url: add CURLOPT_SSL_VERIFYSTATUS option (3af90a6e) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP curl

docs/libcurl/opts/CURLOPT_SSL_VERIFYSTATUS.3

0 → 100644

+53 −0

Original line number	Original line	Diff line number	Diff line
			.\" **************************************************************************
			.\" * _ _ ____ _
			.\" * Project ___\| \| \| \| _ \\| \|
			.\" * / __\| \| \| \| \|_) \| \|
			.\" * \| (__\| \|_\| \| _ <\| \|___
			.\" * \___\|\___/\|_\| \_\_____\|
			.\" *
			.\" * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
			.\" *
			.\" * This software is licensed as described in the file COPYING, which
			.\" * you should have received as part of this distribution. The terms
			.\" * are also available at http://curl.haxx.se/docs/copyright.html.
			.\" *
			.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
			.\" * copies of the Software, and permit persons to whom the Software is
			.\" * furnished to do so, under the terms of the COPYING file.
			.\" *
			.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
			.\" * KIND, either express or implied.
			.\" *
			.\" **************************************************************************
			.\"
			.TH CURLOPT_SSL_VERIFYSTATUS 3 "04 Dec 2014" "libcurl 7.40.0" "curl_easy_setopt options"
			.SH NAME
			CURLOPT_SSL_VERIFYSTATUS \- verify the certificate's status
			.SH SYNOPSIS
			#include <curl/curl.h>

			CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_VERIFYSTATUS, long verify);
			.SH DESCRIPTION
			Pass a long as parameter to enable or disable.

			This option determines whether libcurl verifies the status of the server cert
			using the "Certificate Status Request" TLS extension (aka. OCSP stapling).

			Note that if this option is enabled but the server does not support the TLS
			extension, the verification will fail.

			.SH DEFAULT
			0
			.SH PROTOCOLS
			All TLS based protocols: HTTPS, FTPS, IMAPS, POP3, SMTPS etc.
			.SH EXAMPLE
			TODO
			.SH AVAILABILITY
			This is currently only supported by the GnuTLS and NSS TLS backends.
			.SH RETURN VALUE
			Returns CURLE_OK if OCSP stapling is supported by the SSL backend, otherwise
			returns CURLE_NOT_BUILT_IN.
			.SH "SEE ALSO"
			.BR CURLOPT_SSL_VERIFYHOST "(3), "
			.BR CURLOPT_SSL_VERIFYPEER "(3), "
			.BR CURLOPT_CAINFO "(3), "

docs/libcurl/symbols-in-versions

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -118,6 +118,7 @@ CURLE_SSL_CRL_BADFILE 7.19.0
	CURLE_SSL_ENGINE_INITFAILED 7.12.3		CURLE_SSL_ENGINE_INITFAILED 7.12.3
	CURLE_SSL_ENGINE_NOTFOUND 7.9.3		CURLE_SSL_ENGINE_NOTFOUND 7.9.3
	CURLE_SSL_ENGINE_SETFAILED 7.9.3		CURLE_SSL_ENGINE_SETFAILED 7.9.3
			CURLE_SSL_INVALIDCERTSTATUS 7.41.0
	CURLE_SSL_ISSUER_ERROR 7.19.0		CURLE_SSL_ISSUER_ERROR 7.19.0
	CURLE_SSL_PEER_CERTIFICATE 7.8 7.17.1		CURLE_SSL_PEER_CERTIFICATE 7.8 7.17.1
	CURLE_SSL_PINNEDPUBKEYNOTMATCH 7.39.0		CURLE_SSL_PINNEDPUBKEYNOTMATCH 7.39.0
	@@ -513,6 +514,7 @@ CURLOPT_SSL_OPTIONS 7.25.0
	CURLOPT_SSL_SESSIONID_CACHE 7.16.0		CURLOPT_SSL_SESSIONID_CACHE 7.16.0
	CURLOPT_SSL_VERIFYHOST 7.8.1		CURLOPT_SSL_VERIFYHOST 7.8.1
	CURLOPT_SSL_VERIFYPEER 7.4.2		CURLOPT_SSL_VERIFYPEER 7.4.2
			CURLOPT_SSL_VERIFYSTATUS 7.41.0
	CURLOPT_STDERR 7.1		CURLOPT_STDERR 7.1
	CURLOPT_TCP_KEEPALIVE 7.25.0		CURLOPT_TCP_KEEPALIVE 7.25.0
	CURLOPT_TCP_KEEPIDLE 7.25.0		CURLOPT_TCP_KEEPIDLE 7.25.0

