aboutsummaryrefslogtreecommitdiff
path: root/lib/nss.c
AgeCommit message (Collapse)Author
2009-12-02lib/nss.c: avoid use of uninitialized valueKamil Dudka
2009-11-12- libcurl-NSS now tries to reconnect with TLS disabled in case it detectsKamil Dudka
a broken TLS server. However it does not happen if SSL version is selected manually. The approach was originally taken from PSM. Kaspar Brand helped me to complete the patch. Original bug reports: https://bugzilla.redhat.com/525496 https://bugzilla.redhat.com/527771
2009-11-12- Kevin Baughman provided a fix preventing libcurl-NSS from crash on doublyKamil Dudka
closed NSPR descriptor. The issue was hard to find, reported several times before and always closed unresolved. More info at the RH bug: https://bugzilla.redhat.com/534176
2009-11-05- Dropped misleading timeouts in libcurl-NSS and made sure the SSL socket worksKamil Dudka
in non-blocking mode.
2009-10-28Since the NSS lib closes the socket the memory tracking system wrongly gets aDaniel Stenberg
false positive on a leaked socket, so this introduces a way to tell the system that the socket is indeed closed without explicitly closing it!
2009-10-18- Kevin Baughman found a double close() problem with libcurl-NSS, as whenDaniel Stenberg
libcurl called NSS to close the SSL "session" it also closed the actual socket.
2009-10-07fix gcc warnings in lib/nss.cKamil Dudka
2009-09-21added support for new SQLite cert database format: added a runtime check for ↵Gunter Knauf
version 3.12.0, and depending on the result add 'sql:' prefix to cert database directory so that newer SQLIte database format works.
2009-09-21added aditional check for the directory specified with SSL_DIR, and fall ↵Gunter Knauf
back to hardcoded directory if not a valid directory.
2009-09-08added debug output for NSS certpath.Gunter Knauf
2009-09-06added casts to silent compiler warning on 64bit systems.Gunter Knauf
2009-09-06use our define struct_stat to be compatible with largefile support.Gunter Knauf
2009-09-06added base64.h include to silent warnings about missing prototype for ↵Gunter Knauf
ATOB_ConvertAsciiToItem.
2009-08-28- Improved error message for not matching certificate subject name inKamil Dudka
libcurl-NSS. Originally reported at: https://bugzilla.redhat.com/show_bug.cgi?id=516056#c9
2009-08-13- Changed NSS code to not ignore the value of ssl.verifyhost and produce moreKamil Dudka
verbose error messages. Originally reported at: https://bugzilla.redhat.com/show_bug.cgi?id=516056
2009-07-20- Claes Jakobsson improved the support for client certificates handlingKamil Dudka
in NSS-powered libcurl. Now the client certificates can be selected automatically by a NSS built-in hook. Additionally pre-login to all PKCS11 slots is no more performed. It used to cause problems with HW tokens. - Fixed reference counting for NSS client certificates. Now the PEM reader module should be always properly unloaded on Curl_nss_cleanup(). If the unload fails though, libcurl will try to reuse the already loaded instance.
2009-06-08- Claes Jakobsson provided a patch for libcurl-NSS that fixed a bad refcountDaniel Stenberg
issue with client certs that caused issues like segfaults. http://curl.haxx.se/mail/lib-2009-05/0316.html
2009-05-28Fixed a few comment typos (from the FreeBSD ports)Dan Fandrich
2009-05-27- Claes Jakobsson fixed libcurl-NSS to build fine even without theDaniel Stenberg
PK11_CreateGenericObject() function.
2009-05-11- Kamil Dudka provided a fix for libcurl-NSS reported by Michael CronenworthDaniel Stenberg
at https://bugzilla.redhat.com/show_bug.cgi?id=453612#c12 If an incorrect password is given while loading a private key, libcurl ends up in an infinite loop consuming memory. The bug is critical.
2009-04-24- Kamil Dudka fixed another NSS-related leak when client certs were used.Daniel Stenberg
2009-04-21libcurl's memory.h renamed to curl_memory.hYang Tse
2009-04-14Kamil Dudka's follow-up fixDaniel Stenberg
2009-04-13- Toshio Kuratomi reported a memory leak problem with libcurl+NSS that turnedDaniel Stenberg
out to be leaking cacerts. Kamil Dudka helped me complete the fix. The issue is found in Redhat's bug tracker: https://bugzilla.redhat.com/show_bug.cgi?id=453612 There are still memory leaks present, but they seem to have other reasons.
2009-03-18- Kamil Dudka brought a patch that enables 6 additional crypto algorithms whenDaniel Stenberg
NSS is used. These ciphers were added in NSS 3.4 and require to be enabled explicitly.
