aboutsummaryrefslogtreecommitdiff
path: root/lib/ssluse.c
AgeCommit message (Collapse)Author
2011-04-21Fix a couple of spelling errors in lib/Fabian Keil
Found with codespell.
2011-04-20CURL_DOES_CONVERSIONS: cleanupDaniel Stenberg
Massively reduce #ifdefs all over (23 #ifdef lines less so far) Moved conversion-specific code to non-ascii.c
2011-04-14Fix a buffer overflow in pubkey_show().Andrei Benea
2011-04-10OpenSSL: no-sslv2 awareDaniel Stenberg
Allow openSSL without SSL2 to be used. This fix is inspired by the fix provided by Cristian Rodríguez. Reported by: Cristian Rodríguez
2011-03-25TSL-SRP: enabled with OpenSSLPeter Sylvester
If a new enough OpenSSL version is used, configure detects the TLS-SRP support and enables it.
2011-02-10Call ERR_peek_error instead of ERR_peek_last_errorDan Fandrich
The latter isn't available in older OpenSSL versions, and is less useful since it returns the most recent error instead of the first one encountered.
2011-02-02ssluse: improved error message on SSL_CTX_new failuresBjoern Sikora
"SSL: couldn't create a context" really isn't that helpful, now it'll also extract an explanation from OpenSSL and append to the right.
2011-01-20Fixed compile using OpenSSL versions < 0.9.4aDarshan Mody
2011-01-04Curl_timeleft: s/conn/data in first argumentDaniel Stenberg
As the function doesn't really use the connectdata struct but only the SessionHanadle struct I modified what argument it wants.
2011-01-04get_cert_chain: support larger data setsDaniel Stenberg
512 bytes turned out too short for some data, so now we allocate a larger buffer instead Bug: http://curl.haxx.se/mail/archive-2011-01/0002.html
2011-01-01pubkey_show: allocate buffer to fit any-size resultDaniel Stenberg
The loop condition was wrong so keys larger than 340 bits would overflow the local stack-based buffer.
2010-12-23ossl_seed: no more RAND_screenDaniel Stenberg
RAND_screen() is slow, not thread-safe and not needed anymore since OpenSSL uses the thread-safe win32 CryptoAPI nowadays.
2010-12-06ossl_connect_common: detect connection re-useHeinrich Ko
ossl_connect_common() now checks whether or not 'struct connectdata->state' is equal 'ssl_connection_complete' and if so, will return CURLE_OK with 'done' set to 'TRUE'. This check prevents ossl_connect_common() from creating a new ssl connection on an existing ssl session which causes openssl to fail when it tries to parse an encrypted TLS packet since the cipher data was effectively thrown away when the new ssl connection was created. Bug: http://curl.haxx.se/mail/lib-2010-11/0169.html
2010-11-08fix compiler warningYang Tse
2010-11-05Revert: use Host: name for SNI and cert name checksDaniel Stenberg
This reverts commit b0fd03f5b8d4520dd232a9d13567d16bd0ad8951, 4b2fbe1e97891f, afecd1aa13b4f, 68cde058f66b3
2010-11-04certcheck: use the custom Host: name for checksDaniel Stenberg
If you use a custom Host: name in a request to a SSL server, libcurl will now use that given name when it verifies the server certificate to be correct rather than using the host name used in the actual URL.
2010-11-04SNI: simplify the custom host name useDaniel Stenberg
The redirect check is already done at the position where the customhost field is assigned so there's no point in doing that a second time.
2010-11-04host: get the custom Host: name more genericlyDaniel Stenberg
When given a custom host name in a Host: header, we can use it for several different purposes other than just cookies, so we rename it and use it for SSL SNI etc.
2010-11-04SNI: set name to custom Host headerHongli Lai (Phusion)
OpenSSL SNI host name should be set to the custom Host header, if the user provided one.
