSSLPeerBadRecordMac:
failf(data, "A record with a bad message authentication code (MAC) "
"was encountered");
break;
case errSSLRecordOverflow:
case errSSLPeerRecordOverflow:
failf(data, "A record overflow occurred");
break;
/* Problem with zlib decompression */
case errSSLPeerDecompressFail:
failf(data, "Decompression failed");
break;
/* Problem with access */
case errSSLPeerAccessDenied:
failf(data, "Access was denied");
break;
case errSSLPeerInsufficientSecurity:
failf(data, "There is insufficient security for this operation");
break;
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
/* These are all certificate problems with the server: */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
case errSSLXCertChainInvalid:
darwinssl: Make certificate errors less techy Previously if a problem was found with one of the server's certificates, we'd log an OSStatus for the end user to look up. Now we explain what was wrong with the site's certificate chain. Also un-did part of the previous commit where the code wouldn't catch errSSLServerAuthCompleted if built under Leopard.
2013-02-08 20:34:11 -05:00
failf(data, "SSL certificate problem: Invalid certificate chain");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
case errSSLUnknownRootCert:
darwinssl: Make certificate errors less techy Previously if a problem was found with one of the server's certificates, we'd log an OSStatus for the end user to look up. Now we explain what was wrong with the site's certificate chain. Also un-did part of the previous commit where the code wouldn't catch errSSLServerAuthCompleted if built under Leopard.
2013-02-08 20:34:11 -05:00
failf(data, "SSL certificate problem: Untrusted root certificate");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
case errSSLNoRootCert:
darwinssl: Make certificate errors less techy Previously if a problem was found with one of the server's certificates, we'd log an OSStatus for the end user to look up. Now we explain what was wrong with the site's certificate chain. Also un-did part of the previous commit where the code wouldn't catch errSSLServerAuthCompleted if built under Leopard.
2013-02-08 20:34:11 -05:00
failf(data, "SSL certificate problem: No root certificate");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case errSSLCertNotYetValid:
failf(data, "SSL certificate problem: The certificate chain had a "
"certificate that is not yet valid");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
case errSSLCertExpired:
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case errSSLPeerCertExpired:
darwinssl: Make certificate errors less techy Previously if a problem was found with one of the server's certificates, we'd log an OSStatus for the end user to look up. Now we explain what was wrong with the site's certificate chain. Also un-did part of the previous commit where the code wouldn't catch errSSLServerAuthCompleted if built under Leopard.
2013-02-08 20:34:11 -05:00
failf(data, "SSL certificate problem: Certificate chain had an "
"expired certificate");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: additional descriptive messages of SSL handshake errors (This doesn't need to appear in the release notes.)
2013-04-01 20:24:32 -04:00
case errSSLBadCert:
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case errSSLPeerBadCert:
darwinssl: additional descriptive messages of SSL handshake errors (This doesn't need to appear in the release notes.)
2013-04-01 20:24:32 -04:00
failf(data, "SSL certificate problem: Couldn't understand the server "
"certificate format");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case errSSLPeerUnsupportedCert:
failf(data, "SSL certificate problem: An unsupported certificate "
"format was encountered");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case errSSLPeerCertRevoked:
failf(data, "SSL certificate problem: The certificate was revoked");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case errSSLPeerCertUnknown:
failf(data, "SSL certificate problem: The certificate is unknown");
ssl: replace all internal uses of CURLE_SSL_CACERT Closes #3291
2018-11-19 20:48:59 -05:00
return CURLE_PEER_FAILED_VERIFICATION;
SSL: Several SSL-backend related fixes axTLS: This will make the axTLS backend perform the RFC2818 checks, honoring the VERIFYHOST setting similar to the OpenSSL backend. Generic for OpenSSL and axTLS: Move the hostcheck and cert_hostcheck functions from the lib/ssluse.c files to make them genericly available for both the OpenSSL, axTLS and other SSL backends. They are now in the new lib/hostcheck.c file. CyaSSL: CyaSSL now also has the RFC2818 checks enabled by default. There is a limitation that the verifyhost can not be enabled exclusively on the Subject CN field comparison. This SSL backend will thus behave like the NSS and the GnuTLS (meaning: RFC2818 ok, or bust). In other words: setting verifyhost to 0 or 1 will disable the Subject Alt Names checks too. Schannel: Updated the schannel information messages: Split the IP address usage message from the verifyhost setting and changed the message about disabling SNI (Server Name Indication, used in HTTP virtual hosting) into a message stating that the Subject Alternative Names checks are being disabled when verifyhost is set to 0 or 1. As a side effect of switching off the RFC2818 related servername checks with SCH_CRED_NO_SERVERNAME_CHECK (http://msdn.microsoft.com/en-us/library/aa923430.aspx) the SNI feature is being disabled. This effect is not documented in MSDN, but Wireshark output clearly shows the effect (details on the libcurl maillist). PolarSSL: Fix the prototype change in PolarSSL of ssl_set_session() and the move of the peer_cert from the ssl_context to the ssl_session. Found this change in the PolarSSL SVN between r1316 and r1317 where the POLARSSL_VERSION_NUMBER was at 0x01010100. But to accommodate the Ubuntu PolarSSL version 1.1.4 the check is to discriminate between lower then PolarSSL version 1.2.0 and 1.2.0 and higher. Note: The PolarSSL SVN trunk jumped from version 1.1.1 to 1.2.0. Generic: All the SSL backends are fixed and checked to work with the ssl.verifyhost as a boolean, which is an internal API change.
