1 /***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
9 *
10 * This software is licensed as described in the file COPYING, which
11 * you should have received as part of this distribution. The terms
12 * are also available at http://curl.haxx.se/docs/copyright.html.
13 *
14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15 * copies of the Software, and permit persons to whom the Software is
16 * furnished to do so, under the terms of the COPYING file.
17 *
18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19 * KIND, either express or implied.
20 *
21 ***************************************************************************/
22
23 /*
24 * Source file for all NSS-specific code for the TLS/SSL layer. No code
25 * but vtls.c should ever call or use these functions.
26 */
27
28 #include "curl_setup.h"
29
30 #ifdef USE_NSS
31
32 #include "urldata.h"
33 #include "sendf.h"
34 #include "formdata.h" /* for the boundary function */
35 #include "url.h" /* for the ssl config check function */
36 #include "connect.h"
37 #include "strequal.h"
38 #include "select.h"
39 #include "vtls.h"
40 #include "llist.h"
41 #include "curl_printf.h"
42 #include "nssg.h"
43 #include <nspr.h>
44 #include <nss.h>
45 #include <ssl.h>
46 #include <sslerr.h>
47 #include <secerr.h>
48 #include <secmod.h>
49 #include <sslproto.h>
50 #include <prtypes.h>
51 #include <pk11pub.h>
52 #include <prio.h>
53 #include <secitem.h>
54 #include <secport.h>
55 #include <certdb.h>
56 #include <base64.h>
57 #include <cert.h>
58 #include <prerror.h>
59 #include <keyhi.h> /* for SECKEY_DestroyPublicKey() */
60
61 #define NSSVERNUM ((NSS_VMAJOR<<16)|(NSS_VMINOR<<8)|NSS_VPATCH)
62
63 #if NSSVERNUM >= 0x030f00 /* 3.15.0 */
64 #include <ocsp.h>
65 #endif
66
67 #include "rawstr.h"
68 #include "warnless.h"
69 #include "x509asn1.h"
70
71 /* The last #include files should be: */
72 #include "curl_memory.h"
73 #include "memdebug.h"
74
75 #define SSL_DIR "/etc/pki/nssdb"
76
77 /* enough to fit the string "PEM Token #[0|1]" */
78 #define SLOTSIZE 13
79
80 PRFileDesc *PR_ImportTCPSocket(PRInt32 osfd);
81
82 PRLock * nss_initlock = NULL;
83 PRLock * nss_crllock = NULL;
84 struct curl_llist *nss_crl_list = NULL;
85 NSSInitContext * nss_context = NULL;
86
87 volatile int initialized = 0;
88
89 typedef struct {
90 const char *name;
91 int num;
92 } cipher_s;
93
94 #define PK11_SETATTRS(_attr, _idx, _type, _val, _len) do { \
95 CK_ATTRIBUTE *ptr = (_attr) + ((_idx)++); \
96 ptr->type = (_type); \
97 ptr->pValue = (_val); \
98 ptr->ulValueLen = (_len); \
99 } WHILE_FALSE
100
101 #define CERT_NewTempCertificate __CERT_NewTempCertificate
102
103 #define NUM_OF_CIPHERS sizeof(cipherlist)/sizeof(cipherlist[0])
104 static const cipher_s cipherlist[] = {
105 /* SSL2 cipher suites */
106 {"rc4", SSL_EN_RC4_128_WITH_MD5},
107 {"rc4-md5", SSL_EN_RC4_128_WITH_MD5},
108 {"rc4export", SSL_EN_RC4_128_EXPORT40_WITH_MD5},
109 {"rc2", SSL_EN_RC2_128_CBC_WITH_MD5},
110 {"rc2export", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5},
111 {"des", SSL_EN_DES_64_CBC_WITH_MD5},
112 {"desede3", SSL_EN_DES_192_EDE3_CBC_WITH_MD5},
113 /* SSL3/TLS cipher suites */
114 {"rsa_rc4_128_md5", SSL_RSA_WITH_RC4_128_MD5},
115 {"rsa_rc4_128_sha", SSL_RSA_WITH_RC4_128_SHA},
116 {"rsa_3des_sha", SSL_RSA_WITH_3DES_EDE_CBC_SHA},
117 {"rsa_des_sha", SSL_RSA_WITH_DES_CBC_SHA},
118 {"rsa_rc4_40_md5", SSL_RSA_EXPORT_WITH_RC4_40_MD5},
119 {"rsa_rc2_40_md5", SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5},
120 {"rsa_null_md5", SSL_RSA_WITH_NULL_MD5},
121 {"rsa_null_sha", SSL_RSA_WITH_NULL_SHA},
122 {"fips_3des_sha", SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA},
123 {"fips_des_sha", SSL_RSA_FIPS_WITH_DES_CBC_SHA},
124 {"fortezza", SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA},
125 {"fortezza_rc4_128_sha", SSL_FORTEZZA_DMS_WITH_RC4_128_SHA},
126 {"fortezza_null", SSL_FORTEZZA_DMS_WITH_NULL_SHA},
127 /* TLS 1.0: Exportable 56-bit Cipher Suites. */
128 {"rsa_des_56_sha", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA},
129 {"rsa_rc4_56_sha", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA},
130 /* AES ciphers. */
131 {"dhe_dss_aes_128_cbc_sha", TLS_DHE_DSS_WITH_AES_128_CBC_SHA},
132 {"dhe_dss_aes_256_cbc_sha", TLS_DHE_DSS_WITH_AES_256_CBC_SHA},
133 {"dhe_rsa_aes_128_cbc_sha", TLS_DHE_RSA_WITH_AES_128_CBC_SHA},
134 {"dhe_rsa_aes_256_cbc_sha", TLS_DHE_RSA_WITH_AES_256_CBC_SHA},
135 {"rsa_aes_128_sha", TLS_RSA_WITH_AES_128_CBC_SHA},
136 {"rsa_aes_256_sha", TLS_RSA_WITH_AES_256_CBC_SHA},
137 /* ECC ciphers. */
138 {"ecdh_ecdsa_null_sha", TLS_ECDH_ECDSA_WITH_NULL_SHA},
139 {"ecdh_ecdsa_rc4_128_sha", TLS_ECDH_ECDSA_WITH_RC4_128_SHA},
140 {"ecdh_ecdsa_3des_sha", TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA},
141 {"ecdh_ecdsa_aes_128_sha", TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA},
142 {"ecdh_ecdsa_aes_256_sha", TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA},
143 {"ecdhe_ecdsa_null_sha", TLS_ECDHE_ECDSA_WITH_NULL_SHA},
144 {"ecdhe_ecdsa_rc4_128_sha", TLS_ECDHE_ECDSA_WITH_RC4_128_SHA},
145 {"ecdhe_ecdsa_3des_sha", TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA},
146 {"ecdhe_ecdsa_aes_128_sha", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA},
147 {"ecdhe_ecdsa_aes_256_sha", TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA},
148 {"ecdh_rsa_null_sha", TLS_ECDH_RSA_WITH_NULL_SHA},
149 {"ecdh_rsa_128_sha", TLS_ECDH_RSA_WITH_RC4_128_SHA},
150 {"ecdh_rsa_3des_sha", TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA},
151 {"ecdh_rsa_aes_128_sha", TLS_ECDH_RSA_WITH_AES_128_CBC_SHA},
152 {"ecdh_rsa_aes_256_sha", TLS_ECDH_RSA_WITH_AES_256_CBC_SHA},
153 {"echde_rsa_null", TLS_ECDHE_RSA_WITH_NULL_SHA},
154 {"ecdhe_rsa_rc4_128_sha", TLS_ECDHE_RSA_WITH_RC4_128_SHA},
155 {"ecdhe_rsa_3des_sha", TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA},
156 {"ecdhe_rsa_aes_128_sha", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA},
157 {"ecdhe_rsa_aes_256_sha", TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA},
158 {"ecdh_anon_null_sha", TLS_ECDH_anon_WITH_NULL_SHA},
159 {"ecdh_anon_rc4_128sha", TLS_ECDH_anon_WITH_RC4_128_SHA},
160 {"ecdh_anon_3des_sha", TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA},
161 {"ecdh_anon_aes_128_sha", TLS_ECDH_anon_WITH_AES_128_CBC_SHA},
162 {"ecdh_anon_aes_256_sha", TLS_ECDH_anon_WITH_AES_256_CBC_SHA},
163 #ifdef TLS_RSA_WITH_NULL_SHA256
164 /* new HMAC-SHA256 cipher suites specified in RFC */
165 {"rsa_null_sha_256", TLS_RSA_WITH_NULL_SHA256},
166 {"rsa_aes_128_cbc_sha_256", TLS_RSA_WITH_AES_128_CBC_SHA256},
167 {"rsa_aes_256_cbc_sha_256", TLS_RSA_WITH_AES_256_CBC_SHA256},
168 {"dhe_rsa_aes_128_cbc_sha_256", TLS_DHE_RSA_WITH_AES_128_CBC_SHA256},
169 {"dhe_rsa_aes_256_cbc_sha_256", TLS_DHE_RSA_WITH_AES_256_CBC_SHA256},
170 {"ecdhe_ecdsa_aes_128_cbc_sha_256", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256},
171 {"ecdhe_rsa_aes_128_cbc_sha_256", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256},
172 #endif
173 #ifdef TLS_RSA_WITH_AES_128_GCM_SHA256
174 /* AES GCM cipher suites in RFC 5288 and RFC 5289 */
175 {"rsa_aes_128_gcm_sha_256", TLS_RSA_WITH_AES_128_GCM_SHA256},
176 {"dhe_rsa_aes_128_gcm_sha_256", TLS_DHE_RSA_WITH_AES_128_GCM_SHA256},
177 {"dhe_dss_aes_128_gcm_sha_256", TLS_DHE_DSS_WITH_AES_128_GCM_SHA256},
178 {"ecdhe_ecdsa_aes_128_gcm_sha_256", TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
179 {"ecdh_ecdsa_aes_128_gcm_sha_256", TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256},
180 {"ecdhe_rsa_aes_128_gcm_sha_256", TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
181 {"ecdh_rsa_aes_128_gcm_sha_256", TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256},
182 #endif
183 };
184
185 static const char* pem_library = "libnsspem.so";
186 SECMODModule* mod = NULL;
187
188 /* NSPR I/O layer we use to detect blocking direction during SSL handshake */
189 static PRDescIdentity nspr_io_identity = PR_INVALID_IO_LAYER;
190 static PRIOMethods nspr_io_methods;
191
nss_error_to_name(PRErrorCode code)192 static const char* nss_error_to_name(PRErrorCode code)
193 {
194 const char *name = PR_ErrorToName(code);
195 if(name)
196 return name;
197
198 return "unknown error";
199 }
200
nss_print_error_message(struct SessionHandle * data,PRUint32 err)201 static void nss_print_error_message(struct SessionHandle *data, PRUint32 err)
202 {
203 failf(data, "%s", PR_ErrorToString(err, PR_LANGUAGE_I_DEFAULT));
204 }
205
set_ciphers(struct SessionHandle * data,PRFileDesc * model,char * cipher_list)206 static SECStatus set_ciphers(struct SessionHandle *data, PRFileDesc * model,
207 char *cipher_list)
208 {
209 unsigned int i;
210 PRBool cipher_state[NUM_OF_CIPHERS];
211 PRBool found;
212 char *cipher;
213
214 /* First disable all ciphers. This uses a different max value in case
215 * NSS adds more ciphers later we don't want them available by
216 * accident
217 */
218 for(i=0; i<SSL_NumImplementedCiphers; i++) {
219 SSL_CipherPrefSet(model, SSL_ImplementedCiphers[i], PR_FALSE);
220 }
221
222 /* Set every entry in our list to false */
223 for(i=0; i<NUM_OF_CIPHERS; i++) {
224 cipher_state[i] = PR_FALSE;
225 }
226
227 cipher = cipher_list;
228
229 while(cipher_list && (cipher_list[0])) {
230 while((*cipher) && (ISSPACE(*cipher)))
231 ++cipher;
232
233 if((cipher_list = strchr(cipher, ','))) {
234 *cipher_list++ = '\0';
235 }
236
237 found = PR_FALSE;
238
239 for(i=0; i<NUM_OF_CIPHERS; i++) {
240 if(Curl_raw_equal(cipher, cipherlist[i].name)) {
241 cipher_state[i] = PR_TRUE;
242 found = PR_TRUE;
243 break;
244 }
245 }
246
247 if(found == PR_FALSE) {
248 failf(data, "Unknown cipher in list: %s", cipher);
249 return SECFailure;
250 }
251
252 if(cipher_list) {
253 cipher = cipher_list;
254 }
255 }
256
257 /* Finally actually enable the selected ciphers */
258 for(i=0; i<NUM_OF_CIPHERS; i++) {
259 if(!cipher_state[i])
260 continue;
261
262 if(SSL_CipherPrefSet(model, cipherlist[i].num, PR_TRUE) != SECSuccess) {
263 failf(data, "cipher-suite not supported by NSS: %s", cipherlist[i].name);
264 return SECFailure;
265 }
266 }
267
268 return SECSuccess;
269 }
270
271 /*
272 * Get the number of ciphers that are enabled. We use this to determine
273 * if we need to call NSS_SetDomesticPolicy() to enable the default ciphers.
