123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674 |
- #include "curl_setup.h"
- #ifdef USE_MBEDTLS
- #include <mbedtls/version.h>
- #if MBEDTLS_VERSION_NUMBER >= 0x02040000
- #include <mbedtls/net_sockets.h>
- #else
- #include <mbedtls/net.h>
- #endif
- #include <mbedtls/ssl.h>
- #include <mbedtls/x509.h>
- #include <mbedtls/error.h>
- #include <mbedtls/entropy.h>
- #include <mbedtls/ctr_drbg.h>
- #include <mbedtls/sha256.h>
- #if MBEDTLS_VERSION_MAJOR >= 2
- # ifdef MBEDTLS_DEBUG
- # include <mbedtls/debug.h>
- # endif
- #endif
- #include "cipher_suite.h"
- #include "strcase.h"
- #include "urldata.h"
- #include "sendf.h"
- #include "inet_pton.h"
- #include "mbedtls.h"
- #include "vtls.h"
- #include "vtls_int.h"
- #include "x509asn1.h"
- #include "parsedate.h"
- #include "connect.h"
- #include "select.h"
- #include "multiif.h"
- #include "mbedtls_threadlock.h"
- #include "strdup.h"
- #include "curl_printf.h"
- #include "curl_memory.h"
- #include "memdebug.h"
- #ifdef USE_HTTP2
- # undef HAS_ALPN
- # ifdef MBEDTLS_SSL_ALPN
- # define HAS_ALPN
- # endif
- #endif
- struct mbed_ssl_backend_data {
- mbedtls_ctr_drbg_context ctr_drbg;
- mbedtls_entropy_context entropy;
- mbedtls_ssl_context ssl;
- mbedtls_x509_crt cacert;
- mbedtls_x509_crt clicert;
- #ifdef MBEDTLS_X509_CRL_PARSE_C
- mbedtls_x509_crl crl;
- #endif
- mbedtls_pk_context pk;
- mbedtls_ssl_config config;
- #ifdef HAS_ALPN
- const char *protocols[3];
- #endif
- int *ciphersuites;
- BIT(initialized);
- BIT(sent_shutdown);
- };
- #if (defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)) || \
- defined(_WIN32)
- #define THREADING_SUPPORT
- #endif
- #ifndef MBEDTLS_ERROR_C
- #define mbedtls_strerror(a,b,c) b[0] = 0
- #endif
- #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && MBEDTLS_VERSION_NUMBER >= 0x03060000
- #define TLS13_SUPPORT
- #endif
- #if defined(TLS13_SUPPORT) && defined(MBEDTLS_SSL_SESSION_TICKETS)
- #define HAS_SESSION_TICKETS
- #endif
- #ifdef THREADING_SUPPORT
- static mbedtls_entropy_context ts_entropy;
- static int entropy_init_initialized = 0;
- static void entropy_init_mutex(mbedtls_entropy_context *ctx)
- {
-
- Curl_mbedtlsthreadlock_lock_function(0);
- if(entropy_init_initialized == 0) {
- mbedtls_entropy_init(ctx);
- entropy_init_initialized = 1;
- }
- Curl_mbedtlsthreadlock_unlock_function(0);
- }
- static void entropy_cleanup_mutex(mbedtls_entropy_context *ctx)
- {
-
- Curl_mbedtlsthreadlock_lock_function(0);
- if(entropy_init_initialized == 1) {
- mbedtls_entropy_free(ctx);
- entropy_init_initialized = 0;
- }
- Curl_mbedtlsthreadlock_unlock_function(0);
- }
- static int entropy_func_mutex(void *data, unsigned char *output, size_t len)
- {
- int ret;
-
- Curl_mbedtlsthreadlock_lock_function(1);
- ret = mbedtls_entropy_func(data, output, len);
- Curl_mbedtlsthreadlock_unlock_function(1);
- return ret;
- }
- #endif
- #ifdef MBEDTLS_DEBUG
- static void mbed_debug(void *context, int level, const char *f_name,
- int line_nb, const char *line)
- {
- struct Curl_easy *data = (struct Curl_easy *)context;
- (void) level;
- (void) line_nb;
- (void) f_name;
- if(data) {
- size_t len = strlen(line);
- if(len && (line[len - 1] == '\n'))
-
- len--;
- infof(data, "%.*s", (int)len, line);
- }
- }
- #endif
- static int mbedtls_bio_cf_write(void *bio,
- const unsigned char *buf, size_t blen)
- {
- struct Curl_cfilter *cf = bio;
- struct Curl_easy *data = CF_DATA_CURRENT(cf);
- ssize_t nwritten;
- CURLcode result;
- DEBUGASSERT(data);
- if(!data)
- return 0;
- nwritten = Curl_conn_cf_send(cf->next, data, (char *)buf, blen, FALSE,
- &result);
- CURL_TRC_CF(data, cf, "mbedtls_bio_cf_out_write(len=%zu) -> %zd, err=%d",
- blen, nwritten, result);
- if(nwritten < 0 && CURLE_AGAIN == result) {
- nwritten = MBEDTLS_ERR_SSL_WANT_WRITE;
- }
- return (int)nwritten;
- }
- static int mbedtls_bio_cf_read(void *bio, unsigned char *buf, size_t blen)
- {
- struct Curl_cfilter *cf = bio;
- struct Curl_easy *data = CF_DATA_CURRENT(cf);
- ssize_t nread;
- CURLcode result;
- DEBUGASSERT(data);
- if(!data)
- return 0;
-
- if(!buf)
- return 0;
- nread = Curl_conn_cf_recv(cf->next, data, (char *)buf, blen, &result);
- CURL_TRC_CF(data, cf, "mbedtls_bio_cf_in_read(len=%zu) -> %zd, err=%d",
- blen, nread, result);
- if(nread < 0 && CURLE_AGAIN == result) {
- nread = MBEDTLS_ERR_SSL_WANT_READ;
- }
- return (int)nread;
- }
- static const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_fr =
- {
-
- MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA1) |
- MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_RIPEMD160) |
- MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA224) |
- MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) |
- MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384) |
- MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512),
- 0xFFFFFFF,
- 0xFFFFFFF,
- 1024,
- };
- #define RSA_PUB_DER_MAX_BYTES (38 + 2 * MBEDTLS_MPI_MAX_SIZE)
- #define ECP_PUB_DER_MAX_BYTES (30 + 2 * MBEDTLS_ECP_MAX_BYTES)
- #define PUB_DER_MAX_BYTES (RSA_PUB_DER_MAX_BYTES > ECP_PUB_DER_MAX_BYTES ? \
- RSA_PUB_DER_MAX_BYTES : ECP_PUB_DER_MAX_BYTES)
- static CURLcode
- mbed_set_ssl_version_min_max(struct Curl_easy *data,
- struct mbed_ssl_backend_data *backend,
- struct ssl_primary_config *conn_config)
- {
-
- #if MBEDTLS_VERSION_NUMBER < 0x03020000
- int ver_min = MBEDTLS_SSL_MINOR_VERSION_3;
- int ver_max = MBEDTLS_SSL_MINOR_VERSION_3;
- #else
-
- mbedtls_ssl_protocol_version ver_min = MBEDTLS_SSL_VERSION_TLS1_2;
- mbedtls_ssl_protocol_version ver_max = MBEDTLS_SSL_VERSION_TLS1_2;
- #endif
- switch(conn_config->version) {
- case CURL_SSLVERSION_DEFAULT:
- #if MBEDTLS_VERSION_NUMBER < 0x03000000
- case CURL_SSLVERSION_TLSv1:
- case CURL_SSLVERSION_TLSv1_0:
- ver_min = MBEDTLS_SSL_MINOR_VERSION_1;
- break;
- case CURL_SSLVERSION_TLSv1_1:
- ver_min = MBEDTLS_SSL_MINOR_VERSION_2;
- break;
- #else
- case CURL_SSLVERSION_TLSv1:
- case CURL_SSLVERSION_TLSv1_0:
- case CURL_SSLVERSION_TLSv1_1:
- #endif
- case CURL_SSLVERSION_TLSv1_2:
-
- break;
- case CURL_SSLVERSION_TLSv1_3:
- #ifdef TLS13_SUPPORT
- ver_min = MBEDTLS_SSL_VERSION_TLS1_3;
- break;
- #endif
- default:
- failf(data, "mbedTLS: unsupported minimum TLS version value: %x",
- conn_config->version);
- return CURLE_SSL_CONNECT_ERROR;
- }
- switch(conn_config->version_max) {
- case CURL_SSLVERSION_MAX_DEFAULT:
- case CURL_SSLVERSION_MAX_NONE:
- case CURL_SSLVERSION_MAX_TLSv1_3:
- #ifdef TLS13_SUPPORT
- ver_max = MBEDTLS_SSL_VERSION_TLS1_3;
- break;
- #endif
- case CURL_SSLVERSION_MAX_TLSv1_2:
-
- break;
- #if MBEDTLS_VERSION_NUMBER < 0x03000000
- case CURL_SSLVERSION_MAX_TLSv1_1:
- ver_max = MBEDTLS_SSL_MINOR_VERSION_2;
- break;
- case CURL_SSLVERSION_MAX_TLSv1_0:
- ver_max = MBEDTLS_SSL_MINOR_VERSION_1;
- break;
- #else
- case CURL_SSLVERSION_MAX_TLSv1_1:
- case CURL_SSLVERSION_MAX_TLSv1_0:
- #endif
- default:
- failf(data, "mbedTLS: unsupported maximum TLS version value");
- return CURLE_SSL_CONNECT_ERROR;
- }
- #if MBEDTLS_VERSION_NUMBER < 0x03020000
- mbedtls_ssl_conf_min_version(&backend->config, MBEDTLS_SSL_MAJOR_VERSION_3,
- ver_min);
- mbedtls_ssl_conf_max_version(&backend->config, MBEDTLS_SSL_MAJOR_VERSION_3,
- ver_max);
- #else
- mbedtls_ssl_conf_min_tls_version(&backend->config, ver_min);
- mbedtls_ssl_conf_max_tls_version(&backend->config, ver_max);
- #endif
- return CURLE_OK;
- }
- #ifdef MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8
- #if MBEDTLS_VERSION_NUMBER >= 0x03020000
- static int
- mbed_cipher_suite_get_str(uint16_t id, char *buf, size_t buf_size,
- bool prefer_rfc)
- {
- if(id == MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8)
- msnprintf(buf, buf_size, "%s", "TLS_ECJPAKE_WITH_AES_128_CCM_8");
- else
- return Curl_cipher_suite_get_str(id, buf, buf_size, prefer_rfc);
- return 0;
- }
- #endif
- static uint16_t
- mbed_cipher_suite_walk_str(const char **str, const char **end)
- {
- uint16_t id = Curl_cipher_suite_walk_str(str, end);
- size_t len = *end - *str;
- if(!id) {
- if(strncasecompare("TLS_ECJPAKE_WITH_AES_128_CCM_8", *str, len))
- id = MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8;
- }
- return id;
- }
- #else
- #define mbed_cipher_suite_get_str Curl_cipher_suite_get_str
- #define mbed_cipher_suite_walk_str Curl_cipher_suite_walk_str
- #endif
- static CURLcode
- mbed_set_selected_ciphers(struct Curl_easy *data,
- struct mbed_ssl_backend_data *backend,
- const char *ciphers12,
- const char *ciphers13)
- {
- const char *ciphers = ciphers12;
- const int *supported;
- int *selected;
- size_t supported_len, count = 0, default13_count = 0, i, j;
- const char *ptr, *end;
- supported = mbedtls_ssl_list_ciphersuites();
- for(i = 0; supported[i] != 0; i++);
- supported_len = i;
- selected = malloc(sizeof(int) * (supported_len + 1));
- if(!selected)
- return CURLE_OUT_OF_MEMORY;
- #ifndef TLS13_SUPPORT
- (void) ciphers13, (void) j;
- #else
- if(!ciphers13) {
-
- for(j = 0; j < supported_len; j++) {
- uint16_t id = (uint16_t) supported[j];
- if(strncmp(mbedtls_ssl_get_ciphersuite_name(id), "TLS1-3", 6) != 0)
- continue;
- selected[count++] = id;
- }
- default13_count = count;
- }
- else
- ciphers = ciphers13;
- add_ciphers:
- #endif
- for(ptr = ciphers; ptr[0] != '\0' && count < supported_len; ptr = end) {
- uint16_t id = mbed_cipher_suite_walk_str(&ptr, &end);
-
- if(id) {
- for(i = 0; i < supported_len && supported[i] != id; i++);
- if(i == supported_len)
- id = 0;
- }
- if(!id) {
