File: | vtls/curl_darwinssl.c |
Location: | line 138, column 5 |
Description: | Value stored to 'bytesRead' is never read |
1 | /*************************************************************************** |
2 | * _ _ ____ _ |
3 | * Project ___| | | | _ \| | |
4 | * / __| | | | |_) | | |
5 | * | (__| |_| | _ <| |___ |
6 | * \___|\___/|_| \_\_____| |
7 | * |
8 | * Copyright (C) 2012 - 2013, Nick Zitzmann, <nickzman@gmail.com>. |
9 | * Copyright (C) 2012 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al. |
10 | * |
11 | * This software is licensed as described in the file COPYING, which |
12 | * you should have received as part of this distribution. The terms |
13 | * are also available at http://curl.haxx.se/docs/copyright.html. |
14 | * |
15 | * You may opt to use, copy, modify, merge, publish, distribute and/or sell |
16 | * copies of the Software, and permit persons to whom the Software is |
17 | * furnished to do so, under the terms of the COPYING file. |
18 | * |
19 | * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY |
20 | * KIND, either express or implied. |
21 | * |
22 | ***************************************************************************/ |
23 | |
24 | /* |
25 | * Source file for all iOS and Mac OS X SecureTransport-specific code for the |
26 | * TLS/SSL layer. No code but vtls.c should ever call or use these functions. |
27 | */ |
28 | |
29 | #include "curl_setup.h" |
30 | |
31 | #include "urldata.h" /* for the SessionHandle definition */ |
32 | #include "curl_base64.h" |
33 | |
34 | #ifdef USE_DARWINSSL1 |
35 | |
36 | #ifdef HAVE_LIMITS_H1 |
37 | #include <limits.h> |
38 | #endif |
39 | |
40 | #include <Security/Security.h> |
41 | #include <Security/SecureTransport.h> |
42 | #include <CoreFoundation/CoreFoundation.h> |
43 | #include <CommonCrypto/CommonDigest.h> |
44 | |
45 | /* The Security framework has changed greatly between iOS and different OS X |
46 | versions, and we will try to support as many of them as we can (back to |
47 | Leopard and iOS 5) by using macros and weak-linking. |
48 | |
49 | IMPORTANT: If TLS 1.1 and 1.2 support are important for you on OS X, then |
50 | you must build this project against the 10.8 SDK or later. */ |
51 | #if (TARGET_OS_MAC1 && !(TARGET_OS_EMBEDDED0 || TARGET_OS_IPHONE0)) |
52 | |
53 | #if MAC_OS_X_VERSION_MAX_ALLOWED1080 < 1050 |
54 | #error "The darwinssl back-end requires Leopard or later." |
55 | #endif /* MAC_OS_X_VERSION_MAX_ALLOWED < 1050 */ |
56 | |
57 | #define CURL_BUILD_IOS0 0 |
58 | #define CURL_BUILD_IOS_70 0 |
59 | #define CURL_BUILD_MAC1 1 |
60 | /* This is the maximum API level we are allowed to use when building: */ |
61 | #define CURL_BUILD_MAC_10_51080 >= 1050 MAC_OS_X_VERSION_MAX_ALLOWED1080 >= 1050 |
62 | #define CURL_BUILD_MAC_10_61080 >= 1060 MAC_OS_X_VERSION_MAX_ALLOWED1080 >= 1060 |
63 | #define CURL_BUILD_MAC_10_71080 >= 1070 MAC_OS_X_VERSION_MAX_ALLOWED1080 >= 1070 |
64 | #define CURL_BUILD_MAC_10_81080 >= 1080 MAC_OS_X_VERSION_MAX_ALLOWED1080 >= 1080 |
65 | #define CURL_BUILD_MAC_10_91080 >= 1090 MAC_OS_X_VERSION_MAX_ALLOWED1080 >= 1090 |
66 | /* These macros mean "the following code is present to allow runtime backward |
67 | compatibility with at least this cat or earlier": |
68 | (You set this at build-time by setting the MACOSX_DEPLOYMENT_TARGET |
69 | environmental variable.) */ |
70 | #define CURL_SUPPORT_MAC_10_51080 <= 1050 MAC_OS_X_VERSION_MIN_REQUIRED1080 <= 1050 |
71 | #define CURL_SUPPORT_MAC_10_61080 <= 1060 MAC_OS_X_VERSION_MIN_REQUIRED1080 <= 1060 |
72 | #define CURL_SUPPORT_MAC_10_71080 <= 1070 MAC_OS_X_VERSION_MIN_REQUIRED1080 <= 1070 |
73 | #define CURL_SUPPORT_MAC_10_81080 <= 1080 MAC_OS_X_VERSION_MIN_REQUIRED1080 <= 1080 |
74 | #define CURL_SUPPORT_MAC_10_91080 <= 1090 MAC_OS_X_VERSION_MIN_REQUIRED1080 <= 1090 |
75 | |
76 | #elif TARGET_OS_EMBEDDED0 || TARGET_OS_IPHONE0 |
77 | #define CURL_BUILD_IOS0 1 |
78 | #define CURL_BUILD_IOS_70 __IPHONE_OS_VERSION_MAX_ALLOWED >= 70000 |
79 | #define CURL_BUILD_MAC1 0 |
80 | #define CURL_BUILD_MAC_10_51080 >= 1050 0 |
81 | #define CURL_BUILD_MAC_10_61080 >= 1060 0 |
82 | #define CURL_BUILD_MAC_10_71080 >= 1070 0 |
83 | #define CURL_BUILD_MAC_10_81080 >= 1080 0 |
84 | #define CURL_SUPPORT_MAC_10_51080 <= 1050 0 |
85 | #define CURL_SUPPORT_MAC_10_61080 <= 1060 0 |
86 | #define CURL_SUPPORT_MAC_10_71080 <= 1070 0 |
87 | #define CURL_SUPPORT_MAC_10_81080 <= 1080 0 |
88 | |
89 | #else |
90 | #error "The darwinssl back-end requires iOS or OS X." |
91 | #endif /* (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE)) */ |
92 | |
93 | #if CURL_BUILD_MAC1 |
94 | #include <sys/sysctl.h> |
95 | #endif /* CURL_BUILD_MAC */ |
96 | |
97 | #include "urldata.h" |
98 | #include "sendf.h" |
99 | #include "inet_pton.h" |
100 | #include "connect.h" |
101 | #include "select.h" |
102 | #include "vtls.h" |
103 | #include "curl_darwinssl.h" |
104 | |
105 | #define _MPRINTF_REPLACE /* use our functions only */ |
106 | #include <curl/mprintf.h> |
107 | |
108 | #include "curl_memory.h" |
109 | /* The last #include file should be: */ |
110 | #include "memdebug.h" |
111 | |
112 | /* From MacTypes.h (which we can't include because it isn't present in iOS: */ |
113 | #define ioErr-36 -36 |
114 | #define paramErr-50 -50 |
115 | |
116 | /* The following two functions were ripped from Apple sample code, |
117 | * with some modifications: */ |
118 | static OSStatus SocketRead(SSLConnectionRef connection, |
119 | void *data, /* owned by |
120 | * caller, data |
121 | * RETURNED */ |
122 | size_t *dataLength) /* IN/OUT */ |
123 | { |
124 | size_t bytesToGo = *dataLength; |
125 | size_t initLen = bytesToGo; |
126 | UInt8 *currData = (UInt8 *)data; |
127 | /*int sock = *(int *)connection;*/ |
128 | struct ssl_connect_data *connssl = (struct ssl_connect_data *)connection; |
129 | int sock = connssl->ssl_sockfd; |
130 | OSStatus rtn = noErr; |
131 | size_t bytesRead; |
132 | ssize_t rrtn; |
133 | int theErr; |
134 | |
135 | *dataLength = 0; |
136 | |
137 | for(;;) { |
138 | bytesRead = 0; |
Value stored to 'bytesRead' is never read | |
139 | rrtn = read(sock, currData, bytesToGo); |
140 | if(rrtn <= 0) { |
141 | /* this is guesswork... */ |
142 | theErr = errno(*__error()); |
143 | if(rrtn == 0) { /* EOF = server hung up */ |
144 | /* the framework will turn this into errSSLClosedNoNotify */ |
145 | rtn = errSSLClosedGraceful; |
146 | } |
147 | else /* do the switch */ |
148 | switch(theErr) { |
149 | case ENOENT2: |
150 | /* connection closed */ |
151 | rtn = errSSLClosedGraceful; |
152 | break; |
153 | case ECONNRESET54: |
154 | rtn = errSSLClosedAbort; |
155 | break; |
156 | case EAGAIN35: |
157 | rtn = errSSLWouldBlock; |
158 | connssl->ssl_direction = false0; |
159 | break; |
160 | default: |
161 | rtn = ioErr-36; |
162 | break; |
163 | } |
164 | break; |
165 | } |
166 | else { |
167 | bytesRead = rrtn; |
168 | } |
169 | bytesToGo -= bytesRead; |
170 | currData += bytesRead; |
171 | |
172 | if(bytesToGo == 0) { |
173 | /* filled buffer with incoming data, done */ |
174 | break; |
175 | } |
176 | } |
177 | *dataLength = initLen - bytesToGo; |
178 | |
179 | return rtn; |
180 | } |
181 | |
182 | static OSStatus SocketWrite(SSLConnectionRef connection, |
183 | const void *data, |
184 | size_t *dataLength) /* IN/OUT */ |
185 | { |
186 | size_t bytesSent = 0; |
187 | /*int sock = *(int *)connection;*/ |
188 | struct ssl_connect_data *connssl = (struct ssl_connect_data *)connection; |
189 | int sock = connssl->ssl_sockfd; |
190 | ssize_t length; |
191 | size_t dataLen = *dataLength; |
192 | const UInt8 *dataPtr = (UInt8 *)data; |
193 | OSStatus ortn; |
194 | int theErr; |
195 | |
196 | *dataLength = 0; |
197 | |
198 | do { |
199 | length = write(sock, |
200 | (char*)dataPtr + bytesSent, |
201 | dataLen - bytesSent); |
202 | } while((length > 0) && |
203 | ( (bytesSent += length) < dataLen) ); |
204 | |
205 | if(length <= 0) { |
206 | theErr = errno(*__error()); |
207 | if(theErr == EAGAIN35) { |
208 | ortn = errSSLWouldBlock; |
209 | connssl->ssl_direction = true1; |
210 | } |
211 | else { |
212 | ortn = ioErr-36; |
213 | } |
214 | } |
215 | else { |
216 | ortn = noErr; |
217 | } |
218 | *dataLength = bytesSent; |
219 | return ortn; |
220 | } |
221 | |
222 | CF_INLINEstatic __inline__ __attribute__((always_inline)) const char *SSLCipherNameForNumber(SSLCipherSuite cipher) { |
223 | switch (cipher) { |
224 | /* SSL version 3.0 */ |
225 | case SSL_RSA_WITH_NULL_MD5: |
226 | return "SSL_RSA_WITH_NULL_MD5"; |
227 | break; |
228 | case SSL_RSA_WITH_NULL_SHA: |
229 | return "SSL_RSA_WITH_NULL_SHA"; |
230 | break; |
231 | case SSL_RSA_EXPORT_WITH_RC4_40_MD5: |
232 | return "SSL_RSA_EXPORT_WITH_RC4_40_MD5"; |
233 | break; |
234 | case SSL_RSA_WITH_RC4_128_MD5: |
235 | return "SSL_RSA_WITH_RC4_128_MD5"; |
236 | break; |
237 | case SSL_RSA_WITH_RC4_128_SHA: |
238 | return "SSL_RSA_WITH_RC4_128_SHA"; |
239 | break; |
240 | case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5: |
241 | return "SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5"; |
242 | break; |
243 | case SSL_RSA_WITH_IDEA_CBC_SHA: |
244 | return "SSL_RSA_WITH_IDEA_CBC_SHA"; |
245 | break; |
246 | case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA: |
247 | return "SSL_RSA_EXPORT_WITH_DES40_CBC_SHA"; |
248 | break; |
249 | case SSL_RSA_WITH_DES_CBC_SHA: |
250 | return "SSL_RSA_WITH_DES_CBC_SHA"; |
251 | break; |
252 | case SSL_RSA_WITH_3DES_EDE_CBC_SHA: |
253 | return "SSL_RSA_WITH_3DES_EDE_CBC_SHA"; |
254 | break; |
255 | case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA: |
256 | return "SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA"; |
257 | break; |
258 | case SSL_DH_DSS_WITH_DES_CBC_SHA: |
259 | return "SSL_DH_DSS_WITH_DES_CBC_SHA"; |
260 | break; |
261 | case SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA: |
262 | return "SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA"; |
263 | break; |
264 | case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA: |
265 | return "SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA"; |
266 | break; |
267 | case SSL_DH_RSA_WITH_DES_CBC_SHA: |
268 | return "SSL_DH_RSA_WITH_DES_CBC_SHA"; |
269 | break; |
270 | case SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA: |
271 | return "SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA"; |
272 | break; |
273 | case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA: |
274 | return "SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA"; |
275 | break; |
276 | case SSL_DHE_DSS_WITH_DES_CBC_SHA: |
277 | return "SSL_DHE_DSS_WITH_DES_CBC_SHA"; |
278 | break; |
279 | case SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA: |
280 | return "SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"; |
281 | break; |
282 | case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA: |
283 | return "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA"; |
284 | break; |
285 | case SSL_DHE_RSA_WITH_DES_CBC_SHA: |
286 | return "SSL_DHE_RSA_WITH_DES_CBC_SHA"; |
287 | break; |
288 | case SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA: |
289 | return "SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA"; |
290 | break; |
291 | case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5: |
292 | return "SSL_DH_anon_EXPORT_WITH_RC4_40_MD5"; |
293 | break; |
294 | case SSL_DH_anon_WITH_RC4_128_MD5: |
295 | return "SSL_DH_anon_WITH_RC4_128_MD5"; |
296 | break; |
297 | case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA: |
298 | return "SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA"; |
299 | break; |
300 | case SSL_DH_anon_WITH_DES_CBC_SHA: |
301 | return "SSL_DH_anon_WITH_DES_CBC_SHA"; |
302 | break; |
303 | case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA: |
304 | return "SSL_DH_anon_WITH_3DES_EDE_CBC_SHA"; |
305 | break; |
306 | case SSL_FORTEZZA_DMS_WITH_NULL_SHA: |
307 | return "SSL_FORTEZZA_DMS_WITH_NULL_SHA"; |
308 | break; |
309 | case SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA: |
310 | return "SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA"; |
311 | break; |
312 | /* TLS 1.0 with AES (RFC 3268) |
313 | (Apparently these are used in SSLv3 implementations as well.) */ |
314 | case TLS_RSA_WITH_AES_128_CBC_SHA: |
