aboutsummaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2009-08-03indentation fixes onlyDaniel Stenberg
2009-08-03Reverted the zero-byte-in-name check to instead rely on the fact that strlenDaniel Stenberg
and the name length differ in those cases and thus leave the matching function unmodified from before, as the matching functions never have to bother with the zero bytes in legitimate cases. Peter Sylvester helped me realize that this fix is slightly better as it leaves more code unmodified and makes the detection a bit more obvious in the code.
2009-08-02Extended my embedded-zero-in-cert-name fix based on a comment from ScottDaniel Stenberg
Cantor. My previous attempt was half-baked and didn't cover the normal CN case.
2009-08-01- Curt Bogmine reported a problem with SNI enabled on a particular server. WeDaniel Stenberg
should introduce an option to disable SNI, but as we're in feature freeze now I've addressed the obvious bug here (pointed out by Peter Sylvester): we shouldn't try to enable SNI when SSLv2 or SSLv3 is explicitly selected. Code for OpenSSL and GnuTLS was fixed. NSS doesn't seem to have a particular option for SNI, or are we simply not using it?
2009-08-01- Scott Cantor posted the bug report #2829955Daniel Stenberg
(http://curl.haxx.se/bug/view.cgi?id=2829955) mentioning the recent SSL cert verification flaw found and exploited by Moxie Marlinspike. The presentation he did at Black Hat is available here: https://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Marlinspike Apparently at least one CA allowed a subjectAltName or CN that contain a zero byte, and thus clients that assumed they would never have zero bytes were exploited to OK a certificate that didn't actually match the site. Like if the name in the cert was "example.com\0theatualsite.com", libcurl would happily verify that cert for example.com. libcurl now better use the length of the extracted name, not assuming it is zero terminated.
2009-08-01- Tanguy Fautre pointed out that OpenSSL's function RAND_screen() (presentDaniel Stenberg
only in some OpenSSL installs - like on Windows) isn't thread-safe and we agreed that moving it to the global_init() function is a decent way to deal with this situation.
2009-08-01- Alexander Beedie provided the patch for a noproxy problem: If I have setDaniel Stenberg
CURLOPT_NOPROXY to "*", or to a host that should not use a proxy, I actually could still end up using a proxy if a proxy environment variable was set.
2009-07-27- All the quote options (CURLOPT_QUOTE, CURLOPT_POSTQUOTE andDaniel Stenberg
CURLOPT_PREQUOTE) now accept a preceeding asterisk before the command to send when using FTP, as a sign that libcurl shall simply ignore the response from the server instead of treating it as an error. Not treating a 400+ FTP response code as an error means that failed commands will not abort the chain of commands, nor will they cause the connection to get disconnected.
2009-07-27From: Johan van SelstDaniel Stenberg
"you replaced the old SSLeay_add_ssl_algorithms() call with OpenSSL_add_all_algorithms(), however unlike the name suggests, the second function is not a superset of the first. When using SSL both these functions will need to be called in order to offer complete functionality"
2009-07-26- Bug report #2825989 (http://curl.haxx.se/bug/view.cgi?id=2825989) pointedDaniel Stenberg
out that OpenSSL-powered libcurl didn't support the SHA-2 digest algorithm, and provided the solution too: to use OpenSSL_add_all_algorithms() instead of the older SSLeay_* alternative. OpenSSL_add_all_algorithms was added in OpenSSL 0.9.5
2009-07-24changes to silent compiler warnings with 64bit systems.Gunter Knauf
2009-07-24changes to silent compiler warnings with 64bit systems.Gunter Knauf
2009-07-23changes to silent compiler warnings with 64bit systems.Gunter Knauf
2009-07-23fixed brace error.Gunter Knauf
2009-07-23changes to silent compiler warnings with 64bit systems.Gunter Knauf
2009-07-23blocked sshkeycallback() with HAVE_LIBSSH2_KNOWNHOST_API to avoid compiler ↵Gunter Knauf
warnings.
2009-07-22- Added CURLOPT_SSH_KNOWNHOSTS, CURLOPT_SSH_KEYFUNCTION, CURLOPT_SSH_KEYDATA.Daniel Stenberg
They introduce known_host support for SSH keys to libcurl. See docs for details.
2009-07-22- David Binderman found a memory and fd leak in lib/gtls.c:load_file()Michal Marek
(https://bugzilla.novell.com/523919). When looking at the code, I found that also the ptr pointer can leak.
