summaryrefslogtreecommitdiff
path: root/lib/vtls
Commit message (Collapse)AuthorAgeFilesLines
* code style: use spaces around equals signsDaniel Stenberg2017-09-1110-61/+61
|
* mbedtls: enable CA path processingJay Satiro2017-09-101-1/+1
| | | | | | | | CA path processing was implemented when mbedtls.c was added to libcurl in fe7590f, but it was never enabled. Bug: https://github.com/curl/curl/issues/1877 Reported-by: SBKarr@users.noreply.github.com
* OpenSSL: fix yet another mistake while encapsulating SSL backend dataJohannes Schindelin2017-09-071-1/+3
| | | | | | | | | | | | Another mistake in my manual fixups of the largely mechanical search-and-replace ("connssl->" -> "BACKEND->"), just like the previous commit concerning HTTPS proxies (and hence not caught during my earlier testing). Fixes #1855 Closes #1871 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* OpenSSL: fix erroneous SSL backend encapsulationJohannes Schindelin2017-09-071-2/+2
| | | | | | | | | | | | | | | | | | In d65e6cc4f (vtls: prepare the SSL backends for encapsulated private data, 2017-06-21), this developer prepared for a separation of the private data of the SSL backends from the general connection data. This conversion was partially automated (search-and-replace) and partially manual (e.g. proxy_ssl's backend data). Sadly, there was a crucial error in the manual part, where the wrong handle was used: rather than connecting ssl[sockindex]' BIO to the proxy_ssl[sockindex]', we reconnected proxy_ssl[sockindex]. The reason was an incorrect location to paste "BACKEND->"... d'oh. Reported by Jay Satiro in https://github.com/curl/curl/issues/1855. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: fix memory corruptionJay Satiro2017-09-071-0/+10
| | | | | | | | | | | | Ever since 70f1db321 (vtls: encapsulate SSL backend-specific data, 2017-07-28), the code handling HTTPS proxies was broken because the pointer to the SSL backend data was not swapped between conn->ssl[sockindex] and conn->proxy_ssl[sockindex] as intended, but instead set to NULL (causing segmentation faults). [jes: provided the commit message, tested and verified the patch] Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: switch to CURL_SHA256_DIGEST_LENGTH defineDaniel Stenberg2017-09-073-7/+8
| | | | | | | | | ... instead of the prefix-less version since WolfSSL 3.12 now uses an enum with that name that causes build failures for us. Fixes #1865 Closes #1867 Reported-by: Gisle Vanem
* SSL: fix unused parameter warningsJay Satiro2017-09-064-0/+6
|
* vtls: select ssl backend case-insensitive (follow-up)Gisle Vanem2017-09-061-5/+8
| | | | | | | | | | | | | - Do a case-insensitive comparison of CURL_SSL_BACKEND env as well. - Change Curl_strcasecompare calls to strcasecompare (maps to the former but shorter). Follow-up to c290b8f. Bug: https://github.com/curl/curl/commit/c290b8f#commitcomment-24094313 Co-authored-by: Jay Satiro
* openssl: Integrate Peter Wu's SSLKEYLOGFILE implementationJay Satiro2017-09-051-0/+168
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This is an adaptation of 2 of Peter Wu's SSLKEYLOGFILE implementations. The first one, written for old OpenSSL versions: https://git.lekensteyn.nl/peter/wireshark-notes/tree/src/sslkeylog.c The second one, written for BoringSSL and new OpenSSL versions: https://github.com/curl/curl/pull/1346 Note the first one is GPL licensed but the author gave permission to waive that license for libcurl. As of right now this feature is disabled by default, and does not have a configure option to enable it. To enable this feature define ENABLE_SSLKEYLOGFILE when building libcurl and set environment variable SSLKEYLOGFILE to a pathname that will receive the keys. And in Wireshark change your preferences to point to that key file: Edit > Preferences > Protocols > SSL > Master-Secret Co-authored-by: Peter Wu Ref: https://github.com/curl/curl/pull/1030 Ref: https://github.com/curl/curl/pull/1346 Closes https://github.com/curl/curl/pull/1866
* openssl: use OpenSSL's default ciphers by defaultKamil Dudka2017-09-051-4/+14
| | | | | | | | Up2date versions of OpenSSL maintain the default reasonably secure without breaking compatibility, so it is better not to override the default by curl. Suggested at https://bugzilla.redhat.com/1483972 Closes #1846
* schannel: return CURLE_SSL_CACERT on failed verificationDaniel Stenberg2017-09-041-1/+1
| | | | | | | ... not *CACERT_BADFILE as it isn't really because of a bad file. Bug: https://curl.haxx.se/mail/lib-2017-09/0002.html Closes #1858
* curl_global_sslset: select backend by name case insensitivelyDaniel Stenberg2017-09-011-1/+1
| | | | Closes #1849
* darwinssl: handle long strings in TLS certs (follow-up)Jay Satiro2017-08-311-2/+17
| | | | | | | | | | | | | - Fix handling certificate subjects that are already UTF-8 encoded. Follow-up to b3b75d1 from two days ago. Since then a copy would be skipped if the subject was already UTF-8, possibly resulting in a NULL deref later on. Ref: https://github.com/curl/curl/issues/1823 Ref: https://github.com/curl/curl/pull/1831 Closes https://github.com/curl/curl/pull/1836
* cyassl: call it the "WolfSSL" backendDaniel Stenberg2017-08-311-1/+1
| | | | | | ... instead of cyassl, as this is the current name for it. Closes #1844
* polarssl: fix multissl breakageDaniel Stenberg2017-08-311-5/+2
