aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-05-10vauth: Fix incorrect function description for Curl_auth_user_contains_domain()Steve Holme
...and misalignment of these comments. From a78c61a4. Closes #3860
2019-05-10Revert "multi: support verbose conncache closure handle"Jay Satiro
This reverts commit b0972bc. - No longer show verbose output for the conncache closure handle. The offending commit was added so that the conncache closure handle would inherit verbose mode from the user's easy handle. (Note there is no way for the user to set options for the closure handle which is why that was necessary.) Other debug settings such as the debug function were not also inherited since we determined that could lead to crashes if the user's per-handle private data was used on an unexpected handle. The reporter here says he has a debug function to capture the verbose output, and does not expect or want any output to stderr; however because the conncache closure handle does not inherit the debug function the verbose output for that handle does go to stderr. There are other plausible scenarios as well such as the user redirects stderr on their handle, which is also not inherited since it could lead to crashes when used on an unexpected handle. Short of allowing the user to set options for the conncache closure handle I don't think there's much we can safely do except no longer inherit the verbose setting. Bug: https://curl.haxx.se/mail/lib-2019-05/0021.html Reported-by: Kristoffer Gleditsch Ref: https://github.com/curl/curl/pull/3598 Ref: https://github.com/curl/curl/pull/3618 Closes https://github.com/curl/curl/pull/3856
2019-05-10ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup()Steve Holme
From 6012fa5a. Closes #3858
2019-05-09BUG-BOUNTY: minor formatting fixes [ci skip]Daniel Stenberg
2019-05-09RELEASE-NOTES: syncedDaniel Stenberg
2019-05-09BUG-BOUNTY.md: add the Dropbox "bonus" extra payout ability [ci skip]Daniel Stenberg
Closes #3839
2019-05-09http_negotiate: do not treat failure of gss_init_sec_context() as fatalKamil Dudka
Fixes #3726 Closes #3849
2019-05-09spnego_gssapi: fix return code on gss_init_sec_context() failureKamil Dudka
Fixes #3726 Closes #3849
2019-05-09gen_resp_file.bat: Removed unnecessary @ from all but the first commandSteve Holme
There is need to use @ on every command once echo has been turned off. Closes #3854
2019-05-08http: Ignore HTTP/2 prior knowledge setting for HTTP proxiesJay Satiro
- Do not switch to HTTP/2 for an HTTP proxy that is not tunnelling to the destination host. We already do something similar for HTTPS proxies by not sending h2. [1] Prior to this change setting CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE would incorrectly use HTTP/2 to talk to the proxy, which is not something we support (yet?). Also it's debatable whether or not that setting should apply to HTTP/2 proxies. [1]: https://github.com/curl/curl/commit/17c5d05 Bug: https://github.com/curl/curl/issues/3570 Bug: https://github.com/curl/curl/issues/3832 Closes https://github.com/curl/curl/pull/3853
2019-05-08travis: update mesalink build to xenialMarcel Raad
Closes https://github.com/curl/curl/pull/3842
2019-05-08OpenSSL: Report -fips in version if OpenSSL is built with FIPSRicky Leverence
Older versions of OpenSSL report FIPS availabilty via an OPENSSL_FIPS define. It uses this define to determine whether to publish -fips at the end of the version displayed. Applications that utilize the version reported by OpenSSL will see a mismatch if they compare it to what curl reports, as curl is not modifying the version in the same way. This change simply adds a check to see if OPENSSL_FIPS is defined, and will alter the reported version to match what OpenSSL itself provides. This only appears to be applicable in versions of OpenSSL <1.1.1 Closes #3771
2019-05-07nss: allow fifos and character devices for certificates.Frank Gevaerts
Currently you can do things like --cert <(cat ./cert.crt) with (at least) the openssl backend, but that doesn't work for nss because is_file rejects fifos. I don't actually know if this is sufficient, nss might do things internally (like seeking back) that make this not work, so actual testing is needed. Closes #3807
2019-05-06test2100: Fix typos in test descriptionDaniel Gustafsson
2019-05-06ssh: define USE_SSH if SSH is enabled (any backend)Daniel Stenberg
Closes #3846
2019-05-05winbuild: Add our standard copyright header to the winbuild batch filesSteve Holme
2019-05-05makedebug: Fix ERRORLEVEL detection after running where.exeSteve Holme
Closes #3838
2019-05-05urlapi: add CURLUPART_ZONEID to set and getDaniel Stenberg
The zoneid can be used with IPv6 numerical addresses. Updated test 1560 to verify. Closes #3834
2019-05-05WRITEFUNCTION: add missing set_in_callback around callbackTaiyu Len
Closes #3837
2019-05-04RELEASE-NOTES: syncedDaniel Stenberg
2019-05-03CURLMOPT_TIMERFUNCTION.3: warn about the recursive risk [ci skip]Daniel Stenberg
Reported-by: Ricardo Gomes Bug: #3537 Closes #3836
2019-05-03CURLOPT_CHUNK_BGN_FUNCTION.3: document the struct and time valueDaniel Stenberg
The time field in the curl_fileinfo struct will always be zero. No code was ever implemented to actually convert the date string to a time_t. Fixes #3829 Closes #3835
2019-05-03OS400/ccsidcurl.c: code style fixesDaniel Stenberg
2019-05-03OS400/ccsidcurl: replace use of Curl_vsetoptDaniel Stenberg
(and make the code style comply) Fixes #3833
2019-05-03urlapi: strip off scope id from numerical IPv6 addressesDaniel Stenberg
... to make the host name "usable". Store the scope id and put it back when extracting a URL out of it. Also makes curl_url_set() syntax check CURLUPART_HOST. Fixes #3817 Closes #3822
2019-05-02RELEASE-NOTES: syncedDaniel Stenberg
2019-05-02multiif.h: remove unused protosDaniel Stenberg
... for functions related to pipelining. Those functions were removed in 2f44e94efb3df. Closes #3828
2019-05-01travis: mesalink: temporarily disable test 3001Yiming Jing
... due to SHA-1 signatures in test certs
2019-05-01travis: upgrade the MesaLink TLS backend to v1.0.0Yiming Jing
Closes #3823 Closes #3776
2019-05-01ConnectionExists: improve non-multiplexing use caseDaniel Stenberg
- better log output - make sure multiplex is enabled for it to be used
2019-05-01multi: provide Curl_multiuse_state to update informationDaniel Stenberg
As soon as a TLS backend gets ALPN conformation about the specific HTTP version it can now set the multiplex situation for the "bundle" and trigger moving potentially queued up transfers to the CONNECT state.
