Sessionid cache management is inseparable from managing individual
session lifetimes. E.g. for reference-counted sessions (like those in
SChannel and OpenSSL engines) every session addition and removal
should be accompanied with refcount increment and decrement
respectively. Failing to do so synchronously leads to a race condition
that causes symptoms like use-after-free and memory corruption.
This commit:
 - makes existing session cache locking explicit, thus allowing
   individual engines to manage lock's scope.
 - fixes OpenSSL and SChannel engines by putting refcount management
   inside this lock's scope in relevant places.
 - adds these explicit locking calls to other engines that use
   sessionid cache to accommodate for this change. Note, however,
   that it is unknown whether any of these engines could also have
   this race.

Bug: https://github.com/curl/curl/issues/815
Fixes #815
Closes #847

... that the new checksrc detected

closes #496

Add a "pinnedpubkey" section to the "Server Certificate" verbose

Bug: https://github.com/bagder/curl/issues/410
Reported-by: W. Mark Kubacki

Closes #430
Closes #410

... since the funciton can fail on OOM. Check this return code.

Coverity CID 1291705.

This option can be used to enable/disable TLS False Start defined in the RFC
draft-bmoeller-tls-falsestart.

Removed the curl_ prefix from the schannel source files as discussed
with Marc and Daniel at FOSDEM.

Slight code cleanup as the SSL backend #define is mixed up with the API
function setup.

Fixed the following warning and error from commit 3af90a6e when SSL
is not being used:

url.c:2004: warning C4013: 'Curl_ssl_cert_status_request' undefined;
            assuming extern returning int

error LNK2019: unresolved external symbol Curl_ssl_cert_status_request
               referenced in function Curl_setopt

This option can be used to enable/disable certificate status verification using
the "Certificate Status Request" TLS extension defined in RFC6066 section 8.

This also adds the CURLE_SSL_INVALIDCERTSTATUS error, to be used when the
certificate status verification fails, and the Curl_ssl_cert_status_request()
function, used to check whether the SSL backend supports the status_request
extension.

The return type for this function was 0 on success and 1 on error. This
was then examined by the calling functions and, in most cases, used to
return CURLE_OUT_OF_MEMORY.

Instead use CURLcode for the return type and return the out of memory
error directly, propagating it up the call stack.

The return type of this function is a boolean value, and even uses a
bool internally, so use bool in the function declaration as well as
the variables that store the return value, to avoid any confusion.

vtls.c:185:46: warning: unused parameter 'data'

It turned out some features were not enabled in the build since for
example url.c #ifdefs on features that are defined on a per-backend
basis but vtls.h didn't include the backend headers.

CURLOPT_CERTINFO was one such feature that was accidentally disabled.

Each backend now defines CURL_SSL_BACKEND accordingly. Added the *AXTLS
one which was missing previously.

... by defining Curl_ssl_random() properly

To force each backend implementation to really attempt to provide proper
random. If a proper random function is missing, then we can explicitly
make use of the default one we use when TLS support is missing.

This commit makes sure it works for darwinssl, gnutls, nss and openssl.

Curl_rand() will return a dummy and repatable random value for this
case. Makes it possible to write test cases that verify output.

Also, fake timestamp with CURL_FORCETIME set.

Only when built debug enabled of course.

Curl_ssl_random() was not used anymore so it has been
removed. Curl_rand() is enough.

create_digest_md5_message: generate base64 instead of hex string

curl_sasl: also fix memory leaks in some OOM situations

According to https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-05
it is "http/1.1" and not "http/1.0".

Add ALPN support when using GnuTLS >= 3.2.0. This allows
libcurl to negotiate HTTP/2.0 for https connections when
built with GnuTLS.

See:
http://www.gnutls.org/manual/gnutls.html#Application-Layer-Protocol-Negotiation-_0028ALPN_0029
http://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-04

When doing multi-part formposts, libcurl used a pseudo-random value that
was seeded with time(). This turns out to be bad for users who formpost
data that is provided with users who then can guess how the boundary
string will look like and then they can forge a different formpost part
and trick the receiver.

My advice to such implementors is (still even after this change) to not
rely on the boundary strings being cryptographically strong. Fix your
code and logic to not depend on them that much!

