lib/vtls/darwinssl.c

   1 /***************************************************************************
   2  *                                  _   _ ____  _
   3  *  Project                     ___| | | |  _ \| |
   4  *                             / __| | | | |_) | |
   5  *                            | (__| |_| |  _ <| |___
   6  *                             \___|\___/|_| \_\_____|
   7  *
   8  * Copyright (C) 2012 - 2014, Nick Zitzmann, <nickzman@gmail.com>.
   9  * Copyright (C) 2012 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
  10  *
  11  * This software is licensed as described in the file COPYING, which
  12  * you should have received as part of this distribution. The terms
  13  * are also available at https://curl.haxx.se/docs/copyright.html.
  14  *
  15  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  16  * copies of the Software, and permit persons to whom the Software is
  17  * furnished to do so, under the terms of the COPYING file.
  18  *
  19  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  20  * KIND, either express or implied.
  21  *
  22  ***************************************************************************/
  23
  24 /*
  25  * Source file for all iOS and Mac OS X SecureTransport-specific code for the
  26  * TLS/SSL layer. No code but vtls.c should ever call or use these functions.
  27  */
  28
  29 #include "curl_setup.h"
  30
  31 #include "urldata.h" /* for the Curl_easy definition */
  32 #include "curl_base64.h"
  33 #include "strtok.h"
  34
  35 #ifdef USE_DARWINSSL
  36
  37 #ifdef HAVE_LIMITS_H
  38 #include <limits.h>
  39 #endif
  40
  41 #include <Security/Security.h>
  42 #include <Security/SecureTransport.h>
  43 #include <CoreFoundation/CoreFoundation.h>
  44 #include <CommonCrypto/CommonDigest.h>
  45
  46 /* The Security framework has changed greatly between iOS and different OS X
  47    versions, and we will try to support as many of them as we can (back to
  48    Leopard and iOS 5) by using macros and weak-linking.
  49
  50    IMPORTANT: If TLS 1.1 and 1.2 support are important for you on OS X, then
  51    you must build this project against the 10.8 SDK or later. */
  52 #if (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE))
  53
  54 #if MAC_OS_X_VERSION_MAX_ALLOWED < 1050
  55 #error "The darwinssl back-end requires Leopard or later."
  56 #endif /* MAC_OS_X_VERSION_MAX_ALLOWED < 1050 */
  57
  58 #define CURL_BUILD_IOS 0
  59 #define CURL_BUILD_IOS_7 0
  60 #define CURL_BUILD_MAC 1
  61 /* This is the maximum API level we are allowed to use when building: */
  62 #define CURL_BUILD_MAC_10_5 MAC_OS_X_VERSION_MAX_ALLOWED >= 1050
  63 #define CURL_BUILD_MAC_10_6 MAC_OS_X_VERSION_MAX_ALLOWED >= 1060
  64 #define CURL_BUILD_MAC_10_7 MAC_OS_X_VERSION_MAX_ALLOWED >= 1070
  65 #define CURL_BUILD_MAC_10_8 MAC_OS_X_VERSION_MAX_ALLOWED >= 1080
  66 #define CURL_BUILD_MAC_10_9 MAC_OS_X_VERSION_MAX_ALLOWED >= 1090
  67 /* These macros mean "the following code is present to allow runtime backward
  68    compatibility with at least this cat or earlier":
  69    (You set this at build-time by setting the MACOSX_DEPLOYMENT_TARGET
  70    environmental variable.) */
  71 #define CURL_SUPPORT_MAC_10_5 MAC_OS_X_VERSION_MIN_REQUIRED <= 1050
  72 #define CURL_SUPPORT_MAC_10_6 MAC_OS_X_VERSION_MIN_REQUIRED <= 1060
  73 #define CURL_SUPPORT_MAC_10_7 MAC_OS_X_VERSION_MIN_REQUIRED <= 1070
  74 #define CURL_SUPPORT_MAC_10_8 MAC_OS_X_VERSION_MIN_REQUIRED <= 1080
  75 #define CURL_SUPPORT_MAC_10_9 MAC_OS_X_VERSION_MIN_REQUIRED <= 1090
  76
  77 #elif TARGET_OS_EMBEDDED || TARGET_OS_IPHONE
  78 #define CURL_BUILD_IOS 1
  79 #define CURL_BUILD_IOS_7 __IPHONE_OS_VERSION_MAX_ALLOWED >= 70000
  80 #define CURL_BUILD_MAC 0
  81 #define CURL_BUILD_MAC_10_5 0
  82 #define CURL_BUILD_MAC_10_6 0
  83 #define CURL_BUILD_MAC_10_7 0
  84 #define CURL_BUILD_MAC_10_8 0
  85 #define CURL_SUPPORT_MAC_10_5 0
  86 #define CURL_SUPPORT_MAC_10_6 0
  87 #define CURL_SUPPORT_MAC_10_7 0
  88 #define CURL_SUPPORT_MAC_10_8 0
  89 #define CURL_SUPPORT_MAC_10_9 0
  90
  91 #else
  92 #error "The darwinssl back-end requires iOS or OS X."
  93 #endif /* (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE)) */
  94
  95 #if CURL_BUILD_MAC
  96 #include <sys/sysctl.h>
  97 #endif /* CURL_BUILD_MAC */
  98
  99 #include "urldata.h"
 100 #include "sendf.h"
 101 #include "inet_pton.h"
 102 #include "connect.h"
 103 #include "select.h"
 104 #include "vtls.h"
 105 #include "darwinssl.h"
 106 #include "curl_printf.h"
 107
 108 #include "curl_memory.h"
 109 /* The last #include file should be: */
 110 #include "memdebug.h"
 111
 112 /* From MacTypes.h (which we can't include because it isn't present in iOS: */
 113 #define ioErr -36
 114 #define paramErr -50
 115
 116 /* The following two functions were ripped from Apple sample code,
 117  * with some modifications: */
 118 static OSStatus SocketRead(SSLConnectionRef connection,
 119                            void *data,          /* owned by
 120                                                  * caller, data
 121                                                  * RETURNED */
 122                            size_t *dataLength)  /* IN/OUT */
 123 {
 124   size_t bytesToGo = *dataLength;
 125   size_t initLen = bytesToGo;
 126   UInt8 *currData = (UInt8 *)data;
 127   /*int sock = *(int *)connection;*/
 128   struct ssl_connect_data *connssl = (struct ssl_connect_data *)connection;
 129   int sock = connssl->ssl_sockfd;
 130   OSStatus rtn = noErr;
 131   size_t bytesRead;
 132   ssize_t rrtn;
 133   int theErr;
 134
 135   *dataLength = 0;
 136
 137   for(;;) {
 138     bytesRead = 0;
 139     rrtn = read(sock, currData, bytesToGo);
 140     if(rrtn <= 0) {
 141       /* this is guesswork... */
 142       theErr = errno;
 143       if(rrtn == 0) { /* EOF = server hung up */
 144         /* the framework will turn this into errSSLClosedNoNotify */
 145         rtn = errSSLClosedGraceful;
 146       }
 147       else /* do the switch */
 148         switch(theErr) {
 149           case ENOENT:
 150             /* connection closed */
 151             rtn = errSSLClosedGraceful;
 152             break;
 153           case ECONNRESET:
 154             rtn = errSSLClosedAbort;
 155             break;
 156           case EAGAIN:
 157             rtn = errSSLWouldBlock;
 158             connssl->ssl_direction = false;
 159             break;
 160           default:
 161             rtn = ioErr;
 162             break;
 163         }
 164       break;
 165     }
 166     else {
 167       bytesRead = rrtn;
 168     }
 169     bytesToGo -= bytesRead;
 170     currData  += bytesRead;
 171
 172     if(bytesToGo == 0) {
 173       /* filled buffer with incoming data, done */
 174       break;
 175     }
 176   }
 177   *dataLength = initLen - bytesToGo;
 178
 179   return rtn;
 180 }
 181
 182 static OSStatus SocketWrite(SSLConnectionRef connection,
 183                             const void *data,
 184                             size_t *dataLength)  /* IN/OUT */
 185 {
 186   size_t bytesSent = 0;
 187   /*int sock = *(int *)connection;*/
 188   struct ssl_connect_data *connssl = (struct ssl_connect_data *)connection;
 189   int sock = connssl->ssl_sockfd;
 190   ssize_t length;
 191   size_t dataLen = *dataLength;
 192   const UInt8 *dataPtr = (UInt8 *)data;
 193   OSStatus ortn;
 194   int theErr;
 195
 196   *dataLength = 0;
 197
 198   do {
 199     length = write(sock,
 200                    (char *)dataPtr + bytesSent,
 201                    dataLen - bytesSent);
 202   } while((length > 0) &&
 203            ( (bytesSent += length) < dataLen) );
 204
 205   if(length <= 0) {
 206     theErr = errno;
 207     if(theErr == EAGAIN) {
 208       ortn = errSSLWouldBlock;
 209       connssl->ssl_direction = true;
 210     }
 211     else {
 212       ortn = ioErr;
 213     }
 214   }
 215   else {
 216     ortn = noErr;
 217   }
 218   *dataLength = bytesSent;
 219   return ortn;
 220 }
 221
 222 #ifndef CURL_DISABLE_VERBOSE_STRINGS
 223 CF_INLINE const char *SSLCipherNameForNumber(SSLCipherSuite cipher)
 224 {
 225   switch(cipher) {
 226     /* SSL version 3.0 */
 227     case SSL_RSA_WITH_NULL_MD5:
 228       return "SSL_RSA_WITH_NULL_MD5";
 229       break;
 230     case SSL_RSA_WITH_NULL_SHA:
 231       return "SSL_RSA_WITH_NULL_SHA";
 232       break;
 233     case SSL_RSA_EXPORT_WITH_RC4_40_MD5:
 234       return "SSL_RSA_EXPORT_WITH_RC4_40_MD5";
 235       break;
 236     case SSL_RSA_WITH_RC4_128_MD5:
 237       return "SSL_RSA_WITH_RC4_128_MD5";
 238       break;
 239     case SSL_RSA_WITH_RC4_128_SHA:
 240       return "SSL_RSA_WITH_RC4_128_SHA";
 241       break;
 242     case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5:
 243       return "SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5";
 244       break;
 245     case SSL_RSA_WITH_IDEA_CBC_SHA:
 246       return "SSL_RSA_WITH_IDEA_CBC_SHA";
 247       break;
 248     case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA:
 249       return "SSL_RSA_EXPORT_WITH_DES40_CBC_SHA";
 250       break;
 251     case SSL_RSA_WITH_DES_CBC_SHA:
 252       return "SSL_RSA_WITH_DES_CBC_SHA";
 253       break;
 254     case SSL_RSA_WITH_3DES_EDE_CBC_SHA:
 255       return "SSL_RSA_WITH_3DES_EDE_CBC_SHA";
 256       break;
 257     case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA:
 258       return "SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA";
 259       break;
 260     case SSL_DH_DSS_WITH_DES_CBC_SHA:
 261       return "SSL_DH_DSS_WITH_DES_CBC_SHA";
 262       break;
 263     case SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA:
 264       return "SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA";
 265       break;
 266     case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA:
 267       return "SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA";
 268       break;
 269     case SSL_DH_RSA_WITH_DES_CBC_SHA:
 270       return "SSL_DH_RSA_WITH_DES_CBC_SHA";
 271       break;
 272     case SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA:
 273       return "SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA";
 274       break;
 275     case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA:
 276       return "SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA";
 277       break;
 278     case SSL_DHE_DSS_WITH_DES_CBC_SHA:
 279       return "SSL_DHE_DSS_WITH_DES_CBC_SHA";
 280       break;
 281     case SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA:
 282       return "SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA";
 283       break;
 284     case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA:
 285       return "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA";
 286       break;
 287     case SSL_DHE_RSA_WITH_DES_CBC_SHA:
 288       return "SSL_DHE_RSA_WITH_DES_CBC_SHA";
 289       break;
 290     case SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA:
 291       return "SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA";
 292       break;
 293     case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5:
 294       return "SSL_DH_anon_EXPORT_WITH_RC4_40_MD5";
 295       break;
 296     case SSL_DH_anon_WITH_RC4_128_MD5:
 297       return "SSL_DH_anon_WITH_RC4_128_MD5";
 298       break;
 299     case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA:
 300       return "SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA";
 301       break;
 302     case SSL_DH_anon_WITH_DES_CBC_SHA:
 303       return "SSL_DH_anon_WITH_DES_CBC_SHA";
 304       break;
 305     case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA:
 306       return "SSL_DH_anon_WITH_3DES_EDE_CBC_SHA";
 307       break;
 308     case SSL_FORTEZZA_DMS_WITH_NULL_SHA:
 309       return "SSL_FORTEZZA_DMS_WITH_NULL_SHA";
 310       break;
 311     case SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA:
 312       return "SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA";
 313       break;
 314     /* TLS 1.0 with AES (RFC 3268)
 315        (Apparently these are used in SSLv3 implementations as well.) */
 316     case TLS_RSA_WITH_AES_128_CBC_SHA:
 317       return "TLS_RSA_WITH_AES_128_CBC_SHA";
 318       break;
 319     case TLS_DH_DSS_WITH_AES_128_CBC_SHA:
 320       return "TLS_DH_DSS_WITH_AES_128_CBC_SHA";
 321       break;