2012-11-02 21:06:51 -04:00
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
/* These are all certificate problems with the client: */
case errSecAuthFailed:
failf(data, "SSL authentication failed");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
case errSSLPeerHandshakeFail:
failf(data, "SSL peer handshake failed, the server most likely "
"requires a client certificate to connect");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
case errSSLPeerUnknownCA:
failf(data, "SSL server rejected the client certificate due to "
"the certificate being signed by an unknown certificate "
"authority");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
darwinssl: add TLS crypto authentication Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-28 01:15:07 -04:00
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
/* This error is raised if the server's cert didn't match the server's
host name: */
SSL: Several SSL-backend related fixes axTLS: This will make the axTLS backend perform the RFC2818 checks, honoring the VERIFYHOST setting similar to the OpenSSL backend. Generic for OpenSSL and axTLS: Move the hostcheck and cert_hostcheck functions from the lib/ssluse.c files to make them genericly available for both the OpenSSL, axTLS and other SSL backends. They are now in the new lib/hostcheck.c file. CyaSSL: CyaSSL now also has the RFC2818 checks enabled by default. There is a limitation that the verifyhost can not be enabled exclusively on the Subject CN field comparison. This SSL backend will thus behave like the NSS and the GnuTLS (meaning: RFC2818 ok, or bust). In other words: setting verifyhost to 0 or 1 will disable the Subject Alt Names checks too. Schannel: Updated the schannel information messages: Split the IP address usage message from the verifyhost setting and changed the message about disabling SNI (Server Name Indication, used in HTTP virtual hosting) into a message stating that the Subject Alternative Names checks are being disabled when verifyhost is set to 0 or 1. As a side effect of switching off the RFC2818 related servername checks with SCH_CRED_NO_SERVERNAME_CHECK (http://msdn.microsoft.com/en-us/library/aa923430.aspx) the SNI feature is being disabled. This effect is not documented in MSDN, but Wireshark output clearly shows the effect (details on the libcurl maillist). PolarSSL: Fix the prototype change in PolarSSL of ssl_set_session() and the move of the peer_cert from the ssl_context to the ssl_session. Found this change in the PolarSSL SVN between r1316 and r1317 where the POLARSSL_VERSION_NUMBER was at 0x01010100. But to accommodate the Ubuntu PolarSSL version 1.1.4 the check is to discriminate between lower then PolarSSL version 1.2.0 and 1.2.0 and higher. Note: The PolarSSL SVN trunk jumped from version 1.1.1 to 1.2.0. Generic: All the SSL backends are fixed and checked to work with the ssl.verifyhost as a boolean, which is an internal API change.
2012-11-02 21:06:51 -04:00
case errSSLHostNameMismatch:
failf(data, "SSL certificate peer verification failed, the "
"certificate did not match \"%s\"\n", conn->host.dispname);
return CURLE_PEER_FAILED_VERIFICATION;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
/* Problem with SSL / TLS negotiation */
case errSSLNegotiation:
failf(data, "Could not negotiate an SSL cipher suite with the server");
break;
case errSSLBadConfiguration:
failf(data, "A configuration error occurred");
break;
case errSSLProtocol:
failf(data, "SSL protocol error");
break;
case errSSLPeerProtocolVersion:
failf(data, "A bad protocol version was encountered");
break;
case errSSLPeerNoRenegotiation:
failf(data, "No renegotiation is allowed");
break;
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
/* Generic handshake errors: */
darwinssl: fix infinite loop if server disconnected abruptly If the server hung up the connection without sending a closure alert, then we'd keep probing the socket for data even though it's dead. Now we're ready for this situation. Bug: http://curl.haxx.se/mail/lib-2013-03/0014.html Reported by: Aki Koskinen
2013-03-04 00:11:10 -05:00
case errSSLConnectionRefused:
failf(data, "Server dropped the connection during the SSL handshake");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
case errSSLClosedAbort:
failf(data, "Server aborted the SSL handshake");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
case errSSLClosedGraceful:
failf(data, "The connection closed gracefully");
break;
case errSSLClosedNoNotify:
failf(data, "The server closed the session with no notification");
break;
darwinssl: additional descriptive messages of SSL handshake errors (This doesn't need to appear in the release notes.)
2013-04-01 20:24:32 -04:00
/* Sometimes paramErr happens with buggy ciphers: */
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
case paramErr:
case errSSLInternal:
case errSSLPeerInternalError:
darwinssl: disable ECC ciphers under Mountain Lion by default I found out that ECC doesn't work as of OS X 10.8.3, so those ciphers are turned off until the next point release of OS X.
2013-03-19 17:21:34 -04:00
failf(data, "Internal SSL engine error encountered during the "
"SSL handshake");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
darwinssl: additional descriptive messages of SSL handshake errors (This doesn't need to appear in the release notes.)
2013-04-01 20:24:32 -04:00
case errSSLFatalAlert:
failf(data, "Fatal SSL engine error encountered during the SSL "
"handshake");
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
/* Unclassified error */
case errSSLBufferOverflow:
failf(data, "An insufficient buffer was provided");
break;
case errSSLIllegalParam:
failf(data, "An illegal parameter was encountered");
break;
case errSSLModuleAttach:
failf(data, "Module attach failure");
break;
case errSSLSessionNotFound:
failf(data, "An attempt to restore an unknown session failed");
break;
case errSSLPeerExportRestriction:
failf(data, "An export restriction occurred");
break;
case errSSLPeerUserCancelled:
failf(data, "The user canceled the operation");
break;
case errSSLPeerUnexpectedMsg:
failf(data, "Peer rejected unexpected message");
break;
#if CURL_BUILD_MAC_10_11 || CURL_BUILD_IOS_9
/* Treaing non-fatal error as fatal like before */
case errSSLClientHelloReceived:
failf(data, "A non-fatal result for providing a server name "
"indication");
break;
#endif
/* Error codes defined in the enum but should never be returned.
