Skip to content

Commit

Permalink
gnutls: remove the BACKEND define kludge
Browse files Browse the repository at this point in the history
  • Loading branch information
@bagder
bagder committed Mar 19, 2020
1 parent aec0b49 commit 89865c1
Showing 1 changed file with 50 additions and 43 deletions.
93 changes: 50 additions & 43 deletions lib/vtls/gtls.c
View file
Expand Up @@ -111,8 +111,6 @@ struct ssl_backend_data {
#endif
};

#define BACKEND connssl->backend

/*
* Custom push and pull callback functions used by GNU TLS to read and write
* to the socket. These functions are simple wrappers to send() and recv()
Expand Down Expand Up @@ -284,7 +282,8 @@ static CURLcode handshake(struct connectdata *conn,
{
struct Curl_easy *data = conn->data;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
gnutls_session_t session = BACKEND->session;
struct ssl_backend_data *backend = connssl->backend;
gnutls_session_t session = backend->session;
curl_socket_t sockfd = conn->sock[sockindex];

for(;;) {
Expand Down Expand Up @@ -523,6 +522,7 @@ gtls_connect_step1(struct connectdata *conn,
{
struct Curl_easy *data = conn->data;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
struct ssl_backend_data *backend = connssl->backend;
unsigned int init_flags;
gnutls_session_t session;
int rc;
Expand Down Expand Up @@ -574,7 +574,7 @@ gtls_connect_step1(struct connectdata *conn,
sni = FALSE; /* SSLv3 has no SNI */

/* allocate a cred struct */
rc = gnutls_certificate_allocate_credentials(&BACKEND->cred);
rc = gnutls_certificate_allocate_credentials(&backend->cred);
if(rc != GNUTLS_E_SUCCESS) {
failf(data, "gnutls_cert_all_cred() failed: %s", gnutls_strerror(rc));
return CURLE_SSL_CONNECT_ERROR;
Expand All @@ -585,14 +585,14 @@ gtls_connect_step1(struct connectdata *conn,
infof(data, "Using TLS-SRP username: %s\n", SSL_SET_OPTION(username));

rc = gnutls_srp_allocate_client_credentials(
&BACKEND->srp_client_cred);
&backend->srp_client_cred);
if(rc != GNUTLS_E_SUCCESS) {
failf(data, "gnutls_srp_allocate_client_cred() failed: %s",
gnutls_strerror(rc));
return CURLE_OUT_OF_MEMORY;
}

rc = gnutls_srp_set_client_credentials(BACKEND->srp_client_cred,
rc = gnutls_srp_set_client_credentials(backend->srp_client_cred,
SSL_SET_OPTION(username),
SSL_SET_OPTION(password));
if(rc != GNUTLS_E_SUCCESS) {
Expand All @@ -605,10 +605,10 @@ gtls_connect_step1(struct connectdata *conn,

if(SSL_CONN_CONFIG(CAfile)) {
/* set the trusted CA cert bundle file */
gnutls_certificate_set_verify_flags(BACKEND->cred,
gnutls_certificate_set_verify_flags(backend->cred,
GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT);

rc = gnutls_certificate_set_x509_trust_file(BACKEND->cred,
rc = gnutls_certificate_set_x509_trust_file(backend->cred,
SSL_CONN_CONFIG(CAfile),
GNUTLS_X509_FMT_PEM);
if(rc < 0) {
Expand All @@ -625,7 +625,7 @@ gtls_connect_step1(struct connectdata *conn,
#ifdef HAS_CAPATH
if(SSL_CONN_CONFIG(CApath)) {
/* set the trusted CA cert directory */
rc = gnutls_certificate_set_x509_trust_dir(BACKEND->cred,
rc = gnutls_certificate_set_x509_trust_dir(backend->cred,
SSL_CONN_CONFIG(CApath),
GNUTLS_X509_FMT_PEM);
if(rc < 0) {
Expand All @@ -644,13 +644,13 @@ gtls_connect_step1(struct connectdata *conn,
/* use system ca certificate store as fallback */
if(SSL_CONN_CONFIG(verifypeer) &&
!(SSL_CONN_CONFIG(CAfile) || SSL_CONN_CONFIG(CApath))) {
gnutls_certificate_set_x509_system_trust(BACKEND->cred);
gnutls_certificate_set_x509_system_trust(backend->cred);
}
#endif

