luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ECH: update APIs to those agreed with OpenSSL maintainers

Browse Source 
Closes #15945
This commit is contained in:
sftcd 2025-01-08 20:08:15 +00:00 committed by Daniel Stenberg
parent 386f570df6
commit 1ae47b91a3
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
5 changed files with 14 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.mailmap
View File

@ -113,3 +113,4 @@ Moritz Buhl <git@moritzbuhl.de>
Aki Sakurai <75532970+AkiSakurai@users.noreply.github.com> Aki Sakurai <75532970+AkiSakurai@users.noreply.github.com>
Sinkevich Artem <artsin666@gmail.com> Sinkevich Artem <artsin666@gmail.com>
Andrew Kirillov <akirillo@uk.ibm.com> Andrew Kirillov <akirillo@uk.ibm.com>
Stephen Farrell <stephen.farrell@cs.tcd.ie>

5
CMakeLists.txt
View File

@ -961,11 +961,10 @@ if(USE_ECH)
if(HAVE_BORINGSSL OR HAVE_AWSLC) if(HAVE_BORINGSSL OR HAVE_AWSLC)
curl_openssl_check_symbol_exists("SSL_set1_ech_config_list" "openssl/ssl.h" HAVE_SSL_SET1_ECH_CONFIG_LIST) curl_openssl_check_symbol_exists("SSL_set1_ech_config_list" "openssl/ssl.h" HAVE_SSL_SET1_ECH_CONFIG_LIST)
elseif(HAVE_OPENSSL) elseif(HAVE_OPENSSL)
curl_openssl_check_symbol_exists("SSL_ech_set1_echconfig" "openssl/ech.h" HAVE_SSL_ECH_SET1_ECHCONFIG) curl_openssl_check_symbol_exists("SSL_set1_ech_config_list" "openssl/ech.h" HAVE_SSL_SET1_ECH_CONFIG_LIST)
endif() endif()
if(HAVE_WOLFSSL_CTX_GENERATEECHCONFIG OR if(HAVE_WOLFSSL_CTX_GENERATEECHCONFIG OR
HAVE_SSL_SET1_ECH_CONFIG_LIST OR HAVE_SSL_SET1_ECH_CONFIG_LIST)
HAVE_SSL_ECH_SET1_ECHCONFIG)
set(HAVE_ECH 1) set(HAVE_ECH 1)
endif() endif()
if(NOT HAVE_ECH) if(NOT HAVE_ECH)

8
configure.ac
View File

@ -4878,13 +4878,7 @@ if test "x$want_ech" != "xno"; then
ECH_ENABLED=0 ECH_ENABLED=0
ECH_SUPPORT='' ECH_SUPPORT=''
dnl check for OpenSSL dnl check for OpenSSL equivalent
if test "x$OPENSSL_ENABLED" = "x1"; then
AC_CHECK_FUNCS(SSL_ech_set1_echconfig,
ECH_SUPPORT="ECH support available via OpenSSL with SSL_ech_set1_echconfig"
ECH_ENABLED=1)
fi
dnl check for BoringSSL equivalent
if test "x$OPENSSL_ENABLED" = "x1"; then if test "x$OPENSSL_ENABLED" = "x1"; then
AC_CHECK_FUNCS(SSL_set1_ech_config_list, AC_CHECK_FUNCS(SSL_set1_ech_config_list,
ECH_SUPPORT="ECH support available via BoringSSL with SSL_set1_ech_config_list" ECH_SUPPORT="ECH support available via BoringSSL with SSL_set1_ech_config_list"

3
lib/curl_config.h.cmake
View File

@ -850,6 +850,3 @@ ${SIZEOF_TIME_T_CODE}
/* Define to 1 if you have the SSL_set1_ech_config_list function. */ /* Define to 1 if you have the SSL_set1_ech_config_list function. */
#cmakedefine HAVE_SSL_SET1_ECH_CONFIG_LIST #cmakedefine HAVE_SSL_SET1_ECH_CONFIG_LIST
/* Define to 1 if you have the SSL_ech_set1_echconfig function. */
#cmakedefine HAVE_SSL_ECH_SET1_ECHCONFIG