315 | return "TLS_RSA_WITH_AES_128_CBC_SHA"; |
316 | break; |
317 | case TLS_DH_DSS_WITH_AES_128_CBC_SHA: |
318 | return "TLS_DH_DSS_WITH_AES_128_CBC_SHA"; |
319 | break; |
320 | case TLS_DH_RSA_WITH_AES_128_CBC_SHA: |
321 | return "TLS_DH_RSA_WITH_AES_128_CBC_SHA"; |
322 | break; |
323 | case TLS_DHE_DSS_WITH_AES_128_CBC_SHA: |
324 | return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA"; |
325 | break; |
326 | case TLS_DHE_RSA_WITH_AES_128_CBC_SHA: |
327 | return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA"; |
328 | break; |
329 | case TLS_DH_anon_WITH_AES_128_CBC_SHA: |
330 | return "TLS_DH_anon_WITH_AES_128_CBC_SHA"; |
331 | break; |
332 | case TLS_RSA_WITH_AES_256_CBC_SHA: |
333 | return "TLS_RSA_WITH_AES_256_CBC_SHA"; |
334 | break; |
335 | case TLS_DH_DSS_WITH_AES_256_CBC_SHA: |
336 | return "TLS_DH_DSS_WITH_AES_256_CBC_SHA"; |
337 | break; |
338 | case TLS_DH_RSA_WITH_AES_256_CBC_SHA: |
339 | return "TLS_DH_RSA_WITH_AES_256_CBC_SHA"; |
340 | break; |
341 | case TLS_DHE_DSS_WITH_AES_256_CBC_SHA: |
342 | return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA"; |
343 | break; |
344 | case TLS_DHE_RSA_WITH_AES_256_CBC_SHA: |
345 | return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"; |
346 | break; |
347 | case TLS_DH_anon_WITH_AES_256_CBC_SHA: |
348 | return "TLS_DH_anon_WITH_AES_256_CBC_SHA"; |
349 | break; |
350 | /* SSL version 2.0 */ |
351 | case SSL_RSA_WITH_RC2_CBC_MD5: |
352 | return "SSL_RSA_WITH_RC2_CBC_MD5"; |
353 | break; |
354 | case SSL_RSA_WITH_IDEA_CBC_MD5: |
355 | return "SSL_RSA_WITH_IDEA_CBC_MD5"; |
356 | break; |
357 | case SSL_RSA_WITH_DES_CBC_MD5: |
358 | return "SSL_RSA_WITH_DES_CBC_MD5"; |
359 | break; |
360 | case SSL_RSA_WITH_3DES_EDE_CBC_MD5: |
361 | return "SSL_RSA_WITH_3DES_EDE_CBC_MD5"; |
362 | break; |
363 | } |
364 | return "SSL_NULL_WITH_NULL_NULL"; |
365 | } |
366 | |
367 | CF_INLINEstatic __inline__ __attribute__((always_inline)) const char *TLSCipherNameForNumber(SSLCipherSuite cipher) { |
368 | switch(cipher) { |
369 | /* TLS 1.0 with AES (RFC 3268) */ |
370 | case TLS_RSA_WITH_AES_128_CBC_SHA: |
371 | return "TLS_RSA_WITH_AES_128_CBC_SHA"; |
372 | break; |
373 | case TLS_DH_DSS_WITH_AES_128_CBC_SHA: |
374 | return "TLS_DH_DSS_WITH_AES_128_CBC_SHA"; |
375 | break; |
376 | case TLS_DH_RSA_WITH_AES_128_CBC_SHA: |
377 | return "TLS_DH_RSA_WITH_AES_128_CBC_SHA"; |
378 | break; |
379 | case TLS_DHE_DSS_WITH_AES_128_CBC_SHA: |
380 | return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA"; |
381 | break; |
382 | case TLS_DHE_RSA_WITH_AES_128_CBC_SHA: |
383 | return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA"; |
384 | break; |
385 | case TLS_DH_anon_WITH_AES_128_CBC_SHA: |
386 | return "TLS_DH_anon_WITH_AES_128_CBC_SHA"; |
387 | break; |
388 | case TLS_RSA_WITH_AES_256_CBC_SHA: |
389 | return "TLS_RSA_WITH_AES_256_CBC_SHA"; |
390 | break; |
391 | case TLS_DH_DSS_WITH_AES_256_CBC_SHA: |
392 | return "TLS_DH_DSS_WITH_AES_256_CBC_SHA"; |
393 | break; |
394 | case TLS_DH_RSA_WITH_AES_256_CBC_SHA: |
395 | return "TLS_DH_RSA_WITH_AES_256_CBC_SHA"; |
396 | break; |
397 | case TLS_DHE_DSS_WITH_AES_256_CBC_SHA: |
398 | return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA"; |
399 | break; |
400 | case TLS_DHE_RSA_WITH_AES_256_CBC_SHA: |
401 | return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"; |
402 | break; |
403 | case TLS_DH_anon_WITH_AES_256_CBC_SHA: |
404 | return "TLS_DH_anon_WITH_AES_256_CBC_SHA"; |
405 | break; |
406 | #if CURL_BUILD_MAC_10_61080 >= 1060 || CURL_BUILD_IOS0 |
407 | /* TLS 1.0 with ECDSA (RFC 4492) */ |
408 | case TLS_ECDH_ECDSA_WITH_NULL_SHA: |
409 | return "TLS_ECDH_ECDSA_WITH_NULL_SHA"; |
410 | break; |
411 | case TLS_ECDH_ECDSA_WITH_RC4_128_SHA: |
412 | return "TLS_ECDH_ECDSA_WITH_RC4_128_SHA"; |
413 | break; |
414 | case TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA: |
415 | return "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA"; |
416 | break; |
417 | case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA: |
418 | return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA"; |
419 | break; |
420 | case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA: |
421 | return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA"; |
422 | break; |
423 | case TLS_ECDHE_ECDSA_WITH_NULL_SHA: |
424 | return "TLS_ECDHE_ECDSA_WITH_NULL_SHA"; |
425 | break; |
426 | case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA: |
427 | return "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"; |
428 | break; |
429 | case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA: |
430 | return "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA"; |
431 | break; |
432 | case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: |
433 | return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"; |
434 | break; |
435 | case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: |
436 | return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"; |
437 | break; |
438 | case TLS_ECDH_RSA_WITH_NULL_SHA: |
439 | return "TLS_ECDH_RSA_WITH_NULL_SHA"; |
440 | break; |
441 | case TLS_ECDH_RSA_WITH_RC4_128_SHA: |
442 | return "TLS_ECDH_RSA_WITH_RC4_128_SHA"; |
443 | break; |
444 | case TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA: |
445 | return "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA"; |
446 | break; |
447 | case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA: |
448 | return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA"; |
449 | break; |
450 | case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA: |
451 | return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA"; |
452 | break; |
453 | case TLS_ECDHE_RSA_WITH_NULL_SHA: |
454 | return "TLS_ECDHE_RSA_WITH_NULL_SHA"; |
455 | break; |
456 | case TLS_ECDHE_RSA_WITH_RC4_128_SHA: |
457 | return "TLS_ECDHE_RSA_WITH_RC4_128_SHA"; |
458 | break; |
459 | case TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA: |
460 | return "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"; |
461 | break; |
462 | case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: |
463 | return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"; |
464 | break; |
465 | case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: |
466 | return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"; |
467 | break; |
468 | case TLS_ECDH_anon_WITH_NULL_SHA: |
469 | return "TLS_ECDH_anon_WITH_NULL_SHA"; |
470 | break; |
471 | case TLS_ECDH_anon_WITH_RC4_128_SHA: |
472 | return "TLS_ECDH_anon_WITH_RC4_128_SHA"; |
473 | break; |
474 | case TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA: |
475 | return "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA"; |
476 | break; |
477 | case TLS_ECDH_anon_WITH_AES_128_CBC_SHA: |
478 | return "TLS_ECDH_anon_WITH_AES_128_CBC_SHA"; |
479 | break; |
480 | case TLS_ECDH_anon_WITH_AES_256_CBC_SHA: |
481 | return "TLS_ECDH_anon_WITH_AES_256_CBC_SHA"; |
482 | break; |
483 | #endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */ |
484 | #if CURL_BUILD_MAC_10_81080 >= 1080 || CURL_BUILD_IOS0 |
485 | /* TLS 1.2 (RFC 5246) */ |
486 | case TLS_RSA_WITH_NULL_MD5: |
487 | return "TLS_RSA_WITH_NULL_MD5"; |
488 | break; |
489 | case TLS_RSA_WITH_NULL_SHA: |
490 | return "TLS_RSA_WITH_NULL_SHA"; |
491 | break; |
492 | case TLS_RSA_WITH_RC4_128_MD5: |
493 | return "TLS_RSA_WITH_RC4_128_MD5"; |
494 | break; |
495 | case TLS_RSA_WITH_RC4_128_SHA: |
496 | return "TLS_RSA_WITH_RC4_128_SHA"; |
497 | break; |
498 | case TLS_RSA_WITH_3DES_EDE_CBC_SHA: |
499 | return "TLS_RSA_WITH_3DES_EDE_CBC_SHA"; |
500 | break; |
501 | case TLS_RSA_WITH_NULL_SHA256: |
502 | return "TLS_RSA_WITH_NULL_SHA256"; |
503 | break; |
504 | case TLS_RSA_WITH_AES_128_CBC_SHA256: |
505 | return "TLS_RSA_WITH_AES_128_CBC_SHA256"; |
506 | break; |
507 | case TLS_RSA_WITH_AES_256_CBC_SHA256: |
508 | return "TLS_RSA_WITH_AES_256_CBC_SHA256"; |
509 | break; |
510 | case TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA: |
511 | return "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA"; |
512 | break; |
513 | case TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA: |
514 | return "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA"; |
515 | break; |
516 | case TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA: |
517 | return "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA"; |
518 | break; |
519 | case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA: |
520 | return "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA"; |
521 | break; |
522 | case TLS_DH_DSS_WITH_AES_128_CBC_SHA256: |
523 | return "TLS_DH_DSS_WITH_AES_128_CBC_SHA256"; |
524 | break; |
525 | case TLS_DH_RSA_WITH_AES_128_CBC_SHA256: |
526 | return "TLS_DH_RSA_WITH_AES_128_CBC_SHA256"; |
527 | break; |
528 | case TLS_DHE_DSS_WITH_AES_128_CBC_SHA256: |
529 | return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256"; |
530 | break; |
531 | case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: |
532 | return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256"; |
533 | break; |
534 | case TLS_DH_DSS_WITH_AES_256_CBC_SHA256: |
535 | return "TLS_DH_DSS_WITH_AES_256_CBC_SHA256"; |
536 | break; |
537 | case TLS_DH_RSA_WITH_AES_256_CBC_SHA256: |
538 | return "TLS_DH_RSA_WITH_AES_256_CBC_SHA256"; |
539 | break; |
540 | case TLS_DHE_DSS_WITH_AES_256_CBC_SHA256: |
541 | return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256"; |
542 | break; |
543 | case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: |
544 | return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"; |
545 | break; |
546 | case TLS_DH_anon_WITH_RC4_128_MD5: |
547 | return "TLS_DH_anon_WITH_RC4_128_MD5"; |
548 | break; |
549 | case TLS_DH_anon_WITH_3DES_EDE_CBC_SHA: |
550 | return "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA"; |
551 | break; |
552 | case TLS_DH_anon_WITH_AES_128_CBC_SHA256: |
553 | return "TLS_DH_anon_WITH_AES_128_CBC_SHA256"; |
554 | break; |
555 | case TLS_DH_anon_WITH_AES_256_CBC_SHA256: |
556 | return "TLS_DH_anon_WITH_AES_256_CBC_SHA256"; |
557 | break; |
558 | /* TLS 1.2 with AES GCM (RFC 5288) */ |
559 | case TLS_RSA_WITH_AES_128_GCM_SHA256: |
560 | return "TLS_RSA_WITH_AES_128_GCM_SHA256"; |
561 | break; |
562 | case TLS_RSA_WITH_AES_256_GCM_SHA384: |
563 | return "TLS_RSA_WITH_AES_256_GCM_SHA384"; |
564 | break; |
565 | case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: |
566 | return "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"; |
567 | break; |
568 | case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: |
569 | return "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"; |
570 | break; |
571 | case TLS_DH_RSA_WITH_AES_128_GCM_SHA256: |
572 | return "TLS_DH_RSA_WITH_AES_128_GCM_SHA256"; |
573 | break; |
574 | case TLS_DH_RSA_WITH_AES_256_GCM_SHA384: |
575 | return "TLS_DH_RSA_WITH_AES_256_GCM_SHA384"; |
576 | break; |
577 | case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256: |
578 | return "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256"; |
579 | break; |
580 | case TLS_DHE_DSS_WITH_AES_256_GCM_SHA384: |
581 | return "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384"; |
582 | break; |
583 | case TLS_DH_DSS_WITH_AES_128_GCM_SHA256: |
584 | return "TLS_DH_DSS_WITH_AES_128_GCM_SHA256"; |
585 | break; |
586 | case TLS_DH_DSS_WITH_AES_256_GCM_SHA384: |
587 | return "TLS_DH_DSS_WITH_AES_256_GCM_SHA384"; |
588 | break; |
589 | case TLS_DH_anon_WITH_AES_128_GCM_SHA256: |
590 | return "TLS_DH_anon_WITH_AES_128_GCM_SHA256"; |
591 | break; |
592 | case TLS_DH_anon_WITH_AES_256_GCM_SHA384: |
593 | return "TLS_DH_anon_WITH_AES_256_GCM_SHA384"; |
594 | break; |
595 | /* TLS 1.2 with elliptic curve ciphers (RFC 5289) */ |
596 | case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: |
597 | return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"; |
598 | break; |
599 | case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384: |
600 | return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384"; |
601 | break; |
602 | case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256: |
603 | return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256"; |
604 | break; |
