aboutsummaryrefslogtreecommitdiff
path: root/lib/vtls
AgeCommit message (Collapse)Author
2014-07-30polarssl: provide a (weak) random functionDaniel Stenberg
This now provides a weak random function since PolarSSL doesn't have a quick and easy way to provide a good one. It does however provide the framework to make one so it _can_ and _should_ be done...
2014-07-30cyassl: use the default (weeker) randomDaniel Stenberg
I couldn't find any dedicated function in its API to get a "good" random with.
2014-07-30cyassl: made it compile with version 2.0.6 againDaniel Stenberg
ASN_NO_SIGNER_E didn't exist back then!
2014-07-30vtls: make the random function mandatory in the TLS backendDaniel Stenberg
To force each backend implementation to really attempt to provide proper random. If a proper random function is missing, then we can explicitly make use of the default one we use when TLS support is missing. This commit makes sure it works for darwinssl, gnutls, nss and openssl.
2014-07-28nss: do not check the version of NSS at run timeKamil Dudka
The minimal required version of NSS is 3.14.x so it does not make sense to check for NSS 3.12.0+ at run time.
2014-07-23cyassl.c: return the correct error code on no CA certDan Fandrich
CyaSSL 3.0.0 returns a unique error code if no CA cert is available, so translate that into CURLE_SSL_CACERT_BADFILE when peer verification is requested.
2014-07-15gnutls: fix compiler warningDaniel Stenberg
conversion to 'int' from 'long int' may alter its value
2014-07-14gnutls: detect lack of SRP support in GnuTLS at run-time and try withoutDan Fandrich
Reported-by: David Woodhouse
2014-07-14gnutls: handle IP address in cert name checkDavid Woodhouse
Before GnuTLS 3.3.6, the gnutls_x509_crt_check_hostname() function didn't actually check IP addresses in SubjectAltName, even though it was explicitly documented as doing so. So do it ourselves...
2014-07-13gnutls: improved error message if setting cipher list failsDan Fandrich
Reported-by: David Woodhouse
2014-07-12gnutls: fixed a couple of uninitialized variable referencesDan Fandrich
2014-07-12gnutls: fixed compilation against versions < 2.12.0Dan Fandrich
The AES-GCM ciphers were added to GnuTLS as late as ver. 3.0.1 but the code path in which they're referenced here is only ever used for somewhat older GnuTLS versions. This caused undeclared identifier errors when compiling against those.
2014-07-12gnutls: explicitly added SRP to the priority stringDan Fandrich
This seems to have become necessary for SRP support to work starting with GnuTLS ver. 2.99.0. Since support for SRP was added to GnuTLS before the function that takes this priority string, there should be no issue with backward compatibility.
2014-07-11gnutls: ignore invalid certificate dates with VERIFYPEER disabledDan Fandrich
This makes the behaviour consistent with what happens if a date can be extracted from the certificate but is expired.
2014-07-04nss: make the list of CRL items globalKamil Dudka
Otherwise NSS could use an already freed item for another connection.
2014-07-04nss: fix a memory leak when CURLOPT_CRLFILE is usedKamil Dudka
2014-07-04nss: make crl_der allocated on heapKamil Dudka
... and spell it as crl_der instead of crlDER
2014-07-04nss: let nss_{cache,load}_crl return CURLcodeKamil Dudka
2014-07-02nss: make the fallback to SSLv3 work againKamil Dudka
This feature was unintentionally disabled by commit ff92fcfb.
2014-07-02nss: do not abort on connection failureKamil Dudka
... due to calling SSL_VersionRangeGet() with NULL file descriptor reported-by: upstream tests 305 and 404
2014-06-11NTLM: set a fake entropy for debug builds with CURL_ENTROPY setDaniel Stenberg
Curl_rand() will return a dummy and repatable random value for this case. Makes it possible to write test cases that verify output. Also, fake timestamp with CURL_FORCETIME set. Only when built debug enabled of course. Curl_ssl_random() was not used anymore so it has been removed. Curl_rand() is enough. create_digest_md5_message: generate base64 instead of hex string curl_sasl: also fix memory leaks in some OOM situations
2014-06-11Curl_rand: Use a fake entropy for debug builds when CURL_ENTROPY setSteve Holme
2014-06-03Curl_ossl_init: call OPENSSL_config for initing enginesDaniel Stenberg
Bug: http://curl.haxx.se/mail/lib-2014-06/0003.html Reported-by: Дмитрий Фалько
2014-05-28gnutls: allow building with nghttp2 but without ALPN supportDaniel Stenberg
It might not be the most useful combo, but...
