Unverified Commit 76a9c3c4 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

Secure Transport: no more "darwinssl" 

Everyone calls it Secure Transport, now we do too.

Reviewed-by: Nick Zitzmann

Closes #3619
parent 267fae33

configure.ac

+23 −18
Original line number Diff line number Diff line
@@ -155,7 +155,7 @@ AC_SUBST(PKGADD_VENDOR) 


dnl

dnl initialize all the info variables

    curl_ssl_msg="no      (--with-{ssl,gnutls,nss,polarssl,mbedtls,cyassl,winssl,darwinssl,mesalink} )"

    curl_ssl_msg="no      (--with-{ssl,gnutls,nss,polarssl,mbedtls,cyassl,schannel,secure-transport,mesalink} )"

    curl_ssh_msg="no      (--with-libssh2)"

   curl_zlib_msg="no      (--with-zlib)"

 curl_brotli_msg="no      (--with-brotli)"
@@ -1509,22 +1509,27 @@ else 
  AC_MSG_RESULT(no)

fi



OPT_DARWINSSL=no

OPT_SECURETRANSPORT=no

AC_ARG_WITH(darwinssl,dnl

AC_HELP_STRING([--with-darwinssl],[enable Apple OS native SSL/TLS])

AC_HELP_STRING([--without-darwinssl], [disable Apple OS native SSL/TLS]),

  OPT_DARWINSSL=$withval)

  OPT_SECURETRANSPORT=$withval)



AC_MSG_CHECKING([whether to enable Apple OS native SSL/TLS])

if test -z "$ssl_backends" -o "x$OPT_DARWINSSL" != xno; then

  if test "x$OPT_DARWINSSL" != "xno" &&

AC_ARG_WITH(secure-transport,dnl

AC_HELP_STRING([--with-secure-transport],[enable Apple OS native SSL/TLS])

AC_HELP_STRING([--without-secure-transport], [disable Apple OS native SSL/TLS]),

  OPT_SECURETRANSPORT=$withval)



AC_MSG_CHECKING([whether to enable Secure Transport])

if test -z "$ssl_backends" -o "x$OPT_SECURETRANSPORT" != xno; then

  if test "x$OPT_SECURETRANSPORT" != "xno" &&

     test -d "/System/Library/Frameworks/Security.framework"; then

    AC_MSG_RESULT(yes)

    AC_DEFINE(USE_DARWINSSL, 1, [to enable Apple OS native SSL/TLS support])

    AC_SUBST(USE_DARWINSSL, [1])

    ssl_msg="Apple OS-native"

    test darwinssl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes

    DARWINSSL_ENABLED=1

    AC_DEFINE(USE_SECTRANSP, 1, [enable Secure Transport])

    AC_SUBST(USE_SECTRANSP, [1])

    ssl_msg="Secure Transport"

    test secure-transport != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes

    SECURETRANSPORT_ENABLED=1

    LDFLAGS="$LDFLAGS -framework CoreFoundation -framework Security"

  else

    AC_MSG_RESULT(no)
@@ -2633,10 +2638,10 @@ if test -z "$ssl_backends" -o "x$OPT_NSS" != xno; then 
  test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"

fi



case "x$OPENSSL_ENABLED$GNUTLS_ENABLED$NSS_ENABLED$POLARSSL_ENABLED$MBEDTLS_ENABLED$CYASSL_ENABLED$WINSSL_ENABLED$DARWINSSL_ENABLED$MESALINK_ENABLED" in

case "x$OPENSSL_ENABLED$GNUTLS_ENABLED$NSS_ENABLED$POLARSSL_ENABLED$MBEDTLS_ENABLED$CYASSL_ENABLED$WINSSL_ENABLED$SECURETRANSPORT_ENABLED$MESALINK_ENABLED" in

x)

  AC_MSG_WARN([SSL disabled, you will not be able to use HTTPS, FTPS, NTLM and more.])

  AC_MSG_WARN([Use --with-ssl, --with-gnutls, --with-polarssl, --with-cyassl, --with-nss, --with-winssl, --with-darwinssl, or --with-mesalink to address this.])

  AC_MSG_WARN([Use --with-ssl, --with-gnutls, --with-polarssl, --with-cyassl, --with-nss, --with-schannel, --with-secure-transport, or --with-mesalink to address this.])