2009-07-20- Claes Jakobsson improved the support for client certificates handlingKamil Dudka
in NSS-powered libcurl. Now the client certificates can be selected automatically by a NSS built-in hook. Additionally pre-login to all PKCS11 slots is no more performed. It used to cause problems with HW tokens. - Fixed reference counting for NSS client certificates. Now the PEM reader module should be always properly unloaded on Curl_nss_cleanup(). If the unload fails though, libcurl will try to reuse the already loaded instance.
2009-07-16added a cast to silent compiler warning with 64bit systems.Gunter Knauf
2009-07-15Added nonblock.c to the non-automake makefiles (note that the dependenciesDan Fandrich
in the Watcom makefiles aren't quite correct).
2009-07-15fixed typo.Gunter Knauf
2009-07-14ENH: add optional support for c-aresBill Hoffman
2009-07-14ENH: move config.h.cmake to curl_config.h.cmake so it builds againBill Hoffman
2009-07-14ENH: add nonblock.c to build for CMakeBill Hoffman
2009-07-14renamed generated config.h to curl_config.h in order to avoid clashes when ↵Gunter Knauf
libcurl is used with other projects which also have a config.h.
2009-07-11silence a compiler warningDaniel Stenberg
2009-07-09add these new files to CVS as wellDaniel Stenberg
2009-07-09- Eric Wong introduced curlx_nonblock() that the curl tool now (re-)uses forDaniel Stenberg
setting a file descriptor non-blocking. Used by the functionality Eric himself brough on June 15th.
2009-07-08- Constantine Sapuntzakis posted bug report #2813123Daniel Stenberg
(http://curl.haxx.se/bug/view.cgi?id=2813123) and an a patch that fixes the problem: Url A is accessed using auth. Url A redirects to Url B (on a different server0. Url B reuses a persistent connection. Url B has auth, even though it's on a different server. Note: if Url B does not reuse a persistent connection, auth is not sent.
2009-07-04added INET_ADDRSTRLEN define in case system headers dont provide.Gunter Knauf
2009-07-04removed NIFLAGS which is no longer used; added NI_MAXHOST since its missing ↵Gunter Knauf
with some platforms.
2009-07-04Markus Koetter provided a patch to avoid getnameinfo() usage which broke a ↵Gunter Knauf
couple of both IPv4 and IPv6 autobuilds.
2009-06-30Tor Arntsen pointed out a missing #ifdef for IPv6, and I changed another oneDaniel Stenberg
to use the "standard" ENABLE_IPV6 one. Also, if port number cannot be figured out to connect to after a name resolve (due to it not being IPv4 or IPv6), that particular address will now simply be skipped.
2009-06-29- Markus Koetter made CURLOPT_FTPPORT (and curl's -P/--ftpport) support a portDaniel Stenberg
range if given colon-separated after the host name/address part. Like "192.168.0.1:2000-10000"
2009-06-29- Modified the separators used for CURLOPT_CERTINFO in multi-part outputs. IDaniel Stenberg
don't know how they got wrong in the first place, but using this output format makes it possible to quite easily separate the string into an array of multiple items.
2009-06-27Fixed a compiler warning.Dan Fandrich
2009-06-19fix indentation.Michal Marek
2009-06-19sclose() function-like macro definition used to close a socket,Yang Tse
now solely based on HAVE_CLOSESOCKET and HAVE_CLOSESOCKET_CAMEL config file preprocessor definitions.
2009-06-16- When doing non-anonymous ftp via http proxies and the password is notMichal Marek
provided in the url, add it there (squid needs this).
2009-06-15Replaced use of standard C library rand()/srand() by our own pseudo-random ↵Patrick Monnerat
number generator.
2009-06-15DEBUGBUILD / CURLDEBUG decoupling follow-upYang Tse
2009-06-15 DEBUGBUILD / CURLDEBUG decoupling follow-upYang Tse
2009-06-13improve usability with UNIX-like shells or a DOS command interpretersYang Tse
2009-06-12include <limits.h> for INT_MAX definitionYang Tse
2009-06-12fix compiler warningYang Tse
2009-06-11DOS adjustmentsYang Tse
2009-06-10- Fabian Keil ran clang on the (lib)curl code, found a bunch of warnings andDaniel Stenberg
contributed a range of patches to fix them.
2009-06-10Adjusted to take in account that...Yang Tse
With the curl memory tracking feature decoupled from the debug build feature, CURLDEBUG and DEBUGBUILD preprocessor symbol definitions are used as follows: CURLDEBUG used for curl debug memory tracking specific code (--enable-curldebug) DEBUGBUILD used for debug enabled specific code (--enable-debug)
2009-06-09ENH: lower case cmake functions and remove tabs and re-indent cmake codeBill Hoffman