aboutsummaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2014-01-12OpenSSL: deselect weak ciphers by defaultDaniel Stenberg
By default even recent versions of OpenSSL support and accept both "export strength" ciphers, small-bitsize ciphers as well as downright deprecated ones. This change sets a default cipher set that avoids the worst ciphers, and subsequently makes https://www.howsmyssl.com/a/check no longer grade curl/OpenSSL connects as 'Bad'. Bug: http://curl.haxx.se/bug/view.cgi?id=1323 Reported-by: Jeff Hodges
2014-01-12multi: remove MULTI_TIMEOUT_INACCURACYDaniel Stenberg
With the recently added timeout "reminder" functionality, there's no reason left for us to execute timeout code before the time is ripe. Simplifies the handling too. This will make the *TIMEOUT and *CONNECTTIMEOUT options more accurate again, which probably is most important when the *_MS versions are used. In multi_socket, make sure to update 'now' after having handled activity on a socket.
2014-01-10multi_socket: remind app if timeout didn't runDaniel Stenberg
BACKGROUND: We have learned that on some systems timeout timers are inaccurate and might occasionally fire off too early. To make the multi_socket API work with this, we made libcurl execute timeout actions a bit early too if they are within our MULTI_TIMEOUT_INACCURACY. (added in commit 2c72732ebf, present since 7.21.0) Switching everything to the multi API made this inaccuracy problem slightly more notable as now everyone can be affected. Recently (commit 21091549c02) we tweaked that inaccuracy value to make timeouts more accurate and made it platform specific. We also figured out that we have code at places that check for fixed timeout values so they MUST NOT run too early as then they will not trigger at all (see commit be28223f35 and a691e044705) - so there are definitately problems with running timeouts before they're supposed to run. (We've handled that so far by adding the inaccuracy margin to those specific timeouts.) The libcurl multi_socket API tells the application with a callback that a timeout expires in N milliseconds (and it explicitly will not tell it again for the same timeout), and the application is then supposed to call libcurl when that timeout expires. When libcurl subsequently gets called with curl_multi_socket_action(...CURL_SOCKET_TIMEOUT...), it knows that the application thinks the timeout expired - and alas, if it is within the inaccuracy level libcurl will run code handling that handle. If the application says CURL_SOCKET_TIMEOUT to libcurl and _isn't_ within the inaccuracy level, libcurl will not consider the timeout expired and it will not tell the application again since the timeout value is still the same. NOW: This change introduces a modified behavior here. If the application says CURL_SOCKET_TIMEOUT and libcurl finds no timeout code to run, it will inform the application about the timeout value - *again* even if it is the same timeout that it already told about before (although libcurl will of course tell it the updated time so that it'll still get the correct remaining time). This way, we will not risk that the application believes it has done its job and libcurl thinks the time hasn't come yet to run any code and both just sit waiting. This also allows us to decrease the MULTI_TIMEOUT_INACCURACY margin, but that will be handled in a separate commit. A repeated timeout update to the application risk that the timeout will then fire again immediately and we have what basically is a busy-loop until the time is fine even for libcurl. If that becomes a problem, we need to address it.
2014-01-10threaded-resolver: never use NULL hints with getaddrinfoDaniel Stenberg
The net effect of this bug as it appeared to users, would be that libcurl would timeout in the connect phase. When disabling IPv6 use but still using getaddrinfo, libcurl would wrongly not init the "hints" struct field in init_thread_sync() which would subsequently lead to a getaddrinfo() invoke with a zeroed hints with ai_socktype set to 0 instead of SOCK_STREAM. This would lead to different behaviors on different platforms but basically incorrect output. This code was introduced in 483ff1ca75cbea, released in curl 7.20.0. This bug became a problem now due to the happy eyeballs code and how libcurl now traverses the getaddrinfo() results differently. Bug: http://curl.haxx.se/mail/lib-2014-01/0061.html Reported-by: Fabian Frank Debugged-by: Fabian Frank
2014-01-09darwinssl: un-break Leopard build after PKCS#12 changeNick Zitzmann
It turns out errSecDecode wasn't defined in Leopard's headers. So we use the enum's value instead. Bug: http://curl.haxx.se/mail/lib-2013-12/0150.html Reported by: Abram Pousada
2014-01-08Curl_updateconninfo: don't do anything for UDP "connections"Daniel Stenberg
getpeername() doesn't work for UDP sockets since they're not connected Reported-by: Priyanka Shah Bug: http://curl.haxx.se/mail/archive-2014-01/0016.html
2014-01-08info: remove debug outputDaniel Stenberg
Removed some of the infof() calls that were added with the recent pipeline improvements but they're not useful to the vast majority of readers and the pipelining seems to fundamentaly work - the debugging outputs can easily be added there if debugging these functions is needed again.
