mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2024-12-15 06:40:09 +08:00
Code Issues Packages Projects Releases Wiki Activity
b81e0b0778
curl/lib/vtls/bearssl.c
Michael Forney 9024b01387 bearssl: Improve I/O handling 
Factor out common I/O loop as bearssl_run_until, which reads/writes TLS
records until the desired engine state is reached. This is now used for
the handshake, read, write, and close.

Match OpenSSL SSL_write behavior, and don't return the number of bytes
written until the corresponding records have been completely flushed
across the socket. This involves keeping track of the length of data
buffered into the TLS engine, and assumes that when CURLE_AGAIN is
returned, the write function will be called again with the same data
and length arguments. This is the same requirement of SSL_write.

Handle TLS close notify as EOF when reading by returning 0.

Closes https://github.com/curl/curl/pull/4748
2019-12-31 02:43:47 -05:00

867 lines
25 KiB
C
Raw Blame History

/***************************************************************************
* _ _ ____ _
* Project ___| | | | _ \| |
* / __| | | | |_) | |
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 2019, Michael Forney, <mforney@mforney.org>
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
* are also available at https://curl.haxx.se/docs/copyright.html.
*
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
* copies of the Software, and permit persons to whom the Software is
* furnished to do so, under the terms of the COPYING file.
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
* KIND, either express or implied.
*
***************************************************************************/
#include "curl_setup.h"
#ifdef USE_BEARSSL
#include <bearssl.h>
#include "bearssl.h"
#include "urldata.h"
#include "sendf.h"
#include "inet_pton.h"
#include "vtls.h"
#include "connect.h"
#include "select.h"
#include "multiif.h"
#include "curl_printf.h"
#include "curl_memory.h"
struct x509_context {
const br_x509_class *vtable;
br_x509_minimal_context minimal;
bool verifyhost;
bool verifypeer;
};
struct ssl_backend_data {
br_ssl_client_context ctx;
struct x509_context x509;
unsigned char buf[BR_SSL_BUFSIZE_BIDI];
br_x509_trust_anchor *anchors;
size_t anchors_len;
const char *protocols[2];
/* SSL client context is active */
bool active;
/* size of pending write, yet to be flushed */
size_t pending_write;
};
#define BACKEND connssl->backend
struct cafile_parser {
CURLcode err;
bool in_cert;
br_x509_decoder_context xc;
/* array of trust anchors loaded from CAfile */
br_x509_trust_anchor *anchors;
size_t anchors_len;
/* buffer for DN data */
unsigned char dn[1024];
size_t dn_len;
};
static void append_dn(void *ctx, const void *buf, size_t len)
{
struct cafile_parser *ca = ctx;
if(ca->err != CURLE_OK || !ca->in_cert)
return;
if(sizeof(ca->dn) - ca->dn_len < len) {
ca->err = CURLE_FAILED_INIT;
return;
}
memcpy(ca->dn + ca->dn_len, buf, len);
ca->dn_len += len;
}
static void x509_push(void *ctx, const void *buf, size_t len)
{
struct cafile_parser *ca = ctx;
if(ca->in_cert)
br_x509_decoder_push(&ca->xc, buf, len);
}
static CURLcode load_cafile(const char *path, br_x509_trust_anchor **anchors,
size_t *anchors_len)
{
struct cafile_parser ca;
br_pem_decoder_context pc;
br_x509_trust_anchor *ta;
size_t ta_size;
br_x509_trust_anchor *new_anchors;
size_t new_anchors_len;