include/curl/curl.h

+4 −0

Original line number	Original line	Diff line number	Diff line
	@@ -523,6 +523,7 @@ typedef enum {
	session will be queued */		session will be queued */
	CURLE_SSL_PINNEDPUBKEYNOTMATCH, /* 90 - specified pinned public key did not		CURLE_SSL_PINNEDPUBKEYNOTMATCH, /* 90 - specified pinned public key did not
	match */		match */
			CURLE_SSL_INVALIDCERTSTATUS, /* 91 - invalid certificate status */
	CURL_LAST /* never use! */		CURL_LAST /* never use! */
	} CURLcode;		} CURLcode;

	@@ -1622,6 +1623,9 @@ typedef enum {
	/* Path to Unix domain socket */		/* Path to Unix domain socket */
	CINIT(UNIX_SOCKET_PATH, OBJECTPOINT, 231),		CINIT(UNIX_SOCKET_PATH, OBJECTPOINT, 231),

			/* Set if we should verify the certificate status. */
			CINIT(SSL_VERIFYSTATUS, LONG, 232),

	CURLOPT_LASTENTRY /* the last unused */		CURLOPT_LASTENTRY /* the last unused */
	} CURLoption;		} CURLoption;

lib/strerror.c

+4 −1

Original line number	Original line	Diff line number	Diff line
	@@ -5,7 +5,7 @@
	* \| (__\| \|_\| \| _ <\| \|___		* \| (__\| \|_\| \| _ <\| \|___
	* \___\|\___/\|_\| \_\_____\|		* \___\|\___/\|_\| \_\_____\|
	*		*
	* Copyright (C) 2004 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.		* Copyright (C) 2004 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
	*		*
	* This software is licensed as described in the file COPYING, which		* This software is licensed as described in the file COPYING, which
	* you should have received as part of this distribution. The terms		* you should have received as part of this distribution. The terms
	@@ -301,6 +301,9 @@ curl_easy_strerror(CURLcode error)
	case CURLE_SSL_PINNEDPUBKEYNOTMATCH:		case CURLE_SSL_PINNEDPUBKEYNOTMATCH:
	return "SSL public key does not match pinned public key";		return "SSL public key does not match pinned public key";

			case CURLE_SSL_INVALIDCERTSTATUS:
			return "SSL server certificate status verification FAILED";

	/* error codes not used by current libcurl */		/* error codes not used by current libcurl */
	case CURLE_OBSOLETE20:		case CURLE_OBSOLETE20:
	case CURLE_OBSOLETE24:		case CURLE_OBSOLETE24:

lib/url.c

+11 −0

Original line number	Original line	Diff line number	Diff line
	@@ -1997,6 +1997,17 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,

	data->set.ssl.verifyhost = (0 != arg)?TRUE:FALSE;		data->set.ssl.verifyhost = (0 != arg)?TRUE:FALSE;
	break;		break;
			case CURLOPT_SSL_VERIFYSTATUS:
			/*
			* Enable certificate status verifying.
			*/
			if(!Curl_ssl_cert_status_request()) {
			result = CURLE_NOT_BUILT_IN;
			break;
			}

			data->set.ssl.verifystatus = (0 != va_arg(param, long))?TRUE:FALSE;
			break;
	case CURLOPT_SSL_CTX_FUNCTION:		case CURLOPT_SSL_CTX_FUNCTION:
	#ifdef have_curlssl_ssl_ctx		#ifdef have_curlssl_ssl_ctx
	/*		/*