romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-16 02:01:40 +03:00
Code Issues Projects Releases Packages Wiki Activity
curl/src
History
Johannes Schindelin 5450428491 schannel: add "best effort" revocation check option 
- Implement new option CURLSSLOPT_REVOKE_BEST_EFFORT and
  --ssl-revoke-best-effort to allow a "best effort" revocation check.

A best effort revocation check ignores errors that the revocation check
was unable to take place. The reasoning is described in detail below and
discussed further in the PR.

---

When running e.g. with Fiddler, the schannel backend fails with an
unhelpful error message:

	Unknown error (0x80092012) - The revocation function was unable
	to check revocation for the certificate.

Sadly, many enterprise users who are stuck behind MITM proxies suffer
the very same problem.

This has been discussed in plenty of issues:
https://github.com/curl/curl/issues/3727,
https://github.com/curl/curl/issues/264, for example.

In the latter, a Microsoft Edge developer even made the case that the
common behavior is to ignore issues when a certificate has no recorded
distribution point for revocation lists, or when the server is offline.
This is also known as "best effort" strategy and addresses the Fiddler
issue.

Unfortunately, this strategy was not chosen as the default for schannel
(and is therefore a backend-specific behavior: OpenSSL seems to happily
ignore the offline servers and missing distribution points).

To maintain backward-compatibility, we therefore add a new flag
(`CURLSSLOPT_REVOKE_BEST_EFFORT`) and a new option
(`--ssl-revoke-best-effort`) to select the new behavior.

Due to the many related issues Git for Windows and GitHub Desktop, the
plan is to make this behavior the default in these software packages.

The test 2070 was added to verify this behavior, adapted from 310.

