libcurl: update to 7.87.0

1 files changed, 1206 insertions, 1214 deletions

diff --git a/libs/libcurl/src/vtls/bearssl.c b/libs/libcurl/src/vtls/bearssl.c
index 1221ce8c84..6d53fab53c 100644
--- a/libs/libcurl/src/vtls/bearssl.c
+++ b/libs/libcurl/src/vtls/bearssl.c
@@ -1,1214 +1,1206 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) 2019 - 2022, Michael Forney, <mforney@mforney.org>
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-#include "curl_setup.h"
-
-#ifdef USE_BEARSSL
-
-#include <bearssl.h>
-
-#include "bearssl.h"
-#include "urldata.h"
-#include "sendf.h"
-#include "inet_pton.h"
-#include "vtls.h"
-#include "connect.h"
-#include "select.h"
-#include "multiif.h"
-#include "curl_printf.h"
-#include "curl_memory.h"
-#include "strcase.h"
-
-struct x509_context {
-  const br_x509_class *vtable;
-  br_x509_minimal_context minimal;
-  br_x509_decoder_context decoder;
-  bool verifyhost;
-  bool verifypeer;
-  int cert_num;
-};
-
-struct ssl_backend_data {
-  br_ssl_client_context ctx;
-  struct x509_context x509;
-  unsigned char buf[BR_SSL_BUFSIZE_BIDI];
-  br_x509_trust_anchor *anchors;
-  size_t anchors_len;
-  const char *protocols[2];
-  /* SSL client context is active */
-  bool active;
-  /* size of pending write, yet to be flushed */
-  size_t pending_write;
-};
-
-struct cafile_parser {
-  CURLcode err;
-  bool in_cert;
-  br_x509_decoder_context xc;
-  /* array of trust anchors loaded from CAfile */
-  br_x509_trust_anchor *anchors;
-  size_t anchors_len;
-  /* buffer for DN data */
-  unsigned char dn[1024];
-  size_t dn_len;
-};
-
-#define CAFILE_SOURCE_PATH 1
-#define CAFILE_SOURCE_BLOB 2
-struct cafile_source {
-  int type;
-  const char *data;
-  size_t len;
-};
-
-static void append_dn(void *ctx, const void *buf, size_t len)
-{
-  struct cafile_parser *ca = ctx;
-
-  if(ca->err != CURLE_OK || !ca->in_cert)
-    return;
-  if(sizeof(ca->dn) - ca->dn_len < len) {
-    ca->err = CURLE_FAILED_INIT;
-    return;
-  }
-  memcpy(ca->dn + ca->dn_len, buf, len);
-  ca->dn_len += len;
-}
-
-static void x509_push(void *ctx, const void *buf, size_t len)
-{
-  struct cafile_parser *ca = ctx;
-
-  if(ca->in_cert)
-    br_x509_decoder_push(&ca->xc, buf, len);
-}
-
-static CURLcode load_cafile(struct cafile_source *source,
-                            br_x509_trust_anchor **anchors,
-                            size_t *anchors_len)
-{
-  struct cafile_parser ca;
-  br_pem_decoder_context pc;
-  br_x509_trust_anchor *ta;
-  size_t ta_size;
-  br_x509_trust_anchor *new_anchors;
-  size_t new_anchors_len;
-  br_x509_pkey *pkey;
-  FILE *fp = 0;
-  unsigned char buf[BUFSIZ];
-  const unsigned char *p;
-  const char *name;
-  size_t n, i, pushed;
-
-  DEBUGASSERT(source->type == CAFILE_SOURCE_PATH
-              || source->type == CAFILE_SOURCE_BLOB);
-
-  if(source->type == CAFILE_SOURCE_PATH) {
-    fp = fopen(source->data, "rb");
-    if(!fp)
-      return CURLE_SSL_CACERT_BADFILE;
-  }
-
-  if(source->type == CAFILE_SOURCE_BLOB && source->len > (size_t)INT_MAX)
-    return CURLE_SSL_CACERT_BADFILE;
-
-  ca.err = CURLE_OK;
-  ca.in_cert = FALSE;
-  ca.anchors = NULL;
-  ca.anchors_len = 0;
-  br_pem_decoder_init(&pc);
-  br_pem_decoder_setdest(&pc, x509_push, &ca);
-  do {
-    if(source->type == CAFILE_SOURCE_PATH) {
-      n = fread(buf, 1, sizeof(buf), fp);
-      if(n == 0)
-        break;
-      p = buf;
-    }
-    else if(source->type == CAFILE_SOURCE_BLOB) {
-      n = source->len;
-      p = (unsigned char *) source->data;
-    }
-    while(n) {
-      pushed = br_pem_decoder_push(&pc, p, n);
-      if(ca.err)
-        goto fail;
-      p += pushed;
-      n -= pushed;
-
-      switch(br_pem_decoder_event(&pc)) {
-      case 0:
-        break;
-      case BR_PEM_BEGIN_OBJ:
-        name = br_pem_decoder_name(&pc);
-        if(strcmp(name, "CERTIFICATE") && strcmp(name, "X509 CERTIFICATE"))
-          break;
-        br_x509_decoder_init(&ca.xc, append_dn, &ca);
-        ca.in_cert = TRUE;
-        ca.dn_len = 0;
-        break;
-      case BR_PEM_END_OBJ:
-        if(!ca.in_cert)
-          break;
-        ca.in_cert = FALSE;
-        if(br_x509_decoder_last_error(&ca.xc)) {
-          ca.err = CURLE_SSL_CACERT_BADFILE;
-          goto fail;
-        }
-        /* add trust anchor */
-        if(ca.anchors_len == SIZE_MAX / sizeof(ca.anchors[0])) {
-          ca.err = CURLE_OUT_OF_MEMORY;
-          goto fail;
-        }
-        new_anchors_len = ca.anchors_len + 1;
-        new_anchors = realloc(ca.anchors,
-                              new_anchors_len * sizeof(ca.anchors[0]));
-        if(!new_anchors) {
-          ca.err = CURLE_OUT_OF_MEMORY;
-          goto fail;
-        }
-        ca.anchors = new_anchors;
-        ca.anchors_len = new_anchors_len;
-        ta = &ca.anchors[ca.anchors_len - 1];
-        ta->dn.data = NULL;
-        ta->flags = 0;
-        if(br_x509_decoder_isCA(&ca.xc))
-          ta->flags |= BR_X509_TA_CA;
-        pkey = br_x509_decoder_get_pkey(&ca.xc);
-        if(!pkey) {
-          ca.err = CURLE_SSL_CACERT_BADFILE;
-          goto fail;
-        }
-        ta->pkey = *pkey;
-
-        /* calculate space needed for trust anchor data */
-        ta_size = ca.dn_len;
-        switch(pkey->key_type) {
-        case BR_KEYTYPE_RSA:
-          ta_size += pkey->key.rsa.nlen + pkey->key.rsa.elen;
-          break;
-        case BR_KEYTYPE_EC:
-          ta_size += pkey->key.ec.qlen;
-          break;
-        default:
-          ca.err = CURLE_FAILED_INIT;
-          goto fail;
-        }
-
-        /* fill in trust anchor DN and public key data */
-        ta->dn.data = malloc(ta_size);
-        if(!ta->dn.data) {
-          ca.err = CURLE_OUT_OF_MEMORY;
-          goto fail;
-        }
-        memcpy(ta->dn.data, ca.dn, ca.dn_len);
-        ta->dn.len = ca.dn_len;
-        switch(pkey->key_type) {
-        case BR_KEYTYPE_RSA:
-          ta->pkey.key.rsa.n = ta->dn.data + ta->dn.len;
-          memcpy(ta->pkey.key.rsa.n, pkey->key.rsa.n, pkey->key.rsa.nlen);
-          ta->pkey.key.rsa.e = ta->pkey.key.rsa.n + ta->pkey.key.rsa.nlen;
-          memcpy(ta->pkey.key.rsa.e, pkey->key.rsa.e, pkey->key.rsa.elen);
-          break;
-        case BR_KEYTYPE_EC:
-          ta->pkey.key.ec.q = ta->dn.data + ta->dn.len;
-          memcpy(ta->pkey.key.ec.q, pkey->key.ec.q, pkey->key.ec.qlen);
-          break;
-        }
-        break;
-      default:
-        ca.err = CURLE_SSL_CACERT_BADFILE;
-        goto fail;
-      }
-    }
-  } while(source->type != CAFILE_SOURCE_BLOB);
-  if(fp && ferror(fp))
-    ca.err = CURLE_READ_ERROR;
-  else if(ca.in_cert)
-    ca.err = CURLE_SSL_CACERT_BADFILE;
-
-fail:
-  if(fp)
-    fclose(fp);
-  if(ca.err == CURLE_OK) {
-    *anchors = ca.anchors;
-    *anchors_len = ca.anchors_len;
-  }
-  else {
-    for(i = 0; i < ca.anchors_len; ++i)
-      free(ca.anchors[i].dn.data);
-    free(ca.anchors);
-  }
-
-  return ca.err;
-}
-
-static void x509_start_chain(const br_x509_class **ctx,
-                             const char *server_name)
-{
-  struct x509_context *x509 = (struct x509_context *)ctx;
-
-  if(!x509->verifypeer) {
-    x509->cert_num = 0;
-    return;
-  }
-
-  if(!x509->verifyhost)
-    server_name = NULL;
-  x509->minimal.vtable->start_chain(&x509->minimal.vtable, server_name);
-}
-
-static void x509_start_cert(const br_x509_class **ctx, uint32_t length)
-{
-  struct x509_context *x509 = (struct x509_context *)ctx;
-
-  if(!x509->verifypeer) {
-    /* Only decode the first cert in the chain to obtain the public key */
-    if(x509->cert_num == 0)
-      br_x509_decoder_init(&x509->decoder, NULL, NULL);
-    return;
-  }
-
-  x509->minimal.vtable->start_cert(&x509->minimal.vtable, length);
-}
-
-static void x509_append(const br_x509_class **ctx, const unsigned char *buf,
-                        size_t len)
-{
-  struct x509_context *x509 = (struct x509_context *)ctx;
-
-  if(!x509->verifypeer) {
-    if(x509->cert_num == 0)
-      br_x509_decoder_push(&x509->decoder, buf, len);
-    return;
-  }
-
-  x509->minimal.vtable->append(&x509->minimal.vtable, buf, len);
-}
-
-static void x509_end_cert(const br_x509_class **ctx)
-{
-  struct x509_context *x509 = (struct x509_context *)ctx;
-
-  if(!x509->verifypeer) {
-    x509->cert_num++;
-    return;
-  }
-
-  x509->minimal.vtable->end_cert(&x509->minimal.vtable);
-}
-
-static unsigned x509_end_chain(const br_x509_class **ctx)
-{
-  struct x509_context *x509 = (struct x509_context *)ctx;
-
-  if(!x509->verifypeer) {
-    return br_x509_decoder_last_error(&x509->decoder);
-  }
-
-  return x509->minimal.vtable->end_chain(&x509->minimal.vtable);
-}
-
-static const br_x509_pkey *x509_get_pkey(const br_x509_class *const *ctx,
-                                         unsigned *usages)
-{
-  struct x509_context *x509 = (struct x509_context *)ctx;
-
-  if(!x509->verifypeer) {
-    /* Nothing in the chain is verified, just return the public key of the
-       first certificate and allow its usage for both TLS_RSA_* and
-       TLS_ECDHE_* */
-    if(usages)
-      *usages = BR_KEYTYPE_KEYX | BR_KEYTYPE_SIGN;
-    return br_x509_decoder_get_pkey(&x509->decoder);
-  }
-
-  return x509->minimal.vtable->get_pkey(&x509->minimal.vtable, usages);
-}
-
-static const br_x509_class x509_vtable = {
-  sizeof(struct x509_context),
-  x509_start_chain,
-  x509_start_cert,
-  x509_append,
-  x509_end_cert,
-  x509_end_chain,
-  x509_get_pkey
-};
-
-struct st_cipher {
-  const char *name; /* Cipher suite IANA name. It starts with "TLS_" prefix */
-  const char *alias_name; /* Alias name is the same as OpenSSL cipher name */
-  uint16_t num; /* BearSSL cipher suite */
-};
-
-/* Macro to initialize st_cipher data structure */
-#define CIPHER_DEF(num, alias) { #num, alias, BR_##num }
-
-static const struct st_cipher ciphertable[] = {
-  /* RFC 2246 TLS 1.0 */
-  CIPHER_DEF(TLS_RSA_WITH_3DES_EDE_CBC_SHA,                        /* 0x000A */
