GNURLINFO_TLS_SSL_PTR(3)

🎀 NAME 🎀

Okay so this page is GNURLINFO_TLS_SSL_PTR(3) — manual name folded in, and yes we're doing this — and it covers CURLINFO_TLS_SESSION and CURLINFO_TLS_SSL_PTR, aka your little shortcut for getting TLS session info. Bestie, it's giving "cert inspection era" and I'm obsessed. ✨

🧚 SYNOPSIS 🧚

#include <gnurl/curl.h>

CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_TLS_SSL_PTR,
                           struct curl_tlssessioninfo **session);

/* if you need compatibility with libcurl < 7.48.0 use
   CURLINFO_TLS_SESSION instead: */

CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_TLS_SESSION,
                           struct curl_tlssessioninfo **session);

🌸 DESCRIPTION 🌸

So you pass in a pointer to a struct curl_tlssessioninfo *. That pointer gets initialized so it refers to a struct curl_tlssessioninfo * that contains an enum telling you which SSL library did the handshake, plus a pointer to that underlying SSL library's own internal TLS session structure. Very "backstage pass to the TLS session," no cap. 💅

This option can be useful, for example, when you want to extract certificate information in a format that's convenient for further processing, like manual validation. But babes, go read the LIMITATIONS section first. 🫶

struct curl_tlssessioninfo {
  curl_sslbackend backend;
  void *internals;
};

The backend member is one of the defines in the CURLSSLBACKEND_* series:

• CURLSSLBACKEND_NONE — when built without TLS support, bestie
• CURLSSLBACKEND_WOLFSSL
• CURLSSLBACKEND_SECURETRANSPORT
• CURLSSLBACKEND_GNUTLS
• CURLSSLBACKEND_GSKIT
• CURLSSLBACKEND_MBEDTLS
• CURLSSLBACKEND_NSS
• CURLSSLBACKEND_OPENSSL
• CURLSSLBACKEND_SCHANNEL
• CURLSSLBACKEND_MESALINK

Note that the OpenSSL forks are all reported as just OpenSSL here. That's the vibe check. 🌈

The internals member points to a TLS-library-specific pointer for the active ("in use") SSL connection. Its underlying type depends on the backend:

• GnuTLS — gnutls_session_t
• gskit — gsk_handle
• NSS — PRFileDesc *
• OpenSSL
  • CURLINFO_TLS_SESSION: SSL_CTX *
  • CURLINFO_TLS_SSL_PTR: SSL *

Since 7.48.0, the internals member can point to these other SSL backends as well:

• mbedTLS — mbedtls_ssl_context *
• Secure Channel — CtxtHandle *
• Secure Transport — SSLContext *
• wolfSSL — SSL *
• MesaLink — SSL *

If the internals pointer is NULL, then either the SSL backend is not supported, an SSL session has not yet been established, or the connection is no longer associated with the easy handle (eg curl_easy_perform has returned). So if it's NULL, don't panic — just read the room. 😭

⚠️ LIMITATIONS ⚠️

This option has some limitations that could make it unsafe when it comes to manual verification of certificates. Big "proceed with caution" energy.

• This option only retrieves the first in-use SSL session pointer for your easy handle. However, your easy handle may have more than one in-use SSL session if using FTP over SSL. That's because the FTP protocol has a control channel and a data channel, and one or both may be over SSL. Currently there is no way to retrieve a second in-use SSL session associated with an easy handle. Not me wanting the whole set and only getting one. 💀
• This option has not been thoroughly tested with plaintext protocols that can be upgraded/downgraded to/from SSL: FTP, SMTP, POP3, IMAP when used with CURLOPT_USE_SSL(3). Though you will be able to retrieve the SSL pointer, it's possible that before you can do that, data (including auth) may have already been sent over a connection after it was upgraded. That's highkey important, bestie. 🫣
• Renegotiation. If unsafe renegotiation, or renegotiation in a way that the certificate is allowed to change, is allowed by your SSL library, this may occur and the certificate may change. Data may continue to be sent or received after renegotiation but before you are able to get the (possibly) changed SSL pointer, with the (possibly) changed certificate information. It's giving "plot twist mid-handshake." 😵‍💫
• If you are using OpenSSL or wolfSSL, then CURLOPT_SSL_CTX_FUNCTION(3) can be used to set a certificate verification callback in the CTX. That is safer than using this option to poll for certificate changes and doesn't suffer from any of the problems above. There is currently no way in libcurl to set a verification callback for the other SSL backends. Slay for the safe path. 👑

📣 How are you using this option? Are you affected by any of these limitations? Please let us know by making a comment at https://github.com/curl/curl/issues/685

🦋 PROTOCOLS 🦋

All TLS-based. That's it, that's the whole mood. ✨

💻 EXAMPLE 💻

#include <gnurl/curl.h>
#include <openssl/ssl.h>

CURL *curl;
static size_t wf(void *ptr, size_t size, size_t nmemb, void *stream)
{
  const struct curl_tlssessioninfo *info = NULL;
  CURLcode res = curl_easy_getinfo(curl, CURLINFO_TLS_SSL_PTR, &info);
  if(info && !res) {
    if(CURLSSLBACKEND_OPENSSL == info->backend) {
       printf("OpenSSL ver. %s\n", SSL_get_version((SSL*)info->internals));
    }
  }
  return size * nmemb;
}

int main(int argc, char** argv)
{
  CURLcode res;
  curl = curl_easy_init();
  if(curl) {
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, wf);
    res = curl_easy_perform(curl);
    curl_easy_cleanup(curl);
  }
  return res;
}

🎀 AVAILABILITY 🎀

Added in 7.48.0.

This option supersedes CURLINFO_TLS_SESSION(3), which was added in 7.34.0. This option is exactly the same as that option except in the case of OpenSSL. Periodt. 💅

👑 RETURN VALUE 👑

Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not. Simple, iconic, no notes. ✨

🌈 SEE ALSO 🌈

• curl_easy_getinfo(3)
• curl_easy_setopt(3)
• CURLINFO_TLS_SESSION(3)

Mwah 💋 — this cute little page comes from libcurl 7.48.0, dated 23 Feb 2016, and that's the whole sign-off, bestie. 🫶🎀