aboutsummaryrefslogtreecommitdiff
path: root/lib/nss.c
AgeCommit message (Collapse)Author
2011-04-04nss: fix a crash within SSL_AuthCertificate()Kamil Dudka
The bug was introduced in 806dbb0 (a wrong value was passed in as the first argument to the default callback in our wrapper).
2011-03-15nss: do not ignore value of CURLOPT_SSL_VERIFYPEERKamil Dudka
When NSS-powered libcurl connected to a SSL server with CURLOPT_SSL_VERIFYPEER equal to zero, NSS remembered that the peer certificate was accepted by libcurl and did not ask the second time when connecting to the same server with CURLOPT_SSL_VERIFYPEER equal to one. This patch turns off the SSL session cache for the particular SSL socket if peer verification is disabled. In order to avoid any performance impact, the peer verification is completely skipped in that case, which makes it even faster than before. Bug: https://bugzilla.redhat.com/678580
2011-02-22nss: do not ignore failure of SSL handshakeKamil Dudka
Flaw introduced in fc77790 and present in curl-7.21.4. Bug: https://bugzilla.redhat.com/669702#c16
2011-02-17nss: avoid memory leak on SSL connection failureKamil Dudka
2011-02-16nss_load_key: fix unused variable warningDaniel Stenberg
2011-01-27nss: avoid memory leaks and failure of NSS shutdownKamil Dudka
... in case more than one CA is loaded. Bug: https://bugzilla.redhat.com/670802
2011-01-18nss: fix a bug in handling of CURLOPT_CAPATHKamil Dudka
... and update the curl.1 and curl_easy_setopt.3 man pages such that they do not suggest to use an OpenSSL utility if curl is not built against OpenSSL. Bug: https://bugzilla.redhat.com/669702
2011-01-04Curl_timeleft: s/conn/data in first argumentDaniel Stenberg
As the function doesn't really use the connectdata struct but only the SessionHanadle struct I modified what argument it wants.
2011-01-04nss: avoid CURLE_OUT_OF_MEMORY given a file name without any slashKamil Dudka
Bug: https://bugzilla.redhat.com/623663
2011-01-02Curl_nss_connect: avoid PATH_MAXDaniel Stenberg
Since some systems don't have PATH_MAX and it isn't that clever to assume a fixed maximum path length, the code now allocates buffer space instead of using stack. Reported by: Samuel Thibault Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608521
2010-06-30http_ntlm: add support for NSSKamil Dudka
When configured with '--without-ssl --with-nss', NTLM authentication now uses NSS crypto library for MD5 and DES. For MD4 we have a local implementation in that case. More details are available at https://bugzilla.redhat.com/603783 In order to get it working, curl_global_init() must be called with CURL_GLOBAL_SSL or CURL_GLOBAL_ALL. That's necessary because NSS needs to be initialized globally and we do so only when the NSS library is actually required by protocol. The mentioned call of curl_global_init() is responsible for creating of the initialization mutex. There was also slightly changed the NSS initialization scenario, in particular, loading of the NSS PEM module. It used to be loaded always right after the NSS library was initialized. Now the library is initialized as soon as any SSL or NTLM is required, while the PEM module is prevented from being loaded until the SSL is actually required.
2010-05-11sendrecv: make them two pairs of send/recv to properly deal with FTPSHoward Chu
FTP(S) use two connections that can be set to different recv and send functions independently, so by introducing recv+send pairs in the same manner we already have sockets/connections we can work with FTPS fine. This commit fixes the FTPS regression introduced in change d64bd82.
2010-05-11nss: make it possible to read ASCII and DER CRLKamil Dudka
2010-05-11nss: add CRL to cache instead of read-only NSS dbKamil Dudka
2010-05-07sendrecv: split the I/O handling into private handlerHoward Chu
Howard Chu brought the bulk work of this patch that properly moves out the sending and recving of data to the parts of the code that are properly responsible for the various ways of doing so. Daniel Stenberg assisted with polishing a few bits and fixed some minor flaws in the original patch. Another upside of this patch is that we now abuse CURLcodes less with the "magic" -1 return codes and instead use CURLE_AGAIN more consistently.
2010-04-24nss: fix SSL handshake timeout underflowKamil Dudka
2010-04-06nss: handle client certificate related errorsKamil Dudka
2010-04-04refactorize interface of Curl_ssl_recv/Curl_ssl_sendKamil Dudka
2010-03-31fix compiler warning with a cast.Guenter Knauf
2010-03-24remove the CVSish $Id$ linesDaniel Stenberg
2010-02-17use curl standard indentation and line lengthsDaniel Stenberg
2009-12-02lib/nss.c: avoid use of uninitialized valueKamil Dudka
2009-11-12- libcurl-NSS now tries to reconnect with TLS disabled in case it detectsKamil Dudka
a broken TLS server. However it does not happen if SSL version is selected manually. The approach was originally taken from PSM. Kaspar Brand helped me to complete the patch. Original bug reports: https://bugzilla.redhat.com/525496 https://bugzilla.redhat.com/527771
2009-11-12- Kevin Baughman provided a fix preventing libcurl-NSS from crash on doublyKamil Dudka
closed NSPR descriptor. The issue was hard to find, reported several times before and always closed unresolved. More info at the RH bug: https://bugzilla.redhat.com/534176
2009-11-05- Dropped misleading timeouts in libcurl-NSS and made sure the SSL socket worksKamil Dudka
in non-blocking mode.