274 */
num_enabled_ciphers(void)275 static int num_enabled_ciphers(void)
276 {
277 PRInt32 policy = 0;
278 int count = 0;
279 unsigned int i;
280
281 for(i=0; i<NUM_OF_CIPHERS; i++) {
282 SSL_CipherPolicyGet(cipherlist[i].num, &policy);
283 if(policy)
284 count++;
285 }
286 return count;
287 }
288
289 /*
290 * Determine whether the nickname passed in is a filename that needs to
291 * be loaded as a PEM or a regular NSS nickname.
292 *
293 * returns 1 for a file
294 * returns 0 for not a file (NSS nickname)
295 */
is_file(const char * filename)296 static int is_file(const char *filename)
297 {
298 struct_stat st;
299
300 if(filename == NULL)
301 return 0;
302
303 if(stat(filename, &st) == 0)
304 if(S_ISREG(st.st_mode))
305 return 1;
306
307 return 0;
308 }
309
310 /* Check if the given string is filename or nickname of a certificate. If the
311 * given string is recognized as filename, return NULL. If the given string is
312 * recognized as nickname, return a duplicated string. The returned string
313 * should be later deallocated using free(). If the OOM failure occurs, we
314 * return NULL, too.
315 */
dup_nickname(struct SessionHandle * data,enum dupstring cert_kind)316 static char* dup_nickname(struct SessionHandle *data, enum dupstring cert_kind)
317 {
318 const char *str = data->set.str[cert_kind];
319 const char *n;
320
321 if(!is_file(str))
322 /* no such file exists, use the string as nickname */
323 return strdup(str);
324
325 /* search the last slash; we require at least one slash in a file name */
326 n = strrchr(str, '/');
327 if(!n) {
328 infof(data, "warning: certificate file name \"%s\" handled as nickname; "
329 "please use \"./%s\" to force file name\n", str, str);
330 return strdup(str);
331 }
332
333 /* we'll use the PEM reader to read the certificate from file */
334 return NULL;
335 }
336
337 /* Call PK11_CreateGenericObject() with the given obj_class and filename. If
338 * the call succeeds, append the object handle to the list of objects so that
339 * the object can be destroyed in Curl_nss_close(). */
nss_create_object(struct ssl_connect_data * ssl,CK_OBJECT_CLASS obj_class,const char * filename,bool cacert)340 static CURLcode nss_create_object(struct ssl_connect_data *ssl,
341 CK_OBJECT_CLASS obj_class,
342 const char *filename, bool cacert)
343 {
344 PK11SlotInfo *slot;
345 PK11GenericObject *obj;
346 CK_BBOOL cktrue = CK_TRUE;
347 CK_BBOOL ckfalse = CK_FALSE;
348 CK_ATTRIBUTE attrs[/* max count of attributes */ 4];
349 int attr_cnt = 0;
350 CURLcode result = (cacert)
351 ? CURLE_SSL_CACERT_BADFILE
352 : CURLE_SSL_CERTPROBLEM;
353
354 const int slot_id = (cacert) ? 0 : 1;
355 char *slot_name = aprintf("PEM Token #%d", slot_id);
356 if(!slot_name)
357 return CURLE_OUT_OF_MEMORY;
358
359 slot = PK11_FindSlotByName(slot_name);
360 free(slot_name);
361 if(!slot)
362 return result;
363
364 PK11_SETATTRS(attrs, attr_cnt, CKA_CLASS, &obj_class, sizeof(obj_class));
365 PK11_SETATTRS(attrs, attr_cnt, CKA_TOKEN, &cktrue, sizeof(CK_BBOOL));
366 PK11_SETATTRS(attrs, attr_cnt, CKA_LABEL, (unsigned char *)filename,
367 strlen(filename) + 1);
368
369 if(CKO_CERTIFICATE == obj_class) {
370 CK_BBOOL *pval = (cacert) ? (&cktrue) : (&ckfalse);
371 PK11_SETATTRS(attrs, attr_cnt, CKA_TRUST, pval, sizeof(*pval));
372 }
373
374 obj = PK11_CreateGenericObject(slot, attrs, attr_cnt, PR_FALSE);
375 PK11_FreeSlot(slot);
376 if(!obj)
377 return result;
378
379 if(!Curl_llist_insert_next(ssl->obj_list, ssl->obj_list->tail, obj)) {
380 PK11_DestroyGenericObject(obj);
381 return CURLE_OUT_OF_MEMORY;
382 }
383
384 if(!cacert && CKO_CERTIFICATE == obj_class)
385 /* store reference to a client certificate */
386 ssl->obj_clicert = obj;
387
388 return CURLE_OK;
389 }
390
391 /* Destroy the NSS object whose handle is given by ptr. This function is
392 * a callback of Curl_llist_alloc() used by Curl_llist_destroy() to destroy
393 * NSS objects in Curl_nss_close() */
nss_destroy_object(void * user,void * ptr)394 static void nss_destroy_object(void *user, void *ptr)
395 {
396 PK11GenericObject *obj = (PK11GenericObject *)ptr;
397 (void) user;
398 PK11_DestroyGenericObject(obj);
399 }
400
401 /* same as nss_destroy_object() but for CRL items */
nss_destroy_crl_item(void * user,void * ptr)402 static void nss_destroy_crl_item(void *user, void *ptr)
403 {
404 SECItem *crl_der = (SECItem *)ptr;
405 (void) user;
406 SECITEM_FreeItem(crl_der, PR_TRUE);
407 }
408
nss_load_cert(struct ssl_connect_data * ssl,const char * filename,PRBool cacert)409 static CURLcode nss_load_cert(struct ssl_connect_data *ssl,
410 const char *filename, PRBool cacert)
411 {
412 CURLcode result = (cacert)
413 ? CURLE_SSL_CACERT_BADFILE
414 : CURLE_SSL_CERTPROBLEM;
415
416 /* libnsspem.so leaks memory if the requested file does not exist. For more
417 * details, go to <https://bugzilla.redhat.com/734760>. */
418 if(is_file(filename))
419 result = nss_create_object(ssl, CKO_CERTIFICATE, filename, cacert);
420
421 if(!result && !cacert) {
422 /* we have successfully loaded a client certificate */
423 CERTCertificate *cert;
424 char *nickname = NULL;
425 char *n = strrchr(filename, '/');
426 if(n)
427 n++;
428
429 /* The following undocumented magic helps to avoid a SIGSEGV on call
430 * of PK11_ReadRawAttribute() from SelectClientCert() when using an
431 * immature version of libnsspem.so. For more details, go to
432 * <https://bugzilla.redhat.com/733685>. */
433 nickname = aprintf("PEM Token #1:%s", n);
434 if(nickname) {
435 cert = PK11_FindCertFromNickname(nickname, NULL);
436 if(cert)
437 CERT_DestroyCertificate(cert);
438
439 free(nickname);
440 }
441 }
442
443 return result;
444 }
445
446 /* add given CRL to cache if it is not already there */
nss_cache_crl(SECItem * crl_der)447 static CURLcode nss_cache_crl(SECItem *crl_der)
448 {
449 CERTCertDBHandle *db = CERT_GetDefaultCertDB();
450 CERTSignedCrl *crl = SEC_FindCrlByDERCert(db, crl_der, 0);
451 if(crl) {
452 /* CRL already cached */
453 SEC_DestroyCrl(crl);
454 SECITEM_FreeItem(crl_der, PR_TRUE);
455 return CURLE_OK;
456 }
457
458 /* acquire lock before call of CERT_CacheCRL() and accessing nss_crl_list */
459 PR_Lock(nss_crllock);
460
461 /* store the CRL item so that we can free it in Curl_nss_cleanup() */
462 if(!Curl_llist_insert_next(nss_crl_list, nss_crl_list->tail, crl_der)) {
463 SECITEM_FreeItem(crl_der, PR_TRUE);
464 PR_Unlock(nss_crllock);
465 return CURLE_OUT_OF_MEMORY;
466 }
467
468 if(SECSuccess != CERT_CacheCRL(db, crl_der)) {
469 /* unable to cache CRL */
470 PR_Unlock(nss_crllock);
471 return CURLE_SSL_CRL_BADFILE;
472 }
473
474 /* we need to clear session cache, so that the CRL could take effect */
475 SSL_ClearSessionCache();
476 PR_Unlock(nss_crllock);
477 return CURLE_OK;
478 }
479
nss_load_crl(const char * crlfilename)480 static CURLcode nss_load_crl(const char* crlfilename)
481 {
482 PRFileDesc *infile;
483 PRFileInfo info;
484 SECItem filedata = { 0, NULL, 0 };
485 SECItem *crl_der = NULL;
486 char *body;
487
488 infile = PR_Open(crlfilename, PR_RDONLY, 0);
489 if(!infile)
490 return CURLE_SSL_CRL_BADFILE;
491
492 if(PR_SUCCESS != PR_GetOpenFileInfo(infile, &info))
493 goto fail;
494
495 if(!SECITEM_AllocItem(NULL, &filedata, info.size + /* zero ended */ 1))
496 goto fail;
497
498 if(info.size != PR_Read(infile, filedata.data, info.size))
499 goto fail;
500
501 crl_der = SECITEM_AllocItem(NULL, NULL, 0U);
502 if(!crl_der)
503 goto fail;
504
