summaryrefslogtreecommitdiff
path: root/lib/vtls/schannel_verify.c
Commit message (Collapse)AuthorAgeFilesLines
* copyright: update all copyright lines and remove year rangesDaniel Stenberg2023-01-031-3/+3
| | | | | | | | | | | | - they are mostly pointless in all major jurisdictions - many big corporations and projects already don't use them - saves us from pointless churn - git keeps history for us - the year range is kept in COPYING checksrc is updated to allow non-year using copyright statements Closes #10205
* vtls: localization of state data in filtersStefan Eissing2022-11-221-11/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - almost all backend calls pass the Curl_cfilter intance instead of connectdata+sockindex - ssl_connect_data is remove from struct connectdata and made internal to vtls - ssl_connect_data is allocated in the added filter, kept at cf->ctx - added function to let a ssl filter access its ssl_primary_config and ssl_config_data this selects the propert subfields in conn and data, for filters added as plain or proxy - adjusted all backends to use the changed api - adjusted all backends to access config data via the exposed functions, no longer using conn or data directly cfilter renames for clear purpose: - methods `Curl_conn_*(data, conn, sockindex)` work on the complete filter chain at `sockindex` and connection `conn`. - methods `Curl_cf_*(cf, ...)` work on a specific Curl_cfilter instance. - methods `Curl_conn_cf()` work on/with filter instances at a connection. - rebased and resolved some naming conflicts - hostname validation (und session lookup) on SECONDARY use the same name as on FIRST (again). new debug macros and removing connectdata from function signatures where not needed. adapting schannel for new Curl_read_plain paramter. Closes #9919
* lib: connection filters (cfilter) addition to curl:Stefan Eissing2022-11-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | - general construct/destroy in connectdata - default implementations of callback functions - connect: cfilters for connect and accept - socks: cfilter for socks proxying - http_proxy: cfilter for http proxy tunneling - vtls: cfilters for primary and proxy ssl - change in general handling of data/conn - Curl_cfilter_setup() sets up filter chain based on data settings, if none are installed by the protocol handler setup - Curl_cfilter_connect() boot straps filters into `connected` status, used by handlers and multi to reach further stages - Curl_cfilter_is_connected() to check if a conn is connected, e.g. all filters have done their work - Curl_cfilter_get_select_socks() gets the sockets and READ/WRITE indicators for multi select to work - Curl_cfilter_data_pending() asks filters if the have incoming data pending for recv - Curl_cfilter_recv()/Curl_cfilter_send are the general callbacks installed in conn->recv/conn->send for io handling - Curl_cfilter_attach_data()/Curl_cfilter_detach_data() inform filters and addition/removal of a `data` from their connection - adding vtl functions to prevent use of Curl_ssl globals directly in other parts of the code. Reviewed-by: Daniel Stenberg Closes #9855
* copyright: make repository REUSE compliantmax.mehl2022-06-131-0/+2
| | | | | | | | | | | Add licensing and copyright information for all files in this repository. This either happens in the file itself as a comment header or in the file `.reuse/dep5`. This commit also adds a Github workflow to check pull requests and adapts copyright.pl to the changes. Closes #8869
* schannel: remove dead code that will never runDaniel Stenberg2022-04-061-4/+0
| | | | | | | | As the condition can't ever evaluate true Reported-by: Andrey Alifanov Ref: #8675 Closes #8677
* ssl: reduce allocated space for ssl backend when FTP is disabledMAntoniak2022-02-211-0/+2
| | | | | | Add assert() for the backend pointer in many places Closes #8471
* hostcheck: reduce strlen calls on chained certificatesHenrik Holst2022-02-131-1/+2
| | | | Closes #8428
* hostcheck: pass in pattern length too, to avoid a strlen callDaniel Stenberg2022-02-101-1/+2
| | | | | | Removes one strlen() call per SAN name in a cert-check. Closes #8418
