1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362 |
- #include "curl_setup.h"
- #ifdef HAVE_SYS_TYPES_H
- #include <sys/types.h>
- #endif
- #ifdef HAVE_SYS_STAT_H
- #include <sys/stat.h>
- #endif
- #ifdef HAVE_FCNTL_H
- #include <fcntl.h>
- #endif
- #include "urldata.h"
- #include "cfilters.h"
- #include "vtls.h"
- #include "vtls_int.h"
- #include "openssl.h"
- #include "gtls.h"
- #include "wolfssl.h"
- #include "schannel.h"
- #include "sectransp.h"
- #include "mbedtls.h"
- #include "bearssl.h"
- #include "rustls.h"
- #include "slist.h"
- #include "sendf.h"
- #include "strcase.h"
- #include "url.h"
- #include "progress.h"
- #include "share.h"
- #include "multiif.h"
- #include "timeval.h"
- #include "curl_md5.h"
- #include "warnless.h"
- #include "curl_base64.h"
- #include "curl_printf.h"
- #include "inet_pton.h"
- #include "connect.h"
- #include "select.h"
- #include "strdup.h"
- #include "rand.h"
- #include "curl_memory.h"
- #include "memdebug.h"
- #define SSLSESSION_SHARED(data) (data->share && \
- (data->share->specifier & \
- (1<<CURL_LOCK_DATA_SSL_SESSION)))
- #define CLONE_STRING(var) \
- do { \
- if(source->var) { \
- dest->var = strdup(source->var); \
- if(!dest->var) \
- return FALSE; \
- } \
- else \
- dest->var = NULL; \
- } while(0)
- #define CLONE_BLOB(var) \
- do { \
- if(blobdup(&dest->var, source->var)) \
- return FALSE; \
- } while(0)
- static CURLcode blobdup(struct curl_blob **dest,
- struct curl_blob *src)
- {
- DEBUGASSERT(dest);
- DEBUGASSERT(!*dest);
- if(src) {
-
- struct curl_blob *d;
- d = malloc(sizeof(struct curl_blob) + src->len);
- if(!d)
- return CURLE_OUT_OF_MEMORY;
- d->len = src->len;
-
- d->flags = CURL_BLOB_COPY;
- d->data = (void *)((char *)d + sizeof(struct curl_blob));
- memcpy(d->data, src->data, src->len);
- *dest = d;
- }
- return CURLE_OK;
- }
- static bool blobcmp(struct curl_blob *first, struct curl_blob *second)
- {
- if(!first && !second)
- return TRUE;
- if(!first || !second)
- return FALSE;
- if(first->len != second->len)
- return FALSE;
- return !memcmp(first->data, second->data, first->len);
- }
- #ifdef USE_SSL
- static const struct alpn_spec ALPN_SPEC_H11 = {
- { ALPN_HTTP_1_1 }, 1
- };
- #ifdef USE_HTTP2
- static const struct alpn_spec ALPN_SPEC_H2 = {
- { ALPN_H2 }, 1
- };
- static const struct alpn_spec ALPN_SPEC_H2_H11 = {
- { ALPN_H2, ALPN_HTTP_1_1 }, 2
- };
- #endif
- static const struct alpn_spec *alpn_get_spec(int httpwant, bool use_alpn)
- {
- if(!use_alpn)
- return NULL;
- #ifdef USE_HTTP2
- if(httpwant == CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE)
- return &ALPN_SPEC_H2;
- if(httpwant >= CURL_HTTP_VERSION_2)
- return &ALPN_SPEC_H2_H11;
- #else
- (void)httpwant;
- #endif
-
- return &ALPN_SPEC_H11;
- }
- #endif
- void Curl_ssl_easy_config_init(struct Curl_easy *data)
- {
-
- data->set.ssl.primary.verifypeer = TRUE;
- data->set.ssl.primary.verifyhost = TRUE;
- data->set.ssl.primary.cache_session = TRUE;
- #ifndef CURL_DISABLE_PROXY
- data->set.proxy_ssl = data->set.ssl;
- #endif
- }
- static bool
- match_ssl_primary_config(struct Curl_easy *data,
- struct ssl_primary_config *c1,
- struct ssl_primary_config *c2)
- {
- (void)data;
- if((c1->version == c2->version) &&
- (c1->version_max == c2->version_max) &&
- (c1->ssl_options == c2->ssl_options) &&
- (c1->verifypeer == c2->verifypeer) &&
- (c1->verifyhost == c2->verifyhost) &&
- (c1->verifystatus == c2->verifystatus) &&
- blobcmp(c1->cert_blob, c2->cert_blob) &&
- blobcmp(c1->ca_info_blob, c2->ca_info_blob) &&
- blobcmp(c1->issuercert_blob, c2->issuercert_blob) &&
- Curl_safecmp(c1->CApath, c2->CApath) &&
- Curl_safecmp(c1->CAfile, c2->CAfile) &&
- Curl_safecmp(c1->issuercert, c2->issuercert) &&
- Curl_safecmp(c1->clientcert, c2->clientcert) &&
- #ifdef USE_TLS_SRP
- !Curl_timestrcmp(c1->username, c2->username) &&
- !Curl_timestrcmp(c1->password, c2->password) &&
- #endif
- strcasecompare(c1->cipher_list, c2->cipher_list) &&
- strcasecompare(c1->cipher_list13, c2->cipher_list13) &&
- strcasecompare(c1->curves, c2->curves) &&
- strcasecompare(c1->CRLfile, c2->CRLfile) &&
- strcasecompare(c1->pinned_key, c2->pinned_key))
- return TRUE;
- return FALSE;
- }
- bool Curl_ssl_conn_config_match(struct Curl_easy *data,
- struct connectdata *candidate,
- bool proxy)
- {
- #ifndef CURL_DISABLE_PROXY
- if(proxy)
- return match_ssl_primary_config(data, &data->set.proxy_ssl.primary,
- &candidate->proxy_ssl_config);
- #else
- (void)proxy;
- #endif
- return match_ssl_primary_config(data, &data->set.ssl.primary,
- &candidate->ssl_config);
- }
- static bool clone_ssl_primary_config(struct ssl_primary_config *source,
- struct ssl_primary_config *dest)
- {
- dest->version = source->version;
- dest->version_max = source->version_max;
- dest->verifypeer = source->verifypeer;
- dest->verifyhost = source->verifyhost;
- dest->verifystatus = source->verifystatus;
- dest->cache_session = source->cache_session;
- dest->ssl_options = source->ssl_options;
- CLONE_BLOB(cert_blob);
- CLONE_BLOB(ca_info_blob);
- CLONE_BLOB(issuercert_blob);
- CLONE_STRING(CApath);
- CLONE_STRING(CAfile);
- CLONE_STRING(issuercert);
- CLONE_STRING(clientcert);
- CLONE_STRING(cipher_list);
- CLONE_STRING(cipher_list13);
- CLONE_STRING(pinned_key);
- CLONE_STRING(curves);
- CLONE_STRING(CRLfile);
- #ifdef USE_TLS_SRP
- CLONE_STRING(username);
- CLONE_STRING(password);
- #endif
- return TRUE;
- }
- static void free_primary_ssl_config(struct ssl_primary_config *sslc)
- {
- Curl_safefree(sslc->CApath);
- Curl_safefree(sslc->CAfile);
- Curl_safefree(sslc->issuercert);
- Curl_safefree(sslc->clientcert);
- Curl_safefree(sslc->cipher_list);
- Curl_safefree(sslc->cipher_list13);
- Curl_safefree(sslc->pinned_key);
- Curl_safefree(sslc->cert_blob);
- Curl_safefree(sslc->ca_info_blob);
- Curl_safefree(sslc->issuercert_blob);
- Curl_safefree(sslc->curves);
- Curl_safefree(sslc->CRLfile);
- #ifdef USE_TLS_SRP
- Curl_safefree(sslc->username);
- Curl_safefree(sslc->password);
- #endif
- }
- CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
- {
- data->set.ssl.primary.CApath = data->set.str[STRING_SSL_CAPATH];
- data->set.ssl.primary.CAfile = data->set.str[STRING_SSL_CAFILE];
- data->set.ssl.primary.CRLfile = data->set.str[STRING_SSL_CRLFILE];
- data->set.ssl.primary.issuercert = data->set.str[STRING_SSL_ISSUERCERT];
- data->set.ssl.primary.issuercert_blob = data->set.blobs[BLOB_SSL_ISSUERCERT];
- data->set.ssl.primary.cipher_list =
- data->set.str[STRING_SSL_CIPHER_LIST];
- data->set.ssl.primary.cipher_list13 =
- data->set.str[STRING_SSL_CIPHER13_LIST];
- data->set.ssl.primary.pinned_key =