28
lib/vtls/openssl.c
View File

@ -83,8 +83,7 @@
#include <openssl/tls1.h> #include <openssl/tls1.h>
#include <openssl/evp.h> #include <openssl/evp.h>
#if defined(HAVE_SSL_SET1_ECH_CONFIG_LIST) || \ #if defined(HAVE_SSL_SET1_ECH_CONFIG_LIST)
defined(HAVE_SSL_ECH_SET1_ECHCONFIG)
#define USE_ECH_OPENSSL #define USE_ECH_OPENSSL
#endif #endif
@ -4069,7 +4068,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
} }
if(SSL_set1_ech_config_list(octx->ssl, ech_config, if(SSL_set1_ech_config_list(octx->ssl, ech_config,
ech_config_len) != 1) { ech_config_len) != 1) {
infof(data, "ECH: SSL_ECH_set1_echconfig failed"); infof(data, "ECH: SSL_ECH_set1_ech_config_list failed");
if(data->set.tls_ech & CURLECH_HARD) { if(data->set.tls_ech & CURLECH_HARD) {
free(ech_config); free(ech_config);
return CURLE_SSL_CONNECT_ERROR; return CURLE_SSL_CONNECT_ERROR;
@ -4084,8 +4083,9 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
return CURLE_SSL_CONNECT_ERROR; return CURLE_SSL_CONNECT_ERROR;
} }
ech_config_len = strlen(data->set.str[STRING_ECH_CONFIG]); ech_config_len = strlen(data->set.str[STRING_ECH_CONFIG]);
if(SSL_ech_set1_echconfig(octx->ssl, ech_config, ech_config_len) != 1) { if(SSL_set1_ech_config_list(octx->ssl, ech_config,
infof(data, "ECH: SSL_ECH_set1_echconfig failed"); ech_config_len) != 1) {
infof(data, "ECH: SSL_ECH_set1_ech_config_list failed");
if(data->set.tls_ech & CURLECH_HARD) if(data->set.tls_ech & CURLECH_HARD)
return CURLE_SSL_CONNECT_ERROR; return CURLE_SSL_CONNECT_ERROR;
} }
@ -4113,19 +4113,11 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
size_t elen = rinfo->echconfiglist_len; size_t elen = rinfo->echconfiglist_len;
infof(data, "ECH: ECHConfig from DoH HTTPS RR"); infof(data, "ECH: ECHConfig from DoH HTTPS RR");
# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
if(SSL_ech_set1_echconfig(octx->ssl, ecl, elen) != 1) {
infof(data, "ECH: SSL_ECH_set1_echconfig failed");
if(data->set.tls_ech & CURLECH_HARD)
return CURLE_SSL_CONNECT_ERROR;
}
# else
if(SSL_set1_ech_config_list(octx->ssl, ecl, elen) != 1) { if(SSL_set1_ech_config_list(octx->ssl, ecl, elen) != 1) {
infof(data, "ECH: SSL_set1_ech_config_list failed (BoringSSL)"); infof(data, "ECH: SSL_set1_ech_config_list failed");
if(data->set.tls_ech & CURLECH_HARD) if(data->set.tls_ech & CURLECH_HARD)
return CURLE_SSL_CONNECT_ERROR; return CURLE_SSL_CONNECT_ERROR;
} }
# endif
else { else {
trying_ech_now = 1; trying_ech_now = 1;
infof(data, "ECH: imported ECHConfigList of length %zu", elen); infof(data, "ECH: imported ECHConfigList of length %zu", elen);
@ -4148,7 +4140,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
if(trying_ech_now && outername) { if(trying_ech_now && outername) {
infof(data, "ECH: inner: '%s', outer: '%s'", infof(data, "ECH: inner: '%s', outer: '%s'",
peer->hostname ? peer->hostname : "NULL", outername); peer->hostname ? peer->hostname : "NULL", outername);
result = SSL_ech_set_server_names(octx->ssl, result = SSL_ech_set1_server_names(octx->ssl,
peer->hostname, outername, peer->hostname, outername,
0 /* do send outer */); 0 /* do send outer */);
if(result != 1) { if(result != 1) {
@ -4287,7 +4279,7 @@ static void ossl_trace_ech_retry_configs(struct Curl_easy *data, SSL* ssl,
if(!ECH_ENABLED(data)) if(!ECH_ENABLED(data))
return; return;
# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) # if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
rv = SSL_ech_get_retry_config(ssl, &rcs, &rcl); rv = SSL_ech_get1_retry_config(ssl, &rcs, &rcl);
# else # else
SSL_get0_ech_retry_configs(ssl, &rcs, &rcl); SSL_get0_ech_retry_configs(ssl, &rcs, &rcl);
rv = (int)rcl; rv = (int)rcl;
@ -4302,7 +4294,7 @@ static void ossl_trace_ech_retry_configs(struct Curl_easy *data, SSL* ssl,
infof(data, "ECH: retry_configs %s", b64str); infof(data, "ECH: retry_configs %s", b64str);
free(b64str); free(b64str);
#if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) #if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
rv = SSL_ech_get_status(ssl, &inner, &outer); rv = SSL_ech_get1_status(ssl, &inner, &outer);
infof(data, "ECH: retry_configs for %s from %s, %d %d", infof(data, "ECH: retry_configs for %s from %s, %d %d",
inner ? inner : "NULL", outer ? outer : "NULL", reason, rv); inner ? inner : "NULL", outer ? outer : "NULL", reason, rv);
#else #else
@ -4510,7 +4502,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
const char *status = NULL; const char *status = NULL;
int rv; int rv;
rv = SSL_ech_get_status(octx->ssl, &inner, &outer); rv = SSL_ech_get1_status(octx->ssl, &inner, &outer);
switch(rv) { switch(rv) {
case SSL_ECH_STATUS_SUCCESS: case SSL_ECH_STATUS_SUCCESS:
status = "succeeded"; status = "succeeded";