Commit Graph

4617 Commits

Author SHA1 Message Date
Nils Maier
f7cc24d6cf Internally use HMAC in http auth
To at least get constant time compare.
Also fix incorrect parsing of the creds (were incorrectly stripped).
Also add unit tests.
2014-05-22 15:24:20 +02:00
Nils Maier
d02ee723bd Improve aria2.rst and usage texts a bit.
(Keep in mind that I'm not a native speaker either)
- Fix some typos.
- Fix some grammar stuff.
- Clarify some things.
- Add a new paragraph or two...
2014-05-20 18:02:47 +02:00
Nils Maier
17f03e8f29 Fix some typos in README.rst 2014-05-20 12:54:29 +02:00
Nils Maier
855dfa0e2f Authorize RPC multicalls only once.
Cache the auth status afterwards and just assume the token still matches
(within the same request, of course).
2014-05-20 12:53:39 +02:00
Nils Maier
88b61f2eb9 Adjust RPC token processing time
Make it consume a bit less time.
2014-05-20 12:53:38 +02:00
Nils Maier
bb50de1336 Improve write cache failures error reporting 2014-05-20 12:52:26 +02:00
Nils Maier
fd3348cc88 Use -pipe when GCC 2014-05-20 12:50:56 +02:00
Nils Maier
5c07f0109e Fix F_PREALLOC based allocation on some OSX versions 2014-05-08 16:40:09 +02:00
Nils Maier
1dd7409c4e Fix unused function warning about generateRandomDataUrandom in mingw-w64 2014-05-08 16:38:32 +02:00
Nils Maier
a0f275a9f1 Remove unused function getWin32Handle 2014-05-08 16:38:32 +02:00
Tatsuhiro Tsujikawa
f60e55cece Use index.html as filename for conditional-get when file is missing in URI
Previously we disabled conditional-get if file part is missing in URI.
But we use constant string "index.html" in this case, so we can do the
same to determine the modification time.  In this patch, if we have
file part in URI, we are not going to set absolute file path in
FileEntry, since it prevents content-disposition from working.
2014-05-08 21:49:04 +09:00
Tatsuhiro Tsujikawa
84f1a15e10 Check negative number from Integer::i() where it is not allowed 2014-05-01 11:34:27 +09:00
Tatsuhiro Tsujikawa
4c2ad69a75 Ignore negative metadata size in extended handshake 2014-04-30 23:46:27 +09:00
Tatsuhiro Tsujikawa
6c3a33d958 Merge branch 'master' of github.com:tatsuhiro-t/aria2 2014-04-27 23:26:51 +09:00
Tatsuhiro Tsujikawa
6020756d2e Always add README.html to dist_doc_DATA
rst2html is required to produce README.html from README.rst.  We
include generated README.html to distribution.  And rst2html is not
required when compiling sources in distribution and always README.html
is available.
2014-04-27 23:24:23 +09:00
Nils Maier
82dad90ff3 Validate token using PBKDF2-HMAC-SHA1.
This change should make token validation more resilient to:
 - timing attacks (constant time array compare)
 - brute-force/dictionary attacks (PBKDF2)