- data->set.str[STRING_SSL_PINNEDPUBLICKEY];
- data->set.ssl.primary.cert_blob = data->set.blobs[BLOB_CERT];
- data->set.ssl.primary.ca_info_blob = data->set.blobs[BLOB_CAINFO];
- data->set.ssl.primary.curves = data->set.str[STRING_SSL_EC_CURVES];
- #ifdef USE_TLS_SRP
- data->set.ssl.primary.username = data->set.str[STRING_TLSAUTH_USERNAME];
- data->set.ssl.primary.password = data->set.str[STRING_TLSAUTH_PASSWORD];
- #endif
- data->set.ssl.cert_type = data->set.str[STRING_CERT_TYPE];
- data->set.ssl.key = data->set.str[STRING_KEY];
- data->set.ssl.key_type = data->set.str[STRING_KEY_TYPE];
- data->set.ssl.key_passwd = data->set.str[STRING_KEY_PASSWD];
- data->set.ssl.primary.clientcert = data->set.str[STRING_CERT];
- data->set.ssl.key_blob = data->set.blobs[BLOB_KEY];
- #ifndef CURL_DISABLE_PROXY
- data->set.proxy_ssl.primary.CApath = data->set.str[STRING_SSL_CAPATH_PROXY];
- data->set.proxy_ssl.primary.CAfile = data->set.str[STRING_SSL_CAFILE_PROXY];
- data->set.proxy_ssl.primary.cipher_list =
- data->set.str[STRING_SSL_CIPHER_LIST_PROXY];
- data->set.proxy_ssl.primary.cipher_list13 =
- data->set.str[STRING_SSL_CIPHER13_LIST_PROXY];
- data->set.proxy_ssl.primary.pinned_key =
- data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY];
- data->set.proxy_ssl.primary.cert_blob = data->set.blobs[BLOB_CERT_PROXY];
- data->set.proxy_ssl.primary.ca_info_blob =
- data->set.blobs[BLOB_CAINFO_PROXY];
- data->set.proxy_ssl.primary.issuercert =
- data->set.str[STRING_SSL_ISSUERCERT_PROXY];
- data->set.proxy_ssl.primary.issuercert_blob =
- data->set.blobs[BLOB_SSL_ISSUERCERT_PROXY];
- data->set.proxy_ssl.primary.CRLfile =
- data->set.str[STRING_SSL_CRLFILE_PROXY];
- data->set.proxy_ssl.cert_type = data->set.str[STRING_CERT_TYPE_PROXY];
- data->set.proxy_ssl.key = data->set.str[STRING_KEY_PROXY];
- data->set.proxy_ssl.key_type = data->set.str[STRING_KEY_TYPE_PROXY];
- data->set.proxy_ssl.key_passwd = data->set.str[STRING_KEY_PASSWD_PROXY];
- data->set.proxy_ssl.primary.clientcert = data->set.str[STRING_CERT_PROXY];
- data->set.proxy_ssl.key_blob = data->set.blobs[BLOB_KEY_PROXY];
- #ifdef USE_TLS_SRP
- data->set.proxy_ssl.primary.username =
- data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
- data->set.proxy_ssl.primary.password =
- data->set.str[STRING_TLSAUTH_PASSWORD_PROXY];
- #endif
- #endif
- return CURLE_OK;
- }
- CURLcode Curl_ssl_conn_config_init(struct Curl_easy *data,
- struct connectdata *conn)
- {
-
- if(!clone_ssl_primary_config(&data->set.ssl.primary, &conn->ssl_config))
- return CURLE_OUT_OF_MEMORY;
- #ifndef CURL_DISABLE_PROXY
- if(!clone_ssl_primary_config(&data->set.proxy_ssl.primary,
- &conn->proxy_ssl_config))
- return CURLE_OUT_OF_MEMORY;
- #endif
- return CURLE_OK;
- }
- void Curl_ssl_conn_config_cleanup(struct connectdata *conn)
- {
- free_primary_ssl_config(&conn->ssl_config);
- #ifndef CURL_DISABLE_PROXY
- free_primary_ssl_config(&conn->proxy_ssl_config);
- #endif
- }
- void Curl_ssl_conn_config_update(struct Curl_easy *data, bool for_proxy)
- {
-
- if(data->conn) {
- struct ssl_primary_config *src, *dest;
- #ifndef CURL_DISABLE_PROXY
- src = for_proxy ? &data->set.proxy_ssl.primary : &data->set.ssl.primary;
- dest = for_proxy ? &data->conn->proxy_ssl_config : &data->conn->ssl_config;
- #else
- (void)for_proxy;
- src = &data->set.ssl.primary;
- dest = &data->conn->ssl_config;
- #endif
- dest->verifyhost = src->verifyhost;
- dest->verifypeer = src->verifypeer;
- dest->verifystatus = src->verifystatus;
- }
- }
- #ifdef USE_SSL
- static int multissl_setup(const struct Curl_ssl *backend);
- #endif
- curl_sslbackend Curl_ssl_backend(void)
- {
- #ifdef USE_SSL
- multissl_setup(NULL);
- return Curl_ssl->info.id;
- #else
- return CURLSSLBACKEND_NONE;
- #endif
- }
- #ifdef USE_SSL
- static bool init_ssl = FALSE;
- int Curl_ssl_init(void)
- {
-
- if(init_ssl)
- return 1;
- init_ssl = TRUE;
- return Curl_ssl->init();
- }
- static bool ssl_prefs_check(struct Curl_easy *data)
- {
-
- const unsigned char sslver = data->set.ssl.primary.version;
- if(sslver >= CURL_SSLVERSION_LAST) {
- failf(data, "Unrecognized parameter value passed via CURLOPT_SSLVERSION");
- return FALSE;
- }
- switch(data->set.ssl.primary.version_max) {
- case CURL_SSLVERSION_MAX_NONE:
- case CURL_SSLVERSION_MAX_DEFAULT:
- break;
- default:
- if((data->set.ssl.primary.version_max >> 16) < sslver) {
- failf(data, "CURL_SSLVERSION_MAX incompatible with CURL_SSLVERSION");
- return FALSE;
- }
- }
- return TRUE;
- }
- static struct ssl_connect_data *cf_ctx_new(struct Curl_easy *data,
- const struct alpn_spec *alpn)
- {
- struct ssl_connect_data *ctx;
- (void)data;
- ctx = calloc(1, sizeof(*ctx));
- if(!ctx)
- return NULL;
- ctx->alpn = alpn;
- Curl_bufq_init2(&ctx->earlydata, CURL_SSL_EARLY_MAX, 1, BUFQ_OPT_NO_SPARES);
- ctx->backend = calloc(1, Curl_ssl->sizeof_ssl_backend_data);
- if(!ctx->backend) {
- free(ctx);
- return NULL;
- }
- return ctx;
- }
- static void cf_ctx_free(struct ssl_connect_data *ctx)
- {
- if(ctx) {
- Curl_safefree(ctx->alpn_negotiated);
- Curl_bufq_free(&ctx->earlydata);
- free(ctx->backend);
- free(ctx);
- }
- }
- static CURLcode ssl_connect(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- CURLcode result;
- if(!ssl_prefs_check(data))
- return CURLE_SSL_CONNECT_ERROR;
-
- connssl->state = ssl_connection_negotiating;
- result = Curl_ssl->connect_blocking(cf, data);
- if(!result) {
- DEBUGASSERT(connssl->state == ssl_connection_complete);
- }
- return result;
- }
- static CURLcode
- ssl_connect_nonblocking(struct Curl_cfilter *cf, struct Curl_easy *data,
- bool *done)
- {
- if(!ssl_prefs_check(data))
- return CURLE_SSL_CONNECT_ERROR;
-
- return Curl_ssl->connect_nonblocking(cf, data, done);
- }
- void Curl_ssl_sessionid_lock(struct Curl_easy *data)
- {
- if(SSLSESSION_SHARED(data))
- Curl_share_lock(data, CURL_LOCK_DATA_SSL_SESSION, CURL_LOCK_ACCESS_SINGLE);
- }
- void Curl_ssl_sessionid_unlock(struct Curl_easy *data)
- {
- if(SSLSESSION_SHARED(data))
- Curl_share_unlock(data, CURL_LOCK_DATA_SSL_SESSION);
- }
- bool Curl_ssl_getsessionid(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- const struct ssl_peer *peer,
- void **ssl_sessionid,
- size_t *idsize,
- char **palpn)
- {
- struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
- struct Curl_ssl_session *check;
- size_t i;
- long *general_age;
- bool no_match = TRUE;
- *ssl_sessionid = NULL;
- if(palpn)
- *palpn = NULL;
- if(!ssl_config)
- return TRUE;
- DEBUGASSERT(ssl_config->primary.cache_session);
- if(!ssl_config->primary.cache_session || !data->state.session)
-
- return TRUE;
-
- if(SSLSESSION_SHARED(data))