605 | case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384: |
606 | return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384"; |
607 | break; |
608 | case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: |
609 | return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"; |
610 | break; |
611 | case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384: |
612 | return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"; |
613 | break; |
614 | case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256: |
615 | return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256"; |
616 | break; |
617 | case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384: |
618 | return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384"; |
619 | break; |
620 | case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: |
621 | return "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"; |
622 | break; |
623 | case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: |
624 | return "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"; |
625 | break; |
626 | case TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256: |
627 | return "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256"; |
628 | break; |
629 | case TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384: |
630 | return "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384"; |
631 | break; |
632 | case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: |
633 | return "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; |
634 | break; |
635 | case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: |
636 | return "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"; |
637 | break; |
638 | case TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256: |
639 | return "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"; |
640 | break; |
641 | case TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384: |
642 | return "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384"; |
643 | break; |
644 | case TLS_EMPTY_RENEGOTIATION_INFO_SCSV: |
645 | return "TLS_EMPTY_RENEGOTIATION_INFO_SCSV"; |
646 | break; |
647 | #else |
648 | case SSL_RSA_WITH_NULL_MD5: |
649 | return "TLS_RSA_WITH_NULL_MD5"; |
650 | break; |
651 | case SSL_RSA_WITH_NULL_SHA: |
652 | return "TLS_RSA_WITH_NULL_SHA"; |
653 | break; |
654 | case SSL_RSA_WITH_RC4_128_MD5: |
655 | return "TLS_RSA_WITH_RC4_128_MD5"; |
656 | break; |
657 | case SSL_RSA_WITH_RC4_128_SHA: |
658 | return "TLS_RSA_WITH_RC4_128_SHA"; |
659 | break; |
660 | case SSL_RSA_WITH_3DES_EDE_CBC_SHA: |
661 | return "TLS_RSA_WITH_3DES_EDE_CBC_SHA"; |
662 | break; |
663 | case SSL_DH_anon_WITH_RC4_128_MD5: |
664 | return "TLS_DH_anon_WITH_RC4_128_MD5"; |
665 | break; |
666 | case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA: |
667 | return "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA"; |
668 | break; |
669 | #endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ |
670 | #if CURL_BUILD_MAC_10_91080 >= 1090 || CURL_BUILD_IOS_70 |
671 | /* TLS PSK (RFC 4279): */ |
672 | case TLS_PSK_WITH_RC4_128_SHA: |
673 | return "TLS_PSK_WITH_RC4_128_SHA"; |
674 | break; |
675 | case TLS_PSK_WITH_3DES_EDE_CBC_SHA: |
676 | return "TLS_PSK_WITH_3DES_EDE_CBC_SHA"; |
677 | break; |
678 | case TLS_PSK_WITH_AES_128_CBC_SHA: |
679 | return "TLS_PSK_WITH_AES_128_CBC_SHA"; |
680 | break; |
681 | case TLS_PSK_WITH_AES_256_CBC_SHA: |
682 | return "TLS_PSK_WITH_AES_256_CBC_SHA"; |
683 | break; |
684 | case TLS_DHE_PSK_WITH_RC4_128_SHA: |
685 | return "TLS_DHE_PSK_WITH_RC4_128_SHA"; |
686 | break; |
687 | case TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA: |
688 | return "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA"; |
689 | break; |
690 | case TLS_DHE_PSK_WITH_AES_128_CBC_SHA: |
691 | return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA"; |
692 | break; |
693 | case TLS_DHE_PSK_WITH_AES_256_CBC_SHA: |
694 | return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA"; |
695 | break; |
696 | case TLS_RSA_PSK_WITH_RC4_128_SHA: |
697 | return "TLS_RSA_PSK_WITH_RC4_128_SHA"; |
698 | break; |
699 | case TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA: |
700 | return "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA"; |
701 | break; |
702 | case TLS_RSA_PSK_WITH_AES_128_CBC_SHA: |
703 | return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA"; |
704 | break; |
705 | case TLS_RSA_PSK_WITH_AES_256_CBC_SHA: |
706 | return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA"; |
707 | break; |
708 | /* More TLS PSK (RFC 4785): */ |
709 | case TLS_PSK_WITH_NULL_SHA: |
710 | return "TLS_PSK_WITH_NULL_SHA"; |
711 | break; |
712 | case TLS_DHE_PSK_WITH_NULL_SHA: |
713 | return "TLS_DHE_PSK_WITH_NULL_SHA"; |
714 | break; |
715 | case TLS_RSA_PSK_WITH_NULL_SHA: |
716 | return "TLS_RSA_PSK_WITH_NULL_SHA"; |
717 | break; |
718 | /* Even more TLS PSK (RFC 5487): */ |
719 | case TLS_PSK_WITH_AES_128_GCM_SHA256: |
720 | return "TLS_PSK_WITH_AES_128_GCM_SHA256"; |
721 | break; |
722 | case TLS_PSK_WITH_AES_256_GCM_SHA384: |
723 | return "TLS_PSK_WITH_AES_256_GCM_SHA384"; |
724 | break; |
725 | case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256: |
726 | return "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256"; |
727 | break; |
728 | case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384: |
729 | return "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384"; |
730 | break; |
731 | case TLS_RSA_PSK_WITH_AES_128_GCM_SHA256: |
732 | return "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256"; |
733 | break; |
734 | case TLS_RSA_PSK_WITH_AES_256_GCM_SHA384: |
735 | return "TLS_PSK_WITH_AES_256_GCM_SHA384"; |
736 | break; |
737 | case TLS_PSK_WITH_AES_128_CBC_SHA256: |
738 | return "TLS_PSK_WITH_AES_128_CBC_SHA256"; |
739 | break; |
740 | case TLS_PSK_WITH_AES_256_CBC_SHA384: |
741 | return "TLS_PSK_WITH_AES_256_CBC_SHA384"; |
742 | break; |
743 | case TLS_PSK_WITH_NULL_SHA256: |
744 | return "TLS_PSK_WITH_NULL_SHA256"; |
745 | break; |
746 | case TLS_PSK_WITH_NULL_SHA384: |
747 | return "TLS_PSK_WITH_NULL_SHA384"; |
748 | break; |
749 | case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256: |
750 | return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256"; |
751 | break; |
752 | case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384: |
753 | return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384"; |
754 | break; |
755 | case TLS_DHE_PSK_WITH_NULL_SHA256: |
756 | return "TLS_DHE_PSK_WITH_NULL_SHA256"; |
757 | break; |
758 | case TLS_DHE_PSK_WITH_NULL_SHA384: |
759 | return "TLS_RSA_PSK_WITH_NULL_SHA384"; |
760 | break; |
761 | case TLS_RSA_PSK_WITH_AES_128_CBC_SHA256: |
762 | return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256"; |
763 | break; |
764 | case TLS_RSA_PSK_WITH_AES_256_CBC_SHA384: |
765 | return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384"; |
766 | break; |
767 | case TLS_RSA_PSK_WITH_NULL_SHA256: |
768 | return "TLS_RSA_PSK_WITH_NULL_SHA256"; |
769 | break; |
770 | case TLS_RSA_PSK_WITH_NULL_SHA384: |
771 | return "TLS_RSA_PSK_WITH_NULL_SHA384"; |
772 | break; |
773 | #endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */ |
774 | } |
775 | return "TLS_NULL_WITH_NULL_NULL"; |
776 | } |
777 | |
778 | #if CURL_BUILD_MAC1 |
779 | CF_INLINEstatic __inline__ __attribute__((always_inline)) void GetDarwinVersionNumber(int *major, int *minor) |
780 | { |
781 | int mib[2]; |
782 | char *os_version; |
783 | size_t os_version_len; |
784 | char *os_version_major, *os_version_minor/*, *os_version_point*/; |
785 | |
786 | /* Get the Darwin kernel version from the kernel using sysctl(): */ |
787 | mib[0] = CTL_KERN1; |
788 | mib[1] = KERN_OSRELEASE2; |
789 | if(sysctl(mib, 2, NULL((void*)0), &os_version_len, NULL((void*)0), 0) == -1) |
790 | return; |
791 | os_version = malloc(os_version_len*sizeof(char))Curl_cmalloc(os_version_len*sizeof(char)); |
792 | if(!os_version) |
793 | return; |
794 | if(sysctl(mib, 2, os_version, &os_version_len, NULL((void*)0), 0) == -1) { |
795 | free(os_version)Curl_cfree(os_version); |
796 | return; |
797 | } |
798 | |
799 | /* Parse the version: */ |
800 | os_version_major = strtok(os_version, "."); |
801 | os_version_minor = strtok(NULL((void*)0), "."); |
802 | /*os_version_point = strtok(NULL, ".");*/ |
803 | *major = atoi(os_version_major); |
804 | *minor = atoi(os_version_minor); |
805 | free(os_version)Curl_cfree(os_version); |
806 | } |
807 | #endif /* CURL_BUILD_MAC */ |
808 | |
809 | /* Apple provides a myriad of ways of getting information about a certificate |
810 | into a string. Some aren't available under iOS or newer cats. So here's |
811 | a unified function for getting a string describing the certificate that |
812 | ought to work in all cats starting with Leopard. */ |
813 | CF_INLINEstatic __inline__ __attribute__((always_inline)) CFStringRef CopyCertSubject(SecCertificateRef cert) |
814 | { |
815 | CFStringRef server_cert_summary = CFSTR("(null)")((CFStringRef) __builtin___CFStringMakeConstantString ("" "(null)" "")); |
816 | |
817 | #if CURL_BUILD_IOS0 |
818 | /* iOS: There's only one way to do this. */ |
819 | server_cert_summary = SecCertificateCopySubjectSummary(cert); |
820 | #else |
821 | #if CURL_BUILD_MAC_10_71080 >= 1070 |
822 | /* Lion & later: Get the long description if we can. */ |
823 | if(SecCertificateCopyLongDescription != NULL((void*)0)) |
824 | server_cert_summary = |
825 | SecCertificateCopyLongDescription(NULL((void*)0), cert, NULL((void*)0)); |
826 | else |
827 | #endif /* CURL_BUILD_MAC_10_7 */ |
828 | #if CURL_BUILD_MAC_10_61080 >= 1060 |
829 | /* Snow Leopard: Get the certificate summary. */ |
830 | if(SecCertificateCopySubjectSummary != NULL((void*)0)) |
831 | server_cert_summary = SecCertificateCopySubjectSummary(cert); |
832 | else |
833 | #endif /* CURL_BUILD_MAC_10_6 */ |
834 | /* Leopard is as far back as we go... */ |
835 | (void)SecCertificateCopyCommonName(cert, &server_cert_summary); |
836 | #endif /* CURL_BUILD_IOS */ |
837 | return server_cert_summary; |
838 | } |
839 | |
840 | #if CURL_SUPPORT_MAC_10_61080 <= 1060 |
841 | /* The SecKeychainSearch API was deprecated in Lion, and using it will raise |
842 | deprecation warnings, so let's not compile this unless it's necessary: */ |
843 | static OSStatus CopyIdentityWithLabelOldSchool(char *label, |
844 | SecIdentityRef *out_c_a_k) |
845 | { |
846 | OSStatus status = errSecItemNotFound; |
847 | SecKeychainAttributeList attr_list; |
848 | SecKeychainAttribute attr; |
849 | SecKeychainSearchRef search = NULL((void*)0); |
850 | SecCertificateRef cert = NULL((void*)0); |
851 | |
852 | /* Set up the attribute list: */ |
853 | attr_list.count = 1L; |
854 | attr_list.attr = &attr; |
855 | |
856 | /* Set up our lone search criterion: */ |
857 | attr.tag = kSecLabelItemAttr; |
858 | attr.data = label; |
859 | attr.length = (UInt32)strlen(label); |
860 | |
861 | /* Start searching: */ |
862 | status = SecKeychainSearchCreateFromAttributes(NULL((void*)0), |
863 | kSecCertificateItemClass, |
864 | &attr_list, |
865 | &search); |
866 | if(status == noErr) { |
867 | status = SecKeychainSearchCopyNext(search, |
868 | (SecKeychainItemRef *)&cert); |
869 | if(status == noErr && cert) { |
870 | /* If we found a certificate, does it have a private key? */ |
871 | status = SecIdentityCreateWithCertificate(NULL((void*)0), cert, out_c_a_k); |
872 | CFRelease(cert); |
873 | } |
874 | } |
875 | |
876 | if(search) |
877 | CFRelease(search); |
878 | return status; |
879 | } |
880 | #endif /* CURL_SUPPORT_MAC_10_6 */ |
881 | |
882 | static OSStatus CopyIdentityWithLabel(char *label, |
883 | SecIdentityRef *out_cert_and_key) |
884 | { |
885 | OSStatus status = errSecItemNotFound; |
886 | |
887 | #if CURL_BUILD_MAC_10_71080 >= 1070 || CURL_BUILD_IOS0 |
888 | /* SecItemCopyMatching() was introduced in iOS and Snow Leopard. |
889 | kSecClassIdentity was introduced in Lion. If both exist, let's use them |
890 | to find the certificate. */ |
891 | if(SecItemCopyMatching != NULL((void*)0) && kSecClassIdentity != NULL((void*)0)) { |
892 | CFTypeRef keys[4]; |
893 | CFTypeRef values[4]; |
894 | CFDictionaryRef query_dict; |
895 | CFStringRef label_cf = CFStringCreateWithCString(NULL((void*)0), label, |
