mirror of
https://github.com/moparisthebest/curl
synced 2024-12-21 15:48:49 -05:00
tls: make setting pinnedkey option fail if not supported
to make it obvious to users trying to use the feature with TLS backends not supporting it. Discussed in #781 Reported-by: Travis Burtrum
This commit is contained in:
Daniel Stenberg
parent
100c7b478f
commit
283babfaf8
@ -2072,12 +2072,16 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
|
||||
#endif
|
||||
break;
|
||||
case CURLOPT_PINNEDPUBLICKEY:
|
||||
#ifdef have_curlssl_pinnedpubkey /* only by supported backends */
|
||||
/*
|
||||
* Set pinned public key for SSL connection.
|
||||
* Specify file name of the public key in DER format.
|
||||
*/
|
||||
result = setstropt(&data->set.str[STRING_SSL_PINNEDPUBLICKEY],
|
||||
va_arg(param, char *));
|
||||
#else
|
||||
result = CURLE_NOT_BUILT_IN;
|
||||
#endif
|
||||
break;
|
||||
case CURLOPT_CAINFO:
|
||||
/*
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
* | (__| |_| | _ <| |___
|
||||
* \___|\___/|_| \_\_____|
|
||||
*
|
||||
* Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
* Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
*
|
||||
* This software is licensed as described in the file COPYING, which
|
||||
* you should have received as part of this distribution. The terms
|
||||
@ -51,7 +51,6 @@ and that's a problem since options.h hasn't been included yet. */
|
||||
#include "urldata.h"
|
||||
#include "sendf.h"
|
||||
#include "inet_pton.h"
|
||||
#include "cyassl.h"
|
||||
#include "vtls.h"
|
||||
#include "parsedate.h"
|
||||
#include "connect.h" /* for the connect timeout */
|
||||
@ -69,6 +68,8 @@ and that's a problem since options.h hasn't been included yet. */
|
||||
#include <cyassl/ctaocrypt/random.h>
|
||||
#include <cyassl/ctaocrypt/sha256.h>
|
||||
|
||||
#include "cyassl.h"
|
||||
|
||||
/* The last #include files should be: */
|
||||
#include "curl_memory.h"
|
||||
#include "memdebug.h"
|
||||
@ -100,18 +101,6 @@ and that's a problem since options.h hasn't been included yet. */
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/* KEEP_PEER_CERT is a product of the presence of build time symbol
|
||||
OPENSSL_EXTRA without NO_CERTS, depending on the version. KEEP_PEER_CERT is
|
||||
in wolfSSL's settings.h, and the latter two are build time symbols in
|
||||
options.h. */
|
||||
#ifndef KEEP_PEER_CERT
|
||||
#if defined(HAVE_CYASSL_GET_PEER_CERTIFICATE) || \
|
||||
defined(HAVE_WOLFSSL_GET_PEER_CERTIFICATE) || \
|
||||
(defined(OPENSSL_EXTRA) && !defined(NO_CERTS))
|
||||
#define KEEP_PEER_CERT
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/* HAVE_SUPPORTED_CURVES is wolfSSL's build time symbol for enabling the ECC
|
||||
supported curve extension in options.h. Note ECC is enabled separately. */
|
||||
#ifndef HAVE_SUPPORTED_CURVES
|
||||
|
||||
@ -7,7 +7,7 @@
|
||||
* | (__| |_| | _ <| |___
|
||||
* \___|\___/|_| \_\_____|
|
||||
*
|
||||
* Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
* Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
*
|
||||
* This software is licensed as described in the file COPYING, which
|
||||
* you should have received as part of this distribution. The terms
|
||||
