bearssl.c@ 98326

最後變更在這個檔案從98326是 98326,由 vboxsync 提交於 2 年前
curl-7.87.0: Applied and adjusted our curl changes to 7.83.1. bugref:10356
屬性 svn:eol-style 設為 `native`
檔案大小: 37.4 KB

行
1	/***************************************************************************
2	* _ _ ____ _
3	* Project ___\| \| \| \| _ \\| \|
4	* / __\| \| \| \| \|_) \| \|
5	* \| (__\| \|_\| \| _ <\| \|___
6	* \___\|\___/\|_\| \_\_____\|
7	*
8	* Copyright (C) 2019 - 2022, Michael Forney, <[email protected]>
9	*
10	* This software is licensed as described in the file COPYING, which
11	* you should have received as part of this distribution. The terms
12	* are also available at https://curl.se/docs/copyright.html.
13	*
14	* You may opt to use, copy, modify, merge, publish, distribute and/or sell
15	* copies of the Software, and permit persons to whom the Software is
16	* furnished to do so, under the terms of the COPYING file.
17	*
18	* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19	* KIND, either express or implied.
20	*
21	* SPDX-License-Identifier: curl
22	*
23	***************************************************************************/
24	#include "curl_setup.h"
25
26	#ifdef USE_BEARSSL
27
28	#include <bearssl.h>
29
30	#include "bearssl.h"
31	#include "urldata.h"
32	#include "sendf.h"
33	#include "inet_pton.h"
34	#include "vtls.h"
35	#include "vtls_int.h"
36	#include "connect.h"
37	#include "select.h"
38	#include "multiif.h"
39	#include "curl_printf.h"
40	#include "strcase.h"
41
42	/* The last #include files should be: */
43	#include "curl_memory.h"
44	#include "memdebug.h"
45
46	struct x509_context {
47	const br_x509_class *vtable;
48	br_x509_minimal_context minimal;
49	br_x509_decoder_context decoder;
50	bool verifyhost;
51	bool verifypeer;
52	int cert_num;
53	};
54
55	struct ssl_backend_data {
56	br_ssl_client_context ctx;
57	struct x509_context x509;
58	unsigned char buf[BR_SSL_BUFSIZE_BIDI];
59	br_x509_trust_anchor *anchors;
60	size_t anchors_len;
61	const char *protocols[2];
62	/* SSL client context is active */
63	bool active;
64	/* size of pending write, yet to be flushed */
65	size_t pending_write;
66	};
67
68	struct cafile_parser {
69	CURLcode err;
70	bool in_cert;
71	br_x509_decoder_context xc;
72	/* array of trust anchors loaded from CAfile */
73	br_x509_trust_anchor *anchors;
74	size_t anchors_len;
75	/* buffer for DN data */
76	unsigned char dn[1024];
77	size_t dn_len;
78	};
79
80	#define CAFILE_SOURCE_PATH 1
81	#define CAFILE_SOURCE_BLOB 2
82	struct cafile_source {
83	int type;
84	const char *data;
85	size_t len;
86	};
87
88	static void append_dn(void ctx, const void buf, size_t len)
89	{
90	struct cafile_parser *ca = ctx;
91
92	if(ca->err != CURLE_OK \|\| !ca->in_cert)
93	return;
94	if(sizeof(ca->dn) - ca->dn_len < len) {
95	ca->err = CURLE_FAILED_INIT;
96	return;
97	}
98	memcpy(ca->dn + ca->dn_len, buf, len);
99	ca->dn_len += len;
100	}
101
102	static void x509_push(void ctx, const void buf, size_t len)
103	{
104	struct cafile_parser *ca = ctx;
105
106	if(ca->in_cert)
107	br_x509_decoder_push(&ca->xc, buf, len);
108	}
109
110	static CURLcode load_cafile(struct cafile_source *source,
111	br_x509_trust_anchor **anchors,
112	size_t *anchors_len)
113	{
114	struct cafile_parser ca;
115	br_pem_decoder_context pc;
116	br_x509_trust_anchor *ta;
117	size_t ta_size;
118	br_x509_trust_anchor *new_anchors;
119	size_t new_anchors_len;
120	br_x509_pkey *pkey;
121	FILE *fp = 0;
122	unsigned char buf[BUFSIZ];
123	const unsigned char *p;
124	const char *name;
125	size_t n, i, pushed;
126
127	DEBUGASSERT(source->type == CAFILE_SOURCE_PATH
128	\|\| source->type == CAFILE_SOURCE_BLOB);
129
130	if(source->type == CAFILE_SOURCE_PATH) {
131	fp = fopen(source->data, "rb");
132	if(!fp)
133	return CURLE_SSL_CACERT_BADFILE;
134	}
135
136	if(source->type == CAFILE_SOURCE_BLOB && source->len > (size_t)INT_MAX)
137	return CURLE_SSL_CACERT_BADFILE;
138
139	ca.err = CURLE_OK;
140	ca.in_cert = FALSE;
141	ca.anchors = NULL;
142	ca.anchors_len = 0;
143	br_pem_decoder_init(&pc);
144	br_pem_decoder_setdest(&pc, x509_push, &ca);
145	do {
146	if(source->type == CAFILE_SOURCE_PATH) {
147	n = fread(buf, 1, sizeof(buf), fp);
148	if(n == 0)
149	break;
150	p = buf;
151	}
152	else if(source->type == CAFILE_SOURCE_BLOB) {
153	n = source->len;
154	p = (unsigned char *) source->data;
155	}
156	while(n) {
157	pushed = br_pem_decoder_push(&pc, p, n);
158	if(ca.err)
159	goto fail;
160	p += pushed;
161	n -= pushed;
162
163	switch(br_pem_decoder_event(&pc)) {
164	case 0:
165	break;
166	case BR_PEM_BEGIN_OBJ:
