summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* hsts: enable by defaultbagder/enable-hsts-by-defaultDaniel Stenberg2021-04-1415-40/+65
| | | | | | No longer considered experimental. Closes #6700
* RELEASE-NOTES: syncedcurl-7_76_1Daniel Stenberg2021-04-141-6/+30
| | | | curl 7.76.1 release
* THANKS: add names from 7.76.1Daniel Stenberg2021-04-131-0/+10
|
* misc: update copyright year ranges to match latest updatesDaniel Stenberg2021-04-132-2/+2
|
* ngtcp2: Use ALPN h3-29 for nowTatsuhiro Tsujikawa2021-04-131-4/+6
| | | | | Fixes #6864 Cloes #6886
* TODO: remove 18.22 --fail-with-bodyJay Satiro2021-04-111-9/+0
| | | | --fail-with-body was added in 8a964cb (precedes curl-7_76_0).
* src/tool_vms.c: remove duplicated word in commentJürgen Gmach2021-04-101-1/+1
| | | | Closes #6881
* configure: fix CURL_DARWIN_CFLAGS useDaniel Stenberg2021-04-091-1/+1
| | | | | | | | | The macro name change was not completely done. Follow-up to 5d2c384452543c Bug: https://github.com/curl/curl/commit/5d2c384452543c7b6c9fb02eaa0afc84fd5ab941#commitcomment-49315187 Reported-by: Marcel Raad Closes #6878
* github/workflow: add "security-extended" to codeql-analysis.ymlAnthony Shaw2021-04-091-0/+1
| | | | | | Extends the CodeQL code scan. Closes #6815
* examples/hiperfifo.c: check event_initialized before deleteJochem Broekhoff2021-04-091-2/+6
| | | | | | | | If event_del is called with the event struct (still) zeroed out, a segmentation fault may occur. event_initialized checks whether the event struct is nonzero. Closes #6876
* ntlm: fix negotiated flags usagePatrick Monnerat2021-04-0931-51/+57
| | | | | | | | | | | | | | | | | According to Microsoft document MS-NLMP, current flags usage is not accurate: flag NTLMFLAG_NEGOTIATE_NTLM2_KEY controls the use of extended security in an NTLM authentication message and NTLM version 2 cannot be negotiated within the protocol. The solution implemented here is: if the extended security flag is set, prefer using NTLM version 2 (as a server featuring extended security should also support version 2). If version 2 has been disabled at compile time, use extended security. Tests involving NTLM are adjusted to this new behavior. Fixes #6813 Closes #6849
* ntlm: support version 2 on 32-bit platformsPatrick Monnerat2021-04-093-19/+66
| | | | Closes #6849
* curl_ntlm_core.h: simplify conditionals for USE_NTLM2SESSIONPatrick Monnerat2021-04-091-3/+2
| | | | | | | ... as !defined(CURL_DISABLE_CRYPTO_AUTH) is a prerequisite for the whole NTLM. Closes #6849
* lib: remove unused HAVE_INET_NTOA_R* definesDaniel Stenberg2021-04-082-18/+0
| | | | Closes #6867
* configure: include <time.h> unconditionallyMichael Forney2021-04-074-54/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | In 2682e5f5, several instances of AC_HEADER_TIME were removed since it is a deprecated autoconf macro. However, this was the macro that defined TIME_WITH_SYS_TIME, which was used to indicate that <time.h> can be included alongside <sys/time.h>. TIME_WITH_SYS_TIME is still used in the configure test body and since it is no longer defined, <time.h> is *not* included on systems that have <sys/time.h>. In particular, at least on musl libc and glibc, <sys/time.h> does not implicitly include <time.h> and does not declare clock_gettime, gmtime_r, or localtime_r. This causes configure to fail to detect those functions. The AC_HEADER_TIME macro deprecation text says > All current systems provide time.h; it need not be checked for. > Not all systems provide sys/time.h, but those that do, all allow > you to include it and time.h simultaneously. So, to fix this issue, simply include <time.h> unconditionally when testing for time-related functions and in libcurl, and don't bother checking for it. Closes #6859
* configure: remove use of RETSIGTYPEMichael Forney2021-04-0719-85/+12
| | | | | | | | | | | This was previously defined by the obsolete AC_TYPE_SIGNAL macro, which was removed in 2682e5f5. The deprecation text says > Your code may safely assume C89 semantics that RETSIGTYPE is void. So, remove it and just use void instead. Closes #6861
* install: add instructions for Apple Darwin platformsMuhammed Yavuz Nuzumlalı2021-04-071-17/+45
