12 Commits

Author	SHA1	Message	Date
Jay Satiro	ec783dc142	SSL: Remove SSLv3 from SSL default due to POODLE attack ... - Remove SSLv3 from SSL default in darwinssl, schannel, cyassl, nss, openssl effectively making the default TLS 1.x. axTLS is not affected since it supports only TLS, and gnutls is not affected since it already defaults to TLS 1.x. - Update CURLOPT_SSLVERSION doc	2014-10-24 13:41:56 +02:00
Marc Hoersken	330346d51c	curl_schannel.c: Fixed possible memory or handle leak ... First try to fix possible memory leaks, in this case: Only connssl->ctxt xor onnssl->cred being initialized.	2014-10-04 18:24:23 +02:00
Marcel Raad	f8f2188888	schannel: use CryptGenRandom for random numbers ... This function is available for every Windows version since Windows 95/NT. reference: http://msdn.microsoft.com/en-us/library/windows/desktop/aa379942.aspx	2014-07-31 13:10:54 +02:00
Daniel Stenberg	a18a2ba0bb	schannel: don't use the connect-timeout during send ... As there's a default connection timeout and this wrongly used the connection timeout during a transfer after the connection is completed, this function would trigger timeouts during transfers erroneously. Bug: http://curl.haxx.se/bug/view.cgi?id=1352 Figured-out-by: Radu Simionescu	2014-05-05 00:10:37 +02:00
Marc Hoersken	6f72c2fe31	curl_schannel.c: added explicit cast of structure pointers	2014-04-18 22:38:42 +02:00
Marc Hoersken	a703914e60	curl_schannel.c: fix possible dereference of null pointer	2014-04-18 22:36:12 +02:00
Marc Hoersken	e904b15f21	curl_schannel.c: Updated copyright years	2014-02-24 22:12:55 +01:00
David Ryskalczyk	63fc8ee7be	winssl: Enable hostname verification of IP address using SAN or CN ... Original commit message was: Don't omit CN verification in SChannel when an IP address is used. Side-effect of this change: SChannel and CryptoAPI do not support the iPAddress subjectAltName according to RFC 2818. If present, SChannel will first compare the IP address to the dNSName subjectAltNames and then fallback to the most specific Common Name in the Subject field of the certificate. This means that after this change curl will not connect to SSL/TLS hosts as long as the IP address is not specified in the SAN or CN of the server certificate or the verifyhost option is disabled.	2014-02-24 22:12:55 +01:00
Marc Hoersken	82f558366f	winssl: improved default SSL/TLS protocol selection ... For some reason Windows 7 SP1 chooses TLS 1.0 instead of TLS 1.2 if it is not explicitly enabled within grbitEnabledProtocols. More information can be found on MSDN: http://msdn.microsoft.com/library/windows/desktop/aa379810.aspx	2014-01-31 20:01:25 +01:00
Steve Holme	f88f9bed00	vtls: Updated comments referencing sslgen.c and ssluse.c	2013-12-26 21:42:22 +00:00
Steve Holme	9aa6e4357a	vtls: Fixed up include of vtls.h	2013-12-26 21:25:51 +00:00
Daniel Stenberg	a47c142a88	vtls: moved all TLS/SSL source and header files into subdir	2013-12-20 17:12:42 +01:00