We list them here just in case. */
#if CURL_BUILD_MAC_10_6
/* Only returned when kSSLSessionOptionBreakOnCertRequested is set */
case errSSLClientCertRequested:
failf(data, "The server has requested a client certificate");
break;
#endif
#if CURL_BUILD_MAC_10_9
/* Alias for errSSLLast, end of error range */
case errSSLUnexpectedRecord:
failf(data, "Unexpected (skipped) record in DTLS");
break;
#endif
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
default:
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
/* May also return codes listed in Security Framework Result Codes */
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
failf(data, "Unknown SSL protocol error in connection to %s:%d",
HTTPS-proxy: fixed mbedtls and polishing
2016-11-21 05:01:25 -05:00
hostname, err);
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
break;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
darwinssl: more specific and unified error codes Closes #2901
2018-08-14 19:53:18 -04:00
return CURLE_SSL_CONNECT_ERROR;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
else {
/* we have been connected fine, we're not waiting for anything else. */
connssl->connecting_state = ssl_connect_3;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
if(data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG]) {
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
CURLcode result = pkp_pin_peer_pubkey(data, BACKEND->ssl_ctx,
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG]);
if(result) {
failf(data, "SSL: public key does not match pinned public key!");
return result;
}
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* SECTRANSP_PINNEDPUBKEY */
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* Informational message */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLGetNegotiatedCipher(BACKEND->ssl_ctx, &cipher);
(void)SSLGetNegotiatedProtocolVersion(BACKEND->ssl_ctx, &protocol);
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(protocol) {
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
case kSSLProtocol2:
infof(data, "SSL 2.0 connection using %s\n",
SSLCipherNameForNumber(cipher));
break;
case kSSLProtocol3:
infof(data, "SSL 3.0 connection using %s\n",
SSLCipherNameForNumber(cipher));
break;
case kTLSProtocol1:
infof(data, "TLS 1.0 connection using %s\n",
TLSCipherNameForNumber(cipher));
break;
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
case kTLSProtocol11:
infof(data, "TLS 1.1 connection using %s\n",
TLSCipherNameForNumber(cipher));
break;
case kTLSProtocol12:
infof(data, "TLS 1.2 connection using %s\n",
TLSCipherNameForNumber(cipher));
break;
darwinssl: add support for TLSv1.3 Closes https://github.com/curl/curl/pull/1794
2017-08-16 14:05:09 -04:00
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
#if CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11
case kTLSProtocol13:
infof(data, "TLS 1.3 connection using %s\n",
TLSCipherNameForNumber(cipher));
break;
#endif /* CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11 */
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
default:
infof(data, "Unknown protocol connection\n");
break;
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
#if(CURL_BUILD_MAC_10_13 || CURL_BUILD_IOS_11) && HAVE_BUILTIN_AVAILABLE == 1
if(conn->bits.tls_enable_alpn) {
sectransp: tvOS 11 is required for ALPN support Reported-by: nianxuejie on github Assisted-by: Nick Zitzmann Assisted-by: Jay Satiro Fixes #3689 Closes #3690
2019-03-19 05:19:40 -04:00
if(__builtin_available(macOS 10.13.4, iOS 11, tvOS 11, *)) {
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
CFArrayRef alpnArr = NULL;
CFStringRef chosenProtocol = NULL;
err = SSLCopyALPNProtocols(BACKEND->ssl_ctx, &alpnArr);
if(err == noErr && alpnArr && CFArrayGetCount(alpnArr) >= 1)
chosenProtocol = CFArrayGetValueAtIndex(alpnArr, 0);
#ifdef USE_NGHTTP2
if(chosenProtocol &&
!CFStringCompare(chosenProtocol, CFSTR(NGHTTP2_PROTO_VERSION_ID),
0)) {
conn->negnpn = CURL_HTTP_VERSION_2;
}
else
#endif
if(chosenProtocol &&
!CFStringCompare(chosenProtocol, CFSTR(ALPN_HTTP_1_1), 0)) {
conn->negnpn = CURL_HTTP_VERSION_1_1;
}
else
infof(data, "ALPN, server did not agree to a protocol\n");
multi: provide Curl_multiuse_state to update information As soon as a TLS backend gets ALPN conformation about the specific HTTP version it can now set the multiplex situation for the "bundle" and trigger moving potentially queued up transfers to the CONNECT state.
2019-04-30 05:14:38 -04:00
Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ?
BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
darwinssl: add support for ALPN negotiation
2018-07-11 03:45:14 -04:00
/* chosenProtocol is a reference to the string within alpnArr
and doesn't need to be freed separately */
if(alpnArr)
CFRelease(alpnArr);
}
}
#endif
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
return CURLE_OK;
}
}
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
#ifndef CURL_DISABLE_VERBOSE_STRINGS
/* This should be called during step3 of the connection at the earliest */
static void
show_verbose_server_cert(struct connectdata *conn,
int sockindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
internals: rename the SessionHandle struct to Curl_easy
2016-06-21 09:47:12 -04:00
struct Curl_easy *data = conn->data;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
darwinssl: fix crash that started happening in Lion Something (a recent security update maybe?) changed in Lion, and now it has changed SSLCopyPeerTrust such that it may return noErr but also give us a null trust, which caught us off guard and caused an eventual crash.
2013-06-22 17:13:36 -04:00
CFArrayRef server_certs = NULL;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
SecCertificateRef server_cert;
OSStatus err;
CFIndex i, count;
darwinssl: fix crash that started happening in Lion Something (a recent security update maybe?) changed in Lion, and now it has changed SSLCopyPeerTrust such that it may return noErr but also give us a null trust, which caught us off guard and caused an eventual crash.
2013-06-22 17:13:36 -04:00
SecTrustRef trust = NULL;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
if(!BACKEND->ssl_ctx)
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
return;
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
#if CURL_BUILD_IOS
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
#pragma unused(server_certs)
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLCopyPeerTrust(BACKEND->ssl_ctx, &trust);
darwinssl: fix crash that started happening in Lion Something (a recent security update maybe?) changed in Lion, and now it has changed SSLCopyPeerTrust such that it may return noErr but also give us a null trust, which caught us off guard and caused an eventual crash.
2013-06-22 17:13:36 -04:00
/* For some reason, SSLCopyPeerTrust() can return noErr and yet return
a null trust, so be on guard for that: */
if(err == noErr && trust) {
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
count = SecTrustGetCertificateCount(trust);
for(i = 0L ; i < count ; i++) {
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
CURLcode result;
char *certp;
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
server_cert = SecTrustGetCertificateAtIndex(trust, i);
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
result = CopyCertSubject(data, server_cert, &certp);
if(!result) {
infof(data, "Server certificate: %s\n", certp);
free(certp);
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
}
}
CFRelease(trust);
}
#else
/* SSLCopyPeerCertificates() is deprecated as of Mountain Lion.
The function SecTrustGetCertificateAtIndex() is officially present
in Lion, but it is unfortunately also present in Snow Leopard as
private API and doesn't work as expected. So we have to look for
a different symbol to make sure this code is only executed under
Lion or later. */
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
if(SecTrustEvaluateAsync != NULL) {
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
#pragma unused(server_certs)
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLCopyPeerTrust(BACKEND->ssl_ctx, &trust);
darwinssl: fix crash that started happening in Lion Something (a recent security update maybe?) changed in Lion, and now it has changed SSLCopyPeerTrust such that it may return noErr but also give us a null trust, which caught us off guard and caused an eventual crash.
2013-06-22 17:13:36 -04:00
/* For some reason, SSLCopyPeerTrust() can return noErr and yet return
a null trust, so be on guard for that: */
if(err == noErr && trust) {
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
count = SecTrustGetCertificateCount(trust);
for(i = 0L ; i < count ; i++) {
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
char *certp;
CURLcode result;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
server_cert = SecTrustGetCertificateAtIndex(trust, i);
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
result = CopyCertSubject(data, server_cert, &certp);
if(!result) {
infof(data, "Server certificate: %s\n", certp);
free(certp);
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
}
}
CFRelease(trust);
}
}
else {
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_SUPPORT_MAC_10_8
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLCopyPeerCertificates(BACKEND->ssl_ctx, &server_certs);
darwinssl: fix crash that started happening in Lion Something (a recent security update maybe?) changed in Lion, and now it has changed SSLCopyPeerTrust such that it may return noErr but also give us a null trust, which caught us off guard and caused an eventual crash.
