mbedtls.c@ 106542

最後變更在這個檔案從106542是 104083,由 vboxsync 提交於 11 月前
curl-8.7.1: Applied and adjusted our curl changes to 8.4.0. bugref:10639
屬性 svn:eol-style 設為 `native`
檔案大小: 40.3 KB

行
1	/***************************************************************************
2	* _ _ ____ _
3	* Project ___\| \| \| \| _ \\| \|
4	* / __\| \| \| \| \|_) \| \|
5	* \| (__\| \|_\| \| _ <\| \|___
6	* \___\|\___/\|_\| \_\_____\|
7	*
8	* Copyright (C) Daniel Stenberg, <[email protected]>, et al.
9	* Copyright (C) Hoi-Ho Chan, <[email protected]>
10	*
11	* This software is licensed as described in the file COPYING, which
12	* you should have received as part of this distribution. The terms
13	* are also available at https://curl.se/docs/copyright.html.
14	*
15	* You may opt to use, copy, modify, merge, publish, distribute and/or sell
16	* copies of the Software, and permit persons to whom the Software is
17	* furnished to do so, under the terms of the COPYING file.
18	*
19	* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20	* KIND, either express or implied.
21	*
22	* SPDX-License-Identifier: curl
23	*
24	***************************************************************************/
25
26	/*
27	* Source file for all mbedTLS-specific code for the TLS/SSL layer. No code
28	* but vtls.c should ever call or use these functions.
29	*
30	*/
31
32	#include "curl_setup.h"
33
34	#ifdef USE_MBEDTLS
35
36	/* Define this to enable lots of debugging for mbedTLS */
37	/* #define MBEDTLS_DEBUG */
38
39	#ifdef __GNUC__
40	#pragma GCC diagnostic push
41	/* mbedTLS (as of v3.5.1) has a duplicate function declaration
42	in its public headers. Disable the warning that detects it. */
43	#pragma GCC diagnostic ignored "-Wredundant-decls"
44	#endif
45
46	#include <mbedtls/version.h>
47	#if MBEDTLS_VERSION_NUMBER >= 0x02040000
48	#include <mbedtls/net_sockets.h>
49	#else
50	#include <mbedtls/net.h>
51	#endif
52	#include <mbedtls/ssl.h>
53	#include <mbedtls/x509.h>
54
55	#include <mbedtls/error.h>
56	#include <mbedtls/entropy.h>
57	#include <mbedtls/ctr_drbg.h>
58	#include <mbedtls/sha256.h>
59
60	#if MBEDTLS_VERSION_MAJOR >= 2
61	# ifdef MBEDTLS_DEBUG
62	# include <mbedtls/debug.h>
63	# endif
64	#endif
65
66	#ifdef __GNUC__
67	#pragma GCC diagnostic pop
68	#endif
69
70	#include "urldata.h"
71	#include "sendf.h"
72	#include "inet_pton.h"
73	#include "mbedtls.h"
74	#include "vtls.h"
75	#include "vtls_int.h"
76	#include "parsedate.h"
77	#include "connect.h" /* for the connect timeout */
78	#include "select.h"
79	#include "multiif.h"
80	#include "mbedtls_threadlock.h"
81	#include "strdup.h"
82
83	/* The last 3 #include files should be in this order */
84	#include "curl_printf.h"
85	#include "curl_memory.h"
86	#include "memdebug.h"
87
88	/* ALPN for http2 */
89	#ifdef USE_HTTP2
90	# undef HAS_ALPN
91	# ifdef MBEDTLS_SSL_ALPN
92	# define HAS_ALPN
93	# endif
94	#endif
95
96	struct mbed_ssl_backend_data {
97	mbedtls_ctr_drbg_context ctr_drbg;
98	mbedtls_entropy_context entropy;
99	mbedtls_ssl_context ssl;
100	mbedtls_x509_crt cacert;
101	mbedtls_x509_crt clicert;
102	#ifdef MBEDTLS_X509_CRL_PARSE_C
103	mbedtls_x509_crl crl;
104	#endif
105	mbedtls_pk_context pk;
106	mbedtls_ssl_config config;
107	#ifdef HAS_ALPN
108	const char *protocols[3];
109	#endif
110	};
111
112	/* apply threading? */
113	#if (defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)) \|\| \
114	defined(_WIN32)
115	#define THREADING_SUPPORT
116	#endif
117
118	#ifndef MBEDTLS_ERROR_C
119	#define mbedtls_strerror(a,b,c) b[0] = 0
120	#endif
121
122	#if defined(THREADING_SUPPORT)
123	static mbedtls_entropy_context ts_entropy;
124
125	static int entropy_init_initialized = 0;
126
127	static void entropy_init_mutex(mbedtls_entropy_context *ctx)
128	{
129	/* lock 0 = entropy_init_mutex() */
130	Curl_mbedtlsthreadlock_lock_function(0);
131	if(entropy_init_initialized == 0) {
132	mbedtls_entropy_init(ctx);
133	entropy_init_initialized = 1;
134	}
135	Curl_mbedtlsthreadlock_unlock_function(0);
136	}
137
138	static void entropy_cleanup_mutex(mbedtls_entropy_context *ctx)
139	{
140	/* lock 0 = use same lock as init */
141	Curl_mbedtlsthreadlock_lock_function(0);
142	if(entropy_init_initialized == 1) {
143	mbedtls_entropy_free(ctx);
144	entropy_init_initialized = 0;
145	}
146	Curl_mbedtlsthreadlock_unlock_function(0);
147	}
148
149	static int entropy_func_mutex(void data, unsigned char output, size_t len)
150	{
151	int ret;
152	/* lock 1 = entropy_func_mutex() */
153	Curl_mbedtlsthreadlock_lock_function(1);
154	ret = mbedtls_entropy_func(data, output, len);
155	Curl_mbedtlsthreadlock_unlock_function(1);
156
157	return ret;
158	}
159
160	#endif /* THREADING_SUPPORT */
161
162	#ifdef MBEDTLS_DEBUG
163	static void mbed_debug(void context, int level, const char f_name,
164	int line_nb, const char *line)
165	{
166	struct Curl_easy *data = NULL;
167
168	if(!context)
169	return;
170
171	data = (struct Curl_easy *)context;
172
173	infof(data, "%s", line);
174	(void) level;
175	}
176	#endif
177
178	static int mbedtls_bio_cf_write(void *bio,
179	const unsigned char *buf, size_t blen)
180	{
181	struct Curl_cfilter *cf = bio;
182	struct Curl_easy *data = CF_DATA_CURRENT(cf);
183	ssize_t nwritten;
184	CURLcode result;
185
186	DEBUGASSERT(data);
187	if(!data)
188	return 0;
189
190	nwritten = Curl_conn_cf_send(cf->next, data, (char *)buf, blen, &result);