 322     case TLS_DH_RSA_WITH_AES_128_CBC_SHA:
 323       return "TLS_DH_RSA_WITH_AES_128_CBC_SHA";
 324       break;
 325     case TLS_DHE_DSS_WITH_AES_128_CBC_SHA:
 326       return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA";
 327       break;
 328     case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
 329       return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA";
 330       break;
 331     case TLS_DH_anon_WITH_AES_128_CBC_SHA:
 332       return "TLS_DH_anon_WITH_AES_128_CBC_SHA";
 333       break;
 334     case TLS_RSA_WITH_AES_256_CBC_SHA:
 335       return "TLS_RSA_WITH_AES_256_CBC_SHA";
 336       break;
 337     case TLS_DH_DSS_WITH_AES_256_CBC_SHA:
 338       return "TLS_DH_DSS_WITH_AES_256_CBC_SHA";
 339       break;
 340     case TLS_DH_RSA_WITH_AES_256_CBC_SHA:
 341       return "TLS_DH_RSA_WITH_AES_256_CBC_SHA";
 342       break;
 343     case TLS_DHE_DSS_WITH_AES_256_CBC_SHA:
 344       return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA";
 345       break;
 346     case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
 347       return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA";
 348       break;
 349     case TLS_DH_anon_WITH_AES_256_CBC_SHA:
 350       return "TLS_DH_anon_WITH_AES_256_CBC_SHA";
 351       break;
 352     /* SSL version 2.0 */
 353     case SSL_RSA_WITH_RC2_CBC_MD5:
 354       return "SSL_RSA_WITH_RC2_CBC_MD5";
 355       break;
 356     case SSL_RSA_WITH_IDEA_CBC_MD5:
 357       return "SSL_RSA_WITH_IDEA_CBC_MD5";
 358       break;
 359     case SSL_RSA_WITH_DES_CBC_MD5:
 360       return "SSL_RSA_WITH_DES_CBC_MD5";
 361       break;
 362     case SSL_RSA_WITH_3DES_EDE_CBC_MD5:
 363       return "SSL_RSA_WITH_3DES_EDE_CBC_MD5";
 364       break;
 365   }
 366   return "SSL_NULL_WITH_NULL_NULL";
 367 }
 368
 369 CF_INLINE const char *TLSCipherNameForNumber(SSLCipherSuite cipher)
 370 {
 371   switch(cipher) {
 372     /* TLS 1.0 with AES (RFC 3268) */
 373     case TLS_RSA_WITH_AES_128_CBC_SHA:
 374       return "TLS_RSA_WITH_AES_128_CBC_SHA";
 375       break;
 376     case TLS_DH_DSS_WITH_AES_128_CBC_SHA:
 377       return "TLS_DH_DSS_WITH_AES_128_CBC_SHA";
 378       break;
 379     case TLS_DH_RSA_WITH_AES_128_CBC_SHA:
 380       return "TLS_DH_RSA_WITH_AES_128_CBC_SHA";
 381       break;
 382     case TLS_DHE_DSS_WITH_AES_128_CBC_SHA:
 383       return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA";
 384       break;
 385     case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
 386       return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA";
 387       break;
 388     case TLS_DH_anon_WITH_AES_128_CBC_SHA:
 389       return "TLS_DH_anon_WITH_AES_128_CBC_SHA";
 390       break;
 391     case TLS_RSA_WITH_AES_256_CBC_SHA:
 392       return "TLS_RSA_WITH_AES_256_CBC_SHA";
 393       break;
 394     case TLS_DH_DSS_WITH_AES_256_CBC_SHA:
 395       return "TLS_DH_DSS_WITH_AES_256_CBC_SHA";
 396       break;
 397     case TLS_DH_RSA_WITH_AES_256_CBC_SHA:
 398       return "TLS_DH_RSA_WITH_AES_256_CBC_SHA";
 399       break;
 400     case TLS_DHE_DSS_WITH_AES_256_CBC_SHA:
 401       return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA";
 402       break;
 403     case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
 404       return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA";
 405       break;
 406     case TLS_DH_anon_WITH_AES_256_CBC_SHA:
 407       return "TLS_DH_anon_WITH_AES_256_CBC_SHA";
 408       break;
 409 #if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS
 410     /* TLS 1.0 with ECDSA (RFC 4492) */
 411     case TLS_ECDH_ECDSA_WITH_NULL_SHA:
 412       return "TLS_ECDH_ECDSA_WITH_NULL_SHA";
 413       break;
 414     case TLS_ECDH_ECDSA_WITH_RC4_128_SHA:
 415       return "TLS_ECDH_ECDSA_WITH_RC4_128_SHA";
 416       break;
 417     case TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA:
 418       return "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA";
 419       break;
 420     case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA:
 421       return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA";
 422       break;
 423     case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA:
 424       return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA";
 425       break;
 426     case TLS_ECDHE_ECDSA_WITH_NULL_SHA:
 427       return "TLS_ECDHE_ECDSA_WITH_NULL_SHA";
 428       break;
 429     case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA:
 430       return "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA";
 431       break;
 432     case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:
 433       return "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA";
 434       break;
 435     case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
 436       return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA";
 437       break;
 438     case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
 439       return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA";
 440       break;
 441     case TLS_ECDH_RSA_WITH_NULL_SHA:
 442       return "TLS_ECDH_RSA_WITH_NULL_SHA";
 443       break;
 444     case TLS_ECDH_RSA_WITH_RC4_128_SHA:
 445       return "TLS_ECDH_RSA_WITH_RC4_128_SHA";
 446       break;
 447     case TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA:
 448       return "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA";
 449       break;
 450     case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA:
 451       return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA";
 452       break;
 453     case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA:
 454       return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA";
 455       break;
 456     case TLS_ECDHE_RSA_WITH_NULL_SHA:
 457       return "TLS_ECDHE_RSA_WITH_NULL_SHA";
 458       break;
 459     case TLS_ECDHE_RSA_WITH_RC4_128_SHA:
 460       return "TLS_ECDHE_RSA_WITH_RC4_128_SHA";
 461       break;
 462     case TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:
 463       return "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA";
 464       break;
 465     case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
 466       return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA";
 467       break;
 468     case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
 469       return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA";
 470       break;
 471     case TLS_ECDH_anon_WITH_NULL_SHA:
 472       return "TLS_ECDH_anon_WITH_NULL_SHA";
 473       break;
 474     case TLS_ECDH_anon_WITH_RC4_128_SHA:
 475       return "TLS_ECDH_anon_WITH_RC4_128_SHA";
 476       break;
 477     case TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA:
 478       return "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA";
 479       break;
 480     case TLS_ECDH_anon_WITH_AES_128_CBC_SHA:
 481       return "TLS_ECDH_anon_WITH_AES_128_CBC_SHA";
 482       break;
 483     case TLS_ECDH_anon_WITH_AES_256_CBC_SHA:
 484       return "TLS_ECDH_anon_WITH_AES_256_CBC_SHA";
 485       break;
 486 #endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */
 487 #if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
 488     /* TLS 1.2 (RFC 5246) */
 489     case TLS_RSA_WITH_NULL_MD5:
 490       return "TLS_RSA_WITH_NULL_MD5";
 491       break;
 492     case TLS_RSA_WITH_NULL_SHA:
 493       return "TLS_RSA_WITH_NULL_SHA";
 494       break;
 495     case TLS_RSA_WITH_RC4_128_MD5:
 496       return "TLS_RSA_WITH_RC4_128_MD5";
 497       break;
 498     case TLS_RSA_WITH_RC4_128_SHA:
 499       return "TLS_RSA_WITH_RC4_128_SHA";
 500       break;
 501     case TLS_RSA_WITH_3DES_EDE_CBC_SHA:
 502       return "TLS_RSA_WITH_3DES_EDE_CBC_SHA";
 503       break;
 504     case TLS_RSA_WITH_NULL_SHA256:
 505       return "TLS_RSA_WITH_NULL_SHA256";
 506       break;
 507     case TLS_RSA_WITH_AES_128_CBC_SHA256:
 508       return "TLS_RSA_WITH_AES_128_CBC_SHA256";
 509       break;
 510     case TLS_RSA_WITH_AES_256_CBC_SHA256:
 511       return "TLS_RSA_WITH_AES_256_CBC_SHA256";
 512       break;
 513     case TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA:
 514       return "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA";
 515       break;
 516     case TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA:
 517       return "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA";
 518       break;
 519     case TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA:
 520       return "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA";
 521       break;
 522     case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA:
 523       return "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA";
 524       break;
 525     case TLS_DH_DSS_WITH_AES_128_CBC_SHA256:
 526       return "TLS_DH_DSS_WITH_AES_128_CBC_SHA256";
 527       break;
 528     case TLS_DH_RSA_WITH_AES_128_CBC_SHA256:
 529       return "TLS_DH_RSA_WITH_AES_128_CBC_SHA256";
 530       break;
 531     case TLS_DHE_DSS_WITH_AES_128_CBC_SHA256:
 532       return "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256";
 533       break;
 534     case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
 535       return "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256";
 536       break;
 537     case TLS_DH_DSS_WITH_AES_256_CBC_SHA256:
 538       return "TLS_DH_DSS_WITH_AES_256_CBC_SHA256";
 539       break;
 540     case TLS_DH_RSA_WITH_AES_256_CBC_SHA256:
 541       return "TLS_DH_RSA_WITH_AES_256_CBC_SHA256";
 542       break;
 543     case TLS_DHE_DSS_WITH_AES_256_CBC_SHA256:
 544       return "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256";
 545       break;
 546     case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
 547       return "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256";
 548       break;
 549     case TLS_DH_anon_WITH_RC4_128_MD5:
 550       return "TLS_DH_anon_WITH_RC4_128_MD5";
 551       break;
 552     case TLS_DH_anon_WITH_3DES_EDE_CBC_SHA:
 553       return "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA";
 554       break;
 555     case TLS_DH_anon_WITH_AES_128_CBC_SHA256:
 556       return "TLS_DH_anon_WITH_AES_128_CBC_SHA256";
 557       break;
 558     case TLS_DH_anon_WITH_AES_256_CBC_SHA256:
 559       return "TLS_DH_anon_WITH_AES_256_CBC_SHA256";
 560       break;
 561     /* TLS 1.2 with AES GCM (RFC 5288) */
 562     case TLS_RSA_WITH_AES_128_GCM_SHA256:
 563       return "TLS_RSA_WITH_AES_128_GCM_SHA256";
 564       break;
 565     case TLS_RSA_WITH_AES_256_GCM_SHA384:
 566       return "TLS_RSA_WITH_AES_256_GCM_SHA384";
 567       break;
 568     case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
 569       return "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256";
 570       break;
 571     case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
 572       return "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384";
 573       break;
 574     case TLS_DH_RSA_WITH_AES_128_GCM_SHA256:
 575       return "TLS_DH_RSA_WITH_AES_128_GCM_SHA256";
 576       break;
 577     case TLS_DH_RSA_WITH_AES_256_GCM_SHA384:
 578       return "TLS_DH_RSA_WITH_AES_256_GCM_SHA384";
 579       break;
 580     case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256:
 581       return "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256";
 582       break;
 583     case TLS_DHE_DSS_WITH_AES_256_GCM_SHA384:
 584       return "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384";
 585       break;
 586     case TLS_DH_DSS_WITH_AES_128_GCM_SHA256:
 587       return "TLS_DH_DSS_WITH_AES_128_GCM_SHA256";
 588       break;
 589     case TLS_DH_DSS_WITH_AES_256_GCM_SHA384:
 590       return "TLS_DH_DSS_WITH_AES_256_GCM_SHA384";
 591       break;
 592     case TLS_DH_anon_WITH_AES_128_GCM_SHA256:
 593       return "TLS_DH_anon_WITH_AES_128_GCM_SHA256";
 594       break;
 595     case TLS_DH_anon_WITH_AES_256_GCM_SHA384:
 596       return "TLS_DH_anon_WITH_AES_256_GCM_SHA384";
 597       break;
 598     /* TLS 1.2 with elliptic curve ciphers (RFC 5289) */
 599     case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
 600       return "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256";
 601       break;
 602     case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
