romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 10:43:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

lib/subdirs: fix formatting nits

Browse source 
Closes #19757
This commit is contained in:
Viktor Szakats 2025-11-29 02:16:52 +01:00
parent 0eed8b7330
commit 2253bc330f
No known key found for this signature in database
GPG key ID: B5ABD165E2AEF201
64 changed files with 1218 additions and 1416 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/vtls/apple.c
View file

@ -207,8 +207,7 @@ CURLcode Curl_vtls_apple_verify(struct Curl_cfilter *cf,
#if defined(HAVE_BUILTIN_AVAILABLE) && defined(SUPPORTS_SecOCSP)
if(ocsp_len > 0) {
if(__builtin_available(macOS 10.9, iOS 7, tvOS 9, watchOS 2, *)) {
CFDataRef ocspdata =
CFDataCreate(NULL, ocsp_buf, (CFIndex)ocsp_len);
CFDataRef ocspdata = CFDataCreate(NULL, ocsp_buf, (CFIndex)ocsp_len);
status = SecTrustSetOCSPResponse(trust, ocspdata);
CFRelease(ocspdata);
@ -243,7 +242,7 @@ CURLcode Curl_vtls_apple_verify(struct Curl_cfilter *cf,
err_desc = curlx_malloc(size + 1);
if(err_desc) {
if(!CFStringGetCString(error_ref, err_desc, size,
kCFStringEncodingUTF8)) {
kCFStringEncodingUTF8)) {
curlx_free(err_desc);
err_desc = NULL;
}

42
lib/vtls/cipher_suite.c
View file

@ -547,8 +547,7 @@ static const struct cs_entry cs_list [] = {
};
#define CS_LIST_LEN CURL_ARRAYSIZE(cs_list)
static int cs_str_to_zip(const char *cs_str, size_t cs_len,
uint8_t zip[6])
static int cs_str_to_zip(const char *cs_str, size_t cs_len, uint8_t zip[6])
{
uint8_t indexes[8] = {0};
const char *entry, *cur;
@ -568,7 +567,8 @@ static int cs_str_to_zip(const char *cs_str, size_t cs_len,
/* determine the length of the part */
cur = nxt;
for(; nxt < end && *nxt != '\0' && *nxt != separator; nxt++);
for(; nxt < end && *nxt != '\0' && *nxt != separator; nxt++)
;
len = nxt - cur;
/* lookup index for the part (skip empty string at 0) */
@ -581,22 +581,21 @@ static int cs_str_to_zip(const char *cs_str, size_t cs_len,
if(idx == CS_TXT_LEN)
return -1;
indexes[i++] = (uint8_t) idx;
indexes[i++] = (uint8_t)idx;
} while(nxt < end && *(nxt++) != '\0');
/* zip the 8 indexes into 48 bits */
zip[0] = (uint8_t) (indexes[0] << 2 | (indexes[1] & 0x3F) >> 4);
zip[1] = (uint8_t) (indexes[1] << 4 | (indexes[2] & 0x3F) >> 2);
zip[2] = (uint8_t) (indexes[2] << 6 | (indexes[3] & 0x3F));
zip[3] = (uint8_t) (indexes[4] << 2 | (indexes[5] & 0x3F) >> 4);
zip[4] = (uint8_t) (indexes[5] << 4 | (indexes[6] & 0x3F) >> 2);
zip[5] = (uint8_t) (indexes[6] << 6 | (indexes[7] & 0x3F));
zip[0] = (uint8_t)(indexes[0] << 2 | (indexes[1] & 0x3F) >> 4);
zip[1] = (uint8_t)(indexes[1] << 4 | (indexes[2] & 0x3F) >> 2);
zip[2] = (uint8_t)(indexes[2] << 6 | (indexes[3] & 0x3F));
zip[3] = (uint8_t)(indexes[4] << 2 | (indexes[5] & 0x3F) >> 4);
zip[4] = (uint8_t)(indexes[5] << 4 | (indexes[6] & 0x3F) >> 2);
zip[5] = (uint8_t)(indexes[6] << 6 | (indexes[7] & 0x3F));
return 0;
}
static int cs_zip_to_str(const uint8_t zip[6],
char *buf, size_t buf_size)
static int cs_zip_to_str(const uint8_t zip[6], char *buf, size_t buf_size)
{
uint8_t indexes[8] = {0};
const char *entry;
@ -659,13 +658,12 @@ uint16_t Curl_cipher_suite_lookup_id(const char *cs_str, size_t cs_len)
static bool cs_is_separator(char c)
{
switch(c) {
case ' ':
case '\t':
case ':':
case ',':
case ';':
return TRUE;
default:;
case ' ':
case '\t':
case ':':
case ',':
case ';':
return TRUE;
}
return FALSE;
}
@ -673,10 +671,12 @@ static bool cs_is_separator(char c)
uint16_t Curl_cipher_suite_walk_str(const char **str, const char **end)
{
/* move string pointer to first non-separator or end of string */
for(; cs_is_separator(*str[0]); (*str)++);
for(; cs_is_separator(*str[0]); (*str)++)
;
/* move end pointer to next separator or end of string */
for(*end = *str; *end[0] != '\0' && !cs_is_separator(*end[0]); (*end)++);
for(*end = *str; *end[0] != '\0' && !cs_is_separator(*end[0]); (*end)++)
;
return Curl_cipher_suite_lookup_id(*str, *end - *str);
}

84
lib/vtls/gtls.c
View file

@ -66,7 +66,7 @@
#ifdef GTLSDEBUG
static void tls_log_func(int level, const char *str)
{
curl_mfprintf(stderr, "|<%d>| %s", level, str);
curl_mfprintf(stderr, "|<%d>| %s", level, str);
}
#endif
@ -131,8 +131,7 @@ static ssize_t gtls_pull(void *s, void *buf, size_t blen)
}
result = Curl_conn_cf_recv(cf->next, data, buf, blen, &nread);
CURL_TRC_CF(data, cf, "glts_pull(len=%zu) -> %d, %zd",
blen, result, nread);
CURL_TRC_CF(data, cf, "glts_pull(len=%zu) -> %d, %zd", blen, result, nread);
backend->gtls.io_result = result;
if(result) {
/* !checksrc! disable ERRNOVAR 1 */
@ -173,9 +172,7 @@ static void gtls_cleanup(void)
}
#ifndef CURL_DISABLE_VERBOSE_STRINGS
static void showtime(struct Curl_easy *data,
const char *text,
time_t stamp)
static void showtime(struct Curl_easy *data, const char *text, time_t stamp)
{
struct tm buffer;
const struct tm *tm = &buffer;
@ -209,10 +206,10 @@ static gnutls_datum_t load_file(const char *file)
f = curlx_fopen(file, "rb");
if(!f)
return loaded_file;
if(fseek(f, 0, SEEK_END) != 0
|| (filelen = ftell(f)) < 0
|| fseek(f, 0, SEEK_SET) != 0
|| !(ptr = curlx_malloc((size_t)filelen)))
if(fseek(f, 0, SEEK_END) != 0 ||
(filelen = ftell(f)) < 0 ||
fseek(f, 0, SEEK_SET) != 0 ||
!(ptr = curlx_malloc((size_t)filelen)))
goto out;
if(fread(ptr, 1, (size_t)filelen, f) < (size_t)filelen) {
curlx_free(ptr);
@ -231,7 +228,6 @@ static void unload_file(gnutls_datum_t data)
curlx_free(data.data);
}
/* this function does an SSL/TLS (re-)handshake */
static CURLcode cf_gtls_handshake(struct Curl_cfilter *cf,
struct Curl_easy *data)
@ -584,20 +580,20 @@ static bool gtls_shared_creds_different(struct Curl_cfilter *cf,
return strcmp(sc->CAfile, conn_config->CAfile);
}
static struct gtls_shared_creds*
gtls_get_cached_creds(struct Curl_cfilter *cf, struct Curl_easy *data)
static struct gtls_shared_creds *gtls_get_cached_creds(struct Curl_cfilter *cf,
struct Curl_easy *data)
{
struct gtls_shared_creds *shared_creds;
if(data->multi) {
shared_creds = Curl_hash_pick(&data->multi->proto_hash,
CURL_UNCONST(MPROTO_GTLS_X509_KEY),
sizeof(MPROTO_GTLS_X509_KEY)-1);
if(shared_creds && shared_creds->creds &&
!gtls_shared_creds_expired(data, shared_creds) &&
!gtls_shared_creds_different(cf, shared_creds)) {
return shared_creds;
}
sizeof(MPROTO_GTLS_X509_KEY) - 1);
if(shared_creds && shared_creds->creds &&
!gtls_shared_creds_expired(data, shared_creds) &&
!gtls_shared_creds_different(cf, shared_creds)) {
return shared_creds;
}
}
return NULL;
}
@ -605,7 +601,7 @@ gtls_get_cached_creds(struct Curl_cfilter *cf, struct Curl_easy *data)
static void gtls_shared_creds_hash_free(void *key, size_t key_len, void *p)
{
struct gtls_shared_creds *sc = p;
DEBUGASSERT(key_len == (sizeof(MPROTO_GTLS_X509_KEY)-1));
DEBUGASSERT(key_len == (sizeof(MPROTO_GTLS_X509_KEY) - 1));
DEBUGASSERT(!memcmp(MPROTO_GTLS_X509_KEY, key, key_len));
(void)key;
(void)key_len;
@ -635,9 +631,9 @@ static void gtls_set_cached_creds(struct Curl_cfilter *cf,
return;
if(!Curl_hash_add2(&data->multi->proto_hash,
CURL_UNCONST(MPROTO_GTLS_X509_KEY),
sizeof(MPROTO_GTLS_X509_KEY)-1,
sc, gtls_shared_creds_hash_free)) {
CURL_UNCONST(MPROTO_GTLS_X509_KEY),
sizeof(MPROTO_GTLS_X509_KEY) - 1,
sc, gtls_shared_creds_hash_free)) {
Curl_gtls_shared_creds_free(&sc); /* down reference again */
return;
}
@ -839,7 +835,7 @@ static CURLcode gtls_set_priority(struct Curl_cfilter *cf,
if((conn_config->cipher_list[0] == '+') ||
(conn_config->cipher_list[0] == '-') ||
(conn_config->cipher_list[0] == '!')) {
/* add it to out own */
/* add it to out own */
if(!curlx_dyn_len(&buf)) { /* not added yet */
result = curlx_dyn_add(&buf, priority);
if(result)
@ -1106,8 +1102,8 @@ static CURLcode gtls_on_session_reuse(struct Curl_cfilter *cf,
connssl->earlydata_state = ssl_earlydata_await;
connssl->state = ssl_connection_deferred;
result = Curl_alpn_set_negotiated(cf, data, connssl,
(const unsigned char *)scs->alpn,
scs->alpn ? strlen(scs->alpn) : 0);
(const unsigned char *)scs->alpn,
scs->alpn ? strlen(scs->alpn) : 0);
*do_early_data = !result;
}
return result;
@ -1225,8 +1221,8 @@ out:
return result;
}
static CURLcode
gtls_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
static CURLcode gtls_connect_step1(struct Curl_cfilter *cf,
struct Curl_easy *data)
{
struct ssl_connect_data *connssl = cf->ctx;
struct gtls_ssl_backend_data *backend =
@ -1333,8 +1329,7 @@ static CURLcode pkp_pin_peer_pubkey(struct Curl_easy *data,
return result;
}
void Curl_gtls_report_handshake(struct Curl_easy *data,
struct gtls_ctx *gctx)
void Curl_gtls_report_handshake(struct Curl_easy *data, struct gtls_ctx *gctx)
{
#ifndef CURL_DISABLE_VERBOSE_STRINGS
if(Curl_trc_is_verbose(data)) {
@ -1580,8 +1575,7 @@ static CURLcode glts_apple_verify(struct Curl_cfilter *cf,
CURLcode result;
result = Curl_vtls_apple_verify(cf, data, peer, chain->num_certs,
gtls_chain_get_der, chain,
NULL, 0);
gtls_chain_get_der, chain, NULL, 0);
*pverified = !result;
if(*pverified)
infof(data, " SSL certificate verified by Apple SecTrust.");
@ -1589,14 +1583,13 @@ static CURLcode glts_apple_verify(struct Curl_cfilter *cf,
}
#endif /* USE_APPLE_SECTRUST */
CURLcode
Curl_gtls_verifyserver(struct Curl_cfilter *cf,
struct Curl_easy *data,
gnutls_session_t session,
struct ssl_primary_config *config,
struct ssl_config_data *ssl_config,
struct ssl_peer *peer,
const char *pinned_key)
CURLcode Curl_gtls_verifyserver(struct Curl_cfilter *cf,
struct Curl_easy *data,
gnutls_session_t session,
struct ssl_primary_config *config,
struct ssl_config_data *ssl_config,
struct ssl_peer *peer,
const char *pinned_key)
{
struct gtls_cert_chain chain;
gnutls_x509_crt_t x509_cert = NULL, x509_issuer = NULL;
@ -1651,7 +1644,7 @@ Curl_gtls_verifyserver(struct Curl_cfilter *cf,
goto out;
for(i = 0; i < chain.num_certs; i++) {
const char *beg = (const char *) chain.certs[i].data;
const char *beg = (const char *)chain.certs[i].data;
const char *end = beg + chain.certs[i].size;
result = Curl_extract_certinfo(data, (int)i, beg, end);
@ -1897,7 +1890,7 @@ static CURLcode gtls_send_earlydata(struct Curl_cfilter *cf,
{
struct ssl_connect_data *connssl = cf->ctx;
struct gtls_ssl_backend_data *backend =
(struct gtls_ssl_backend_data *)connssl->backend;
(struct gtls_ssl_backend_data *)connssl->backend;
CURLcode result = CURLE_OK;
const unsigned char *buf;
size_t blen;
@ -1907,8 +1900,7 @@ static CURLcode gtls_send_earlydata(struct Curl_cfilter *cf,
backend->gtls.io_result = CURLE_OK;
while(Curl_bufq_peek(&connssl->earlydata, &buf, &blen)) {
n = gnutls_record_send_early_data(backend->gtls.session, buf, blen);
CURL_TRC_CF(data, cf, "gtls_send_earlydata(len=%zu) -> %zd",
blen, n);
CURL_TRC_CF(data, cf, "gtls_send_earlydata(len=%zu) -> %zd", blen, n);
if(n < 0) {
if(n == GNUTLS_E_AGAIN)
result = CURLE_AGAIN;
@ -1947,7 +1939,7 @@ static CURLcode gtls_connect_common(struct Curl_cfilter *cf,
{
struct ssl_connect_data *connssl = cf->ctx;
struct gtls_ssl_backend_data *backend =
(struct gtls_ssl_backend_data *)connssl->backend;
(struct gtls_ssl_backend_data *)connssl->backend;
CURLcode result = CURLE_OK;
DEBUGASSERT(backend);
@ -2131,7 +2123,7 @@ static CURLcode gtls_shutdown(struct Curl_cfilter *cf,
size_t i;
DEBUGASSERT(backend);
/* If we have no handshaked connection or already shut down */
/* If we have no handshaked connection or already shut down */
if(!backend->gtls.session || cf->shutdown ||
connssl->state != ssl_connection_complete) {
*done = TRUE;

3
lib/vtls/gtls.h
View file

@ -119,8 +119,7 @@ CURLcode Curl_gtls_cache_session(struct Curl_cfilter *cf,
size_t quic_tp_len);
/* Report properties of a successful handshake */
void Curl_gtls_report_handshake(struct Curl_easy *data,
struct gtls_ctx *gctx);
void Curl_gtls_report_handshake(struct Curl_easy *data, struct gtls_ctx *gctx);
extern const struct Curl_ssl Curl_ssl_gnutls;

4
lib/vtls/hostcheck.c
View file

@ -84,9 +84,9 @@ static bool hostmatch(const char *hostname,
DEBUGASSERT(hostlen);
/* normalize pattern and hostname by stripping off trailing dots */
if(hostname[hostlen-1]=='.')
if(hostname[hostlen - 1] == '.')
hostlen--;
if(pattern[patternlen-1]=='.')
if(pattern[patternlen - 1] == '.')
patternlen--;
if(strncmp(pattern, "*.", 2))

