• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /***************************************************************************
2  *                                  _   _ ____  _
3  *  Project                     ___| | | |  _ \| |
4  *                             / __| | | | |_) | |
5  *                            | (__| |_| |  _ <| |___
6  *                             \___|\___/|_| \_\_____|
7  *
8  * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
9  *
10  * This software is licensed as described in the file COPYING, which
11  * you should have received as part of this distribution. The terms
12  * are also available at https://curl.haxx.se/docs/copyright.html.
13  *
14  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15  * copies of the Software, and permit persons to whom the Software is
16  * furnished to do so, under the terms of the COPYING file.
17  *
18  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19  * KIND, either express or implied.
20  *
21  ***************************************************************************/
22 
23 /* This file is for implementing all "generic" SSL functions that all libcurl
24    internals should use. It is then responsible for calling the proper
25    "backend" function.
26 
27    SSL-functions in libcurl should call functions in this source file, and not
28    to any specific SSL-layer.
29 
30    Curl_ssl_ - prefix for generic ones
31 
32    Note that this source code uses the functions of the configured SSL
33    backend via the global Curl_ssl instance.
34 
35    "SSL/TLS Strong Encryption: An Introduction"
36    https://httpd.apache.org/docs/2.0/ssl/ssl_intro.html
37 */
38 
39 #include "curl_setup.h"
40 
41 #ifdef HAVE_SYS_TYPES_H
42 #include <sys/types.h>
43 #endif
44 #ifdef HAVE_SYS_STAT_H
45 #include <sys/stat.h>
46 #endif
47 #ifdef HAVE_FCNTL_H
48 #include <fcntl.h>
49 #endif
50 
51 #include "urldata.h"
52 
53 #include "vtls.h" /* generic SSL protos etc */
54 #include "slist.h"
55 #include "sendf.h"
56 #include "strcase.h"
57 #include "url.h"
58 #include "progress.h"
59 #include "share.h"
60 #include "multiif.h"
61 #include "timeval.h"
62 #include "curl_md5.h"
63 #include "warnless.h"
64 #include "curl_base64.h"
65 #include "curl_printf.h"
66 
67 /* The last #include files should be: */
68 #include "curl_memory.h"
69 #include "memdebug.h"
70 
71 /* convenience macro to check if this handle is using a shared SSL session */
72 #define SSLSESSION_SHARED(data) (data->share &&                        \
73                                  (data->share->specifier &             \
74                                   (1<<CURL_LOCK_DATA_SSL_SESSION)))
75 
76 #define CLONE_STRING(var)                    \
77   if(source->var) {                          \
78     dest->var = strdup(source->var);         \
79     if(!dest->var)                           \
80       return FALSE;                          \
81   }                                          \
82   else                                       \
83     dest->var = NULL;
84 
85 bool
Curl_ssl_config_matches(struct ssl_primary_config * data,struct ssl_primary_config * needle)86 Curl_ssl_config_matches(struct ssl_primary_config* data,
87                         struct ssl_primary_config* needle)
88 {
89   if((data->version == needle->version) &&
90      (data->version_max == needle->version_max) &&
91      (data->verifypeer == needle->verifypeer) &&
92      (data->verifyhost == needle->verifyhost) &&
93      (data->verifystatus == needle->verifystatus) &&
94      Curl_safe_strcasecompare(data->CApath, needle->CApath) &&
95      Curl_safe_strcasecompare(data->CAfile, needle->CAfile) &&
96      Curl_safe_strcasecompare(data->clientcert, needle->clientcert) &&
97      Curl_safe_strcasecompare(data->random_file, needle->random_file) &&
98      Curl_safe_strcasecompare(data->egdsocket, needle->egdsocket) &&
99      Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) &&
100      Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13) &&
101      Curl_safe_strcasecompare(data->pinned_key, needle->pinned_key))
102     return TRUE;
103 
104   return FALSE;
105 }
106 
107 bool
Curl_clone_primary_ssl_config(struct ssl_primary_config * source,struct ssl_primary_config * dest)108 Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
109                               struct ssl_primary_config *dest)
110 {
111   dest->version = source->version;
112   dest->version_max = source->version_max;
113   dest->verifypeer = source->verifypeer;
114   dest->verifyhost = source->verifyhost;
115   dest->verifystatus = source->verifystatus;
116   dest->sessionid = source->sessionid;
117 
118   CLONE_STRING(CApath);
119   CLONE_STRING(CAfile);
120   CLONE_STRING(clientcert);
121   CLONE_STRING(random_file);
122   CLONE_STRING(egdsocket);
123   CLONE_STRING(cipher_list);
124   CLONE_STRING(cipher_list13);
125   CLONE_STRING(pinned_key);
126 
127   return TRUE;
128 }
129 
Curl_free_primary_ssl_config(struct ssl_primary_config * sslc)130 void Curl_free_primary_ssl_config(struct ssl_primary_config* sslc)
131 {
132   Curl_safefree(sslc->CApath);
133   Curl_safefree(sslc->CAfile);
134   Curl_safefree(sslc->clientcert);
135   Curl_safefree(sslc->random_file);
136   Curl_safefree(sslc->egdsocket);
137   Curl_safefree(sslc->cipher_list);
138   Curl_safefree(sslc->cipher_list13);
139   Curl_safefree(sslc->pinned_key);
140 }
141 
142 #ifdef USE_SSL
143 static int multissl_init(const struct Curl_ssl *backend);
144 #endif
145 
Curl_ssl_backend(void)146 int Curl_ssl_backend(void)
