summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* http2: convert an assert to run-time checkbagder/http2-assert-to-run-timeDaniel Stenberg2018-04-211-2/+4
| | | | | | | | | Fuzzing has proven we can reach code in on_frame_recv with status_code not having been set, so let's detect that in run-time (instead of with assert) and error error accordingly. Detected by OSS-Fuzz Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7903
* http2: handle GOAWAY properlyDaniel Stenberg2018-04-204-9/+31
| | | | | | | | | | When receiving REFUSED_STREAM, mark the connection for close and retry streams accordingly on another/fresh connection. Reported-by: Terry Wu Fixes #2416 Fixes #1618 Closes #2510
* http2: clear the "drain counter" when a stream is closedDaniel Stenberg2018-04-201-0/+1
| | | | | | | | | | This fixes the notorious "httpc->drain_total >= data->state.drain" assert. Reported-by: Anders Bakken Fixes #1680 Closes #2509
* http2: avoid strstr() on data not zero terminatedDaniel Stenberg2018-04-201-2/+5
| | | | | | | | | | | | | It's not strictly clear if the API contract allows us to call strstr() on a string that isn't zero terminated even when we know it will find the substring, and clang's ASAN check dislikes us for it. Also added a check of the return code in case it fails, even if I can't think of a situation how that can trigger. Detected by OSS-Fuzz Closes #2513 Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7760
* openssl: fix subjectAltName check on non-ASCII platformsStephan Mühlstrasser2018-04-201-4/+46
| | | | | | | | Curl_cert_hostcheck operates with the host character set, therefore the ASCII subjectAltName string retrieved with OpenSSL must be converted to the host encoding before comparison. Closes #2493
* openssl: Add support for OpenSSL 1.1.1 verbose-mode trace messagesJay Satiro2018-04-201-8/+47
| | | | | | | | | | | - Support handling verbose-mode trace messages of type SSL3_RT_INNER_CONTENT_TYPE, SSL3_MT_ENCRYPTED_EXTENSIONS, SSL3_MT_END_OF_EARLY_DATA, SSL3_MT_KEY_UPDATE, SSL3_MT_NEXT_PROTO, SSL3_MT_MESSAGE_HASH Reported-by: iz8mbw@users.noreply.github.com Fixes https://github.com/curl/curl/issues/2403
* ftplistparser: keep state between invokesDaniel Stenberg2018-04-191-1/+2
| | | | | | | | Regression from f786d1f14 Reported-by: wncboy on github Fixes #2445 Closes #2508
* detect_proxy: only show proxy use if it had contentsDaniel Stenberg2018-04-191-1/+2
|
* http2: handle on_begin_headers() called more than onceDaniel Stenberg2018-04-191-8/+4
| | | | | | | | | | | This triggered an assert if called more than once in debug mode (and a memory leak if not debug build). With the right sequence of HTTP/2 headers incoming it can happen. Detected by OSS-Fuzz Closes #2507 Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7764
* schannel: add support for CURLOPT_CAINFODan McNulty2018-04-1837-258/+1406
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Move verify_certificate functionality in schannel.c into a new file called schannel_verify.c. Additionally, some structure defintions from schannel.c have been moved to schannel.h to allow them to be used in schannel_verify.c. - Make verify_certificate functionality for Schannel available on all versions of Windows instead of just Windows CE. verify_certificate will be invoked on Windows CE or when the user specifies CURLOPT_CAINFO and CURLOPT_SSL_VERIFYPEER. - In verify_certificate, create a custom certificate chain engine that exclusively trusts the certificate store backed by the CURLOPT_CAINFO file. - doc updates of --cacert/CAINFO support for schannel - Use CERT_NAME_SEARCH_ALL_NAMES_FLAG when invoking CertGetNameString when available. This implements a TODO in schannel.c to improve handling of multiple SANs in a certificate. In particular, all SANs will now be searched instead of just the first name. - Update tool_operate.c to not search for the curl-ca-bundle.crt file when using Schannel to maintain backward compatibility. Previously, any curl-ca-bundle.crt file found in that search would have been ignored by Schannel. But, with CAINFO support, the file found by that search would have been used as the certificate store and could cause issues for any users that have curl-ca-bundle.crt in the search path. - Update url.c to not set the build time CURL_CA_BUNDLE if the selected SSL backend is Schannel. We allow setting CA location for schannel only when explicitly specified by the user via CURLOPT_CAINFO / --cacert. - Add new test cases 3000 and 3001. These test cases check that the first and last SAN, respectively, matches the connection hostname. New test certificates have been added for these cases. For 3000, the certificate prefix is Server-localhost-firstSAN and for 3001, the certificate prefix is Server-localhost-secondSAN. - Remove TODO 15.2 (Add support for custom server certificate validation), this commit addresses it. Closes https://github.com/curl/curl/pull/1325
* schannel: fix warningJay Satiro2018-04-171-1/+2
| | | | | | | | | | - Fix warning 'integer from pointer without a cast' on 3rd arg in CertOpenStore. The arg type HCRYPTPROV may be a pointer or integer type of the same size. Follow-up to e35b025. Caught by Marc's CI builds.
