luna - curl/lib/vtls/mbedtls.c

   1/***************************************************************************
   2 *                                  _   _ ____  _
   3 *  Project                     ___| | | |  _ \| |
   4 *                             / __| | | | |_) | |
   5 *                            | (__| |_| |  _ <| |___
   6 *                             \___|\___/|_| \_\_____|
   7 *
   8 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
   9 * Copyright (C) Hoi-Ho Chan, <hoiho.chan@gmail.com>
  10 *
  11 * This software is licensed as described in the file COPYING, which
  12 * you should have received as part of this distribution. The terms
  13 * are also available at https://curl.se/docs/copyright.html.
  14 *
  15 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16 * copies of the Software, and permit persons to whom the Software is
  17 * furnished to do so, under the terms of the COPYING file.
  18 *
  19 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20 * KIND, either express or implied.
  21 *
  22 * SPDX-License-Identifier: curl
  23 *
  24 ***************************************************************************/
  25/*
  26 * Source file for all mbedTLS-specific code for the TLS/SSL layer. No code
  27 * but vtls.c should ever call or use these functions.
  28 *
  29 */
  30#include "curl_setup.h"
  31
  32#ifdef USE_MBEDTLS
  33
  34/* Define this to enable lots of debugging for mbedTLS */
  35/* #define MBEDTLS_DEBUG */
  36
  37#include <mbedtls/version.h>
  38#if MBEDTLS_VERSION_NUMBER < 0x03020000
  39#error "mbedTLS 3.2.0 or later required"
  40#endif
  41#include <psa/crypto_config.h>
  42#include <mbedtls/net_sockets.h>
  43#include <mbedtls/ssl.h>
  44#include <mbedtls/x509.h>
  45#include <mbedtls/psa_util.h>
  46
  47#if MBEDTLS_VERSION_NUMBER < 0x04000000 && !defined(MBEDTLS_CTR_DRBG_C)
  48#error "MBEDTLS_CTR_DRBG_C is required for mbedTLS 3.x."
  49#endif
  50
  51#include <mbedtls/error.h>
  52#if MBEDTLS_VERSION_NUMBER < 0x04000000
  53#include <mbedtls/entropy.h>
  54#include <mbedtls/ctr_drbg.h>
  55#endif
  56#ifdef MBEDTLS_DEBUG
  57#include <mbedtls/debug.h>
  58#endif
  59
  60#include "vtls/cipher_suite.h"
  61#include "urldata.h"
  62#include "curl_trc.h"
  63#include "vtls/mbedtls.h"
  64#include "vtls/vtls.h"
  65#include "vtls/vtls_int.h"
  66#include "vtls/vtls_scache.h"
  67#include "vtls/x509asn1.h"
  68#include "connect.h" /* for the connect timeout */
  69#include "curlx/strdup.h"
  70#include "curl_sha256.h"
  71
  72/* ALPN for http2 */
  73#if defined(USE_HTTP2) && defined(MBEDTLS_SSL_ALPN)
  74#define HAS_ALPN_MBEDTLS
  75#endif
  76
  77struct mbed_ssl_backend_data {
  78  mbedtls_ssl_context ssl;
  79  mbedtls_x509_crt cacert;
  80  mbedtls_x509_crt clicert;
  81#ifdef MBEDTLS_X509_CRL_PARSE_C
  82  mbedtls_x509_crl crl;
  83#endif
  84  mbedtls_pk_context pk;
  85  mbedtls_ssl_config config;
  86#ifdef HAS_ALPN_MBEDTLS
  87  const char *protocols[3];
  88#endif
  89  int *ciphersuites;
  90  size_t send_blocked_len;
  91  BIT(initialized); /* mbedtls_ssl_context is initialized */
  92  BIT(sent_shutdown);
  93  BIT(send_blocked);
  94};
  95
  96/** A context for random number generation (RNG).
  97 */
  98#if MBEDTLS_VERSION_NUMBER < 0x04000000
  99struct rng_context_t {
 100  mbedtls_entropy_context entropy;
 101  mbedtls_ctr_drbg_context drbg;
 102};
 103
 104static struct rng_context_t rng;
 105#endif
 106
 107#ifndef MBEDTLS_ERROR_C
 108#define mbedtls_strerror(a, b, c) b[0] = 0
 109#endif
 110
 111#ifdef MBEDTLS_DEBUG
 112static void mbed_debug(void *context, int level, const char *f_name,
 113                       int line_nb, const char *line)
 114{
 115  struct Curl_easy *data = (struct Curl_easy *)context;
 116  (void)level;
 117  (void)line_nb;
 118  (void)f_name;
 119
 120  if(data) {
 121    size_t len = strlen(line);
 122    if(len && (line[len - 1] == '\n'))
 123      /* discount any trailing newline */
 124      len--;
 125    infof(data, "%.*s", (int)len, line);
 126  }
 127}
 128#endif
 129
 130static int mbedtls_bio_cf_write(void *bio,
 131                                const unsigned char *buf, size_t blen)
 132{
 133  struct Curl_cfilter *cf = bio;
 134  struct Curl_easy *data = CF_DATA_CURRENT(cf);
 135  size_t nwritten;
 136  CURLcode result;
 137
 138  DEBUGASSERT(data);
 139  if(!data)
 140    return 0;
 141
 142  result = Curl_conn_cf_send(cf->next, data, buf, blen, FALSE, &nwritten);
 143  CURL_TRC_CF(data, cf, "mbedtls_bio_cf_out_write(len=%zu) -> %d, %zu",
 144              blen, result, nwritten);
 145  if(result == CURLE_AGAIN)
 146    return MBEDTLS_ERR_SSL_WANT_WRITE;
 147  return result ? -1 : (int)nwritten;
 148}
 149
 150static int mbedtls_bio_cf_read(void *bio, unsigned char *buf, size_t blen)
 151{
 152  struct Curl_cfilter *cf = bio;
 153  struct Curl_easy *data = CF_DATA_CURRENT(cf);
 154  size_t nread = 0;
 155  CURLcode result;
 156
 157  DEBUGASSERT(data);
 158  if(!data)
 159    return 0;
 160  /* OpenSSL catches this case, so should we. */
 161  if(!buf)
 162    return 0;
 163
 164  result = Curl_conn_cf_recv(cf->next, data, (char *)buf, blen, &nread);
 165  CURL_TRC_CF(data, cf, "mbedtls_bio_cf_in_read(len=%zu) -> %d, %zu",
 166              blen, result, nread);
 167  if(result == CURLE_AGAIN)
 168    return MBEDTLS_ERR_SSL_WANT_READ;
 169  /* nread is never larger than int here */
 170  return result ? -1 : (int)nread;
 171}
 172
 173/* See:
 174 * https://web.archive.org/web/20200921194007/tls.mbed.org/discussions/generic/howto-determine-exact-buffer-len-for-mbedtls_pk_write_pubkey_der
 175 */
 176#define RSA_PUB_DER_MAX_BYTES   (38 + (2 * MBEDTLS_MPI_MAX_SIZE))
 177#define ECP_PUB_DER_MAX_BYTES   (30 + (2 * MBEDTLS_ECP_MAX_BYTES))
 178
 179#define PUB_DER_MAX_BYTES   (RSA_PUB_DER_MAX_BYTES > ECP_PUB_DER_MAX_BYTES ? \
 180                             RSA_PUB_DER_MAX_BYTES : ECP_PUB_DER_MAX_BYTES)
 181
 182static CURLcode
 183mbed_set_ssl_version_min_max(struct Curl_easy *data,
 184                             struct mbed_ssl_backend_data *backend,
 185                             struct ssl_primary_config *conn_config)
 186{
 187  mbedtls_ssl_protocol_version ver_min =
 188#ifdef MBEDTLS_SSL_PROTO_TLS1_2
 189    MBEDTLS_SSL_VERSION_TLS1_2
 190#else
 191    MBEDTLS_SSL_VERSION_TLS1_3
 192#endif
 193    ;
 194  mbedtls_ssl_protocol_version ver_max =
 195#ifdef MBEDTLS_SSL_PROTO_TLS1_3
 196    MBEDTLS_SSL_VERSION_TLS1_3
 197#else
 198    MBEDTLS_SSL_VERSION_TLS1_2
 199#endif
 200    ;
 201
 202  DEBUGASSERT(conn_config->version != CURL_SSLVERSION_DEFAULT);
 203  switch(conn_config->version) {
 204  case CURL_SSLVERSION_TLSv1:
 205  case CURL_SSLVERSION_TLSv1_0:
 206  case CURL_SSLVERSION_TLSv1_1:
 207  case CURL_SSLVERSION_TLSv1_2:
 208#ifdef MBEDTLS_SSL_PROTO_TLS1_2
 209    ver_min = MBEDTLS_SSL_VERSION_TLS1_2;
 210    break;
 211#endif
 212  case CURL_SSLVERSION_TLSv1_3:
 213#ifdef MBEDTLS_SSL_PROTO_TLS1_3
 214    ver_min = MBEDTLS_SSL_VERSION_TLS1_3;
 215    break;
 216#endif
 217  default:
 218    failf(data, "mbedTLS: unsupported minimum TLS version value: %x",
 219          conn_config->version);
 220    return CURLE_SSL_CONNECT_ERROR;
 221  }
 222
 223  switch(conn_config->version_max) {
 224  case CURL_SSLVERSION_MAX_DEFAULT:
 225  case CURL_SSLVERSION_MAX_NONE:
 226  case CURL_SSLVERSION_MAX_TLSv1_3:
 227#ifdef MBEDTLS_SSL_PROTO_TLS1_3
 228    ver_max = MBEDTLS_SSL_VERSION_TLS1_3;
 229    break;
 230#endif
 231#ifdef MBEDTLS_SSL_PROTO_TLS1_2
 232  case CURL_SSLVERSION_MAX_TLSv1_2:
 233    ver_max = MBEDTLS_SSL_VERSION_TLS1_2;
 234    break;
 235#endif
 236  case CURL_SSLVERSION_MAX_TLSv1_1:
 237  case CURL_SSLVERSION_MAX_TLSv1_0:
 238  default:
 239    failf(data, "mbedTLS: unsupported maximum TLS version value");
 240    return CURLE_SSL_CONNECT_ERROR;
 241  }
 242
 243  mbedtls_ssl_conf_min_tls_version(&backend->config, ver_min);
 244  mbedtls_ssl_conf_max_tls_version(&backend->config, ver_max);
 245
 246  return CURLE_OK;
 247}
 248
 249/* TLS_ECJPAKE_WITH_AES_128_CCM_8 (0xC0FF) is marked experimental in mbedTLS.