* hostcheck: fixed to not touch used input stringsDaniel Stenberg2022-01-241-5/+2
| | | | | | | | Avoids the need to clone the strings before check, thus avoiding mallocs, which for cases where there are many SAN names in a cert could end up numerous. Closes #8321
* version_win32: Check build number and platform idWyatt O'Day2021-12-021-2/+3
| | | | | | | | | | | | | Prior to this change the build number was not checked during version comparison, and the platform id was supposed to be checked but wasn't. Checking the build number is required for enabling "evergreen" Windows 10/11 features (like TLS 1.3). Ref: https://github.com/curl/curl/pull/7784 Closes https://github.com/curl/curl/pull/7824 Closes https://github.com/curl/curl/pull/7867
* vtls: fix typo in schannel_verify.cIkko Ashimine2021-08-131-1/+1
| | | | | | occurence -> occurrence Closes #7566
* infof: remove newline from format strings, always append itDaniel Stenberg2021-07-071-4/+4
| | | | | | | | | | | | | | | | - the data needs to be "line-based" anyway since it's also passed to the debug callback/application - it makes infof() work like failf() and consistency is good - there's an assert that triggers on newlines in the format string - Also removes a few instances of "..." - Removes the code that would append "..." to the end of the data *iff* it was truncated in infof() Closes #7357
* SSL: support in-memory CA certs for some backendsGilles Vollant2021-05-051-110/+161
| | | | | | | | | | | | | | | | | - New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to specify in-memory PEM certificates for OpenSSL, Schannel (Windows) and Secure Transport (Apple) SSL backends. Prior to this change PEM certificates could only be imported from a file and not from memory. Co-authored-by: moparisthebest@users.noreply.github.com Ref: https://github.com/curl/curl/pull/4679 Ref: https://github.com/curl/curl/pull/5677 Ref: https://github.com/curl/curl/pull/6109 Closes https://github.com/curl/curl/pull/6662
* vtls: deduplicate some DISABLE_PROXY ifdefsMichał Antoniak2021-04-221-7/+1
| | | | | | | | | | | continue from #5735 - using SSL_HOST_NAME, SSL_HOST_DISPNAME, SSL_PINNED_PUB_KEY for other tls backend - create SSL_HOST_PORT Closes #6660
* tidy-up: make conditional checks more consistentDaniel Stenberg2021-04-221-2/+2
| | | | | | ... remove '== NULL' and '!= 0' Closes #6912
* schannel: Evaluate CURLOPT_SSL_OPTIONS via SSL_SET_OPTION macroJay Satiro2021-03-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | - Change use of those options from CURLOPT_SSL_OPTIONS that are not already evaluated via SSL_SET_OPTION in schannel and secure transport to use that instead of data->set.ssl.optname. Example: Evaluate SSL_SET_OPTION(no_revoke) instead of data->set.ssl.no_revoke. This change is because options set via CURLOPT_SSL_OPTIONS (data->set.ssl.optname) are separate from those set for HTTPS proxy via CURLOPT_PROXY_SSL_OPTIONS (data->set.proxy_ssl.optname). The SSL_SET_OPTION macro determines whether the connection is for HTTPS proxy and based on that which option to evaluate. Since neither Schannel nor Secure Transport backends currently support HTTPS proxy in libcurl, this change is for posterity and has no other effect. Closes https://github.com/curl/curl/pull/6690
* vtls: reduce conn->data usePatrick Monnerat2021-01-191-6/+5
| | | | Closes #6474
* schannel_verify: fix safefree call typoDaniel Stenberg2021-01-151-5/+5
| | | | | | Follow-up from e87ad71d1ba00519 Closes #6459
* schannel: plug a memory-leakGisle Vanem2021-01-141-1/+1
| | | | | | ... when built without -DUNICODE. Closes #6457
* curl.se: new homeDaniel Stenberg2020-11-041-1/+1
| | | | Closes #6172
* win32: Add Curl_verify_windows_version() to curlxCameron Cawley2020-08-021-4/+4
| | | | Closes https://github.com/curl/curl/pull/5754
* vtls: repair the build with `CURL_DISABLE_PROXY`Saleem Abdulrasool2020-06-011-0/+4
| | | | | | | | | `http_proxy` will not be available in `conndata` if `CURL_DISABLE_PROXY` is enabled. Repair the build with that configuration. Follow-up to f3d501dc67 Closes #5498
