summaryrefslogtreecommitdiff
path: root/lib/vtls/openssl.h
Commit message (Collapse)AuthorAgeFilesLines
* vtls: fold the backend ID into the Curl_ssl structureJohannes Schindelin2017-08-281-3/+0
| | | | Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: move SSL backends' private constants out of their header filesJohannes Schindelin2017-08-281-3/+0
| | | | Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: remove obsolete declarations of SSL backend functionalityJohannes Schindelin2017-08-281-40/+0
| | | | | | | | | | | | | | | | | | | These functions are all available via the Curl_ssl struct now, no need to declare them separately anymore. As the global declarations are removed, the corresponding function definitions are marked as file-local. The only two exceptions here are Curl_mbedtls_shutdown() and Curl_polarssl_shutdown(): only the declarations were removed, there are no function definitions to mark file-local. Please note that Curl_nss_force_init() is *still* declared globally, as the only SSL backend-specific function, because it was introduced specifically for the use case where cURL was compiled with `--without-ssl --with-nss`. For details, see f3b77e561 (http_ntlm: add support for NSS, 2010-06-27). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: move the SUPPORT_HTTPS_PROXY flag into the Curl_ssl structJohannes Schindelin2017-08-281-3/+0
| | | | | | That will allow us to choose the SSL backend at runtime. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: convert the have_curlssl_* constants to runtime flagsJohannes Schindelin2017-08-281-12/+0
| | | | | | | | | | The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: move sha256sum into the Curl_ssl structJohannes Schindelin2017-08-281-8/+0
| | | | | | | | | | | | The SHA-256 checksumming is also an SSL backend-specific function. Let's include it in the struct declaring the functionality of SSL backends. In contrast to MD5, there is no fall-back code. To indicate this, the respective entries are NULL for those backends that offer no support for SHA-256 checksumming. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: move md5sum into the Curl_ssl structJohannes Schindelin2017-08-281-5/+0
| | | | | | | | | | The MD5 summing is also an SSL backend-specific function. So let's include it, offering the previous fall-back code as a separate function now: Curl_none_md5sum(). To allow for that, the signature had to be changed so that an error could be returned from the implementation (Curl_none_md5sum() can run out of memory). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: use the Curl_ssl struct to access all SSL backends' functionalityJohannes Schindelin2017-08-281-17/+0
| | | | | | | | This is the first step to unify the SSL backend handling. Now all the SSL backend-specific functionality is accessed via a global instance of the Curl_ssl struct. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: declare Curl_ssl structs for every SSL backendJohannes Schindelin2017-08-281-0/+2
| | | | | | | | The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* rand: make it work without TLS backingDaniel Stenberg2017-01-121-3/+3
| | | | | | | Regression introduced in commit f682156a4fc6c4 Reported-by: John Kohl Bug: https://curl.haxx.se/mail/lib-2017-01/0055.html
* curl_version_info: add CURL_VERSION_HTTPS_PROXYOkhin Vasilij2016-11-261-0/+3
| | | | Closes #1142
* internals: rename the SessionHandle struct to Curl_easyDaniel Stenberg2016-06-221-5/+5
|
* tls: make setting pinnedkey option fail if not supportedDaniel Stenberg2016-05-011-2/+5
| | | | | | | | to make it obvious to users trying to use the feature with TLS backends not supporting it. Discussed in #781 Reported-by: Travis Burtrum
* URLs: change all http:// URLs to https://Daniel Stenberg2016-02-031-1/+1
|
* openssl: build with < 0.9.8Daniel Stenberg2015-09-171-1/+1
| | | | | | ... without sha256 support and no define saying so. Reported-by: Rajkumar Mandal
* openssl: VMS support for SHA256John Malmberg2015-07-141-0/+2
| | | | | | | | | setup-vms.h: More symbols for SHA256, hacks for older VAX openssl.h: Use OpenSSL OPENSSL_NO_SHA256 macro to allow building on VAX. openssl.c: Use OpenSSL version checks and OPENSSL_NO_SHA256 macro to allow building on VAX and 64 bit VMS.