191	CURL_TRC_CF(data, cf, "mbedtls_bio_cf_out_write(len=%zu) -> %zd, err=%d",
192	blen, nwritten, result);
193	if(nwritten < 0 && CURLE_AGAIN == result) {
194	nwritten = MBEDTLS_ERR_SSL_WANT_WRITE;
195	}
196	return (int)nwritten;
197	}
198
199	static int mbedtls_bio_cf_read(void bio, unsigned char buf, size_t blen)
200	{
201	struct Curl_cfilter *cf = bio;
202	struct Curl_easy *data = CF_DATA_CURRENT(cf);
203	ssize_t nread;
204	CURLcode result;
205
206	DEBUGASSERT(data);
207	if(!data)
208	return 0;
209	/* OpenSSL catches this case, so should we. */
210	if(!buf)
211	return 0;
212
213	nread = Curl_conn_cf_recv(cf->next, data, (char *)buf, blen, &result);
214	CURL_TRC_CF(data, cf, "mbedtls_bio_cf_in_read(len=%zu) -> %zd, err=%d",
215	blen, nread, result);
216	if(nread < 0 && CURLE_AGAIN == result) {
217	nread = MBEDTLS_ERR_SSL_WANT_READ;
218	}
219	return (int)nread;
220	}
221
222	/*
223	* profile
224	*/
225	static const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_fr =
226	{
227	/* Hashes from SHA-1 and above */
228	MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA1) \|
229	MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_RIPEMD160) \|
230	MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA224) \|
231	MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) \|
232	MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384) \|
233	MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512),
234	0xFFFFFFF, /* Any PK alg */
235	0xFFFFFFF, /* Any curve */
236	1024, /* RSA min key len */
237	};
238
239	/* See https://tls.mbed.org/discussions/generic/
240	howto-determine-exact-buffer-len-for-mbedtls_pk_write_pubkey_der
241	*/
242	#define RSA_PUB_DER_MAX_BYTES (38 + 2 * MBEDTLS_MPI_MAX_SIZE)
243	#define ECP_PUB_DER_MAX_BYTES (30 + 2 * MBEDTLS_ECP_MAX_BYTES)
244
245	#define PUB_DER_MAX_BYTES (RSA_PUB_DER_MAX_BYTES > ECP_PUB_DER_MAX_BYTES ? \
246	RSA_PUB_DER_MAX_BYTES : ECP_PUB_DER_MAX_BYTES)
247
248	#if MBEDTLS_VERSION_NUMBER >= 0x03020000
249	static CURLcode mbedtls_version_from_curl(
250	mbedtls_ssl_protocol_version* mbedver, long version)
251	{
252	switch(version) {
253	case CURL_SSLVERSION_TLSv1_0:
254	case CURL_SSLVERSION_TLSv1_1:
255	case CURL_SSLVERSION_TLSv1_2:
256	*mbedver = MBEDTLS_SSL_VERSION_TLS1_2;
257	return CURLE_OK;
258	case CURL_SSLVERSION_TLSv1_3:
259	break;
260	}
261
262	return CURLE_SSL_CONNECT_ERROR;
263	}
264	#else
265	static CURLcode mbedtls_version_from_curl(int *mbedver, long version)
266	{
267	#if MBEDTLS_VERSION_NUMBER >= 0x03000000
268	switch(version) {
269	case CURL_SSLVERSION_TLSv1_0:
270	case CURL_SSLVERSION_TLSv1_1:
271	case CURL_SSLVERSION_TLSv1_2:
272	*mbedver = MBEDTLS_SSL_MINOR_VERSION_3;
273	return CURLE_OK;
274	case CURL_SSLVERSION_TLSv1_3:
275	break;
276	}
277	#else
278	switch(version) {
279	case CURL_SSLVERSION_TLSv1_0:
280	*mbedver = MBEDTLS_SSL_MINOR_VERSION_1;
281	return CURLE_OK;
282	case CURL_SSLVERSION_TLSv1_1:
283	*mbedver = MBEDTLS_SSL_MINOR_VERSION_2;
284	return CURLE_OK;
285	case CURL_SSLVERSION_TLSv1_2:
286	*mbedver = MBEDTLS_SSL_MINOR_VERSION_3;
287	return CURLE_OK;
288	case CURL_SSLVERSION_TLSv1_3:
289	break;
290	}
291	#endif
292
293	return CURLE_SSL_CONNECT_ERROR;
294	}
295	#endif
296
297	static CURLcode
298	set_ssl_version_min_max(struct Curl_cfilter cf, struct Curl_easy data)
299	{
300	struct ssl_connect_data *connssl = cf->ctx;
301	struct mbed_ssl_backend_data *backend =
302	(struct mbed_ssl_backend_data *)connssl->backend;
303	struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
304	#if MBEDTLS_VERSION_NUMBER >= 0x03020000
305	mbedtls_ssl_protocol_version mbedtls_ver_min = MBEDTLS_SSL_VERSION_TLS1_2;
306	mbedtls_ssl_protocol_version mbedtls_ver_max = MBEDTLS_SSL_VERSION_TLS1_2;
307	#elif MBEDTLS_VERSION_NUMBER >= 0x03000000
308	int mbedtls_ver_min = MBEDTLS_SSL_MINOR_VERSION_3;
309	int mbedtls_ver_max = MBEDTLS_SSL_MINOR_VERSION_3;
310	#else
311	int mbedtls_ver_min = MBEDTLS_SSL_MINOR_VERSION_1;
312	int mbedtls_ver_max = MBEDTLS_SSL_MINOR_VERSION_1;
313	#endif
314	long ssl_version = conn_config->version;
315	long ssl_version_max = conn_config->version_max;
316	CURLcode result = CURLE_OK;
317
318	DEBUGASSERT(backend);
319
320	switch(ssl_version) {
321	case CURL_SSLVERSION_DEFAULT:
322	case CURL_SSLVERSION_TLSv1:
323	ssl_version = CURL_SSLVERSION_TLSv1_0;
324	break;
325	}
326
327	switch(ssl_version_max) {
328	case CURL_SSLVERSION_MAX_NONE:
329	case CURL_SSLVERSION_MAX_DEFAULT:
330	ssl_version_max = CURL_SSLVERSION_MAX_TLSv1_2;
331	break;
332	}
333
334	result = mbedtls_version_from_curl(&mbedtls_ver_min, ssl_version);
335	if(result) {
336	failf(data, "unsupported min version passed via CURLOPT_SSLVERSION");
337	return result;
338	}
339	result = mbedtls_version_from_curl(&mbedtls_ver_max, ssl_version_max >> 16);
340	if(result) {
341	failf(data, "unsupported max version passed via CURLOPT_SSLVERSION");
342	return result;
343	}
344
345	#if MBEDTLS_VERSION_NUMBER >= 0x03020000
346	mbedtls_ssl_conf_min_tls_version(&backend->config, mbedtls_ver_min);
347	mbedtls_ssl_conf_max_tls_version(&backend->config, mbedtls_ver_max);
348	#else
349	mbedtls_ssl_conf_min_version(&backend->config, MBEDTLS_SSL_MAJOR_VERSION_3,
350	mbedtls_ver_min);
351	mbedtls_ssl_conf_max_version(&backend->config, MBEDTLS_SSL_MAJOR_VERSION_3,
352	mbedtls_ver_max);
353	#endif
354
355	return result;
356	}
357