 250   The number is not reserved by IANA nor is the cipher suite present in other
 251   SSL implementations. Provide provisional support for specifying the cipher
 252   suite here. */
 253#ifdef MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8
 254static int mbed_cipher_suite_get_str(uint16_t id, char *buf, size_t buf_size,
 255                                     bool prefer_rfc)
 256{
 257  if(id == MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8)
 258    curl_msnprintf(buf, buf_size, "%s", "TLS_ECJPAKE_WITH_AES_128_CCM_8");
 259  else
 260    return Curl_cipher_suite_get_str(id, buf, buf_size, prefer_rfc);
 261  return 0;
 262}
 263
 264static uint16_t mbed_cipher_suite_walk_str(const char **str, const char **end)
 265{
 266  uint16_t id = Curl_cipher_suite_walk_str(str, end);
 267  size_t len = *end - *str;
 268  static const char ecjpake_suite[] = "TLS_ECJPAKE_WITH_AES_128_CCM_8";
 269
 270  if(!id) {
 271    if((len == sizeof(ecjpake_suite) - 1) &&
 272       curl_strnequal(ecjpake_suite, *str, len))
 273      id = MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8;
 274  }
 275  return id;
 276}
 277#else
 278#define mbed_cipher_suite_get_str Curl_cipher_suite_get_str
 279#define mbed_cipher_suite_walk_str Curl_cipher_suite_walk_str
 280#endif
 281
 282static CURLcode
 283mbed_set_selected_ciphers(struct Curl_easy *data,
 284                          struct mbed_ssl_backend_data *backend,
 285                          const char *ciphers12,
 286                          const char *ciphers13)
 287{
 288  const char *ciphers = ciphers12;
 289  const int *supported;
 290  int *selected;
 291  size_t supported_len, count = 0, default13_count = 0, i, j;
 292  const char *ptr, *end;
 293
 294  supported = mbedtls_ssl_list_ciphersuites();
 295  for(i = 0; supported[i] != 0; i++)
 296    ;
 297  supported_len = i;
 298
 299  selected = curlx_malloc(sizeof(int) * (supported_len + 1));
 300  if(!selected)
 301    return CURLE_OUT_OF_MEMORY;
 302
 303#ifndef MBEDTLS_SSL_PROTO_TLS1_3
 304  (void)ciphers13, (void)j;
 305#else
 306  if(!ciphers13) {
 307    /* Add default TLSv1.3 ciphers to selection */
 308    for(j = 0; j < supported_len; j++) {
 309      uint16_t id = (uint16_t)supported[j];
 310      if(strncmp(mbedtls_ssl_get_ciphersuite_name(id), "TLS1-3", 6) != 0)
 311        continue;
 312
 313      selected[count++] = id;
 314    }
 315
 316    default13_count = count;
 317  }
 318  else
 319    ciphers = ciphers13;
 320
 321add_ciphers:
 322#endif
 323  for(ptr = ciphers; ptr[0] != '\0' && count < supported_len; ptr = end) {
 324    uint16_t id = mbed_cipher_suite_walk_str(&ptr, &end);
 325
 326    /* Check if cipher is supported */
 327    if(id) {
 328      for(i = 0; i < supported_len && supported[i] != id; i++)
 329        ;
 330      if(i == supported_len)
 331        id = 0;
 332    }
 333    if(!id) {
 334      if(ptr[0] != '\0')
 335        infof(data, "mbedTLS: unknown cipher in list: \"%.*s\"",
 336              (int)(end - ptr), ptr);
 337      continue;
 338    }
 339
 340    /* No duplicates allowed (so selected cannot overflow) */
 341    for(i = 0; i < count && selected[i] != id; i++)
 342      ;
 343    if(i < count) {
 344      if(i >= default13_count)
 345        infof(data, "mbedTLS: duplicate cipher in list: \"%.*s\"",
 346              (int)(end - ptr), ptr);
 347      continue;
 348    }
 349
 350    selected[count++] = id;
 351  }
 352
 353#ifdef MBEDTLS_SSL_PROTO_TLS1_3
 354  if(ciphers == ciphers13 && ciphers12) {
 355    ciphers = ciphers12;
 356    goto add_ciphers;
 357  }
 358
 359  if(!ciphers12) {
 360    /* Add default TLSv1.2 ciphers to selection */
 361    for(j = 0; j < supported_len; j++) {
 362      uint16_t id = (uint16_t)supported[j];
 363      if(strncmp(mbedtls_ssl_get_ciphersuite_name(id), "TLS1-3", 6) == 0)
 364        continue;
 365
 366      /* No duplicates allowed (so selected cannot overflow) */
 367      for(i = 0; i < count && selected[i] != id; i++)
 368        ;
 369      if(i < count)
 370        continue;
 371
 372      selected[count++] = id;
 373    }
 374  }
 375#endif
 376
 377  selected[count] = 0;
 378
 379  if(count == 0) {
 380    curlx_free(selected);
 381    failf(data, "mbedTLS: no supported cipher in list");
 382    return CURLE_SSL_CIPHER;
 383  }
 384
 385  /* mbedtls_ssl_conf_ciphersuites(): The ciphersuites array is not copied.
