mbedtls: add support for CURLOPT_SSL_CTX_FUNCTION (a360906d) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP curl

docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.3

+12 −9

Original line number	Original line	Diff line number	Diff line
	@@ -22,7 +22,7 @@
	.\"		.\"
	.TH CURLOPT_SSL_CTX_FUNCTION 3 "19 Jun 2014" "libcurl 7.37.0" "curl_easy_setopt options"		.TH CURLOPT_SSL_CTX_FUNCTION 3 "19 Jun 2014" "libcurl 7.37.0" "curl_easy_setopt options"
	.SH NAME		.SH NAME
	CURLOPT_SSL_CTX_FUNCTION \- SSL context callback for OpenSSL or wolfSSL/CyaSSL		CURLOPT_SSL_CTX_FUNCTION \- SSL context callback for OpenSSL, wolfSSL/CyaSSL or mbedTLS
	.SH SYNOPSIS		.SH SYNOPSIS
	.nf		.nf
	#include <curl/curl.h>		#include <curl/curl.h>
	@@ -32,8 +32,9 @@ CURLcode ssl_ctx_callback(CURL curl, void ssl_ctx, void *userptr);
	CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_CTX_FUNCTION,		CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_CTX_FUNCTION,
	ssl_ctx_callback);		ssl_ctx_callback);
	.SH DESCRIPTION		.SH DESCRIPTION
	This option only works for libcurl powered by OpenSSL or wolfSSL/CyaSSL. If		This option only works for libcurl powered by OpenSSL, wolfSSL/CyaSSL or
	libcurl was built against another SSL library this functionality is absent.		mbedTLS. If libcurl was built against another SSL library this functionality is
			absent.

	Pass a pointer to your callback function, which should match the prototype		Pass a pointer to your callback function, which should match the prototype
	shown above.		shown above.
	@@ -42,13 +43,15 @@ This callback function gets called by libcurl just before the initialization
	of an SSL connection after having processed all other SSL related options to		of an SSL connection after having processed all other SSL related options to
	give a last chance to an application to modify the behaviour of the SSL		give a last chance to an application to modify the behaviour of the SSL
	initialization. The \fIssl_ctx\fP parameter is actually a pointer to the SSL		initialization. The \fIssl_ctx\fP parameter is actually a pointer to the SSL
	library's \fISSL_CTX\fP. If an error is returned from the callback no attempt		library's \fISSL_CTX\fP for OpenSSL or wolfSSL/CyaSSL, and a pointer to
	to establish a connection is made and the perform operation will return the		\fImbedtls_ssl_config\fP for mbedTLS. If an error is returned from the callback
	callback's error code. Set the \fIuserptr\fP argument with the		no attempt to establish a connection is made and the perform operation will
			return the callback's error code. Set the \fIuserptr\fP argument with the
	\fICURLOPT_SSL_CTX_DATA(3)\fP option.		\fICURLOPT_SSL_CTX_DATA(3)\fP option.

	This function will get called on all new connections made to a server, during		This function will get called on all new connections made to a server, during
	the SSL negotiation. The SSL_CTX pointer will be a new one every time.		the SSL negotiation. The \fIssl_ctx\fP will point to a newly initialized object
			each time, but note the pointer may be the same as from a prior call.

	To use this properly, a non-trivial amount of knowledge of your SSL library is		To use this properly, a non-trivial amount of knowledge of your SSL library is
	necessary. For example, you can use this function to call library-specific		necessary. For example, you can use this function to call library-specific
	@@ -133,8 +136,8 @@ int main(void)
	}		}
	.fi		.fi
	.SH AVAILABILITY		.SH AVAILABILITY
	Added in 7.11.0 for OpenSSL. Added in 7.42.0 for wolfSSL/CyaSSL. Other SSL		Added in 7.11.0 for OpenSSL. Added in 7.42.0 for wolfSSL/CyaSSL. Added in
	backends not supported.		7.54.0 for mbedTLS. Other SSL backends not supported.
	.SH RETURN VALUE		.SH RETURN VALUE
	CURLE_OK if supported; or an error such as:		CURLE_OK if supported; or an error such as:

lib/vtls/mbedtls.c

+10 −0

Original line number	Original line	Diff line number	Diff line
	@@ -495,6 +495,16 @@ mbed_connect_step1(struct connectdata *conn,
	mbedtls_debug_set_threshold(4);		mbedtls_debug_set_threshold(4);
	#endif		#endif

			/* give application a chance to interfere with mbedTLS set up. */
			if(data->set.ssl.fsslctx) {
			ret = (*data->set.ssl.fsslctx)(data, &connssl->config,
			data->set.ssl.fsslctxp);
			if(ret) {
			failf(data, "error signaled by ssl ctx callback");
			return ret;
			}
			}

	connssl->connecting_state = ssl_connect_2;		connssl->connecting_state = ssl_connect_2;

	return CURLE_OK;		return CURLE_OK;

lib/vtls/mbedtls.h

+3 −0

Original line number	Original line	Diff line number	Diff line
	@@ -56,6 +56,9 @@ CURLcode Curl_mbedtls_random(struct Curl_easy data, unsigned char entropy,
	/* this backends supports CURLOPT_PINNEDPUBLICKEY */		/* this backends supports CURLOPT_PINNEDPUBLICKEY */
	#define have_curlssl_pinnedpubkey 1		#define have_curlssl_pinnedpubkey 1

			/* this backend supports CURLOPT_SSL_CTX_* */
			#define have_curlssl_ssl_ctx 1

	/* API setup for mbedTLS */		/* API setup for mbedTLS */
	#define curlssl_init() Curl_mbedtls_init()		#define curlssl_init() Curl_mbedtls_init()
	#define curlssl_cleanup() Curl_mbedtls_cleanup()		#define curlssl_cleanup() Curl_mbedtls_cleanup()

Admin message