if(SSL_SET_OPTION(CRLfile)) {
/* set the CRL list file */
rc = gnutls_certificate_set_x509_crl_file(BACKEND->cred,
rc = gnutls_certificate_set_x509_crl_file(backend->cred,
SSL_SET_OPTION(CRLfile),
GNUTLS_X509_FMT_PEM);
if(rc < 0) {
Expand All @@ -675,14 +675,14 @@ gtls_connect_step1(struct connectdata *conn,
init_flags |= GNUTLS_NO_TICKETS;
#endif

rc = gnutls_init(&BACKEND->session, init_flags);
rc = gnutls_init(&backend->session, init_flags);
if(rc != GNUTLS_E_SUCCESS) {
failf(data, "gnutls_init() failed: %d", rc);
return CURLE_SSL_CONNECT_ERROR;
}

/* convenient assign */
session = BACKEND->session;
session = backend->session;

if((0 == Curl_inet_pton(AF_INET, hostname, &addr)) &&
#ifdef ENABLE_IPV6
Expand Down Expand Up @@ -845,7 +845,7 @@ gtls_connect_step1(struct connectdata *conn,
GNUTLS_PKCS_USE_PBES2_AES_128 | GNUTLS_PKCS_USE_PBES2_AES_192 |
GNUTLS_PKCS_USE_PBES2_AES_256;
rc = gnutls_certificate_set_x509_key_file2(
BACKEND->cred,
backend->cred,
SSL_SET_OPTION(cert),
SSL_SET_OPTION(key) ?
SSL_SET_OPTION(key) : SSL_SET_OPTION(cert),
Expand All @@ -865,7 +865,7 @@ gtls_connect_step1(struct connectdata *conn,
}
else {
if(gnutls_certificate_set_x509_key_file(
BACKEND->cred,
backend->cred,
SSL_SET_OPTION(cert),
SSL_SET_OPTION(key) ?
SSL_SET_OPTION(key) : SSL_SET_OPTION(cert),
Expand All @@ -881,7 +881,7 @@ gtls_connect_step1(struct connectdata *conn,
/* put the credentials to the current session */
if(SSL_SET_OPTION(authtype) == CURL_TLSAUTH_SRP) {
rc = gnutls_credentials_set(session, GNUTLS_CRD_SRP,
BACKEND->srp_client_cred);
backend->srp_client_cred);
if(rc != GNUTLS_E_SUCCESS) {
failf(data, "gnutls_credentials_set() failed: %s", gnutls_strerror(rc));
return CURLE_SSL_CONNECT_ERROR;
Expand All @@ -891,7 +891,7 @@ gtls_connect_step1(struct connectdata *conn,
#endif
{
rc = gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE,
BACKEND->cred);
backend->cred);
if(rc != GNUTLS_E_SUCCESS) {
failf(data, "gnutls_credentials_set() failed: %s", gnutls_strerror(rc));
return CURLE_SSL_CONNECT_ERROR;
Expand Down Expand Up @@ -1026,7 +1026,8 @@ gtls_connect_step3(struct connectdata *conn,
const char *ptr;
struct Curl_easy *data = conn->data;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
gnutls_session_t session = BACKEND->session;
struct ssl_backend_data *backend = connssl->backend;
gnutls_session_t session = backend->session;
int rc;
#ifdef HAS_ALPN
gnutls_datum_t proto;
Expand Down Expand Up @@ -1577,13 +1578,14 @@ static bool Curl_gtls_data_pending(const struct connectdata *conn,
{
const struct ssl_connect_data *connssl = &conn->ssl[connindex];
bool res = FALSE;
if(BACKEND->session &&
0 != gnutls_record_check_pending(BACKEND->session))
struct ssl_backend_data *backend = connssl->backend;
if(backend->session &&
0 != gnutls_record_check_pending(backend->session))
res = TRUE;

connssl = &conn->proxy_ssl[connindex];
if(BACKEND->session &&
0 != gnutls_record_check_pending(BACKEND->session))
if(backend->session &&
0 != gnutls_record_check_pending(backend->session))
res = TRUE;

return res;
Expand All @@ -1596,7 +1598,8 @@ static ssize_t gtls_send(struct connectdata *conn,
CURLcode *curlcode)
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
ssize_t rc = gnutls_record_send(BACKEND->session, mem, len);
struct ssl_backend_data *backend = connssl->backend;
ssize_t rc = gnutls_record_send(backend->session, mem, len);

if(rc < 0) {
*curlcode = (rc == GNUTLS_E_AGAIN)
Expand All @@ -1611,19 +1614,20 @@ static ssize_t gtls_send(struct connectdata *conn,