147 {
148 #ifdef USE_SSL
149   multissl_init(NULL);
150   return Curl_ssl->info.id;
151 #else
152   return (int)CURLSSLBACKEND_NONE;
153 #endif
154 }
155 
156 #ifdef USE_SSL
157 
158 /* "global" init done? */
159 static bool init_ssl = FALSE;
160 
161 /**
162  * Global SSL init
163  *
164  * @retval 0 error initializing SSL
165  * @retval 1 SSL initialized successfully
166  */
Curl_ssl_init(void)167 int Curl_ssl_init(void)
168 {
169   /* make sure this is only done once */
170   if(init_ssl)
171     return 1;
172   init_ssl = TRUE; /* never again */
173 
174   return Curl_ssl->init();
175 }
176 
177 
178 /* Global cleanup */
Curl_ssl_cleanup(void)179 void Curl_ssl_cleanup(void)
180 {
181   if(init_ssl) {
182     /* only cleanup if we did a previous init */
183     Curl_ssl->cleanup();
184     init_ssl = FALSE;
185   }
186 }
187 
ssl_prefs_check(struct Curl_easy * data)188 static bool ssl_prefs_check(struct Curl_easy *data)
189 {
190   /* check for CURLOPT_SSLVERSION invalid parameter value */
191   const long sslver = data->set.ssl.primary.version;
192   if((sslver < 0) || (sslver >= CURL_SSLVERSION_LAST)) {
193     failf(data, "Unrecognized parameter value passed via CURLOPT_SSLVERSION");
194     return FALSE;
195   }
196 
197   switch(data->set.ssl.primary.version_max) {
198   case CURL_SSLVERSION_MAX_NONE:
199   case CURL_SSLVERSION_MAX_DEFAULT:
200     break;
201 
202   default:
203     if((data->set.ssl.primary.version_max >> 16) < sslver) {
204       failf(data, "CURL_SSLVERSION_MAX incompatible with CURL_SSLVERSION");
205       return FALSE;
206     }
207   }
208 
209   return TRUE;
210 }
211 
212 static CURLcode
ssl_connect_init_proxy(struct connectdata * conn,int sockindex)213 ssl_connect_init_proxy(struct connectdata *conn, int sockindex)
214 {
215   DEBUGASSERT(conn->bits.proxy_ssl_connected[sockindex]);
216   if(ssl_connection_complete == conn->ssl[sockindex].state &&
217      !conn->proxy_ssl[sockindex].use) {
218     struct ssl_backend_data *pbdata;
219 
220     if(!(Curl_ssl->supports & SSLSUPP_HTTPS_PROXY))
221       return CURLE_NOT_BUILT_IN;
222 
223     /* The pointers to the ssl backend data, which is opaque here, are swapped
224        rather than move the contents. */
225     pbdata = conn->proxy_ssl[sockindex].backend;
226     conn->proxy_ssl[sockindex] = conn->ssl[sockindex];
227 
228     memset(&conn->ssl[sockindex], 0, sizeof(conn->ssl[sockindex]));
229     memset(pbdata, 0, Curl_ssl->sizeof_ssl_backend_data);
230 
231     conn->ssl[sockindex].backend = pbdata;
232   }
233   return CURLE_OK;
234 }
235 
236 CURLcode
Curl_ssl_connect(struct connectdata * conn,int sockindex)237 Curl_ssl_connect(struct connectdata *conn, int sockindex)
238 {
239   CURLcode result;
240 
241   if(conn->bits.proxy_ssl_connected[sockindex]) {
242     result = ssl_connect_init_proxy(conn, sockindex);
243     if(result)
244       return result;
245   }
246 
247   if(!ssl_prefs_check(conn->data))
248     return CURLE_SSL_CONNECT_ERROR;
249 
250   /* mark this is being ssl-enabled from here on. */
251   conn->ssl[sockindex].use = TRUE;
252   conn->ssl[sockindex].state = ssl_connection_negotiating;
253 
254   result = Curl_ssl->connect_blocking(conn, sockindex);
255 
256   if(!result)
257     Curl_pgrsTime(conn->data, TIMER_APPCONNECT); /* SSL is connected */
258 
259   return result;
260 }
261 
262 CURLcode
Curl_ssl_connect_nonblocking(struct connectdata * conn,int sockindex,bool * done)263 Curl_ssl_connect_nonblocking(struct connectdata *conn, int sockindex,
264                              bool *done)
265 {
266   CURLcode result;
267   if(conn->bits.proxy_ssl_connected[sockindex]) {
268     result = ssl_connect_init_proxy(conn, sockindex);
269     if(result)
270       return result;
271   }
272 
273   if(!ssl_prefs_check(conn->data))
274     return CURLE_SSL_CONNECT_ERROR;
275 
276   /* mark this is being ssl requested from here on. */
277   conn->ssl[sockindex].use = TRUE;
278   result = Curl_ssl->connect_nonblocking(conn, sockindex, done);
279   if(!result && *done)
280     Curl_pgrsTime(conn->data, TIMER_APPCONNECT); /* SSL is connected */
281   return result;
282 }
283 
284 /*
285  * Lock shared SSL session data
286  */
Curl_ssl_sessionid_lock(struct connectdata * conn)287 void Curl_ssl_sessionid_lock(struct connectdata *conn)
288 {
289   if(SSLSESSION_SHARED(conn->data))
290     Curl_share_lock(conn->data,
291                     CURL_LOCK_DATA_SSL_SESSION, CURL_LOCK_ACCESS_SINGLE);
292 }
293 
294 /*
295  * Unlock shared SSL session data
296  */
Curl_ssl_sessionid_unlock(struct connectdata * conn)297 void Curl_ssl_sessionid_unlock(struct connectdata *conn)
298 {
299   if(SSLSESSION_SHARED(conn->data))
300     Curl_share_unlock(conn->data, CURL_LOCK_DATA_SSL_SESSION);
301 }
302 
303 /*
304  * Check if there's a session ID for the given connection in the cache, and if
305  * there's one suitable, it is provided. Returns TRUE when no entry matched.
306  */
Curl_ssl_getsessionid(struct connectdata * conn,void ** ssl_sessionid,size_t * idsize,int sockindex)307 bool Curl_ssl_getsessionid(struct connectdata *conn,
308                            void **ssl_sessionid,
309                            size_t *idsize, /* set 0 if unknown */
310                            int sockindex)
311 {
312   struct curl_ssl_session *check;
313   struct Curl_easy *data = conn->data;
314   size_t i;
315   long *general_age;
316   bool no_match = TRUE;
317 
318   const bool isProxy = CONNECT_PROXY_SSL();
319   struct ssl_primary_config * const ssl_config = isProxy ?