I moved the Curl_rand() function into the sslgen.c source file now to be
able to take advantage of the SSL library's random function if it
provides one. If not, try to use the RANDOM_FILE for seeding and as a
last resort keep the old logic, just modified to also add microseconds
which makes it harder to properly guess the exact seed.

The formboundary() function in formdata.c is now using 64 bit entropy
for the boundary and therefore the string of dashes was reduced by 4
letters and there are 16 hex digits following it. The total length is
thus still the same.

Bug: http://curl.haxx.se/bug/view.cgi?id=1251
Reported-by: "Floris"

This commit renames lib/setup.h to lib/curl_setup.h and
renames lib/setup_once.h to lib/curl_setup_once.h.

Removes the need and usage of a header inclusion guard foreign
to libcurl. [1]

Removes the need and presence of an alarming notice we carried
in old setup_once.h [2]

----------------------------------------

1 - lib/setup_once.h used __SETUP_ONCE_H macro as header inclusion guard
    up to commit ec691ca3 which changed this to HEADER_CURL_SETUP_ONCE_H,
    this single inclusion guard is enough to ensure that inclusion of
    lib/setup_once.h done from lib/setup.h is only done once.

    Additionally lib/setup.h has always used __SETUP_ONCE_H macro to
    protect inclusion of setup_once.h even after commit ec691ca3, this
    was to avoid a circular header inclusion triggered when building a
    c-ares enabled version with c-ares sources available which also has
    a setup_once.h header. Commit ec691ca3 exposes the real nature of
    __SETUP_ONCE_H usage in lib/setup.h, it is a header inclusion guard
    foreign to libcurl belonging to c-ares's setup_once.h

    The renaming this commit does, fixes the circular header inclusion,
    and as such removes the need and usage of a header inclusion guard
    foreign to libcurl. Macro __SETUP_ONCE_H no longer used in libcurl.

2 - Due to the circular interdependency of old lib/setup_once.h and the
    c-ares setup_once.h header, old file lib/setup_once.h has carried
    back from 2006 up to now days an alarming and prominent notice about
    the need of keeping libcurl's and c-ares's setup_once.h in sync.

    Given that this commit fixes the circular interdependency, the need
    and presence of mentioned notice is removed.

    All mentioned interdependencies come back from now old days when
    the c-ares project lived inside a curl subdirectory. This commit
    removes last traces of such fact.

This reverts renaming and usage of lib/*.h header files done
28-12-2012, reverting 2 commits:

  f871de00... build: make use of 76 lib/*.h renamed files
  ffd8e127... build: rename 76 lib/*.h files

This also reverts removal of redundant include guard (redundant thanks
to changes in above commits) done 2-12-2013, reverting 1 commit:

  c087374c... curl_setup.h: remove redundant include guard

This also reverts renaming and usage of lib/*.c source files done
3-12-2013, reverting 3 commits:

  13606bbf... build: make use of 93 lib/*.c renamed files
  5b6e7927... build: rename 93 lib/*.c files
  7d83dfff... build: commit 13606bbf follow-up 1

Start of related discussion thread:

  http://curl.haxx.se/mail/lib-2013-01/0012.html

Asking for confirmation on pushing this revertion commit:

  http://curl.haxx.se/mail/lib-2013-01/0048.html

Confirmation summary:

  http://curl.haxx.se/mail/lib-2013-01/0079.html

NOTICE: The list of 2 files that have been modified by other
intermixed commits, while renamed, and also by at least one
of the 6 commits this one reverts follows below. These 2 files
will exhibit a hole in history unless git's '--follow' option
is used when viewing logs.

  lib/curl_imap.h
  lib/curl_smtp.h

76 private header files renamed to use our standard naming scheme.

This commit only does the file renaming.