 386     It must remain valid for the lifetime of the SSL configuration */
 387  backend->ciphersuites = selected;
 388  mbedtls_ssl_conf_ciphersuites(&backend->config, backend->ciphersuites);
 389  return CURLE_OK;
 390}
 391
 392static void mbed_dump_cert_info(struct Curl_easy *data,
 393                                const mbedtls_x509_crt *crt)
 394{
 395#if !defined(CURLVERBOSE) || defined(MBEDTLS_X509_REMOVE_INFO)
 396  (void)data, (void)crt;
 397#else
 398  const size_t bufsize = 16384;
 399  char *p, *buffer = curlx_malloc(bufsize);
 400
 401  if(buffer && mbedtls_x509_crt_info(buffer, bufsize, " ", crt) > 0) {
 402    infof(data, "Server certificate:");
 403    for(p = buffer; *p; p += *p != '\0') {
 404      size_t s = strcspn(p, "\n");
 405      infof(data, "%.*s", (int)s, p);
 406      p += s;
 407    }
 408  }
 409  else
 410    infof(data, "Unable to dump certificate information");
 411
 412  curlx_free(buffer);
 413#endif
 414}
 415
 416static void mbed_extract_certinfo(struct Curl_easy *data,
 417                                  const mbedtls_x509_crt *crt)
 418{
 419  CURLcode result;
 420  const mbedtls_x509_crt *cur;
 421  int cert_count = 0;
 422  int i;
 423
 424  for(cur = crt; cur && cert_count <= MAX_ALLOWED_CERT_AMOUNT; cur = cur->next)
 425    cert_count++;
 426
 427  if(cert_count > MAX_ALLOWED_CERT_AMOUNT) {
 428    infof(data, "More certificates than allowed (%d), skipping certinfo",
 429          MAX_ALLOWED_CERT_AMOUNT);
 430    return;
 431  }
 432
 433  result = Curl_ssl_init_certinfo(data, cert_count);
 434
 435  for(i = 0, cur = crt; result == CURLE_OK && cur; ++i, cur = cur->next) {
 436    const char *beg = (const char *)cur->raw.p;
 437    const char *end = beg + cur->raw.len;
 438    result = Curl_extract_certinfo(data, i, beg, end);
 439  }
 440}
 441
 442static int mbed_verify_cb(void *ptr, mbedtls_x509_crt *crt,
 443                          int depth, uint32_t *flags)
 444{
 445  struct Curl_cfilter *cf = (struct Curl_cfilter *)ptr;
 446  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
 447  struct Curl_easy *data = CF_DATA_CURRENT(cf);
 448
 449  if(depth == 0) {
 450    if(data->set.verbose)
 451      mbed_dump_cert_info(data, crt);
 452    if(data->set.ssl.certinfo)
 453      mbed_extract_certinfo(data, crt);
 454  }
 455
 456  if(!conn_config->verifypeer)
 457    *flags = 0;
 458  else if(!conn_config->verifyhost)
 459    *flags &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH;
 460
 461  if(*flags) {
 462#ifndef MBEDTLS_X509_REMOVE_INFO
 463    char buf[128];
 464    mbedtls_x509_crt_verify_info(buf, sizeof(buf), "", *flags);
 465    failf(data, "mbedTLS: %s", buf);
 466#else
 467    failf(data, "mbedTLS: certificate verification error 0x%08x", *flags);
 468#endif
 469  }
 470
 471  return 0;
 472}
 473
 474static CURLcode mbed_load_cacert(struct Curl_cfilter *cf,
 475                                 struct Curl_easy *data)
 476{
 477  struct ssl_connect_data *connssl = cf->ctx;
 478  struct mbed_ssl_backend_data *backend =
 479    (struct mbed_ssl_backend_data *)connssl->backend;
 480  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
 481  const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
 482  const char * const ssl_cafile =
 483    /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
 484    (ca_info_blob ? NULL : conn_config->CAfile);
 485  const bool verifypeer = conn_config->verifypeer;
 486  const char * const ssl_capath = conn_config->CApath;
 487#ifdef MBEDTLS_PEM_PARSE_C
 488  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
 489  const char * const ssl_cert_type = ssl_config->cert_type;
 490#endif
 491  int ret = -1;
 492  char errorbuf[128];
 493
 494  mbedtls_x509_crt_init(&backend->cacert);
 495
 496  if(ca_info_blob && verifypeer) {
 497#ifdef MBEDTLS_PEM_PARSE_C
 498    /* if DER or a null-terminated PEM process using
 499       mbedtls_x509_crt_parse(). */
 500    if((ssl_cert_type && curl_strequal(ssl_cert_type, "DER")) ||
 501       ((char *)(ca_info_blob->data))[ca_info_blob->len - 1] == '\0') {
 502      ret = mbedtls_x509_crt_parse(&backend->cacert, ca_info_blob->data,
 503                                   ca_info_blob->len);
 504    }
 505    else { /* they say it is PEM and it is not null-terminated */
 506
 507      /* Unfortunately, mbedtls_x509_crt_parse() requires the data to be
 508         null-terminated if the data is PEM encoded (even when provided the
 509         exact length). The function accepts PEM or DER formats, but we cannot
 510         assume if the user passed in a PEM format cert that it is
 511         null-terminated. */
 512      unsigned char *newblob = curlx_memdup0(ca_info_blob->data,
 513                                             ca_info_blob->len);
 514      if(!newblob)
 515        return CURLE_OUT_OF_MEMORY;
 516
 517      ret = mbedtls_x509_crt_parse(&backend->cacert, newblob,
 518                                   ca_info_blob->len + 1);
 519      curlx_free(newblob);
 520    }
 521#else
 522    /* DER encoded certs do not need to be null-terminated because it is a
 523       binary format. Thus, if we are not compiling with PEM_PARSE we can avoid
 524       the extra memory copies altogether. */
 525    ret = mbedtls_x509_crt_parse_der(&backend->cacert, ca_info_blob->data,
 526                                     ca_info_blob->len);
 527#endif
 528
 529    if(ret < 0) {
 530      mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
 531      failf(data, "mbedTLS: error importing CA cert blob: (-0x%04X) %s",
 532            -ret, errorbuf);
 533      return CURLE_SSL_CERTPROBLEM;
 534    }
 535  }
 536
 537  if(ssl_cafile && verifypeer) {
 538#ifdef MBEDTLS_FS_IO
 539    ret = mbedtls_x509_crt_parse_file(&backend->cacert, ssl_cafile);
 540
 541    if(ret < 0) {
 542      mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
 543      failf(data, "mbedTLS: error reading CA cert file %s: (-0x%04X) %s",
 544            ssl_cafile, -ret, errorbuf);
 545      return CURLE_SSL_CACERT_BADFILE;
 546    }
 547#else
 548    failf(data, "mbedTLS: functions that use the file system not built in");
 549    return CURLE_NOT_BUILT_IN;
 550#endif
 551  }
 552
 553  if(ssl_capath) {
 554#ifdef MBEDTLS_FS_IO
 555    ret = mbedtls_x509_crt_parse_path(&backend->cacert, ssl_capath);
 556
 557    if(ret < 0) {
 558      mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
 559      failf(data, "mbedTLS: error reading CA cert path %s: (-0x%04X) %s",
 560            ssl_capath, -ret, errorbuf);
 561
 562      if(verifypeer)
 563        return CURLE_SSL_CACERT_BADFILE;
 564    }
 565#else
 566    failf(data, "mbedTLS: functions that use the file system not built in");
 567    return CURLE_NOT_BUILT_IN;
 568#endif
 569  }
 570
 571  return CURLE_OK;
 572}
 573
 574static CURLcode mbed_load_clicert(struct Curl_cfilter *cf,
 575                                  struct Curl_easy *data)
 576{
 577  struct ssl_connect_data *connssl = cf->ctx;
 578  struct mbed_ssl_backend_data *backend =
 579    (struct mbed_ssl_backend_data *)connssl->backend;
 580  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
 581  char * const ssl_cert = ssl_config->primary.clientcert;
 582  const struct curl_blob *ssl_cert_blob = ssl_config->primary.cert_blob;
 583#ifdef MBEDTLS_PEM_PARSE_C
 584  const char * const ssl_cert_type = ssl_config->cert_type;
 585#endif
 586  int ret = -1;
 587  char errorbuf[128];
 588
 589  mbedtls_x509_crt_init(&backend->clicert);
 590
 591  if(ssl_cert) {
 592#ifdef MBEDTLS_FS_IO
 593    ret = mbedtls_x509_crt_parse_file(&backend->clicert, ssl_cert);
 594
 595    if(ret) {
 596      mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
 597      failf(data, "mbedTLS: error reading client cert file %s: (-0x%04X) %s",
 598            ssl_cert, -ret, errorbuf);
 599
 600      return CURLE_SSL_CERTPROBLEM;
 601    }
 602#else
 603    failf(data, "mbedTLS: functions that use the file system not built in");
 604    return CURLE_NOT_BUILT_IN;
 605#endif
 606  }
 607
 608  if(ssl_cert_blob) {
 609#ifdef MBEDTLS_PEM_PARSE_C
 610    /* if DER or a null-terminated PEM process using
 611       mbedtls_x509_crt_parse(). */
 612    if((ssl_cert_type && curl_strequal(ssl_cert_type, "DER")) ||
 613       ((char *)(ssl_cert_blob->data))[ssl_cert_blob->len - 1] == '\0') {