* docs: fix typosJakub Wilk2018-04-1754-75/+75
| | | | Closes https://github.com/curl/curl/pull/2503
* RELEASE-NOTES: syncedDaniel Stenberg2018-04-171-9/+52
|
* winbuild: Support custom devel paths for each dependencykdekker2018-04-173-86/+152
| | | | | | | | | | | | | | | | | | - Support custom devel paths for c-ares, mbedTLS, nghttp2, libSSH2, OpenSSL and zlib. Respectively: CARES_PATH, MBEDTLS_PATH, NGHTTP2_PATH, SSH2_PATH, SSL_PATH and ZLIB_PATH. - Use lib.exe for making the static library instead of link.exe /lib. The latter is undocumented and could cause problems as noted in the comments. - Remove a dangling URL that no longer worked. (I was not able to find the IDN download at MSDN/microsoft.com, so it seems to be removed.) - Remove custom override for release-ssh2-ssl-dll-zlib configuration. Nobody knows why it was there and as far as we can see is unnecessary. Closes https://github.com/curl/curl/pull/2474
* README.md: add backers and sponsorsJess2018-04-171-0/+27
| | | | Closes #2484
* schannel: add client certificate authenticationArchangel_SDY2018-04-172-1/+123
| | | | | | | Users can now specify a client certificate in system certificates store explicitly using expression like `--cert "CurrentUser\MY\<thumbprint>"` Closes #2376
* ntlm_sspi: fix authentication using Credential Managertoughengineer2018-04-166-10/+41
| | | | | | | | | | | | | If you pass empty user/pass asking curl to use Windows Credential Storage (as stated in the docs) and it has valid credentials for the domain, e.g. curl -v -u : --ntlm example.com currently authentication fails. This change fixes it by providing proper SPN string to the SSPI API calls. Fixes https://github.com/curl/curl/issues/1622 Closes https://github.com/curl/curl/pull/1660
* configure: keep LD_LIBRARY_PATH changes localDaniel Stenberg2018-04-162-49/+63
| | | | | | | | | | ... only set it when we actually have to run tests to reduce its impact on for example build commands etc. Fixes #2490 Closes #2492 Reported-by: Dmitry Mikhirev
* urldata: make service names unconditionalMarcel Raad2018-04-162-10/+1
| | | | | | | | | | | The ifdefs have become quite long. Also, the condition for the definition of CURLOPT_SERVICE_NAME and for setting it from CURLOPT_SERVICE_NAME have diverged. We will soon also need the two options for NTLM, at least when using SSPI, for https://github.com/curl/curl/pull/1660. Just make the definitions unconditional to make that easier. Closes https://github.com/curl/curl/pull/2479
* test1148: tolerate progress updates betterDaniel Stenberg2018-04-161-1/+6
| | | | | Fixes #2446 Closes #2488
* ssh: show libSSH2 error code when closing failsChristian Schmitz2018-04-161-22/+57
| | | | Closes #2500
* vauth: Fix typoDaniel Gustafsson2018-04-153-5/+5
| | | | | | Address various spellings of "credentials". Closes https://github.com/curl/curl/pull/2496
* system.h: Add sparcv8plus to oracle/sunpro 32-bit detectionDagobert Michelsen2018-04-151-1/+3