Based-on-work-by: georgeok <giorgos.n.oikonomou@gmail.com>
Co-authored-by: Markus Olsson <j.markus.olsson@gmail.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Closes https://github.com/curl/curl/pull/4981
2020-03-18 03:23:39 -04:00
..
macos docs/comments: Update to secure URL versions 2017-08-08 21:41:07 +02:00
.gitignore VC: remove the makefile.vc6 build infra 2017-01-23 14:27:32 +01:00
CMakeLists.txt CMake: Add support for CMAKE_LTO option. 2020-01-13 23:14:49 +01:00
curl.rc (lib)curl.rc: fixup for minor bugs 2018-12-10 00:10:04 +01:00
Makefile.am src/makefile: fix uncompressed hugehelp.c generation 2019-08-01 07:46:09 +02:00
makefile.amiga whitespace fixes 2018-09-23 22:24:02 +00:00
makefile.dj whitespace fixes 2018-09-23 22:24:02 +00:00
Makefile.inc writeout: support to generate JSON output 2020-03-17 15:01:28 +01:00
Makefile.m32 Makefile.m32: Improve windres parameter compatibility 2020-03-14 19:08:17 -04:00
Makefile.netware axtls: removed 2018-11-01 10:29:53 +01:00
Makefile.Watcom s/cURL/curl 2016-11-07 10:36:23 +01:00
mkhelp.pl curl: remove MANUAL from -M output 2019-02-20 08:20:27 +01:00
slist_wc.c copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
slist_wc.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_binmode.c copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_binmode.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_bname.c copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_bname.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_cb_dbg.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
tool_cb_dbg.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_cb_hdr.c cleanup: comment typos 2020-02-21 08:38:00 +01:00
tool_cb_hdr.h curl: two new command line options for etags 2019-11-28 13:05:20 +01:00
tool_cb_prg.c curl: make the -# spaceship bar not wrap the line 2020-01-26 18:31:00 +01:00
tool_cb_prg.h whitespace fixes 2018-09-23 22:24:02 +00:00
tool_cb_rea.c curl: remove 'config' field from OutStruct 2020-01-12 17:17:44 +01:00
tool_cb_rea.h curl: fix --upload-file . hangs if delay in STDIN 2019-11-26 09:17:52 +01:00
tool_cb_see.c tool_cb_see: set correct copyright year range 2020-03-07 11:00:48 +01:00
tool_cb_see.h tool_cb_see: set correct copyright year range 2020-03-07 11:00:48 +01:00
tool_cb_wrt.c curl: remove 'config' field from OutStruct 2020-01-12 17:17:44 +01:00
tool_cb_wrt.h curl: remove 'config' field from OutStruct 2020-01-12 17:17:44 +01:00
tool_cfgable.c curl: two new command line options for etags 2019-11-28 13:05:20 +01:00
tool_cfgable.h schannel: add "best effort" revocation check option 2020-03-18 03:23:39 -04:00
tool_convert.c cli tool: refactor encoding conversion sequence for switch case fallthrough. 2019-02-16 02:04:24 +01:00
tool_convert.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_dirhie.c tool_dirhie.c: fix the copyright year range 2020-01-09 22:49:29 +01:00
tool_dirhie.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_doswin.c nit: Copyright year out of date 2020-02-19 08:04:35 +01:00
tool_doswin.h nit: Copyright year out of date 2020-02-19 08:04:35 +01:00
tool_easysrc.c copyright: fix the year ranges for two files 2019-12-02 08:02:39 +01:00
tool_easysrc.h mime: use in curl cli tool instead of form API. 2017-09-02 18:17:33 +01:00
tool_filetime.c time-cond: fix reading the file modification time on Windows 2018-02-05 22:02:10 +01:00
tool_filetime.h whitespace fixes 2018-09-23 22:24:02 +00:00
tool_formparse.c tool_formparse: remove redundant assignment 2019-05-20 08:06:24 +02:00
tool_formparse.h cli tool: fix mime post with --disable-libcurl-option configure option 2019-02-19 17:08:58 +01:00
tool_getparam.c schannel: add "best effort" revocation check option 2020-03-18 03:23:39 -04:00
tool_getparam.h curl: report error for "--no-" on non-boolean options 2019-05-20 19:04:54 +02:00
tool_getpass.c build: fix Codacy warnings 2019-06-05 20:38:06 +02:00
tool_getpass.h checksrc: code style: use 'char *name' style 2016-11-24 23:58:22 +01:00
tool_help.c schannel: add "best effort" revocation check option 2020-03-18 03:23:39 -04:00
tool_help.h curl: support parallel transfers 2019-07-20 19:14:16 +02:00
tool_helpers.c curl: report error for "--no-" on non-boolean options 2019-05-20 19:04:54 +02:00
tool_helpers.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_homedir.c tool_home: Fix the copyright year being out of date 2020-02-13 00:40:08 +00:00
tool_homedir.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_hugehelp.c.cvs tests: checksrc compliance 2016-12-19 02:31:59 -05:00
tool_hugehelp.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_libinfo.c copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_libinfo.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_main.c nit: Copyright year out of date 2020-02-19 08:04:35 +01:00
tool_main.h curl: support parallel transfers 2019-07-20 19:14:16 +02:00
tool_metalink.c windows: suppress UI in all CryptAcquireContext() calls 2020-03-17 23:08:02 +00:00
tool_metalink.h curl: fix memory leaked by parse_metalink() 2019-09-13 10:09:48 +02:00
tool_msgs.c curl: use errorf() better 2019-12-10 10:03:33 +01:00
tool_msgs.h curl: show better error message when no homedir is found 2019-12-03 16:26:02 +01:00
tool_operate.c schannel: add "best effort" revocation check option 2020-03-18 03:23:39 -04:00
tool_operate.h curl: two new command line options for etags 2019-11-28 13:05:20 +01:00
tool_operhlp.c tool_operhlp: Copyright year out of date, should be 2020 2020-02-04 08:30:05 +01:00
tool_operhlp.h curl: support parallel transfers 2019-07-20 19:14:16 +02:00
tool_panykey.c copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_panykey.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_paramhlp.c curl -w: handle a blank input file correctly 2020-01-06 10:10:48 +01:00
tool_paramhlp.h tool: make a few char pointers point to const char instead 2019-12-31 22:18:56 +01:00
tool_parsecfg.c curl/parseconfig: use curl_free() to free memory allocated by libcurl 2019-12-18 14:48:41 +01:00
tool_parsecfg.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_progress.c curl: remove 'config' field from OutStruct 2020-01-12 17:17:44 +01:00
tool_progress.h curl: support parallel transfers 2019-07-20 19:14:16 +02:00
tool_sdecls.h curl: remove 'config' field from OutStruct 2020-01-12 17:17:44 +01:00
tool_setopt.c schannel: add "best effort" revocation check option 2020-03-18 03:23:39 -04:00
tool_setopt.h build: Disable Visual Studio warning "conditional expression is constant" 2019-12-01 19:01:02 -05:00
tool_setup.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_sleep.c copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_sleep.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_strdup.c code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
tool_strdup.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_urlglob.c curl: make #0 not output the full URL 2020-01-13 15:37:46 +01:00
tool_urlglob.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_util.c nit: Copyright year out of date 2020-02-19 08:04:35 +01:00
tool_util.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_version.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_vms.c copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_vms.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00
tool_writeout.c writeout: support to generate JSON output 2020-03-17 15:01:28 +01:00
tool_writeout.h writeout: support to generate JSON output 2020-03-17 15:01:28 +01:00
tool_writeout_json.c writeout_json: add missing comma to fix the HTTP version 2020-03-17 16:05:05 +01:00
tool_writeout_json.h writeout: support to generate JSON output 2020-03-17 15:01:28 +01:00
tool_xattr.c curl: follow-up to 3f16990ec8 2019-02-11 14:22:36 +01:00
tool_xattr.h copyrights: fix copyright year range 2019-11-08 14:51:42 +01:00