2013-12-18 08:27:31 -05:00
|
|
|
#***************************************************************************
|
|
|
|
|
# _ _ ____ _
|
|
|
|
|
# Project ___| | | | _ \| |
|
|
|
|
|
# / __| | | | |_) | |
|
|
|
|
|
# | (__| |_| | _ <| |___
|
|
|
|
|
# \___|\___/|_| \_\_____|
|
|
|
|
|
#
|
2020-01-16 02:17:04 -05:00
|
|
|
# Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
|
2013-12-18 08:27:31 -05:00
|
|
|
#
|
|
|
|
|
# This software is licensed as described in the file COPYING, which
|
|
|
|
|
# you should have received as part of this distribution. The terms
|
2016-02-02 18:19:02 -05:00
|
|
|
# are also available at https://curl.haxx.se/docs/copyright.html.
|
2013-12-18 08:27:31 -05:00
|
|
|
#
|
|
|
|
|
# You may opt to use, copy, modify, merge, publish, distribute and/or sell
|
|
|
|
|
# copies of the Software, and permit persons to whom the Software is
|
|
|
|
|
# furnished to do so, under the terms of the COPYING file.
|
|
|
|
|
#
|
|
|
|
|
# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
|
|
|
|
|
# KIND, either express or implied.
|
|
|
|
|
#
|
|
|
|
|
###########################################################################
|
2007-07-23 17:46:26 -04:00
|
|
|
|
2020-04-14 05:19:12 -04:00
|
|
|
LIB_VAUTH_CFILES = vauth/cleartext.c vauth/cram.c vauth/digest.c \
|
|
|
|
|
vauth/digest_sspi.c vauth/krb5_gssapi.c vauth/krb5_sspi.c vauth/ntlm.c \
|
|
|
|
|
vauth/ntlm_sspi.c vauth/oauth2.c vauth/spnego_gssapi.c vauth/spnego_sspi.c \
|
|
|
|
|
vauth/vauth.c
|
2015-09-12 06:48:24 -04:00
|
|
|
|
2020-04-14 05:19:12 -04:00
|
|
|
LIB_VAUTH_HFILES = vauth/digest.h vauth/ntlm.h vauth/vauth.h
|
2015-09-12 06:48:24 -04:00
|
|
|
|
vtls: Extract and simplify key log file handling from OpenSSL
Create a set of routines for TLS key log file handling to enable reuse
with other TLS backends. Simplify the OpenSSL backend as follows:
- Drop the ENABLE_SSLKEYLOGFILE macro as it is unconditionally enabled.
- Do not perform dynamic memory allocation when preparing a log entry.
Unless the TLS specifications change we can suffice with a reasonable
fixed-size buffer.
- Simplify state tracking when SSL_CTX_set_keylog_callback is
unavailable. My original sslkeylog.c code included this tracking in
order to handle multiple calls to SSL_connect and detect new keys
after renegotiation (via SSL_read/SSL_write). For curl however we can
be sure that a single master secret eventually becomes available
after SSL_connect, so a simple flag is sufficient. An alternative to
the flag is examining SSL_state(), but this seems more complex and is
not pursued. Capturing keys after server renegotiation was already
unsupported in curl and remains unsupported.
Tested with curl built against OpenSSL 0.9.8zh, 1.0.2u, and 1.1.1f
(`SSLKEYLOGFILE=keys.txt curl -vkso /dev/null https://localhost:4433`)
against an OpenSSL 1.1.1f server configured with:
# Force non-TLSv1.3, use TLSv1.0 since 0.9.8 fails with 1.1 or 1.2
openssl s_server -www -tls1
# Likewise, but fail the server handshake.
openssl s_server -www -tls1 -Verify 2
# TLS 1.3 test. No need to test the failing server handshake.
openssl s_server -www -tls1_3
Verify that all secrets (1 for TLS 1.0, 4 for TLS 1.3) are correctly
written using Wireshark. For the first and third case, expect four
matches per connection (decrypted Server Finished, Client Finished, HTTP
Request, HTTP Response). For the second case where the handshake fails,
expect a decrypted Server Finished only.
tshark -i lo -pf tcp -otls.keylog_file:keys.txt -Tfields \
-eframe.number -eframe.time -etcp.stream -e_ws.col.Info \
-dtls.port==4433,http -ohttp.desegment_body:FALSE \
-Y 'tls.handshake.verify_data or http'
A single connection can easily be identified via the `tcp.stream` field.
