a55731050e
Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.
New libcurl options:
- CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
- CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
- CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
- CURLOPT_HTTPSIG_HEADERS: space-separated components to sign
New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers
The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.
Verified by test 5000 to 5021
Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes #22386
Closes #21239
1.9 KiB
| c | SPDX-License-Identifier | Title | Section | Source | See-also | Protocol | Added-in | |||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. | curl | CURLOPT_HTTPSIG_ALGORITHM | 3 | libcurl |
|
|
8.22.0 |
NAME
CURLOPT_HTTPSIG_ALGORITHM - RFC 9421 HTTP Message Signatures algorithm
SYNOPSIS
#include <curl/curl.h>
CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPSIG_ALGORITHM,
long algorithm);
DESCRIPTION
This feature is experimental and may change before it is considered stable. We advise against using it in production.
Enable RFC 9421 HTTP Message Signatures on outgoing requests. Pass a long set to one of the values below to select the signing algorithm.
CURLHTTPSIG_NONE (0)
Disable HTTP Message Signatures.
CURLHTTPSIG_ED25519 (1)
Sign with Ed25519 (RFC 8032). Requires a TLS backend with Ed25519 support.
CURLHTTPSIG_HMAC_SHA256 (2)
Sign with HMAC-SHA256.
Setting this option to a non-zero value also sets CURLOPT_HTTPAUTH(3) to CURLAUTH_HTTPSIG. The options CURLOPT_HTTPSIG_KEY(3) and CURLOPT_HTTPSIG_KEYID(3) must also be set.
DEFAULT
CURLHTTPSIG_NONE (0)
%PROTOCOLS%
EXAMPLE
int main(void)
{
CURL *curl = curl_easy_init();
if(curl) {
curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/api");
curl_easy_setopt(curl, CURLOPT_HTTPSIG_ALGORITHM,
CURLHTTPSIG_ED25519);
curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEY,
"9f8362f87a484a954e6e740c5b4c0e84"
"229139a20aa8ab56ff66586f6a7d29c5");
curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEYID, "my-key-id");
curl_easy_perform(curl);
}
}
%AVAILABILITY%
RETURN VALUE
curl_easy_setopt(3) returns a CURLcode indicating success or error.
CURLE_OK (0) means everything was OK, non-zero means an error occurred, see libcurl-errors(3).