aboutsummaryrefslogtreecommitdiff
path: root/lib/gtls.c
AgeCommit message (Collapse)Author
2012-06-14Fix bad failf() and info() usageYang Tse
Calls to failf() are not supposed to provide trailing newline. Calls to infof() must provide trailing newline. Fixed 30 or so strings.
2012-01-24gnutls: enforced use of SSLv3Daniel Stenberg
With advice from Nikos Mavrogiannopoulos, changed the priority string to add "actual priorities" and favour ARCFOUR. This makes libcurl work better when enforcing SSLv3 with GnuTLS. Both in the sense that the libmicrohttpd test is now working again but also that it mitigates a weakness in the older SSL/TLS protocols. Bug: http://curl.haxx.se/mail/lib-2012-01/0225.html Reported by: Christian Grothoff
2012-01-16add LF termination to infof() trace stringYang Tse
2011-11-24Fix unreleased regression when using windows gnutls versions older than 2.8Yang Tse
2011-11-23gnutls: only translate winsock errors for old versionsMark Brand
Bugfix: https handshake fails using gnutls 3 on windows http://sourceforge.net/tracker/index.php?func=detail&aid=3441084&group_id=976&atid=100976 New gnutls versions have an error handler that knows about Winsock errors, which is why gnutls_transport_set_global_errno() was deprecated and then removed. This is a correction of commit f5bb370 (blame me) which meant to reimplement gnutls_transport_set_global_errno(), which is not necessary.
2011-11-19Add support for using nettle instead of gcrypt as gnutls backendMartin Storsjo
2011-11-02gtls_connect_step1: remove use of deprecated functionsDaniel Stenberg
Use gnutls_priority_set_direct() instead of gnutls_protocol_set_priority(). Remove the gnutls_certificate_type_set_priority() use since x509 is the default certificate type anyway. Reported by: Vincent Torri
2011-10-29gtls.c: gnutls_transport_set_global_errno() deprecated in version 2.12.3Yang Tse
2011-10-20gtls: only call gnutls_transport_set_lowat with <gnutls-2.12.0Tim Harder
The default lowat level for gnutls-2.12* is set to zero to avoid unnecessary system calls and the gnutls_transport_set_lowat function has been totally removed in >=gnutls-3 which causes build failures. Therefore, the function shouldn't be used except for versions that require it, <gnutls-2.12.0.
2011-07-26stdio.h, stdlib.h, string.h, stdarg.h and ctype.h inclusion done in setup_once.hYang Tse
2011-06-04Curl_socket_ready: make timeout a 'long'Daniel Stenberg
It was mostly typecasted to int all over the code so switching to long instead all over should be a net gain.
2011-05-18GnuTLS handshake: fix timeoutDaniel Stenberg
Commit cbf4961bf3e garbled the timeout handling while doing SSL handshaking (in an attempt at fixing another bug). This puts sanity back. Bug: http://curl.haxx.se/mail/lib-2011-05/0167.html Reported by: Ethan Glasser Camp
2011-04-27whitespace cleanup: no space first in conditionalsDaniel Stenberg
"if(a)" is our style, not "if( a )"
2011-04-27source cleanup: unify look, style and indent levelsDaniel Stenberg
By the use of a the new lib/checksrc.pl script that checks that our basic source style rules are followed.
2011-02-09CURLE_TLSAUTH_FAILED: removedQuinn Slack
On second thought, I think CURLE_TLSAUTH_FAILED should be eliminated. It was only being raised when an internal error occurred while allocating or setting the GnuTLS SRP client credentials struct. For TLS authentication failures, the general CURLE_SSL_CONNECT_ERROR seems appropriate; its error string already includes "passwords" as a possible cause. Having a separate TLS auth error code might also cause people to think that a TLS auth failure means the wrong username or password was entered, when it could also be a sign of a man-in-the-middle attack.
2011-02-07Curl_gmtime: added a portable gmtimeDaniel Stenberg
Instead of polluting many places with #ifdefs, we create a single place for this function, and also check return code properly so that a NULL pointer returned won't cause problems.
2011-01-19TLS-SRP: support added when using GnuTLSQuinn Slack
2011-01-08gtls: fix memory leakDaniel Stenberg
Bug: http://curl.haxx.se/mail/lib-2011-01/0079.html Reported by: Quinn Slack
2011-01-04Curl_timeleft: s/conn/data in first argumentDaniel Stenberg
As the function doesn't really use the connectdata struct but only the SessionHanadle struct I modified what argument it wants.
2010-11-20gtls: define and use gtls_EAGAIN, gtls_EINTR and gtls_EIO.Yang Tse
Winsock builds clobber some errno.h defines in setup_once.
2010-11-19Detect socket errors in GnuTLS on WindowsMatthias Bolte
On Windows, translate WSAGetLastError() to errno values as GNU TLS does it internally, too. This is necessary because send() and recv() on Windows don't set errno when they fail but GNU TLS expects a proper errno value. Bug: http://curl.haxx.se/bug/view.cgi?id=3110991
2010-11-14gnutls->handshake: improved timeout handlingDaniel Stenberg
When no timeout is set, we call the socket_ready function with a timeout value of 0 during handshake, which makes it loop too much/fast in this function. It also made this function return CURLE_OPERATION_TIMEDOUT wrongly on a slow handshake. However, the particular bug report that highlighted this problem is not solved by this fix, as this fix only makes the more proper error get reported instead. Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=594150 Reported by: Johannes Ernst
2010-11-08fix compiler warningYang Tse
2010-05-11sendrecv: make them two pairs of send/recv to properly deal with FTPSHoward Chu
FTP(S) use two connections that can be set to different recv and send functions independently, so by introducing recv+send pairs in the same manner we already have sockets/connections we can work with FTPS fine. This commit fixes the FTPS regression introduced in change d64bd82.