2020-05-03 11:10:40 -04:00
|
|
|
LIB_VTLS_CFILES = vtls/bearssl.c vtls/gskit.c vtls/gtls.c vtls/keylog.c \
|
|
|
|
|
vtls/mbedtls.c vtls/mbedtls_threadlock.c vtls/mesalink.c vtls/nss.c \
|
|
|
|
|
vtls/openssl.c vtls/schannel.c vtls/schannel_verify.c vtls/sectransp.c \
|
|
|
|
|
vtls/vtls.c vtls/wolfssl.c
|
2020-01-16 02:17:04 -05:00
|
|
|
|
vtls: Extract and simplify key log file handling from OpenSSL
Create a set of routines for TLS key log file handling to enable reuse
with other TLS backends. Simplify the OpenSSL backend as follows:
- Drop the ENABLE_SSLKEYLOGFILE macro as it is unconditionally enabled.
- Do not perform dynamic memory allocation when preparing a log entry.
Unless the TLS specifications change we can suffice with a reasonable
fixed-size buffer.
- Simplify state tracking when SSL_CTX_set_keylog_callback is
unavailable. My original sslkeylog.c code included this tracking in
order to handle multiple calls to SSL_connect and detect new keys
after renegotiation (via SSL_read/SSL_write). For curl however we can
be sure that a single master secret eventually becomes available
after SSL_connect, so a simple flag is sufficient. An alternative to
the flag is examining SSL_state(), but this seems more complex and is
not pursued. Capturing keys after server renegotiation was already
unsupported in curl and remains unsupported.
Tested with curl built against OpenSSL 0.9.8zh, 1.0.2u, and 1.1.1f
(`SSLKEYLOGFILE=keys.txt curl -vkso /dev/null https://localhost:4433`)
against an OpenSSL 1.1.1f server configured with:
# Force non-TLSv1.3, use TLSv1.0 since 0.9.8 fails with 1.1 or 1.2
openssl s_server -www -tls1
# Likewise, but fail the server handshake.
openssl s_server -www -tls1 -Verify 2
# TLS 1.3 test. No need to test the failing server handshake.
openssl s_server -www -tls1_3
Verify that all secrets (1 for TLS 1.0, 4 for TLS 1.3) are correctly
written using Wireshark. For the first and third case, expect four
matches per connection (decrypted Server Finished, Client Finished, HTTP
Request, HTTP Response). For the second case where the handshake fails,
expect a decrypted Server Finished only.
tshark -i lo -pf tcp -otls.keylog_file:keys.txt -Tfields \
-eframe.number -eframe.time -etcp.stream -e_ws.col.Info \
-dtls.port==4433,http -ohttp.desegment_body:FALSE \
-Y 'tls.handshake.verify_data or http'
A single connection can easily be identified via the `tcp.stream` field.
2020-05-03 11:10:40 -04:00
|
|
|
LIB_VTLS_HFILES = vtls/bearssl.h vtls/gskit.h vtls/gtls.h vtls/keylog.h \
|
|
|
|
|
vtls/mbedtls.h vtls/mbedtls_threadlock.h vtls/mesalink.h vtls/nssg.h \
|
|
|
|
|
vtls/openssl.h vtls/schannel.h vtls/sectransp.h vtls/vtls.h vtls/wolfssl.h
|
2013-12-18 08:25:43 -05:00
|
|
|
|
2020-05-07 08:17:42 -04:00
|
|
|
LIB_VQUIC_CFILES = vquic/ngtcp2.c vquic/quiche.c vquic/vquic.c
|
2019-07-21 17:48:58 -04:00
|
|
|
|
2020-05-07 08:17:42 -04:00
|
|
|
LIB_VQUIC_HFILES = vquic/ngtcp2.h vquic/quiche.h vquic/vquic.h
|
2019-07-21 17:48:58 -04:00
|
|
|
|
2020-04-14 05:19:12 -04:00
|
|
|
LIB_VSSH_CFILES = vssh/libssh.c vssh/libssh2.c vssh/wolfssh.c
|
2019-08-16 10:01:42 -04:00
|
|
|
|
2019-11-17 15:04:37 -05:00
|
|
|
LIB_VSSH_HFILES = vssh/ssh.h
|
|
|
|
|
|
2020-04-14 05:19:12 -04:00
|
|
|
LIB_CFILES = altsvc.c amigaos.c asyn-ares.c asyn-thread.c base64.c \
|
|
|
|
|