- if(ptr[0] != '\0')
- infof(data, "mbedTLS: unknown cipher in list: \"%.*s\"",
- (int) (end - ptr), ptr);
- continue;
- }
-
- for(i = 0; i < count && selected[i] != id; i++);
- if(i < count) {
- if(i >= default13_count)
- infof(data, "mbedTLS: duplicate cipher in list: \"%.*s\"",
- (int) (end - ptr), ptr);
- continue;
- }
- selected[count++] = id;
- }
- #ifdef TLS13_SUPPORT
- if(ciphers == ciphers13 && ciphers12) {
- ciphers = ciphers12;
- goto add_ciphers;
- }
- if(!ciphers12) {
-
- for(j = 0; j < supported_len; j++) {
- uint16_t id = (uint16_t) supported[j];
- if(strncmp(mbedtls_ssl_get_ciphersuite_name(id), "TLS1-3", 6) == 0)
- continue;
-
- for(i = 0; i < count && selected[i] != id; i++);
- if(i < count)
- continue;
- selected[count++] = id;
- }
- }
- #endif
- selected[count] = 0;
- if(count == 0) {
- free(selected);
- failf(data, "mbedTLS: no supported cipher in list");
- return CURLE_SSL_CIPHER;
- }
-
- backend->ciphersuites = selected;
- mbedtls_ssl_conf_ciphersuites(&backend->config, backend->ciphersuites);
- return CURLE_OK;
- }
- static void
- mbed_dump_cert_info(struct Curl_easy *data, const mbedtls_x509_crt *crt)
- {
- #if defined(CURL_DISABLE_VERBOSE_STRINGS) || \
- (MBEDTLS_VERSION_NUMBER >= 0x03000000 && defined(MBEDTLS_X509_REMOVE_INFO))
- (void) data, (void) crt;
- #else
- const size_t bufsize = 16384;
- char *p, *buffer = malloc(bufsize);
- if(buffer && mbedtls_x509_crt_info(buffer, bufsize, " ", crt) > 0) {
- infof(data, "Server certificate:");
- for(p = buffer; *p; p += *p != '\0') {
- size_t s = strcspn(p, "\n");
- infof(data, "%.*s", (int) s, p);
- p += s;
- }
- }
- else
- infof(data, "Unable to dump certificate information");
- free(buffer);
- #endif
- }
- static void
- mbed_extract_certinfo(struct Curl_easy *data, const mbedtls_x509_crt *crt)
- {
- CURLcode result;
- const mbedtls_x509_crt *cur;
- int i;
- for(i = 0, cur = crt; cur; ++i, cur = cur->next);
- result = Curl_ssl_init_certinfo(data, i);
- for(i = 0, cur = crt; result == CURLE_OK && cur; ++i, cur = cur->next) {
- const char *beg = (const char *) cur->raw.p;
- const char *end = beg + cur->raw.len;
- result = Curl_extract_certinfo(data, i, beg, end);
- }
- }
- static int mbed_verify_cb(void *ptr, mbedtls_x509_crt *crt,
- int depth, uint32_t *flags)
- {
- struct Curl_cfilter *cf = (struct Curl_cfilter *) ptr;
- struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
- struct Curl_easy *data = CF_DATA_CURRENT(cf);
- if(depth == 0) {
- if(data->set.verbose)
- mbed_dump_cert_info(data, crt);
- if(data->set.ssl.certinfo)
- mbed_extract_certinfo(data, crt);
- }
- if(!conn_config->verifypeer)
- *flags = 0;
- else if(!conn_config->verifyhost)
- *flags &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH;
- if(*flags) {
- #if MBEDTLS_VERSION_NUMBER < 0x03000000 || !defined(MBEDTLS_X509_REMOVE_INFO)
- char buf[128];
- mbedtls_x509_crt_verify_info(buf, sizeof(buf), "", *flags);
- failf(data, "mbedTLS: %s", buf);
- #else
- failf(data, "mbedTLS: certificate verification error 0x%08x", *flags);
- #endif
- }
- return 0;
- }
- static CURLcode
- mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- struct mbed_ssl_backend_data *backend =
- (struct mbed_ssl_backend_data *)connssl->backend;
- struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
- const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
- const char * const ssl_cafile =
-
- (ca_info_blob ? NULL : conn_config->CAfile);
- const bool verifypeer = conn_config->verifypeer;
- const char * const ssl_capath = conn_config->CApath;
- char * const ssl_cert = ssl_config->primary.clientcert;
- const struct curl_blob *ssl_cert_blob = ssl_config->primary.cert_blob;
- const char * const ssl_crlfile = ssl_config->primary.CRLfile;
- const char *hostname = connssl->peer.hostname;
- int ret = -1;
- char errorbuf[128];
- DEBUGASSERT(backend);
- DEBUGASSERT(!backend->initialized);
- if((conn_config->version == CURL_SSLVERSION_SSLv2) ||
- (conn_config->version == CURL_SSLVERSION_SSLv3)) {
- failf(data, "Not supported SSL version");
- return CURLE_NOT_BUILT_IN;
- }
- #ifdef THREADING_SUPPORT
- mbedtls_ctr_drbg_init(&backend->ctr_drbg);
- ret = mbedtls_ctr_drbg_seed(&backend->ctr_drbg, entropy_func_mutex,
- &ts_entropy, NULL, 0);
- if(ret) {
- mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
- failf(data, "mbedtls_ctr_drbg_seed returned (-0x%04X) %s",
- -ret, errorbuf);
- return CURLE_FAILED_INIT;
- }
- #else
- mbedtls_entropy_init(&backend->entropy);
- mbedtls_ctr_drbg_init(&backend->ctr_drbg);
- ret = mbedtls_ctr_drbg_seed(&backend->ctr_drbg, mbedtls_entropy_func,
- &backend->entropy, NULL, 0);
- if(ret) {
- mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
- failf(data, "mbedtls_ctr_drbg_seed returned (-0x%04X) %s",
