romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 14:33:44 +03:00
Code Issues Projects Releases Packages Wiki Activity

ssl: set engine implicitly when a PKCS#11 URI is provided

Browse source 
This allows the use of PKCS#11 URI for certificates and keys without
setting the corresponding type as "ENG" and the engine as "pkcs11"
explicitly. If a PKCS#11 URI is provided for certificate, key,
proxy_certificate or proxy_key, the corresponding type is set as "ENG"
if not provided and the engine is set to "pkcs11" if not provided.

Acked-by: Nikos Mavrogiannopoulos
Closes #2333
This commit is contained in:
Anderson Toshiyuki Sasaki 2018-02-19 14:31:06 +01:00 • committed by Daniel Stenberg
parent c892795ea3
commit 298d2565e2
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 109 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

38
lib/vtls/openssl.c
View file

@ -558,8 +558,25 @@ static int ssl_ui_writer(UI *ui, UI_STRING *uis)
}
return (UI_method_get_writer(UI_OpenSSL()))(ui, uis);
}
/*
* Check if a given string is a PKCS#11 URI
*/
static bool is_pkcs11_uri(const char *string)
{
if(strncasecompare(string, "pkcs11:", 7)) {
return TRUE;
}
else {
return FALSE;
}
}
#endif
static CURLcode Curl_ossl_set_engine(struct Curl_easy *data,
const char *engine);
static
int cert_stuff(struct connectdata *conn,
SSL_CTX* ctx,
@ -622,6 +639,16 @@ int cert_stuff(struct connectdata *conn,
case SSL_FILETYPE_ENGINE:
#if defined(USE_OPENSSL_ENGINE) && defined(ENGINE_CTRL_GET_CMD_FROM_NAME)
{
/* Implicitly use pkcs11 engine if none was provided and the
* cert_file is a PKCS#11 URI */
if(!data->state.engine) {
if(is_pkcs11_uri(cert_file)) {
if(Curl_ossl_set_engine(data, "pkcs11") != CURLE_OK) {
return 0;
}
}
}
if(data->state.engine) {
const char *cmd_name = "LOAD_CERT_CTRL";
struct {
@ -798,6 +825,17 @@ int cert_stuff(struct connectdata *conn,
#ifdef USE_OPENSSL_ENGINE
{ /* XXXX still needs some work */
EVP_PKEY *priv_key = NULL;
/* Implicitly use pkcs11 engine if none was provided and the
* key_file is a PKCS#11 URI */
if(!data->state.engine) {
if(is_pkcs11_uri(key_file)) {
if(Curl_ossl_set_engine(data, "pkcs11") != CURLE_OK) {
return 0;
}
}
}
if(data->state.engine) {
UI_METHOD *ui_method =
UI_create_method((char *)"curl user interface");