896 | kCFStringEncodingUTF8); |
897 | |
898 | /* Set up our search criteria and expected results: */ |
899 | values[0] = kSecClassIdentity; /* we want a certificate and a key */ |
900 | keys[0] = kSecClass; |
901 | values[1] = kCFBooleanTrue; /* we want a reference */ |
902 | keys[1] = kSecReturnRef; |
903 | values[2] = kSecMatchLimitOne; /* one is enough, thanks */ |
904 | keys[2] = kSecMatchLimit; |
905 | /* identity searches need a SecPolicyRef in order to work */ |
906 | values[3] = SecPolicyCreateSSL(false0, label_cf); |
907 | keys[3] = kSecMatchPolicy; |
908 | query_dict = CFDictionaryCreate(NULL((void*)0), (const void **)keys, |
909 | (const void **)values, 4L, |
910 | &kCFCopyStringDictionaryKeyCallBacks, |
911 | &kCFTypeDictionaryValueCallBacks); |
912 | CFRelease(values[3]); |
913 | CFRelease(label_cf); |
914 | |
915 | /* Do we have a match? */ |
916 | status = SecItemCopyMatching(query_dict, (CFTypeRef *)out_cert_and_key); |
917 | CFRelease(query_dict); |
918 | } |
919 | else { |
920 | #if CURL_SUPPORT_MAC_10_61080 <= 1060 |
921 | /* On Leopard and Snow Leopard, fall back to SecKeychainSearch. */ |
922 | status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key); |
923 | #endif /* CURL_SUPPORT_MAC_10_7 */ |
924 | } |
925 | #elif CURL_SUPPORT_MAC_10_61080 <= 1060 |
926 | /* For developers building on older cats, we have no choice but to fall back |
927 | to SecKeychainSearch. */ |
928 | status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key); |
929 | #endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */ |
930 | return status; |
931 | } |
932 | |
933 | static OSStatus CopyIdentityFromPKCS12File(const char *cPath, |
934 | const char *cPassword, |
935 | SecIdentityRef *out_cert_and_key) |
936 | { |
937 | OSStatus status = errSecItemNotFound; |
938 | CFURLRef pkcs_url = CFURLCreateFromFileSystemRepresentation(NULL((void*)0), |
939 | (const UInt8 *)cPath, strlen(cPath), false0); |
940 | CFStringRef password = cPassword ? CFStringCreateWithCString(NULL((void*)0), |
941 | cPassword, kCFStringEncodingUTF8) : NULL((void*)0); |
942 | CFDataRef pkcs_data = NULL((void*)0); |
943 | |
944 | /* We can import P12 files on iOS or OS X 10.7 or later: */ |
945 | /* These constants are documented as having first appeared in 10.6 but they |
946 | raise linker errors when used on that cat for some reason. */ |
947 | #if CURL_BUILD_MAC_10_71080 >= 1070 || CURL_BUILD_IOS0 |
948 | if(CFURLCreateDataAndPropertiesFromResource(NULL((void*)0), pkcs_url, &pkcs_data, |
949 | NULL((void*)0), NULL((void*)0), &status)) { |
950 | const void *cKeys[] = {kSecImportExportPassphrase}; |
951 | const void *cValues[] = {password}; |
952 | CFDictionaryRef options = CFDictionaryCreate(NULL((void*)0), cKeys, cValues, |
953 | password ? 1L : 0L, NULL((void*)0), NULL((void*)0)); |
954 | CFArrayRef items = NULL((void*)0); |
955 | |
956 | /* Here we go: */ |
957 | status = SecPKCS12Import(pkcs_data, options, &items); |
958 | if(status == noErr) { |
959 | CFDictionaryRef identity_and_trust = CFArrayGetValueAtIndex(items, 0L); |
960 | const void *temp_identity = CFDictionaryGetValue(identity_and_trust, |
961 | kSecImportItemIdentity); |
962 | |
963 | /* Retain the identity; we don't care about any other data... */ |
964 | CFRetain(temp_identity); |
965 | *out_cert_and_key = (SecIdentityRef)temp_identity; |
966 | CFRelease(items); |
967 | } |
968 | CFRelease(options); |
969 | CFRelease(pkcs_data); |
970 | } |
971 | #endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */ |
972 | if(password) |
973 | CFRelease(password); |
974 | CFRelease(pkcs_url); |
975 | return status; |
976 | } |
977 | |
978 | /* This code was borrowed from nss.c, with some modifications: |
979 | * Determine whether the nickname passed in is a filename that needs to |
980 | * be loaded as a PEM or a regular NSS nickname. |
981 | * |
982 | * returns 1 for a file |
983 | * returns 0 for not a file |
984 | */ |
985 | CF_INLINEstatic __inline__ __attribute__((always_inline)) bool_Bool is_file(const char *filename) |
986 | { |
987 | struct_statstruct stat st; |
988 | |
989 | if(filename == NULL((void*)0)) |
990 | return false0; |
991 | |
992 | if(stat(filename, &st) == 0) |
993 | return S_ISREG(st.st_mode)(((st.st_mode) & 0170000) == 0100000); |
994 | return false0; |
995 | } |
996 | |
997 | static CURLcode darwinssl_connect_step1(struct connectdata *conn, |
998 | int sockindex) |
999 | { |
1000 | struct SessionHandle *data = conn->data; |
1001 | curl_socket_t sockfd = conn->sock[sockindex]; |
1002 | struct ssl_connect_data *connssl = &conn->ssl[sockindex]; |
1003 | #ifdef ENABLE_IPV61 |
1004 | struct in6_addr addr; |
1005 | #else |
1006 | struct in_addr addr; |
1007 | #endif /* ENABLE_IPV6 */ |
1008 | size_t all_ciphers_count = 0UL, allowed_ciphers_count = 0UL, i; |
1009 | SSLCipherSuite *all_ciphers = NULL((void*)0), *allowed_ciphers = NULL((void*)0); |
1010 | char *ssl_sessionid; |
1011 | size_t ssl_sessionid_len; |
1012 | OSStatus err = noErr; |
1013 | #if CURL_BUILD_MAC1 |
1014 | int darwinver_maj = 0, darwinver_min = 0; |
1015 | |
1016 | GetDarwinVersionNumber(&darwinver_maj, &darwinver_min); |
1017 | #endif /* CURL_BUILD_MAC */ |
1018 | |
1019 | #if CURL_BUILD_MAC_10_81080 >= 1080 || CURL_BUILD_IOS0 |
1020 | if(SSLCreateContext != NULL((void*)0)) { /* use the newer API if avaialble */ |
1021 | if(connssl->ssl_ctx) |
1022 | CFRelease(connssl->ssl_ctx); |
1023 | connssl->ssl_ctx = SSLCreateContext(NULL((void*)0), kSSLClientSide, kSSLStreamType); |
1024 | if(!connssl->ssl_ctx) { |
1025 | failfCurl_failf(data, "SSL: couldn't create a context!"); |
1026 | return CURLE_OUT_OF_MEMORY; |
1027 | } |
1028 | } |
1029 | else { |
1030 | /* The old ST API does not exist under iOS, so don't compile it: */ |
1031 | #if CURL_SUPPORT_MAC_10_81080 <= 1080 |
1032 | if(connssl->ssl_ctx) |
1033 | (void)SSLDisposeContext(connssl->ssl_ctx); |
1034 | err = SSLNewContext(false0, &(connssl->ssl_ctx)); |
1035 | if(err != noErr) { |
1036 | failfCurl_failf(data, "SSL: couldn't create a context: OSStatus %d", err); |
1037 | return CURLE_OUT_OF_MEMORY; |
1038 | } |
1039 | #endif /* CURL_SUPPORT_MAC_10_8 */ |
1040 | } |
1041 | #else |
1042 | if(connssl->ssl_ctx) |
1043 | (void)SSLDisposeContext(connssl->ssl_ctx); |
1044 | err = SSLNewContext(false0, &(connssl->ssl_ctx)); |
1045 | if(err != noErr) { |
1046 | failfCurl_failf(data, "SSL: couldn't create a context: OSStatus %d", err); |
1047 | return CURLE_OUT_OF_MEMORY; |
1048 | } |
1049 | #endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ |
1050 | connssl->ssl_write_buffered_length = 0UL; /* reset buffered write length */ |
1051 | |
1052 | /* check to see if we've been told to use an explicit SSL/TLS version */ |
1053 | #if CURL_BUILD_MAC_10_81080 >= 1080 || CURL_BUILD_IOS0 |
1054 | if(SSLSetProtocolVersionMax != NULL((void*)0)) { |
1055 | switch(data->set.ssl.version) { |
1056 | case CURL_SSLVERSION_DEFAULT: default: |
1057 | (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kSSLProtocol3); |
1058 | (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol12); |
1059 | break; |
1060 | case CURL_SSLVERSION_TLSv1: |
1061 | (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol1); |
1062 | (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol12); |
1063 | break; |
1064 | case CURL_SSLVERSION_TLSv1_0: |
1065 | (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol1); |
1066 | (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol1); |
1067 | break; |
1068 | case CURL_SSLVERSION_TLSv1_1: |
1069 | (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol11); |
1070 | (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol11); |
1071 | break; |
1072 | case CURL_SSLVERSION_TLSv1_2: |
1073 | (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol12); |
1074 | (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol12); |
1075 | break; |
1076 | case CURL_SSLVERSION_SSLv3: |
1077 | (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kSSLProtocol3); |
1078 | (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kSSLProtocol3); |
1079 | break; |
1080 | case CURL_SSLVERSION_SSLv2: |
1081 | err = SSLSetProtocolVersionMin(connssl->ssl_ctx, kSSLProtocol2); |
1082 | if(err != noErr) { |
1083 | failfCurl_failf(data, "Your version of the OS does not support SSLv2"); |
1084 | return CURLE_SSL_CONNECT_ERROR; |
1085 | } |
1086 | (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kSSLProtocol2); |
1087 | } |
1088 | } |
1089 | else { |
1090 | #if CURL_SUPPORT_MAC_10_81080 <= 1080 |
1091 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1092 | kSSLProtocolAll, |
1093 | false0); |
1094 | switch (data->set.ssl.version) { |
1095 | case CURL_SSLVERSION_DEFAULT: default: |
1096 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1097 | kSSLProtocol3, |
1098 | true1); |
1099 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1100 | kTLSProtocol1, |
1101 | true1); |
1102 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1103 | kTLSProtocol11, |
1104 | true1); |
1105 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1106 | kTLSProtocol12, |
1107 | true1); |
1108 | break; |
1109 | case CURL_SSLVERSION_TLSv1: |
1110 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1111 | kTLSProtocol1, |
1112 | true1); |
1113 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1114 | kTLSProtocol11, |
1115 | true1); |
1116 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1117 | kTLSProtocol12, |
1118 | true1); |
1119 | break; |
1120 | case CURL_SSLVERSION_TLSv1_0: |
1121 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1122 | kTLSProtocol1, |
1123 | true1); |
1124 | break; |
1125 | case CURL_SSLVERSION_TLSv1_1: |
1126 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1127 | kTLSProtocol11, |
1128 | true1); |
1129 | break; |
1130 | case CURL_SSLVERSION_TLSv1_2: |
1131 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1132 | kTLSProtocol12, |
1133 | true1); |
1134 | break; |
1135 | case CURL_SSLVERSION_SSLv3: |
1136 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1137 | kSSLProtocol3, |
1138 | true1); |
1139 | break; |
1140 | case CURL_SSLVERSION_SSLv2: |
1141 | err = SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1142 | kSSLProtocol2, |
1143 | true1); |
1144 | if(err != noErr) { |
1145 | failfCurl_failf(data, "Your version of the OS does not support SSLv2"); |
1146 | return CURLE_SSL_CONNECT_ERROR; |
1147 | } |
1148 | break; |
1149 | } |
1150 | #endif /* CURL_SUPPORT_MAC_10_8 */ |
1151 | } |
1152 | #else |
1153 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, kSSLProtocolAll, false0); |
1154 | switch(data->set.ssl.version) { |
1155 | default: |
1156 | case CURL_SSLVERSION_DEFAULT: |
1157 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1158 | kSSLProtocol3, |
1159 | true1); |
1160 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1161 | kTLSProtocol1, |
1162 | true1); |
1163 | break; |
1164 | case CURL_SSLVERSION_TLSv1: |
1165 | case CURL_SSLVERSION_TLSv1_0: |
1166 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1167 | kTLSProtocol1, |
1168 | true1); |
1169 | break; |
1170 | case CURL_SSLVERSION_TLSv1_1: |
1171 | failfCurl_failf(data, "Your version of the OS does not support TLSv1.1"); |
1172 | return CURLE_SSL_CONNECT_ERROR; |
1173 | case CURL_SSLVERSION_TLSv1_2: |
1174 | failfCurl_failf(data, "Your version of the OS does not support TLSv1.2"); |
1175 | return CURLE_SSL_CONNECT_ERROR; |
1176 | case CURL_SSLVERSION_SSLv2: |
1177 | err = SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1178 | kSSLProtocol2, |
1179 | true1); |
1180 | if(err != noErr) { |
1181 | failfCurl_failf(data, "Your version of the OS does not support SSLv2"); |
1182 | return CURLE_SSL_CONNECT_ERROR; |
1183 | } |
1184 | break; |
1185 | case CURL_SSLVERSION_SSLv3: |
1186 | (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, |
1187 | kSSLProtocol3, |
1188 | true1); |
1189 | break; |
1190 | } |
1191 | #endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ |
1192 | |
1193 | if(data->set.str[STRING_KEY]) { |
1194 | infofCurl_infof(data, "WARNING: SSL: CURLOPT_SSLKEY is ignored by Secure " |
1195 | "Transport. The private key must be in the Keychain.\n"); |
1196 | } |
1197 | |