505 /* place a trailing zero right after the visible data */
506 body = (char*)filedata.data;
507 body[--filedata.len] = '\0';
508
509 body = strstr(body, "-----BEGIN");
510 if(body) {
511 /* assume ASCII */
512 char *trailer;
513 char *begin = PORT_Strchr(body, '\n');
514 if(!begin)
515 begin = PORT_Strchr(body, '\r');
516 if(!begin)
517 goto fail;
518
519 trailer = strstr(++begin, "-----END");
520 if(!trailer)
521 goto fail;
522
523 /* retrieve DER from ASCII */
524 *trailer = '\0';
525 if(ATOB_ConvertAsciiToItem(crl_der, begin))
526 goto fail;
527
528 SECITEM_FreeItem(&filedata, PR_FALSE);
529 }
530 else
531 /* assume DER */
532 *crl_der = filedata;
533
534 PR_Close(infile);
535 return nss_cache_crl(crl_der);
536
537 fail:
538 PR_Close(infile);
539 SECITEM_FreeItem(crl_der, PR_TRUE);
540 SECITEM_FreeItem(&filedata, PR_FALSE);
541 return CURLE_SSL_CRL_BADFILE;
542 }
543
nss_load_key(struct connectdata * conn,int sockindex,char * key_file)544 static CURLcode nss_load_key(struct connectdata *conn, int sockindex,
545 char *key_file)
546 {
547 PK11SlotInfo *slot;
548 SECStatus status;
549 CURLcode result;
550 struct ssl_connect_data *ssl = conn->ssl;
551
552 (void)sockindex; /* unused */
553
554 result = nss_create_object(ssl, CKO_PRIVATE_KEY, key_file, FALSE);
555 if(result) {
556 PR_SetError(SEC_ERROR_BAD_KEY, 0);
557 return result;
558 }
559
560 slot = PK11_FindSlotByName("PEM Token #1");
561 if(!slot)
562 return CURLE_SSL_CERTPROBLEM;
563
564 /* This will force the token to be seen as re-inserted */
565 SECMOD_WaitForAnyTokenEvent(mod, 0, 0);
566 PK11_IsPresent(slot);
567
568 status = PK11_Authenticate(slot, PR_TRUE,
569 conn->data->set.str[STRING_KEY_PASSWD]);
570 PK11_FreeSlot(slot);
571
572 return (SECSuccess == status) ? CURLE_OK : CURLE_SSL_CERTPROBLEM;
573 }
574
display_error(struct connectdata * conn,PRInt32 err,const char * filename)575 static int display_error(struct connectdata *conn, PRInt32 err,
576 const char *filename)
577 {
578 switch(err) {
579 case SEC_ERROR_BAD_PASSWORD:
580 failf(conn->data, "Unable to load client key: Incorrect password");
581 return 1;
582 case SEC_ERROR_UNKNOWN_CERT:
583 failf(conn->data, "Unable to load certificate %s", filename);
584 return 1;
585 default:
586 break;
587 }
588 return 0; /* The caller will print a generic error */
589 }
590
cert_stuff(struct connectdata * conn,int sockindex,char * cert_file,char * key_file)591 static CURLcode cert_stuff(struct connectdata *conn, int sockindex,
592 char *cert_file, char *key_file)
593 {
594 struct SessionHandle *data = conn->data;
595 CURLcode result;
596
597 if(cert_file) {
598 result = nss_load_cert(&conn->ssl[sockindex], cert_file, PR_FALSE);
599 if(result) {
600 const PRErrorCode err = PR_GetError();
601 if(!display_error(conn, err, cert_file)) {
602 const char *err_name = nss_error_to_name(err);
603 failf(data, "unable to load client cert: %d (%s)", err, err_name);
604 }
605
606 return result;
607 }
608 }
609
610 if(key_file || (is_file(cert_file))) {
611 if(key_file)
612 result = nss_load_key(conn, sockindex, key_file);
613 else
614 /* In case the cert file also has the key */
615 result = nss_load_key(conn, sockindex, cert_file);
616 if(result) {
617 const PRErrorCode err = PR_GetError();
618 if(!display_error(conn, err, key_file)) {
619 const char *err_name = nss_error_to_name(err);
620 failf(data, "unable to load client key: %d (%s)", err, err_name);
621 }
622
623 return result;
624 }
625 }
626
627 return CURLE_OK;
628 }
629
nss_get_password(PK11SlotInfo * slot,PRBool retry,void * arg)630 static char * nss_get_password(PK11SlotInfo * slot, PRBool retry, void *arg)
631 {
632 (void)slot; /* unused */
633
634 if(retry || NULL == arg)
635 return NULL;
636 else
637 return (char *)PORT_Strdup((char *)arg);
638 }
639
640 /* bypass the default SSL_AuthCertificate() hook in case we do not want to
641 * verify peer */
nss_auth_cert_hook(void * arg,PRFileDesc * fd,PRBool checksig,PRBool isServer)642 static SECStatus nss_auth_cert_hook(void *arg, PRFileDesc *fd, PRBool checksig,
643 PRBool isServer)
644 {
645 struct connectdata *conn = (struct connectdata *)arg;
646
647 #ifdef SSL_ENABLE_OCSP_STAPLING
648 if(conn->data->set.ssl.verifystatus) {
649 SECStatus cacheResult;
650
651 const SECItemArray *csa = SSL_PeerStapledOCSPResponses(fd);
652 if(!csa) {
653 failf(conn->data, "Invalid OCSP response");
654 return SECFailure;
655 }
656
657 if(csa->len == 0) {
658 failf(conn->data, "No OCSP response received");
659 return SECFailure;
660 }
661
662 cacheResult = CERT_CacheOCSPResponseFromSideChannel(
663 CERT_GetDefaultCertDB(), SSL_PeerCertificate(fd),
664 PR_Now(), &csa->items[0], arg
665 );
666
667 if(cacheResult != SECSuccess) {
668 failf(conn->data, "Invalid OCSP response");
669 return cacheResult;
670 }
671 }
672 #endif
673
674 if(!conn->data->set.ssl.verifypeer) {
675 infof(conn->data, "skipping SSL peer certificate verification\n");
676 return SECSuccess;
677 }
678
679 return SSL_AuthCertificate(CERT_GetDefaultCertDB(), fd, checksig, isServer);
680 }
681
682 /**
683 * Inform the application that the handshake is complete.
684 */
HandshakeCallback(PRFileDesc * sock,void * arg)685 static void HandshakeCallback(PRFileDesc *sock, void *arg)
686 {
687 struct connectdata *conn = (struct connectdata*) arg;
688 unsigned int buflenmax = 50;
689 unsigned char buf[50];
690 unsigned int buflen;
691 SSLNextProtoState state;
692
693 if(!conn->data->set.ssl_enable_npn && !conn->data->set.ssl_enable_alpn) {
694 return;
695 }
696
697 if(SSL_GetNextProto(sock, &state, buf, &buflen, buflenmax) == SECSuccess) {
698
699 switch(state) {
700 case SSL_NEXT_PROTO_NO_SUPPORT:
701 case SSL_NEXT_PROTO_NO_OVERLAP:
702 infof(conn->data, "ALPN/NPN, server did not agree to a protocol\n");
703 return;
704 #ifdef SSL_ENABLE_ALPN
705 case SSL_NEXT_PROTO_SELECTED:
706 infof(conn->data, "ALPN, server accepted to use %.*s\n", buflen, buf);
707 break;
708 #endif
709 case SSL_NEXT_PROTO_NEGOTIATED:
710 infof(conn->data, "NPN, server accepted to use %.*s\n", buflen, buf);
711 break;
712 }
713
714 #ifdef USE_NGHTTP2
715 if(buflen == NGHTTP2_PROTO_VERSION_ID_LEN &&
716 !memcmp(NGHTTP2_PROTO_VERSION_ID, buf, NGHTTP2_PROTO_VERSION_ID_LEN)) {
717 conn->negnpn = CURL_HTTP_VERSION_2_0;
718 }
719 else
720 #endif
721 if(buflen == ALPN_HTTP_1_1_LENGTH &&
722 !memcmp(ALPN_HTTP_1_1, buf, ALPN_HTTP_1_1_LENGTH)) {
723 conn->negnpn = CURL_HTTP_VERSION_1_1;
724 }
725 }
726 }
727
728 #if NSSVERNUM >= 0x030f04 /* 3.15.4 */
CanFalseStartCallback(PRFileDesc * sock,void * client_data,PRBool * canFalseStart)729 static SECStatus CanFalseStartCallback(PRFileDesc *sock, void *client_data,
730 PRBool *canFalseStart)
731 {
732 struct connectdata *conn = client_data;
733 struct SessionHandle *data = conn->data;
734
735 SSLChannelInfo channelInfo;
736 SSLCipherSuiteInfo cipherInfo;
737
738 SECStatus rv;
739 PRBool negotiatedExtension;
740
741 *canFalseStart = PR_FALSE;
742
743 if(SSL_GetChannelInfo(sock, &channelInfo, sizeof(channelInfo)) != SECSuccess)
744 return SECFailure;
745
746 if(SSL_GetCipherSuiteInfo(channelInfo.cipherSuite, &cipherInfo,
747 sizeof(cipherInfo)) != SECSuccess)
748 return SECFailure;
749
750 /* Prevent version downgrade attacks from TLS 1.2, and avoid False Start for
751 * TLS 1.3 and later. See https://bugzilla.mozilla.org/show_bug.cgi?id=861310
752 */
753 if(channelInfo.protocolVersion != SSL_LIBRARY_VERSION_TLS_1_2)
754 goto end;
755
756 /* Only allow ECDHE key exchange algorithm.