-             "DES-CBC3-SHA"),
-
-  /* RFC 3268 TLS 1.0 AES */
-  CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA,                         /* 0x002F */
-             "AES128-SHA"),
-  CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA,                         /* 0x0035 */
-             "AES256-SHA"),
-
-  /* RFC 5246 TLS 1.2 */
-  CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA256,                      /* 0x003C */
-             "AES128-SHA256"),
-  CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA256,                      /* 0x003D */
-             "AES256-SHA256"),
-
-  /* RFC 5288 TLS 1.2 AES GCM */
-  CIPHER_DEF(TLS_RSA_WITH_AES_128_GCM_SHA256,                      /* 0x009C */
-             "AES128-GCM-SHA256"),
-  CIPHER_DEF(TLS_RSA_WITH_AES_256_GCM_SHA384,                      /* 0x009D */
-             "AES256-GCM-SHA384"),
-
-  /* RFC 4492 TLS 1.0 ECC */
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,                 /* 0xC003 */
-             "ECDH-ECDSA-DES-CBC3-SHA"),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,                  /* 0xC004 */
-             "ECDH-ECDSA-AES128-SHA"),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,                  /* 0xC005 */
-             "ECDH-ECDSA-AES256-SHA"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,                /* 0xC008 */
-             "ECDHE-ECDSA-DES-CBC3-SHA"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,                 /* 0xC009 */
-             "ECDHE-ECDSA-AES128-SHA"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,                 /* 0xC00A */
-             "ECDHE-ECDSA-AES256-SHA"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,                   /* 0xC00D */
-             "ECDH-RSA-DES-CBC3-SHA"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,                    /* 0xC00E */
-             "ECDH-RSA-AES128-SHA"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,                    /* 0xC00F */
-             "ECDH-RSA-AES256-SHA"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,                  /* 0xC012 */
-             "ECDHE-RSA-DES-CBC3-SHA"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,                   /* 0xC013 */
-             "ECDHE-RSA-AES128-SHA"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,                   /* 0xC014 */
-             "ECDHE-RSA-AES256-SHA"),
-
-  /* RFC 5289 TLS 1.2 ECC HMAC SHA256/384 */
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,              /* 0xC023 */
-             "ECDHE-ECDSA-AES128-SHA256"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,              /* 0xC024 */
-             "ECDHE-ECDSA-AES256-SHA384"),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,               /* 0xC025 */
-             "ECDH-ECDSA-AES128-SHA256"),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,               /* 0xC026 */
-             "ECDH-ECDSA-AES256-SHA384"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,                /* 0xC027 */
-             "ECDHE-RSA-AES128-SHA256"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,                /* 0xC028 */
-             "ECDHE-RSA-AES256-SHA384"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,                 /* 0xC029 */
-             "ECDH-RSA-AES128-SHA256"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,                 /* 0xC02A */
-             "ECDH-RSA-AES256-SHA384"),
-
-  /* RFC 5289 TLS 1.2 GCM */
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,              /* 0xC02B */
-             "ECDHE-ECDSA-AES128-GCM-SHA256"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,              /* 0xC02C */
-             "ECDHE-ECDSA-AES256-GCM-SHA384"),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,               /* 0xC02D */
-             "ECDH-ECDSA-AES128-GCM-SHA256"),
-  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,               /* 0xC02E */
-             "ECDH-ECDSA-AES256-GCM-SHA384"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,                /* 0xC02F */
-             "ECDHE-RSA-AES128-GCM-SHA256"),
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,                /* 0xC030 */
-             "ECDHE-RSA-AES256-GCM-SHA384"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,                 /* 0xC031 */
-             "ECDH-RSA-AES128-GCM-SHA256"),
-  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,                 /* 0xC032 */
-             "ECDH-RSA-AES256-GCM-SHA384"),
-#ifdef BR_TLS_RSA_WITH_AES_128_CCM
-
-  /* RFC 6655 TLS 1.2 CCM
-     Supported since BearSSL 0.6 */
-  CIPHER_DEF(TLS_RSA_WITH_AES_128_CCM,                             /* 0xC09C */
-             "AES128-CCM"),
-  CIPHER_DEF(TLS_RSA_WITH_AES_256_CCM,                             /* 0xC09D */
-             "AES256-CCM"),
-  CIPHER_DEF(TLS_RSA_WITH_AES_128_CCM_8,                           /* 0xC0A0 */
-             "AES128-CCM8"),
-  CIPHER_DEF(TLS_RSA_WITH_AES_256_CCM_8,                           /* 0xC0A1 */
-             "AES256-CCM8"),
-
-  /* RFC 7251 TLS 1.2 ECC CCM
-     Supported since BearSSL 0.6 */
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CCM,                     /* 0xC0AC */
-             "ECDHE-ECDSA-AES128-CCM"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CCM,                     /* 0xC0AD */
-             "ECDHE-ECDSA-AES256-CCM"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,                   /* 0xC0AE */
-             "ECDHE-ECDSA-AES128-CCM8"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8,                   /* 0xC0AF */
-             "ECDHE-ECDSA-AES256-CCM8"),
-#endif
-
-  /* RFC 7905 TLS 1.2 ChaCha20-Poly1305
-     Supported since BearSSL 0.2 */
-  CIPHER_DEF(TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,          /* 0xCCA8 */
-             "ECDHE-RSA-CHACHA20-POLY1305"),
-  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,        /* 0xCCA9 */
-             "ECDHE-ECDSA-CHACHA20-POLY1305"),
-};
-
-#define NUM_OF_CIPHERS (sizeof(ciphertable) / sizeof(ciphertable[0]))
-#define CIPHER_NAME_BUF_LEN 64
-
-static bool is_separator(char c)
-{
-  /* Return whether character is a cipher list separator. */
-  switch(c) {
-    case ' ':
-    case '\t':
-    case ':':
-    case ',':
-    case ';':
-      return true;
-  }
-  return false;
-}
-
-static CURLcode bearssl_set_selected_ciphers(struct Curl_easy *data,
-                                             br_ssl_engine_context *ssl_eng,
-                                             const char *ciphers)
-{
-  uint16_t selected_ciphers[NUM_OF_CIPHERS];
-  size_t selected_count = 0;
-  char cipher_name[CIPHER_NAME_BUF_LEN];
-  const char *cipher_start = ciphers;
-  const char *cipher_end;
-  size_t i, j;
-
-  if(!cipher_start)
-    return CURLE_SSL_CIPHER;
-
-  while(true) {
-    /* Extract the next cipher name from the ciphers string */
-    while(is_separator(*cipher_start))
-      ++cipher_start;
-    if(*cipher_start == '\0')
-      break;
-    cipher_end = cipher_start;
-    while(*cipher_end != '\0' && !is_separator(*cipher_end))
-      ++cipher_end;
-    j = cipher_end - cipher_start < CIPHER_NAME_BUF_LEN - 1 ?
-        cipher_end - cipher_start : CIPHER_NAME_BUF_LEN - 1;
-    strncpy(cipher_name, cipher_start, j);
-    cipher_name[j] = '\0';
-    cipher_start = cipher_end;
-
-    /* Lookup the cipher name in the table of available ciphers. If the cipher
-       name starts with "TLS_" we do the lookup by IANA name. Otherwise, we try
-       to match cipher name by an (OpenSSL) alias. */
-    if(strncasecompare(cipher_name, "TLS_", 4)) {
-      for(i = 0; i < NUM_OF_CIPHERS &&
-                 !strcasecompare(cipher_name, ciphertable[i].name); ++i);
-    }
-    else {
-      for(i = 0; i < NUM_OF_CIPHERS &&
-                 !strcasecompare(cipher_name, ciphertable[i].alias_name); ++i);
-    }
-    if(i == NUM_OF_CIPHERS) {
-      infof(data, "BearSSL: unknown cipher in list: %s", cipher_name);
-      continue;
-    }
-
-    /* No duplicates allowed */
-    for(j = 0; j < selected_count &&
-               selected_ciphers[j] != ciphertable[i].num; j++);
-    if(j < selected_count) {
-      infof(data, "BearSSL: duplicate cipher in list: %s", cipher_name);
-      continue;
-    }
-
-    DEBUGASSERT(selected_count < NUM_OF_CIPHERS);
-    selected_ciphers[selected_count] = ciphertable[i].num;
-    ++selected_count;
-  }
-
-  if(selected_count == 0) {
-    failf(data, "BearSSL: no supported cipher in list");
-    return CURLE_SSL_CIPHER;
-  }
-
-  br_ssl_engine_set_suites(ssl_eng, selected_ciphers, selected_count);
-  return CURLE_OK;
-}
-
-static CURLcode bearssl_connect_step1(struct Curl_easy *data,
-                                      struct connectdata *conn, int sockindex)
-{
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-  struct ssl_backend_data *backend = connssl->backend;
-  const struct curl_blob *ca_info_blob = SSL_CONN_CONFIG(ca_info_blob);
-  const char * const ssl_cafile =
-    /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
-    (ca_info_blob ? NULL : SSL_CONN_CONFIG(CAfile));
-  const char *hostname = SSL_HOST_NAME();
-  const bool verifypeer = SSL_CONN_CONFIG(verifypeer);
-  const bool verifyhost = SSL_CONN_CONFIG(verifyhost);
-  CURLcode ret;
-  unsigned version_min, version_max;
-#ifdef ENABLE_IPV6
-  struct in6_addr addr;
-#else
-  struct in_addr addr;
-#endif
-
-  DEBUGASSERT(backend);
-
-  switch(SSL_CONN_CONFIG(version)) {
-  case CURL_SSLVERSION_SSLv2:
-    failf(data, "BearSSL does not support SSLv2");
-    return CURLE_SSL_CONNECT_ERROR;
-  case CURL_SSLVERSION_SSLv3:
-    failf(data, "BearSSL does not support SSLv3");
-    return CURLE_SSL_CONNECT_ERROR;
-  case CURL_SSLVERSION_TLSv1_0:
-    version_min = BR_TLS10;
-    version_max = BR_TLS10;
-    break;
-  case CURL_SSLVERSION_TLSv1_1:
-    version_min = BR_TLS11;
-    version_max = BR_TLS11;
-    break;
-  case CURL_SSLVERSION_TLSv1_2:
-    version_min = BR_TLS12;
