aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-04-29docs: minor polish to the bug bounty / security docsReed Loden
Closes #3811
2019-04-29CURL_MAX_INPUT_LENGTH: largest acceptable string input sizeDaniel Stenberg
This limits all accepted input strings passed to libcurl to be less than CURL_MAX_INPUT_LENGTH (8000000) bytes, for these API calls: curl_easy_setopt() and curl_url_set(). The 8000000 number is arbitrary picked and is meant to detect mistakes or abuse, not to limit actual practical use cases. By limiting the acceptable string lengths we also reduce the risk of integer overflows all over. NOTE: This does not apply to `CURLOPT_POSTFIELDS`. Test 1559 verifies. Closes #3805
2019-04-28curlver.h: use parenthesis in CURL_VERSION_BITS macroTseng Jun
Closes #3809
2019-04-27cmake: rename CMAKE_USE_DARWINSSL to CMAKE_USE_SECTRANSPSimon Warta
Closes https://github.com/curl/curl/pull/3769
2019-04-23ntlm: Missed pre-processor || (or) during rebase for cd15acd0Steve Holme
2019-04-23ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4Steve Holme
Just like we do for mbed TLS, use our local implementation of MD4 when OpenSSL doesn't support it. This allows a type-3 message to include the NT response.
2019-04-23INTERNALS: fix misindentation of ToC itemDaniel Gustafsson
Kerberos was incorrectly indented as a subsection under FTP, which is incorrect as they are both top level sections. A fix for this was first attempted in commit fef38a0898322f285401c5ff2f5e7c90dbf3be63 but that was a few paddles short of being complete.
2019-04-23INTERNALS: Add structs to ToCAron Bergman
Add the subsections under "Structs in libcurl" to the table of contents. Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
2019-04-23INTERNALS: Add code highlightingAron Bergman
Make all struct members under the Curl_handler section print in monospace font. Closes #3801 Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
2019-04-22docs/BUG-BOUNTY: bug bounty time [skip ci]Daniel Stenberg
Introducing the curl bug bounty program on hackerone. We now recommend filing security issues directly in the hackerone ticket system which only is readable to curl security team members. Assisted-by: Daniel Gustafsson Closes #3488
2019-04-22sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616Steve Holme
RFC 4616 specifies the authzid is optional in the client authentication message and that the server will derive the authorisation identity (authzid) from the authentication identity (authcid) when not specified by the client.
2019-04-22memdebug: fix variable nameGisle Vanem
Follow-up to 76b6348 which renamed logfile as curl_dbg_logfile. Ref: https://github.com/curl/curl/commit/76b6348#r33259088
2019-04-21vauth/cleartext: Don't send the authzid if it is emptySteve Holme
Follow up to 762a292f.
2019-04-21test 196,197,198: add 'retry' keyword [skip ci]Daniel Stenberg
2019-04-21RELEASE-NOTES: syncedDaniel Stenberg
2019-04-21CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuseDaniel Stenberg
... and disconnect too old ones instead of trying to reuse. Default max age is set to 118 seconds. Ref: #3722 Closes #3782
2019-04-20altsvc: Fix building with cookies disablesPo-Chuan Hsieh
ALTSVC requires Curl_get_line which is defined in lib/cookie.c inside a #if check of HTTP and COOKIES. That makes Curl_get_line undefined if COOKIES is disabled. Fix by splitting out the function into a separate file which can be included where needed. Closes #3717 Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>
2019-04-20test1002: correct the name [skip ci]Daniel Stenberg
2019-04-20test660: verify CONNECT_ONLY with IMAPDaniel Stenberg
which basically just makes sure LOGOUT is *not* issued on disconnect
2019-04-20Curl_disconnect: treat all CONNECT_ONLY connections as "dead"Daniel Stenberg
Since the connection has been used by the "outside" we don't know the state of it anymore and curl should not use it anymore. Bug: https://curl.haxx.se/mail/lib-2019-04/0052.html Closes #3795
2019-04-19multi: fix the statenames (follow-up fix from 2f44e94efb3df8e)Daniel Stenberg
The list of names must be in sync with the defined states in the header file!
2019-04-16openvms: Remove pre-processors for Windows as VMS cannot support themSteve Holme
2019-04-16openvms: Remove pre-processor for SecureTransport as VMS cannot support itSteve Holme
Fixes #3768 Closes #3785
2019-04-16TODO: Add issue link to an existing entryJay Satiro
2019-04-16RELEASE-NOTES: syncedDaniel Stenberg
2019-04-16tool_help: Warn if curl and libcurl versions do not matchJay Satiro
.. because functionality may be affected if the versions differ. This commit implements TODO 18.7 "warning if curl version is not in sync with libcurl version". Ref: https://github.com/curl/curl/blob/curl-7_64_1/docs/TODO#L1028-L1033 Closes https://github.com/curl/curl/pull/3774
2019-04-16md5: Update the function signature following d84da52dSteve Holme
2019-04-15md5: Forgot to update the code alignment in d84da52dSteve Holme
2019-04-15md5: Return CURLcode from the internally accessible functionsSteve Holme
Following 28f826b3 to return CURLE_OK instead of numeric 0.
