aboutsummaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2013-02-10Fix NULL pointer reference when closing an unused multi handle.Linus Nielsen Feltzing
2013-02-10email: Post STARTLS capability code tidy up (Part One)Steve Holme
Corrected the order of the CAPA / CAPABILITY state machine constants to match the execution order.
2013-02-10imap: Fixed memory leak following commit f6010d9a0359Steve Holme
2013-02-10smtp: Added support for the STARTTLS capability (Part Two)Steve Holme
Added honoring of the tls_supported flag when starting a TLS upgrade rather than unconditionally attempting it. If the use_ssl flag is set to CURLUSESSL_TRY and the server doesn't support TLS upgrades then the connection will continue to authenticate. If this flag is set to CURLUSESSL_ALL then the connection will complete with a failure as it did previously.
2013-02-10pop3: Added support for the STLS capability (Part Three)Steve Holme
Added honoring of the tls_supported flag when starting a TLS upgrade rather than unconditionally attempting it. If the use_ssl flag is set to CURLUSESSL_TRY and the server doesn't support TLS upgrades then the connection will continue to authenticate. If this flag is set to CURLUSESSL_ALL then the connection will complete with a failure as it did previously.
2013-02-10imap: Added support for the STARTTLS capability (Part Three)Steve Holme
Added honoring of the tls_supported flag when starting a TLS upgrade rather than unconditionally attempting it. If the use_ssl flag is set to CURLUSESSL_TRY and the server doesn't support TLS upgrades then the connection will continue to authenticate. If this flag is set to CURLUSESSL_ALL then the connection will complete with a failure as it did previously.
2013-02-10pop3: Added support for the STLS capability (Part Two)Steve Holme
Added sending of initial CAPA command before STLS is sent. This allows for the detection of the capability before trying to upgrade the connection.
2013-02-10imap: Added support for the STARTTLS capability (Part Two)Steve Holme
Added sending of initial CAPABILITY command before STARTTLS is sent. This allows for the detection of the capability before trying to upgrade the connection.
2013-02-10smtp: Added support for the STLS capability (Part One)Steve Holme
Introduced detection of the STARTTLS capability, in order to add support for TLS upgrades without unconditionally sending the STARTTLS command.
2013-02-10pop3: Added support for the STLS capability (Part One)Steve Holme
Introduced detection of the STLS capability, in order to add support for TLS upgrades without unconditionally sending the STLS command.
2013-02-10imap: Added support for the STARTTLS capability (Part One)Steve Holme
Introduced detection of the STARTTLS capability, in order to add support for TLS upgrades without unconditionally sending the STARTTLS command.
2013-02-09smtp: Fixed an issue when processing EHLO failure responses (Part 3)Steve Holme
Follow up fix to commit 62bd21746443 to cater for servers that don't respond with a 250 in their EHLO responses. Additionally updated the SMTP tests to respond with a 250 response code as per RFC5321.
2013-02-09pop3: Fixed SASL authentication capability detectionSteve Holme
Fixed the SASL capability detection to include the space character before the authentication mechanism list. Otherwise a capability such as SASLSOMETHING would be interpreted as enabling SASL and potentially trying to identify SOMETHING as a mechanism.
2013-02-09pop3: Fixed incorrect return value from pop3_endofresp()Steve Holme
Corrected an incorrect return value when -ERR is received from the server - introduced in commit b5bb61ee697b (June 2012).
2013-02-09smtp: Fixed an issue when processing EHLO failure responses (Part 2)Steve Holme
Follow up fix to commit 23d17190ee32 as EHLO capabilities can exist within a positive response line.
2013-02-09smtp: Fixed an issue with missing capabilities after the AUTH lineSteve Holme
Follow up to commit 40f9bb787f05 to fix missing capabilities after an AUTH line.
2013-02-08darwinssl: Make certificate errors less techyNick Zitzmann
Previously if a problem was found with one of the server's certificates, we'd log an OSStatus for the end user to look up. Now we explain what was wrong with the site's certificate chain. Also un-did part of the previous commit where the code wouldn't catch errSSLServerAuthCompleted if built under Leopard.
2013-02-09Updated dependency libs.Guenter Knauf
2013-02-09imap: Corrected some commentsSteve Holme
2013-02-09smtp: Fixed an issue when processing EHLO failure responsesSteve Holme
Fixed a small issue where smtp_endofresp() would look for capabilities in the description part of a failure response. In theory a server shouldn't respond with SIZE or AUTH in an EHLO command's failure response but if it did then capabilities would be unnecessarily set before eventually failing.
2013-02-08pop3: Reworked pop3_endofresp() to simplify it littleSteve Holme
Reworked pop3_endofresp() to simplify it and provide consistency between imap and smtp.
