src/lib/libfetch/common.c, branch release/10.3.0

MFH (r294326): fall back to standard / configured CA store

2016-02-20T22:58:33Z

PR: 193871 Approved by: re (gjb)

MFH (r280630): remove all traces of SSLv2 support

2016-01-16T20:24:02Z

MFH (r285141): remove unused variable MFH (r288217): correctly check return value from getaddrinfo(3) MFH (r289419): fix bugs in HTTPS tunnelling MFH (r289420): use fopen()'s "e" mode instead of fcntl for close-on-exec MFH (r291453, r291461): use .netrc for http servers and proxies MFH (r292330, r292332): reset bufpos to 0 after refilling in chunked mode PR: 194483 199801 193740 204771

MFH (r273114, r273124): disable SSLv3 by default.

2015-01-12T10:02:23Z

MFC: r267131, r267132, r267133, r268493, r268671

2014-07-20T00:29:41Z

Use NULL instead of 0 (Patch by Sascha Wildner for Dragonfly) Remove unnecessary semicolons (Patch by Sascha Wildner for Dragonfly) Add support for arbitrary http requests [1] Support EAGAIN in fetch_writev Submitted by: Alex Hornung [1] Reviewed by: des

MFH (r266291): look for root certs in /usr/local first

2014-05-24T22:50:58Z

MFH (r260904): fix format string

2014-02-27T13:27:04Z

MFH (r261230, r261263): fix buffering issues MFH (r261284): bump copyright

MFC r258347,r258349:

2013-11-29T21:13:30Z

Support SNI in libfetch SNI is Server Name Indentification which is a protocol for TLS that indicates the host that is being connected to at the start of the handshake. It allows to use Virtual Hosts on HTTPS. PR: kern/183583 Approved by: bapt (implicit) Approved by: re (gjb)

Implement certificate verification, and many other SSL-related

2013-07-26T15:53:43Z

imrovements; complete details in the PR. PR: kern/175514 Submitted by: Michael Gmelin MFC after: 1 week

libfetch: Avoid SIGPIPE on network connections.

2012-05-28T19:22:23Z

To avoid unexpected process termination from SIGPIPE when writing to a closed network connection, enable SO_NOSIGPIPE on all network connections. The POSIX standard MSG_NOSIGNAL is not used since it requires modifying all send calls to add this flag. This is particularly nasty for SSL connections. Reviewed by: des Tested by: bapt MFC after: 5 days

Since the socket is non-blocking, it is necessary to use select(2) even

2012-04-30T12:11:45Z

when there is no timeout, because read(2) will return immediately if there is no data waiting in the TCP buffer, causing fetch_read() to busy-loop on slow connections. MFC after: 3 weeks Noticed by: Yanhui Shen