aboutsummaryrefslogtreecommitdiff
path: root/lib/vtls
AgeCommit message (Collapse)Author
2014-09-13url: let the backend decide CURLOPT_SSL_CTX_ supportDaniel Stenberg
... to further remove specific TLS backend knowledge from url.c
2014-09-13vtls: have the backend tell if it supports CERTINFODaniel Stenberg
2014-09-13CURLOPT_CAPATH: return failure if set without backend supportDaniel Stenberg
2014-09-10openssl: build fix for versions < 0.9.8ePaul Howarth
Bug: http://curl.haxx.se/mail/lib-2014-09/0064.html
2014-09-08polarassl: avoid memset() when clearing the first byte is enoughDaniel Stenberg
2014-09-08polarssl: support CURLOPT_CAPATH / --capathCatalin Patulea
Signed-off-by: Catalin Patulea <cat@vv.carleton.ca>
2014-09-04darwinssl: Use CopyCertSubject() to check CA cert.Vilmos Nebehaj
SecCertificateCopyPublicKey() is not available on iPhone. Use CopyCertSubject() instead to see if the certificate returned by SecCertificateCreateWithData() is valid. Reported-by: Toby Peterson
2014-09-01polarssl: implement CURLOPT_SSLVERSIONAndre Heinecke
Forwards the setting as minimum ssl version (if set) to polarssl. If the server does not support the requested version the SSL Handshake will fail. Bug: http://curl.haxx.se/bug/view.cgi?id=1419
2014-09-01Check CA certificate in curl_darwinssl.c.Vilmos Nebehaj
SecCertificateCreateWithData() returns a non-NULL SecCertificateRef even if the buffer holds an invalid or corrupt certificate. Call SecCertificateCopyPublicKey() to make sure cacert is a valid certificate.
2014-08-30Fix CA certificate bundle handling in darwinssl.Vilmos Nebehaj
If the --cacert option is used with a CA certificate bundle that contains multiple CA certificates, iterate through it, adding each certificate as a trusted root CA.
2014-08-22openssl.c: Fixed longer than 79 columnsSteve Holme
2014-08-21openssl.c: Fixed compilation warningSteve Holme
warning: declaration of 'minor' shadows a global declaration
2014-08-13openssl: fix version report for the 0.9.8 branchJose Alf
Fixed libcurl to correctly output the newer versions of OpenSSL 0.9.8, starting from openssl-0.9.8za.
2014-08-08schannel: Fixed compilation warning in vtls.cSteve Holme
vtls.c:688:43: warning: unused parameter 'data'
2014-08-07openssl: replace call to OPENSSL_configDaniel Stenberg
OPENSSL_config() is "strongly recommended" to use but unfortunately that function makes an exit() call on wrongly formatted config files which makes it hard to use in some situations. OPENSSL_config() itself calls CONF_modules_load_file() and we use that instead and we ignore its return code! Reported-by: Jan Ehrhardt Bug: http://curl.haxx.se/bug/view.cgi?id=1401
2014-08-05darwinssl: don't use strtok()Toby Peterson
The GetDarwinVersionNumber() function uses strtok, which is not thread-safe.
2014-08-05Curl_ossl_version: adapted to detect BoringSSLDaniel Stenberg
This seems to be the way it should work. Right now we can't build with BoringSSL and try this out properly due to a minor API breakage.
2014-08-04Curl_ossl_version: detect and show libresslDaniel Stenberg
LibreSSL is otherwise OpenSSL API compliant (so far)
2014-08-03gtls: only define Curl_gtls_seed if Nettle is not being usedDan Fandrich
2014-08-03ssl: provide Curl_ssl_backend even if no SSL library is availableDan Fandrich
2014-08-01openssl: make ossl_send return CURLE_OK betterDaniel Stenberg
Previously it only returned a CURLcode for errors, which is when it returns a different size than what was passed in to it. The http2 code only checked the curlcode and thus failed.
2014-07-31schannel: use CryptGenRandom for random numbersMarcel Raad
This function is available for every Windows version since Windows 95/NT. reference: http://msdn.microsoft.com/en-us/library/windows/desktop/aa379942.aspx
2014-07-31ssl: generalize how the ssl backend identifier is setDaniel Stenberg
Each backend now defines CURL_SSL_BACKEND accordingly. Added the *AXTLS one which was missing previously.
2014-07-31axtls: define curlssl_random using axTLS's PRNGDan Fandrich
2014-07-31cyassl: fix the test for ASN_NO_SIGNER_EDan Fandrich
It's an enum so a macro test won't work. The CyaSSL changelog doesn't say exactly when this error code was introduced, but it's likely to be 2.7.0.