static void close_one(struct ssl_connect_data *connssl)
{
if(BACKEND->session) {
gnutls_bye(BACKEND->session, GNUTLS_SHUT_WR);
gnutls_deinit(BACKEND->session);
BACKEND->session = NULL;
struct ssl_backend_data *backend = connssl->backend;
if(backend->session) {
gnutls_bye(backend->session, GNUTLS_SHUT_WR);
gnutls_deinit(backend->session);
backend->session = NULL;
}
if(BACKEND->cred) {
gnutls_certificate_free_credentials(BACKEND->cred);
BACKEND->cred = NULL;
if(backend->cred) {
gnutls_certificate_free_credentials(backend->cred);
backend->cred = NULL;
}
#ifdef USE_TLS_SRP
if(BACKEND->srp_client_cred) {
gnutls_srp_free_client_credentials(BACKEND->srp_client_cred);
BACKEND->srp_client_cred = NULL;
if(backend->srp_client_cred) {
gnutls_srp_free_client_credentials(backend->srp_client_cred);
backend->srp_client_cred = NULL;
}
#endif
}
Expand All @@ -1641,6 +1645,7 @@ static void Curl_gtls_close(struct connectdata *conn, int sockindex)
static int Curl_gtls_shutdown(struct connectdata *conn, int sockindex)
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
struct ssl_backend_data *backend = connssl->backend;
int retval = 0;
struct Curl_easy *data = conn->data;

Expand All @@ -1651,10 +1656,10 @@ static int Curl_gtls_shutdown(struct connectdata *conn, int sockindex)
we do not send one. Let's hope other servers do the same... */

if(data->set.ftp_ccc == CURLFTPSSL_CCC_ACTIVE)
gnutls_bye(BACKEND->session, GNUTLS_SHUT_WR);
gnutls_bye(backend->session, GNUTLS_SHUT_WR);
#endif

if(BACKEND->session) {
if(backend->session) {
ssize_t result;
bool done = FALSE;
char buf[120];
Expand All @@ -1665,7 +1670,7 @@ static int Curl_gtls_shutdown(struct connectdata *conn, int sockindex)
if(what > 0) {
/* Something to read, let's do it and hope that it is the close
notify alert from the server */
result = gnutls_record_recv(BACKEND->session,
result = gnutls_record_recv(backend->session,
buf, sizeof(buf));
switch(result) {
case 0:
Expand Down Expand Up @@ -1695,18 +1700,18 @@ static int Curl_gtls_shutdown(struct connectdata *conn, int sockindex)
done = TRUE;
}
}
gnutls_deinit(BACKEND->session);
gnutls_deinit(backend->session);
}
gnutls_certificate_free_credentials(BACKEND->cred);
gnutls_certificate_free_credentials(backend->cred);

#ifdef USE_TLS_SRP
if(SSL_SET_OPTION(authtype) == CURL_TLSAUTH_SRP
&& SSL_SET_OPTION(username) != NULL)
gnutls_srp_free_client_credentials(BACKEND->srp_client_cred);
gnutls_srp_free_client_credentials(backend->srp_client_cred);
#endif

BACKEND->cred = NULL;
BACKEND->session = NULL;
backend->cred = NULL;
backend->session = NULL;

return retval;
}
Expand All @@ -1718,9 +1723,10 @@ static ssize_t gtls_recv(struct connectdata *conn, /* connection data */
CURLcode *curlcode)
{
struct ssl_connect_data *connssl = &conn->ssl[num];
struct ssl_backend_data *backend = connssl->backend;
ssize_t ret;

ret = gnutls_record_recv(BACKEND->session, buf, buffersize);
ret = gnutls_record_recv(backend->session, buf, buffersize);
if((ret == GNUTLS_E_AGAIN) || (ret == GNUTLS_E_INTERRUPTED)) {
*curlcode = CURLE_AGAIN;
return -1;
Expand Down Expand Up @@ -1846,8 +1852,9 @@ static bool Curl_gtls_cert_status_request(void)
static void *Curl_gtls_get_internals(struct ssl_connect_data *connssl,
CURLINFO info UNUSED_PARAM)
{
struct ssl_backend_data *backend = connssl->backend;
(void)info;
return BACKEND->session;
return backend->session;
}

const struct Curl_ssl Curl_ssl_gnutls = {
Expand Down

0 comments on commit 89865c1

Please sign in to comment.