2013-06-22 17:13:36 -04:00
/* Just in case SSLCopyPeerCertificates() returns null too... */
if(err == noErr && server_certs) {
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
count = CFArrayGetCount(server_certs);
for(i = 0L ; i < count ; i++) {
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
char *certp;
CURLcode result;
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs,
i);
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
result = CopyCertSubject(data, server_cert, &certp);
if(!result) {
infof(data, "Server certificate: %s\n", certp);
free(certp);
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
}
}
CFRelease(server_certs);
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_SUPPORT_MAC_10_8 */
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_IOS */
darwinssl: fixed for older Mac OS X versions SSL didn't work on older cats if built on a newer cat with weak-linking turned on to support the older cat
2012-09-07 22:01:08 -04:00
#else
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
#pragma unused(trust)
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLCopyPeerCertificates(BACKEND->ssl_ctx, &server_certs);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err == noErr) {
count = CFArrayGetCount(server_certs);
for(i = 0L ; i < count ; i++) {
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
CURLcode result;
char *certp;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs, i);
darwinssl: handle long strings in TLS certs ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-25 10:56:03 -04:00
result = CopyCertSubject(data, server_cert, &certp);
if(!result) {
infof(data, "Server certificate: %s\n", certp);
free(certp);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
}
CFRelease(server_certs);
}
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
}
#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
static CURLcode
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
sectransp_connect_step3(struct connectdata *conn,
darwinssl: Avoid parsing certificates when not in verbose mode The information extracted from the server certificates in step 3 is only used when in verbose mode, and there is no error handling or validation performed as that has already been done. Only run the certificate information extraction when in verbose mode and libcurl was built with verbose strings. Closes https://github.com/curl/curl/pull/1246
2017-02-05 04:26:07 -05:00
int sockindex)
{
struct Curl_easy *data = conn->data;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
/* There is no step 3!
* Well, okay, if verbose mode is on, let's print the details of the
* server certificates. */
#ifndef CURL_DISABLE_VERBOSE_STRINGS
if(data->set.verbose)
show_verbose_server_cert(conn, sockindex);
#endif
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
connssl->connecting_state = ssl_connect_done;
return CURLE_OK;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static Curl_recv sectransp_recv;
static Curl_send sectransp_send;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
static CURLcode
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
sectransp_connect_common(struct connectdata *conn,
DarwinSSL: several adjustments - Renamed st_ function prefix to darwinssl_ - Renamed Curl_st_ function prefix to Curl_darwinssl_ - Moved the duplicated ssl_connect_done out of the #ifdef in lib/urldata.h - Fixed a teensy little bug that made non-blocking connection attempts block - Made it so that it builds cleanly against the iOS 5.1 SDK
2012-06-26 15:39:48 -04:00
int sockindex,
bool nonblocking,
bool *done)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
CURLcode result;
internals: rename the SessionHandle struct to Curl_easy
2016-06-21 09:47:12 -04:00
struct Curl_easy *data = conn->data;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
curl_socket_t sockfd = conn->sock[sockindex];
long timeout_ms;
int what;
/* check if the connection has already been established */
if(ssl_connection_complete == connssl->state) {
*done = TRUE;
return CURLE_OK;
}
code style: use spaces around equals signs
2017-09-09 17:09:06 -04:00
if(ssl_connect_1 == connssl->connecting_state) {
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* Find out how much more time we're allowed */
timeout_ms = Curl_timeleft(data, NULL, TRUE);
if(timeout_ms < 0) {
/* no need to continue if time already is up */
failf(data, "SSL connection timeout");
return CURLE_OPERATION_TIMEDOUT;
}
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
result = sectransp_connect_step1(conn, sockindex);
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(result)
return result;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
while(ssl_connect_2 == connssl->connecting_state ||
ssl_connect_2_reading == connssl->connecting_state ||
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
ssl_connect_2_writing == connssl->connecting_state) {
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
/* check allowed time left */
timeout_ms = Curl_timeleft(data, NULL, TRUE);
if(timeout_ms < 0) {
/* no need to continue if time already is up */
failf(data, "SSL connection timeout");
return CURLE_OPERATION_TIMEDOUT;
}
/* if ssl is expecting something, check if it's available. */
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(connssl->connecting_state == ssl_connect_2_reading ||
connssl->connecting_state == ssl_connect_2_writing) {
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
curl_socket_t writefd = ssl_connect_2_writing ==
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
darwinssl: fixed freeze involving the multi interface Previously the curl_multi interface would freeze if darwinssl was enabled and at least one of the handles tried to connect to a Web site using HTTPS. Removed the "wouldblock" state darwinssl was using because I figured out a solution for our "would block but in which direction?" dilemma.
2012-07-16 22:20:57 -04:00
curl_socket_t readfd = ssl_connect_2_reading ==
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
select: switch to macros in uppercase Curl_select_ready() was the former API that was replaced with Curl_select_check() a while back and the former arg setup was provided with a define (in order to leave existing code unmodified). Now we instead offer SOCKET_READABLE and SOCKET_WRITABLE for the most common shortcuts where only one socket is checked. They're also more visibly macros.
2016-10-18 04:58:58 -04:00
what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
nonblocking?0:timeout_ms);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(what < 0) {
/* fatal error */
failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
return CURLE_SSL_CONNECT_ERROR;
}
else if(0 == what) {
if(nonblocking) {
*done = FALSE;
return CURLE_OK;
}
else {
/* timeout */
failf(data, "SSL connection timeout");
return CURLE_OPERATION_TIMEDOUT;
}
}
/* socket is readable or writable */
}
/* Run transaction, and return to the caller if it failed or if this
* connection is done nonblocking and this loop would execute again. This
* permits the owner of a multi handle to abort a connection attempt
* before step2 has completed while ensuring that a client using select()
* or epoll() will always have a valid fdset to wait on.