 603       return "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384";
 604       break;
 605     case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256:
 606       return "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256";
 607       break;
 608     case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384:
 609       return "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384";
 610       break;
 611     case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
 612       return "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256";
 613       break;
 614     case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384:
 615       return "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384";
 616       break;
 617     case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256:
 618       return "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256";
 619       break;
 620     case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384:
 621       return "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384";
 622       break;
 623     case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
 624       return "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256";
 625       break;
 626     case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
 627       return "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384";
 628       break;
 629     case TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256:
 630       return "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256";
 631       break;
 632     case TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384:
 633       return "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384";
 634       break;
 635     case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
 636       return "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256";
 637       break;
 638     case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
 639       return "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384";
 640       break;
 641     case TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256:
 642       return "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256";
 643       break;
 644     case TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384:
 645       return "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384";
 646       break;
 647     case TLS_EMPTY_RENEGOTIATION_INFO_SCSV:
 648       return "TLS_EMPTY_RENEGOTIATION_INFO_SCSV";
 649       break;
 650 #else
 651     case SSL_RSA_WITH_NULL_MD5:
 652       return "TLS_RSA_WITH_NULL_MD5";
 653       break;
 654     case SSL_RSA_WITH_NULL_SHA:
 655       return "TLS_RSA_WITH_NULL_SHA";
 656       break;
 657     case SSL_RSA_WITH_RC4_128_MD5:
 658       return "TLS_RSA_WITH_RC4_128_MD5";
 659       break;
 660     case SSL_RSA_WITH_RC4_128_SHA:
 661       return "TLS_RSA_WITH_RC4_128_SHA";
 662       break;
 663     case SSL_RSA_WITH_3DES_EDE_CBC_SHA:
 664       return "TLS_RSA_WITH_3DES_EDE_CBC_SHA";
 665       break;
 666     case SSL_DH_anon_WITH_RC4_128_MD5:
 667       return "TLS_DH_anon_WITH_RC4_128_MD5";
 668       break;
 669     case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA:
 670       return "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA";
 671       break;
 672 #endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
 673 #if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
 674     /* TLS PSK (RFC 4279): */
 675     case TLS_PSK_WITH_RC4_128_SHA:
 676       return "TLS_PSK_WITH_RC4_128_SHA";
 677       break;
 678     case TLS_PSK_WITH_3DES_EDE_CBC_SHA:
 679       return "TLS_PSK_WITH_3DES_EDE_CBC_SHA";
 680       break;
 681     case TLS_PSK_WITH_AES_128_CBC_SHA:
 682       return "TLS_PSK_WITH_AES_128_CBC_SHA";
 683       break;
 684     case TLS_PSK_WITH_AES_256_CBC_SHA:
 685       return "TLS_PSK_WITH_AES_256_CBC_SHA";
 686       break;
 687     case TLS_DHE_PSK_WITH_RC4_128_SHA:
 688       return "TLS_DHE_PSK_WITH_RC4_128_SHA";
 689       break;
 690     case TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA:
 691       return "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA";
 692       break;
 693     case TLS_DHE_PSK_WITH_AES_128_CBC_SHA:
 694       return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA";
 695       break;
 696     case TLS_DHE_PSK_WITH_AES_256_CBC_SHA:
 697       return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA";
 698       break;
 699     case TLS_RSA_PSK_WITH_RC4_128_SHA:
 700       return "TLS_RSA_PSK_WITH_RC4_128_SHA";
 701       break;
 702     case TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA:
 703       return "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA";
 704       break;
 705     case TLS_RSA_PSK_WITH_AES_128_CBC_SHA:
 706       return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA";
 707       break;
 708     case TLS_RSA_PSK_WITH_AES_256_CBC_SHA:
 709       return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA";
 710       break;
 711     /* More TLS PSK (RFC 4785): */
 712     case TLS_PSK_WITH_NULL_SHA:
 713       return "TLS_PSK_WITH_NULL_SHA";
 714       break;
 715     case TLS_DHE_PSK_WITH_NULL_SHA:
 716       return "TLS_DHE_PSK_WITH_NULL_SHA";
 717       break;
 718     case TLS_RSA_PSK_WITH_NULL_SHA:
 719       return "TLS_RSA_PSK_WITH_NULL_SHA";
 720       break;
 721     /* Even more TLS PSK (RFC 5487): */
 722     case TLS_PSK_WITH_AES_128_GCM_SHA256:
 723       return "TLS_PSK_WITH_AES_128_GCM_SHA256";
 724       break;
 725     case TLS_PSK_WITH_AES_256_GCM_SHA384:
 726       return "TLS_PSK_WITH_AES_256_GCM_SHA384";
 727       break;
 728     case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256:
 729       return "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256";
 730       break;
 731     case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384:
 732       return "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384";
 733       break;
 734     case TLS_RSA_PSK_WITH_AES_128_GCM_SHA256:
 735       return "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256";
 736       break;
 737     case TLS_RSA_PSK_WITH_AES_256_GCM_SHA384:
 738       return "TLS_PSK_WITH_AES_256_GCM_SHA384";
 739       break;
 740     case TLS_PSK_WITH_AES_128_CBC_SHA256:
 741       return "TLS_PSK_WITH_AES_128_CBC_SHA256";
 742       break;
 743     case TLS_PSK_WITH_AES_256_CBC_SHA384:
 744       return "TLS_PSK_WITH_AES_256_CBC_SHA384";
 745       break;
 746     case TLS_PSK_WITH_NULL_SHA256:
 747       return "TLS_PSK_WITH_NULL_SHA256";
 748       break;
 749     case TLS_PSK_WITH_NULL_SHA384:
 750       return "TLS_PSK_WITH_NULL_SHA384";
 751       break;
 752     case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256:
 753       return "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256";
 754       break;
 755     case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384:
 756       return "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384";
 757       break;
 758     case TLS_DHE_PSK_WITH_NULL_SHA256:
 759       return "TLS_DHE_PSK_WITH_NULL_SHA256";
 760       break;
 761     case TLS_DHE_PSK_WITH_NULL_SHA384:
 762       return "TLS_RSA_PSK_WITH_NULL_SHA384";
 763       break;
 764     case TLS_RSA_PSK_WITH_AES_128_CBC_SHA256:
 765       return "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256";
 766       break;
 767     case TLS_RSA_PSK_WITH_AES_256_CBC_SHA384:
 768       return "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384";
 769       break;
 770     case TLS_RSA_PSK_WITH_NULL_SHA256:
 771       return "TLS_RSA_PSK_WITH_NULL_SHA256";
 772       break;
 773     case TLS_RSA_PSK_WITH_NULL_SHA384:
 774       return "TLS_RSA_PSK_WITH_NULL_SHA384";
 775       break;
 776 #endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
 777   }
 778   return "TLS_NULL_WITH_NULL_NULL";
 779 }
 780 #endif /* !CURL_DISABLE_VERBOSE_STRINGS */
 781
 782 #if CURL_BUILD_MAC
 783 CF_INLINE void GetDarwinVersionNumber(int *major, int *minor)
 784 {
 785   int mib[2];
 786   char *os_version;
 787   size_t os_version_len;
 788   char *os_version_major, *os_version_minor;
 789   char *tok_buf;
 790
 791   /* Get the Darwin kernel version from the kernel using sysctl(): */
 792   mib[0] = CTL_KERN;
 793   mib[1] = KERN_OSRELEASE;
 794   if(sysctl(mib, 2, NULL, &os_version_len, NULL, 0) == -1)
 795     return;
 796   os_version = malloc(os_version_len*sizeof(char));
 797   if(!os_version)
 798     return;
 799   if(sysctl(mib, 2, os_version, &os_version_len, NULL, 0) == -1) {
 800     free(os_version);
 801     return;
 802   }
 803
 804   /* Parse the version: */
 805   os_version_major = strtok_r(os_version, ".", &tok_buf);
 806   os_version_minor = strtok_r(NULL, ".", &tok_buf);
 807   *major = atoi(os_version_major);
 808   *minor = atoi(os_version_minor);
 809   free(os_version);
 810 }
 811 #endif /* CURL_BUILD_MAC */
 812
 813 /* Apple provides a myriad of ways of getting information about a certificate
 814    into a string. Some aren't available under iOS or newer cats. So here's
 815    a unified function for getting a string describing the certificate that
 816    ought to work in all cats starting with Leopard. */
 817 CF_INLINE CFStringRef CopyCertSubject(SecCertificateRef cert)
 818 {
 819   CFStringRef server_cert_summary = CFSTR("(null)");
 820
 821 #if CURL_BUILD_IOS
 822   /* iOS: There's only one way to do this. */
 823   server_cert_summary = SecCertificateCopySubjectSummary(cert);
 824 #else
 825 #if CURL_BUILD_MAC_10_7
 826   /* Lion & later: Get the long description if we can. */
 827   if(SecCertificateCopyLongDescription != NULL)
 828     server_cert_summary =
 829       SecCertificateCopyLongDescription(NULL, cert, NULL);
 830   else
 831 #endif /* CURL_BUILD_MAC_10_7 */
 832 #if CURL_BUILD_MAC_10_6
 833   /* Snow Leopard: Get the certificate summary. */
 834   if(SecCertificateCopySubjectSummary != NULL)
 835     server_cert_summary = SecCertificateCopySubjectSummary(cert);
 836   else
 837 #endif /* CURL_BUILD_MAC_10_6 */
 838   /* Leopard is as far back as we go... */
 839   (void)SecCertificateCopyCommonName(cert, &server_cert_summary);
 840 #endif /* CURL_BUILD_IOS */
 841   return server_cert_summary;
 842 }
 843
 844 #if CURL_SUPPORT_MAC_10_6
 845 /* The SecKeychainSearch API was deprecated in Lion, and using it will raise
 846    deprecation warnings, so let's not compile this unless it's necessary: */
 847 static OSStatus CopyIdentityWithLabelOldSchool(char *label,
 848                                                SecIdentityRef *out_c_a_k)
 849 {
 850   OSStatus status = errSecItemNotFound;
 851   SecKeychainAttributeList attr_list;
 852   SecKeychainAttribute attr;
 853   SecKeychainSearchRef search = NULL;
 854   SecCertificateRef cert = NULL;
 855
 856   /* Set up the attribute list: */
 857   attr_list.count = 1L;
 858   attr_list.attr = &attr;
 859
 860   /* Set up our lone search criterion: */
 861   attr.tag = kSecLabelItemAttr;
 862   attr.data = label;
 863   attr.length = (UInt32)strlen(label);
 864
 865   /* Start searching: */
 866   status = SecKeychainSearchCreateFromAttributes(NULL,
 867                                                  kSecCertificateItemClass,
 868                                                  &attr_list,
 869                                                  &search);
 870   if(status == noErr) {
 871     status = SecKeychainSearchCopyNext(search,
 872                                        (SecKeychainItemRef *)&cert);
 873     if(status == noErr && cert) {
 874       /* If we found a certificate, does it have a private key? */
 875       status = SecIdentityCreateWithCertificate(NULL, cert, out_c_a_k);
 876       CFRelease(cert);
 877     }
 878   }
 879
 880   if(search)
 881     CFRelease(search);
 882   return status;
 883 }
 884 #endif /* CURL_SUPPORT_MAC_10_6 */
 885
 886 static OSStatus CopyIdentityWithLabel(char *label,
 887                                       SecIdentityRef *out_cert_and_key)
 888 {
 889   OSStatus status = errSecItemNotFound;
 890
 891 #if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
 892   CFArrayRef keys_list;
 893   CFIndex keys_list_count;
 894   CFIndex i;
 895   CFStringRef common_name;
 896
 897   /* SecItemCopyMatching() was introduced in iOS and Snow Leopard.