br_x509_pkey *pkey;
FILE *fp;
unsigned char buf[BUFSIZ], *p;
const char *name;
size_t n, i, pushed;
fp = fopen(path, "rb");
if(!fp)
return CURLE_SSL_CACERT_BADFILE;
ca.err = CURLE_OK;
ca.in_cert = FALSE;
ca.anchors = NULL;
ca.anchors_len = 0;
br_pem_decoder_init(&pc);
br_pem_decoder_setdest(&pc, x509_push, &ca);
for(;;) {
n = fread(buf, 1, sizeof(buf), fp);
if(n == 0)
break;
p = buf;
while(n) {
pushed = br_pem_decoder_push(&pc, p, n);
if(ca.err)
goto fail;
p += pushed;
n -= pushed;
switch(br_pem_decoder_event(&pc)) {
case 0:
break;
case BR_PEM_BEGIN_OBJ:
name = br_pem_decoder_name(&pc);
if(strcmp(name, "CERTIFICATE") && strcmp(name, "X509 CERTIFICATE"))
break;
br_x509_decoder_init(&ca.xc, append_dn, &ca);
if(ca.anchors_len == SIZE_MAX / sizeof(ca.anchors[0])) {
ca.err = CURLE_OUT_OF_MEMORY;
goto fail;
}
new_anchors_len = ca.anchors_len + 1;
new_anchors = realloc(ca.anchors,
new_anchors_len * sizeof(ca.anchors[0]));
if(!new_anchors) {
ca.err = CURLE_OUT_OF_MEMORY;
goto fail;
}
ca.anchors = new_anchors;
ca.anchors_len = new_anchors_len;
ca.in_cert = TRUE;
ca.dn_len = 0;
ta = &ca.anchors[ca.anchors_len - 1];
ta->dn.data = NULL;
break;
case BR_PEM_END_OBJ:
if(!ca.in_cert)
break;
ca.in_cert = FALSE;
if(br_x509_decoder_last_error(&ca.xc)) {
ca.err = CURLE_SSL_CACERT_BADFILE;
goto fail;
}
ta->flags = 0;
if(br_x509_decoder_isCA(&ca.xc))
ta->flags |= BR_X509_TA_CA;
pkey = br_x509_decoder_get_pkey(&ca.xc);
if(!pkey) {
ca.err = CURLE_SSL_CACERT_BADFILE;
goto fail;
}
ta->pkey = *pkey;
/* calculate space needed for trust anchor data */
ta_size = ca.dn_len;
switch(pkey->key_type) {
case BR_KEYTYPE_RSA:
ta_size += pkey->key.rsa.nlen + pkey->key.rsa.elen;
break;
case BR_KEYTYPE_EC:
ta_size += pkey->key.ec.qlen;
break;
default:
ca.err = CURLE_FAILED_INIT;
goto fail;
}
/* fill in trust anchor DN and public key data */
ta->dn.data = malloc(ta_size);
if(!ta->dn.data) {
ca.err = CURLE_OUT_OF_MEMORY;
goto fail;
}
memcpy(ta->dn.data, ca.dn, ca.dn_len);
ta->dn.len = ca.dn_len;
switch(pkey->key_type) {
case BR_KEYTYPE_RSA:
ta->pkey.key.rsa.n = ta->dn.data + ta->dn.len;
memcpy(ta->pkey.key.rsa.n, pkey->key.rsa.n, pkey->key.rsa.nlen);
ta->pkey.key.rsa.e = ta->pkey.key.rsa.n + ta->pkey.key.rsa.nlen;
memcpy(ta->pkey.key.rsa.e, pkey->key.rsa.e, pkey->key.rsa.elen);
break;
case BR_KEYTYPE_EC:
ta->pkey.key.ec.q = ta->dn.data + ta->dn.len;
memcpy(ta->pkey.key.ec.q, pkey->key.ec.q, pkey->key.ec.qlen);
break;
}
break;
default:
ca.err = CURLE_SSL_CACERT_BADFILE;
goto fail;
}
}
}
if(ferror(fp))
ca.err = CURLE_READ_ERROR;
fail:
fclose(fp);
if(ca.err == CURLE_OK) {
*anchors = ca.anchors;
*anchors_len = ca.anchors_len;
}
else {
for(i = 0; i < ca.anchors_len; ++i)
free(ca.anchors[i].dn.data);
free(ca.anchors);
}
return ca.err;
}
static void x509_start_chain(const br_x509_class **ctx,
const char *server_name)
{
struct x509_context *x509 = (struct x509_context *)ctx;
if(!x509->verifyhost)
server_name = NULL;
x509->minimal.vtable->start_chain(&x509->minimal.vtable, server_name);
}
static void x509_start_cert(const br_x509_class **ctx, uint32_t length)
{
struct x509_context *x509 = (struct x509_context *)ctx;
x509->minimal.vtable->start_cert(&x509->minimal.vtable, length);
}
static void x509_append(const br_x509_class **ctx, const unsigned char *buf,
size_t len)
{
struct x509_context *x509 = (struct x509_context *)ctx;
x509->minimal.vtable->append(&x509->minimal.vtable, buf, len);