- -ret, errorbuf);
- return CURLE_FAILED_INIT;
- }
- #endif
-
- mbedtls_x509_crt_init(&backend->cacert);
- if(ca_info_blob && verifypeer) {
-
- unsigned char *newblob = Curl_memdup0(ca_info_blob->data,
- ca_info_blob->len);
- if(!newblob)
- return CURLE_OUT_OF_MEMORY;
- ret = mbedtls_x509_crt_parse(&backend->cacert, newblob,
- ca_info_blob->len + 1);
- free(newblob);
- if(ret < 0) {
- mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
- failf(data, "Error importing ca cert blob - mbedTLS: (-0x%04X) %s",
- -ret, errorbuf);
- return CURLE_SSL_CERTPROBLEM;
- }
- }
- if(ssl_cafile && verifypeer) {
- #ifdef MBEDTLS_FS_IO
- ret = mbedtls_x509_crt_parse_file(&backend->cacert, ssl_cafile);
- if(ret < 0) {
- mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
- failf(data, "Error reading ca cert file %s - mbedTLS: (-0x%04X) %s",
- ssl_cafile, -ret, errorbuf);
- return CURLE_SSL_CACERT_BADFILE;
- }
- #else
- failf(data, "mbedtls: functions that use the filesystem not built in");
- return CURLE_NOT_BUILT_IN;
- #endif
- }
- if(ssl_capath) {
- #ifdef MBEDTLS_FS_IO
- ret = mbedtls_x509_crt_parse_path(&backend->cacert, ssl_capath);
- if(ret < 0) {
- mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
- failf(data, "Error reading ca cert path %s - mbedTLS: (-0x%04X) %s",
- ssl_capath, -ret, errorbuf);
- if(verifypeer)
- return CURLE_SSL_CACERT_BADFILE;
- }
- #else
- failf(data, "mbedtls: functions that use the filesystem not built in");
- return CURLE_NOT_BUILT_IN;
- #endif
- }
-
- mbedtls_x509_crt_init(&backend->clicert);
- if(ssl_cert) {
- #ifdef MBEDTLS_FS_IO
- ret = mbedtls_x509_crt_parse_file(&backend->clicert, ssl_cert);
- if(ret) {
- mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
- failf(data, "Error reading client cert file %s - mbedTLS: (-0x%04X) %s",
- ssl_cert, -ret, errorbuf);
- return CURLE_SSL_CERTPROBLEM;
- }
- #else
- failf(data, "mbedtls: functions that use the filesystem not built in");
- return CURLE_NOT_BUILT_IN;
- #endif
- }
- if(ssl_cert_blob) {
-
- unsigned char *newblob = Curl_memdup0(ssl_cert_blob->data,
- ssl_cert_blob->len);
- if(!newblob)
- return CURLE_OUT_OF_MEMORY;
- ret = mbedtls_x509_crt_parse(&backend->clicert, newblob,
- ssl_cert_blob->len + 1);
- free(newblob);
- if(ret) {
- mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
- failf(data, "Error reading client cert data %s - mbedTLS: (-0x%04X) %s",
- ssl_config->key, -ret, errorbuf);
- return CURLE_SSL_CERTPROBLEM;
- }
- }
-
- mbedtls_pk_init(&backend->pk);
- if(ssl_config->key || ssl_config->key_blob) {
- if(ssl_config->key) {
- #ifdef MBEDTLS_FS_IO
- #if MBEDTLS_VERSION_NUMBER >= 0x03000000
- ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
- ssl_config->key_passwd,
- mbedtls_ctr_drbg_random,
- &backend->ctr_drbg);
- #else
- ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
- ssl_config->key_passwd);
- #endif
- if(ret) {
- mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
- failf(data, "Error reading private key %s - mbedTLS: (-0x%04X) %s",
- ssl_config->key, -ret, errorbuf);
- return CURLE_SSL_CERTPROBLEM;
- }
- #else
- failf(data, "mbedtls: functions that use the filesystem not built in");
- return CURLE_NOT_BUILT_IN;
- #endif
- }
- else {
- const struct curl_blob *ssl_key_blob = ssl_config->key_blob;
- const unsigned char *key_data =
- (const unsigned char *)ssl_key_blob->data;
- const char *passwd = ssl_config->key_passwd;
- #if MBEDTLS_VERSION_NUMBER >= 0x03000000
- ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
- (const unsigned char *)passwd,
- passwd ? strlen(passwd) : 0,
- mbedtls_ctr_drbg_random,
- &backend->ctr_drbg);
- #else
- ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
- (const unsigned char *)passwd,
- passwd ? strlen(passwd) : 0);
- #endif
- if(ret) {
- mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
- failf(data, "Error parsing private key - mbedTLS: (-0x%04X) %s",
- -ret, errorbuf);
- return CURLE_SSL_CERTPROBLEM;
- }
- }
- if(ret == 0 && !(mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_RSA) ||
- mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_ECKEY)))
- ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
- }
-
- #ifdef MBEDTLS_X509_CRL_PARSE_C
- mbedtls_x509_crl_init(&backend->crl);
- if(ssl_crlfile) {
- #ifdef MBEDTLS_FS_IO
- ret = mbedtls_x509_crl_parse_file(&backend->crl, ssl_crlfile);
- if(ret) {
- mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
- failf(data, "Error reading CRL file %s - mbedTLS: (-0x%04X) %s",
- ssl_crlfile, -ret, errorbuf);
- return CURLE_SSL_CRL_BADFILE;
- }
- #else
- failf(data, "mbedtls: functions that use the filesystem not built in");
- return CURLE_NOT_BUILT_IN;
- #endif
- }
- #else
- if(ssl_crlfile) {