320     &conn->proxy_ssl_config :
321     &conn->ssl_config;
322   const char * const name = isProxy ? conn->http_proxy.host.name :
323     conn->host.name;
324   int port = isProxy ? (int)conn->port : conn->remote_port;
325   *ssl_sessionid = NULL;
326 
327   DEBUGASSERT(SSL_SET_OPTION(primary.sessionid));
328 
329   if(!SSL_SET_OPTION(primary.sessionid))
330     /* session ID re-use is disabled */
331     return TRUE;
332 
333   /* Lock if shared */
334   if(SSLSESSION_SHARED(data))
335     general_age = &data->share->sessionage;
336   else
337     general_age = &data->state.sessionage;
338 
339   for(i = 0; i < data->set.general_ssl.max_ssl_sessions; i++) {
340     check = &data->state.session[i];
341     if(!check->sessionid)
342       /* not session ID means blank entry */
343       continue;
344     if(strcasecompare(name, check->name) &&
345        ((!conn->bits.conn_to_host && !check->conn_to_host) ||
346         (conn->bits.conn_to_host && check->conn_to_host &&
347          strcasecompare(conn->conn_to_host.name, check->conn_to_host))) &&
348        ((!conn->bits.conn_to_port && check->conn_to_port == -1) ||
349         (conn->bits.conn_to_port && check->conn_to_port != -1 &&
350          conn->conn_to_port == check->conn_to_port)) &&
351        (port == check->remote_port) &&
352        strcasecompare(conn->handler->scheme, check->scheme) &&
353        Curl_ssl_config_matches(ssl_config, &check->ssl_config)) {
354       /* yes, we have a session ID! */
355       (*general_age)++;          /* increase general age */
356       check->age = *general_age; /* set this as used in this age */
357       *ssl_sessionid = check->sessionid;
358       if(idsize)
359         *idsize = check->idsize;
360       no_match = FALSE;
361       break;
362     }
363   }
364 
365   return no_match;
366 }
367 
368 /*
369  * Kill a single session ID entry in the cache.
370  */
Curl_ssl_kill_session(struct curl_ssl_session * session)371 void Curl_ssl_kill_session(struct curl_ssl_session *session)
372 {
373   if(session->sessionid) {
374     /* defensive check */
375 
376     /* free the ID the SSL-layer specific way */
377     Curl_ssl->session_free(session->sessionid);
378 
379     session->sessionid = NULL;
380     session->age = 0; /* fresh */
381 
382     Curl_free_primary_ssl_config(&session->ssl_config);
383 
384     Curl_safefree(session->name);
385     Curl_safefree(session->conn_to_host);
386   }
387 }
388 
389 /*
390  * Delete the given session ID from the cache.
391  */
Curl_ssl_delsessionid(struct connectdata * conn,void * ssl_sessionid)392 void Curl_ssl_delsessionid(struct connectdata *conn, void *ssl_sessionid)
393 {
394   size_t i;
395   struct Curl_easy *data = conn->data;
396 
397   for(i = 0; i < data->set.general_ssl.max_ssl_sessions; i++) {
398     struct curl_ssl_session *check = &data->state.session[i];
399 
400     if(check->sessionid == ssl_sessionid) {
401       Curl_ssl_kill_session(check);
402       break;
403     }
404   }
405 }
406 
407 /*
408  * Store session id in the session cache. The ID passed on to this function
409  * must already have been extracted and allocated the proper way for the SSL
410  * layer. Curl_XXXX_session_free() will be called to free/kill the session ID
411  * later on.
412  */
Curl_ssl_addsessionid(struct connectdata * conn,void * ssl_sessionid,size_t idsize,int sockindex)413 CURLcode Curl_ssl_addsessionid(struct connectdata *conn,
414                                void *ssl_sessionid,
415                                size_t idsize,
416                                int sockindex)
417 {
418   size_t i;
419   struct Curl_easy *data = conn->data; /* the mother of all structs */
420   struct curl_ssl_session *store = &data->state.session[0];
421   long oldest_age = data->state.session[0].age; /* zero if unused */
422   char *clone_host;
423   char *clone_conn_to_host;
424   int conn_to_port;
425   long *general_age;
426   const bool isProxy = CONNECT_PROXY_SSL();
427   struct ssl_primary_config * const ssl_config = isProxy ?
428     &conn->proxy_ssl_config :
429     &conn->ssl_config;
430 
431   DEBUGASSERT(SSL_SET_OPTION(primary.sessionid));
432 
433   clone_host = strdup(isProxy ? conn->http_proxy.host.name : conn->host.name);
434   if(!clone_host)
435     return CURLE_OUT_OF_MEMORY; /* bail out */
436 
437   if(conn->bits.conn_to_host) {
438     clone_conn_to_host = strdup(conn->conn_to_host.name);
439     if(!clone_conn_to_host) {
440       free(clone_host);
441       return CURLE_OUT_OF_MEMORY; /* bail out */
442     }
443   }
444   else
445     clone_conn_to_host = NULL;
446 
447   if(conn->bits.conn_to_port)
448     conn_to_port = conn->conn_to_port;
449   else
450     conn_to_port = -1;
451 
452   /* Now we should add the session ID and the host name to the cache, (remove
453      the oldest if necessary) */
454 
455   /* If using shared SSL session, lock! */
456   if(SSLSESSION_SHARED(data)) {
457     general_age = &data->share->sessionage;
458   }
459   else {
460     general_age = &data->state.sessionage;
461   }
462 
463   /* find an empty slot for us, or find the oldest */
464   for(i = 1; (i < data->set.general_ssl.max_ssl_sessions) &&
465         data->state.session[i].sessionid; i++) {
466     if(data->state.session[i].age < oldest_age) {
467       oldest_age = data->state.session[i].age;
468       store = &data->state.session[i];
469     }
470   }
471   if(i == data->set.general_ssl.max_ssl_sessions)
472     /* cache is full, we must "kill" the oldest entry! */
473     Curl_ssl_kill_session(store);
474   else
475     store = &data->state.session[i]; /* use this slot */
476 
477   /* now init the session struct wisely */
478   store->sessionid = ssl_sessionid;
479   store->idsize = idsize;
480   store->age = *general_age;    /* set current age */
481   /* free it if there's one already present */
482   free(store->name);
483   free(store->conn_to_host);
484   store->name = clone_host;               /* clone host name */
485   store->conn_to_host = clone_conn_to_host; /* clone connect to host name */
486   store->conn_to_port = conn_to_port; /* connect to port number */
487   /* port number */
488   store->remote_port = isProxy ? (int)conn->port : conn->remote_port;
489   store->scheme = conn->handler->scheme;
490 
491   if(!Curl_clone_primary_ssl_config(ssl_config, &store->ssl_config)) {
492     store->sessionid = NULL; /* let caller free sessionid */
493     free(clone_host);
494     free(clone_conn_to_host);
495     return CURLE_OUT_OF_MEMORY;
496   }
497 
498   return CURLE_OK;
499 }
500 
501 
Curl_ssl_close_all(struct Curl_easy * data)502 void Curl_ssl_close_all(struct Curl_easy *data)
503 {
504   /* kill the session ID cache if not shared */
505   if(data->state.session && !SSLSESSION_SHARED(data)) {
506     size_t i;
507     for(i = 0; i < data->set.general_ssl.max_ssl_sessions; i++)
508       /* the single-killer function handles empty table slots */
509       Curl_ssl_kill_session(&data->state.session[i]);
510 
511     /* free the cache data */
512     Curl_safefree(data->state.session);
513   }
514 
