summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* fixup comparison of constant 9999 with expression of type 'CURLUPart' is ↵bagder/urlapi-zoneidDaniel Stenberg2019-05-051-1/+1
| | | | always false
* urlapi: add CURLUPART_ZONEID to set and getDaniel Stenberg2019-05-038-23/+74
| | | | | | The zoneid can be used with IPv6 numerical addresses. Updated test 1560 to verify.
* urlapi: strip off scope id from numerical IPv6 addressesDaniel Stenberg2019-05-035-12/+192
| | | | | | | | | | ... to make the host name "usable". Store the scope id and put it back when extracting a URL out of it. Also makes curl_url_set() syntax check CURLUPART_HOST. Fixes #3817 Closes #3822
* RELEASE-NOTES: syncedDaniel Stenberg2019-05-021-8/+27
|
* multiif.h: remove unused protosDaniel Stenberg2019-05-021-15/+0
| | | | | | | ... for functions related to pipelining. Those functions were removed in 2f44e94efb3df. Closes #3828
* travis: mesalink: temporarily disable test 3001Yiming Jing2019-05-011-1/+1
| | | | ... due to SHA-1 signatures in test certs
* travis: upgrade the MesaLink TLS backend to v1.0.0Yiming Jing2019-05-012-1/+30
| | | | | Closes #3823 Closes #3776
* ConnectionExists: improve non-multiplexing use caseDaniel Stenberg2019-05-011-2/+7
| | | | | | - better log output - make sure multiplex is enabled for it to be used
* multi: provide Curl_multiuse_state to update informationDaniel Stenberg2019-05-0110-2/+48
| | | | | | As soon as a TLS backend gets ALPN conformation about the specific HTTP version it can now set the multiplex situation for the "bundle" and trigger moving potentially queued up transfers to the CONNECT state.
* process_pending_handles: mark queued transfers as previously pendingDaniel Stenberg2019-05-012-0/+9
| | | | | | | | | With transfers being queued up, we only move one at a a time back to the CONNECT state but now we mark moved transfers so that when a moved transfer is confirmed "successful" (it connected) it will trigger the move of another pending transfer. Previously, it would otherwise wait until the transfer was done before doing this. This makes queued up pending transfers get processed (much) faster.
* http: mark bundle as not for multiuse on < HTTP/2 responseDaniel Stenberg2019-05-011-0/+4
| | | | | Fixes #3813 Closes #3815
* cookie: Guard against possible NULL ptr derefDaniel Gustafsson2019-05-011-5/+7
| | | | | | | | | | In case the name pointer isn't set (due to memory pressure most likely) we need to skip the prefix matching and reject with a badcookie to avoid a possible NULL pointer dereference. Closes #3820 #3821 Reported-by: Jonathan Moerman Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* os400: Add CURLOPT_MAXAGE_CONN to ILE/RPG bindingsPatrick Monnerat2019-04-301-0/+2
|
* nss: provide more specific error messages on failed initKamil Dudka2019-04-291-2/+8
| | | | Closes #3808
* docs: minor polish to the bug bounty / security docsReed Loden2019-04-294-23/+30
| | | | Closes #3811
* CURL_MAX_INPUT_LENGTH: largest acceptable string input sizeDaniel Stenberg2019-04-297-3/+146
| | | | | | | | | | | | | | | | | This limits all accepted input strings passed to libcurl to be less than CURL_MAX_INPUT_LENGTH (8000000) bytes, for these API calls: curl_easy_setopt() and curl_url_set(). The 8000000 number is arbitrary picked and is meant to detect mistakes or abuse, not to limit actual practical use cases. By limiting the acceptable string lengths we also reduce the risk of integer overflows all over. NOTE: This does not apply to `CURLOPT_POSTFIELDS`. Test 1559 verifies. Closes #3805
* curlver.h: use parenthesis in CURL_VERSION_BITS macroTseng Jun2019-04-281-1/+1
| | | | Closes #3809
* cmake: rename CMAKE_USE_DARWINSSL to CMAKE_USE_SECTRANSPSimon Warta2019-04-272-11/+15
| | | | Closes https://github.com/curl/curl/pull/3769
* ntlm: Missed pre-processor || (or) during rebase for cd15acd0Steve Holme2019-04-231-1/+1
|
* ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4Steve Holme2019-04-234-6/+16
| | | | | | Just like we do for mbed TLS, use our local implementation of MD4 when OpenSSL doesn't support it. This allows a type-3 message to include the NT response.
* INTERNALS: fix misindentation of ToC itemDaniel Gustafsson2019-04-231-1/+1
| | | | | | | Kerberos was incorrectly indented as a subsection under FTP, which is incorrect as they are both top level sections. A fix for this was first attempted in commit fef38a0898322f285401c5ff2f5e7c90dbf3be63 but that was a few paddles short of being complete.
* INTERNALS: Add structs to ToCAron Bergman2019-04-231-0/+14
| | | | | | | Add the subsections under "Structs in libcurl" to the table of contents. Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
* INTERNALS: Add code highlightingAron Bergman2019-04-231-9/+9
| | | | | | | | | Make all struct members under the Curl_handler section print in monospace font. Closes #3801 Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
* docs/BUG-BOUNTY: bug bounty time [skip ci]Daniel Stenberg2019-04-226-32/+130
| | | | | | | | | | Introducing the curl bug bounty program on hackerone. We now recommend filing security issues directly in the hackerone ticket system which only is readable to curl security team members. Assisted-by: Daniel Gustafsson Closes #3488
* sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616Steve Holme2019-04-2216-29/+29
| | | | | | | RFC 4616 specifies the authzid is optional in the client authentication message and that the server will derive the authorisation identity (authzid) from the authentication identity (authcid) when not specified by the client.
