romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 22:53:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

httpsig: add RFC 9421 HTTP Message Signatures support

Browse source 
Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.

New libcurl options:
 - CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
 - CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
 - CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
 - CURLOPT_HTTPSIG_HEADERS: space-separated components to sign

New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers

The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.

Verified by test 5000 to 5021

Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes #22386
Closes #21239
This commit is contained in:
Sameeh Jubran 2026-07-24 22:49:52 +02:00 • committed by Daniel Stenberg
parent ebc5212dac
commit a55731050e
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
78 changed files with 3192 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

24
include/curl/curl.h
View file

@ -843,12 +843,20 @@ typedef enum {
#endif
#define CURLAUTH_BEARER (((unsigned long)1) << 6)
#define CURLAUTH_AWS_SIGV4 (((unsigned long)1) << 7)
#define CURLAUTH_HTTPSIG (((unsigned long)1) << 8)
#define CURLAUTH_ONLY (((unsigned long)1) << 31)
#define CURLAUTH_ANY ((~CURLAUTH_DIGEST_IE) & \
#define CURLAUTH_ANY ((~(CURLAUTH_DIGEST_IE | \
CURLAUTH_HTTPSIG)) & \
((unsigned long)0xffffffff))
#define CURLAUTH_ANYSAFE ((~(CURLAUTH_BASIC | CURLAUTH_DIGEST_IE)) & \
#define CURLAUTH_ANYSAFE ((~(CURLAUTH_BASIC | CURLAUTH_DIGEST_IE | \
CURLAUTH_HTTPSIG)) & \
((unsigned long)0xffffffff))
/* constants for CURLOPT_HTTPSIG_ALGORITHM */
#define CURLHTTPSIG_NONE 0L
#define CURLHTTPSIG_ED25519 1L
#define CURLHTTPSIG_HMAC_SHA256 2L
/* all types supported by server */
#define CURLSSH_AUTH_ANY ((unsigned long)0xffffffff)
#define CURLSSH_AUTH_NONE 0L /* none allowed, silly but complete */
@ -2266,6 +2274,18 @@ typedef enum {
/* set TLS supported signature algorithms */
CURLOPT(CURLOPT_SSL_SIGNATURE_ALGORITHMS, CURLOPTTYPE_STRINGPOINT, 328),
/* RFC 9421 HTTP Message Signatures algorithm */
CURLOPT(CURLOPT_HTTPSIG_ALGORITHM, CURLOPTTYPE_VALUES, 329),
/* Hex-encoded key for HTTP Message Signatures */
CURLOPT(CURLOPT_HTTPSIG_KEY, CURLOPTTYPE_STRINGPOINT, 330),
/* Key identifier for HTTP Message Signatures */
CURLOPT(CURLOPT_HTTPSIG_KEYID, CURLOPTTYPE_STRINGPOINT, 331),
/* Space-separated list of components to sign for HTTP Message Signatures */
CURLOPT(CURLOPT_HTTPSIG_HEADERS, CURLOPTTYPE_STRINGPOINT, 332),
CURLOPT_LASTENTRY /* the last unused */
} CURLoption;

3
include/curl/typecheck-gcc.h
View file

@ -496,6 +496,9 @@ CURLWARNING(Wcurl_easy_getinfo_err_curl_off_t,
(option) == CURLOPT_USERAGENT || \
(option) == CURLOPT_USERNAME || \
(option) == CURLOPT_AWS_SIGV4 || \
(option) == CURLOPT_HTTPSIG_HEADERS || \
(option) == CURLOPT_HTTPSIG_KEY || \
(option) == CURLOPT_HTTPSIG_KEYID || \
(option) == CURLOPT_USERPWD || \
(option) == CURLOPT_XOAUTH2_BEARER || \
0)