Johannes Schindelin 5450428491 schannel: add "best effort" revocation check option ... - Implement new option CURLSSLOPT_REVOKE_BEST_EFFORT and --ssl-revoke-best-effort to allow a "best effort" revocation check. A best effort revocation check ignores errors that the revocation check was unable to take place. The reasoning is described in detail below and discussed further in the PR. --- When running e.g. with Fiddler, the schannel backend fails with an unhelpful error message: Unknown error (0x80092012) - The revocation function was unable to check revocation for the certificate. Sadly, many enterprise users who are stuck behind MITM proxies suffer the very same problem. This has been discussed in plenty of issues: https://github.com/curl/curl/issues/3727, https://github.com/curl/curl/issues/264, for example. In the latter, a Microsoft Edge developer even made the case that the common behavior is to ignore issues when a certificate has no recorded distribution point for revocation lists, or when the server is offline. This is also known as "best effort" strategy and addresses the Fiddler issue. Unfortunately, this strategy was not chosen as the default for schannel (and is therefore a backend-specific behavior: OpenSSL seems to happily ignore the offline servers and missing distribution points). To maintain backward-compatibility, we therefore add a new flag (`CURLSSLOPT_REVOKE_BEST_EFFORT`) and a new option (`--ssl-revoke-best-effort`) to select the new behavior. Due to the many related issues Git for Windows and GitHub Desktop, the plan is to make this behavior the default in these software packages. The test 2070 was added to verify this behavior, adapted from 310. Based-on-work-by: georgeok <giorgos.n.oikonomou@gmail.com> Co-authored-by: Markus Olsson <j.markus.olsson@gmail.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Closes https://github.com/curl/curl/pull/4981		2020-03-18 03:23:39 -04:00
..
opts	schannel: add "best effort" revocation check option	2020-03-18 03:23:39 -04:00
.gitignore	gitignore: Ignore man page dist files	2017-03-07 23:27:31 +01:00
ABI	ABI doc: use secure URL	2015-07-30 15:02:44 +02:00
CMakeLists.txt	cmake: fix build with cmake 2.8.12.2	2017-03-30 23:43:35 +02:00
curl_easy_cleanup.3	docs: mention NULL is fine input to several functions	2018-08-10 00:24:12 +02:00
curl_easy_duphandle.3	curl_easy_duphandle.3: clarify that a duped handle has no shares	2019-03-01 21:47:30 +01:00
curl_easy_escape.3	docs: fix typo funtion -> function	2017-08-12 14:56:37 +02:00
curl_easy_getinfo.3	CURLINFO_RETRY_AFTER: parse the Retry-After header value	2019-08-07 14:45:39 +02:00
curl_easy_init.3	URLs: change all http:// URLs to https://	2016-02-03 00:19:02 +01:00
curl_easy_pause.3	curl_easy_pause.3: fix man page reference	2016-05-01 23:24:09 +02:00
curl_easy_perform.3	whitespace fixes	2018-09-23 22:24:02 +00:00
curl_easy_recv.3	curl_easy_recv: Improve documentation and example program	2016-12-18 12:56:23 +01:00
curl_easy_reset.3	altsvc: keep a copy of the file name to survive handle reset	2020-02-09 22:41:49 +01:00
curl_easy_send.3	curl_easy_recv: Improve documentation and example program	2016-12-18 12:56:23 +01:00
curl_easy_setopt.3	smtp: Allow RCPT TO command to fail for some recipients	2020-01-21 10:40:19 +01:00
curl_easy_strerror.3	URLs: change all http:// URLs to https://	2016-02-03 00:19:02 +01:00
curl_easy_unescape.3	unescape: avoid integer overflow	2016-10-31 08:46:35 +01:00
curl_easy_upkeep.3	curl_easy_upkeep: removed 'conn' from the name	2018-09-07 13:43:26 +02:00
curl_escape.3	curl_escape.3: Add a link to curl_free	2020-03-02 18:16:24 -05:00
curl_formadd.3	documentation: curl_formadd field and file names are now escaped	2018-12-11 15:31:23 +01:00
curl_formfree.3	docs: mention NULL is fine input to several functions	2018-08-10 00:24:12 +02:00
curl_formget.3	mime: new MIME API.	2017-09-02 17:47:10 +01:00
curl_free.3	docs: mention NULL is fine input to several functions	2018-08-10 00:24:12 +02:00
curl_getdate.3	parsedate: fix date parsing for systems with 32 bit long	2018-01-25 22:20:52 +01:00
curl_getenv.3	curl_getenv.3: Fix the memory handling description	2020-03-02 18:16:23 -05:00
curl_global_cleanup.3	curl_global_cleanup.3: don't unload the lib with sub threads running	2016-09-20 23:00:52 +02:00
curl_global_init_mem.3	curl_global_init_mem.3: mention it was added in 7.12.0	2019-08-11 00:19:45 +02:00
curl_global_init.3	global_init: assume the EINTR bit by default	2020-01-26 18:27:18 +01:00
curl_global_sslset.3	polarssl: remove more references and mentions	2020-03-05 07:57:45 +01:00
curl_mime_addpart.3	form/mime: field names are not allowed to contain zero-valued bytes.	2017-09-22 01:08:29 +01:00
curl_mime_data_cb.3	docs: fix typos	2018-04-17 15:32:51 -04:00
curl_mime_data.3	form/mime: field names are not allowed to contain zero-valued bytes.	2017-09-22 01:08:29 +01:00
curl_mime_encoder.3	mime: implement encoders.	2017-09-05 17:55:51 +01:00
curl_mime_filedata.3	docs: fix typos	2018-04-17 15:32:51 -04:00
curl_mime_filename.3	form/mime: field names are not allowed to contain zero-valued bytes.	2017-09-22 01:08:29 +01:00
curl_mime_free.3	docs: mention NULL is fine input to several functions	2018-08-10 00:24:12 +02:00
curl_mime_headers.3	form/mime: field names are not allowed to contain zero-valued bytes.	2017-09-22 01:08:29 +01:00
curl_mime_init.3	form/mime: field names are not allowed to contain zero-valued bytes.	2017-09-22 01:08:29 +01:00
curl_mime_name.3	form/mime: field names are not allowed to contain zero-valued bytes.	2017-09-22 01:08:29 +01:00
curl_mime_subparts.3	docs/curl_mime_*.3: added examples	2017-09-05 11:15:02 +02:00
curl_mime_type.3	docs: fix typos	2018-04-17 15:32:51 -04:00
curl_mprintf.3	curl/mprintf.h: remove support for _MPRINTF_REPLACE	2016-04-01 10:46:36 +02:00
curl_multi_add_handle.3	docs: fix missed option name markups	2018-06-30 18:33:07 +02:00
curl_multi_assign.3	URLs: change all http:// URLs to https://	2016-02-03 00:19:02 +01:00
curl_multi_cleanup.3	docs: mention NULL is fine input to several functions	2018-08-10 00:24:12 +02:00
curl_multi_fdset.3	curl_multi_fdset.3: emphasize curl_multi_timeout	2017-11-09 07:52:19 +01:00
curl_multi_info_read.3	URLs: change all http:// URLs to https://	2016-02-03 00:19:02 +01:00
curl_multi_init.3	whitespace fixes	2018-09-23 22:24:02 +00:00
curl_multi_perform.3	copyrights: update all copyright notices to 2019 on files changed this year	2019-11-02 23:15:56 +01:00
curl_multi_poll.3	multi: add curl_multi_wakeup()	2019-11-25 15:45:56 +01:00
curl_multi_remove_handle.3	curl_multi_remove_handle.3: use at any time, just not from within callbacks	2019-02-19 11:22:29 +01:00
curl_multi_setopt.3	CURLMOPT_MAX_CONCURRENT_STREAMS: new setopt	2019-10-02 07:47:48 +02:00
curl_multi_socket_action.3	CURLMOPT_SOCKETFUNCTION.3: clarified	2019-06-10 13:07:32 +02:00
curl_multi_socket_all.3	The inital early embryos to describe the curl_multi_socket() API. Committed	2005-12-22 15:11:11 +00:00
curl_multi_socket.3	docs: fix missed option name markups	2018-06-30 18:33:07 +02:00
curl_multi_strerror.3	URLs: change all http:// URLs to https://	2016-02-03 00:19:02 +01:00
curl_multi_timeout.3	whitespace fixes	2018-09-23 22:24:02 +00:00
curl_multi_wait.3	docs: add more references to curl_multi_poll	2019-11-28 22:29:18 +01:00
curl_multi_wakeup.3	curl_multi_wakeup.3: add example and AVAILABILITY	2019-11-26 08:11:32 +01:00
curl_share_cleanup.3	docs: mention NULL is fine input to several functions	2018-08-10 00:24:12 +02:00
curl_share_init.3	whitespace fixes	2018-09-23 22:24:02 +00:00
curl_share_setopt.3	curl_share_setopt.3: Note sharing cookies doesn't enable the engine	2020-03-06 02:57:17 -05:00
curl_share_strerror.3	URLs: change all http:// URLs to https://	2016-02-03 00:19:02 +01:00
curl_slist_append.3	docs: mention potential leak in curl_slist_append	2019-01-02 12:49:49 +01:00
curl_slist_free_all.3	whitespace fixes	2018-09-23 22:24:02 +00:00
curl_strequal.3	curl_strequal.3: fix typo in SYNOPSIS	2017-06-29 01:16:56 +02:00
curl_strnequal.3	prepend the man3 dir to the file name to work better.	2004-04-02 11:04:34 +00:00
curl_unescape.3	URLs: change all http:// URLs to https://	2016-02-03 00:19:02 +01:00
curl_url_cleanup.3	curl_url-docs: fix AVAILABILITY as Added in curl 7.62.0	2018-09-08 16:02:25 +02:00
curl_url_dup.3	curl_url-docs: fix AVAILABILITY as Added in curl 7.62.0	2018-09-08 16:02:25 +02:00
curl_url_get.3	docs: disambiguate CURLUPART_HOST is for host name (ie no port)	2019-09-28 18:13:33 +02:00
curl_url_set.3	docs: mention CURL_MAX_INPUT_LENGTH restrictions	2020-01-05 17:06:47 +01:00
curl_url.3	curl_url.3: this is not experimental anymore	2019-03-22 18:33:06 +01:00
curl_version_info.3	curl_version_info: make the quic_version a const	2019-08-13 23:15:49 +02:00
curl_version.3	URLs: change all http:// URLs to https://	2016-02-03 00:19:02 +01:00
getinfo-times	getinfo-times: Typo fixed	2014-08-29 16:41:17 +02:00
libcurl-easy.3	URLs: change all http:// URLs to https://	2016-02-03 00:19:02 +01:00
libcurl-env.3	docs: fix typos	2018-04-17 15:32:51 -04:00
libcurl-errors.3	multi: Improve parameter check for curl_multi_remove_handle	2020-03-18 02:58:42 -04:00
libcurl-multi.3	docs: add more references to curl_multi_poll	2019-11-28 22:29:18 +01:00
libcurl-security.3	docs: add warnings about FILE: URLs on Windows	2020-03-13 16:56:41 +01:00
libcurl-share.3	libcurl-share.3: the connection cache is shareable now	2017-11-27 09:42:39 +01:00
libcurl-thread.3	docs: Fix links to OpenSSL docs	2019-06-30 17:16:28 -04:00
libcurl-tutorial.3	copyrights: update all copyright notices to 2019 on files changed this year	2019-11-02 23:15:56 +01:00
libcurl-url.3	libcurl-url.3: overview man page for the URL API	2018-09-10 23:29:37 +02:00
libcurl.3	Add a man page for curl_global_sslset()	2017-08-28 14:56:59 +02:00
libcurl.m4	libcurl.m4: Avoid obsolete warning	2016-05-20 16:05:39 +02:00
Makefile.am	docs/libcurl/index.html: removed	2018-05-15 16:41:55 +02:00
Makefile.inc	multi: add curl_multi_wakeup()	2019-11-25 15:45:56 +01:00
mksymbolsmanpage.pl	scripts: allow all perl scripts to be run directly	2018-01-07 15:42:11 -05:00
symbols-in-versions	schannel: add "best effort" revocation check option	2020-03-18 03:23:39 -04:00
symbols.pl	scripts: allow all perl scripts to be run directly	2018-01-07 15:42:11 -05:00