* cleanup: use a single space after equals sign in assignmentsDaniel Stenberg2020-05-261-1/+1
|
* source cleanup: remove all custom typedef structsDaniel Stenberg2020-05-151-3/+3
| | | | | | | | | | | - Stick to a single unified way to use structs - Make checksrc complain on 'typedef struct {' - Allow them in tests, public headers and examples - Let MD4_CTX, MD5_CTX, and SHA256_CTX typedefs remain as they actually typedef different types/structs depending on build conditions. Closes #5338
* curl_multibyte: add to curlxMarcel Raad2020-05-141-5/+5
| | | | | | | This will also be needed in the tool and tests. Ref: https://github.com/curl/curl/pull/3758#issuecomment-482197512 Closes https://github.com/curl/curl/pull/3784
* schannel: add "best effort" revocation check optionJohannes Schindelin2020-03-181-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Implement new option CURLSSLOPT_REVOKE_BEST_EFFORT and --ssl-revoke-best-effort to allow a "best effort" revocation check. A best effort revocation check ignores errors that the revocation check was unable to take place. The reasoning is described in detail below and discussed further in the PR. --- When running e.g. with Fiddler, the schannel backend fails with an unhelpful error message: Unknown error (0x80092012) - The revocation function was unable to check revocation for the certificate. Sadly, many enterprise users who are stuck behind MITM proxies suffer the very same problem. This has been discussed in plenty of issues: https://github.com/curl/curl/issues/3727, https://github.com/curl/curl/issues/264, for example. In the latter, a Microsoft Edge developer even made the case that the common behavior is to ignore issues when a certificate has no recorded distribution point for revocation lists, or when the server is offline. This is also known as "best effort" strategy and addresses the Fiddler issue. Unfortunately, this strategy was not chosen as the default for schannel (and is therefore a backend-specific behavior: OpenSSL seems to happily ignore the offline servers and missing distribution points). To maintain backward-compatibility, we therefore add a new flag (`CURLSSLOPT_REVOKE_BEST_EFFORT`) and a new option (`--ssl-revoke-best-effort`) to select the new behavior. Due to the many related issues Git for Windows and GitHub Desktop, the plan is to make this behavior the default in these software packages. The test 2070 was added to verify this behavior, adapted from 310. Based-on-work-by: georgeok <giorgos.n.oikonomou@gmail.com> Co-authored-by: Markus Olsson <j.markus.olsson@gmail.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Closes https://github.com/curl/curl/pull/4981
* schannel_verify: Fix alt names manual verify for UNICODE buildsJay Satiro2020-01-131-1/+1
| | | | | | | Follow-up to 29e40a6 from two days ago, which added that feature for Windows 7 and earlier. The bug only occurred in same. Ref: https://github.com/curl/curl/pull/4761
* misc: Copyright year out of date, should be 2020Daniel Stenberg2020-01-121-1/+1
| | | | | | Follow-up to recent commits [skip ci]
* schannel: Make CURLOPT_CAINFO work better on Windows 7Faizur Rahman2020-01-111-20/+130
| | | | | | | | | | | | | | | | | | | | | - Support hostname verification via alternative names (SAN) in the peer certificate when CURLOPT_CAINFO is used in Windows 7 and earlier. CERT_NAME_SEARCH_ALL_NAMES_FLAG doesn't exist before Windows 8. As a result CertGetNameString doesn't quite work on those versions of Windows. This change provides an alternative solution for CertGetNameString by iterating through CERT_ALT_NAME_INFO for earlier versions of Windows. Prior to this change many certificates failed the hostname validation when CURLOPT_CAINFO was used in Windows 7 and earlier. Most certificates now represent multiple hostnames and rely on the alternative names field exclusively to represent their hostnames. Reported-by: Jeroen Ooms Fixes https://github.com/curl/curl/issues/3711 Closes https://github.com/curl/curl/pull/4761
* strerror: Add Curl_winapi_strerror for Win API specific errorsJay Satiro2019-12-011-9/+14
