summaryrefslogtreecommitdiff
path: root/lib/vtls
AgeCommit message (Collapse)Author
2021-01-13Merge tag 'curl-7_74_0'nikita
7.74.0
2020-12-07openssl: make the OCSP verification verify the certificate idDaniel Stenberg
CVE-2020-8286 Reported by anonymous Bug: https://curl.se/docs/CVE-2020-8286.html
2020-12-03openssl: use OPENSSL_init_ssl() with >= 1.1.0Daniel Stenberg
Reported-by: Kovalkov Dmitrii and Per Nilsson Fixes #6254 Fixes #6256 Closes #6260
2020-12-01openssl: free mem_buf in error pathDaniel Stenberg
To fix a memory-leak. Closes #6267
2020-11-30openssl: remove #if 0 leftoverDaniel Stenberg
Follow-up to 4c9768565ec3a9 (from Sep 2008) Closes #6268
2020-11-24infof/failf calls: fix format specifiersRikard Falkeborn
Update a few format specifiers to match what is being printed. Closes #6241
2020-11-19openssl: guard against OOM on context creationDaniel Gustafsson
EVP_MD_CTX_create will allocate memory for the context and returns NULL in case the allocation fails. Make sure to catch any allocation failures and exit early if so. In passing, also move to EVP_DigestInit rather than EVP_DigestInit_ex as the latter is intended for ENGINE selection which we don't do. Closes #6224 Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Emil Engler <me@emilengler.com>
2020-11-05copyright: fix year rangesDaniel Stenberg
Follow-up from 4d2f8006777
2020-11-04curl.se: new homeDaniel Stenberg
Closes #6172
2020-11-02gnutls: fix memory leaks (certfields memory wasn't released)Harry Sintonen
Closes #6153
2020-10-16openssl: acknowledge SRP disabling in configure properlyDaniel Stenberg
Follow-up to 68a513247409 Use a new separate define that is the combination of both HAVE_OPENSSL_SRP and USE_TLS_SRP: USE_OPENSSL_SRP Bug: https://curl.haxx.se/mail/lib-2020-10/0037.html Closes #6094
2020-10-15checksrc: warn on empty line before open braceDaniel Stenberg
... and fix a few occurances Closes #6088
2020-10-12windows: fix comparison of mismatched types warningViktor Szakats
clang 10, mingw-w64: ``` vtls/openssl.c:2917:33: warning: comparison of integers of different signs: 'DWORD' (aka 'unsigned long') and 'HRESULT' (aka 'long') [-Wsign-compare] if(GetLastError() != CRYPT_E_NOT_FOUND) ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~ ``` Approved-by: Daniel Stenberg Closes #6062
2020-10-07mbedtls: add missing header when defining MBEDTLS_DEBUGFrederik Wedel-Heinen
Closes #6045
2020-10-01vtls: deduplicate some DISABLE_PROXY ifdefsKamil Dudka
... in the code of gtls, nss, and openssl Closes #5735
2020-09-30sectransp: make it build with --disable-proxyDaniel Stenberg
Follow-up from #5466 and f3d501dc678d80 Reported-by: Javier Navarro Fixes #6025 Closes #6026
2020-09-28schannel: return CURLE_PEER_FAILED_VERIFICATION for untrusted rootDaniel Stenberg
This matches what is returned in other TLS backends in the same situation. Reviewed-by: Jay Satiro Reviewed-by: Emil Engler Follow-up to 5a3efb1 Reported-by: iammrtau on github Fixes #6003 Closes #6018
2020-09-14Merge tag 'curl-7_72_0' into masternikita
curl 7.72.0
2020-09-14Merge tag 'curl-7_71_1'nikita
curl 7.71.1
2020-09-14vtls: deduplicate client certificates in ssl_config_dataGergely Nagy
Closes #5629
2020-09-08lib: fix -Wassign-enum warningsDaniel Stenberg
configure --enable-debug now enables -Wassign-enum with clang, identifying several enum "abuses" also fixed. Reported-by: Gisle Vanem Bug: https://github.com/curl/curl/commit/879007f8118771f4896334731aaca5850a154675#commitcomment-42087553 Closes #5929
2020-09-07openssl: consider ALERT_CERTIFICATE_EXPIRED a failed verificationDaniel Stenberg