----------------------------------------

  renamed:    amigaos.h -> curl_amigaos.h
  renamed:    arpa_telnet.h -> curl_arpa_telnet.h
  renamed:    asyn.h -> curl_asyn.h
  renamed:    axtls.h -> curl_axtls.h
  renamed:    bundles.h -> curl_bundles.h
  renamed:    conncache.h -> curl_conncache.h
  renamed:    connect.h -> curl_connect.h
  renamed:    content_encoding.h -> curl_content_encoding.h
  renamed:    cookie.h -> curl_cookie.h
  renamed:    cyassl.h -> curl_cyassl.h
  renamed:    dict.h -> curl_dict.h
  renamed:    easyif.h -> curl_easyif.h
  renamed:    escape.h -> curl_escape.h
  renamed:    file.h -> curl_file.h
  renamed:    fileinfo.h -> curl_fileinfo.h
  renamed:    formdata.h -> curl_formdata.h
  renamed:    ftp.h -> curl_ftp.h
  renamed:    ftplistparser.h -> curl_ftplistparser.h
  renamed:    getinfo.h -> curl_getinfo.h
  renamed:    gopher.h -> curl_gopher.h
  renamed:    gtls.h -> curl_gtls.h
  renamed:    hash.h -> curl_hash.h
  renamed:    hostcheck.h -> curl_hostcheck.h
  renamed:    hostip.h -> curl_hostip.h
  renamed:    http.h -> curl_http.h
  renamed:    http_chunks.h -> curl_http_chunks.h
  renamed:    http_digest.h -> curl_http_digest.h
  renamed:    http_negotiate.h -> curl_http_negotiate.h
  renamed:    http_proxy.h -> curl_http_proxy.h
  renamed:    if2ip.h -> curl_if2ip.h
  renamed:    imap.h -> curl_imap.h
  renamed:    inet_ntop.h -> curl_inet_ntop.h
  renamed:    inet_pton.h -> curl_inet_pton.h
  renamed:    krb4.h -> curl_krb4.h
  renamed:    llist.h -> curl_llist.h
  renamed:    memdebug.h -> curl_memdebug.h
  renamed:    multiif.h -> curl_multiif.h
  renamed:    netrc.h -> curl_netrc.h
  renamed:    non-ascii.h -> curl_non-ascii.h
  renamed:    nonblock.h -> curl_nonblock.h
  renamed:    nssg.h -> curl_nssg.h
  renamed:    parsedate.h -> curl_parsedate.h
  renamed:    pingpong.h -> curl_pingpong.h
  renamed:    polarssl.h -> curl_polarssl.h
  renamed:    pop3.h -> curl_pop3.h
  renamed:    progress.h -> curl_progress.h
  renamed:    qssl.h -> curl_qssl.h
  renamed:    rawstr.h -> curl_rawstr.h
  renamed:    rtsp.h -> curl_rtsp.h
  renamed:    select.h -> curl_select.h
  renamed:    sendf.h -> curl_sendf.h
  renamed:    setup.h -> curl_setup.h
  renamed:    setup_once.h -> curl_setup_once.h
  renamed:    share.h -> curl_share.h
  renamed:    slist.h -> curl_slist.h
  renamed:    smtp.h -> curl_smtp.h
  renamed:    sockaddr.h -> curl_sockaddr.h
  renamed:    socks.h -> curl_socks.h
  renamed:    speedcheck.h -> curl_speedcheck.h
  renamed:    splay.h -> curl_splay.h
  renamed:    ssh.h -> curl_ssh.h
  renamed:    sslgen.h -> curl_sslgen.h
  renamed:    ssluse.h -> curl_ssluse.h
  renamed:    strdup.h -> curl_strdup.h
  renamed:    strequal.h -> curl_strequal.h
  renamed:    strerror.h -> curl_strerror.h
  renamed:    strtok.h -> curl_strtok.h
  renamed:    strtoofft.h -> curl_strtoofft.h
  renamed:    telnet.h -> curl_telnet.h
  renamed:    tftp.h -> curl_tftp.h
  renamed:    timeval.h -> curl_timeval.h
  renamed:    transfer.h -> curl_transfer.h
  renamed:    url.h -> curl_url.h
  renamed:    urldata.h -> curl_urldata.h
  renamed:    warnless.h -> curl_warnless.h
  renamed:    wildcard.h -> curl_wildcard.h

----------------------------------------

76 private header files renamed to use our standard naming scheme.

This change affects 322 files in libcurl's source tree.

curl_ntlm_msgs.c would previously use an #ifdef maze and direct
SSL-library calls instead of using the SSL layer we have for this
purpose.