summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* VERSIONS: refreshedDaniel Stenberg2020-12-071-7/+6
| | | | | We always use the patch number these days: all releases are "major.minor.patch"
* cmake: don't use reserved target name 'test'Jakub Zakrzewski2020-12-071-1/+0
| | | | | | | CMake up to 3.10 always reserves this name Fixes #6257 Closes #6258
* openssl: make the OCSP verification verify the certificate idDaniel Stenberg2020-12-071-29/+54
| | | | | | | | CVE-2020-8286 Reported by anonymous Bug: https://curl.se/docs/CVE-2020-8286.html
* ftp: make wc_statemach loop instead of recurseDaniel Stenberg2020-12-071-100/+102
| | | | | | | | CVE-2020-8285 Fixes #6255 Bug: https://curl.se/docs/CVE-2020-8285.html Reported-by: xnynx on github
* ftp: CURLOPT_FTP_SKIP_PASV_IP by defaultDaniel Stenberg2020-12-0714-3/+18
| | | | | | | | | | | | The command line tool also independently sets --ftp-skip-pasv-ip by default. Ten test cases updated to adapt the modified --libcurl output. Bug: https://curl.se/docs/CVE-2020-8284.html CVE-2020-8284 Reported-by: Varnavas Papaioannou
* urlapi: don't accept blank port number field without schemeDaniel Stenberg2020-12-074-18/+39
| | | | | | | | | | ... as it makes the URL parser accept "very-long-hostname://" as a valid host name and we don't want that. The parser now only accepts a blank (no digits) after the colon if the URL starts with a scheme. Reported-by: d4d on hackerone Closes #6283
* Revert "multi: implement wait using winsock events"Daniel Stenberg2020-12-062-153/+3
| | | | | | | | | | | This reverts commit d2a7d7c185f98df8f3e585e5620cbc0482e45fac. This commit also reverts the subsequent follow-ups to that commit, which were all done within windows #ifdefs that are removed in this change. Marc helped me verify this. Fixes #6146 Closes #6281
* ftp: retry getpeername for FTP with TCP_FASTOPENKlaus Crusius2020-12-063-45/+70
| | | | | | | | | | | | In the case of TFO, the remote host name is not resolved at the connetion time. For FTP that has lead to missing hostname for the secondary connection. Therefore the name resolution is done at the time, when FTP requires it. Fixes #6252 Closes #6265 Closes #6282
* scripts/completion.pl: parse all optsThomas Danielsson2020-12-051-1/+1
| | | | | | | For tab-completion it may be preferable to include all the available options. Closes #6280
* RELEASE-NOTES: syncedDaniel Stenberg2020-12-041-6/+25
|
* openssl: use OPENSSL_init_ssl() with >= 1.1.0Daniel Stenberg2020-12-031-4/+15
| | | | | | | Reported-by: Kovalkov Dmitrii and Per Nilsson Fixes #6254 Fixes #6256 Closes #6260
* SECURITY-PROCESS: disclose on hackeroneDaniel Stenberg2020-12-031-0/+8
| | | | | | | Once a vulnerability has been published, the hackerone issue should be disclosed. For tranparency. Closes #6275
* tests/util.py: fix compatibility with Python 2Marc Hoersken2020-12-031-0/+15
| | | | | | | | | | Backporting the Python 3 implementation of setStream to ClosingFileHandler as a fallback within Python 2. Reported-by: Jay Satiro Fixes #6259 Closes #6270
* docs: fix typos and markup in ETag manpage sectionsDaniel Gustafsson2020-12-032-3/+3
| | | | | Reported-by: emanruse on github Fixes #6273
