aboutsummaryrefslogtreecommitdiff
path: root/lib/socks.c
AgeCommit message (Collapse)Author
2020-06-08socks: detect connection close during handshakeDaniel Stenberg
The SOCKS4/5 state machines weren't properly terminated when the proxy connection got closed, leading to a busy-loop. Reported-By: zloi-user on github Fixes #5532 Closes #5542
2020-06-08socks: remove unreachable breaks in socks.c and mime.cxquery
Closes #5537
2020-06-06timeouts: move ms timeouts to timediff_t from int and longMarc Hoersken
Now that all functions in select.[ch] take timediff_t instead of the limited int or long, we can remove type conversions and related preprocessor checks to silence compiler warnings. Avoiding conversions from time_t was already done in 842f73de. Based upon #5262 Supersedes #5214, #5220 and #5221 Follow up to #5343 and #5479 Closes #5490
2020-06-05socks: fix expected length of SOCKS5 replyCherish98
Commit 4a4b63d forgot to set the expected SOCKS5 reply length when the reply ATYP is X'01'. This resulted in erroneously expecting more bytes when the request length is greater than the reply length (e.g., when remotely resolving the hostname). Closes #5527
2020-05-19hostip: make Curl_printable_address not return anythingDaniel Stenberg
It was not used much anyway and instead we let it store a blank buffer in case of failure. Reported-by: MonocleAI Fixes #5411 Closes #5418
2020-05-15source cleanup: remove all custom typedef structsDaniel Stenberg
- Stick to a single unified way to use structs - Make checksrc complain on 'typedef struct {' - Allow them in tests, public headers and examples - Let MD4_CTX, MD5_CTX, and SHA256_CTX typedefs remain as they actually typedef different types/structs depending on build conditions. Closes #5338
2020-04-23select: make Curl_socket_check take timediff_t timeoutDaniel Stenberg
Coverity found CID 1461718: Integer handling issues (CONSTANT_EXPRESSION_RESULT) "timeout_ms > 9223372036854775807L" is always false regardless of the values of its operands. This occurs as the logical second operand of "||". Closes #5240
2020-04-12socks: Fix blocking timeout logicJay Satiro
- Document in Curl_timeleft's comment block that returning 0 signals no timeout (ie there's infinite time left). - Fix SOCKS' Curl_blockread_all for the case when no timeout was set. Prior to this change if the timeout had a value of 0 and that was passed to SOCKET_READABLE it would return right away instead of blocking. That was likely because it was not well understood that when Curl_timeleft returns 0 it is not a timeout of 0 ms but actually means no timeout. Ref: https://github.com/curl/curl/pull/5214#issuecomment-612512360 Closes https://github.com/curl/curl/pull/5220
2020-04-11lib: fix conversion warnings for SOCKET_WRITABLE/READABLEJay Satiro
- If loss of data may occur converting a timediff_t to time_t and the time value is > TIME_T_MAX then treat it as TIME_T_MAX. This is a follow-up to 8843678 which removed the (time_t) typecast from the macros so that conversion warnings could be identified. Closes https://github.com/curl/curl/pull/5199
2020-03-08socks4: fix host resolve regressionDaniel Stenberg
1. The socks4 state machine was broken in the host resolving phase 2. The code now insists on IPv4-only when using SOCKS4 as the protocol only supports that. Regression from #4907 and 4a4b63d, shipped in 7.69.0 Reported-by: amishmm on github Bug: https://github.com/curl/curl/issues/5053#issuecomment-596191594 Closes #5061
2020-03-07socks5: switch state properly when the resolve is doneDaniel Stenberg
Regression from 4a4b63d (and #4907) Reported-by: vitaha85 on github Fixes #5053 Closes #5056
2020-02-18SOCKS: fix typo in printf formattingDaniel Stenberg
Follow-up to 4a4b63daa Reported-by: Peter Piekarski Bug: https://github.com/curl/curl/commit/4a4b63daaa01ef59b131d91e8e6e6dfe275c0f08#r37351330
2020-02-17socks: make the connect phase non-blockingDaniel Stenberg
Removes two entries from KNOWN_BUGS. Closes #4907
2019-09-21socks: Fix destination host shown on SOCKS5 errorJay Satiro