}
static void x509_end_cert(const br_x509_class **ctx)
{
struct x509_context *x509 = (struct x509_context *)ctx;
x509->minimal.vtable->end_cert(&x509->minimal.vtable);
}
static unsigned x509_end_chain(const br_x509_class **ctx)
{
struct x509_context *x509 = (struct x509_context *)ctx;
unsigned err;
err = x509->minimal.vtable->end_chain(&x509->minimal.vtable);
if(err && !x509->verifypeer) {
/* ignore any X.509 errors */
err = BR_ERR_OK;
}
return err;
}
static const br_x509_pkey *x509_get_pkey(const br_x509_class *const *ctx,
unsigned *usages)
{
struct x509_context *x509 = (struct x509_context *)ctx;
return x509->minimal.vtable->get_pkey(&x509->minimal.vtable, usages);
}
static const br_x509_class x509_vtable = {
sizeof(struct x509_context),
x509_start_chain,
x509_start_cert,
x509_append,
x509_end_cert,
x509_end_chain,
x509_get_pkey
};
static CURLcode bearssl_connect_step1(struct connectdata *conn, int sockindex)
{
struct Curl_easy *data = conn->data;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
const char * const ssl_cafile = SSL_CONN_CONFIG(CAfile);
const char *hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
conn->host.name;
const bool verifypeer = SSL_CONN_CONFIG(verifypeer);
const bool verifyhost = SSL_CONN_CONFIG(verifyhost);
CURLcode ret;
unsigned version_min, version_max;
#ifdef ENABLE_IPV6
struct in6_addr addr;
#else
struct in_addr addr;
#endif
switch(SSL_CONN_CONFIG(version)) {
case CURL_SSLVERSION_SSLv2:
failf(data, "BearSSL does not support SSLv2");
return CURLE_SSL_CONNECT_ERROR;
case CURL_SSLVERSION_SSLv3:
failf(data, "BearSSL does not support SSLv3");
return CURLE_SSL_CONNECT_ERROR;
case CURL_SSLVERSION_TLSv1_0:
version_min = BR_TLS10;
version_max = BR_TLS10;
break;
case CURL_SSLVERSION_TLSv1_1:
version_min = BR_TLS11;
version_max = BR_TLS11;
break;
case CURL_SSLVERSION_TLSv1_2:
version_min = BR_TLS12;
version_max = BR_TLS12;
break;
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
version_min = BR_TLS10;
version_max = BR_TLS12;
break;
default:
failf(data, "BearSSL: unknown CURLOPT_SSLVERSION");
return CURLE_SSL_CONNECT_ERROR;
}
if(ssl_cafile) {
ret = load_cafile(ssl_cafile, &BACKEND->anchors, &BACKEND->anchors_len);
if(ret != CURLE_OK) {
if(verifypeer) {
failf(data, "error setting certificate verify locations:\n"
" CAfile: %s\n", ssl_cafile);
return ret;
}
infof(data, "error setting certificate verify locations,"
" continuing anyway:\n");
}
}
/* initialize SSL context */
br_ssl_client_init_full(&BACKEND->ctx, &BACKEND->x509.minimal,
BACKEND->anchors, BACKEND->anchors_len);
br_ssl_engine_set_versions(&BACKEND->ctx.eng, version_min, version_max);
br_ssl_engine_set_buffer(&BACKEND->ctx.eng, BACKEND->buf,
sizeof(BACKEND->buf), 1);
/* initialize X.509 context */
BACKEND->x509.vtable = &x509_vtable;
BACKEND->x509.verifypeer = verifypeer;
BACKEND->x509.verifyhost = verifyhost;
br_ssl_engine_set_x509(&BACKEND->ctx.eng, &BACKEND->x509.vtable);
if(SSL_SET_OPTION(primary.sessionid)) {
void *session;
Curl_ssl_sessionid_lock(conn);
if(!Curl_ssl_getsessionid(conn, &session, NULL, sockindex)) {
br_ssl_engine_set_session_parameters(&BACKEND->ctx.eng, session);
infof(data, "BearSSL: re-using session ID\n");
}
Curl_ssl_sessionid_unlock(conn);
}
if(conn->bits.tls_enable_alpn) {
int cur = 0;
/* NOTE: when adding more protocols here, increase the size of the
* protocols array in `struct ssl_backend_data`.