  ;;

x1)

  # one SSL backend is enabled
@@ -3065,9 +3070,9 @@ AC_HELP_STRING([--disable-versioned-symbols], [Disable versioned symbols in shar 
        elif test "x$CYASSL_ENABLED" = "x1"; then

          versioned_symbols_flavour="CYASSL_"

        elif test "x$WINSSL_ENABLED" = "x1"; then

          versioned_symbols_flavour="WINSSL_"

        elif test "x$DARWINSSL_ENABLED" = "x1"; then

          versioned_symbols_flavour="DARWINSSL_"

          versioned_symbols_flavour="SCHANNEL_"

        elif test "x$SECURETRANSPORT_ENABLED" = "x1"; then

          versioned_symbols_flavour="SECURE_TRANSPORT_"

        else

          versioned_symbols_flavour=""

        fi
@@ -4118,7 +4123,7 @@ fi 
if test "x$CURL_DISABLE_CRYPTO_AUTH" != "x1"; then

  if test "x$OPENSSL_ENABLED" = "x1" -o "x$USE_WINDOWS_SSPI" = "x1" \

      -o "x$GNUTLS_ENABLED" = "x1" -o "x$MBEDTLS_ENABLED" = "x1" \

      -o "x$NSS_ENABLED" = "x1" -o "x$DARWINSSL_ENABLED" = "x1"; then

      -o "x$NSS_ENABLED" = "x1" -o "x$SECURETRANSPORT_ENABLED" = "x1"; then

    SUPPORT_FEATURES="$SUPPORT_FEATURES NTLM"



    if test "x$CURL_DISABLE_HTTP" != "x1" -a \
@@ -4200,7 +4205,7 @@ if test "x$CURL_DISABLE_SMB" != "x1" \ 
    -a "x$CURL_DISABLE_CRYPTO_AUTH" != "x1" \

    -a \( "x$OPENSSL_ENABLED" = "x1" -o "x$USE_WINDOWS_SSPI" = "x1" \

      -o "x$GNUTLS_ENABLED" = "x1" -o "x$MBEDTLS_ENABLED" = "x1" \

      -o "x$NSS_ENABLED" = "x1" -o "x$DARWINSSL_ENABLED" = "x1" \); then

      -o "x$NSS_ENABLED" = "x1" -o "x$SECURETRANSPORT_ENABLED" = "x1" \); then

  SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS SMB"

  if test "x$SSL_ENABLED" = "x1"; then

    SUPPORT_PROTOCOLS="$SUPPORT_PROTOCOLS SMBS"

docs/libcurl/symbols-in-versions

+2 −1
Original line number Diff line number Diff line
@@ -707,7 +707,7 @@ CURLSSH_AUTH_PUBLICKEY 7.16.1 
CURLSSLBACKEND_AXTLS            7.38.0       7.61.0

CURLSSLBACKEND_BORINGSSL        7.49.0

CURLSSLBACKEND_CYASSL           7.34.0

CURLSSLBACKEND_DARWINSSL        7.34.0

CURLSSLBACKEND_DARWINSSL        7.34.0       7.64.1

CURLSSLBACKEND_GNUTLS           7.34.0

CURLSSLBACKEND_GSKIT            7.34.0

CURLSSLBACKEND_LIBRESSL         7.49.0
@@ -719,6 +719,7 @@ CURLSSLBACKEND_OPENSSL 7.34.0 
CURLSSLBACKEND_POLARSSL         7.34.0

CURLSSLBACKEND_QSOSSL           7.34.0        -           7.38.1

CURLSSLBACKEND_SCHANNEL         7.34.0

CURLSSLBACKEND_SECURETRANSPORT  7.64.1

CURLSSLBACKEND_WOLFSSL          7.49.0

CURLSSLOPT_ALLOW_BEAST          7.25.0

CURLSSLOPT_NO_REVOKE            7.44.0

include/curl/curl.h

+5 −2
Original line number Diff line number Diff line
@@ -7,7 +7,7 @@ 
 *                            | (__| |_| |  _ <| |___

 *                             \___|\___/|_| \_\_____|

 *

 * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.

 * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.

 *

 * This software is licensed as described in the file COPYING, which

 * you should have received as part of this distribution. The terms
@@ -151,7 +151,7 @@ typedef enum { 
  CURLSSLBACKEND_POLARSSL = 6,

  CURLSSLBACKEND_WOLFSSL = 7,

  CURLSSLBACKEND_SCHANNEL = 8,

  CURLSSLBACKEND_DARWINSSL = 9,

  CURLSSLBACKEND_SECURETRANSPORT = 9,

  CURLSSLBACKEND_AXTLS = 10, /* never used since 7.63.0 */

  CURLSSLBACKEND_MBEDTLS = 11,

  CURLSSLBACKEND_MESALINK = 12
@@ -160,7 +160,10 @@ typedef enum { 
/* aliases for library clones and renames */

#define CURLSSLBACKEND_LIBRESSL CURLSSLBACKEND_OPENSSL

#define CURLSSLBACKEND_BORINGSSL CURLSSLBACKEND_OPENSSL



/* deprecated names: */

#define CURLSSLBACKEND_CYASSL CURLSSLBACKEND_WOLFSSL

#define CURLSSLBACKEND_DARWINSSL CURLSSLBACKEND_SECURETRANSPORT



struct curl_httppost {

  struct curl_httppost *next;       /* next entry in the list */

lib/Makefile.inc

+3 −3
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ 
#                            | (__| |_| |  _ <| |___

#                             \___|\___/|_| \_\_____|

#

# Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.

# Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.

#

# This software is licensed as described in the file COPYING, which

# you should have received as part of this distribution. The terms
@@ -30,11 +30,11 @@ LIB_VAUTH_HFILES = vauth/vauth.h vauth/digest.h vauth/ntlm.h 
LIB_VTLS_CFILES = vtls/openssl.c vtls/gtls.c vtls/vtls.c vtls/nss.c     \

  vtls/polarssl.c vtls/polarssl_threadlock.c                            \

  vtls/cyassl.c vtls/schannel.c vtls/schannel_verify.c                  \

  vtls/darwinssl.c vtls/gskit.c vtls/mbedtls.c vtls/mesalink.c

  vtls/sectransp.c vtls/gskit.c vtls/mbedtls.c vtls/mesalink.c



LIB_VTLS_HFILES = vtls/openssl.h vtls/vtls.h vtls/gtls.h                \

  vtls/nssg.h vtls/polarssl.h vtls/polarssl_threadlock.h                \

  vtls/cyassl.h vtls/schannel.h vtls/darwinssl.h vtls/gskit.h           \

  vtls/cyassl.h vtls/schannel.h vtls/sectransp.h vtls/gskit.h           \

  vtls/mbedtls.h vtls/mesalink.h



LIB_CFILES = file.c timeval.c base64.c hostip.c progress.c formdata.c   \

lib/curl_ntlm_core.c

+6 −6
Original line number Diff line number Diff line
@@ -38,7 +38,7 @@ 
   3. USE_GNUTLS

   4. USE_NSS

   5. USE_MBEDTLS

   6. USE_DARWINSSL

   6. USE_SECTRANSP

   7. USE_OS400CRYPTO

   8. USE_WIN32_CRYPTO
@@ -101,7 +101,7 @@ 
#    include "curl_md4.h"

#  endif



#elif defined(USE_DARWINSSL)

#elif defined(USE_SECTRANSP)



#  include <CommonCrypto/CommonCryptor.h>

#  include <CommonCrypto/CommonDigest.h>
@@ -290,7 +290,7 @@ static bool encrypt_des(const unsigned char *in, unsigned char *out, 
  return mbedtls_des_crypt_ecb(&ctx, in, out) == 0;

}



#elif defined(USE_DARWINSSL)

#elif defined(USE_SECTRANSP)



static bool encrypt_des(const unsigned char *in, unsigned char *out,

                        const unsigned char *key_56)
@@ -437,7 +437,7 @@ void Curl_ntlm_core_lm_resp(const unsigned char *keys, 
  setup_des_key(keys + 14, &des);

  gcry_cipher_encrypt(des, results + 16, 8, plaintext, 8);

  gcry_cipher_close(des);

#elif defined(USE_NSS) || defined(USE_MBEDTLS) || defined(USE_DARWINSSL) \

#elif defined(USE_NSS) || defined(USE_MBEDTLS) || defined(USE_SECTRANSP) \

  || defined(USE_OS400CRYPTO) || defined(USE_WIN32_CRYPTO)

  encrypt_des(plaintext, results, keys);

  encrypt_des(plaintext, results + 8, keys + 7);
@@ -501,7 +501,7 @@ CURLcode Curl_ntlm_core_mk_lm_hash(struct Curl_easy *data, 
    setup_des_key(pw + 7, &des);

    gcry_cipher_encrypt(des, lmbuffer + 8, 8, magic, 8);

    gcry_cipher_close(des);

#elif defined(USE_NSS) || defined(USE_MBEDTLS) || defined(USE_DARWINSSL) \

#elif defined(USE_NSS) || defined(USE_MBEDTLS) || defined(USE_SECTRANSP) \

  || defined(USE_OS400CRYPTO) || defined(USE_WIN32_CRYPTO)

    encrypt_des(magic, lmbuffer, pw);

    encrypt_des(magic, lmbuffer + 8, pw + 7);
@@ -591,7 +591,7 @@ CURLcode Curl_ntlm_core_mk_nt_hash(struct Curl_easy *data, 
#else

    Curl_md4it(ntbuffer, pw, 2 * len);

#endif

#elif defined(USE_DARWINSSL)

#elif defined(USE_SECTRANSP)

    (void)CC_MD4(pw, (CC_LONG)(2 * len), ntbuffer);

#elif defined(USE_OS400CRYPTO)

    Curl_md4it(ntbuffer, pw, 2 * len);