aboutsummaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2019-05-08http: Ignore HTTP/2 prior knowledge setting for HTTP proxiesJay Satiro
- Do not switch to HTTP/2 for an HTTP proxy that is not tunnelling to the destination host. We already do something similar for HTTPS proxies by not sending h2. [1] Prior to this change setting CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE would incorrectly use HTTP/2 to talk to the proxy, which is not something we support (yet?). Also it's debatable whether or not that setting should apply to HTTP/2 proxies. [1]: https://github.com/curl/curl/commit/17c5d05 Bug: https://github.com/curl/curl/issues/3570 Bug: https://github.com/curl/curl/issues/3832 Closes https://github.com/curl/curl/pull/3853
2019-05-08OpenSSL: Report -fips in version if OpenSSL is built with FIPSRicky Leverence
Older versions of OpenSSL report FIPS availabilty via an OPENSSL_FIPS define. It uses this define to determine whether to publish -fips at the end of the version displayed. Applications that utilize the version reported by OpenSSL will see a mismatch if they compare it to what curl reports, as curl is not modifying the version in the same way. This change simply adds a check to see if OPENSSL_FIPS is defined, and will alter the reported version to match what OpenSSL itself provides. This only appears to be applicable in versions of OpenSSL <1.1.1 Closes #3771
2019-05-07nss: allow fifos and character devices for certificates.Frank Gevaerts
Currently you can do things like --cert <(cat ./cert.crt) with (at least) the openssl backend, but that doesn't work for nss because is_file rejects fifos. I don't actually know if this is sufficient, nss might do things internally (like seeking back) that make this not work, so actual testing is needed. Closes #3807
2019-05-06ssh: define USE_SSH if SSH is enabled (any backend)Daniel Stenberg
Closes #3846
2019-05-05urlapi: add CURLUPART_ZONEID to set and getDaniel Stenberg
The zoneid can be used with IPv6 numerical addresses. Updated test 1560 to verify. Closes #3834
2019-05-05WRITEFUNCTION: add missing set_in_callback around callbackTaiyu Len
Closes #3837
2019-05-03urlapi: strip off scope id from numerical IPv6 addressesDaniel Stenberg
... to make the host name "usable". Store the scope id and put it back when extracting a URL out of it. Also makes curl_url_set() syntax check CURLUPART_HOST. Fixes #3817 Closes #3822
2019-05-02multiif.h: remove unused protosDaniel Stenberg
... for functions related to pipelining. Those functions were removed in 2f44e94efb3df. Closes #3828
2019-05-01travis: upgrade the MesaLink TLS backend to v1.0.0Yiming Jing
Closes #3823 Closes #3776
2019-05-01ConnectionExists: improve non-multiplexing use caseDaniel Stenberg
- better log output - make sure multiplex is enabled for it to be used
2019-05-01multi: provide Curl_multiuse_state to update informationDaniel Stenberg
As soon as a TLS backend gets ALPN conformation about the specific HTTP version it can now set the multiplex situation for the "bundle" and trigger moving potentially queued up transfers to the CONNECT state.
2019-05-01process_pending_handles: mark queued transfers as previously pendingDaniel Stenberg
With transfers being queued up, we only move one at a a time back to the CONNECT state but now we mark moved transfers so that when a moved transfer is confirmed "successful" (it connected) it will trigger the move of another pending transfer. Previously, it would otherwise wait until the transfer was done before doing this. This makes queued up pending transfers get processed (much) faster.
2019-05-01http: mark bundle as not for multiuse on < HTTP/2 responseDaniel Stenberg
Fixes #3813 Closes #3815
2019-05-01cookie: Guard against possible NULL ptr derefDaniel Gustafsson
In case the name pointer isn't set (due to memory pressure most likely) we need to skip the prefix matching and reject with a badcookie to avoid a possible NULL pointer dereference. Closes #3820 #3821 Reported-by: Jonathan Moerman Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2019-04-29nss: provide more specific error messages on failed initKamil Dudka
Closes #3808
2019-04-29CURL_MAX_INPUT_LENGTH: largest acceptable string input sizeDaniel Stenberg
This limits all accepted input strings passed to libcurl to be less than CURL_MAX_INPUT_LENGTH (8000000) bytes, for these API calls: curl_easy_setopt() and curl_url_set(). The 8000000 number is arbitrary picked and is meant to detect mistakes or abuse, not to limit actual practical use cases. By limiting the acceptable string lengths we also reduce the risk of integer overflows all over. NOTE: This does not apply to `CURLOPT_POSTFIELDS`. Test 1559 verifies. Closes #3805
2019-04-27cmake: rename CMAKE_USE_DARWINSSL to CMAKE_USE_SECTRANSPSimon Warta
Closes https://github.com/curl/curl/pull/3769
2019-04-23ntlm: Missed pre-processor || (or) during rebase for cd15acd0Steve Holme
2019-04-23ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4Steve Holme
Just like we do for mbed TLS, use our local implementation of MD4 when OpenSSL doesn't support it. This allows a type-3 message to include the NT response.