2019-05-01process_pending_handles: mark queued transfers as previously pendingDaniel Stenberg
With transfers being queued up, we only move one at a a time back to the CONNECT state but now we mark moved transfers so that when a moved transfer is confirmed "successful" (it connected) it will trigger the move of another pending transfer. Previously, it would otherwise wait until the transfer was done before doing this. This makes queued up pending transfers get processed (much) faster.
2019-05-01http: mark bundle as not for multiuse on < HTTP/2 responseDaniel Stenberg
Fixes #3813 Closes #3815
2019-05-01cookie: Guard against possible NULL ptr derefDaniel Gustafsson
In case the name pointer isn't set (due to memory pressure most likely) we need to skip the prefix matching and reject with a badcookie to avoid a possible NULL pointer dereference. Closes #3820 #3821 Reported-by: Jonathan Moerman Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2019-04-30os400: Add CURLOPT_MAXAGE_CONN to ILE/RPG bindingsPatrick Monnerat
2019-04-29nss: provide more specific error messages on failed initKamil Dudka
Closes #3808
2019-04-29docs: minor polish to the bug bounty / security docsReed Loden
Closes #3811
2019-04-29CURL_MAX_INPUT_LENGTH: largest acceptable string input sizeDaniel Stenberg
This limits all accepted input strings passed to libcurl to be less than CURL_MAX_INPUT_LENGTH (8000000) bytes, for these API calls: curl_easy_setopt() and curl_url_set(). The 8000000 number is arbitrary picked and is meant to detect mistakes or abuse, not to limit actual practical use cases. By limiting the acceptable string lengths we also reduce the risk of integer overflows all over. NOTE: This does not apply to `CURLOPT_POSTFIELDS`. Test 1559 verifies. Closes #3805
2019-04-28curlver.h: use parenthesis in CURL_VERSION_BITS macroTseng Jun
Closes #3809
2019-04-27cmake: rename CMAKE_USE_DARWINSSL to CMAKE_USE_SECTRANSPSimon Warta
Closes https://github.com/curl/curl/pull/3769
2019-04-23ntlm: Missed pre-processor || (or) during rebase for cd15acd0Steve Holme
2019-04-23ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4Steve Holme
Just like we do for mbed TLS, use our local implementation of MD4 when OpenSSL doesn't support it. This allows a type-3 message to include the NT response.
2019-04-23INTERNALS: fix misindentation of ToC itemDaniel Gustafsson
Kerberos was incorrectly indented as a subsection under FTP, which is incorrect as they are both top level sections. A fix for this was first attempted in commit fef38a0898322f285401c5ff2f5e7c90dbf3be63 but that was a few paddles short of being complete.
2019-04-23INTERNALS: Add structs to ToCAron Bergman
Add the subsections under "Structs in libcurl" to the table of contents. Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
2019-04-23INTERNALS: Add code highlightingAron Bergman
Make all struct members under the Curl_handler section print in monospace font. Closes #3801 Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
2019-04-22docs/BUG-BOUNTY: bug bounty time [skip ci]Daniel Stenberg
Introducing the curl bug bounty program on hackerone. We now recommend filing security issues directly in the hackerone ticket system which only is readable to curl security team members. Assisted-by: Daniel Gustafsson Closes #3488
2019-04-22sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616Steve Holme
RFC 4616 specifies the authzid is optional in the client authentication message and that the server will derive the authorisation identity (authzid) from the authentication identity (authcid) when not specified by the client.
2019-04-22memdebug: fix variable nameGisle Vanem
Follow-up to 76b6348 which renamed logfile as curl_dbg_logfile. Ref: https://github.com/curl/curl/commit/76b6348#r33259088
2019-04-21vauth/cleartext: Don't send the authzid if it is emptySteve Holme
Follow up to 762a292f.
2019-04-21test 196,197,198: add 'retry' keyword [skip ci]Daniel Stenberg
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-05 02:30:58 +0000