1198 | if(data->set.str[STRING_CERT]) { |
1199 | SecIdentityRef cert_and_key = NULL((void*)0); |
1200 | bool_Bool is_cert_file = is_file(data->set.str[STRING_CERT]); |
1201 | |
1202 | /* User wants to authenticate with a client cert. Look for it: |
1203 | If we detect that this is a file on disk, then let's load it. |
1204 | Otherwise, assume that the user wants to use an identity loaded |
1205 | from the Keychain. */ |
1206 | if(is_cert_file) { |
1207 | if(!data->set.str[STRING_CERT_TYPE]) |
1208 | infofCurl_infof(data, "WARNING: SSL: Certificate type not set, assuming " |
1209 | "PKCS#12 format.\n"); |
1210 | else if(strncmp(data->set.str[STRING_CERT_TYPE], "P12", |
1211 | strlen(data->set.str[STRING_CERT_TYPE])) != 0) |
1212 | infofCurl_infof(data, "WARNING: SSL: The Security framework only supports " |
1213 | "loading identities that are in PKCS#12 format.\n"); |
1214 | |
1215 | err = CopyIdentityFromPKCS12File(data->set.str[STRING_CERT], |
1216 | data->set.str[STRING_KEY_PASSWD], &cert_and_key); |
1217 | } |
1218 | else |
1219 | err = CopyIdentityWithLabel(data->set.str[STRING_CERT], &cert_and_key); |
1220 | |
1221 | if(err == noErr) { |
1222 | SecCertificateRef cert = NULL((void*)0); |
1223 | CFTypeRef certs_c[1]; |
1224 | CFArrayRef certs; |
1225 | |
1226 | /* If we found one, print it out: */ |
1227 | err = SecIdentityCopyCertificate(cert_and_key, &cert); |
1228 | if(err == noErr) { |
1229 | CFStringRef cert_summary = CopyCertSubject(cert); |
1230 | char cert_summary_c[128]; |
1231 | |
1232 | if(cert_summary) { |
1233 | memset(cert_summary_c, 0, 128)((__builtin_object_size (cert_summary_c, 0) != (size_t) -1) ? __builtin___memset_chk (cert_summary_c, 0, 128, __builtin_object_size (cert_summary_c, 0)) : __inline_memset_chk (cert_summary_c, 0 , 128)); |
1234 | if(CFStringGetCString(cert_summary, |
1235 | cert_summary_c, |
1236 | 128, |
1237 | kCFStringEncodingUTF8)) { |
1238 | infofCurl_infof(data, "Client certificate: %s\n", cert_summary_c); |
1239 | } |
1240 | CFRelease(cert_summary); |
1241 | CFRelease(cert); |
1242 | } |
1243 | } |
1244 | certs_c[0] = cert_and_key; |
1245 | certs = CFArrayCreate(NULL((void*)0), (const void **)certs_c, 1L, |
1246 | &kCFTypeArrayCallBacks); |
1247 | err = SSLSetCertificate(connssl->ssl_ctx, certs); |
1248 | if(certs) |
1249 | CFRelease(certs); |
1250 | if(err != noErr) { |
1251 | failfCurl_failf(data, "SSL: SSLSetCertificate() failed: OSStatus %d", err); |
1252 | return CURLE_SSL_CERTPROBLEM; |
1253 | } |
1254 | CFRelease(cert_and_key); |
1255 | } |
1256 | else { |
1257 | switch(err) { |
1258 | case errSecAuthFailed: case -25264: /* errSecPkcs12VerifyFailure */ |
1259 | failfCurl_failf(data, "SSL: Incorrect password for the certificate \"%s\" " |
1260 | "and its private key.", data->set.str[STRING_CERT]); |
1261 | break; |
1262 | case -26275: /* errSecDecode */ case -25257: /* errSecUnknownFormat */ |
1263 | failfCurl_failf(data, "SSL: Couldn't make sense of the data in the " |
1264 | "certificate \"%s\" and its private key.", |
1265 | data->set.str[STRING_CERT]); |
1266 | break; |
1267 | case -25260: /* errSecPassphraseRequired */ |
1268 | failfCurl_failf(data, "SSL The certificate \"%s\" requires a password.", |
1269 | data->set.str[STRING_CERT]); |
1270 | break; |
1271 | case errSecItemNotFound: |
1272 | failfCurl_failf(data, "SSL: Can't find the certificate \"%s\" and its private " |
1273 | "key in the Keychain.", data->set.str[STRING_CERT]); |
1274 | break; |
1275 | default: |
1276 | failfCurl_failf(data, "SSL: Can't load the certificate \"%s\" and its private " |
1277 | "key: OSStatus %d", data->set.str[STRING_CERT], err); |
1278 | break; |
1279 | } |
1280 | return CURLE_SSL_CERTPROBLEM; |
1281 | } |
1282 | } |
1283 | |
1284 | /* SSL always tries to verify the peer, this only says whether it should |
1285 | * fail to connect if the verification fails, or if it should continue |
1286 | * anyway. In the latter case the result of the verification is checked with |
1287 | * SSL_get_verify_result() below. */ |
1288 | #if CURL_BUILD_MAC_10_61080 >= 1060 || CURL_BUILD_IOS0 |
1289 | /* Snow Leopard introduced the SSLSetSessionOption() function, but due to |
1290 | a library bug with the way the kSSLSessionOptionBreakOnServerAuth flag |
1291 | works, it doesn't work as expected under Snow Leopard or Lion. |
1292 | So we need to call SSLSetEnableCertVerify() on those older cats in order |
1293 | to disable certificate validation if the user turned that off. |
1294 | (SecureTransport will always validate the certificate chain by |
1295 | default.) */ |
1296 | /* (Note: Darwin 12.x.x is Mountain Lion.) */ |
1297 | #if CURL_BUILD_MAC1 |
1298 | if(SSLSetSessionOption != NULL((void*)0) && darwinver_maj >= 12) { |
1299 | #else |
1300 | if(SSLSetSessionOption != NULL((void*)0)) { |
1301 | #endif /* CURL_BUILD_MAC */ |
1302 | bool_Bool break_on_auth = !data->set.ssl.verifypeer || |
1303 | data->set.str[STRING_SSL_CAFILE]; |
1304 | err = SSLSetSessionOption(connssl->ssl_ctx, |
1305 | kSSLSessionOptionBreakOnServerAuth, |
1306 | break_on_auth); |
1307 | if(err != noErr) { |
1308 | failfCurl_failf(data, "SSL: SSLSetSessionOption() failed: OSStatus %d", err); |
1309 | return CURLE_SSL_CONNECT_ERROR; |
1310 | } |
1311 | } |
1312 | else { |
1313 | #if CURL_SUPPORT_MAC_10_81080 <= 1080 |
1314 | err = SSLSetEnableCertVerify(connssl->ssl_ctx, |
1315 | data->set.ssl.verifypeer?true1:false0); |
1316 | if(err != noErr) { |
1317 | failfCurl_failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err); |
1318 | return CURLE_SSL_CONNECT_ERROR; |
1319 | } |
1320 | #endif /* CURL_SUPPORT_MAC_10_8 */ |
1321 | } |
1322 | #else |
1323 | err = SSLSetEnableCertVerify(connssl->ssl_ctx, |
1324 | data->set.ssl.verifypeer?true1:false0); |
1325 | if(err != noErr) { |
1326 | failfCurl_failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err); |
1327 | return CURLE_SSL_CONNECT_ERROR; |
1328 | } |
1329 | #endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */ |
1330 | |
1331 | if(data->set.str[STRING_SSL_CAFILE]) { |
1332 | bool_Bool is_cert_file = is_file(data->set.str[STRING_SSL_CAFILE]); |
1333 | if (!is_cert_file) { |
1334 | failfCurl_failf(data, "SSL: can't load CA certificate file %s", |
1335 | data->set.str[STRING_SSL_CAFILE]); |
1336 | return CURLE_SSL_CACERT_BADFILE; |
1337 | } |
1338 | if (!data->set.ssl.verifypeer) { |
1339 | failfCurl_failf(data, "SSL: CA certificate set, but certificate verification " |
1340 | "is disabled"); |
1341 | return CURLE_SSL_CONNECT_ERROR; |
1342 | } |
1343 | } |
1344 | |
1345 | /* Configure hostname check. SNI is used if available. |
1346 | * Both hostname check and SNI require SSLSetPeerDomainName(). |
1347 | * Also: the verifyhost setting influences SNI usage */ |
1348 | if(data->set.ssl.verifyhost) { |
1349 | err = SSLSetPeerDomainName(connssl->ssl_ctx, conn->host.name, |
1350 | strlen(conn->host.name)); |
1351 | |
1352 | if(err != noErr) { |
1353 | infofCurl_infof(data, "WARNING: SSL: SSLSetPeerDomainName() failed: OSStatus %d\n", |
1354 | err); |
1355 | } |
1356 | |
1357 | if((Curl_inet_pton(AF_INET, conn->host.name, &addr)inet_pton(2,conn->host.name,&addr)) |
1358 | #ifdef ENABLE_IPV61 |
1359 | || (Curl_inet_pton(AF_INET6, conn->host.name, &addr)inet_pton(30,conn->host.name,&addr)) |
1360 | #endif |
1361 | ) { |
1362 | infofCurl_infof(data, "WARNING: using IP address, SNI is being disabled by " |
1363 | "the OS.\n"); |
1364 | } |
1365 | } |
1366 | |
1367 | /* Disable cipher suites that ST supports but are not safe. These ciphers |
1368 | are unlikely to be used in any case since ST gives other ciphers a much |
1369 | higher priority, but it's probably better that we not connect at all than |
1370 | to give the user a false sense of security if the server only supports |
1371 | insecure ciphers. (Note: We don't care about SSLv2-only ciphers.) */ |
1372 | (void)SSLGetNumberSupportedCiphers(connssl->ssl_ctx, &all_ciphers_count); |
1373 | all_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite))Curl_cmalloc(all_ciphers_count*sizeof(SSLCipherSuite)); |
1374 | allowed_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite))Curl_cmalloc(all_ciphers_count*sizeof(SSLCipherSuite)); |
1375 | if(all_ciphers && allowed_ciphers && |
1376 | SSLGetSupportedCiphers(connssl->ssl_ctx, all_ciphers, |
1377 | &all_ciphers_count) == noErr) { |
1378 | for(i = 0UL ; i < all_ciphers_count ; i++) { |
1379 | #if CURL_BUILD_MAC1 |
1380 | /* There's a known bug in early versions of Mountain Lion where ST's ECC |
1381 | ciphers (cipher suite 0xC001 through 0xC032) simply do not work. |
1382 | Work around the problem here by disabling those ciphers if we are |
1383 | running in an affected version of OS X. */ |
1384 | if(darwinver_maj == 12 && darwinver_min <= 3 && |
1385 | all_ciphers[i] >= 0xC001 && all_ciphers[i] <= 0xC032) { |
1386 | continue; |
1387 | } |
1388 | #endif /* CURL_BUILD_MAC */ |
1389 | switch(all_ciphers[i]) { |
1390 | /* Disable NULL ciphersuites: */ |
1391 | case SSL_NULL_WITH_NULL_NULL: |
1392 | case SSL_RSA_WITH_NULL_MD5: |
1393 | case SSL_RSA_WITH_NULL_SHA: |
1394 | case 0x003B: /* TLS_RSA_WITH_NULL_SHA256 */ |
1395 | case SSL_FORTEZZA_DMS_WITH_NULL_SHA: |
1396 | case 0xC001: /* TLS_ECDH_ECDSA_WITH_NULL_SHA */ |
1397 | case 0xC006: /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */ |
1398 | case 0xC00B: /* TLS_ECDH_RSA_WITH_NULL_SHA */ |
1399 | case 0xC010: /* TLS_ECDHE_RSA_WITH_NULL_SHA */ |
1400 | case 0x002C: /* TLS_PSK_WITH_NULL_SHA */ |
1401 | case 0x002D: /* TLS_DHE_PSK_WITH_NULL_SHA */ |
1402 | case 0x002E: /* TLS_RSA_PSK_WITH_NULL_SHA */ |
1403 | case 0x00B0: /* TLS_PSK_WITH_NULL_SHA256 */ |
1404 | case 0x00B1: /* TLS_PSK_WITH_NULL_SHA384 */ |
1405 | case 0x00B4: /* TLS_DHE_PSK_WITH_NULL_SHA256 */ |
1406 | case 0x00B5: /* TLS_DHE_PSK_WITH_NULL_SHA384 */ |
1407 | case 0x00B8: /* TLS_RSA_PSK_WITH_NULL_SHA256 */ |
1408 | case 0x00B9: /* TLS_RSA_PSK_WITH_NULL_SHA384 */ |
1409 | /* Disable anonymous ciphersuites: */ |
1410 | case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5: |
1411 | case SSL_DH_anon_WITH_RC4_128_MD5: |
1412 | case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA: |
1413 | case SSL_DH_anon_WITH_DES_CBC_SHA: |
1414 | case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA: |
1415 | case TLS_DH_anon_WITH_AES_128_CBC_SHA: |
1416 | case TLS_DH_anon_WITH_AES_256_CBC_SHA: |
1417 | case 0xC015: /* TLS_ECDH_anon_WITH_NULL_SHA */ |
1418 | case 0xC016: /* TLS_ECDH_anon_WITH_RC4_128_SHA */ |
1419 | case 0xC017: /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */ |
1420 | case 0xC018: /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */ |
1421 | case 0xC019: /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */ |
1422 | case 0x006C: /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */ |
1423 | case 0x006D: /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */ |
1424 | case 0x00A6: /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */ |
1425 | case 0x00A7: /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */ |
1426 | /* Disable weak key ciphersuites: */ |
1427 | case SSL_RSA_EXPORT_WITH_RC4_40_MD5: |
1428 | case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5: |
1429 | case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA: |
1430 | case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA: |
1431 | case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA: |
1432 | case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA: |
1433 | case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA: |
1434 | case SSL_RSA_WITH_DES_CBC_SHA: |
1435 | case SSL_DH_DSS_WITH_DES_CBC_SHA: |
1436 | case SSL_DH_RSA_WITH_DES_CBC_SHA: |
1437 | case SSL_DHE_DSS_WITH_DES_CBC_SHA: |
1438 | case SSL_DHE_RSA_WITH_DES_CBC_SHA: |
1439 | /* Disable IDEA: */ |
1440 | case SSL_RSA_WITH_IDEA_CBC_SHA: |
1441 | case SSL_RSA_WITH_IDEA_CBC_MD5: |
1442 | break; |
1443 | default: /* enable everything else */ |
1444 | allowed_ciphers[allowed_ciphers_count++] = all_ciphers[i]; |
1445 | break; |
1446 | } |
1447 | } |
1448 | err = SSLSetEnabledCiphers(connssl->ssl_ctx, allowed_ciphers, |
1449 | allowed_ciphers_count); |
1450 | if(err != noErr) { |
1451 | failfCurl_failf(data, "SSL: SSLSetEnabledCiphers() failed: OSStatus %d", err); |
