mbedtls: support CURLOPT_CERTINFO

Closes #13113

diff --git a/docs/libcurl/opts/CURLINFO_CERTINFO.md b/docs/libcurl/opts/CURLINFO_CERTINFO.md
index 633beed17bee3cd6749b235de7a62d31688c3d6c..203e39ccddd6b86d041481b60f969b9884e24720 100644 (file)
--- a/docs/libcurl/opts/CURLINFO_CERTINFO.md
+++ b/docs/libcurl/opts/CURLINFO_CERTINFO.md
@@ -93,9 +93,10 @@ See also the *certinfo.c* example.
 
 # AVAILABILITY
 
-This option is only working in libcurl built with OpenSSL, GnuTLS, Schannel or
-Secure Transport. GnuTLS support added in 7.42.0. Schannel support added in
-7.50.0. Secure Transport support added in 7.79.0.
+This option is only working in libcurl built with OpenSSL, GnuTLS, Schannel,
+Secure Transport or mbedTLS. GnuTLS support added in 7.42.0. Schannel support
+added in 7.50.0. Secure Transport support added in 7.79.0. mbedTLS support added
+in 8.9.0.
 
 Added in 7.19.1
 

diff --git a/docs/libcurl/opts/CURLOPT_CERTINFO.md b/docs/libcurl/opts/CURLOPT_CERTINFO.md
index 71339cd0322dbb58660dbdb85fe76af8a7d3aa9a..5aaa219b90b2d725915250877f0300aadb5f61ae 100644 (file)
--- a/docs/libcurl/opts/CURLOPT_CERTINFO.md
+++ b/docs/libcurl/opts/CURLOPT_CERTINFO.md
@@ -85,6 +85,7 @@ int main(void)
 # AVAILABILITY
 
 Schannel support added in 7.50.0. Secure Transport support added in 7.79.0.
+mbedTLS support added in 8.9.0.
 
 # RETURN VALUE
 

diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c
index 45c78de1e7ec603557a7f6320e7d204b5cdabe3f..3748709d4c25ec8b9329ec4d5067f6529061ff78 100644 (file)
--- a/lib/vtls/mbedtls.c
+++ b/lib/vtls/mbedtls.c
@@ -75,6 +75,7 @@
 #include "mbedtls.h"
 #include "vtls.h"
 #include "vtls_int.h"
+#include "x509asn1.h"
 #include "parsedate.h"
 #include "connect.h" /* for the connect timeout */
 #include "select.h"
@@ -922,6 +923,60 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
   return CURLE_OK;
 }
 
+static int count_server_cert(const mbedtls_x509_crt *peercert)
+{
+  int count = 1;
+
+  DEBUGASSERT(peercert);
+
+  while(peercert->next) {
+    ++count;
+    peercert = peercert->next;
+  }
+  return count;
+}
+
+static CURLcode collect_server_cert_single(struct Curl_easy *data,
+                                           const mbedtls_x509_crt *server_cert,
+                                           int idx)
+{
+  const char *beg, *end;
+
+  DEBUGASSERT(server_cert);
+
+  beg = (const char *)server_cert->raw.p;
+  end = beg + server_cert->raw.len;
+  return Curl_extract_certinfo(data, idx, beg, end);
+}
+
+static CURLcode collect_server_cert(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    const struct mbedtls_x509_crt *peercert)
+{
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+  const bool show_verbose_server_cert = data->set.verbose;
+#else
+  const bool show_verbose_server_cert = false;
+#endif
+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+  CURLcode result = CURLE_PEER_FAILED_VERIFICATION;
+  int i, count;
+
+  if(!show_verbose_server_cert && !ssl_config->certinfo)
+    return CURLE_OK;
+
+  if(!peercert)
+    return result;
+
+  count = count_server_cert(peercert);
+  result = Curl_ssl_init_certinfo(data, count);
+  for(i = 0 ; !result && peercert ; i++) {
+    result = collect_server_cert_single(data, peercert, i);
+    peercert = peercert->next;
+  }
+  return result;
+}
+
 static CURLcode
 mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
 {
@@ -1004,6 +1059,12 @@ mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
 
   peercert = mbedtls_ssl_get_peer_cert(&backend->ssl);
 