515   Curl_ssl->close_all(data);
516 }
517 
518 #if defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \
519   defined(USE_SECTRANSP) || defined(USE_POLARSSL) || defined(USE_NSS) || \
520   defined(USE_MBEDTLS) || defined(USE_WOLFSSL)
Curl_ssl_getsock(struct connectdata * conn,curl_socket_t * socks)521 int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks)
522 {
523   struct ssl_connect_data *connssl = &conn->ssl[FIRSTSOCKET];
524 
525   if(connssl->connecting_state == ssl_connect_2_writing) {
526     /* write mode */
527     socks[0] = conn->sock[FIRSTSOCKET];
528     return GETSOCK_WRITESOCK(0);
529   }
530   if(connssl->connecting_state == ssl_connect_2_reading) {
531     /* read mode */
532     socks[0] = conn->sock[FIRSTSOCKET];
533     return GETSOCK_READSOCK(0);
534   }
535 
536   return GETSOCK_BLANK;
537 }
538 #else
Curl_ssl_getsock(struct connectdata * conn,curl_socket_t * socks)539 int Curl_ssl_getsock(struct connectdata *conn,
540                      curl_socket_t *socks)
541 {
542   (void)conn;
543   (void)socks;
544   return GETSOCK_BLANK;
545 }
546 /* USE_OPENSSL || USE_GNUTLS || USE_SCHANNEL || USE_SECTRANSP || USE_NSS */
547 #endif
548 
Curl_ssl_close(struct connectdata * conn,int sockindex)549 void Curl_ssl_close(struct connectdata *conn, int sockindex)
550 {
551   DEBUGASSERT((sockindex <= 1) && (sockindex >= -1));
552   Curl_ssl->close_one(conn, sockindex);
553 }
554 
Curl_ssl_shutdown(struct connectdata * conn,int sockindex)555 CURLcode Curl_ssl_shutdown(struct connectdata *conn, int sockindex)
556 {
557   if(Curl_ssl->shut_down(conn, sockindex))
558     return CURLE_SSL_SHUTDOWN_FAILED;
559 
560   conn->ssl[sockindex].use = FALSE; /* get back to ordinary socket usage */
561   conn->ssl[sockindex].state = ssl_connection_none;
562 
563   conn->recv[sockindex] = Curl_recv_plain;
564   conn->send[sockindex] = Curl_send_plain;
565 
566   return CURLE_OK;
567 }
568 
569 /* Selects an SSL crypto engine
570  */
Curl_ssl_set_engine(struct Curl_easy * data,const char * engine)571 CURLcode Curl_ssl_set_engine(struct Curl_easy *data, const char *engine)
572 {
573   return Curl_ssl->set_engine(data, engine);
574 }
575 
576 /* Selects the default SSL crypto engine
577  */
Curl_ssl_set_engine_default(struct Curl_easy * data)578 CURLcode Curl_ssl_set_engine_default(struct Curl_easy *data)
579 {
580   return Curl_ssl->set_engine_default(data);
581 }
582 
583 /* Return list of OpenSSL crypto engine names. */
Curl_ssl_engines_list(struct Curl_easy * data)584 struct curl_slist *Curl_ssl_engines_list(struct Curl_easy *data)
585 {
586   return Curl_ssl->engines_list(data);
587 }
588 
589 /*
590  * This sets up a session ID cache to the specified size. Make sure this code
591  * is agnostic to what underlying SSL technology we use.
592  */
Curl_ssl_initsessions(struct Curl_easy * data,size_t amount)593 CURLcode Curl_ssl_initsessions(struct Curl_easy *data, size_t amount)
594 {
595   struct curl_ssl_session *session;
596 
597   if(data->state.session)
598     /* this is just a precaution to prevent multiple inits */
599     return CURLE_OK;
600 
601   session = calloc(amount, sizeof(struct curl_ssl_session));
602   if(!session)
603     return CURLE_OUT_OF_MEMORY;
604 
605   /* store the info in the SSL section */
606   data->set.general_ssl.max_ssl_sessions = amount;
607   data->state.session = session;
608   data->state.sessionage = 1; /* this is brand new */
609   return CURLE_OK;
610 }
611 
612 static size_t Curl_multissl_version(char *buffer, size_t size);
613 
Curl_ssl_version(char * buffer,size_t size)614 size_t Curl_ssl_version(char *buffer, size_t size)
615 {
616 #ifdef CURL_WITH_MULTI_SSL
617   return Curl_multissl_version(buffer, size);
618 #else
619   return Curl_ssl->version(buffer, size);
620 #endif
621 }
622 
623 /*
624  * This function tries to determine connection status.
625  *
626  * Return codes:
627  *     1 means the connection is still in place
628  *     0 means the connection has been closed
629  *    -1 means the connection status is unknown
630  */
Curl_ssl_check_cxn(struct connectdata * conn)631 int Curl_ssl_check_cxn(struct connectdata *conn)
632 {
633   return Curl_ssl->check_cxn(conn);
634 }
635 
Curl_ssl_data_pending(const struct connectdata * conn,int connindex)636 bool Curl_ssl_data_pending(const struct connectdata *conn,
637                            int connindex)
638 {
639   return Curl_ssl->data_pending(conn, connindex);
640 }
641 
Curl_ssl_free_certinfo(struct Curl_easy * data)642 void Curl_ssl_free_certinfo(struct Curl_easy *data)
643 {
644   struct curl_certinfo *ci = &data->info.certs;
645 
646   if(ci->num_of_certs) {
647     /* free all individual lists used */
648     int i;
649     for(i = 0; i<ci->num_of_certs; i++) {
650       curl_slist_free_all(ci->certinfo[i]);
651       ci->certinfo[i] = NULL;
652     }
653 
654     free(ci->certinfo); /* free the actual array too */
655     ci->certinfo = NULL;
656     ci->num_of_certs = 0;
657   }
658 }
659 
Curl_ssl_init_certinfo(struct Curl_easy * data,int num)660 CURLcode Curl_ssl_init_certinfo(struct Curl_easy *data, int num)
661 {
662   struct curl_certinfo *ci = &data->info.certs;
663   struct curl_slist **table;
664 
665   /* Free any previous certificate information structures */
666   Curl_ssl_free_certinfo(data);
667 
668   /* Allocate the required certificate information structures */
669   table = calloc((size_t) num, sizeof(struct curl_slist *));
670   if(!table)
671     return CURLE_OUT_OF_MEMORY;
672 
673   ci->num_of_certs = num;
674   ci->certinfo = table;
675 
676   return CURLE_OK;
677 }
678 
679 /*
680  * 'value' is NOT a zero terminated string
681  */
Curl_ssl_push_certinfo_len(struct Curl_easy * data,int certnum,const char * label,const char * value,size_t valuelen)682 CURLcode Curl_ssl_push_certinfo_len(struct Curl_easy *data,
683                                     int certnum,
684                                     const char *label,
685                                     const char *value,
686                                     size_t valuelen)
687 {
688   struct curl_certinfo *ci = &data->info.certs;
689   char *output;
690   struct curl_slist *nl;
691   CURLcode result = CURLE_OK;
692   size_t labellen = strlen(label);
693   size_t outlen = labellen + 1 + valuelen + 1; /* label:value\0 */
694 
695   output = malloc(outlen);
696   if(!output)
697     return CURLE_OUT_OF_MEMORY;
698 
699   /* sprintf the label and colon */
700   msnprintf(output, outlen, "%s:", label);
701 
702   /* memcpy the value (it might not be zero terminated) */
703   memcpy(&output[labellen + 1], value, valuelen);
704 
705   /* zero terminate the output */
706   output[labellen + 1 + valuelen] = 0;
707 
708   nl = Curl_slist_append_nodup(ci->certinfo[certnum], output);
709   if(!nl) {
710     free(output);
711     curl_slist_free_all(ci->certinfo[certnum]);
712     result = CURLE_OUT_OF_MEMORY;
713   }
714 
715   ci->certinfo[certnum] = nl;
716   return result;
717 }
718 
719 /*
720  * This is a convenience function for push_certinfo_len that takes a zero
721  * terminated value.