-    version_max = BR_TLS12;
-    break;
-  case CURL_SSLVERSION_DEFAULT:
-  case CURL_SSLVERSION_TLSv1:
-    version_min = BR_TLS10;
-    version_max = BR_TLS12;
-    break;
-  default:
-    failf(data, "BearSSL: unknown CURLOPT_SSLVERSION");
-    return CURLE_SSL_CONNECT_ERROR;
-  }
-
-  if(ca_info_blob) {
-    struct cafile_source source;
-    source.type = CAFILE_SOURCE_BLOB;
-    source.data = ca_info_blob->data;
-    source.len = ca_info_blob->len;
-
-    ret = load_cafile(&source, &backend->anchors, &backend->anchors_len);
-    if(ret != CURLE_OK) {
-      if(verifypeer) {
-        failf(data, "error importing CA certificate blob");
-        return ret;
-      }
-      /* Only warn if no certificate verification is required. */
-      infof(data, "error importing CA certificate blob, continuing anyway");
-    }
-  }
-
-  if(ssl_cafile) {
-    struct cafile_source source;
-    source.type = CAFILE_SOURCE_PATH;
-    source.data = ssl_cafile;
-    source.len = 0;
-
-    ret = load_cafile(&source, &backend->anchors, &backend->anchors_len);
-    if(ret != CURLE_OK) {
-      if(verifypeer) {
-        failf(data, "error setting certificate verify locations."
-              " CAfile: %s", ssl_cafile);
-        return ret;
-      }
-      infof(data, "error setting certificate verify locations,"
-            " continuing anyway:");
-    }
-  }
-
-  /* initialize SSL context */
-  br_ssl_client_init_full(&backend->ctx, &backend->x509.minimal,
-                          backend->anchors, backend->anchors_len);
-  br_ssl_engine_set_versions(&backend->ctx.eng, version_min, version_max);
-  br_ssl_engine_set_buffer(&backend->ctx.eng, backend->buf,
-                           sizeof(backend->buf), 1);
-
-  if(SSL_CONN_CONFIG(cipher_list)) {
-    /* Override the ciphers as specified. For the default cipher list see the
-       BearSSL source code of br_ssl_client_init_full() */
-    ret = bearssl_set_selected_ciphers(data, &backend->ctx.eng,
-                                       SSL_CONN_CONFIG(cipher_list));
-    if(ret)
-      return ret;
-  }
-
-  /* initialize X.509 context */
-  backend->x509.vtable = &x509_vtable;
-  backend->x509.verifypeer = verifypeer;
-  backend->x509.verifyhost = verifyhost;
-  br_ssl_engine_set_x509(&backend->ctx.eng, &backend->x509.vtable);
-
-  if(SSL_SET_OPTION(primary.sessionid)) {
-    void *session;
-
-    Curl_ssl_sessionid_lock(data);
-    if(!Curl_ssl_getsessionid(data, conn, SSL_IS_PROXY() ? TRUE : FALSE,
-                              &session, NULL, sockindex)) {
-      br_ssl_engine_set_session_parameters(&backend->ctx.eng, session);
-      infof(data, "BearSSL: re-using session ID");
-    }
-    Curl_ssl_sessionid_unlock(data);
-  }
-
-  if(conn->bits.tls_enable_alpn) {
-    int cur = 0;
-
-    /* NOTE: when adding more protocols here, increase the size of the
-     * protocols array in `struct ssl_backend_data`.
-     */
-
-#ifdef USE_HTTP2
-    if(data->state.httpwant >= CURL_HTTP_VERSION_2
-#ifndef CURL_DISABLE_PROXY
-      && (!SSL_IS_PROXY() || !conn->bits.tunnel_proxy)
-#endif
-      ) {
-      backend->protocols[cur++] = ALPN_H2;
-      infof(data, VTLS_INFOF_ALPN_OFFER_1STR, ALPN_H2);
-    }
-#endif
-
-    backend->protocols[cur++] = ALPN_HTTP_1_1;
-    infof(data, VTLS_INFOF_ALPN_OFFER_1STR, ALPN_HTTP_1_1);
-
-    br_ssl_engine_set_protocol_names(&backend->ctx.eng,
-                                     backend->protocols, cur);
-  }
-
-  if((1 == Curl_inet_pton(AF_INET, hostname, &addr))
-#ifdef ENABLE_IPV6
-      || (1 == Curl_inet_pton(AF_INET6, hostname, &addr))
-#endif
-     ) {
-    if(verifyhost) {
-      failf(data, "BearSSL: "
-            "host verification of IP address is not supported");
-      return CURLE_PEER_FAILED_VERIFICATION;
-    }
-    hostname = NULL;
-  }
-  else {
-    char *snihost = Curl_ssl_snihost(data, hostname, NULL);
-    if(!snihost) {
-      failf(data, "Failed to set SNI");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-    hostname = snihost;
-  }
-
-  /* give application a chance to interfere with SSL set up. */
-  if(data->set.ssl.fsslctx) {
-    Curl_set_in_callback(data, true);
-    ret = (*data->set.ssl.fsslctx)(data, &backend->ctx,
-                                   data->set.ssl.fsslctxp);
-    Curl_set_in_callback(data, false);
-    if(ret) {
-      failf(data, "BearSSL: error signaled by ssl ctx callback");
-      return ret;
-    }
-  }
-
-  if(!br_ssl_client_reset(&backend->ctx, hostname, 1))
-    return CURLE_FAILED_INIT;
-  backend->active = TRUE;
-
-  connssl->connecting_state = ssl_connect_2;
-
-  return CURLE_OK;
-}
-
-static CURLcode bearssl_run_until(struct Curl_easy *data,
-                                  struct connectdata *conn, int sockindex,
-                                  unsigned target)
-{
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-  struct ssl_backend_data *backend = connssl->backend;
-  curl_socket_t sockfd = conn->sock[sockindex];
-  unsigned state;
-  unsigned char *buf;
-  size_t len;
-  ssize_t ret;
-  int err;
-
-  DEBUGASSERT(backend);
-
-  for(;;) {
-    state = br_ssl_engine_current_state(&backend->ctx.eng);
-    if(state & BR_SSL_CLOSED) {
-      err = br_ssl_engine_last_error(&backend->ctx.eng);
-      switch(err) {
-      case BR_ERR_OK:
-        /* TLS close notify */
-        if(connssl->state != ssl_connection_complete) {
-          failf(data, "SSL: connection closed during handshake");
-          return CURLE_SSL_CONNECT_ERROR;
-        }
-        return CURLE_OK;
-      case BR_ERR_X509_EXPIRED:
-        failf(data, "SSL: X.509 verification: "
-              "certificate is expired or not yet valid");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      case BR_ERR_X509_BAD_SERVER_NAME:
-        failf(data, "SSL: X.509 verification: "
-              "expected server name was not found in the chain");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      case BR_ERR_X509_NOT_TRUSTED:
-        failf(data, "SSL: X.509 verification: "
-              "chain could not be linked to a trust anchor");
-        return CURLE_PEER_FAILED_VERIFICATION;
-      }
-      /* X.509 errors are documented to have the range 32..63 */
-      if(err >= 32 && err < 64)
-        return CURLE_PEER_FAILED_VERIFICATION;
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-    if(state & target)
-      return CURLE_OK;
-    if(state & BR_SSL_SENDREC) {
-      buf = br_ssl_engine_sendrec_buf(&backend->ctx.eng, &len);
-      ret = swrite(sockfd, buf, len);
-      if(ret == -1) {
-        if(SOCKERRNO == EAGAIN || SOCKERRNO == EWOULDBLOCK) {
-          if(connssl->state != ssl_connection_complete)
-            connssl->connecting_state = ssl_connect_2_writing;
-          return CURLE_AGAIN;
-        }
-        return CURLE_WRITE_ERROR;
-      }
-      br_ssl_engine_sendrec_ack(&backend->ctx.eng, ret);
-    }
-    else if(state & BR_SSL_RECVREC) {
-      buf = br_ssl_engine_recvrec_buf(&backend->ctx.eng, &len);
-      ret = sread(sockfd, buf, len);
-      if(ret == 0) {
-        failf(data, "SSL: EOF without close notify");
-        return CURLE_READ_ERROR;
-      }
-      if(ret == -1) {
-        if(SOCKERRNO == EAGAIN || SOCKERRNO == EWOULDBLOCK) {
-          if(connssl->state != ssl_connection_complete)
-            connssl->connecting_state = ssl_connect_2_reading;
-          return CURLE_AGAIN;
-        }
-        return CURLE_READ_ERROR;
-      }
-      br_ssl_engine_recvrec_ack(&backend->ctx.eng, ret);
-    }
-  }
-}
-
-static CURLcode bearssl_connect_step2(struct Curl_easy *data,
-                                      struct connectdata *conn, int sockindex)
-{
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-  struct ssl_backend_data *backend = connssl->backend;
-  CURLcode ret;
-
-  DEBUGASSERT(backend);
-
-  ret = bearssl_run_until(data, conn, sockindex,
-                          BR_SSL_SENDAPP | BR_SSL_RECVAPP);
-  if(ret == CURLE_AGAIN)
-    return CURLE_OK;
-  if(ret == CURLE_OK) {
-    if(br_ssl_engine_current_state(&backend->ctx.eng) == BR_SSL_CLOSED) {
-      failf(data, "SSL: connection closed during handshake");
-      return CURLE_SSL_CONNECT_ERROR;
-    }
-    connssl->connecting_state = ssl_connect_3;
-  }
-  return ret;
-}
-
-static CURLcode bearssl_connect_step3(struct Curl_easy *data,
-                                      struct connectdata *conn, int sockindex)
-{
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-  struct ssl_backend_data *backend = connssl->backend;
-  CURLcode ret;
-
-  DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
-  DEBUGASSERT(backend);
-
-  if(conn->bits.tls_enable_alpn) {
-    const char *protocol;
-
-    protocol = br_ssl_engine_get_selected_protocol(&backend->ctx.eng);
-    if(protocol) {
-      infof(data, VTLS_INFOF_ALPN_ACCEPTED_1STR, protocol);
-
-#ifdef USE_HTTP2
-      if(!strcmp(protocol, ALPN_H2))
-        conn->alpn = CURL_HTTP_VERSION_2;
-      else
-#endif
-      if(!strcmp(protocol, ALPN_HTTP_1_1))
-        conn->alpn = CURL_HTTP_VERSION_1_1;
-      else
-        infof(data, "ALPN, unrecognized protocol %s", protocol);
-      Curl_multiuse_state(data, conn->alpn == CURL_HTTP_VERSION_2 ?
-                          BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);
-    }
-    else
-      infof(data, VTLS_INFOF_NO_ALPN);
-  }
-
-  if(SSL_SET_OPTION(primary.sessionid)) {
-    bool incache;
-    bool added = FALSE;
-    void *oldsession;
-    br_ssl_session_parameters *session;
-
-    session = malloc(sizeof(*session));
-    if(!session)
-      return CURLE_OUT_OF_MEMORY;
-    br_ssl_engine_get_session_parameters(&backend->ctx.eng, session);
-    Curl_ssl_sessionid_lock(data);
-    incache = !(Curl_ssl_getsessionid(data, conn,
-                                      SSL_IS_PROXY() ? TRUE : FALSE,
-                                      &oldsession, NULL, sockindex));
-    if(incache)
-      Curl_ssl_delsessionid(data, oldsession);
