libfetch, fetch: Stop recommending the use of ca_root_nss.

MFC after: 3 days
Reviewed by: kevans, emaste
Differential Revision: https://reviews.freebsd.org/D42119

Remove $FreeBSD$: two-line nroff pattern

Remove /^\.\\"\n\.\\"\s*\$FreeBSD\$$\n/

There's no PEM(3) anywhere around; delete reference.

Remove support for SSLv3 from fetch(3).

Support for SSLv3 was already removed from OpenSSL (r361392).

Differential Revision: https://reviews.freebsd.org/D24947

Merge ^/head r357966 through r357999.

fetch(3): Add SOCKS5 support

This change adds SOCKS5 support to the library fetch(3) and updates the man
page.

Details: Within the fetch_connect() function, fetch(3) checks if the
SOCKS5_PROXY envi

fetch(3): Add SOCKS5 support

This change adds SOCKS5 support to the library fetch(3) and updates the man
page.

Details: Within the fetch_connect() function, fetch(3) checks if the
SOCKS5_PROXY environment variable is set. If so, it connects to this host
rather than the end-host. It then initializes the SOCKS5 connection in
accordance with RFC 1928 and returns the resulting conn_t (file descriptor)
for usage by the regular FTP/HTTP handlers.

Design Decision: This change defaults all DNS resolutions through the proxy
by sending all IPs as hostnames. Going forward, another feature might be to
create another environmental variable to toggle resolutions through the
proxy or not..

One may set the SOCKS5_PROXY environment variable in any of the formats:

SOCKS5_PROXY=proxy.example.com
SOCKS5_PROXY=proxy.example.com:1080
SOCKS5_PROXY=192.0.2.0
SOCKS5_PROXY=198.51.100.0:1080
SOCKS5_PROXY=[2001:db8::1]
SOCKS5_PROXY=[2001:db8::2]:1080

Then perform a request with fetch(1).

(note by kevans)
I've since been informed that Void Linux/xbps has a fork of libfetch that
also implements SOCKS5. I may compare/contrast the two in the mid-to-near
future.

Submitted by: Farhan Khan <farhan farhan codes>
Differential Revision: https://reviews.freebsd.org/D18908

show more ...

Merge ^/head r351317 through r351731.

Document fetchReqHTTP().

Submitted by: Farhan Khan <khanzf@gmail.com>
Reviewed by: 0mp
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D18788

MFH

Sponsored by: The FreeBSD Foundation

Fix bunch of .Xrs.

MFC after: 1 month
Sponsored by: The FreeBSD Foundation

Update fetch.1 and fetch.3 to reflect libfetch's actual use of CA bundles

Reviewed by: wblock
Approved by: wblock
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D5558

MFH r289384-r293170

Sponsored by: The FreeBSD Foundation

Catch up with head.

Use .netrc for HTTP sites and proxies, not just FTP.

PR: 193740
Submitted by: TEUBEL György <tgyurci@gmail.com>
MFC after: 1 week

Catch up with HEAD (r280229-r284686).

Merge sync of head

Merge from HEAD

MFH: r278968-r280640

Sponsored by: The FreeBSD Foundation

Remove defunct SSLv2 support from fetch(1) and fetch(3).

Reintegrate head revisions r273096-r277147

Sponsored by: The FreeBSD Foundation

Merge from head@274682

Sync to HEAD@r274095.

IFC @r273206

As pointed out by several people, r273114 was incorrect: it unconditionally
disabled everything except TLS 1.0. Replace it with a more carefully
wrought patch:

- Switch the default for SSLv3 from

As pointed out by several people, r273114 was incorrect: it unconditionally
disabled everything except TLS 1.0. Replace it with a more carefully
wrought patch:

- Switch the default for SSLv3 from on to off
- Add environment variables to control TLS 1.1 and 1.2
- In verbose mode, report which version is used
- Update the man page to reflect these changes.

MFC after: 1 week

show more ...

IFC @r269962

Submitted by: Anish Gupta (akgupt3@gmail.com)