167	name = br_pem_decoder_name(&pc);
168	if(strcmp(name, "CERTIFICATE") && strcmp(name, "X509 CERTIFICATE"))
169	break;
170	br_x509_decoder_init(&ca.xc, append_dn, &ca);
171	ca.in_cert = TRUE;
172	ca.dn_len = 0;
173	break;
174	case BR_PEM_END_OBJ:
175	if(!ca.in_cert)
176	break;
177	ca.in_cert = FALSE;
178	if(br_x509_decoder_last_error(&ca.xc)) {
179	ca.err = CURLE_SSL_CACERT_BADFILE;
180	goto fail;
181	}
182	/* add trust anchor */
183	if(ca.anchors_len == SIZE_MAX / sizeof(ca.anchors[0])) {
184	ca.err = CURLE_OUT_OF_MEMORY;
185	goto fail;
186	}
187	new_anchors_len = ca.anchors_len + 1;
188	new_anchors = realloc(ca.anchors,
189	new_anchors_len * sizeof(ca.anchors[0]));
190	if(!new_anchors) {
191	ca.err = CURLE_OUT_OF_MEMORY;
192	goto fail;
193	}
194	ca.anchors = new_anchors;
195	ca.anchors_len = new_anchors_len;
196	ta = &ca.anchors[ca.anchors_len - 1];
197	ta->dn.data = NULL;
198	ta->flags = 0;
199	if(br_x509_decoder_isCA(&ca.xc))
200	ta->flags \|= BR_X509_TA_CA;
201	pkey = br_x509_decoder_get_pkey(&ca.xc);
202	if(!pkey) {
203	ca.err = CURLE_SSL_CACERT_BADFILE;
204	goto fail;
205	}
206	ta->pkey = *pkey;
207
208	/* calculate space needed for trust anchor data */
209	ta_size = ca.dn_len;
210	switch(pkey->key_type) {
211	case BR_KEYTYPE_RSA:
212	ta_size += pkey->key.rsa.nlen + pkey->key.rsa.elen;
213	break;
214	case BR_KEYTYPE_EC:
215	ta_size += pkey->key.ec.qlen;
216	break;
217	default:
218	ca.err = CURLE_FAILED_INIT;
219	goto fail;
220	}
221
222	/* fill in trust anchor DN and public key data */
223	ta->dn.data = malloc(ta_size);
224	if(!ta->dn.data) {
225	ca.err = CURLE_OUT_OF_MEMORY;
226	goto fail;
227	}
228	memcpy(ta->dn.data, ca.dn, ca.dn_len);
229	ta->dn.len = ca.dn_len;
230	switch(pkey->key_type) {
231	case BR_KEYTYPE_RSA:
232	ta->pkey.key.rsa.n = ta->dn.data + ta->dn.len;
233	memcpy(ta->pkey.key.rsa.n, pkey->key.rsa.n, pkey->key.rsa.nlen);
234	ta->pkey.key.rsa.e = ta->pkey.key.rsa.n + ta->pkey.key.rsa.nlen;
235	memcpy(ta->pkey.key.rsa.e, pkey->key.rsa.e, pkey->key.rsa.elen);
236	break;
237	case BR_KEYTYPE_EC:
238	ta->pkey.key.ec.q = ta->dn.data + ta->dn.len;
239	memcpy(ta->pkey.key.ec.q, pkey->key.ec.q, pkey->key.ec.qlen);
240	break;
241	}
242	break;
243	default:
244	ca.err = CURLE_SSL_CACERT_BADFILE;
245	goto fail;
246	}
247	}
248	} while(source->type != CAFILE_SOURCE_BLOB);
249	if(fp && ferror(fp))
250	ca.err = CURLE_READ_ERROR;
251	else if(ca.in_cert)
252	ca.err = CURLE_SSL_CACERT_BADFILE;
253
254	fail:
255	if(fp)
256	fclose(fp);
257	if(ca.err == CURLE_OK) {
258	*anchors = ca.anchors;
259	*anchors_len = ca.anchors_len;
260	}
261	else {
262	for(i = 0; i < ca.anchors_len; ++i)
263	free(ca.anchors[i].dn.data);
264	free(ca.anchors);
265	}
266
267	return ca.err;
268	}
269
270	static void x509_start_chain(const br_x509_class **ctx,
271	const char *server_name)
272	{
273	struct x509_context x509 = (struct x509_context )ctx;
274
275	if(!x509->verifypeer) {
276	x509->cert_num = 0;
277	return;
278	}
279
280	if(!x509->verifyhost)
281	server_name = NULL;
282	x509->minimal.vtable->start_chain(&x509->minimal.vtable, server_name);
283	}
284
285	static void x509_start_cert(const br_x509_class **ctx, uint32_t length)
286	{
287	struct x509_context x509 = (struct x509_context )ctx;
288
289	if(!x509->verifypeer) {
290	/* Only decode the first cert in the chain to obtain the public key */
291	if(x509->cert_num == 0)
292	br_x509_decoder_init(&x509->decoder, NULL, NULL);
293	return;
294	}
295
296	x509->minimal.vtable->start_cert(&x509->minimal.vtable, length);
297	}
298
299	static void x509_append(const br_x509_class *ctx, const unsigned char buf,
300	size_t len)
301	{
302	struct x509_context x509 = (struct x509_context )ctx;
303
304	if(!x509->verifypeer) {
305	if(x509->cert_num == 0)
306	br_x509_decoder_push(&x509->decoder, buf, len);
307	return;
308	}
309
310	x509->minimal.vtable->append(&x509->minimal.vtable, buf, len);
311	}
312
313	static void x509_end_cert(const br_x509_class **ctx)
314	{
315	struct x509_context x509 = (struct x509_context )ctx;
316
317	if(!x509->verifypeer) {
318	x509->cert_num++;
319	return;
320	}
321
322	x509->minimal.vtable->end_cert(&x509->minimal.vtable);
323	}
324
325	static unsigned x509_end_chain(const br_x509_class **ctx)
326	{
327	struct x509_context x509 = (struct x509_context )ctx;
328
329	if(!x509->verifypeer) {
330	return br_x509_decoder_last_error(&x509->decoder);
331	}
332
333	return x509->minimal.vtable->end_chain(&x509->minimal.vtable);
334	}
335
336	static const br_x509_pkey x509_get_pkey(const br_x509_class const *ctx,