| | | | | | | | | | | With specific compiler options selecting the arch like -xarch=sparc on newer compilers like Oracle Studio 12.4 there is no definition of __sparcv8 but __sparcv8plus which means the V9 ISA, but limited to the 32ÎíÎñbit subset defined by the V8plus ISA specification, without the Visual Instruction Set (VIS), and without other implementation-specific ISA extensions. So it should be the same as __sparcv8. Closes https://github.com/curl/curl/pull/2491
* checksrc: Fix typoDaniel Gustafsson2018-04-152-5/+5
| | | | | | Fix typo in "semicolon" spelling and remove stray tab character. Closes https://github.com/curl/curl/pull/2498
* all: Refactor malloc+memset to use callocDaniel Gustafsson2018-04-1513-46/+16
| | | | | | | | | | When a zeroed out allocation is required, use calloc() rather than malloc() followed by an explicit memset(). The result will be the same, but using calloc() everywhere increases consistency in the codebase and avoids the risk of subtle bugs when code is injected between malloc and memset by accident. Closes https://github.com/curl/curl/pull/2497
* duphandle: make sure CURLOPT_RESOLVE is duplicated fine tooDaniel Stenberg2018-04-122-1/+14
| | | | | | | | Verified in test 1502 now Fixes #2485 Closes #2486 Reported-by: Ernst Sjöstrand
* mailmap: add a monnerat fixup [ci skip]Daniel Stenberg2018-04-121-0/+1
|
* proxy: show getenv proxy use in verbose outputDaniel Stenberg2018-04-111-7/+19
| | | | | | | | | ... to aid debugging etc as it sometimes isn't immediately obvious why curl uses or doesn't use a proxy. Inspired by #2477 Closes #2480
* travis: build libpsl and make builds use itDaniel Stenberg2018-04-111-17/+57
| | | | closes #2471
* travis: bump to clang 6 and gcc 7Daniel Stenberg2018-04-101-9/+9
| | | | | | Extra-eye-on-this-by: Marcel Raad Closes #2478
* travis: use trusty for coverage buildMarcel Raad2018-04-101-1/+1
| | | | | | This works now and precise is in the process of being decommissioned. Closes https://github.com/curl/curl/pull/2476
* lib: silence null-dereference warningsMarcel Raad2018-04-092-4/+0
| | | | | | | | | | In debug mode, MingGW-w64's GCC 7.3 issues null-dereference warnings when dereferencing pointers after DEBUGASSERT-ing that they are not NULL. Fix this by removing the DEBUGASSERTs. Suggested-by: Daniel Stenberg Ref: https://github.com/curl/curl/pull/2463
* winbuild: fix URLkdekker2018-04-091-1/+1
| | | | | | | Follow up on https://github.com/curl/curl/pull/2472. Now using en-us instead of nl-nl as language code in the URL. Closes https://github.com/curl/curl/pull/2475
* winbuild: updated the documentationkdekker2018-04-092-8/+19
| | | | | | | The setenv command no longer exists and visual studio build prompts got changed. Used Visual Studio 2015/2017 as reference. Closes #2472
* test1136: fix cookie order after commit c990eadd1277Daniel Stenberg2018-04-091-1/+1
|
* build: cleanup to fix clang warnings/errorsDaniel Stenberg2018-04-083-28/+18
| | | | | | | | | | unit1309 and vtls/gtls: error: arithmetic on a null pointer treated as a cast from integer to pointer is a GNU extension Reported-by: Rikard Falkeborn Fixes #2466 Closes #2468
* examples/sftpuploadresmue: Fix Windows large file seekJay Satiro2018-04-071-1/+5
| | | | | | | | | - Use _fseeki64 instead of fseek (long) to seek curl_off_t in Windows. - Use CURL_FORMAT_CURL_OFF_T specifier instead of %ld to print curl_off_t. Caught by Marc's CI builds.