2019-04-22sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616Steve Holme
RFC 4616 specifies the authzid is optional in the client authentication message and that the server will derive the authorisation identity (authzid) from the authentication identity (authcid) when not specified by the client.
2019-04-22memdebug: fix variable nameGisle Vanem
Follow-up to 76b6348 which renamed logfile as curl_dbg_logfile. Ref: https://github.com/curl/curl/commit/76b6348#r33259088
2019-04-21vauth/cleartext: Don't send the authzid if it is emptySteve Holme
Follow up to 762a292f.
2019-04-21CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuseDaniel Stenberg
... and disconnect too old ones instead of trying to reuse. Default max age is set to 118 seconds. Ref: #3722 Closes #3782
2019-04-20altsvc: Fix building with cookies disablesPo-Chuan Hsieh
ALTSVC requires Curl_get_line which is defined in lib/cookie.c inside a #if check of HTTP and COOKIES. That makes Curl_get_line undefined if COOKIES is disabled. Fix by splitting out the function into a separate file which can be included where needed. Closes #3717 Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>
2019-04-20Curl_disconnect: treat all CONNECT_ONLY connections as "dead"Daniel Stenberg
Since the connection has been used by the "outside" we don't know the state of it anymore and curl should not use it anymore. Bug: https://curl.haxx.se/mail/lib-2019-04/0052.html Closes #3795
2019-04-19multi: fix the statenames (follow-up fix from 2f44e94efb3df8e)Daniel Stenberg
The list of names must be in sync with the defined states in the header file!
2019-04-16md5: Update the function signature following d84da52dSteve Holme
2019-04-15md5: Forgot to update the code alignment in d84da52dSteve Holme
2019-04-15md5: Return CURLcode from the internally accessible functionsSteve Holme
Following 28f826b3 to return CURLE_OK instead of numeric 0.
2019-04-14md(4|5): Fixed indentation oddities with the importation of replacement codeSteve Holme
The indentation from 211d5329 and 57d6d253 was a little strange as parts didn't align correctly, uses 4 spaces rather than 2. Checked the indentation of the original source so it aligns, albeit, using curl style.
2019-04-14md5: Code style to return CURLE_OK rather than numeric 0Steve Holme
2019-04-14md5: Corrected code style for some pointer argumentsSteve Holme
2019-04-13singleipconnect: show port in the verbose "Trying ..." messageDaniel Stenberg
To aid debugging better.
2019-04-13CURLOPT_ADDRESS_SCOPE: fix range check and moretmilburn
Commit 9081014 fixed most of the confusing issues between scope id and scope however 844896d added bad limits checking assuming that the scope is being set and not the scope id. I have fixed the documentation so it all refers to scope ids. In addition Curl_if2ip refered to the scope id as remote_scope_id which is incorrect, so I renamed it to local_scope_id. Adjusted-by: Daniel Stenberg Closes #3655 Closes #3765 Fixes #3713
2019-04-13urlapi: stricter CURLUPART_PORT parsingDaniel Stenberg
Only allow well formed decimal numbers in the input. Document that the number MUST be between 1 and 65535. Add tests to test 1560 to verify the above. Ref: https://github.com/curl/curl/issues/3753 Closes #3762
2019-04-12openssl: mark connection for close on TLS close_notifyDaniel Stenberg
Without this, detecting and avoid reusing a closed TLS connection (without a previous GOAWAY) when doing HTTP/2 is tricky. Reported-by: Tom van der Woerdt Fixes #3750 Closes #3763
2019-04-11vauth/cleartext: Update the PLAIN login function signature to match RFC 4616Steve Holme
Functionally this doesn't change anything as we still use the username for both the authorisation identity and the authentication identity. Closes #3757
2019-04-11url: always clone the CUROPT_CURLU handleDaniel Stenberg
Since a few code paths actually update that data. Fixes #3753 Closes #3761 Reported-by: Poul T Lomholt
2019-04-11CURLOPT_DNS_USE_GLOBAL_CACHE: removeDaniel Stenberg
Remove the code too. The functionality has been disabled in code since 7.62.0. Setting this option will from now on simply be ignored and have no function. Closes #3654
2019-04-11build: fix Codacy/CppCheck warningsMarcel Raad
- remove unused variables - declare conditionally used variables conditionally - suppress unused variable warnings in the CMake tests - remove dead variable stores - consistently use WIN32 macro to detect Windows Closes https://github.com/curl/curl/pull/3739