337	unsigned *usages)
338	{
339	struct x509_context x509 = (struct x509_context )ctx;
340
341	if(!x509->verifypeer) {
342	/* Nothing in the chain is verified, just return the public key of the
343	first certificate and allow its usage for both TLS_RSA_* and
344	TLS_ECDHE_* */
345	if(usages)
346	*usages = BR_KEYTYPE_KEYX \| BR_KEYTYPE_SIGN;
347	return br_x509_decoder_get_pkey(&x509->decoder);
348	}
349
350	return x509->minimal.vtable->get_pkey(&x509->minimal.vtable, usages);
351	}
352
353	static const br_x509_class x509_vtable = {
354	sizeof(struct x509_context),
355	x509_start_chain,
356	x509_start_cert,
357	x509_append,
358	x509_end_cert,
359	x509_end_chain,
360	x509_get_pkey
361	};
362
363	struct st_cipher {
364	const char name; / Cipher suite IANA name. It starts with "TLS_" prefix */
365	const char alias_name; / Alias name is the same as OpenSSL cipher name */
366	uint16_t num; /* BearSSL cipher suite */
367	};
368
369	/* Macro to initialize st_cipher data structure */
370	#define CIPHER_DEF(num, alias) { #num, alias, BR_##num }
371
372	static const struct st_cipher ciphertable[] = {
373	/* RFC 2246 TLS 1.0 */
374	CIPHER_DEF(TLS_RSA_WITH_3DES_EDE_CBC_SHA, /* 0x000A */
375	"DES-CBC3-SHA"),
376
377	/* RFC 3268 TLS 1.0 AES */
378	CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA, /* 0x002F */
379	"AES128-SHA"),
380	CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA, /* 0x0035 */
381	"AES256-SHA"),
382
383	/* RFC 5246 TLS 1.2 */
384	CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA256, /* 0x003C */
385	"AES128-SHA256"),
386	CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA256, /* 0x003D */
387	"AES256-SHA256"),
388
389	/* RFC 5288 TLS 1.2 AES GCM */
390	CIPHER_DEF(TLS_RSA_WITH_AES_128_GCM_SHA256, /* 0x009C */
391	"AES128-GCM-SHA256"),
392	CIPHER_DEF(TLS_RSA_WITH_AES_256_GCM_SHA384, /* 0x009D */
393	"AES256-GCM-SHA384"),
394
395	/* RFC 4492 TLS 1.0 ECC */
396	CIPHER_DEF(TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, /* 0xC003 */
397	"ECDH-ECDSA-DES-CBC3-SHA"),
398	CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, /* 0xC004 */
399	"ECDH-ECDSA-AES128-SHA"),
400	CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, /* 0xC005 */
401	"ECDH-ECDSA-AES256-SHA"),
402	CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, /* 0xC008 */
403	"ECDHE-ECDSA-DES-CBC3-SHA"),
404	CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, /* 0xC009 */
405	"ECDHE-ECDSA-AES128-SHA"),
406	CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, /* 0xC00A */
407	"ECDHE-ECDSA-AES256-SHA"),
408	CIPHER_DEF(TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, /* 0xC00D */
409	"ECDH-RSA-DES-CBC3-SHA"),
410	CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, /* 0xC00E */
411	"ECDH-RSA-AES128-SHA"),
412	CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, /* 0xC00F */
413	"ECDH-RSA-AES256-SHA"),
414	CIPHER_DEF(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, /* 0xC012 */
415	"ECDHE-RSA-DES-CBC3-SHA"),
416	CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, /* 0xC013 */
417	"ECDHE-RSA-AES128-SHA"),
418	CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, /* 0xC014 */
419	"ECDHE-RSA-AES256-SHA"),
420
421	/* RFC 5289 TLS 1.2 ECC HMAC SHA256/384 */
422	CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, /* 0xC023 */
423	"ECDHE-ECDSA-AES128-SHA256"),
424	CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, /* 0xC024 */
425	"ECDHE-ECDSA-AES256-SHA384"),
426	CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, /* 0xC025 */
427	"ECDH-ECDSA-AES128-SHA256"),
428	CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, /* 0xC026 */
429	"ECDH-ECDSA-AES256-SHA384"),
430	CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, /* 0xC027 */
431	"ECDHE-RSA-AES128-SHA256"),
432	CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, /* 0xC028 */
433	"ECDHE-RSA-AES256-SHA384"),
434	CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, /* 0xC029 */
435	"ECDH-RSA-AES128-SHA256"),
436	CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, /* 0xC02A */
437	"ECDH-RSA-AES256-SHA384"),
438
439	/* RFC 5289 TLS 1.2 GCM */
440	CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, /* 0xC02B */
441	"ECDHE-ECDSA-AES128-GCM-SHA256"),
442	CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, /* 0xC02C */
443	"ECDHE-ECDSA-AES256-GCM-SHA384"),
444	CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, /* 0xC02D */
445	"ECDH-ECDSA-AES128-GCM-SHA256"),
446	CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, /* 0xC02E */
447	"ECDH-ECDSA-AES256-GCM-SHA384"),