| | | | | | | | | | | | | | | - In all code call Curl_winapi_strerror instead of Curl_strerror when the error code is known to be from Windows GetLastError. Curl_strerror prefers CRT error codes (errno) over Windows API error codes (GetLastError) when the two overlap. When we know the error code is from GetLastError it is more accurate to prefer the Windows API error messages. Reported-by: Richard Alcock Fixes https://github.com/curl/curl/issues/4550 Closes https://github.com/curl/curl/pull/4581
* schannel_verify: Fix concurrent openings of CA fileJay Satiro2019-11-011-1/+1
| | | | | | | | | | | | | | - Open the CA file using FILE_SHARE_READ mode so that others can read from it as well. Prior to this change our schannel code opened the CA file without sharing which meant concurrent openings (eg an attempt from another thread or process) would fail during the time it was open without sharing, which in curl's case would cause error: "schannel: failed to open CA file". Bug: https://curl.haxx.se/mail/lib-2019-10/0104.html Reported-by: Richard Alcock
* strerror: make the strerror function use local buffersDaniel Stenberg2019-02-261-17/+28
| | | | | | | | | | | | | | | | Instead of using a fixed 256 byte buffer in the connectdata struct. In my build, this reduces the size of the connectdata struct by 11.8%, from 2160 to 1904 bytes with no functionality or performance loss. This also fixes a bug in schannel's Curl_verify_certificate where it called Curl_sspi_strerror when it should have called Curl_strerror for string from GetLastError. the only effect would have been no text or the wrong text being shown for the error. Co-authored-by: Jay Satiro Closes #3612
* schannel: fix compiler warningMarcel Raad2019-01-061-3/+3
| | | | | | | | | When building with Unicode on MSVC, the compiler warns about freeing a pointer to const in Curl_unicodefree. Fix this by declaring it as non-const and casting the argument to Curl_convert_UTF8_to_tchar to non-const too, like we do in all other places. Closes https://github.com/curl/curl/pull/3435
* winssl: be consistent in Schannel capitalizationDaniel Gustafsson2018-11-071-1/+1
| | | | | | | | The productname from Microsoft is "Schannel", but in infof/failf reporting we use "schannel". This removes different versions. Closes #3243 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* schannel: use Curl_ prefix for global private symbolsDaniel Stenberg2018-11-011-1/+1
| | | | | | | Curl_verify_certificate() must use the Curl_ prefix since it is globally available in the lib and otherwise steps outside of our namespace! Closes #3201
* memory: ensure to check allocation resultsDaniel Gustafsson2018-10-031-0/+4
| | | | | | | | | | | | | | | | The result of a memory allocation should always be checked, as we may run under memory pressure where even a small allocation can fail. This adds checking and error handling to a few cases where the allocation wasn't checked for success. In the ftp case, the freeing of the path variable is moved ahead of the allocation since there is little point in keeping it around across the strdup, and the separation makes for more readable code. In nwlib, the lock is aslo freed in the error path. Also bumps the copyright years on affected files. Closes #3084 Reviewed-by: Jay Satiro <raysatiro@yahoo.com> Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* sendf: Fix whitespace in infof/failf concatenationDaniel Gustafsson2018-09-131-1/+1
| | | | | | | | | | Strings broken on multiple rows in the .c file need to have appropriate whitespace padding on either side of the concatenation point to render a correct amalgamated string. Fix by adding a space at the occurrences found. Closes #2986 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* schannel: unified error code handlingHan Han2018-09-061-1/+1
| | | | Closes #2901
* schannel: avoid incompatible pointer warningViktor Szakats2018-06-121-1/+1
