summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* SSL: Several SSL-backend related fixesOscar Koeroo2012-11-089-89/+270
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | axTLS: This will make the axTLS backend perform the RFC2818 checks, honoring the VERIFYHOST setting similar to the OpenSSL backend. Generic for OpenSSL and axTLS: Move the hostcheck and cert_hostcheck functions from the lib/ssluse.c files to make them genericly available for both the OpenSSL, axTLS and other SSL backends. They are now in the new lib/hostcheck.c file. CyaSSL: CyaSSL now also has the RFC2818 checks enabled by default. There is a limitation that the verifyhost can not be enabled exclusively on the Subject CN field comparison. This SSL backend will thus behave like the NSS and the GnuTLS (meaning: RFC2818 ok, or bust). In other words: setting verifyhost to 0 or 1 will disable the Subject Alt Names checks too. Schannel: Updated the schannel information messages: Split the IP address usage message from the verifyhost setting and changed the message about disabling SNI (Server Name Indication, used in HTTP virtual hosting) into a message stating that the Subject Alternative Names checks are being disabled when verifyhost is set to 0 or 1. As a side effect of switching off the RFC2818 related servername checks with SCH_CRED_NO_SERVERNAME_CHECK (http://msdn.microsoft.com/en-us/library/aa923430.aspx) the SNI feature is being disabled. This effect is not documented in MSDN, but Wireshark output clearly shows the effect (details on the libcurl maillist). PolarSSL: Fix the prototype change in PolarSSL of ssl_set_session() and the move of the peer_cert from the ssl_context to the ssl_session. Found this change in the PolarSSL SVN between r1316 and r1317 where the POLARSSL_VERSION_NUMBER was at 0x01010100. But to accommodate the Ubuntu PolarSSL version 1.1.4 the check is to discriminate between lower then PolarSSL version 1.2.0 and 1.2.0 and higher. Note: The PolarSSL SVN trunk jumped from version 1.1.1 to 1.2.0. Generic: All the SSL backends are fixed and checked to work with the ssl.verifyhost as a boolean, which is an internal API change.
* libcurl: VERSIONINFO updateDaniel Stenberg2012-11-081-2/+2
| | | | | | | Since we added the curl_multi_wait function, the VERSIONINFO needed updating. Reported by: Patrick Monnerat
* Added .def file to output.Guenter Knauf2012-11-081-3/+4
| | | | Requested by Johnny Luong on the libcurl list.
* Added deps for static metalink-aware MinGW builds.Guenter Knauf2012-11-081-0/+16
|
* Fix compilation of lib1501Fabian Keil2012-11-081-1/+1
|
* Curl_readwrite: remove debug outputDaniel Stenberg2012-11-081-6/+0
| | | | | | | The text "additional stuff not fine" text was added for debug purposes a while ago, but it isn't really helping anyone and for some reason some Linux distributions provide their libcurls built with debug info still present and thus (far too many) users get to read this info.
* RELEASE-NOTES: synced with 487538e87a3d5eDaniel Stenberg2012-11-071-2/+15
| | | | 6 new bugfixes and 3 more contributors...
* http_perhapsrewind: consider NTLM over proxy tooDaniel Stenberg2012-11-071-2/+3
| | | | | | | | | | The logic previously checked for a started NTLM negotiation only for host and not also with proxy, leading to problems doing POSTs over a proxy NTLM that are larger than 2000 bytes. Now it includes proxy in the check. Bug: http://curl.haxx.se/bug/view.cgi?id=3582321 Reported by: John Suprock
* Curl_connecthost: friendlier "couldn't connect" messageLars Buitinck2012-11-071-1/+3
|
* test1413: verify redirects to URLs with fragmentsDaniel Stenberg2012-11-062-1/+74
| | | | | | | The bug report claimed it didn't work. This problem was probably fixed in 473003fbdf. Bug: http://curl.haxx.se/bug/view.cgi?id=3581898
* URL parser: cut off '#' fragments from URLs (better)Daniel Stenberg2012-11-062-2/+10
| | | | | | | | | | The existing logic only cut off the fragment from the separate 'path' buffer which is used when sending HTTP to hosts. The buffer that held the full URL used for proxies were not dealt with. It is now. Test case 5 was updated to use a fragment on a URL over a proxy. Bug: http://curl.haxx.se/bug/view.cgi?id=3579813
* OpenSSL/servercert: use correct buffer size, not size of pointerDaniel Stenberg2012-11-061-3/+3
| | | | Bug: http://curl.haxx.se/bug/view.cgi?id=3579286
* curl: set CURLOPT_SSL_VERIFYHOST to 0 to disableDaniel Stenberg2012-11-061-1/+1
|
* test 2027/2030: take duplicate Digest requests into accountDaniel Stenberg2012-11-062-10/+46
| | | | | With the reversion of ce8311c7e49eca and the new clear logic, this flaw is present and we allow it.