| | | | Closes #6860
* configure: disable min version set for DarwinMuhammed Yavuz Nuzumlalı2021-04-071-24/+5
| | | | | Fixes #6838 Closes #6860
* docs/HTTP3.md: update the build instruction using gnutlsDavid Hu2021-04-071-1/+1
| | | | | | | | In ngtcp2 the `with-gnutls` option is disabled by default, which will cause `curl` unable to be `make` because of lacking the libraries needed. Closes #6857
* RELEASE-NOTES: syncedDaniel Stenberg2021-04-071-6/+22
|
* typecheck-gcc: make the ssl-ctx-cb check use SSL_CTX pointersDaniel Stenberg2021-04-071-6/+6
| | | | | | | | ... and not values. Reported-by: locpyl-tidnyd on github Fixes #6818 Closes #6819
* ngtcp2+gnutls: clear credentials when freedDaniel Stenberg2021-04-071-1/+3
| | | | | | | | ... to avoid double-free. Reported-by: Kenneth Davidson Fixes #6824 Closes #6856
* tool_progress: Fix progress meter in parallel modeCherish982021-04-051-0/+8
| | | | | | | | | | | | | | | | Make sure the total amount of DL/UL bytes are counted before the transfer finalizes. Otherwise if a transfer finishes too quick, its total numbers are not added, and results in a DL%/UL% that goes above 100%. Detail: progress_meter() is called periodically, and it may not catch a transfer's total bytes if the value was unknown during the last call, and the transfer is finished and deleted (i.e., lost) during the next call. Closes https://github.com/curl/curl/pull/6840
* libssh: get rid of PATH_MAXEmil Engler2021-04-051-4/+3
| | | | | | | | This removes the last occurrence of PATH_MAX inside our libssh implementation by calculating the path length from the string length of the two components. Closes #6829
* http_proxy: only loop on 407 + close if we have credentialsDaniel Stenberg2021-04-053-1/+62
| | | | | | | | | | ... to fix the retry-loop. Add test 718 to verify. Reported-by: Daniel Kurečka Fixes #6828 Closes #6850
* h2: allow 100 streams by defaultDaniel Stenberg2021-04-051-1/+1
| | | | | | | | | instead of 13, before the server has told how many streams it accepts. The server can always reject new streams anyway if we go above what it accepts. Ref: #6826 Closes #6852
* file: support GETing directories againLuke Granger-Brown2021-04-053-13/+53
| | | | | | | | | | | | | | After 957bc1881e686f9714c4e6a01bf33535091f0e21, we no longer compute an expected_size for directories. This has the upshot that when we compare even an empty Range with the available size, we fail. This brings back the previous behaviour, which was to succeed, but with empty content. This also removes the "Accept-ranges: bytes" header, which is nonsensical on directories. Adds test 3016 Fixes #6845 Closes #6846
* RELEASE-NOTES: syncedDaniel Stenberg2021-04-042-274/+15
| | | | and bumped to 7.76.1
* TLS: fix HTTP/2 selectionDaniel Stenberg2021-04-027-8/+8
| | | | | | | | | | | for GnuTLS, BearSSL, mbedTLS, NSS, SChannnel, Secure Transport and wolfSSL... Regression since 88dd1a8a115b1f5ece (shipped in 7.76.0) Reported-by: Kenneth Davidson Reported-by: romamik om github Fixes #6825 Closes #6827
* hostip: Fix for builds that disable all asynchronous DNSJay Satiro2021-04-021-0/+2
| | | | | | | | | | | | | | | - Define Curl_resolver_error function only when USE_CURL_ASYNC. Prior to this change building curl without an asynchronous resolver backend (c-ares or threaded) and without DoH (DNS-over-HTTPS, which is also asynchronous but independent of resolver backend) would cause a build error since Curl_resolver_error is called by and evaluates variables only available in asynchronous builds. Reported-by: Benbuck Nason Fixes https://github.com/curl/curl/issues/6831 Closes https://github.com/curl/curl/pull/6832
* openssl: Fix CURLOPT_SSLCERT_BLOB without CURLOPT_SSLCERT_KEYGilles Vollant2021-03-311-52/+56
| | | | | | Reported-by: Christian Schmitz Fixes #6816 Closes #6820
* RELEASE-NOTES: syncedcurl-7_76_0Daniel Stenberg2021-03-311-9/+29
| | | | curl 7.76.0 release
* THANKS: added names from 7.76.0Daniel Stenberg2021-03-311-0/+35
|
* CURLOPT_AUTOREFERER.3: clarify that it sets the full URLDaniel Stenberg2021-03-301-3/+3
| | | | ... some users may not want that!