* curl_setup: provide a CURL_SA_FAMILY_T type if none existsDaniel Stenberg2018-04-073-4/+9
| | | | | | | ... and use this type instead of 'sa_family_t' in the code since several platforms don't have it. Closes #2463
* build: add picky compiler warning flags for gcc 6 and 7Eric Gallager2018-04-076-5/+25
|
* configure: detect sa_family_tDaniel Stenberg2018-04-071-0/+20
|
* tool_operate: Fix retry on FTP 4xx to ignore other protocolsStefan Agner2018-04-071-1/+5
| | | | | | | | | | | | | | | Only treat response code as FTP response codes in case the protocol type is FTP. This fixes an issue where an HTTP download was treated as FTP in case libcurl returned with 33. This happens when the download has already finished and the server responses 416: HTTP/1.1 416 Requested Range Not Satisfiable This should not be treated as an FTP error. Fixes #2464 Closes #2465
* hash: calculate sizes with size_t instead of longsDaniel Stenberg2018-04-062-5/+5
| | | | | | ... since they return size_t anyway! closes #2462
* RELEASE-NOTES: syncedDaniel Stenberg2018-04-062-4/+59
|
* build-openssl.bat: Refer to VS2017 as VC14.1 instead of VC15Jay Satiro2018-04-062-21/+21
| | | | | | | | .. and do the same for build-wolfssl.bat. Because MS calls it VC14.1. Closes https://github.com/curl/curl/pull/2189
* winbuild: make the clean target work without build-typekdekker2018-04-062-11/+18
| | | | | | | | | Due to the check in Makefile.vc and MakefileBuild.vc, no make call can be invoked unless a build-type was specified. However, a clean target only existed when a build type was specified. As a result, the clean target was unreachable. Made clean target unconditional. Closes #2455
* build-openssl.bat: allow custom paths for VS and perlpatelvivekv19932018-04-061-24/+66
| | | | | Fixes #2430 Closes #2457
* FTP: allow PASV on IPv6 connections when a proxy is being usedLaurie Clark-Michalek2018-04-061-1/+1
| | | | | | | | | | | | In the situation of a client connecting to an FTP server using an IPv6 tunnel proxy, the connection info will indicate that the connection is IPv6. However, because the server behing the proxy is IPv4, it is permissable to attempt PSV mode. In the case of the FTP server being IPv4 only, EPSV will always fail, and with the current logic curl will be unable to connect to the server, as the IPv6 fwdproxy causes curl to think that EPSV is impossible. Closes #2432
* file: restore old behavior for file:////foo/bar URLsJon DeVree2018-04-062-35/+13
| | | | | | | | | | | | | | | | | | | | | curl 7.57.0 and up interpret this according to Appendix E.3.2 of RFC 8089 but then returns an error saying this is unimplemented. This is actually a regression in behavior on both Windows and Unix. Before curl 7.57.0 this URL was treated as a path of "//foo/bar" and then passed to the relevant OS API. This means that the behavior of this case is actually OS dependent. The Unix path resolution rules say that the OS must handle swallowing the extra "/" and so this path is the same as "/foo/bar" The Windows path resolution rules say that this is a UNC path and automatically handles the SMB access for the program. So curl on Windows was already doing Appendix E.3.2 without any special code in curl. Regression Closes #2438
* Revert "openssl: Don't add verify locations when verifypeer==0"Gaurav Malhotra2018-04-061-15/+16
| | | | | | | | | | | | | This reverts commit dc85437736e1fc90e689bb1f6c51c8f1aa9430eb. libcurl (with the OpenSSL backend) performs server certificate verification even if verifypeer == 0 and the verification result is available using CURLINFO_SSL_VERIFYRESULT. The commit that is being reverted caused the CURLINFO_SSL_VERIFYRESULT to not have useful information for the verifypeer == 0 use case (it would always have X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY). Closes #2451
* tls: fix mbedTLS 2.7.0 build + handle sha256 failuresWyatt O'Day2018-04-0610-10/+29
| | | | | | (mbedtls 2.70 compiled with MBEDTLS_DEPRECATED_REMOVED) Closes #2453
View Lorry Controller Status