2010-09-12ssluse: removed redundant check that is always trueDaniel Stenberg
2010-08-01multi: fix FTPS connecting the data connection with OpenSSLDaniel Stenberg
Commit 496002ea1cd76af7f (released in 7.20.1) broke FTPS when using the multi interface and OpenSSL was used. The condition for the non-blocking connect was incorrect. Reported by: Georg Lippitsch Bug: http://curl.haxx.se/mail/lib-2010-07/0270.html
2010-06-05OpenSSL: fix spurious SSL connection abortsConstantine Sapuntzakis
Was seeing spurious SSL connection aborts using libcurl and OpenSSL. I tracked it down to uncleared error state on the OpenSSL error stack - patch attached deals with that. Rough idea of problem: Code that uses libcurl calls some library that uses OpenSSL but don't clear the OpenSSL error stack after an error. ssluse.c calls SSL_read which eventually gets an EWOULDBLOCK from the OS. Returns -1 to indicate an error ssluse.c calls SSL_get_error. First thing, SSL_get_error calls ERR_get_error to check the OpenSSL error stack, finds an old error and returns SSL_ERROR_SSL instead of SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE. ssluse.c returns an error and aborts the connection Solution: Clear the openssl error stack before calling SSL_* operation if we're going to call SSL_get_error afterwards. Notes: This is much more likely to happen with multi because it's easier to intersperse other calls to the OpenSSL library in the same thread.
2010-05-14OpenSSL: multi interface handshake could hangDaniel Stenberg
John-Mark Bell filed bug #3000052 that identified a problem (with an associated patch) with the OpenSSL handshake state machine when the multi interface is used: Performing an https request using a curl multi handle and using select or epoll to wait for events results in a hang. It appears that the cause is the fix for bug #2958179, which makes ossl_connect_common unconditionally return from the step 2 loop when fetching from a multi handle. When ossl_connect_step2 has completed, it updates connssl->connecting_state to ssl_connect_3. ossl_connect_common will then return to the caller, as a multi handle is in use. Eventually, the client code will call curl_multi_fdset to obtain an updated fdset to select or epoll on. For https requests, curl_multi_fdset will cause https_getsock to be called. https_getsock will only return a socket handle if the connecting_state is ssl_connect_2_reading or ssl_connect_2_writing. Therefore, the client will never obtain a valid fdset, and thus not drive the multi handle, resulting in a hang. (http://curl.haxx.se/bug/view.cgi?id=3000052)
2010-05-11sendrecv: make them two pairs of send/recv to properly deal with FTPSHoward Chu
FTP(S) use two connections that can be set to different recv and send functions independently, so by introducing recv+send pairs in the same manner we already have sockets/connections we can work with FTPS fine. This commit fixes the FTPS regression introduced in change d64bd82.
2010-05-07sendrecv: split the I/O handling into private handlerHoward Chu
Howard Chu brought the bulk work of this patch that properly moves out the sending and recving of data to the parts of the code that are properly responsible for the various ways of doing so. Daniel Stenberg assisted with polishing a few bits and fixed some minor flaws in the original patch. Another upside of this patch is that we now abuse CURLcodes less with the "magic" -1 return codes and instead use CURLE_AGAIN more consistently.
2010-04-04refactorize interface of Curl_ssl_recv/Curl_ssl_sendKamil Dudka
2010-03-24remove the CVSish $Id$ linesDaniel Stenberg
2010-03-02- Andrei Benea filed bug report #2956698 and pointed out that theDaniel Stenberg
CURLOPT_CERTINFO feature leaked memory due to a missing OpenSSL function call. He provided the patch to fix it too. http://curl.haxx.se/bug/view.cgi?id=2956698
2010-03-01- Wesley Miaw reported bug #2958179 which identified a case of looping duringDaniel Stenberg
OpenSSL based SSL handshaking even though the multi interface was used and there was no good reason for it. http://curl.haxx.se/bug/view.cgi?id=2958179
2010-02-05- avoid OpenSSL 0.9.8 ENGINE_by_id memory leakYang Tse
- cleanup parenthesis usage in return statements
2010-01-28fix printf-style format stringsYang Tse
2010-01-08- Johan van Selst found and fixed a OpenSSL session ref count leak:Daniel Stenberg
ossl_connect_step3() increments an SSL session handle reference counter on each call. When sessions are re-used this reference counter may be incremented many times, but it will be decremented only once when done (by Curl_ossl_session_free()); and the internal OpenSSL data will not be freed if this reference count remains positive. When a session is re-used the reference counter should be corrected by explicitly calling SSL_SESSION_free() after each consecutive SSL_get1_session() to avoid introducing a memory leak. (http://curl.haxx.se/bug/view.cgi?id=2926284)
2009-12-17- David Byron fixed Curl_ossl_cleanup to actually call ENGINE_cleanup whenDaniel Stenberg
available.