19
lib/vtls/keylog.c
View file

@ -38,8 +38,7 @@
/* The fp for the open SSLKEYLOGFILE, or NULL if not open */
static FILE *keylog_file_fp;
void
Curl_tls_keylog_open(void)
void Curl_tls_keylog_open(void)
{
char *keylog_file_name;
@ -63,8 +62,7 @@ Curl_tls_keylog_open(void)
}
}
void
Curl_tls_keylog_close(void)
void Curl_tls_keylog_close(void)
{
if(keylog_file_fp) {
curlx_fclose(keylog_file_fp);
@ -72,14 +70,12 @@ Curl_tls_keylog_close(void)
}
}
bool
Curl_tls_keylog_enabled(void)
bool Curl_tls_keylog_enabled(void)
{
return keylog_file_fp != NULL;
}
bool
Curl_tls_keylog_write_line(const char *line)
bool Curl_tls_keylog_write_line(const char *line)
{
/* The current maximum valid keylog line length LF and NUL is 195. */
size_t linelen;
@ -107,10 +103,9 @@ Curl_tls_keylog_write_line(const char *line)
return TRUE;
}
bool
Curl_tls_keylog_write(const char *label,
const unsigned char client_random[CLIENT_RANDOM_SIZE],
const unsigned char *secret, size_t secretlen)
bool Curl_tls_keylog_write(const char *label,
const unsigned char client_random[CLIENT_RANDOM_SIZE],
const unsigned char *secret, size_t secretlen)
{
size_t pos, i;
unsigned char line[KEYLOG_LABEL_MAXLEN + 1 + 2 * CLIENT_RANDOM_SIZE + 1 +

73
lib/vtls/mbedtls.c
View file

@ -38,7 +38,7 @@
#include <mbedtls/version.h>
#if MBEDTLS_VERSION_NUMBER < 0x03020000
#error "mbedTLS 3.2.0 or later required"
#error "mbedTLS 3.2.0 or later required"
#endif
#include <psa/crypto_config.h>
#include <mbedtls/net_sockets.h>
@ -77,7 +77,7 @@
/* ALPN for http2 */
#if defined(USE_HTTP2) && defined(MBEDTLS_SSL_ALPN)
# define HAS_ALPN_MBEDTLS
#define HAS_ALPN_MBEDTLS
#endif
struct mbed_ssl_backend_data {
@ -109,7 +109,7 @@ struct mbed_ssl_backend_data {
#endif
#ifndef MBEDTLS_ERROR_C
#define mbedtls_strerror(a,b,c) b[0] = 0
#define mbedtls_strerror(a, b, c) b[0] = 0
#endif
#if defined(CURL_MBEDTLS_DRBG) && defined(HAS_THREADING_SUPPORT)
@ -217,8 +217,7 @@ static int mbedtls_bio_cf_read(void *bio, unsigned char *buf, size_t blen)
/*
* profile
*/
static const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_fr =
{
static const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_fr = {
/* Hashes from SHA-1 and above */
MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA1) |
MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_RIPEMD160) |
@ -307,9 +306,8 @@ mbed_set_ssl_version_min_max(struct Curl_easy *data,
cipher suite present in other SSL implementations. Provide
provisional support for specifying the cipher suite here. */
#ifdef MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8
static int
mbed_cipher_suite_get_str(uint16_t id, char *buf, size_t buf_size,
bool prefer_rfc)
static int mbed_cipher_suite_get_str(uint16_t id, char *buf, size_t buf_size,
bool prefer_rfc)
{
if(id == MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8)
curl_msnprintf(buf, buf_size, "%s", "TLS_ECJPAKE_WITH_AES_128_CCM_8");
@ -318,8 +316,7 @@ mbed_cipher_suite_get_str(uint16_t id, char *buf, size_t buf_size,
return 0;
}
static uint16_t
mbed_cipher_suite_walk_str(const char **str, const char **end)
static uint16_t mbed_cipher_suite_walk_str(const char **str, const char **end)
{
uint16_t id = Curl_cipher_suite_walk_str(str, end);
size_t len = *end - *str;
@ -348,7 +345,8 @@ mbed_set_selected_ciphers(struct Curl_easy *data,
const char *ptr, *end;
supported = mbedtls_ssl_list_ciphersuites();
for(i = 0; supported[i] != 0; i++);
for(i = 0; supported[i] != 0; i++)
;
supported_len = i;
selected = curlx_malloc(sizeof(int) * (supported_len + 1));
@ -361,7 +359,7 @@ mbed_set_selected_ciphers(struct Curl_easy *data,
if(!ciphers13) {
/* Add default TLSv1.3 ciphers to selection */
for(j = 0; j < supported_len; j++) {
uint16_t id = (uint16_t) supported[j];
uint16_t id = (uint16_t)supported[j];
if(strncmp(mbedtls_ssl_get_ciphersuite_name(id), "TLS1-3", 6) != 0)
continue;
@ -380,23 +378,25 @@ add_ciphers:
/* Check if cipher is supported */
if(id) {
for(i = 0; i < supported_len && supported[i] != id; i++);
for(i = 0; i < supported_len && supported[i] != id; i++)
;
if(i == supported_len)
id = 0;
}
if(!id) {
if(ptr[0] != '\0')
infof(data, "mbedTLS: unknown cipher in list: \"%.*s\"",
(int) (end - ptr), ptr);
(int)(end - ptr), ptr);
continue;
}
/* No duplicates allowed (so selected cannot overflow) */
for(i = 0; i < count && selected[i] != id; i++);
for(i = 0; i < count && selected[i] != id; i++)
;
if(i < count) {
if(i >= default13_count)
infof(data, "mbedTLS: duplicate cipher in list: \"%.*s\"",
(int) (end - ptr), ptr);
(int)(end - ptr), ptr);
continue;
}
@ -412,12 +412,13 @@ add_ciphers:
if(!ciphers12) {
/* Add default TLSv1.2 ciphers to selection */
for(j = 0; j < supported_len; j++) {
uint16_t id = (uint16_t) supported[j];
uint16_t id = (uint16_t)supported[j];
if(strncmp(mbedtls_ssl_get_ciphersuite_name(id), "TLS1-3", 6) == 0)
continue;
/* No duplicates allowed (so selected cannot overflow) */
for(i = 0; i < count && selected[i] != id; i++);
for(i = 0; i < count && selected[i] != id; i++)
;
if(i < count)
continue;
@ -441,8 +442,8 @@ add_ciphers:
return CURLE_OK;
}
static void
mbed_dump_cert_info(struct Curl_easy *data, const mbedtls_x509_crt *crt)
static void mbed_dump_cert_info(struct Curl_easy *data,
const mbedtls_x509_crt *crt)
{
#if defined(CURL_DISABLE_VERBOSE_STRINGS) || defined(MBEDTLS_X509_REMOVE_INFO)
(void)data, (void)crt;
@ -454,7 +455,7 @@ mbed_dump_cert_info(struct Curl_easy *data, const mbedtls_x509_crt *crt)
infof(data, "Server certificate:");
for(p = buffer; *p; p += *p != '\0') {
size_t s = strcspn(p, "\n");
infof(data, "%.*s", (int) s, p);
infof(data, "%.*s", (int)s, p);
p += s;
}
}
@ -465,8 +466,8 @@ mbed_dump_cert_info(struct Curl_easy *data, const mbedtls_x509_crt *crt)
#endif
}
static void
mbed_extract_certinfo(struct Curl_easy *data, const mbedtls_x509_crt *crt)
static void mbed_extract_certinfo(struct Curl_easy *data,
const mbedtls_x509_crt *crt)
{
CURLcode result;
const mbedtls_x509_crt *cur;
@ -485,7 +486,7 @@ mbed_extract_certinfo(struct Curl_easy *data, const mbedtls_x509_crt *crt)
result = Curl_ssl_init_certinfo(data, cert_count);
for(i = 0, cur = crt; result == CURLE_OK && cur; ++i, cur = cur->next) {
const char *beg = (const char *) cur->raw.p;
const char *beg = (const char *)cur->raw.p;
const char *end = beg + cur->raw.len;
result = Curl_extract_certinfo(data, i, beg, end);
}
@ -494,7 +495,7 @@ mbed_extract_certinfo(struct Curl_easy *data, const mbedtls_x509_crt *crt)
static int mbed_verify_cb(void *ptr, mbedtls_x509_crt *crt,
int depth, uint32_t *flags)
{
struct Curl_cfilter *cf = (struct Curl_cfilter *) ptr;
struct Curl_cfilter *cf = (struct Curl_cfilter *)ptr;
struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
struct Curl_easy *data = CF_DATA_CURRENT(cf);
@ -523,8 +524,8 @@ static int mbed_verify_cb(void *ptr, mbedtls_x509_crt *crt,
return 0;
}
static CURLcode
mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
static CURLcode mbed_connect_step1(struct Curl_cfilter *cf,
struct Curl_easy *data)
{
struct ssl_connect_data *connssl = cf->ctx;
struct mbed_ssl_backend_data *backend =
@ -959,8 +960,8 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
return CURLE_OK;
}
static CURLcode
mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
static CURLcode mbed_connect_step2(struct Curl_cfilter *cf,
struct Curl_easy *data)
{
CURLcode result;
int ret;
@ -1004,8 +1005,8 @@ mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
{
char cipher_str[64];
uint16_t cipher_id;
cipher_id = (uint16_t)
mbedtls_ssl_get_ciphersuite_id_from_ssl(&backend->ssl);
cipher_id =
(uint16_t)mbedtls_ssl_get_ciphersuite_id_from_ssl(&backend->ssl);
mbed_cipher_suite_get_str(cipher_id, cipher_str, sizeof(cipher_str), TRUE);
infof(data, "mbedTLS: %s Handshake complete, cipher is %s",
mbedtls_ssl_get_version(&backend->ssl), cipher_str);
@ -1084,8 +1085,8 @@ pinnedpubkey_error:
return CURLE_OK;
}
static CURLcode
mbed_new_session(struct Curl_cfilter *cf, struct Curl_easy *data)
static CURLcode mbed_new_session(struct Curl_cfilter *cf,
struct Curl_easy *data)
{
struct ssl_connect_data *connssl = cf->ctx;
struct mbed_ssl_backend_data *backend =
@ -1148,8 +1149,7 @@ out:
}
static CURLcode mbed_send(struct Curl_cfilter *cf, struct Curl_easy *data,
const void *mem, size_t len,
size_t *pnwritten)
const void *mem, size_t len, size_t *pnwritten)
{
struct ssl_connect_data *connssl = cf->ctx;
struct mbed_ssl_backend_data *backend =
@ -1327,8 +1327,7 @@ static void mbedtls_close(struct Curl_cfilter *cf, struct Curl_easy *data)
}
static CURLcode mbed_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
char *buf, size_t buffersize,
size_t *pnread)
char *buf, size_t buffersize, size_t *pnread)
{
struct ssl_connect_data *connssl = cf->ctx;
struct mbed_ssl_backend_data *backend =

5
lib/vtls/mbedtls_threadlock.c
View file

@ -24,9 +24,8 @@
***************************************************************************/
#include "../curl_setup.h"
#if defined(USE_MBEDTLS) && \
((defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)) || \
defined(_WIN32))
#if defined(USE_MBEDTLS) && \
((defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)) || defined(_WIN32))
#if defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)
# include <pthread.h>

3
lib/vtls/mbedtls_threadlock.h
View file

@ -28,8 +28,7 @@
#ifdef USE_MBEDTLS
#if (defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)) || \
defined(_WIN32)
#if (defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)) || defined(_WIN32)
int Curl_mbedtlsthreadlock_thread_setup(void);
int Curl_mbedtlsthreadlock_thread_cleanup(void);