- general_age = &data->share->sessionage;
- else
- general_age = &data->state.sessionage;
- for(i = 0; i < data->set.general_ssl.max_ssl_sessions; i++) {
- check = &data->state.session[i];
- if(!check->sessionid)
-
- continue;
- if(strcasecompare(peer->hostname, check->name) &&
- ((!cf->conn->bits.conn_to_host && !check->conn_to_host) ||
- (cf->conn->bits.conn_to_host && check->conn_to_host &&
- strcasecompare(cf->conn->conn_to_host.name, check->conn_to_host))) &&
- ((!cf->conn->bits.conn_to_port && check->conn_to_port == -1) ||
- (cf->conn->bits.conn_to_port && check->conn_to_port != -1 &&
- cf->conn->conn_to_port == check->conn_to_port)) &&
- (peer->port == check->remote_port) &&
- (peer->transport == check->transport) &&
- strcasecompare(cf->conn->handler->scheme, check->scheme) &&
- match_ssl_primary_config(data, conn_config, &check->ssl_config)) {
-
- (*general_age)++;
- check->age = *general_age;
- *ssl_sessionid = check->sessionid;
- if(idsize)
- *idsize = check->idsize;
- if(palpn)
- *palpn = check->alpn;
- no_match = FALSE;
- break;
- }
- }
- CURL_TRC_CF(data, cf, "%s cached session ID for %s://%s:%d",
- no_match ? "No" : "Found",
- cf->conn->handler->scheme, peer->hostname, peer->port);
- return no_match;
- }
- void Curl_ssl_kill_session(struct Curl_ssl_session *session)
- {
- if(session->sessionid) {
-
-
- session->sessionid_free(session->sessionid, session->idsize);
- session->sessionid = NULL;
- session->sessionid_free = NULL;
- session->age = 0;
- free_primary_ssl_config(&session->ssl_config);
- Curl_safefree(session->name);
- Curl_safefree(session->conn_to_host);
- Curl_safefree(session->alpn);
- }
- }
- void Curl_ssl_delsessionid(struct Curl_easy *data, void *ssl_sessionid)
- {
- size_t i;
- for(i = 0; i < data->set.general_ssl.max_ssl_sessions; i++) {
- struct Curl_ssl_session *check = &data->state.session[i];
- if(check->sessionid == ssl_sessionid) {
- Curl_ssl_kill_session(check);
- break;
- }
- }
- }
- CURLcode Curl_ssl_set_sessionid(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- const struct ssl_peer *peer,
- const char *alpn,
- void *ssl_sessionid,
- size_t idsize,
- Curl_ssl_sessionid_dtor *sessionid_free_cb)
- {
- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
- struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
- size_t i;
- struct Curl_ssl_session *store;
- long oldest_age;
- char *clone_host = NULL;
- char *clone_conn_to_host = NULL;
- char *clone_alpn = NULL;
- int conn_to_port;
- long *general_age;
- void *old_sessionid;
- size_t old_size;
- CURLcode result = CURLE_OUT_OF_MEMORY;
- DEBUGASSERT(ssl_sessionid);
- DEBUGASSERT(sessionid_free_cb);
- if(!data->state.session) {
- sessionid_free_cb(ssl_sessionid, idsize);
- return CURLE_OK;
- }
- if(!Curl_ssl_getsessionid(cf, data, peer, &old_sessionid, &old_size, NULL)) {
- if((old_size == idsize) &&
- ((old_sessionid == ssl_sessionid) ||
- (idsize && !memcmp(old_sessionid, ssl_sessionid, idsize)))) {
-
- sessionid_free_cb(ssl_sessionid, idsize);
- return CURLE_OK;
- }
- Curl_ssl_delsessionid(data, old_sessionid);
- }
- store = &data->state.session[0];
- oldest_age = data->state.session[0].age;
- DEBUGASSERT(ssl_config->primary.cache_session);
- (void)ssl_config;
- clone_host = strdup(peer->hostname);
- if(!clone_host)
- goto out;
- if(cf->conn->bits.conn_to_host) {
- clone_conn_to_host = strdup(cf->conn->conn_to_host.name);
- if(!clone_conn_to_host)
- goto out;
- }
- clone_alpn = alpn ? strdup(alpn) : NULL;
- if(alpn && !clone_alpn)
- goto out;
- if(cf->conn->bits.conn_to_port)
- conn_to_port = cf->conn->conn_to_port;
- else
- conn_to_port = -1;
-
-
- if(SSLSESSION_SHARED(data)) {
- general_age = &data->share->sessionage;
- }
- else {
- general_age = &data->state.sessionage;
- }
-
- for(i = 1; (i < data->set.general_ssl.max_ssl_sessions) &&
- data->state.session[i].sessionid; i++) {
- if(data->state.session[i].age < oldest_age) {
- oldest_age = data->state.session[i].age;
- store = &data->state.session[i];
- }
- }
- if(i == data->set.general_ssl.max_ssl_sessions)
-
- Curl_ssl_kill_session(store);
- else
- store = &data->state.session[i];
-
- if(!clone_ssl_primary_config(conn_config, &store->ssl_config)) {
- free_primary_ssl_config(&store->ssl_config);
- store->sessionid = NULL;
- goto out;
- }
- store->sessionid = ssl_sessionid;
- store->idsize = idsize;
- store->sessionid_free = sessionid_free_cb;
- store->age = *general_age;
-
- free(store->name);
- free(store->conn_to_host);
- store->name = clone_host;
- clone_host = NULL;
- store->conn_to_host = clone_conn_to_host;
- clone_conn_to_host = NULL;
- store->conn_to_port = conn_to_port;
- store->alpn = clone_alpn;
- clone_alpn = NULL;
-
- store->remote_port = peer->port;
- store->scheme = cf->conn->handler->scheme;
- store->transport = peer->transport;
- result = CURLE_OK;
- out:
- free(clone_host);
- free(clone_conn_to_host);
- free(clone_alpn);
- if(result) {
- failf(data, "Failed to add Session ID to cache for %s://%s:%d [%s]",
- store->scheme, store->name, store->remote_port,
- Curl_ssl_cf_is_proxy(cf) ? "PROXY" : "server");
- sessionid_free_cb(ssl_sessionid, idsize);
- return result;
- }
- CURL_TRC_CF(data, cf, "Added Session ID to cache for %s://%s:%d [%s]",
- store->scheme, store->name, store->remote_port,
- Curl_ssl_cf_is_proxy(cf) ? "PROXY" : "server");
- return CURLE_OK;
- }
- CURLcode Curl_ssl_get_channel_binding(struct Curl_easy *data, int sockindex,
- struct dynbuf *binding)
- {
- if(Curl_ssl->get_channel_binding)
- return Curl_ssl->get_channel_binding(data, sockindex, binding);
- return CURLE_OK;
- }
- void Curl_ssl_close_all(struct Curl_easy *data)
- {
-
- if(data->state.session && !SSLSESSION_SHARED(data)) {
- size_t i;
- for(i = 0; i < data->set.general_ssl.max_ssl_sessions; i++)
-
- Curl_ssl_kill_session(&data->state.session[i]);
-
- Curl_safefree(data->state.session);
- }
- Curl_ssl->close_all(data);
- }
- void Curl_ssl_adjust_pollset(struct Curl_cfilter *cf, struct Curl_easy *data,
- struct easy_pollset *ps)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- if(connssl->io_need) {
- curl_socket_t sock = Curl_conn_cf_get_socket(cf->next, data);
- if(sock != CURL_SOCKET_BAD) {
- if(connssl->io_need & CURL_SSL_IO_NEED_SEND) {
- Curl_pollset_set_out_only(data, ps, sock);
- CURL_TRC_CF(data, cf, "adjust_pollset, POLLOUT fd=%" FMT_SOCKET_T,
- sock);
- }
- else {
- Curl_pollset_set_in_only(data, ps, sock);
- CURL_TRC_CF(data, cf, "adjust_pollset, POLLIN fd=%" FMT_SOCKET_T,
- sock);
- }
- }
- }
- }
- CURLcode Curl_ssl_set_engine(struct Curl_easy *data, const char *engine)
- {
- return Curl_ssl->set_engine(data, engine);