* quiche: close the connectionDaniel Stenberg2020-12-022-8/+15
| | | | | | Reported-by: Junho Choi Fixes #6213 Closes #6217
* ngtcp2: Fix build error due to symbol name changeJay Satiro2020-12-021-4/+4
| | | | | | | | | | - NGTCP2_CRYPTO_LEVEL_APP -> NGTCP2_CRYPTO_LEVEL_APPLICATION ngtcp2/ngtcp2@76232e9 changed the name. ngtcp2 master is required to build curl with http3 support. Closes https://github.com/curl/curl/pull/6271
* cmake: check for linux/tcp.hKlaus Crusius2020-12-014-0/+8
| | | | | | The HAVE_LINUX_TCP_H define was not set by cmake. Closes #6252
* NEW-PROTOCOL: document what needs to be done to add oneDaniel Stenberg2020-12-012-0/+111
| | | | Closes #6263
* splay: rename Curl_splayremovebyaddr to Curl_splayremoveDaniel Stenberg2020-12-014-19/+11
| | | | | | | ... and remove the old unused proto for the old Curl_splayremove version. Closes #6269
* openssl: free mem_buf in error pathDaniel Stenberg2020-12-011-9/+9
| | | | | | To fix a memory-leak. Closes #6267
* openssl: remove #if 0 leftoverDaniel Stenberg2020-11-301-4/+0
| | | | | | Follow-up to 4c9768565ec3a9 (from Sep 2008) Closes #6268
* ntlm: avoid malloc(0) on zero length user and domainDaniel Stenberg2020-11-291-6/+2
| | | | | | | | ... and simplify the too-long checks somewhat. Detected by OSS-Fuzz Closes #6264
* RELEASE-NOTES: syncedDaniel Stenberg2020-11-281-8/+33
|
* tests/server/tftpd.c: close upload file in case of abortMarc Hoersken2020-11-281-0/+6
| | | | | | | | | | | Commit c353207 removed the closing right after do_tftp which covered the case of abort. This handles that case. Reviewed-by: Jay Satiro Reviewed-by: Daniel Stenberg Follow up to #6209 Closes #6234
* ngtcp2: use the minimal version of QUIC supported by ngtcp2Daiki Ueno2020-11-261-1/+1
| | | | Closes #6250
* ngtcp2: advertise h3 ALPN unconditionallyDaiki Ueno2020-11-261-17/+5
| | | | Closes #6250
* vquic/ngtcp2.h: define local_addr as sockaddr_storageDaiki Ueno2020-11-262-4/+5
| | | | | | | | | | | | This field needs to be wide enough to hold sockaddr_in6 when connecting via IPv6. Otherwise, ngtcp2_conn_read_pkt will drop the packets because of the address mismatch: I00000022 [...] con ignore packet from unknown path We can safely assume that struct sockaddr_storage is available, as it is used in the public interface of ngtcp2. Closes #6250
* socks: check for DNS entries with the right port numberDaniel Stenberg2020-11-261-1/+1
| | | | | | | | | | The resolve call is done with the right port number, but the subsequent check used the wrong one, which then could find a previous resolve which would return and leave the fresh resolve "incomplete" and leaking memory. Fixes #6247 Closes #6253
* curl_setup: USE_RESOLVE_ON_IPS is for Apple native resolver useDaniel Stenberg2020-11-261-1/+1
| | | | ... so don't define it when instructed to use c-ares!
* test506: make it not run in c-ares buildsDaniel Stenberg2020-11-261-2/+3
| | | | | | | | As the asynch nature of it may trigger events in another order. A c-ares upgrade made it break. Reported-by: Marc Hörsken Fixes #6247
* runtests: make 'c-ares' a "feature" to depend onDaniel Stenberg2020-11-262-0/+2
| | | | ... also added to the docs.