-    ret = Curl_ssl_addsessionid(data, conn,
-                                SSL_IS_PROXY() ? TRUE : FALSE,
-                                session, 0, sockindex, &added);
-    Curl_ssl_sessionid_unlock(data);
-    if(!added)
-      free(session);
-    if(ret) {
-      return CURLE_OUT_OF_MEMORY;
-    }
-  }
-
-  connssl->connecting_state = ssl_connect_done;
-
-  return CURLE_OK;
-}
-
-static ssize_t bearssl_send(struct Curl_easy *data, int sockindex,
-                            const void *buf, size_t len, CURLcode *err)
-{
-  struct connectdata *conn = data->conn;
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-  struct ssl_backend_data *backend = connssl->backend;
-  unsigned char *app;
-  size_t applen;
-
-  DEBUGASSERT(backend);
-
-  for(;;) {
-    *err = bearssl_run_until(data, conn, sockindex, BR_SSL_SENDAPP);
-    if (*err != CURLE_OK)
-      return -1;
-    app = br_ssl_engine_sendapp_buf(&backend->ctx.eng, &applen);
-    if(!app) {
-      failf(data, "SSL: connection closed during write");
-      *err = CURLE_SEND_ERROR;
-      return -1;
-    }
-    if(backend->pending_write) {
-      applen = backend->pending_write;
-      backend->pending_write = 0;
-      return applen;
-    }
-    if(applen > len)
-      applen = len;
-    memcpy(app, buf, applen);
-    br_ssl_engine_sendapp_ack(&backend->ctx.eng, applen);
-    br_ssl_engine_flush(&backend->ctx.eng, 0);
-    backend->pending_write = applen;
-  }
-}
-
-static ssize_t bearssl_recv(struct Curl_easy *data, int sockindex,
-                            char *buf, size_t len, CURLcode *err)
-{
-  struct connectdata *conn = data->conn;
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-  struct ssl_backend_data *backend = connssl->backend;
-  unsigned char *app;
-  size_t applen;
-
-  DEBUGASSERT(backend);
-
-  *err = bearssl_run_until(data, conn, sockindex, BR_SSL_RECVAPP);
-  if(*err != CURLE_OK)
-    return -1;
-  app = br_ssl_engine_recvapp_buf(&backend->ctx.eng, &applen);
-  if(!app)
-    return 0;
-  if(applen > len)
-    applen = len;
-  memcpy(buf, app, applen);
-  br_ssl_engine_recvapp_ack(&backend->ctx.eng, applen);
-
-  return applen;
-}
-
-static CURLcode bearssl_connect_common(struct Curl_easy *data,
-                                       struct connectdata *conn,
-                                       int sockindex,
-                                       bool nonblocking,
-                                       bool *done)
-{
-  CURLcode ret;
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-  curl_socket_t sockfd = conn->sock[sockindex];
-  timediff_t timeout_ms;
-  int what;
-
-  /* check if the connection has already been established */
-  if(ssl_connection_complete == connssl->state) {
-    *done = TRUE;
-    return CURLE_OK;
-  }
-
-  if(ssl_connect_1 == connssl->connecting_state) {
-    ret = bearssl_connect_step1(data, conn, sockindex);
-    if(ret)
-      return ret;
-  }
-
-  while(ssl_connect_2 == connssl->connecting_state ||
-        ssl_connect_2_reading == connssl->connecting_state ||
-        ssl_connect_2_writing == connssl->connecting_state) {
-    /* check allowed time left */
-    timeout_ms = Curl_timeleft(data, NULL, TRUE);
-
-    if(timeout_ms < 0) {
-      /* no need to continue if time already is up */
-      failf(data, "SSL connection timeout");
-      return CURLE_OPERATION_TIMEDOUT;
-    }
-
-    /* if ssl is expecting something, check if it's available. */
-    if(ssl_connect_2_reading == connssl->connecting_state ||
-       ssl_connect_2_writing == connssl->connecting_state) {
-
-      curl_socket_t writefd = ssl_connect_2_writing ==
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-      curl_socket_t readfd = ssl_connect_2_reading ==
-        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;
-
-      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,
-                               nonblocking?0:timeout_ms);
-      if(what < 0) {
-        /* fatal error */
-        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);
-        return CURLE_SSL_CONNECT_ERROR;
-      }
-      else if(0 == what) {
-        if(nonblocking) {
-          *done = FALSE;
-          return CURLE_OK;
-        }
-        else {
-          /* timeout */
-          failf(data, "SSL connection timeout");
-          return CURLE_OPERATION_TIMEDOUT;
-        }
-      }
-      /* socket is readable or writable */
-    }
-
-    /* Run transaction, and return to the caller if it failed or if this
-     * connection is done nonblocking and this loop would execute again. This
-     * permits the owner of a multi handle to abort a connection attempt
-     * before step2 has completed while ensuring that a client using select()
-     * or epoll() will always have a valid fdset to wait on.
-     */
-    ret = bearssl_connect_step2(data, conn, sockindex);
-    if(ret || (nonblocking &&
-               (ssl_connect_2 == connssl->connecting_state ||
-                ssl_connect_2_reading == connssl->connecting_state ||
-                ssl_connect_2_writing == connssl->connecting_state)))
-      return ret;
-  }
-
-  if(ssl_connect_3 == connssl->connecting_state) {
-    ret = bearssl_connect_step3(data, conn, sockindex);
-    if(ret)
-      return ret;
-  }
-
-  if(ssl_connect_done == connssl->connecting_state) {
-    connssl->state = ssl_connection_complete;
-    conn->recv[sockindex] = bearssl_recv;
-    conn->send[sockindex] = bearssl_send;
-    *done = TRUE;
-  }
-  else
-    *done = FALSE;
-
-  /* Reset our connect state machine */
-  connssl->connecting_state = ssl_connect_1;
-
-  return CURLE_OK;
-}
-
-static size_t bearssl_version(char *buffer, size_t size)
-{
-  return msnprintf(buffer, size, "BearSSL");
-}
-
-static bool bearssl_data_pending(const struct connectdata *conn,
-                                 int connindex)
-{
-  const struct ssl_connect_data *connssl = &conn->ssl[connindex];
-  struct ssl_backend_data *backend = connssl->backend;
-  DEBUGASSERT(backend);
-  return br_ssl_engine_current_state(&backend->ctx.eng) & BR_SSL_RECVAPP;
-}
-
-static CURLcode bearssl_random(struct Curl_easy *data UNUSED_PARAM,
-                               unsigned char *entropy, size_t length)
-{
-  static br_hmac_drbg_context ctx;
-  static bool seeded = FALSE;
-
-  if(!seeded) {
-    br_prng_seeder seeder;
-
-    br_hmac_drbg_init(&ctx, &br_sha256_vtable, NULL, 0);
-    seeder = br_prng_seeder_system(NULL);
-    if(!seeder || !seeder(&ctx.vtable))
-      return CURLE_FAILED_INIT;
-    seeded = TRUE;
-  }
-  br_hmac_drbg_generate(&ctx, entropy, length);
-
-  return CURLE_OK;
-}
-
-static CURLcode bearssl_connect(struct Curl_easy *data,
-                                struct connectdata *conn, int sockindex)
-{
-  CURLcode ret;
-  bool done = FALSE;
-
-  ret = bearssl_connect_common(data, conn, sockindex, FALSE, &done);
-  if(ret)
-    return ret;
-
-  DEBUGASSERT(done);
-
-  return CURLE_OK;
-}
-
-static CURLcode bearssl_connect_nonblocking(struct Curl_easy *data,
-                                            struct connectdata *conn,
-                                            int sockindex, bool *done)
-{
-  return bearssl_connect_common(data, conn, sockindex, TRUE, done);
-}
-
-static void *bearssl_get_internals(struct ssl_connect_data *connssl,
-                                   CURLINFO info UNUSED_PARAM)
-{
-  struct ssl_backend_data *backend = connssl->backend;
-  DEBUGASSERT(backend);
-  return &backend->ctx;
-}
-
-static void bearssl_close(struct Curl_easy *data,
-                          struct connectdata *conn, int sockindex)
-{
-  struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-  struct ssl_backend_data *backend = connssl->backend;
-  size_t i;
-
-  DEBUGASSERT(backend);
-
-  if(backend->active) {
-    br_ssl_engine_close(&backend->ctx.eng);
-    (void)bearssl_run_until(data, conn, sockindex, BR_SSL_CLOSED);
-  }
-  for(i = 0; i < backend->anchors_len; ++i)
-    free(backend->anchors[i].dn.data);
-  free(backend->anchors);
-}
-
-static void bearssl_session_free(void *ptr)
-{
-  free(ptr);
-}
-
-static CURLcode bearssl_sha256sum(const unsigned char *input,
-                                  size_t inputlen,
-                                  unsigned char *sha256sum,
-                                  size_t sha256len UNUSED_PARAM)
-{
-  br_sha256_context ctx;
-
-  br_sha256_init(&ctx);
-  br_sha256_update(&ctx, input, inputlen);
-  br_sha256_out(&ctx, sha256sum);
-  return CURLE_OK;
-}
-
-const struct Curl_ssl Curl_ssl_bearssl = {
-  { CURLSSLBACKEND_BEARSSL, "bearssl" }, /* info */
-  SSLSUPP_CAINFO_BLOB | SSLSUPP_SSL_CTX,
-  sizeof(struct ssl_backend_data),
-
-  Curl_none_init,                  /* init */
-  Curl_none_cleanup,               /* cleanup */
-  bearssl_version,                 /* version */
-  Curl_none_check_cxn,             /* check_cxn */
-  Curl_none_shutdown,              /* shutdown */
-  bearssl_data_pending,            /* data_pending */
-  bearssl_random,                  /* random */
-  Curl_none_cert_status_request,   /* cert_status_request */
-  bearssl_connect,                 /* connect */
-  bearssl_connect_nonblocking,     /* connect_nonblocking */
-  Curl_ssl_getsock,                /* getsock */
-  bearssl_get_internals,           /* get_internals */
-  bearssl_close,                   /* close_one */
-  Curl_none_close_all,             /* close_all */
-  bearssl_session_free,            /* session_free */
-  Curl_none_set_engine,            /* set_engine */
-  Curl_none_set_engine_default,    /* set_engine_default */
-  Curl_none_engines_list,          /* engines_list */
-  Curl_none_false_start,           /* false_start */
-  bearssl_sha256sum,               /* sha256sum */
-  NULL,                            /* associate_connection */
-  NULL                             /* disassociate_connection */
-};
-
-#endif /* USE_BEARSSL */
+/***************************************************************************

