generic-library/curl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
18,734 Commits 5 Branches 157 Tags 40 MiB
884df3a51f
Commit Graph

16 Commits

Author SHA1 Message Date
Nick Zitzmann
bd87aec5a7 darwinssl: detect possible future removal of SSLv3 from the framework 
If Apple ever drops SSLv3 support from the Security framework, we'll fail with an error if the user insists on using SSLv3.
 2014-10-24 18:59:13 -05:00
Jay Satiro
ec783dc142 SSL: Remove SSLv3 from SSL default due to POODLE attack 
- Remove SSLv3 from SSL default in darwinssl, schannel, cyassl, nss,
openssl effectively making the default TLS 1.x. axTLS is not affected
since it supports only TLS, and gnutls is not affected since it already
defaults to TLS 1.x.

- Update CURLOPT_SSLVERSION doc
 2014-10-24 13:41:56 +02:00
Vilmos Nebehaj
fd1ce3856a darwinssl: Use CopyCertSubject() to check CA cert. 
SecCertificateCopyPublicKey() is not available on iPhone. Use
CopyCertSubject() instead to see if the certificate returned by
SecCertificateCreateWithData() is valid.

Reported-by: Toby Peterson
 2014-09-04 19:00:02 -05:00
Vilmos Nebehaj
0426670f0a Check CA certificate in curl_darwinssl.c. 
SecCertificateCreateWithData() returns a non-NULL SecCertificateRef even
if the buffer holds an invalid or corrupt certificate. Call
SecCertificateCopyPublicKey() to make sure cacert is a valid
certificate.
 2014-09-01 00:34:37 +02:00
Vilmos Nebehaj
4c134bcfce Fix CA certificate bundle handling in darwinssl. 
If the --cacert option is used with a CA certificate bundle that
contains multiple CA certificates, iterate through it, adding each
certificate as a trusted root CA.
 2014-08-30 20:10:07 +02:00
Toby Peterson
0e452a02f1 darwinssl: don't use strtok() 
The GetDarwinVersionNumber() function uses strtok, which is not
thread-safe.
 2014-08-05 08:58:49 +02:00
Daniel Stenberg
8dfd22089c vtls: make the random function mandatory in the TLS backend 
To force each backend implementation to really attempt to provide proper
random. If a proper random function is missing, then we can explicitly
make use of the default one we use when TLS support is missing.

This commit makes sure it works for darwinssl, gnutls, nss and openssl.
 2014-07-30 00:05:47 +02:00
Nick Zitzmann
32e9275edb darwinssl: fix lint & build warnings in the previous commit 2014-05-21 19:21:15 -05:00
Vilmos Nebehaj
cd2cedf002 Add support for --cacert in DarwinSSL. 
Security Framework on OS X makes it possible to supply extra anchor (CA)
certificates via the Certificate, Key, and Trust Services API. This
commit makes the '--cacert' option work using this API.

More information:

https://developer.apple.com/library/mac/documentation/security/Reference/certifkeytrustservices/Reference/reference.html

The HTTPS tests now pass on OS X except 314, which requires the '--crl'
option to work.
 2014-05-21 18:48:14 -05:00
Steve Holme
678239df54 darwinssl: Updated copyright following recent changes 2014-05-15 18:38:42 +01:00
Nick Zitzmann
69cdc95932 darwinssl: fix potential crash when attempting to copy an identity 
from a P12 file

This could've happened if SecPKCS12Import() returned noErr _and_ no
identity.
 2014-05-14 17:48:14 -05:00
David Ryskalczyk
afc6e5004f Don't omit CN verification in DarwinSSL when an IP address is used. 2014-02-23 12:37:27 -05:00
Nick Zitzmann
21aa79f463 darwinssl: un-break Leopard build after PKCS#12 change 
It turns out errSecDecode wasn't defined in Leopard's headers. So
we use the enum's value instead.

Bug: http://curl.haxx.se/mail/lib-2013-12/0150.html
Reported by: Abram Pousada
 2014-01-09 17:53:29 -06:00
Steve Holme
f88f9bed00 vtls: Updated comments referencing sslgen.c and ssluse.c 2013-12-26 21:42:22 +00:00
Steve Holme
9aa6e4357a vtls: Fixed up include of vtls.h 2013-12-26 21:25:51 +00:00
Daniel Stenberg
a47c142a88 vtls: moved all TLS/SSL source and header files into subdir 2013-12-20 17:12:42 +01:00