2019-04-11polarssl_threadlock: remove conditionally unused codeMarcel Raad
Make functions no-ops if neither both USE_THREADS_POSIX and HAVE_PTHREAD_H nor both USE_THREADS_WIN32 and HAVE_PROCESS_H are defined. Previously, if only one of them was defined, there was either code compiled that did nothing useful or the wrong header included for the functions used. Also, move POLARSSL_MUTEX_T define to implementation file as it's not used externally. Closes https://github.com/curl/curl/pull/3739
2019-04-11emailL Added reference to RFC8314 for implicit TLSSteve Holme
2019-04-08socks: fix error messageDaniel Stenberg
2019-04-07socks5: user name and passwords must be shorter than 256Daniel Stenberg
bytes... since the protocol needs to store the length in a single byte field. Reported-by: XmiliaH on github Fixes #3737 Closes #3740
2019-04-07urlapi: urlencode characters above 0x7f correctlyJakub Zakrzewski
fixes #3741 Closes #3742
2019-04-07multi_runsingle(): fix use-after-freeEven Rouault
Fixes #3745 Closes #3746 The following snippet ``` int main() { CURL* hCurlHandle = curl_easy_init(); curl_easy_setopt(hCurlHandle, CURLOPT_URL, "http://example.com"); curl_easy_setopt(hCurlHandle, CURLOPT_PROXY, "1"); curl_easy_perform(hCurlHandle); curl_easy_cleanup(hCurlHandle); return 0; } ``` triggers the following Valgrind warning ``` ==4125== Invalid read of size 8 ==4125== at 0x4E7D1EE: Curl_llist_remove (llist.c:97) ==4125== by 0x4E7EF5C: detach_connnection (multi.c:798) ==4125== by 0x4E80545: multi_runsingle (multi.c:1451) ==4125== by 0x4E8197C: curl_multi_perform (multi.c:2072) ==4125== by 0x4E766A0: easy_transfer (easy.c:625) ==4125== by 0x4E76915: easy_perform (easy.c:719) ==4125== by 0x4E7697C: curl_easy_perform (easy.c:738) ==4125== by 0x4008BE: main (in /home/even/curl/test) ==4125== Address 0x9b3d1d0 is 1,120 bytes inside a block of size 1,600 free'd ==4125== at 0x4C2ECF0: free (vg_replace_malloc.c:530) ==4125== by 0x4E62C36: conn_free (url.c:756) ==4125== by 0x4E62D34: Curl_disconnect (url.c:818) ==4125== by 0x4E48DF9: Curl_once_resolved (hostip.c:1097) ==4125== by 0x4E8052D: multi_runsingle (multi.c:1446) ==4125== by 0x4E8197C: curl_multi_perform (multi.c:2072) ==4125== by 0x4E766A0: easy_transfer (easy.c:625) ==4125== by 0x4E76915: easy_perform (easy.c:719) ==4125== by 0x4E7697C: curl_easy_perform (easy.c:738) ==4125== by 0x4008BE: main (in /home/even/curl/test) ==4125== Block was alloc'd at ==4125== at 0x4C2F988: calloc (vg_replace_malloc.c:711) ==4125== by 0x4E6438E: allocate_conn (url.c:1654) ==4125== by 0x4E685B4: create_conn (url.c:3496) ==4125== by 0x4E6968F: Curl_connect (url.c:4023) ==4125== by 0x4E802E7: multi_runsingle (multi.c:1368) ==4125== by 0x4E8197C: curl_multi_perform (multi.c:2072) ==4125== by 0x4E766A0: easy_transfer (easy.c:625) ==4125== by 0x4E76915: easy_perform (easy.c:719) ==4125== by 0x4E7697C: curl_easy_perform (easy.c:738) ==4125== by 0x4008BE: main (in /home/even/curl/test) ``` This has been bisected to commit 2f44e94 Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14109 Credit to OSS Fuzz
2019-04-06pipelining: removedDaniel Stenberg
As previously planned and documented in DEPRECATE.md, all pipelining code is removed. Closes #3651
2019-04-05ftplistparser: fix LGTM alert "Empty block without comment"Marcel Raad
Removing the block is consistent with line 954/957. Closes https://github.com/curl/curl/pull/3732
2019-04-05transfer: fix LGTM alert "Comparison is always true"Marcel Raad
Just remove the redundant condition, which also makes it clear that k->buf is always 0-terminated if this break is not hit. Closes https://github.com/curl/curl/pull/3732
2019-04-04smtp: fix compiler warningRikard Falkeborn
- Fix clang string-plus-int warning. Clang 8 warns about adding a string to an int does not append to the string. Indeed it doesn't, but that was not the intention either. Use array indexing as suggested to silence the warning. There should be no functional changes. (In other words clang warns about "foo"+2 but not &"foo"[2] so use the latter.) smtp.c:1221:29: warning: adding 'int' to a string does not append to the string [-Wstring-plus-int] eob = strdup(SMTP_EOB + 2); ~~~~~~~~~~~~~~~~^~~~ Closes https://github.com/curl/curl/pull/3729
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-09 13:22:10 +0000