722  */
Curl_ssl_push_certinfo(struct Curl_easy * data,int certnum,const char * label,const char * value)723 CURLcode Curl_ssl_push_certinfo(struct Curl_easy *data,
724                                 int certnum,
725                                 const char *label,
726                                 const char *value)
727 {
728   size_t valuelen = strlen(value);
729 
730   return Curl_ssl_push_certinfo_len(data, certnum, label, value, valuelen);
731 }
732 
Curl_ssl_random(struct Curl_easy * data,unsigned char * entropy,size_t length)733 CURLcode Curl_ssl_random(struct Curl_easy *data,
734                          unsigned char *entropy,
735                          size_t length)
736 {
737   return Curl_ssl->random(data, entropy, length);
738 }
739 
740 /*
741  * Public key pem to der conversion
742  */
743 
pubkey_pem_to_der(const char * pem,unsigned char ** der,size_t * der_len)744 static CURLcode pubkey_pem_to_der(const char *pem,
745                                   unsigned char **der, size_t *der_len)
746 {
747   char *stripped_pem, *begin_pos, *end_pos;
748   size_t pem_count, stripped_pem_count = 0, pem_len;
749   CURLcode result;
750 
751   /* if no pem, exit. */
752   if(!pem)
753     return CURLE_BAD_CONTENT_ENCODING;
754 
755   begin_pos = strstr(pem, "-----BEGIN PUBLIC KEY-----");
756   if(!begin_pos)
757     return CURLE_BAD_CONTENT_ENCODING;
758 
759   pem_count = begin_pos - pem;
760   /* Invalid if not at beginning AND not directly following \n */
761   if(0 != pem_count && '\n' != pem[pem_count - 1])
762     return CURLE_BAD_CONTENT_ENCODING;
763 
764   /* 26 is length of "-----BEGIN PUBLIC KEY-----" */
765   pem_count += 26;
766 
767   /* Invalid if not directly following \n */
768   end_pos = strstr(pem + pem_count, "\n-----END PUBLIC KEY-----");
769   if(!end_pos)
770     return CURLE_BAD_CONTENT_ENCODING;
771 
772   pem_len = end_pos - pem;
773 
774   stripped_pem = malloc(pem_len - pem_count + 1);
775   if(!stripped_pem)
776     return CURLE_OUT_OF_MEMORY;
777 
778   /*
779    * Here we loop through the pem array one character at a time between the
780    * correct indices, and place each character that is not '\n' or '\r'
781    * into the stripped_pem array, which should represent the raw base64 string
782    */
783   while(pem_count < pem_len) {
784     if('\n' != pem[pem_count] && '\r' != pem[pem_count])
785       stripped_pem[stripped_pem_count++] = pem[pem_count];
786     ++pem_count;
787   }
788   /* Place the null terminator in the correct place */
789   stripped_pem[stripped_pem_count] = '\0';
790 
791   result = Curl_base64_decode(stripped_pem, der, der_len);
792 
793   Curl_safefree(stripped_pem);
794 
795   return result;
796 }
797 
798 /*
799  * Generic pinned public key check.