2009-02-27Indentation fixes, untabify and related whitespace-cleanup. No code changed.Daniel Stenberg
2009-02-17- Kamil Dudka made NSS-powered builds compile and run again!Daniel Stenberg
2009-01-07fix compiler warningsDaniel Stenberg
2009-01-07- Rob Crittenden did once again provide an NSS update:Daniel Stenberg
I have to jump through a few hoops now with the NSS library initialization since another part of an application may have already initialized NSS by the time Curl gets invoked. This patch is more careful to only shutdown the NSS library if Curl did the initialization. It also adds in a bit of code to set the default ciphers if the app that call NSS_Init* did not call NSS_SetDomesticPolicy() or set specific ciphers. One might argue that this lets other application developers get lazy and/or they aren't using the NSS API correctly, and you'd be right. But still, this will avoid terribly difficult-to-trace crashes and is generally helpful.
2008-11-15based on a report by Jim Meyering, I went over and added checks for returnDaniel Stenberg
codes for all calls to malloc and strdup that were missing. I also changed a few malloc(13) to use arrays on the stack and a few malloc(PATH_MAX) to instead use aprintf() to lower memory use. I also fixed a memory leak in Curl_nss_connect() when CURLOPT_ISSUERCERT is in use.
2008-10-16Renamed Curl_ascii_equal to Curl_raw_equal and bugfixed the my_toupper functionDaniel Stenberg
used in strequal.c so now all test cases run fine for me again.
2008-10-15- Pascal Terjan filed bug #2154627Daniel Stenberg
(http://curl.haxx.se/bug/view.cgi?id=2154627) which pointed out that libcurl uses strcasecmp() in multiple places where it causes failures when the Turkish locale is used. This is because 'i' and 'I' isn't the same letter so strcasecmp() on those letters are different in Turkish than in English (or just about all other languages). I thus introduced a totally new internal function in libcurl (called Curl_ascii_equal) for doing case insentive comparisons for english-(ascii?) style strings that thus will make "file" and "FILE" match even if the Turkish locale is selected.
2008-09-23- Rob Crittenden brought a patch to "add some locking for thread-safety to NSSDaniel Stenberg
implementation".
2008-09-06remove unnecessary typecasting of malloc()Yang Tse
2008-09-04Made some variables constDan Fandrich
2008-09-04fix print formatting string directivesYang Tse
2008-06-21made Curl_nss_send() take const data to kill compiler warningDaniel Stenberg
2008-06-20- Phil Pellouchoud found a case where libcurl built with NSS failed toDaniel Stenberg
handshake with a SSLv2 server, and it turned out to be because it didn't recognize the cipher named "rc4-md5". In our list that cipher was named plainly "rc4". I've now added rc4-md5 to work as an alias as Phil reported that it made things work for him again.
2008-06-19Removed the #define of ciphernum since keeping a define updated to be theDaniel Stenberg
number of entries in a provided table is doomed to fail in the long run. Now we use the NUM_OF_CIPHERS define instead to figure out the amount.
2008-06-19s/strcasecmp/strequal to make it more portableDaniel Stenberg
2008-06-18- Rob Crittenden brought a fix for the NSS layer that makes libcurl no longerDaniel Stenberg
always fire up a new connection rather than using the existing one when the multi interface is used. Original bug report: https://bugzilla.redhat.com/show_bug.cgi?id=450140
2008-06-18removed warning about unused argument by simply removing that argument fromDaniel Stenberg
the check_issuer_cert() proto
2008-06-18check_issuer_cert() now builds and there's one warning less. Still one compilerDaniel Stenberg
warning in the code though but we need NSS' base64.h header for that and we don't currently have a suitable way to include it as our own base64.h header kind of "blocks" it.
2008-06-12fixed bad infof() usage!Daniel Stenberg
2008-06-11- I did a cleanup of the internal generic SSL layer and how the various SSLDaniel Stenberg
libraries are supported. Starting now, each underlying SSL library support code does a set of defines for the 16 functions the generic layer (sslgen.c) uses (all these new function defines use the prefix "curlssl_"). This greatly simplified the generic layer in readability by involving much less #ifdefs and other preprocessor stuff and should make it easier for people to make libcurl work with new SSL libraries. Hopefully I can later on document these 16 functions somewhat as well. I also made most of the internal SSL-dependent functions (using Curl_ssl_ prefix) #defined to nothing when no SSL support is requested - previously they would unnecessarily call mostly empty functions.
2008-06-06code style cleanupDaniel Stenberg
2008-06-06- Axel Tillequin and Arnaud Ebalard added support for CURLOPT_ISSUERCERT, forDaniel Stenberg
OpenSSL, NSS and GnuTLS-built libcurls.
2008-06-06- Axel Tillequin and Arnaud Ebalard added support for CURLOPT_CRLFILE, forDaniel Stenberg
OpenSSL, NSS and GnuTLS-built libcurls.
2008-05-26fix: preprocessor complaining about macro redefinitionYang Tse
2008-02-20- Based on initial work done by Gautam Kachroo to address a bug, we now keepDaniel Stenberg
better control at the exact state of the connection's SSL status so that we know exactly when it has completed the SSL negotiation or not so that there won't be accidental re-uses of connections that are wrongly believed to be in SSL-completed-negotiate state.