- failf(data, "mbedtls: crl support not built in");
- return CURLE_NOT_BUILT_IN;
- }
- #endif
- infof(data, "mbedTLS: Connecting to %s:%d", hostname, connssl->peer.port);
- mbedtls_ssl_config_init(&backend->config);
- ret = mbedtls_ssl_config_defaults(&backend->config,
- MBEDTLS_SSL_IS_CLIENT,
- MBEDTLS_SSL_TRANSPORT_STREAM,
- MBEDTLS_SSL_PRESET_DEFAULT);
- if(ret) {
- failf(data, "mbedTLS: ssl_config failed");
- return CURLE_SSL_CONNECT_ERROR;
- }
- #ifdef MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED
-
- mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(&backend->config,
- MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED);
- #endif
-
- mbedtls_ssl_conf_verify(&backend->config, mbed_verify_cb, cf);
- mbedtls_ssl_conf_authmode(&backend->config, MBEDTLS_SSL_VERIFY_REQUIRED);
- mbedtls_ssl_init(&backend->ssl);
- backend->initialized = TRUE;
-
- mbedtls_ssl_conf_cert_profile(&backend->config,
- &mbedtls_x509_crt_profile_fr);
- ret = mbed_set_ssl_version_min_max(data, backend, conn_config);
- if(ret != CURLE_OK)
- return ret;
- mbedtls_ssl_conf_rng(&backend->config, mbedtls_ctr_drbg_random,
- &backend->ctr_drbg);
- ret = mbedtls_ssl_setup(&backend->ssl, &backend->config);
- if(ret) {
- mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
- failf(data, "ssl_setup failed - mbedTLS: (-0x%04X) %s",
- -ret, errorbuf);
- return CURLE_SSL_CONNECT_ERROR;
- }
- mbedtls_ssl_set_bio(&backend->ssl, cf,
- mbedtls_bio_cf_write,
- mbedtls_bio_cf_read,
- NULL );
- #ifndef TLS13_SUPPORT
- if(conn_config->cipher_list) {
- CURLcode result = mbed_set_selected_ciphers(data, backend,
- conn_config->cipher_list,
- NULL);
- #else
- if(conn_config->cipher_list || conn_config->cipher_list13) {
- CURLcode result = mbed_set_selected_ciphers(data, backend,
- conn_config->cipher_list,
- conn_config->cipher_list13);
- #endif
- if(result != CURLE_OK) {
- failf(data, "mbedTLS: failed to set cipher suites");
- return result;
- }
- }
- else {
- mbedtls_ssl_conf_ciphersuites(&backend->config,
- mbedtls_ssl_list_ciphersuites());
- }
- #if defined(MBEDTLS_SSL_RENEGOTIATION)
- mbedtls_ssl_conf_renegotiation(&backend->config,
- MBEDTLS_SSL_RENEGOTIATION_ENABLED);
- #endif
- #if defined(MBEDTLS_SSL_SESSION_TICKETS)
- mbedtls_ssl_conf_session_tickets(&backend->config,
- MBEDTLS_SSL_SESSION_TICKETS_DISABLED);
- #endif
-
- if(ssl_config->primary.cache_session) {
- void *sdata = NULL;
- size_t slen = 0;
- Curl_ssl_sessionid_lock(data);
- if(!Curl_ssl_getsessionid(cf, data, &connssl->peer,
- &sdata, &slen, NULL) && slen) {
- mbedtls_ssl_session session;
- mbedtls_ssl_session_init(&session);
- ret = mbedtls_ssl_session_load(&session, sdata, slen);
- if(ret) {
- failf(data, "error loading cached session: -0x%x", -ret);
- }
- else {
- ret = mbedtls_ssl_set_session(&backend->ssl, &session);
- if(ret)
- failf(data, "error setting session: -0x%x", -ret);
- else
- infof(data, "SSL reusing session ID");
- }
- mbedtls_ssl_session_free(&session);
- }
- Curl_ssl_sessionid_unlock(data);
- }
- mbedtls_ssl_conf_ca_chain(&backend->config,
- &backend->cacert,
- #ifdef MBEDTLS_X509_CRL_PARSE_C
- &backend->crl);
- #else
- NULL);
- #endif
- if(ssl_config->key || ssl_config->key_blob) {
- mbedtls_ssl_conf_own_cert(&backend->config,
- &backend->clicert, &backend->pk);
- }
- if(mbedtls_ssl_set_hostname(&backend->ssl, connssl->peer.sni ?
- connssl->peer.sni : connssl->peer.hostname)) {
-
- failf(data, "Failed to set SNI");
- return CURLE_SSL_CONNECT_ERROR;
- }
- #ifdef HAS_ALPN
- if(connssl->alpn) {
- struct alpn_proto_buf proto;
- size_t i;
- for(i = 0; i < connssl->alpn->count; ++i) {
- backend->protocols[i] = connssl->alpn->entries[i];
- }
-
- if(mbedtls_ssl_conf_alpn_protocols(&backend->config,
- &backend->protocols[0])) {
- failf(data, "Failed setting ALPN protocols");
- return CURLE_SSL_CONNECT_ERROR;
- }
- Curl_alpn_to_proto_str(&proto, connssl->alpn);
- infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
- }
- #endif
- #ifdef MBEDTLS_DEBUG
-
- mbedtls_ssl_conf_dbg(&backend->config, mbed_debug, data);
-
- mbedtls_debug_set_threshold(4);
- #endif
-
- if(data->set.ssl.fsslctx) {
- CURLcode result = (*data->set.ssl.fsslctx)(data, &backend->config,
- data->set.ssl.fsslctxp);
- if(result != CURLE_OK) {
- failf(data, "error signaled by ssl ctx callback");
- return result;
- }
- }
- connssl->connecting_state = ssl_connect_2;
- return CURLE_OK;
- }
- static CURLcode
- mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- int ret;
- struct ssl_connect_data *connssl = cf->ctx;
- struct mbed_ssl_backend_data *backend =
- (struct mbed_ssl_backend_data *)connssl->backend;
- #ifndef CURL_DISABLE_PROXY
- const char * const pinnedpubkey = Curl_ssl_cf_is_proxy(cf) ?