+ *                                  _   _ ____  _

+ *  Project                     ___| | | |  _ \| |

+ *                             / __| | | | |_) | |

+ *                            | (__| |_| |  _ <| |___

+ *                             \___|\___/|_| \_\_____|

+ *

+ * Copyright (C) 2019 - 2022, Michael Forney, <mforney@mforney.org>

+ *

+ * This software is licensed as described in the file COPYING, which

+ * you should have received as part of this distribution. The terms

+ * are also available at https://curl.se/docs/copyright.html.

+ *

+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell

+ * copies of the Software, and permit persons to whom the Software is

+ * furnished to do so, under the terms of the COPYING file.

+ *

+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY

+ * KIND, either express or implied.

+ *

+ * SPDX-License-Identifier: curl

+ *

+ ***************************************************************************/

+#include "curl_setup.h"

+

+#ifdef USE_BEARSSL

+

+#include <bearssl.h>

+

+#include "bearssl.h"

+#include "urldata.h"

+#include "sendf.h"

+#include "inet_pton.h"

+#include "vtls.h"

+#include "vtls_int.h"

+#include "connect.h"

+#include "select.h"

+#include "multiif.h"

+#include "curl_printf.h"

+#include "strcase.h"

+

+/* The last #include files should be: */

+#include "curl_memory.h"

+#include "memdebug.h"

+

+struct x509_context {

+  const br_x509_class *vtable;

+  br_x509_minimal_context minimal;

+  br_x509_decoder_context decoder;

+  bool verifyhost;

+  bool verifypeer;

+  int cert_num;

+};

+

+struct ssl_backend_data {

+  br_ssl_client_context ctx;

+  struct x509_context x509;

+  unsigned char buf[BR_SSL_BUFSIZE_BIDI];

+  br_x509_trust_anchor *anchors;

+  size_t anchors_len;

+  const char *protocols[2];

+  /* SSL client context is active */

+  bool active;

+  /* size of pending write, yet to be flushed */

+  size_t pending_write;

+};

+

+struct cafile_parser {

+  CURLcode err;

+  bool in_cert;

+  br_x509_decoder_context xc;

+  /* array of trust anchors loaded from CAfile */

+  br_x509_trust_anchor *anchors;

+  size_t anchors_len;

+  /* buffer for DN data */

+  unsigned char dn[1024];

+  size_t dn_len;

+};

+

+#define CAFILE_SOURCE_PATH 1

+#define CAFILE_SOURCE_BLOB 2

+struct cafile_source {

+  int type;

+  const char *data;

+  size_t len;

+};

+

+static void append_dn(void *ctx, const void *buf, size_t len)

+{

+  struct cafile_parser *ca = ctx;

+

+  if(ca->err != CURLE_OK || !ca->in_cert)

+    return;

+  if(sizeof(ca->dn) - ca->dn_len < len) {

+    ca->err = CURLE_FAILED_INIT;

+    return;

+  }

+  memcpy(ca->dn + ca->dn_len, buf, len);

+  ca->dn_len += len;

+}

+

+static void x509_push(void *ctx, const void *buf, size_t len)

+{

+  struct cafile_parser *ca = ctx;

+

+  if(ca->in_cert)

+    br_x509_decoder_push(&ca->xc, buf, len);

+}

+

+static CURLcode load_cafile(struct cafile_source *source,

+                            br_x509_trust_anchor **anchors,

+                            size_t *anchors_len)

+{

+  struct cafile_parser ca;

+  br_pem_decoder_context pc;

+  br_x509_trust_anchor *ta;

+  size_t ta_size;

+  br_x509_trust_anchor *new_anchors;

+  size_t new_anchors_len;

+  br_x509_pkey *pkey;

+  FILE *fp = 0;

+  unsigned char buf[BUFSIZ];

+  const unsigned char *p;

+  const char *name;

+  size_t n, i, pushed;

+

+  DEBUGASSERT(source->type == CAFILE_SOURCE_PATH

+              || source->type == CAFILE_SOURCE_BLOB);

+

+  if(source->type == CAFILE_SOURCE_PATH) {

+    fp = fopen(source->data, "rb");

+    if(!fp)

+      return CURLE_SSL_CACERT_BADFILE;

+  }

+

+  if(source->type == CAFILE_SOURCE_BLOB && source->len > (size_t)INT_MAX)

+    return CURLE_SSL_CACERT_BADFILE;

+

+  ca.err = CURLE_OK;

+  ca.in_cert = FALSE;

+  ca.anchors = NULL;

+  ca.anchors_len = 0;

+  br_pem_decoder_init(&pc);

+  br_pem_decoder_setdest(&pc, x509_push, &ca);

+  do {

+    if(source->type == CAFILE_SOURCE_PATH) {

+      n = fread(buf, 1, sizeof(buf), fp);

+      if(n == 0)

+        break;

+      p = buf;

+    }

+    else if(source->type == CAFILE_SOURCE_BLOB) {

+      n = source->len;

+      p = (unsigned char *) source->data;

+    }

+    while(n) {

+      pushed = br_pem_decoder_push(&pc, p, n);

+      if(ca.err)

+        goto fail;

+      p += pushed;

+      n -= pushed;

+

+      switch(br_pem_decoder_event(&pc)) {

+      case 0:

+        break;

+      case BR_PEM_BEGIN_OBJ:

+        name = br_pem_decoder_name(&pc);

+        if(strcmp(name, "CERTIFICATE") && strcmp(name, "X509 CERTIFICATE"))

+          break;

+        br_x509_decoder_init(&ca.xc, append_dn, &ca);

+        ca.in_cert = TRUE;

+        ca.dn_len = 0;

+        break;

+      case BR_PEM_END_OBJ:

+        if(!ca.in_cert)

+          break;

+        ca.in_cert = FALSE;

+        if(br_x509_decoder_last_error(&ca.xc)) {

+          ca.err = CURLE_SSL_CACERT_BADFILE;

+          goto fail;

+        }

+        /* add trust anchor */

+        if(ca.anchors_len == SIZE_MAX / sizeof(ca.anchors[0])) {

+          ca.err = CURLE_OUT_OF_MEMORY;

+          goto fail;

+        }

+        new_anchors_len = ca.anchors_len + 1;

+        new_anchors = realloc(ca.anchors,

+                              new_anchors_len * sizeof(ca.anchors[0]));

+        if(!new_anchors) {

+          ca.err = CURLE_OUT_OF_MEMORY;

+          goto fail;

+        }

+        ca.anchors = new_anchors;

+        ca.anchors_len = new_anchors_len;

+        ta = &ca.anchors[ca.anchors_len - 1];

+        ta->dn.data = NULL;

+        ta->flags = 0;

+        if(br_x509_decoder_isCA(&ca.xc))

+          ta->flags |= BR_X509_TA_CA;

+        pkey = br_x509_decoder_get_pkey(&ca.xc);

+        if(!pkey) {

+          ca.err = CURLE_SSL_CACERT_BADFILE;

+          goto fail;

+        }

+        ta->pkey = *pkey;

+

+        /* calculate space needed for trust anchor data */

+        ta_size = ca.dn_len;

+        switch(pkey->key_type) {

+        case BR_KEYTYPE_RSA:

+          ta_size += pkey->key.rsa.nlen + pkey->key.rsa.elen;

+          break;

+        case BR_KEYTYPE_EC:

+          ta_size += pkey->key.ec.qlen;

+          break;

+        default:

+          ca.err = CURLE_FAILED_INIT;

+          goto fail;

+        }

+

+        /* fill in trust anchor DN and public key data */

+        ta->dn.data = malloc(ta_size);

+        if(!ta->dn.data) {

+          ca.err = CURLE_OUT_OF_MEMORY;

+          goto fail;

+        }

+        memcpy(ta->dn.data, ca.dn, ca.dn_len);

+        ta->dn.len = ca.dn_len;

+        switch(pkey->key_type) {

+        case BR_KEYTYPE_RSA:

+          ta->pkey.key.rsa.n = ta->dn.data + ta->dn.len;

+          memcpy(ta->pkey.key.rsa.n, pkey->key.rsa.n, pkey->key.rsa.nlen);

+          ta->pkey.key.rsa.e = ta->pkey.key.rsa.n + ta->pkey.key.rsa.nlen;

+          memcpy(ta->pkey.key.rsa.e, pkey->key.rsa.e, pkey->key.rsa.elen);

+          break;

+        case BR_KEYTYPE_EC:

+          ta->pkey.key.ec.q = ta->dn.data + ta->dn.len;

+          memcpy(ta->pkey.key.ec.q, pkey->key.ec.q, pkey->key.ec.qlen);

+          break;

+        }

+        break;

+      default:

+        ca.err = CURLE_SSL_CACERT_BADFILE;

+        goto fail;

+      }

+    }

+  } while(source->type != CAFILE_SOURCE_BLOB);

+  if(fp && ferror(fp))

+    ca.err = CURLE_READ_ERROR;

+  else if(ca.in_cert)

+    ca.err = CURLE_SSL_CACERT_BADFILE;

+

+fail:

+  if(fp)

+    fclose(fp);

+  if(ca.err == CURLE_OK) {

+    *anchors = ca.anchors;

+    *anchors_len = ca.anchors_len;

+  }

+  else {

+    for(i = 0; i < ca.anchors_len; ++i)

+      free(ca.anchors[i].dn.data);

+    free(ca.anchors);

+  }

+

+  return ca.err;

+}

+

+static void x509_start_chain(const br_x509_class **ctx,

+                             const char *server_name)

+{

+  struct x509_context *x509 = (struct x509_context *)ctx;

+

+  if(!x509->verifypeer) {

+    x509->cert_num = 0;

+    return;

+  }

+

+  if(!x509->verifyhost)

+    server_name = NULL;

+  x509->minimal.vtable->start_chain(&x509->minimal.vtable, server_name);

+}

+

+static void x509_start_cert(const br_x509_class **ctx, uint32_t length)

+{

+  struct x509_context *x509 = (struct x509_context *)ctx;

+

+  if(!x509->verifypeer) {

+    /* Only decode the first cert in the chain to obtain the public key */

+    if(x509->cert_num == 0)

+      br_x509_decoder_init(&x509->decoder, NULL, NULL);

+    return;

+  }

+

+  x509->minimal.vtable->start_cert(&x509->minimal.vtable, length);

+}

+

+static void x509_append(const br_x509_class **ctx, const unsigned char *buf,

+                        size_t len)

+{

+  struct x509_context *x509 = (struct x509_context *)ctx;

+

+  if(!x509->verifypeer) {

+    if(x509->cert_num == 0)

+      br_x509_decoder_push(&x509->decoder, buf, len);

+    return;

+  }

+

+  x509->minimal.vtable->append(&x509->minimal.vtable, buf, len);

+}

+

+static void x509_end_cert(const br_x509_class **ctx)

+{

+  struct x509_context *x509 = (struct x509_context *)ctx;

+

+  if(!x509->verifypeer) {

+    x509->cert_num++;

+    return;

+  }

+

+  x509->minimal.vtable->end_cert(&x509->minimal.vtable);

+}

+

+static unsigned x509_end_chain(const br_x509_class **ctx)

+{

+  struct x509_context *x509 = (struct x509_context *)ctx;

+

+  if(!x509->verifypeer) {

+    return br_x509_decoder_last_error(&x509->decoder);

+  }

+

+  return x509->minimal.vtable->end_chain(&x509->minimal.vtable);

+}

+

+static const br_x509_pkey *x509_get_pkey(const br_x509_class *const *ctx,

+                                         unsigned *usages)

+{

+  struct x509_context *x509 = (struct x509_context *)ctx;

+

+  if(!x509->verifypeer) {

+    /* Nothing in the chain is verified, just return the public key of the

+       first certificate and allow its usage for both TLS_RSA_* and

+       TLS_ECDHE_* */

+    if(usages)