2013-02-08imap: Renamed state variables in imap_authenticate()Steve Holme
Renamed the authstate1 and authstate2 variables in imap_authenticate() as the old name was a left over from when there was only one state variable which was named due to a clash with the state() function. Additionally this provides consistency with the smtp module.
2013-02-08smtp: Reworked smtp_endofresp() to allow for extra capability detectionSteve Holme
2013-02-08smtp: Renamed smtp_state_auth_passwd_resp() functionSteve Holme
Renamed the login password response function to better describe it's purpose as well as for consistency with the imap and pop3 modules.
2013-02-08ntlm: fix memory leakGisle Vanem
Running tests\libtest\libntlmconnect.exe reveals a 1 byte (!) leak in ./lib/curl_ntlm_msgs.c: perl ..\memanalyze.pl c:memdebug.curl Leak detected: memory still allocated: 1 bytes At 9771e8, there's 1 bytes. allocated by curl_ntlm_msgs.c:399 Snippet from curl_ntlm_msgs.c: /* setup ntlm identity's domain and length */ dup_domain.tchar_ptr = malloc(sizeof(TCHAR) * (domlen + 1)); (my domlen == 0). 'dup_domain.tbyte_ptr' looks to be freed in Curl_ntlm_sspi_cleanup() via 'ntlm->identity.Domain'. But I see no freeing of 'dup_domain.tchar_ptr'.
2013-02-08DONE: consider callback-aborted transfers prematureDaniel Stenberg
This bug report properly identified that when doing SMTP and aborting the transfer with a callback, it must be considered aborted prematurely by the code to avoid QUIT etc to be attempted as that would cause a hang. The new test case 1507 verifies this behavior. Reported by: Patricia Muscalu Bug: http://curl.haxx.se/bug/view.cgi?id=1184
2013-02-07darwinssl: Fix build under LeopardNick Zitzmann
It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH ciphers in its headers, so the cases for them have been taken out of the build when building under Leopard. Also added a standard function for getting a string description of a SecCertificateRef.
2013-02-07imap: Added support for SASL-IR extension (Part 2)Steve Holme
Modified imap_authenticate() to add support for sending the initial response with the AUTHENTICATE command, as per RFC4959.
2013-02-07smtp: Updated SMTP_AUTH_PASSWD state constantSteve Holme
Changed the SMTP_AUTH_PASSWD state constant to SMTP_AUTH_LOGIN_PASSWD to better describe the state as the second part of an AUTH LOGIN command, as well as for consistency with the imap and pop3 modules.
2013-02-07imap: Added support for SASL-IR extension (Part 1)Steve Holme
Introduced detection of the SASL-IR capability, in order to add support for sending the initial response with the AUTHENTICATE command, as per RFC4959.
2013-02-07imap: Changed response tag generation to be completely uniqueSteve Holme
Updated the automatic response tag generation to follow the examples given in RC3501, which list a 4 character string such as A001, A002, etc. As a unique identifier should be generated for each command the string generation is based on the connection id and the incrementing command id.
2013-02-06imap: Small variable rename in preparation for upcoming changeSteve Holme
Renamed a couple of variables and updated some comments in preparation for upcoming command id / response tag change.
2013-02-06msvc: move Makefile.msvc.names into winbuild/Daniel Stenberg
In an attempt to clear up misc files from the root dir
2013-02-06email: Moved starttls code in separate functionsSteve Holme
To help maintain the readability of the code in imap.c, pop3.c and smtp.c moved the starttls code into state_starttls() functions.
2013-02-06vms: config-vms.h is removed, no use trying to distribute itDaniel Stenberg
2013-02-06Curl_sasl_create_digest_md5_message: fix buffer overflowEldar Zaitov
When negotiating SASL DIGEST-MD5 authentication, the function Curl_sasl_create_digest_md5_message() uses the data provided from the server without doing the proper length checks and that data is then appended to a local fixed-size buffer on the stack. This vulnerability can be exploited by someone who is in control of a server that a libcurl based program is accessing with POP3, SMTP or IMAP. For applications that accept user provided URLs, it is also thinkable that a malicious user would feed an application with a URL to a server hosting code targetting this flaw. Bug: http://curl.haxx.se/docs/adv_20130206.html
2013-02-06setup-vms.h: post VMS patch cleanup - IIIYang Tse
- rename post-config-vms.h to setup-vms.h - move its inclusion into proper location in curl_setup.h
2013-02-05imap.h: Corrected incorrect comment clarificationSteve Holme
Corrected comment clarification made in commit 167717b8069a.
