summaryrefslogtreecommitdiff
path: root/lib/vtls/vtls.c
Commit message (Collapse)AuthorAgeFilesLines
* warnless: move from the curlx_ to Curl_ name spaceDaniel Stenberg2017-06-071-2/+2
|
* TLS: Fix switching off SSL session id when client cert is usedJay Satiro2017-04-181-3/+6
| | | | | | | | | | | | | | Move the sessionid flag to ssl_primary_config so that ssl and proxy_ssl will each have their own sessionid flag. Regression since HTTPS-Proxy support was added in cb4e2be. Prior to that this issue had been fixed in 247d890, CVE-2016-5419. Bug: https://github.com/curl/curl/issues/1341 Reported-by: lijian996@users.noreply.github.com The new incarnation of this bug is called CVE-2017-7468 and is documented here: https://curl.haxx.se/docs/adv_20170419.html
* Improve code readbilitySylvestre Ledru2017-03-131-1/+1
| | | | | | ... by removing the else branch after a return, break or continue. Closes #1310
* vtls: add options to specify range of enabled TLS versionsJozef Kralik2017-03-081-2/+17
| | | | | | | This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
* vtls: source indentation fixDaniel Stenberg2017-01-221-8/+8
|
* vtls: fix PolarSSL non-blocking handlingDaniel Stenberg2017-01-201-3/+2
| | | | | | | A regression brought in cb4e2be Reported-by: Michael Kaufmann Bug: https://github.com/curl/curl/issues/1174#issuecomment-274018791
* vtls: fix mbedtls multi non blocking handshake.Antoine Aubert2017-01-201-2/+3
| | | | | | | When using multi, mbedtls handshake is in non blocking mode. vtls must set wait for read/write flags for the socket. Closes #1223
* rand: make it work without TLS backingDaniel Stenberg2017-01-121-7/+2
| | | | | | | Regression introduced in commit f682156a4fc6c4 Reported-by: John Kohl Bug: https://curl.haxx.se/mail/lib-2017-01/0055.html
* vtls: s/SSLEAY/OPENSSLDaniel Stenberg2016-12-261-2/+2
| | | | | | | | Fixed an old leftover use of the USE_SSLEAY define which would make a socket get removed from the applications sockets to monitor when the multi_socket API was used, leading to timeouts. Bug: #1174
* curl_version_info: add CURL_VERSION_HTTPS_PROXYOkhin Vasilij2016-11-261-2/+1
| | | | Closes #1142
* checksrc: move open braces to comply with function declaration styleDaniel Stenberg2016-11-241-3/+4
|
* checksrc: code style: use 'char *name' styleDaniel Stenberg2016-11-241-10/+11
|
* proxy: Support HTTPS proxy and SOCKS+HTTP(s)Alex Rousskov2016-11-241-88/+121
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
* Curl_rand: fixed and moved to rand.cDaniel Stenberg2016-11-141-75/+9
| | | | | | | | | | | | | Now Curl_rand() is made to fail if it cannot get the necessary random level. Changed the proto of Curl_rand() slightly to provide a number of ints at once. Moved out from vtls, since it isn't a TLS function and vtls provides Curl_ssl_random() for this to use. Discussion: https://curl.haxx.se/mail/lib-2016-11/0119.html
* strcasecompare: all case insensitive string compares ignore locale nowDaniel Stenberg2016-10-311-8/+8
| | | | | We had some confusions on when each function was used. We should not act differently on different locales anyway.