 898      kSecClassIdentity was introduced in Lion. If both exist, let's use them
 899      to find the certificate. */
 900   if(SecItemCopyMatching != NULL && kSecClassIdentity != NULL) {
 901     CFTypeRef keys[5];
 902     CFTypeRef values[5];
 903     CFDictionaryRef query_dict;
 904     CFStringRef label_cf = CFStringCreateWithCString(NULL, label,
 905       kCFStringEncodingUTF8);
 906
 907     /* Set up our search criteria and expected results: */
 908     values[0] = kSecClassIdentity; /* we want a certificate and a key */
 909     keys[0] = kSecClass;
 910     values[1] = kCFBooleanTrue;    /* we want a reference */
 911     keys[1] = kSecReturnRef;
 912     values[2] = kSecMatchLimitAll; /* kSecMatchLimitOne would be better if the
 913                                     * label matching below worked correctly */
 914     keys[2] = kSecMatchLimit;
 915     /* identity searches need a SecPolicyRef in order to work */
 916     values[3] = SecPolicyCreateSSL(false, NULL);
 917     keys[3] = kSecMatchPolicy;
 918     /* match the name of the certificate (doesn't work in macOS 10.12.1) */
 919     values[4] = label_cf;
 920     keys[4] = kSecAttrLabel;
 921     query_dict = CFDictionaryCreate(NULL, (const void **)keys,
 922                                     (const void **)values, 5L,
 923                                     &kCFCopyStringDictionaryKeyCallBacks,
 924                                     &kCFTypeDictionaryValueCallBacks);
 925     CFRelease(values[3]);
 926
 927     /* Do we have a match? */
 928     status = SecItemCopyMatching(query_dict, (CFTypeRef *) &keys_list);
 929
 930     /* Because kSecAttrLabel matching doesn't work with kSecClassIdentity,
 931      * we need to find the correct identity ourselves */
 932     if(status == noErr) {
 933       keys_list_count = CFArrayGetCount(keys_list);
 934       *out_cert_and_key = NULL;
 935       status = 1;
 936       for(i=0; i<keys_list_count; i++) {
 937         OSStatus err = noErr;
 938         SecCertificateRef cert = NULL;
 939         SecIdentityRef identity =
 940           (SecIdentityRef) CFArrayGetValueAtIndex(keys_list, i);
 941         err = SecIdentityCopyCertificate(identity, &cert);
 942         if(err == noErr) {
 943 #if CURL_BUILD_IOS
 944           common_name = SecCertificateCopySubjectSummary(cert);
 945 #elif CURL_BUILD_MAC_10_7
 946           SecCertificateCopyCommonName(cert, &common_name);
 947 #endif
 948           if(CFStringCompare(common_name, label_cf, 0) == kCFCompareEqualTo) {
 949             CFRelease(cert);
 950             CFRelease(common_name);
 951             CFRetain(identity);
 952             *out_cert_and_key = identity;
 953             status = noErr;
 954             break;
 955           }
 956           CFRelease(common_name);
 957         }
 958         CFRelease(cert);
 959       }
 960     }
 961
 962     if(keys_list)
 963       CFRelease(keys_list);
 964     CFRelease(query_dict);
 965     CFRelease(label_cf);
 966   }
 967   else {
 968 #if CURL_SUPPORT_MAC_10_6
 969     /* On Leopard and Snow Leopard, fall back to SecKeychainSearch. */
 970     status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key);
 971 #endif /* CURL_SUPPORT_MAC_10_6 */
 972   }
 973 #elif CURL_SUPPORT_MAC_10_6
 974   /* For developers building on older cats, we have no choice but to fall back
 975      to SecKeychainSearch. */
 976   status = CopyIdentityWithLabelOldSchool(label, out_cert_and_key);
 977 #endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
 978   return status;
 979 }
 980
 981 static OSStatus CopyIdentityFromPKCS12File(const char *cPath,
 982                                            const char *cPassword,
 983                                            SecIdentityRef *out_cert_and_key)
 984 {
 985   OSStatus status = errSecItemNotFound;
 986   CFURLRef pkcs_url = CFURLCreateFromFileSystemRepresentation(NULL,
 987     (const UInt8 *)cPath, strlen(cPath), false);
 988   CFStringRef password = cPassword ? CFStringCreateWithCString(NULL,
 989     cPassword, kCFStringEncodingUTF8) : NULL;
 990   CFDataRef pkcs_data = NULL;
 991
 992   /* We can import P12 files on iOS or OS X 10.7 or later: */
 993   /* These constants are documented as having first appeared in 10.6 but they
 994      raise linker errors when used on that cat for some reason. */
 995 #if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
 996   if(CFURLCreateDataAndPropertiesFromResource(NULL, pkcs_url, &pkcs_data,
 997     NULL, NULL, &status)) {
 998     const void *cKeys[] = {kSecImportExportPassphrase};
 999     const void *cValues[] = {password};
1000     CFDictionaryRef options = CFDictionaryCreate(NULL, cKeys, cValues,
1001       password ? 1L : 0L, NULL, NULL);
1002     CFArrayRef items = NULL;
1003
1004     /* Here we go: */
1005     status = SecPKCS12Import(pkcs_data, options, &items);
1006     if(status == errSecSuccess && items && CFArrayGetCount(items)) {
1007       CFDictionaryRef identity_and_trust = CFArrayGetValueAtIndex(items, 0L);
1008       const void *temp_identity = CFDictionaryGetValue(identity_and_trust,
1009         kSecImportItemIdentity);
1010
1011       /* Retain the identity; we don't care about any other data... */
1012       CFRetain(temp_identity);
1013       *out_cert_and_key = (SecIdentityRef)temp_identity;
1014     }
1015
1016     if(items)
1017       CFRelease(items);
1018     CFRelease(options);
1019     CFRelease(pkcs_data);
1020   }
1021 #endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
1022   if(password)
1023     CFRelease(password);
1024   CFRelease(pkcs_url);
1025   return status;
1026 }
1027
1028 /* This code was borrowed from nss.c, with some modifications:
1029  * Determine whether the nickname passed in is a filename that needs to
1030  * be loaded as a PEM or a regular NSS nickname.
1031  *
1032  * returns 1 for a file
1033  * returns 0 for not a file
1034  */
1035 CF_INLINE bool is_file(const char *filename)
1036 {
1037   struct_stat st;
1038
1039   if(filename == NULL)
1040     return false;
1041
1042   if(stat(filename, &st) == 0)
1043     return S_ISREG(st.st_mode);
1044   return false;
1045 }
1046
1047 static CURLcode darwinssl_connect_step1(struct connectdata *conn,
1048                                         int sockindex)
1049 {
1050   struct Curl_easy *data = conn->data;
1051   curl_socket_t sockfd = conn->sock[sockindex];
1052   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
1053   const char * const ssl_cafile = SSL_CONN_CONFIG(CAfile);
1054   const bool verifypeer = SSL_CONN_CONFIG(verifypeer);
1055   char * const ssl_cert = SSL_SET_OPTION(cert);
1056   const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
1057     conn->host.name;
1058   const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port;
1059 #ifdef ENABLE_IPV6
1060   struct in6_addr addr;
1061 #else
1062   struct in_addr addr;
1063 #endif /* ENABLE_IPV6 */
1064   size_t all_ciphers_count = 0UL, allowed_ciphers_count = 0UL, i;
1065   SSLCipherSuite *all_ciphers = NULL, *allowed_ciphers = NULL;
1066   OSStatus err = noErr;
1067 #if CURL_BUILD_MAC
1068   int darwinver_maj = 0, darwinver_min = 0;
1069
1070   GetDarwinVersionNumber(&darwinver_maj, &darwinver_min);
1071 #endif /* CURL_BUILD_MAC */
1072
1073 #if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
1074   if(SSLCreateContext != NULL) {  /* use the newer API if avaialble */
1075     if(connssl->ssl_ctx)
1076       CFRelease(connssl->ssl_ctx);
1077     connssl->ssl_ctx = SSLCreateContext(NULL, kSSLClientSide, kSSLStreamType);
1078     if(!connssl->ssl_ctx) {
1079       failf(data, "SSL: couldn't create a context!");
1080       return CURLE_OUT_OF_MEMORY;
1081     }
1082   }
1083   else {
1084   /* The old ST API does not exist under iOS, so don't compile it: */
1085 #if CURL_SUPPORT_MAC_10_8
1086     if(connssl->ssl_ctx)
1087       (void)SSLDisposeContext(connssl->ssl_ctx);
1088     err = SSLNewContext(false, &(connssl->ssl_ctx));
1089     if(err != noErr) {
1090       failf(data, "SSL: couldn't create a context: OSStatus %d", err);
1091       return CURLE_OUT_OF_MEMORY;
1092     }
1093 #endif /* CURL_SUPPORT_MAC_10_8 */
1094   }
1095 #else
1096   if(connssl->ssl_ctx)
1097     (void)SSLDisposeContext(connssl->ssl_ctx);
1098   err = SSLNewContext(false, &(connssl->ssl_ctx));
1099   if(err != noErr) {
1100     failf(data, "SSL: couldn't create a context: OSStatus %d", err);
1101     return CURLE_OUT_OF_MEMORY;
1102   }
1103 #endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
1104   connssl->ssl_write_buffered_length = 0UL; /* reset buffered write length */
1105
1106   /* check to see if we've been told to use an explicit SSL/TLS version */
1107 #if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
1108   if(SSLSetProtocolVersionMax != NULL) {
1109     switch(conn->ssl_config.version) {
1110     case CURL_SSLVERSION_DEFAULT:
1111     case CURL_SSLVERSION_TLSv1:
1112       (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol1);
1113       (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol12);
1114       break;
1115     case CURL_SSLVERSION_TLSv1_0:
1116       (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol1);
1117       (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol1);
1118       break;
1119     case CURL_SSLVERSION_TLSv1_1:
1120       (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol11);
1121       (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol11);
1122       break;
1123     case CURL_SSLVERSION_TLSv1_2:
1124       (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol12);
1125       (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol12);
1126       break;
1127     case CURL_SSLVERSION_TLSv1_3:
1128       failf(data, "DarwinSSL: TLS 1.3 is not yet supported");
1129       return CURLE_SSL_CONNECT_ERROR;
1130     case CURL_SSLVERSION_SSLv3:
1131       err = SSLSetProtocolVersionMin(connssl->ssl_ctx, kSSLProtocol3);
1132       if(err != noErr) {
1133         failf(data, "Your version of the OS does not support SSLv3");
1134         return CURLE_SSL_CONNECT_ERROR;
1135       }
1136       (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kSSLProtocol3);
1137       break;
1138     case CURL_SSLVERSION_SSLv2:
1139       err = SSLSetProtocolVersionMin(connssl->ssl_ctx, kSSLProtocol2);
1140       if(err != noErr) {
1141         failf(data, "Your version of the OS does not support SSLv2");
1142         return CURLE_SSL_CONNECT_ERROR;
1143       }
1144       (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kSSLProtocol2);
1145       break;
1146     default:
1147       failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
1148       return CURLE_SSL_CONNECT_ERROR;
1149     }
1150   }
1151   else {
1152 #if CURL_SUPPORT_MAC_10_8
1153     (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
1154                                        kSSLProtocolAll,
1155                                        false);
1156     switch(conn->ssl_config.version) {
1157     case CURL_SSLVERSION_DEFAULT:
1158     case CURL_SSLVERSION_TLSv1:
1159       (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
1160                                          kTLSProtocol1,
1161                                          true);
1162       (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
1163                                          kTLSProtocol11,
1164                                          true);
1165       (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
1166                                          kTLSProtocol12,
1167                                          true);
1168       break;
1169     case CURL_SSLVERSION_TLSv1_0:
1170       (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
1171                                          kTLSProtocol1,
1172                                          true);
1173       break;
1174     case CURL_SSLVERSION_TLSv1_1:
1175       (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
1176                                          kTLSProtocol11,
1177                                          true);
1178       break;
1179     case CURL_SSLVERSION_TLSv1_2:
1180       (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
1181                                          kTLSProtocol12,
1182                                          true);
1183       break;
1184     case CURL_SSLVERSION_TLSv1_3:
1185       failf(data, "DarwinSSL: TLS 1.3 is not yet supported");
1186       return CURLE_SSL_CONNECT_ERROR;
1187     case CURL_SSLVERSION_SSLv3:
1188       err = SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
1189                                          kSSLProtocol3,
1190                                          true);
1191       if(err != noErr) {
1192         failf(data, "Your version of the OS does not support SSLv3");
1193         return CURLE_SSL_CONNECT_ERROR;
1194       }
1195       break;
1196     case CURL_SSLVERSION_SSLv2:
1197       err = SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
1198                                          kSSLProtocol2,
1199                                          true);
1200       if(err != noErr) {
1201         failf(data, "Your version of the OS does not support SSLv2");
1202         return CURLE_SSL_CONNECT_ERROR;
1203       }
1204       break;
1205     default:
1206       failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
1207       return CURLE_SSL_CONNECT_ERROR;
1208     }
1209 #endif  /* CURL_SUPPORT_MAC_10_8 */
1210   }
1211 #else
1212   (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, kSSLProtocolAll, false);
1213   switch(conn->ssl_config.version) {
1214   case CURL_SSLVERSION_DEFAULT:
1215   case CURL_SSLVERSION_TLSv1:
1216   case CURL_SSLVERSION_TLSv1_0:
1217     (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
1218                                        kTLSProtocol1,
1219                                        true);
1220     break;
1221   case CURL_SSLVERSION_TLSv1_1:
1222     failf(data, "Your version of the OS does not support TLSv1.1");
1223     return CURLE_SSL_CONNECT_ERROR;
1224   case CURL_SSLVERSION_TLSv1_2:
1225     failf(data, "Your version of the OS does not support TLSv1.2");
1226     return CURLE_SSL_CONNECT_ERROR;
1227   case CURL_SSLVERSION_TLSv1_3:
1228     failf(data, "Your version of the OS does not support TLSv1.3");
1229     return CURLE_SSL_CONNECT_ERROR;
1230   case CURL_SSLVERSION_SSLv2:
1231     err = SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
1232                                        kSSLProtocol2,
1233                                        true);
1234     if(err != noErr) {
1235       failf(data, "Your version of the OS does not support SSLv2");
1236       return CURLE_SSL_CONNECT_ERROR;
1237     }
1238     break;
1239   case CURL_SSLVERSION_SSLv3:
1240     err = SSLSetProtocolVersionEnabled(connssl->ssl_ctx,
1241                                        kSSLProtocol3,
1242                                        true);
1243     if(err != noErr) {
1244       failf(data, "Your version of the OS does not support SSLv3");
1245       return CURLE_SSL_CONNECT_ERROR;
1246     }
1247     break;
1248   default:
1249     failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
1250     return CURLE_SSL_CONNECT_ERROR;
1251   }
1252 #endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
1253
1254   if(SSL_SET_OPTION(key)) {
1255     infof(data, "WARNING: SSL: CURLOPT_SSLKEY is ignored by Secure "
1256           "Transport. The private key must be in the Keychain.\n");
1257   }
1258
1259   if(ssl_cert) {
1260     SecIdentityRef cert_and_key = NULL;
1261     bool is_cert_file = is_file(ssl_cert);
1262
1263     /* User wants to authenticate with a client cert. Look for it:
1264        If we detect that this is a file on disk, then let's load it.
1265        Otherwise, assume that the user wants to use an identity loaded
1266        from the Keychain. */
1267     if(is_cert_file) {
1268       if(!SSL_SET_OPTION(cert_type))
1269         infof(data, "WARNING: SSL: Certificate type not set, assuming "
1270                     "PKCS#12 format.\n");
1271       else if(strncmp(SSL_SET_OPTION(cert_type), "P12",
1272         strlen(SSL_SET_OPTION(cert_type))) != 0)
1273         infof(data, "WARNING: SSL: The Security framework only supports "
1274                     "loading identities that are in PKCS#12 format.\n");
1275
1276       err = CopyIdentityFromPKCS12File(ssl_cert,
1277         SSL_SET_OPTION(key_passwd), &cert_and_key);
1278     }
1279     else
1280       err = CopyIdentityWithLabel(ssl_cert, &cert_and_key);
1281
1282     if(err == noErr) {
1283       SecCertificateRef cert = NULL;
1284       CFTypeRef certs_c[1];
1285       CFArrayRef certs;
1286
1287       /* If we found one, print it out: */
1288       err = SecIdentityCopyCertificate(cert_and_key, &cert);
1289       if(err == noErr) {
1290         CFStringRef cert_summary = CopyCertSubject(cert);
1291         char cert_summary_c[128];
1292
1293         if(cert_summary) {
1294           memset(cert_summary_c, 0, 128);
1295           if(CFStringGetCString(cert_summary,
1296                                 cert_summary_c,
1297                                 128,
1298                                 kCFStringEncodingUTF8)) {
1299             infof(data, "Client certificate: %s\n", cert_summary_c);
1300           }
1301           CFRelease(cert_summary);
1302           CFRelease(cert);
1303         }
1304       }
1305       certs_c[0] = cert_and_key;
1306       certs = CFArrayCreate(NULL, (const void **)certs_c, 1L,
1307                             &kCFTypeArrayCallBacks);
1308       err = SSLSetCertificate(connssl->ssl_ctx, certs);
1309       if(certs)
1310         CFRelease(certs);
1311       if(err != noErr) {
1312         failf(data, "SSL: SSLSetCertificate() failed: OSStatus %d", err);
1313         return CURLE_SSL_CERTPROBLEM;
1314       }
1315       CFRelease(cert_and_key);
1316     }
1317     else {
1318       switch(err) {
1319       case errSecAuthFailed: case -25264: /* errSecPkcs12VerifyFailure */
1320         failf(data, "SSL: Incorrect password for the certificate \"%s\" "
1321                     "and its private key.", ssl_cert);
1322         break;
1323       case -26275: /* errSecDecode */ case -25257: /* errSecUnknownFormat */
1324         failf(data, "SSL: Couldn't make sense of the data in the "
1325                     "certificate \"%s\" and its private key.",
1326                     ssl_cert);
1327         break;
1328       case -25260: /* errSecPassphraseRequired */
1329         failf(data, "SSL The certificate \"%s\" requires a password.",
1330                     ssl_cert);
1331         break;
1332       case errSecItemNotFound:
1333         failf(data, "SSL: Can't find the certificate \"%s\" and its private "
1334                     "key in the Keychain.", ssl_cert);
1335         break;
1336       default:
1337         failf(data, "SSL: Can't load the certificate \"%s\" and its private "
1338                     "key: OSStatus %d", ssl_cert, err);
1339         break;
1340       }
1341       return CURLE_SSL_CERTPROBLEM;
1342     }
1343   }
1344
1345   /* SSL always tries to verify the peer, this only says whether it should
1346    * fail to connect if the verification fails, or if it should continue
1347    * anyway. In the latter case the result of the verification is checked with
1348    * SSL_get_verify_result() below. */
1349 #if CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS
1350   /* Snow Leopard introduced the SSLSetSessionOption() function, but due to
1351      a library bug with the way the kSSLSessionOptionBreakOnServerAuth flag
1352      works, it doesn't work as expected under Snow Leopard, Lion or
1353      Mountain Lion.
1354      So we need to call SSLSetEnableCertVerify() on those older cats in order
1355      to disable certificate validation if the user turned that off.
1356      (SecureTransport will always validate the certificate chain by
1357      default.)
1358   Note:
1359   Darwin 11.x.x is Lion (10.7)
1360   Darwin 12.x.x is Mountain Lion (10.8)
1361   Darwin 13.x.x is Mavericks (10.9)
1362   Darwin 14.x.x is Yosemite (10.10)
1363   Darwin 15.x.x is El Capitan (10.11)
1364   */
1365 #if CURL_BUILD_MAC
1366   if(SSLSetSessionOption != NULL && darwinver_maj >= 13) {
1367 #else
1368   if(SSLSetSessionOption != NULL) {
1369 #endif /* CURL_BUILD_MAC */
1370     bool break_on_auth = !conn->ssl_config.verifypeer || ssl_cafile;
1371     err = SSLSetSessionOption(connssl->ssl_ctx,
1372                               kSSLSessionOptionBreakOnServerAuth,
1373                               break_on_auth);
1374     if(err != noErr) {
1375       failf(data, "SSL: SSLSetSessionOption() failed: OSStatus %d", err);
1376       return CURLE_SSL_CONNECT_ERROR;
1377     }
1378   }
1379   else {
1380 #if CURL_SUPPORT_MAC_10_8
1381     err = SSLSetEnableCertVerify(connssl->ssl_ctx,
1382                                  conn->ssl_config.verifypeer?true:false);
1383     if(err != noErr) {
1384       failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err);
1385       return CURLE_SSL_CONNECT_ERROR;
1386     }
1387 #endif /* CURL_SUPPORT_MAC_10_8 */
1388   }
1389 #else
1390   err = SSLSetEnableCertVerify(connssl->ssl_ctx,
1391                                conn->ssl_config.verifypeer?true:false);
1392   if(err != noErr) {
1393     failf(data, "SSL: SSLSetEnableCertVerify() failed: OSStatus %d", err);
1394     return CURLE_SSL_CONNECT_ERROR;
1395   }
1396 #endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */
1397
1398   if(ssl_cafile && verifypeer) {
1399     bool is_cert_file = is_file(ssl_cafile);
1400
1401     if(!is_cert_file) {
1402       failf(data, "SSL: can't load CA certificate file %s", ssl_cafile);
1403       return CURLE_SSL_CACERT_BADFILE;
1404     }
1405   }
1406
1407   /* Configure hostname check. SNI is used if available.
1408    * Both hostname check and SNI require SSLSetPeerDomainName().
1409    * Also: the verifyhost setting influences SNI usage */
1410   if(conn->ssl_config.verifyhost) {
1411     err = SSLSetPeerDomainName(connssl->ssl_ctx, hostname,
1412     strlen(hostname));
1413
1414     if(err != noErr) {
1415       infof(data, "WARNING: SSL: SSLSetPeerDomainName() failed: OSStatus %d\n",
1416             err);
1417     }
1418
1419     if((Curl_inet_pton(AF_INET, hostname, &addr))
1420   #ifdef ENABLE_IPV6
1421     || (Curl_inet_pton(AF_INET6, hostname, &addr))
1422   #endif
1423        ) {
1424       infof(data, "WARNING: using IP address, SNI is being disabled by "
1425             "the OS.\n");
1426     }
1427   }
1428
1429   /* Disable cipher suites that ST supports but are not safe. These ciphers
1430      are unlikely to be used in any case since ST gives other ciphers a much
1431      higher priority, but it's probably better that we not connect at all than
1432      to give the user a false sense of security if the server only supports
1433      insecure ciphers. (Note: We don't care about SSLv2-only ciphers.) */
1434   (void)SSLGetNumberSupportedCiphers(connssl->ssl_ctx, &all_ciphers_count);
1435   all_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite));
1436   allowed_ciphers = malloc(all_ciphers_count*sizeof(SSLCipherSuite));
1437   if(all_ciphers && allowed_ciphers &&
1438      SSLGetSupportedCiphers(connssl->ssl_ctx, all_ciphers,
1439        &all_ciphers_count) == noErr) {
1440     for(i = 0UL ; i < all_ciphers_count ; i++) {
1441 #if CURL_BUILD_MAC
1442      /* There's a known bug in early versions of Mountain Lion where ST's ECC
1443         ciphers (cipher suite 0xC001 through 0xC032) simply do not work.
1444         Work around the problem here by disabling those ciphers if we are
1445         running in an affected version of OS X. */
1446       if(darwinver_maj == 12 && darwinver_min <= 3 &&
1447          all_ciphers[i] >= 0xC001 && all_ciphers[i] <= 0xC032) {
1448         continue;
1449       }
1450 #endif /* CURL_BUILD_MAC */
1451       switch(all_ciphers[i]) {
1452         /* Disable NULL ciphersuites: */
1453         case SSL_NULL_WITH_NULL_NULL:
1454         case SSL_RSA_WITH_NULL_MD5:
1455         case SSL_RSA_WITH_NULL_SHA:
1456         case 0x003B: /* TLS_RSA_WITH_NULL_SHA256 */
1457         case SSL_FORTEZZA_DMS_WITH_NULL_SHA:
1458         case 0xC001: /* TLS_ECDH_ECDSA_WITH_NULL_SHA */
1459         case 0xC006: /* TLS_ECDHE_ECDSA_WITH_NULL_SHA */
1460         case 0xC00B: /* TLS_ECDH_RSA_WITH_NULL_SHA */
1461         case 0xC010: /* TLS_ECDHE_RSA_WITH_NULL_SHA */
1462         case 0x002C: /* TLS_PSK_WITH_NULL_SHA */
1463         case 0x002D: /* TLS_DHE_PSK_WITH_NULL_SHA */
1464         case 0x002E: /* TLS_RSA_PSK_WITH_NULL_SHA */
1465         case 0x00B0: /* TLS_PSK_WITH_NULL_SHA256 */
1466         case 0x00B1: /* TLS_PSK_WITH_NULL_SHA384 */
1467         case 0x00B4: /* TLS_DHE_PSK_WITH_NULL_SHA256 */
1468         case 0x00B5: /* TLS_DHE_PSK_WITH_NULL_SHA384 */
1469         case 0x00B8: /* TLS_RSA_PSK_WITH_NULL_SHA256 */
1470         case 0x00B9: /* TLS_RSA_PSK_WITH_NULL_SHA384 */
1471         /* Disable anonymous ciphersuites: */
1472         case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5:
1473         case SSL_DH_anon_WITH_RC4_128_MD5:
1474         case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA:
1475         case SSL_DH_anon_WITH_DES_CBC_SHA:
1476         case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA:
1477         case TLS_DH_anon_WITH_AES_128_CBC_SHA:
1478         case TLS_DH_anon_WITH_AES_256_CBC_SHA:
1479         case 0xC015: /* TLS_ECDH_anon_WITH_NULL_SHA */
1480         case 0xC016: /* TLS_ECDH_anon_WITH_RC4_128_SHA */
1481         case 0xC017: /* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA */
1482         case 0xC018: /* TLS_ECDH_anon_WITH_AES_128_CBC_SHA */
1483         case 0xC019: /* TLS_ECDH_anon_WITH_AES_256_CBC_SHA */
1484         case 0x006C: /* TLS_DH_anon_WITH_AES_128_CBC_SHA256 */
1485         case 0x006D: /* TLS_DH_anon_WITH_AES_256_CBC_SHA256 */
1486         case 0x00A6: /* TLS_DH_anon_WITH_AES_128_GCM_SHA256 */
1487         case 0x00A7: /* TLS_DH_anon_WITH_AES_256_GCM_SHA384 */
1488         /* Disable weak key ciphersuites: */
1489         case SSL_RSA_EXPORT_WITH_RC4_40_MD5:
1490         case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5:
1491         case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA:
1492         case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA:
1493         case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA:
1494         case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA:
1495         case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA:
1496         case SSL_RSA_WITH_DES_CBC_SHA:
1497         case SSL_DH_DSS_WITH_DES_CBC_SHA:
1498         case SSL_DH_RSA_WITH_DES_CBC_SHA:
1499         case SSL_DHE_DSS_WITH_DES_CBC_SHA:
1500         case SSL_DHE_RSA_WITH_DES_CBC_SHA:
1501         /* Disable IDEA: */
1502         case SSL_RSA_WITH_IDEA_CBC_SHA:
1503         case SSL_RSA_WITH_IDEA_CBC_MD5:
1504         /* Disable RC4: */
1505         case SSL_RSA_WITH_RC4_128_MD5:
1506         case SSL_RSA_WITH_RC4_128_SHA:
1507         case 0xC002: /* TLS_ECDH_ECDSA_WITH_RC4_128_SHA */
1508         case 0xC007: /* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA*/
1509         case 0xC00C: /* TLS_ECDH_RSA_WITH_RC4_128_SHA */
1510         case 0xC011: /* TLS_ECDHE_RSA_WITH_RC4_128_SHA */
1511         case 0x008A: /* TLS_PSK_WITH_RC4_128_SHA */
1512         case 0x008E: /* TLS_DHE_PSK_WITH_RC4_128_SHA */
1513         case 0x0092: /* TLS_RSA_PSK_WITH_RC4_128_SHA */
1514           break;
1515         default: /* enable everything else */
1516           allowed_ciphers[allowed_ciphers_count++] = all_ciphers[i];
1517           break;
1518       }
1519     }
1520     err = SSLSetEnabledCiphers(connssl->ssl_ctx, allowed_ciphers,
1521                                allowed_ciphers_count);
1522     if(err != noErr) {
1523       failf(data, "SSL: SSLSetEnabledCiphers() failed: OSStatus %d", err);
1524       return CURLE_SSL_CONNECT_ERROR;
1525     }
1526   }
1527   else {
1528     Curl_safefree(all_ciphers);
1529     Curl_safefree(allowed_ciphers);
1530     failf(data, "SSL: Failed to allocate memory for allowed ciphers");
1531     return CURLE_OUT_OF_MEMORY;
1532   }
1533   Curl_safefree(all_ciphers);
1534   Curl_safefree(allowed_ciphers);
1535
1536 #if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
1537   /* We want to enable 1/n-1 when using a CBC cipher unless the user