@ -25,6 +25,18 @@
|
||||
|
||||
#ifdef USE_CYASSL
|
||||
|
||||
/* KEEP_PEER_CERT is a product of the presence of build time symbol
|
||||
OPENSSL_EXTRA without NO_CERTS, depending on the version. KEEP_PEER_CERT is
|
||||
in wolfSSL's settings.h, and the latter two are build time symbols in
|
||||
options.h. */
|
||||
#ifndef KEEP_PEER_CERT
|
||||
#if defined(HAVE_CYASSL_GET_PEER_CERTIFICATE) || \
|
||||
defined(HAVE_WOLFSSL_GET_PEER_CERTIFICATE) || \
|
||||
(defined(OPENSSL_EXTRA) && !defined(NO_CERTS))
|
||||
#define KEEP_PEER_CERT
|
||||
#endif
|
||||
#endif
|
||||
|
||||
CURLcode Curl_cyassl_connect(struct connectdata *conn, int sockindex);
|
||||
bool Curl_cyassl_data_pending(const struct connectdata* conn, int connindex);
|
||||
int Curl_cyassl_shutdown(struct connectdata* conn, int sockindex);
|
||||
@ -53,6 +65,11 @@ void Curl_cyassl_sha256sum(const unsigned char *tmp, /* input */
|
||||
/* this backend supports CURLOPT_SSL_CTX_* */
|
||||
#define have_curlssl_ssl_ctx 1
|
||||
|
||||
#ifdef KEEP_PEER_CERT
|
||||
/* this backend supports CURLOPT_PINNEDPUBLICKEY */
|
||||
#define have_curlssl_pinnedpubkey 1
|
||||
#endif
|
||||
|
||||
/* API setup for CyaSSL */
|
||||
#define curlssl_init Curl_cyassl_init
|
||||
#define curlssl_cleanup() Curl_nop_stmt
|
||||
|
||||
@ -7,7 +7,7 @@
|
||||
* | (__| |_| | _ <| |___
|
||||
* \___|\___/|_| \_\_____|
|
||||
*
|
||||
* Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
* Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
*
|
||||
* This software is licensed as described in the file COPYING, which
|
||||
* you should have received as part of this distribution. The terms
|
||||
@ -64,6 +64,9 @@ bool Curl_gtls_cert_status_request(void);
|
||||
/* this backend supports CURLOPT_CERTINFO */
|
||||
#define have_curlssl_certinfo 1
|
||||
|
||||
/* this backend supports CURLOPT_PINNEDPUBLICKEY */
|
||||
#define have_curlssl_pinnedpubkey 1
|
||||
|
||||
/* API setup for GnuTLS */
|
||||
#define curlssl_init Curl_gtls_init
|
||||
#define curlssl_cleanup Curl_gtls_cleanup
|
||||
|
||||
@ -50,6 +50,9 @@ void Curl_mbedtls_session_free(void *ptr);
|
||||
size_t Curl_mbedtls_version(char *buffer, size_t size);
|
||||
int Curl_mbedtls_shutdown(struct connectdata *conn, int sockindex);
|
||||
|
||||
/* this backends supports CURLOPT_PINNEDPUBLICKEY */
|
||||
#define have_curlssl_pinnedpubkey 1
|
||||
|
||||
/* API setup for mbedTLS */
|
||||
#define curlssl_init() Curl_mbedtls_init()
|
||||
#define curlssl_cleanup() Curl_mbedtls_cleanup()
|
||||
|
||||
@ -7,7 +7,7 @@
|
||||
* | (__| |_| | _ <| |___
|
||||
* \___|\___/|_| \_\_____|
|
||||
*
|
||||
* Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
* Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
*
|
||||
* This software is licensed as described in the file COPYING, which
|
||||
* you should have received as part of this distribution. The terms
|
||||
@ -74,6 +74,9 @@ bool Curl_nss_false_start(void);
|
||||
/* this backend supports CURLOPT_CERTINFO */
|
||||
#define have_curlssl_certinfo 1
|
||||
|
||||
/* this backends supports CURLOPT_PINNEDPUBLICKEY */
|
||||
#define have_curlssl_pinnedpubkey 1
|
||||
|
||||
/* API setup for NSS */
|
||||