| | | | | | Reported-by: Dan Fandrich Bug: https://curl.haxx.se/mail/lib-2017-08/0121.html Closes #1843
* configure: allow setting the default SSL backendJohannes Schindelin2017-08-281-0/+4
| | | | | | | | | | | | | Previously, we used as default SSL backend whatever was first in the `available_backends` array. However, some users may want to override that default without patching the source code. Now they can: with the --with-default-ssl-backend=<backend> option of the ./configure script. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: use Curl_ssl_multi pseudo backend only when neededJohannes Schindelin2017-08-281-1/+26
| | | | | | | | When only one SSL backend is configured, it is totally unnecessary to let multissl_init() configure the backend at runtime, we can select the correct backend at build time already. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* version: if built with more than one SSL backend, report all of themJohannes Schindelin2017-08-281-7/+44
| | | | | | | To discern the active one from the inactive ones, put the latter into parentheses. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: introduce curl_global_sslset()Johannes Schindelin2017-08-281-9/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let's add a compile time safe API to select an SSL backend. This function needs to be called *before* curl_global_init(), and can be called only once. Side note: we do not explicitly test that it is called before curl_global_init(), but we do verify that it is not called multiple times (even implicitly). If SSL is used before the function was called, it will use whatever the CURL_SSL_BACKEND environment variable says (or default to the first available SSL backend), and if a subsequent call to curl_global_sslset() disagrees with the previous choice, it will fail with CURLSSLSET_TOO_LATE. The function also accepts an "avail" parameter to point to a (read-only) NULL-terminated list of available backends. This comes in real handy if an application wants to let the user choose between whatever SSL backends the currently available libcurl has to offer: simply call curl_global_sslset(-1, NULL, &avail); which will return CURLSSLSET_UNKNOWN_BACKEND and populate the avail variable to point to the relevant information to present to the user. Just like with the HTTP/2 push functions, we have to add the function declaration of curl_global_sslset() function to the header file *multi.h* because VMS and OS/400 require a stable order of functions declared in include/curl/*.h (where the header files are sorted alphabetically). This looks a bit funny, but it cannot be helped. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: refactor out essential information about the SSL backendsJohannes Schindelin2017-08-2812-26/+18
| | | | | | | | | | | | | | | There is information about the compiled-in SSL backends that is really no concern of any code other than the SSL backend itself, such as which function (if any) implements SHA-256 summing. And there is information that is really interesting to the user, such as the name, or the curl_sslbackend value. Let's factor out the latter into a publicly visible struct. This information will be used in the upcoming API to set the SSL backend globally. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: allow selecting which SSL backend to use at runtimeJohannes Schindelin2017-08-2811-18/+143
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When building software for the masses, it is sometimes not possible to decide for all users which SSL backend is appropriate. Git for Windows, for example, uses cURL to perform clones, fetches and pushes via HTTPS, and some users strongly prefer OpenSSL, while other users really need to use Secure Channel because it offers enterprise-ready tools to manage credentials via Windows' Credential Store. The current Git for Windows versions use the ugly work-around of building libcurl once with OpenSSL support and once with Secure Channel support, and switching out the binaries in the installer depending on the user's choice. Needless to say, this is a super ugly workaround that actually only works in some cases: Git for Windows also comes in a portable form, and in a form intended for third-party applications requiring Git functionality, in which cases this "swap out libcurl-4.dll" simply is not an option. Therefore, the Git for Windows project has a vested interest in teaching cURL to make the SSL backend a *runtime* option. This patch makes that possible. By running ./configure with multiple --with-<backend> options, cURL will be built with multiple backends. For the moment, the backend can be configured using the environment variable CURL_SSL_BACKEND (valid values are e.g. "openssl" and "schannel"). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: fold the backend ID into the Curl_ssl structureJohannes Schindelin2017-08-2822-33/+17
| | | | Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: encapsulate SSL backend-specific dataJohannes Schindelin2017-08-2811-21/+153