*/
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
result = sectransp_connect_step2(conn, sockindex);
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(result || (nonblocking &&
(ssl_connect_2 == connssl->connecting_state ||
ssl_connect_2_reading == connssl->connecting_state ||
ssl_connect_2_writing == connssl->connecting_state)))
return result;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
} /* repeat step2 until all transactions are done. */
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(ssl_connect_3 == connssl->connecting_state) {
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
result = sectransp_connect_step3(conn, sockindex);
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(result)
return result;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(ssl_connect_done == connssl->connecting_state) {
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
connssl->state = ssl_connection_complete;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
conn->recv[sockindex] = sectransp_recv;
conn->send[sockindex] = sectransp_send;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
*done = TRUE;
}
else
*done = FALSE;
/* Reset our connect state machine */
connssl->connecting_state = ssl_connect_1;
return CURLE_OK;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static CURLcode Curl_sectransp_connect_nonblocking(struct connectdata *conn,
vtls: remove obsolete declarations of SSL backend functionality These functions are all available via the Curl_ssl struct now, no need to declare them separately anymore. As the global declarations are removed, the corresponding function definitions are marked as file-local. The only two exceptions here are Curl_mbedtls_shutdown() and Curl_polarssl_shutdown(): only the declarations were removed, there are no function definitions to mark file-local. Please note that Curl_nss_force_init() is *still* declared globally, as the only SSL backend-specific function, because it was introduced specifically for the use case where cURL was compiled with `--without-ssl --with-nss`. For details, see f3b77e561 (http_ntlm: add support for NSS, 2010-06-27). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-23 07:19:00 -04:00
int sockindex, bool *done)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
return sectransp_connect_common(conn, sockindex, TRUE, done);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static CURLcode Curl_sectransp_connect(struct connectdata *conn, int sockindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
CURLcode result;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
bool done = FALSE;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
result = sectransp_connect_common(conn, sockindex, FALSE, &done);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: Use 'CURLcode result' for curl result codes
2014-12-27 12:36:35 -05:00
if(result)
return result;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
DEBUGASSERT(done);
return CURLE_OK;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static void Curl_sectransp_close(struct connectdata *conn, int sockindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
if(BACKEND->ssl_ctx) {
(void)SSLClose(BACKEND->ssl_ctx);
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
if(SSLCreateContext != NULL)
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
CFRelease(BACKEND->ssl_ctx);
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#if CURL_SUPPORT_MAC_10_8
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
else
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLDisposeContext(BACKEND->ssl_ctx);
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_SUPPORT_MAC_10_8 */
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
#else
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
(void)SSLDisposeContext(BACKEND->ssl_ctx);
darwinssl: reform OS-specific #defines This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
2013-06-22 14:23:26 -04:00
#endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
BACKEND->ssl_ctx = NULL;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
}
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
BACKEND->ssl_sockfd = 0;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static int Curl_sectransp_shutdown(struct connectdata *conn, int sockindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
internals: rename the SessionHandle struct to Curl_easy
2016-06-21 09:47:12 -04:00
struct Curl_easy *data = conn->data;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
ssize_t nread;
int what;
int rc;
char buf[120];
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
if(!BACKEND->ssl_ctx)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
return 0;
if(data->set.ftp_ccc != CURLFTPSSL_CCC_ACTIVE)
return 0;
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
Curl_sectransp_close(conn, sockindex);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
rc = 0;
select: switch to macros in uppercase Curl_select_ready() was the former API that was replaced with Curl_select_check() a while back and the former arg setup was provided with a define (in order to leave existing code unmodified). Now we instead offer SOCKET_READABLE and SOCKET_WRITABLE for the most common shortcuts where only one socket is checked. They're also more visibly macros.
2016-10-18 04:58:58 -04:00
what = SOCKET_READABLE(conn->sock[sockindex], SSL_SHUTDOWN_TIMEOUT);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
for(;;) {
if(what < 0) {
/* anything that gets here is fatally bad */
failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
rc = -1;
break;
}
if(!what) { /* timeout */
failf(data, "SSL shutdown timeout");
break;
}
/* Something to read, let's do it and hope that it is the close
notify alert from the server. No way to SSL_Read now, so use read(). */
nread = read(conn->sock[sockindex], buf, sizeof(buf));
if(nread < 0) {
failf(data, "read: %s", strerror(errno));
rc = -1;
}
if(nread <= 0)
break;
select: switch to macros in uppercase Curl_select_ready() was the former API that was replaced with Curl_select_check() a while back and the former arg setup was provided with a define (in order to leave existing code unmodified). Now we instead offer SOCKET_READABLE and SOCKET_WRITABLE for the most common shortcuts where only one socket is checked. They're also more visibly macros.
2016-10-18 04:58:58 -04:00
what = SOCKET_READABLE(conn->sock[sockindex], 0);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
return rc;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static void Curl_sectransp_session_free(void *ptr)
darwinssl: add TLS session resumption This ought to speed up additional TLS handshakes, at least in theory.
2013-04-12 14:20:10 -04:00
{
/* ST, as of iOS 5 and Mountain Lion, has no public method of deleting a
cached session ID inside the Security framework. There is a private
function that does this, but I don't want to have to explain to you why I
got your application rejected from the App Store due to the use of a
private API, so the best we can do is free up our own char array that we
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
created way back in sectransp_connect_step1... */
darwinssl: add TLS session resumption This ought to speed up additional TLS handshakes, at least in theory.
2013-04-12 14:20:10 -04:00
Curl_safefree(ptr);
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static size_t Curl_sectransp_version(char *buffer, size_t size)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
snprintf: renamed and we now only use msnprintf() The function does not return the same value as snprintf() normally does, so readers may be mislead into thinking the code works differently than it actually does. A different function name makes this easier to detect. Reported-by: Tomas Hoger Assisted-by: Daniel Gustafsson Fixes #3296 Closes #3297
2018-11-22 03:01:24 -05:00
return msnprintf(buffer, size, "SecureTransport");
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
/*
* This function uses SSLGetSessionState to determine connection status.
*
* Return codes:
* 1 means the connection is still in place
* 0 means the connection has been closed
* -1 means the connection status is unknown
*/
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static int Curl_sectransp_check_cxn(struct connectdata *conn)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
struct ssl_connect_data *connssl = &conn->ssl[FIRSTSOCKET];
OSStatus err;
SSLSessionState state;
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
if(BACKEND->ssl_ctx) {
err = SSLGetSessionState(BACKEND->ssl_ctx, &state);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err == noErr)
return state == kSSLConnected || state == kSSLHandshake;
return -1;
}
return 0;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static bool Curl_sectransp_data_pending(const struct connectdata *conn,
vtls: remove obsolete declarations of SSL backend functionality These functions are all available via the Curl_ssl struct now, no need to declare them separately anymore. As the global declarations are removed, the corresponding function definitions are marked as file-local. The only two exceptions here are Curl_mbedtls_shutdown() and Curl_polarssl_shutdown(): only the declarations were removed, there are no function definitions to mark file-local. Please note that Curl_nss_force_init() is *still* declared globally, as the only SSL backend-specific function, because it was introduced specifically for the use case where cURL was compiled with `--without-ssl --with-nss`. For details, see f3b77e561 (http_ntlm: add support for NSS, 2010-06-27). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-23 07:19:00 -04:00
int connindex)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
const struct ssl_connect_data *connssl = &conn->ssl[connindex];
OSStatus err;
size_t buffer;
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
if(BACKEND->ssl_ctx) { /* SSL is in use */
err = SSLGetBufferedReadSize(BACKEND->ssl_ctx, &buffer);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err == noErr)
return buffer > 0UL;
return false;
}
else
return false;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static CURLcode Curl_sectransp_random(struct Curl_easy *data UNUSED_PARAM,
vtls: remove obsolete declarations of SSL backend functionality These functions are all available via the Curl_ssl struct now, no need to declare them separately anymore. As the global declarations are removed, the corresponding function definitions are marked as file-local. The only two exceptions here are Curl_mbedtls_shutdown() and Curl_polarssl_shutdown(): only the declarations were removed, there are no function definitions to mark file-local. Please note that Curl_nss_force_init() is *still* declared globally, as the only SSL backend-specific function, because it was introduced specifically for the use case where cURL was compiled with `--without-ssl --with-nss`. For details, see f3b77e561 (http_ntlm: add support for NSS, 2010-06-27). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-23 07:19:00 -04:00
unsigned char *entropy, size_t length)
DarwinSSL: allow using NTLM authentication Allow NTLM authentication when building using SecureTransport (Darwin) for SSL. This uses CommonCrypto, a cryptography library that ships with all versions of iOS and Mac OS X. It's like OpenSSL's libcrypto, except that it's missing a few less-common cyphers and doesn't have a big number data structure.
