1 #ifndef HEADER_CURL_VTLS_INT_H 2 #define HEADER_CURL_VTLS_INT_H 3 /*************************************************************************** 4 * _ _ ____ _ 5 * Project ___| | | | _ \| | 6 * / __| | | | |_) | | 7 * | (__| |_| | _ <| |___ 8 * \___|\___/|_| \_\_____| 9 * 10 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. 11 * 12 * This software is licensed as described in the file COPYING, which 13 * you should have received as part of this distribution. The terms 14 * are also available at https://curl.se/docs/copyright.html. 15 * 16 * You may opt to use, copy, modify, merge, publish, distribute and/or sell 17 * copies of the Software, and permit persons to whom the Software is 18 * furnished to do so, under the terms of the COPYING file. 19 * 20 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY 21 * KIND, either express or implied. 22 * 23 * SPDX-License-Identifier: curl 24 * 25 ***************************************************************************/ 26 #include "curl_setup.h" 27 #include "cfilters.h" 28 #include "urldata.h" 29 30 #ifdef USE_SSL 31 32 /* see https://www.iana.org/assignments/tls-extensiontype-values/ */ 33 #define ALPN_HTTP_1_1_LENGTH 8 34 #define ALPN_HTTP_1_1 "http/1.1" 35 #define ALPN_HTTP_1_0_LENGTH 8 36 #define ALPN_HTTP_1_0 "http/1.0" 37 #define ALPN_H2_LENGTH 2 38 #define ALPN_H2 "h2" 39 #define ALPN_H3_LENGTH 2 40 #define ALPN_H3 "h3" 41 42 /* conservative sizes on the ALPN entries and count we are handling, 43 * we can increase these if we ever feel the need or have to accommodate 44 * ALPN strings from the "outside". */ 45 #define ALPN_NAME_MAX 10 46 #define ALPN_ENTRIES_MAX 3 47 #define ALPN_PROTO_BUF_MAX (ALPN_ENTRIES_MAX * (ALPN_NAME_MAX + 1)) 48 49 struct alpn_spec { 50 const char entries[ALPN_ENTRIES_MAX][ALPN_NAME_MAX]; 51 size_t count; /* number of entries */ 52 }; 53 54 struct alpn_proto_buf { 55 unsigned char data[ALPN_PROTO_BUF_MAX]; 56 int len; 57 }; 58 59 CURLcode Curl_alpn_to_proto_buf(struct alpn_proto_buf *buf, 60 const struct alpn_spec *spec); 61 CURLcode Curl_alpn_to_proto_str(struct alpn_proto_buf *buf, 62 const struct alpn_spec *spec); 63 64 CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf, 65 struct Curl_easy *data, 66 const unsigned char *proto, 67 size_t proto_len); 68 69 /* Information in each SSL cfilter context: cf->ctx */ 70 struct ssl_connect_data { 71 ssl_connection_state state; 72 ssl_connect_state connecting_state; 73 char *hostname; /* hostname for verification */ 74 char *dispname; /* display version of hostname */ 75 const struct alpn_spec *alpn; /* ALPN to use or NULL for none */ 76 void *backend; /* vtls backend specific props */ 77 struct cf_call_data call_data; /* data handle used in current call */ 78 struct curltime handshake_done; /* time when handshake finished */ 79 int port; /* remote port at origin */ 80 BIT(use_alpn); /* if ALPN shall be used in handshake */ 81 }; 82 83 84 #undef CF_CTX_CALL_DATA 85 #define CF_CTX_CALL_DATA(cf) \ 86 ((struct ssl_connect_data *)(cf)->ctx)->call_data 87 88 89 /* Definitions for SSL Implementations */ 90 91 struct Curl_ssl { 92 /* 93 * This *must* be the first entry to allow returning the list of available 94 * backends in curl_global_sslset(). 95 */ 96 curl_ssl_backend info; 97 unsigned int supports; /* bitfield, see above */ 98 size_t sizeof_ssl_backend_data; 99 100 int (*init)(void); 101 void (*cleanup)(void); 102 103 size_t (*version)(char *buffer, size_t size); 104 int (*check_cxn)(struct Curl_cfilter *cf, struct Curl_easy *data); 105 int (*shut_down)(struct Curl_cfilter *cf, 106 struct Curl_easy *data); 107 bool (*data_pending)(struct Curl_cfilter *cf, 108 const struct Curl_easy *data); 109 110 /* return 0 if a find random is filled in */ 111 CURLcode (*random)(struct Curl_easy *data, unsigned char *entropy, 112 size_t length); 113 bool (*cert_status_request)(void); 114 115 CURLcode (*connect_blocking)(struct Curl_cfilter *cf, 116 struct Curl_easy *data); 117 CURLcode (*connect_nonblocking)(struct Curl_cfilter *cf, 118 struct Curl_easy *data, 119 bool *done); 120 121 /* If the SSL backend wants to read or write on this connection during a 122 handshake, set socks[0] to the connection's FIRSTSOCKET, and return 123 a bitmap indicating read or write with GETSOCK_WRITESOCK(0) or 124 GETSOCK_READSOCK(0). Otherwise return GETSOCK_BLANK. 