757 * See https://bugzilla.mozilla.org/show_bug.cgi?id=952863 */
758 if(cipherInfo.keaType != ssl_kea_ecdh)
759 goto end;
760
761 /* Prevent downgrade attacks on the symmetric cipher. We do not allow CBC
762 * mode due to BEAST, POODLE, and other attacks on the MAC-then-Encrypt
763 * design. See https://bugzilla.mozilla.org/show_bug.cgi?id=1109766 */
764 if(cipherInfo.symCipher != ssl_calg_aes_gcm)
765 goto end;
766
767 /* Enforce ALPN or NPN to do False Start, as an indicator of server
768 * compatibility. */
769 rv = SSL_HandshakeNegotiatedExtension(sock, ssl_app_layer_protocol_xtn,
770 &negotiatedExtension);
771 if(rv != SECSuccess || !negotiatedExtension) {
772 rv = SSL_HandshakeNegotiatedExtension(sock, ssl_next_proto_nego_xtn,
773 &negotiatedExtension);
774 }
775
776 if(rv != SECSuccess || !negotiatedExtension)
777 goto end;
778
779 *canFalseStart = PR_TRUE;
780
781 infof(data, "Trying TLS False Start\n");
782
783 end:
784 return SECSuccess;
785 }
786 #endif
787
display_cert_info(struct SessionHandle * data,CERTCertificate * cert)788 static void display_cert_info(struct SessionHandle *data,
789 CERTCertificate *cert)
790 {
791 char *subject, *issuer, *common_name;
792 PRExplodedTime printableTime;
793 char timeString[256];
794 PRTime notBefore, notAfter;
795
796 subject = CERT_NameToAscii(&cert->subject);
797 issuer = CERT_NameToAscii(&cert->issuer);
798 common_name = CERT_GetCommonName(&cert->subject);
799 infof(data, "\tsubject: %s\n", subject);
800
801 CERT_GetCertTimes(cert, ¬Before, ¬After);
802 PR_ExplodeTime(notBefore, PR_GMTParameters, &printableTime);
803 PR_FormatTime(timeString, 256, "%b %d %H:%M:%S %Y GMT", &printableTime);
804 infof(data, "\tstart date: %s\n", timeString);
805 PR_ExplodeTime(notAfter, PR_GMTParameters, &printableTime);
806 PR_FormatTime(timeString, 256, "%b %d %H:%M:%S %Y GMT", &printableTime);
807 infof(data, "\texpire date: %s\n", timeString);
808 infof(data, "\tcommon name: %s\n", common_name);
809 infof(data, "\tissuer: %s\n", issuer);
810
811 PR_Free(subject);
812 PR_Free(issuer);
813 PR_Free(common_name);
814 }
815
display_conn_info(struct connectdata * conn,PRFileDesc * sock)816 static CURLcode display_conn_info(struct connectdata *conn, PRFileDesc *sock)
817 {
818 CURLcode result = CURLE_OK;
819 SSLChannelInfo channel;
820 SSLCipherSuiteInfo suite;
821 CERTCertificate *cert;
822 CERTCertificate *cert2;
823 CERTCertificate *cert3;
824 PRTime now;
825 int i;
826
827 if(SSL_GetChannelInfo(sock, &channel, sizeof channel) ==
828 SECSuccess && channel.length == sizeof channel &&
829 channel.cipherSuite) {
830 if(SSL_GetCipherSuiteInfo(channel.cipherSuite,
831 &suite, sizeof suite) == SECSuccess) {
832 infof(conn->data, "SSL connection using %s\n", suite.cipherSuiteName);
833 }
834 }
835
836 cert = SSL_PeerCertificate(sock);
837 if(cert) {
838 infof(conn->data, "Server certificate:\n");
839
840 if(!conn->data->set.ssl.certinfo) {
841 display_cert_info(conn->data, cert);
842 CERT_DestroyCertificate(cert);
843 }
844 else {
845 /* Count certificates in chain. */
846 now = PR_Now();
847 i = 1;
848 if(!cert->isRoot) {
849 cert2 = CERT_FindCertIssuer(cert, now, certUsageSSLCA);
850 while(cert2) {
851 i++;
852 if(cert2->isRoot) {
853 CERT_DestroyCertificate(cert2);
854 break;
855 }
856 cert3 = CERT_FindCertIssuer(cert2, now, certUsageSSLCA);
857 CERT_DestroyCertificate(cert2);
858 cert2 = cert3;
859 }
860 }
861
862 result = Curl_ssl_init_certinfo(conn->data, i);
863 if(!result) {
864 for(i = 0; cert; cert = cert2) {
865 result = Curl_extract_certinfo(conn, i++, (char *)cert->derCert.data,
866 (char *)cert->derCert.data +
867 cert->derCert.len);
868 if(result)
869 break;
870
871 if(cert->isRoot) {
872 CERT_DestroyCertificate(cert);
873 break;
874 }
875
876 cert2 = CERT_FindCertIssuer(cert, now, certUsageSSLCA);
877 CERT_DestroyCertificate(cert);
878 }
879 }
880 }
881 }
882
883 return result;
884 }
885
BadCertHandler(void * arg,PRFileDesc * sock)886 static SECStatus BadCertHandler(void *arg, PRFileDesc *sock)
887 {
888 struct connectdata *conn = (struct connectdata *)arg;
889 struct SessionHandle *data = conn->data;
890 PRErrorCode err = PR_GetError();
891 CERTCertificate *cert;
892
893 /* remember the cert verification result */
894 data->set.ssl.certverifyresult = err;
895
896 if(err == SSL_ERROR_BAD_CERT_DOMAIN && !data->set.ssl.verifyhost)
897 /* we are asked not to verify the host name */
898 return SECSuccess;
899
900 /* print only info about the cert, the error is printed off the callback */
901 cert = SSL_PeerCertificate(sock);
902 if(cert) {
903 infof(data, "Server certificate:\n");
904 display_cert_info(data, cert);
905 CERT_DestroyCertificate(cert);
906 }
907
908 return SECFailure;
909 }
910
911 /**
912 *
913 * Check that the Peer certificate's issuer certificate matches the one found
914 * by issuer_nickname. This is not exactly the way OpenSSL and GNU TLS do the
915 * issuer check, so we provide comments that mimic the OpenSSL
916 * X509_check_issued function (in x509v3/v3_purp.c)
917 */
check_issuer_cert(PRFileDesc * sock,char * issuer_nickname)918 static SECStatus check_issuer_cert(PRFileDesc *sock,
919 char *issuer_nickname)
920 {
921 CERTCertificate *cert, *cert_issuer, *issuer;
922 SECStatus res=SECSuccess;
923 void *proto_win = NULL;
924
925 /*
926 PRArenaPool *tmpArena = NULL;
927 CERTAuthKeyID *authorityKeyID = NULL;
928 SECITEM *caname = NULL;
929 */
930
931 cert = SSL_PeerCertificate(sock);
932 cert_issuer = CERT_FindCertIssuer(cert, PR_Now(), certUsageObjectSigner);
933
934 proto_win = SSL_RevealPinArg(sock);
935 issuer = PK11_FindCertFromNickname(issuer_nickname, proto_win);
936
937 if((!cert_issuer) || (!issuer))
938 res = SECFailure;
939 else if(SECITEM_CompareItem(&cert_issuer->derCert,
940 &issuer->derCert)!=SECEqual)
941 res = SECFailure;
942
943 CERT_DestroyCertificate(cert);
944 CERT_DestroyCertificate(issuer);
945 CERT_DestroyCertificate(cert_issuer);
946 return res;
947 }
948
cmp_peer_pubkey(struct ssl_connect_data * connssl,const char * pinnedpubkey)949 static CURLcode cmp_peer_pubkey(struct ssl_connect_data *connssl,
950 const char *pinnedpubkey)
951 {
952 CURLcode result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
953 struct SessionHandle *data = connssl->data;
954 CERTCertificate *cert;
955
956 if(!pinnedpubkey)
957 /* no pinned public key specified */
958 return CURLE_OK;
959
960 /* get peer certificate */
961 cert = SSL_PeerCertificate(connssl->handle);
962 if(cert) {
963 /* extract public key from peer certificate */
964 SECKEYPublicKey *pubkey = CERT_ExtractPublicKey(cert);
965 if(pubkey) {
966 /* encode the public key as DER */
967 SECItem *cert_der = PK11_DEREncodePublicKey(pubkey);
968 if(cert_der) {
969 /* compare the public key with the pinned public key */
970 result = Curl_pin_peer_pubkey(pinnedpubkey,
971 cert_der->data,
972 cert_der->len);
973 SECITEM_FreeItem(cert_der, PR_TRUE);
974 }
975 SECKEY_DestroyPublicKey(pubkey);
976 }
977 CERT_DestroyCertificate(cert);
978 }
979
980 /* report the resulting status */
981 switch(result) {
982 case CURLE_OK:
983 infof(data, "pinned public key verified successfully!\n");
984 break;
985 case CURLE_SSL_PINNEDPUBKEYNOTMATCH:
986 failf(data, "failed to verify pinned public key");
987 break;
988 default:
989 /* OOM, etc. */
990 break;
991 }
992
993 return result;
994 }
995
996 /**
997 *
998 * Callback to pick the SSL client certificate.