*/
#ifdef USE_NGHTTP2
if(data->set.httpversion >= CURL_HTTP_VERSION_2 &&
(!SSL_IS_PROXY() || !conn->bits.tunnel_proxy)) {
BACKEND->protocols[cur++] = NGHTTP2_PROTO_VERSION_ID;
infof(data, "ALPN, offering %s\n", NGHTTP2_PROTO_VERSION_ID);
}
#endif
BACKEND->protocols[cur++] = ALPN_HTTP_1_1;
infof(data, "ALPN, offering %s\n", ALPN_HTTP_1_1);
br_ssl_engine_set_protocol_names(&BACKEND->ctx.eng,
BACKEND->protocols, cur);
}
if((1 == Curl_inet_pton(AF_INET, hostname, &addr))
#ifdef ENABLE_IPV6
|| (1 == Curl_inet_pton(AF_INET6, hostname, &addr))
#endif
) {
if(verifyhost) {
failf(data, "BearSSL: "
"host verification of IP address is not supported");
return CURLE_PEER_FAILED_VERIFICATION;
}
hostname = NULL;
}
if(!br_ssl_client_reset(&BACKEND->ctx, hostname, 0))
return CURLE_FAILED_INIT;
BACKEND->active = TRUE;
connssl->connecting_state = ssl_connect_2;
return CURLE_OK;
}
static CURLcode bearssl_run_until(struct connectdata *conn, int sockindex,
unsigned target)
{
struct Curl_easy *data = conn->data;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
curl_socket_t sockfd = conn->sock[sockindex];
unsigned state;
unsigned char *buf;
size_t len;
ssize_t ret;
int err;
for(;;) {
state = br_ssl_engine_current_state(&BACKEND->ctx.eng);
if(state & BR_SSL_CLOSED) {
err = br_ssl_engine_last_error(&BACKEND->ctx.eng);
switch(err) {
case BR_ERR_OK:
/* TLS close notify */
if(connssl->state != ssl_connection_complete) {
failf(data, "SSL: connection closed during handshake");
return CURLE_SSL_CONNECT_ERROR;
}
return CURLE_OK;
case BR_ERR_X509_EXPIRED:
failf(data, "SSL: X.509 verification: "
"certificate is expired or not yet valid");
return CURLE_PEER_FAILED_VERIFICATION;
case BR_ERR_X509_BAD_SERVER_NAME:
failf(data, "SSL: X.509 verification: "
"expected server name was not found in the chain");
return CURLE_PEER_FAILED_VERIFICATION;
case BR_ERR_X509_NOT_TRUSTED:
failf(data, "SSL: X.509 verification: "
"chain could not be linked to a trust anchor");
return CURLE_PEER_FAILED_VERIFICATION;
}
/* X.509 errors are documented to have the range 32..63 */
if(err >= 32 && err < 64)
return CURLE_PEER_FAILED_VERIFICATION;
return CURLE_SSL_CONNECT_ERROR;
}
if(state & target)
return CURLE_OK;
if(state & BR_SSL_SENDREC) {
buf = br_ssl_engine_sendrec_buf(&BACKEND->ctx.eng, &len);
ret = swrite(sockfd, buf, len);
if(ret == -1) {
if(SOCKERRNO == EAGAIN || SOCKERRNO == EWOULDBLOCK) {
if(connssl->state != ssl_connection_complete)
connssl->connecting_state = ssl_connect_2_writing;
return CURLE_AGAIN;
}
return CURLE_WRITE_ERROR;
}
br_ssl_engine_sendrec_ack(&BACKEND->ctx.eng, ret);
}
else if(state & BR_SSL_RECVREC) {
buf = br_ssl_engine_recvrec_buf(&BACKEND->ctx.eng, &len);
ret = sread(sockfd, buf, len);
if(ret == 0) {
failf(data, "SSL: EOF without close notify");
return CURLE_READ_ERROR;
}
if(ret == -1) {