2019-04-15tests: Run global cleanup at end of testsDaniel Gustafsson
Make sure to run curl_global_cleanup() when shutting down the test suite to release any resources allocated in the SSL setup. This is clearly visible when running tests with PolarSSL where the thread lock calloc() memory which isn't released when not running cleanup. Below is an excerpt from the autobuild logs: ==12368== 96 bytes in 1 blocks are possibly lost in loss record 1 of 2 ==12368== at 0x4837B65: calloc (vg_replace_malloc.c:752) ==12368== by 0x11A76E: curl_dbg_calloc (memdebug.c:205) ==12368== by 0x145CDF: Curl_polarsslthreadlock_thread_setup (polarssl_threadlock.c:54) ==12368== by 0x145B37: Curl_polarssl_init (polarssl.c:865) ==12368== by 0x14129D: Curl_ssl_init (vtls.c:171) ==12368== by 0x118B4C: global_init (easy.c:158) ==12368== by 0x118BF5: curl_global_init (easy.c:221) ==12368== by 0x118D0B: curl_easy_init (easy.c:299) ==12368== by 0x114E96: test (lib1906.c:32) ==12368== by 0x115495: main (first.c:174) Closes #3783 Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com> Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2019-04-15travis: use mbedtls from XenialMarcel Raad
No need to build it from source anymore. Closes https://github.com/curl/curl/pull/3779
2019-04-15travis: use libpsl from XenialMarcel Raad
This makes building libpsl and libidn2 from source unnecessary and removes the need for the autopoint and libunistring-dev packages. Closes https://github.com/curl/curl/pull/3779
2019-04-15runtests: start socksd like other serversDaniel Stenberg
... without a $srcdir prefix. Triggered by the failures in several autobuilds. Closes #3781
2019-04-14socksd: Fix typosDaniel Gustafsson
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2019-04-14socksd: Properly decorate static variablesDaniel Gustafsson
Mark global variables static to avoid compiler warning in Clang when using -Wmissing-variable-declarations. Closes #3778 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2019-04-14md(4|5): Fixed indentation oddities with the importation of replacement codeSteve Holme
The indentation from 211d5329 and 57d6d253 was a little strange as parts didn't align correctly, uses 4 spaces rather than 2. Checked the indentation of the original source so it aligns, albeit, using curl style.
2019-04-14md5: Code style to return CURLE_OK rather than numeric 0Steve Holme
2019-04-14md5: Corrected code style for some pointer argumentsSteve Holme
2019-04-13travis: update some builds to xenialMarcel Raad
Xenial comes with more up-to-date software versions and more available packages, some of which we currently build from source. Unfortunately, some builds would fail with Xenial because of assertion failures in Valgrind when using OpenSSL, so leave these at Trusty. Closes https://github.com/curl/curl/pull/3777
2019-04-13test: make tests and test scripts use socksd for SOCKSDaniel Stenberg
Make all SOCKS tests use socksd instead of ssh.
2019-04-13socksd: new SOCKS 4+5 server for testsDaniel Stenberg
Closes #3752
2019-04-13singleipconnect: show port in the verbose "Trying ..." messageDaniel Stenberg
To aid debugging better.
2019-04-13CURLOPT_ADDRESS_SCOPE: fix range check and moretmilburn
Commit 9081014 fixed most of the confusing issues between scope id and scope however 844896d added bad limits checking assuming that the scope is being set and not the scope id. I have fixed the documentation so it all refers to scope ids. In addition Curl_if2ip refered to the scope id as remote_scope_id which is incorrect, so I renamed it to local_scope_id. Adjusted-by: Daniel Stenberg Closes #3655 Closes #3765 Fixes #3713
2019-04-13urlapi: stricter CURLUPART_PORT parsingDaniel Stenberg
Only allow well formed decimal numbers in the input. Document that the number MUST be between 1 and 65535. Add tests to test 1560 to verify the above. Ref: https://github.com/curl/curl/issues/3753 Closes #3762
2019-04-13winbuild: Support MultiSSL buildsJan-E
- Remove the lines in winbuild/Makefile.vc that generate an error with multiple SSL backends. - Add /DCURL_WITH_MULTI_SSL in winbuild/MakefileBuild.vc if multiple SSL backends are set. Closes https://github.com/curl/curl/pull/3772
2019-04-12travis: remove mesalink builds (temporarily?)Daniel Stenberg
Since the mesalink build started to fail on travis, even though we build a fixed release version, we disable it to prevent it from blocking progress. Closes #3767
2019-04-12openssl: mark connection for close on TLS close_notifyDaniel Stenberg
Without this, detecting and avoid reusing a closed TLS connection (without a previous GOAWAY) when doing HTTP/2 is tricky. Reported-by: Tom van der Woerdt Fixes #3750 Closes #3763
2019-04-12RELEASE-NOTES: syncedDaniel Stenberg
2019-04-11vauth/cleartext: Update the PLAIN login function signature to match RFC 4616Steve Holme
Functionally this doesn't change anything as we still use the username for both the authorisation identity and the authentication identity. Closes #3757
2019-04-11test1906: verify CURLOPT_CURLU + CURLOPT_PORT usageDaniel Stenberg
Based-on-code-by: Poul T Lomholt
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-22 13:03:58 +0000