 614
 615      ret = mbedtls_x509_crt_parse(&backend->clicert,
 616                                   ssl_cert_blob->data,
 617                                   ssl_cert_blob->len);
 618    }
 619    else { /* they say it is PEM and it is not null-terminated */
 620
 621      /* Unfortunately, mbedtls_x509_crt_parse() requires the data to be
 622         null-terminated if the data is PEM encoded (even when provided the
 623         exact length). The function accepts PEM or DER formats, but we cannot
 624         assume if the user passed in a PEM format cert that it is
 625         null-terminated. */
 626      unsigned char *newblob = curlx_memdup0(ssl_cert_blob->data,
 627                                             ssl_cert_blob->len);
 628      if(!newblob)
 629        return CURLE_OUT_OF_MEMORY;
 630      ret = mbedtls_x509_crt_parse(&backend->clicert, newblob,
 631                                   ssl_cert_blob->len + 1);
 632      curlx_free(newblob);
 633    }
 634#else
 635    /* DER encoded certs do not need to be null-terminated because it is a
 636       binary format. Thus, if we are not compiling with PEM_PARSE we can avoid
 637       the extra memory copies altogether. */
 638    ret = mbedtls_x509_crt_parse_der(&backend->clicert, ssl_cert_blob->data,
 639                                     ssl_cert_blob->len);
 640#endif
 641
 642    if(ret) {
 643      mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
 644      failf(data, "mbedTLS: error reading client cert blob: (-0x%04X) %s",
 645            -ret, errorbuf);
 646      return CURLE_SSL_CERTPROBLEM;
 647    }
 648  }
 649
 650  return CURLE_OK;
 651}
 652
 653static CURLcode mbed_load_privkey(struct Curl_cfilter *cf,
 654                                  struct Curl_easy *data)
 655{
 656  struct ssl_connect_data *connssl = cf->ctx;
 657  struct mbed_ssl_backend_data *backend =
 658    (struct mbed_ssl_backend_data *)connssl->backend;
 659  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
 660  int ret = -1;
 661  char errorbuf[128];
 662
 663  mbedtls_pk_init(&backend->pk);
 664
 665  if(ssl_config->key || ssl_config->key_blob) {
 666    if(ssl_config->key) {
 667#ifdef MBEDTLS_FS_IO
 668#if MBEDTLS_VERSION_NUMBER >= 0x04000000
 669      ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
 670                                     ssl_config->key_passwd);
 671      if(ret == 0 &&
 672         !(mbedtls_pk_can_do_psa(&backend->pk,
 673                                 PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_ANY_HASH),
 674                                 PSA_KEY_USAGE_SIGN_HASH) ||
 675           mbedtls_pk_can_do_psa(&backend->pk,
 676                                 MBEDTLS_PK_ALG_ECDSA(PSA_ALG_ANY_HASH),
 677                                 PSA_KEY_USAGE_SIGN_HASH)))
 678        ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
 679#else
 680      ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
 681                                     ssl_config->key_passwd,
 682                                     mbedtls_ctr_drbg_random,
 683                                     &rng.drbg);
 684      if(ret == 0 && !(mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_RSA) ||
 685                       mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_ECKEY)))
 686        ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
 687#endif
 688
 689      if(ret) {
 690        mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
 691        failf(data, "mbedTLS: error reading private key %s: (-0x%04X) %s",
 692              ssl_config->key, -ret, errorbuf);
 693        return CURLE_SSL_CERTPROBLEM;
 694      }
 695#else
 696      failf(data, "mbedTLS: functions that use the file system not built in");
 697      return CURLE_NOT_BUILT_IN;
 698#endif
 699    }
 700    else {
 701      const struct curl_blob *ssl_key_blob = ssl_config->key_blob;
 702      const char *passwd = ssl_config->key_passwd;
 703      /* Unfortunately, mbedtls_pk_parse_key() requires the data to be
 704         null-terminated if the data is PEM encoded (even when provided the
 705         exact length). */
 706      unsigned char *newblob = curlx_memdup0(ssl_key_blob->data,
 707                                             ssl_key_blob->len);
 708      if(!newblob)
 709        return CURLE_OUT_OF_MEMORY;
 710
 711#if MBEDTLS_VERSION_NUMBER >= 0x04000000
 712      ret = mbedtls_pk_parse_key(&backend->pk, newblob, ssl_key_blob->len,
 713                                 (const unsigned char *)passwd,
 714                                 passwd ? strlen(passwd) : 0);
 715      if(ret == 0 &&
 716         !(mbedtls_pk_can_do_psa(&backend->pk,
 717                                 PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_ANY_HASH),
 718                                 PSA_KEY_USAGE_SIGN_HASH) ||
 719           mbedtls_pk_can_do_psa(&backend->pk,
 720                                 MBEDTLS_PK_ALG_ECDSA(PSA_ALG_ANY_HASH),
 721                                 PSA_KEY_USAGE_SIGN_HASH)))
 722        ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
 723#else
 724      ret = mbedtls_pk_parse_key(&backend->pk, newblob, ssl_key_blob->len,
 725                                 (const unsigned char *)passwd,
 726                                 passwd ? strlen(passwd) : 0,
 727                                 mbedtls_ctr_drbg_random,
 728                                 &rng.drbg);
 729      if(ret == 0 && !(mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_RSA) ||
 730                       mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_ECKEY)))
 731        ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
 732#endif
 733      curlx_free(newblob);
 734
 735      if(ret) {
 736        mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
 737        failf(data, "mbedTLS: error parsing private key: (-0x%04X) %s",
 738              -ret, errorbuf);
 739        return CURLE_SSL_CERTPROBLEM;
 740      }
 741    }
 742  }
 743
 744  return CURLE_OK;
 745}
 746
 747static CURLcode mbed_load_crl(struct Curl_cfilter *cf,
 748                               struct Curl_easy *data)
 749{
 750  struct ssl_connect_data *connssl = cf->ctx;
 751  struct mbed_ssl_backend_data *backend =
 752    (struct mbed_ssl_backend_data *)connssl->backend;
 753  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
 754  const char * const ssl_crlfile = ssl_config->primary.CRLfile;
 755
 756#ifdef MBEDTLS_X509_CRL_PARSE_C
 757  mbedtls_x509_crl_init(&backend->crl);
 758
 759  if(ssl_crlfile) {
 760    char errorbuf[128];
 761#ifdef MBEDTLS_FS_IO
 762    int ret = mbedtls_x509_crl_parse_file(&backend->crl, ssl_crlfile);
 763
 764    if(ret) {
 765      mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
 766      failf(data, "mbedTLS: error reading CRL file %s: (-0x%04X) %s",
 767            ssl_crlfile, -ret, errorbuf);
 768
 769      return CURLE_SSL_CRL_BADFILE;
 770    }
 771#else
 772    (void)errorbuf;
 773    failf(data, "mbedTLS: functions that use the file system not built in");
 774    return CURLE_NOT_BUILT_IN;
 775#endif
 776  }
 777#else
 778  (void)backend;
 779  if(ssl_crlfile) {
 780    failf(data, "mbedTLS: CRL support not built in");
 781    return CURLE_NOT_BUILT_IN;
 782  }
 783#endif
 784
 785  return CURLE_OK;
 786}
 787
 788static CURLcode mbed_configure_ssl(struct Curl_cfilter *cf,
 789                                   struct Curl_easy *data)
 790{
 791  struct ssl_connect_data *connssl = cf->ctx;
 792  struct mbed_ssl_backend_data *backend =
 793    (struct mbed_ssl_backend_data *)connssl->backend;
 794  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
 795  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
 796  int ret;
 797  CURLcode result;
 798  char errorbuf[128];
 799
 800  infof(data, "mbedTLS: Connecting to %s:%d",
 801        connssl->peer.dest->hostname, connssl->peer.dest->port);
 802
 803  mbedtls_ssl_config_init(&backend->config);
 804  ret = mbedtls_ssl_config_defaults(&backend->config,
 805                                    MBEDTLS_SSL_IS_CLIENT,
 806                                    MBEDTLS_SSL_TRANSPORT_STREAM,
 807                                    MBEDTLS_SSL_PRESET_DEFAULT);
 808  if(ret) {