if(SOCKERRNO == EAGAIN || SOCKERRNO == EWOULDBLOCK) {
if(connssl->state != ssl_connection_complete)
connssl->connecting_state = ssl_connect_2_reading;
return CURLE_AGAIN;
}
return CURLE_READ_ERROR;
}
br_ssl_engine_recvrec_ack(&BACKEND->ctx.eng, ret);
}
}
}
static CURLcode bearssl_connect_step2(struct connectdata *conn, int sockindex)
{
struct Curl_easy *data = conn->data;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
CURLcode ret;
ret = bearssl_run_until(conn, sockindex, BR_SSL_SENDAPP | BR_SSL_RECVAPP);
if(ret == CURLE_AGAIN)
return CURLE_OK;
if(ret == CURLE_OK) {
if(br_ssl_engine_current_state(&BACKEND->ctx.eng) == BR_SSL_CLOSED) {
failf(data, "SSL: connection closed during handshake");
return CURLE_SSL_CONNECT_ERROR;
}
connssl->connecting_state = ssl_connect_3;
}
return ret;
}
static CURLcode bearssl_connect_step3(struct connectdata *conn, int sockindex)
{
struct Curl_easy *data = conn->data;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
CURLcode ret;
DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
if(conn->bits.tls_enable_alpn) {
const char *protocol;
protocol = br_ssl_engine_get_selected_protocol(&BACKEND->ctx.eng);
if(protocol) {
infof(data, "ALPN, server accepted to use %s\n", protocol);
#ifdef USE_NGHTTP2
if(!strcmp(protocol, NGHTTP2_PROTO_VERSION_ID))
conn->negnpn = CURL_HTTP_VERSION_2;
else
#endif
if(!strcmp(protocol, ALPN_HTTP_1_1))
conn->negnpn = CURL_HTTP_VERSION_1_1;
else
infof(data, "ALPN, unrecognized protocol %s\n", protocol);
Curl_multiuse_state(conn, conn->negnpn == CURL_HTTP_VERSION_2 ?
BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
}
else
infof(data, "ALPN, server did not agree to a protocol\n");
}
if(SSL_SET_OPTION(primary.sessionid)) {
bool incache;
void *oldsession;
br_ssl_session_parameters *session;
session = malloc(sizeof(*session));
if(!session)
return CURLE_OUT_OF_MEMORY;
br_ssl_engine_get_session_parameters(&BACKEND->ctx.eng, session);
Curl_ssl_sessionid_lock(conn);
incache = !(Curl_ssl_getsessionid(conn, &oldsession, NULL, sockindex));
if(incache)
Curl_ssl_delsessionid(conn, oldsession);
ret = Curl_ssl_addsessionid(conn, session, 0, sockindex);
Curl_ssl_sessionid_unlock(conn);
if(ret) {
free(session);
return CURLE_OUT_OF_MEMORY;
}
}
connssl->connecting_state = ssl_connect_done;
return CURLE_OK;
}
static ssize_t bearssl_send(struct connectdata *conn, int sockindex,
const void *buf, size_t len, CURLcode *err)
{
struct Curl_easy *data = conn->data;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
unsigned char *app;
size_t applen;
for(;;) {
*err = bearssl_run_until(conn, sockindex, BR_SSL_SENDAPP);
if (*err != CURLE_OK)
return -1;
app = br_ssl_engine_sendapp_buf(&BACKEND->ctx.eng, &applen);
if(!app) {
failf(data, "SSL: connection closed during write");
*err = CURLE_SEND_ERROR;
return -1;
}