2010-05-07sendrecv: split the I/O handling into private handlerHoward Chu
Howard Chu brought the bulk work of this patch that properly moves out the sending and recving of data to the parts of the code that are properly responsible for the various ways of doing so. Daniel Stenberg assisted with polishing a few bits and fixed some minor flaws in the original patch. Another upside of this patch is that we now abuse CURLcodes less with the "magic" -1 return codes and instead use CURLE_AGAIN more consistently.
2010-04-16GnuTLS: make the connection phase non-blockingJerome Vouillon
When multi interface is used, the SSL handshake is no longer blocking when GnuTLS is used.
2010-04-16SSL_RECV: EOF is not an error hereDaniel Stenberg
The recent overhaul of the SSL recv function made this treat a zero returned from gnutls_record_recv() as an error, and this caused our HTTPS test cases to fail. We leave it to upper layer code to detect if an EOF is a problem or not.
2010-04-04refactorize interface of Curl_ssl_recv/Curl_ssl_sendKamil Dudka
2010-03-24remove the CVSish $Id$ linesDaniel Stenberg
2009-10-19added cast macros to silent compiler warnings with 64-bit systems.Gunter Knauf
2009-08-30add casts to silent compiler warnings with 64bit systems.Gunter Knauf
2009-08-01- Curt Bogmine reported a problem with SNI enabled on a particular server. WeDaniel Stenberg
should introduce an option to disable SNI, but as we're in feature freeze now I've addressed the obvious bug here (pointed out by Peter Sylvester): we shouldn't try to enable SNI when SSLv2 or SSLv3 is explicitly selected. Code for OpenSSL and GnuTLS was fixed. NSS doesn't seem to have a particular option for SNI, or are we simply not using it?
2009-07-22- David Binderman found a memory and fd leak in lib/gtls.c:load_file()Michal Marek
(https://bugzilla.novell.com/523919). When looking at the code, I found that also the ptr pointer can leak.
2009-05-05I simplified the SSL session id re-use code now to *always* ditch the previousDaniel Stenberg
one and store the current one, as it makes the code less complex and I'm not even sure I can check for the same session id using memcmp() like that.
2009-05-04- Inspired by Michael Smith's session id fix for OpenSSL, I did theDaniel Stenberg
corresponding fix in the GnuTLS code: make sure to store the new session id in case the re-used one is rejected.
2009-04-21libcurl's memory.h renamed to curl_memory.hYang Tse
2009-03-08- Andre Guibert de Bruet fixed the gnutls-using code: There are a few placesDaniel Stenberg
in the gnutls code where we were checking for negative values for errors, when the man pages state that GNUTLS_E_SUCCESS is returned on success and other values indicate error conditions.
2009-02-25- As Daniel Fandrich figured out, we must do the GnuTLS initing in theDaniel Stenberg
curl_global_init() function to properly maintain the performing functions thread-safe. We've previously (28 April 2007) moved the init to a later time just to avoid it to fail very early when libgcrypt dislikes the situation, but that move was bad and the fix should rather be in libgcrypt or elsewhere.
2009-02-12Added support for Digest and NTLM authentication using GnuTLS.Dan Fandrich
2008-11-18Made an array static constDan Fandrich
2008-11-18Added #include "rawstr.h"Dan Fandrich
2008-11-11- Rainer Canavan filed bug #2255627Daniel Stenberg
(http://curl.haxx.se/bug/view.cgi?id=2255627) which pointed out that a program using libcurl's multi interface to download a HTTPS page with a libcurl built powered by OpenSSL, would easily get silly and instead hand over SSL details as data instead of the actual HTTP headers and body. This happened because libcurl would consider the connection handshake done too early. This problem was introduced at September 22nd 2008 with my fix of the bug #2107377 The correct fix is now instead done within the GnuTLS-handling code, as both the OpenSSL and the NSS code already deal with this situation in similar fashion. I added test case 560 in an attempt to verify this fix, but unfortunately it didn't trigger it even before this fix!
2008-10-16Renamed Curl_ascii_equal to Curl_raw_equal and bugfixed the my_toupper functionDaniel Stenberg
used in strequal.c so now all test cases run fine for me again.
2008-10-15- Pascal Terjan filed bug #2154627Daniel Stenberg
(http://curl.haxx.se/bug/view.cgi?id=2154627) which pointed out that libcurl uses strcasecmp() in multiple places where it causes failures when the Turkish locale is used. This is because 'i' and 'I' isn't the same letter so strcasecmp() on those letters are different in Turkish than in English (or just about all other languages). I thus introduced a totally new internal function in libcurl (called Curl_ascii_equal) for doing case insentive comparisons for english-(ascii?) style strings that thus will make "file" and "FILE" match even if the Turkish locale is selected.
2008-06-10fix warning in GnuTLS build by making sure Curl_gtls_send() takes a constDaniel Stenberg
void *
2008-06-06- Axel Tillequin and Arnaud Ebalard added support for CURLOPT_ISSUERCERT, forDaniel Stenberg
OpenSSL, NSS and GnuTLS-built libcurls.
2008-06-06- Axel Tillequin and Arnaud Ebalard added support for CURLOPT_CRLFILE, forDaniel Stenberg
OpenSSL, NSS and GnuTLS-built libcurls.
2008-02-26Added support for server name indication (RFC 4366).Gunter Knauf
Patch submitted by Kaspar Brand.
2008-02-25- Kaspar Brand made GnuTLS-built libcurl properly acknowledge the option thatDaniel Stenberg
forces it to prefer SSLv3.
2008-02-20oops, fixed to buildDaniel Stenberg