delta/curl.git/lib/vtls/nss.c, branch bagder/NULL-checks github.com: bagder/curl.git checksrc: detect more kinds of NULL comparisons we avoid 2021-12-26T11:04:25+00:00 Daniel Stenberg daniel@haxx.se 2021-12-25T20:41:14+00:00 ecbd1fa78dd5dd9a917424264fde259934ae4b59 Co-authored-by: Jay Satiro Closes #8180 
Co-authored-by: Jay Satiro
Closes #8180
nss:set_cipher don't clobber the cipher list 2021-12-20T09:51:44+00:00 Daniel Stenberg daniel@haxx.se 2021-12-17T22:40:11+00:00 556a42edfb9b3fcd744f2e032e59498bc8af4841 The string is set by the user and needs to remain intact for proper connection reuse etc. Reported-by: Eric Musser Fixes #8160 Closes #8161 
The string is set by the user and needs to remain intact for proper
connection reuse etc.

Reported-by: Eric Musser
Fixes #8160
Closes #8161
tls: remove newline from three infof() calls 2021-10-19T21:03:57+00:00 Daniel Stenberg daniel@haxx.se 2021-10-19T15:38:18+00:00 54aa9c48b20387f763a24f6000583cab5a44d110 Follow-up to e7416cf Reported-by: billionai on github Fixes #7879 Closes #7880 
Follow-up to e7416cf

Reported-by: billionai on github
Fixes #7879
Closes #7880
lib: avoid fallthrough cases in switch statements 2021-09-29T08:00:52+00:00 Daniel Gustafsson daniel@yesql.se 2021-09-29T08:00:52+00:00 12246eddc5d844efec16141d259092fd69f89bc4 Commit b5a434f7f0ee4d64857f8592eced5b9007d83620 inhibits the warning on implicit fallthrough cases, since the current coding of indicating fallthrough with comments is falling out of fashion with new compilers. This attempts to make the issue smaller by rewriting fallthroughs to no longer fallthrough, via either breaking the cases or turning switch statements into if statements. lib/content_encoding.c: the fallthrough codepath is simply copied into the case as it's a single line. lib/http_ntlm.c: the fallthrough case skips a state in the state- machine and fast-forwards to NTLMSTATE_LAST. Do this before the switch statement instead to set up the states that we actually want. lib/http_proxy.c: the fallthrough is just falling into exiting the switch statement which can be done easily enough in the case. lib/mime.c: switch statement rewritten as if statement. lib/pop3.c: the fallthrough case skips to the next state in the statemachine, do this explicitly instead. lib/urlapi.c: switch statement rewritten as if statement. lib/vssh/wolfssh.c: the fallthrough cases fast-forwards the state machine, do this by running another iteration of the switch statement instead. lib/vtls/gtls.c: switch statement rewritten as if statement. lib/vtls/nss.c: the fallthrough codepath is simply copied into the case as it's a single line. Also twiddle a comment to not be inside a non-brace if statement. Closes: #7322 See-also: #7295 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 
Commit b5a434f7f0ee4d64857f8592eced5b9007d83620 inhibits the warning
on implicit fallthrough cases, since the current coding of indicating
fallthrough with comments is falling out of fashion with new compilers.
This attempts to make the issue smaller by rewriting fallthroughs to no
longer fallthrough, via either breaking the cases or turning switch
statements into if statements.

  lib/content_encoding.c: the fallthrough codepath is simply copied
    into the case as it's a single line.
  lib/http_ntlm.c: the fallthrough case skips a state in the state-
    machine and fast-forwards to NTLMSTATE_LAST. Do this before the
    switch statement instead to set up the states that we actually
    want.
  lib/http_proxy.c: the fallthrough is just falling into exiting the
    switch statement which can be done easily enough in the case.
  lib/mime.c: switch statement rewritten as if statement.
  lib/pop3.c: the fallthrough case skips to the next state in the
    statemachine, do this explicitly instead.
  lib/urlapi.c: switch statement rewritten as if statement.
  lib/vssh/wolfssh.c: the fallthrough cases fast-forwards the state
    machine, do this by running another iteration of the switch
    statement instead.
  lib/vtls/gtls.c: switch statement rewritten as if statement.
  lib/vtls/nss.c: the fallthrough codepath is simply copied into the
    case as it's a single line. Also twiddle a comment to not be
    inside a non-brace if statement.