| | | | | | | | | | | | | | | | | | | | with clang-6.0: ``` vtls/schannel_verify.c: In function 'add_certs_to_store': vtls/schannel_verify.c:212:30: warning: passing argument 11 of 'CryptQueryObject' from incompatible pointer type [-Wincompatible-pointer-types] &cert_context)) { ^ In file included from /usr/share/mingw-w64/include/schannel.h:10:0, from /usr/share/mingw-w64/include/schnlsp.h:9, from vtls/schannel.h:29, from vtls/schannel_verify.c:40: /usr/share/mingw-w64/include/wincrypt.h:4437:26: note: expected 'const void **' but argument is of type 'CERT_CONTEXT ** {aka struct _CERT_CONTEXT **}' WINIMPM WINBOOL WINAPI CryptQueryObject (DWORD dwObjectType, const void *pvObject, DWORD dwExpectedContentTypeFlags, DWORD dwExpectedFormatTypeFlags, DWORD dwFlags, ^~~~~~~~~~~~~~~~ ``` Ref: https://msdn.microsoft.com/library/windows/desktop/aa380264 Closes https://github.com/curl/curl/pull/2648
* schannel: make CAinfo parsing resilient to CR/LFJohannes Schindelin2018-05-221-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | OpenSSL has supported --cacert for ages, always accepting LF-only line endings ("Unix line endings") as well as CR/LF line endings ("Windows line endings"). When we introduced support for --cacert also with Secure Channel (or in cURL speak: "WinSSL"), we did not take care to support CR/LF line endings, too, even if we are much more likely to receive input in that form when using Windows. Let's fix that. Happily, CryptQueryObject(), the function we use to parse the ca-bundle, accepts CR/LF input already, and the trailing LF before the END CERTIFICATE marker catches naturally any CR/LF line ending, too. So all we need to care about is the BEGIN CERTIFICATE marker. We do not actually need to verify here that the line ending is CR/LF. Just checking for a CR or an LF is really plenty enough. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Closes https://github.com/curl/curl/pull/2592
* schannel_verify: fix build for non-schannelDaniel Stenberg2018-05-161-2/+1
|
* schannel: disable manual verify if APIs not availableJay Satiro2018-05-161-4/+7
| | | | | .. because original MinGW and old compilers do not have the Windows API definitions needed to support manual verification.
* schannel: add support for CURLOPT_CAINFODan McNulty2018-04-181-0/+551
- Move verify_certificate functionality in schannel.c into a new file called schannel_verify.c. Additionally, some structure defintions from schannel.c have been moved to schannel.h to allow them to be used in schannel_verify.c. - Make verify_certificate functionality for Schannel available on all versions of Windows instead of just Windows CE. verify_certificate will be invoked on Windows CE or when the user specifies CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER. - In verify_certificate, create a custom certificate chain engine that exclusively trusts the certificate store backed by the CURLOPT_CAINFO file. - doc updates of --cacert/CAINFO support for schannel - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString when available. This implements a TODO in schannel.c to improve handling of multiple SANs in a certificate. In particular, all SANs will now be searched instead of just the first name. - Update tool_operate.c to not search for the curl-ca-bundle.crt file when using Schannel to maintain backward compatibility. Previously, any curl-ca-bundle.crt file found in that search would have been ignored by Schannel. But, with CAINFO support, the file found by that search would have been used as the certificate store and could cause issues for any users that have curl-ca-bundle.crt in the search path. - Update url.c to not set the build time CURL_CA_BUNDLE if the selected SSL backend is Schannel. We allow setting CA location for schannel only when explicitly specified by the user via CURLOPT_CAINFO / --cacert. - Add new test cases 3000 and 3001. These test cases check that the first and last SAN, respectively, matches the connection hostname. New test certificates have been added for these cases. For 3000, the certificate prefix is Server-localhost-firstSAN and for 3001, the certificate prefix is Server-localhost-secondSAN. - Remove TODO 15.2 (Add support for custom server certificate validation), this commit addresses it. Closes https://github.com/curl/curl/pull/1325
View Lorry Controller Status