#
3a35901a |
| 04-Nov-2024 |
Stefan Eissing |
wolfssl: coexist with openssl, further work Build wolfSSL master with ./configure --prefix=/path --enable-ip-alt-name --enable-quic --enable-earlydata --enable-psk --enable-open
wolfssl: coexist with openssl, further work Build wolfSSL master with ./configure --prefix=/path --enable-ip-alt-name --enable-quic --enable-earlydata --enable-psk --enable-opensslcoexist and configure curl with openssl + wolfssl. Normal tests run. pytest session resumption fails, as wolfssl does not handle the new_session callback without opensslextra right now. Closes #15481
show more ...
|
#
cb011ac0 |
| 28-Oct-2024 |
Daniel Stenberg |
tls: avoid abusing CURLE_SSL_ENGINE_INITFAILED That error code was introduced and has been used for OpenSSL ENGINE things and not others, so switch the other use cases over to other TLS
tls: avoid abusing CURLE_SSL_ENGINE_INITFAILED That error code was introduced and has been used for OpenSSL ENGINE things and not others, so switch the other use cases over to other TLS related error codes. Closes #15430
show more ...
|
#
a58584a8 |
| 03-Oct-2024 |
Gabriel Marin |
checksrc: add check for spaces around logical AND operators Closes #15144
|
#
962097b8 |
| 09-Oct-2024 |
Stefan Eissing |
TLS: TLSv1.3 earlydata support for curl Based on #14135, implement TLSv1.3 earlydata support for the curl command line, libcurl and its implementation in GnuTLS. If a known TLS
TLS: TLSv1.3 earlydata support for curl Based on #14135, implement TLSv1.3 earlydata support for the curl command line, libcurl and its implementation in GnuTLS. If a known TLS session announces early data support, and the feature is enabled *and* it is not a "connect-only" transfer, delay the TLS handshake until the first request is being sent. - Add --tls-earldata as new boolean command line option for curl. - Add CURLSSLOPT_EARLYDATA to libcurl to enable use of the feature. - Add CURLINFO_EARLYDATA_SENT_T to libcurl, reporting the amount of bytes sent and accepted/rejected by the server. Implementation details: - store the ALPN protocol selected at the SSL session. - When reusing the session and enabling earlydata, use exactly that ALPN protocol for negoptiation with the server. When the sessions ALPN does not match the connections ALPN, earlydata will not be enabled. - Check that the server selected the correct ALPN protocol for an earlydata connect. If the server does not confirm or reports something different, the connect fails. - HTTP/2: delay sending the initial SETTINGS frames during connect, if not connect-only. Verification: - add test_02_32 to verify earlydata GET with nghttpx. - add test_07_70 to verify earlydata PUT with nghttpx. - add support in 'hx-download', 'hx-upload' clients for the feature Assisted-by: ad-chaos on github Closes #15211
show more ...
|
#
bcec0840 |
| 02-Oct-2024 |
Daniel Stenberg |
lib: use bool/TRUE/FALSE properly booleans should use the type 'bool' and set the value to TRUE/FALSE non-booleans should not be 'bool' and should not set the value to TRUE/FALS
lib: use bool/TRUE/FALSE properly booleans should use the type 'bool' and set the value to TRUE/FALSE non-booleans should not be 'bool' and should not set the value to TRUE/FALSE Closes #15123
show more ...
|
#
fbf5d507 |
| 18-Sep-2024 |
Daniel Stenberg |
lib/src: white space edits to comply better with code style ... as checksrc now finds and complains about these. Closes #14921
|
#
5a263710 |
| 14-Sep-2024 |
Gabriel Marin |
lib, src, tests: added space around ternary expressions Closes #14912
|
#
89728451 |
| 12-Sep-2024 |
Daniel McCarney |
vtls/rustls: support strong CSRNG data Now that the curl rustls vtls backend is using rustls 0.14 we can address the weak random situation by using `rustls_default_crypto_provider_ra
vtls/rustls: support strong CSRNG data Now that the curl rustls vtls backend is using rustls 0.14 we can address the weak random situation by using `rustls_default_crypto_provider_random()` to provide a `Curl_ssl` `random` callback that fills the provided buffer with cryptographically secure random data. The mentions in `docs/` about weak RNG when using rustls are removed as they are no longer applicable. Closes #14889
show more ...
|
#
6d9b40d6 |
| 12-Sep-2024 |
Daniel McCarney |
vtls/rustls: simplify ciphersuite skipping Now that the rustls vtls backend is using rustls 0.14 we can take advantage of `rustls_supported_ciphersuite_protocol_version()` to skip TL
vtls/rustls: simplify ciphersuite skipping Now that the rustls vtls backend is using rustls 0.14 we can take advantage of `rustls_supported_ciphersuite_protocol_version()` to skip TLS 1.3 and TLS 1.2 ciphersuites as required without needing to interrogate the ciphersuite names as `rustls_str`s. Closes #14889
show more ...