+  if(peercert) {
+    const CURLcode result = collect_server_cert(cf, data, peercert);
+    if(result)
+      return result;
+  }
+
   if(peercert && data->set.verbose) {
 #ifndef MBEDTLS_X509_REMOVE_INFO
     const size_t bufsize = 16384;
@@ -1611,6 +1672,7 @@ const struct Curl_ssl Curl_ssl_mbedtls = {
 
   SSLSUPP_CA_PATH |
   SSLSUPP_CAINFO_BLOB |
+  SSLSUPP_CERTINFO |
   SSLSUPP_PINNEDPUBKEY |
   SSLSUPP_SSL_CTX |
   SSLSUPP_HTTPS_PROXY,

diff --git a/lib/vtls/x509asn1.c b/lib/vtls/x509asn1.c
index 8aa9504ce30c0770c83229aea1ec22c8031e9a4b..c896838de71303a56a370b3343b33a765da98464 100644 (file)
--- a/lib/vtls/x509asn1.c
+++ b/lib/vtls/x509asn1.c
@@ -25,13 +25,15 @@
 #include "curl_setup.h"
 
 #if defined(USE_GNUTLS) || defined(USE_WOLFSSL) ||      \
-  defined(USE_SCHANNEL) || defined(USE_SECTRANSP)
+  defined(USE_SCHANNEL) || defined(USE_SECTRANSP) ||    \
+  defined(USE_MBEDTLS)
 
 #if defined(USE_WOLFSSL) || defined(USE_SCHANNEL)
 #define WANT_PARSEX509 /* uses Curl_parseX509() */
 #endif
 
-#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP)
+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
+  defined(USE_MBEDTLS)
 #define WANT_EXTRACT_CERTINFO /* uses Curl_extract_certinfo() */
 #define WANT_PARSEX509 /* ... uses Curl_parseX509() */
 #endif

diff --git a/lib/vtls/x509asn1.h b/lib/vtls/x509asn1.h
index 23a67b828a6ed94cf0efec9c7e02f2f02c84c82e..5844460467cceff00ca578a4a700d08b2a56abef 100644 (file)
--- a/lib/vtls/x509asn1.h
+++ b/lib/vtls/x509asn1.h
@@ -28,7 +28,8 @@
 #include "curl_setup.h"
 
 #if defined(USE_GNUTLS) || defined(USE_WOLFSSL) || \
-  defined(USE_SCHANNEL) || defined(USE_SECTRANSP)
+  defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
+  defined(USE_MBEDTLS)
 
 #include "cfilters.h"
 #include "urldata.h"

diff --git a/tests/data/test3102 b/tests/data/test3102
index 4df7ba9c1f6cf2685fbb16f06e9e2cc7b83e2bd0..7635e65432760d30b111055c0eab03818e411452 100644 (file)
--- a/tests/data/test3102
+++ b/tests/data/test3102
@@ -20,7 +20,6 @@ HTTP GET
 <features>
 SSL
 !bearssl
-!mbedtls
 !rustls
 !wolfssl
 </features>

diff --git a/tests/test1275.pl b/tests/test1275.pl
index 47ce7995789f072c942c76534cc0c88652269416..353391d2f3d9f76272ffc0bddd6fb45861f0d716 100755 (executable)
--- a/tests/test1275.pl
+++ b/tests/test1275.pl
@@ -32,6 +32,7 @@ my $errors;
 my %accepted=('curl' => 1,
               'libcurl' => 1,
               'macOS' => 1,
+              'mbedTLS' => 1,
               'c-ares' => 1);
 
 sub checkfile {