2014-05-28gnutls: don't use deprecated type names anymoreAlessandro Ghedini
2014-05-25polarssl: add ALPN supportFabian Frank
PolarSSL added ALPN support in their 1.3.6 release. See: https://polarssl.org/tech-updates/releases/polarssl-1.3.6-released
2014-05-23openssl: Fix uninitialized variable use in NPN callbackTatsuhiro Tsujikawa
OpenSSL passes out and outlen variable uninitialized to select_next_proto_cb callback function. If the callback function returns SSL_TLSEXT_ERR_OK, the caller assumes the callback filled values in out and outlen and processes as such. Previously, if there is no overlap in protocol lists, curl code does not fill any values in these variables and returns SSL_TLSEXT_ERR_OK, which means we are triggering undefined behavior. valgrind warns this. This patch fixes this issue by fallback to HTTP/1.1 if there is no overlap.
2014-05-21darwinssl: fix lint & build warnings in the previous commitNick Zitzmann
2014-05-21Add support for --cacert in DarwinSSL.Vilmos Nebehaj
Security Framework on OS X makes it possible to supply extra anchor (CA) certificates via the Certificate, Key, and Trust Services API. This commit makes the '--cacert' option work using this API. More information: https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html The HTTPS tests now pass on OS X except 314, which requires the '--crl' option to work.
2014-05-20ALPN: fix typo in http/1.1 identifierFabian Frank
According to https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-05 it is "http/1.1" and not "http/1.0".
2014-05-17axtls: Fixed too long source lineDan Fandrich
2014-05-16axtls: Add a TODO to a potential blocking call with no timeoutDan Fandrich
2014-05-15CURLINFO_SSL_VERIFYRESULT: assign at first connect callDaniel Stenberg
The variable wasn't assigned at all until step3 which would lead to a failed connect never assigning the variable and thus returning a bad value. Reported-by: Larry Lin Bug: http://curl.haxx.se/mail/lib-2014-04/0203.html
2014-05-15darwinssl: Updated copyright following recent changesSteve Holme
2014-05-14darwinssl: fix potential crash when attempting to copy an identityNick Zitzmann
from a P12 file This could've happened if SecPKCS12Import() returned noErr _and_ no identity.
2014-05-12openssl: unbreak PKCS12 supportDaniel Stenberg
Regression introduced in ce362e8eb9c (7.31.0) Bug: http://curl.haxx.se/bug/view.cgi?id=1371 Reported-by: Dmitry
2014-05-05schannel: don't use the connect-timeout during sendDaniel Stenberg
As there's a default connection timeout and this wrongly used the connection timeout during a transfer after the connection is completed, this function would trigger timeouts during transfers erroneously. Bug: http://curl.haxx.se/bug/view.cgi?id=1352 Figured-out-by: Radu Simionescu
2014-05-04openssl: biomem->data is not zero terminatedDaniel Stenberg
So printf(%s) on it or reading before bounds checking is wrong, fixing it. Could previously lead to reading out of boundary. Reported-by: Török Edwin
2014-04-25nss: propagate blocking direction from NSPR I/OKamil Dudka
... during the non-blocking SSL handshake
2014-04-23cyassl: Use error-ssl.h when availableDan Fandrich
Versions since at least 2.9.4 renamed error.h to error-ssl.h, so use whichever one is available.
2014-04-22gtls: fix NULL pointer dereferenceDaniel Stenberg
gnutls_x509_crt_import() must not be called with a NULL certificate Bug: http://curl.haxx.se/mail/lib-2014-04/0145.html Reported-by: Damian Dixon
2014-04-22nss: implement non-blocking SSL handshakeKamil Dudka
2014-04-22nss: split Curl_nss_connect() into 4 functionsKamil Dudka
2014-04-18curl_schannel.c: added explicit cast of structure pointersMarc Hoersken
2014-04-18curl_schannel.c: fix possible dereference of null pointerMarc Hoersken
2014-04-03http2+openssl: fix compiler warnings in ALPN using codeDaniel Stenberg
2014-03-31http2: let openssl mention the exact protocol negotiatedDaniel Stenberg
Remove a superfluous "negotiated http2" info line
2014-03-31http2: remove _DRAFT09 from the NPN_HTTP2 enumDaniel Stenberg
We're progressing throught drafts so there's no point in having a fixed one in a symbol that'll survive.
2014-03-22polarssl: avoid extra newlines in debug messagesGisle Vanem
The debug messages printed inside PolarSSL always seems to end with a newline. So 'infof()' should not add one. Besides the trace 'line' should be 'const'.
2014-03-18polarssl: break compatibility with version older than 1.3.Gaël PORTAY
Remove all #ifdef/else/endif macros that ensure compatibility with polarssl version previous than 1.3.