If the error reason from the lib is SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED, libcurl will return CURLE_PEER_FAILED_VERIFICATION and not CURLE_SSL_CONNECT_ERROR. This unifies the libcurl return code and makes libressl run test 313 (CRL testing) fine. Closes #5934
2020-09-02openssl: avoid error conditions when importing native CADaniel Stenberg
The code section that is OpenSSL 3+ specific now uses the same logic as is used in the version < 3 section. It caused a compiler error without it. Closes #5907
2020-09-02vtls: make it 'struct Curl_ssl_session'Daniel Stenberg
Use uppercase C for internal symbols. Closes #5906
2020-09-02schannel: make it 'struct Curl_schannel*'Daniel Stenberg
As internal global names should use captical C. Closes #5906
2020-09-02llist: make it "struct Curl_llist"Daniel Stenberg
As internal global names should use captical C. Closes #5906
2020-08-30tls: add CURLOPT_SSL_EC_CURVES and --curvesMichael Baentsch
Closes #5892
2020-08-28TLS: fix SRP detection by using the proper #ifdefsDaniel Stenberg
USE_TLS_SRP will be true if *any* selected TLS backend can use SRP HAVE_OPENSSL_SRP is defined when OpenSSL can use it HAVE_GNUTLS_SRP is defined when GnuTLS can use it Clarify in the curl_verison_info docs that CURL_VERSION_TLSAUTH_SRP is set if at least one of the supported backends offers SRP. Reported-by: Stefan Strogin Fixes #5865 Closes #5870
2020-08-26openssl: Fix wincrypt symbols conflict with BoringSSLJay Satiro
OpenSSL undefines the conflicting symbols but BoringSSL does not so we must do it ourselves. Reported-by: Samuel Tranchet Assisted-by: Javier Blazquez Ref: https://bugs.chromium.org/p/boringssl/issues/detail?id=371 Ref: https://github.com/openssl/openssl/blob/OpenSSL_1_1_1g/include/openssl/ossl_typ.h#L66-L73 Fixes https://github.com/curl/curl/issues/5669 Closes https://github.com/curl/curl/pull/5857
2020-08-26schannel: fix memory leak when using get_cert_locationfullincome
The get_cert_location function allocates memory only on success. Previously get_cert_location was able to allocate memory and return error. It wasn't obvious and in this case the memory wasn't released. Fixes #5855 Closes #5860
2020-08-19tls: provide the CApath verbose log on its own lineDaniel Stenberg
... not newline separated from the previous line. This makes it output asterisk prefixed properly like other verbose putput! Reported-by: jmdavitt on github Fixes #5826 Closes #5827
2020-08-10ftp: don't do ssl_shutdown instead of ssl_closeDaniel Stenberg
The shutdown function is for downgrading a connection from TLS to plain, and this is not requested here. Have ssl_close reset the TLS connection state. This partially reverts commit f002c850d98d Reported-by: Rasmus Melchior Jacobsen Reported-by: Denis Goleshchikhin Fixes #5797
2020-08-05gtls: survive not being able to get name/issuerDaniel Stenberg
Closes #5778
2020-08-02win32: Add Curl_verify_windows_version() to curlxCameron Cawley
Closes https://github.com/curl/curl/pull/5754
2020-08-01openssl: fix build with LibreSSL < 2.9.1Marcel Raad
`SSL_CTX_add0_chain_cert` and `SSL_CTX_clear_chain_certs` were introduced in LibreSSL 2.9.1 [0]. [0] https://github.com/libressl-portable/openbsd/commit/0db809ee178457c8170abfae3931d7bd13abf3ef Closes https://github.com/curl/curl/pull/5757
2020-07-27WIN32: stop forcing narrow-character APIMarcel Raad
Except where the results are only used for character output. getenv is not touched because it's part of the public API, and having it return UTF-8 instead of ANSI would be a breaking change. Fixes https://github.com/curl/curl/issues/5658 Fixes https://github.com/curl/curl/issues/5712 Closes https://github.com/curl/curl/pull/5718
2020-07-14nss: fix build with disabled proxy supportBaruch Siach
Avoid reference to fields that do not exist when CURL_DISABLE_PROXY is defined. Closes #5667