- data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
- data->set.str[STRING_SSL_PINNEDPUBLICKEY];
- #else
- const char * const pinnedpubkey = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
- #endif
- DEBUGASSERT(backend);
- ret = mbedtls_ssl_handshake(&backend->ssl);
- if(ret == MBEDTLS_ERR_SSL_WANT_READ) {
- connssl->io_need = CURL_SSL_IO_NEED_RECV;
- return CURLE_OK;
- }
- else if(ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
- connssl->io_need = CURL_SSL_IO_NEED_SEND;
- return CURLE_OK;
- }
- else if(ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED) {
- failf(data, "peer certificate could not be verified");
- return CURLE_PEER_FAILED_VERIFICATION;
- }
- else if(ret) {
- char errorbuf[128];
- #if MBEDTLS_VERSION_NUMBER >= 0x03020000
- CURL_TRC_CF(data, cf, "TLS version %04X",
- mbedtls_ssl_get_version_number(&backend->ssl));
- #endif
- mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
- failf(data, "ssl_handshake returned: (-0x%04X) %s",
- -ret, errorbuf);
- return CURLE_SSL_CONNECT_ERROR;
- }
- #if MBEDTLS_VERSION_NUMBER >= 0x03020000
- {
- char cipher_str[64];
- uint16_t cipher_id;
- cipher_id = (uint16_t)
- mbedtls_ssl_get_ciphersuite_id_from_ssl(&backend->ssl);
- mbed_cipher_suite_get_str(cipher_id, cipher_str, sizeof(cipher_str), TRUE);
- infof(data, "mbedTLS: %s Handshake complete, cipher is %s",
- mbedtls_ssl_get_version(&backend->ssl), cipher_str);
- }
- #else
- infof(data, "mbedTLS: %s Handshake complete",
- mbedtls_ssl_get_version(&backend->ssl));
- #endif
- if(pinnedpubkey) {
- int size;
- CURLcode result;
- const mbedtls_x509_crt *peercert;
- mbedtls_x509_crt *p = NULL;
- unsigned char *pubkey = NULL;
- peercert = mbedtls_ssl_get_peer_cert(&backend->ssl);
- #if MBEDTLS_VERSION_NUMBER == 0x03000000
- if(!peercert || !peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p) ||
- !peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len)) {
- #else
- if(!peercert || !peercert->raw.p || !peercert->raw.len) {
- #endif
- failf(data, "Failed due to missing peer certificate");
- return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
- }
- p = calloc(1, sizeof(*p));
- if(!p)
- return CURLE_OUT_OF_MEMORY;
- pubkey = malloc(PUB_DER_MAX_BYTES);
- if(!pubkey) {
- result = CURLE_OUT_OF_MEMORY;
- goto pinnedpubkey_error;
- }
- mbedtls_x509_crt_init(p);
-
- #if MBEDTLS_VERSION_NUMBER == 0x03000000
- if(mbedtls_x509_crt_parse_der(p,
- peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p),
- peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len))) {
- #else
- if(mbedtls_x509_crt_parse_der(p, peercert->raw.p, peercert->raw.len)) {
- #endif
- failf(data, "Failed copying peer certificate");
- result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
- goto pinnedpubkey_error;
- }
- #if MBEDTLS_VERSION_NUMBER == 0x03000000
- size = mbedtls_pk_write_pubkey_der(&p->MBEDTLS_PRIVATE(pk), pubkey,
- PUB_DER_MAX_BYTES);
- #else
- size = mbedtls_pk_write_pubkey_der(&p->pk, pubkey, PUB_DER_MAX_BYTES);
- #endif
- if(size <= 0) {
- failf(data, "Failed copying public key from peer certificate");
- result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
- goto pinnedpubkey_error;
- }
-
- result = Curl_pin_peer_pubkey(data,
- pinnedpubkey,
- &pubkey[PUB_DER_MAX_BYTES - size], size);
- pinnedpubkey_error:
- mbedtls_x509_crt_free(p);
- free(p);
- free(pubkey);
- if(result) {
- return result;
- }
- }
- #ifdef HAS_ALPN
- if(connssl->alpn) {
- const char *proto = mbedtls_ssl_get_alpn_protocol(&backend->ssl);
- Curl_alpn_set_negotiated(cf, data, connssl, (const unsigned char *)proto,
- proto ? strlen(proto) : 0);
- }
- #endif
- connssl->connecting_state = ssl_connect_3;
- infof(data, "SSL connected");
- return CURLE_OK;
- }
- static void mbedtls_session_free(void *session, size_t slen)
- {
- (void)slen;
- free(session);
- }
- static CURLcode
- mbed_new_session(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- struct mbed_ssl_backend_data *backend =
- (struct mbed_ssl_backend_data *)connssl->backend;
- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
- CURLcode result = CURLE_OK;
- DEBUGASSERT(backend);
- if(ssl_config->primary.cache_session) {
- int ret;
- mbedtls_ssl_session session;
- unsigned char *sdata = NULL;
- size_t slen = 0;
- mbedtls_ssl_session_init(&session);
- ret = mbedtls_ssl_get_session(&backend->ssl, &session);
- if(ret) {
- if(ret != MBEDTLS_ERR_SSL_ALLOC_FAILED)
- mbedtls_ssl_session_free(&session);
- failf(data, "mbedtls_ssl_get_session returned -0x%x", -ret);
- return CURLE_SSL_CONNECT_ERROR;
- }
- mbedtls_ssl_session_save(&session, NULL, 0, &slen);
- if(!slen) {
- failf(data, "failed to serialize session: length is 0");
- }
- else {
- sdata = malloc(slen);
- if(sdata) {
- ret = mbedtls_ssl_session_save(&session, sdata, slen, &slen);
- if(ret) {
- failf(data, "failed to serialize session: -0x%x", -ret);
- }
- else {
- Curl_ssl_sessionid_lock(data);
- result = Curl_ssl_set_sessionid(cf, data, &connssl->peer, NULL,
- sdata, slen, mbedtls_session_free);
- Curl_ssl_sessionid_unlock(data);
- if(!result)
- sdata = NULL;
- }
- }
- }
- mbedtls_ssl_session_free(&session);
- free(sdata);
- }
- return result;
- }
- static ssize_t mbed_send(struct Curl_cfilter *cf, struct Curl_easy *data,
- const void *mem, size_t len,
- CURLcode *curlcode)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- struct mbed_ssl_backend_data *backend =
- (struct mbed_ssl_backend_data *)connssl->backend;
- int ret = -1;
- (void)data;
- DEBUGASSERT(backend);
- ret = mbedtls_ssl_write(&backend->ssl, (unsigned char *)mem, len);
- if(ret < 0) {
- CURL_TRC_CF(data, cf, "mbedtls_ssl_write(len=%zu) -> -0x%04X",
- len, -ret);
- *curlcode = ((ret == MBEDTLS_ERR_SSL_WANT_WRITE)
- #ifdef TLS13_SUPPORT
- || (ret == MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET)
- #endif
- ) ? CURLE_AGAIN : CURLE_SEND_ERROR;
- ret = -1;
- }
- return ret;
- }
- static void mbedtls_close_all(struct Curl_easy *data)
- {
- (void)data;
- }