2014-01-08trynextip: fix build for non-IPV6 capable systemsDaniel Stenberg
AF_INET6 may not exist then Patched-by: Iida Yosiaki Bug: http://curl.haxx.se/bug/view.cgi?id=1322
2014-01-07ConnectionExists: fix NTLM check for new connectionDaniel Stenberg
When the requested authentication bitmask includes NTLM, we cannot re-use a connection for another username/password as we then risk re-using NTLM (connection-based auth). This has the unfortunate downside that if you include NTLM as a possible auth, you cannot re-use connections for other usernames/passwords even if NTLM doesn't end up the auth type used. Reported-by: Paras S Patched-by: Paras S Bug: http://curl.haxx.se/mail/lib-2014-01/0046.html
2014-01-05mk-ca-bundle.pl: avoid warnings with -d without parameterDaniel Stenberg
2014-01-05mk-ca-bundle: introduces -d and warns about using this scriptLeif W
2014-01-05Makefile: Added missing WinSSL and x64 configurationsSteve Holme
2014-01-05multi.c: fix possible dereference of null pointerMarc Hoersken
2014-01-04Updated copyright year for recent changesSteve Holme
2014-01-04conncache.c: fix possible dereference of null pointerMarc Hoersken
2014-01-04FTP parselist: fix "total" parserDaniel Stenberg
A regression introduced in 7f3b87d8782eae1 (present in the 7.21.4 release) broke the total parser. Now skip the whitespace and the digits. Reported-by: Justin Maggard Bug: http://curl.haxx.se/mail/lib-2014-01/0019.html
2014-01-03Makefile.vc6: follow up fix for 11e8066 and 92b9ae5Marc Hoersken
2014-01-03progresscallback: make CURLE_ABORTED_BY_CALLBACK get returned betterDaniel Stenberg
When the progress callback returned 1 at a very early state, the code would not make CURLE_ABORTED_BY_CALLBACK get returned but the process would still be interrupted. In the HTTP case, this would then cause a CURLE_GOT_NOTHING to erroneously get returned instead. Reported-by: Petr Novak Bug: http://curl.haxx.se/bug/view.cgi?id=1318
2014-01-03pipeline: remove print_pipeline()Daniel Stenberg
This is a debug function only and serves no purpose in production code, it only slows things down. I left the code #ifdef'ed for possible future pipeline debugging. Also, this was a global function without proper namespace usage. Reported-by: He Qin Bug: http://curl.haxx.se/bug/view.cgi?id=1320
2014-01-03openssl: allow explicit sslv2 selectionDaniel Stenberg
If OpenSSL is built to support SSLv2 this brings back the ability to explicitly select that as a protocol level. Reported-by: Steve Holme Bug: http://curl.haxx.se/mail/lib-2014-01/0013.html
2014-01-02Updated copyright year for recent changesSteve Holme
2014-01-03vtls/nssg.h: fixed include references to moved fileMarc Hoersken
2014-01-02OpenSSL: Fix forcing SSLv3 connectionsBarry Abrahamson
Some feedback provided by byte_bucket on IRC pointed out that commit db11750cfa5b1 wasn’t really correct because it allows for “upgrading” to a newer protocol when it should be only allowing for SSLv3. This change fixes that. When SSLv3 connection is forced, don't allow SSL negotiations for newer versions. Feedback provided by byte_bucket in #curl. This behavior is also consistent with the other force flags like --tlsv1.1 which doesn't allow for TLSv1.2 negotiation, etc Feedback-by: byte_bucket Bug: http://curl.haxx.se/bug/view.cgi?id=1319
2014-01-02Trial to fix the nmake Makefile for vtls files.Guenter Knauf
2014-01-02Fix NetWare build for vtls files.Guenter Knauf
2014-01-01OpenSSL: Fix forcing SSLv3 connectionsBarry Abrahamson
Since ad34a2d5c87c7f4b14e8dded3 (present in 7.34.0 release) forcing SSLv3 will always return the error "curl: (35) Unsupported SSL protocol version" Can be replicated with `curl -I -3 https://www.google.com/`. This fix simply allows for v3 to be forced.
2013-12-31imap: Fixed line length warningSteve Holme
2013-12-31mprintf: Replaced internal usage of FORMAT_OFF_T and FORMAT_OFF_TUSteve Holme
Following commit 0aafd77fa4c6f2, replaced the internal usage of FORMAT_OFF_T and FORMAT_OFF_TU with the external versions that we expect API programmers to use. This negates the need for separate definitions which were subtly different under different platforms/compilers.
2013-12-30mprintf: Added support for I, I32 and I64 size specifiersSteve Holme
Added support to the built-in printf() replacement functions, for these non-ANSI extensions when compiling under Visual Studio, Borland, Watcom and MinGW. This fixes problems when generating libcurl source code that contains curl_off_t variables.