2020-07-12bearssl: fix build with disabled proxy supportBaruch Siach
Avoid reference to fields that do not exist when CURL_DISABLE_PROXY is defined. Reviewed-by: Nicolas Sterchele Closes #5666
2020-07-04gnutls: repair the build with `CURL_DISABLE_PROXY`Alex Kiernan
`http_proxy`/`proxy_ssl`/`tunnel_proxy` will not be available in `conn` if `CURL_DISABLE_PROXY` is enabled. Repair the build with that configuration. Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Closes #5645
2020-07-03gnutls: Fetch backend when using proxyAlex Kiernan
Fixes: 89865c149 ("gnutls: remove the BACKEND define kludge") Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
2020-06-29vtls: compare cert blob when finding a connection to reuseDaniel Stenberg
Reported-by: Gergely Nagy Fixes #5617 Closes #5619
2020-06-28terminology: call them null-terminated stringsDaniel Stenberg
Updated terminology in docs, comments and phrases to refer to C strings as "null-terminated". Done to unify with how most other C oriented docs refer of them and what users in general seem to prefer (based on a single highly unscientific poll on twitter). Reported-by: coinhubs on github Fixes #5598 Closes #5608
2020-06-26mbedtls: fix build with disabled proxy supportBaruch Siach
Don't reference fields that do not exist. Fixes build failure: vtls/mbedtls.c: In function 'mbed_connect_step1': vtls/mbedtls.c:249:54: error: 'struct connectdata' has no member named 'http_proxy' Closes #5615
2020-06-25openssl: Fix compilation on Windows when ngtcp2 is enabledJavier Blazquez
- Include wincrypt before OpenSSL includes so that the latter can properly handle any conflicts between the two. Closes https://github.com/curl/curl/pull/5606
2020-06-22openssl: Don't ignore CA paths when using Windows CA storeJay Satiro
This commit changes the behavior of CURLSSLOPT_NATIVE_CA so that it does not override CURLOPT_CAINFO / CURLOPT_CAPATH, or the hardcoded default locations. Instead the CA store can now be used at the same time. The change is due to the impending release. The issue is still being discussed. The behavior of CURLSSLOPT_NATIVE_CA is subject to change and is now documented as experimental. Ref: bc052cc (parent commit) Ref: https://github.com/curl/curl/issues/5585
2020-06-22openssl: Fix CA fallback logic for OpenSSL 3.0 buildJay Satiro
Prior to this change I assume a build error would occur when CURL_CA_FALLBACK was used. Closes https://github.com/curl/curl/pull/5587
2020-06-16ntlm: enable NTLM support with wolfSSLRuurd Beerstra
When wolfSSL is built with its OpenSSL API layer, it fetures the same DES* functions that OpenSSL has. This change take advantage of that. Co-authored-by: Daniel Stenberg Closes #5556 Fixes #5548
2020-06-06openssl: set FLAG_TRUSTED_FIRST unconditionallyFrançois Rigault
On some systems, openssl 1.0.x is still the default, but it has been patched to contain all the recent security fixes. As a result of this patching, it is possible for macro X509_V_FLAG_NO_ALT_CHAINS to be defined, while the previous behavior of openssl to not look at trusted chains first, remains. Fix it: ensure X509_V_FLAG_TRUSTED_FIRST is always set, do not try to probe for the behavior of openssl based on the existence ofmacros. Closes #5530
2020-06-01vtls: repair the build with `CURL_DISABLE_PROXY`Saleem Abdulrasool
`http_proxy` will not be available in `conndata` if `CURL_DISABLE_PROXY` is enabled. Repair the build with that configuration. Follow-up to f3d501dc67 Closes #5498
2020-05-30build: disable more code/data when built without proxy supportDaniel Stenberg
Added build to travis to verify Closes #5466
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-02 19:42:09 +0000