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | So far, all of the SSL backends' private data has been declared as part of the ssl_connect_data struct, in one big #if .. #elif .. #endif block. This can only work as long as the SSL backend is a compile-time option, something we want to change in the next commits. Therefore, let's encapsulate the exact data needed by each SSL backend into a private struct, and let's avoid bleeding any SSL backend-specific information into urldata.h. This is also necessary to allow multiple SSL backends to be compiled in at the same time, as e.g. OpenSSL's and CyaSSL's headers cannot be included in the same .c file. To avoid too many malloc() calls, we simply append the private structs to the connectdata struct in allocate_conn(). This requires us to take extra care of alignment issues: struct fields often need to be aligned on certain boundaries e.g. 32-bit values need to be stored at addresses that divide evenly by 4 (= 32 bit / 8 bit-per-byte). We do that by assuming that no SSL backend's private data contains any fields that need to be aligned on boundaries larger than `long long` (typically 64-bit) would need. Under this assumption, we simply add a dummy field of type `long long` to the `struct connectdata` struct. This field will never be accessed but acts as a placeholder for the four instances of ssl_backend_data instead. the size of each ssl_backend_data struct is stored in the SSL backend-specific metadata, to allow allocate_conn() to know how much extra space to allocate, and how to initialize the ssl[sockindex]->backend and proxy_ssl[sockindex]->backend pointers. This would appear to be a little complicated at first, but is really necessary to encapsulate the private data of each SSL backend correctly. And we need to encapsulate thusly if we ever want to allow selecting CyaSSL and OpenSSL at runtime, as their headers cannot be included within the same .c file (there are just too many conflicting definitions and declarations for that). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: prepare the SSL backends for encapsulated private dataJohannes Schindelin2017-08-2810-712/+762
| | | | | | | | | | | | At the moment, cURL's SSL backend needs to be configured at build time. As such, it is totally okay for them to hard-code their backend-specific data in the ssl_connect_data struct. In preparation for making the SSL backend a runtime option, let's make the access of said private data a bit more abstract so that it can be adjusted later in an easy manner. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* getinfo: access SSL internals via Curl_sslJohannes Schindelin2017-08-2811-0/+83
| | | | | | | | | | | In the ongoing endeavor to abstract out all SSL backend-specific functionality, this is the next step: Instead of hard-coding how the different SSL backends access their internal data in getinfo.c, let's implement backend-specific functions to do that task. This will also allow for switching SSL backends as a runtime option. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: move SSL backends' private constants out of their header filesJohannes Schindelin2017-08-284-51/+51
| | | | Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* axtls: use Curl_none_* versions of init() and cleanup()Johannes Schindelin2017-08-281-17/+7
| | | | | | | There are convenient no-op versions of the init/cleanup functions now, no need to define private ones for axTLS. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: remove obsolete declarations of SSL backend functionalityJohannes Schindelin2017-08-2821-380/+134
| | | | | | | | | | | | | | | | | | | These functions are all available via the Curl_ssl struct now, no need to declare them separately anymore. As the global declarations are removed, the corresponding function definitions are marked as file-local. The only two exceptions here are Curl_mbedtls_shutdown() and Curl_polarssl_shutdown(): only the declarations were removed, there are no function definitions to mark file-local. Please note that Curl_nss_force_init() is *still* declared globally, as the only SSL backend-specific function, because it was introduced specifically for the use case where cURL was compiled with `--without-ssl --with-nss`. For details, see f3b77e561 (http_ntlm: add support for NSS, 2010-06-27). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* schannel: reorder functions topologicallyJohannes Schindelin2017-08-281-12/+12
| | | | | | | | | | | | The _shutdown() function calls the _session_free() function; While this is not a problem now (because schannel.h declares both functions), a patch looming in the immediate future with make all of these functions file-local. So let's just move the _session_free() function's definition before it is called. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* axtls: reorder functions topologicallyJohannes Schindelin2017-08-281-16/+16
| | | | | | | | | | | | The connect_finish() function (like many other functions after it) calls the Curl_axtls_close() function; While this is not a problem now (because axtls.h declares the latter function), a patch looming in the immediate future with make all of these functions file-local. So let's just move the Curl_axtls_close() function's definition before it is called. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: move the SUPPORT_HTTPS_PROXY flag into the Curl_ssl structJohannes Schindelin2017-08-2816-16/+16
| | | | | | That will allow us to choose the SSL backend at runtime. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: convert the have_curlssl_* constants to runtime flagsJohannes Schindelin2017-08-2820-87/+93
