vtls: move SSL backends' private constants out of their header files

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

vtls: remove obsolete declarations of SSL backend functionality

These functions are all available via the Curl_ssl struct now, no need
to declare them separately anymore.

As the

vtls: remove obsolete declarations of SSL backend functionality

These functions are all available via the Curl_ssl struct now, no need
to declare them separately anymore.

As the global declarations are removed, the corresponding function
definitions are marked as file-local. The only two exceptions here are
Curl_mbedtls_shutdown() and Curl_polarssl_shutdown(): only the
declarations were removed, there are no function definitions to mark
file-local.

Please note that Curl_nss_force_init() is *still* declared globally, as
the only SSL backend-specific function, because it was introduced
specifically for the use case where cURL was compiled with
`--without-ssl --with-nss`. For details, see f3b77e561 (http_ntlm: add
support for NSS, 2010-06-27).

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

show more ...

vtls: convert the have_curlssl_* constants to runtime flags

The entire idea of introducing the Curl_ssl struct to describe SSL
backends is to prepare for choosing the SSL backend at runt

vtls: convert the have_curlssl_* constants to runtime flags

The entire idea of introducing the Curl_ssl struct to describe SSL
backends is to prepare for choosing the SSL backend at runtime.

To that end, convert all the #ifdef have_curlssl_* style conditionals
to use bit flags instead.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

show more ...

vtls: use the Curl_ssl struct to access all SSL backends' functionality

This is the first step to unify the SSL backend handling. Now all the
SSL backend-specific functionality is access

vtls: use the Curl_ssl struct to access all SSL backends' functionality

This is the first step to unify the SSL backend handling. Now all the
SSL backend-specific functionality is accessed via a global instance of
the Curl_ssl struct.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

show more ...

vtls: declare Curl_ssl structs for every SSL backend

The idea of introducing the Curl_ssl struct was to unify how the SSL
backends are declared and called. To this end, we now provide an

vtls: declare Curl_ssl structs for every SSL backend

The idea of introducing the Curl_ssl struct was to unify how the SSL
backends are declared and called. To this end, we now provide an
instance of the Curl_ssl struct for each and every SSL backend.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

show more ...

vtls: use consistent signature for _random() implementations

This will make the upcoming multissl backend much easier to implement.

Signed-off-by: Johannes Schindelin <johannes.schi

vtls: use consistent signature for _random() implementations

This will make the upcoming multissl backend much easier to implement.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

show more ...

rand: make it work without TLS backing

Regression introduced in commit f682156a4fc6c4

Reported-by: John Kohl
Bug: https://curl.haxx.se/mail/lib-2017-01/0055.html

schannel: add CURLOPT_CERTINFO support

Closes #822

URLs: change all http:// URLs to https://

schannel: schannel_recv overhaul

This commit is several drafts squashed together. The changes from each
draft are noted below. If any changes are similar and possibly
contradictory t

schannel: schannel_recv overhaul

This commit is several drafts squashed together. The changes from each
draft are noted below. If any changes are similar and possibly
contradictory the change in the latest draft takes precedence.

Bug: https://github.com/bagder/curl/issues/244
Reported-by: Chris Araman

%%
%% Draft 1
%%
- return 0 if len == 0. that will have to be documented.
- continue on and process the caches regardless of raw recv
- if decrypted data will be returned then set the error code to CURLE_OK
and return its count
- if decrypted data will not be returned and the connection has closed
(eg nread == 0) then return 0 and CURLE_OK
- if decrypted data will not be returned and the connection *hasn't*
closed then set the error code to CURLE_AGAIN --only if an error code
isn't already set-- and return -1
- narrow the Win2k workaround to only Win2k

%%
%% Draft 2
%%
- Trying out a change in flow to handle corner cases.

%%
%% Draft 3
%%
- Back out the lazier decryption change made in draft2.

%%
%% Draft 4
%%
- Some formatting and branching changes
- Decrypt all encrypted cached data when len == 0
- Save connection closed state
- Change special Win2k check to use connection closed state

%%
%% Draft 5
%%
- Default to CURLE_AGAIN in cleanup if an error code wasn't set and the
connection isn't closed.

%%
%% Draft 6
%%
- Save the last error only if it is an unrecoverable error.

Prior to this I saved the last error state in all cases; unfortunately
the logic to cover that in all cases would lead to some muddle and I'm
concerned that could then lead to a bug in the future so I've replaced
it by only recording an unrecoverable error and that state will persist.

- Do not recurse on renegotiation.

Instead we'll continue on to process any trailing encrypted data
received during the renegotiation only.

- Move the err checks in cleanup after the check for decrypted data.

In either case decrypted data is always returned but I think it's easier
to understand when those err checks come after the decrypted data check.

%%
%% Draft 7
%%
- Regardless of len value go directly to cleanup if there is an
unrecoverable error or a close_notify was already received. Prior to
this change we only acknowledged those two states if len != 0.

- Fix a bug in connection closed behavior: Set the error state in the
cleanup, because we don't know for sure it's an error until that time.

- (Related to above) In the case the connection is closed go "greedy"
with the decryption to make sure all remaining encrypted data has been
decrypted even if it is not needed at that time by the caller. This is
necessary because we can only tell if the connection closed gracefully
(close_notify) once all encrypted data has been decrypted.

- Do not renegotiate when an unrecoverable error is pending.

%%
%% Draft 8
%%
- Don't show 'server closed the connection' info message twice.

- Show an info message if server closed abruptly (missing close_notify).

show more ...

schannel: Removed curl_ prefix from source files

Removed the curl_ prefix from the schannel source files as discussed
with Marc and Daniel at FOSDEM.