358	static CURLcode
359	mbed_connect_step1(struct Curl_cfilter cf, struct Curl_easy data)
360	{
361	struct ssl_connect_data *connssl = cf->ctx;
362	struct mbed_ssl_backend_data *backend =
363	(struct mbed_ssl_backend_data *)connssl->backend;
364	struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
365	const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
366	struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
367	const char * const ssl_cafile =
368	/* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
369	(ca_info_blob ? NULL : conn_config->CAfile);
370	const bool verifypeer = conn_config->verifypeer;
371	const char * const ssl_capath = conn_config->CApath;
372	char * const ssl_cert = ssl_config->primary.clientcert;
373	const struct curl_blob *ssl_cert_blob = ssl_config->primary.cert_blob;
374	const char * const ssl_crlfile = ssl_config->primary.CRLfile;
375	const char *hostname = connssl->peer.hostname;
376	int ret = -1;
377	char errorbuf[128];
378
379	DEBUGASSERT(backend);
380
381	if((conn_config->version == CURL_SSLVERSION_SSLv2) \|\|
382	(conn_config->version == CURL_SSLVERSION_SSLv3)) {
383	failf(data, "Not supported SSL version");
384	return CURLE_NOT_BUILT_IN;
385	}
386
387	#ifdef THREADING_SUPPORT
388	mbedtls_ctr_drbg_init(&backend->ctr_drbg);
389
390	ret = mbedtls_ctr_drbg_seed(&backend->ctr_drbg, entropy_func_mutex,
391	&ts_entropy, NULL, 0);
392	if(ret) {
393	mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
394	failf(data, "mbedtls_ctr_drbg_seed returned (-0x%04X) %s",
395	-ret, errorbuf);
396	return CURLE_FAILED_INIT;
397	}
398	#else
399	mbedtls_entropy_init(&backend->entropy);
400	mbedtls_ctr_drbg_init(&backend->ctr_drbg);
401
402	ret = mbedtls_ctr_drbg_seed(&backend->ctr_drbg, mbedtls_entropy_func,
403	&backend->entropy, NULL, 0);
404	if(ret) {
405	mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
406	failf(data, "mbedtls_ctr_drbg_seed returned (-0x%04X) %s",
407	-ret, errorbuf);
408	return CURLE_FAILED_INIT;
409	}
410	#endif /* THREADING_SUPPORT */
411
412	/* Load the trusted CA */
413	mbedtls_x509_crt_init(&backend->cacert);
414
415	if(ca_info_blob && verifypeer) {
416	/* Unfortunately, mbedtls_x509_crt_parse() requires the data to be null
417	terminated even when provided the exact length, forcing us to waste
418	extra memory here. */
419	unsigned char *newblob = Curl_memdup0(ca_info_blob->data,
420	ca_info_blob->len);
421	if(!newblob)
422	return CURLE_OUT_OF_MEMORY;
423	ret = mbedtls_x509_crt_parse(&backend->cacert, newblob,
424	ca_info_blob->len + 1);
425	free(newblob);
426	if(ret<0) {
427	mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
428	failf(data, "Error importing ca cert blob - mbedTLS: (-0x%04X) %s",
429	-ret, errorbuf);
430	return CURLE_SSL_CERTPROBLEM;
431	}
432	}
433
434	if(ssl_cafile && verifypeer) {
435	#ifdef MBEDTLS_FS_IO
436	ret = mbedtls_x509_crt_parse_file(&backend->cacert, ssl_cafile);
437
438	if(ret<0) {
439	mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
440	failf(data, "Error reading ca cert file %s - mbedTLS: (-0x%04X) %s",
441	ssl_cafile, -ret, errorbuf);
442	return CURLE_SSL_CACERT_BADFILE;
443	}
444	#else
445	failf(data, "mbedtls: functions that use the filesystem not built in");
446	return CURLE_NOT_BUILT_IN;
447	#endif
448	}
449
450	if(ssl_capath) {
451	#ifdef MBEDTLS_FS_IO
452	ret = mbedtls_x509_crt_parse_path(&backend->cacert, ssl_capath);
453
454	if(ret<0) {
455	mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
456	failf(data, "Error reading ca cert path %s - mbedTLS: (-0x%04X) %s",
457	ssl_capath, -ret, errorbuf);
458
459	if(verifypeer)
460	return CURLE_SSL_CACERT_BADFILE;
461	}
462	#else
463	failf(data, "mbedtls: functions that use the filesystem not built in");
464	return CURLE_NOT_BUILT_IN;
465	#endif
466	}
467
468	/* Load the client certificate */
469	mbedtls_x509_crt_init(&backend->clicert);
470
471	if(ssl_cert) {
472	#ifdef MBEDTLS_FS_IO
473	ret = mbedtls_x509_crt_parse_file(&backend->clicert, ssl_cert);
474
475	if(ret) {
476	mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
477	failf(data, "Error reading client cert file %s - mbedTLS: (-0x%04X) %s",
478	ssl_cert, -ret, errorbuf);
479
480	return CURLE_SSL_CERTPROBLEM;
481	}
482	#else
483	failf(data, "mbedtls: functions that use the filesystem not built in");
484	return CURLE_NOT_BUILT_IN;
485	#endif
486	}
487
488	if(ssl_cert_blob) {
489	/* Unfortunately, mbedtls_x509_crt_parse() requires the data to be null
490	terminated even when provided the exact length, forcing us to waste
491	extra memory here. */
492	unsigned char *newblob = Curl_memdup0(ssl_cert_blob->data,
493	ssl_cert_blob->len);
494	if(!newblob)
495	return CURLE_OUT_OF_MEMORY;
496	ret = mbedtls_x509_crt_parse(&backend->clicert, newblob,
497	ssl_cert_blob->len + 1);
498	free(newblob);
499
500	if(ret) {
501	mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
502	failf(data, "Error reading private key %s - mbedTLS: (-0x%04X) %s",
503	ssl_config->key, -ret, errorbuf);
504	return CURLE_SSL_CERTPROBLEM;
505	}
506	}
507
508	/* Load the client private key */
509	mbedtls_pk_init(&backend->pk);
510
511	if(ssl_config->key \|\| ssl_config->key_blob) {
512	if(ssl_config->key) {
513	#ifdef MBEDTLS_FS_IO
514	#if MBEDTLS_VERSION_NUMBER >= 0x03000000
515	ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
516	ssl_config->key_passwd,