Prior to this change when a server returned a socks5 connect error then curl would parse the destination address:port from that data and show it to the user as the destination: curld -v --socks5 10.0.3.1:1080 http://google.com:99 * SOCKS5 communication to google.com:99 * SOCKS5 connect to IPv4 172.217.12.206 (locally resolved) * Can't complete SOCKS5 connection to 253.127.0.0:26673. (1) curl: (7) Can't complete SOCKS5 connection to 253.127.0.0:26673. (1) That's incorrect because the address:port included in the connect error is actually a bind address:port (typically unused) and not the destination address:port. This fix changes curl to show the destination information that curl sent to the server instead: curld -v --socks5 10.0.3.1:1080 http://google.com:99 * SOCKS5 communication to google.com:99 * SOCKS5 connect to IPv4 172.217.7.14:99 (locally resolved) * Can't complete SOCKS5 connection to 172.217.7.14:99. (1) curl: (7) Can't complete SOCKS5 connection to 172.217.7.14:99. (1) curld -v --socks5-hostname 10.0.3.1:1080 http://google.com:99 * SOCKS5 communication to google.com:99 * SOCKS5 connect to google.com:99 (remotely resolved) * Can't complete SOCKS5 connection to google.com:99. (1) curl: (7) Can't complete SOCKS5 connection to google.com:99. (1) Ref: https://tools.ietf.org/html/rfc1928#section-6 Closes https://github.com/curl/curl/pull/4394
2019-05-11doh: disable DOH for the cases it doesn't workDaniel Stenberg
Due to limitations in Curl_resolver_wait_resolv(), it doesn't work for DOH resolves. This fix disables DOH for those. Limitation added to KNOWN_BUGS. Fixes #3850 Closes #3857
2019-04-08socks: fix error messageDaniel Stenberg
2019-04-07socks5: user name and passwords must be shorter than 256Daniel Stenberg
bytes... since the protocol needs to store the length in a single byte field. Reported-by: XmiliaH on github Fixes #3737 Closes #3740
2019-03-05source: fix two 'nread' may be used uninitialized warningsDaniel Stenberg
Both seem to be false positives but we don't like warnings. Closes #3646
2018-09-23whitespace fixesViktor Szakats
- replace tabs with spaces where possible - remove line ending spaces - remove double/triple newlines at EOF - fix a non-UTF-8 character - cleanup a few indentations/line continuations in manual examples Closes https://github.com/curl/curl/pull/3037
2018-09-22URL and mailmap updates, remove an obsolete directory [ci skip]Viktor Szakats
Closes https://github.com/curl/curl/pull/3031
2018-09-01all: s/int/size_t cleanupDaniel Stenberg
Assisted-by: Rikard Falkeborn Closes #2922
2018-06-11cppcheck: fix warningsMarian Klymov
- Get rid of variable that was generating false positive warning (unitialized) - Fix issues in tests - Reduce scope of several variables all over etc Closes #2631
2017-10-28Curl_timeleft: change return type to timediff_tDaniel Stenberg
returning 'time_t' is problematic when that type is unsigned and we return values less than zero to signal "already expired", used in several places in the code. Closes #2021
2017-09-18socks: fix incorrect port number in SOCKS4 error messageJay Satiro
Prior to this change it appears the SOCKS5 port parsing was erroneously used for the SOCKS4 error message, and as a result an incorrect port would be shown in the error message. Bug: https://github.com/curl/curl/issues/1892 Reported-by: Jackarain@users.noreply.github.com
2017-09-11code style: use spaces around plusesDaniel Stenberg
2017-09-11code style: use spaces around equals signsDaniel Stenberg
2017-06-28CURLOPT_SOCKS5_AUTH: allowed methods for SOCKS5 proxy authKamil Dudka
If libcurl was built with GSS-API support, it unconditionally advertised GSS-API authentication while connecting to a SOCKS5 proxy. This caused problems in environments with improperly configured Kerberos: a stock libcurl failed to connect, despite libcurl built without GSS-API connected fine using username and password. This commit introduces the CURLOPT_SOCKS5_AUTH option to control the allowed methods for SOCKS5 authentication at run time. Note that a new option was preferred over reusing CURLOPT_PROXYAUTH for compatibility reasons because the set of authentication methods allowed by default was different for HTTP and SOCKS5 proxies. Bug: https://curl.haxx.se/mail/lib-2017-01/0005.html Closes https://github.com/curl/curl/pull/1454