148
lib/vtls/openssl.c
View file

@ -179,7 +179,7 @@ static void ossl_provider_cleanup(struct Curl_easy *data);
#define OSSL_PACKAGE "BoringSSL"
#elif defined(OPENSSL_IS_AWSLC)
#define OSSL_PACKAGE "AWS-LC"
#elif defined(USE_NGTCP2) && defined(USE_NGHTTP3) && \
#elif defined(USE_NGTCP2) && defined(USE_NGHTTP3) && \
!defined(OPENSSL_QUIC_API2)
#define OSSL_PACKAGE "quictls"
#else
@ -234,7 +234,7 @@ static CURLcode pubkey_show(struct Curl_easy *data,
return push_certinfo(data, mem, namebuf, num);
}
#define print_pubkey_BN(_type, _name, _num) \
#define print_pubkey_BN(_type, _name, _num) \
pubkey_show(data, mem, _num, #_type, #_name, _name)
static int asn1_object_dump(const ASN1_OBJECT *a, char *buf, size_t len)
@ -685,8 +685,7 @@ static void ossl_keylog_callback(const SSL *ssl, const char *line)
* ossl_log_tls12_secret is called by libcurl to make the CLIENT_RANDOMs if the
* OpenSSL being used does not have native support for doing that.
*/
static void
ossl_log_tls12_secret(const SSL *ssl, bool *keylog_done)
static void ossl_log_tls12_secret(const SSL *ssl, bool *keylog_done)
{
const SSL_SESSION *session;
unsigned char client_random[SSL3_RANDOM_SIZE];
@ -791,8 +790,7 @@ static char *ossl_strerror(unsigned long error, char *buf, size_t size)
return buf;
}
static int passwd_callback(char *buf, int num, int encrypting,
void *password)
static int passwd_callback(char *buf, int num, int encrypting, void *password)
{
DEBUGASSERT(encrypting == 0);
@ -932,8 +930,7 @@ static int use_certificate_blob(SSL_CTX *ctx, const struct curl_blob *blob,
}
else if(type == SSL_FILETYPE_PEM) {
/* ERR_R_PEM_LIB; */
x = PEM_read_bio_X509(in, NULL,
passwd_callback, CURL_UNCONST(key_passwd));
x = PEM_read_bio_X509(in, NULL, passwd_callback, CURL_UNCONST(key_passwd));
}
else {
ret = 0;
@ -979,9 +976,9 @@ end:
return ret;
}
static int
use_certificate_chain_blob(SSL_CTX *ctx, const struct curl_blob *blob,
const char *key_passwd)
static int use_certificate_chain_blob(SSL_CTX *ctx,
const struct curl_blob *blob,
const char *key_passwd)
{
int ret = 0;
X509 *x = NULL;
@ -1011,8 +1008,7 @@ use_certificate_chain_blob(SSL_CTX *ctx, const struct curl_blob *blob,
}
while((ca = PEM_read_bio_X509(in, NULL, passwd_callback,
CURL_UNCONST(key_passwd)))
!= NULL) {
CURL_UNCONST(key_passwd))) != NULL) {
if(!SSL_CTX_add0_chain_cert(ctx, ca)) {
X509_free(ca);
@ -1054,8 +1050,7 @@ static int enginecheck(struct Curl_easy *data,
}
if(data->state.engine) {
UI_METHOD *ui_method =
UI_create_method("curl user interface");
UI_METHOD *ui_method = UI_create_method("curl user interface");
if(!ui_method) {
failf(data, "unable to create " OSSL_PACKAGE " user-interface method");
return 0;
@ -1116,8 +1111,7 @@ static int providercheck(struct Curl_easy *data,
EVP_PKEY *priv_key = NULL;
OSSL_STORE_CTX *store = NULL;
OSSL_STORE_INFO *info = NULL;
UI_METHOD *ui_method =
UI_create_method("curl user interface");
UI_METHOD *ui_method = UI_create_method("curl user interface");
if(!ui_method) {
failf(data, "unable to create " OSSL_PACKAGE " user-interface method");
return 0;
@ -1221,16 +1215,15 @@ static int engineload(struct Curl_easy *data,
/* Load the certificate from the engine */
if(!ENGINE_ctrl_cmd(data->state.engine, cmd_name,
0, &params, NULL, 1)) {
failf(data, "ssl engine cannot load client cert with id"
" '%s' [%s]", cert_file,
failf(data, "ssl engine cannot load client cert with id '%s' [%s]",
cert_file,
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)));
return 0;
}
if(!params.cert) {
failf(data, "ssl engine did not initialized the certificate "
"properly.");
failf(data, "ssl engine did not initialized the certificate properly.");
return 0;
}
@ -1352,8 +1345,7 @@ static int pkcs12load(struct Curl_easy *data,
if(cert_blob) {
cert_bio = BIO_new_mem_buf(cert_blob->data, (int)(cert_blob->len));
if(!cert_bio) {
failf(data,
"BIO_new_mem_buf NULL, " OSSL_PACKAGE " error %s",
failf(data, "BIO_new_mem_buf NULL, " OSSL_PACKAGE " error %s",
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)) );
return 0;
@ -1362,8 +1354,7 @@ static int pkcs12load(struct Curl_easy *data,
else {
cert_bio = BIO_new(BIO_s_file());
if(!cert_bio) {
failf(data,
"BIO_new return NULL, " OSSL_PACKAGE " error %s",
failf(data, "BIO_new return NULL, " OSSL_PACKAGE " error %s",
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)) );
return 0;
@ -1386,11 +1377,9 @@ static int pkcs12load(struct Curl_easy *data,
}
if(!PKCS12_parse(p12, key_passwd, &pri, &x509, &ca)) {
failf(data,
"could not parse PKCS12 file, check password, " OSSL_PACKAGE
failf(data, "could not parse PKCS12 file, check password, " OSSL_PACKAGE
" error %s",
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)) );
ossl_strerror(ERR_get_error(), error_buffer, sizeof(error_buffer)));
PKCS12_free(p12);
return 0;
}
@ -1398,17 +1387,14 @@ static int pkcs12load(struct Curl_easy *data,
PKCS12_free(p12);
if(SSL_CTX_use_certificate(ctx, x509) != 1) {
failf(data,
"could not load PKCS12 client certificate, " OSSL_PACKAGE
failf(data, "could not load PKCS12 client certificate, " OSSL_PACKAGE
" error %s",
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)) );
ossl_strerror(ERR_get_error(), error_buffer, sizeof(error_buffer)));
goto fail;
}
if(SSL_CTX_use_PrivateKey(ctx, pri) != 1) {
failf(data, "unable to use private key from PKCS12 file '%s'",
cert_file);
failf(data, "unable to use private key from PKCS12 file '%s'", cert_file);
goto fail;
}
@ -1500,7 +1486,7 @@ static CURLcode client_cert(struct Curl_easy *data,
"(no key found, wrong passphrase, or wrong file format?)",
(cert_blob ? "CURLOPT_SSLCERT_BLOB" : cert_file),
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)) );
sizeof(error_buffer)));
return CURLE_SSL_CERTPROBLEM;
}
break;
@ -1520,7 +1506,7 @@ static CURLcode client_cert(struct Curl_easy *data,
"(no key found, wrong passphrase, or wrong file format?)",
(cert_blob ? "CURLOPT_SSLCERT_BLOB" : cert_file),
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)) );
sizeof(error_buffer)));
return CURLE_SSL_CERTPROBLEM;
}
break;
@ -1850,20 +1836,17 @@ static CURLcode ossl_set_provider(struct Curl_easy *data, const char *iname)
return CURLE_OK;
}
data->state.provider =
OSSL_PROVIDER_try_load(data->state.libctx, name, 1);
data->state.provider = OSSL_PROVIDER_try_load(data->state.libctx, name, 1);
if(!data->state.provider) {
char error_buffer[256];
failf(data, "Failed to initialize provider: %s",
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)));
ossl_strerror(ERR_get_error(), error_buffer, sizeof(error_buffer)));
ossl_provider_cleanup(data);
return CURLE_SSL_ENGINE_NOTFOUND;
}
/* load the base provider as well */
data->state.baseprov =
OSSL_PROVIDER_try_load(data->state.libctx, "base", 1);
data->state.baseprov = OSSL_PROVIDER_try_load(data->state.libctx, "base", 1);
if(!data->state.baseprov) {
ossl_provider_cleanup(data);
failf(data, "Failed to load base");
@ -1875,7 +1858,6 @@ static CURLcode ossl_set_provider(struct Curl_easy *data, const char *iname)
}
#endif
static CURLcode ossl_shutdown(struct Curl_cfilter *cf,
struct Curl_easy *data,
bool send_shutdown, bool *done)
@ -2138,7 +2120,7 @@ static CURLcode ossl_verifyhost(struct Curl_easy *data,
if(check->type == target) {
/* get data and length */
const char *altptr = (const char *)ASN1_STRING_get0_data(check->d.ia5);
size_t altlen = (size_t) ASN1_STRING_length(check->d.ia5);
size_t altlen = (size_t)ASN1_STRING_length(check->d.ia5);
switch(target) {
case GEN_DNS: /* name/pattern comparison */
@ -2166,8 +2148,7 @@ static CURLcode ossl_verifyhost(struct Curl_easy *data,
our server IP address is */
if((altlen == addrlen) && !memcmp(altptr, &addr, altlen)) {
matched = TRUE;
infof(data,
" subjectAltName: \"%s\" matches cert's IP address!",
infof(data, " subjectAltName: \"%s\" matches cert's IP address!",
peer->dispname);
}
break;
@ -2242,8 +2223,7 @@ static CURLcode ossl_verifyhost(struct Curl_easy *data,
/* error already detected, pass through */
;
else if(!cn) {
failf(data,
"SSL: unable to obtain common name from peer certificate");
failf(data, "SSL: unable to obtain common name from peer certificate");
result = CURLE_PEER_FAILED_VERIFICATION;
}
else if(!Curl_cert_hostcheck((const char *)cn, cnlen,
@ -2780,7 +2760,7 @@ out:
*/
static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
{
struct Curl_cfilter *cf = (struct Curl_cfilter*) SSL_get_app_data(ssl);
struct Curl_cfilter *cf = (struct Curl_cfilter *)SSL_get_app_data(ssl);
if(cf) {
struct Curl_easy *data = CF_DATA_CURRENT(cf);
struct ssl_connect_data *connssl = cf->ctx;
@ -3181,7 +3161,7 @@ static CURLcode ossl_populate_x509_store(struct Curl_cfilter *cf,
failf(data, "error loading CRL file: %s", ssl_crlfile);
return CURLE_SSL_CRL_BADFILE;
}
x509flags = X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL;
x509flags = X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL;
infof(data, " CRLfile: %s", ssl_crlfile);
}
@ -3210,7 +3190,7 @@ static CURLcode ossl_populate_x509_store(struct Curl_cfilter *cf,
}
/* key to use at `multi->proto_hash` */
#define MPROTO_OSSL_X509_KEY "tls:ossl:x509:share"
#define MPROTO_OSSL_X509_KEY "tls:ossl:x509:share"
struct ossl_x509_share {
char *CAfile; /* CAfile path used to generate X509 store */
@ -3222,7 +3202,7 @@ struct ossl_x509_share {
static void oss_x509_share_free(void *key, size_t key_len, void *p)
{
struct ossl_x509_share *share = p;
DEBUGASSERT(key_len == (sizeof(MPROTO_OSSL_X509_KEY)-1));
DEBUGASSERT(key_len == (sizeof(MPROTO_OSSL_X509_KEY) - 1));
DEBUGASSERT(!memcmp(MPROTO_OSSL_X509_KEY, key, key_len));
(void)key;
(void)key_len;
@ -3233,9 +3213,8 @@ static void oss_x509_share_free(void *key, size_t key_len, void *p)
curlx_free(share);
}
static bool
ossl_cached_x509_store_expired(const struct Curl_easy *data,
const struct ossl_x509_share *mb)
static bool ossl_cached_x509_store_expired(const struct Curl_easy *data,
const struct ossl_x509_share *mb)
{
const struct ssl_general_config *cfg = &data->set.general_ssl;
if(cfg->ca_cache_timeout < 0)
@ -3249,9 +3228,8 @@ ossl_cached_x509_store_expired(const struct Curl_easy *data,
}
}
static bool
ossl_cached_x509_store_different(struct Curl_cfilter *cf,
const struct ossl_x509_share *mb)
static bool ossl_cached_x509_store_different(struct Curl_cfilter *cf,
const struct ossl_x509_share *mb)
{
struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
if(!mb->CAfile || !conn_config->CAfile)
@ -3272,7 +3250,7 @@ static X509_STORE *ossl_get_cached_x509_store(struct Curl_cfilter *cf,
*pempty = TRUE;
share = multi ? Curl_hash_pick(&multi->proto_hash,
CURL_UNCONST(MPROTO_OSSL_X509_KEY),
sizeof(MPROTO_OSSL_X509_KEY)-1) : NULL;
sizeof(MPROTO_OSSL_X509_KEY) - 1) : NULL;
if(share && share->store &&
!ossl_cached_x509_store_expired(data, share) &&
!ossl_cached_x509_store_different(cf, share)) {
@ -3297,7 +3275,7 @@ static void ossl_set_cached_x509_store(struct Curl_cfilter *cf,
return;
share = Curl_hash_pick(&multi->proto_hash,
CURL_UNCONST(MPROTO_OSSL_X509_KEY),
sizeof(MPROTO_OSSL_X509_KEY)-1);
sizeof(MPROTO_OSSL_X509_KEY) - 1);
if(!share) {
share = curlx_calloc(1, sizeof(*share));
@ -3305,7 +3283,7 @@ static void ossl_set_cached_x509_store(struct Curl_cfilter *cf,
return;
if(!Curl_hash_add2(&multi->proto_hash,
CURL_UNCONST(MPROTO_OSSL_X509_KEY),
sizeof(MPROTO_OSSL_X509_KEY)-1,
sizeof(MPROTO_OSSL_X509_KEY) - 1,
share, oss_x509_share_free)) {
curlx_free(share);
return;
@ -3508,8 +3486,7 @@ static CURLcode ossl_init_ech(struct ossl_ctx *octx,
if(data->set.tls_ech & CURLECH_HARD)
return result;
}
if(SSL_set1_ech_config_list(octx->ssl, ech_config,
ech_config_len) != 1) {
if(SSL_set1_ech_config_list(octx->ssl, ech_config, ech_config_len) != 1) {
infof(data, "ECH: SSL_ECH_set1_ech_config_list failed");
if(data->set.tls_ech & CURLECH_HARD) {
curlx_free(ech_config);
@ -3519,14 +3496,13 @@ static CURLcode ossl_init_ech(struct ossl_ctx *octx,
curlx_free(ech_config);
trying_ech_now = 1;
# else
ech_config = (unsigned char *) data->set.str[STRING_ECH_CONFIG];
ech_config = (unsigned char *)data->set.str[STRING_ECH_CONFIG];
if(!ech_config) {
infof(data, "ECH: ECHConfig from command line empty");
return CURLE_SSL_CONNECT_ERROR;
}
ech_config_len = strlen(data->set.str[STRING_ECH_CONFIG]);
if(SSL_set1_ech_config_list(octx->ssl, ech_config,
ech_config_len) != 1) {
if(SSL_set1_ech_config_list(octx->ssl, ech_config, ech_config_len) != 1) {
infof(data, "ECH: SSL_ECH_set1_ech_config_list failed");
if(data->set.tls_ech & CURLECH_HARD)
return CURLE_SSL_CONNECT_ERROR;
@ -3584,16 +3560,16 @@ static CURLcode ossl_init_ech(struct ossl_ctx *octx,
infof(data, "ECH: inner: '%s', outer: '%s'",
peer->hostname ? peer->hostname : "NULL", outername);
result = SSL_ech_set1_server_names(octx->ssl,
peer->hostname, outername,
0 /* do send outer */);
peer->hostname, outername,
0 /* do send outer */);
if(result != 1) {
infof(data, "ECH: rv failed to set server name(s) %d [ERROR]", result);
return CURLE_SSL_CONNECT_ERROR;
}
}
# endif /* HAVE_BORINGSSL_LIKE */
if(trying_ech_now
&& SSL_set_min_proto_version(octx->ssl, TLS1_3_VERSION) != 1) {
if(trying_ech_now &&
SSL_set_min_proto_version(octx->ssl, TLS1_3_VERSION) != 1) {
infof(data, "ECH: cannot force TLSv1.3 [ERROR]");
return CURLE_SSL_CONNECT_ERROR;
}
@ -3602,7 +3578,6 @@ static CURLcode ossl_init_ech(struct ossl_ctx *octx,
}
#endif /* USE_ECH_OPENSSL */
static CURLcode ossl_init_ssl(struct ossl_ctx *octx,
struct Curl_cfilter *cf,
struct Curl_easy *data,
@ -3706,7 +3681,6 @@ static CURLcode ossl_init_method(struct Curl_cfilter *cf,
return *pmethod ? CURLE_OK : CURLE_SSL_CONNECT_ERROR;
}
CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
struct Curl_cfilter *cf,
struct Curl_easy *data,
@ -3821,7 +3795,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
/* "--tlsv<x.y>" options mean TLS >= version <x.y> */
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1: /* TLS >= version 1.0 */
case CURL_SSLVERSION_TLSv1: /* TLS >= version 1.0 */
case CURL_SSLVERSION_TLSv1_0: /* TLS >= version 1.0 */
case CURL_SSLVERSION_TLSv1_1: /* TLS >= version 1.1 */
case CURL_SSLVERSION_TLSv1_2: /* TLS >= version 1.2 */
@ -4036,8 +4010,7 @@ static CURLcode ossl_on_session_reuse(struct Curl_cfilter *cf,
return result;
}
void Curl_ossl_report_handshake(struct Curl_easy *data,
struct ossl_ctx *octx)
void Curl_ossl_report_handshake(struct Curl_easy *data, struct ossl_ctx *octx)
{
#ifndef CURL_DISABLE_VERBOSE_STRINGS
if(Curl_trc_is_verbose(data)) {
@ -4065,7 +4038,6 @@ void Curl_ossl_report_handshake(struct Curl_easy *data,
(void)data;
(void)octx;
#endif /* CURL_DISABLE_VERBOSE_STRINGS */
}
static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
@ -4121,7 +4093,7 @@ static CURLcode ossl_connect_step1(struct Curl_cfilter *cf,
#ifdef USE_ECH_OPENSSL
/* If we have retry configs, then trace those out */
static void ossl_trace_ech_retry_configs(struct Curl_easy *data, SSL* ssl,
static void ossl_trace_ech_retry_configs(struct Curl_easy *data, SSL *ssl,
int reason)
{
CURLcode result = CURLE_OK;
@ -4247,7 +4219,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
else {
/* untreated error */
sslerr_t errdetail;
char error_buffer[256]="";
char error_buffer[256] = "";
CURLcode result;
long lerr;
int lib;
@ -4319,7 +4291,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
* the SO_ERROR is also lost.
*/
if(CURLE_SSL_CONNECT_ERROR == result && errdetail == 0) {
char extramsg[80]="";
char extramsg[80] = "";
int sockerr = SOCKERRNO;
if(sockerr && detail == SSL_ERROR_SYSCALL)
@ -4374,7 +4346,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
break;
default:
status = "unexpected status";
infof(data, "ECH: unexpected status %d",rv);
infof(data, "ECH: unexpected status %d", rv);
}
infof(data, "ECH: result: status is %s, inner is %s, outer is %s",
(status ? status : "NULL"),
@ -4418,7 +4390,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
* Heavily modified from:
* https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#OpenSSL
*/
static CURLcode ossl_pkp_pin_peer_pubkey(struct Curl_easy *data, X509* cert,
static CURLcode ossl_pkp_pin_peer_pubkey(struct Curl_easy *data, X509 *cert,
const char *pinnedpubkey)
{
/* Scratch */
@ -4534,8 +4506,7 @@ static void infof_certstack(struct Curl_easy *data, const SSL *ssl)
type_name = NULL;
#endif
infof(data,
" Certificate level %d: "
infof(data, " Certificate level %d: "
"Public key type %s%s (%d/%d Bits/secBits), signed using %s",
cert_level, type_name ? type_name : "?",
get_group_name == 0 ? "" : group_name_final,
@ -4553,7 +4524,7 @@ static CURLcode ossl_check_issuer(struct Curl_cfilter *cf,
struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
X509 *issuer = NULL;
BIO *fp = NULL;
char err_buf[256]="";
char err_buf[256] = "";
bool verify_enabled = (conn_config->verifypeer || conn_config->verifyhost);
CURLcode result = CURLE_OK;
@ -4671,12 +4642,12 @@ static CURLcode ossl_infof_cert(struct Curl_cfilter *cf,
infof(data, " subject: %s", result ? "[NONE]" : curlx_dyn_ptr(&dname));
ASN1_TIME_print(mem, X509_get0_notBefore(server_cert));
len = BIO_get_mem_data(mem, (char **) &buf);
len = BIO_get_mem_data(mem, (char **)&buf);
infof(data, " start date: %.*s", (int)len, buf);
(void)BIO_reset(mem);
ASN1_TIME_print(mem, X509_get0_notAfter(server_cert));
len = BIO_get_mem_data(mem, (char **) &buf);
len = BIO_get_mem_data(mem, (char **)&buf);
infof(data, " expire date: %.*s", (int)len, buf);
(void)BIO_reset(mem);
@ -5118,8 +5089,7 @@ static CURLcode ossl_send(struct Curl_cfilter *cf,
result = CURLE_AGAIN;
octx->blocked_ssl_write_len = memlen;
goto out;
case SSL_ERROR_SYSCALL:
{
case SSL_ERROR_SYSCALL: {
int sockerr = SOCKERRNO;
if(octx->io_result == CURLE_AGAIN) {

3
lib/vtls/openssl.h
View file

@ -150,8 +150,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
struct ssl_peer *peer);
/* Report properties of a successful handshake */
void Curl_ossl_report_handshake(struct Curl_easy *data,
struct ossl_ctx *octx);
void Curl_ossl_report_handshake(struct Curl_easy *data, struct ossl_ctx *octx);
#endif /* USE_OPENSSL */
#endif /* HEADER_CURL_SSLUSE_H */