999 */
SelectClientCert(void * arg,PRFileDesc * sock,struct CERTDistNamesStr * caNames,struct CERTCertificateStr ** pRetCert,struct SECKEYPrivateKeyStr ** pRetKey)1000 static SECStatus SelectClientCert(void *arg, PRFileDesc *sock,
1001 struct CERTDistNamesStr *caNames,
1002 struct CERTCertificateStr **pRetCert,
1003 struct SECKEYPrivateKeyStr **pRetKey)
1004 {
1005 struct ssl_connect_data *connssl = (struct ssl_connect_data *)arg;
1006 struct SessionHandle *data = connssl->data;
1007 const char *nickname = connssl->client_nickname;
1008
1009 if(connssl->obj_clicert) {
1010 /* use the cert/key provided by PEM reader */
1011 static const char pem_slotname[] = "PEM Token #1";
1012 SECItem cert_der = { 0, NULL, 0 };
1013 void *proto_win = SSL_RevealPinArg(sock);
1014 struct CERTCertificateStr *cert;
1015 struct SECKEYPrivateKeyStr *key;
1016
1017 PK11SlotInfo *slot = PK11_FindSlotByName(pem_slotname);
1018 if(NULL == slot) {
1019 failf(data, "NSS: PK11 slot not found: %s", pem_slotname);
1020 return SECFailure;
1021 }
1022
1023 if(PK11_ReadRawAttribute(PK11_TypeGeneric, connssl->obj_clicert, CKA_VALUE,
1024 &cert_der) != SECSuccess) {
1025 failf(data, "NSS: CKA_VALUE not found in PK11 generic object");
1026 PK11_FreeSlot(slot);
1027 return SECFailure;
1028 }
1029
1030 cert = PK11_FindCertFromDERCertItem(slot, &cert_der, proto_win);
1031 SECITEM_FreeItem(&cert_der, PR_FALSE);
1032 if(NULL == cert) {
1033 failf(data, "NSS: client certificate from file not found");
1034 PK11_FreeSlot(slot);
1035 return SECFailure;
1036 }
1037
1038 key = PK11_FindPrivateKeyFromCert(slot, cert, NULL);
1039 PK11_FreeSlot(slot);
1040 if(NULL == key) {
1041 failf(data, "NSS: private key from file not found");
1042 CERT_DestroyCertificate(cert);
1043 return SECFailure;
1044 }
1045
1046 infof(data, "NSS: client certificate from file\n");
1047 display_cert_info(data, cert);
1048
1049 *pRetCert = cert;
1050 *pRetKey = key;
1051 return SECSuccess;
1052 }
1053
1054 /* use the default NSS hook */
1055 if(SECSuccess != NSS_GetClientAuthData((void *)nickname, sock, caNames,
1056 pRetCert, pRetKey)
1057 || NULL == *pRetCert) {
1058
1059 if(NULL == nickname)
1060 failf(data, "NSS: client certificate not found (nickname not "
1061 "specified)");
1062 else
1063 failf(data, "NSS: client certificate not found: %s", nickname);
1064
1065 return SECFailure;
1066 }
1067
1068 /* get certificate nickname if any */
1069 nickname = (*pRetCert)->nickname;
1070 if(NULL == nickname)
1071 nickname = "[unknown]";
1072
1073 if(NULL == *pRetKey) {
1074 failf(data, "NSS: private key not found for certificate: %s", nickname);
1075 return SECFailure;
1076 }
1077
1078 infof(data, "NSS: using client certificate: %s\n", nickname);
1079 display_cert_info(data, *pRetCert);
1080 return SECSuccess;
1081 }
1082
1083 /* update blocking direction in case of PR_WOULD_BLOCK_ERROR */
nss_update_connecting_state(ssl_connect_state state,void * secret)1084 static void nss_update_connecting_state(ssl_connect_state state, void *secret)
1085 {
1086 struct ssl_connect_data *connssl = (struct ssl_connect_data *)secret;
1087 if(PR_GetError() != PR_WOULD_BLOCK_ERROR)
1088 /* an unrelated error is passing by */
1089 return;
1090
1091 switch(connssl->connecting_state) {
1092 case ssl_connect_2:
1093 case ssl_connect_2_reading:
1094 case ssl_connect_2_writing:
1095 break;
1096 default:
1097 /* we are not called from an SSL handshake */
1098 return;
1099 }
1100
1101 /* update the state accordingly */
1102 connssl->connecting_state = state;
1103 }
1104
1105 /* recv() wrapper we use to detect blocking direction during SSL handshake */
nspr_io_recv(PRFileDesc * fd,void * buf,PRInt32 amount,PRIntn flags,PRIntervalTime timeout)1106 static PRInt32 nspr_io_recv(PRFileDesc *fd, void *buf, PRInt32 amount,
1107 PRIntn flags, PRIntervalTime timeout)
1108 {
1109 const PRRecvFN recv_fn = fd->lower->methods->recv;
1110 const PRInt32 rv = recv_fn(fd->lower, buf, amount, flags, timeout);
1111 if(rv < 0)
1112 /* check for PR_WOULD_BLOCK_ERROR and update blocking direction */
1113 nss_update_connecting_state(ssl_connect_2_reading, fd->secret);
1114 return rv;
1115 }
1116
1117 /* send() wrapper we use to detect blocking direction during SSL handshake */
nspr_io_send(PRFileDesc * fd,const void * buf,PRInt32 amount,PRIntn flags,PRIntervalTime timeout)1118 static PRInt32 nspr_io_send(PRFileDesc *fd, const void *buf, PRInt32 amount,
1119 PRIntn flags, PRIntervalTime timeout)
1120 {
1121 const PRSendFN send_fn = fd->lower->methods->send;
1122 const PRInt32 rv = send_fn(fd->lower, buf, amount, flags, timeout);
1123 if(rv < 0)
1124 /* check for PR_WOULD_BLOCK_ERROR and update blocking direction */
1125 nss_update_connecting_state(ssl_connect_2_writing, fd->secret);
1126 return rv;
1127 }
1128
1129 /* close() wrapper to avoid assertion failure due to fd->secret != NULL */
nspr_io_close(PRFileDesc * fd)1130 static PRStatus nspr_io_close(PRFileDesc *fd)
1131 {
1132 const PRCloseFN close_fn = PR_GetDefaultIOMethods()->close;
1133 fd->secret = NULL;
1134 return close_fn(fd);
1135 }
1136
1137 /* data might be NULL */
nss_init_core(struct SessionHandle * data,const char * cert_dir)1138 static CURLcode nss_init_core(struct SessionHandle *data, const char *cert_dir)
1139 {
1140 NSSInitParameters initparams;
1141
1142 if(nss_context != NULL)
1143 return CURLE_OK;
1144
1145 memset((void *) &initparams, '\0', sizeof(initparams));
1146 initparams.length = sizeof(initparams);
1147
1148 if(cert_dir) {
1149 char *certpath = aprintf("sql:%s", cert_dir);
1150 if(!certpath)
1151 return CURLE_OUT_OF_MEMORY;
1152
1153 infof(data, "Initializing NSS with certpath: %s\n", certpath);
1154 nss_context = NSS_InitContext(certpath, "", "", "", &initparams,
1155 NSS_INIT_READONLY | NSS_INIT_PK11RELOAD);
1156 free(certpath);
1157
1158 if(nss_context != NULL)
1159 return CURLE_OK;
1160
1161 infof(data, "Unable to initialize NSS database\n");
1162 }
1163
1164 infof(data, "Initializing NSS with certpath: none\n");
1165 nss_context = NSS_InitContext("", "", "", "", &initparams, NSS_INIT_READONLY
1166 | NSS_INIT_NOCERTDB | NSS_INIT_NOMODDB | NSS_INIT_FORCEOPEN
1167 | NSS_INIT_NOROOTINIT | NSS_INIT_OPTIMIZESPACE | NSS_INIT_PK11RELOAD);
1168 if(nss_context != NULL)
1169 return CURLE_OK;
1170
1171 infof(data, "Unable to initialize NSS\n");
1172 return CURLE_SSL_CACERT_BADFILE;
1173 }
1174
1175 /* data might be NULL */
nss_init(struct SessionHandle * data)1176 static CURLcode nss_init(struct SessionHandle *data)
1177 {
1178 char *cert_dir;
1179 struct_stat st;
1180 CURLcode result;
1181
1182 if(initialized)
1183 return CURLE_OK;
1184
1185 /* list of all CRL items we need to destroy in Curl_nss_cleanup() */
1186 nss_crl_list = Curl_llist_alloc(nss_destroy_crl_item);
1187 if(!nss_crl_list)
1188 return CURLE_OUT_OF_MEMORY;
1189
1190 /* First we check if $SSL_DIR points to a valid dir */
1191 cert_dir = getenv("SSL_DIR");
1192 if(cert_dir) {
1193 if((stat(cert_dir, &st) != 0) ||
1194 (!S_ISDIR(st.st_mode))) {
1195 cert_dir = NULL;
1196 }
1197 }
1198
1199 /* Now we check if the default location is a valid dir */
1200 if(!cert_dir) {
1201 if((stat(SSL_DIR, &st) == 0) &&
1202 (S_ISDIR(st.st_mode))) {
1203 cert_dir = (char *)SSL_DIR;
1204 }
1205 }
1206
1207 if(nspr_io_identity == PR_INVALID_IO_LAYER) {
1208 /* allocate an identity for our own NSPR I/O layer */
1209 nspr_io_identity = PR_GetUniqueIdentity("libcurl");
1210 if(nspr_io_identity == PR_INVALID_IO_LAYER)
1211 return CURLE_OUT_OF_MEMORY;
1212
1213 /* the default methods just call down to the lower I/O layer */
1214 memcpy(&nspr_io_methods, PR_GetDefaultIOMethods(), sizeof nspr_io_methods);
1215
1216 /* override certain methods in the table by our wrappers */
1217 nspr_io_methods.recv = nspr_io_recv;
1218 nspr_io_methods.send = nspr_io_send;
1219 nspr_io_methods.close = nspr_io_close;
1220 }
1221
1222 result = nss_init_core(data, cert_dir);
1223 if(result)
1224 return result;
1225
1226 if(num_enabled_ciphers() == 0)
1227 NSS_SetDomesticPolicy();
1228
1229 initialized = 1;
1230
1231 return CURLE_OK;
1232 }
1233
1234 /**
1235 * Global SSL init
1236 *
1237 * @retval 0 error initializing SSL
1238 * @retval 1 SSL initialized successfully
1239 */
Curl_nss_init(void)1240 int Curl_nss_init(void)
1241 {
1242 /* curl_global_init() is not thread-safe so this test is ok */
1243 if(nss_initlock == NULL) {
1244 PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 256);
1245 nss_initlock = PR_NewLock();
1246 nss_crllock = PR_NewLock();
1247 }
1248
1249 /* We will actually initialize NSS later */
1250
1251 return 1;
1252 }
1253
1254 /* data might be NULL */
Curl_nss_force_init(struct SessionHandle * data)1255 CURLcode Curl_nss_force_init(struct SessionHandle *data)
1256 {
1257 CURLcode result;
1258 if(!nss_initlock) {
1259 if(data)
1260 failf(data, "unable to initialize NSS, curl_global_init() should have "
1261 "been called with CURL_GLOBAL_SSL or CURL_GLOBAL_ALL");
1262 return CURLE_FAILED_INIT;
1263 }
1264
1265 PR_Lock(nss_initlock);
1266 result = nss_init(data);
1267 PR_Unlock(nss_initlock);
1268
1269 return result;
1270 }
1271
1272 /* Global cleanup */
Curl_nss_cleanup(void)1273 void Curl_nss_cleanup(void)
1274 {
1275 /* This function isn't required to be threadsafe and this is only done
1276 * as a safety feature.
1277 */
1278 PR_Lock(nss_initlock);
1279 if(initialized) {
1280 /* Free references to client certificates held in the SSL session cache.