2013-12-28connect.c: Fixed compilation warningSteve Holme
warning: 'res' may be used uninitialized in this function
2013-12-28connect: Try all addresses in first connection attemptBjörn Stenberg
Fixes a bug when all addresses in the first family fail immediately, due to "Network unreachable" for example, curl would hang and never try the next address family. Iterate through all address families when to trying establish the first connection attempt. Bug: http://curl.haxx.se/bug/view.cgi?id=1315 Reported-by: Michal Górny and Anthony G. Basile
2013-12-27sendf.c: Fixed compilation warning from f2d234a4dd9bccSteve Holme
sendf.c:450:81: warning: Longer than 79 columns
2013-12-27FILE: Fixed sending of data would always return CURLE_WRITE_ERRORSteve Holme
Introduced in commit 2a4ee0d2215556 sending of data via the FILE protocol would always return CURLE_WRITE_ERROR regardless of whether CURL_WRITEFUNC_PAUSE was returned from the callback function or not.
2013-12-26FILE: we don't support paused transfers using this protocolDaniel Stenberg
Make sure that we detect such attempts and return a proper error code instead of silently handling this in problematic ways. Updated the documentation to mention this limitation. Bug: http://curl.haxx.se/bug/view.cgi?id=1286
2013-12-26vtls: Updated comments referencing sslgen.c and ssluse.cSteve Holme
2013-12-26vtls: Fixed up include of vtls.hSteve Holme
2013-12-25curl_dofree: allow free(NULL)Daniel Stenberg
Previously this memdebug free() replacement didn't properly work with a NULL argument which has made us write code that avoids calling free(NULL) - which causes some extra nuisance and unnecessary code. Starting now, we should allow free(NULL) even when built with the memdebug system enabled. free(NULL) is permitted by POSIX
2013-12-25Curl_thread_create: use Curl_safefree to allow NULL betterDaniel Stenberg
free() itself allows a NULL input but our memory debug system requires Curl_safefree() to be used instead when a "legitimate" NULL may be freed. Like in the code here. Pointed-out-by: Steve Holme
2013-12-25threaded resolver: Use pthread_t * for curl_thread_tLuke Dashjr
... since pthread_t may be non-scalar and/or may represent a real thread with scalar 0. Bug: http://curl.haxx.se/bug/view.cgi?id=1314
2013-12-24imap: Fixed auth preference not being honored when CAPABILITY not supportedSteve Holme
If a user indicated they preferred to authenticate using a SASL mechanism, but SASL authentication wasn't supported by the server, curl would always fall back to clear text when CAPABILITY wasn't supported, even though the user didn't want to use this.
2013-12-24pop3: Fixed auth preference not being honored when CAPA not supportedSteve Holme
If a user indicated they preferred to authenticate using APOP or a SASL mechanism, but neither were supported by the server, curl would always fall back to clear text when CAPA wasn't supported, even though the user didn't want to use this. This also fixes the auto build failure caused by commit 6f2d5f0562f64a.
2013-12-24Curl_pp_readresp: use memmove not memcpy, possibly overlapping areasDaniel Stenberg
Fixes commit 1deac31eba7
2013-12-24pop3: Fixed APOP being determined by CAPA response rather than by timestampSteve Holme
This commit replaces that of 9f260b5d6610f3 because according to RFC-2449, section 6, there is no APOP capability "...even though APOP is an optional command in [POP3]. Clients discover server support of APOP by the presence in the greeting banner of an initial challenge enclosed in angle brackets."
2013-12-22FILE: don't wait due to CURLOPT_MAX_RECV_SPEED_LARGEDaniel Stenberg
The FILE:// code doesn't support this option - and it doesn't make sense to support it as long as it works as it does since then it'd only block even longer. But: setting CURLOPT_MAX_RECV_SPEED_LARGE would make the transfer first get done and then libcurl would wait until the average speed would get low enough. This happened because the transfer happens completely in the DO state for FILE:// but then it would still unconditionally continue in to the PERFORM state where the speed check is made. Starting now, the code will skip from DO_DONE to DONE immediately if no socket is set to be recv()ed or send()ed to. Bug: http://curl.haxx.se/bug/view.cgi?id=1312 Reported-by: Mohammad AlSaleh
2013-12-22email: Fixed segfault introduced in commit 195b63f99c2fe3Steve Holme
2013-12-22code police: fix indent level to silence checksrc complaintsDaniel Stenberg
2013-12-21email: Extended the login options to support multiple auth mechanismsSteve Holme
2013-12-22Curl_pp_readresp: replace stupid loop with memcpyDaniel Stenberg
2013-12-22Curl_pp_readresp: zero terminate lineDaniel Stenberg
The comment in the code mentions the zero terminating after having copied data, but it mistakingly zero terminated the source data and not the destination! This caused the test 864 problem discussed on the list: http://curl.haxx.se/mail/lib-2013-12/0113.html Signed-off-by: Daniel Stenberg <daniel@haxx.se>
2013-12-21Revert "pop3: Added debug information to assist with test864 failure"Steve Holme
This reverts commit 727d798d680f29c8b3cb7d7f03d6b6a3eb4356da.