448	CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, /* 0xC02F */
449	"ECDHE-RSA-AES128-GCM-SHA256"),
450	CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, /* 0xC030 */
451	"ECDHE-RSA-AES256-GCM-SHA384"),
452	CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, /* 0xC031 */
453	"ECDH-RSA-AES128-GCM-SHA256"),
454	CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, /* 0xC032 */
455	"ECDH-RSA-AES256-GCM-SHA384"),
456	#ifdef BR_TLS_RSA_WITH_AES_128_CCM
457
458	/* RFC 6655 TLS 1.2 CCM
459	Supported since BearSSL 0.6 */
460	CIPHER_DEF(TLS_RSA_WITH_AES_128_CCM, /* 0xC09C */
461	"AES128-CCM"),
462	CIPHER_DEF(TLS_RSA_WITH_AES_256_CCM, /* 0xC09D */
463	"AES256-CCM"),
464	CIPHER_DEF(TLS_RSA_WITH_AES_128_CCM_8, /* 0xC0A0 */
465	"AES128-CCM8"),
466	CIPHER_DEF(TLS_RSA_WITH_AES_256_CCM_8, /* 0xC0A1 */
467	"AES256-CCM8"),
468
469	/* RFC 7251 TLS 1.2 ECC CCM
470	Supported since BearSSL 0.6 */
471	CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CCM, /* 0xC0AC */
472	"ECDHE-ECDSA-AES128-CCM"),
473	CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CCM, /* 0xC0AD */
474	"ECDHE-ECDSA-AES256-CCM"),
475	CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8, /* 0xC0AE */
476	"ECDHE-ECDSA-AES128-CCM8"),
477	CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8, /* 0xC0AF */
478	"ECDHE-ECDSA-AES256-CCM8"),
479	#endif
480
481	/* RFC 7905 TLS 1.2 ChaCha20-Poly1305
482	Supported since BearSSL 0.2 */
483	CIPHER_DEF(TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, /* 0xCCA8 */
484	"ECDHE-RSA-CHACHA20-POLY1305"),
485	CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, /* 0xCCA9 */
486	"ECDHE-ECDSA-CHACHA20-POLY1305"),
487	};
488
489	#define NUM_OF_CIPHERS (sizeof(ciphertable) / sizeof(ciphertable[0]))
490	#define CIPHER_NAME_BUF_LEN 64
491
492	static bool is_separator(char c)
493	{
494	/* Return whether character is a cipher list separator. */
495	switch(c) {
496	case ' ':
497	case '\t':
498	case ':':
499	case ',':
500	case ';':
501	return true;
502	}
503	return false;
504	}
505
506	static CURLcode bearssl_set_selected_ciphers(struct Curl_easy *data,
507	br_ssl_engine_context *ssl_eng,
508	const char *ciphers)
509	{
510	uint16_t selected_ciphers[NUM_OF_CIPHERS];
511	size_t selected_count = 0;
512	char cipher_name[CIPHER_NAME_BUF_LEN];
513	const char *cipher_start = ciphers;
514	const char *cipher_end;
515	size_t i, j;
516
517	if(!cipher_start)
518	return CURLE_SSL_CIPHER;
519
520	while(true) {
521	/* Extract the next cipher name from the ciphers string */
522	while(is_separator(*cipher_start))
523	++cipher_start;
524	if(*cipher_start == '\0')
525	break;
526	cipher_end = cipher_start;
527	while(cipher_end != '\0' && !is_separator(cipher_end))
528	++cipher_end;
529	j = cipher_end - cipher_start < CIPHER_NAME_BUF_LEN - 1 ?
530	cipher_end - cipher_start : CIPHER_NAME_BUF_LEN - 1;
531	strncpy(cipher_name, cipher_start, j);
532	cipher_name[j] = '\0';
533	cipher_start = cipher_end;
534
535	/* Lookup the cipher name in the table of available ciphers. If the cipher
536	name starts with "TLS_" we do the lookup by IANA name. Otherwise, we try
537	to match cipher name by an (OpenSSL) alias. */
538	if(strncasecompare(cipher_name, "TLS_", 4)) {
539	for(i = 0; i < NUM_OF_CIPHERS &&
540	!strcasecompare(cipher_name, ciphertable[i].name); ++i);
541	}
542	else {
543	for(i = 0; i < NUM_OF_CIPHERS &&
544	!strcasecompare(cipher_name, ciphertable[i].alias_name); ++i);
545	}
546	if(i == NUM_OF_CIPHERS) {
547	infof(data, "BearSSL: unknown cipher in list: %s", cipher_name);
548	continue;
549	}
550
551	/* No duplicates allowed */
552	for(j = 0; j < selected_count &&
553	selected_ciphers[j] != ciphertable[i].num; j++);
554	if(j < selected_count) {
555	infof(data, "BearSSL: duplicate cipher in list: %s", cipher_name);
556	continue;
557	}
558
559	DEBUGASSERT(selected_count < NUM_OF_CIPHERS);
560	selected_ciphers[selected_count] = ciphertable[i].num;
561	++selected_count;
562	}
563
564	if(selected_count == 0) {
565	failf(data, "BearSSL: no supported cipher in list");
566	return CURLE_SSL_CIPHER;
567	}
568
569	br_ssl_engine_set_suites(ssl_eng, selected_ciphers, selected_count);
570	return CURLE_OK;
571	}
572
573	static CURLcode bearssl_connect_step1(struct Curl_cfilter *cf,
574	struct Curl_easy *data)
575	{
576	struct ssl_connect_data *connssl = cf->ctx;
577	struct ssl_backend_data *backend = connssl->backend;
578	struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
579	struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
580	const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;