2009-10-28Since the NSS lib closes the socket the memory tracking system wrongly gets aDaniel Stenberg
false positive on a leaked socket, so this introduces a way to tell the system that the socket is indeed closed without explicitly closing it!
2009-10-18- Kevin Baughman found a double close() problem with libcurl-NSS, as whenDaniel Stenberg
libcurl called NSS to close the SSL "session" it also closed the actual socket.
2009-10-07fix gcc warnings in lib/nss.cKamil Dudka
2009-09-21added support for new SQLite cert database format: added a runtime check for ↵Gunter Knauf
version 3.12.0, and depending on the result add 'sql:' prefix to cert database directory so that newer SQLIte database format works.
2009-09-21added aditional check for the directory specified with SSL_DIR, and fall ↵Gunter Knauf
back to hardcoded directory if not a valid directory.
2009-09-08added debug output for NSS certpath.Gunter Knauf
2009-09-06added casts to silent compiler warning on 64bit systems.Gunter Knauf
2009-09-06use our define struct_stat to be compatible with largefile support.Gunter Knauf
2009-09-06added base64.h include to silent warnings about missing prototype for ↵Gunter Knauf
ATOB_ConvertAsciiToItem.
2009-08-28- Improved error message for not matching certificate subject name inKamil Dudka
libcurl-NSS. Originally reported at: https://bugzilla.redhat.com/show_bug.cgi?id=516056#c9
2009-08-13- Changed NSS code to not ignore the value of ssl.verifyhost and produce moreKamil Dudka
verbose error messages. Originally reported at: https://bugzilla.redhat.com/show_bug.cgi?id=516056
2009-07-20- Claes Jakobsson improved the support for client certificates handlingKamil Dudka
in NSS-powered libcurl. Now the client certificates can be selected automatically by a NSS built-in hook. Additionally pre-login to all PKCS11 slots is no more performed. It used to cause problems with HW tokens. - Fixed reference counting for NSS client certificates. Now the PEM reader module should be always properly unloaded on Curl_nss_cleanup(). If the unload fails though, libcurl will try to reuse the already loaded instance.
2009-06-08- Claes Jakobsson provided a patch for libcurl-NSS that fixed a bad refcountDaniel Stenberg
issue with client certs that caused issues like segfaults. http://curl.haxx.se/mail/lib-2009-05/0316.html
2009-05-28Fixed a few comment typos (from the FreeBSD ports)Dan Fandrich
2009-05-27- Claes Jakobsson fixed libcurl-NSS to build fine even without theDaniel Stenberg
PK11_CreateGenericObject() function.
2009-05-11- Kamil Dudka provided a fix for libcurl-NSS reported by Michael CronenworthDaniel Stenberg
at https://bugzilla.redhat.com/show_bug.cgi?id=453612#c12 If an incorrect password is given while loading a private key, libcurl ends up in an infinite loop consuming memory. The bug is critical.
2009-04-24- Kamil Dudka fixed another NSS-related leak when client certs were used.Daniel Stenberg
2009-04-21libcurl's memory.h renamed to curl_memory.hYang Tse
2009-04-14Kamil Dudka's follow-up fixDaniel Stenberg
2009-04-13- Toshio Kuratomi reported a memory leak problem with libcurl+NSS that turnedDaniel Stenberg
out to be leaking cacerts. Kamil Dudka helped me complete the fix. The issue is found in Redhat's bug tracker: https://bugzilla.redhat.com/show_bug.cgi?id=453612 There are still memory leaks present, but they seem to have other reasons.
2009-03-18- Kamil Dudka brought a patch that enables 6 additional crypto algorithms whenDaniel Stenberg
NSS is used. These ciphers were added in NSS 3.4 and require to be enabled explicitly.
2009-02-27Indentation fixes, untabify and related whitespace-cleanup. No code changed.Daniel Stenberg
2009-02-17- Kamil Dudka made NSS-powered builds compile and run again!Daniel Stenberg
2009-01-07fix compiler warningsDaniel Stenberg
2009-01-07- Rob Crittenden did once again provide an NSS update:Daniel Stenberg
I have to jump through a few hoops now with the NSS library initialization since another part of an application may have already initialized NSS by the time Curl gets invoked. This patch is more careful to only shutdown the NSS library if Curl did the initialization. It also adds in a bit of code to set the default ciphers if the app that call NSS_Init* did not call NSS_SetDomesticPolicy() or set specific ciphers. One might argue that this lets other application developers get lazy and/or they aren't using the NSS API correctly, and you'd be right. But still, this will avoid terribly difficult-to-trace crashes and is generally helpful.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-01 17:59:24 +0000