* define: remove CURL_DISABLE_NTLM ifdefsbagder/disable-scan-improvementDaniel Stenberg2021-03-294-12/+3
| | | | | | | It was never defined anywhere. Fixed disable-scan (test 1165) to also scan headers, which found this issue. Closes #6809
* vtls: fix addsessionid for non-proxy buildsDaniel Stenberg2021-03-291-3/+0
| | | | | | Follow-up to b09c8ee15771c61 Fixes #6812 Closes #6811
* cmake: support WinIDNLi Xinwei2021-03-292-1/+15
| | | | Closes #6807
* transfer: clear 'referer' in declarationDaniel Stenberg2021-03-291-2/+2
| | | | | | | | | To silence (false positive) compiler warnings about it. Follow-up to 7214288898f5625 Reviewed-by: Marcel Raad Closes #6810
* config: fix SSPI enabling NTLM if crypto auth is disabledMarc Hoersken2021-03-292-15/+19
| | | | | | | | | | | Avoid enabling NTLM feature based upon Windows SSPI being enabled in case that crypto auth is disabled. Reported-by: Marcel Raad Follow-up to #6277 Fixes #6803 Closes #6808
* HISTORY: add two 2021 eventsDaniel Stenberg2021-03-291-2/+8
|
* vtls: add 'isproxy' argument to Curl_ssl_get/addsessionid()Daniel Stenberg2021-03-2810-44/+103
| | | | | | | | | To make sure we set and extract the correct session. Reported-by: Mingtao Yang Bug: https://curl.se/docs/CVE-2021-22890.html CVE-2021-22890
* transfer: strip credentials from the auto-referer header fieldViktor Szakats2021-03-283-3/+90
| | | | | | | | Added test 2081 to verify. CVE-2021-22876 Bug: https://curl.se/docs/CVE-2021-22876.html
* curl_sasl: fix compiler error with --disable-crypto-authDaniel Stenberg2021-03-281-2/+1
| | | | | | ... if libgsasl was found. Closes #6806
* ldap: only set the callback ptr for TLS context when TLS is usedPatrick Monnerat2021-03-281-4/+5
| | | | | | Follow-up to a5eee22e594c2460f Fixes #6804 Closes #6805
* copyright: update copyright year ranges to 2021Daniel Stenberg2021-03-2735-35/+36
| | | | | Reviewed-by: Emil Engler Closes #6802
* send_speed: simplify the checks for if a speed limit is setDaniel Stenberg2021-03-273-7/+7
| | | | | ... as we know the value cannot be set to negative: enforced by setopt()
* http: cap body data amount during send speed limitingDaniel Stenberg2021-03-272-11/+40
| | | | | | | | | By making sure never to send off more than the allowed number of bytes per second the speed limit logic is given more room to actually work. Reported-by: Fabian Keil Bug: https://curl.se/mail/lib-2021-03/0042.html Closes #6797
* urldata: merge "struct DynamicStatic" into "struct UrlState"Daniel Stenberg2021-03-2616-141/+127
| | | | | | | | Both were used for the same purposes and there was no logical separation between them. Combined, this also saves 16 bytes in less holes in my test build. Closes #6798
* tests/README.md: mentioned that en_US.UTF-8 is requiredDaniel Stenberg2021-03-261-0/+1
| | | | | Reported-by: Oumph on github Fixes #6768
* HISTORY: fixed the Mac OS X 10.1 release dateDaniel Stenberg2021-03-261-5/+7
| | | | Based on what Wikipedia says
View Lorry Controller Status