1538      specifically doesn't want us doing that: */
1539   if(SSLSetSessionOption != NULL) {
1540     /* TODO s/data->set.ssl.enable_beast/SSL_SET_OPTION(enable_beast)/g */
1541     SSLSetSessionOption(connssl->ssl_ctx, kSSLSessionOptionSendOneByteRecord,
1542                       !data->set.ssl.enable_beast);
1543     SSLSetSessionOption(connssl->ssl_ctx, kSSLSessionOptionFalseStart,
1544                       data->set.ssl.falsestart); /* false start support */
1545   }
1546 #endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
1547
1548   /* Check if there's a cached ID we can/should use here! */
1549   if(data->set.general_ssl.sessionid) {
1550     char *ssl_sessionid;
1551     size_t ssl_sessionid_len;
1552
1553     Curl_ssl_sessionid_lock(conn);
1554     if(!Curl_ssl_getsessionid(conn, (void **)&ssl_sessionid,
1555                               &ssl_sessionid_len, sockindex)) {
1556       /* we got a session id, use it! */
1557       err = SSLSetPeerID(connssl->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
1558       Curl_ssl_sessionid_unlock(conn);
1559       if(err != noErr) {
1560         failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err);
1561         return CURLE_SSL_CONNECT_ERROR;
1562       }
1563       /* Informational message */
1564       infof(data, "SSL re-using session ID\n");
1565     }
1566     /* If there isn't one, then let's make one up! This has to be done prior
1567        to starting the handshake. */
1568     else {
1569       CURLcode result;
1570       ssl_sessionid =
1571         aprintf("%s:%d:%d:%s:%hu", ssl_cafile,
1572                 verifypeer, SSL_CONN_CONFIG(verifyhost), hostname, port);
1573       ssl_sessionid_len = strlen(ssl_sessionid);
1574
1575       err = SSLSetPeerID(connssl->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
1576       if(err != noErr) {
1577         Curl_ssl_sessionid_unlock(conn);
1578         failf(data, "SSL: SSLSetPeerID() failed: OSStatus %d", err);
1579         return CURLE_SSL_CONNECT_ERROR;
1580       }
1581
1582       result = Curl_ssl_addsessionid(conn, ssl_sessionid, ssl_sessionid_len,
1583                                      sockindex);
1584       Curl_ssl_sessionid_unlock(conn);
1585       if(result) {
1586         failf(data, "failed to store ssl session");
1587         return result;
1588       }
1589     }
1590   }
1591
1592   err = SSLSetIOFuncs(connssl->ssl_ctx, SocketRead, SocketWrite);
1593   if(err != noErr) {
1594     failf(data, "SSL: SSLSetIOFuncs() failed: OSStatus %d", err);
1595     return CURLE_SSL_CONNECT_ERROR;
1596   }
1597
1598   /* pass the raw socket into the SSL layers */
1599   /* We need to store the FD in a constant memory address, because
1600    * SSLSetConnection() will not copy that address. I've found that
1601    * conn->sock[sockindex] may change on its own. */
1602   connssl->ssl_sockfd = sockfd;
1603   err = SSLSetConnection(connssl->ssl_ctx, connssl);
1604   if(err != noErr) {
1605     failf(data, "SSL: SSLSetConnection() failed: %d", err);
1606     return CURLE_SSL_CONNECT_ERROR;
1607   }
1608
1609   connssl->connecting_state = ssl_connect_2;
1610   return CURLE_OK;
1611 }
1612
1613 static long pem_to_der(const char *in, unsigned char **out, size_t *outlen)
1614 {
1615   char *sep_start, *sep_end, *cert_start, *cert_end;
1616   size_t i, j, err;
1617   size_t len;
1618   unsigned char *b64;
1619
1620   /* Jump through the separators at the beginning of the certificate. */
1621   sep_start = strstr(in, "-----");
1622   if(sep_start == NULL)
1623     return 0;
1624   cert_start = strstr(sep_start + 1, "-----");
1625   if(cert_start == NULL)
1626     return -1;
1627
1628   cert_start += 5;
1629
1630   /* Find separator after the end of the certificate. */
1631   cert_end = strstr(cert_start, "-----");
1632   if(cert_end == NULL)
1633     return -1;
1634
1635   sep_end = strstr(cert_end + 1, "-----");
1636   if(sep_end == NULL)
1637     return -1;
1638   sep_end += 5;
1639
1640   len = cert_end - cert_start;
1641   b64 = malloc(len + 1);
1642   if(!b64)
1643     return -1;
1644
1645   /* Create base64 string without linefeeds. */
1646   for(i = 0, j = 0; i < len; i++) {
1647     if(cert_start[i] != '\r' && cert_start[i] != '\n')
1648       b64[j++] = cert_start[i];
1649   }
1650   b64[j] = '\0';
1651
1652   err = Curl_base64_decode((const char *)b64, out, outlen);
1653   free(b64);
1654   if(err) {
1655     free(*out);
1656     return -1;
1657   }
1658
1659   return sep_end - in;
1660 }
1661
1662 static int read_cert(const char *file, unsigned char **out, size_t *outlen)
1663 {
1664   int fd;
1665   ssize_t n, len = 0, cap = 512;
1666   unsigned char buf[cap], *data;
1667
1668   fd = open(file, 0);
1669   if(fd < 0)
1670     return -1;
1671
1672   data = malloc(cap);
1673   if(!data) {
1674     close(fd);
1675     return -1;
1676   }
1677
1678   for(;;) {
1679     n = read(fd, buf, sizeof(buf));
1680     if(n < 0) {
1681       close(fd);
1682       free(data);
1683       return -1;
1684     }
1685     else if(n == 0) {
1686       close(fd);
1687       break;
1688     }
1689
1690     if(len + n >= cap) {
1691       cap *= 2;
1692       data = realloc(data, cap);
1693       if(!data) {
1694         close(fd);
1695         return -1;
1696       }
1697     }
1698
1699     memcpy(data + len, buf, n);
1700     len += n;
1701   }
1702   data[len] = '\0';
1703
1704   *out = data;
1705   *outlen = len;
1706
1707   return 0;
1708 }
1709
1710 static int sslerr_to_curlerr(struct Curl_easy *data, int err)
1711 {
1712   switch(err) {
1713     case errSSLXCertChainInvalid:
1714       failf(data, "SSL certificate problem: Invalid certificate chain");
1715       return CURLE_SSL_CACERT;
1716     case errSSLUnknownRootCert:
1717       failf(data, "SSL certificate problem: Untrusted root certificate");
1718       return CURLE_SSL_CACERT;
1719     case errSSLNoRootCert:
1720       failf(data, "SSL certificate problem: No root certificate");
1721       return CURLE_SSL_CACERT;
1722     case errSSLCertExpired:
1723       failf(data, "SSL certificate problem: Certificate chain had an "
1724             "expired certificate");
1725       return CURLE_SSL_CACERT;
1726     case errSSLBadCert:
1727       failf(data, "SSL certificate problem: Couldn't understand the server "
1728             "certificate format");
1729       return CURLE_SSL_CONNECT_ERROR;
1730     case errSSLHostNameMismatch:
1731       failf(data, "SSL certificate peer hostname mismatch");
1732       return CURLE_PEER_FAILED_VERIFICATION;
1733     default:
1734       failf(data, "SSL unexpected certificate error %d", err);
1735       return CURLE_SSL_CACERT;
1736   }
1737 }
1738
1739 static int append_cert_to_array(struct Curl_easy *data,
1740                                 unsigned char *buf, size_t buflen,
1741                                 CFMutableArrayRef array)
1742 {
1743     CFDataRef certdata = CFDataCreate(kCFAllocatorDefault, buf, buflen);
1744     if(!certdata) {
1745       failf(data, "SSL: failed to allocate array for CA certificate");
1746       return CURLE_OUT_OF_MEMORY;
1747     }
1748
1749     SecCertificateRef cacert =
1750       SecCertificateCreateWithData(kCFAllocatorDefault, certdata);
1751     CFRelease(certdata);
1752     if(!cacert) {
1753       failf(data, "SSL: failed to create SecCertificate from CA certificate");
1754       return CURLE_SSL_CACERT;
1755     }
1756
1757     /* Check if cacert is valid. */
1758     CFStringRef subject = CopyCertSubject(cacert);
1759     if(subject) {
1760       char subject_cbuf[128];
1761       memset(subject_cbuf, 0, 128);
1762       if(!CFStringGetCString(subject,
1763                             subject_cbuf,
1764                             128,
1765                             kCFStringEncodingUTF8)) {
1766         CFRelease(cacert);
1767         failf(data, "SSL: invalid CA certificate subject");
1768         return CURLE_SSL_CACERT;
1769       }
1770       CFRelease(subject);
1771     }
1772     else {
1773       CFRelease(cacert);
1774       failf(data, "SSL: invalid CA certificate");
1775       return CURLE_SSL_CACERT;
1776     }
1777
1778     CFArrayAppendValue(array, cacert);
1779     CFRelease(cacert);
1780
1781     return CURLE_OK;
1782 }
1783
1784 static int verify_cert(const char *cafile, struct Curl_easy *data,
1785                        SSLContextRef ctx)
1786 {
1787   int n = 0, rc;
1788   long res;
1789   unsigned char *certbuf, *der;
1790   size_t buflen, derlen, offset = 0;
1791
1792   if(read_cert(cafile, &certbuf, &buflen) < 0) {
1793     failf(data, "SSL: failed to read or invalid CA certificate");
1794     return CURLE_SSL_CACERT;
1795   }
1796
1797   /*
1798    * Certbuf now contains the contents of the certificate file, which can be
1799    * - a single DER certificate,
1800    * - a single PEM certificate or
1801    * - a bunch of PEM certificates (certificate bundle).
1802    *
1803    * Go through certbuf, and convert any PEM certificate in it into DER
1804    * format.
1805    */
1806   CFMutableArrayRef array = CFArrayCreateMutable(kCFAllocatorDefault, 0,
1807                                                  &kCFTypeArrayCallBacks);
1808   if(array == NULL) {
1809     free(certbuf);
1810     failf(data, "SSL: out of memory creating CA certificate array");
1811     return CURLE_OUT_OF_MEMORY;
1812   }
1813
1814   while(offset < buflen) {
1815     n++;
1816
1817     /*
1818      * Check if the certificate is in PEM format, and convert it to DER. If
1819      * this fails, we assume the certificate is in DER format.
1820      */
1821     res = pem_to_der((const char *)certbuf + offset, &der, &derlen);
1822     if(res < 0) {
1823       free(certbuf);
1824       CFRelease(array);
1825       failf(data, "SSL: invalid CA certificate #%d (offset %d) in bundle",
1826             n, offset);
1827       return CURLE_SSL_CACERT;
1828     }
1829     offset += res;
1830
1831     if(res == 0 && offset == 0) {
1832       /* This is not a PEM file, probably a certificate in DER format. */
1833       rc = append_cert_to_array(data, certbuf, buflen, array);
1834       free(certbuf);
1835       if(rc != CURLE_OK) {
1836         CFRelease(array);
1837         return rc;
1838       }
1839       break;
1840     }
1841     else if(res == 0) {
1842       /* No more certificates in the bundle. */
1843       free(certbuf);
1844       break;
1845     }
1846
1847     rc = append_cert_to_array(data, der, derlen, array);
1848     free(der);
1849     if(rc != CURLE_OK) {
1850       free(certbuf);
1851       CFRelease(array);
1852       return rc;
1853     }
1854   }
1855
1856   SecTrustRef trust;
1857   OSStatus ret = SSLCopyPeerTrust(ctx, &trust);
1858   if(trust == NULL) {
1859     failf(data, "SSL: error getting certificate chain");
1860     CFRelease(array);
1861     return CURLE_OUT_OF_MEMORY;
1862   }
1863   else if(ret != noErr) {
1864     CFRelease(array);
1865     return sslerr_to_curlerr(data, ret);
1866   }
1867
1868   ret = SecTrustSetAnchorCertificates(trust, array);
1869   if(ret != noErr) {
1870     CFRelease(trust);
1871     return sslerr_to_curlerr(data, ret);
1872   }
1873   ret = SecTrustSetAnchorCertificatesOnly(trust, true);
1874   if(ret != noErr) {
1875     CFRelease(trust);
1876     return sslerr_to_curlerr(data, ret);
1877   }
1878
1879   SecTrustResultType trust_eval = 0;
1880   ret = SecTrustEvaluate(trust, &trust_eval);
1881   CFRelease(array);
1882   CFRelease(trust);
1883   if(ret != noErr) {
1884     return sslerr_to_curlerr(data, ret);
1885   }
1886
1887   switch(trust_eval) {
1888     case kSecTrustResultUnspecified:
1889     case kSecTrustResultProceed:
1890       return CURLE_OK;
1891
1892     case kSecTrustResultRecoverableTrustFailure:
1893     case kSecTrustResultDeny:
1894     default:
1895       failf(data, "SSL: certificate verification failed (result: %d)",
1896             trust_eval);
1897       return CURLE_PEER_FAILED_VERIFICATION;
1898   }
1899 }
1900
1901 static CURLcode
1902 darwinssl_connect_step2(struct connectdata *conn, int sockindex)
1903 {
1904   struct Curl_easy *data = conn->data;
1905   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
1906   OSStatus err;
1907   SSLCipherSuite cipher;
1908   SSLProtocol protocol = 0;
1909   const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
1910     conn->host.name;
1911
1912   DEBUGASSERT(ssl_connect_2 == connssl->connecting_state
1913               || ssl_connect_2_reading == connssl->connecting_state
1914               || ssl_connect_2_writing == connssl->connecting_state);
1915
1916   /* Here goes nothing: */
1917   err = SSLHandshake(connssl->ssl_ctx);
1918
1919   if(err != noErr) {
1920     switch(err) {
1921       case errSSLWouldBlock:  /* they're not done with us yet */
1922         connssl->connecting_state = connssl->ssl_direction ?