2009-12-10minor indent changeDaniel Stenberg
2009-11-18Make usage of calloc()'s arguments consistent with rest of code baseYang Tse
2009-11-15Client certificate ENG file type requires OpenSSL 0.9.7 or newerYang Tse
2009-11-14OpenSSL 0.9.7 or newer required for ENGINE_CTRL_GET_CMD_FROM_NAME definitionYang Tse
2009-11-14- Camille Moncelier added support for the file type SSL_FILETYPE_ENGINE forDaniel Stenberg
the client certificate. It also disable the key name test as some engines can select a private key/cert automatically (When there is only one key and/or certificate on the hardware device used by the engine)
2009-10-14we only need to call ASN1_STRING_length() if ASN1_STRING_type() detects UTF-8,Gunter Knauf
else ASN1_STRING_to_UTF8() returns the string length.
2009-09-25- Chris Mumford filed bug report #2861587Daniel Stenberg
(http://curl.haxx.se/bug/view.cgi?id=2861587) identifying that libcurl used the OpenSSL function X509_load_crl_file() wrongly and failed if it would load a CRL file with more than one certificate within. This is now fixed.
2009-09-25fix compiler warning: end-of-loop code not reachedYang Tse
2009-09-24fix compiler warning: variable "sni" was set but never usedYang Tse
2009-09-16- Sven Anders reported that we introduced a cert verfication flaw for OpenSSL-Daniel Stenberg
powered libcurl in 7.19.6. If there was a X509v3 Subject Alternative Name field in the certficate it had to match and so even if non-DNS and non-IP entry was present it caused the verification to fail.
2009-08-29add cast to silent compiler warning with 64bit systems.Gunter Knauf
2009-08-29fix shadow definition of outp.Gunter Knauf
2009-08-11- Peter Sylvester made the HTTPS test server use specific certificates forDaniel Stenberg
each test, so that the test suite can now be used to actually test the verification of cert names etc. This made an error show up in the OpenSSL- specific code where it would attempt to match the CN field even if a subjectAltName exists that doesn't match. This is now fixed and verified in test 311.
2009-08-03avoid possible NULL dereference caused by my previous fixDaniel Stenberg
2009-08-03Reverted the zero-byte-in-name check to instead rely on the fact that strlenDaniel Stenberg
and the name length differ in those cases and thus leave the matching function unmodified from before, as the matching functions never have to bother with the zero bytes in legitimate cases. Peter Sylvester helped me realize that this fix is slightly better as it leaves more code unmodified and makes the detection a bit more obvious in the code.
2009-08-02Extended my embedded-zero-in-cert-name fix based on a comment from ScottDaniel Stenberg
Cantor. My previous attempt was half-baked and didn't cover the normal CN case.
2009-08-01- Curt Bogmine reported a problem with SNI enabled on a particular server. WeDaniel Stenberg
should introduce an option to disable SNI, but as we're in feature freeze now I've addressed the obvious bug here (pointed out by Peter Sylvester): we shouldn't try to enable SNI when SSLv2 or SSLv3 is explicitly selected. Code for OpenSSL and GnuTLS was fixed. NSS doesn't seem to have a particular option for SNI, or are we simply not using it?