#define curlssl_init Curl_nss_init
|
||||
#define curlssl_cleanup Curl_nss_cleanup
|
||||
|
||||
@ -7,7 +7,7 @@
|
||||
* | (__| |_| | _ <| |___
|
||||
* \___|\___/|_| \_\_____|
|
||||
*
|
||||
* Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
* Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
*
|
||||
* This software is licensed as described in the file COPYING, which
|
||||
* you should have received as part of this distribution. The terms
|
||||
@ -88,9 +88,12 @@ bool Curl_ossl_cert_status_request(void);
|
||||
/* this backend supports CURLOPT_CERTINFO */
|
||||
#define have_curlssl_certinfo 1
|
||||
|
||||
/* this backend suppots CURLOPT_SSL_CTX_* */
|
||||
/* this backend supports CURLOPT_SSL_CTX_* */
|
||||
#define have_curlssl_ssl_ctx 1
|
||||
|
||||
/* this backend supports CURLOPT_PINNEDPUBLICKEY */
|
||||
#define have_curlssl_pinnedpubkey 1
|
||||
|
||||
/* API setup for OpenSSL */
|
||||
#define curlssl_init Curl_ossl_init
|
||||
#define curlssl_cleanup Curl_ossl_cleanup
|
||||
|
||||
@ -7,7 +7,7 @@
|
||||
* | (__| |_| | _ <| |___
|
||||
* \___|\___/|_| \_\_____|
|
||||
*
|
||||
* Copyright (C) 2012 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
* Copyright (C) 2012 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
* Copyright (C) 2010, Hoi-Ho Chan, <hoiho.chan@gmail.com>
|
||||
*
|
||||
* This software is licensed as described in the file COPYING, which
|
||||
@ -52,6 +52,9 @@ int Curl_polarssl_shutdown(struct connectdata *conn, int sockindex);
|
||||
/* this backend supports the CAPATH option */
|
||||
#define have_curlssl_ca_path 1
|
||||
|
||||
/* this backends supports CURLOPT_PINNEDPUBLICKEY */
|
||||
#define have_curlssl_pinnedpubkey 1
|
||||
|
||||
/* API setup for PolarSSL */
|
||||
#define curlssl_init() Curl_polarssl_init()
|
||||
#define curlssl_cleanup() Curl_polarssl_cleanup()
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
* | (__| |_| | _ <| |___
|
||||
* \___|\___/|_| \_\_____|
|
||||
*
|
||||
* Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
* Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
|
||||
*
|
||||
* This software is licensed as described in the file COPYING, which
|
||||
* you should have received as part of this distribution. The terms
|
||||
@ -815,9 +815,9 @@ CURLcode Curl_pin_peer_pubkey(struct SessionHandle *data,
|
||||
if(!pubkey || !pubkeylen)
|
||||
return result;
|
||||
|
||||
#ifdef curlssl_sha256sum
|
||||
/* only do this if pinnedpubkey starts with "sha256//", length 8 */
|
||||
if(strncmp(pinnedpubkey, "sha256//", 8) == 0) {
|
||||
#ifdef curlssl_sha256sum
|
||||
/* compute sha256sum of public key */
|
||||
sha256sumdigest = malloc(SHA256_DIGEST_LENGTH);
|
||||
if(!sha256sumdigest)
|
||||
@ -870,11 +870,12 @@ CURLcode Curl_pin_peer_pubkey(struct SessionHandle *data,
|
||||
} while(end_pos && begin_pos);
|
||||
Curl_safefree(encoded);
|
||||
Curl_safefree(pinkeycopy);
|
||||
#else
|
||||
/* without sha256 support, this cannot match */
|
||||
(void)data;
|
||||
#endif
|
||||
return result;
|
||||
}
|
||||
#else
|
||||
(void)data;
|
||||
#endif
|
||||
|
||||
fp = fopen(pinnedpubkey, "rb");
|
||||
if(!fp)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user