openssl.h (5822B)
1 #ifndef HEADER_CURL_SSLUSE_H 2 #define HEADER_CURL_SSLUSE_H 3 /*************************************************************************** 4 * _ _ ____ _ 5 * Project ___| | | | _ \| | 6 * / __| | | | |_) | | 7 * | (__| |_| | _ <| |___ 8 * \___|\___/|_| \_\_____| 9 * 10 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. 11 * 12 * This software is licensed as described in the file COPYING, which 13 * you should have received as part of this distribution. The terms 14 * are also available at https://curl.se/docs/copyright.html. 15 * 16 * You may opt to use, copy, modify, merge, publish, distribute and/or sell 17 * copies of the Software, and permit persons to whom the Software is 18 * furnished to do so, under the terms of the COPYING file. 19 * 20 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY 21 * KIND, either express or implied. 22 * 23 * SPDX-License-Identifier: curl 24 * 25 ***************************************************************************/ 26 27 #include "../curl_setup.h" 28 29 #ifdef USE_OPENSSL 30 /* 31 * This header should only be needed to get included by vtls.c, openssl.c 32 * and ngtcp2.c 33 */ 34 #include <openssl/opensslv.h> 35 #include <openssl/ossl_typ.h> 36 #include <openssl/ssl.h> 37 38 #include "../urldata.h" 39 40 /* 41 * Whether SSL_CTX_set_keylog_callback is available. 42 * OpenSSL: supported since 1.1.1 https://github.com/openssl/openssl/pull/2287 43 * BoringSSL: supported since d28f59c27bac (committed 2015-11-19) 44 * LibreSSL: not supported. 3.5.0+ has a stub function that does nothing. 45 */ 46 #if (OPENSSL_VERSION_NUMBER >= 0x10101000L && \ 47 !defined(LIBRESSL_VERSION_NUMBER)) || \ 48 defined(OPENSSL_IS_BORINGSSL) 49 #define HAVE_KEYLOG_CALLBACK 50 #endif 51 52 /* Check for OpenSSL 1.1.1 which has early data support. */ 53 #undef HAVE_OPENSSL_EARLYDATA 54 #if OPENSSL_VERSION_NUMBER >= 0x10100010L && defined(TLS1_3_VERSION) && \ 55 !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) 56 #define HAVE_OPENSSL_EARLYDATA 57 #endif 58 59 struct alpn_spec; 60 struct ssl_peer; 61 struct Curl_ssl_session; 62 63 /* Struct to hold a curl OpenSSL instance */ 64 struct ossl_ctx { 65 /* these ones requires specific SSL-types */ 66 SSL_CTX* ssl_ctx; 67 SSL* ssl; 68 X509* server_cert; 69 BIO_METHOD *bio_method; 70 CURLcode io_result; /* result of last BIO cfilter operation */ 71 #ifndef HAVE_KEYLOG_CALLBACK 72 /* Set to true once a valid keylog entry has been created to avoid dupes. 73 This is a bool and not a bitfield because it is passed by address. */ 74 bool keylog_done; 75 #endif 76 BIT(x509_store_setup); /* x509 store has been set up */ 77 BIT(reused_session); /* session-ID was reused for this */ 78 }; 79 80 size_t Curl_ossl_version(char *buffer, size_t size); 81 82 typedef CURLcode Curl_ossl_ctx_setup_cb(struct Curl_cfilter *cf, 83 struct Curl_easy *data, 84 void *user_data); 85 86 typedef int Curl_ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid); 87 typedef CURLcode Curl_ossl_init_session_reuse_cb(struct Curl_cfilter *cf, 88 struct Curl_easy *data, 89 struct alpn_spec *alpns, 90 struct Curl_ssl_session *scs, 91 bool *do_early_data); 92 93 CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx, 94 struct Curl_cfilter *cf, 95 struct Curl_easy *data, 96 struct ssl_peer *peer, 97 const struct alpn_spec *alpns, 98 Curl_ossl_ctx_setup_cb *cb_setup, 99 void *cb_user_data, 100 Curl_ossl_new_session_cb *cb_new_session, 101 void *ssl_user_data, 102 Curl_ossl_init_session_reuse_cb *sess_reuse_cb); 103 104 #if (OPENSSL_VERSION_NUMBER < 0x30000000L) 105 #define SSL_get1_peer_certificate SSL_get_peer_certificate 106 #endif 107 108 extern const struct Curl_ssl Curl_ssl_openssl; 109 110 /** 111 * Setup the OpenSSL X509_STORE in `ssl_ctx` for the cfilter `cf` and 112 * easy handle `data`. Will allow reuse of a shared cache if suitable 113 * and configured. 114 */ 115 CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf, 116 struct Curl_easy *data, 117 SSL_CTX *ssl_ctx); 118 119 CURLcode Curl_ossl_ctx_configure(struct Curl_cfilter *cf, 120 struct Curl_easy *data, 121 SSL_CTX *ssl_ctx); 122 123 /* 124 * Add a new session to the cache. Takes ownership of the session. 125 */ 126 CURLcode Curl_ossl_add_session(struct Curl_cfilter *cf, 127 struct Curl_easy *data, 128 const char *ssl_peer_key, 129 SSL_SESSION *ssl_sessionid, 130 int ietf_tls_id, 131 const char *alpn, 132 unsigned char *quic_tp, 133 size_t quic_tp_len); 134 135 /* 136 * Get the server cert, verify it and show it, etc., only call failf() if 137 * ssl config verifypeer or -host is set. Otherwise all this is for 138 * informational purposes only! 139 */ 140 CURLcode Curl_oss_check_peer_cert(struct Curl_cfilter *cf, 141 struct Curl_easy *data, 142 struct ossl_ctx *octx, 143 struct ssl_peer *peer); 144 145 /* Report properties of a successful handshake */ 146 void Curl_ossl_report_handshake(struct Curl_easy *data, 147 struct ossl_ctx *octx); 148 149 #endif /* USE_OPENSSL */ 150 #endif /* HEADER_CURL_SSLUSE_H */