+      *usages = BR_KEYTYPE_KEYX | BR_KEYTYPE_SIGN;

+    return br_x509_decoder_get_pkey(&x509->decoder);

+  }

+

+  return x509->minimal.vtable->get_pkey(&x509->minimal.vtable, usages);

+}

+

+static const br_x509_class x509_vtable = {

+  sizeof(struct x509_context),

+  x509_start_chain,

+  x509_start_cert,

+  x509_append,

+  x509_end_cert,

+  x509_end_chain,

+  x509_get_pkey

+};

+

+struct st_cipher {

+  const char *name; /* Cipher suite IANA name. It starts with "TLS_" prefix */

+  const char *alias_name; /* Alias name is the same as OpenSSL cipher name */

+  uint16_t num; /* BearSSL cipher suite */

+};

+

+/* Macro to initialize st_cipher data structure */

+#define CIPHER_DEF(num, alias) { #num, alias, BR_##num }

+

+static const struct st_cipher ciphertable[] = {

+  /* RFC 2246 TLS 1.0 */

+  CIPHER_DEF(TLS_RSA_WITH_3DES_EDE_CBC_SHA,                        /* 0x000A */

+             "DES-CBC3-SHA"),

+

+  /* RFC 3268 TLS 1.0 AES */

+  CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA,                         /* 0x002F */

+             "AES128-SHA"),

+  CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA,                         /* 0x0035 */

+             "AES256-SHA"),

+

+  /* RFC 5246 TLS 1.2 */

+  CIPHER_DEF(TLS_RSA_WITH_AES_128_CBC_SHA256,                      /* 0x003C */

+             "AES128-SHA256"),

+  CIPHER_DEF(TLS_RSA_WITH_AES_256_CBC_SHA256,                      /* 0x003D */

+             "AES256-SHA256"),

+

+  /* RFC 5288 TLS 1.2 AES GCM */

+  CIPHER_DEF(TLS_RSA_WITH_AES_128_GCM_SHA256,                      /* 0x009C */

+             "AES128-GCM-SHA256"),

+  CIPHER_DEF(TLS_RSA_WITH_AES_256_GCM_SHA384,                      /* 0x009D */

+             "AES256-GCM-SHA384"),

+

+  /* RFC 4492 TLS 1.0 ECC */

+  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,                 /* 0xC003 */

+             "ECDH-ECDSA-DES-CBC3-SHA"),

+  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,                  /* 0xC004 */

+             "ECDH-ECDSA-AES128-SHA"),

+  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,                  /* 0xC005 */

+             "ECDH-ECDSA-AES256-SHA"),

+  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,                /* 0xC008 */

+             "ECDHE-ECDSA-DES-CBC3-SHA"),

+  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,                 /* 0xC009 */

+             "ECDHE-ECDSA-AES128-SHA"),

+  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,                 /* 0xC00A */

+             "ECDHE-ECDSA-AES256-SHA"),

+  CIPHER_DEF(TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,                   /* 0xC00D */

+             "ECDH-RSA-DES-CBC3-SHA"),

+  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,                    /* 0xC00E */

+             "ECDH-RSA-AES128-SHA"),

+  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,                    /* 0xC00F */

+             "ECDH-RSA-AES256-SHA"),

+  CIPHER_DEF(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,                  /* 0xC012 */

+             "ECDHE-RSA-DES-CBC3-SHA"),

+  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,                   /* 0xC013 */

+             "ECDHE-RSA-AES128-SHA"),

+  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,                   /* 0xC014 */

+             "ECDHE-RSA-AES256-SHA"),

+

+  /* RFC 5289 TLS 1.2 ECC HMAC SHA256/384 */

+  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,              /* 0xC023 */

+             "ECDHE-ECDSA-AES128-SHA256"),

+  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,              /* 0xC024 */

+             "ECDHE-ECDSA-AES256-SHA384"),

+  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,               /* 0xC025 */

+             "ECDH-ECDSA-AES128-SHA256"),

+  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,               /* 0xC026 */

+             "ECDH-ECDSA-AES256-SHA384"),

+  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,                /* 0xC027 */

+             "ECDHE-RSA-AES128-SHA256"),

+  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,                /* 0xC028 */

+             "ECDHE-RSA-AES256-SHA384"),

+  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,                 /* 0xC029 */

+             "ECDH-RSA-AES128-SHA256"),

+  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,                 /* 0xC02A */

+             "ECDH-RSA-AES256-SHA384"),

+

+  /* RFC 5289 TLS 1.2 GCM */

+  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,              /* 0xC02B */

+             "ECDHE-ECDSA-AES128-GCM-SHA256"),

+  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,              /* 0xC02C */

+             "ECDHE-ECDSA-AES256-GCM-SHA384"),

+  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,               /* 0xC02D */

+             "ECDH-ECDSA-AES128-GCM-SHA256"),

+  CIPHER_DEF(TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,               /* 0xC02E */

+             "ECDH-ECDSA-AES256-GCM-SHA384"),

+  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,                /* 0xC02F */

+             "ECDHE-RSA-AES128-GCM-SHA256"),

+  CIPHER_DEF(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,                /* 0xC030 */

+             "ECDHE-RSA-AES256-GCM-SHA384"),

+  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,                 /* 0xC031 */

+             "ECDH-RSA-AES128-GCM-SHA256"),

+  CIPHER_DEF(TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,                 /* 0xC032 */

+             "ECDH-RSA-AES256-GCM-SHA384"),

+#ifdef BR_TLS_RSA_WITH_AES_128_CCM

+

+  /* RFC 6655 TLS 1.2 CCM

+     Supported since BearSSL 0.6 */

+  CIPHER_DEF(TLS_RSA_WITH_AES_128_CCM,                             /* 0xC09C */

+             "AES128-CCM"),

+  CIPHER_DEF(TLS_RSA_WITH_AES_256_CCM,                             /* 0xC09D */

+             "AES256-CCM"),

+  CIPHER_DEF(TLS_RSA_WITH_AES_128_CCM_8,                           /* 0xC0A0 */

+             "AES128-CCM8"),

+  CIPHER_DEF(TLS_RSA_WITH_AES_256_CCM_8,                           /* 0xC0A1 */

+             "AES256-CCM8"),

+

+  /* RFC 7251 TLS 1.2 ECC CCM

+     Supported since BearSSL 0.6 */

+  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CCM,                     /* 0xC0AC */

+             "ECDHE-ECDSA-AES128-CCM"),

+  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CCM,                     /* 0xC0AD */

+             "ECDHE-ECDSA-AES256-CCM"),

+  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,                   /* 0xC0AE */

+             "ECDHE-ECDSA-AES128-CCM8"),

+  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8,                   /* 0xC0AF */

+             "ECDHE-ECDSA-AES256-CCM8"),

+#endif

+

+  /* RFC 7905 TLS 1.2 ChaCha20-Poly1305

+     Supported since BearSSL 0.2 */

+  CIPHER_DEF(TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,          /* 0xCCA8 */

+             "ECDHE-RSA-CHACHA20-POLY1305"),

+  CIPHER_DEF(TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,        /* 0xCCA9 */

+             "ECDHE-ECDSA-CHACHA20-POLY1305"),

+};

+

+#define NUM_OF_CIPHERS (sizeof(ciphertable) / sizeof(ciphertable[0]))

+#define CIPHER_NAME_BUF_LEN 64

+

+static bool is_separator(char c)

+{

+  /* Return whether character is a cipher list separator. */

+  switch(c) {

+    case ' ':

+    case '\t':

+    case ':':

+    case ',':

+    case ';':

+      return true;

+  }

+  return false;

+}

+

+static CURLcode bearssl_set_selected_ciphers(struct Curl_easy *data,

+                                             br_ssl_engine_context *ssl_eng,

+                                             const char *ciphers)

+{

+  uint16_t selected_ciphers[NUM_OF_CIPHERS];

+  size_t selected_count = 0;

+  char cipher_name[CIPHER_NAME_BUF_LEN];

+  const char *cipher_start = ciphers;

+  const char *cipher_end;

+  size_t i, j;

+

+  if(!cipher_start)

+    return CURLE_SSL_CIPHER;

+

+  while(true) {

+    /* Extract the next cipher name from the ciphers string */

+    while(is_separator(*cipher_start))

+      ++cipher_start;

+    if(*cipher_start == '\0')

+      break;

+    cipher_end = cipher_start;

+    while(*cipher_end != '\0' && !is_separator(*cipher_end))

+      ++cipher_end;

+    j = cipher_end - cipher_start < CIPHER_NAME_BUF_LEN - 1 ?

+        cipher_end - cipher_start : CIPHER_NAME_BUF_LEN - 1;

+    strncpy(cipher_name, cipher_start, j);

+    cipher_name[j] = '\0';

+    cipher_start = cipher_end;

+

+    /* Lookup the cipher name in the table of available ciphers. If the cipher

+       name starts with "TLS_" we do the lookup by IANA name. Otherwise, we try

+       to match cipher name by an (OpenSSL) alias. */

+    if(strncasecompare(cipher_name, "TLS_", 4)) {

+      for(i = 0; i < NUM_OF_CIPHERS &&

+                 !strcasecompare(cipher_name, ciphertable[i].name); ++i);

+    }

+    else {

+      for(i = 0; i < NUM_OF_CIPHERS &&

+                 !strcasecompare(cipher_name, ciphertable[i].alias_name); ++i);

+    }

+    if(i == NUM_OF_CIPHERS) {

+      infof(data, "BearSSL: unknown cipher in list: %s", cipher_name);

+      continue;

+    }

+

+    /* No duplicates allowed */

+    for(j = 0; j < selected_count &&

+               selected_ciphers[j] != ciphertable[i].num; j++);

+    if(j < selected_count) {

+      infof(data, "BearSSL: duplicate cipher in list: %s", cipher_name);

+      continue;

+    }

+

+    DEBUGASSERT(selected_count < NUM_OF_CIPHERS);

+    selected_ciphers[selected_count] = ciphertable[i].num;

+    ++selected_count;

+  }

+

+  if(selected_count == 0) {

+    failf(data, "BearSSL: no supported cipher in list");

+    return CURLE_SSL_CIPHER;

+  }

+

+  br_ssl_engine_set_suites(ssl_eng, selected_ciphers, selected_count);

+  return CURLE_OK;

+}

+

+static CURLcode bearssl_connect_step1(struct Curl_cfilter *cf,

+                                      struct Curl_easy *data)

+{

+  struct ssl_connect_data *connssl = cf->ctx;

+  struct ssl_backend_data *backend = connssl->backend;

+  struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);

+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);

+  const struct curl_blob *ca_info_blob = conn_config->ca_info_blob;

+  const char * const ssl_cafile =

+    /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */

+    (ca_info_blob ? NULL : conn_config->CAfile);

+  const char *hostname = connssl->hostname;

+  const bool verifypeer = conn_config->verifypeer;

+  const bool verifyhost = conn_config->verifyhost;

+  CURLcode ret;

+  unsigned version_min, version_max;

+#ifdef ENABLE_IPV6

+  struct in6_addr addr;

+#else

+  struct in_addr addr;

+#endif

+

+  DEBUGASSERT(backend);

+

+  switch(conn_config->version) {

+  case CURL_SSLVERSION_SSLv2:

+    failf(data, "BearSSL does not support SSLv2");