* Curl_pretransfer: clear out unwanted auth methodsDaniel Stenberg2012-11-061-0/+6
| | | | | | As a handle can be re-used after having done HTTP auth in a previous request, it must make sure to clear out the HTTP types that aren't wanted in this new request.
* test1412: verify Digest with repeated URLsDaniel Stenberg2012-11-062-1/+118
| | | | | | | This test case verifies that bug 3582718 is fixed. Bug: http://curl.haxx.se/bug/view.cgi?id=3582718 Reported by: Nick Zitzmann (originally)
* Revert "Zero out auth structs before transfer"Daniel Stenberg2012-11-061-4/+0
| | | | | | | This reverts commit ce8311c7e49eca93c136b58efa6763853541ec97. The commit made test 2024 work but caused a regression with repeated Digest authentication. We need to fix this differently.
* CURLOPT_SSL_VERIFYHOST: stop supporting the 1 valueDaniel Stenberg2012-11-068-30/+31
| | | | | | | | | | | | | | | | | | | | | | After a research team wrote a document[1] that found several live source codes out there in the wild that misused the CURLOPT_SSL_VERIFYHOST option thinking it was a boolean, this change now bans 1 as a value and will make libcurl return error for it. 1 was never a sensible value to use in production but was introduced back in the days to help debugging. It was always documented clearly this way. 1 was never supported by all SSL backends in libcurl, so this cleanup makes the treatment of it unified. The report's list of mistakes for this option were all PHP code and while there's a binding layer between libcurl and PHP, the PHP team has decided that they have an as thin layer as possible on top of libcurl so they will not alter or specifically filter a 'TRUE' value for this particular option. I sympathize with that position. [1] = http://daniel.haxx.se/blog/2012/10/25/libcurl-claimed-to-be-dangerous/
* gnutls: fix compiler warningsDaniel Stenberg2012-11-061-2/+2
|
* gnutls: print alerts during handshakeAlessandro Ghedini2012-11-061-2/+22
|
* gnutls: fix the error_is_fatal logicAlessandro Ghedini2012-11-061-6/+6
|
* RELEASE-NOTES: synced with fa6d78829fd30adDaniel Stenberg2012-11-061-4/+24
|
* httpcustomheader.c: free the headers after useDaniel Stenberg2012-11-061-1/+4
|
* uniformly use AM_CPPFLAGS, avoid deprecated INCLUDESDave Reisner2012-11-066-66/+63
| | | | | | | | | | | | | Since automake 1.12.4, the warnings are issued on running automake: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS') Avoid INCLUDES and roll these flags into AM_CPPFLAGS. Compile tested on: Ubuntu 10.04 (automake 1:1.11.1-1) Ubuntu 12.04 (automake 1:1.11.3-1ubuntu2) Arch Linux (automake 1.12.4)
* libauthretry.c: shorten lines to fit within 80 colsDaniel Stenberg2012-11-061-6/+10
|
* ftp_readresp: fix build without krb4 supportDaniel Stenberg2012-11-051-2/+2
| | | | Oops, my previous commit broke builds with krb support.
* test/README: mention the 1500 test number rangeDaniel Stenberg2012-11-041-1/+3
|
* FTP: prevent the multi interface from blockingDaniel Stenberg2012-11-049-22/+234
| | | | | | | | | | | | | | | As pointed out in Bug report #3579064, curl_multi_perform() would wrongly use a blocking mechanism internally for some commands which could lead to for example a very long block if the LIST response never showed. The solution was to make sure to properly continue to use the multi interface non-blocking state machine. The new test 1501 verifies the fix. Bug: http://curl.haxx.se/bug/view.cgi?id=3579064 Reported by: Guido Berhoerster
* winbuild: Use machine type of development environmentMarc Hoersken2012-11-011-3/+7
| | | | | This patch restores the original behavior instead of always falling back to x86 if no MACHINE-type was specified.