| | | | | | | | | | The entire idea of introducing the Curl_ssl struct to describe SSL backends is to prepare for choosing the SSL backend at runtime. To that end, convert all the #ifdef have_curlssl_* style conditionals to use bit flags instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: move sha256sum into the Curl_ssl structJohannes Schindelin2017-08-2819-78/+69
| | | | | | | | | | | | The SHA-256 checksumming is also an SSL backend-specific function. Let's include it in the struct declaring the functionality of SSL backends. In contrast to MD5, there is no fall-back code. To indicate this, the respective entries are NULL for those backends that offer no support for SHA-256 checksumming. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: move md5sum into the Curl_ssl structJohannes Schindelin2017-08-2816-61/+62
| | | | | | | | | | The MD5 summing is also an SSL backend-specific function. So let's include it, offering the previous fall-back code as a separate function now: Curl_none_md5sum(). To allow for that, the signature had to be changed so that an error could be returned from the implementation (Curl_none_md5sum() can run out of memory). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: use the Curl_ssl struct to access all SSL backends' functionalityJohannes Schindelin2017-08-2822-209/+41
| | | | | | | | This is the first step to unify the SSL backend handling. Now all the SSL backend-specific functionality is accessed via a global instance of the Curl_ssl struct. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: declare Curl_ssl structs for every SSL backendJohannes Schindelin2017-08-2822-0/+346
| | | | | | | | The idea of introducing the Curl_ssl struct was to unify how the SSL backends are declared and called. To this end, we now provide an instance of the Curl_ssl struct for each and every SSL backend. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: introduce a new struct for SSL backendsJohannes Schindelin2017-08-281-0/+33
| | | | | | | | This new struct is similar in nature to Curl_handler: it will define the functions and capabilities of all the SSL backends (where Curl_handler defines the functions and capabilities of protocol handlers). Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: make sure every _sha256sum()'s first arg is constJohannes Schindelin2017-08-282-4/+3
| | | | | | | | This patch makes the signature of the _sha256sum() functions consistent among the SSL backends, in preparation for unifying the way all SSL backends are accessed. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: make sure all _data_pending() functions return boolJohannes Schindelin2017-08-284-4/+4
| | | | | | | | This patch makes the signature of the _data_pending() functions consistent among the SSL backends, in preparation for unifying the way all SSL backends are accessed. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: make sure all _cleanup() functions return voidJohannes Schindelin2017-08-284-6/+4
| | | | | | | | This patch makes the signature of the _cleanup() functions consistent among the SSL backends, in preparation for unifying the way all SSL backends are accessed. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* vtls: use consistent signature for _random() implementationsJohannes Schindelin2017-08-284-7/+9
| | | | | | This will make the upcoming multissl backend much easier to implement. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* darwinssl: handle long strings in TLS certsDaniel Stenberg2017-08-271-68/+73
| | | | | | | | | | | ... as the previous fixed length 128 bytes buffer was sometimes too small. Fixes #1823 Closes #1831 Reported-by: Benjamin Sergeant Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
* darwinssi: fix error: variable length array usedDaniel Stenberg2017-08-161-1/+1
|
* openssl: fix "error: this statement may fall through"Daniel Stenberg2017-08-111-0/+1
| | | | A gcc7 warning.
* openssl: remove CONST_ASN1_BIT_STRING.David Benjamin2017-08-111-3/+1
| | | | | | Just making the pointer as const works for the pre-1.1.0 path too. Closes #1759
* darwinssl: fix compiler warningMarcel Raad2017-08-051-1/+1
| | | | | | | | | | | clang complains: vtls/darwinssl.c:40:8: error: extra tokens at end of #endif directive [-Werror,-Wextra-tokens] This breaks the darwinssl build on Travis. Fix it by making this token a comment. Closes https://github.com/curl/curl/pull/1734
* darwin: silence compiler warningsDaniel Stenberg2017-08-041-2/+12
| | | | | | With a clang pragma and three type fixes Fixes #1722
* darwinssl: fix curlssl_sha256sum() compiler warnings on first argumentDaniel Stenberg2017-08-032-7/+8
|
* timeval: struct curltime is a struct timeval replacementDaniel Stenberg2017-07-281-6/+8
| | | | | | | | | ... to make all libcurl internals able to use the same data types for the struct members. The timeval struct differs subtly on several platforms so it makes it cumbersome to use everywhere. Ref: #1652 Closes #1693
* darwinssl: fix variable type mistake (regression)Daniel Stenberg2017-07-271-1/+2
| | | | | | | | ... which made --tlsv1.2 not work because it would blank the max tls version variable. Reported-by: Nick Miyake Bug: #1703
View Lorry Controller Status