517	mbedtls_ctr_drbg_random,
518	&backend->ctr_drbg);
519	#else
520	ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
521	ssl_config->key_passwd);
522	#endif
523
524	if(ret) {
525	mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
526	failf(data, "Error reading private key %s - mbedTLS: (-0x%04X) %s",
527	ssl_config->key, -ret, errorbuf);
528	return CURLE_SSL_CERTPROBLEM;
529	}
530	#else
531	failf(data, "mbedtls: functions that use the filesystem not built in");
532	return CURLE_NOT_BUILT_IN;
533	#endif
534	}
535	else {
536	const struct curl_blob *ssl_key_blob = ssl_config->key_blob;
537	const unsigned char *key_data =
538	(const unsigned char *)ssl_key_blob->data;
539	const char *passwd = ssl_config->key_passwd;
540	#if MBEDTLS_VERSION_NUMBER >= 0x03000000
541	ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
542	(const unsigned char *)passwd,
543	passwd ? strlen(passwd) : 0,
544	mbedtls_ctr_drbg_random,
545	&backend->ctr_drbg);
546	#else
547	ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
548	(const unsigned char *)passwd,
549	passwd ? strlen(passwd) : 0);
550	#endif
551
552	if(ret) {
553	mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
554	failf(data, "Error parsing private key - mbedTLS: (-0x%04X) %s",
555	-ret, errorbuf);
556	return CURLE_SSL_CERTPROBLEM;
557	}
558	}
559
560	if(ret == 0 && !(mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_RSA) \|\|
561	mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_ECKEY)))
562	ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
563	}
564
565	/* Load the CRL */
566	#ifdef MBEDTLS_X509_CRL_PARSE_C
567	mbedtls_x509_crl_init(&backend->crl);
568
569	if(ssl_crlfile) {
570	#ifdef MBEDTLS_FS_IO
571	ret = mbedtls_x509_crl_parse_file(&backend->crl, ssl_crlfile);
572
573	if(ret) {
574	mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
575	failf(data, "Error reading CRL file %s - mbedTLS: (-0x%04X) %s",
576	ssl_crlfile, -ret, errorbuf);
577
578	return CURLE_SSL_CRL_BADFILE;
579	}
580	#else
581	failf(data, "mbedtls: functions that use the filesystem not built in");
582	return CURLE_NOT_BUILT_IN;
583	#endif
584	}
585	#else
586	if(ssl_crlfile) {
587	failf(data, "mbedtls: crl support not built in");
588	return CURLE_NOT_BUILT_IN;
589	}
590	#endif
591
592	infof(data, "mbedTLS: Connecting to %s:%d", hostname, connssl->port);
593
594	mbedtls_ssl_config_init(&backend->config);
595	ret = mbedtls_ssl_config_defaults(&backend->config,
596	MBEDTLS_SSL_IS_CLIENT,
597	MBEDTLS_SSL_TRANSPORT_STREAM,
598	MBEDTLS_SSL_PRESET_DEFAULT);
599	if(ret) {
600	failf(data, "mbedTLS: ssl_config failed");
601	return CURLE_SSL_CONNECT_ERROR;
602	}
603
604	mbedtls_ssl_init(&backend->ssl);
605	if(mbedtls_ssl_setup(&backend->ssl, &backend->config)) {
606	failf(data, "mbedTLS: ssl_init failed");
607	return CURLE_SSL_CONNECT_ERROR;
608	}
609
610	/* new profile with RSA min key len = 1024 ... */
611	mbedtls_ssl_conf_cert_profile(&backend->config,
612	&mbedtls_x509_crt_profile_fr);
613
614	switch(conn_config->version) {
615	case CURL_SSLVERSION_DEFAULT:
616	case CURL_SSLVERSION_TLSv1:
617	#if MBEDTLS_VERSION_NUMBER < 0x03000000
618	mbedtls_ssl_conf_min_version(&backend->config, MBEDTLS_SSL_MAJOR_VERSION_3,
619	MBEDTLS_SSL_MINOR_VERSION_1);
620	infof(data, "mbedTLS: Set min SSL version to TLS 1.0");
621	break;
622	#endif
623	case CURL_SSLVERSION_TLSv1_0:
624	case CURL_SSLVERSION_TLSv1_1:
625	case CURL_SSLVERSION_TLSv1_2:
626	case CURL_SSLVERSION_TLSv1_3:
627	{
628	CURLcode result = set_ssl_version_min_max(cf, data);
629	if(result != CURLE_OK)
630	return result;
631	break;
632	}
633	default:
634	failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
635	return CURLE_SSL_CONNECT_ERROR;
636	}
637
638	mbedtls_ssl_conf_authmode(&backend->config, MBEDTLS_SSL_VERIFY_OPTIONAL);
639
640	mbedtls_ssl_conf_rng(&backend->config, mbedtls_ctr_drbg_random,
641	&backend->ctr_drbg);
642	mbedtls_ssl_set_bio(&backend->ssl, cf,
643	mbedtls_bio_cf_write,
644	mbedtls_bio_cf_read,
645	NULL /* rev_timeout() */);
646
647	mbedtls_ssl_conf_ciphersuites(&backend->config,
648	mbedtls_ssl_list_ciphersuites());
649
650	#if defined(MBEDTLS_SSL_RENEGOTIATION)
651	mbedtls_ssl_conf_renegotiation(&backend->config,
652	MBEDTLS_SSL_RENEGOTIATION_ENABLED);
653	#endif
654
655	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
656	mbedtls_ssl_conf_session_tickets(&backend->config,
657	MBEDTLS_SSL_SESSION_TICKETS_DISABLED);
658	#endif
659
660	/* Check if there's a cached ID we can/should use here! */
661	if(ssl_config->primary.sessionid) {
662	void *old_session = NULL;
663
664	Curl_ssl_sessionid_lock(data);
665	if(!Curl_ssl_getsessionid(cf, data, &old_session, NULL)) {
666	ret = mbedtls_ssl_set_session(&backend->ssl, old_session);
667	if(ret) {
668	Curl_ssl_sessionid_unlock(data);
669	failf(data, "mbedtls_ssl_set_session returned -0x%x", -ret);
670	return CURLE_SSL_CONNECT_ERROR;
671	}
672	infof(data, "mbedTLS reusing session");
673	}
674	Curl_ssl_sessionid_unlock(data);
675	}
676
677	mbedtls_ssl_conf_ca_chain(&backend->config,
678	&backend->cacert,
679	#ifdef MBEDTLS_X509_CRL_PARSE_C
680	&backend->crl);
681	#else
682	NULL);
683	#endif
684
685	if(ssl_config->key \|\| ssl_config->key_blob) {
686	mbedtls_ssl_conf_own_cert(&backend->config,
687	&backend->clicert, &backend->pk);
688	}
689
690	if(mbedtls_ssl_set_hostname(&backend->ssl, connssl->peer.sni?