1281 * Omitting this hampers destruction of the security module owning
1282 * the certificates. */
1283 SSL_ClearSessionCache();
1284
1285 if(mod && SECSuccess == SECMOD_UnloadUserModule(mod)) {
1286 SECMOD_DestroyModule(mod);
1287 mod = NULL;
1288 }
1289 NSS_ShutdownContext(nss_context);
1290 nss_context = NULL;
1291 }
1292
1293 /* destroy all CRL items */
1294 Curl_llist_destroy(nss_crl_list, NULL);
1295 nss_crl_list = NULL;
1296
1297 PR_Unlock(nss_initlock);
1298
1299 PR_DestroyLock(nss_initlock);
1300 PR_DestroyLock(nss_crllock);
1301 nss_initlock = NULL;
1302
1303 initialized = 0;
1304 }
1305
1306 /*
1307 * This function uses SSL_peek to determine connection status.
1308 *
1309 * Return codes:
1310 * 1 means the connection is still in place
1311 * 0 means the connection has been closed
1312 * -1 means the connection status is unknown
1313 */
1314 int
Curl_nss_check_cxn(struct connectdata * conn)1315 Curl_nss_check_cxn(struct connectdata *conn)
1316 {
1317 int rc;
1318 char buf;
1319
1320 rc =
1321 PR_Recv(conn->ssl[FIRSTSOCKET].handle, (void *)&buf, 1, PR_MSG_PEEK,
1322 PR_SecondsToInterval(1));
1323 if(rc > 0)
1324 return 1; /* connection still in place */
1325
1326 if(rc == 0)
1327 return 0; /* connection has been closed */
1328
1329 return -1; /* connection status unknown */
1330 }
1331
1332 /*
1333 * This function is called when an SSL connection is closed.
1334 */
Curl_nss_close(struct connectdata * conn,int sockindex)1335 void Curl_nss_close(struct connectdata *conn, int sockindex)
1336 {
1337 struct ssl_connect_data *connssl = &conn->ssl[sockindex];
1338
1339 if(connssl->handle) {
1340 /* NSS closes the socket we previously handed to it, so we must mark it
1341 as closed to avoid double close */
1342 fake_sclose(conn->sock[sockindex]);
1343 conn->sock[sockindex] = CURL_SOCKET_BAD;
1344
1345 if((connssl->client_nickname != NULL) || (connssl->obj_clicert != NULL))
1346 /* A server might require different authentication based on the
1347 * particular path being requested by the client. To support this
1348 * scenario, we must ensure that a connection will never reuse the
1349 * authentication data from a previous connection. */
1350 SSL_InvalidateSession(connssl->handle);
1351
1352 free(connssl->client_nickname);
1353 connssl->client_nickname = NULL;
1354 /* destroy all NSS objects in order to avoid failure of NSS shutdown */
1355 Curl_llist_destroy(connssl->obj_list, NULL);
1356 connssl->obj_list = NULL;
1357 connssl->obj_clicert = NULL;
1358
1359 PR_Close(connssl->handle);
1360 connssl->handle = NULL;
1361 }
1362 }
1363
1364 /* return true if NSS can provide error code (and possibly msg) for the
1365 error */
is_nss_error(CURLcode err)1366 static bool is_nss_error(CURLcode err)
1367 {
1368 switch(err) {
1369 case CURLE_PEER_FAILED_VERIFICATION:
1370 case CURLE_SSL_CACERT:
1371 case CURLE_SSL_CERTPROBLEM:
1372 case CURLE_SSL_CONNECT_ERROR:
1373 case CURLE_SSL_ISSUER_ERROR:
1374 return true;
1375
1376 default:
1377 return false;
1378 }
1379 }
1380
1381 /* return true if the given error code is related to a client certificate */
is_cc_error(PRInt32 err)1382 static bool is_cc_error(PRInt32 err)
1383 {
1384 switch(err) {
1385 case SSL_ERROR_BAD_CERT_ALERT:
1386 case SSL_ERROR_EXPIRED_CERT_ALERT:
1387 case SSL_ERROR_REVOKED_CERT_ALERT:
1388 return true;
1389
1390 default:
1391 return false;
1392 }
1393 }
1394
1395 static Curl_recv nss_recv;
1396 static Curl_send nss_send;
1397
nss_load_ca_certificates(struct connectdata * conn,int sockindex)1398 static CURLcode nss_load_ca_certificates(struct connectdata *conn,
1399 int sockindex)
1400 {
1401 struct SessionHandle *data = conn->data;
1402 const char *cafile = data->set.ssl.CAfile;
1403 const char *capath = data->set.ssl.CApath;
1404
1405 if(cafile) {
1406 CURLcode result = nss_load_cert(&conn->ssl[sockindex], cafile, PR_TRUE);
1407 if(result)
1408 return result;
1409 }
1410
1411 if(capath) {
1412 struct_stat st;
1413 if(stat(capath, &st) == -1)
1414 return CURLE_SSL_CACERT_BADFILE;
1415
1416 if(S_ISDIR(st.st_mode)) {
1417 PRDirEntry *entry;
1418 PRDir *dir = PR_OpenDir(capath);
1419 if(!dir)
1420 return CURLE_SSL_CACERT_BADFILE;
1421
1422 while((entry = PR_ReadDir(dir, PR_SKIP_BOTH | PR_SKIP_HIDDEN))) {
1423 char *fullpath = aprintf("%s/%s", capath, entry->name);
1424 if(!fullpath) {
1425 PR_CloseDir(dir);
1426 return CURLE_OUT_OF_MEMORY;
1427 }
1428
1429 if(CURLE_OK != nss_load_cert(&conn->ssl[sockindex], fullpath, PR_TRUE))
1430 /* This is purposefully tolerant of errors so non-PEM files can
1431 * be in the same directory */
1432 infof(data, "failed to load '%s' from CURLOPT_CAPATH\n", fullpath);
1433
1434 free(fullpath);
1435 }
1436
1437 PR_CloseDir(dir);
1438 }
1439 else
1440 infof(data, "warning: CURLOPT_CAPATH not a directory (%s)\n", capath);
1441 }
1442
1443 infof(data, " CAfile: %s\n CApath: %s\n",
1444 cafile ? cafile : "none",
1445 capath ? capath : "none");
1446
1447 return CURLE_OK;
1448 }
1449
nss_init_sslver(SSLVersionRange * sslver,struct SessionHandle * data)1450 static CURLcode nss_init_sslver(SSLVersionRange *sslver,
1451 struct SessionHandle *data)
1452 {
1453 switch(data->set.ssl.version) {
1454 default:
1455 case CURL_SSLVERSION_DEFAULT:
1456 case CURL_SSLVERSION_TLSv1:
1457 sslver->min = SSL_LIBRARY_VERSION_TLS_1_0;
1458 #ifdef SSL_LIBRARY_VERSION_TLS_1_2
1459 sslver->max = SSL_LIBRARY_VERSION_TLS_1_2;
1460 #elif defined SSL_LIBRARY_VERSION_TLS_1_1
1461 sslver->max = SSL_LIBRARY_VERSION_TLS_1_1;
1462 #else
1463 sslver->max = SSL_LIBRARY_VERSION_TLS_1_0;
1464 #endif
1465 return CURLE_OK;
1466
1467 case CURL_SSLVERSION_SSLv2:
1468 sslver->min = SSL_LIBRARY_VERSION_2;
1469 sslver->max = SSL_LIBRARY_VERSION_2;
1470 return CURLE_OK;
1471
1472 case CURL_SSLVERSION_SSLv3:
1473 sslver->min = SSL_LIBRARY_VERSION_3_0;
1474 sslver->max = SSL_LIBRARY_VERSION_3_0;
1475 return CURLE_OK;
1476
1477 case CURL_SSLVERSION_TLSv1_0:
1478 sslver->min = SSL_LIBRARY_VERSION_TLS_1_0;
1479 sslver->max = SSL_LIBRARY_VERSION_TLS_1_0;
1480 return CURLE_OK;
1481
1482 case CURL_SSLVERSION_TLSv1_1:
1483 #ifdef SSL_LIBRARY_VERSION_TLS_1_1
1484 sslver->min = SSL_LIBRARY_VERSION_TLS_1_1;
1485 sslver->max = SSL_LIBRARY_VERSION_TLS_1_1;
1486 return CURLE_OK;
1487 #endif
1488 break;
1489
1490 case CURL_SSLVERSION_TLSv1_2:
1491 #ifdef SSL_LIBRARY_VERSION_TLS_1_2
1492 sslver->min = SSL_LIBRARY_VERSION_TLS_1_2;
1493 sslver->max = SSL_LIBRARY_VERSION_TLS_1_2;
1494 return CURLE_OK;
1495 #endif
1496 break;
1497 }
1498
1499 failf(data, "TLS minor version cannot be set");
1500 return CURLE_SSL_CONNECT_ERROR;
1501 }
1502
nss_fail_connect(struct ssl_connect_data * connssl,struct SessionHandle * data,CURLcode curlerr)1503 static CURLcode nss_fail_connect(struct ssl_connect_data *connssl,
1504 struct SessionHandle *data,
1505 CURLcode curlerr)
1506 {
1507 PRErrorCode err = 0;
1508
1509 if(is_nss_error(curlerr)) {
1510 /* read NSPR error code */
1511 err = PR_GetError();
1512 if(is_cc_error(err))
1513 curlerr = CURLE_SSL_CERTPROBLEM;
1514
1515 /* print the error number and error string */
1516 infof(data, "NSS error %d (%s)\n", err, nss_error_to_name(err));
1517
1518 /* print a human-readable message describing the error if available */
1519 nss_print_error_message(data, err);
1520 }
1521
1522 /* cleanup on connection failure */
1523 Curl_llist_destroy(connssl->obj_list, NULL);
1524 connssl->obj_list = NULL;
1525
1526 return curlerr;
1527 }
1528
1529 /* Switch the SSL socket into non-blocking mode. */
nss_set_nonblock(struct ssl_connect_data * connssl,struct SessionHandle * data)1530 static CURLcode nss_set_nonblock(struct ssl_connect_data *connssl,
1531 struct SessionHandle *data)
1532 {
1533 static PRSocketOptionData sock_opt;
1534 sock_opt.option = PR_SockOpt_Nonblocking;
1535 sock_opt.value.non_blocking = PR_TRUE;
1536
1537 if(PR_SetSocketOption(connssl->handle, &sock_opt) != PR_SUCCESS)
1538 return nss_fail_connect(connssl, data, CURLE_SSL_CONNECT_ERROR);
1539
1540 return CURLE_OK;
1541 }
1542
nss_setup_connect(struct connectdata * conn,int sockindex)1543 static CURLcode nss_setup_connect(struct connectdata *conn, int sockindex)
1544 {
1545 PRFileDesc *model = NULL;
1546 PRFileDesc *nspr_io = NULL;
1547 PRFileDesc *nspr_io_stub = NULL;
1548 PRBool ssl_no_cache;
1549 PRBool ssl_cbc_random_iv;
1550 struct SessionHandle *data = conn->data;
1551 curl_socket_t sockfd = conn->sock[sockindex];
1552 struct ssl_connect_data *connssl = &conn->ssl[sockindex];
1553 CURLcode result;
1554
1555 SSLVersionRange sslver = {
1556 SSL_LIBRARY_VERSION_TLS_1_0, /* min */
1557 SSL_LIBRARY_VERSION_TLS_1_0 /* max */
1558 };
1559
1560 connssl->data = data;
1561
1562 /* list of all NSS objects we need to destroy in Curl_nss_close() */
1563 connssl->obj_list = Curl_llist_alloc(nss_destroy_object);
1564 if(!connssl->obj_list)
1565 return CURLE_OUT_OF_MEMORY;
1566
1567 /* FIXME. NSS doesn't support multiple databases open at the same time. */
1568 PR_Lock(nss_initlock);
1569 result = nss_init(conn->data);
1570 if(result) {
1571 PR_Unlock(nss_initlock);
1572 goto error;
1573 }
1574
1575 result = CURLE_SSL_CONNECT_ERROR;
1576
1577 if(!mod) {
1578 char *configstring = aprintf("library=%s name=PEM", pem_library);
1579 if(!configstring) {
1580 PR_Unlock(nss_initlock);
1581 goto error;
1582 }
1583 mod = SECMOD_LoadUserModule(configstring, NULL, PR_FALSE);
1584 free(configstring);
1585
1586 if(!mod || !mod->loaded) {
1587 if(mod) {
1588 SECMOD_DestroyModule(mod);
1589 mod = NULL;
1590 }
1591 infof(data, "WARNING: failed to load NSS PEM library %s. Using "
1592 "OpenSSL PEM certificates will not work.\n", pem_library);
1593 }
1594 }
1595
1596 PK11_SetPasswordFunc(nss_get_password);
1597 PR_Unlock(nss_initlock);
1598
1599 model = PR_NewTCPSocket();
1600 if(!model)
1601 goto error;
1602 model = SSL_ImportFD(NULL, model);
1603
1604 if(SSL_OptionSet(model, SSL_SECURITY, PR_TRUE) != SECSuccess)
1605 goto error;
1606 if(SSL_OptionSet(model, SSL_HANDSHAKE_AS_SERVER, PR_FALSE) != SECSuccess)
1607 goto error;
1608 if(SSL_OptionSet(model, SSL_HANDSHAKE_AS_CLIENT, PR_TRUE) != SECSuccess)
1609 goto error;
1610
1611 /* do not use SSL cache if disabled or we are not going to verify peer */
1612 ssl_no_cache = (conn->ssl_config.sessionid && data->set.ssl.verifypeer) ?
