aboutsummaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2013-05-27Digest auth: escape user names with \ or " in themDaniel Stenberg
When sending the HTTP Authorization: header for digest, the user name needs to be escaped if it contains a double-quote or backslash. Test 1229 was added to verify Reported and fixed by: Nach M. S Bug: http://curl.haxx.se/bug/view.cgi?id=1230
2013-05-22ossl_recv: SSL_read() returning 0 is an error tooMike Giancola
SSL_read can return 0 for "not successful", according to the open SSL documentation: http://www.openssl.org/docs/ssl/SSL_read.html
2013-05-22ossl_send: SSL_write() returning 0 is an error tooMike Giancola
We found that in specific cases if the connection is abruptly closed, the underlying socket is listed in a close_wait state. We continue to call the curl_multi_perform, curl_mutli_fdset etc. None of these APIs report the socket closed / connection finished. Since we have cases where the multi connection is only used once, this can pose a problem for us. I've read that if another connection was to come in, curl would see the socket as bad and attempt to close it at that time - unfortunately, this does not work for us. I found that in specific situations, if SSL_write returns 0, curl did not recognize the socket as closed (or errored out) and did not report it to the application. I believe we need to change the code slightly, to check if ssl_write returns 0. If so, treat it as an error - the same as a negative return code. For OpenSSL - the ssl_write documentation is here: http://www.openssl.org/docs/ssl/SSL_write.html
2013-05-21Curl_cookie_add: handle IPv6 hostsDaniel Stenberg
1 - don't skip host names with a colon in them in an attempt to bail out on HTTP headers in the cookie file parser. It was only a shortcut anyway and trying to parse a file with HTTP headers will still be handled, only slightly slower. 2 - don't skip domain names based on number of dots. The original netscape cookie spec had this oddity mentioned and while our code decreased the check to only check for two, the existing cookie spec has no such dot counting required. Bug: http://curl.haxx.se/bug/view.cgi?id=1221 Reported-by: Stefan Neis
2013-05-18cookies: only consider full path matchesYAMADA Yasuharu
I found a bug which cURL sends cookies to the path not to aim at. For example: - cURL sends a request to http://example.fake/hoge/ - server returns cookie which with path=/hoge; the point is there is NOT the '/' end of path string. - cURL sends a request to http://example.fake/hogege/ with the cookie. The reason for this old "feature" is because that behavior is what is described in the original netscape cookie spec: http://curl.haxx.se/rfc/cookie_spec.html The current cookie spec (RFC6265) clarifies the situation: http://tools.ietf.org/html/rfc6265#section-5.2.4
2013-05-16axtls: prevent memleaks on SSL handshake failuresEric Hu
2013-05-12Revert "WIN32 MemoryTracking: track wcsdup() _wcsdup() and _tcsdup() usage"Daniel Stenberg
This reverts commit 8ec2cb5544b86306b702484ea785b6b9596562ab. We don't have any code anywhere in libcurl (or the curl tool) that use wcsdup so there's no such memory use to track. It seems to cause mild problems with the Borland compiler though that we may avoid by reverting this change again. Bug: http://curl.haxx.se/mail/lib-2013-05/0070.html
2013-05-11Updated zlib version in build files.Guenter Knauf
2013-05-09nss: give PR_INTERVAL_NO_WAIT instead of -1 to PR_Recv/PR_SendDaniel Stenberg
Reported by: David Strauss Bug: http://curl.haxx.se/mail/lib-2013-05/0088.html
2013-05-07servercert: allow empty subjectDaniel Stenberg
Bug: http://curl.haxx.se/bug/view.cgi?id=1220 Patch by: John Gardiner Myers
2013-05-05curl_schannel.c: Fixed invalid memory access during SSL shutdownMarc Hoersken
2013-05-04smtp: Fix trailing whitespace warningSteve Holme
2013-05-04smtp: Fix compilation warningSteve Holme
comparison between signed and unsigned integer expressions
2013-05-04smtp: Updated RFC-2821 references to RFC-5321Steve Holme
2013-05-04smtp: Fixed sending of double CRLF caused by first in EOBSteve Holme
If the mail sent during the transfer contains a terminating <CRLF> then we should not send the first <CRLF> of the EOB as specified in RFC-5321. Additionally don't send the <CRLF> if there is "no mail data" as the DATA command already includes it.
2013-05-01bindlocal: move brace out of #ifdefLars Johannesen
The code within #ifdef HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID wrongly had two closing braces when it should only have one, so builds without that define would fail. Bug: http://curl.haxx.se/mail/lib-2013-05/0000.html
2013-04-30smtp: Tidy up to move the eob counter to the per-request structureSteve Holme
Move the eob counter from the smtp_conn structure to the SMTP structure as it is associated with a SMTP payload on a per-request basis.
2013-04-29smtp: Fixed unknown percentage complete in progress barSteve Holme
The curl command line utility would display the the completed progress bar with a percentage of zero as the progress routines didn't know the size of the transfer.
2013-04-28email: Tidy up of *_perform_authenticate()Steve Holme
Removed the hard returns from imap and pop3 by using the same style for sending the authentication string as smtp. Moved the "Other mechanisms not supported" check in smtp to match that of imap and pop3 to provide consistency between the three email protocols.
2013-04-28smtp: Updated limit check to be more readable like the check in pop3Steve Holme
2013-04-28pop3: Added 255 octet limit check when sending initial responseSteve Holme
Added 255 octet limit check as per Section 4. Paragraph 8 of RFC-5034.