if(BACKEND->pending_write) {
applen = BACKEND->pending_write;
BACKEND->pending_write = 0;
return applen;
}
if(applen > len)
applen = len;
memcpy(app, buf, applen);
br_ssl_engine_sendapp_ack(&BACKEND->ctx.eng, applen);
br_ssl_engine_flush(&BACKEND->ctx.eng, 0);
BACKEND->pending_write = applen;
}
}
static ssize_t bearssl_recv(struct connectdata *conn, int sockindex,
char *buf, size_t len, CURLcode *err)
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
unsigned char *app;
size_t applen;
*err = bearssl_run_until(conn, sockindex, BR_SSL_RECVAPP);
if(*err != CURLE_OK)
return -1;
app = br_ssl_engine_recvapp_buf(&BACKEND->ctx.eng, &applen);
if(!app)
return 0;
if(applen > len)
applen = len;
memcpy(buf, app, applen);
br_ssl_engine_recvapp_ack(&BACKEND->ctx.eng, applen);
return applen;
}
static CURLcode bearssl_connect_common(struct connectdata *conn,
int sockindex,
bool nonblocking,
bool *done)
{
CURLcode ret;
struct Curl_easy *data = conn->data;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
curl_socket_t sockfd = conn->sock[sockindex];
time_t timeout_ms;
int what;
/* check if the connection has already been established */
if(ssl_connection_complete == connssl->state) {
*done = TRUE;
return CURLE_OK;
}
if(ssl_connect_1 == connssl->connecting_state) {
ret = bearssl_connect_step1(conn, sockindex);
if(ret)
return ret;
}
while(ssl_connect_2 == connssl->connecting_state ||
ssl_connect_2_reading == connssl->connecting_state ||
ssl_connect_2_writing == connssl->connecting_state) {
/* check allowed time left */
timeout_ms = Curl_timeleft(data, NULL, TRUE);
if(timeout_ms < 0) {
/* no need to continue if time already is up */
failf(data, "SSL connection timeout");
return CURLE_OPERATION_TIMEDOUT;
}
/* if ssl is expecting something, check if it's available. */
if(ssl_connect_2_reading == connssl->connecting_state ||
ssl_connect_2_writing == connssl->connecting_state) {
curl_socket_t writefd = ssl_connect_2_writing ==
connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
curl_socket_t readfd = ssl_connect_2_reading ==
connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
nonblocking?0:timeout_ms);
if(what < 0) {
/* fatal error */
failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
return CURLE_SSL_CONNECT_ERROR;
}
else if(0 == what) {
if(nonblocking) {
*done = FALSE;
return CURLE_OK;
}
else {
/* timeout */
failf(data, "SSL connection timeout");
return CURLE_OPERATION_TIMEDOUT;
}
}
/* socket is readable or writable */
}
/* Run transaction, and return to the caller if it failed or if this
* connection is done nonblocking and this loop would execute again. This
* permits the owner of a multi handle to abort a connection attempt
* before step2 has completed while ensuring that a client using select()
* or epoll() will always have a valid fdset to wait on.