800  */
801 
Curl_pin_peer_pubkey(struct Curl_easy * data,const char * pinnedpubkey,const unsigned char * pubkey,size_t pubkeylen)802 CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data,
803                               const char *pinnedpubkey,
804                               const unsigned char *pubkey, size_t pubkeylen)
805 {
806   FILE *fp;
807   unsigned char *buf = NULL, *pem_ptr = NULL;
808   CURLcode result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
809 
810   /* if a path wasn't specified, don't pin */
811   if(!pinnedpubkey)
812     return CURLE_OK;
813   if(!pubkey || !pubkeylen)
814     return result;
815 
816   /* only do this if pinnedpubkey starts with "sha256//", length 8 */
817   if(strncmp(pinnedpubkey, "sha256//", 8) == 0) {
818     CURLcode encode;
819     size_t encodedlen, pinkeylen;
820     char *encoded, *pinkeycopy, *begin_pos, *end_pos;
821     unsigned char *sha256sumdigest;
822 
823     if(!Curl_ssl->sha256sum) {
824       /* without sha256 support, this cannot match */
825       return result;
826     }
827 
828     /* compute sha256sum of public key */
829     sha256sumdigest = malloc(CURL_SHA256_DIGEST_LENGTH);
830     if(!sha256sumdigest)
831       return CURLE_OUT_OF_MEMORY;
832     encode = Curl_ssl->sha256sum(pubkey, pubkeylen,
833                         sha256sumdigest, CURL_SHA256_DIGEST_LENGTH);
834 
835     if(encode != CURLE_OK)
836       return encode;
837 
838     encode = Curl_base64_encode(data, (char *)sha256sumdigest,
839                                 CURL_SHA256_DIGEST_LENGTH, &encoded,
840                                 &encodedlen);
841     Curl_safefree(sha256sumdigest);
842 
843     if(encode)
844       return encode;
845 
846     infof(data, "\t public key hash: sha256//%s\n", encoded);
847 
848     /* it starts with sha256//, copy so we can modify it */
849     pinkeylen = strlen(pinnedpubkey) + 1;
850     pinkeycopy = malloc(pinkeylen);
851     if(!pinkeycopy) {
852       Curl_safefree(encoded);
853       return CURLE_OUT_OF_MEMORY;
854     }
855     memcpy(pinkeycopy, pinnedpubkey, pinkeylen);
856     /* point begin_pos to the copy, and start extracting keys */
857     begin_pos = pinkeycopy;
858     do {
859       end_pos = strstr(begin_pos, ";sha256//");
860       /*
861        * if there is an end_pos, null terminate,
862        * otherwise it'll go to the end of the original string
863        */
864       if(end_pos)
865         end_pos[0] = '\0';
866 
867       /* compare base64 sha256 digests, 8 is the length of "sha256//" */
868       if(encodedlen == strlen(begin_pos + 8) &&
869          !memcmp(encoded, begin_pos + 8, encodedlen)) {
870         result = CURLE_OK;
871         break;
872       }
873 
874       /*
875        * change back the null-terminator we changed earlier,
876        * and look for next begin
877        */
878       if(end_pos) {
879         end_pos[0] = ';';
880         begin_pos = strstr(end_pos, "sha256//");
881       }
882     } while(end_pos && begin_pos);
883     Curl_safefree(encoded);
884     Curl_safefree(pinkeycopy);
885     return result;
886   }
887 
888   fp = fopen(pinnedpubkey, "rb");
889   if(!fp)
890     return result;
891 
892   do {
893     long filesize;
894     size_t size, pem_len;
895     CURLcode pem_read;
896 
897     /* Determine the file's size */
898     if(fseek(fp, 0, SEEK_END))
899       break;
900     filesize = ftell(fp);
901     if(fseek(fp, 0, SEEK_SET))
902       break;
903     if(filesize < 0 || filesize > MAX_PINNED_PUBKEY_SIZE)
904       break;
905 
906     /*
907      * if the size of our certificate is bigger than the file
908      * size then it can't match
909      */
910     size = curlx_sotouz((curl_off_t) filesize);
911     if(pubkeylen > size)
912       break;
913 
914     /*
915      * Allocate buffer for the pinned key
916      * With 1 additional byte for null terminator in case of PEM key
917      */
918     buf = malloc(size + 1);
919     if(!buf)
920       break;
921 
922     /* Returns number of elements read, which should be 1 */
923     if((int) fread(buf, size, 1, fp) != 1)
924       break;
925 
926     /* If the sizes are the same, it can't be base64 encoded, must be der */
927     if(pubkeylen == size) {
928       if(!memcmp(pubkey, buf, pubkeylen))
929         result = CURLE_OK;
930       break;
931     }
932 
933     /*
934      * Otherwise we will assume it's PEM and try to decode it
935      * after placing null terminator
936      */
937     buf[size] = '\0';
938     pem_read = pubkey_pem_to_der((const char *)buf, &pem_ptr, &pem_len);
939     /* if it wasn't read successfully, exit */
940     if(pem_read)
941       break;
942 
943     /*
944      * if the size of our certificate doesn't match the size of
945      * the decoded file, they can't be the same, otherwise compare
946      */
947     if(pubkeylen == pem_len && !memcmp(pubkey, pem_ptr, pubkeylen))
948       result = CURLE_OK;
949   } while(0);
950 
951   Curl_safefree(buf);
952   Curl_safefree(pem_ptr);
953   fclose(fp);
954 
955   return result;
956 }
957 
958 #ifndef CURL_DISABLE_CRYPTO_AUTH
Curl_ssl_md5sum(unsigned char * tmp,size_t tmplen,unsigned char * md5sum,size_t md5len)959 CURLcode Curl_ssl_md5sum(unsigned char *tmp, /* input */
960                          size_t tmplen,
961                          unsigned char *md5sum, /* output */
962                          size_t md5len)
963 {
964   return Curl_ssl->md5sum(tmp, tmplen, md5sum, md5len);
965 }
966 #endif
967 
968 /*
969  * Check whether the SSL backend supports the status_request extension.
970  */
Curl_ssl_cert_status_request(void)971 bool Curl_ssl_cert_status_request(void)
972 {
973   return Curl_ssl->cert_status_request();
974 }
975 
976 /*
977  * Check whether the SSL backend supports false start.
978  */
Curl_ssl_false_start(void)979 bool Curl_ssl_false_start(void)
980 {
981   return Curl_ssl->false_start();
982 }
983 
984 /*
985  * Check whether the SSL backend supports setting TLS 1.3 cipher suites
986  */
Curl_ssl_tls13_ciphersuites(void)987 bool Curl_ssl_tls13_ciphersuites(void)
988 {
989   return Curl_ssl->supports & SSLSUPP_TLS13_CIPHERSUITES;
990 }
991 
992 /*
993  * Default implementations for unsupported functions.