+    return CURLE_SSL_CONNECT_ERROR;

+  case CURL_SSLVERSION_SSLv3:

+    failf(data, "BearSSL does not support SSLv3");

+    return CURLE_SSL_CONNECT_ERROR;

+  case CURL_SSLVERSION_TLSv1_0:

+    version_min = BR_TLS10;

+    version_max = BR_TLS10;

+    break;

+  case CURL_SSLVERSION_TLSv1_1:

+    version_min = BR_TLS11;

+    version_max = BR_TLS11;

+    break;

+  case CURL_SSLVERSION_TLSv1_2:

+    version_min = BR_TLS12;

+    version_max = BR_TLS12;

+    break;

+  case CURL_SSLVERSION_DEFAULT:

+  case CURL_SSLVERSION_TLSv1:

+    version_min = BR_TLS10;

+    version_max = BR_TLS12;

+    break;

+  default:

+    failf(data, "BearSSL: unknown CURLOPT_SSLVERSION");

+    return CURLE_SSL_CONNECT_ERROR;

+  }

+

+  if(ca_info_blob) {

+    struct cafile_source source;

+    source.type = CAFILE_SOURCE_BLOB;

+    source.data = ca_info_blob->data;

+    source.len = ca_info_blob->len;

+

+    ret = load_cafile(&source, &backend->anchors, &backend->anchors_len);

+    if(ret != CURLE_OK) {

+      if(verifypeer) {

+        failf(data, "error importing CA certificate blob");

+        return ret;

+      }

+      /* Only warn if no certificate verification is required. */

+      infof(data, "error importing CA certificate blob, continuing anyway");

+    }

+  }

+

+  if(ssl_cafile) {

+    struct cafile_source source;

+    source.type = CAFILE_SOURCE_PATH;

+    source.data = ssl_cafile;

+    source.len = 0;

+

+    ret = load_cafile(&source, &backend->anchors, &backend->anchors_len);

+    if(ret != CURLE_OK) {

+      if(verifypeer) {

+        failf(data, "error setting certificate verify locations."

+              " CAfile: %s", ssl_cafile);

+        return ret;

+      }

+      infof(data, "error setting certificate verify locations,"

+            " continuing anyway:");

+    }

+  }

+

+  /* initialize SSL context */

+  br_ssl_client_init_full(&backend->ctx, &backend->x509.minimal,

+                          backend->anchors, backend->anchors_len);

+  br_ssl_engine_set_versions(&backend->ctx.eng, version_min, version_max);

+  br_ssl_engine_set_buffer(&backend->ctx.eng, backend->buf,

+                           sizeof(backend->buf), 1);

+

+  if(conn_config->cipher_list) {

+    /* Override the ciphers as specified. For the default cipher list see the

+       BearSSL source code of br_ssl_client_init_full() */

+    ret = bearssl_set_selected_ciphers(data, &backend->ctx.eng,

+                                       conn_config->cipher_list);

+    if(ret)

+      return ret;

+  }

+

+  /* initialize X.509 context */

+  backend->x509.vtable = &x509_vtable;

+  backend->x509.verifypeer = verifypeer;

+  backend->x509.verifyhost = verifyhost;

+  br_ssl_engine_set_x509(&backend->ctx.eng, &backend->x509.vtable);

+

+  if(ssl_config->primary.sessionid) {

+    void *session;

+

+    Curl_ssl_sessionid_lock(data);

+    if(!Curl_ssl_getsessionid(cf, data, &session, NULL)) {

+      br_ssl_engine_set_session_parameters(&backend->ctx.eng, session);

+      infof(data, "BearSSL: re-using session ID");

+    }

+    Curl_ssl_sessionid_unlock(data);

+  }

+

+  if(cf->conn->bits.tls_enable_alpn) {

+    int cur = 0;

+

+    /* NOTE: when adding more protocols here, increase the size of the

+     * protocols array in `struct ssl_backend_data`.

+     */

+

+#ifdef USE_HTTP2

+    if(data->state.httpwant >= CURL_HTTP_VERSION_2

+#ifndef CURL_DISABLE_PROXY

+      && (!Curl_ssl_cf_is_proxy(cf) || !cf->conn->bits.tunnel_proxy)

+#endif

+      ) {

+      backend->protocols[cur++] = ALPN_H2;

+      infof(data, VTLS_INFOF_ALPN_OFFER_1STR, ALPN_H2);

+    }

+#endif

+

+    backend->protocols[cur++] = ALPN_HTTP_1_1;

+    infof(data, VTLS_INFOF_ALPN_OFFER_1STR, ALPN_HTTP_1_1);

+

+    br_ssl_engine_set_protocol_names(&backend->ctx.eng,

+                                     backend->protocols, cur);

+  }

+

+  if((1 == Curl_inet_pton(AF_INET, hostname, &addr))

+#ifdef ENABLE_IPV6

+      || (1 == Curl_inet_pton(AF_INET6, hostname, &addr))

+#endif

+     ) {

+    if(verifyhost) {

+      failf(data, "BearSSL: "

+            "host verification of IP address is not supported");

+      return CURLE_PEER_FAILED_VERIFICATION;

+    }

+    hostname = NULL;

+  }

+  else {

+    char *snihost = Curl_ssl_snihost(data, hostname, NULL);

+    if(!snihost) {

+      failf(data, "Failed to set SNI");

+      return CURLE_SSL_CONNECT_ERROR;

+    }

+    hostname = snihost;

+  }

+

+  /* give application a chance to interfere with SSL set up. */

+  if(data->set.ssl.fsslctx) {

+    Curl_set_in_callback(data, true);

+    ret = (*data->set.ssl.fsslctx)(data, &backend->ctx,

+                                   data->set.ssl.fsslctxp);

+    Curl_set_in_callback(data, false);

+    if(ret) {

+      failf(data, "BearSSL: error signaled by ssl ctx callback");

+      return ret;

+    }

+  }

+

+  if(!br_ssl_client_reset(&backend->ctx, hostname, 1))

+    return CURLE_FAILED_INIT;

+  backend->active = TRUE;

+

+  connssl->connecting_state = ssl_connect_2;

+

+  return CURLE_OK;

+}

+

+static CURLcode bearssl_run_until(struct Curl_cfilter *cf,

+                                  struct Curl_easy *data,

+                                  unsigned target)

+{

+  struct ssl_connect_data *connssl = cf->ctx;

+  struct ssl_backend_data *backend = connssl->backend;

+  unsigned state;

+  unsigned char *buf;

+  size_t len;

+  ssize_t ret;

+  CURLcode result;

+  int err;

+

+  DEBUGASSERT(backend);

+

+  for(;;) {

+    state = br_ssl_engine_current_state(&backend->ctx.eng);

+    if(state & BR_SSL_CLOSED) {

+      err = br_ssl_engine_last_error(&backend->ctx.eng);

+      switch(err) {

+      case BR_ERR_OK:

+        /* TLS close notify */

+        if(connssl->state != ssl_connection_complete) {

+          failf(data, "SSL: connection closed during handshake");

+          return CURLE_SSL_CONNECT_ERROR;

+        }

+        return CURLE_OK;

+      case BR_ERR_X509_EXPIRED:

+        failf(data, "SSL: X.509 verification: "

+              "certificate is expired or not yet valid");

+        return CURLE_PEER_FAILED_VERIFICATION;

+      case BR_ERR_X509_BAD_SERVER_NAME:

+        failf(data, "SSL: X.509 verification: "

+              "expected server name was not found in the chain");

+        return CURLE_PEER_FAILED_VERIFICATION;

+      case BR_ERR_X509_NOT_TRUSTED:

+        failf(data, "SSL: X.509 verification: "

+              "chain could not be linked to a trust anchor");

+        return CURLE_PEER_FAILED_VERIFICATION;

+      }

+      /* X.509 errors are documented to have the range 32..63 */

+      if(err >= 32 && err < 64)

+        return CURLE_PEER_FAILED_VERIFICATION;

+      return CURLE_SSL_CONNECT_ERROR;

+    }

+    if(state & target)

+      return CURLE_OK;

+    if(state & BR_SSL_SENDREC) {

+      buf = br_ssl_engine_sendrec_buf(&backend->ctx.eng, &len);

+      ret = Curl_conn_cf_send(cf->next, data, (char *)buf, len, &result);

+      if(ret <= 0) {

+        return result;

+      }

+      br_ssl_engine_sendrec_ack(&backend->ctx.eng, ret);

+    }

+    else if(state & BR_SSL_RECVREC) {

+      buf = br_ssl_engine_recvrec_buf(&backend->ctx.eng, &len);

+      ret = Curl_conn_cf_recv(cf->next, data, (char *)buf, len, &result);

+      if(ret == 0) {

+        failf(data, "SSL: EOF without close notify");

+        return CURLE_READ_ERROR;

+      }

+      if(ret <= 0) {

+        return result;

+      }

+      br_ssl_engine_recvrec_ack(&backend->ctx.eng, ret);

+    }

+  }

+}

+

+static CURLcode bearssl_connect_step2(struct Curl_cfilter *cf,

+                                      struct Curl_easy *data)

+{

+  struct ssl_connect_data *connssl = cf->ctx;

+  struct ssl_backend_data *backend = connssl->backend;

+  CURLcode ret;

+

+  DEBUGASSERT(backend);

+

+  ret = bearssl_run_until(cf, data, BR_SSL_SENDAPP | BR_SSL_RECVAPP);

+  if(ret == CURLE_AGAIN)

+    return CURLE_OK;

+  if(ret == CURLE_OK) {

+    if(br_ssl_engine_current_state(&backend->ctx.eng) == BR_SSL_CLOSED) {

+      failf(data, "SSL: connection closed during handshake");

+      return CURLE_SSL_CONNECT_ERROR;

+    }

+    connssl->connecting_state = ssl_connect_3;

+  }

+  return ret;

+}

+

+static CURLcode bearssl_connect_step3(struct Curl_cfilter *cf,

+                                      struct Curl_easy *data)

+{

+  struct ssl_connect_data *connssl = cf->ctx;

+  struct ssl_backend_data *backend = connssl->backend;

+  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);

+  CURLcode ret;

+

+  DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);

+  DEBUGASSERT(backend);

+

+  if(cf->conn->bits.tls_enable_alpn) {

+    const char *protocol;

+

+    protocol = br_ssl_engine_get_selected_protocol(&backend->ctx.eng);

+    if(protocol) {

+      infof(data, VTLS_INFOF_ALPN_ACCEPTED_1STR, protocol);

+

+#ifdef USE_HTTP2

+      if(!strcmp(protocol, ALPN_H2))

+        cf->conn->alpn = CURL_HTTP_VERSION_2;

+      else

+#endif

+      if(!strcmp(protocol, ALPN_HTTP_1_1))

+        cf->conn->alpn = CURL_HTTP_VERSION_1_1;

+      else

+        infof(data, "ALPN, unrecognized protocol %s", protocol);

+      Curl_multiuse_state(data, cf->conn->alpn == CURL_HTTP_VERSION_2 ?