Closes: #7322
See-also: #7295
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
vtls: fix connection reuse checks for issuer cert and case sensitivity 2021-07-20T07:36:06+00:00 Daniel Stenberg daniel@haxx.se 2021-06-18T22:42:28+00:00 5ea3145850ebff1dc2b13d17440300a01ca38161 CVE-2021-22924 Reported-by: Harry Sintonen Bug: https://curl.se/docs/CVE-2021-22924.html 
CVE-2021-22924

Reported-by: Harry Sintonen
Bug: https://curl.se/docs/CVE-2021-22924.html
infof: remove newline from format strings, always append it 2021-07-07T20:54:01+00:00 Daniel Stenberg daniel@haxx.se 2021-07-06T15:05:17+00:00 e7416cfd2bd58d256b8524f31ef22a43aa23a970 - the data needs to be "line-based" anyway since it's also passed to the debug callback/application - it makes infof() work like failf() and consistency is good - there's an assert that triggers on newlines in the format string - Also removes a few instances of "..." - Removes the code that would append "..." to the end of the data *iff* it was truncated in infof() Closes #7357 
- the data needs to be "line-based" anyway since it's also passed to the
  debug callback/application

- it makes infof() work like failf() and consistency is good

- there's an assert that triggers on newlines in the format string

- Also removes a few instances of "..."

- Removes the code that would append "..." to the end of the data *iff*
  it was truncated in infof()

Closes #7357
ssl: read pending close notify alert before closing the connection 2021-06-01T07:40:40+00:00 Michael Kaufmann mail@michael-kaufmann.ch 2021-05-18T09:34:02+00:00 b249592d29ae0a2b3e8e07fdbc01f33b5a5b8420 This avoids a TCP reset (RST) if the server initiates a connection shutdown by sending an SSL close notify alert and then closes the TCP connection. For SSL connections, usually the server announces that it will close the connection with an SSL close notify alert. curl should read this alert. If curl does not read this alert and just closes the connection, some operating systems close the TCP connection with an RST flag. See RFC 1122, section 4.2.2.13 If curl reads the close notify alert, the TCP connection is closed normally with a FIN flag. The new code is similar to existing code in the "SSL shutdown" function: try to read an alert (non-blocking), and ignore any read errors. Closes #7095 
This avoids a TCP reset (RST) if the server initiates a connection
shutdown by sending an SSL close notify alert and then closes the TCP
connection.

For SSL connections, usually the server announces that it will close the
connection with an SSL close notify alert. curl should read this alert.
If curl does not read this alert and just closes the connection, some
operating systems close the TCP connection with an RST flag.

See RFC 1122, section 4.2.2.13

If curl reads the close notify alert, the TCP connection is closed
normally with a FIN flag.

The new code is similar to existing code in the "SSL shutdown" function:
try to read an alert (non-blocking), and ignore any read errors.

Closes #7095
openssl: associate/detach the transfer from connection 2021-05-24T11:15:10+00:00 Harry Sintonen sintonen@iki.fi 2021-05-05T11:42:26+00:00 7f4a9a9b2a49547eae24d2e19bc5c346e9026479 CVE-2021-22901 Bug: https://curl.se/docs/CVE-2021-22901.html 
CVE-2021-22901

Bug: https://curl.se/docs/CVE-2021-22901.html
NSS: make colons, commas and spaces valid separators in cipher list 2021-05-22T22:11:30+00:00 Sergey Markelov sergey@solidstatenetworks.com 2021-05-21T23:44:15+00:00 96adbf5cdb6f36665af2583083454e4ae38292f0 Fixes #7110 Closes #7115 
Fixes #7110
Closes #7115
tls: add USE_HTTP2 define 2021-04-29T13:04:39+00:00 Jacob Hoffman-Andrews github@hoffman-andrews.com 2021-04-25T01:05:15+00:00 a3268eca792f1c2ff8754de3c4094ee9762b2a87 This abstracts across the two HTTP/2 backends: nghttp2 and Hyper. Add our own define for the "h2" ALPN protocol, so TLS backends can use it without depending on a specific HTTP backend. Closes #6959 
This abstracts across the two HTTP/2 backends: nghttp2 and Hyper.

Add our own define for the "h2" ALPN protocol, so TLS backends can use
it without depending on a specific HTTP backend.

Closes #6959