summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authormoparisthebest <admin@moparisthebest.com>2014-09-30 22:31:17 -0400
committerDaniel Stenberg <daniel@haxx.se>2014-10-07 14:44:19 +0200
commit93e450793ce289925dfd1d5e3b2d14e781f8dfd4 (patch)
tree3ceea898922e067a4a692204f6388ab633deebef /include
parentd1b56d00439ab26d7fc43e37ab18ae331ddc400d (diff)
downloadcurl-93e450793ce289925dfd1d5e3b2d14e781f8dfd4.tar.gz
SSL: implement public key pinning
Option --pinnedpubkey takes a path to a public key in DER format and only connect if it matches (currently only implemented with OpenSSL). Provides CURLOPT_PINNEDPUBLICKEY for curl_easy_setopt(). Extract a public RSA key from a website like so: openssl s_client -connect google.com:443 2>&1 < /dev/null | \ sed -n '/-----BEGIN/,/-----END/p' | openssl x509 -noout -pubkey \ | openssl rsa -pubin -outform DER > google.com.der
Diffstat (limited to 'include')
-rw-r--r--include/curl/curl.h6
1 files changed, 6 insertions, 0 deletions
diff --git a/include/curl/curl.h b/include/curl/curl.h
index d40b2dbbf..ccd9c3bcb 100644
--- a/include/curl/curl.h
+++ b/include/curl/curl.h
@@ -521,6 +521,8 @@ typedef enum {
CURLE_CHUNK_FAILED, /* 88 - chunk callback reported error */
CURLE_NO_CONNECTION_AVAILABLE, /* 89 - No connection available, the
session will be queued */
+ CURLE_SSL_PINNEDPUBKEYNOTMATCH, /* 90 - specified pinned public key did not
+ match */
CURL_LAST /* never use! */
} CURLcode;
@@ -1611,6 +1613,10 @@ typedef enum {
/* Pass in a bitmask of "header options" */
CINIT(HEADEROPT, LONG, 229),
+ /* The public key in DER form used to validate the peer public key
+ this option is used only if SSL_VERIFYPEER is true */
+ CINIT(PINNEDPUBLICKEY, OBJECTPOINT, 230),
+
CURLOPT_LASTENTRY /* the last unused */
} CURLoption;