2013-02-05VMS: fix and generate the VMS build configJohn E. Malmberg
config_h.com is a new file that generates a config.h file based on the curl_config.h.in file and a quick scan of the configure script. This is actually a generic procedure that is shared with other VMS packages. The existing pre-built config-vms.h had over 100 entries that were not correct and in some cases conflicted with the build options available in the build_vms.com. generate_config_vms_h_curl.com is a helper procedure to the config_h.com. It covers the cases that the generic config_h.com is not able to figure out, and accepts input from the build_vms.com procedure. build_curlbuild_h.com is a new file to generate the curlbuild.h file that Curl is now using when it is using a curl_config.h file. post-config-vms.h is a new file that is needed to provide VMS specific definitions, and most of them need to be set before the system header files are included. The VMS build procedure is fixed: 1. Fixed to link in the correct HP ssl library. 2. Fixed to detect if HP Kerberos is installed. 3. Fixed to detect if HP LDAP is installed. 4. Fixed to detect if gnv$libzshr is installed. 5. Simplified the input parameter parsing to not use a loop. 6. Warn that 64 bit pointer option support is not complete in comments. 7. Default to IEEE floating if platform supports it so resulting libcurl will be compatible with other open source projects on VMS. 8. Default to LARGEFILE if platform supports it. 9. Default to enable SSL, LDAP, Kerberos, libz if the libraries are present. 10. Build with exact case global symbols for libcurl. 11. Generate linker option file needed. 12. Compiler list option only commonly needed items. 13. fulllist option for those who really want it. 14. Create debug symbol file on Alpha, IA64.
2013-02-05Curl_proxyCONNECT: return once CONNECT is sentDaniel Stenberg
By doing this unconditionally, we infer a simpler and more defined behavior. This also has the upside that test 1021 no longer fails for me even if I run with valgrind. Also fixed some wrong comments.
2013-02-05email: Reworked comments in the endofresp() functionsSteve Holme
Tidied up the comments in the endofresp() functions to be more meaningful prior to release.
2013-02-05schannel: Removed extended error connection setup flagMarc Hoersken
According KB975858 this flag may cause problems on Windows 7 and Windows Server 2008 R2 systems. Extended error information is not currently used by libcurl and therefore not a requirement. The flag may improve the SSL-connection shutdown in case of an error. This means it might be a good improvement in the future. Fixes bug/issue #1187 - thanks for the report
2013-02-05singleipconnect: Update *sockp for all CURLE_OKTor Arntsen
The 56b7c87c7 change left a case where a good sockfd was not copied to *sockp before returning with CURLE_OK
2013-02-05curl_easy_perform: Value stored to 'mcode' is never readDaniel Stenberg
pointed out by clang-analyzer
2013-02-05singleipconnect: remove dead assignmentDaniel Stenberg
pointed out by clang-analyzer
2013-02-05CURLMOPT_MAXCONNECTS: restore functionalityLinus Nielsen Feltzing
When a connection is no longer used, it is kept in the cache. If the cache is full, the oldest idle connection is closed. If no connection is idle, the current one is closed instead.
2013-02-04email: Provided extra comments following recent pop3/imap fixesSteve Holme
Provided additional clarification about the logic of the authenticate() functions following commit 6b6bdc83bd36 and b4270a9af1d0.
2013-02-04pop3.c: Updated variable names to use shorter / more readable variantSteve Holme
Tidied up code from commit 6b6bdc83bdUpdated where a few instances of the pop3c struct variable used the longer conndata struct rather than matching what other code in pop3_authenticate() used.
2013-02-03imap: Fixed no known authentication mechanism when fallback is requiredSteve Holme
Fixed an issue where (lib)curl is compiled without support for a supported challenge-response based SASL authentication mechanism, such as CRAM-MD5 or NTLM, the server doesn't support the LOGIN or PLAIN mechanisms and (lib)curl doesn't fallback to Clear Text authentication. Note: In order to fallback to Clear Text authentication properly this fix adds support for the LOGINDISABLED server capability. imap: Fixed no known authentication mechanism when fallback is required Fixed an issue where (lib)curl is compiled without support for a supported challenge-response based SASL authentication mechanism, such as CRAM-MD5 or NTLM, the server doesn't support the LOGIN or PLAIN mechanisms and (lib)curl doesn't fallback to Clear Text authentication. Note: In order to fallback to Clear Text authentication properly this fix adds support for the LOGINDISABLED server capability. Related bug: http://curl.haxx.se/mail/lib-2013-02/0004.html Reported by: Stanislav Ivochkin
2013-02-03pop3: Fixed no known authentication mechanism when fallback is requiredSteve Holme
Fixed an issue where (lib)curl is compiled without support for a supported challenge-response based SASL authentication mechanism, such as CRAM-MD5 or NTLM, the server doesn't support the LOGIN or PLAIN mechanisms and (lib)curl doesn't fallback to APOP or Clear Text authentication. Bug: http://curl.haxx.se/mail/lib-2013-02/0004.html Reported by: Stanislav Ivochkin