+                          BUNDLE_MULTIPLEX : BUNDLE_NO_MULTIUSE);

+    }

+    else

+      infof(data, VTLS_INFOF_NO_ALPN);

+  }

+

+  if(ssl_config->primary.sessionid) {

+    bool incache;

+    bool added = FALSE;

+    void *oldsession;

+    br_ssl_session_parameters *session;

+

+    session = malloc(sizeof(*session));

+    if(!session)

+      return CURLE_OUT_OF_MEMORY;

+    br_ssl_engine_get_session_parameters(&backend->ctx.eng, session);

+    Curl_ssl_sessionid_lock(data);

+    incache = !(Curl_ssl_getsessionid(cf, data, &oldsession, NULL));

+    if(incache)

+      Curl_ssl_delsessionid(data, oldsession);

+    ret = Curl_ssl_addsessionid(cf, data, session, 0, &added);

+    Curl_ssl_sessionid_unlock(data);

+    if(!added)

+      free(session);

+    if(ret) {

+      return CURLE_OUT_OF_MEMORY;

+    }

+  }

+

+  connssl->connecting_state = ssl_connect_done;

+

+  return CURLE_OK;

+}

+

+static ssize_t bearssl_send(struct Curl_cfilter *cf, struct Curl_easy *data,

+                            const void *buf, size_t len, CURLcode *err)

+{

+  struct ssl_connect_data *connssl = cf->ctx;

+  struct ssl_backend_data *backend = connssl->backend;

+  unsigned char *app;

+  size_t applen;

+

+  DEBUGASSERT(backend);

+

+  for(;;) {

+    *err = bearssl_run_until(cf, data, BR_SSL_SENDAPP);

+    if (*err != CURLE_OK)

+      return -1;

+    app = br_ssl_engine_sendapp_buf(&backend->ctx.eng, &applen);

+    if(!app) {

+      failf(data, "SSL: connection closed during write");

+      *err = CURLE_SEND_ERROR;

+      return -1;

+    }

+    if(backend->pending_write) {

+      applen = backend->pending_write;

+      backend->pending_write = 0;

+      return applen;

+    }

+    if(applen > len)

+      applen = len;

+    memcpy(app, buf, applen);

+    br_ssl_engine_sendapp_ack(&backend->ctx.eng, applen);

+    br_ssl_engine_flush(&backend->ctx.eng, 0);

+    backend->pending_write = applen;

+  }

+}

+

+static ssize_t bearssl_recv(struct Curl_cfilter *cf, struct Curl_easy *data,

+                            char *buf, size_t len, CURLcode *err)

+{

+  struct ssl_connect_data *connssl = cf->ctx;

+  struct ssl_backend_data *backend = connssl->backend;

+  unsigned char *app;

+  size_t applen;

+

+  DEBUGASSERT(backend);

+

+  *err = bearssl_run_until(cf, data, BR_SSL_RECVAPP);

+  if(*err != CURLE_OK)

+    return -1;

+  app = br_ssl_engine_recvapp_buf(&backend->ctx.eng, &applen);

+  if(!app)

+    return 0;

+  if(applen > len)

+    applen = len;

+  memcpy(buf, app, applen);

+  br_ssl_engine_recvapp_ack(&backend->ctx.eng, applen);

+

+  return applen;

+}

+

+static CURLcode bearssl_connect_common(struct Curl_cfilter *cf,

+                                       struct Curl_easy *data,

+                                       bool nonblocking,

+                                       bool *done)

+{

+  CURLcode ret;

+  struct ssl_connect_data *connssl = cf->ctx;

+  curl_socket_t sockfd = cf->conn->sock[cf->sockindex];

+  timediff_t timeout_ms;

+  int what;

+

+  /* check if the connection has already been established */

+  if(ssl_connection_complete == connssl->state) {

+    *done = TRUE;

+    return CURLE_OK;

+  }

+

+  if(ssl_connect_1 == connssl->connecting_state) {

+    ret = bearssl_connect_step1(cf, data);

+    if(ret)

+      return ret;

+  }

+

+  while(ssl_connect_2 == connssl->connecting_state ||

+        ssl_connect_2_reading == connssl->connecting_state ||

+        ssl_connect_2_writing == connssl->connecting_state) {

+    /* check allowed time left */

+    timeout_ms = Curl_timeleft(data, NULL, TRUE);

+

+    if(timeout_ms < 0) {

+      /* no need to continue if time already is up */

+      failf(data, "SSL connection timeout");

+      return CURLE_OPERATION_TIMEDOUT;

+    }

+

+    /* if ssl is expecting something, check if it's available. */

+    if(ssl_connect_2_reading == connssl->connecting_state ||

+       ssl_connect_2_writing == connssl->connecting_state) {

+

+      curl_socket_t writefd = ssl_connect_2_writing ==

+        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;

+      curl_socket_t readfd = ssl_connect_2_reading ==

+        connssl->connecting_state?sockfd:CURL_SOCKET_BAD;

+

+      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd,

+                               nonblocking?0:timeout_ms);

+      if(what < 0) {

+        /* fatal error */

+        failf(data, "select/poll on SSL socket, errno: %d", SOCKERRNO);

+        return CURLE_SSL_CONNECT_ERROR;

+      }

+      else if(0 == what) {

+        if(nonblocking) {

+          *done = FALSE;

+          return CURLE_OK;

+        }

+        else {

+          /* timeout */

+          failf(data, "SSL connection timeout");

+          return CURLE_OPERATION_TIMEDOUT;

+        }

+      }

+      /* socket is readable or writable */

+    }

+

+    /* Run transaction, and return to the caller if it failed or if this

+     * connection is done nonblocking and this loop would execute again. This

+     * permits the owner of a multi handle to abort a connection attempt

+     * before step2 has completed while ensuring that a client using select()

+     * or epoll() will always have a valid fdset to wait on.

+     */

+    ret = bearssl_connect_step2(cf, data);

+    if(ret || (nonblocking &&

+               (ssl_connect_2 == connssl->connecting_state ||

+                ssl_connect_2_reading == connssl->connecting_state ||

+                ssl_connect_2_writing == connssl->connecting_state)))

+      return ret;

+  }

+

+  if(ssl_connect_3 == connssl->connecting_state) {

+    ret = bearssl_connect_step3(cf, data);

+    if(ret)

+      return ret;

+  }

+

+  if(ssl_connect_done == connssl->connecting_state) {

+    connssl->state = ssl_connection_complete;

+    *done = TRUE;

+  }

+  else

+    *done = FALSE;

+

+  /* Reset our connect state machine */

+  connssl->connecting_state = ssl_connect_1;

+

+  return CURLE_OK;

+}

+

+static size_t bearssl_version(char *buffer, size_t size)

+{

+  return msnprintf(buffer, size, "BearSSL");

+}

+

+static bool bearssl_data_pending(struct Curl_cfilter *cf,

+                                 const struct Curl_easy *data)

+{

+  struct ssl_connect_data *ctx = cf->ctx;

+

+  (void)data;

+  DEBUGASSERT(ctx && ctx->backend);

+  return br_ssl_engine_current_state(&ctx->backend->ctx.eng) & BR_SSL_RECVAPP;

+}

+

+static CURLcode bearssl_random(struct Curl_easy *data UNUSED_PARAM,

+                               unsigned char *entropy, size_t length)

+{

+  static br_hmac_drbg_context ctx;

+  static bool seeded = FALSE;

+

+  if(!seeded) {

+    br_prng_seeder seeder;

+

+    br_hmac_drbg_init(&ctx, &br_sha256_vtable, NULL, 0);

+    seeder = br_prng_seeder_system(NULL);

+    if(!seeder || !seeder(&ctx.vtable))

+      return CURLE_FAILED_INIT;

+    seeded = TRUE;

+  }

+  br_hmac_drbg_generate(&ctx, entropy, length);

+

+  return CURLE_OK;

+}

+

+static CURLcode bearssl_connect(struct Curl_cfilter *cf,

+                                struct Curl_easy *data)

+{

+  CURLcode ret;

+  bool done = FALSE;

+

+  ret = bearssl_connect_common(cf, data, FALSE, &done);

+  if(ret)

+    return ret;

+

+  DEBUGASSERT(done);

+

+  return CURLE_OK;

+}

+

+static CURLcode bearssl_connect_nonblocking(struct Curl_cfilter *cf,

+                                            struct Curl_easy *data,

+                                            bool *done)

+{

+  return bearssl_connect_common(cf, data, TRUE, done);

+}

+

+static void *bearssl_get_internals(struct ssl_connect_data *connssl,

+                                   CURLINFO info UNUSED_PARAM)

+{

+  struct ssl_backend_data *backend = connssl->backend;

+  DEBUGASSERT(backend);

+  return &backend->ctx;

+}

+

+static void bearssl_close(struct Curl_cfilter *cf, struct Curl_easy *data)

+{

+  struct ssl_connect_data *connssl = cf->ctx;

+  struct ssl_backend_data *backend = connssl->backend;

+  size_t i;

+

+  DEBUGASSERT(backend);

+

+  if(backend->active) {

+    backend->active = FALSE;

+    br_ssl_engine_close(&backend->ctx.eng);

+    (void)bearssl_run_until(cf, data, BR_SSL_CLOSED);

+  }

+  if(backend->anchors) {

+    for(i = 0; i < backend->anchors_len; ++i)

+      free(backend->anchors[i].dn.data);

+    Curl_safefree(backend->anchors);

+  }

+}

+

+static void bearssl_session_free(void *ptr)

+{

+  free(ptr);

+}

+

+static CURLcode bearssl_sha256sum(const unsigned char *input,

+                                  size_t inputlen,

+                                  unsigned char *sha256sum,

+                                  size_t sha256len UNUSED_PARAM)

+{

+  br_sha256_context ctx;

+

+  br_sha256_init(&ctx);

+  br_sha256_update(&ctx, input, inputlen);

+  br_sha256_out(&ctx, sha256sum);

+  return CURLE_OK;

+}

+

+const struct Curl_ssl Curl_ssl_bearssl = {

+  { CURLSSLBACKEND_BEARSSL, "bearssl" }, /* info */

+  SSLSUPP_CAINFO_BLOB | SSLSUPP_SSL_CTX | SSLSUPP_HTTPS_PROXY,

+  sizeof(struct ssl_backend_data),

+

+  Curl_none_init,                  /* init */

+  Curl_none_cleanup,               /* cleanup */

+  bearssl_version,                 /* version */

+  Curl_none_check_cxn,             /* check_cxn */

+  Curl_none_shutdown,              /* shutdown */

+  bearssl_data_pending,            /* data_pending */

+  bearssl_random,                  /* random */

+  Curl_none_cert_status_request,   /* cert_status_request */

+  bearssl_connect,                 /* connect */

+  bearssl_connect_nonblocking,     /* connect_nonblocking */

+  Curl_ssl_get_select_socks,                /* getsock */

+  bearssl_get_internals,           /* get_internals */

+  bearssl_close,                   /* close_one */

+  Curl_none_close_all,             /* close_all */

+  bearssl_session_free,            /* session_free */

+  Curl_none_set_engine,            /* set_engine */

+  Curl_none_set_engine_default,    /* set_engine_default */

+  Curl_none_engines_list,          /* engines_list */

+  Curl_none_false_start,           /* false_start */

+  bearssl_sha256sum,               /* sha256sum */

+  NULL,                            /* associate_connection */

+  NULL,                            /* disassociate_connection */

+  NULL,                            /* free_multi_ssl_backend_data */

+  bearssl_recv,                    /* recv decrypted data */

+  bearssl_send,                    /* send data to encrypt */

+};

+

+#endif /* USE_BEARSSL */