1452 | return CURLE_SSL_CONNECT_ERROR; |
1453 | } |
1454 | } |
1455 | else { |
1456 | Curl_safefree(all_ciphers)do {if((all_ciphers)) {Curl_cfree((all_ciphers)); (all_ciphers ) = ((void*)0);}} while(0); |
1457 | Curl_safefree(allowed_ciphers)do {if((allowed_ciphers)) {Curl_cfree((allowed_ciphers)); (allowed_ciphers ) = ((void*)0);}} while(0); |
1458 | failfCurl_failf(data, "SSL: Failed to allocate memory for allowed ciphers"); |
1459 | return CURLE_OUT_OF_MEMORY; |
1460 | } |
1461 | Curl_safefree(all_ciphers)do {if((all_ciphers)) {Curl_cfree((all_ciphers)); (all_ciphers ) = ((void*)0);}} while(0); |
1462 | Curl_safefree(allowed_ciphers)do {if((allowed_ciphers)) {Curl_cfree((allowed_ciphers)); (allowed_ciphers ) = ((void*)0);}} while(0); |
1463 | |
1464 | #if CURL_BUILD_MAC_10_91080 >= 1090 || CURL_BUILD_IOS_70 |
1465 | /* We want to enable 1/n-1 when using a CBC cipher unless the user |
1466 | specifically doesn't want us doing that: */ |
1467 | if(SSLSetSessionOption != NULL((void*)0)) |
1468 | SSLSetSessionOption(connssl->ssl_ctx, kSSLSessionOptionSendOneByteRecord, |
1469 | !data->set.ssl_enable_beast); |
1470 | #endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */ |
1471 | |
1472 | /* Check if there's a cached ID we can/should use here! */ |
1473 | if(!Curl_ssl_getsessionid(conn, (void **)&ssl_sessionid, |
1474 | &ssl_sessionid_len)) { |
1475 | /* we got a session id, use it! */ |
1476 | err = SSLSetPeerID(connssl->ssl_ctx, ssl_sessionid, ssl_sessionid_len); |
1477 | if(err != noErr) { |
1478 | failfCurl_failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err); |
1479 | return CURLE_SSL_CONNECT_ERROR; |
1480 | } |
1481 | /* Informational message */ |
1482 | infofCurl_infof(data, "SSL re-using session ID\n"); |
1483 | } |
1484 | /* If there isn't one, then let's make one up! This has to be done prior |
1485 | to starting the handshake. */ |
1486 | else { |
1487 | CURLcode retcode; |
1488 | |
1489 | ssl_sessionid = malloc(256*sizeof(char))Curl_cmalloc(256*sizeof(char)); |
1490 | ssl_sessionid_len = snprintfcurl_msnprintf(ssl_sessionid, 256, "curl:%s:%hu", |
1491 | conn->host.name, conn->remote_port); |
1492 | err = SSLSetPeerID(connssl->ssl_ctx, ssl_sessionid, ssl_sessionid_len); |
1493 | if(err != noErr) { |
1494 | failfCurl_failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err); |
1495 | return CURLE_SSL_CONNECT_ERROR; |
1496 | } |
1497 | retcode = Curl_ssl_addsessionid(conn, ssl_sessionid, ssl_sessionid_len); |
1498 | if(retcode!= CURLE_OK) { |
1499 | failfCurl_failf(data, "failed to store ssl session"); |
1500 | return retcode; |
1501 | } |
1502 | } |
1503 | |
1504 | err = SSLSetIOFuncs(connssl->ssl_ctx, SocketRead, SocketWrite); |
1505 | if(err != noErr) { |
1506 | failfCurl_failf(data, "SSL: SSLSetIOFuncs() failed: OSStatus %d", err); |
1507 | return CURLE_SSL_CONNECT_ERROR; |
1508 | } |
1509 | |
1510 | /* pass the raw socket into the SSL layers */ |
1511 | /* We need to store the FD in a constant memory address, because |
1512 | * SSLSetConnection() will not copy that address. I've found that |
1513 | * conn->sock[sockindex] may change on its own. */ |
1514 | connssl->ssl_sockfd = sockfd; |
1515 | err = SSLSetConnection(connssl->ssl_ctx, connssl); |
1516 | if(err != noErr) { |
1517 | failfCurl_failf(data, "SSL: SSLSetConnection() failed: %d", err); |
1518 | return CURLE_SSL_CONNECT_ERROR; |
1519 | } |
1520 | |
1521 | connssl->connecting_state = ssl_connect_2; |
1522 | return CURLE_OK; |
1523 | } |
1524 | |
1525 | static int pem_to_der(const char *in, unsigned char **out, size_t *outlen) |
1526 | { |
1527 | char *sep, *start, *end; |
1528 | int i, j, err; |
1529 | size_t len; |
1530 | unsigned char *b64; |
1531 | |
1532 | /* Jump through the separators in the first line. */ |
1533 | sep = strstr(in, "-----"); |
1534 | if (sep == NULL((void*)0)) |
1535 | return -1; |
1536 | sep = strstr(sep + 1, "-----"); |
1537 | if (sep == NULL((void*)0)) |
1538 | return -1; |
1539 | |
1540 | start = sep + 5; |
1541 | |
1542 | /* Find beginning of last line separator. */ |
1543 | end = strstr(start, "-----"); |
1544 | if (end == NULL((void*)0)) |
1545 | return -1; |
1546 | |
1547 | len = end - start; |
1548 | *out = malloc(len)Curl_cmalloc(len); |
1549 | if (!*out) |
1550 | return -1; |
1551 | |
1552 | b64 = malloc(len + 1)Curl_cmalloc(len + 1); |
1553 | if (!b64) { |
1554 | free(*out)Curl_cfree(*out); |
1555 | return -1; |
1556 | } |
1557 | |
1558 | /* Create base64 string without linefeeds. */ |
1559 | for (i = 0, j = 0; i < len; i++) { |
1560 | if (start[i] != '\r' && start[i] != '\n') |
1561 | b64[j++] = start[i]; |
1562 | } |
1563 | b64[j] = '\0'; |
1564 | |
1565 | err = (int)Curl_base64_decode((const char *)b64, out, outlen); |
1566 | free(b64)Curl_cfree(b64); |
1567 | if (err) { |
1568 | free(*out)Curl_cfree(*out); |
1569 | return -1; |
1570 | } |
1571 | |
1572 | return 0; |
1573 | } |
1574 | |
1575 | static int read_cert(const char *file, unsigned char **out, size_t *outlen) |
1576 | { |
1577 | int fd, ret, n, len = 0, cap = 512; |
1578 | size_t derlen; |
1579 | unsigned char buf[cap], *data, *der; |
1580 | |
1581 | fd = open(file, 0); |
1582 | if (fd < 0) |
1583 | return -1; |
1584 | |
1585 | data = malloc(cap)Curl_cmalloc(cap); |
1586 | if (!data) { |
1587 | close(fd); |
1588 | return -1; |
1589 | } |
1590 | |
1591 | for (;;) { |
1592 | n = read(fd, buf, sizeof(buf)); |
1593 | if (n < 0) { |
1594 | close(fd); |
1595 | free(data)Curl_cfree(data); |
1596 | return -1; |
1597 | } else if (n == 0) { |
1598 | close(fd); |
1599 | break; |
1600 | } |
1601 | |
1602 | if (len + n >= cap) { |
1603 | cap *= 2; |
1604 | data = realloc(data, cap)Curl_crealloc(data, cap); |
1605 | if (!data) { |
1606 | close(fd); |
1607 | return -1; |
1608 | } |
1609 | } |
1610 | |
1611 | memcpy(data + len, buf, n)((__builtin_object_size (data + len, 0) != (size_t) -1) ? __builtin___memcpy_chk (data + len, buf, n, __builtin_object_size (data + len, 0)) : __inline_memcpy_chk (data + len, buf, n)); |
1612 | len += n; |
1613 | } |
1614 | data[len] = '\0'; |
1615 | |
1616 | /* |
1617 | * Check if the certificate is in PEM format, and convert it to DER. If this |
1618 | * fails, we assume the certificate is in DER format. |
1619 | */ |
1620 | if (pem_to_der((const char *)data, &der, &derlen) == 0) { |
1621 | free(data)Curl_cfree(data); |
1622 | data = der; |
1623 | len = derlen; |
1624 | } |
1625 | |
1626 | *out = data; |
1627 | *outlen = len; |
1628 | |
1629 | return 0; |
1630 | } |
1631 | |
1632 | static int sslerr_to_curlerr(struct SessionHandle *data, int err) |
1633 | { |
1634 | switch(err) { |
1635 | case errSSLXCertChainInvalid: |
1636 | failfCurl_failf(data, "SSL certificate problem: Invalid certificate chain"); |
1637 | return CURLE_SSL_CACERT; |
1638 | case errSSLUnknownRootCert: |
1639 | failfCurl_failf(data, "SSL certificate problem: Untrusted root certificate"); |
1640 | return CURLE_SSL_CACERT; |
1641 | case errSSLNoRootCert: |
1642 | failfCurl_failf(data, "SSL certificate problem: No root certificate"); |
1643 | return CURLE_SSL_CACERT; |
1644 | case errSSLCertExpired: |
1645 | failfCurl_failf(data, "SSL certificate problem: Certificate chain had an " |
1646 | "expired certificate"); |
1647 | return CURLE_SSL_CACERT; |
1648 | case errSSLBadCert: |
1649 | failfCurl_failf(data, "SSL certificate problem: Couldn't understand the server " |
1650 | "certificate format"); |
1651 | return CURLE_SSL_CONNECT_ERROR; |
1652 | case errSSLHostNameMismatch: |
1653 | failfCurl_failf(data, "SSL certificate peer hostname mismatch"); |
1654 | return CURLE_PEER_FAILED_VERIFICATION; |
1655 | default: |
1656 | failfCurl_failf(data, "SSL unexpected certificate error %d", err); |
1657 | return CURLE_SSL_CACERT; |
1658 | } |
1659 | } |
1660 | |
1661 | static int verify_cert(const char *cafile, struct SessionHandle *data, |
1662 | SSLContextRef ctx) |
1663 | { |
1664 | unsigned char *certbuf; |
1665 | size_t buflen; |
1666 | if (read_cert(cafile, &certbuf, &buflen) < 0) { |
1667 | failfCurl_failf(data, "SSL: failed to read or invalid CA certificate"); |
1668 | return CURLE_SSL_CACERT; |
1669 | } |
1670 | |
1671 | CFDataRef certdata = CFDataCreate(kCFAllocatorDefault, certbuf, buflen); |
1672 | free(certbuf)Curl_cfree(certbuf); |
1673 | if (!certdata) { |
1674 | failfCurl_failf(data, "SSL: failed to allocate array for CA certificate"); |
1675 | return CURLE_OUT_OF_MEMORY; |
1676 | } |
1677 | |
1678 | SecCertificateRef cacert = SecCertificateCreateWithData(kCFAllocatorDefault, |
1679 | certdata); |
1680 | CFRelease(certdata); |
1681 | if (!cacert) { |
1682 | failfCurl_failf(data, "SSL: failed to create SecCertificate from CA certificate"); |
1683 | return CURLE_SSL_CACERT; |
1684 | } |
1685 | |
1686 | SecTrustRef trust; |
1687 | OSStatus ret = SSLCopyPeerTrust(ctx, &trust); |
1688 | if (trust == NULL((void*)0)) { |
1689 | failfCurl_failf(data, "SSL: error getting certificate chain"); |
1690 | return CURLE_OUT_OF_MEMORY; |
1691 | } else if (ret != noErr) { |
1692 | return sslerr_to_curlerr(data, ret); |
1693 | } |
1694 | |
1695 | CFMutableArrayRef array = CFArrayCreateMutable(kCFAllocatorDefault, 0, |
1696 | &kCFTypeArrayCallBacks); |
1697 | CFArrayAppendValue(array, cacert); |
1698 | CFRelease(cacert); |
1699 | |
1700 | ret = SecTrustSetAnchorCertificates(trust, array); |
1701 | if (ret != noErr) { |
1702 | CFRelease(trust); |
1703 | return sslerr_to_curlerr(data, ret); |
1704 | } |
1705 | |
1706 | SecTrustResultType trust_eval = 0; |
1707 | ret = SecTrustEvaluate(trust, &trust_eval); |
1708 | CFRelease(array); |
1709 | CFRelease(trust); |
1710 | if (ret != noErr) { |
1711 | return sslerr_to_curlerr(data, ret); |
1712 | } |
1713 | |
1714 | switch (trust_eval) { |
1715 | case kSecTrustResultUnspecified: |
1716 | case kSecTrustResultProceed: |
1717 | infofCurl_infof(data, "SSL: certificate verification succeeded (result: %d)", |
1718 | trust_eval); |
1719 | return CURLE_OK; |
1720 | |
1721 | case kSecTrustResultRecoverableTrustFailure: |
1722 | case kSecTrustResultDeny: |
1723 | default: |
1724 | failfCurl_failf(data, "SSL: certificate verification failed (result: %d)", |
1725 | trust_eval); |
1726 | return CURLE_PEER_FAILED_VERIFICATION; |
1727 | } |
1728 | } |
1729 | |
1730 | static CURLcode |
1731 | darwinssl_connect_step2(struct connectdata *conn, int sockindex) |
1732 | { |
1733 | struct SessionHandle *data = conn->data; |
1734 | struct ssl_connect_data *connssl = &conn->ssl[sockindex]; |
1735 | OSStatus err; |
1736 | SSLCipherSuite cipher; |
1737 | SSLProtocol protocol = 0; |
1738 | |
1739 | DEBUGASSERT(ssl_connect_2 == connssl->connecting_statedo { } while(0) |
1740 | || ssl_connect_2_reading == connssl->connecting_statedo { } while(0) |
1741 | || ssl_connect_2_writing == connssl->connecting_state)do { } while(0); |
1742 | |
1743 | /* Here goes nothing: */ |
1744 | err = SSLHandshake(connssl->ssl_ctx); |
1745 | |
1746 | if(err != noErr) { |
1747 | switch (err) { |
1748 | case errSSLWouldBlock: /* they're not done with us yet */ |
1749 | connssl->connecting_state = connssl->ssl_direction ? |
1750 | ssl_connect_2_writing : ssl_connect_2_reading; |
1751 | return CURLE_OK; |
1752 | |
1753 | /* The below is errSSLServerAuthCompleted; it's not defined in |
1754 | Leopard's headers */ |
1755 | case -9841: |
1756 | if(data->set.str[STRING_SSL_CAFILE]) { |
1757 | int res = verify_cert(data->set.str[STRING_SSL_CAFILE], data, |
1758 | connssl->ssl_ctx); |
1759 | if (res != CURLE_OK) |
1760 | return res; |
1761 | } |
1762 | /* the documentation says we need to call SSLHandshake() again */ |
1763 | return darwinssl_connect_step2(conn, sockindex); |
1764 | |
1765 | /* These are all certificate problems with the server: */ |
1766 | case errSSLXCertChainInvalid: |
1767 | failfCurl_failf(data, "SSL certificate problem: Invalid certificate chain"); |
1768 | return CURLE_SSL_CACERT; |
1769 | case errSSLUnknownRootCert: |
1770 | failfCurl_failf(data, "SSL certificate problem: Untrusted root certificate"); |
1771 | return CURLE_SSL_CACERT; |
1772 | case errSSLNoRootCert: |
1773 | failfCurl_failf(data, "SSL certificate problem: No root certificate"); |
1774 | return CURLE_SSL_CACERT; |