176
lib/vtls/rustls.c
View file

@ -42,8 +42,7 @@
#include "cipher_suite.h"
#include "x509asn1.h"
struct rustls_ssl_backend_data
{
struct rustls_ssl_backend_data {
const struct rustls_client_config *config;
struct rustls_connection *conn;
size_t plain_out_buffered;
@ -58,17 +57,17 @@ static CURLcode map_error(const rustls_result r)
return CURLE_PEER_FAILED_VERIFICATION;
}
switch(r) {
case RUSTLS_RESULT_OK:
return CURLE_OK;
case RUSTLS_RESULT_NULL_PARAMETER:
return CURLE_BAD_FUNCTION_ARGUMENT;
default:
return CURLE_RECV_ERROR;
case RUSTLS_RESULT_OK:
return CURLE_OK;
case RUSTLS_RESULT_NULL_PARAMETER:
return CURLE_BAD_FUNCTION_ARGUMENT;
default:
return CURLE_RECV_ERROR;
}
}
static void
rustls_failf(struct Curl_easy *data, const rustls_result rr, const char *msg)
static void rustls_failf(struct Curl_easy *data, const rustls_result rr,
const char *msg)
{
char errorbuf[STRERROR_LEN];
size_t errorlen;
@ -76,8 +75,8 @@ rustls_failf(struct Curl_easy *data, const rustls_result rr, const char *msg)
failf(data, "%s: %.*s", msg, (int)errorlen, errorbuf);
}
static bool
cr_data_pending(struct Curl_cfilter *cf, const struct Curl_easy *data)
static bool cr_data_pending(struct Curl_cfilter *cf,
const struct Curl_easy *data)
{
const struct ssl_connect_data *ctx = cf->ctx;
struct rustls_ssl_backend_data *backend;
@ -93,11 +92,11 @@ struct io_ctx {
struct Curl_easy *data;
};
static int
read_cb(void *userdata, uint8_t *buf, uintptr_t len, uintptr_t *out_n)
static int read_cb(void *userdata, uint8_t *buf, uintptr_t len,
uintptr_t *out_n)
{
const struct io_ctx *io_ctx = userdata;
struct ssl_connect_data *const connssl = io_ctx->cf->ctx;
struct ssl_connect_data * const connssl = io_ctx->cf->ctx;
CURLcode result;
int ret = 0;
size_t nread;
@ -120,8 +119,8 @@ read_cb(void *userdata, uint8_t *buf, uintptr_t len, uintptr_t *out_n)
return ret;
}
static int
write_cb(void *userdata, const uint8_t *buf, uintptr_t len, uintptr_t *out_n)
static int write_cb(void *userdata, const uint8_t *buf, uintptr_t len,
uintptr_t *out_n)
{
const struct io_ctx *io_ctx = userdata;
CURLcode result;
@ -146,8 +145,8 @@ write_cb(void *userdata, const uint8_t *buf, uintptr_t len, uintptr_t *out_n)
static ssize_t tls_recv_more(struct Curl_cfilter *cf,
struct Curl_easy *data, CURLcode *err)
{
const struct ssl_connect_data *const connssl = cf->ctx;
struct rustls_ssl_backend_data *const backend =
const struct ssl_connect_data * const connssl = cf->ctx;
struct rustls_ssl_backend_data * const backend =
(struct rustls_ssl_backend_data *)connssl->backend;
struct io_ctx io_ctx;
size_t tls_bytes_read = 0;
@ -186,12 +185,11 @@ static ssize_t tls_recv_more(struct Curl_cfilter *cf,
* Filter receive method implementation. `plainbuf` and `plainlen`
* are always not NULL/0.
*/
static CURLcode
cr_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
char *plainbuf, size_t plainlen, size_t *pnread)
static CURLcode cr_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
char *plainbuf, size_t plainlen, size_t *pnread)
{
const struct ssl_connect_data *const connssl = cf->ctx;
struct rustls_ssl_backend_data *const backend =
const struct ssl_connect_data * const connssl = cf->ctx;
struct rustls_ssl_backend_data * const backend =
(struct rustls_ssl_backend_data *)connssl->backend;
struct rustls_connection *rconn = NULL;
CURLcode result = CURLE_OK;
@ -300,12 +298,12 @@ static CURLcode cr_flush_out(struct Curl_cfilter *cf, struct Curl_easy *data,
* In that case, it will not read anything into Rustls' plaintext input buffer.
* It will only drain Rustls' plaintext output buffer into the socket.
*/
static CURLcode
cr_send(struct Curl_cfilter *cf, struct Curl_easy *data,
const void *plainbuf, size_t plainlen, size_t *pnwritten)
static CURLcode cr_send(struct Curl_cfilter *cf, struct Curl_easy *data,
const void *plainbuf, size_t plainlen,
size_t *pnwritten)
{
const struct ssl_connect_data *const connssl = cf->ctx;
struct rustls_ssl_backend_data *const backend =
const struct ssl_connect_data * const connssl = cf->ctx;
struct rustls_ssl_backend_data * const backend =
(struct rustls_ssl_backend_data *)connssl->backend;
struct rustls_connection *rconn = NULL;
size_t plainwritten = 0;
@ -379,18 +377,15 @@ out:
/* A server certificate verify callback for Rustls that always returns
RUSTLS_RESULT_OK, or in other words disable certificate verification. */
static uint32_t
cr_verify_none(void *userdata,
const rustls_verify_server_cert_params *params)
static uint32_t cr_verify_none(void *userdata,
const rustls_verify_server_cert_params *params)
{
(void)userdata;
(void)params;
return RUSTLS_RESULT_OK;
}
static int
read_file_into(const char *filename,
struct dynbuf *out)
static int read_file_into(const char *filename, struct dynbuf *out)
{
FILE *f = curlx_fopen(filename, FOPEN_READTEXT);
if(!f) {
@ -464,16 +459,17 @@ add_ciphers:
if(!id) {
if(ptr[0] != '\0')
infof(data, "rustls: unknown cipher in list: \"%.*s\"",
(int) (end - ptr), ptr);
(int)(end - ptr), ptr);
continue;
}
/* No duplicates allowed (so selected cannot overflow) */
for(i = 0; i < count && selected[i] != entry; i++);
for(i = 0; i < count && selected[i] != entry; i++)
;
if(i < count) {
if(i >= default13_count)
infof(data, "rustls: duplicate cipher in list: \"%.*s\"",
(int) (end - ptr), ptr);
(int)(end - ptr), ptr);
continue;
}
@ -494,7 +490,8 @@ add_ciphers:
continue;
/* No duplicates allowed (so selected cannot overflow) */
for(i = 0; i < count && selected[i] != entry; i++);
for(i = 0; i < count && selected[i] != entry; i++)
;
if(i < count)
continue;
@ -505,10 +502,10 @@ add_ciphers:
*selected_size = count;
}
static void
cr_keylog_log_cb(struct rustls_str label,
const uint8_t *client_random, size_t client_random_len,
const uint8_t *secret, size_t secret_len)
static void cr_keylog_log_cb(struct rustls_str label,
const uint8_t *client_random,
size_t client_random_len, const uint8_t *secret,
size_t secret_len)
{
char clabel[KEYLOG_LABEL_MAXLEN];
(void)client_random_len;
@ -528,12 +525,11 @@ init_config_builder(struct Curl_easy *data,
const struct rustls_crypto_provider *custom_provider = NULL;
uint16_t tls_versions[2] = {
RUSTLS_TLS_VERSION_TLSV1_2,
RUSTLS_TLS_VERSION_TLSV1_3,
RUSTLS_TLS_VERSION_TLSV1_2,
RUSTLS_TLS_VERSION_TLSV1_3,
};
size_t tls_versions_len = 2;
size_t cipher_suites_len =
rustls_default_crypto_provider_ciphersuites_len();
size_t cipher_suites_len = rustls_default_crypto_provider_ciphersuites_len();
CURLcode result = CURLE_OK;
rustls_result rr;
@ -602,7 +598,7 @@ init_config_builder(struct Curl_easy *data,
&custom_provider_builder);
if(rr != RUSTLS_RESULT_OK) {
rustls_failf(data, rr,
"failed to create crypto provider builder from default");
"failed to create crypto provider builder from default");
result = CURLE_SSL_CIPHER;
goto cleanup;
}
@ -614,13 +610,13 @@ init_config_builder(struct Curl_easy *data,
cipher_suites_len);
if(rr != RUSTLS_RESULT_OK) {
rustls_failf(data, rr,
"failed to set ciphersuites for crypto provider builder");
"failed to set ciphersuites for crypto provider builder");
result = CURLE_SSL_CIPHER;
goto cleanup;
}
rr = rustls_crypto_provider_builder_build(
custom_provider_builder, &custom_provider);
rr = rustls_crypto_provider_builder_build(custom_provider_builder,
&custom_provider);
if(rr != RUSTLS_RESULT_OK) {
rustls_failf(data, rr, "failed to build custom crypto provider");
result = CURLE_SSL_CIPHER;
@ -628,9 +624,9 @@ init_config_builder(struct Curl_easy *data,
}
rr = rustls_client_config_builder_new_custom(custom_provider,
tls_versions,
tls_versions_len,
config_builder);
tls_versions,
tls_versions_len,
config_builder);
if(rr != RUSTLS_RESULT_OK) {
rustls_failf(data, rr, "failed to create client config builder");
result = CURLE_SSL_CIPHER;
@ -669,8 +665,7 @@ init_config_builder_alpn(struct Curl_easy *data,
infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
}
static CURLcode
init_config_builder_verifier_crl(
static CURLcode init_config_builder_verifier_crl(
struct Curl_easy *data,
const struct ssl_primary_config *conn_config,
struct rustls_web_pki_server_cert_verifier_builder *builder)
@ -723,7 +718,6 @@ init_config_builder_verifier(struct Curl_easy *data,
1);
if(rr != RUSTLS_RESULT_OK) {
rustls_failf(data, rr, "failed to parse trusted certificates from blob");
result = CURLE_SSL_CACERT_BADFILE;
goto cleanup;
}
@ -734,7 +728,6 @@ init_config_builder_verifier(struct Curl_easy *data,
1);
if(rr != RUSTLS_RESULT_OK) {
rustls_failf(data, rr, "failed to load trusted certificates");
result = CURLE_SSL_CACERT_BADFILE;
goto cleanup;
}
@ -755,8 +748,8 @@ init_config_builder_verifier(struct Curl_easy *data,
if(conn_config->CRLfile) {
result = init_config_builder_verifier_crl(data,
conn_config,
verifier_builder);
conn_config,
verifier_builder);
if(result) {
goto cleanup;
}
@ -789,8 +782,7 @@ cleanup:
return result;
}
static CURLcode
init_config_builder_platform_verifier(
static CURLcode init_config_builder_platform_verifier(
struct Curl_easy *data,
struct rustls_client_config_builder *builder)
{
@ -890,10 +882,8 @@ init_config_builder_client_auth(struct Curl_easy *data,
rr = rustls_certified_key_keys_match(certified_key);
if(rr != RUSTLS_RESULT_OK) {
rustls_failf(data,
rr,
rustls_failf(data, rr,
"rustls: client certificate and keypair files do not match:");
result = CURLE_SSL_CERTPROBLEM;
goto cleanup;
}
@ -1011,9 +1001,9 @@ cleanup:
}
#endif /* USE_ECH */
static CURLcode
cr_init_backend(struct Curl_cfilter *cf, struct Curl_easy *data,
struct rustls_ssl_backend_data *const backend)
static CURLcode cr_init_backend(struct Curl_cfilter *cf,
struct Curl_easy *data,
struct rustls_ssl_backend_data * const backend)
{
const struct ssl_connect_data *connssl = cf->ctx;
const struct ssl_primary_config *conn_config =
@ -1091,9 +1081,7 @@ cr_init_backend(struct Curl_cfilter *cf, struct Curl_easy *data,
return result;
}
rr = rustls_client_config_builder_build(
config_builder,
&backend->config);
rr = rustls_client_config_builder_build(config_builder, &backend->config);
if(rr != RUSTLS_RESULT_OK) {
rustls_failf(data, rr, "failed to build client config");
return CURLE_SSL_CONNECT_ERROR;
@ -1116,11 +1104,11 @@ cr_init_backend(struct Curl_cfilter *cf, struct Curl_easy *data,
return result;
}
static void
cr_set_negotiated_alpn(struct Curl_cfilter *cf, struct Curl_easy *data,
const struct rustls_connection *rconn)
static void cr_set_negotiated_alpn(struct Curl_cfilter *cf,
struct Curl_easy *data,
const struct rustls_connection *rconn)
{
struct ssl_connect_data *const connssl = cf->ctx;
struct ssl_connect_data * const connssl = cf->ctx;
const uint8_t *protocol = NULL;
size_t len = 0;
@ -1133,12 +1121,11 @@ cr_set_negotiated_alpn(struct Curl_cfilter *cf, struct Curl_easy *data,
* This function will set `*done` to true once the handshake is complete.
* This function never reads the value of `*done*`.
*/
static CURLcode
cr_connect(struct Curl_cfilter *cf,
struct Curl_easy *data, bool *done)
static CURLcode cr_connect(struct Curl_cfilter *cf, struct Curl_easy *data,
bool *done)
{
struct ssl_connect_data *const connssl = cf->ctx;
const struct rustls_ssl_backend_data *const backend =
struct ssl_connect_data * const connssl = cf->ctx;
const struct rustls_ssl_backend_data * const backend =
(struct rustls_ssl_backend_data *)connssl->backend;
const struct rustls_connection *rconn = NULL;
CURLcode tmperr = CURLE_OK;
@ -1165,9 +1152,9 @@ cr_connect(struct Curl_cfilter *cf,
/* Read/write data until the handshake is done or the socket would block. */
for(;;) {
/*
* Connection has been established according to Rustls. Set send/recv
* handlers, and update the state machine.
*/
* Connection has been established according to Rustls. Set send/recv
* handlers, and update the state machine.
*/
connssl->io_need = CURL_SSL_IO_NEED_NONE;
if(!rustls_connection_is_handshaking(rconn)) {
/* Rustls claims it is no longer handshaking *before* it has
@ -1186,8 +1173,7 @@ cr_connect(struct Curl_cfilter *cf,
}
/* REALLY Done with the handshake. */
{
const uint16_t proto =
rustls_connection_get_protocol_version(rconn);
const uint16_t proto = rustls_connection_get_protocol_version(rconn);
const rustls_str ciphersuite_name =
rustls_connection_get_negotiated_ciphersuite_name(rconn);
const rustls_str kex_group_name =
@ -1297,9 +1283,7 @@ cr_connect(struct Curl_cfilter *cf,
DEBUGASSERT(FALSE);
}
static void *
cr_get_internals(struct ssl_connect_data *connssl,
CURLINFO info)
static void *cr_get_internals(struct ssl_connect_data *connssl, CURLINFO info)
{
struct rustls_ssl_backend_data *backend =
(struct rustls_ssl_backend_data *)connssl->backend;
@ -1308,10 +1292,8 @@ cr_get_internals(struct ssl_connect_data *connssl,
return backend->conn;
}
static CURLcode
cr_shutdown(struct Curl_cfilter *cf,
struct Curl_easy *data,
const bool send_shutdown, bool *done)
static CURLcode cr_shutdown(struct Curl_cfilter *cf, struct Curl_easy *data,
const bool send_shutdown, bool *done)
{
struct ssl_connect_data *connssl = cf->ctx;
struct rustls_ssl_backend_data *backend =
@ -1373,8 +1355,7 @@ out:
return result;
}
static void
cr_close(struct Curl_cfilter *cf, struct Curl_easy *data)
static void cr_close(struct Curl_cfilter *cf, struct Curl_easy *data)
{
const struct ssl_connect_data *connssl = cf->ctx;
struct rustls_ssl_backend_data *backend =
@ -1398,13 +1379,12 @@ static size_t cr_version(char *buffer, size_t size)
return curl_msnprintf(buffer, size, "%.*s", (int)ver.len, ver.data);
}
static CURLcode
cr_random(struct Curl_easy *data, unsigned char *entropy, size_t length)
static CURLcode cr_random(struct Curl_easy *data, unsigned char *entropy,
size_t length)
{
rustls_result rresult = 0;
(void)data;
rresult =
rustls_default_crypto_provider_random(entropy, length);
rresult = rustls_default_crypto_provider_random(entropy, length);
return map_error(rresult);
}