* tool_writeout: use off_t getinfo-types instead of doublesDaniel Stenberg2020-11-261-30/+29
| | | | | | | | Commit 3b80d3ca46b12e52342 (June 2017) introduced getinfo replacement variables that use curl_off_t instead of doubles. Switch the --write-out function over to use them. Closes #6248
* file: avoid duplicated code sequenceEmil Engler2020-11-251-11/+1
| | | | | | | | | file_disconnect() is identical with file_do() except the function header but as the arguments are unused anyway so why not just return file_do() directly! Reviewed-by: Daniel Stenberg Closes #6249
* infof/failf calls: fix format specifiersRikard Falkeborn2020-11-2412-20/+20
| | | | | | Update a few format specifiers to match what is being printed. Closes #6241
* docs/INTERNALS: remove reference to Curl_sendf()Daniel Stenberg2020-11-242-7/+3
| | | | | | | | | The function has been removed from common usage. Also removed comment in gopher.c that still referenced it. Reported-by: Rikard Falkeborn Fixes #6242 Closes #6243
* examples: update .gitignoreRikard Falkeborn2020-11-231-4/+8
| | | | | | | | | | | | Add files that are generated by 'make examples' and remove some that have been renamed. The commits that renamed the programs are e9625c5bc6c046a (imap.c and simplesmtp.c were renamed to imap-fetch.c and smtp-send.c) and ad39e7ec01e7 (pop3slist.c and pop3s.c were renamed to pop3-list.c and pop3-ssl.c). Closes #6240
* asyn: use 'struct thread_data *' instead of 'void *'Daniel Stenberg2020-11-233-25/+24
| | | | | | | | | | To reduce use of types that can't be checked at compile time. Also removes several typecasts. ... and rename the struct field from 'os_specific' to 'tdata'. Closes #6239 Reviewed-by: Jay Satiro
* Makefile.m32: add support for UNICODE buildsViktor Szakats2020-11-232-0/+13
| | | | | | | | | | | | | It requires the linker to support the `-municode` option. This is available in more recent mingw-w64 releases. Ref: https://gcc.gnu.org/onlinedocs/gcc/x86-Windows-Options.html Ref: https://stackoverflow.com/questions/3571250/wwinmain-unicode-and-mingw/11706847#11706847 Reviewed-by: Jay Satiro Reviewed-by: Marcel Raad Closes #6228
* urldata: remove 'void *protop' and create the union 'p'Daniel Stenberg2020-11-2322-168/+183
| | | | | | | ... to avoid the use of 'void *' for the protocol specific structs done per transfer. Closes #6238
* winbuild: remove docs from Makefiles and refer to README.mdDaniel Stenberg2020-11-223-56/+13
| | | | | | | | | | | | | | | Reduce risk for conflicting docs and makes it to a single place to fix and polish. add these missing options to the readme: ENABLE_OPENSSL_AUTO_LOAD_CONFIG and ENABLE_UNICODE clarify ENABLE_SCHANNEL default varies Fixes #6216 Closes #6227 Co-Authored-by: Jay Satiro
* http3: use the master branch of GnuTLS for testingDaiki Ueno2020-11-222-5/+5
| | | | Closes #6235
* KNOWN_BUGS: curl with wolfSSL lacks support for renegotiationDaniel Stenberg2020-11-221-0/+9
| | | | Closes #5839
* KNOWN_BUGS: wakeup socket disconnect causes havocDaniel Stenberg2020-11-221-0/+13
| | | | | Closes #6132 Closes #6133
* RELEASE-NOTES: syncedDaniel Stenberg2020-11-211-4/+23
|
* curl: add compatibility for Amiga and GCC 6.5Oliver Urbann2020-11-205-14/+21
| | | | | | | Changes are mainly reordering and adding of includes required to compile with a more recent version of GCC. Closes #6220
* tests/server/tftpd.c: close upload file right after transferMarc Hoersken2020-11-201-5/+4
| | | | | | | | | | Make sure uploaded file is no longer locked after the transfer while waiting for the final ACK to be handled. Assisted-by: Daniel Stenberg Bug: #6058 Closes #6209
* CI/cirrus: simplify logic for disabled testsMarc Hoersken2020-11-201-10/+3
| | | | | | | | | | | | | | The OpenSSH server instance for the testsuite cannot be started on FreeBSD, therefore the SFTP and SCP tests are disabled right away from the beginning. The previous OS version specific logic for SKIP_TESTS is no longer needed/used and can therefore be removed. Reviewed-by: Daniel Stenberg Follow up to #6211 Closes #6229
* mailmap: Daniel HwangDaniel Gustafsson2020-11-201-0/+1
| | | | | | | | Add Daniel Hwang to the mailmap to cover the alternative spelling Daniel Lee Hwang which was used in one commit. Closes #6230 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* openssl: guard against OOM on context creationDaniel Gustafsson2020-11-191-2/+6
| | | | | | | | | | | | | EVP_MD_CTX_create will allocate memory for the context and returns NULL in case the allocation fails. Make sure to catch any allocation failures and exit early if so. In passing, also move to EVP_DigestInit rather than EVP_DigestInit_ex as the latter is intended for ENGINE selection which we don't do. Closes #6224 Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Emil Engler <me@emilengler.com>
* cmake: use libcurl.rc in all Windows buildsVincent Torri2020-11-191-1/+1
| | | | | Reviewed-by: Marcel Raad Closes #6215
View Lorry Controller Status