2012-06-27 05:57:31 -04:00
{
darwinssl: don't use arc4random_buf Re-wrote Curl_darwinssl_random() to not use arc4random_buf() because the function is not available prior to iOS 4.3 and OS X 10.7.
2012-07-07 18:03:16 -04:00
/* arc4random_buf() isn't available on cats older than Lion, so let's
do this manually for the benefit of the older cats. */
size_t i;
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
u_int32_t random_number = 0;
darwinssl: don't use arc4random_buf Re-wrote Curl_darwinssl_random() to not use arc4random_buf() because the function is not available prior to iOS 4.3 and OS X 10.7.
2012-07-07 18:03:16 -04:00
SSL: fix unused parameter warnings
2017-09-06 15:11:55 -04:00
(void)data;
darwinssl: don't use arc4random_buf Re-wrote Curl_darwinssl_random() to not use arc4random_buf() because the function is not available prior to iOS 4.3 and OS X 10.7.
2012-07-07 18:03:16 -04:00
for(i = 0 ; i < length ; i++) {
if(i % sizeof(u_int32_t) == 0)
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
random_number = arc4random();
entropy[i] = random_number & 0xFF;
random_number >>= 8;
darwinssl: don't use arc4random_buf Re-wrote Curl_darwinssl_random() to not use arc4random_buf() because the function is not available prior to iOS 4.3 and OS X 10.7.
2012-07-07 18:03:16 -04:00
}
darwinssl: add TLS 1.1 and 1.2 support, replace deprecated functions In Mountain Lion, Apple added TLS 1.1 and 1.2, and deprecated a number of SecureTransport functions, some of which we were using. We now check to see if the replacement functions are present, and if so, we use them instead. The old functions are still present for users of older cats. Also fixed a build warning that started to appear under Mountain Lion
2012-08-17 00:31:41 -04:00
i = random_number = 0;
rand: make it work without TLS backing Regression introduced in commit f682156a4fc6c4 Reported-by: John Kohl Bug: https://curl.haxx.se/mail/lib-2017-01/0055.html
2017-01-12 11:41:26 -05:00
return CURLE_OK;
DarwinSSL: allow using NTLM authentication Allow NTLM authentication when building using SecureTransport (Darwin) for SSL. This uses CommonCrypto, a cryptography library that ships with all versions of iOS and Mac OS X. It's like OpenSSL's libcrypto, except that it's missing a few less-common cyphers and doesn't have a big number data structure.
2012-06-27 05:57:31 -04:00
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static CURLcode Curl_sectransp_md5sum(unsigned char *tmp, /* input */
vtls: move md5sum into the Curl_ssl struct The MD5 summing is also an SSL backend-specific function. So let's include it, offering the previous fall-back code as a separate function now: Curl_none_md5sum(). To allow for that, the signature had to be changed so that an error could be returned from the implementation (Curl_none_md5sum() can run out of memory). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 19:04:56 -04:00
size_t tmplen,
unsigned char *md5sum, /* output */
size_t md5len)
DarwinSSL: allow using NTLM authentication Allow NTLM authentication when building using SecureTransport (Darwin) for SSL. This uses CommonCrypto, a cryptography library that ships with all versions of iOS and Mac OS X. It's like OpenSSL's libcrypto, except that it's missing a few less-common cyphers and doesn't have a big number data structure.
2012-06-27 05:57:31 -04:00
{
(void)md5len;
darwinssl: Fix implicit conversion compiler warnings The Clang compiler found a few implicit conversion problems that have now been fixed.
2012-12-11 23:43:48 -05:00
(void)CC_MD5(tmp, (CC_LONG)tmplen, md5sum);
vtls: move md5sum into the Curl_ssl struct The MD5 summing is also an SSL backend-specific function. So let's include it, offering the previous fall-back code as a separate function now: Curl_none_md5sum(). To allow for that, the signature had to be changed so that an error could be returned from the implementation (Curl_none_md5sum() can run out of memory). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 19:04:56 -04:00
return CURLE_OK;
DarwinSSL: allow using NTLM authentication Allow NTLM authentication when building using SecureTransport (Darwin) for SSL. This uses CommonCrypto, a cryptography library that ships with all versions of iOS and Mac OS X. It's like OpenSSL's libcrypto, except that it's missing a few less-common cyphers and doesn't have a big number data structure.
2012-06-27 05:57:31 -04:00
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static CURLcode Curl_sectransp_sha256sum(const unsigned char *tmp, /* input */
vtls: move sha256sum into the Curl_ssl struct The SHA-256 checksumming is also an SSL backend-specific function. Let's include it in the struct declaring the functionality of SSL backends. In contrast to MD5, there is no fall-back code. To indicate this, the respective entries are NULL for those backends that offer no support for SHA-256 checksumming. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 19:04:56 -04:00
size_t tmplen,
unsigned char *sha256sum, /* output */
size_t sha256len)
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
{
vtls: switch to CURL_SHA256_DIGEST_LENGTH define ... instead of the prefix-less version since WolfSSL 3.12 now uses an enum with that name that causes build failures for us. Fixes #1865 Closes #1867 Reported-by: Gisle Vanem
2017-09-06 03:32:02 -04:00
assert(sha256len >= CURL_SHA256_DIGEST_LENGTH);
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
(void)CC_SHA256(tmp, (CC_LONG)tmplen, sha256sum);
tls: fix mbedTLS 2.7.0 build + handle sha256 failures (mbedtls 2.70 compiled with MBEDTLS_DEPRECATED_REMOVED) Closes #2453
2018-04-02 13:33:00 -04:00
return CURLE_OK;
SecureTransport/DarwinSSL: Implement public key pinning Closes #1400
2017-04-17 19:47:51 -04:00
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static bool Curl_sectransp_false_start(void)
checksrc: move open braces to comply with function declaration style
2016-11-23 02:49:04 -05:00
{
darwinsssl: add support for TLS False Start TLS False Start support requires iOS 7.0 or later, or OS X 10.9 or later.