2014-07-31cyassl: use RNG_GenerateBlock to generate a good random numberDan Fandrich
2014-07-30vtls: repair build without TLS supportDaniel Stenberg
... by defining Curl_ssl_random() properly
2014-07-30polarssl: provide a (weak) random functionDaniel Stenberg
This now provides a weak random function since PolarSSL doesn't have a quick and easy way to provide a good one. It does however provide the framework to make one so it _can_ and _should_ be done...
2014-07-30cyassl: use the default (weeker) randomDaniel Stenberg
I couldn't find any dedicated function in its API to get a "good" random with.
2014-07-30cyassl: made it compile with version 2.0.6 againDaniel Stenberg
ASN_NO_SIGNER_E didn't exist back then!
2014-07-30vtls: make the random function mandatory in the TLS backendDaniel Stenberg
To force each backend implementation to really attempt to provide proper random. If a proper random function is missing, then we can explicitly make use of the default one we use when TLS support is missing. This commit makes sure it works for darwinssl, gnutls, nss and openssl.
2014-07-28nss: do not check the version of NSS at run timeKamil Dudka
The minimal required version of NSS is 3.14.x so it does not make sense to check for NSS 3.12.0+ at run time.
2014-07-23cyassl.c: return the correct error code on no CA certDan Fandrich
CyaSSL 3.0.0 returns a unique error code if no CA cert is available, so translate that into CURLE_SSL_CACERT_BADFILE when peer verification is requested.
2014-07-15gnutls: fix compiler warningDaniel Stenberg
conversion to 'int' from 'long int' may alter its value
2014-07-14gnutls: detect lack of SRP support in GnuTLS at run-time and try withoutDan Fandrich
Reported-by: David Woodhouse
2014-07-14gnutls: handle IP address in cert name checkDavid Woodhouse
Before GnuTLS 3.3.6, the gnutls_x509_crt_check_hostname() function didn't actually check IP addresses in SubjectAltName, even though it was explicitly documented as doing so. So do it ourselves...
2014-07-13gnutls: improved error message if setting cipher list failsDan Fandrich
Reported-by: David Woodhouse
2014-07-12gnutls: fixed a couple of uninitialized variable referencesDan Fandrich
2014-07-12gnutls: fixed compilation against versions < 2.12.0Dan Fandrich
The AES-GCM ciphers were added to GnuTLS as late as ver. 3.0.1 but the code path in which they're referenced here is only ever used for somewhat older GnuTLS versions. This caused undeclared identifier errors when compiling against those.
2014-07-12gnutls: explicitly added SRP to the priority stringDan Fandrich
This seems to have become necessary for SRP support to work starting with GnuTLS ver. 2.99.0. Since support for SRP was added to GnuTLS before the function that takes this priority string, there should be no issue with backward compatibility.
2014-07-11gnutls: ignore invalid certificate dates with VERIFYPEER disabledDan Fandrich
This makes the behaviour consistent with what happens if a date can be extracted from the certificate but is expired.
2014-07-04nss: make the list of CRL items globalKamil Dudka
Otherwise NSS could use an already freed item for another connection.
2014-07-04nss: fix a memory leak when CURLOPT_CRLFILE is usedKamil Dudka
2014-07-04nss: make crl_der allocated on heapKamil Dudka
... and spell it as crl_der instead of crlDER
2014-07-04nss: let nss_{cache,load}_crl return CURLcodeKamil Dudka
2014-07-02nss: make the fallback to SSLv3 work againKamil Dudka
This feature was unintentionally disabled by commit ff92fcfb.
2014-07-02nss: do not abort on connection failureKamil Dudka
... due to calling SSL_VersionRangeGet() with NULL file descriptor reported-by: upstream tests 305 and 404
2014-06-11NTLM: set a fake entropy for debug builds with CURL_ENTROPY setDaniel Stenberg
Curl_rand() will return a dummy and repatable random value for this case. Makes it possible to write test cases that verify output. Also, fake timestamp with CURL_FORCETIME set. Only when built debug enabled of course. Curl_ssl_random() was not used anymore so it has been removed. Curl_rand() is enough. create_digest_md5_message: generate base64 instead of hex string curl_sasl: also fix memory leaks in some OOM situations
2014-06-11Curl_rand: Use a fake entropy for debug builds when CURL_ENTROPY setSteve Holme
2014-06-03Curl_ossl_init: call OPENSSL_config for initing enginesDaniel Stenberg
Bug: http://curl.haxx.se/mail/lib-2014-06/0003.html Reported-by: Дмитрий Фалько
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-26 21:57:36 +0000