conncache.c connect.c content_encoding.c cookie.c curl_addrinfo.c \
|
|
|
|
|
curl_ctype.c curl_des.c curl_endian.c curl_fnmatch.c curl_get_line.c \
|
|
|
|
|
curl_gethostname.c curl_gssapi.c curl_memrchr.c curl_multibyte.c \
|
|
|
|
|
curl_ntlm_core.c curl_ntlm_wb.c curl_path.c curl_range.c curl_rtmp.c \
|
|
|
|
|
curl_sasl.c curl_sspi.c curl_threads.c dict.c dotdot.c easy.c escape.c \
|
|
|
|
|
file.c fileinfo.c formdata.c ftp.c url.c ftplistparser.c getenv.c getinfo.c \
|
|
|
|
|
gopher.c hash.c hmac.c hostasyn.c hostcheck.c hostip.c hostip4.c hostip6.c \
|
|
|
|
|
hostsyn.c http.c http2.c http_chunks.c http_digest.c http_negotiate.c \
|
|
|
|
|
http_ntlm.c http_proxy.c idn_win32.c if2ip.c imap.c inet_ntop.c inet_pton.c \
|
|
|
|
|
krb5.c ldap.c llist.c md4.c md5.c memdebug.c mime.c mprintf.c mqtt.c \
|
|
|
|
|
multi.c netrc.c non-ascii.c nonblock.c openldap.c parsedate.c pingpong.c \
|
|
|
|
|
pop3.c progress.c psl.c doh.c rand.c rename.c rtsp.c security.c select.c \
|
|
|
|
|
sendf.c setopt.c sha256.c share.c slist.c smb.c smtp.c socketpair.c socks.c \
|
|
|
|
|
socks_gssapi.c socks_sspi.c speedcheck.c splay.c strcase.c strdup.c \
|
|
|
|
|
strerror.c strtok.c strtoofft.c system_win32.c telnet.c tftp.c timeval.c \
|
2020-05-02 11:04:08 -04:00
|
|
|
transfer.c urlapi.c version.c warnless.c wildcard.c x509asn1.c dynbuf.c
|
2012-12-28 06:40:20 -05:00
|
|
|
|
2020-04-14 05:19:12 -04:00
|
|
|
LIB_HFILES = altsvc.h amigaos.h arpa_telnet.h asyn.h conncache.h connect.h \
|
|
|
|
|
content_encoding.h cookie.h curl_addrinfo.h curl_base64.h curl_ctype.h \
|
|
|
|
|
curl_des.h curl_endian.h curl_fnmatch.h curl_get_line.h curl_gethostname.h \
|
|
|
|
|
curl_gssapi.h curl_hmac.h curl_ldap.h curl_md4.h curl_md5.h curl_memory.h \
|
|
|
|
|
curl_memrchr.h curl_multibyte.h curl_ntlm_core.h curl_ntlm_wb.h curl_path.h \
|
|
|
|
|
curl_printf.h curl_range.h curl_rtmp.h curl_sasl.h curl_sec.h curl_setup.h \
|
|
|
|
|
curl_setup_once.h curl_sha256.h curl_sspi.h curl_threads.h curlx.h dict.h \
|
|
|
|
|
dotdot.h easyif.h escape.h file.h fileinfo.h formdata.h ftp.h url.h \
|
|
|
|
|
ftplistparser.h getinfo.h gopher.h hash.h hostcheck.h hostip.h http.h \
|
|
|
|
|
http2.h http_chunks.h http_digest.h http_negotiate.h http_ntlm.h \
|
|
|
|
|
http_proxy.h if2ip.h imap.h inet_ntop.h inet_pton.h llist.h memdebug.h \
|
|
|
|
|
mime.h mqtt.h multihandle.h multiif.h netrc.h non-ascii.h nonblock.h \
|
|
|
|
|
parsedate.h pingpong.h pop3.h progress.h psl.h doh.h quic.h rand.h rename.h \
|
|
|
|
|
rtsp.h select.h sendf.h setopt.h setup-vms.h share.h sigpipe.h slist.h \
|
|
|
|
|
smb.h smtp.h sockaddr.h socketpair.h socks.h speedcheck.h splay.h strcase.h \
|
|
|
|
|
strdup.h strerror.h strtok.h strtoofft.h system_win32.h telnet.h tftp.h \
|
|
|
|
|
timeval.h transfer.h urlapi-int.h urldata.h warnless.h wildcard.h \
|
2020-05-02 11:04:08 -04:00
|
|
|
x509asn1.h dynbuf.h
|
2014-05-09 17:27:40 -04:00
|
|
|
|
2014-05-18 16:43:40 -04:00
|
|
|
LIB_RCFILES = libcurl.rc
|
2014-05-11 15:52:52 -04:00
|
|
|
|
2019-07-21 17:48:58 -04:00
|
|
|
CSOURCES = $(LIB_CFILES) $(LIB_VAUTH_CFILES) $(LIB_VTLS_CFILES) \
|
2019-08-16 10:01:42 -04:00
|
|
|
$(LIB_VQUIC_CFILES) $(LIB_VSSH_CFILES)
|
2019-07-21 17:48:58 -04:00
|
|
|
HHEADERS = $(LIB_HFILES) $(LIB_VAUTH_HFILES) $(LIB_VTLS_HFILES) \
|
2019-11-17 15:04:37 -05:00
|
|
|
$(LIB_VQUIC_HFILES) $(LIB_VSSH_HFILES)
|