|
#
f09adc3a |
| 12-Sep-2024 |
Daniel McCarney |
vtls/rustls: rustls-ffi 0.14.0 update * Documentation is updated to describe new required version, and to link to the upstream README about cryptography providers. * GitHub workflo
vtls/rustls: rustls-ffi 0.14.0 update * Documentation is updated to describe new required version, and to link to the upstream README about cryptography providers. * GitHub workflow is updated to fetch 0.14.0. * Breaking changes in`lib/vtls/rustls.c` are addressed: * The `rustls_client_config_builder_build()` function now uses an out parameter for the built config instead of returning it directly. This allows the building process to fail if the default crypto provider state isn't appropriate, or another error condition occurs. * Default ciphersuites are collected using renamed functions named to make it clear the ciphersuites are associated with the default crypto provider. * Customization of ciphersuites is now done via a `rustls_crypto_provider_builder` used to instantiate a `rustls_crypto_provider`. The customized provider can then can be used with `rustls_client_config_builder_new_custom` in place of providing ciphersuites directly. * `rustls_connection_get_negotiated_ciphersuite()` now returns the ciphersuite ID directly. Closes #14889
show more ...
|
#
65b8d894 |
| 06-Aug-2024 |
Daniel McCarney |
vtls/rustls: differentiate error messages It's easier to diagnose a problem when there is one place where the error message can be emitted. For that reason this commit updates two er
vtls/rustls: differentiate error messages It's easier to diagnose a problem when there is one place where the error message can be emitted. For that reason this commit updates two errors that were shared between other fallible operations to use unique messages. Closes #14889
show more ...
|
#
d38458d8 |
| 19-Jul-2024 |
Daniel McCarney |
vtls/rustls: simplify builder cleanup Don't build `config_builder` just to free the resulting config, free the builder directly. When `cr_init_backend` encounters an error condi
vtls/rustls: simplify builder cleanup Don't build `config_builder` just to free the resulting config, free the builder directly. When `cr_init_backend` encounters an error condition setting up the Rustls client configuration it must do something with the `config_builder` that was constructed earlier to avoid a memory leak. The previous implementation preferred to use a pattern of building the builder (thus consuming it) and then freeing the built config (to avoid a memory leak). However, the purpose/intent is clearer when we just free the builder directly instead of building it and freeing the result. Closes #14889
show more ...
|
#
0ca15307 |
| 09-Sep-2024 |
Jan Venekamp <1422460+jan2000@users.noreply.github.com> |
rustls: fixed minor logic bug in default cipher selection Follow-up to 1e03d4b Closes #14840
|
#
4ff04615 |
| 02-Sep-2024 |
Daniel Stenberg |
lib: use FMT_ as prefix instead of CURL_FORMAT_ For printf format defines used internally. Makes the code slighly easier to read. Closes #14764
|
#
d76b6485 |
| 31-Aug-2024 |
Daniel Stenberg |
rand: only provide weak random when needed builds without TLS and builds using rustls Closes #14749
|
#
c5cb8e7c |
| 19-Aug-2024 |
Viktor Szakats |
tidy-up: spelling quiche and Rustls Closes #14605
|
#
38fa458e |
| 19-Aug-2024 |
Jan Venekamp <1422460+jan2000@users.noreply.github.com> |
rustls: fix setting tls version The value CURL_SSLVERSION_TLSv1_0 was unsupported. Closes #14586
|
#
1e03d4bc |
| 13-Aug-2024 |
Jan Venekamp <1422460+jan2000@users.noreply.github.com> |
rustls: add support for setting TLS version and ciphers Add support for CURLOPT_SSLVERSION, CURLOPT_TLS13_CIPHERS and CURLOPT_SSL_CIPHER_LIST. Closes #14535
|
#
0a5ea09a |
| 29-Feb-2024 |
Max Faxälv |
spnego_gssapi: implement TLS channel bindings for openssl Channel Bindings are used to tie the session context to a specific TLS channel. This is to provide additional proof of valid ide
spnego_gssapi: implement TLS channel bindings for openssl Channel Bindings are used to tie the session context to a specific TLS channel. This is to provide additional proof of valid identity, mitigating authentication relay attacks. Major web servers have the ability to require (None/Accept/Require) GSSAPI channel binding, rendering Curl unable to connect to such websites unless support for channel bindings is implemented. IIS calls this feature Extended Protection (EPA), which is used in Enterprise environments using Kerberos for authentication. This change require krb5 >= 1.19, otherwise channel bindings won't be forwarded through SPNEGO. Co-Authored-By: Steffen Kieß <947515+steffen-kiess@users.noreply.github.com> Closes #13098
show more ...
|
#
911c3166 |
| 18-Jul-2024 |
Stefan Eissing |
lib: add eos flag to send methods Adds a `bool eos` flag to send methods to indicate that the data is the last chunk the invovled transfer wants to send to the server. This will
lib: add eos flag to send methods Adds a `bool eos` flag to send methods to indicate that the data is the last chunk the invovled transfer wants to send to the server. This will help protocol filters like HTTP/2 and 3 to forward the stream's EOF flag and also allow to EAGAIN such calls when buffers are not yet fully flushed. Closes #14220
show more ...