1775 | case errSSLCertExpired: |
1776 | failfCurl_failf(data, "SSL certificate problem: Certificate chain had an " |
1777 | "expired certificate"); |
1778 | return CURLE_SSL_CACERT; |
1779 | case errSSLBadCert: |
1780 | failfCurl_failf(data, "SSL certificate problem: Couldn't understand the server " |
1781 | "certificate format"); |
1782 | return CURLE_SSL_CONNECT_ERROR; |
1783 | |
1784 | /* These are all certificate problems with the client: */ |
1785 | case errSecAuthFailed: |
1786 | failfCurl_failf(data, "SSL authentication failed"); |
1787 | return CURLE_SSL_CONNECT_ERROR; |
1788 | case errSSLPeerHandshakeFail: |
1789 | failfCurl_failf(data, "SSL peer handshake failed, the server most likely " |
1790 | "requires a client certificate to connect"); |
1791 | return CURLE_SSL_CONNECT_ERROR; |
1792 | case errSSLPeerUnknownCA: |
1793 | failfCurl_failf(data, "SSL server rejected the client certificate due to " |
1794 | "the certificate being signed by an unknown certificate " |
1795 | "authority"); |
1796 | return CURLE_SSL_CONNECT_ERROR; |
1797 | |
1798 | /* This error is raised if the server's cert didn't match the server's |
1799 | host name: */ |
1800 | case errSSLHostNameMismatch: |
1801 | failfCurl_failf(data, "SSL certificate peer verification failed, the " |
1802 | "certificate did not match \"%s\"\n", conn->host.dispname); |
1803 | return CURLE_PEER_FAILED_VERIFICATION; |
1804 | |
1805 | /* Generic handshake errors: */ |
1806 | case errSSLConnectionRefused: |
1807 | failfCurl_failf(data, "Server dropped the connection during the SSL handshake"); |
1808 | return CURLE_SSL_CONNECT_ERROR; |
1809 | case errSSLClosedAbort: |
1810 | failfCurl_failf(data, "Server aborted the SSL handshake"); |
1811 | return CURLE_SSL_CONNECT_ERROR; |
1812 | case errSSLNegotiation: |
1813 | failfCurl_failf(data, "Could not negotiate an SSL cipher suite with the server"); |
1814 | return CURLE_SSL_CONNECT_ERROR; |
1815 | /* Sometimes paramErr happens with buggy ciphers: */ |
1816 | case paramErr-50: case errSSLInternal: |
1817 | failfCurl_failf(data, "Internal SSL engine error encountered during the " |
1818 | "SSL handshake"); |
1819 | return CURLE_SSL_CONNECT_ERROR; |
1820 | case errSSLFatalAlert: |
1821 | failfCurl_failf(data, "Fatal SSL engine error encountered during the SSL " |
1822 | "handshake"); |
1823 | return CURLE_SSL_CONNECT_ERROR; |
1824 | default: |
1825 | failfCurl_failf(data, "Unknown SSL protocol error in connection to %s:%d", |
1826 | conn->host.name, err); |
1827 | return CURLE_SSL_CONNECT_ERROR; |
1828 | } |
1829 | } |
1830 | else { |
1831 | /* we have been connected fine, we're not waiting for anything else. */ |
1832 | connssl->connecting_state = ssl_connect_3; |
1833 | |
1834 | /* Informational message */ |
1835 | (void)SSLGetNegotiatedCipher(connssl->ssl_ctx, &cipher); |
1836 | (void)SSLGetNegotiatedProtocolVersion(connssl->ssl_ctx, &protocol); |
1837 | switch (protocol) { |
1838 | case kSSLProtocol2: |
1839 | infofCurl_infof(data, "SSL 2.0 connection using %s\n", |
1840 | SSLCipherNameForNumber(cipher)); |
1841 | break; |
1842 | case kSSLProtocol3: |
1843 | infofCurl_infof(data, "SSL 3.0 connection using %s\n", |
1844 | SSLCipherNameForNumber(cipher)); |
1845 | break; |
1846 | case kTLSProtocol1: |
1847 | infofCurl_infof(data, "TLS 1.0 connection using %s\n", |
1848 | TLSCipherNameForNumber(cipher)); |
1849 | break; |
1850 | #if CURL_BUILD_MAC_10_81080 >= 1080 || CURL_BUILD_IOS0 |
1851 | case kTLSProtocol11: |
1852 | infofCurl_infof(data, "TLS 1.1 connection using %s\n", |
1853 | TLSCipherNameForNumber(cipher)); |
1854 | break; |
1855 | case kTLSProtocol12: |
1856 | infofCurl_infof(data, "TLS 1.2 connection using %s\n", |
1857 | TLSCipherNameForNumber(cipher)); |
1858 | break; |
1859 | #endif |
1860 | default: |
1861 | infofCurl_infof(data, "Unknown protocol connection\n"); |
1862 | break; |
1863 | } |
1864 | |
1865 | return CURLE_OK; |
1866 | } |
1867 | } |
1868 | |
1869 | static CURLcode |
1870 | darwinssl_connect_step3(struct connectdata *conn, |
1871 | int sockindex) |
1872 | { |
1873 | struct SessionHandle *data = conn->data; |
1874 | struct ssl_connect_data *connssl = &conn->ssl[sockindex]; |
1875 | CFStringRef server_cert_summary; |
1876 | char server_cert_summary_c[128]; |
1877 | CFArrayRef server_certs = NULL((void*)0); |
1878 | SecCertificateRef server_cert; |
1879 | OSStatus err; |
1880 | CFIndex i, count; |
1881 | SecTrustRef trust = NULL((void*)0); |
1882 | |
1883 | /* There is no step 3! |
1884 | * Well, okay, if verbose mode is on, let's print the details of the |
1885 | * server certificates. */ |
1886 | #if CURL_BUILD_MAC_10_71080 >= 1070 || CURL_BUILD_IOS0 |
1887 | #if CURL_BUILD_IOS0 |
1888 | #pragma unused(server_certs) |
1889 | err = SSLCopyPeerTrust(connssl->ssl_ctx, &trust); |
1890 | /* For some reason, SSLCopyPeerTrust() can return noErr and yet return |
1891 | a null trust, so be on guard for that: */ |
1892 | if(err == noErr && trust) { |
1893 | count = SecTrustGetCertificateCount(trust); |
1894 | for(i = 0L ; i < count ; i++) { |
1895 | server_cert = SecTrustGetCertificateAtIndex(trust, i); |
1896 | server_cert_summary = CopyCertSubject(server_cert); |
1897 | memset(server_cert_summary_c, 0, 128)((__builtin_object_size (server_cert_summary_c, 0) != (size_t ) -1) ? __builtin___memset_chk (server_cert_summary_c, 0, 128 , __builtin_object_size (server_cert_summary_c, 0)) : __inline_memset_chk (server_cert_summary_c, 0, 128)); |
1898 | if(CFStringGetCString(server_cert_summary, |
1899 | server_cert_summary_c, |
1900 | 128, |
1901 | kCFStringEncodingUTF8)) { |
1902 | infofCurl_infof(data, "Server certificate: %s\n", server_cert_summary_c); |
1903 | } |
1904 | CFRelease(server_cert_summary); |
1905 | } |
1906 | CFRelease(trust); |
1907 | } |
1908 | #else |
1909 | /* SSLCopyPeerCertificates() is deprecated as of Mountain Lion. |
1910 | The function SecTrustGetCertificateAtIndex() is officially present |
1911 | in Lion, but it is unfortunately also present in Snow Leopard as |
1912 | private API and doesn't work as expected. So we have to look for |
1913 | a different symbol to make sure this code is only executed under |
1914 | Lion or later. */ |
1915 | if(SecTrustEvaluateAsync != NULL((void*)0)) { |
1916 | #pragma unused(server_certs) |
1917 | err = SSLCopyPeerTrust(connssl->ssl_ctx, &trust); |
1918 | /* For some reason, SSLCopyPeerTrust() can return noErr and yet return |
1919 | a null trust, so be on guard for that: */ |
1920 | if(err == noErr && trust) { |
1921 | count = SecTrustGetCertificateCount(trust); |
1922 | for(i = 0L ; i < count ; i++) { |
1923 | server_cert = SecTrustGetCertificateAtIndex(trust, i); |
1924 | server_cert_summary = CopyCertSubject(server_cert); |
1925 | memset(server_cert_summary_c, 0, 128)((__builtin_object_size (server_cert_summary_c, 0) != (size_t ) -1) ? __builtin___memset_chk (server_cert_summary_c, 0, 128 , __builtin_object_size (server_cert_summary_c, 0)) : __inline_memset_chk (server_cert_summary_c, 0, 128)); |
1926 | if(CFStringGetCString(server_cert_summary, |
1927 | server_cert_summary_c, |
1928 | 128, |
1929 | kCFStringEncodingUTF8)) { |
1930 | infofCurl_infof(data, "Server certificate: %s\n", server_cert_summary_c); |
1931 | } |
1932 | CFRelease(server_cert_summary); |
1933 | } |
1934 | CFRelease(trust); |
1935 | } |
1936 | } |
1937 | else { |
1938 | #if CURL_SUPPORT_MAC_10_81080 <= 1080 |
1939 | err = SSLCopyPeerCertificates(connssl->ssl_ctx, &server_certs); |
1940 | /* Just in case SSLCopyPeerCertificates() returns null too... */ |
1941 | if(err == noErr && server_certs) { |
1942 | count = CFArrayGetCount(server_certs); |
1943 | for(i = 0L ; i < count ; i++) { |
1944 | server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs, |
1945 | i); |
1946 | |
1947 | server_cert_summary = CopyCertSubject(server_cert); |
1948 | memset(server_cert_summary_c, 0, 128)((__builtin_object_size (server_cert_summary_c, 0) != (size_t ) -1) ? __builtin___memset_chk (server_cert_summary_c, 0, 128 , __builtin_object_size (server_cert_summary_c, 0)) : __inline_memset_chk (server_cert_summary_c, 0, 128)); |
1949 | if(CFStringGetCString(server_cert_summary, |
1950 | server_cert_summary_c, |
1951 | 128, |
1952 | kCFStringEncodingUTF8)) { |
1953 | infofCurl_infof(data, "Server certificate: %s\n", server_cert_summary_c); |
1954 | } |
1955 | CFRelease(server_cert_summary); |
1956 | } |
1957 | CFRelease(server_certs); |
1958 | } |
1959 | #endif /* CURL_SUPPORT_MAC_10_8 */ |
1960 | } |
1961 | #endif /* CURL_BUILD_IOS */ |
1962 | #else |
1963 | #pragma unused(trust) |
1964 | err = SSLCopyPeerCertificates(connssl->ssl_ctx, &server_certs); |
1965 | if(err == noErr) { |
1966 | count = CFArrayGetCount(server_certs); |
1967 | for(i = 0L ; i < count ; i++) { |
1968 | server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs, i); |
1969 | server_cert_summary = CopyCertSubject(server_cert); |
1970 | memset(server_cert_summary_c, 0, 128)((__builtin_object_size (server_cert_summary_c, 0) != (size_t ) -1) ? __builtin___memset_chk (server_cert_summary_c, 0, 128 , __builtin_object_size (server_cert_summary_c, 0)) : __inline_memset_chk (server_cert_summary_c, 0, 128)); |
1971 | if(CFStringGetCString(server_cert_summary, |
1972 | server_cert_summary_c, |
1973 | 128, |
1974 | kCFStringEncodingUTF8)) { |
1975 | infofCurl_infof(data, "Server certificate: %s\n", server_cert_summary_c); |
1976 | } |
1977 | CFRelease(server_cert_summary); |
1978 | } |
1979 | CFRelease(server_certs); |
1980 | } |
1981 | #endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */ |
1982 | |
1983 | connssl->connecting_state = ssl_connect_done; |
1984 | return CURLE_OK; |
1985 | } |
1986 | |
1987 | static Curl_recv darwinssl_recv; |
1988 | static Curl_send darwinssl_send; |
1989 | |
1990 | static CURLcode |
1991 | darwinssl_connect_common(struct connectdata *conn, |
1992 | int sockindex, |
1993 | bool_Bool nonblocking, |
1994 | bool_Bool *done) |
1995 | { |
1996 | CURLcode retcode; |
1997 | struct SessionHandle *data = conn->data; |
1998 | struct ssl_connect_data *connssl = &conn->ssl[sockindex]; |
1999 | curl_socket_t sockfd = conn->sock[sockindex]; |
2000 | long timeout_ms; |
2001 | int what; |
2002 | |
2003 | /* check if the connection has already been established */ |
2004 | if(ssl_connection_complete == connssl->state) { |
2005 | *done = TRUE1; |
2006 | return CURLE_OK; |
2007 | } |
2008 | |
2009 | if(ssl_connect_1==connssl->connecting_state) { |
2010 | /* Find out how much more time we're allowed */ |
2011 | timeout_ms = Curl_timeleft(data, NULL((void*)0), TRUE1); |
2012 | |
2013 | if(timeout_ms < 0) { |
2014 | /* no need to continue if time already is up */ |
2015 | failfCurl_failf(data, "SSL connection timeout"); |
2016 | return CURLE_OPERATION_TIMEDOUT; |
2017 | } |
2018 | retcode = darwinssl_connect_step1(conn, sockindex); |
2019 | if(retcode) |
2020 | return retcode; |
2021 | } |
2022 | |
2023 | while(ssl_connect_2 == connssl->connecting_state || |
2024 | ssl_connect_2_reading == connssl->connecting_state || |
2025 | ssl_connect_2_writing == connssl->connecting_state) { |
2026 | |
2027 | /* check allowed time left */ |
2028 | timeout_ms = Curl_timeleft(data, NULL((void*)0), TRUE1); |
2029 | |
2030 | if(timeout_ms < 0) { |
2031 | /* no need to continue if time already is up */ |
2032 | failfCurl_failf(data, "SSL connection timeout"); |
2033 | return CURLE_OPERATION_TIMEDOUT; |
2034 | } |
2035 | |
2036 | /* if ssl is expecting something, check if it's available. */ |
2037 | if(connssl->connecting_state == ssl_connect_2_reading |
2038 | || connssl->connecting_state == ssl_connect_2_writing) { |
2039 | |
2040 | curl_socket_t writefd = ssl_connect_2_writing == |
2041 | connssl->connecting_state?sockfd:CURL_SOCKET_BAD-1; |
2042 | curl_socket_t readfd = ssl_connect_2_reading == |
2043 | connssl->connecting_state?sockfd:CURL_SOCKET_BAD-1; |
2044 | |
2045 | what = Curl_socket_ready(readfd, writefd, nonblocking?0:timeout_ms)Curl_socket_check(readfd, -1, writefd, nonblocking?0:timeout_ms ); |
2046 | if(what < 0) { |
2047 | /* fatal error */ |
2048 | failfCurl_failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO((*__error()))); |
2049 | return CURLE_SSL_CONNECT_ERROR; |
2050 | } |
