Also add options for specifying a certificate and key, which can
be used both when operating as client and as server.
Partially based on a patch by Peter Ross.
Signed-off-by: Martin Storsjö <martin@martin.st>
A file containing the trusted CA certificates needs to be
supplied via the ca_file AVOption, unless the TLS library
has got a system default file/database set up.
This doesn't check the hostname of the peer certificate with
openssl, which requires a non-trivial piece of code for
manually matching the desired hostname to the string provided
by the certificate, not provided as a library function.
That is, with openssl, this only validates that the received
certificate is signed with the right CA, but not that it is
the actual server we think we're talking to.
Verification is still disabled by default since we can't count
on a proper CA database existing at all times.
Signed-off-by: Martin Storsjö <martin@martin.st>
The handling of the environment variable no_proxy, present since
one of the initial commits (de6d9b6404), is inconsistent with
how many other applications and libraries interpret this
variable. Its bare presence does not indicate that the use of
proxies should be skipped, but it is some sort of pattern for
hosts that does not need using a proxy (e.g. for a local network).
As investigated by Rudolf Polzer, different libraries handle this
in different ways, some supporting IP address masks, some supporting
arbitrary globbing using *, some just checking that the pattern matches
the end of the hostname without regard for whether it actually is
the right domain or a domain that ends in the same string.
This simple logic should be pretty similar to the logic used by
lynx and curl.
Signed-off-by: Martin Storsjö <martin@martin.st>
OpenSSL returns 0 when the peer has closed the connection. GnuTLS
doesn't return that though, but returns
GNUTLS_E_UNEXPECTED_PACKET_LENGTH if the connection simply is closed
without a clean close notify packet.
Tested-by: Antti Seppälä <a.seppala@gmail.com>
Signed-off-by: Martin Storsjö <martin@martin.st>
This definition is in two files, since the definitions will move
to the private header at the next bump.
Signed-off-by: Martin Storsjö <martin@martin.st>
TLSv1 is compatible with SSLv3, so this doesn't change much
in terms of compatibility. By explicitly using TLSv1, OpenSSL
sends the server name indication (SNI) header, which we
already set using SSL_set_tlsext_host_name (earlier, this
didn't have any effect).
SNI allows servers to serve SSL content for different host
names with separate certificates on one single port (vhosts).
Signed-off-by: Martin Storsjö <martin@martin.st>
The return value ret isn't an error code that can be passed
to ERR_error_string().
This makes the error messages printed actually contain useful
information.
Signed-off-by: Martin Storsjö <martin@martin.st>
Note, this protocol doesn't yet check verify the server
certificate against a local database of trusted CA root
certificates.
Signed-off-by: Martin Storsjö <martin@martin.st>
Martin Storsjö
Michael Niedermayer
Diego Biurrun
Luca Barbato
Gabriel Dume
Matt Oliver
Thilo Borgmann
Peter Ross
Anton Khirnov