581	const char * const ssl_cafile =
582	/* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
583	(ca_info_blob ? NULL : conn_config->CAfile);
584	const char *hostname = connssl->hostname;
585	const bool verifypeer = conn_config->verifypeer;
586	const bool verifyhost = conn_config->verifyhost;
587	CURLcode ret;
588	unsigned version_min, version_max;
589	#ifdef ENABLE_IPV6
590	struct in6_addr addr;
591	#else
592	struct in_addr addr;
593	#endif
594
595	DEBUGASSERT(backend);
596
597	switch(conn_config->version) {
598	case CURL_SSLVERSION_SSLv2:
599	failf(data, "BearSSL does not support SSLv2");
600	return CURLE_SSL_CONNECT_ERROR;
601	case CURL_SSLVERSION_SSLv3:
602	failf(data, "BearSSL does not support SSLv3");
603	return CURLE_SSL_CONNECT_ERROR;
604	case CURL_SSLVERSION_TLSv1_0:
605	version_min = BR_TLS10;
606	version_max = BR_TLS10;
607	break;
608	case CURL_SSLVERSION_TLSv1_1:
609	version_min = BR_TLS11;
610	version_max = BR_TLS11;
611	break;
612	case CURL_SSLVERSION_TLSv1_2:
613	version_min = BR_TLS12;
614	version_max = BR_TLS12;
615	break;
616	case CURL_SSLVERSION_DEFAULT:
617	case CURL_SSLVERSION_TLSv1:
618	version_min = BR_TLS10;
619	version_max = BR_TLS12;
620	break;
621	default:
622	failf(data, "BearSSL: unknown CURLOPT_SSLVERSION");
623	return CURLE_SSL_CONNECT_ERROR;
624	}
625
626	if(ca_info_blob) {
627	struct cafile_source source;
628	source.type = CAFILE_SOURCE_BLOB;
629	source.data = ca_info_blob->data;
630	source.len = ca_info_blob->len;
631
632	ret = load_cafile(&source, &backend->anchors, &backend->anchors_len);
633	if(ret != CURLE_OK) {
634	if(verifypeer) {
635	failf(data, "error importing CA certificate blob");
636	return ret;
637	}
638	/* Only warn if no certificate verification is required. */
639	infof(data, "error importing CA certificate blob, continuing anyway");
640	}
641	}
642
643	if(ssl_cafile) {
644	struct cafile_source source;
645	source.type = CAFILE_SOURCE_PATH;
646	source.data = ssl_cafile;
647	source.len = 0;
648
649	ret = load_cafile(&source, &backend->anchors, &backend->anchors_len);
650	if(ret != CURLE_OK) {
651	if(verifypeer) {
652	failf(data, "error setting certificate verify locations."
653	" CAfile: %s", ssl_cafile);
654	return ret;
655	}
656	infof(data, "error setting certificate verify locations,"
657	" continuing anyway:");
658	}
659	}
660
661	/* initialize SSL context */
662	br_ssl_client_init_full(&backend->ctx, &backend->x509.minimal,
663	backend->anchors, backend->anchors_len);
664	br_ssl_engine_set_versions(&backend->ctx.eng, version_min, version_max);
665	br_ssl_engine_set_buffer(&backend->ctx.eng, backend->buf,
666	sizeof(backend->buf), 1);
667
668	if(conn_config->cipher_list) {
669	/* Override the ciphers as specified. For the default cipher list see the
670	BearSSL source code of br_ssl_client_init_full() */
671	ret = bearssl_set_selected_ciphers(data, &backend->ctx.eng,
672	conn_config->cipher_list);
673	if(ret)
674	return ret;
675	}
676
677	/* initialize X.509 context */
678	backend->x509.vtable = &x509_vtable;
679	backend->x509.verifypeer = verifypeer;
680	backend->x509.verifyhost = verifyhost;
681	br_ssl_engine_set_x509(&backend->ctx.eng, &backend->x509.vtable);
682
683	if(ssl_config->primary.sessionid) {
684	void *session;
685
686	Curl_ssl_sessionid_lock(data);
687	if(!Curl_ssl_getsessionid(cf, data, &session, NULL)) {
688	br_ssl_engine_set_session_parameters(&backend->ctx.eng, session);
689	infof(data, "BearSSL: re-using session ID");
690	}
691	Curl_ssl_sessionid_unlock(data);
692	}
693
694	if(cf->conn->bits.tls_enable_alpn) {
695	int cur = 0;
696
697	/* NOTE: when adding more protocols here, increase the size of the
698	* protocols array in `struct ssl_backend_data`.
699	*/
700
701	#ifdef USE_HTTP2
702	if(data->state.httpwant >= CURL_HTTP_VERSION_2
703	#ifndef CURL_DISABLE_PROXY
704	&& (!Curl_ssl_cf_is_proxy(cf) \|\| !cf->conn->bits.tunnel_proxy)
705	#endif
706	) {
707	backend->protocols[cur++] = ALPN_H2;
708	infof(data, VTLS_INFOF_ALPN_OFFER_1STR, ALPN_H2);
709	}
710	#endif
711
712	backend->protocols[cur++] = ALPN_HTTP_1_1;
713	infof(data, VTLS_INFOF_ALPN_OFFER_1STR, ALPN_HTTP_1_1);
714
715	br_ssl_engine_set_protocol_names(&backend->ctx.eng,
716	backend->protocols, cur);
717	}
718
719	if((1 == Curl_inet_pton(AF_INET, hostname, &addr))
720	#ifdef ENABLE_IPV6
721	\|\| (1 == Curl_inet_pton(AF_INET6, hostname, &addr))
722	#endif
723	) {
724	if(verifyhost) {
725	failf(data, "BearSSL: "
726	"host verification of IP address is not supported");
727	return CURLE_PEER_FAILED_VERIFICATION;