2013-04-27darwinssl: add TLS crypto authenticationNick Zitzmann
Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
2013-04-27imap: Added support for overriding the SASL initial responseSteve Holme
In addition to checking for the SASL-IR capability the user can override the sending of the client's initial response in the AUTHENTICATION command with the use of CURLOPT_SASL_IR should the server erroneously not report SASL-IR when it does support it.
2013-04-27smtp: Added support for disabling the SASL initial responseSteve Holme
Updated the default behaviour of sending the client's initial response in the AUTH command to not send it and added support for CURLOPT_SASL_IR to allow the user to specify including the response. Related Bug: http://curl.haxx.se/mail/lib-2012-03/0114.html Reported-by: Gokhan Sengun
2013-04-27pop3: Added support for enabling the SASL initial responseSteve Holme
Allowed the user to specify whether to send the client's intial response in the AUTH command via CURLOPT_SASL_IR.
2013-04-27sasl-ir: Added CURLOPT_SASL_IR to enable/disable the SASL initial responseSteve Holme
2013-04-26curl_easy_init: use less mallocsDaniel Stenberg
By introducing an internal alternative to curl_multi_init() that accepts parameters to set the hash sizes, easy handles will now use tiny socket and connection hash tables since it will only ever add a single easy handle to that multi handle. This decreased the number mallocs in test 40 (which is a rather simple and typical easy interface use case) from 1142 to 138. The maximum amount of memory allocated used went down from 118969 to 78805.
2013-04-26ftp_state_pasv_resp: connect through proxy also when set by envDaniel Stenberg
When connecting back to an FTP server after having sent PASV/EPSV, libcurl sometimes didn't use the proxy properly even though the proxy was used for the initial connect. The function wrongly checked for the CURLOPT_PROXY variable to be set, which made it act wrongly if the proxy information was set with an environment variable. Added test case 711 to verify (based on 707 which uses --socks5). Also added test712 to verify another variation of setting the proxy: with --proxy socks5:// Bug: http://curl.haxx.se/bug/view.cgi?id=1218 Reported-by: Zekun Ni
2013-04-26url: initialize speed-check data for file:// protocolZdenek Pavlas
... in order to prevent an artificial timeout event based on stale speed-check data from a previous network transfer. This commit fixes a regression caused by 9dd85bced56f6951107f69e581c872c1e7e3e58e. Bug: https://bugzilla.redhat.com/906031
2013-04-23url: Added smtp and pop3 hostnames to the protocol detection listSteve Holme
2013-04-22getinfo.c: reset timecond when clearing session-info variablesAlessandro Ghedini
Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=705783 Reported-by: Ludovico Cavedon <cavedon@debian.org>
2013-04-21url: Fixed missing length check in parse_proxy()Steve Holme
Commit 11332577b3cb removed the length check that was performed by the old scanf() code.
2013-04-21url: Fixed crash when no username or password supplied for proxySteve Holme
Fixed an issue in parse_proxy(), introduced in commit 11332577b3cb, where an empty username or password (For example: http://:@example.com) would cause a crash.
2013-04-21url: Removed unused text length constantsSteve Holme
2013-04-21url: Updated proxy URL parsing to use parse_login_details()Steve Holme
2013-04-21url: Tidy up of setstropt_userpwd() parametersSteve Holme
Updated the naming convention of the login parameters to match those of other functions.
2013-04-21url: Tidy up of code and comments following recent changesSteve Holme
Tidy up of variable names and comments in setstropt_userpwd() and parse_login_details().
2013-04-20url: Simplified setstropt_userpwd() following recent changesSteve Holme
There is no need to perform separate clearing of data if a NULL option pointer is passed in. Instead this operation can be performed by simply not calling parse_login_details() and letting the rest of the code do the work.
2013-04-20url: Correction to scope of if statements when setting dataSteve Holme
2013-04-20url: Fixed memory leak in setstropt_userpwd()Steve Holme
setstropt_userpwd() was calling setstropt() in commit fddb7b44a79d to set each of the login details which would duplicate the strings and subsequently cause a memory leak.
2013-04-20url: Added overriding of URL login options from CURLOPT_USERPWDSteve Holme
2013-04-20url: Added support for parsing login options from the CURLOPT_USERPWDSteve Holme
In addition to parsing the optional login options from the URL, added support for parsing them from CURLOPT_USERPWD, to allow the following supported command line: --user username:password;options
2013-04-19url: Added bounds checking to parse_login_details()Steve Holme
Added bounds checking when searching for the separator characters within the login string as this string may not be NULL terminated (For example it is the login part of a URL). We do this in preference to allocating a new string to copy the login details into which could then be passed to parse_login_details() for performance reasons.
2013-04-19url: Added size_t cast to pointer based length calculationsSteve Holme
2013-04-19url: Corrected minor typo in commentSteve Holme
2013-04-18url: Fix chksrc longer than 79 columns warningSteve Holme
2013-04-18url: Fix incorrect variable type for result codeSteve Holme
2013-04-18url: Fix compiler warningSteve Holme
signed and unsigned type in conditional expression
2013-04-18url: Moved parsing of login details out of parse_url_login()Steve Holme
Separated the parsing of login details from the processing of them in parse_url_login() ready for use by setstropt_userpwd().
2013-04-18url: Re-factored set_userpass() and parse_url_userpass()Steve Holme
Re-factored these functions to reflect their new behaviour following the addition of login options.
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-05 14:54:56 +0000