 809    failf(data, "mbedTLS: ssl_config failed");
 810    return CURLE_SSL_CONNECT_ERROR;
 811  }
 812
 813#ifdef MBEDTLS_DEBUG
 814  /* In order to make that work in mbedtls MBEDTLS_DEBUG_C must be defined. */
 815  mbedtls_ssl_conf_dbg(&backend->config, mbed_debug, data);
 816  /* - 0 No debug
 817   * - 1 Error
 818   * - 2 State change
 819   * - 3 Informational
 820   * - 4 Verbose
 821   */
 822  mbedtls_debug_set_threshold(4);
 823#endif
 824
 825#if defined(MBEDTLS_SSL_SESSION_TICKETS) && \
 826  defined(MBEDTLS_SSL_PROTO_TLS1_3) &&      \
 827  MBEDTLS_VERSION_NUMBER >= 0x03060100 &&   \
 828  MBEDTLS_VERSION_NUMBER < 0x04000000
 829  /* New in mbedTLS 3.6.1, need to enable, default is now disabled. 4.0.0
 830     enabled it by default for TLSv1.3. */
 831  mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(
 832    &backend->config, MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED);
 833#endif
 834
 835  /* Always let mbedTLS verify certificates, if verifypeer or verifyhost are
 836   * disabled we clear the corresponding error flags in the verify callback
 837   * function. That is also where we log verification errors. */
 838  mbedtls_ssl_conf_verify(&backend->config, mbed_verify_cb, cf);
 839  mbedtls_ssl_conf_authmode(&backend->config, MBEDTLS_SSL_VERIFY_REQUIRED);
 840
 841  mbedtls_ssl_init(&backend->ssl);
 842  backend->initialized = TRUE;
 843
 844  /* use the default secure profile baked into mbedTLS */
 845  mbedtls_ssl_conf_cert_profile(&backend->config,
 846                                &mbedtls_x509_crt_profile_next);
 847
 848  result = mbed_set_ssl_version_min_max(data, backend, conn_config);
 849  if(result)
 850    return result;
 851
 852#if MBEDTLS_VERSION_NUMBER < 0x04000000
 853  mbedtls_ssl_conf_rng(&backend->config, mbedtls_ctr_drbg_random,
 854                       &rng.drbg);
 855#endif
 856
 857  ret = mbedtls_ssl_setup(&backend->ssl,
 858                          &backend->config);
 859  if(ret) {
 860    mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
 861    failf(data, "mbedTLS: ssl_setup failed: "
 862          "(-0x%04X) %s", -ret, errorbuf);
 863    return CURLE_SSL_CONNECT_ERROR;
 864  }
 865
 866  mbedtls_ssl_set_bio(&backend->ssl, cf,
 867                      mbedtls_bio_cf_write,
 868                      mbedtls_bio_cf_read,
 869                      NULL /*  rev_timeout() */);
 870
 871#ifndef MBEDTLS_SSL_PROTO_TLS1_3
 872  if(conn_config->cipher_list) {
 873    result = mbed_set_selected_ciphers(data, backend,
 874                                       conn_config->cipher_list, NULL);
 875#else
 876  if(conn_config->cipher_list || conn_config->cipher_list13) {
 877    result = mbed_set_selected_ciphers(data, backend,
 878                                       conn_config->cipher_list,
 879                                       conn_config->cipher_list13);
 880#endif
 881    if(result) {
 882      failf(data, "mbedTLS: failed to set cipher suites");
 883      return result;
 884    }
 885  }
 886  else {
 887    mbedtls_ssl_conf_ciphersuites(&backend->config,
 888                                  mbedtls_ssl_list_ciphersuites());
 889  }
 890
 891#ifdef MBEDTLS_SSL_RENEGOTIATION
 892  mbedtls_ssl_conf_renegotiation(&backend->config,
 893                                 MBEDTLS_SSL_RENEGOTIATION_ENABLED);
 894#endif
 895
 896#ifdef MBEDTLS_SSL_SESSION_TICKETS
 897  mbedtls_ssl_conf_session_tickets(&backend->config,
 898                                   MBEDTLS_SSL_SESSION_TICKETS_DISABLED);
 899#endif
 900
 901  /* Check if there is a cached ID we can/should use here! */
 902  if(Curl_ssl_scache_use(cf, data)) {
 903    struct Curl_ssl_session *sc_session = NULL;
 904    CURLcode sresult = Curl_ssl_scache_take(cf, data, connssl->peer.scache_key,
 905                                            &sc_session);
 906    if(!sresult && sc_session && sc_session->sdata && sc_session->sdata_len) {
 907      mbedtls_ssl_session session;
 908
 909      mbedtls_ssl_session_init(&session);
 910      ret = mbedtls_ssl_session_load(&session, sc_session->sdata,
 911                                     sc_session->sdata_len);
 912      if(ret) {
 913        failf(data, "SSL session error loading: -0x%x", -ret);
 914      }
 915      else {
 916        ret = mbedtls_ssl_set_session(&backend->ssl, &session);
 917        if(ret)
 918          failf(data, "SSL session error setting: -0x%x", -ret);
 919        else
 920          infof(data, "SSL reusing session ID");
 921      }
 922      mbedtls_ssl_session_free(&session);
 923    }
 924    Curl_ssl_scache_return(cf, data, connssl->peer.scache_key,
 925                           sc_session);
 926  }
 927
 928  mbedtls_ssl_conf_ca_chain(&backend->config, &backend->cacert,
 929#ifdef MBEDTLS_X509_CRL_PARSE_C
 930                            &backend->crl
 931#else
 932                            NULL
 933#endif
 934    );
 935
 936  if(ssl_config->key || ssl_config->key_blob) {
 937    mbedtls_ssl_conf_own_cert(&backend->config, &backend->clicert,
 938                              &backend->pk);
 939  }
 940
 941  if(mbedtls_ssl_set_hostname(&backend->ssl, connssl->peer.sni ?
 942                              connssl->peer.sni :
 943                              connssl->peer.dest->hostname)) {
 944    /* mbedtls_ssl_set_hostname() sets the name to use in CN/SAN checks and
 945       the name to set in the SNI extension. Thus even if curl connects to
 946       a host specified as an IP address, this function must be used. */
 947    failf(data, "Failed to set SNI");
 948    return CURLE_SSL_CONNECT_ERROR;
 949  }
 950
 951#ifdef HAS_ALPN_MBEDTLS
 952  if(connssl->alpn) {
 953    struct alpn_proto_buf proto;
 954    size_t i;
 955
 956    for(i = 0; i < connssl->alpn->count; ++i) {
 957      backend->protocols[i] = connssl->alpn->entries[i];
 958    }
 959    /* this function does not clone the protocols array, which is why we need
 960       to keep it around */
 961    if(mbedtls_ssl_conf_alpn_protocols(&backend->config,
 962                                       &backend->protocols[0])) {
 963      failf(data, "Failed setting ALPN protocols");
 964      return CURLE_SSL_CONNECT_ERROR;
 965    }
 966    Curl_alpn_to_proto_str(&proto, connssl->alpn);
 967    infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
 968  }
 969#endif
 970
 971  /* give application a chance to interfere with mbedTLS set up. */
 972  if(data->set.ssl.fsslctx) {
 973    result = (*data->set.ssl.fsslctx)(data, &backend->config,
 974                                      data->set.ssl.fsslctxp);
 975    if(result)
 976      failf(data, "error signaled by ssl ctx callback");
 977  }
 978
 979  return result;
 980}
 981
 982static CURLcode mbed_connect_step1(struct Curl_cfilter *cf,
 983                                   struct Curl_easy *data)
 984{
 985  struct ssl_connect_data *connssl = cf->ctx;
 986  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
 987  CURLcode result;
 988
 989  if((conn_config->version == CURL_SSLVERSION_SSLv2) ||
 990     (conn_config->version == CURL_SSLVERSION_SSLv3)) {
 991    failf(data, "Not supported SSL version");
 992    return CURLE_NOT_BUILT_IN;
 993  }
 994
 995  result = mbed_load_cacert(cf, data);
 996  if(!result)
 997    result = mbed_load_clicert(cf, data);
 998  if(!result)
 999    result = mbed_load_privkey(cf, data);
1000  if(!result)
1001    result = mbed_load_crl(cf, data);
1002  if(!result)
1003    result = mbed_configure_ssl(cf, data);
1004  if(result)
1005    return result;
1006
1007  connssl->connecting_state = ssl_connect_2;
1008  return CURLE_OK;
1009}
1010
1011#if defined(MBEDTLS_PK_WRITE_C) && defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
1012#define HAVE_PINNED_PUBKEY
1013#endif
1014
1015static CURLcode mbed_connect_step2(struct Curl_cfilter *cf,
1016                                   struct Curl_easy *data)
1017{
1018#if defined(HAVE_PINNED_PUBKEY) || defined(HAS_ALPN_MBEDTLS)
1019  CURLcode result;
1020#endif
1021  int ret;
1022  struct ssl_connect_data *connssl = cf->ctx;
1023  struct mbed_ssl_backend_data *backend =
1024    (struct mbed_ssl_backend_data *)connssl->backend;
1025#ifdef HAVE_PINNED_PUBKEY
1026#ifndef CURL_DISABLE_PROXY
1027  const char * const pinnedpubkey = Curl_ssl_cf_is_proxy(cf) ?
