mirror of
https://github.com/curl/curl
synced 2026-08-25 12:32:35 -04:00
a55731050e
Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.
New libcurl options:
- CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
- CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
- CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
- CURLOPT_HTTPSIG_HEADERS: space-separated components to sign
New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers
The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.
Verified by test 5000 to 5021
Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes #22386
Closes #21239
72 lines
2.9 KiB
C
72 lines
2.9 KiB
C
#ifndef HEADER_CURL_HMAC_H
|
|
#define HEADER_CURL_HMAC_H
|
|
/***************************************************************************
|
|
* _ _ ____ _
|
|
* Project ___| | | | _ \| |
|
|
* / __| | | | |_) | |
|
|
* | (__| |_| | _ <| |___
|
|
* \___|\___/|_| \_\_____|
|
|
*
|
|
* Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
|
|
*
|
|
* This software is licensed as described in the file COPYING, which
|
|
* you should have received as part of this distribution. The terms
|
|
* are also available at https://curl.se/docs/copyright.html.
|
|
*
|
|
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
|
|
* copies of the Software, and permit persons to whom the Software is
|
|
* furnished to do so, under the terms of the COPYING file.
|
|
*
|
|
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
|
|
* KIND, either express or implied.
|
|
*
|
|
* SPDX-License-Identifier: curl
|
|
*
|
|
***************************************************************************/
|
|
|
|
#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) || \
|
|
!defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) || \
|
|
!defined(CURL_DISABLE_HTTPSIG) || \
|
|
defined(USE_LIBSSH2) || defined(USE_SSL)
|
|
|
|
#define HMAC_MD5_LENGTH 16
|
|
|
|
typedef CURLcode (*HMAC_hinit)(void *context);
|
|
typedef void (*HMAC_hupdate)(void *context,
|
|
const unsigned char *data,
|
|
unsigned int len);
|
|
typedef void (*HMAC_hfinal)(unsigned char *result, void *context);
|
|
|
|
/* Per-hash function HMAC parameters. */
|
|
struct HMAC_params {
|
|
HMAC_hinit hinit; /* Initialize context procedure. */
|
|
HMAC_hupdate hupdate; /* Update context with data. */
|
|
HMAC_hfinal hfinal; /* Get final result procedure. */
|
|
unsigned int ctxtsize; /* Context structure size. */
|
|
unsigned int maxkeylen; /* Maximum key length (bytes). */
|
|
unsigned int resultlen; /* Result length (bytes). */
|
|
};
|
|
|
|
/* HMAC computation context. */
|
|
struct HMAC_context {
|
|
const struct HMAC_params *hash; /* Hash function definition. */
|
|
void *hashctxt1; /* Hash function context 1. */
|
|
void *hashctxt2; /* Hash function context 2. */
|
|
};
|
|
|
|
/* Prototypes. */
|
|
struct HMAC_context *Curl_HMAC_init(const struct HMAC_params *hashparams,
|
|
const unsigned char *key,
|
|
unsigned int keylen);
|
|
void Curl_HMAC_update(struct HMAC_context *ctxt,
|
|
const unsigned char *data,
|
|
unsigned int len);
|
|
int Curl_HMAC_final(struct HMAC_context *ctxt, unsigned char *output);
|
|
|
|
CURLcode Curl_hmacit(const struct HMAC_params *hashparams,
|
|
const unsigned char *key, const size_t keylen,
|
|
const unsigned char *data, size_t datalen,
|
|
unsigned char *output);
|
|
#endif
|
|
|
|
#endif /* HEADER_CURL_HMAC_H */
|