| Age | Commit message (Collapse) | Author |
|---|
|
|
|
Option --pinnedpubkey takes a path to a public key in DER format and
only connect if it matches (currently only implemented with OpenSSL).
Provides CURLOPT_PINNEDPUBLICKEY for curl_easy_setopt().
Extract a public RSA key from a website like so:
openssl s_client -connect google.com:443 2>&1 < /dev/null | \
sed -n '/-----BEGIN/,/-----END/p' | openssl x509 -noout -pubkey \
| openssl rsa -pubin -outform DER > google.com.der
|
|
First try to fix possible memory leaks, in this case:
Only connssl->ctxt xor onnssl->cred being initialized.
|
|
|
|
... to further remove specific TLS backend knowledge from url.c
|
|
|
|
|
|
Bug: http://curl.haxx.se/mail/lib-2014-09/0064.html
|
|
|
|
Signed-off-by: Catalin Patulea <cat@vv.carleton.ca>
|
|
SecCertificateCopyPublicKey() is not available on iPhone. Use
CopyCertSubject() instead to see if the certificate returned by
SecCertificateCreateWithData() is valid.
Reported-by: Toby Peterson
|
|
Forwards the setting as minimum ssl version (if set) to polarssl. If
the server does not support the requested version the SSL Handshake will
fail.
Bug: http://curl.haxx.se/bug/view.cgi?id=1419
|
|
SecCertificateCreateWithData() returns a non-NULL SecCertificateRef even
if the buffer holds an invalid or corrupt certificate. Call
SecCertificateCopyPublicKey() to make sure cacert is a valid
certificate.
|
|
If the --cacert option is used with a CA certificate bundle that
contains multiple CA certificates, iterate through it, adding each
certificate as a trusted root CA.
|
|
|
|
warning: declaration of 'minor' shadows a global declaration
|
|
Fixed libcurl to correctly output the newer versions of OpenSSL 0.9.8,
starting from openssl-0.9.8za.
|
|
vtls.c:688:43: warning: unused parameter 'data'
|
|
OPENSSL_config() is "strongly recommended" to use but unfortunately that
function makes an exit() call on wrongly formatted config files which
makes it hard to use in some situations. OPENSSL_config() itself calls
CONF_modules_load_file() and we use that instead and we ignore its
return code!
Reported-by: Jan Ehrhardt
Bug: http://curl.haxx.se/bug/view.cgi?id=1401
|
|
The GetDarwinVersionNumber() function uses strtok, which is not
thread-safe.
|
|
This seems to be the way it should work. Right now we can't build with
BoringSSL and try this out properly due to a minor API breakage.
|
|
LibreSSL is otherwise OpenSSL API compliant (so far)
|
|
|
|
|
|
Previously it only returned a CURLcode for errors, which is when it
returns a different size than what was passed in to it.
The http2 code only checked the curlcode and thus failed.
|
|
This function is available for every Windows version since Windows 95/NT.
reference:
http://msdn.microsoft.com/en-us/library/windows/desktop/aa379942.aspx
|
|
Each backend now defines CURL_SSL_BACKEND accordingly. Added the *AXTLS
one which was missing previously.
|
|
|
|
It's an enum so a macro test won't work. The CyaSSL changelog doesn't
say exactly when this error code was introduced, but it's likely
to be 2.7.0.
|
|
|
|
... by defining Curl_ssl_random() properly
|
|
This now provides a weak random function since PolarSSL doesn't have a
quick and easy way to provide a good one. It does however provide the
framework to make one so it _can_ and _should_ be done...
|
|
I couldn't find any dedicated function in its API to get a "good" random
with.
|
|
ASN_NO_SIGNER_E didn't exist back then!
|
|
To force each backend implementation to really attempt to provide proper
random. If a proper random function is missing, then we can explicitly
make use of the default one we use when TLS support is missing.
This commit makes sure it works for darwinssl, gnutls, nss and openssl.
|
|
The minimal required version of NSS is 3.14.x so it does not make sense
to check for NSS 3.12.0+ at run time.
|
|
CyaSSL 3.0.0 returns a unique error code if no CA cert is available,
so translate that into CURLE_SSL_CACERT_BADFILE when peer verification
is requested.
|
|
conversion to 'int' from 'long int' may alter its value
|
|
Reported-by: David Woodhouse
|
|
Before GnuTLS 3.3.6, the gnutls_x509_crt_check_hostname() function
didn't actually check IP addresses in SubjectAltName, even though it was
explicitly documented as doing so. So do it ourselves...
|
|
Reported-by: David Woodhouse
|
|
|
|
The AES-GCM ciphers were added to GnuTLS as late as ver. 3.0.1 but
the code path in which they're referenced here is only ever used for
somewhat older GnuTLS versions. This caused undeclared identifier errors
when compiling against those.
|
|
This seems to have become necessary for SRP support to work starting
with GnuTLS ver. 2.99.0. Since support for SRP was added to GnuTLS
before the function that takes this priority string, there should be no
issue with backward compatibility.
|
|
This makes the behaviour consistent with what happens if a date can
be extracted from the certificate but is expired.
|
|
Otherwise NSS could use an already freed item for another connection.
|
|
|
|
... and spell it as crl_der instead of crlDER
|
|
|
|
This feature was unintentionally disabled by commit ff92fcfb.
|