*/
ret = bearssl_connect_step2(conn, sockindex);
if(ret || (nonblocking &&
(ssl_connect_2 == connssl->connecting_state ||
ssl_connect_2_reading == connssl->connecting_state ||
ssl_connect_2_writing == connssl->connecting_state)))
return ret;
}
if(ssl_connect_3 == connssl->connecting_state) {
ret = bearssl_connect_step3(conn, sockindex);
if(ret)
return ret;
}
if(ssl_connect_done == connssl->connecting_state) {
connssl->state = ssl_connection_complete;
conn->recv[sockindex] = bearssl_recv;
conn->send[sockindex] = bearssl_send;
*done = TRUE;
}
else
*done = FALSE;
/* Reset our connect state machine */
connssl->connecting_state = ssl_connect_1;
return CURLE_OK;
}
static size_t Curl_bearssl_version(char *buffer, size_t size)
{
return msnprintf(buffer, size, "BearSSL");
}
static bool Curl_bearssl_data_pending(const struct connectdata *conn,
int connindex)
{
const struct ssl_connect_data *connssl = &conn->ssl[connindex];
return br_ssl_engine_current_state(&BACKEND->ctx.eng) & BR_SSL_RECVAPP;
}
static CURLcode Curl_bearssl_random(struct Curl_easy *data UNUSED_PARAM,
unsigned char *entropy, size_t length)
{
static br_hmac_drbg_context ctx;
static bool seeded = FALSE;
if(!seeded) {
br_prng_seeder seeder;
br_hmac_drbg_init(&ctx, &br_sha256_vtable, NULL, 0);
seeder = br_prng_seeder_system(NULL);
if(!seeder || !seeder(&ctx.vtable))
return CURLE_FAILED_INIT;
seeded = TRUE;
}
br_hmac_drbg_generate(&ctx, entropy, length);
return CURLE_OK;
}
static CURLcode Curl_bearssl_connect(struct connectdata *conn, int sockindex)
{
CURLcode ret;
bool done = FALSE;
ret = bearssl_connect_common(conn, sockindex, FALSE, &done);
if(ret)
return ret;
DEBUGASSERT(done);
return CURLE_OK;
}
static CURLcode Curl_bearssl_connect_nonblocking(struct connectdata *conn,
int sockindex, bool *done)
{
return bearssl_connect_common(conn, sockindex, TRUE, done);
}
static void *Curl_bearssl_get_internals(struct ssl_connect_data *connssl,
CURLINFO info UNUSED_PARAM)
{
return &BACKEND->ctx;
}
static void Curl_bearssl_close(struct connectdata *conn, int sockindex)
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
size_t i;
if(BACKEND->active) {
br_ssl_engine_close(&BACKEND->ctx.eng);
(void)bearssl_run_until(conn, sockindex, BR_SSL_CLOSED);
}
for(i = 0; i < BACKEND->anchors_len; ++i)
free(BACKEND->anchors[i].dn.data);
free(BACKEND->anchors);
}
static void Curl_bearssl_session_free(void *ptr)
{
free(ptr);
}
static CURLcode Curl_bearssl_md5sum(unsigned char *input,
size_t inputlen,
unsigned char *md5sum,
size_t md5len UNUSED_PARAM)
{
br_md5_context ctx;
br_md5_init(&ctx);
br_md5_update(&ctx, input, inputlen);
br_md5_out(&ctx, md5sum);
return CURLE_OK;
}
static CURLcode Curl_bearssl_sha256sum(const unsigned char *input,
size_t inputlen,
unsigned char *sha256sum,
size_t sha256len UNUSED_PARAM)
{
br_sha256_context ctx;
br_sha256_init(&ctx);
br_sha256_update(&ctx, input, inputlen);
br_sha256_out(&ctx, sha256sum);
return CURLE_OK;
}
const struct Curl_ssl Curl_ssl_bearssl = {
{ CURLSSLBACKEND_BEARSSL, "bearssl" },
0,
sizeof(struct ssl_backend_data),
Curl_none_init,
Curl_none_cleanup,
Curl_bearssl_version,
Curl_none_check_cxn,
Curl_none_shutdown,
Curl_bearssl_data_pending,
Curl_bearssl_random,
Curl_none_cert_status_request,
Curl_bearssl_connect,
Curl_bearssl_connect_nonblocking,
Curl_bearssl_get_internals,
Curl_bearssl_close,
Curl_none_close_all,
Curl_bearssl_session_free,
Curl_none_set_engine,
Curl_none_set_engine_default,
Curl_none_engines_list,
Curl_none_false_start,
Curl_bearssl_md5sum,
Curl_bearssl_sha256sum
};
#endif /* USE_BEARSSL */
Reference in New Issue View Git Blame Copy Permalink