 Closes #220
2014-04-19 19:10:06 +02:00
Nils Maier
98ba096951 Add util::security (compare, HMAC, PBKDF2)
See #220
2014-04-19 19:07:38 +02:00
Nils Maier
37a84182b7 makerelease-osx: Do not build universal by default 2014-04-18 20:03:05 +02:00
Nils Maier
cd204ff525 Add --disable-websocket 2014-04-17 18:02:42 +02:00
Nils Maier
010131161e Remove ENABLE_MESSAGE_DIGEST, since we got the internal md, always 2014-04-17 18:02:42 +02:00
Nils Maier
befd799d17 configure: Do not check for nettle/gcrypt when appletls or wintls 2014-04-17 18:02:42 +02:00
Tatsuhiro Tsujikawa
67aa993ca9 Enable wintls by default and remove its experimental status 2014-04-17 22:28:29 +09:00
Tatsuhiro Tsujikawa
83691981e3 mingw32: Enable wintls and compile with GMP
By enabling wintls, we can use Windows certificate store to validate
server's certificate.  Previously, we built windows build using
openssl and since we don't bundle CA certificates, aria2 fails to
validate server's certificate unless user setups their CA
certificates.  GMP provides fast big integer calculations, whic is
used in BitTorrent encryption.
2014-04-15 23:02:45 +09:00
Nils Maier
e4135ca669 Fix typo: BitTorr(r)ent 2014-04-13 18:51:07 +02:00
Nils Maier
aa02545fba Use mpz_pown_sec where available 2014-04-13 18:51:06 +02:00
Nils Maier
ead6685b18 Warn (or error with explicit --with-libgmp) if gmp is not actually found 2014-04-13 18:51:06 +02:00
Nils Maier
b223bbf308 makerelease-osx: GMP --enable-fat 2014-04-13 18:51:06 +02:00
Nils Maier
7e4644927f makerelease-osx: Explicitly put arch include and lib into flags.
For libgmp
2014-04-13 18:51:06 +02:00
Nils Maier
c694a05797 Fix some warnings 2014-04-13 18:51:05 +02:00
Nils Maier
18c35f56b8 AppleTLS: Enable BEAST mitigations in ST
Only available in 10.9+, but since we might be building on a previous
version but running on 10.9+, always try to set the option.
2014-04-13 18:51:05 +02:00
Nils Maier
e195dc5f00 AppleTLS: Update cipher suites
Also make the suite selection more sane.
2014-04-13 18:51:05 +02:00
Nils Maier
39d66bd560 WinTLS: Improve error reporting 2014-04-13 18:51:05 +02:00
Nils Maier
51beb4bfa7 WinTLS: Move some defines out of the header 2014-04-13 18:51:04 +02:00
Nils Maier
219fd5b4b7 WinTLS: Make ca-file rejection a warning 2014-04-13 18:51:04 +02:00
Nils Maier
8d55e30561 WinTLS: Use SCH_USE_STRONG_CRYPTO
See: #217
2014-04-13 18:50:54 +02:00
Nils Maier
0a51b8d172 WinTLS: Accept chains with no revocation information.
This is kind what browser do anyway (IE, Firefox, Chrome tested), what
AppleTLS does, what GnuTLS does and what OpenSSL does. Actually, most
browsers will also be OK with the CRL/OCSP provider being offline.
WinTLS will still fail in that case.

Should revocation information be available in the trust chain (CRL or
OCSP) the certificate still will be checked!

"Real" CAs, aka. those provided by the OS or system CA bundle, usually
provide revocation information and are thus still checked.
It should be mostly (only?) custom (organization) CAs that lack
revocation information, but those users might want to use aria2 in their
intranets and VPNs anyway ;)

See #217
2014-04-13 18:50:38 +02:00
Nils Maier
13a202df07 Fix GnuTLS 2.x compatiblity
Closes GH-216
2014-04-12 02:55:31 +02:00
Nils Maier
2d9bf0f374 AppleTLS: Use newer, non-deprecated API in 10.8+ 2014-04-12 02:55:31 +02:00
Nils Maier
7600886d3d Implement falloc equivalent in OSX 2014-04-12 02:55:31 +02:00
Tatsuhiro Tsujikawa
a95674aef3 Update doc 2014-04-09 23:30:44 +09:00
Tatsuhiro Tsujikawa
e5db3a4cbb Update NEWS 2014-03-30 18:22:09 +09:00
Tatsuhiro Tsujikawa
305ef84e5d Bump up version number to 1.18.5 2014-03-30 18:20:32 +09:00
Tatsuhiro Tsujikawa
f0473dc34d Ignore error when setting DSCP value
Setting DSCP is additional feature and failure to enable it should not
abort download entirely.  This change fixes the bug that windows build
does not perform bittorrent downloads.
2014-03-30 14:14:28 +09:00
Tatsuhiro Tsujikawa
551adc5133 mingw: Undef localtime_r and asctime_r 2014-03-24 01:11:30 +09:00
Tatsuhiro Tsujikawa
dc54b90bcc Update pre-built README 2014-03-24 00:39:21 +09:00
Tatsuhiro Tsujikawa
1188e4f1a2 Fix mingw32 build with gcc 4.8.2
Now mingw-w64 C++ compiler defines __USE_MINGW_ANSI_STDIO to 1, we
have to follow it as well.  We hope that mingw version of stdio
function behaves like Linux ones.  We have not tested them thoroughly
yet.  pthread for windows defines its own HAVE_STRUCT_TIMESPEC macro.
To avoid warning, we rename our version of it as
HAVE_A2_STRUCT_TIMESPEC.
2014-03-24 00:37:30 +09:00
Tatsuhiro Tsujikawa
96ffc3dfd4 Bump up version number to 1.18.4 2014-03-23 21:35:15 +09:00
Tatsuhiro Tsujikawa
49d4585890 Update bash_completion 2014-03-23 21:34:13 +09:00
Tatsuhiro Tsujikawa
2a1181b4a3 Update NEWS 2014-03-23 21:23:09 +09:00
Tatsuhiro Tsujikawa
644a74da01 Update .gitignore 2014-03-22 12:26:15 +09:00