728	}
729	hostname = NULL;
730	}
731	else {
732	char *snihost = Curl_ssl_snihost(data, hostname, NULL);
733	if(!snihost) {
734	failf(data, "Failed to set SNI");
735	return CURLE_SSL_CONNECT_ERROR;
736	}
737	hostname = snihost;
738	}
739
740	/* give application a chance to interfere with SSL set up. */
741	if(data->set.ssl.fsslctx) {
742	Curl_set_in_callback(data, true);
743	ret = (*data->set.ssl.fsslctx)(data, &backend->ctx,
744	data->set.ssl.fsslctxp);
745	Curl_set_in_callback(data, false);
746	if(ret) {
747	failf(data, "BearSSL: error signaled by ssl ctx callback");
748	return ret;
749	}
750	}
751
752	if(!br_ssl_client_reset(&backend->ctx, hostname, 1))
753	return CURLE_FAILED_INIT;
754	backend->active = TRUE;
755
756	connssl->connecting_state = ssl_connect_2;
757
758	return CURLE_OK;
759	}
760
761	static CURLcode bearssl_run_until(struct Curl_cfilter *cf,
762	struct Curl_easy *data,
763	unsigned target)
764	{
765	struct ssl_connect_data *connssl = cf->ctx;
766	struct ssl_backend_data *backend = connssl->backend;
767	unsigned state;
768	unsigned char *buf;
769	size_t len;
770	ssize_t ret;
771	CURLcode result;
772	int err;
773
774	DEBUGASSERT(backend);
775
776	for(;;) {
777	state = br_ssl_engine_current_state(&backend->ctx.eng);
778	if(state & BR_SSL_CLOSED) {
779	err = br_ssl_engine_last_error(&backend->ctx.eng);
780	switch(err) {
781	case BR_ERR_OK:
782	/* TLS close notify */
783	if(connssl->state != ssl_connection_complete) {
784	failf(data, "SSL: connection closed during handshake");
785	return CURLE_SSL_CONNECT_ERROR;
786	}
787	return CURLE_OK;
788	case BR_ERR_X509_EXPIRED:
789	failf(data, "SSL: X.509 verification: "
790	"certificate is expired or not yet valid");
791	return CURLE_PEER_FAILED_VERIFICATION;
792	case BR_ERR_X509_BAD_SERVER_NAME:
793	failf(data, "SSL: X.509 verification: "
794	"expected server name was not found in the chain");
795	return CURLE_PEER_FAILED_VERIFICATION;
796	case BR_ERR_X509_NOT_TRUSTED:
797	failf(data, "SSL: X.509 verification: "
798	"chain could not be linked to a trust anchor");
799	return CURLE_PEER_FAILED_VERIFICATION;
800	}
801	/* X.509 errors are documented to have the range 32..63 */
802	if(err >= 32 && err < 64)
803	return CURLE_PEER_FAILED_VERIFICATION;
804	return CURLE_SSL_CONNECT_ERROR;
805	}
806	if(state & target)
807	return CURLE_OK;
808	if(state & BR_SSL_SENDREC) {
809	buf = br_ssl_engine_sendrec_buf(&backend->ctx.eng, &len);
810	ret = Curl_conn_cf_send(cf->next, data, (char *)buf, len, &result);
811	if(ret <= 0) {
812	return result;
813	}
814	br_ssl_engine_sendrec_ack(&backend->ctx.eng, ret);
815	}
816	else if(state & BR_SSL_RECVREC) {
817	buf = br_ssl_engine_recvrec_buf(&backend->ctx.eng, &len);
818	ret = Curl_conn_cf_recv(cf->next, data, (char *)buf, len, &result);
819	if(ret == 0) {
820	failf(data, "SSL: EOF without close notify");
821	return CURLE_READ_ERROR;
822	}
823	if(ret <= 0) {
824	return result;
825	}
826	br_ssl_engine_recvrec_ack(&backend->ctx.eng, ret);
827	}
828	}
829	}
830
831	static CURLcode bearssl_connect_step2(struct Curl_cfilter *cf,
832	struct Curl_easy *data)
833	{
834	struct ssl_connect_data *connssl = cf->ctx;
835	struct ssl_backend_data *backend = connssl->backend;
836	CURLcode ret;
837
838	DEBUGASSERT(backend);
839
840	ret = bearssl_run_until(cf, data, BR_SSL_SENDAPP \| BR_SSL_RECVAPP);
841	if(ret == CURLE_AGAIN)
842	return CURLE_OK;
843	if(ret == CURLE_OK) {
844	if(br_ssl_engine_current_state(&backend->ctx.eng) == BR_SSL_CLOSED) {
845	failf(data, "SSL: connection closed during handshake");
846	return CURLE_SSL_CONNECT_ERROR;
847	}
848	connssl->connecting_state = ssl_connect_3;
849	}
850	return ret;
851	}
852
853	static CURLcode bearssl_connect_step3(struct Curl_cfilter *cf,
854	struct Curl_easy *data)
855	{
856	struct ssl_connect_data *connssl = cf->ctx;
857	struct ssl_backend_data *backend = connssl->backend;
858	struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
859	CURLcode ret;
860
861	DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
862	DEBUGASSERT(backend);
863
864	if(cf->conn->bits.tls_enable_alpn) {
865	const char *protocol;
866
867	protocol = br_ssl_engine_get_selected_protocol(&backend->ctx.eng);
868	if(protocol) {
869	infof(data, VTLS_INFOF_ALPN_ACCEPTED_1STR, protocol);
870
871	#ifdef USE_HTTP2
872	if(!strcmp(protocol, ALPN_H2))
873	cf->conn->alpn = CURL_HTTP_VERSION_2;
874	else
875	#endif
876	if(!strcmp(protocol, ALPN_HTTP_1_1))
877	cf->conn->alpn = CURL_HTTP_VERSION_1_1;
878	else
879	infof(data, "ALPN, unrecognized protocol %s", protocol);