691	connssl->peer.sni : connssl->peer.hostname)) {
692	/* mbedtls_ssl_set_hostname() sets the name to use in CN/SAN checks and
693	the name to set in the SNI extension. So even if curl connects to a
694	host specified as an IP address, this function must be used. */
695	failf(data, "Failed to set SNI");
696	return CURLE_SSL_CONNECT_ERROR;
697	}
698
699	#ifdef HAS_ALPN
700	if(connssl->alpn) {
701	struct alpn_proto_buf proto;
702	size_t i;
703
704	for(i = 0; i < connssl->alpn->count; ++i) {
705	backend->protocols[i] = connssl->alpn->entries[i];
706	}
707	/* this function doesn't clone the protocols array, which is why we need
708	to keep it around */
709	if(mbedtls_ssl_conf_alpn_protocols(&backend->config,
710	&backend->protocols[0])) {
711	failf(data, "Failed setting ALPN protocols");
712	return CURLE_SSL_CONNECT_ERROR;
713	}
714	Curl_alpn_to_proto_str(&proto, connssl->alpn);
715	infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
716	}
717	#endif
718
719	#ifdef MBEDTLS_DEBUG
720	/* In order to make that work in mbedtls MBEDTLS_DEBUG_C must be defined. */
721	mbedtls_ssl_conf_dbg(&backend->config, mbed_debug, data);
722	/* - 0 No debug
723	* - 1 Error
724	* - 2 State change
725	* - 3 Informational
726	* - 4 Verbose
727	*/
728	mbedtls_debug_set_threshold(4);
729	#endif
730
731	/* give application a chance to interfere with mbedTLS set up. */
732	if(data->set.ssl.fsslctx) {
733	ret = (*data->set.ssl.fsslctx)(data, &backend->config,
734	data->set.ssl.fsslctxp);
735	if(ret) {
736	failf(data, "error signaled by ssl ctx callback");
737	return ret;
738	}
739	}
740
741	connssl->connecting_state = ssl_connect_2;
742
743	return CURLE_OK;
744	}
745
746	static CURLcode
747	mbed_connect_step2(struct Curl_cfilter cf, struct Curl_easy data)
748	{
749	int ret;
750	struct ssl_connect_data *connssl = cf->ctx;
751	struct mbed_ssl_backend_data *backend =
752	(struct mbed_ssl_backend_data *)connssl->backend;
753	struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
754	const mbedtls_x509_crt *peercert;
755	const char * const pinnedpubkey = Curl_ssl_cf_is_proxy(cf)?
756	data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY]:
757	data->set.str[STRING_SSL_PINNEDPUBLICKEY];
758
759	DEBUGASSERT(backend);
760
761	ret = mbedtls_ssl_handshake(&backend->ssl);
762
763	if(ret == MBEDTLS_ERR_SSL_WANT_READ) {
764	connssl->connecting_state = ssl_connect_2_reading;
765	return CURLE_OK;
766	}
767	else if(ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
768	connssl->connecting_state = ssl_connect_2_writing;
769	return CURLE_OK;
770	}
771	else if(ret) {
772	char errorbuf[128];
773	mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
774	failf(data, "ssl_handshake returned - mbedTLS: (-0x%04X) %s",
775	-ret, errorbuf);
776	return CURLE_SSL_CONNECT_ERROR;
777	}
778
779	infof(data, "mbedTLS: Handshake complete, cipher is %s",
780	mbedtls_ssl_get_ciphersuite(&backend->ssl));
781
782	ret = mbedtls_ssl_get_verify_result(&backend->ssl);
783
784	if(!conn_config->verifyhost)
785	/* Ignore hostname errors if verifyhost is disabled */
786	ret &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH;
787
788	if(ret && conn_config->verifypeer) {
789	if(ret & MBEDTLS_X509_BADCERT_EXPIRED)
790	failf(data, "Cert verify failed: BADCERT_EXPIRED");
791
792	else if(ret & MBEDTLS_X509_BADCERT_REVOKED)
793	failf(data, "Cert verify failed: BADCERT_REVOKED");
794
795	else if(ret & MBEDTLS_X509_BADCERT_CN_MISMATCH)
796	failf(data, "Cert verify failed: BADCERT_CN_MISMATCH");
797
798	else if(ret & MBEDTLS_X509_BADCERT_NOT_TRUSTED)
799	failf(data, "Cert verify failed: BADCERT_NOT_TRUSTED");
800
801	else if(ret & MBEDTLS_X509_BADCERT_FUTURE)
802	failf(data, "Cert verify failed: BADCERT_FUTURE");
803
804	return CURLE_PEER_FAILED_VERIFICATION;
805	}
806
807	peercert = mbedtls_ssl_get_peer_cert(&backend->ssl);
808
809	if(peercert && data->set.verbose) {
810	#ifndef MBEDTLS_X509_REMOVE_INFO
811	const size_t bufsize = 16384;
812	char *buffer = malloc(bufsize);
813
814	if(!buffer)
815	return CURLE_OUT_OF_MEMORY;
816
817	if(mbedtls_x509_crt_info(buffer, bufsize, "* ", peercert) > 0)
818	infof(data, "Dumping cert info: %s", buffer);
819	else
820	infof(data, "Unable to dump certificate information");
821
822	free(buffer);
823	#else
824	infof(data, "Unable to dump certificate information");
825	#endif
826	}
827
828	if(pinnedpubkey) {
829	int size;
830	CURLcode result;
831	mbedtls_x509_crt *p = NULL;
832	unsigned char *pubkey = NULL;
833
834	#if MBEDTLS_VERSION_NUMBER == 0x03000000
835	if(!peercert \|\| !peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p) \|\|
836	!peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len)) {
837	#else
838	if(!peercert \|\| !peercert->raw.p \|\| !peercert->raw.len) {
839	#endif
840	failf(data, "Failed due to missing peer certificate");
841	return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
842	}
843
844	p = calloc(1, sizeof(*p));
845
846	if(!p)
847	return CURLE_OUT_OF_MEMORY;
848
849	pubkey = malloc(PUB_DER_MAX_BYTES);
850
851	if(!pubkey) {
852	result = CURLE_OUT_OF_MEMORY;
853	goto pinnedpubkey_error;
854	}
855
856	mbedtls_x509_crt_init(p);
857
858	/* Make a copy of our const peercert because mbedtls_pk_write_pubkey_der
859	needs a non-const key, for now.