2051 | else if(0 == what) { |
2052 | if(nonblocking) { |
2053 | *done = FALSE0; |
2054 | return CURLE_OK; |
2055 | } |
2056 | else { |
2057 | /* timeout */ |
2058 | failfCurl_failf(data, "SSL connection timeout"); |
2059 | return CURLE_OPERATION_TIMEDOUT; |
2060 | } |
2061 | } |
2062 | /* socket is readable or writable */ |
2063 | } |
2064 | |
2065 | /* Run transaction, and return to the caller if it failed or if this |
2066 | * connection is done nonblocking and this loop would execute again. This |
2067 | * permits the owner of a multi handle to abort a connection attempt |
2068 | * before step2 has completed while ensuring that a client using select() |
2069 | * or epoll() will always have a valid fdset to wait on. |
2070 | */ |
2071 | retcode = darwinssl_connect_step2(conn, sockindex); |
2072 | if(retcode || (nonblocking && |
2073 | (ssl_connect_2 == connssl->connecting_state || |
2074 | ssl_connect_2_reading == connssl->connecting_state || |
2075 | ssl_connect_2_writing == connssl->connecting_state))) |
2076 | return retcode; |
2077 | |
2078 | } /* repeat step2 until all transactions are done. */ |
2079 | |
2080 | |
2081 | if(ssl_connect_3==connssl->connecting_state) { |
2082 | retcode = darwinssl_connect_step3(conn, sockindex); |
2083 | if(retcode) |
2084 | return retcode; |
2085 | } |
2086 | |
2087 | if(ssl_connect_done==connssl->connecting_state) { |
2088 | connssl->state = ssl_connection_complete; |
2089 | conn->recv[sockindex] = darwinssl_recv; |
2090 | conn->send[sockindex] = darwinssl_send; |
2091 | *done = TRUE1; |
2092 | } |
2093 | else |
2094 | *done = FALSE0; |
2095 | |
2096 | /* Reset our connect state machine */ |
2097 | connssl->connecting_state = ssl_connect_1; |
2098 | |
2099 | return CURLE_OK; |
2100 | } |
2101 | |
2102 | CURLcode |
2103 | Curl_darwinssl_connect_nonblocking(struct connectdata *conn, |
2104 | int sockindex, |
2105 | bool_Bool *done) |
2106 | { |
2107 | return darwinssl_connect_common(conn, sockindex, TRUE1, done); |
2108 | } |
2109 | |
2110 | CURLcode |
2111 | Curl_darwinssl_connect(struct connectdata *conn, |
2112 | int sockindex) |
2113 | { |
2114 | CURLcode retcode; |
2115 | bool_Bool done = FALSE0; |
2116 | |
2117 | retcode = darwinssl_connect_common(conn, sockindex, FALSE0, &done); |
2118 | |
2119 | if(retcode) |
2120 | return retcode; |
2121 | |
2122 | DEBUGASSERT(done)do { } while(0); |
2123 | |
2124 | return CURLE_OK; |
2125 | } |
2126 | |
2127 | void Curl_darwinssl_close(struct connectdata *conn, int sockindex) |
2128 | { |
2129 | struct ssl_connect_data *connssl = &conn->ssl[sockindex]; |
2130 | |
2131 | if(connssl->ssl_ctx) { |
2132 | (void)SSLClose(connssl->ssl_ctx); |
2133 | #if CURL_BUILD_MAC_10_81080 >= 1080 || CURL_BUILD_IOS0 |
2134 | if(SSLCreateContext != NULL((void*)0)) |
2135 | CFRelease(connssl->ssl_ctx); |
2136 | #if CURL_SUPPORT_MAC_10_81080 <= 1080 |
2137 | else |
2138 | (void)SSLDisposeContext(connssl->ssl_ctx); |
2139 | #endif /* CURL_SUPPORT_MAC_10_8 */ |
2140 | #else |
2141 | (void)SSLDisposeContext(connssl->ssl_ctx); |
2142 | #endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */ |
2143 | connssl->ssl_ctx = NULL((void*)0); |
2144 | } |
2145 | connssl->ssl_sockfd = 0; |
2146 | } |
2147 | |
2148 | void Curl_darwinssl_close_all(struct SessionHandle *data) |
2149 | { |
2150 | /* SecureTransport doesn't separate sessions from contexts, so... */ |
2151 | (void)data; |
2152 | } |
2153 | |
2154 | int Curl_darwinssl_shutdown(struct connectdata *conn, int sockindex) |
2155 | { |
2156 | struct ssl_connect_data *connssl = &conn->ssl[sockindex]; |
2157 | struct SessionHandle *data = conn->data; |
2158 | ssize_t nread; |
2159 | int what; |
2160 | int rc; |
2161 | char buf[120]; |
2162 | |
2163 | if(!connssl->ssl_ctx) |
2164 | return 0; |
2165 | |
2166 | if(data->set.ftp_ccc != CURLFTPSSL_CCC_ACTIVE) |
2167 | return 0; |
2168 | |
2169 | Curl_darwinssl_close(conn, sockindex); |
2170 | |
2171 | rc = 0; |
2172 | |
2173 | what = Curl_socket_ready(conn->sock[sockindex],Curl_socket_check(conn->sock[sockindex], -1, -1, 10000) |
2174 | CURL_SOCKET_BAD, SSL_SHUTDOWN_TIMEOUT)Curl_socket_check(conn->sock[sockindex], -1, -1, 10000); |
2175 | |
2176 | for(;;) { |
2177 | if(what < 0) { |
2178 | /* anything that gets here is fatally bad */ |
2179 | failfCurl_failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO((*__error()))); |
2180 | rc = -1; |
2181 | break; |
2182 | } |
2183 | |
2184 | if(!what) { /* timeout */ |
2185 | failfCurl_failf(data, "SSL shutdown timeout"); |
2186 | break; |
2187 | } |
2188 | |
2189 | /* Something to read, let's do it and hope that it is the close |
2190 | notify alert from the server. No way to SSL_Read now, so use read(). */ |
2191 | |
2192 | nread = read(conn->sock[sockindex], buf, sizeof(buf)); |
2193 | |
2194 | if(nread < 0) { |
2195 | failfCurl_failf(data, "read: %s", strerror(errno(*__error()))); |
2196 | rc = -1; |
2197 | } |
2198 | |
2199 | if(nread <= 0) |
2200 | break; |
2201 | |
2202 | what = Curl_socket_ready(conn->sock[sockindex], CURL_SOCKET_BAD, 0)Curl_socket_check(conn->sock[sockindex], -1, -1, 0); |
2203 | } |
2204 | |
2205 | return rc; |
2206 | } |
2207 | |
2208 | void Curl_darwinssl_session_free(void *ptr) |
2209 | { |
2210 | /* ST, as of iOS 5 and Mountain Lion, has no public method of deleting a |
2211 | cached session ID inside the Security framework. There is a private |
2212 | function that does this, but I don't want to have to explain to you why I |
2213 | got your application rejected from the App Store due to the use of a |
2214 | private API, so the best we can do is free up our own char array that we |
2215 | created way back in darwinssl_connect_step1... */ |
2216 | Curl_safefree(ptr)do {if((ptr)) {Curl_cfree((ptr)); (ptr) = ((void*)0);}} while (0); |
2217 | } |
2218 | |
2219 | size_t Curl_darwinssl_version(char *buffer, size_t size) |
2220 | { |
2221 | return snprintfcurl_msnprintf(buffer, size, "SecureTransport"); |
2222 | } |
2223 | |
2224 | /* |
2225 | * This function uses SSLGetSessionState to determine connection status. |
2226 | * |
2227 | * Return codes: |
2228 | * 1 means the connection is still in place |
2229 | * 0 means the connection has been closed |
2230 | * -1 means the connection status is unknown |
2231 | */ |
2232 | int Curl_darwinssl_check_cxn(struct connectdata *conn) |
2233 | { |
2234 | struct ssl_connect_data *connssl = &conn->ssl[FIRSTSOCKET0]; |
2235 | OSStatus err; |
2236 | SSLSessionState state; |
2237 | |
2238 | if(connssl->ssl_ctx) { |
2239 | err = SSLGetSessionState(connssl->ssl_ctx, &state); |
2240 | if(err == noErr) |
2241 | return state == kSSLConnected || state == kSSLHandshake; |
2242 | return -1; |
2243 | } |
2244 | return 0; |
2245 | } |
2246 | |
2247 | bool_Bool Curl_darwinssl_data_pending(const struct connectdata *conn, |
2248 | int connindex) |
2249 | { |
2250 | const struct ssl_connect_data *connssl = &conn->ssl[connindex]; |
2251 | OSStatus err; |
2252 | size_t buffer; |
2253 | |
2254 | if(connssl->ssl_ctx) { /* SSL is in use */ |
2255 | err = SSLGetBufferedReadSize(connssl->ssl_ctx, &buffer); |
2256 | if(err == noErr) |
2257 | return buffer > 0UL; |
2258 | return false0; |
2259 | } |
2260 | else |
2261 | return false0; |
2262 | } |
2263 | |
2264 | void Curl_darwinssl_random(struct SessionHandle *data, |
2265 | unsigned char *entropy, |
2266 | size_t length) |
2267 | { |
2268 | /* arc4random_buf() isn't available on cats older than Lion, so let's |
2269 | do this manually for the benefit of the older cats. */ |
2270 | size_t i; |
2271 | u_int32_t random_number = 0; |
2272 | |
2273 | for(i = 0 ; i < length ; i++) { |
2274 | if(i % sizeof(u_int32_t) == 0) |
2275 | random_number = arc4random(); |
2276 | entropy[i] = random_number & 0xFF; |
2277 | random_number >>= 8; |
2278 | } |
2279 | i = random_number = 0; |
2280 | (void)data; |
2281 | } |
2282 | |
2283 | void Curl_darwinssl_md5sum(unsigned char *tmp, /* input */ |
2284 | size_t tmplen, |
2285 | unsigned char *md5sum, /* output */ |
2286 | size_t md5len) |
2287 | { |
2288 | (void)md5len; |
2289 | (void)CC_MD5(tmp, (CC_LONG)tmplen, md5sum); |
2290 | } |
2291 | |
2292 | static ssize_t darwinssl_send(struct connectdata *conn, |
2293 | int sockindex, |
2294 | const void *mem, |
2295 | size_t len, |
2296 | CURLcode *curlcode) |
2297 | { |
2298 | /*struct SessionHandle *data = conn->data;*/ |
2299 | struct ssl_connect_data *connssl = &conn->ssl[sockindex]; |
2300 | size_t processed = 0UL; |
2301 | OSStatus err; |
2302 | |
2303 | /* The SSLWrite() function works a little differently than expected. The |
2304 | fourth argument (processed) is currently documented in Apple's |
2305 | documentation as: "On return, the length, in bytes, of the data actually |
2306 | written." |
2307 | |
2308 | Now, one could interpret that as "written to the socket," but actually, |
2309 | it returns the amount of data that was written to a buffer internal to |
2310 | the SSLContextRef instead. So it's possible for SSLWrite() to return |
2311 | errSSLWouldBlock and a number of bytes "written" because those bytes were |
2312 | encrypted and written to a buffer, not to the socket. |
2313 | |
2314 | So if this happens, then we need to keep calling SSLWrite() over and |
2315 | over again with no new data until it quits returning errSSLWouldBlock. */ |
2316 | |
2317 | /* Do we have buffered data to write from the last time we were called? */ |
2318 | if(connssl->ssl_write_buffered_length) { |
2319 | /* Write the buffered data: */ |
2320 | err = SSLWrite(connssl->ssl_ctx, NULL((void*)0), 0UL, &processed); |
2321 | switch (err) { |
2322 | case noErr: |
2323 | /* processed is always going to be 0 because we didn't write to |
2324 | the buffer, so return how much was written to the socket */ |
2325 | processed = connssl->ssl_write_buffered_length; |
2326 | connssl->ssl_write_buffered_length = 0UL; |
2327 | break; |
2328 | case errSSLWouldBlock: /* argh, try again */ |
2329 | *curlcode = CURLE_AGAIN; |
2330 | return -1L; |
2331 | default: |
2332 | failfCurl_failf(conn->data, "SSLWrite() returned error %d", err); |
2333 | *curlcode = CURLE_SEND_ERROR; |
2334 | return -1L; |
2335 | } |
2336 | } |
2337 | else { |
2338 | /* We've got new data to write: */ |
2339 | err = SSLWrite(connssl->ssl_ctx, mem, len, &processed); |
2340 | if(err != noErr) { |
2341 | switch (err) { |
2342 | case errSSLWouldBlock: |
2343 | /* Data was buffered but not sent, we have to tell the caller |
2344 | to try sending again, and remember how much was buffered */ |
2345 | connssl->ssl_write_buffered_length = len; |
2346 | *curlcode = CURLE_AGAIN; |
2347 | return -1L; |
2348 | default: |
2349 | failfCurl_failf(conn->data, "SSLWrite() returned error %d", err); |
2350 | *curlcode = CURLE_SEND_ERROR; |
2351 | return -1L; |
2352 | } |
2353 | } |
2354 | } |
2355 | return (ssize_t)processed; |
2356 | } |
2357 | |
2358 | static ssize_t darwinssl_recv(struct connectdata *conn, |
2359 | int num, |
2360 | char *buf, |
2361 | size_t buffersize, |
2362 | CURLcode *curlcode) |
2363 | { |
2364 | /*struct SessionHandle *data = conn->data;*/ |
2365 | struct ssl_connect_data *connssl = &conn->ssl[num]; |
2366 | size_t processed = 0UL; |
2367 | OSStatus err = SSLRead(connssl->ssl_ctx, buf, buffersize, &processed); |
2368 | |
2369 | if(err != noErr) { |
2370 | switch (err) { |
2371 | case errSSLWouldBlock: /* return how much we read (if anything) */ |
2372 | if(processed) |
2373 | return (ssize_t)processed; |
2374 | *curlcode = CURLE_AGAIN; |
2375 | return -1L; |
2376 | break; |
2377 | |
2378 | /* errSSLClosedGraceful - server gracefully shut down the SSL session |
2379 | errSSLClosedNoNotify - server hung up on us instead of sending a |
2380 | closure alert notice, read() is returning 0 |
2381 | Either way, inform the caller that the server disconnected. */ |
2382 | case errSSLClosedGraceful: |
2383 | case errSSLClosedNoNotify: |
2384 | *curlcode = CURLE_OK; |
2385 | return -1L; |
2386 | break; |
2387 | |
2388 | default: |
2389 | failfCurl_failf(conn->data, "SSLRead() return error %d", err); |
2390 | *curlcode = CURLE_RECV_ERROR; |
2391 | return -1L; |
2392 | break; |
2393 | } |
2394 | } |
2395 | return (ssize_t)processed; |
2396 | } |
2397 | |
2398 | #endif /* USE_DARWINSSL */ |