1923             ssl_connect_2_writing : ssl_connect_2_reading;
1924         return CURLE_OK;
1925
1926       /* The below is errSSLServerAuthCompleted; it's not defined in
1927         Leopard's headers */
1928       case -9841:
1929         if(SSL_CONN_CONFIG(CAfile) && SSL_CONN_CONFIG(verifypeer)) {
1930           int res = verify_cert(SSL_CONN_CONFIG(CAfile), data,
1931                                 connssl->ssl_ctx);
1932           if(res != CURLE_OK)
1933             return res;
1934         }
1935         /* the documentation says we need to call SSLHandshake() again */
1936         return darwinssl_connect_step2(conn, sockindex);
1937
1938       /* These are all certificate problems with the server: */
1939       case errSSLXCertChainInvalid:
1940         failf(data, "SSL certificate problem: Invalid certificate chain");
1941         return CURLE_SSL_CACERT;
1942       case errSSLUnknownRootCert:
1943         failf(data, "SSL certificate problem: Untrusted root certificate");
1944         return CURLE_SSL_CACERT;
1945       case errSSLNoRootCert:
1946         failf(data, "SSL certificate problem: No root certificate");
1947         return CURLE_SSL_CACERT;
1948       case errSSLCertExpired:
1949         failf(data, "SSL certificate problem: Certificate chain had an "
1950               "expired certificate");
1951         return CURLE_SSL_CACERT;
1952       case errSSLBadCert:
1953         failf(data, "SSL certificate problem: Couldn't understand the server "
1954               "certificate format");
1955         return CURLE_SSL_CONNECT_ERROR;
1956
1957       /* These are all certificate problems with the client: */
1958       case errSecAuthFailed:
1959         failf(data, "SSL authentication failed");
1960         return CURLE_SSL_CONNECT_ERROR;
1961       case errSSLPeerHandshakeFail:
1962         failf(data, "SSL peer handshake failed, the server most likely "
1963               "requires a client certificate to connect");
1964         return CURLE_SSL_CONNECT_ERROR;
1965       case errSSLPeerUnknownCA:
1966         failf(data, "SSL server rejected the client certificate due to "
1967               "the certificate being signed by an unknown certificate "
1968               "authority");
1969         return CURLE_SSL_CONNECT_ERROR;
1970
1971       /* This error is raised if the server's cert didn't match the server's
1972          host name: */
1973       case errSSLHostNameMismatch:
1974         failf(data, "SSL certificate peer verification failed, the "
1975               "certificate did not match \"%s\"\n", conn->host.dispname);
1976         return CURLE_PEER_FAILED_VERIFICATION;
1977
1978       /* Generic handshake errors: */
1979       case errSSLConnectionRefused:
1980         failf(data, "Server dropped the connection during the SSL handshake");
1981         return CURLE_SSL_CONNECT_ERROR;
1982       case errSSLClosedAbort:
1983         failf(data, "Server aborted the SSL handshake");
1984         return CURLE_SSL_CONNECT_ERROR;
1985       case errSSLNegotiation:
1986         failf(data, "Could not negotiate an SSL cipher suite with the server");
1987         return CURLE_SSL_CONNECT_ERROR;
1988       /* Sometimes paramErr happens with buggy ciphers: */
1989       case paramErr: case errSSLInternal:
1990         failf(data, "Internal SSL engine error encountered during the "
1991               "SSL handshake");
1992         return CURLE_SSL_CONNECT_ERROR;
1993       case errSSLFatalAlert:
1994         failf(data, "Fatal SSL engine error encountered during the SSL "
1995               "handshake");
1996         return CURLE_SSL_CONNECT_ERROR;
1997       default:
1998         failf(data, "Unknown SSL protocol error in connection to %s:%d",
1999               hostname, err);
2000         return CURLE_SSL_CONNECT_ERROR;
2001     }
2002   }
2003   else {
2004     /* we have been connected fine, we're not waiting for anything else. */
2005     connssl->connecting_state = ssl_connect_3;
2006
2007     /* Informational message */
2008     (void)SSLGetNegotiatedCipher(connssl->ssl_ctx, &cipher);
2009     (void)SSLGetNegotiatedProtocolVersion(connssl->ssl_ctx, &protocol);
2010     switch(protocol) {
2011       case kSSLProtocol2:
2012         infof(data, "SSL 2.0 connection using %s\n",
2013               SSLCipherNameForNumber(cipher));
2014         break;
2015       case kSSLProtocol3:
2016         infof(data, "SSL 3.0 connection using %s\n",
2017               SSLCipherNameForNumber(cipher));
2018         break;
2019       case kTLSProtocol1:
2020         infof(data, "TLS 1.0 connection using %s\n",
2021               TLSCipherNameForNumber(cipher));
2022         break;
2023 #if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
2024       case kTLSProtocol11:
2025         infof(data, "TLS 1.1 connection using %s\n",
2026               TLSCipherNameForNumber(cipher));
2027         break;
2028       case kTLSProtocol12:
2029         infof(data, "TLS 1.2 connection using %s\n",
2030               TLSCipherNameForNumber(cipher));
2031         break;
2032 #endif
2033       default:
2034         infof(data, "Unknown protocol connection\n");
2035         break;
2036     }
2037
2038     return CURLE_OK;
2039   }
2040 }
2041
2042 #ifndef CURL_DISABLE_VERBOSE_STRINGS
2043 /* This should be called during step3 of the connection at the earliest */
2044 static void
2045 show_verbose_server_cert(struct connectdata *conn,
2046                          int sockindex)
2047 {
2048   struct Curl_easy *data = conn->data;
2049   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
2050   CFStringRef server_cert_summary;
2051   char server_cert_summary_c[128];
2052   CFArrayRef server_certs = NULL;
2053   SecCertificateRef server_cert;
2054   OSStatus err;
2055   CFIndex i, count;
2056   SecTrustRef trust = NULL;
2057
2058   if(!connssl->ssl_ctx)
2059     return;
2060
2061 #if CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS
2062 #if CURL_BUILD_IOS
2063 #pragma unused(server_certs)
2064   err = SSLCopyPeerTrust(connssl->ssl_ctx, &trust);
2065   /* For some reason, SSLCopyPeerTrust() can return noErr and yet return
2066      a null trust, so be on guard for that: */
2067   if(err == noErr && trust) {
2068     count = SecTrustGetCertificateCount(trust);
2069     for(i = 0L ; i < count ; i++) {
2070       server_cert = SecTrustGetCertificateAtIndex(trust, i);
2071       server_cert_summary = CopyCertSubject(server_cert);
2072       memset(server_cert_summary_c, 0, 128);
2073       if(CFStringGetCString(server_cert_summary,
2074                             server_cert_summary_c,
2075                             128,
2076                             kCFStringEncodingUTF8)) {
2077         infof(data, "Server certificate: %s\n", server_cert_summary_c);
2078       }
2079       CFRelease(server_cert_summary);
2080     }
2081     CFRelease(trust);
2082   }
2083 #else
2084   /* SSLCopyPeerCertificates() is deprecated as of Mountain Lion.
2085      The function SecTrustGetCertificateAtIndex() is officially present
2086      in Lion, but it is unfortunately also present in Snow Leopard as
2087      private API and doesn't work as expected. So we have to look for
2088      a different symbol to make sure this code is only executed under
2089      Lion or later. */
2090   if(SecTrustEvaluateAsync != NULL) {
2091 #pragma unused(server_certs)
2092     err = SSLCopyPeerTrust(connssl->ssl_ctx, &trust);
2093     /* For some reason, SSLCopyPeerTrust() can return noErr and yet return
2094        a null trust, so be on guard for that: */
2095     if(err == noErr && trust) {
2096       count = SecTrustGetCertificateCount(trust);
2097       for(i = 0L ; i < count ; i++) {
2098         server_cert = SecTrustGetCertificateAtIndex(trust, i);
2099         server_cert_summary = CopyCertSubject(server_cert);
2100         memset(server_cert_summary_c, 0, 128);
2101         if(CFStringGetCString(server_cert_summary,
2102                               server_cert_summary_c,
2103                               128,
2104                               kCFStringEncodingUTF8)) {
2105           infof(data, "Server certificate: %s\n", server_cert_summary_c);
2106         }
2107         CFRelease(server_cert_summary);
2108       }
2109       CFRelease(trust);
2110     }
2111   }
2112   else {
2113 #if CURL_SUPPORT_MAC_10_8
2114     err = SSLCopyPeerCertificates(connssl->ssl_ctx, &server_certs);
2115     /* Just in case SSLCopyPeerCertificates() returns null too... */
2116     if(err == noErr && server_certs) {
2117       count = CFArrayGetCount(server_certs);
2118       for(i = 0L ; i < count ; i++) {
2119         server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs,
2120                                                                 i);
2121
2122         server_cert_summary = CopyCertSubject(server_cert);
2123         memset(server_cert_summary_c, 0, 128);
2124         if(CFStringGetCString(server_cert_summary,
2125                               server_cert_summary_c,
2126                               128,
2127                               kCFStringEncodingUTF8)) {
2128           infof(data, "Server certificate: %s\n", server_cert_summary_c);
2129         }
2130         CFRelease(server_cert_summary);
2131       }
2132       CFRelease(server_certs);
2133     }
2134 #endif /* CURL_SUPPORT_MAC_10_8 */
2135   }
2136 #endif /* CURL_BUILD_IOS */
2137 #else
2138 #pragma unused(trust)
2139   err = SSLCopyPeerCertificates(connssl->ssl_ctx, &server_certs);
2140   if(err == noErr) {
2141     count = CFArrayGetCount(server_certs);
2142     for(i = 0L ; i < count ; i++) {
2143       server_cert = (SecCertificateRef)CFArrayGetValueAtIndex(server_certs, i);
2144       server_cert_summary = CopyCertSubject(server_cert);
2145       memset(server_cert_summary_c, 0, 128);
2146       if(CFStringGetCString(server_cert_summary,
2147                             server_cert_summary_c,
2148                             128,
2149                             kCFStringEncodingUTF8)) {
2150         infof(data, "Server certificate: %s\n", server_cert_summary_c);
2151       }
2152       CFRelease(server_cert_summary);
2153     }
2154     CFRelease(server_certs);
2155   }
2156 #endif /* CURL_BUILD_MAC_10_7 || CURL_BUILD_IOS */
2157 }
2158 #endif /* !CURL_DISABLE_VERBOSE_STRINGS */
2159
2160 static CURLcode
2161 darwinssl_connect_step3(struct connectdata *conn,
2162                         int sockindex)
2163 {
2164   struct Curl_easy *data = conn->data;
2165   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
2166
2167   /* There is no step 3!