1028    data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
1029    data->set.str[STRING_SSL_PINNEDPUBLICKEY];
1030#else
1031  const char * const pinnedpubkey = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
1032#endif
1033#endif
1034
1035  DEBUGASSERT(backend);
1036
1037  ret = mbedtls_ssl_handshake(&backend->ssl);
1038
1039  if(ret == MBEDTLS_ERR_SSL_WANT_READ) {
1040    connssl->io_need = CURL_SSL_IO_NEED_RECV;
1041    return CURLE_OK;
1042  }
1043  else if(ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
1044    connssl->io_need = CURL_SSL_IO_NEED_SEND;
1045    return CURLE_OK;
1046  }
1047  else if(ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED) {
1048    failf(data, "peer certificate could not be verified");
1049    return CURLE_PEER_FAILED_VERIFICATION;
1050  }
1051  else if(ret) {
1052    char errorbuf[128];
1053    CURL_TRC_CF(data, cf, "TLS version %04X",
1054                mbedtls_ssl_get_version_number(&backend->ssl));
1055    mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
1056    failf(data, "ssl_handshake returned: (-0x%04X) %s",
1057          -ret, errorbuf);
1058    return CURLE_SSL_CONNECT_ERROR;
1059  }
1060
1061  {
1062    char cipher_str[64];
1063    uint16_t cipher_id;
1064    cipher_id =
1065      (uint16_t)mbedtls_ssl_get_ciphersuite_id_from_ssl(&backend->ssl);
1066    mbed_cipher_suite_get_str(cipher_id, cipher_str, sizeof(cipher_str), TRUE);
1067    infof(data, "mbedTLS: %s Handshake complete, cipher is %s",
1068          mbedtls_ssl_get_version(&backend->ssl), cipher_str);
1069  }
1070
1071#ifdef HAVE_PINNED_PUBKEY
1072  if(pinnedpubkey) {
1073    int size;
1074    const mbedtls_x509_crt *peercert;
1075    mbedtls_x509_crt *p = NULL;
1076    unsigned char *pubkey = NULL;
1077
1078    peercert = mbedtls_ssl_get_peer_cert(&backend->ssl);
1079    if(!peercert || !peercert->raw.p || !peercert->raw.len) {
1080      failf(data, "Failed due to missing peer certificate");
1081      return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
1082    }
1083
1084    p = curlx_calloc(1, sizeof(*p));
1085
1086    if(!p)
1087      return CURLE_OUT_OF_MEMORY;
1088
1089    pubkey = curlx_malloc(PUB_DER_MAX_BYTES);
1090
1091    if(!pubkey) {
1092      result = CURLE_OUT_OF_MEMORY;
1093      goto pinnedpubkey_error;
1094    }
1095
1096    mbedtls_x509_crt_init(p);
1097
1098    /* Make a copy of our const peercert because mbedtls_pk_write_pubkey_der
1099       needs a non-const key, for now.
1100       https://github.com/Mbed-TLS/mbedtls/issues/396 */
1101    if(mbedtls_x509_crt_parse_der(p, peercert->raw.p, peercert->raw.len)) {
1102      failf(data, "Failed copying peer certificate");
1103      result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
1104      goto pinnedpubkey_error;
1105    }
1106
1107    size = mbedtls_pk_write_pubkey_der(&p->pk, pubkey, PUB_DER_MAX_BYTES);
1108
1109    if(size <= 0) {
1110      failf(data, "Failed copying public key from peer certificate");
1111      result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
1112      goto pinnedpubkey_error;
1113    }
1114
1115    /* mbedtls_pk_write_pubkey_der writes data at the end of the buffer. */
1116    result = Curl_pin_peer_pubkey(data,
1117                                  pinnedpubkey,
1118                                  &pubkey[PUB_DER_MAX_BYTES - size], size);
1119pinnedpubkey_error:
1120    mbedtls_x509_crt_free(p);
1121    curlx_free(p);
1122    curlx_free(pubkey);
1123    if(result)
1124      return result;
1125  }
1126#endif
1127
1128#ifdef HAS_ALPN_MBEDTLS
1129  if(connssl->alpn) {
1130    const char *proto = mbedtls_ssl_get_alpn_protocol(&backend->ssl);
1131
1132    result = Curl_alpn_set_negotiated(cf, data, connssl,
1133                                      (const unsigned char *)proto,
1134                                      proto ? strlen(proto) : 0);
1135    if(result)
1136      return result;
1137  }
1138#endif
1139
1140  connssl->connecting_state = ssl_connect_3;
1141  infof(data, "SSL connected");
1142
1143  return CURLE_OK;
1144}
1145
1146static CURLcode mbed_new_session(struct Curl_cfilter *cf,
1147                                 struct Curl_easy *data)
1148{
1149  struct ssl_connect_data *connssl = cf->ctx;
1150  struct mbed_ssl_backend_data *backend =
1151    (struct mbed_ssl_backend_data *)connssl->backend;
1152  mbedtls_ssl_session session;
1153  bool msession_alloced = FALSE;
1154  struct Curl_ssl_session *sc_session = NULL;
1155  unsigned char *sdata = NULL;
1156  size_t slen = 0;
1157  int ietf_tls_id;
1158  CURLcode result = CURLE_OK;
1159  int ret;
1160
1161  DEBUGASSERT(backend);
1162  if(!Curl_ssl_scache_use(cf, data))
1163    return CURLE_OK;
1164
1165  mbedtls_ssl_session_init(&session);
1166  ret = mbedtls_ssl_get_session(&backend->ssl, &session);
1167  msession_alloced = (ret != MBEDTLS_ERR_SSL_ALLOC_FAILED);
1168  if(ret) {
1169    failf(data, "mbedtls_ssl_get_session returned -0x%x", -ret);
1170    result = CURLE_SSL_CONNECT_ERROR;
1171    goto out;
1172  }
1173
1174  mbedtls_ssl_session_save(&session, NULL, 0, &slen);
1175  if(!slen) {
1176    failf(data, "failed to serialize session: length is 0");
1177    goto out;
1178  }
1179
1180  sdata = curlx_malloc(slen);
1181  if(!sdata) {
1182    result = CURLE_OUT_OF_MEMORY;
1183    goto out;
1184  }
1185
1186  ret = mbedtls_ssl_session_save(&session, sdata, slen, &slen);
1187  if(ret) {
1188    failf(data, "failed to serialize session: -0x%x", -ret);
1189    goto out;
1190  }
1191
1192  ietf_tls_id = mbedtls_ssl_get_version_number(&backend->ssl);
1193  result = Curl_ssl_session_create(sdata, slen,
1194                                   ietf_tls_id,
1195                                   connssl->negotiated.alpn, 0, 0,
1196                                   &sc_session);
1197  sdata = NULL;  /* call took ownership */
1198  if(!result)
1199    result = Curl_ssl_scache_put(cf, data, connssl->peer.scache_key,
1200                                 sc_session);
1201
1202out:
1203  if(msession_alloced)
1204    mbedtls_ssl_session_free(&session);
1205  curlx_free(sdata);
1206  return result;
1207}
1208
1209static CURLcode mbed_send(struct Curl_cfilter *cf, struct Curl_easy *data,
1210                          const void *mem, size_t len, size_t *pnwritten)
1211{
1212  struct ssl_connect_data *connssl = cf->ctx;
1213  struct mbed_ssl_backend_data *backend =
1214    (struct mbed_ssl_backend_data *)connssl->backend;
1215  CURLcode result = CURLE_OK;
1216  int nwritten;
1217
1218  DEBUGASSERT(backend);
1219  *pnwritten = 0;
1220  connssl->io_need = CURL_SSL_IO_NEED_NONE;
1221  /* mbedTLS is picky when a mbedtls_ssl_write() was previously blocked.
1222   * It requires to be called with the same amount of bytes again, or it
1223   * loses bytes, e.g. reporting all was sent but they were not.