- }
- CURLcode Curl_ssl_set_engine_default(struct Curl_easy *data)
- {
- return Curl_ssl->set_engine_default(data);
- }
- struct curl_slist *Curl_ssl_engines_list(struct Curl_easy *data)
- {
- return Curl_ssl->engines_list(data);
- }
- CURLcode Curl_ssl_initsessions(struct Curl_easy *data, size_t amount)
- {
- struct Curl_ssl_session *session;
- if(data->state.session)
-
- return CURLE_OK;
- session = calloc(amount, sizeof(struct Curl_ssl_session));
- if(!session)
- return CURLE_OUT_OF_MEMORY;
-
- data->set.general_ssl.max_ssl_sessions = amount;
- data->state.session = session;
- data->state.sessionage = 1;
- return CURLE_OK;
- }
- static size_t multissl_version(char *buffer, size_t size);
- void Curl_ssl_version(char *buffer, size_t size)
- {
- #ifdef CURL_WITH_MULTI_SSL
- (void)multissl_version(buffer, size);
- #else
- (void)Curl_ssl->version(buffer, size);
- #endif
- }
- void Curl_ssl_free_certinfo(struct Curl_easy *data)
- {
- struct curl_certinfo *ci = &data->info.certs;
- if(ci->num_of_certs) {
-
- int i;
- for(i = 0; i < ci->num_of_certs; i++) {
- curl_slist_free_all(ci->certinfo[i]);
- ci->certinfo[i] = NULL;
- }
- free(ci->certinfo);
- ci->certinfo = NULL;
- ci->num_of_certs = 0;
- }
- }
- CURLcode Curl_ssl_init_certinfo(struct Curl_easy *data, int num)
- {
- struct curl_certinfo *ci = &data->info.certs;
- struct curl_slist **table;
-
- Curl_ssl_free_certinfo(data);
-
- table = calloc((size_t) num, sizeof(struct curl_slist *));
- if(!table)
- return CURLE_OUT_OF_MEMORY;
- ci->num_of_certs = num;
- ci->certinfo = table;
- return CURLE_OK;
- }
- CURLcode Curl_ssl_push_certinfo_len(struct Curl_easy *data,
- int certnum,
- const char *label,
- const char *value,
- size_t valuelen)
- {
- struct curl_certinfo *ci = &data->info.certs;
- struct curl_slist *nl;
- CURLcode result = CURLE_OK;
- struct dynbuf build;
- DEBUGASSERT(certnum < ci->num_of_certs);
- Curl_dyn_init(&build, CURL_X509_STR_MAX);
- if(Curl_dyn_add(&build, label) ||
- Curl_dyn_addn(&build, ":", 1) ||
- Curl_dyn_addn(&build, value, valuelen))
- return CURLE_OUT_OF_MEMORY;
- nl = Curl_slist_append_nodup(ci->certinfo[certnum],
- Curl_dyn_ptr(&build));
- if(!nl) {
- Curl_dyn_free(&build);
- curl_slist_free_all(ci->certinfo[certnum]);
- result = CURLE_OUT_OF_MEMORY;
- }
- ci->certinfo[certnum] = nl;
- return result;
- }
- CURLcode Curl_ssl_random(struct Curl_easy *data,
- unsigned char *entropy,
- size_t length)
- {
- DEBUGASSERT(length == sizeof(int));
- if(Curl_ssl->random)
- return Curl_ssl->random(data, entropy, length);
- else
- return CURLE_NOT_BUILT_IN;
- }
- static CURLcode pubkey_pem_to_der(const char *pem,
- unsigned char **der, size_t *der_len)
- {
- char *begin_pos, *end_pos;
- size_t pem_count, pem_len;
- CURLcode result;
- struct dynbuf pbuf;
-
- if(!pem)
- return CURLE_BAD_CONTENT_ENCODING;
- Curl_dyn_init(&pbuf, MAX_PINNED_PUBKEY_SIZE);
- begin_pos = strstr(pem, "-----BEGIN PUBLIC KEY-----");
- if(!begin_pos)
- return CURLE_BAD_CONTENT_ENCODING;
- pem_count = begin_pos - pem;
-
- if(0 != pem_count && '\n' != pem[pem_count - 1])
- return CURLE_BAD_CONTENT_ENCODING;
-
- pem_count += 26;
-
- end_pos = strstr(pem + pem_count, "\n-----END PUBLIC KEY-----");
- if(!end_pos)
- return CURLE_BAD_CONTENT_ENCODING;
- pem_len = end_pos - pem;
-
- while(pem_count < pem_len) {
- if('\n' != pem[pem_count] && '\r' != pem[pem_count]) {
- result = Curl_dyn_addn(&pbuf, &pem[pem_count], 1);
- if(result)
- return result;
- }
- ++pem_count;
- }
- result = Curl_base64_decode(Curl_dyn_ptr(&pbuf), der, der_len);
- Curl_dyn_free(&pbuf);
- return result;
- }
- CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data,
- const char *pinnedpubkey,
- const unsigned char *pubkey, size_t pubkeylen)
- {
- CURLcode result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
- #ifdef CURL_DISABLE_VERBOSE_STRINGS
- (void)data;
- #endif
-
- if(!pinnedpubkey)
- return CURLE_OK;
- if(!pubkey || !pubkeylen)
- return result;
-
- if(!strncmp(pinnedpubkey, "sha256//", 8)) {
- CURLcode encode;
- size_t encodedlen = 0;
- char *encoded = NULL, *pinkeycopy, *begin_pos, *end_pos;
- unsigned char *sha256sumdigest;
- if(!Curl_ssl->sha256sum) {
-
- return result;
- }
-
- sha256sumdigest = malloc(CURL_SHA256_DIGEST_LENGTH);
- if(!sha256sumdigest)
- return CURLE_OUT_OF_MEMORY;
- encode = Curl_ssl->sha256sum(pubkey, pubkeylen,
- sha256sumdigest, CURL_SHA256_DIGEST_LENGTH);
- if(!encode)
- encode = Curl_base64_encode((char *)sha256sumdigest,
- CURL_SHA256_DIGEST_LENGTH, &encoded,
- &encodedlen);
- Curl_safefree(sha256sumdigest);
- if(encode)
- return encode;
- infof(data, " public key hash: sha256//%s", encoded);
-
- pinkeycopy = strdup(pinnedpubkey);
- if(!pinkeycopy) {
- Curl_safefree(encoded);
- return CURLE_OUT_OF_MEMORY;
- }
-
- begin_pos = pinkeycopy;
- do {
- end_pos = strstr(begin_pos, ";sha256//");
-
- if(end_pos)
- end_pos[0] = '\0';
-
- if(encodedlen == strlen(begin_pos + 8) &&
- !memcmp(encoded, begin_pos + 8, encodedlen)) {
- result = CURLE_OK;
- break;
- }
-
- if(end_pos) {
- end_pos[0] = ';';
- begin_pos = strstr(end_pos, "sha256//");
- }
- } while(end_pos && begin_pos);
- Curl_safefree(encoded);
- Curl_safefree(pinkeycopy);
- }
- else {
- long filesize;
- size_t size, pem_len;
- CURLcode pem_read;
- struct dynbuf buf;
- char unsigned *pem_ptr = NULL;
- size_t left;
- FILE *fp = fopen(pinnedpubkey, "rb");
- if(!fp)
- return result;
- Curl_dyn_init(&buf, MAX_PINNED_PUBKEY_SIZE);
-
- if(fseek(fp, 0, SEEK_END))
- goto end;
- filesize = ftell(fp);
- if(fseek(fp, 0, SEEK_SET))
- goto end;
- if(filesize < 0 || filesize > MAX_PINNED_PUBKEY_SIZE)
- goto end;
-
- size = curlx_sotouz((curl_off_t) filesize);
- if(pubkeylen > size)
- goto end;
-
- left = size;
- do {
- char buffer[1024];
- size_t want = left > sizeof(buffer) ? sizeof(buffer) : left;
- if(want != fread(buffer, 1, want, fp))
- goto end;
- if(Curl_dyn_addn(&buf, buffer, want))
- goto end;
- left -= want;
- } while(left);
-
- if(pubkeylen == size) {
- if(!memcmp(pubkey, Curl_dyn_ptr(&buf), pubkeylen))
- result = CURLE_OK;
- goto end;
- }
-
- pem_read = pubkey_pem_to_der(Curl_dyn_ptr(&buf), &pem_ptr, &pem_len);
-
- if(pem_read)
- goto end;
-
- if(pubkeylen == pem_len && !memcmp(pubkey, pem_ptr, pubkeylen))
- result = CURLE_OK;
- end:
- Curl_dyn_free(&buf);
- Curl_safefree(pem_ptr);
- fclose(fp);
- }
- return result;
- }
- bool Curl_ssl_cert_status_request(void)
- {
- return Curl_ssl->cert_status_request();
- }
- bool Curl_ssl_false_start(struct Curl_easy *data)
- {
- (void)data;
- return Curl_ssl->false_start();
- }
- int Curl_none_init(void)
- {
- return 1;
- }