* vtls: only re-use session-ids using the same schemeDaniel Stenberg2016-10-131-0/+2
| | | | To make it harder to do cross-protocol mistakes
* TLS: random file/egd doesn't have to match for conn reuseDaniel Stenberg2016-08-261-2/+0
|
* TLS: only reuse connections with the same client certDaniel Stenberg2016-08-031-0/+1
| | | | | CVE-2016-5420 Bug: https://curl.haxx.se/docs/adv_20160803B.html
* TLS: switch off SSL session id when client cert is usedDaniel Stenberg2016-08-031-0/+10
| | | | | | | CVE-2016-5419 Bug: https://curl.haxx.se/docs/adv_20160803A.html Reported-by: Bru Rom Contributions-by: Eric Rescorla and Ray Satiro
* internals: rename the SessionHandle struct to Curl_easyDaniel Stenberg2016-06-221-16/+16
|
* vtls: Only call add/getsession if session id is enabledJay Satiro2016-06-221-3/+3
| | | | | | | | | | | Prior to this change we called Curl_ssl_getsessionid and Curl_ssl_addsessionid regardless of whether session ID reusing was enabled. According to comments that is in case session ID reuse was disabled but then later enabled. The old way was not intuitive and probably not something users expected. When a user disables session ID caching I'd guess they don't expect the session ID to be cached anyway in case the caching is later enabled.
* vtls: fix ssl session cache race conditionIvan Avdeev2016-06-011-18/+20
| | | | | | | | | | | | | | | | | | | | | | Sessionid cache management is inseparable from managing individual session lifetimes. E.g. for reference-counted sessions (like those in SChannel and OpenSSL engines) every session addition and removal should be accompanied with refcount increment and decrement respectively. Failing to do so synchronously leads to a race condition that causes symptoms like use-after-free and memory corruption. This commit: - makes existing session cache locking explicit, thus allowing individual engines to manage lock's scope. - fixes OpenSSL and SChannel engines by putting refcount management inside this lock's scope in relevant places. - adds these explicit locking calls to other engines that use sessionid cache to accommodate for this change. Note, however, that it is unknown whether any of these engines could also have this race. Bug: https://github.com/curl/curl/issues/815 Fixes #815 Closes #847
* tls: make setting pinnedkey option fail if not supportedDaniel Stenberg2016-05-011-5/+6
| | | | | | | | to make it obvious to users trying to use the feature with TLS backends not supporting it. Discussed in #781 Reported-by: Travis Burtrum
* news: CURLOPT_CONNECT_TO and --connect-toMichael Kaufmann2016-04-171-1/+28
| | | | | Makes curl connect to the given host+port instead of the host+port found in the URL.
* URLs: change more http to httpsViktor Szakats2016-02-041-1/+1
|
* URLs: change all http:// URLs to https://Daniel Stenberg2016-02-031-1/+1
|
* vtls: fix compiler warning for TLS backends without sha256Daniel Stenberg2015-10-201-0/+2
| | | | ... noticed with mbedTLS.
* vtls: Change designator name for server's pubkey hashJay Satiro2015-09-191-5/+3
| | | | | | | | | - Change the designator name we use to show the base64 encoded sha256 hash of the server's public key from 'pinnedpubkey' to 'public key hash'. Though the server's public key hash is only shown when comparing pinned public key hashes, the server's hash may not match one of the pinned.
* ssl: add server cert's "sha256//" hash to verboseDaniel Hwang2015-09-191-20/+23
| | | | | | | | | | Add a "pinnedpubkey" section to the "Server Certificate" verbose Bug: https://github.com/bagder/curl/issues/410 Reported-by: W. Mark Kubacki Closes #430 Closes #410
* SSL: Pinned public key hash supportmoparisthebest2015-07-011-0/+66
|
* vtls: Don't accept unknown CURLOPT_SSLVERSION valuesJay Satiro2015-03-271-0/+19
|
* Curl_ssl_md5sum: return CURLcodeDaniel Stenberg2015-03-251-4/+7
| | | | | | ... since the funciton can fail on OOM. Check this return code. Coverity CID 1291705.
* curl_memory: make curl_memory.h the second-last header file loadedDan Fandrich2015-03-241-2/+2
| | | | | | | This header file must be included after all header files except memdebug.h, as it does similar memory function redefinitions and can be similarly affected by conflicting definitions in system or dependent library headers.
* vtls: fix compile with --disable-crypto-auth but with SSLDan Fandrich2015-03-241-0/+2
| | | | This is a strange combination of options, but is allowed.