1613 PR_FALSE : PR_TRUE;
1614 if(SSL_OptionSet(model, SSL_NO_CACHE, ssl_no_cache) != SECSuccess)
1615 goto error;
1616
1617 /* enable/disable the requested SSL version(s) */
1618 if(nss_init_sslver(&sslver, data) != CURLE_OK)
1619 goto error;
1620 if(SSL_VersionRangeSet(model, &sslver) != SECSuccess)
1621 goto error;
1622
1623 ssl_cbc_random_iv = !data->set.ssl_enable_beast;
1624 #ifdef SSL_CBC_RANDOM_IV
1625 /* unless the user explicitly asks to allow the protocol vulnerability, we
1626 use the work-around */
1627 if(SSL_OptionSet(model, SSL_CBC_RANDOM_IV, ssl_cbc_random_iv) != SECSuccess)
1628 infof(data, "warning: failed to set SSL_CBC_RANDOM_IV = %d\n",
1629 ssl_cbc_random_iv);
1630 #else
1631 if(ssl_cbc_random_iv)
1632 infof(data, "warning: support for SSL_CBC_RANDOM_IV not compiled in\n");
1633 #endif
1634
1635 if(data->set.ssl.cipher_list) {
1636 if(set_ciphers(data, model, data->set.ssl.cipher_list) != SECSuccess) {
1637 result = CURLE_SSL_CIPHER;
1638 goto error;
1639 }
1640 }
1641
1642 if(!data->set.ssl.verifypeer && data->set.ssl.verifyhost)
1643 infof(data, "warning: ignoring value of ssl.verifyhost\n");
1644
1645 /* bypass the default SSL_AuthCertificate() hook in case we do not want to
1646 * verify peer */
1647 if(SSL_AuthCertificateHook(model, nss_auth_cert_hook, conn) != SECSuccess)
1648 goto error;
1649
1650 data->set.ssl.certverifyresult=0; /* not checked yet */
1651 if(SSL_BadCertHook(model, BadCertHandler, conn) != SECSuccess)
1652 goto error;
1653
1654 if(SSL_HandshakeCallback(model, HandshakeCallback, conn) != SECSuccess)
1655 goto error;
1656
1657 if(data->set.ssl.verifypeer) {
1658 const CURLcode rv = nss_load_ca_certificates(conn, sockindex);
1659 if(rv) {
1660 result = rv;
1661 goto error;
1662 }
1663 }
1664
1665 if(data->set.ssl.CRLfile) {
1666 const CURLcode rv = nss_load_crl(data->set.ssl.CRLfile);
1667 if(rv) {
1668 result = rv;
1669 goto error;
1670 }
1671 infof(data, " CRLfile: %s\n", data->set.ssl.CRLfile);
1672 }
1673
1674 if(data->set.str[STRING_CERT]) {
1675 char *nickname = dup_nickname(data, STRING_CERT);
1676 if(nickname) {
1677 /* we are not going to use libnsspem.so to read the client cert */
1678 connssl->obj_clicert = NULL;
1679 }
1680 else {
1681 CURLcode rv = cert_stuff(conn, sockindex, data->set.str[STRING_CERT],
1682 data->set.str[STRING_KEY]);
1683 if(rv) {
1684 /* failf() is already done in cert_stuff() */
1685 result = rv;
1686 goto error;
1687 }
1688 }
1689
1690 /* store the nickname for SelectClientCert() called during handshake */
1691 connssl->client_nickname = nickname;
1692 }
1693 else
1694 connssl->client_nickname = NULL;
1695
1696 if(SSL_GetClientAuthDataHook(model, SelectClientCert,
1697 (void *)connssl) != SECSuccess) {
1698 result = CURLE_SSL_CERTPROBLEM;
1699 goto error;
1700 }
1701
1702 /* wrap OS file descriptor by NSPR's file descriptor abstraction */
1703 nspr_io = PR_ImportTCPSocket(sockfd);
1704 if(!nspr_io)
1705 goto error;
1706
1707 /* create our own NSPR I/O layer */
1708 nspr_io_stub = PR_CreateIOLayerStub(nspr_io_identity, &nspr_io_methods);
1709 if(!nspr_io_stub) {
1710 PR_Close(nspr_io);
1711 goto error;
1712 }
1713
1714 /* make the per-connection data accessible from NSPR I/O callbacks */
1715 nspr_io_stub->secret = (void *)connssl;
1716
1717 /* push our new layer to the NSPR I/O stack */
1718 if(PR_PushIOLayer(nspr_io, PR_TOP_IO_LAYER, nspr_io_stub) != PR_SUCCESS) {
1719 PR_Close(nspr_io);
1720 PR_Close(nspr_io_stub);
1721 goto error;
1722 }
1723
1724 /* import our model socket onto the current I/O stack */
1725 connssl->handle = SSL_ImportFD(model, nspr_io);
1726 if(!connssl->handle) {
1727 PR_Close(nspr_io);
1728 goto error;
1729 }
1730
1731 PR_Close(model); /* We don't need this any more */
1732 model = NULL;
1733
1734 /* This is the password associated with the cert that we're using */
1735 if(data->set.str[STRING_KEY_PASSWD]) {
1736 SSL_SetPKCS11PinArg(connssl->handle, data->set.str[STRING_KEY_PASSWD]);
1737 }
1738
1739 #ifdef SSL_ENABLE_OCSP_STAPLING
1740 if(data->set.ssl.verifystatus) {
1741 if(SSL_OptionSet(connssl->handle, SSL_ENABLE_OCSP_STAPLING, PR_TRUE)
1742 != SECSuccess)
1743 goto error;
1744 }
1745 #endif
1746
1747 #ifdef SSL_ENABLE_NPN
1748 if(SSL_OptionSet(connssl->handle, SSL_ENABLE_NPN, data->set.ssl_enable_npn
1749 ? PR_TRUE : PR_FALSE) != SECSuccess)
1750 goto error;
1751 #endif
1752
1753 #ifdef SSL_ENABLE_ALPN
1754 if(SSL_OptionSet(connssl->handle, SSL_ENABLE_ALPN, data->set.ssl_enable_alpn
1755 ? PR_TRUE : PR_FALSE) != SECSuccess)
1756 goto error;
1757 #endif
1758
1759 #if NSSVERNUM >= 0x030f04 /* 3.15.4 */
1760 if(data->set.ssl.falsestart) {
1761 if(SSL_OptionSet(connssl->handle, SSL_ENABLE_FALSE_START, PR_TRUE)
1762 != SECSuccess)
1763 goto error;
1764
1765 if(SSL_SetCanFalseStartCallback(connssl->handle, CanFalseStartCallback,
1766 conn) != SECSuccess)
1767 goto error;
1768 }
1769 #endif
1770
1771 #if defined(SSL_ENABLE_NPN) || defined(SSL_ENABLE_ALPN)
1772 if(data->set.ssl_enable_npn || data->set.ssl_enable_alpn) {
1773 int cur = 0;
1774 unsigned char protocols[128];
1775
1776 #ifdef USE_NGHTTP2
1777 if(data->set.httpversion == CURL_HTTP_VERSION_2_0) {
1778 protocols[cur++] = NGHTTP2_PROTO_VERSION_ID_LEN;
1779 memcpy(&protocols[cur], NGHTTP2_PROTO_VERSION_ID,
1780 NGHTTP2_PROTO_VERSION_ID_LEN);
1781 cur += NGHTTP2_PROTO_VERSION_ID_LEN;
1782 }
1783 #endif
1784 protocols[cur++] = ALPN_HTTP_1_1_LENGTH;
1785 memcpy(&protocols[cur], ALPN_HTTP_1_1, ALPN_HTTP_1_1_LENGTH);
1786 cur += ALPN_HTTP_1_1_LENGTH;
1787
1788 if(SSL_SetNextProtoNego(connssl->handle, protocols, cur) != SECSuccess)
1789 goto error;
1790 }
1791 #endif
1792
1793
1794 /* Force handshake on next I/O */
1795 SSL_ResetHandshake(connssl->handle, /* asServer */ PR_FALSE);
1796
1797 SSL_SetURL(connssl->handle, conn->host.name);
1798
1799 return CURLE_OK;
1800
1801 error:
1802 if(model)
1803 PR_Close(model);
1804
1805 return nss_fail_connect(connssl, data, result);
1806 }
1807
nss_do_connect(struct connectdata * conn,int sockindex)1808 static CURLcode nss_do_connect(struct connectdata *conn, int sockindex)
1809 {
1810 struct ssl_connect_data *connssl = &conn->ssl[sockindex];
1811 struct SessionHandle *data = conn->data;
1812 CURLcode result = CURLE_SSL_CONNECT_ERROR;
1813 PRUint32 timeout;
1814
1815 /* check timeout situation */
1816 const long time_left = Curl_timeleft(data, NULL, TRUE);
1817 if(time_left < 0L) {
1818 failf(data, "timed out before SSL handshake");
1819 result = CURLE_OPERATION_TIMEDOUT;
1820 goto error;
1821 }
1822
1823 /* Force the handshake now */
1824 timeout = PR_MillisecondsToInterval((PRUint32) time_left);
1825 if(SSL_ForceHandshakeWithTimeout(connssl->handle, timeout) != SECSuccess) {
1826 if(PR_GetError() == PR_WOULD_BLOCK_ERROR)
1827 /* blocking direction is updated by nss_update_connecting_state() */
1828 return CURLE_AGAIN;
1829 else if(conn->data->set.ssl.certverifyresult == SSL_ERROR_BAD_CERT_DOMAIN)
1830 result = CURLE_PEER_FAILED_VERIFICATION;
1831 else if(conn->data->set.ssl.certverifyresult!=0)
1832 result = CURLE_SSL_CACERT;