- void Curl_none_cleanup(void)
- { }
- CURLcode Curl_none_shutdown(struct Curl_cfilter *cf UNUSED_PARAM,
- struct Curl_easy *data UNUSED_PARAM,
- bool send_shutdown UNUSED_PARAM,
- bool *done)
- {
- (void)data;
- (void)cf;
- (void)send_shutdown;
-
- *done = TRUE;
- return CURLE_OK;
- }
- int Curl_none_check_cxn(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- (void)cf;
- (void)data;
- return -1;
- }
- void Curl_none_close_all(struct Curl_easy *data UNUSED_PARAM)
- {
- (void)data;
- }
- void Curl_none_session_free(void *ptr UNUSED_PARAM)
- {
- (void)ptr;
- }
- bool Curl_none_data_pending(struct Curl_cfilter *cf UNUSED_PARAM,
- const struct Curl_easy *data UNUSED_PARAM)
- {
- (void)cf;
- (void)data;
- return 0;
- }
- bool Curl_none_cert_status_request(void)
- {
- return FALSE;
- }
- CURLcode Curl_none_set_engine(struct Curl_easy *data UNUSED_PARAM,
- const char *engine UNUSED_PARAM)
- {
- (void)data;
- (void)engine;
- return CURLE_NOT_BUILT_IN;
- }
- CURLcode Curl_none_set_engine_default(struct Curl_easy *data UNUSED_PARAM)
- {
- (void)data;
- return CURLE_NOT_BUILT_IN;
- }
- struct curl_slist *Curl_none_engines_list(struct Curl_easy *data UNUSED_PARAM)
- {
- (void)data;
- return (struct curl_slist *)NULL;
- }
- bool Curl_none_false_start(void)
- {
- return FALSE;
- }
- static int multissl_init(void)
- {
- if(multissl_setup(NULL))
- return 1;
- return Curl_ssl->init();
- }
- static CURLcode multissl_connect(struct Curl_cfilter *cf,
- struct Curl_easy *data)
- {
- if(multissl_setup(NULL))
- return CURLE_FAILED_INIT;
- return Curl_ssl->connect_blocking(cf, data);
- }
- static CURLcode multissl_connect_nonblocking(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- bool *done)
- {
- if(multissl_setup(NULL))
- return CURLE_FAILED_INIT;
- return Curl_ssl->connect_nonblocking(cf, data, done);
- }
- static void multissl_adjust_pollset(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- struct easy_pollset *ps)
- {
- if(multissl_setup(NULL))
- return;
- Curl_ssl->adjust_pollset(cf, data, ps);
- }
- static void *multissl_get_internals(struct ssl_connect_data *connssl,
- CURLINFO info)
- {
- if(multissl_setup(NULL))
- return NULL;
- return Curl_ssl->get_internals(connssl, info);
- }
- static void multissl_close(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- if(multissl_setup(NULL))
- return;
- Curl_ssl->close(cf, data);
- }
- static ssize_t multissl_recv_plain(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- char *buf, size_t len, CURLcode *code)
- {
- if(multissl_setup(NULL))
- return CURLE_FAILED_INIT;
- return Curl_ssl->recv_plain(cf, data, buf, len, code);
- }
- static ssize_t multissl_send_plain(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- const void *mem, size_t len,
- CURLcode *code)
- {
- if(multissl_setup(NULL))
- return CURLE_FAILED_INIT;
- return Curl_ssl->send_plain(cf, data, mem, len, code);
- }
- static const struct Curl_ssl Curl_ssl_multi = {
- { CURLSSLBACKEND_NONE, "multi" },
- 0,
- (size_t)-1,
- multissl_init,
- Curl_none_cleanup,
- multissl_version,
- Curl_none_check_cxn,
- Curl_none_shutdown,
- Curl_none_data_pending,
- NULL,
- Curl_none_cert_status_request,
- multissl_connect,
- multissl_connect_nonblocking,
- multissl_adjust_pollset,
- multissl_get_internals,
- multissl_close,
- Curl_none_close_all,
- Curl_none_set_engine,
- Curl_none_set_engine_default,
- Curl_none_engines_list,
- Curl_none_false_start,
- NULL,
- NULL,
- NULL,
- multissl_recv_plain,
- multissl_send_plain,
- NULL,
- };
- const struct Curl_ssl *Curl_ssl =
- #if defined(CURL_WITH_MULTI_SSL)
- &Curl_ssl_multi;
- #elif defined(USE_WOLFSSL)
- &Curl_ssl_wolfssl;
- #elif defined(USE_GNUTLS)
- &Curl_ssl_gnutls;
- #elif defined(USE_MBEDTLS)
- &Curl_ssl_mbedtls;
- #elif defined(USE_RUSTLS)
- &Curl_ssl_rustls;
- #elif defined(USE_OPENSSL)
- &Curl_ssl_openssl;
- #elif defined(USE_SECTRANSP)
- &Curl_ssl_sectransp;
- #elif defined(USE_SCHANNEL)
- &Curl_ssl_schannel;
- #elif defined(USE_BEARSSL)
- &Curl_ssl_bearssl;
- #else
- #error "Missing struct Curl_ssl for selected SSL backend"
- #endif
- static const struct Curl_ssl *available_backends[] = {
- #if defined(USE_WOLFSSL)
- &Curl_ssl_wolfssl,
- #endif
- #if defined(USE_GNUTLS)
- &Curl_ssl_gnutls,
- #endif
- #if defined(USE_MBEDTLS)
- &Curl_ssl_mbedtls,
- #endif
- #if defined(USE_OPENSSL)
- &Curl_ssl_openssl,
- #endif
- #if defined(USE_SECTRANSP)
- &Curl_ssl_sectransp,
- #endif
- #if defined(USE_SCHANNEL)
- &Curl_ssl_schannel,
- #endif
- #if defined(USE_BEARSSL)
- &Curl_ssl_bearssl,
- #endif
- #if defined(USE_RUSTLS)
- &Curl_ssl_rustls,
- #endif
- NULL
- };
- void Curl_ssl_cleanup(void)
- {
- if(init_ssl) {
-
- Curl_ssl->cleanup();
- #if defined(CURL_WITH_MULTI_SSL)
- Curl_ssl = &Curl_ssl_multi;
- #endif
- init_ssl = FALSE;
- }
- }
- static size_t multissl_version(char *buffer, size_t size)
- {
- static const struct Curl_ssl *selected;
- static char backends[200];
- static size_t backends_len;
- const struct Curl_ssl *current;
- current = Curl_ssl == &Curl_ssl_multi ? available_backends[0] : Curl_ssl;
- if(current != selected) {
- char *p = backends;
- char *end = backends + sizeof(backends);
- int i;
- selected = current;
- backends[0] = '\0';
- for(i = 0; available_backends[i]; ++i) {
- char vb[200];
- bool paren = (selected != available_backends[i]);
- if(available_backends[i]->version(vb, sizeof(vb))) {
- p += msnprintf(p, end - p, "%s%s%s%s", (p != backends ? " " : ""),
- (paren ? "(" : ""), vb, (paren ? ")" : ""));
- }
- }
- backends_len = p - backends;
- }
- if(size) {
- if(backends_len < size)
- strcpy(buffer, backends);
- else
- *buffer = 0;
- }
- return 0;
- }
- static int multissl_setup(const struct Curl_ssl *backend)
- {
- const char *env;
- char *env_tmp;
- if(Curl_ssl != &Curl_ssl_multi)
- return 1;
- if(backend) {
- Curl_ssl = backend;
- return 0;
- }
- if(!available_backends[0])
- return 1;
- env = env_tmp = curl_getenv("CURL_SSL_BACKEND");
- #ifdef CURL_DEFAULT_SSL_BACKEND
- if(!env)
- env = CURL_DEFAULT_SSL_BACKEND;
- #endif
- if(env) {
- int i;
- for(i = 0; available_backends[i]; i++) {
- if(strcasecompare(env, available_backends[i]->info.name)) {
- Curl_ssl = available_backends[i];
- free(env_tmp);
- return 0;
- }
- }
- }
-
- Curl_ssl = available_backends[0];
- free(env_tmp);
- return 0;
- }
- CURLsslset Curl_init_sslset_nolock(curl_sslbackend id, const char *name,
- const curl_ssl_backend ***avail)
- {
- int i;
- if(avail)
- *avail = (const curl_ssl_backend **)&available_backends;
- if(Curl_ssl != &Curl_ssl_multi)
- return id == Curl_ssl->info.id ||
- (name && strcasecompare(name, Curl_ssl->info.name)) ?