* url: add CURLOPT_SSL_FALSESTART optionAlessandro Ghedini2015-03-201-0/+12
| | | | | This option can be used to enable/disable TLS False Start defined in the RFC draft-bmoeller-tls-falsestart.
* Bug #149: Deletion of unnecessary checks before calls of the function "free"Markus Elfring2015-03-161-2/+1
| | | | | | | | | | | The function "free" is documented in the way that no action shall occur for a passed null pointer. It is therefore not needed that a function caller repeats a corresponding check. http://stackoverflow.com/questions/18775608/free-a-null-pointer-anyway-or-check-first This issue was fixed by using the software Coccinelle 1.0.0-rc24. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
* vtls: use curl_printf.h all overDaniel Stenberg2015-03-031-4/+2
| | | | No need to use _MPRINTF_REPLACE internally.
* url: add CURLOPT_SSL_VERIFYSTATUS optionAlessandro Ghedini2015-01-161-0/+12
| | | | | | | | | | This option can be used to enable/disable certificate status verification using the "Certificate Status Request" TLS extension defined in RFC6066 section 8. This also adds the CURLE_SSL_INVALIDCERTSTATUS error, to be used when the certificate status verification fails, and the Curl_ssl_cert_status_request() function, used to check whether the SSL backend supports the status_request extension.
* vtls: Don't set cert info count until memory allocation is successfulSteve Holme2014-12-261-2/+6
| | | | | | Otherwise Curl_ssl_init_certinfo() can fail and set the num_of_certs member variable to the requested count, which could then be used incorrectly as libcurl closes down.
* vtls: Use CURLcode for Curl_ssl_init_certinfo() return typeSteve Holme2014-12-261-8/+7
| | | | | | | | | The return type for this function was 0 on success and 1 on error. This was then examined by the calling functions and, in most cases, used to return CURLE_OUT_OF_MEMORY. Instead use CURLcode for the return type and return the out of memory error directly, propagating it up the call stack.
* vtls: Use bool for Curl_ssl_getsessionid() return typeSteve Holme2014-12-251-3/+3
| | | | | | The return type of this function is a boolean value, and even uses a bool internally, so use bool in the function declaration as well as the variables that store the return value, to avoid any confusion.
* SSL: Add PEM format support for public key pinningmoparisthebest2014-11-241-12/+100
|
* vtls.c: Fixed compilation warningSteve Holme2014-10-291-1/+3
| | | | conversion from 'size_t' to 'unsigned int', possible loss of data
* code cleanup: we prefer 'CURLcode result'Daniel Stenberg2014-10-241-12/+12
| | | | | | | | | | | | | | ... for the local variable name in functions holding the return code. Using the same name universally makes code easier to read and follow. Also, unify code for checking for CURLcode errors with: if(result) or if(!result) instead of if(result == CURLE_OK), if(CURLE_OK == result) or if(result != CURLE_OK)
* Curl_rand: Uninitialized variable: rDaniel Stenberg2014-10-231-1/+1
| | | | | | | This is not actually used uninitialized but we silence warnings. Bug: http://curl.haxx.se/bug/view.cgi?id=1437 Reported-by: Julien
* Factorize pinned public key code into generic file handling and backend specificPatrick Monnerat2014-10-131-0/+56
|
* vtls: remove QsoSSLPatrick Monnerat2014-10-131-1/+0
|
* vtls/*: deprecate have_curlssl_md5sum and set-up default md5sum implementationPatrick Monnerat2014-10-131-2/+10
|
* vtls: have vtls.h include the backend header filesDaniel Stenberg2014-10-091-10/+0
| | | | | | | | It turned out some features were not enabled in the build since for example url.c #ifdefs on features that are defined on a per-backend basis but vtls.h didn't include the backend headers. CURLOPT_CERTINFO was one such feature that was accidentally disabled.
* ssl: provide Curl_ssl_backend even if no SSL library is availableDan Fandrich2014-08-031-5/+5
|
View Lorry Controller Status