2168    * Well, okay, if verbose mode is on, let's print the details of the
2169    * server certificates. */
2170 #ifndef CURL_DISABLE_VERBOSE_STRINGS
2171   if(data->set.verbose)
2172     show_verbose_server_cert(conn, sockindex);
2173 #endif
2174
2175   connssl->connecting_state = ssl_connect_done;
2176   return CURLE_OK;
2177 }
2178
2179 static Curl_recv darwinssl_recv;
2180 static Curl_send darwinssl_send;
2181
2182 static CURLcode
2183 darwinssl_connect_common(struct connectdata *conn,
2184                          int sockindex,
2185                          bool nonblocking,
2186                          bool *done)
2187 {
2188   CURLcode result;
2189   struct Curl_easy *data = conn->data;
2190   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
2191   curl_socket_t sockfd = conn->sock[sockindex];
2192   long timeout_ms;
2193   int what;
2194
2195   /* check if the connection has already been established */
2196   if(ssl_connection_complete == connssl->state) {
2197     *done = TRUE;
2198     return CURLE_OK;
2199   }
2200
2201   if(ssl_connect_1==connssl->connecting_state) {
2202     /* Find out how much more time we're allowed */
2203     timeout_ms = Curl_timeleft(data, NULL, TRUE);
2204
2205     if(timeout_ms < 0) {
2206       /* no need to continue if time already is up */
2207       failf(data, "SSL connection timeout");
2208       return CURLE_OPERATION_TIMEDOUT;
2209     }
2210
2211     result = darwinssl_connect_step1(conn, sockindex);
2212     if(result)
2213       return result;
2214   }
2215
2216   while(ssl_connect_2 == connssl->connecting_state ||
2217         ssl_connect_2_reading == connssl->connecting_state ||
2218         ssl_connect_2_writing == connssl->connecting_state) {
2219
2220     /* check allowed time left */
2221     timeout_ms = Curl_timeleft(data, NULL, TRUE);
2222
2223     if(timeout_ms < 0) {
2224       /* no need to continue if time already is up */
2225       failf(data, "SSL connection timeout");
2226       return CURLE_OPERATION_TIMEDOUT;
2227     }
2228
2229     /* if ssl is expecting something, check if it's available. */
2230     if(connssl->connecting_state == ssl_connect_2_reading ||
2231        connssl->connecting_state == ssl_connect_2_writing) {
2232
2233       curl_socket_t writefd = ssl_connect_2_writing ==
2234       connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
2235       curl_socket_t readfd = ssl_connect_2_reading ==
2236       connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
2237
2238       what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
2239                                nonblocking?0:timeout_ms);
2240       if(what < 0) {
2241         /* fatal error */
2242         failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
2243         return CURLE_SSL_CONNECT_ERROR;
2244       }
2245       else if(0 == what) {
2246         if(nonblocking) {
2247           *done = FALSE;
2248           return CURLE_OK;
2249         }
2250         else {
2251           /* timeout */
2252           failf(data, "SSL connection timeout");
2253           return CURLE_OPERATION_TIMEDOUT;
2254         }
2255       }
2256       /* socket is readable or writable */
2257     }
2258
2259     /* Run transaction, and return to the caller if it failed or if this
2260      * connection is done nonblocking and this loop would execute again. This
2261      * permits the owner of a multi handle to abort a connection attempt
2262      * before step2 has completed while ensuring that a client using select()
2263      * or epoll() will always have a valid fdset to wait on.
2264      */
2265     result = darwinssl_connect_step2(conn, sockindex);
2266     if(result || (nonblocking &&
2267                   (ssl_connect_2 == connssl->connecting_state ||
2268                    ssl_connect_2_reading == connssl->connecting_state ||
2269                    ssl_connect_2_writing == connssl->connecting_state)))
2270       return result;
2271
2272   } /* repeat step2 until all transactions are done. */
2273
2274
2275   if(ssl_connect_3 == connssl->connecting_state) {
2276     result = darwinssl_connect_step3(conn, sockindex);
2277     if(result)
2278       return result;
2279   }
2280
2281   if(ssl_connect_done == connssl->connecting_state) {
2282     connssl->state = ssl_connection_complete;
2283     conn->recv[sockindex] = darwinssl_recv;
2284     conn->send[sockindex] = darwinssl_send;
2285     *done = TRUE;
2286   }
2287   else
2288     *done = FALSE;
2289
2290   /* Reset our connect state machine */
2291   connssl->connecting_state = ssl_connect_1;
2292
2293   return CURLE_OK;
2294 }
2295
2296 CURLcode
2297 Curl_darwinssl_connect_nonblocking(struct connectdata *conn,
2298                                    int sockindex,
2299                                    bool *done)
2300 {
2301   return darwinssl_connect_common(conn, sockindex, TRUE, done);
2302 }
2303
2304 CURLcode
2305 Curl_darwinssl_connect(struct connectdata *conn,
2306                        int sockindex)
2307 {
2308   CURLcode result;
2309   bool done = FALSE;
2310
2311   result = darwinssl_connect_common(conn, sockindex, FALSE, &done);
2312
2313   if(result)
2314     return result;
2315
2316   DEBUGASSERT(done);
2317
2318   return CURLE_OK;
2319 }
2320
2321 void Curl_darwinssl_close(struct connectdata *conn, int sockindex)
2322 {
2323   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
2324
2325   if(connssl->ssl_ctx) {
2326     (void)SSLClose(connssl->ssl_ctx);
2327 #if CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS
2328     if(SSLCreateContext != NULL)
2329       CFRelease(connssl->ssl_ctx);
2330 #if CURL_SUPPORT_MAC_10_8
2331     else
2332       (void)SSLDisposeContext(connssl->ssl_ctx);
2333 #endif  /* CURL_SUPPORT_MAC_10_8 */
2334 #else
2335     (void)SSLDisposeContext(connssl->ssl_ctx);
2336 #endif /* CURL_BUILD_MAC_10_8 || CURL_BUILD_IOS */
2337     connssl->ssl_ctx = NULL;
2338   }
2339   connssl->ssl_sockfd = 0;
2340 }
2341
2342 int Curl_darwinssl_shutdown(struct connectdata *conn, int sockindex)
2343 {
2344   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
2345   struct Curl_easy *data = conn->data;
2346   ssize_t nread;
2347   int what;
2348   int rc;
2349   char buf[120];
2350
2351   if(!connssl->ssl_ctx)
2352     return 0;
2353
2354   if(data->set.ftp_ccc != CURLFTPSSL_CCC_ACTIVE)
2355     return 0;
2356
2357   Curl_darwinssl_close(conn, sockindex);
2358
2359   rc = 0;
2360
2361   what = SOCKET_READABLE(conn->sock[sockindex], SSL_SHUTDOWN_TIMEOUT);
2362
2363   for(;;) {
2364     if(what < 0) {
2365       /* anything that gets here is fatally bad */
2366       failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
2367       rc = -1;
2368       break;
2369     }
2370
2371     if(!what) {                                /* timeout */
2372       failf(data, "SSL shutdown timeout");
2373       break;
2374     }
2375
2376     /* Something to read, let's do it and hope that it is the close
2377      notify alert from the server. No way to SSL_Read now, so use read(). */
2378
2379     nread = read(conn->sock[sockindex], buf, sizeof(buf));
2380
2381     if(nread < 0) {
2382       failf(data, "read: %s", strerror(errno));
2383       rc = -1;
2384     }
2385
2386     if(nread <= 0)
2387       break;
2388
2389     what = SOCKET_READABLE(conn->sock[sockindex], 0);
2390   }
2391
2392   return rc;
2393 }
2394
2395 void Curl_darwinssl_session_free(void *ptr)
2396 {
2397   /* ST, as of iOS 5 and Mountain Lion, has no public method of deleting a
2398      cached session ID inside the Security framework. There is a private
2399      function that does this, but I don't want to have to explain to you why I
2400      got your application rejected from the App Store due to the use of a
2401      private API, so the best we can do is free up our own char array that we
2402      created way back in darwinssl_connect_step1... */
2403   Curl_safefree(ptr);
2404 }
2405
2406 size_t Curl_darwinssl_version(char *buffer, size_t size)
2407 {
2408   return snprintf(buffer, size, "SecureTransport");
2409 }
2410
2411 /*
2412  * This function uses SSLGetSessionState to determine connection status.
2413  *
2414  * Return codes:
2415  *     1 means the connection is still in place
2416  *     0 means the connection has been closed
2417  *    -1 means the connection status is unknown
2418  */
2419 int Curl_darwinssl_check_cxn(struct connectdata *conn)
2420 {
2421   struct ssl_connect_data *connssl = &conn->ssl[FIRSTSOCKET];
2422   OSStatus err;
2423   SSLSessionState state;
2424
2425   if(connssl->ssl_ctx) {
2426     err = SSLGetSessionState(connssl->ssl_ctx, &state);
2427     if(err == noErr)
2428       return state == kSSLConnected || state == kSSLHandshake;
2429     return -1;
2430   }
2431   return 0;
2432 }
2433
2434 bool Curl_darwinssl_data_pending(const struct connectdata *conn,
2435                                  int connindex)
2436 {
2437   const struct ssl_connect_data *connssl = &conn->ssl[connindex];
2438   OSStatus err;
2439   size_t buffer;
2440
2441   if(connssl->ssl_ctx) {  /* SSL is in use */
2442     err = SSLGetBufferedReadSize(connssl->ssl_ctx, &buffer);
2443     if(err == noErr)
2444       return buffer > 0UL;
2445     return false;
2446   }
2447   else
2448     return false;
2449 }
2450
2451 CURLcode Curl_darwinssl_random(unsigned char *entropy,
2452                                size_t length)
2453 {
2454   /* arc4random_buf() isn't available on cats older than Lion, so let's
2455      do this manually for the benefit of the older cats. */
2456   size_t i;
2457   u_int32_t random_number = 0;
2458
2459   for(i = 0 ; i < length ; i++) {
2460     if(i % sizeof(u_int32_t) == 0)
2461       random_number = arc4random();
2462     entropy[i] = random_number & 0xFF;
2463     random_number >>= 8;
2464   }
2465   i = random_number = 0;
2466   return CURLE_OK;
2467 }
2468
2469 void Curl_darwinssl_md5sum(unsigned char *tmp, /* input */
2470                            size_t tmplen,
2471                            unsigned char *md5sum, /* output */
2472                            size_t md5len)
2473 {
2474   (void)md5len;
2475   (void)CC_MD5(tmp, (CC_LONG)tmplen, md5sum);
2476 }
2477
2478 bool Curl_darwinssl_false_start(void)
2479 {
2480 #if CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7
2481   if(SSLSetSessionOption != NULL)
2482     return TRUE;
2483 #endif
2484   return FALSE;
2485 }
2486
2487 static ssize_t darwinssl_send(struct connectdata *conn,
2488                               int sockindex,
2489                               const void *mem,
2490                               size_t len,
2491                               CURLcode *curlcode)
2492 {
2493   /*struct Curl_easy *data = conn->data;*/
2494   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
2495   size_t processed = 0UL;
2496   OSStatus err;
2497
2498   /* The SSLWrite() function works a little differently than expected. The
2499      fourth argument (processed) is currently documented in Apple's
2500      documentation as: "On return, the length, in bytes, of the data actually
2501      written."
2502
2503      Now, one could interpret that as "written to the socket," but actually,
2504      it returns the amount of data that was written to a buffer internal to
2505      the SSLContextRef instead. So it's possible for SSLWrite() to return
2506      errSSLWouldBlock and a number of bytes "written" because those bytes were
2507      encrypted and written to a buffer, not to the socket.
2508
2509      So if this happens, then we need to keep calling SSLWrite() over and
2510      over again with no new data until it quits returning errSSLWouldBlock. */
2511
2512   /* Do we have buffered data to write from the last time we were called? */
2513   if(connssl->ssl_write_buffered_length) {
2514     /* Write the buffered data: */
2515     err = SSLWrite(connssl->ssl_ctx, NULL, 0UL, &processed);
2516     switch(err) {
2517       case noErr:
2518         /* processed is always going to be 0 because we didn't write to
2519            the buffer, so return how much was written to the socket */
2520         processed = connssl->ssl_write_buffered_length;
2521         connssl->ssl_write_buffered_length = 0UL;
2522         break;
2523       case errSSLWouldBlock: /* argh, try again */
2524         *curlcode = CURLE_AGAIN;
2525         return -1L;
2526       default:
2527         failf(conn->data, "SSLWrite() returned error %d", err);
2528         *curlcode = CURLE_SEND_ERROR;
2529         return -1L;
2530     }
2531   }
2532   else {
2533     /* We've got new data to write: */
2534     err = SSLWrite(connssl->ssl_ctx, mem, len, &processed);
2535     if(err != noErr) {
2536       switch(err) {
2537         case errSSLWouldBlock:
2538           /* Data was buffered but not sent, we have to tell the caller
2539              to try sending again, and remember how much was buffered */
2540           connssl->ssl_write_buffered_length = len;
2541           *curlcode = CURLE_AGAIN;
2542           return -1L;
2543         default:
2544           failf(conn->data, "SSLWrite() returned error %d", err);
2545           *curlcode = CURLE_SEND_ERROR;
2546           return -1L;
2547       }
2548     }
2549   }
2550   return (ssize_t)processed;
2551 }
2552
2553 static ssize_t darwinssl_recv(struct connectdata *conn,
2554                               int num,
2555                               char *buf,
2556                               size_t buffersize,
2557                               CURLcode *curlcode)
2558 {
2559   /*struct Curl_easy *data = conn->data;*/
2560   struct ssl_connect_data *connssl = &conn->ssl[num];
2561   size_t processed = 0UL;
2562   OSStatus err = SSLRead(connssl->ssl_ctx, buf, buffersize, &processed);
2563
2564   if(err != noErr) {
2565     switch(err) {
2566       case errSSLWouldBlock:  /* return how much we read (if anything) */
2567         if(processed)
2568           return (ssize_t)processed;
2569         *curlcode = CURLE_AGAIN;
2570         return -1L;
2571         break;
2572
2573       /* errSSLClosedGraceful - server gracefully shut down the SSL session
2574          errSSLClosedNoNotify - server hung up on us instead of sending a
2575            closure alert notice, read() is returning 0
2576          Either way, inform the caller that the server disconnected. */
2577       case errSSLClosedGraceful:
2578       case errSSLClosedNoNotify:
2579         *curlcode = CURLE_OK;
2580         return -1L;
2581         break;
2582
2583       default:
2584         failf(conn->data, "SSLRead() return error %d", err);
2585         *curlcode = CURLE_RECV_ERROR;
2586         return -1L;
2587         break;
2588     }
2589   }
2590   return (ssize_t)processed;
2591 }
2592
2593 #endif /* USE_DARWINSSL */