- CURLSSLSET_OK :
- #if defined(CURL_WITH_MULTI_SSL)
- CURLSSLSET_TOO_LATE;
- #else
- CURLSSLSET_UNKNOWN_BACKEND;
- #endif
- for(i = 0; available_backends[i]; i++) {
- if(available_backends[i]->info.id == id ||
- (name && strcasecompare(available_backends[i]->info.name, name))) {
- multissl_setup(available_backends[i]);
- return CURLSSLSET_OK;
- }
- }
- return CURLSSLSET_UNKNOWN_BACKEND;
- }
- #else
- CURLsslset Curl_init_sslset_nolock(curl_sslbackend id, const char *name,
- const curl_ssl_backend ***avail)
- {
- (void)id;
- (void)name;
- (void)avail;
- return CURLSSLSET_NO_BACKENDS;
- }
- #endif
- #ifdef USE_SSL
- void Curl_ssl_peer_cleanup(struct ssl_peer *peer)
- {
- if(peer->dispname != peer->hostname)
- free(peer->dispname);
- free(peer->sni);
- free(peer->hostname);
- peer->hostname = peer->sni = peer->dispname = NULL;
- peer->type = CURL_SSL_PEER_DNS;
- }
- static void cf_close(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- if(connssl) {
- Curl_ssl->close(cf, data);
- connssl->state = ssl_connection_none;
- Curl_ssl_peer_cleanup(&connssl->peer);
- }
- cf->connected = FALSE;
- }
- static ssl_peer_type get_peer_type(const char *hostname)
- {
- if(hostname && hostname[0]) {
- #ifdef USE_IPV6
- struct in6_addr addr;
- #else
- struct in_addr addr;
- #endif
- if(Curl_inet_pton(AF_INET, hostname, &addr))
- return CURL_SSL_PEER_IPV4;
- #ifdef USE_IPV6
- else if(Curl_inet_pton(AF_INET6, hostname, &addr)) {
- return CURL_SSL_PEER_IPV6;
- }
- #endif
- }
- return CURL_SSL_PEER_DNS;
- }
- CURLcode Curl_ssl_peer_init(struct ssl_peer *peer, struct Curl_cfilter *cf,
- int transport)
- {
- const char *ehostname, *edispname;
- CURLcode result = CURLE_OUT_OF_MEMORY;
-
- DEBUGASSERT(peer);
- DEBUGASSERT(!peer->hostname);
- DEBUGASSERT(!peer->dispname);
- DEBUGASSERT(!peer->sni);
-
- peer->transport = transport;
- #ifndef CURL_DISABLE_PROXY
- if(Curl_ssl_cf_is_proxy(cf)) {
- ehostname = cf->conn->http_proxy.host.name;
- edispname = cf->conn->http_proxy.host.dispname;
- peer->port = cf->conn->http_proxy.port;
- }
- else
- #endif
- {
- ehostname = cf->conn->host.name;
- edispname = cf->conn->host.dispname;
- peer->port = cf->conn->remote_port;
- }
-
- if(!ehostname || !ehostname[0]) {
- result = CURLE_FAILED_INIT;
- goto out;
- }
- peer->hostname = strdup(ehostname);
- if(!peer->hostname)
- goto out;
- if(!edispname || !strcmp(ehostname, edispname))
- peer->dispname = peer->hostname;
- else {
- peer->dispname = strdup(edispname);
- if(!peer->dispname)
- goto out;
- }
- peer->type = get_peer_type(peer->hostname);
- if(peer->type == CURL_SSL_PEER_DNS) {
-
- size_t len = strlen(peer->hostname);
- if(len && (peer->hostname[len-1] == '.'))
- len--;
- if(len < USHRT_MAX) {
- peer->sni = calloc(1, len + 1);
- if(!peer->sni)
- goto out;
- Curl_strntolower(peer->sni, peer->hostname, len);
- peer->sni[len] = 0;
- }
- }
- result = CURLE_OK;
- out:
- if(result)
- Curl_ssl_peer_cleanup(peer);
- return result;
- }
- static void ssl_cf_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- struct cf_call_data save;
- CF_DATA_SAVE(save, cf, data);
- cf_close(cf, data);
- CF_DATA_RESTORE(cf, save);
- cf_ctx_free(cf->ctx);
- cf->ctx = NULL;
- }
- static void ssl_cf_close(struct Curl_cfilter *cf,
- struct Curl_easy *data)
- {
- struct cf_call_data save;
- CF_DATA_SAVE(save, cf, data);
- cf_close(cf, data);
- if(cf->next)
- cf->next->cft->do_close(cf->next, data);
- CF_DATA_RESTORE(cf, save);
- }
- static CURLcode ssl_cf_connect(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- bool blocking, bool *done)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- struct cf_call_data save;
- CURLcode result;
- if(cf->connected) {
- *done = TRUE;
- return CURLE_OK;
- }
- if(!cf->next) {
- *done = FALSE;
- return CURLE_FAILED_INIT;
- }
- if(!cf->next->connected) {
- result = cf->next->cft->do_connect(cf->next, data, blocking, done);
- if(result || !*done)
- return result;
- }
- CF_DATA_SAVE(save, cf, data);
- CURL_TRC_CF(data, cf, "cf_connect()");
- DEBUGASSERT(data->conn);
- DEBUGASSERT(data->conn == cf->conn);
- DEBUGASSERT(connssl);
- *done = FALSE;
- if(!connssl->peer.hostname) {
- result = Curl_ssl_peer_init(&connssl->peer, cf, TRNSPRT_TCP);
- if(result)
- goto out;
- }
- if(blocking) {
- result = ssl_connect(cf, data);
- *done = (result == CURLE_OK);
- }
- else {
- result = ssl_connect_nonblocking(cf, data, done);
- }
- if(!result && *done) {
- cf->connected = TRUE;
- connssl->handshake_done = Curl_now();
-
- DEBUGASSERT(connssl->state == ssl_connection_complete ||
- connssl->state == ssl_connection_deferred);
- }
- out:
- CURL_TRC_CF(data, cf, "cf_connect() -> %d, done=%d", result, *done);
- CF_DATA_RESTORE(cf, save);
- return result;
- }
- static bool ssl_cf_data_pending(struct Curl_cfilter *cf,
- const struct Curl_easy *data)
- {
- struct cf_call_data save;
- bool result;
- CF_DATA_SAVE(save, cf, data);
- if(Curl_ssl->data_pending(cf, data))
- result = TRUE;
- else
- result = cf->next->cft->has_data_pending(cf->next, data);
- CF_DATA_RESTORE(cf, save);
- return result;
- }
- static ssize_t ssl_cf_send(struct Curl_cfilter *cf,
- struct Curl_easy *data, const void *buf, size_t len,
- bool eos, CURLcode *err)
- {
- struct cf_call_data save;
- ssize_t nwritten = 0;
- (void)eos;
-
- *err = CURLE_OK;
- if(len > 0) {
- CF_DATA_SAVE(save, cf, data);
- nwritten = Curl_ssl->send_plain(cf, data, buf, len, err);
- CF_DATA_RESTORE(cf, save);
- }
- return nwritten;
- }
- static ssize_t ssl_cf_recv(struct Curl_cfilter *cf,
- struct Curl_easy *data, char *buf, size_t len,
- CURLcode *err)
- {
- struct cf_call_data save;
- ssize_t nread;
- CF_DATA_SAVE(save, cf, data);
- *err = CURLE_OK;
- nread = Curl_ssl->recv_plain(cf, data, buf, len, err);
- if(nread > 0) {
- DEBUGASSERT((size_t)nread <= len);
- }
- else if(nread == 0) {
-
- *err = CURLE_OK;
- }
- CURL_TRC_CF(data, cf, "cf_recv(len=%zu) -> %zd, %d", len,
- nread, *err);
- CF_DATA_RESTORE(cf, save);
- return nread;
- }
- static CURLcode ssl_cf_shutdown(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- bool *done)
- {
- CURLcode result = CURLE_OK;
- *done = TRUE;
- if(!cf->shutdown) {
- struct cf_call_data save;
- CF_DATA_SAVE(save, cf, data);
- result = Curl_ssl->shut_down(cf, data, TRUE, done);
- CURL_TRC_CF(data, cf, "cf_shutdown -> %d, done=%d", result, *done);
- CF_DATA_RESTORE(cf, save);
- cf->shutdown = (result || *done);
- }
- return result;
- }
- static void ssl_cf_adjust_pollset(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- struct easy_pollset *ps)
- {
- struct cf_call_data save;
- CF_DATA_SAVE(save, cf, data);
- Curl_ssl->adjust_pollset(cf, data, ps);
- CF_DATA_RESTORE(cf, save);
- }
- static CURLcode ssl_cf_cntrl(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- int event, int arg1, void *arg2)
- {
- struct cf_call_data save;
- (void)arg1;
- (void)arg2;
- switch(event) {
- case CF_CTRL_DATA_ATTACH:
- if(Curl_ssl->attach_data) {
- CF_DATA_SAVE(save, cf, data);
- Curl_ssl->attach_data(cf, data);
- CF_DATA_RESTORE(cf, save);
- }
- break;
- case CF_CTRL_DATA_DETACH:
- if(Curl_ssl->detach_data) {
- CF_DATA_SAVE(save, cf, data);
- Curl_ssl->detach_data(cf, data);
- CF_DATA_RESTORE(cf, save);
- }
- break;
- default:
- break;
- }
- return CURLE_OK;
- }
- static CURLcode ssl_cf_query(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- int query, int *pres1, void *pres2)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- switch(query) {
- case CF_QUERY_TIMER_APPCONNECT: {
- struct curltime *when = pres2;
- if(cf->connected && !Curl_ssl_cf_is_proxy(cf))
- *when = connssl->handshake_done;
- return CURLE_OK;
- }
- default:
- break;
- }
- return cf->next ?