880	Curl_multiuse_state(data, cf->conn->alpn == CURL_HTTP_VERSION_2 ?
881	BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
882	}
883	else
884	infof(data, VTLS_INFOF_NO_ALPN);
885	}
886
887	if(ssl_config->primary.sessionid) {
888	bool incache;
889	bool added = FALSE;
890	void *oldsession;
891	br_ssl_session_parameters *session;
892
893	session = malloc(sizeof(*session));
894	if(!session)
895	return CURLE_OUT_OF_MEMORY;
896	br_ssl_engine_get_session_parameters(&backend->ctx.eng, session);
897	Curl_ssl_sessionid_lock(data);
898	incache = !(Curl_ssl_getsessionid(cf, data, &oldsession, NULL));
899	if(incache)
900	Curl_ssl_delsessionid(data, oldsession);
901	ret = Curl_ssl_addsessionid(cf, data, session, 0, &added);
902	Curl_ssl_sessionid_unlock(data);
903	if(!added)
904	free(session);
905	if(ret) {
906	return CURLE_OUT_OF_MEMORY;
907	}
908	}
909
910	connssl->connecting_state = ssl_connect_done;
911
912	return CURLE_OK;
913	}
914
915	static ssize_t bearssl_send(struct Curl_cfilter cf, struct Curl_easy data,
916	const void buf, size_t len, CURLcode err)
917	{
918	struct ssl_connect_data *connssl = cf->ctx;
919	struct ssl_backend_data *backend = connssl->backend;
920	unsigned char *app;
921	size_t applen;
922
923	DEBUGASSERT(backend);
924
925	for(;;) {
926	*err = bearssl_run_until(cf, data, BR_SSL_SENDAPP);
927	if (*err != CURLE_OK)
928	return -1;
929	app = br_ssl_engine_sendapp_buf(&backend->ctx.eng, &applen);
930	if(!app) {
931	failf(data, "SSL: connection closed during write");
932	*err = CURLE_SEND_ERROR;
933	return -1;
934	}
935	if(backend->pending_write) {
936	applen = backend->pending_write;
937	backend->pending_write = 0;
938	return applen;
939	}
940	if(applen > len)
941	applen = len;
942	memcpy(app, buf, applen);
943	br_ssl_engine_sendapp_ack(&backend->ctx.eng, applen);
944	br_ssl_engine_flush(&backend->ctx.eng, 0);
945	backend->pending_write = applen;
946	}
947	}
948
949	static ssize_t bearssl_recv(struct Curl_cfilter cf, struct Curl_easy data,
950	char buf, size_t len, CURLcode err)
951	{
952	struct ssl_connect_data *connssl = cf->ctx;
953	struct ssl_backend_data *backend = connssl->backend;
954	unsigned char *app;
955	size_t applen;
956
957	DEBUGASSERT(backend);
958
959	*err = bearssl_run_until(cf, data, BR_SSL_RECVAPP);
960	if(*err != CURLE_OK)
961	return -1;
962	app = br_ssl_engine_recvapp_buf(&backend->ctx.eng, &applen);
963	if(!app)
964	return 0;
965	if(applen > len)
966	applen = len;
967	memcpy(buf, app, applen);
968	br_ssl_engine_recvapp_ack(&backend->ctx.eng, applen);
969
970	return applen;
971	}
972
973	static CURLcode bearssl_connect_common(struct Curl_cfilter *cf,
974	struct Curl_easy *data,
975	bool nonblocking,
976	bool *done)
977	{
978	CURLcode ret;
979	struct ssl_connect_data *connssl = cf->ctx;
980	curl_socket_t sockfd = cf->conn->sock[cf->sockindex];
981	timediff_t timeout_ms;
982	int what;
983
984	/* check if the connection has already been established */
985	if(ssl_connection_complete == connssl->state) {
986	*done = TRUE;
987	return CURLE_OK;
988	}
989
990	if(ssl_connect_1 == connssl->connecting_state) {
991	ret = bearssl_connect_step1(cf, data);
992	if(ret)
993	return ret;
994	}
995
996	while(ssl_connect_2 == connssl->connecting_state \|\|
997	ssl_connect_2_reading == connssl->connecting_state \|\|
998	ssl_connect_2_writing == connssl->connecting_state) {
999	/* check allowed time left */
1000	timeout_ms = Curl_timeleft(data, NULL, TRUE);
1001
1002	if(timeout_ms < 0) {
1003	/* no need to continue if time already is up */
1004	failf(data, "SSL connection timeout");
1005	return CURLE_OPERATION_TIMEDOUT;
1006	}
1007
1008	/* if ssl is expecting something, check if it's available. */
1009	if(ssl_connect_2_reading == connssl->connecting_state \|\|
1010	ssl_connect_2_writing == connssl->connecting_state) {
1011
1012	curl_socket_t writefd = ssl_connect_2_writing ==
1013	connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
1014	curl_socket_t readfd = ssl_connect_2_reading ==
1015	connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
1016
1017	what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
1018	nonblocking?0:timeout_ms);
1019	if(what < 0) {
1020	/* fatal error */
1021	failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
1022	return CURLE_SSL_CONNECT_ERROR;
1023	}
1024	else if(0 == what) {
1025	if(nonblocking) {
1026	*done = FALSE;
1027	return CURLE_OK;
1028	}
1029	else {
1030	/* timeout */
1031	failf(data, "SSL connection timeout");
1032	return CURLE_OPERATION_TIMEDOUT;
1033	}
1034	}
1035	/* socket is readable or writable */
1036	}
1037
1038	/* Run transaction, and return to the caller if it failed or if this
1039	* connection is done nonblocking and this loop would execute again. This
1040	* permits the owner of a multi handle to abort a connection attempt
1041	* before step2 has completed while ensuring that a client using select()
1042	* or epoll() will always have a valid fdset to wait on.