125 Mandatory. */ 126 int (*get_select_socks)(struct Curl_cfilter *cf, struct Curl_easy *data, 127 curl_socket_t *socks); 128 129 void *(*get_internals)(struct ssl_connect_data *connssl, CURLINFO info); 130 void (*close)(struct Curl_cfilter *cf, struct Curl_easy *data); 131 void (*close_all)(struct Curl_easy *data); 132 void (*session_free)(void *ptr); 133 134 CURLcode (*set_engine)(struct Curl_easy *data, const char *engine); 135 CURLcode (*set_engine_default)(struct Curl_easy *data); 136 struct curl_slist *(*engines_list)(struct Curl_easy *data); 137 138 bool (*false_start)(void); 139 CURLcode (*sha256sum)(const unsigned char *input, size_t inputlen, 140 unsigned char *sha256sum, size_t sha256sumlen); 141 142 bool (*attach_data)(struct Curl_cfilter *cf, struct Curl_easy *data); 143 void (*detach_data)(struct Curl_cfilter *cf, struct Curl_easy *data); 144 145 void (*free_multi_ssl_backend_data)(struct multi_ssl_backend_data *mbackend); 146 147 ssize_t (*recv_plain)(struct Curl_cfilter *cf, struct Curl_easy *data, 148 char *buf, size_t len, CURLcode *code); 149 ssize_t (*send_plain)(struct Curl_cfilter *cf, struct Curl_easy *data, 150 const void *mem, size_t len, CURLcode *code); 151 152 }; 153 154 extern const struct Curl_ssl *Curl_ssl; 155 156 157 int Curl_none_init(void); 158 void Curl_none_cleanup(void); 159 int Curl_none_shutdown(struct Curl_cfilter *cf, struct Curl_easy *data); 160 int Curl_none_check_cxn(struct Curl_cfilter *cf, struct Curl_easy *data); 161 CURLcode Curl_none_random(struct Curl_easy *data, unsigned char *entropy, 162 size_t length); 163 void Curl_none_close_all(struct Curl_easy *data); 164 void Curl_none_session_free(void *ptr); 165 bool Curl_none_data_pending(struct Curl_cfilter *cf, 166 const struct Curl_easy *data); 167 bool Curl_none_cert_status_request(void); 168 CURLcode Curl_none_set_engine(struct Curl_easy *data, const char *engine); 169 CURLcode Curl_none_set_engine_default(struct Curl_easy *data); 170 struct curl_slist *Curl_none_engines_list(struct Curl_easy *data); 171 bool Curl_none_false_start(void); 172 int Curl_ssl_get_select_socks(struct Curl_cfilter *cf, struct Curl_easy *data, 173 curl_socket_t *socks); 174 175 /** 176 * Get the ssl_config_data in `data` that is relevant for cfilter `cf`. 177 */ 178 struct ssl_config_data *Curl_ssl_cf_get_config(struct Curl_cfilter *cf, 179 struct Curl_easy *data); 180 181 /** 182 * Get the primary config relevant for the filter from its connection. 183 */ 184 struct ssl_primary_config * 185 Curl_ssl_cf_get_primary_config(struct Curl_cfilter *cf); 186 187 /** 188 * Get the first SSL filter in the chain starting with `cf`, or NULL. 189 */ 190 struct Curl_cfilter *Curl_ssl_cf_get_ssl(struct Curl_cfilter *cf); 191 192 /** 193 * Get the SSL filter below the given one or NULL if there is none. 194 */ 195 bool Curl_ssl_cf_is_proxy(struct Curl_cfilter *cf); 196 197 /* extract a session ID 198 * Sessionid mutex must be locked (see Curl_ssl_sessionid_lock). 199 * Caller must make sure that the ownership of returned sessionid object 200 * is properly taken (e.g. its refcount is incremented 201 * under sessionid mutex). 202 */ 203 bool Curl_ssl_getsessionid(struct Curl_cfilter *cf, 204 struct Curl_easy *data, 205 void **ssl_sessionid, 206 size_t *idsize); /* set 0 if unknown */ 207 /* add a new session ID 208 * Sessionid mutex must be locked (see Curl_ssl_sessionid_lock). 209 * Caller must ensure that it has properly shared ownership of this sessionid 210 * object with cache (e.g. incrementing refcount on success) 211 */ 212 CURLcode Curl_ssl_addsessionid(struct Curl_cfilter *cf, 213 struct Curl_easy *data, 214 void *ssl_sessionid, 215 size_t idsize, 216 bool *added); 217 218 #include "openssl.h" /* OpenSSL versions */ 219 #include "gtls.h" /* GnuTLS versions */ 220 #include "wolfssl.h" /* wolfSSL versions */ 221 #include "schannel.h" /* Schannel SSPI version */ 222 #include "sectransp.h" /* SecureTransport (Darwin) version */ 223 #include "mbedtls.h" /* mbedTLS versions */ 224 #include "bearssl.h" /* BearSSL versions */ 225 #include "rustls.h" /* rustls versions */ 226 227 #endif /* USE_SSL */ 228 229 #endif /* HEADER_CURL_VTLS_INT_H */ 230