160
lib/vtls/schannel.c
View file

@ -34,7 +34,7 @@
#ifdef USE_SCHANNEL
#ifndef USE_WINDOWS_SSPI
# error "cannot compile SCHANNEL support without SSPI."
#error "cannot compile SCHANNEL support without SSPI."
#endif
#include "schannel.h"
@ -67,7 +67,7 @@
*/
#ifdef CURL_SCHANNEL_DEV_DEBUG
#define SCH_DEV(x) x
#define SCH_DEV_SHOWBOOL(x) \
#define SCH_DEV_SHOWBOOL(x) \
infof(data, "schannel: " #x " %s", (x) ? "TRUE" : "FALSE");
#else
#define SCH_DEV(x) do { } while(0)
@ -159,10 +159,9 @@ static void InitSecBufferDesc(SecBufferDesc *desc, SecBuffer *BufArr,
desc->cBuffers = NumArrElem;
}
static CURLcode
schannel_set_ssl_version_min_max(DWORD *enabled_protocols,
struct Curl_cfilter *cf,
struct Curl_easy *data)
static CURLcode schannel_set_ssl_version_min_max(DWORD *enabled_protocols,
struct Curl_cfilter *cf,
struct Curl_easy *data)
{
struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
long ssl_version = conn_config->version;
@ -222,7 +221,7 @@ struct algo {
int id;
};
static const struct algo algs[]= {
static const struct algo algs[] = {
CIPHEROPTION(CALG_MD2),
CIPHEROPTION(CALG_MD4),
CIPHEROPTION(CALG_MD5),
@ -330,8 +329,7 @@ static const struct algo algs[]= {
{NULL, 0},
};
static int
get_alg_id_by_name(const char *name)
static int get_alg_id_by_name(const char *name)
{
const char *nameEnd = strchr(name, ':');
size_t n = nameEnd ? (size_t)(nameEnd - name) : strlen(name);
@ -346,9 +344,8 @@ get_alg_id_by_name(const char *name)
#define NUM_CIPHERS 47 /* There are 47 options listed above */
static CURLcode
set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
ALG_ID *algIds)
static CURLcode set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
ALG_ID *algIds)
{
const char *startCur = ciphers;
int algCount = 0;
@ -376,9 +373,8 @@ set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
}
/* Function allocates memory for store_path only if CURLE_OK is returned */
static CURLcode
get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
TCHAR **thumbprint)
static CURLcode get_cert_location(TCHAR *path, DWORD *store_name,
TCHAR **store_path, TCHAR **thumbprint)
{
TCHAR *sep;
TCHAR *store_path_start;
@ -400,14 +396,11 @@ get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
*store_name = CERT_SYSTEM_STORE_SERVICES;
else if(_tcsncmp(path, TEXT("Users"), store_name_len) == 0)
*store_name = CERT_SYSTEM_STORE_USERS;
else if(_tcsncmp(path, TEXT("CurrentUserGroupPolicy"),
store_name_len) == 0)
else if(_tcsncmp(path, TEXT("CurrentUserGroupPolicy"), store_name_len) == 0)
*store_name = CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY;
else if(_tcsncmp(path, TEXT("LocalMachineGroupPolicy"),
store_name_len) == 0)
else if(_tcsncmp(path, TEXT("LocalMachineGroupPolicy"), store_name_len) == 0)
*store_name = CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY;
else if(_tcsncmp(path, TEXT("LocalMachineEnterprise"),
store_name_len) == 0)
else if(_tcsncmp(path, TEXT("LocalMachineEnterprise"), store_name_len) == 0)
*store_name = CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE;
else
return CURLE_SSL_CERTPROBLEM;
@ -431,9 +424,8 @@ get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
return CURLE_OK;
}
static CURLcode
schannel_acquire_credential_handle(struct Curl_cfilter *cf,
struct Curl_easy *data)
static CURLcode schannel_acquire_credential_handle(struct Curl_cfilter *cf,
struct Curl_easy *data)
{
struct ssl_connect_data *connssl = cf->ctx;
struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
@ -461,37 +453,36 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
if(ssl_config->no_revoke) {
flags |= SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
SCH_CRED_IGNORE_REVOCATION_OFFLINE;
SCH_CRED_IGNORE_REVOCATION_OFFLINE;
DEBUGF(infof(data, "schannel: disabled server certificate revocation "
"checks"));
"checks"));
}
else if(ssl_config->revoke_best_effort) {
flags |= SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
SCH_CRED_IGNORE_REVOCATION_OFFLINE | SCH_CRED_REVOCATION_CHECK_CHAIN;
SCH_CRED_IGNORE_REVOCATION_OFFLINE |
SCH_CRED_REVOCATION_CHECK_CHAIN;
DEBUGF(infof(data, "schannel: ignore revocation offline errors"));
}
else {
flags |= SCH_CRED_REVOCATION_CHECK_CHAIN;
DEBUGF(infof(data,
"schannel: checking server certificate revocation"));
DEBUGF(infof(data, "schannel: checking server certificate revocation"));
}
}
else {
flags = SCH_CRED_MANUAL_CRED_VALIDATION |
SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
SCH_CRED_IGNORE_REVOCATION_OFFLINE;
DEBUGF(infof(data,
"schannel: disabled server cert revocation checks"));
SCH_CRED_IGNORE_NO_REVOCATION_CHECK |
SCH_CRED_IGNORE_REVOCATION_OFFLINE;
DEBUGF(infof(data, "schannel: disabled server cert revocation checks"));
}
if(!conn_config->verifyhost) {
flags |= SCH_CRED_NO_SERVERNAME_CHECK;
DEBUGF(infof(data, "schannel: verifyhost setting prevents Schannel from "
"comparing the supplied target name with the subject "
"names in server certificates."));
"comparing the supplied target name with the subject "
"names in server certificates."));
}
if(!ssl_config->auto_client_cert) {
@ -508,8 +499,7 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
case CURL_SSLVERSION_TLSv1_0:
case CURL_SSLVERSION_TLSv1_1:
case CURL_SSLVERSION_TLSv1_2:
case CURL_SSLVERSION_TLSv1_3:
{
case CURL_SSLVERSION_TLSv1_3: {
result = schannel_set_ssl_version_min_max(&enabled_protocols, cf, data);
if(result)
return result;
@ -550,7 +540,7 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
result = get_cert_location(cert_path, &cert_store_name,
&cert_store_path, &cert_thumbprint_str);
if(result && (data->set.ssl.primary.clientcert[0]!='\0'))
if(result && (data->set.ssl.primary.clientcert[0] != '\0'))
fInCert = curlx_fopen(data->set.ssl.primary.clientcert, "rb");
if(result && !fInCert) {
@ -579,7 +569,7 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
https://learn.microsoft.com/archive/msdn-technet-forums/3e7bc95f-b21a-4bcd-bd2c-7f996718cae5
*/
CRYPT_DATA_BLOB datablob;
WCHAR* pszPassword;
WCHAR *pszPassword;
size_t pwd_len = 0;
int str_w_len = 0;
int cert_find_flags;
@ -613,12 +603,12 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
}
/* Convert key-pair data to the in-memory certificate store */
datablob.pbData = (BYTE*)certdata;
datablob.pbData = (BYTE *)certdata;
datablob.cbData = (DWORD)certsize;
if(data->set.ssl.key_passwd)
pwd_len = strlen(data->set.ssl.key_passwd);
pszPassword = (WCHAR*)curlx_malloc(sizeof(WCHAR)*(pwd_len + 1));
pszPassword = (WCHAR *)curlx_malloc(sizeof(WCHAR) * (pwd_len + 1));
if(pszPassword) {
if(pwd_len > 0)
str_w_len = MultiByteToWideChar(CP_UTF8,
@ -854,8 +844,8 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
return CURLE_OK;
}
static CURLcode
schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
static CURLcode schannel_connect_step1(struct Curl_cfilter *cf,
struct Curl_easy *data)
{
size_t written = 0;
struct ssl_connect_data *connssl = cf->ctx;
@ -874,8 +864,7 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
CURLcode result;
DEBUGASSERT(backend);
DEBUGF(infof(data,
"schannel: SSL/TLS connection with %s port %d (step 1/3)",
DEBUGF(infof(data, "schannel: SSL/TLS connection with %s port %d (step 1/3)",
connssl->peer.hostname, connssl->peer.port));
if(curlx_verify_windows_version(5, 1, 0, PLATFORM_WINNT,
@ -899,7 +888,7 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
}
else {
failf(data, "schannel: this version of Windows is too old to support "
"certificate verification via CA bundle file.");
"certificate verification via CA bundle file.");
return CURLE_SSL_CACERT_BADFILE;
}
}
@ -952,7 +941,7 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
int cur = 0;
int list_start_index = 0;
unsigned int *extension_len = NULL;
unsigned short* list_len = NULL;
unsigned short *list_len = NULL;
struct alpn_proto_buf proto;
/* The first four bytes will be an unsigned int indicating number
@ -968,7 +957,7 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
/* The next two bytes will be an unsigned short indicating the number
of bytes used to list the preferred protocols. */
list_len = (unsigned short*)(void *)(&alpn_buffer[cur]);
list_len = (unsigned short *)(void *)(&alpn_buffer[cur]);
cur += (int)sizeof(unsigned short);
list_start_index = cur;
@ -1006,8 +995,8 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
/* security request flags */
backend->req_flags = ISC_REQ_SEQUENCE_DETECT | ISC_REQ_REPLAY_DETECT |
ISC_REQ_CONFIDENTIALITY | ISC_REQ_ALLOCATE_MEMORY |
ISC_REQ_STREAM;
ISC_REQ_CONFIDENTIALITY | ISC_REQ_ALLOCATE_MEMORY |
ISC_REQ_STREAM;
if(!ssl_config->auto_client_cert) {
backend->req_flags |= ISC_REQ_USE_SUPPLIED_CREDS;
@ -1131,8 +1120,8 @@ static CURLcode schannel_error(struct Curl_easy *data,
}
}
static CURLcode
schannel_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
static CURLcode schannel_connect_step2(struct Curl_cfilter *cf,
struct Curl_easy *data)
{
struct ssl_connect_data *connssl = cf->ctx;
struct schannel_ssl_backend_data *backend =
@ -1155,8 +1144,7 @@ schannel_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
doread = (connssl->io_need & CURL_SSL_IO_NEED_SEND) ? FALSE : TRUE;
connssl->io_need = CURL_SSL_IO_NEED_NONE;
DEBUGF(infof(data,
"schannel: SSL/TLS connection with %s port %d (step 2/3)",
DEBUGF(infof(data, "schannel: SSL/TLS connection with %s port %d (step 2/3)",
connssl->peer.hostname, connssl->peer.port));
if(!backend->cred || !backend->ctxt)
@ -1361,7 +1349,8 @@ schannel_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
if(backend->encdata_offset > inbuf[1].cbBuffer) {
memmove(backend->encdata_buffer,
(backend->encdata_buffer + backend->encdata_offset) -
inbuf[1].cbBuffer, inbuf[1].cbBuffer);
inbuf[1].cbBuffer,
inbuf[1].cbBuffer);
backend->encdata_offset = inbuf[1].cbBuffer;
if(sspi_status == SEC_I_CONTINUE_NEEDED) {
doread = FALSE;
@ -1415,8 +1404,7 @@ schannel_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
return CURLE_OK;
}
static bool
valid_cert_encoding(const CERT_CONTEXT *cert_context)
static bool valid_cert_encoding(const CERT_CONTEXT *cert_context)
{
return (cert_context != NULL) &&
((cert_context->dwCertEncodingType & X509_ASN_ENCODING) != 0) &&
@ -1424,12 +1412,11 @@ valid_cert_encoding(const CERT_CONTEXT *cert_context)
(cert_context->cbCertEncoded > 0);
}
typedef bool(*Read_crt_func)(const CERT_CONTEXT *ccert_context,
bool reverse_order, void *arg);
typedef bool (*Read_crt_func)(const CERT_CONTEXT *ccert_context,
bool reverse_order, void *arg);
static void
traverse_cert_store(const CERT_CONTEXT *context, Read_crt_func func,
void *arg)
static void traverse_cert_store(const CERT_CONTEXT *context,
Read_crt_func func, void *arg)
{
const CERT_CONTEXT *current_context = NULL;
bool should_continue = TRUE;
@ -1454,9 +1441,8 @@ traverse_cert_store(const CERT_CONTEXT *context, Read_crt_func func,
CertFreeCertificateContext(current_context);
}
static bool
cert_counter_callback(const CERT_CONTEXT *ccert_context, bool reverse_order,
void *certs_count)
static bool cert_counter_callback(const CERT_CONTEXT *ccert_context,
bool reverse_order, void *certs_count)
{
(void)reverse_order;
if(valid_cert_encoding(ccert_context))
@ -1466,22 +1452,20 @@ cert_counter_callback(const CERT_CONTEXT *ccert_context, bool reverse_order,
return TRUE;
}
struct Adder_args
{
struct Adder_args {
struct Curl_easy *data;
CURLcode result;
int idx;
int certs_count;
};
static bool
add_cert_to_certinfo(const CERT_CONTEXT *ccert_context, bool reverse_order,
void *raw_arg)
static bool add_cert_to_certinfo(const CERT_CONTEXT *ccert_context,
bool reverse_order, void *raw_arg)
{
struct Adder_args *args = (struct Adder_args*)raw_arg;
struct Adder_args *args = (struct Adder_args *)raw_arg;
args->result = CURLE_OK;
if(valid_cert_encoding(ccert_context)) {
const char *beg = (const char *) ccert_context->pbCertEncoded;
const char *beg = (const char *)ccert_context->pbCertEncoded;
const char *end = beg + ccert_context->cbCertEncoded;
int insert_index = reverse_order ? (args->certs_count - 1) - args->idx :
args->idx;
@ -1511,8 +1495,8 @@ static void schannel_session_free(void *sessionid)
}
}
static CURLcode
schannel_connect_step3(struct Curl_cfilter *cf, struct Curl_easy *data)
static CURLcode schannel_connect_step3(struct Curl_cfilter *cf,
struct Curl_easy *data)
{
struct ssl_connect_data *connssl = cf->ctx;
struct schannel_ssl_backend_data *backend =
@ -1527,8 +1511,7 @@ schannel_connect_step3(struct Curl_cfilter *cf, struct Curl_easy *data)
DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
DEBUGASSERT(backend);
DEBUGF(infof(data,
"schannel: SSL/TLS connection with %s port %d (step 3/3)",
DEBUGF(infof(data, "schannel: SSL/TLS connection with %s port %d (step 3/3)",
connssl->peer.hostname, connssl->peer.port));
if(!backend->cred)
@ -1886,9 +1869,8 @@ schannel_recv_renegotiate(struct Curl_cfilter *cf, struct Curl_easy *data,
return result;
}
static CURLcode
schannel_send(struct Curl_cfilter *cf, struct Curl_easy *data,
const void *buf, size_t len, size_t *pnwritten)
static CURLcode schannel_send(struct Curl_cfilter *cf, struct Curl_easy *data,
const void *buf, size_t len, size_t *pnwritten)
{
size_t data_len = 0;
unsigned char *ptr = NULL;
@ -2018,7 +2000,7 @@ schannel_send(struct Curl_cfilter *cf, struct Curl_easy *data,
else if(sspi_status == SEC_E_INSUFFICIENT_MEMORY) {
result = CURLE_OUT_OF_MEMORY;
}
else{
else {
result = CURLE_SEND_ERROR;
}
@ -2032,9 +2014,8 @@ schannel_send(struct Curl_cfilter *cf, struct Curl_easy *data,
return result;
}
static CURLcode
schannel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
char *buf, size_t len, size_t *pnread)
static CURLcode schannel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
char *buf, size_t len, size_t *pnread)
{
size_t size = 0;
size_t nread = 0;
@ -2170,7 +2151,7 @@ schannel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
/* https://learn.microsoft.com/windows/win32/api/sspi/nf-sspi-decryptmessage
*/
sspi_status = Curl_pSecFn->DecryptMessage(&backend->ctxt->ctxt_handle,
&inbuf_desc, 0, NULL);
&inbuf_desc, 0, NULL);
/* check if everything went fine (server may want to renegotiate
or shutdown the connection context) */
@ -2231,7 +2212,8 @@ schannel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
buffer */
memmove(backend->encdata_buffer,
(backend->encdata_buffer + backend->encdata_offset) -
inbuf[3].cbBuffer, inbuf[3].cbBuffer);
inbuf[3].cbBuffer,
inbuf[3].cbBuffer);
backend->encdata_offset = inbuf[3].cbBuffer;
}
@ -2761,7 +2743,7 @@ HCERTSTORE Curl_schannel_get_cached_cert_store(struct Curl_cfilter *cf,
share = Curl_hash_pick(&multi->proto_hash,
CURL_UNCONST(MPROTO_SCHANNEL_CERT_SHARE_KEY),
sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY)-1);
sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY) - 1);
if(!share || !share->cert_store) {
return NULL;
}
@ -2809,7 +2791,7 @@ HCERTSTORE Curl_schannel_get_cached_cert_store(struct Curl_cfilter *cf,
static void schannel_cert_share_free(void *key, size_t key_len, void *p)
{
struct schannel_cert_share *share = p;
DEBUGASSERT(key_len == (sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY)-1));
DEBUGASSERT(key_len == (sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY) - 1));
DEBUGASSERT(!memcmp(MPROTO_SCHANNEL_CERT_SHARE_KEY, key, key_len));
(void)key;
(void)key_len;
@ -2839,7 +2821,7 @@ bool Curl_schannel_set_cached_cert_store(struct Curl_cfilter *cf,
share = Curl_hash_pick(&multi->proto_hash,
CURL_UNCONST(MPROTO_SCHANNEL_CERT_SHARE_KEY),
sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY)-1);
sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY) - 1);
if(!share) {
share = curlx_calloc(1, sizeof(*share));
if(!share) {
@ -2847,7 +2829,7 @@ bool Curl_schannel_set_cached_cert_store(struct Curl_cfilter *cf,
}
if(!Curl_hash_add2(&multi->proto_hash,
CURL_UNCONST(MPROTO_SCHANNEL_CERT_SHARE_KEY),
sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY)-1,
sizeof(MPROTO_SCHANNEL_CERT_SHARE_KEY) - 1,
share, schannel_cert_share_free)) {
curlx_free(share);
return FALSE;