860	https://github.com/ARMmbed/mbedtls/issues/396 */
861	#if MBEDTLS_VERSION_NUMBER == 0x03000000
862	if(mbedtls_x509_crt_parse_der(p,
863	peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p),
864	peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len))) {
865	#else
866	if(mbedtls_x509_crt_parse_der(p, peercert->raw.p, peercert->raw.len)) {
867	#endif
868	failf(data, "Failed copying peer certificate");
869	result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
870	goto pinnedpubkey_error;
871	}
872
873	#if MBEDTLS_VERSION_NUMBER == 0x03000000
874	size = mbedtls_pk_write_pubkey_der(&p->MBEDTLS_PRIVATE(pk), pubkey,
875	PUB_DER_MAX_BYTES);
876	#else
877	size = mbedtls_pk_write_pubkey_der(&p->pk, pubkey, PUB_DER_MAX_BYTES);
878	#endif
879
880	if(size <= 0) {
881	failf(data, "Failed copying public key from peer certificate");
882	result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
883	goto pinnedpubkey_error;
884	}
885
886	/* mbedtls_pk_write_pubkey_der writes data at the end of the buffer. */
887	result = Curl_pin_peer_pubkey(data,
888	pinnedpubkey,
889	&pubkey[PUB_DER_MAX_BYTES - size], size);
890	pinnedpubkey_error:
891	mbedtls_x509_crt_free(p);
892	free(p);
893	free(pubkey);
894	if(result) {
895	return result;
896	}
897	}
898
899	#ifdef HAS_ALPN
900	if(connssl->alpn) {
901	const char *proto = mbedtls_ssl_get_alpn_protocol(&backend->ssl);
902
903	Curl_alpn_set_negotiated(cf, data, (const unsigned char *)proto,
904	proto? strlen(proto) : 0);
905	}
906	#endif
907
908	connssl->connecting_state = ssl_connect_3;
909	infof(data, "SSL connected");
910
911	return CURLE_OK;
912	}
913
914	static CURLcode
915	mbed_connect_step3(struct Curl_cfilter cf, struct Curl_easy data)
916	{
917	CURLcode retcode = CURLE_OK;
918	struct ssl_connect_data *connssl = cf->ctx;
919	struct mbed_ssl_backend_data *backend =
920	(struct mbed_ssl_backend_data *)connssl->backend;
921	struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
922
923	DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
924	DEBUGASSERT(backend);
925
926	if(ssl_config->primary.sessionid) {
927	int ret;
928	mbedtls_ssl_session *our_ssl_sessionid;
929	void *old_ssl_sessionid = NULL;
930	bool added = FALSE;
931
932	our_ssl_sessionid = malloc(sizeof(mbedtls_ssl_session));
933	if(!our_ssl_sessionid)
934	return CURLE_OUT_OF_MEMORY;
935
936	mbedtls_ssl_session_init(our_ssl_sessionid);
937
938	ret = mbedtls_ssl_get_session(&backend->ssl, our_ssl_sessionid);
939	if(ret) {
940	if(ret != MBEDTLS_ERR_SSL_ALLOC_FAILED)
941	mbedtls_ssl_session_free(our_ssl_sessionid);
942	free(our_ssl_sessionid);
943	failf(data, "mbedtls_ssl_get_session returned -0x%x", -ret);
944	return CURLE_SSL_CONNECT_ERROR;
945	}
946
947	/* If there's already a matching session in the cache, delete it */
948	Curl_ssl_sessionid_lock(data);
949	if(!Curl_ssl_getsessionid(cf, data, &old_ssl_sessionid, NULL))
950	Curl_ssl_delsessionid(data, old_ssl_sessionid);
951
952	retcode = Curl_ssl_addsessionid(cf, data, our_ssl_sessionid,
953	0, &added);
954	Curl_ssl_sessionid_unlock(data);
955	if(!added) {
956	mbedtls_ssl_session_free(our_ssl_sessionid);
957	free(our_ssl_sessionid);
958	}
959	if(retcode) {
960	failf(data, "failed to store ssl session");
961	return retcode;
962	}
963	}
964
965	connssl->connecting_state = ssl_connect_done;
966
967	return CURLE_OK;
968	}
969
970	static ssize_t mbed_send(struct Curl_cfilter cf, struct Curl_easy data,
971	const void *mem, size_t len,
972	CURLcode *curlcode)
973	{
974	struct ssl_connect_data *connssl = cf->ctx;
975	struct mbed_ssl_backend_data *backend =
976	(struct mbed_ssl_backend_data *)connssl->backend;
977	int ret = -1;
978
979	(void)data;
980	DEBUGASSERT(backend);
981	ret = mbedtls_ssl_write(&backend->ssl, (unsigned char *)mem, len);
982
983	if(ret < 0) {
984	*curlcode = (ret == MBEDTLS_ERR_SSL_WANT_WRITE) ?
985	CURLE_AGAIN : CURLE_SEND_ERROR;
986	ret = -1;
987	}
988
989	return ret;
990	}
991
992	static void mbedtls_close_all(struct Curl_easy *data)
993	{
994	(void)data;
995	}
996
997	static void mbedtls_close(struct Curl_cfilter cf, struct Curl_easy data)
998	{
999	struct ssl_connect_data *connssl = cf->ctx;
1000	struct mbed_ssl_backend_data *backend =
1001	(struct mbed_ssl_backend_data *)connssl->backend;
1002	char buf[32];
1003
1004	(void)data;
1005	DEBUGASSERT(backend);
1006
1007	/* Maybe the server has already sent a close notify alert.