1224   * Remember the blocked length and use that when set. */
1225  if(backend->send_blocked) {
1226    DEBUGASSERT(backend->send_blocked_len <= len);
1227    CURL_TRC_CF(data, cf, "mbedtls_ssl_write(len=%zu) -> previously blocked "
1228                "on %zu bytes", len, backend->send_blocked_len);
1229    len = backend->send_blocked_len;
1230  }
1231
1232  nwritten = mbedtls_ssl_write(&backend->ssl, (const unsigned char *)mem, len);
1233
1234  if(nwritten >= 0) {
1235    *pnwritten = (size_t)nwritten;
1236    backend->send_blocked = FALSE;
1237  }
1238  else {
1239    CURL_TRC_CF(data, cf, "mbedtls_ssl_write(len=%zu) -> -0x%04X",
1240                len, -nwritten);
1241    switch(nwritten) {
1242#ifdef MBEDTLS_SSL_PROTO_TLS1_3
1243    case MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET:
1244#endif
1245    case MBEDTLS_ERR_SSL_WANT_READ:
1246      connssl->io_need = CURL_SSL_IO_NEED_RECV;
1247      result = CURLE_AGAIN;
1248      break;
1249    case MBEDTLS_ERR_SSL_WANT_WRITE:
1250      connssl->io_need = CURL_SSL_IO_NEED_SEND;
1251      result = CURLE_AGAIN;
1252      break;
1253    default:
1254      result = CURLE_SEND_ERROR;
1255      break;
1256    }
1257    if((result == CURLE_AGAIN) && !backend->send_blocked) {
1258      backend->send_blocked = TRUE;
1259      backend->send_blocked_len = len;
1260    }
1261  }
1262
1263  CURL_TRC_CF(data, cf, "mbedtls_ssl_write(len=%zu) -> %d, %zu",
1264              len, result, *pnwritten);
1265  return result;
1266}
1267
1268static CURLcode mbedtls_shutdown(struct Curl_cfilter *cf,
1269                                 struct Curl_easy *data,
1270                                 bool send_shutdown, bool *done)
1271{
1272  struct ssl_connect_data *connssl = cf->ctx;
1273  struct mbed_ssl_backend_data *backend =
1274    (struct mbed_ssl_backend_data *)connssl->backend;
1275  unsigned char buf[1024];
1276  CURLcode result = CURLE_OK;
1277  int ret = 0;
1278  size_t i;
1279
1280  DEBUGASSERT(backend);
1281
1282  if(!backend->initialized || cf->shutdown) {
1283    *done = TRUE;
1284    return CURLE_OK;
1285  }
1286
1287  connssl->io_need = CURL_SSL_IO_NEED_NONE;
1288  *done = FALSE;
1289
1290  if(!backend->sent_shutdown) {
1291    /* do this only once */
1292    backend->sent_shutdown = TRUE;
1293    if(send_shutdown) {
1294      ret = mbedtls_ssl_close_notify(&backend->ssl);
1295      switch(ret) {
1296      case 0: /* we sent it, receive from the server */
1297        break;
1298      case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: /* server also closed */
1299        *done = TRUE;
1300        goto out;
1301      case MBEDTLS_ERR_SSL_WANT_READ:
1302        connssl->io_need = CURL_SSL_IO_NEED_RECV;
1303        goto out;
1304      case MBEDTLS_ERR_SSL_WANT_WRITE:
1305        connssl->io_need = CURL_SSL_IO_NEED_SEND;
1306        goto out;
1307      default:
1308        CURL_TRC_CF(data, cf, "mbedtls_shutdown error -0x%04X", -ret);
1309        result = CURLE_RECV_ERROR;
1310        goto out;
1311      }
1312    }
1313  }
1314
1315  /* SSL should now have started the shutdown from our side. Since it
1316   * was not complete, we are lacking the close notify from the server. */
1317  for(i = 0; i < 10; ++i) {
1318    ret = mbedtls_ssl_read(&backend->ssl, buf, sizeof(buf));
1319    /* This seems to be a bug in mbedTLS TLSv1.3 where it reports
1320     * WANT_READ, but has not encountered an EAGAIN. */
1321    if(ret == MBEDTLS_ERR_SSL_WANT_READ)
1322      ret = mbedtls_ssl_read(&backend->ssl, buf, sizeof(buf));
1323#ifdef MBEDTLS_SSL_PROTO_TLS1_3
1324    if(ret == MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET)
1325      continue;
1326#endif
1327    if(ret <= 0)
1328      break;
1329  }
1330
1331  if(ret > 0) {
1332    /* still data coming in? */
1333    CURL_TRC_CF(data, cf, "mbedtls_shutdown, still getting data");
1334  }
1335  else if(ret == 0 || (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY)) {
1336    /* We got the close notify alert and are done. */
1337    CURL_TRC_CF(data, cf, "mbedtls_shutdown done");
1338    *done = TRUE;
1339  }
1340  else if(ret == MBEDTLS_ERR_SSL_WANT_READ) {
1341    CURL_TRC_CF(data, cf, "mbedtls_shutdown, need RECV");
1342    connssl->io_need = CURL_SSL_IO_NEED_RECV;
1343  }
1344  else if(ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
1345    CURL_TRC_CF(data, cf, "mbedtls_shutdown, need SEND");
1346    connssl->io_need = CURL_SSL_IO_NEED_SEND;
1347  }
1348  else {
1349    CURL_TRC_CF(data, cf, "mbedtls_shutdown error -0x%04X", -ret);
1350    result = CURLE_RECV_ERROR;
1351  }
1352
1353out:
1354  cf->shutdown = (result || *done);
1355  return result;
1356}
1357
1358static void mbedtls_close(struct Curl_cfilter *cf, struct Curl_easy *data)
1359{
1360  struct ssl_connect_data *connssl = cf->ctx;
1361  struct mbed_ssl_backend_data *backend =
1362    (struct mbed_ssl_backend_data *)connssl->backend;
1363
1364  (void)data;
1365  DEBUGASSERT(backend);
1366  mbedtls_pk_free(&backend->pk);
1367  mbedtls_x509_crt_free(&backend->clicert);
1368  mbedtls_x509_crt_free(&backend->cacert);
1369#ifdef MBEDTLS_X509_CRL_PARSE_C
1370  mbedtls_x509_crl_free(&backend->crl);
1371#endif
1372  curlx_safefree(backend->ciphersuites);
1373  mbedtls_ssl_config_free(&backend->config);
1374  if(backend->initialized) {
1375    mbedtls_ssl_free(&backend->ssl);
1376    backend->initialized = FALSE;
1377  }
1378}
1379
1380static CURLcode mbed_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
1381                          char *buf, size_t buffersize, size_t *pnread)
1382{
1383  struct ssl_connect_data *connssl = cf->ctx;
1384  struct mbed_ssl_backend_data *backend =
1385    (struct mbed_ssl_backend_data *)connssl->backend;
1386  CURLcode result = CURLE_OK;
1387  int nread;
1388
1389  DEBUGASSERT(backend);
1390  *pnread = 0;
1391  connssl->io_need = CURL_SSL_IO_NEED_NONE;
1392
1393  nread = mbedtls_ssl_read(&backend->ssl, (unsigned char *)buf, buffersize);
1394  if(nread > 0)
1395    *pnread = (size_t)nread;
1396  else {
1397    char errorbuf[128];
1398    CURL_TRC_CF(data, cf, "mbedtls_ssl_read(len=%zu) -> -0x%04X",
1399                buffersize, -nread);
1400    switch(nread) {
1401#ifdef MBEDTLS_SSL_SESSION_TICKETS
1402    case MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET:
1403      mbed_new_session(cf, data);
1404      FALLTHROUGH();
1405#endif
1406    case MBEDTLS_ERR_SSL_WANT_READ:
1407      connssl->io_need = CURL_SSL_IO_NEED_RECV;
1408      result = CURLE_AGAIN;
1409      break;
1410    case MBEDTLS_ERR_SSL_WANT_WRITE:
1411      connssl->io_need = CURL_SSL_IO_NEED_SEND;
1412      result = CURLE_AGAIN;
1413      break;
1414    case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
1415      result = CURLE_OK;
1416      break;
1417    default:
1418      mbedtls_strerror(nread, errorbuf, sizeof(errorbuf));
1419      failf(data, "ssl_read returned: (-0x%04X) %s", -nread, errorbuf);
1420      result = CURLE_RECV_ERROR;
1421      break;
1422    }
1423  }
1424  return result;