2017-06-28socks: deduplicate the code for auth requestKamil Dudka
2017-06-28socks: use proxy_user instead of proxy_nameKamil Dudka
... to make it obvious what the data is used for
2017-03-13Improve code readbilitySylvestre Ledru
... by removing the else branch after a return, break or continue. Closes #1310
2016-11-24checksrc: white space edits to comply to stricter checksrcDaniel Stenberg
2016-11-24proxy: Support HTTPS proxy and SOCKS+HTTP(s)Alex Rousskov
* HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
2016-11-18lib: fix compiler warnings after de4de4e3c7cMarcel Raad
Visual C++ now complains about implicitly casting time_t (64-bit) to long (32-bit). Fix this by changing some variables from long to time_t, or explicitly casting to long where the public interface would be affected. Closes #1131
2016-10-31strcasecompare: is the new name for strequal()Daniel Stenberg
... to make it less likely that we forget that the function actually does case insentive compares. Also replaced several invokes of the function with a plain strcmp when case sensitivity is not an issue (like comparing with "-").
2016-10-18select: switch to macros in uppercaseDaniel Stenberg
Curl_select_ready() was the former API that was replaced with Curl_select_check() a while back and the former arg setup was provided with a define (in order to leave existing code unmodified). Now we instead offer SOCKET_READABLE and SOCKET_WRITABLE for the most common shortcuts where only one socket is checked. They're also more visibly macros.
2016-08-20socks.c: display the hostname returned by the SOCKS5 proxy serverMarc Hoersken
Instead of displaying the requested hostname the one returned by the SOCKS5 proxy server is used in case of connection error. The requested hostname is displayed earlier in the connection sequence. The upper-value of the port is moved to a temporary variable and replaced with a 0-byte to make sure the hostname is 0-terminated.
2016-08-20socks.c: use Curl_printable_address in SOCKS5 connection sequenceMarc Hoersken
Replace custom string formatting with Curl_printable_address. Add additional debug and error output in case of failures.
2016-08-20socks.c: align SOCKS4 connection sequence with SOCKS5Marc Hoersken
Calling sscanf is not required since the raw IPv4 address is available and the protocol can be detected using ai_family.
2016-08-20socks.c: improve verbose output of SOCKS5 connection sequenceMarc Hoersken
2016-08-14socks.c: Correctly calculate position of port in response packetMarc Hoersken
Third commit to fix issue #944 regarding SOCKS5 error handling. Reported-by: David Kalnischkies
2016-08-14socks.c: Do not modify and invalidate calculated response lengthMarc Hoersken
Second commit to fix issue #944 regarding SOCKS5 error handling. Reported-by: David Kalnischkies
2016-08-14socks.c: Move error output after reading the whole response packetMarc Hoersken
First commit to fix issue #944 regarding SOCKS5 error handling. Reported-by: David Kalnischkies
2016-06-22internals: rename the SessionHandle struct to Curl_easyDaniel Stenberg
2016-04-03code: style updatesDaniel Stenberg
2016-02-03URLs: change all http:// URLs to https://Daniel Stenberg
2015-10-27socks: Fix incorrect port numbers in failed connect messagesJay Satiro
2015-09-26build: fix failures with -Wcast-align and -WerrorTatsuhiro Tsujikawa
Closes #457
2015-03-17checksrc: use space after commaDaniel Stenberg
2014-10-24code cleanup: we prefer 'CURLcode result'Daniel Stenberg
... for the local variable name in functions holding the return code. Using the same name universally makes code easier to read and follow. Also, unify code for checking for CURLcode errors with: if(result) or if(!result) instead of if(result == CURLE_OK), if(CURLE_OK == result) or if(result != CURLE_OK)
2014-10-04nonblock: call with (void) to show we ignore the return codeDaniel Stenberg
Coverity pointed out several of these.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 08:42:06 +0000