* SSL: Pinned public key hash supportmoparisthebest2015-07-011-0/+5
|
* openssl: use colons properly in the ciphers listDaniel Stenberg2015-03-121-1/+1
| | | | | | While the previous string worked, this is the documented format. Reported-by: Richard Moore
* openssl: sort the ciphers on strengthDaniel Stenberg2015-03-121-1/+2
| | | | | | | | This makes curl pick better (stronger) ciphers by default. The strongest available ciphers are fine according to the HTTP/2 spec so an OpenSSL built curl is no longer rejected by string HTTP/2 servers. Bug: http://curl.haxx.se/bug/view.cgi?id=1487
* openssl: remove all uses of USE_SSLEAYDaniel Stenberg2015-03-051-2/+2
| | | | | | | SSLeay was the name of the library that was subsequently turned into OpenSSL many moons ago (1999). curl does not work with the old SSLeay library since years. This is now reflected by only using USE_OPENSSL in code that depends on OpenSSL.
* openssl: add support for the Certificate Status Request TLS extensionAlessandro Ghedini2015-01-221-0/+3
| | | | | | | | Also known as "status_request" or OCSP stapling, defined in RFC6066 section 8. Thanks-to: Joe Mason - for the work-around for the OpenSSL bug.
* vtls: Separate the SSL backend definition from the API setupSteve Holme2015-01-171-2/+4
| | | | | Slight code cleanup as the SSL backend #define is mixed up with the API function setup.
* vtls: Fixed compilation warning and an ignored return codeSteve Holme2014-12-281-1/+1
| | | | | | | | | | | | | | | | curl_schannel.h:123: warning: right-hand operand of comma expression has no effect Some instances of the curlssl_close_all() function were declared with a void return type whilst others as int. The schannel version returned CURLE_NOT_BUILT_IN and others simply returned zero, but in all cases the return code was ignored by the calling function Curl_ssl_close_all(). For the time being and to keep the internal API consistent, changed all declarations to use a void return type. To reduce code we might want to consider removing the unimplemented versions and use a void #define like schannel does.
* vtls/*: deprecate have_curlssl_md5sum and set-up default md5sum implementationPatrick Monnerat2014-10-131-3/+0
|
* curlssl: make tls backend symbols use curlssl in the nameDaniel Stenberg2014-09-131-1/+1
|
* url: let the backend decide CURLOPT_SSL_CTX_ supportDaniel Stenberg2014-09-131-0/+3
| | | | ... to further remove specific TLS backend knowledge from url.c
* vtls: have the backend tell if it supports CERTINFODaniel Stenberg2014-09-131-0/+3
|
* CURLOPT_CAPATH: return failure if set without backend supportDaniel Stenberg2014-09-131-0/+3
|
* ssl: generalize how the ssl backend identifier is setDaniel Stenberg2014-07-311-0/+1
| | | | | Each backend now defines CURL_SSL_BACKEND accordingly. Added the *AXTLS one which was missing previously.
* vtls: make the random function mandatory in the TLS backendDaniel Stenberg2014-07-301-5/+4
| | | | | | | | To force each backend implementation to really attempt to provide proper random. If a proper random function is missing, then we can explicitly make use of the default one we use when TLS support is missing. This commit makes sure it works for darwinssl, gnutls, nss and openssl.
* OpenSSL: deselect weak ciphers by defaultDaniel Stenberg2014-01-121-1/+3
| | | | | | | | | | | | | By default even recent versions of OpenSSL support and accept both "export strength" ciphers, small-bitsize ciphers as well as downright deprecated ones. This change sets a default cipher set that avoids the worst ciphers, and subsequently makes https://www.howsmyssl.com/a/check no longer grade curl/OpenSSL connects as 'Bad'. Bug: http://curl.haxx.se/bug/view.cgi?id=1323 Reported-by: Jeff Hodges
* vtls: Updated comments referencing sslgen.c and ssluse.cSteve Holme2013-12-261-1/+1
|
* openssl: renamed backend files to openssl.[ch]Daniel Stenberg2013-12-201-0/+99
View Lorry Controller Status