1425}
1426
1427static size_t mbedtls_version(char *buffer, size_t size)
1428{
1429#ifdef MBEDTLS_VERSION_C
1430  /* if mbedtls_version_get_number() is available it is better */
1431  unsigned int version = mbedtls_version_get_number();
1432  return curl_msnprintf(buffer, size, "mbedTLS/%u.%u.%u", version >> 24,
1433                        (version >> 16) & 0xff, (version >> 8) & 0xff);
1434#else
1435  return curl_msnprintf(buffer, size, "mbedTLS/%s", MBEDTLS_VERSION_STRING);
1436#endif
1437}
1438
1439/* 'data' might be NULL */
1440static CURLcode mbedtls_random(struct Curl_easy *data,
1441                               unsigned char *entropy, size_t length)
1442{
1443  psa_status_t status;
1444  (void)data;
1445
1446  status = psa_generate_random(entropy, length);
1447
1448  return status == PSA_SUCCESS ? CURLE_OK : CURLE_FAILED_INIT;
1449}
1450
1451static CURLcode mbedtls_connect(struct Curl_cfilter *cf,
1452                                struct Curl_easy *data,
1453                                bool *done)
1454{
1455  CURLcode result;
1456  struct ssl_connect_data *connssl = cf->ctx;
1457
1458  /* check if the connection has already been established */
1459  if(ssl_connection_complete == connssl->state) {
1460    *done = TRUE;
1461    return CURLE_OK;
1462  }
1463
1464  *done = FALSE;
1465  connssl->io_need = CURL_SSL_IO_NEED_NONE;
1466
1467  if(ssl_connect_1 == connssl->connecting_state) {
1468    result = mbed_connect_step1(cf, data);
1469    if(result)
1470      return result;
1471  }
1472
1473  if(ssl_connect_2 == connssl->connecting_state) {
1474    result = mbed_connect_step2(cf, data);
1475    if(result)
1476      return result;
1477  }
1478
1479  if(ssl_connect_3 == connssl->connecting_state) {
1480    /* For tls1.3 we get notified about new sessions */
1481    struct ssl_connect_data *ctx = cf->ctx;
1482    struct mbed_ssl_backend_data *backend =
1483      (struct mbed_ssl_backend_data *)ctx->backend;
1484
1485    if(mbedtls_ssl_get_version_number(&backend->ssl) <=
1486       MBEDTLS_SSL_VERSION_TLS1_2) {
1487      result = mbed_new_session(cf, data);
1488      if(result)
1489        return result;
1490    }
1491    connssl->connecting_state = ssl_connect_done;
1492  }
1493
1494  if(ssl_connect_done == connssl->connecting_state) {
1495    connssl->state = ssl_connection_complete;
1496    *done = TRUE;
1497  }
1498
1499  return CURLE_OK;
1500}
1501
1502/*
1503 * return 0 error initializing SSL
1504 * return 1 SSL initialized successfully
1505 */
1506static int mbedtls_init(void)
1507{
1508#if MBEDTLS_VERSION_NUMBER < 0x04000000
1509  int ret = 0;
1510#endif
1511  psa_status_t status;
1512  status = psa_crypto_init();
1513
1514  if(status != PSA_SUCCESS)
1515    return 0;
1516
1517#if MBEDTLS_VERSION_NUMBER < 0x04000000
1518  mbedtls_ctr_drbg_init(&rng.drbg);
1519  mbedtls_entropy_init(&rng.entropy);
1520
1521  ret = mbedtls_ctr_drbg_seed(&rng.drbg, mbedtls_entropy_func, &rng.entropy,
1522                              NULL, 0);
1523
1524  if(ret)
1525    /* mbedtls_ctr_drbg_seed returned error */
1526    return 0;
1527
1528  /* To prevent an adversary from reading your random data,
1529     you can enable prediction resistance.
1530
1531     Entropy is gathered before each mbedtls_ctr_drbg_random() call.
1532     Only use this if you have ample supply of good entropy.*/
1533  mbedtls_ctr_drbg_set_prediction_resistance(&rng.drbg,
1534                                             MBEDTLS_CTR_DRBG_PR_ON);
1535#endif
1536  return 1;
1537}
1538
1539static void mbedtls_cleanup(void)
1540{
1541  mbedtls_psa_crypto_free();
1542
1543#if MBEDTLS_VERSION_NUMBER < 0x04000000
1544  mbedtls_ctr_drbg_free(&rng.drbg);
1545  mbedtls_entropy_free(&rng.entropy);
1546#endif
1547}
1548
1549static bool mbedtls_data_pending(struct Curl_cfilter *cf,
1550                                 const struct Curl_easy *data)
1551{
1552  struct ssl_connect_data *ctx = cf->ctx;
1553  struct mbed_ssl_backend_data *backend;
1554
1555  (void)data;
1556  DEBUGASSERT(ctx && ctx->backend);
1557  backend = (struct mbed_ssl_backend_data *)ctx->backend;
1558  return mbedtls_ssl_get_bytes_avail(&backend->ssl) != 0;
1559}
1560
1561static CURLcode mbedtls_sha256sum(const unsigned char *input,
1562                                  size_t inputlen,
1563                                  unsigned char *sha256sum,
1564                                  size_t sha256len)
1565{
1566#if defined(PSA_WANT_ALG_SHA_256) && PSA_WANT_ALG_SHA_256  /* mbedTLS 4+ */
1567  psa_status_t status;
1568  size_t sha256len_actual;
1569  status = psa_hash_compute(PSA_ALG_SHA_256, input, inputlen,
1570                            sha256sum, sha256len,
1571                            &sha256len_actual);
1572  if(status != PSA_SUCCESS)
1573    return CURLE_BAD_FUNCTION_ARGUMENT;
1574  return CURLE_OK;
1575#else
1576  (void)sha256len;
1577  return Curl_sha256it(sha256sum, input, inputlen);
1578#endif
1579}
1580
1581static void *mbedtls_get_internals(struct ssl_connect_data *connssl,
1582                                   CURLINFO info)
1583{
1584  struct mbed_ssl_backend_data *backend =
1585    (struct mbed_ssl_backend_data *)connssl->backend;
1586  (void)info;
1587  DEBUGASSERT(backend);
1588  return &backend->ssl;
1589}
1590
1591const struct Curl_ssl Curl_ssl_mbedtls = {
1592  { CURLSSLBACKEND_MBEDTLS, "mbedtls" }, /* info */
1593
1594  SSLSUPP_CA_PATH |
1595  SSLSUPP_CAINFO_BLOB |
1596  SSLSUPP_CERTINFO |
1597#ifdef HAVE_PINNED_PUBKEY
1598  SSLSUPP_PINNEDPUBKEY |
1599#endif
1600  SSLSUPP_SSL_CTX |
1601#ifdef MBEDTLS_SSL_PROTO_TLS1_3  /* requires mbedTLS 3.6.0+ */
1602  SSLSUPP_TLS13_CIPHERSUITES |
1603#endif
1604  SSLSUPP_HTTPS_PROXY |
1605  SSLSUPP_CIPHER_LIST |
1606#ifdef MBEDTLS_X509_CRL_PARSE_C
1607  SSLSUPP_CRLFILE |
1608#endif
1609  0,
1610
1611  sizeof(struct mbed_ssl_backend_data),
1612
1613  mbedtls_init,                     /* init */
1614  mbedtls_cleanup,                  /* cleanup */
1615  mbedtls_version,                  /* version */
1616  mbedtls_shutdown,                 /* shutdown */
1617  mbedtls_data_pending,             /* data_pending */
1618  mbedtls_random,                   /* random */
1619  NULL,                             /* cert_status_request */
1620  mbedtls_connect,                  /* connect */
1621  Curl_ssl_adjust_pollset,          /* adjust_pollset */
1622  mbedtls_get_internals,            /* get_internals */
1623  mbedtls_close,                    /* close_one */
1624  NULL,                             /* close_all */
1625  NULL,                             /* set_engine */
1626  NULL,                             /* set_engine_default */
1627  NULL,                             /* engines_list */
1628  mbedtls_sha256sum,                /* sha256sum */
1629  mbed_recv,                        /* recv decrypted data */
1630  mbed_send,                        /* send data to encrypt */
1631  NULL,                             /* get_channel_binding */
1632};
1633
1634#endif /* USE_MBEDTLS */