generic-library/curl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

vtls/openssl: use https in URLs and a comment typo fixed

Browse Source
This commit is contained in:
Viktor Szakáts 2014-12-29 04:15:36 +01:00 committed by Daniel Stenberg
parent 63c64e05a4
commit 3a87bdebd1
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
lib/vtls/openssl.c
View File

@ -1797,7 +1797,7 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
The "-no_ticket" option was introduced in Openssl0.9.8j. It's a flag to The "-no_ticket" option was introduced in Openssl0.9.8j. It's a flag to
disable "rfc4507bis session ticket support". rfc4507bis was later turned disable "rfc4507bis session ticket support". rfc4507bis was later turned
into the proper RFC5077 it seems: http://tools.ietf.org/html/rfc5077 into the proper RFC5077 it seems: https://tools.ietf.org/html/rfc5077
The enabled extension concerns the session management. I wonder how often The enabled extension concerns the session management. I wonder how often
libcurl stops a connection and then resumes a TLS session. also, sending libcurl stops a connection and then resumes a TLS session. also, sending
@ -1817,7 +1817,7 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
this option regardless of OpenSSL version and SSL_OP_ALL definition. this option regardless of OpenSSL version and SSL_OP_ALL definition.
OpenSSL added a work-around for a SSL 3.0/TLS 1.0 CBC vulnerability OpenSSL added a work-around for a SSL 3.0/TLS 1.0 CBC vulnerability
(http://www.openssl.org/~bodo/tls-cbc.txt). In 0.9.6e they added a bit to (https://www.openssl.org/~bodo/tls-cbc.txt). In 0.9.6e they added a bit to
SSL_OP_ALL that _disables_ that work-around despite the fact that SSL_OP_ALL that _disables_ that work-around despite the fact that
SSL_OP_ALL is documented to do "rather harmless" workarounds. In order to SSL_OP_ALL is documented to do "rather harmless" workarounds. In order to
keep the secure work-around, the SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS bit keep the secure work-around, the SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS bit
@ -2597,23 +2597,23 @@ static CURLcode pkp_pin_peer_pubkey(X509* cert, const char *pinnedpubkey)
/* Begin Gyrations to get the subjectPublicKeyInfo */ /* Begin Gyrations to get the subjectPublicKeyInfo */
/* Thanks to Viktor Dukhovni on the OpenSSL mailing list */ /* Thanks to Viktor Dukhovni on the OpenSSL mailing list */
/* http://groups.google.com/group/mailing.openssl.users/browse_thread /* https://groups.google.com/group/mailing.openssl.users/browse_thread
/thread/d61858dae102c6c7 */ /thread/d61858dae102c6c7 */
len1 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), NULL); len1 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), NULL);
if(len1 < 1) if(len1 < 1)
break; /* failed */ break; /* failed */
/* http://www.openssl.org/docs/crypto/buffer.html */ /* https://www.openssl.org/docs/crypto/buffer.html */
buff1 = temp = OPENSSL_malloc(len1); buff1 = temp = OPENSSL_malloc(len1);
if(!buff1) if(!buff1)
break; /* failed */ break; /* failed */
/* http://www.openssl.org/docs/crypto/d2i_X509.html */ /* https://www.openssl.org/docs/crypto/d2i_X509.html */
len2 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), &temp); len2 = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), &temp);
/* /*
* These checks are verifying we got back the same values as when we * These checks are verifying we got back the same values as when we
* sized the buffer.Its pretty weak since they should always be the * sized the buffer. It's pretty weak since they should always be the
* same. But it gives us something to test. * same. But it gives us something to test.
*/ */
if((len1 != len2) || !temp || ((temp - buff1) != len1)) if((len1 != len2) || !temp || ((temp - buff1) != len1))
@ -2625,7 +2625,7 @@ static CURLcode pkp_pin_peer_pubkey(X509* cert, const char *pinnedpubkey)
result = Curl_pin_peer_pubkey(pinnedpubkey, buff1, len1); result = Curl_pin_peer_pubkey(pinnedpubkey, buff1, len1);
} while(0); } while(0);
/* http://www.openssl.org/docs/crypto/buffer.html */ /* https://www.openssl.org/docs/crypto/buffer.html */
if(buff1) if(buff1)
OPENSSL_free(buff1); OPENSSL_free(buff1);
@ -3096,7 +3096,7 @@ static ssize_t ossl_recv(struct connectdata *conn, /* connection data */
default: default:
/* openssl/ssl.h for SSL_ERROR_SYSCALL says "look at error stack/return /* openssl/ssl.h for SSL_ERROR_SYSCALL says "look at error stack/return
value/errno" */ value/errno" */
/* http://www.openssl.org/docs/crypto/ERR_get_error.html */ /* https://www.openssl.org/docs/crypto/ERR_get_error.html */
sslerror = ERR_get_error(); sslerror = ERR_get_error();
if((nread < 0) || sslerror) { if((nread < 0) || sslerror) {
/* If the return code was negative or there actually is an error in the /* If the return code was negative or there actually is an error in the