9
lib/vtls/schannel.h
View file

@ -69,15 +69,14 @@
* (and only here).
*/
#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
# undef X509_NAME
# undef X509_CERT_PAIR
# undef X509_EXTENSIONS
#undef X509_NAME
#undef X509_CERT_PAIR
#undef X509_EXTENSIONS
#endif
extern const struct Curl_ssl Curl_ssl_schannel;
CURLcode Curl_verify_host(struct Curl_cfilter *cf,
struct Curl_easy *data);
CURLcode Curl_verify_host(struct Curl_cfilter *cf, struct Curl_easy *data);
CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
struct Curl_easy *data);

51
lib/vtls/schannel_verify.c
View file

@ -33,7 +33,7 @@
#ifdef USE_SCHANNEL
#ifndef USE_WINDOWS_SSPI
# error "cannot compile SCHANNEL support without SSPI."
#error "cannot compile SCHANNEL support without SSPI."
#endif
#include "schannel.h"
@ -157,8 +157,8 @@ static CURLcode add_certs_data_to_store(HCERTSTORE trust_store,
const CERT_CONTEXT *cert_context = NULL;
BOOL add_cert_result = FALSE;
DWORD actual_content_type = 0;
DWORD cert_size = (DWORD)
((end_cert_ptr + end_cert_len) - begin_cert_ptr);
DWORD cert_size =
(DWORD)((end_cert_ptr + end_cert_len) - begin_cert_ptr);
cert_blob.pbData = (BYTE *)CURL_UNCONST(begin_cert_ptr);
cert_blob.cbData = cert_size;
@ -238,13 +238,11 @@ static CURLcode add_certs_data_to_store(HCERTSTORE trust_store,
if(result == CURLE_OK) {
if(!num_certs) {
infof(data,
"schannel: did not add any certificates from CA file '%s'",
infof(data, "schannel: did not add any certificates from CA file '%s'",
ca_file_text);
}
else {
infof(data,
"schannel: added %d certificate(s) from CA file '%s'",
infof(data, "schannel: added %d certificate(s) from CA file '%s'",
num_certs, ca_file_text);
}
}
@ -266,9 +264,7 @@ static CURLcode add_certs_file_to_store(HCERTSTORE trust_store,
ca_file_tstr = curlx_convert_UTF8_to_tchar(ca_file);
if(!ca_file_tstr) {
char buffer[WINAPI_ERROR_LEN];
failf(data,
"schannel: invalid path name for CA file '%s': %s",
ca_file,
failf(data, "schannel: invalid path name for CA file '%s': %s", ca_file,
curlx_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
result = CURLE_SSL_CACERT_BADFILE;
goto cleanup;
@ -288,9 +284,7 @@ static CURLcode add_certs_file_to_store(HCERTSTORE trust_store,
NULL);
if(ca_file_handle == INVALID_HANDLE_VALUE) {
char buffer[WINAPI_ERROR_LEN];
failf(data,
"schannel: failed to open CA file '%s': %s",
ca_file,
failf(data, "schannel: failed to open CA file '%s': %s", ca_file,
curlx_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
result = CURLE_SSL_CACERT_BADFILE;
goto cleanup;
@ -298,8 +292,7 @@ static CURLcode add_certs_file_to_store(HCERTSTORE trust_store,
if(!GetFileSizeEx(ca_file_handle, &file_size)) {
char buffer[WINAPI_ERROR_LEN];
failf(data,
"schannel: failed to determine size of CA file '%s': %s",
failf(data, "schannel: failed to determine size of CA file '%s': %s",
ca_file,
curlx_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
result = CURLE_SSL_CACERT_BADFILE;
@ -307,8 +300,7 @@ static CURLcode add_certs_file_to_store(HCERTSTORE trust_store,
}
if(file_size.QuadPart > MAX_CAFILE_SIZE) {
failf(data,
"schannel: CA file exceeds max size of %u bytes",
failf(data, "schannel: CA file exceeds max size of %u bytes",
MAX_CAFILE_SIZE);
result = CURLE_SSL_CACERT_BADFILE;
goto cleanup;
@ -328,9 +320,7 @@ static CURLcode add_certs_file_to_store(HCERTSTORE trust_store,
if(!ReadFile(ca_file_handle, ca_file_buffer + total_bytes_read,
bytes_to_read, &bytes_read, NULL)) {
char buffer[WINAPI_ERROR_LEN];
failf(data,
"schannel: failed to read from CA file '%s': %s",
ca_file,
failf(data, "schannel: failed to read from CA file '%s': %s", ca_file,
curlx_winapi_strerror(GetLastError(), buffer, sizeof(buffer)));
result = CURLE_SSL_CACERT_BADFILE;
goto cleanup;
@ -455,12 +445,11 @@ static DWORD cert_get_name_string(struct Curl_easy *data,
}
/*
* Returns TRUE if the hostname is a numeric IPv4/IPv6 Address,
* and populates the buffer with IPv4/IPv6 info.
*/
* Returns TRUE if the hostname is a numeric IPv4/IPv6 Address,
* and populates the buffer with IPv4/IPv6 info.
*/
static bool get_num_host_info(struct num_ip_data *ip_blob,
LPCSTR hostname)
static bool get_num_host_info(struct num_ip_data *ip_blob, LPCSTR hostname)
{
struct in_addr ia;
struct in6_addr ia6;
@ -520,9 +509,8 @@ static bool get_alt_name_info(struct Curl_easy *data,
&decode_para,
alt_name_info,
alt_name_info_size)) {
failf(data,
"schannel: CryptDecodeObjectEx() returned no alternate name "
"information.");
failf(data, "schannel: CryptDecodeObjectEx() returned no alternate name "
"information.");
return result;
}
result = TRUE;
@ -530,8 +518,7 @@ static bool get_alt_name_info(struct Curl_easy *data,
}
/* Verify the server's hostname */
CURLcode Curl_verify_host(struct Curl_cfilter *cf,
struct Curl_easy *data)
CURLcode Curl_verify_host(struct Curl_cfilter *cf, struct Curl_easy *data)
{
CURLcode result = CURLE_PEER_FAILED_VERIFICATION;
struct ssl_connect_data *connssl = cf->ctx;
@ -545,7 +532,7 @@ CURLcode Curl_verify_host(struct Curl_cfilter *cf,
DWORD actual_len = 0;
PCERT_ALT_NAME_INFO alt_name_info = NULL;
DWORD alt_name_info_size = 0;
struct num_ip_data ip_blob = { 0 };
struct num_ip_data ip_blob = {0};
bool Win8_compat;
struct num_ip_data *p = &ip_blob;
DWORD i;
@ -840,7 +827,7 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
* list URL, or when the list could not be downloaded because the
* server is currently unreachable. */
dwTrustErrorMask &= ~(DWORD)(CERT_TRUST_REVOCATION_STATUS_UNKNOWN |
CERT_TRUST_IS_OFFLINE_REVOCATION);
CERT_TRUST_IS_OFFLINE_REVOCATION);
}
if(dwTrustErrorMask) {

53
lib/vtls/vtls.c
View file

@ -93,14 +93,13 @@
dest->var = NULL; \
} while(0)
#define CLONE_BLOB(var) \
do { \
if(blobdup(&dest->var, source->var)) \
return FALSE; \
#define CLONE_BLOB(var) \
do { \
if(blobdup(&dest->var, source->var)) \
return FALSE; \
} while(0)
static CURLcode blobdup(struct curl_blob **dest,
struct curl_blob *src)
static CURLcode blobdup(struct curl_blob **dest, struct curl_blob *src)
{
DEBUGASSERT(dest);
DEBUGASSERT(!*dest);
@ -149,8 +148,8 @@ static const struct alpn_spec ALPN_SPEC_H2_H11 = {
#endif
#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_PROXY)
static const struct alpn_spec *
alpn_get_spec(http_majors allowed, bool use_alpn)
static const struct alpn_spec *alpn_get_spec(http_majors allowed,
bool use_alpn)
{
if(!use_alpn)
return NULL;
@ -170,7 +169,6 @@ alpn_get_spec(http_majors allowed, bool use_alpn)
#endif /* !CURL_DISABLE_HTTP || !CURL_DISABLE_PROXY */
#endif /* USE_SSL */
void Curl_ssl_easy_config_init(struct Curl_easy *data)
{
/*
@ -185,10 +183,9 @@ void Curl_ssl_easy_config_init(struct Curl_easy *data)
#endif
}
static bool
match_ssl_primary_config(struct Curl_easy *data,
struct ssl_primary_config *c1,
struct ssl_primary_config *c2)
static bool match_ssl_primary_config(struct Curl_easy *data,
struct ssl_primary_config *c1,
struct ssl_primary_config *c2)
{
(void)data;
if((c1->version == c2->version) &&
@ -324,8 +321,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
sslc->primary.cipher_list13 = data->set.str[STRING_SSL_CIPHER13_LIST];
sslc->primary.signature_algorithms =
data->set.str[STRING_SSL_SIGNATURE_ALGORITHMS];
sslc->primary.pinned_key =
data->set.str[STRING_SSL_PINNEDPUBLICKEY];
sslc->primary.pinned_key = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
sslc->primary.cert_blob = data->set.blobs[BLOB_CERT];
sslc->primary.ca_info_blob = data->set.blobs[BLOB_CAINFO];
sslc->primary.curves = data->set.str[STRING_SSL_EC_CURVES];
@ -538,9 +534,9 @@ void Curl_ssl_close_all(struct Curl_easy *data)
Curl_ssl->close_all(data);
}
CURLcode Curl_ssl_adjust_pollset(struct Curl_cfilter *cf,
struct Curl_easy *data,
struct easy_pollset *ps)
CURLcode Curl_ssl_adjust_pollset(struct Curl_cfilter *cf,
struct Curl_easy *data,
struct easy_pollset *ps)
{
struct ssl_connect_data *connssl = cf->ctx;
@ -628,7 +624,7 @@ CURLcode Curl_ssl_init_certinfo(struct Curl_easy *data, int num)
Curl_ssl_free_certinfo(data);
/* Allocate the required certificate information structures */
table = curlx_calloc((size_t) num, sizeof(struct curl_slist *));
table = curlx_calloc((size_t)num, sizeof(struct curl_slist *));
if(!table)
return CURLE_OUT_OF_MEMORY;
@ -661,8 +657,7 @@ CURLcode Curl_ssl_push_certinfo_len(struct Curl_easy *data,
curlx_dyn_addn(&build, value, valuelen))
return CURLE_OUT_OF_MEMORY;
nl = Curl_slist_append_nodup(ci->certinfo[certnum],
curlx_dyn_ptr(&build));
nl = Curl_slist_append_nodup(ci->certinfo[certnum], curlx_dyn_ptr(&build));
if(!nl) {
curlx_dyn_free(&build);
curl_slist_free_all(ci->certinfo[certnum]);
@ -798,8 +793,8 @@ CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data,
pinned_hash = pinnedpubkey;
while(pinned_hash &&
!strncmp(pinned_hash, "sha256//", (sizeof("sha256//")-1))) {
pinned_hash = pinned_hash + (sizeof("sha256//")-1);
!strncmp(pinned_hash, "sha256//", (sizeof("sha256//") - 1))) {
pinned_hash = pinned_hash + (sizeof("sha256//") - 1);
end_pos = strchr(pinned_hash, ';');
pinned_hash_len = end_pos ?
(size_t)(end_pos - pinned_hash) : strlen(pinned_hash);
@ -845,7 +840,7 @@ CURLcode Curl_pin_peer_pubkey(struct Curl_easy *data,
* if the size of our certificate is bigger than the file
* size then it cannot match
*/
size = curlx_sotouz((curl_off_t) filesize);
size = curlx_sotouz((curl_off_t)filesize);
if(pubkeylen > size)
goto end;
@ -1277,7 +1272,7 @@ CURLcode Curl_ssl_peer_init(struct ssl_peer *peer,
/* not an IP address, normalize according to RCC 6066 ch. 3,
* max len of SNI is 2^16-1, no trailing dot */
size_t len = strlen(peer->hostname);
if(len && (peer->hostname[len-1] == '.'))
if(len && (peer->hostname[len - 1] == '.'))
len--;
if(len < USHRT_MAX) {
peer->sni = curlx_calloc(1, len + 1);
@ -1563,7 +1558,7 @@ static CURLcode ssl_cf_shutdown(struct Curl_cfilter *cf,
*done = TRUE;
/* If we have done the SSL handshake, shut down the connection cleanly */
if(cf->connected && (connssl->state == ssl_connection_complete) &&
!cf->shutdown && Curl_ssl->shut_down) {
!cf->shutdown && Curl_ssl->shut_down) {
struct cf_call_data save;
CF_DATA_SAVE(save, cf, data);
@ -1781,7 +1776,7 @@ static CURLcode cf_ssl_proxy_create(struct Curl_cfilter **pcf,
#ifdef USE_HTTP2
if(conn->http_proxy.proxytype == CURLPROXY_HTTPS2) {
use_alpn = TRUE;
allowed = (CURL_HTTP_V1x|CURL_HTTP_V2x);
allowed = (CURL_HTTP_V1x | CURL_HTTP_V2x);
}
#endif
@ -1847,7 +1842,7 @@ static CURLcode vtls_shutdown_blocking(struct Curl_cfilter *cf,
}
result = connssl->ssl_impl->shut_down(cf, data, send_shutdown, done);
if(result ||*done)
if(result || *done)
goto out;
if(connssl->io_need) {
@ -2042,7 +2037,7 @@ CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
if(proto && proto_len) {
if(memchr(proto, '\0', proto_len)) {
failf(data, "ALPN: server selected protocol contains NUL. "
"Refusing to continue.");
"Refusing to continue.");
result = CURLE_SSL_CONNECT_ERROR;
goto out;
}

12
lib/vtls/vtls.h
View file

@ -253,16 +253,16 @@ extern struct Curl_cftype Curl_cft_ssl_proxy;
#define Curl_ssl_init() 1
#define Curl_ssl_cleanup() Curl_nop_stmt
#define Curl_ssl_close_all(x) Curl_nop_stmt
#define Curl_ssl_set_engine(x,y) CURLE_NOT_BUILT_IN
#define Curl_ssl_set_engine(x, y) CURLE_NOT_BUILT_IN
#define Curl_ssl_set_engine_default(x) CURLE_NOT_BUILT_IN
#define Curl_ssl_engines_list(x) NULL
#define Curl_ssl_free_certinfo(x) Curl_nop_stmt
#define Curl_ssl_random(x,y,z) ((void)x, CURLE_NOT_BUILT_IN)
#define Curl_ssl_random(x, y, z) ((void)x, CURLE_NOT_BUILT_IN)
#define Curl_ssl_cert_status_request() FALSE
#define Curl_ssl_supports(a,b) FALSE
#define Curl_ssl_cfilter_add(a,b,c) CURLE_NOT_BUILT_IN
#define Curl_ssl_cfilter_remove(a,b,c) CURLE_OK
#define Curl_ssl_cf_get_config(a,b) NULL
#define Curl_ssl_supports(a, b) FALSE
#define Curl_ssl_cfilter_add(a, b, c) CURLE_NOT_BUILT_IN
#define Curl_ssl_cfilter_remove(a, b, c) CURLE_OK
#define Curl_ssl_cf_get_config(a, b) NULL
#define Curl_ssl_cf_get_primary_config(a) NULL
#endif

20
lib/vtls/vtls_int.h
View file

@ -71,8 +71,7 @@ CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
const unsigned char *proto,
size_t proto_len);
bool Curl_alpn_contains_proto(const struct alpn_spec *spec,
const char *proto);
bool Curl_alpn_contains_proto(const struct alpn_spec *spec, const char *proto);
/* enum for the nonblocking SSL connection state machine */
typedef enum {
@ -99,11 +98,11 @@ typedef enum {
} ssl_earlydata_state;
#define CURL_SSL_IO_NEED_NONE (0)
#define CURL_SSL_IO_NEED_RECV (1<<0)
#define CURL_SSL_IO_NEED_SEND (1<<1)
#define CURL_SSL_IO_NEED_RECV (1 << 0)
#define CURL_SSL_IO_NEED_SEND (1 << 1)
/* Max earlydata payload we want to send */
#define CURL_SSL_EARLY_MAX (64*1024)
#define CURL_SSL_EARLY_MAX (64 * 1024)
/* Information in each SSL cfilter context: cf->ctx */
struct ssl_connect_data {
@ -130,11 +129,8 @@ struct ssl_connect_data {
BIT(input_pending); /* data for SSL_read() may be available */
};
#undef CF_CTX_CALL_DATA
#define CF_CTX_CALL_DATA(cf) \
((struct ssl_connect_data *)(cf)->ctx)->call_data
#define CF_CTX_CALL_DATA(cf) ((struct ssl_connect_data *)(cf)->ctx)->call_data
/* Definitions for SSL Implementations */
@ -157,8 +153,7 @@ struct Curl_ssl {
/* data_pending() shall return TRUE when it wants to get called again to
drain internal buffers and deliver data instead of waiting for the socket
to get readable */
bool (*data_pending)(struct Curl_cfilter *cf,
const struct Curl_easy *data);
bool (*data_pending)(struct Curl_cfilter *cf, const struct Curl_easy *data);
/* return 0 if a find random is filled in */
CURLcode (*random)(struct Curl_easy *data, unsigned char *entropy,
@ -181,7 +176,7 @@ struct Curl_ssl {
struct curl_slist *(*engines_list)(struct Curl_easy *data);
CURLcode (*sha256sum)(const unsigned char *input, size_t inputlen,
unsigned char *sha256sum, size_t sha256sumlen);
unsigned char *sha256sum, size_t sha256sumlen);
CURLcode (*recv_plain)(struct Curl_cfilter *cf, struct Curl_easy *data,
char *buf, size_t len, size_t *pnread);
CURLcode (*send_plain)(struct Curl_cfilter *cf, struct Curl_easy *data,
@ -189,7 +184,6 @@ struct Curl_ssl {
CURLcode (*get_channel_binding)(struct Curl_easy *data, int sockindex,
struct dynbuf *binding);
};
extern const struct Curl_ssl *Curl_ssl;