2015-03-21 13:22:56 -04:00
#if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
if(SSLSetSessionOption != NULL)
return TRUE;
#endif
return FALSE;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static ssize_t sectransp_send(struct connectdata *conn,
DarwinSSL: several adjustments - Renamed st_ function prefix to darwinssl_ - Renamed Curl_st_ function prefix to Curl_darwinssl_ - Moved the duplicated ssl_connect_done out of the #ifdef in lib/urldata.h - Fixed a teensy little bug that made non-blocking connection attempts block - Made it so that it builds cleanly against the iOS 5.1 SDK
2012-06-26 15:39:48 -04:00
int sockindex,
const void *mem,
size_t len,
CURLcode *curlcode)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
internals: rename the SessionHandle struct to Curl_easy
2016-06-21 09:47:12 -04:00
/*struct Curl_easy *data = conn->data;*/
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
darwinssl: Fix bug where packets were sometimes transmitted twice There was a bug where, if SSLWrite() returned errSSLWouldBlock but did succeed in transmitting at least something, then we'd incorrectly resend the packet. Now we never take errSSLWouldBlock as a sign that nothing was transferred to/from the server. Bug: http://curl.haxx.se/mail/lib-2013-01/0295.html Reported by: Bruno de Carvalho
2013-01-28 21:34:35 -05:00
size_t processed = 0UL;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
OSStatus err;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
/* The SSLWrite() function works a little differently than expected. The
fourth argument (processed) is currently documented in Apple's
documentation as: "On return, the length, in bytes, of the data actually
written."
Now, one could interpret that as "written to the socket," but actually,
it returns the amount of data that was written to a buffer internal to
the SSLContextRef instead. So it's possible for SSLWrite() to return
errSSLWouldBlock and a number of bytes "written" because those bytes were
encrypted and written to a buffer, not to the socket.
So if this happens, then we need to keep calling SSLWrite() over and
over again with no new data until it quits returning errSSLWouldBlock. */
/* Do we have buffered data to write from the last time we were called? */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
if(BACKEND->ssl_write_buffered_length) {
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
/* Write the buffered data: */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLWrite(BACKEND->ssl_ctx, NULL, 0UL, &processed);
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(err) {
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
case noErr:
/* processed is always going to be 0 because we didn't write to
the buffer, so return how much was written to the socket */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
processed = BACKEND->ssl_write_buffered_length;
BACKEND->ssl_write_buffered_length = 0UL;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
break;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
case errSSLWouldBlock: /* argh, try again */
*curlcode = CURLE_AGAIN;
return -1L;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
default:
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
failf(conn->data, "SSLWrite() returned error %d", err);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
*curlcode = CURLE_SEND_ERROR;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
return -1L;
}
}
else {
/* We've got new data to write: */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
err = SSLWrite(BACKEND->ssl_ctx, mem, len, &processed);
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
if(err != noErr) {
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(err) {
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
case errSSLWouldBlock:
/* Data was buffered but not sent, we have to tell the caller
to try sending again, and remember how much was buffered */
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
BACKEND->ssl_write_buffered_length = len;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
*curlcode = CURLE_AGAIN;
return -1L;
default:
failf(conn->data, "SSLWrite() returned error %d", err);
*curlcode = CURLE_SEND_ERROR;
return -1L;
}
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
}
}
return (ssize_t)processed;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static ssize_t sectransp_recv(struct connectdata *conn,
DarwinSSL: several adjustments - Renamed st_ function prefix to darwinssl_ - Renamed Curl_st_ function prefix to Curl_darwinssl_ - Moved the duplicated ssl_connect_done out of the #ifdef in lib/urldata.h - Fixed a teensy little bug that made non-blocking connection attempts block - Made it so that it builds cleanly against the iOS 5.1 SDK
2012-06-26 15:39:48 -04:00
int num,
char *buf,
size_t buffersize,
CURLcode *curlcode)
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
{
internals: rename the SessionHandle struct to Curl_easy
2016-06-21 09:47:12 -04:00
/*struct Curl_easy *data = conn->data;*/
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
struct ssl_connect_data *connssl = &conn->ssl[num];
darwinssl: Fix bug where packets were sometimes transmitted twice There was a bug where, if SSLWrite() returned errSSLWouldBlock but did succeed in transmitting at least something, then we'd incorrectly resend the packet. Now we never take errSSLWouldBlock as a sign that nothing was transferred to/from the server. Bug: http://curl.haxx.se/mail/lib-2013-01/0295.html Reported by: Bruno de Carvalho
2013-01-28 21:34:35 -05:00
size_t processed = 0UL;
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
OSStatus err = SSLRead(BACKEND->ssl_ctx, buf, buffersize, &processed);
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
if(err != noErr) {
checksrc: stricter no-space-before-paren enforcement In order to make the code style more uniform everywhere
2016-12-13 17:34:59 -05:00
switch(err) {
darwinssl: Fix bug where packets were sometimes transmitted twice There was a bug where, if SSLWrite() returned errSSLWouldBlock but did succeed in transmitting at least something, then we'd incorrectly resend the packet. Now we never take errSSLWouldBlock as a sign that nothing was transferred to/from the server. Bug: http://curl.haxx.se/mail/lib-2013-01/0295.html Reported by: Bruno de Carvalho
2013-01-28 21:34:35 -05:00
case errSSLWouldBlock: /* return how much we read (if anything) */
if(processed)
return (ssize_t)processed;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
*curlcode = CURLE_AGAIN;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
return -1L;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
break;
darwinssl: fix infinite loop if server disconnected abruptly If the server hung up the connection without sending a closure alert, then we'd keep probing the socket for data even though it's dead. Now we're ready for this situation. Bug: http://curl.haxx.se/mail/lib-2013-03/0014.html Reported by: Aki Koskinen
2013-03-04 00:11:10 -05:00
/* errSSLClosedGraceful - server gracefully shut down the SSL session
errSSLClosedNoNotify - server hung up on us instead of sending a
closure alert notice, read() is returning 0
Either way, inform the caller that the server disconnected. */
case errSSLClosedGraceful:
case errSSLClosedNoNotify:
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
*curlcode = CURLE_OK;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
return -1L;