|
#
dd95a49d |
| 30-Jul-2024 |
Joe Birr-Pixton |
rustls: make all tests pass - supports IP addresses in certs since 0.21 - Remove workaround, and re-enable tests Closes #14317
|
#
25321de3 |
| 18-Jul-2024 |
Daniel Stenberg |
Revert "lib: send eos flag" This reverts commit be93299f10ef0b2bf7fe5c82140120073831867a.
|
#
be93299f |
| 18-Jul-2024 |
Stefan Eissing |
lib: send eos flag Adds a `bool eos` flag to send methods to indicate that the data is the last chunk the invovled transfer wants to send to the server. This will help protocol
lib: send eos flag Adds a `bool eos` flag to send methods to indicate that the data is the last chunk the invovled transfer wants to send to the server. This will help protocol filters like HTTP/2 and 3 to forward the stream's EOF flag and also allow to EAGAIN such calls when buffers are not yet fully flushed. Closes #14220
show more ...
|
#
c074ba64 |
| 01-Jul-2024 |
Daniel Stenberg |
code: language cleanup in comments Based on the standards and guidelines we use for our documentation. - expand contractions (they're => they are etc) - host name = > hostname
code: language cleanup in comments Based on the standards and guidelines we use for our documentation. - expand contractions (they're => they are etc) - host name = > hostname - file name => filename - user name = username - man page => manpage - run-time => runtime - set-up => setup - back-end => backend - a HTTP => an HTTP - Two spaces after a period => one space after period Closes #14073
show more ...
|
#
c9b95c0b |
| 19-Jun-2024 |
Stefan Eissing |
lib: graceful connection shutdown When libcurl discards a connection there are two phases this may go through: "shutdown" and "closing". If a connection is aborted, the shutdown phas
lib: graceful connection shutdown When libcurl discards a connection there are two phases this may go through: "shutdown" and "closing". If a connection is aborted, the shutdown phase is skipped and it is closed right away. The connection filters attached to the connection implement the phases in their `do_shutdown()` and `do_close()` callbacks. Filters carry now a `shutdown` flags next to `connected` to keep track of the shutdown operation. Filters are shut down from top to bottom. If a filter is not connected, its shutdown is skipped. Notable filters that *do* something during shutdown are HTTP/2 and TLS. HTTP/2 sends the GOAWAY frame. TLS sends its close notify and expects to receive a close notify from the server. As sends and receives may EAGAIN on the network, a shutdown is often not successful right away and needs to poll the connection's socket(s). To facilitate this, such connections are placed on a new shutdown list inside the connection cache. Since managing this list requires the cooperation of a multi handle, only the connection cache belonging to a multi handle is used. If a connection was in another cache when being discarded, it is removed there and added to the multi's cache. If no multi handle is available at that time, the connection is shutdown and closed in a one-time, best-effort attempt. When a multi handle is destroyed, all connection still on the shutdown list are discarded with a final shutdown attempt and close. In curl debug builds, the environment variable `CURL_GRACEFUL_SHUTDOWN` can be set to make this graceful with a timeout in milliseconds given by the variable. The shutdown list is limited to the max number of connections configured for a multi cache. Set via CURLMOPT_MAX_TOTAL_CONNECTIONS. When the limit is reached, the oldest connection on the shutdown list is discarded. - In multi_wait() and multi_waitfds(), collect all connection caches involved (each transfer might carry its own) into a temporary list. Let each connection cache on the list contribute sockets and POLLIN/OUT events it's connections are waiting for. - in multi_perform() collect the connection caches the same way and let them peform their maintenance. This will make another non-blocking attempt to shutdown all connections on its shutdown list. - for event based multis (multi->socket_cb set), add the sockets and their poll events via the callback. When `multi_socket()` is invoked for a socket not known by an active transfer, forward this to the multi's cache for processing. On closing a connection, remove its socket(s) via the callback. TLS connection filters MUST NOT send close nofity messages in their `do_close()` implementation. The reason is that a TLS close notify signals a success. When a connection is aborted and skips its shutdown phase, the server needs to see a missing close notify to detect something has gone wrong. A graceful shutdown of FTP's data connection is performed implicitly before regarding the upload/download as complete and continuing on the control connection. For FTP without TLS, there is just the socket close happening. But with TLS, the sent/received close notify signals that the transfer is complete and healthy. Servers like `vsftpd` verify that and reject uploads without a TLS close notify. - added test_19_* for shutdown related tests - test_19_01 and test_19_02 test for TCP RST packets which happen without a graceful shutdown and should no longer appear otherwise. - add test_19_03 for handling shutdowns by the server - add test_19_04 for handling shutdowns by curl - add test_19_05 for event based shutdowny by server - add test_30_06/07 and test_31_06/07 for shutdown checks on FTP up- and downloads. Closes #13976
show more ...
|