54
lib/vtls/vtls_scache.c
View file

@ -106,23 +106,21 @@ static void cf_ssl_scache_session_ldestroy(void *udata, void *obj)
curlx_free(s);
}
CURLcode
Curl_ssl_session_create(void *sdata, size_t sdata_len,
int ietf_tls_id, const char *alpn,
curl_off_t valid_until, size_t earlydata_max,
struct Curl_ssl_session **psession)
CURLcode Curl_ssl_session_create(void *sdata, size_t sdata_len,
int ietf_tls_id, const char *alpn,
curl_off_t valid_until, size_t earlydata_max,
struct Curl_ssl_session **psession)
{
return Curl_ssl_session_create2(sdata, sdata_len, ietf_tls_id, alpn,
valid_until, earlydata_max,
NULL, 0, psession);
}
CURLcode
Curl_ssl_session_create2(void *sdata, size_t sdata_len,
int ietf_tls_id, const char *alpn,
curl_off_t valid_until, size_t earlydata_max,
unsigned char *quic_tp, size_t quic_tp_len,
struct Curl_ssl_session **psession)
CURLcode Curl_ssl_session_create2(void *sdata, size_t sdata_len,
int ietf_tls_id, const char *alpn,
curl_off_t valid_until, size_t earlydata_max,
unsigned char *quic_tp, size_t quic_tp_len,
struct Curl_ssl_session **psession)
{
struct Curl_ssl_session *s;
@ -322,7 +320,7 @@ CURLcode Curl_ssl_scache_create(size_t max_peers,
}
scache->magic = CURL_SCACHE_MAGIC;
scache->default_lifetime_secs = (24*60*60); /* 1 day */
scache->default_lifetime_secs = (24 * 60 * 60); /* 1 day */
scache->peer_count = max_peers;
scache->peers = peers;
scache->age = 1;
@ -507,7 +505,7 @@ CURLcode Curl_ssl_peer_key_make(struct Curl_cfilter *cf,
if(ssl->version || ssl->version_max) {
r = curlx_dyn_addf(&buf, ":TLSVER-%d-%d", ssl->version,
(ssl->version_max >> 16));
(ssl->version_max >> 16));
if(r)
goto out;
}
@ -616,19 +614,18 @@ static bool cf_ssl_scache_match_auth(struct Curl_ssl_scache_peer *peer,
else if(!Curl_safecmp(peer->clientcert, conn_config->clientcert))
return FALSE;
#ifdef USE_TLS_SRP
if(Curl_timestrcmp(peer->srp_username, conn_config->username) ||
Curl_timestrcmp(peer->srp_password, conn_config->password))
return FALSE;
if(Curl_timestrcmp(peer->srp_username, conn_config->username) ||
Curl_timestrcmp(peer->srp_password, conn_config->password))
return FALSE;
#endif
return TRUE;
}
static CURLcode
cf_ssl_find_peer_by_key(struct Curl_easy *data,
struct Curl_ssl_scache *scache,
const char *ssl_peer_key,
struct ssl_primary_config *conn_config,
struct Curl_ssl_scache_peer **ppeer)
static CURLcode cf_ssl_find_peer_by_key(struct Curl_easy *data,
struct Curl_ssl_scache *scache,
const char *ssl_peer_key,
struct ssl_primary_config *conn_config,
struct Curl_ssl_scache_peer **ppeer)
{
size_t i, peer_key_len = 0;
CURLcode result = CURLE_OK;
@ -718,12 +715,11 @@ cf_ssl_get_free_peer(struct Curl_ssl_scache *scache)
return peer;
}
static CURLcode
cf_ssl_add_peer(struct Curl_easy *data,
struct Curl_ssl_scache *scache,
const char *ssl_peer_key,
struct ssl_primary_config *conn_config,
struct Curl_ssl_scache_peer **ppeer)
static CURLcode cf_ssl_add_peer(struct Curl_easy *data,
struct Curl_ssl_scache *scache,
const char *ssl_peer_key,
struct ssl_primary_config *conn_config,
struct Curl_ssl_scache_peer **ppeer)
{
struct Curl_ssl_scache_peer *peer = NULL;
CURLcode result = CURLE_OK;
@ -1000,7 +996,7 @@ void Curl_ssl_scache_remove_all(struct Curl_cfilter *cf,
#ifdef USE_SSLS_EXPORT
#define CURL_SSL_TICKET_MAX (16*1024)
#define CURL_SSL_TICKET_MAX (16 * 1024)
static CURLcode cf_ssl_scache_peer_set_hmac(struct Curl_ssl_scache_peer *peer)
{

26
lib/vtls/vtls_scache.h
View file

@ -37,8 +37,8 @@ struct ssl_peer;
/* RFC 8446 (TLSv1.3) restrict lifetime to one week max, for
* other, less secure versions, we restrict it to a day */
#define CURL_SCACHE_MAX_13_LIFETIME_SEC (60*60*24*7)
#define CURL_SCACHE_MAX_12_LIFETIME_SEC (60*60*24)
#define CURL_SCACHE_MAX_13_LIFETIME_SEC (60 * 60 * 24 * 7)
#define CURL_SCACHE_MAX_12_LIFETIME_SEC (60 * 60 * 24)
/* Create a session cache for up to max_peers endpoints with a total
* of up to max_sessions SSL sessions per peer */
@ -142,22 +142,18 @@ struct Curl_ssl_session {
* in case this is not known.
* @param psession on return the scached session instance created
*/
CURLcode
Curl_ssl_session_create(void *sdata, size_t sdata_len,
int ietf_tls_id, const char *alpn,
curl_off_t valid_until,
size_t earlydata_max,
struct Curl_ssl_session **psession);
CURLcode Curl_ssl_session_create(void *sdata, size_t sdata_len,
int ietf_tls_id, const char *alpn,
curl_off_t valid_until, size_t earlydata_max,
struct Curl_ssl_session **psession);
/* Variation of session creation with quic transport parameter bytes,
* Takes ownership of `quic_tp` regardless of return code. */
CURLcode
Curl_ssl_session_create2(void *sdata, size_t sdata_len,
int ietf_tls_id, const char *alpn,
curl_off_t valid_until,
size_t earlydata_max,
unsigned char *quic_tp, size_t quic_tp_len,
struct Curl_ssl_session **psession);
CURLcode Curl_ssl_session_create2(void *sdata, size_t sdata_len,
int ietf_tls_id, const char *alpn,
curl_off_t valid_until, size_t earlydata_max,
unsigned char *quic_tp, size_t quic_tp_len,
struct Curl_ssl_session **psession);
/* Destroy a `session` instance. Can be called with NULL.
* Does NOT need locking. */

31
lib/vtls/vtls_spack.c
View file

@ -52,8 +52,8 @@ static CURLcode spack_enc8(struct dynbuf *buf, uint8_t b)
return curlx_dyn_addn(buf, &b, 1);
}
static CURLcode
spack_dec8(uint8_t *val, const uint8_t **src, const uint8_t *end)
static CURLcode spack_dec8(uint8_t *val, const uint8_t **src,
const uint8_t *end)
{
if(end - *src < 1)
return CURLE_READ_ERROR;
@ -70,8 +70,8 @@ static CURLcode spack_enc16(struct dynbuf *buf, uint16_t val)
return curlx_dyn_addn(buf, nval, sizeof(nval));
}
static CURLcode
spack_dec16(uint16_t *val, const uint8_t **src, const uint8_t *end)
static CURLcode spack_dec16(uint16_t *val, const uint8_t **src,
const uint8_t *end)
{
if(end - *src < 2)
return CURLE_READ_ERROR;
@ -90,8 +90,8 @@ static CURLcode spack_enc32(struct dynbuf *buf, uint32_t val)
return curlx_dyn_addn(buf, nval, sizeof(nval));
}
static CURLcode
spack_dec32(uint32_t *val, const uint8_t **src, const uint8_t *end)
static CURLcode spack_dec32(uint32_t *val, const uint8_t **src,
const uint8_t *end)
{
if(end - *src < 4)
return CURLE_READ_ERROR;
@ -107,7 +107,7 @@ static CURLcode spack_enc64(struct dynbuf *buf, uint64_t val)
nval[0] = (uint8_t)(val >> 56);
nval[1] = (uint8_t)(val >> 48);
nval[2] = (uint8_t)(val >> 40);
nval[3] = (uint8_t)(val >> 32); \
nval[3] = (uint8_t)(val >> 32);
nval[4] = (uint8_t)(val >> 24);
nval[5] = (uint8_t)(val >> 16);
nval[6] = (uint8_t)(val >> 8);
@ -115,8 +115,8 @@ static CURLcode spack_enc64(struct dynbuf *buf, uint64_t val)
return curlx_dyn_addn(buf, nval, sizeof(nval));
}
static CURLcode
spack_dec64(uint64_t *val, const uint8_t **src, const uint8_t *end)
static CURLcode spack_dec64(uint64_t *val, const uint8_t **src,
const uint8_t *end)
{
if(end - *src < 8)
return CURLE_READ_ERROR;
@ -141,8 +141,8 @@ static CURLcode spack_encstr16(struct dynbuf *buf, const char *s)
return r;
}
static CURLcode
spack_decstr16(char **val, const uint8_t **src, const uint8_t *end)
static CURLcode spack_decstr16(char **val, const uint8_t **src,
const uint8_t *end)
{
uint16_t slen;
CURLcode r;
@ -158,8 +158,8 @@ spack_decstr16(char **val, const uint8_t **src, const uint8_t *end)
return *val ? CURLE_OK : CURLE_OUT_OF_MEMORY;
}
static CURLcode spack_encdata16(struct dynbuf *buf,
const uint8_t *data, size_t data_len)
static CURLcode spack_encdata16(struct dynbuf *buf, const uint8_t *data,
size_t data_len)
{
CURLcode r;
if(data_len > UINT16_MAX)
@ -171,9 +171,8 @@ static CURLcode spack_encdata16(struct dynbuf *buf,
return r;
}
static CURLcode
spack_decdata16(uint8_t **val, size_t *val_len,
const uint8_t **src, const uint8_t *end)
static CURLcode spack_decdata16(uint8_t **val, size_t *val_len,
const uint8_t **src, const uint8_t *end)
{
uint16_t data_len;
CURLcode r;