darwinssl: un-broke iOS build, fix error on server disconnect The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
2012-10-16 12:33:13 -04:00
break;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
default:
failf(conn->data, "SSLRead() return error %d", err);
*curlcode = CURLE_RECV_ERROR;
darwinssl: Fix send glitchiness with data > 32 or so KB An ambiguity in the SSLWrite() documentation lead to a bad inference in the code where we assumed SSLWrite() returned the amount of bytes written to the socket, when that is not actually true; it returns the amount of data that is buffered for writing to the socket if it returns errSSLWouldBlock. Now darwinssl_send() returns CURLE_AGAIN if data is buffered but not written. Reference URL: http://curl.haxx.se/mail/lib-2013-02/0145.html
2013-02-12 15:02:36 -05:00
return -1L;
darwinssl: add support for native Mac OS X/iOS SSL
2012-06-26 08:01:51 -04:00
break;
}
}
return (ssize_t)processed;
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
static void *Curl_sectransp_get_internals(struct ssl_connect_data *connssl,
getinfo: access SSL internals via Curl_ssl In the ongoing endeavor to abstract out all SSL backend-specific functionality, this is the next step: Instead of hard-coding how the different SSL backends access their internal data in getinfo.c, let's implement backend-specific functions to do that task. This will also allow for switching SSL backends as a runtime option. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-23 10:05:26 -04:00
CURLINFO info UNUSED_PARAM)
{
(void)info;
vtls: prepare the SSL backends for encapsulated private data At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-21 06:41:18 -04:00
return BACKEND->ssl_ctx;
getinfo: access SSL internals via Curl_ssl In the ongoing endeavor to abstract out all SSL backend-specific functionality, this is the next step: Instead of hard-coding how the different SSL backends access their internal data in getinfo.c, let's implement backend-specific functions to do that task. This will also allow for switching SSL backends as a runtime option. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-23 10:05:26 -04:00
}
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
const struct Curl_ssl Curl_ssl_sectransp = {
{ CURLSSLBACKEND_SECURETRANSPORT, "secure-transport" }, /* info */
vtls: declare Curl_ssl structs for every SSL backend The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 10:45:34 -04:00
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#ifdef SECTRANSP_PINNEDPUBKEY
vtls: use unified "supports" bitfield member in backends ... instead of previous separate struct fields, to make it easier to extend and change individual backends without having to modify them all. closes #2547
2018-05-04 06:10:39 -04:00
SSLSUPP_PINNEDPUBKEY,
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
#else
vtls: use unified "supports" bitfield member in backends ... instead of previous separate struct fields, to make it easier to extend and change individual backends without having to modify them all. closes #2547
2018-05-04 06:10:39 -04:00
0,
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* SECTRANSP_PINNEDPUBKEY */
vtls: convert the have_curlssl_* constants to runtime flags The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-20 05:32:53 -04:00
vtls: encapsulate SSL backend-specific data So far, all of the SSL backends' private data has been declared as part of the ssl_connect_data struct, in one big #if .. #elif .. #endif block. This can only work as long as the SSL backend is a compile-time option, something we want to change in the next commits. Therefore, let's encapsulate the exact data needed by each SSL backend into a private struct, and let's avoid bleeding any SSL backend-specific information into urldata.h. This is also necessary to allow multiple SSL backends to be compiled in at the same time, as e.g. OpenSSL's and CyaSSL's headers cannot be included in the same .c file. To avoid too many malloc() calls, we simply append the private structs to the connectdata struct in allocate_conn(). This requires us to take extra care of alignment issues: struct fields often need to be aligned on certain boundaries e.g. 32-bit values need to be stored at addresses that divide evenly by 4 (= 32 bit / 8 bit-per-byte). We do that by assuming that no SSL backend's private data contains any fields that need to be aligned on boundaries larger than `long long` (typically 64-bit) would need. Under this assumption, we simply add a dummy field of type `long long` to the `struct connectdata` struct. This field will never be accessed but acts as a placeholder for the four instances of ssl_backend_data instead. the size of each ssl_backend_data struct is stored in the SSL backend-specific metadata, to allow allocate_conn() to know how much extra space to allocate, and how to initialize the ssl[sockindex]->backend and proxy_ssl[sockindex]->backend pointers. This would appear to be a little complicated at first, but is really necessary to encapsulate the private data of each SSL backend correctly. And we need to encapsulate thusly if we ever want to allow selecting CyaSSL and OpenSSL at runtime, as their headers cannot be included within the same .c file (there are just too many conflicting definitions and declarations for that). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-07-28 16:09:35 -04:00
sizeof(struct ssl_backend_data),
vtls: declare Curl_ssl structs for every SSL backend The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 10:45:34 -04:00
Curl_none_init, /* init */
Curl_none_cleanup, /* cleanup */
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
Curl_sectransp_version, /* version */
Curl_sectransp_check_cxn, /* check_cxn */
Curl_sectransp_shutdown, /* shutdown */
Curl_sectransp_data_pending, /* data_pending */
Curl_sectransp_random, /* random */
vtls: declare Curl_ssl structs for every SSL backend The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 10:45:34 -04:00
Curl_none_cert_status_request, /* cert_status_request */
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
Curl_sectransp_connect, /* connect */
Curl_sectransp_connect_nonblocking, /* connect_nonblocking */
Curl_sectransp_get_internals, /* get_internals */
Curl_sectransp_close, /* close_one */
vtls: declare Curl_ssl structs for every SSL backend The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 10:45:34 -04:00
Curl_none_close_all, /* close_all */
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
Curl_sectransp_session_free, /* session_free */
vtls: declare Curl_ssl structs for every SSL backend The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 10:45:34 -04:00
Curl_none_set_engine, /* set_engine */
Curl_none_set_engine_default, /* set_engine_default */
Curl_none_engines_list, /* engines_list */
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
Curl_sectransp_false_start, /* false_start */
Curl_sectransp_md5sum, /* md5sum */
Curl_sectransp_sha256sum /* sha256sum */
vtls: declare Curl_ssl structs for every SSL backend The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-06-22 10:45:34 -04:00
};
darwin: silence compiler warnings With a clang pragma and three type fixes Fixes #1722
2017-08-03 18:04:39 -04:00
#ifdef __clang__
#pragma clang diagnostic pop
#endif
Secure Transport: no more "darwinssl" Everyone calls it Secure Transport, now we do too. Reviewed-by: Nick Zitzmann Closes #3619
2019-02-26 03:21:12 -05:00
#endif /* USE_SECTRANSP */
Reference in New Issue Copy Permalink