1008	Read it to avoid an RST on the TCP connection. */
1009	(void)mbedtls_ssl_read(&backend->ssl, (unsigned char *)buf, sizeof(buf));
1010
1011	mbedtls_pk_free(&backend->pk);
1012	mbedtls_x509_crt_free(&backend->clicert);
1013	mbedtls_x509_crt_free(&backend->cacert);
1014	#ifdef MBEDTLS_X509_CRL_PARSE_C
1015	mbedtls_x509_crl_free(&backend->crl);
1016	#endif
1017	mbedtls_ssl_config_free(&backend->config);
1018	mbedtls_ssl_free(&backend->ssl);
1019	mbedtls_ctr_drbg_free(&backend->ctr_drbg);
1020	#ifndef THREADING_SUPPORT
1021	mbedtls_entropy_free(&backend->entropy);
1022	#endif /* THREADING_SUPPORT */
1023	}
1024
1025	static ssize_t mbed_recv(struct Curl_cfilter cf, struct Curl_easy data,
1026	char *buf, size_t buffersize,
1027	CURLcode *curlcode)
1028	{
1029	struct ssl_connect_data *connssl = cf->ctx;
1030	struct mbed_ssl_backend_data *backend =
1031	(struct mbed_ssl_backend_data *)connssl->backend;
1032	int ret = -1;
1033	ssize_t len = -1;
1034
1035	(void)data;
1036	DEBUGASSERT(backend);
1037
1038	ret = mbedtls_ssl_read(&backend->ssl, (unsigned char *)buf,
1039	buffersize);
1040
1041	if(ret <= 0) {
1042	if(ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY)
1043	return 0;
1044
1045	*curlcode = (ret == MBEDTLS_ERR_SSL_WANT_READ) ?
1046	CURLE_AGAIN : CURLE_RECV_ERROR;
1047	return -1;
1048	}
1049
1050	len = ret;
1051
1052	return len;
1053	}
1054
1055	static void mbedtls_session_free(void *ptr)
1056	{
1057	mbedtls_ssl_session_free(ptr);
1058	free(ptr);
1059	}
1060
1061	static size_t mbedtls_version(char *buffer, size_t size)
1062	{
1063	#ifdef MBEDTLS_VERSION_C
1064	/* if mbedtls_version_get_number() is available it is better */
1065	unsigned int version = mbedtls_version_get_number();
1066	return msnprintf(buffer, size, "mbedTLS/%u.%u.%u", version>>24,
1067	(version>>16)&0xff, (version>>8)&0xff);
1068	#else
1069	return msnprintf(buffer, size, "mbedTLS/%s", MBEDTLS_VERSION_STRING);
1070	#endif
1071	}
1072
1073	static CURLcode mbedtls_random(struct Curl_easy *data,
1074	unsigned char *entropy, size_t length)
1075	{
1076	#if defined(MBEDTLS_CTR_DRBG_C)
1077	int ret = -1;
1078	char errorbuf[128];
1079	mbedtls_entropy_context ctr_entropy;
1080	mbedtls_ctr_drbg_context ctr_drbg;
1081	mbedtls_entropy_init(&ctr_entropy);
1082	mbedtls_ctr_drbg_init(&ctr_drbg);
1083
1084	ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func,
1085	&ctr_entropy, NULL, 0);
1086
1087	if(ret) {
1088	mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
1089	failf(data, "mbedtls_ctr_drbg_seed returned (-0x%04X) %s",
1090	-ret, errorbuf);
1091	}
1092	else {
1093	ret = mbedtls_ctr_drbg_random(&ctr_drbg, entropy, length);
1094
1095	if(ret) {
1096	mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
1097	failf(data, "mbedtls_ctr_drbg_random returned (-0x%04X) %s",
1098	-ret, errorbuf);
1099	}
1100	}
1101
1102	mbedtls_ctr_drbg_free(&ctr_drbg);
1103	mbedtls_entropy_free(&ctr_entropy);
1104
1105	return ret == 0 ? CURLE_OK : CURLE_FAILED_INIT;
1106	#elif defined(MBEDTLS_HAVEGE_C)
1107	mbedtls_havege_state hs;
1108	mbedtls_havege_init(&hs);
1109	mbedtls_havege_random(&hs, entropy, length);
1110	mbedtls_havege_free(&hs);
1111	return CURLE_OK;
1112	#else
1113	return CURLE_NOT_BUILT_IN;
1114	#endif
1115	}
1116
1117	static CURLcode
1118	mbed_connect_common(struct Curl_cfilter cf, struct Curl_easy data,
1119	bool nonblocking,
1120	bool *done)
1121	{
1122	CURLcode retcode;
1123	struct ssl_connect_data *connssl = cf->ctx;
1124	curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
1125	timediff_t timeout_ms;
1126	int what;
1127
1128	/* check if the connection has already been established */
1129	if(ssl_connection_complete == connssl->state) {
1130	*done = TRUE;
1131	return CURLE_OK;
1132	}
1133
1134	if(ssl_connect_1 == connssl->connecting_state) {
1135	/* Find out how much more time we're allowed */
1136	timeout_ms = Curl_timeleft(data, NULL, TRUE);
1137
1138	if(timeout_ms < 0) {
1139	/* no need to continue if time already is up */
1140	failf(data, "SSL connection timeout");
1141	return CURLE_OPERATION_TIMEDOUT;
1142	}
1143	retcode = mbed_connect_step1(cf, data);
1144	if(retcode)
1145	return retcode;
1146	}
1147
1148	while(ssl_connect_2 == connssl->connecting_state \|\|
1149	ssl_connect_2_reading == connssl->connecting_state \|\|
1150	ssl_connect_2_writing == connssl->connecting_state) {
1151
1152	/* check allowed time left */
1153	timeout_ms = Curl_timeleft(data, NULL, TRUE);
1154
1155	if(timeout_ms < 0) {
1156	/* no need to continue if time already is up */
1157	failf(data, "SSL connection timeout");
1158	return CURLE_OPERATION_TIMEDOUT;
1159	}
1160
1161	/* if ssl is expecting something, check if it's available. */
1162	if(connssl->connecting_state == ssl_connect_2_reading
1163	\|\| connssl->connecting_state == ssl_connect_2_writing) {
1164
1165	curl_socket_t writefd = ssl_connect_2_writing ==
1166	connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
1167	curl_socket_t readfd = ssl_connect_2_reading ==
1168	connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
1169
1170	what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
1171	nonblocking ? 0 : timeout_ms);
1172	if(what < 0) {
1173	/* fatal error */
1174	failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
1175	return CURLE_SSL_CONNECT_ERROR;
1176	}
1177	else if(0 == what) {
1178	if(nonblocking) {
1179	*done = FALSE;
1180	return CURLE_OK;
1181	}
1182	else {
1183	/* timeout */
1184	failf(data, "SSL connection timeout");
1185	return CURLE_OPERATION_TIMEDOUT;
1186	}
1187	}
1188	/* socket is readable or writable */
1189	}
1190
1191	/* Run transaction, and return to the caller if it failed or if
1192	* this connection is part of a multi handle and this loop would
1193	* execute again. This permits the owner of a multi handle to
1194	* abort a connection attempt before step2 has completed while
1195	* ensuring that a client using select() or epoll() will always
1196	* have a valid fdset to wait on.