1043	*/
1044	ret = bearssl_connect_step2(cf, data);
1045	if(ret \|\| (nonblocking &&
1046	(ssl_connect_2 == connssl->connecting_state \|\|
1047	ssl_connect_2_reading == connssl->connecting_state \|\|
1048	ssl_connect_2_writing == connssl->connecting_state)))
1049	return ret;
1050	}
1051
1052	if(ssl_connect_3 == connssl->connecting_state) {
1053	ret = bearssl_connect_step3(cf, data);
1054	if(ret)
1055	return ret;
1056	}
1057
1058	if(ssl_connect_done == connssl->connecting_state) {
1059	connssl->state = ssl_connection_complete;
1060	*done = TRUE;
1061	}
1062	else
1063	*done = FALSE;
1064
1065	/* Reset our connect state machine */
1066	connssl->connecting_state = ssl_connect_1;
1067
1068	return CURLE_OK;
1069	}
1070
1071	static size_t bearssl_version(char *buffer, size_t size)
1072	{
1073	return msnprintf(buffer, size, "BearSSL");
1074	}
1075
1076	static bool bearssl_data_pending(struct Curl_cfilter *cf,
1077	const struct Curl_easy *data)
1078	{
1079	struct ssl_connect_data *ctx = cf->ctx;
1080
1081	(void)data;
1082	DEBUGASSERT(ctx && ctx->backend);
1083	return br_ssl_engine_current_state(&ctx->backend->ctx.eng) & BR_SSL_RECVAPP;
1084	}
1085
1086	static CURLcode bearssl_random(struct Curl_easy *data UNUSED_PARAM,
1087	unsigned char *entropy, size_t length)
1088	{
1089	static br_hmac_drbg_context ctx;
1090	static bool seeded = FALSE;
1091
1092	if(!seeded) {
1093	br_prng_seeder seeder;
1094
1095	br_hmac_drbg_init(&ctx, &br_sha256_vtable, NULL, 0);
1096	seeder = br_prng_seeder_system(NULL);
1097	if(!seeder \|\| !seeder(&ctx.vtable))
1098	return CURLE_FAILED_INIT;
1099	seeded = TRUE;
1100	}
1101	br_hmac_drbg_generate(&ctx, entropy, length);
1102
1103	return CURLE_OK;
1104	}
1105
1106	static CURLcode bearssl_connect(struct Curl_cfilter *cf,
1107	struct Curl_easy *data)
1108	{
1109	CURLcode ret;
1110	bool done = FALSE;
1111
1112	ret = bearssl_connect_common(cf, data, FALSE, &done);
1113	if(ret)
1114	return ret;
1115
1116	DEBUGASSERT(done);
1117
1118	return CURLE_OK;
1119	}
1120
1121	static CURLcode bearssl_connect_nonblocking(struct Curl_cfilter *cf,
1122	struct Curl_easy *data,
1123	bool *done)
1124	{
1125	return bearssl_connect_common(cf, data, TRUE, done);
1126	}
1127
1128	static void bearssl_get_internals(struct ssl_connect_data connssl,
1129	CURLINFO info UNUSED_PARAM)
1130	{
1131	struct ssl_backend_data *backend = connssl->backend;
1132	DEBUGASSERT(backend);
1133	return &backend->ctx;
1134	}
1135
1136	static void bearssl_close(struct Curl_cfilter cf, struct Curl_easy data)
1137	{
1138	struct ssl_connect_data *connssl = cf->ctx;
1139	struct ssl_backend_data *backend = connssl->backend;
1140	size_t i;
1141
1142	DEBUGASSERT(backend);
1143
1144	if(backend->active) {
1145	backend->active = FALSE;
1146	br_ssl_engine_close(&backend->ctx.eng);
1147	(void)bearssl_run_until(cf, data, BR_SSL_CLOSED);
1148	}
1149	if(backend->anchors) {
1150	for(i = 0; i < backend->anchors_len; ++i)
1151	free(backend->anchors[i].dn.data);
1152	Curl_safefree(backend->anchors);
1153	}
1154	}
1155
1156	static void bearssl_session_free(void *ptr)
1157	{
1158	free(ptr);
1159	}
1160
1161	static CURLcode bearssl_sha256sum(const unsigned char *input,
1162	size_t inputlen,
1163	unsigned char *sha256sum,
1164	size_t sha256len UNUSED_PARAM)
1165	{
1166	br_sha256_context ctx;
1167
1168	br_sha256_init(&ctx);
1169	br_sha256_update(&ctx, input, inputlen);
1170	br_sha256_out(&ctx, sha256sum);
1171	return CURLE_OK;
1172	}
1173
1174	const struct Curl_ssl Curl_ssl_bearssl = {
1175	{ CURLSSLBACKEND_BEARSSL, "bearssl" }, /* info */
1176	SSLSUPP_CAINFO_BLOB \| SSLSUPP_SSL_CTX \| SSLSUPP_HTTPS_PROXY,
1177	sizeof(struct ssl_backend_data),
1178
1179	Curl_none_init, /* init */
1180	Curl_none_cleanup, /* cleanup */
1181	bearssl_version, /* version */
1182	Curl_none_check_cxn, /* check_cxn */
1183	Curl_none_shutdown, /* shutdown */
1184	bearssl_data_pending, /* data_pending */
1185	bearssl_random, /* random */
1186	Curl_none_cert_status_request, /* cert_status_request */
1187	bearssl_connect, /* connect */
1188	bearssl_connect_nonblocking, /* connect_nonblocking */
1189	Curl_ssl_get_select_socks, /* getsock */
1190	bearssl_get_internals, /* get_internals */
1191	bearssl_close, /* close_one */
1192	Curl_none_close_all, /* close_all */
1193	bearssl_session_free, /* session_free */
1194	Curl_none_set_engine, /* set_engine */
1195	Curl_none_set_engine_default, /* set_engine_default */
1196	Curl_none_engines_list, /* engines_list */
1197	Curl_none_false_start, /* false_start */
1198	bearssl_sha256sum, /* sha256sum */
1199	NULL, /* associate_connection */
1200	NULL, /* disassociate_connection */
1201	NULL, /* free_multi_ssl_backend_data */
1202	bearssl_recv, /* recv decrypted data */
1203	bearssl_send, /* send data to encrypt */
1204	};
1205
1206	#endif /* USE_BEARSSL */

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/libs/curl-7.87.0/lib/vtls/bearssl.c@ 98326

以其他格式下載: