summaryrefslogtreecommitdiff
path: root/src/lib/libtls/tls_client.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Provide a tls_connect_servername() function that has the same behaviourjsing2015-02-111-3/+12
| | | | | | | | | as tls_connect(), however allows the name to use for verification to be explicitly provided, rather than being inferred from the host value. Requested by reyk@ ok reyk@ tedu@
* Be consistent with naming - only use "host" and "hostname" when referringjsing2015-02-111-15/+15
| | | | | | | | | | to an actual host and use "servername" when referring to the name of the TLS server that we expect to be indentified in the server certificate. Likewise, rename verify_host to verify_name and use the term "name" throughout the verification code (rather than host or hostname). Requested by and ok tedu@
* When parsing the host in tls_connect(), first check if it is a numericreyk2015-02-091-29/+49
| | | | | | | | | IPv4 or IPv6 address before trying to resolve the address with the AI_ADDRCONFIG flag set. This makes sure that attempts to connect to numeric IPs or loopback addresses are always possible and not prevented by AI_ADDRCONFIG. OK jsing@ tedu@
* Use the AI_ADDRCONFIG flag in tls_connect(). This tells the resolverreyk2015-02-081-1/+2
| | | | | | | to ignore unsupported address families - eg. don't resolv IPv6 on IPv4-only hosts. OK jsing@
* Convert tls_connect_fds() and tls_accept_socket() to the new OpenSSL errorjsing2015-02-071-12/+6
| | | | | | | dance handling code. This means that we get slightly useful messages when a TLS connection or accept fails. Requested by reyk@
* Make the TLS connect and accept error messages consistent.bluhm2015-01-301-2/+2
| | | | OK jsing@
* Allow to to load the CA chain directly from memory instead ofreyk2015-01-221-2/+15
| | | | | | | | specifying a file. This enables CA verification in privsep'ed processes that are running chroot'ed without direct access to the certificate files. With feedback, tests, and OK from bluhm@
* For non-blocking sockets tls_connect_fds() could fail with EAGAIN.bluhm2015-01-131-5/+19
| | | | | | | | Use the same logic from the read, write, accept functions to inform the caller wether a readable or writable socket is needed. After that event, the connect function must be called again. All the checks before connecting are done only once. OK tedu@
* Rename the tls_connect_socket() parameter 'socket' to 's' to avoidbluhm2015-01-021-4/+4
| | | | | a compiler warning about shadowing a global declaration. OK jsing@
* include netinet/in.h to define struct in6_addr.bcook2014-12-271-1/+2
| | | | Noticed while testing libtls on FreeBSD.
* Allow specific libtls hostname validation errors to propagate.bcook2014-12-071-4/+5
| | | | | | | | Remove direct calls to printf from the tls_check_hostname() path. This allows NUL byte error messages to bubble up to the caller, to be logged in a program-appropriate way. It also removes non-portable calls to getprogname(). ok jsing@
* revert previous change for now, adjusting based on comments from jsing@bcook2014-12-071-6/+4
|
* Allow specific libtls hostname validation errors to propagate.bcook2014-12-071-4/+6
| | | | | | | | | | | | | Remove direct calls to printf from the tls_check_hostname() path. This allows NUL byte error messages to bubble up to the caller, to be logged in a program-appropriate way. It also removes non-portable calls to getprogname(). The semantics of tls_error() are changed slightly: the last error message is not necessarily preserved between subsequent calls into the library. When the previous call to libtls succeeds, client programs should treat the return value of tls_error() as undefined. ok tedu@
* Add a tls_connect_fds() function that allows a secure connection to bejsing2014-11-021-3/+16
| | | | | | | | | | established using a pair of existing file descriptors. Based on a diff/request from Jan Klemkow. Rides previous libtls rename/library bump. Discussed with tedu@.
* Rename libressl to libtls to avoid confusion and to make it easier tojsing2014-10-311-0/+212
distinguish between LibreSSL (the project) and libressl (the library). Discussed with many.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-27 15:06:26 +0000