* winbuild: Additional clean upMarc Hoersken2012-11-013-7/+3
|
* Even more winbuild refactoringSapien22012-11-011-4/+8
|
* Minor winbuild refactoringSapien22012-11-012-2/+1
|
* Architecture selection for winbuild and minor makefiles refactoringSapien22012-11-014-18/+17
|
* BUGS: fix the bug tracker URLDaniel Stenberg2012-11-011-2/+4
| | | | | | | | | The URL we used before is the one that goes directly to 'add' a bug report, but since you can only do that after first having logged in to sourceforge, the link often doesn't work for visitors. Bug: http://curl.haxx.se/bug/view.cgi?id=3582408 Reported by: Oscar Norlander
* evhiperfifo: fix the pointer passed to WRITEDATADaniel Stenberg2012-11-011-2/+2
| | | | | Bug: http://curl.haxx.se/bug/view.cgi?id=3582407 Reported by: Oscar Norlander
* Fixed MSVC libssh2 static build.Guenter Knauf2012-11-011-1/+1
| | | | | Since libssh2 supports now agent stuff it also depends on user32.lib. Posted to the list by Jan Ehrhardt.
* tlsauthtype: deal with the string case insensitivelyDaniel Stenberg2012-10-231-1/+1
| | | | | | | | When given a string as 'srp' it didn't work, but required 'SRP'. Starting now, the check disregards casing. Bug: http://curl.haxx.se/bug/view.cgi?id=3578418 Reported by: Jeff Connelly
* asyn-ares: restore working with c-ares < 1.6.1Daniel Stenberg2012-10-231-1/+3
| | | | | | | Back in those days the public ares.h header didn't include the ares_version.h header so it needs to be included here. Bug: http://curl.haxx.se/bug/view.cgi?id=3577710
* metalink/md5: Use CommonCrypto on Apple operating systemsNick Zitzmann2012-10-222-4/+15
| | | | | | | | Previously the Metalink code used Apple's CommonCrypto library only if curl was built using the --with-darwinssl option. Now we use CommonCrypto on all Apple operating systems including Tiger or later, or iOS 5 or later, so you don't need to build --with-darwinssl anymore. Also rolled out this change to libcurl's md5 code.
* href_extractor.c: fix the URLDaniel Stenberg2012-10-181-1/+1
|
* href_extractor: example code extracting href elementsMichał Kowalczyk2012-10-182-1/+87
| | | | It does so in a streaming manner using the "Streaming HTML parser".
* darwinssl: un-broke iOS build, fix error on server disconnectNick Zitzmann2012-10-161-11/+81
| | | | | | | | The iOS build was broken by a reference to a function that only existed under OS X; fixed. Also fixed a hard-to-reproduce problem where, if the server disconnected before libcurl got the chance to hang up first and SecureTransport was in use, then we'd raise an error instead of failing gracefully.
* gnutls: put reset code into else blockAlessandro Ghedini2012-10-161-4/+5
| | | | Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690551
* Fix now broken libmetalink-aware OpenSSL build.Guenter Knauf2012-10-131-1/+1
|
* Revert c44e674; add OpenSSL includes/defines.Guenter Knauf2012-10-131-3/+15
| | | | | | The makefile is designed to build against a libmetalink devel package; therefore is does not matter what will change inside libmetalink. Add OpenSSL includes and defines for libmetalink-aware OpenSSL builds.
* version-bump: towards 7.28.1!Daniel Stenberg2012-10-102-79/+10
|
* THANKS: 14 new contributors from 7.28.0Daniel Stenberg2012-10-101-0/+14
|
* RELEASE-NOTES: synced with 8373ca3641curl-7_28_0Daniel Stenberg2012-10-101-1/+2
| | | | One bug, one contributor. Getting ready for release.
* curl_multi_wait: no wait if no descriptors to wait forDaniel Stenberg2012-10-092-3/+10
| | | | | | | | | | This is a minor change in behavior after having been pointed out by Mark Tully and discussed on the list. Initially this case would internally call poll() with no sockets and a timeout which would equal a sleep for that specified time. Bug: http://curl.haxx.se/mail/lib-2012-10/0076.html Reported by: Mark Tully
* TODO-RELEASE: cleanup for 7.28.0Daniel Stenberg2012-10-091-9/+0
| | | | | | | one issue is now KNOWN_BUG #79 the other we just skip since nobody is working on it or is planning to start working on it anytime soon
View Lorry Controller Status