113
lib/vtls/wolfssl.c
View file

@ -127,9 +127,9 @@ static CURLcode wssl_connect(struct Curl_cfilter *cf,
* (--enable-opensslextra or --enable-all).
*/
#if defined(HAVE_SECRET_CALLBACK) && defined(WOLFSSL_TLS13)
static int
wssl_tls13_secret_callback(SSL *ssl, int id, const unsigned char *secret,
int secretSz, void *ctx)
static int wssl_tls13_secret_callback(SSL *ssl, int id,
const unsigned char *secret,
int secretSz, void *ctx)
{
const char *label;
unsigned char client_random[SSL3_RANDOM_SIZE];
@ -309,8 +309,7 @@ static long wssl_bio_cf_ctrl(WOLFSSL_BIO *bio, int cmd, long num, void *ptr)
return ret;
}
static int wssl_bio_cf_out_write(WOLFSSL_BIO *bio,
const char *buf, int blen)
static int wssl_bio_cf_out_write(WOLFSSL_BIO *bio, const char *buf, int blen)
{
struct Curl_cfilter *cf = wolfSSL_BIO_get_data(bio);
struct ssl_connect_data *connssl = cf->ctx;
@ -487,7 +486,7 @@ static int wssl_vtls_new_session_cb(WOLFSSL *ssl, WOLFSSL_SESSION *session)
{
struct Curl_cfilter *cf;
cf = (struct Curl_cfilter*)wolfSSL_get_app_data(ssl);
cf = (struct Curl_cfilter *)wolfSSL_get_app_data(ssl);
DEBUGASSERT(cf != NULL);
if(cf && session) {
struct ssl_connect_data *connssl = cf->ctx;
@ -535,8 +534,8 @@ static CURLcode wssl_on_session_reuse(struct Curl_cfilter *cf,
connssl->earlydata_state = ssl_earlydata_await;
connssl->state = ssl_connection_deferred;
result = Curl_alpn_set_negotiated(cf, data, connssl,
(const unsigned char *)scs->alpn,
scs->alpn ? strlen(scs->alpn) : 0);
(const unsigned char *)scs->alpn,
scs->alpn ? strlen(scs->alpn) : 0);
*do_early_data = !result;
}
return result;
@ -640,7 +639,7 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf,
}
#else
infof(data, "ignoring native CA option because wolfSSL was built without "
"native CA support");
"native CA support");
#endif
}
#endif /* !NO_FILESYSTEM */
@ -688,7 +687,7 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf,
/* Just continue with a warning if no strict certificate
verification is required. */
infof(data, "error setting certificate verify locations,"
" continuing anyway:");
" continuing anyway:");
}
}
else {
@ -707,15 +706,15 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf,
#define MPROTO_WSSL_X509_KEY "tls:wssl:x509:share"
struct wssl_x509_share {
char *CAfile; /* CAfile path used to generate X509 store */
char *CAfile; /* CAfile path used to generate X509 store */
WOLFSSL_X509_STORE *store; /* cached X509 store or NULL if none */
struct curltime time; /* when the cached store was created */
struct curltime time; /* when the cached store was created */
};
static void wssl_x509_share_free(void *key, size_t key_len, void *p)
{
struct wssl_x509_share *share = p;
DEBUGASSERT(key_len == (sizeof(MPROTO_WSSL_X509_KEY)-1));
DEBUGASSERT(key_len == (sizeof(MPROTO_WSSL_X509_KEY) - 1));
DEBUGASSERT(!memcmp(MPROTO_WSSL_X509_KEY, key, key_len));
(void)key;
(void)key_len;
@ -726,9 +725,8 @@ static void wssl_x509_share_free(void *key, size_t key_len, void *p)
curlx_free(share);
}
static bool
wssl_cached_x509_store_expired(const struct Curl_easy *data,
const struct wssl_x509_share *mb)
static bool wssl_cached_x509_store_expired(const struct Curl_easy *data,
const struct wssl_x509_share *mb)
{
const struct ssl_general_config *cfg = &data->set.general_ssl;
struct curltime now = curlx_now();
@ -741,9 +739,8 @@ wssl_cached_x509_store_expired(const struct Curl_easy *data,
return elapsed_ms >= timeout_ms;
}
static bool
wssl_cached_x509_store_different(struct Curl_cfilter *cf,
const struct wssl_x509_share *mb)
static bool wssl_cached_x509_store_different(struct Curl_cfilter *cf,
const struct wssl_x509_share *mb)
{
struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
if(!mb->CAfile || !conn_config->CAfile)
@ -762,7 +759,7 @@ static WOLFSSL_X509_STORE *wssl_get_cached_x509_store(struct Curl_cfilter *cf,
DEBUGASSERT(multi);
share = multi ? Curl_hash_pick(&multi->proto_hash,
CURL_UNCONST(MPROTO_WSSL_X509_KEY),
sizeof(MPROTO_WSSL_X509_KEY)-1) : NULL;
sizeof(MPROTO_WSSL_X509_KEY) - 1) : NULL;
if(share && share->store &&
!wssl_cached_x509_store_expired(data, share) &&
!wssl_cached_x509_store_different(cf, share)) {
@ -785,7 +782,7 @@ static void wssl_set_cached_x509_store(struct Curl_cfilter *cf,
return;
share = Curl_hash_pick(&multi->proto_hash,
CURL_UNCONST(MPROTO_WSSL_X509_KEY),
sizeof(MPROTO_WSSL_X509_KEY)-1);
sizeof(MPROTO_WSSL_X509_KEY) - 1);
if(!share) {
share = curlx_calloc(1, sizeof(*share));
@ -793,7 +790,7 @@ static void wssl_set_cached_x509_store(struct Curl_cfilter *cf,
return;
if(!Curl_hash_add2(&multi->proto_hash,
CURL_UNCONST(MPROTO_WSSL_X509_KEY),
sizeof(MPROTO_WSSL_X509_KEY)-1,
sizeof(MPROTO_WSSL_X509_KEY) - 1,
share, wssl_x509_share_free)) {
curlx_free(share);
return;
@ -876,8 +873,7 @@ CURLcode Curl_wssl_setup_x509_store(struct Curl_cfilter *cf,
}
#ifdef WOLFSSL_TLS13
static CURLcode
wssl_add_default_ciphers(bool tls13, struct dynbuf *buf)
static CURLcode wssl_add_default_ciphers(bool tls13, struct dynbuf *buf)
{
int i;
char *str;
@ -905,8 +901,7 @@ wssl_add_default_ciphers(bool tls13, struct dynbuf *buf)
/* 4.2.0 (2019) */
#if LIBWOLFSSL_VERSION_HEX < 0x04002000 || !defined(OPENSSL_EXTRA)
static int
wssl_legacy_CTX_set_min_proto_version(WOLFSSL_CTX* ctx, int version)
static int wssl_legacy_CTX_set_min_proto_version(WOLFSSL_CTX *ctx, int version)
{
int res;
switch(version) {
@ -933,8 +928,8 @@ wssl_legacy_CTX_set_min_proto_version(WOLFSSL_CTX* ctx, int version)
}
return res;
}
static int
wssl_legacy_CTX_set_max_proto_version(WOLFSSL_CTX* ctx, int version)
static int wssl_legacy_CTX_set_max_proto_version(WOLFSSL_CTX *ctx, int version)
{
(void)ctx, (void)version;
return WOLFSSL_NOT_IMPLEMENTED;
@ -1106,7 +1101,6 @@ static CURLcode ssl_version(struct Curl_easy *data,
return CURLE_OK;
}
#define QUIC_GROUPS "P-256:P-384:P-521"
CURLcode Curl_wssl_ctx_init(struct wssl_ctx *wctx,
@ -1121,7 +1115,7 @@ CURLcode Curl_wssl_ctx_init(struct wssl_ctx *wctx,
{
struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
struct ssl_primary_config *conn_config;
WOLFSSL_METHOD* req_method = NULL;
WOLFSSL_METHOD *req_method = NULL;
struct alpn_spec alpns;
char *curves;
#ifdef WOLFSSL_HAVE_KYBER
@ -1357,8 +1351,7 @@ CURLcode Curl_wssl_ctx_init(struct wssl_ctx *wctx,
/* Ensure the Client Random is preserved. */
wolfSSL_KeepArrays(wctx->ssl);
#if defined(HAVE_SECRET_CALLBACK) && defined(WOLFSSL_TLS13)
wolfSSL_set_tls13_secret_cb(wctx->ssl,
wssl_tls13_secret_callback, NULL);
wolfSSL_set_tls13_secret_cb(wctx->ssl, wssl_tls13_secret_callback, NULL);
#endif
}
#endif /* OPENSSL_EXTRA */
@ -1383,15 +1376,15 @@ CURLcode Curl_wssl_ctx_init(struct wssl_ctx *wctx,
if(data->set.tls_ech == CURLECH_GREASE) {
infof(data, "ECH: GREASE is done by default by wolfSSL: no need to ask");
}
if(data->set.tls_ech & CURLECH_CLA_CFG
&& data->set.str[STRING_ECH_CONFIG]) {
if(data->set.tls_ech & CURLECH_CLA_CFG &&
data->set.str[STRING_ECH_CONFIG]) {
char *b64val = data->set.str[STRING_ECH_CONFIG];
word32 b64len = 0;
b64len = (word32) strlen(b64val);
if(b64len
&& wolfSSL_SetEchConfigsBase64(wctx->ssl, b64val, b64len)
!= WOLFSSL_SUCCESS) {
b64len = (word32)strlen(b64val);
if(b64len &&
wolfSSL_SetEchConfigsBase64(wctx->ssl,
b64val, b64len) != WOLFSSL_SUCCESS) {
if(data->set.tls_ech & CURLECH_HARD) {
result = CURLE_SSL_CONNECT_ERROR;
goto out;
@ -1424,8 +1417,8 @@ CURLcode Curl_wssl_ctx_init(struct wssl_ctx *wctx,
size_t elen = rinfo->echconfiglist_len;
infof(data, "ECH: ECHConfig from DoH HTTPS RR");
if(wolfSSL_SetEchConfigs(wctx->ssl, ecl, (word32) elen) !=
WOLFSSL_SUCCESS) {
if(wolfSSL_SetEchConfigs(wctx->ssl, ecl, (word32)elen) !=
WOLFSSL_SUCCESS) {
infof(data, "ECH: wolfSSL_SetEchConfigs failed");
if(data->set.tls_ech & CURLECH_HARD) {
result = CURLE_SSL_CONNECT_ERROR;
@ -1476,8 +1469,8 @@ out:
* This function loads all the client/CA certificates and CRLs. Setup the TLS
* layer and do all necessary magic.
*/
static CURLcode
wssl_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
static CURLcode wssl_connect_step1(struct Curl_cfilter *cf,
struct Curl_easy *data)
{
struct ssl_connect_data *connssl = cf->ctx;
struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
@ -1542,9 +1535,7 @@ wssl_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
return CURLE_OK;
}
static char *wssl_strerror(unsigned long error, char *buf,
unsigned long size)
static char *wssl_strerror(unsigned long error, char *buf, unsigned long size)
{
DEBUGASSERT(size > 40);
*buf = '\0';
@ -1665,8 +1656,7 @@ static CURLcode wssl_send_earlydata(struct Curl_cfilter *cf,
}
#endif /* WOLFSSL_EARLY_DATA */
static CURLcode wssl_handshake(struct Curl_cfilter *cf,
struct Curl_easy *data)
static CURLcode wssl_handshake(struct Curl_cfilter *cf, struct Curl_easy *data)
{
struct ssl_connect_data *connssl = cf->ctx;
struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
@ -1735,7 +1725,7 @@ static CURLcode wssl_handshake(struct Curl_cfilter *cf,
conn_config->verifyhost &&
!connssl->peer.sni) {
/* we have an IP address as hostname. */
WOLFSSL_X509* cert = wolfSSL_get_peer_certificate(wssl->ssl);
WOLFSSL_X509 *cert = wolfSSL_get_peer_certificate(wssl->ssl);
if(!cert) {
failf(data, "unable to get peer certificate");
return CURLE_PEER_FAILED_VERIFICATION;
@ -1789,11 +1779,11 @@ static CURLcode wssl_handshake(struct Curl_cfilter *cf,
}
else if(wssl->io_result) {
switch(wssl->io_result) {
case CURLE_SEND_ERROR:
case CURLE_RECV_ERROR:
return CURLE_SSL_CONNECT_ERROR;
default:
return wssl->io_result;
case CURLE_SEND_ERROR:
case CURLE_RECV_ERROR:
return CURLE_SSL_CONNECT_ERROR;
default:
return wssl->io_result;
}
}
#ifdef USE_ECH_WOLFSSL
@ -1804,8 +1794,7 @@ static CURLcode wssl_handshake(struct Curl_cfilter *cf,
int rv = 0;
/* this currently does not produce the retry_configs */
rv = wolfSSL_GetEchConfigs(wssl->ssl, echConfigs,
&echConfigsLen);
rv = wolfSSL_GetEchConfigs(wssl->ssl, echConfigs, &echConfigsLen);
if(rv != WOLFSSL_SUCCESS) {
infof(data, "Failed to get ECHConfigs");
}
@ -2087,7 +2076,6 @@ size_t Curl_wssl_version(char *buffer, size_t size)
#endif
}
static int wssl_init(void)
{
int ret;
@ -2101,7 +2089,6 @@ static int wssl_init(void)
return ret;
}
static void wssl_cleanup(void)
{
wssl_bio_cf_free_methods();
@ -2111,7 +2098,6 @@ static void wssl_cleanup(void)
#endif
}
static bool wssl_data_pending(struct Curl_cfilter *cf,
const struct Curl_easy *data)
{
@ -2128,15 +2114,14 @@ static bool wssl_data_pending(struct Curl_cfilter *cf,
return FALSE;
}
void Curl_wssl_report_handshake(struct Curl_easy *data,
struct wssl_ctx *wssl)
void Curl_wssl_report_handshake(struct Curl_easy *data, struct wssl_ctx *wssl)
{
#if (LIBWOLFSSL_VERSION_HEX >= 0x03009010)
infof(data, "SSL connection using %s / %s",
wolfSSL_get_version(wssl->ssl),
wolfSSL_get_cipher_name(wssl->ssl));
infof(data, "SSL connection using %s / %s",
wolfSSL_get_version(wssl->ssl),
wolfSSL_get_cipher_name(wssl->ssl));
#else
infof(data, "SSL connected");
infof(data, "SSL connected");
#endif
}

9
lib/vtls/wolfssl.h
View file

@ -41,9 +41,9 @@ extern const struct Curl_ssl Curl_ssl_wolfssl;
struct wssl_ctx {
struct WOLFSSL_CTX *ssl_ctx;
struct WOLFSSL *ssl;
CURLcode io_result; /* result of last BIO cfilter operation */
CURLcode hs_result; /* result of handshake */
struct WOLFSSL *ssl;
CURLcode io_result; /* result of last BIO cfilter operation */
CURLcode hs_result; /* result of handshake */
int io_send_blocked_len; /* length of last BIO write that EAGAIN-ed */
BIT(x509_store_setup); /* x509 store has been set up */
BIT(shutting_down); /* TLS is being shut down */
@ -88,8 +88,7 @@ CURLcode Curl_wssl_verify_pinned(struct Curl_cfilter *cf,
struct Curl_easy *data,
struct wssl_ctx *wssl);
void Curl_wssl_report_handshake(struct Curl_easy *data,
struct wssl_ctx *wssl);
void Curl_wssl_report_handshake(struct Curl_easy *data, struct wssl_ctx *wssl);
#endif /* USE_WOLFSSL */
#endif /* HEADER_CURL_WOLFSSL_H */

54
lib/vtls/x509asn1.c
View file

@ -192,7 +192,7 @@ static const char *getASN1Element_(struct Curl_asn1Element *elem,
/* Process header byte. */
elem->header = beg;
b = (unsigned char) *beg++;
b = (unsigned char)*beg++;
elem->constructed = (b & 0x20) != 0;
elem->eclass = (b >> 6) & 3;
b &= 0x1F;
@ -203,7 +203,7 @@ static const char *getASN1Element_(struct Curl_asn1Element *elem,
/* Process length. */
if(beg >= end)
return NULL;
b = (unsigned char) *beg++;
b = (unsigned char)*beg++;
if(!(b & 0x80))
len = b;
else if(!(b &= 0x7F)) {
@ -284,7 +284,7 @@ static CURLcode bool2str(struct dynbuf *store,
{
if(end - beg != 1)
return CURLE_BAD_FUNCTION_ARGUMENT;
return curlx_dyn_add(store, *beg ? "TRUE": "FALSE");
return curlx_dyn_add(store, *beg ? "TRUE" : "FALSE");
}
/*
@ -298,13 +298,12 @@ static CURLcode octet2str(struct dynbuf *store,
CURLcode result = CURLE_OK;
while(!result && beg < end)
result = curlx_dyn_addf(store, "%02x:", (unsigned char) *beg++);
result = curlx_dyn_addf(store, "%02x:", (unsigned char)*beg++);
return result;
}
static CURLcode bit2str(struct dynbuf *store,
const char *beg, const char *end)
static CURLcode bit2str(struct dynbuf *store, const char *beg, const char *end)
{
/* Convert an ASN.1 bit string to a printable string. */
@ -318,8 +317,7 @@ static CURLcode bit2str(struct dynbuf *store,
*
* Returns error.
*/
static CURLcode int2str(struct dynbuf *store,
const char *beg, const char *end)
static CURLcode int2str(struct dynbuf *store, const char *beg, const char *end)
{
unsigned int val = 0;
size_t n = end - beg;
@ -335,7 +333,7 @@ static CURLcode int2str(struct dynbuf *store,
val = ~val;
do
val = (val << 8) | *(const unsigned char *) beg++;
val = (val << 8) | *(const unsigned char *)beg++;
while(beg < end);
return curlx_dyn_addf(store, "%s%x", val >= 10 ? "0x" : "", val);
}
@ -348,8 +346,8 @@ static CURLcode int2str(struct dynbuf *store,
*
* Returns error.
*/
static CURLcode
utf8asn1str(struct dynbuf *to, int type, const char *from, const char *end)
static CURLcode utf8asn1str(struct dynbuf *to, int type, const char *from,
const char *end)
{
size_t inlength = end - from;
int size = 1;
@ -390,14 +388,14 @@ utf8asn1str(struct dynbuf *to, int type, const char *from, const char *end)
switch(size) {
case 4:
wc = (wc << 8) | *(const unsigned char *) from++;
wc = (wc << 8) | *(const unsigned char *) from++;
wc = (wc << 8) | *(const unsigned char *)from++;
wc = (wc << 8) | *(const unsigned char *)from++;
FALLTHROUGH();
case 2:
wc = (wc << 8) | *(const unsigned char *) from++;
wc = (wc << 8) | *(const unsigned char *)from++;
FALLTHROUGH();
default: /* case 1: */
wc = (wc << 8) | *(const unsigned char *) from++;
wc = (wc << 8) | *(const unsigned char *)from++;
}
if(wc >= 0x00000080) {
if(wc >= 0x00000800) {
@ -406,19 +404,19 @@ utf8asn1str(struct dynbuf *to, int type, const char *from, const char *end)
/* Invalid char. size for target encoding. */
return CURLE_WEIRD_SERVER_REPLY;
}
buf[3] = (char) (0x80 | (wc & 0x3F));
buf[3] = (char)(0x80 | (wc & 0x3F));
wc = (wc >> 6) | 0x00010000;
charsize++;
}
buf[2] = (char) (0x80 | (wc & 0x3F));
buf[2] = (char)(0x80 | (wc & 0x3F));
wc = (wc >> 6) | 0x00000800;
charsize++;
}
buf[1] = (char) (0x80 | (wc & 0x3F));
buf[1] = (char)(0x80 | (wc & 0x3F));
wc = (wc >> 6) | 0x000000C0;
charsize++;
}
buf[0] = (char) wc;
buf[0] = (char)wc;
result = curlx_dyn_addn(to, buf, charsize);
}
}
@ -438,7 +436,7 @@ static CURLcode encodeOID(struct dynbuf *store,
CURLcode result = CURLE_OK;
/* Process the first two numbers. */
y = *(const unsigned char *) beg++;
y = *(const unsigned char *)beg++;
x = y / 40;
y -= x * 40;
@ -452,7 +450,7 @@ static CURLcode encodeOID(struct dynbuf *store,
do {
if(x & 0xFF000000)
return CURLE_OK;
y = *(const unsigned char *) beg++;
y = *(const unsigned char *)beg++;
x = (x << 7) | (y & 0x7F);
} while(y & 0x80);
result = curlx_dyn_addf(store, ".%u", x);
@ -973,8 +971,8 @@ static CURLcode do_pubkey_field(struct Curl_easy *data, int certnum,
}
/* return 0 on success, 1 on error */
static int do_pubkey(struct Curl_easy *data, int certnum,
const char *algo, struct Curl_asn1Element *param,
static int do_pubkey(struct Curl_easy *data, int certnum, const char *algo,
struct Curl_asn1Element *param,
struct Curl_asn1Element *pubkey)
{
struct Curl_asn1Element elem;
@ -1019,7 +1017,7 @@ static int do_pubkey(struct Curl_easy *data, int certnum,
len = ((elem.end - q) * 8);
if(len) {
unsigned int i;
for(i = *(const unsigned char *) q; !(i & 0x80); i <<= 1)
for(i = *(const unsigned char *)q; !(i & 0x80); i <<= 1)
len--;
}
if(len > 32)
@ -1078,8 +1076,7 @@ static int do_pubkey(struct Curl_easy *data, int certnum,
* Convert an ASN.1 distinguished name into a printable string.
* Return error.
*/
static CURLcode DNtostr(struct dynbuf *store,
struct Curl_asn1Element *dn)
static CURLcode DNtostr(struct dynbuf *store, struct Curl_asn1Element *dn)
{
return encodeDN(store, dn);
}
@ -1135,7 +1132,7 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
/* Version (always fits in less than 32 bits). */
version = 0;
for(ptr = cert.version.beg; ptr < cert.version.end; ptr++)
version = (version << 8) | *(const unsigned char *) ptr;
version = (version << 8) | *(const unsigned char *)ptr;
if(data->set.ssl.certinfo) {
result = curlx_dyn_addf(&out, "%x", version);
if(result)
@ -1163,8 +1160,7 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data,
if(result)
goto done;
if(data->set.ssl.certinfo) {
result = ssl_push_certinfo_dyn(data, certnum, "Signature Algorithm",
&out);
result = ssl_push_certinfo_dyn(data, certnum, "Signature Algorithm", &out);
if(result)
goto done;
}