* memdebug: fix variable nameGisle Vanem2019-04-221-2/+2
| | | | | | Follow-up to 76b6348 which renamed logfile as curl_dbg_logfile. Ref: https://github.com/curl/curl/commit/76b6348#r33259088
* vauth/cleartext: Don't send the authzid if it is emptySteve Holme2019-04-211-2/+3
| | | | Follow up to 762a292f.
* test 196,197,198: add 'retry' keyword [skip ci]Daniel Stenberg2019-04-213-0/+3
|
* RELEASE-NOTES: syncedDaniel Stenberg2019-04-211-4/+15
|
* CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuseDaniel Stenberg2019-04-2110-14/+106
| | | | | | | | | ... and disconnect too old ones instead of trying to reuse. Default max age is set to 118 seconds. Ref: #3722 Closes #3782
* altsvc: Fix building with cookies disablesPo-Chuan Hsieh2019-04-206-31/+88
| | | | | | | | | | | ALTSVC requires Curl_get_line which is defined in lib/cookie.c inside a #if check of HTTP and COOKIES. That makes Curl_get_line undefined if COOKIES is disabled. Fix by splitting out the function into a separate file which can be included where needed. Closes #3717 Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>
* test1002: correct the name [skip ci]Daniel Stenberg2019-04-201-1/+1
|
* test660: verify CONNECT_ONLY with IMAPDaniel Stenberg2019-04-202-1/+35
| | | | which basically just makes sure LOGOUT is *not* issued on disconnect
* Curl_disconnect: treat all CONNECT_ONLY connections as "dead"Daniel Stenberg2019-04-201-0/+4
| | | | | | | | | Since the connection has been used by the "outside" we don't know the state of it anymore and curl should not use it anymore. Bug: https://curl.haxx.se/mail/lib-2019-04/0052.html Closes #3795
* multi: fix the statenames (follow-up fix from 2f44e94efb3df8e)Daniel Stenberg2019-04-191-2/+0
| | | | | The list of names must be in sync with the defined states in the header file!
* openvms: Remove pre-processors for Windows as VMS cannot support themSteve Holme2019-04-161-6/+0
|
* openvms: Remove pre-processor for SecureTransport as VMS cannot support itSteve Holme2019-04-161-3/+0
| | | | | Fixes #3768 Closes #3785
* TODO: Add issue link to an existing entryJay Satiro2019-04-161-0/+2
|
* RELEASE-NOTES: syncedDaniel Stenberg2019-04-161-4/+23
|
* tool_help: Warn if curl and libcurl versions do not matchJay Satiro2019-04-162-8/+4
| | | | | | | | | | | .. because functionality may be affected if the versions differ. This commit implements TODO 18.7 "warning if curl version is not in sync with libcurl version". Ref: https://github.com/curl/curl/blob/curl-7_64_1/docs/TODO#L1028-L1033 Closes https://github.com/curl/curl/pull/3774
* md5: Update the function signature following d84da52dSteve Holme2019-04-161-5/+5
|
* md5: Forgot to update the code alignment in d84da52dSteve Holme2019-04-151-2/+2
|
* md5: Return CURLcode from the internally accessible functionsSteve Holme2019-04-151-2/+2
| | | | Following 28f826b3 to return CURLE_OK instead of numeric 0.
* tests: Run global cleanup at end of testsDaniel Gustafsson2019-04-154-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | Make sure to run curl_global_cleanup() when shutting down the test suite to release any resources allocated in the SSL setup. This is clearly visible when running tests with PolarSSL where the thread lock calloc() memory which isn't released when not running cleanup. Below is an excerpt from the autobuild logs: ==12368== 96 bytes in 1 blocks are possibly lost in loss record 1 of 2 ==12368== at 0x4837B65: calloc (vg_replace_malloc.c:752) ==12368== by 0x11A76E: curl_dbg_calloc (memdebug.c:205) ==12368== by 0x145CDF: Curl_polarsslthreadlock_thread_setup (polarssl_threadlock.c:54) ==12368== by 0x145B37: Curl_polarssl_init (polarssl.c:865) ==12368== by 0x14129D: Curl_ssl_init (vtls.c:171) ==12368== by 0x118B4C: global_init (easy.c:158) ==12368== by 0x118BF5: curl_global_init (easy.c:221) ==12368== by 0x118D0B: curl_easy_init (easy.c:299) ==12368== by 0x114E96: test (lib1906.c:32) ==12368== by 0x115495: main (first.c:174) Closes #3783 Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com> Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* travis: use mbedtls from XenialMarcel Raad2019-04-151-13/+1
| | | | | | No need to build it from source anymore. Closes https://github.com/curl/curl/pull/3779
* travis: use libpsl from XenialMarcel Raad2019-04-151-29/+46
| | | | | | | This makes building libpsl and libidn2 from source unnecessary and removes the need for the autopoint and libunistring-dev packages. Closes https://github.com/curl/curl/pull/3779
* runtests: start socksd like other serversDaniel Stenberg2019-04-151-1/+1
| | | | | | | ... without a $srcdir prefix. Triggered by the failures in several autobuilds. Closes #3781
* socksd: Fix typosDaniel Gustafsson2019-04-141-2/+2
| | | | Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* socksd: Properly decorate static variablesDaniel Gustafsson2019-04-141-4/+4
| | | | | | | | Mark global variables static to avoid compiler warning in Clang when using -Wmissing-variable-declarations. Closes #3778 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* md(4|5): Fixed indentation oddities with the importation of replacement codeSteve Holme2019-04-142-114/+114
| | | | | | | The indentation from 211d5329 and 57d6d253 was a little strange as parts didn't align correctly, uses 4 spaces rather than 2. Checked the indentation of the original source so it aligns, albeit, using curl style.
View Lorry Controller Status