- cf->next->cft->query(cf->next, data, query, pres1, pres2) :
- CURLE_UNKNOWN_OPTION;
- }
- static bool cf_ssl_is_alive(struct Curl_cfilter *cf, struct Curl_easy *data,
- bool *input_pending)
- {
- struct cf_call_data save;
- int result;
-
- CF_DATA_SAVE(save, cf, data);
- result = Curl_ssl->check_cxn(cf, data);
- CF_DATA_RESTORE(cf, save);
- if(result > 0) {
- *input_pending = TRUE;
- return TRUE;
- }
- if(result == 0) {
- *input_pending = FALSE;
- return FALSE;
- }
-
- return cf->next ?
- cf->next->cft->is_alive(cf->next, data, input_pending) :
- FALSE;
- }
- struct Curl_cftype Curl_cft_ssl = {
- "SSL",
- CF_TYPE_SSL,
- CURL_LOG_LVL_NONE,
- ssl_cf_destroy,
- ssl_cf_connect,
- ssl_cf_close,
- ssl_cf_shutdown,
- Curl_cf_def_get_host,
- ssl_cf_adjust_pollset,
- ssl_cf_data_pending,
- ssl_cf_send,
- ssl_cf_recv,
- ssl_cf_cntrl,
- cf_ssl_is_alive,
- Curl_cf_def_conn_keep_alive,
- ssl_cf_query,
- };
- #ifndef CURL_DISABLE_PROXY
- struct Curl_cftype Curl_cft_ssl_proxy = {
- "SSL-PROXY",
- CF_TYPE_SSL|CF_TYPE_PROXY,
- CURL_LOG_LVL_NONE,
- ssl_cf_destroy,
- ssl_cf_connect,
- ssl_cf_close,
- ssl_cf_shutdown,
- Curl_cf_def_get_host,
- ssl_cf_adjust_pollset,
- ssl_cf_data_pending,
- ssl_cf_send,
- ssl_cf_recv,
- ssl_cf_cntrl,
- cf_ssl_is_alive,
- Curl_cf_def_conn_keep_alive,
- Curl_cf_def_query,
- };
- #endif
- static CURLcode cf_ssl_create(struct Curl_cfilter **pcf,
- struct Curl_easy *data,
- struct connectdata *conn)
- {
- struct Curl_cfilter *cf = NULL;
- struct ssl_connect_data *ctx;
- CURLcode result;
- DEBUGASSERT(data->conn);
- ctx = cf_ctx_new(data, alpn_get_spec(data->state.httpwant,
- conn->bits.tls_enable_alpn));
- if(!ctx) {
- result = CURLE_OUT_OF_MEMORY;
- goto out;
- }
- result = Curl_cf_create(&cf, &Curl_cft_ssl, ctx);
- out:
- if(result)
- cf_ctx_free(ctx);
- *pcf = result ? NULL : cf;
- return result;
- }
- CURLcode Curl_ssl_cfilter_add(struct Curl_easy *data,
- struct connectdata *conn,
- int sockindex)
- {
- struct Curl_cfilter *cf;
- CURLcode result;
- result = cf_ssl_create(&cf, data, conn);
- if(!result)
- Curl_conn_cf_add(data, conn, sockindex, cf);
- return result;
- }
- CURLcode Curl_cf_ssl_insert_after(struct Curl_cfilter *cf_at,
- struct Curl_easy *data)
- {
- struct Curl_cfilter *cf;
- CURLcode result;
- result = cf_ssl_create(&cf, data, cf_at->conn);
- if(!result)
- Curl_conn_cf_insert_after(cf_at, cf);
- return result;
- }
- #ifndef CURL_DISABLE_PROXY
- static CURLcode cf_ssl_proxy_create(struct Curl_cfilter **pcf,
- struct Curl_easy *data,
- struct connectdata *conn)
- {
- struct Curl_cfilter *cf = NULL;
- struct ssl_connect_data *ctx;
- CURLcode result;
- bool use_alpn = conn->bits.tls_enable_alpn;
- int httpwant = CURL_HTTP_VERSION_1_1;
- #ifdef USE_HTTP2
- if(conn->http_proxy.proxytype == CURLPROXY_HTTPS2) {
- use_alpn = TRUE;
- httpwant = CURL_HTTP_VERSION_2;
- }
- #endif
- ctx = cf_ctx_new(data, alpn_get_spec(httpwant, use_alpn));
- if(!ctx) {
- result = CURLE_OUT_OF_MEMORY;
- goto out;
- }
- result = Curl_cf_create(&cf, &Curl_cft_ssl_proxy, ctx);
- out:
- if(result)
- cf_ctx_free(ctx);
- *pcf = result ? NULL : cf;
- return result;
- }
- CURLcode Curl_cf_ssl_proxy_insert_after(struct Curl_cfilter *cf_at,
- struct Curl_easy *data)
- {
- struct Curl_cfilter *cf;
- CURLcode result;
- result = cf_ssl_proxy_create(&cf, data, cf_at->conn);
- if(!result)
- Curl_conn_cf_insert_after(cf_at, cf);
- return result;
- }
- #endif
- bool Curl_ssl_supports(struct Curl_easy *data, unsigned int ssl_option)
- {
- (void)data;
- return (Curl_ssl->supports & ssl_option);
- }
- static struct Curl_cfilter *get_ssl_filter(struct Curl_cfilter *cf)
- {
- for(; cf; cf = cf->next) {
- if(cf->cft == &Curl_cft_ssl)
- return cf;
- #ifndef CURL_DISABLE_PROXY
- if(cf->cft == &Curl_cft_ssl_proxy)
- return cf;
- #endif
- }
- return NULL;
- }
- void *Curl_ssl_get_internals(struct Curl_easy *data, int sockindex,
- CURLINFO info, int n)
- {
- void *result = NULL;
- (void)n;
- if(data->conn) {
- struct Curl_cfilter *cf;
-
- cf = get_ssl_filter(data->conn->cfilter[sockindex]);
- if(cf) {
- struct cf_call_data save;
- CF_DATA_SAVE(save, cf, data);
- result = Curl_ssl->get_internals(cf->ctx, info);
- CF_DATA_RESTORE(cf, save);
- }
- }
- return result;
- }
- static CURLcode vtls_shutdown_blocking(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- bool send_shutdown, bool *done)
- {
- struct ssl_connect_data *connssl = cf->ctx;
- struct cf_call_data save;
- CURLcode result = CURLE_OK;
- timediff_t timeout_ms;
- int what, loop = 10;
- if(cf->shutdown) {
- *done = TRUE;
- return CURLE_OK;
- }
- CF_DATA_SAVE(save, cf, data);
- *done = FALSE;
- while(!result && !*done && loop--) {
- timeout_ms = Curl_shutdown_timeleft(cf->conn, cf->sockindex, NULL);
- if(timeout_ms < 0) {
-
- failf(data, "SSL shutdown timeout");
- return CURLE_OPERATION_TIMEDOUT;
- }
- result = Curl_ssl->shut_down(cf, data, send_shutdown, done);
- if(result ||*done)
- goto out;
- if(connssl->io_need) {
- what = Curl_conn_cf_poll(cf, data, timeout_ms);
- if(what < 0) {
-
- failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
- result = CURLE_RECV_ERROR;
- goto out;
- }
- else if(0 == what) {
-
- failf(data, "SSL shutdown timeout");
- result = CURLE_OPERATION_TIMEDOUT;
- goto out;
- }
-
- }
- }
- out:
- CF_DATA_RESTORE(cf, save);
- cf->shutdown = (result || *done);
- return result;
- }