994  */
995 
Curl_none_init(void)996 int Curl_none_init(void)
997 {
998   return 1;
999 }
1000 
Curl_none_cleanup(void)1001 void Curl_none_cleanup(void)
1002 { }
1003 
Curl_none_shutdown(struct connectdata * conn UNUSED_PARAM,int sockindex UNUSED_PARAM)1004 int Curl_none_shutdown(struct connectdata *conn UNUSED_PARAM,
1005                        int sockindex UNUSED_PARAM)
1006 {
1007   (void)conn;
1008   (void)sockindex;
1009   return 0;
1010 }
1011 
Curl_none_check_cxn(struct connectdata * conn UNUSED_PARAM)1012 int Curl_none_check_cxn(struct connectdata *conn UNUSED_PARAM)
1013 {
1014   (void)conn;
1015   return -1;
1016 }
1017 
Curl_none_random(struct Curl_easy * data UNUSED_PARAM,unsigned char * entropy UNUSED_PARAM,size_t length UNUSED_PARAM)1018 CURLcode Curl_none_random(struct Curl_easy *data UNUSED_PARAM,
1019                           unsigned char *entropy UNUSED_PARAM,
1020                           size_t length UNUSED_PARAM)
1021 {
1022   (void)data;
1023   (void)entropy;
1024   (void)length;
1025   return CURLE_NOT_BUILT_IN;
1026 }
1027 
Curl_none_close_all(struct Curl_easy * data UNUSED_PARAM)1028 void Curl_none_close_all(struct Curl_easy *data UNUSED_PARAM)
1029 {
1030   (void)data;
1031 }
1032 
Curl_none_session_free(void * ptr UNUSED_PARAM)1033 void Curl_none_session_free(void *ptr UNUSED_PARAM)
1034 {
1035   (void)ptr;
1036 }
1037 
Curl_none_data_pending(const struct connectdata * conn UNUSED_PARAM,int connindex UNUSED_PARAM)1038 bool Curl_none_data_pending(const struct connectdata *conn UNUSED_PARAM,
1039                             int connindex UNUSED_PARAM)
1040 {
1041   (void)conn;
1042   (void)connindex;
1043   return 0;
1044 }
1045 
Curl_none_cert_status_request(void)1046 bool Curl_none_cert_status_request(void)
1047 {
1048   return FALSE;
1049 }
1050 
Curl_none_set_engine(struct Curl_easy * data UNUSED_PARAM,const char * engine UNUSED_PARAM)1051 CURLcode Curl_none_set_engine(struct Curl_easy *data UNUSED_PARAM,
1052                               const char *engine UNUSED_PARAM)
1053 {
1054   (void)data;
1055   (void)engine;
1056   return CURLE_NOT_BUILT_IN;
1057 }
1058 
Curl_none_set_engine_default(struct Curl_easy * data UNUSED_PARAM)1059 CURLcode Curl_none_set_engine_default(struct Curl_easy *data UNUSED_PARAM)
1060 {
1061   (void)data;
1062   return CURLE_NOT_BUILT_IN;
1063 }
1064 
Curl_none_engines_list(struct Curl_easy * data UNUSED_PARAM)1065 struct curl_slist *Curl_none_engines_list(struct Curl_easy *data UNUSED_PARAM)
1066 {
1067   (void)data;
1068   return (struct curl_slist *)NULL;
1069 }
1070 
Curl_none_false_start(void)1071 bool Curl_none_false_start(void)
1072 {
1073   return FALSE;
1074 }
1075 
1076 #ifndef CURL_DISABLE_CRYPTO_AUTH
Curl_none_md5sum(unsigned char * input,size_t inputlen,unsigned char * md5sum,size_t md5len UNUSED_PARAM)1077 CURLcode Curl_none_md5sum(unsigned char *input, size_t inputlen,
1078                           unsigned char *md5sum, size_t md5len UNUSED_PARAM)
1079 {
1080   MD5_context *MD5pw;
1081 
1082   (void)md5len;
1083 
1084   MD5pw = Curl_MD5_init(Curl_DIGEST_MD5);
1085   if(!MD5pw)
1086     return CURLE_OUT_OF_MEMORY;
1087   Curl_MD5_update(MD5pw, input, curlx_uztoui(inputlen));
1088   Curl_MD5_final(MD5pw, md5sum);
1089   return CURLE_OK;
1090 }
1091 #else
Curl_none_md5sum(unsigned char * input UNUSED_PARAM,size_t inputlen UNUSED_PARAM,unsigned char * md5sum UNUSED_PARAM,size_t md5len UNUSED_PARAM)1092 CURLcode Curl_none_md5sum(unsigned char *input UNUSED_PARAM,
1093                           size_t inputlen UNUSED_PARAM,
1094                           unsigned char *md5sum UNUSED_PARAM,
1095                           size_t md5len UNUSED_PARAM)
1096 {
1097   (void)input;
1098   (void)inputlen;
1099   (void)md5sum;
1100   (void)md5len;
1101   return CURLE_NOT_BUILT_IN;
1102 }
1103 #endif
1104 
Curl_multissl_init(void)1105 static int Curl_multissl_init(void)
1106 {
1107   if(multissl_init(NULL))
1108     return 1;
1109   return Curl_ssl->init();
1110 }
1111 
Curl_multissl_connect(struct connectdata * conn,int sockindex)1112 static CURLcode Curl_multissl_connect(struct connectdata *conn, int sockindex)
1113 {
1114   if(multissl_init(NULL))
1115     return CURLE_FAILED_INIT;
1116   return Curl_ssl->connect_blocking(conn, sockindex);
1117 }
1118 
Curl_multissl_connect_nonblocking(struct connectdata * conn,int sockindex,bool * done)1119 static CURLcode Curl_multissl_connect_nonblocking(struct connectdata *conn,
1120                                                   int sockindex, bool *done)
1121 {
1122   if(multissl_init(NULL))
1123     return CURLE_FAILED_INIT;
1124   return Curl_ssl->connect_nonblocking(conn, sockindex, done);
1125 }
1126 
Curl_multissl_get_internals(struct ssl_connect_data * connssl,CURLINFO info)1127 static void *Curl_multissl_get_internals(struct ssl_connect_data *connssl,
1128                                          CURLINFO info)
1129 {
1130   if(multissl_init(NULL))
1131     return NULL;
1132   return Curl_ssl->get_internals(connssl, info);
1133 }
1134 
Curl_multissl_close(struct connectdata * conn,int sockindex)1135 static void Curl_multissl_close(struct connectdata *conn, int sockindex)
1136 {
1137   if(multissl_init(NULL))
1138     return;
1139   Curl_ssl->close_one(conn, sockindex);
1140 }
1141 
1142 static const struct Curl_ssl Curl_ssl_multi = {
1143   { CURLSSLBACKEND_NONE, "multi" },  /* info */
1144   0, /* supports nothing */
1145   (size_t)-1, /* something insanely large to be on the safe side */
1146 
1147   Curl_multissl_init,                /* init */
1148   Curl_none_cleanup,                 /* cleanup */
1149   Curl_multissl_version,             /* version */
1150   Curl_none_check_cxn,               /* check_cxn */
1151   Curl_none_shutdown,                /* shutdown */
1152   Curl_none_data_pending,            /* data_pending */
1153   Curl_none_random,                  /* random */