- static CURLcode mbedtls_shutdown(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- bool send_shutdown, bool *done)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- struct mbed_ssl_backend_data *backend =
- (struct mbed_ssl_backend_data *)connssl->backend;
- unsigned char buf[1024];
- CURLcode result = CURLE_OK;
- int ret;
- size_t i;
- DEBUGASSERT(backend);
- if(!backend->initialized || cf->shutdown) {
- *done = TRUE;
- return CURLE_OK;
- }
- connssl->io_need = CURL_SSL_IO_NEED_NONE;
- *done = FALSE;
- if(!backend->sent_shutdown) {
-
- backend->sent_shutdown = TRUE;
- if(send_shutdown) {
- ret = mbedtls_ssl_close_notify(&backend->ssl);
- switch(ret) {
- case 0:
- break;
- case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
- *done = TRUE;
- goto out;
- case MBEDTLS_ERR_SSL_WANT_READ:
- connssl->io_need = CURL_SSL_IO_NEED_RECV;
- goto out;
- case MBEDTLS_ERR_SSL_WANT_WRITE:
- connssl->io_need = CURL_SSL_IO_NEED_SEND;
- goto out;
- default:
- CURL_TRC_CF(data, cf, "mbedtls_shutdown error -0x%04X", -ret);
- result = CURLE_RECV_ERROR;
- goto out;
- }
- }
- }
-
- for(i = 0; i < 10; ++i) {
- ret = mbedtls_ssl_read(&backend->ssl, buf, sizeof(buf));
-
- if(ret == MBEDTLS_ERR_SSL_WANT_READ)
- ret = mbedtls_ssl_read(&backend->ssl, buf, sizeof(buf));
- #ifdef TLS13_SUPPORT
- if(ret == MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET)
- continue;
- #endif
- if(ret <= 0)
- break;
- }
- if(ret > 0) {
-
- CURL_TRC_CF(data, cf, "mbedtls_shutdown, still getting data");
- }
- else if(ret == 0 || (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY)) {
-
- CURL_TRC_CF(data, cf, "mbedtls_shutdown done");
- *done = TRUE;
- }
- else if(ret == MBEDTLS_ERR_SSL_WANT_READ) {
- CURL_TRC_CF(data, cf, "mbedtls_shutdown, need RECV");
- connssl->io_need = CURL_SSL_IO_NEED_RECV;
- }
- else if(ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
- CURL_TRC_CF(data, cf, "mbedtls_shutdown, need SEND");
- connssl->io_need = CURL_SSL_IO_NEED_SEND;
- }
- else {
- CURL_TRC_CF(data, cf, "mbedtls_shutdown error -0x%04X", -ret);
- result = CURLE_RECV_ERROR;
- }
- out:
- cf->shutdown = (result || *done);
- return result;
- }
- static void mbedtls_close(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- struct mbed_ssl_backend_data *backend =
- (struct mbed_ssl_backend_data *)connssl->backend;
- (void)data;
- DEBUGASSERT(backend);
- if(backend->initialized) {
- mbedtls_pk_free(&backend->pk);
- mbedtls_x509_crt_free(&backend->clicert);
- mbedtls_x509_crt_free(&backend->cacert);
- #ifdef MBEDTLS_X509_CRL_PARSE_C
- mbedtls_x509_crl_free(&backend->crl);
- #endif
- Curl_safefree(backend->ciphersuites);
- mbedtls_ssl_config_free(&backend->config);
- mbedtls_ssl_free(&backend->ssl);
- mbedtls_ctr_drbg_free(&backend->ctr_drbg);
- #ifndef THREADING_SUPPORT
- mbedtls_entropy_free(&backend->entropy);
- #endif
- backend->initialized = FALSE;
- }
- }
- static ssize_t mbed_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
- char *buf, size_t buffersize,
- CURLcode *curlcode)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- struct mbed_ssl_backend_data *backend =
- (struct mbed_ssl_backend_data *)connssl->backend;
- int ret = -1;
- (void)data;
- DEBUGASSERT(backend);
- ret = mbedtls_ssl_read(&backend->ssl, (unsigned char *)buf,
- buffersize);
- if(ret <= 0) {
- CURL_TRC_CF(data, cf, "mbedtls_ssl_read(len=%zu) -> -0x%04X",
- buffersize, -ret);
- switch(ret) {
- #ifdef HAS_SESSION_TICKETS
- case MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET:
- mbed_new_session(cf, data);
- FALLTHROUGH();
- #endif
- case MBEDTLS_ERR_SSL_WANT_READ:
- *curlcode = CURLE_AGAIN;
- ret = -1;
- break;
- case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
- *curlcode = CURLE_OK;
- ret = 0;
- break;
- default: {
- char errorbuf[128];
- mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
- failf(data, "ssl_read returned: (-0x%04X) %s", -ret, errorbuf);
- *curlcode = CURLE_RECV_ERROR;
- ret = -1;
- break;
- }
- }
- }
- return (ssize_t)ret;
- }
- static size_t mbedtls_version(char *buffer, size_t size)
- {
- #ifdef MBEDTLS_VERSION_C
-
- unsigned int version = mbedtls_version_get_number();
- return msnprintf(buffer, size, "mbedTLS/%u.%u.%u", version >> 24,
- (version >> 16) & 0xff, (version >> 8) & 0xff);
- #else
- return msnprintf(buffer, size, "mbedTLS/%s", MBEDTLS_VERSION_STRING);
- #endif
- }
- static CURLcode mbedtls_random(struct Curl_easy *data,
- unsigned char *entropy, size_t length)
- {
- #if defined(MBEDTLS_CTR_DRBG_C)
- int ret;
- mbedtls_entropy_context ctr_entropy;
- mbedtls_ctr_drbg_context ctr_drbg;
- mbedtls_entropy_init(&ctr_entropy);
- mbedtls_ctr_drbg_init(&ctr_drbg);
- (void)data;
- ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func,
- &ctr_entropy, NULL, 0);
- if(!ret)
- ret = mbedtls_ctr_drbg_random(&ctr_drbg, entropy, length);
- mbedtls_ctr_drbg_free(&ctr_drbg);
- mbedtls_entropy_free(&ctr_entropy);
- return ret == 0 ? CURLE_OK : CURLE_FAILED_INIT;
- #elif defined(MBEDTLS_HAVEGE_C)
- mbedtls_havege_state hs;
- mbedtls_havege_init(&hs);
- mbedtls_havege_random(&hs, entropy, length);
- mbedtls_havege_free(&hs);
- return CURLE_OK;
- #else
- return CURLE_NOT_BUILT_IN;
- #endif
- }
- static CURLcode
- mbed_connect_common(struct Curl_cfilter *cf, struct Curl_easy *data,
- bool nonblocking,
- bool *done)
- {
- CURLcode retcode;
- struct ssl_connect_data *connssl = cf->ctx;
- curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
- timediff_t timeout_ms;
- int what;
-
- if(ssl_connection_complete == connssl->state) {
- *done = TRUE;
- return CURLE_OK;
- }
- if(ssl_connect_1 == connssl->connecting_state) {
-
- timeout_ms = Curl_timeleft(data, NULL, TRUE);
- if(timeout_ms < 0) {
-
- failf(data, "SSL connection timeout");
- return CURLE_OPERATION_TIMEDOUT;
- }
- retcode = mbed_connect_step1(cf, data);
- if(retcode)
- return retcode;
- }
- while(ssl_connect_2 == connssl->connecting_state) {
-
- timeout_ms = Curl_timeleft(data, NULL, TRUE);
- if(timeout_ms < 0) {
-
- failf(data, "SSL connection timeout");
- return CURLE_OPERATION_TIMEDOUT;
- }
-
- if(connssl->io_need) {
- curl_socket_t writefd = (connssl->io_need & CURL_SSL_IO_NEED_SEND) ?