- CURLcode Curl_ssl_cfilter_remove(struct Curl_easy *data,
- int sockindex, bool send_shutdown)
- {
- struct Curl_cfilter *cf, *head;
- CURLcode result = CURLE_OK;
- head = data->conn ? data->conn->cfilter[sockindex] : NULL;
- for(cf = head; cf; cf = cf->next) {
- if(cf->cft == &Curl_cft_ssl) {
- bool done;
- CURL_TRC_CF(data, cf, "shutdown and remove SSL, start");
- Curl_shutdown_start(data, sockindex, NULL);
- result = vtls_shutdown_blocking(cf, data, send_shutdown, &done);
- Curl_shutdown_clear(data, sockindex);
- if(!result && !done)
- result = CURLE_SSL_SHUTDOWN_FAILED;
- Curl_conn_cf_discard_sub(head, cf, data, FALSE);
- CURL_TRC_CF(data, cf, "shutdown and remove SSL, done -> %d", result);
- break;
- }
- }
- return result;
- }
- bool Curl_ssl_cf_is_proxy(struct Curl_cfilter *cf)
- {
- return (cf->cft->flags & CF_TYPE_SSL) && (cf->cft->flags & CF_TYPE_PROXY);
- }
- struct ssl_config_data *
- Curl_ssl_cf_get_config(struct Curl_cfilter *cf, struct Curl_easy *data)
- {
- #ifdef CURL_DISABLE_PROXY
- (void)cf;
- return &data->set.ssl;
- #else
- return Curl_ssl_cf_is_proxy(cf) ? &data->set.proxy_ssl : &data->set.ssl;
- #endif
- }
- struct ssl_primary_config *
- Curl_ssl_cf_get_primary_config(struct Curl_cfilter *cf)
- {
- #ifdef CURL_DISABLE_PROXY
- return &cf->conn->ssl_config;
- #else
- return Curl_ssl_cf_is_proxy(cf) ?
- &cf->conn->proxy_ssl_config : &cf->conn->ssl_config;
- #endif
- }
- CURLcode Curl_alpn_to_proto_buf(struct alpn_proto_buf *buf,
- const struct alpn_spec *spec)
- {
- size_t i, len;
- int off = 0;
- unsigned char blen;
- memset(buf, 0, sizeof(*buf));
- for(i = 0; spec && i < spec->count; ++i) {
- len = strlen(spec->entries[i]);
- if(len >= ALPN_NAME_MAX)
- return CURLE_FAILED_INIT;
- blen = (unsigned char)len;
- if(off + blen + 1 >= (int)sizeof(buf->data))
- return CURLE_FAILED_INIT;
- buf->data[off++] = blen;
- memcpy(buf->data + off, spec->entries[i], blen);
- off += blen;
- }
- buf->len = off;
- return CURLE_OK;
- }
- CURLcode Curl_alpn_to_proto_str(struct alpn_proto_buf *buf,
- const struct alpn_spec *spec)
- {
- size_t i, len;
- size_t off = 0;
- memset(buf, 0, sizeof(*buf));
- for(i = 0; spec && i < spec->count; ++i) {
- len = strlen(spec->entries[i]);
- if(len >= ALPN_NAME_MAX)
- return CURLE_FAILED_INIT;
- if(off + len + 2 >= sizeof(buf->data))
- return CURLE_FAILED_INIT;
- if(off)
- buf->data[off++] = ',';
- memcpy(buf->data + off, spec->entries[i], len);
- off += len;
- }
- buf->data[off] = '\0';
- buf->len = (int)off;
- return CURLE_OK;
- }
- bool Curl_alpn_contains_proto(const struct alpn_spec *spec,
- const char *proto)
- {
- size_t i, plen = proto ? strlen(proto) : 0;
- for(i = 0; spec && plen && i < spec->count; ++i) {
- size_t slen = strlen(spec->entries[i]);
- if((slen == plen) && !memcmp(proto, spec->entries[i], plen))
- return TRUE;
- }
- return FALSE;
- }
- CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
- struct Curl_easy *data,
- struct ssl_connect_data *connssl,
- const unsigned char *proto,
- size_t proto_len)
- {
- CURLcode result = CURLE_OK;
- unsigned char *palpn =
- #ifndef CURL_DISABLE_PROXY
- (cf->conn->bits.tunnel_proxy && Curl_ssl_cf_is_proxy(cf)) ?
- &cf->conn->proxy_alpn : &cf->conn->alpn
- #else
- &cf->conn->alpn
- #endif
- ;
- if(connssl->alpn_negotiated) {
-
- if(!proto_len) {
- failf(data, "ALPN: asked for '%s' from previous session, "
- "but server did not confirm it. Refusing to continue.",
- connssl->alpn_negotiated);
- result = CURLE_SSL_CONNECT_ERROR;
- goto out;
- }
- else if((strlen(connssl->alpn_negotiated) != proto_len) ||
- memcmp(connssl->alpn_negotiated, proto, proto_len)) {
- failf(data, "ALPN: asked for '%s' from previous session, but server "
- "selected '%.*s'. Refusing to continue.",
- connssl->alpn_negotiated, (int)proto_len, proto);
- result = CURLE_SSL_CONNECT_ERROR;
- goto out;
- }
-
- infof(data, "ALPN: server confirmed to use '%s'",
- connssl->alpn_negotiated);
- goto out;
- }
- if(proto && proto_len) {
- if(memchr(proto, '\0', proto_len)) {
- failf(data, "ALPN: server selected protocol contains NUL. "
- "Refusing to continue.");
- result = CURLE_SSL_CONNECT_ERROR;
- goto out;
- }
- connssl->alpn_negotiated = malloc(proto_len + 1);
- if(!connssl->alpn_negotiated)
- return CURLE_OUT_OF_MEMORY;
- memcpy(connssl->alpn_negotiated, proto, proto_len);
- connssl->alpn_negotiated[proto_len] = 0;
- }
- if(proto && proto_len) {
- if(proto_len == ALPN_HTTP_1_1_LENGTH &&
- !memcmp(ALPN_HTTP_1_1, proto, ALPN_HTTP_1_1_LENGTH)) {
- *palpn = CURL_HTTP_VERSION_1_1;
- }
- #ifdef USE_HTTP2
- else if(proto_len == ALPN_H2_LENGTH &&
- !memcmp(ALPN_H2, proto, ALPN_H2_LENGTH)) {
- *palpn = CURL_HTTP_VERSION_2;
- }
- #endif
- #ifdef USE_HTTP3
- else if(proto_len == ALPN_H3_LENGTH &&
- !memcmp(ALPN_H3, proto, ALPN_H3_LENGTH)) {
- *palpn = CURL_HTTP_VERSION_3;
- }
- #endif
- else {
- *palpn = CURL_HTTP_VERSION_NONE;
- failf(data, "unsupported ALPN protocol: '%.*s'", (int)proto_len, proto);
-
-
- goto out;
- }
- if(connssl->state == ssl_connection_deferred)
- infof(data, VTLS_INFOF_ALPN_DEFERRED, (int)proto_len, proto);
- else
- infof(data, VTLS_INFOF_ALPN_ACCEPTED, (int)proto_len, proto);
- }
- else {
- *palpn = CURL_HTTP_VERSION_NONE;
- if(connssl->state == ssl_connection_deferred)
- infof(data, VTLS_INFOF_NO_ALPN_DEFERRED);
- else
- infof(data, VTLS_INFOF_NO_ALPN);
- }
- out:
- return result;
- }
- #endif
|