1833 goto error;
1834 }
1835
1836 result = display_conn_info(conn, connssl->handle);
1837 if(result)
1838 goto error;
1839
1840 if(data->set.str[STRING_SSL_ISSUERCERT]) {
1841 SECStatus ret = SECFailure;
1842 char *nickname = dup_nickname(data, STRING_SSL_ISSUERCERT);
1843 if(nickname) {
1844 /* we support only nicknames in case of STRING_SSL_ISSUERCERT for now */
1845 ret = check_issuer_cert(connssl->handle, nickname);
1846 free(nickname);
1847 }
1848
1849 if(SECFailure == ret) {
1850 infof(data, "SSL certificate issuer check failed\n");
1851 result = CURLE_SSL_ISSUER_ERROR;
1852 goto error;
1853 }
1854 else {
1855 infof(data, "SSL certificate issuer check ok\n");
1856 }
1857 }
1858
1859 result = cmp_peer_pubkey(connssl, data->set.str[STRING_SSL_PINNEDPUBLICKEY]);
1860 if(result)
1861 /* status already printed */
1862 goto error;
1863
1864 return CURLE_OK;
1865
1866 error:
1867 return nss_fail_connect(connssl, data, result);
1868 }
1869
nss_connect_common(struct connectdata * conn,int sockindex,bool * done)1870 static CURLcode nss_connect_common(struct connectdata *conn, int sockindex,
1871 bool *done)
1872 {
1873 struct ssl_connect_data *connssl = &conn->ssl[sockindex];
1874 struct SessionHandle *data = conn->data;
1875 const bool blocking = (done == NULL);
1876 CURLcode result;
1877
1878 if(connssl->state == ssl_connection_complete)
1879 return CURLE_OK;
1880
1881 if(connssl->connecting_state == ssl_connect_1) {
1882 result = nss_setup_connect(conn, sockindex);
1883 if(result)
1884 /* we do not expect CURLE_AGAIN from nss_setup_connect() */
1885 return result;
1886
1887 if(!blocking) {
1888 /* in non-blocking mode, set NSS non-blocking mode before handshake */
1889 result = nss_set_nonblock(connssl, data);
1890 if(result)
1891 return result;
1892 }
1893
1894 connssl->connecting_state = ssl_connect_2;
1895 }
1896
1897 result = nss_do_connect(conn, sockindex);
1898 switch(result) {
1899 case CURLE_OK:
1900 break;
1901 case CURLE_AGAIN:
1902 if(!blocking)
1903 /* CURLE_AGAIN in non-blocking mode is not an error */
1904 return CURLE_OK;
1905 /* fall through */
1906 default:
1907 return result;
1908 }
1909
1910 if(blocking) {
1911 /* in blocking mode, set NSS non-blocking mode _after_ SSL handshake */
1912 result = nss_set_nonblock(connssl, data);
1913 if(result)
1914 return result;
1915 }
1916 else
1917 /* signal completed SSL handshake */
1918 *done = TRUE;
1919
1920 connssl->state = ssl_connection_complete;
1921 conn->recv[sockindex] = nss_recv;
1922 conn->send[sockindex] = nss_send;
1923
1924 /* ssl_connect_done is never used outside, go back to the initial state */
1925 connssl->connecting_state = ssl_connect_1;
1926
1927 return CURLE_OK;
1928 }
1929
Curl_nss_connect(struct connectdata * conn,int sockindex)1930 CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex)
1931 {
1932 return nss_connect_common(conn, sockindex, /* blocking */ NULL);
1933 }
1934
Curl_nss_connect_nonblocking(struct connectdata * conn,int sockindex,bool * done)1935 CURLcode Curl_nss_connect_nonblocking(struct connectdata *conn,
1936 int sockindex, bool *done)
1937 {
1938 return nss_connect_common(conn, sockindex, done);
1939 }
1940
nss_send(struct connectdata * conn,int sockindex,const void * mem,size_t len,CURLcode * curlcode)1941 static ssize_t nss_send(struct connectdata *conn, /* connection data */
1942 int sockindex, /* socketindex */
1943 const void *mem, /* send this data */
1944 size_t len, /* amount to write */
1945 CURLcode *curlcode)
1946 {
1947 ssize_t rc = PR_Send(conn->ssl[sockindex].handle, mem, (int)len, 0,
1948 PR_INTERVAL_NO_WAIT);
1949 if(rc < 0) {
1950 PRInt32 err = PR_GetError();
1951 if(err == PR_WOULD_BLOCK_ERROR)
1952 *curlcode = CURLE_AGAIN;
1953 else {
1954 /* print the error number and error string */
1955 const char *err_name = nss_error_to_name(err);
1956 infof(conn->data, "SSL write: error %d (%s)\n", err, err_name);
1957
1958 /* print a human-readable message describing the error if available */
1959 nss_print_error_message(conn->data, err);
1960
1961 *curlcode = (is_cc_error(err))
1962 ? CURLE_SSL_CERTPROBLEM
1963 : CURLE_SEND_ERROR;
1964 }
1965
1966 return -1;
1967 }
1968
1969 return rc; /* number of bytes */
1970 }
1971
nss_recv(struct connectdata * conn,int num,char * buf,size_t buffersize,CURLcode * curlcode)1972 static ssize_t nss_recv(struct connectdata * conn, /* connection data */
1973 int num, /* socketindex */
1974 char *buf, /* store read data here */
1975 size_t buffersize, /* max amount to read */
1976 CURLcode *curlcode)
1977 {
1978 ssize_t nread = PR_Recv(conn->ssl[num].handle, buf, (int)buffersize, 0,
1979 PR_INTERVAL_NO_WAIT);
1980 if(nread < 0) {
1981 /* failed SSL read */
1982 PRInt32 err = PR_GetError();
1983
1984 if(err == PR_WOULD_BLOCK_ERROR)
1985 *curlcode = CURLE_AGAIN;
1986 else {
1987 /* print the error number and error string */
1988 const char *err_name = nss_error_to_name(err);
1989 infof(conn->data, "SSL read: errno %d (%s)\n", err, err_name);
1990
1991 /* print a human-readable message describing the error if available */
1992 nss_print_error_message(conn->data, err);
1993
1994 *curlcode = (is_cc_error(err))
1995 ? CURLE_SSL_CERTPROBLEM
1996 : CURLE_RECV_ERROR;
1997 }
1998
1999 return -1;
2000 }
2001
2002 return nread;
2003 }
2004
Curl_nss_version(char * buffer,size_t size)2005 size_t Curl_nss_version(char *buffer, size_t size)
2006 {
2007 return snprintf(buffer, size, "NSS/%s", NSS_VERSION);
2008 }
2009
2010 /* data might be NULL */
Curl_nss_seed(struct SessionHandle * data)2011 int Curl_nss_seed(struct SessionHandle *data)
2012 {
2013 /* make sure that NSS is initialized */
2014 return !!Curl_nss_force_init(data);
2015 }
2016
2017 /* data might be NULL */
Curl_nss_random(struct SessionHandle * data,unsigned char * entropy,size_t length)2018 int Curl_nss_random(struct SessionHandle *data,
2019 unsigned char *entropy,
2020 size_t length)
2021 {
2022 Curl_nss_seed(data); /* Initiate the seed if not already done */
2023
2024 if(SECSuccess != PK11_GenerateRandom(entropy, curlx_uztosi(length)))
2025 /* signal a failure */
2026 return -1;
2027
2028 return 0;
2029 }
2030
Curl_nss_md5sum(unsigned char * tmp,size_t tmplen,unsigned char * md5sum,size_t md5len)2031 void Curl_nss_md5sum(unsigned char *tmp, /* input */
2032 size_t tmplen,
2033 unsigned char *md5sum, /* output */
2034 size_t md5len)
2035 {
2036 PK11Context *MD5pw = PK11_CreateDigestContext(SEC_OID_MD5);
2037 unsigned int MD5out;
2038
2039 PK11_DigestOp(MD5pw, tmp, curlx_uztoui(tmplen));
2040 PK11_DigestFinal(MD5pw, md5sum, &MD5out, curlx_uztoui(md5len));
2041 PK11_DestroyContext(MD5pw, PR_TRUE);
2042 }
2043
Curl_nss_cert_status_request(void)2044 bool Curl_nss_cert_status_request(void)
2045 {
2046 #ifdef SSL_ENABLE_OCSP_STAPLING
2047 return TRUE;
2048 #else
2049 return FALSE;
2050 #endif
2051 }
2052
Curl_nss_false_start(void)2053 bool Curl_nss_false_start(void) {
2054 #if NSSVERNUM >= 0x030f04 /* 3.15.4 */
2055 return TRUE;
2056 #else
2057 return FALSE;
2058 #endif
2059 }
2060
2061 #endif /* USE_NSS */
2062