- sockfd : CURL_SOCKET_BAD;
- curl_socket_t readfd = (connssl->io_need & CURL_SSL_IO_NEED_RECV) ?
- sockfd : CURL_SOCKET_BAD;
- what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
- nonblocking ? 0 : timeout_ms);
- if(what < 0) {
-
- failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
- return CURLE_SSL_CONNECT_ERROR;
- }
- else if(0 == what) {
- if(nonblocking) {
- *done = FALSE;
- return CURLE_OK;
- }
- else {
-
- failf(data, "SSL connection timeout");
- return CURLE_OPERATION_TIMEDOUT;
- }
- }
-
- }
-
- connssl->io_need = CURL_SSL_IO_NEED_NONE;
- retcode = mbed_connect_step2(cf, data);
- if(retcode ||
- (nonblocking && (ssl_connect_2 == connssl->connecting_state)))
- return retcode;
- }
- if(ssl_connect_3 == connssl->connecting_state) {
-
- #if MBEDTLS_VERSION_NUMBER >= 0x03020000
- struct ssl_connect_data *ctx = cf->ctx;
- struct mbed_ssl_backend_data *backend =
- (struct mbed_ssl_backend_data *)ctx->backend;
- if(mbedtls_ssl_get_version_number(&backend->ssl) <=
- MBEDTLS_SSL_VERSION_TLS1_2) {
- #else
- {
- #endif
- retcode = mbed_new_session(cf, data);
- if(retcode)
- return retcode;
- }
- connssl->connecting_state = ssl_connect_done;
- }
- if(ssl_connect_done == connssl->connecting_state) {
- connssl->state = ssl_connection_complete;
- *done = TRUE;
- }
- else
- *done = FALSE;
-
- connssl->connecting_state = ssl_connect_1;
- return CURLE_OK;
- }
- static CURLcode mbedtls_connect_nonblocking(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- bool *done)
- {
- return mbed_connect_common(cf, data, TRUE, done);
- }
- static CURLcode mbedtls_connect(struct Curl_cfilter *cf,
- struct Curl_easy *data)
- {
- CURLcode retcode;
- bool done = FALSE;
- retcode = mbed_connect_common(cf, data, FALSE, &done);
- if(retcode)
- return retcode;
- DEBUGASSERT(done);
- return CURLE_OK;
- }
- static int mbedtls_init(void)
- {
- if(!Curl_mbedtlsthreadlock_thread_setup())
- return 0;
- #ifdef THREADING_SUPPORT
- entropy_init_mutex(&ts_entropy);
- #endif
- #ifdef TLS13_SUPPORT
- {
- int ret;
- #ifdef THREADING_SUPPORT
- Curl_mbedtlsthreadlock_lock_function(0);
- #endif
- ret = psa_crypto_init();
- #ifdef THREADING_SUPPORT
- Curl_mbedtlsthreadlock_unlock_function(0);
- #endif
- if(ret != PSA_SUCCESS)
- return 0;
- }
- #endif
- return 1;
- }
- static void mbedtls_cleanup(void)
- {
- #ifdef THREADING_SUPPORT
- entropy_cleanup_mutex(&ts_entropy);
- #endif
- (void)Curl_mbedtlsthreadlock_thread_cleanup();
- }
- static bool mbedtls_data_pending(struct Curl_cfilter *cf,
- const struct Curl_easy *data)
- {
- struct ssl_connect_data *ctx = cf->ctx;
- struct mbed_ssl_backend_data *backend;
- (void)data;
- DEBUGASSERT(ctx && ctx->backend);
- backend = (struct mbed_ssl_backend_data *)ctx->backend;
- return mbedtls_ssl_get_bytes_avail(&backend->ssl) != 0;
- }
- static CURLcode mbedtls_sha256sum(const unsigned char *input,
- size_t inputlen,
- unsigned char *sha256sum,
- size_t sha256len UNUSED_PARAM)
- {
-
- (void)sha256len;
- #if MBEDTLS_VERSION_NUMBER < 0x02070000
- mbedtls_sha256(input, inputlen, sha256sum, 0);
- #else
-
- #if MBEDTLS_VERSION_NUMBER >= 0x03000000
- if(mbedtls_sha256(input, inputlen, sha256sum, 0) != 0)
- #else
- if(mbedtls_sha256_ret(input, inputlen, sha256sum, 0) != 0)
- #endif
- return CURLE_BAD_FUNCTION_ARGUMENT;
- #endif
- return CURLE_OK;
- }
- static void *mbedtls_get_internals(struct ssl_connect_data *connssl,
- CURLINFO info UNUSED_PARAM)
- {
- struct mbed_ssl_backend_data *backend =
- (struct mbed_ssl_backend_data *)connssl->backend;
- (void)info;
- DEBUGASSERT(backend);
- return &backend->ssl;
- }
- const struct Curl_ssl Curl_ssl_mbedtls = {
- { CURLSSLBACKEND_MBEDTLS, "mbedtls" },
- SSLSUPP_CA_PATH |
- SSLSUPP_CAINFO_BLOB |
- SSLSUPP_CERTINFO |
- SSLSUPP_PINNEDPUBKEY |
- SSLSUPP_SSL_CTX |
- #ifdef TLS13_SUPPORT
- SSLSUPP_TLS13_CIPHERSUITES |
- #endif
- SSLSUPP_HTTPS_PROXY |
- SSLSUPP_CIPHER_LIST,
- sizeof(struct mbed_ssl_backend_data),
- mbedtls_init,
- mbedtls_cleanup,
- mbedtls_version,
- Curl_none_check_cxn,
- mbedtls_shutdown,
- mbedtls_data_pending,
- mbedtls_random,
- Curl_none_cert_status_request,
- mbedtls_connect,
- mbedtls_connect_nonblocking,
- Curl_ssl_adjust_pollset,
- mbedtls_get_internals,
- mbedtls_close,
- mbedtls_close_all,
- Curl_none_set_engine,
- Curl_none_set_engine_default,
- Curl_none_engines_list,
- Curl_none_false_start,
- mbedtls_sha256sum,
- NULL,
- NULL,
- mbed_recv,
- mbed_send,
- NULL,
- };
- #endif
|