1154   Curl_none_cert_status_request,     /* cert_status_request */
1155   Curl_multissl_connect,             /* connect */
1156   Curl_multissl_connect_nonblocking, /* connect_nonblocking */
1157   Curl_multissl_get_internals,       /* get_internals */
1158   Curl_multissl_close,               /* close_one */
1159   Curl_none_close_all,               /* close_all */
1160   Curl_none_session_free,            /* session_free */
1161   Curl_none_set_engine,              /* set_engine */
1162   Curl_none_set_engine_default,      /* set_engine_default */
1163   Curl_none_engines_list,            /* engines_list */
1164   Curl_none_false_start,             /* false_start */
1165   Curl_none_md5sum,                  /* md5sum */
1166   NULL                               /* sha256sum */
1167 };
1168 
1169 const struct Curl_ssl *Curl_ssl =
1170 #if defined(CURL_WITH_MULTI_SSL)
1171   &Curl_ssl_multi;
1172 #elif defined(USE_WOLFSSL)
1173   &Curl_ssl_wolfssl;
1174 #elif defined(USE_SECTRANSP)
1175   &Curl_ssl_sectransp;
1176 #elif defined(USE_GNUTLS)
1177   &Curl_ssl_gnutls;
1178 #elif defined(USE_GSKIT)
1179   &Curl_ssl_gskit;
1180 #elif defined(USE_MBEDTLS)
1181   &Curl_ssl_mbedtls;
1182 #elif defined(USE_NSS)
1183   &Curl_ssl_nss;
1184 #elif defined(USE_OPENSSL)
1185   &Curl_ssl_openssl;
1186 #elif defined(USE_POLARSSL)
1187   &Curl_ssl_polarssl;
1188 #elif defined(USE_SCHANNEL)
1189   &Curl_ssl_schannel;
1190 #elif defined(USE_MESALINK)
1191   &Curl_ssl_mesalink;
1192 #else
1193 #error "Missing struct Curl_ssl for selected SSL backend"
1194 #endif
1195 
1196 static const struct Curl_ssl *available_backends[] = {
1197 #if defined(USE_WOLFSSL)
1198   &Curl_ssl_wolfssl,
1199 #endif
1200 #if defined(USE_SECTRANSP)
1201   &Curl_ssl_sectransp,
1202 #endif
1203 #if defined(USE_GNUTLS)
1204   &Curl_ssl_gnutls,
1205 #endif
1206 #if defined(USE_GSKIT)
1207   &Curl_ssl_gskit,
1208 #endif
1209 #if defined(USE_MBEDTLS)
1210   &Curl_ssl_mbedtls,
1211 #endif
1212 #if defined(USE_NSS)
1213   &Curl_ssl_nss,
1214 #endif
1215 #if defined(USE_OPENSSL)
1216   &Curl_ssl_openssl,
1217 #endif
1218 #if defined(USE_POLARSSL)
1219   &Curl_ssl_polarssl,
1220 #endif
1221 #if defined(USE_SCHANNEL)
1222   &Curl_ssl_schannel,
1223 #endif
1224 #if defined(USE_MESALINK)
1225   &Curl_ssl_mesalink,
1226 #endif
1227   NULL
1228 };
1229 
Curl_multissl_version(char * buffer,size_t size)1230 static size_t Curl_multissl_version(char *buffer, size_t size)
1231 {
1232   static const struct Curl_ssl *selected;
1233   static char backends[200];
1234   static size_t total;
1235   const struct Curl_ssl *current;
1236 
1237   current = Curl_ssl == &Curl_ssl_multi ? available_backends[0] : Curl_ssl;
1238 
1239   if(current != selected) {
1240     char *p = backends;
1241     char *end = backends + sizeof(backends);
1242     int i;
1243 
1244     selected = current;
1245 
1246     for(i = 0; available_backends[i] && p < (end - 4); i++) {
1247       if(i)
1248         *(p++) = ' ';
1249       if(selected != available_backends[i])
1250         *(p++) = '(';
1251       p += available_backends[i]->version(p, end - p - 2);
1252       if(selected != available_backends[i])
1253         *(p++) = ')';
1254     }
1255     *p = '\0';
1256     total = p - backends;
1257   }
1258 
1259   if(size > total)
1260     memcpy(buffer, backends, total + 1);
1261   else {
1262     memcpy(buffer, backends, size - 1);
1263     buffer[size - 1] = '\0';
1264   }
1265 
1266   return CURLMIN(size - 1, total);
1267 }
1268 
multissl_init(const struct Curl_ssl * backend)1269 static int multissl_init(const struct Curl_ssl *backend)
1270 {
1271   const char *env;
1272   char *env_tmp;
1273 
1274   if(Curl_ssl != &Curl_ssl_multi)
1275     return 1;
1276 
1277   if(backend) {
1278     Curl_ssl = backend;
1279     return 0;
1280   }
1281 
1282   if(!available_backends[0])
1283     return 1;
1284 
1285   env = env_tmp = curl_getenv("CURL_SSL_BACKEND");
1286 #ifdef CURL_DEFAULT_SSL_BACKEND
1287   if(!env)
1288     env = CURL_DEFAULT_SSL_BACKEND;
1289 #endif
1290   if(env) {
1291     int i;
1292     for(i = 0; available_backends[i]; i++) {
1293       if(strcasecompare(env, available_backends[i]->info.name)) {
1294         Curl_ssl = available_backends[i];
1295         curl_free(env_tmp);
1296         return 0;
1297       }
1298     }
1299   }
1300 
1301   /* Fall back to first available backend */
1302   Curl_ssl = available_backends[0];
1303   curl_free(env_tmp);
1304   return 0;
1305 }
1306 
curl_global_sslset(curl_sslbackend id,const char * name,const curl_ssl_backend *** avail)1307 CURLsslset curl_global_sslset(curl_sslbackend id, const char *name,
1308                               const curl_ssl_backend ***avail)
1309 {
1310   int i;
1311 
1312   if(avail)
1313     *avail = (const curl_ssl_backend **)&available_backends;
1314 
1315   if(Curl_ssl != &Curl_ssl_multi)
1316     return id == Curl_ssl->info.id ||
1317            (name && strcasecompare(name, Curl_ssl->info.name)) ?
1318            CURLSSLSET_OK :
1319 #if defined(CURL_WITH_MULTI_SSL)
1320            CURLSSLSET_TOO_LATE;
1321 #else
1322            CURLSSLSET_UNKNOWN_BACKEND;
1323 #endif
1324 
1325   for(i = 0; available_backends[i]; i++) {
1326     if(available_backends[i]->info.id == id ||
1327        (name && strcasecompare(available_backends[i]->info.name, name))) {
1328       multissl_init(available_backends[i]);
1329       return CURLSSLSET_OK;
1330     }
1331   }
1332 
1333   return CURLSSLSET_UNKNOWN_BACKEND;
1334 }
1335 
1336 #else /* USE_SSL */
curl_global_sslset(curl_sslbackend id,const char * name,const curl_ssl_backend *** avail)1337 CURLsslset curl_global_sslset(curl_sslbackend id, const char *name,
1338                               const curl_ssl_backend ***avail)
1339 {
1340   (void)id;
1341   (void)name;
1342   (void)avail;
1343   return CURLSSLSET_NO_BACKENDS;
1344 }
1345 
1346 #endif /* !USE_SSL */
1347