1197	*/
1198	retcode = mbed_connect_step2(cf, data);
1199	if(retcode \|\| (nonblocking &&
1200	(ssl_connect_2 == connssl->connecting_state \|\|
1201	ssl_connect_2_reading == connssl->connecting_state \|\|
1202	ssl_connect_2_writing == connssl->connecting_state)))
1203	return retcode;
1204
1205	} /* repeat step2 until all transactions are done. */
1206
1207	if(ssl_connect_3 == connssl->connecting_state) {
1208	retcode = mbed_connect_step3(cf, data);
1209	if(retcode)
1210	return retcode;
1211	}
1212
1213	if(ssl_connect_done == connssl->connecting_state) {
1214	connssl->state = ssl_connection_complete;
1215	*done = TRUE;
1216	}
1217	else
1218	*done = FALSE;
1219
1220	/* Reset our connect state machine */
1221	connssl->connecting_state = ssl_connect_1;
1222
1223	return CURLE_OK;
1224	}
1225
1226	static CURLcode mbedtls_connect_nonblocking(struct Curl_cfilter *cf,
1227	struct Curl_easy *data,
1228	bool *done)
1229	{
1230	return mbed_connect_common(cf, data, TRUE, done);
1231	}
1232
1233
1234	static CURLcode mbedtls_connect(struct Curl_cfilter *cf,
1235	struct Curl_easy *data)
1236	{
1237	CURLcode retcode;
1238	bool done = FALSE;
1239
1240	retcode = mbed_connect_common(cf, data, FALSE, &done);
1241	if(retcode)
1242	return retcode;
1243
1244	DEBUGASSERT(done);
1245
1246	return CURLE_OK;
1247	}
1248
1249	/*
1250	* return 0 error initializing SSL
1251	* return 1 SSL initialized successfully
1252	*/
1253	static int mbedtls_init(void)
1254	{
1255	if(!Curl_mbedtlsthreadlock_thread_setup())
1256	return 0;
1257	#ifdef THREADING_SUPPORT
1258	entropy_init_mutex(&ts_entropy);
1259	#endif
1260	return 1;
1261	}
1262
1263	static void mbedtls_cleanup(void)
1264	{
1265	#ifdef THREADING_SUPPORT
1266	entropy_cleanup_mutex(&ts_entropy);
1267	#endif
1268	(void)Curl_mbedtlsthreadlock_thread_cleanup();
1269	}
1270
1271	static bool mbedtls_data_pending(struct Curl_cfilter *cf,
1272	const struct Curl_easy *data)
1273	{
1274	struct ssl_connect_data *ctx = cf->ctx;
1275	struct mbed_ssl_backend_data *backend;
1276
1277	(void)data;
1278	DEBUGASSERT(ctx && ctx->backend);
1279	backend = (struct mbed_ssl_backend_data *)ctx->backend;
1280	return mbedtls_ssl_get_bytes_avail(&backend->ssl) != 0;
1281	}
1282
1283	static CURLcode mbedtls_sha256sum(const unsigned char *input,
1284	size_t inputlen,
1285	unsigned char *sha256sum,
1286	size_t sha256len UNUSED_PARAM)
1287	{
1288	/* TODO: explain this for different mbedtls 2.x vs 3 version */
1289	(void)sha256len;
1290	#if MBEDTLS_VERSION_NUMBER < 0x02070000
1291	mbedtls_sha256(input, inputlen, sha256sum, 0);
1292	#else
1293	/* returns 0 on success, otherwise failure */
1294	#if MBEDTLS_VERSION_NUMBER >= 0x03000000
1295	if(mbedtls_sha256(input, inputlen, sha256sum, 0) != 0)
1296	#else
1297	if(mbedtls_sha256_ret(input, inputlen, sha256sum, 0) != 0)
1298	#endif
1299	return CURLE_BAD_FUNCTION_ARGUMENT;
1300	#endif
1301	return CURLE_OK;
1302	}
1303
1304	static void mbedtls_get_internals(struct ssl_connect_data connssl,
1305	CURLINFO info UNUSED_PARAM)
1306	{
1307	struct mbed_ssl_backend_data *backend =
1308	(struct mbed_ssl_backend_data *)connssl->backend;
1309	(void)info;
1310	DEBUGASSERT(backend);
1311	return &backend->ssl;
1312	}
1313
1314	const struct Curl_ssl Curl_ssl_mbedtls = {
1315	{ CURLSSLBACKEND_MBEDTLS, "mbedtls" }, /* info */
1316
1317	SSLSUPP_CA_PATH \|
1318	SSLSUPP_CAINFO_BLOB \|
1319	SSLSUPP_PINNEDPUBKEY \|
1320	SSLSUPP_SSL_CTX \|
1321	SSLSUPP_HTTPS_PROXY,
1322
1323	sizeof(struct mbed_ssl_backend_data),
1324
1325	mbedtls_init, /* init */
1326	mbedtls_cleanup, /* cleanup */
1327	mbedtls_version, /* version */
1328	Curl_none_check_cxn, /* check_cxn */
1329	Curl_none_shutdown, /* shutdown */
1330	mbedtls_data_pending, /* data_pending */
1331	mbedtls_random, /* random */
1332	Curl_none_cert_status_request, /* cert_status_request */
1333	mbedtls_connect, /* connect */
1334	mbedtls_connect_nonblocking, /* connect_nonblocking */
1335	Curl_ssl_adjust_pollset, /* adjust_pollset */
1336	mbedtls_get_internals, /* get_internals */
1337	mbedtls_close, /* close_one */
1338	mbedtls_close_all, /* close_all */
1339	mbedtls_session_free, /* session_free */
1340	Curl_none_set_engine, /* set_engine */
1341	Curl_none_set_engine_default, /* set_engine_default */
1342	Curl_none_engines_list, /* engines_list */
1343	Curl_none_false_start, /* false_start */
1344	mbedtls_sha256sum, /* sha256sum */
1345	NULL, /* associate_connection */
1346	NULL, /* disassociate_connection */
1347	NULL, /* free_multi_ssl_backend_data */
1348	mbed_recv, /* recv decrypted data */
1349	mbed_send, /* send data to encrypt */
1350	};
1351
1352	#endif /* USE_MBEDTLS */

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/libs/curl-8.7.1/lib/vtls/mbedtls.c@ 106542

以其他格式下載: