summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Curl_http2_setup: don't change connection data on repeat invokesbagder/http2-setupDaniel Stenberg2021-09-161-6/+6
| | | | | | | | | Regression from 3cb8a748670ab88c (releasde in 7.79.0). That change moved transfer oriented inits to before the check but also erroneously moved a few connection oriented ones, which causes problems. Fixes #7730 Reported-by: Evangelos Foutras
* tests/sshserver.pl: make it work with openssh-8.7p1Kamil Dudka2021-09-161-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | ... by not using options with no argument where an argument is required: === Start of file tests/log/ssh_server.log curl_sshd_config line 6: no argument after keyword "DenyGroups" curl_sshd_config line 7: no argument after keyword "AllowGroups" curl_sshd_config line 10: Deprecated option AuthorizedKeysFile2 curl_sshd_config line 29: Deprecated option KeyRegenerationInterval curl_sshd_config line 39: Deprecated option RhostsRSAAuthentication curl_sshd_config line 40: Deprecated option RSAAuthentication curl_sshd_config line 41: Deprecated option ServerKeyBits curl_sshd_config line 45: Deprecated option UseLogin curl_sshd_config line 56: no argument after keyword "AcceptEnv" curl_sshd_config: terminating, 3 bad configuration options === End of file tests/log/ssh_server.log === Start of file log/sftp_server.log curl_sftp_config line 33: Unsupported option "rhostsrsaauthentication" curl_sftp_config line 34: Unsupported option "rsaauthentication" curl_sftp_config line 52: no argument after keyword "sendenv" curl_sftp_config: terminating, 1 bad configuration options Connection closed. Connection closed === End of file log/sftp_server.log Closes #7724
* hsts: handle unlimited expiryDaniel Stenberg2021-09-154-28/+47
| | | | | | | | | | | | | | | | | | | When setting a blank expire string, meaning unlimited, curl would pass TIME_T_MAX to getime_r() when creating the output, while on 64 bit systems such a large value cannot be convetered to a tm struct making curl to exit the loop with an error instead. It can't be converted because the year it would represent doesn't fit in the 'int tm_year' field! Starting now, unlimited expiry is instead handled differently by using a human readable expiry date spelled out as "unlimited" instead of trying to use a distant actual date. Test 1660 and 1915 have been updated to help verify this change. Reported-by: Jonathan Cardoso Fixes #7720 Closes #7721
* curl_multi_fdset: make FD_SET() not operate on sockets out of rangeDaniel Stenberg2021-09-152-13/+21
| | | | | | | | | | The VALID_SOCK() macro was made to only check for FD_SETSIZE if curl was built to use select(), even though the curl_multi_fdset() function always and unconditionally uses FD_SET and needs the check. Reported-by: 0xee on github Fixes #7718 Closes #7719
* FAQ: add GOPHERS + curl works on data, not filesDaniel Stenberg2021-09-151-4/+4
|
* RELEASE-NOTES: syncedcurl-7_79_0Daniel Stenberg2021-09-141-7/+39
| | | | For the 7.79.0 release
* THANKS: add contributors from 7.79.0 release cycleDaniel Stenberg2021-09-141-0/+26
|
* FAQ: add two dev related questionsDaniel Stenberg2021-09-141-0/+41
| | | | | | | | 8.1 Why does curl use C89? 8.2 Will curl be rewritten? Spell-checked-by: Paul Johnson Closes #7715
* zuul.d/jobs: disable three tests for *-openssl-disable-proxyDaniel Stenberg2021-09-131-0/+1
| | | | | | | ... as they mysteriously seem to permfail without being related to proxy. Closes #7714
* ftp,imap,pop3,smtp: reject STARTTLS server response pipeliningPatrick Monnerat2021-09-139-1/+236
| | | | | | | | | | | | | If a server pipelines future responses within the STARTTLS response, the former are preserved in the pingpong cache across TLS negotiation and used as responses to the encrypted commands. This fix detects pipelined STARTTLS responses and rejects them with an error. CVE-2021-22947 Bug: https://curl.se/docs/CVE-2021-22947.html
* ftp,imap,pop3: do not ignore --ssl-reqdPatrick Monnerat2021-09-137-36/+195
| | | | | | | | | | | | In imap and pop3, check if TLS is required even when capabilities request has failed. In ftp, ignore preauthentication (230 status of server greeting) if TLS is required. Bug: https://curl.se/docs/CVE-2021-22946.html CVE-2021-22946
* mqtt: clear the leftovers pointer when sending succeedsz2_ on hackerone2021-09-131-0/+4
| | | | | | CVE-2021-22945 Bug: https://curl.se/docs/CVE-2021-22945.html
* zuul: bump the rustls job to use v0.7.2Daniel Stenberg2021-09-131-1/+2
| | | | | | ... and add -lm when using a rust library. Closes #7701
* RELEASE-PROCEDURE: add release dates from now to 8.0.0 in 2023Daniel Stenberg2021-09-131-4/+5
|
* SECURITY-PROCESS: tweak a little to match current practicesDaniel Stenberg2021-09-131-10/+11
| | | | Closes #7713
* http_proxy: fix the User-Agent inclusion in CONNECTDaniel Stenberg2021-09-133-19/+130
| | | | | | | | | | | | It should not refer to the uagent string that is allocated and created for the end server http request, as that pointer may be cleared on subsequent CONNECT requests. Added test case 1184 to verify. Reported-by: T200proX7 on github Fixes #7705 Closes #7707
* Curl_hsts_loadcb: don't attempt to load if hsts wasn't initedDaniel Stenberg2021-09-121-1/+3
| | | | | | Reported-by: Jonathan Cardoso Fixes #7710 Closes #7711
* ngtcp2: fix build with ngtcp2 and nghttp3Tatsuhiro Tsujikawa2021-09-122-4/+8
| | | | | | | | | ngtcp2_conn_client_new and nghttp3_conn_client_new are now macros. Check the wrapped functions instead. ngtcp2_stream_close callback now takes flags parameter. Closes #7709
* write-out.d: clarify size_download/uploadDaniel Stenberg2021-09-121-2/+4
| | | | | | They show the number of "body" bytes transfered. Fixes #7702 Closes #7706
* http2: Curl_http2_setup needs to init stream data in all invokesDaniel Stenberg2021-09-111-12/+17
| | | | | | | | | | | | Thus function was written to avoid doing multiple connection data initializations, which is fine, but since it also initiates stream related data it is crucial that it doesn't skip those even if called again for the same connection. Solved by moving the stream initializations before the "doing-it-again" check. Reported-by: Inho Oh Fixes #7630 Closes #7692
* url: fix compiler warning in no-verbose buildsDaniel Stenberg2021-09-101-0/+2
| | | | | | Follow-up from 2f0bb864c12 Closes #7700
* non-ascii: fix build errors from strerror fixDaniel Stenberg2021-09-101-12/+10
| | | | | | Follow-up to 2f0bb864c12 Closes #7697
* parse_args: redo the warnings for --remote-header-name combosDaniel Stenberg2021-09-103-13/+13
| | | | | | | | ... to avoid the memory leak risk pointed out by scan-build. Follow-up from 7a3e981781d6c18a Closes #7698
* ngtcp2: adapt to new size defintions upstreamDaniel Stenberg2021-09-101-16/+3
| | | | | Reviewed-by: Tatsuhiro Tsujikawa Closes #7699
* rustls: add strerror.h includeDaniel Stenberg2021-09-101-1/+1
| | | | Follow-up to 2f0bb864c12
* docs: the security list is reached at security at curl.se nowDaniel Stenberg2021-09-102-5/+9
| | | | | | | Also update the FAQ section a bit to encourage users to rather submit security issues on hackerone than sending email. Closes #7689
* runtests: add option -u to error on server unexpectedly aliveMarc Hoersken2021-09-095-30/+102
| | | | | | | | | | | | | | | Let's try to actually handle the server unexpectedly alive case by first making them visible on CI builds as failures. This is needed to detect issues with killing of the test servers completely including nested process chains with multiple PIDs per test server (including bash and perl). On Windows/cygwin platforms this is especially helpful with debugging PID mixups due to cygwin using its own PID space. Reviewed-by: Daniel Stenberg Closes #7180
* opts docs: unify phrasing in NAME headerDaniel Stenberg2021-09-09134-246/+246
| | | | | | | | | | | | | - avoid writing "set ..." or "enable/disable ..." or "specify ..." *All* options for curl_easy_setopt() are about setting or enabling things and most of the existing options didn't use that way of description. - start with lowercase letter, unless abbreviation. For consistency. - Some additional touch-ups Closes #7688
* strerror.h: remove the #include from files not using itDaniel Stenberg2021-09-0912-13/+1
|
* lib: don't use strerror()Daniel Stenberg2021-09-098-22/+71
| | | | | | | | | | We have and provide Curl_strerror() internally for a reason: strerror() is not necessarily thread-safe so we should always try to avoid it. Extended checksrc to warn for this, but feature the check disabled by default and only enable it in lib/ Closes #7685
* cirrus: Add FreeBSD 13.0 job and disable sanitizer buildDaniel Gustafsson2021-09-081-9/+11
| | | | | | | | | | | | | As alluded to the in the now removed comment, a 13.0 image became available and is now ready to be used. The sanitizer builds were running on the 12.1 image which since has been removed from the config, leaving the builds not running at all. When enabled it turns out that they don't actually work due to very long timeouts in executing the tests, so keep the disabled for now but a bit more controlled. Closes #7592
* copyrights: update copyright year rangesDaniel Stenberg2021-09-089-9/+9
|
* RELEASE-NOTES: syncedDaniel Stenberg2021-09-081-11/+28
|
* INTERNALS: c-ares has a new home: c-ares.orgDaniel Stenberg2021-09-071-1/+1
|
* docs: remove experimental mentions from HSTS and MQTTDaniel Stenberg2021-09-077-38/+8
| | | | | | Reported-by: Jonathan Cardoso Bug: https://github.com/curl/curl/pull/6700#issuecomment-913792863 Closes #7681
* curl: add warning for incompatible parameters usageCao ZhenXiang2021-09-061-10/+13
| | | | | | --continue-at - and --remote-header-name are known incompatible parameters Closes #7674
* examples/*hiperfifo.c: fix calloc arguments to match function protogit-bruh2021-09-063-3/+3
| | | | Closes #7678
* INTERNALS: bump c-ares requirement to 1.16.0Daniel Stenberg2021-09-061-1/+1
| | | | Since ba904db0705c93 we use ares_getaddrinfo, added in c-ares 1.16.0
* curl: stop retry if Retry-After: is longer than allowedDaniel Stenberg2021-09-063-1/+66
| | | | | | | | | | | If Retry-After: specifies a period that is longer than what fits within --retry-max-time, then stop retrying immediately. Added test 366 to verify. Reported-by: Kari Pahula Fixes #7675 Closes #7676
* mbedtls: avoid using a large buffer on the stackMAntoniak2021-09-061-13/+17
| | | | | | | | | Use dynamic memory allocation for the buffer used in checking "pinned public key". The PUB_DER_MAX_BYTES parameter with default settings is set to a value greater than 2kB. Co-authored-by: Daniel Stenberg Closes #7586
* configure: make --disable-hsts workDaniel Stenberg2021-09-051-7/+7
| | | | | | | | | | | | The AC_ARG_ENABLE() macro itself uses a variable called 'enable_[option]', so when our script also used a variable with that name for the purpose of storing what the user wants, it also accidentally made it impossible to switch off the feature with --disable-hsts. Fix this by renaming our variable. Reported-by: Michał Antoniak Fixes #7669 Closes #7672
* config.d: note that curlrc is used even when --configJay Satiro2021-09-051-2/+2
| | | | | | | Bug: https://github.com/curl/curl/pull/7666#issuecomment-912214751 Reported-by: Viktor Szakats Closes https://github.com/curl/curl/pull/7667
* RELEASE-NOTES: syncedDaniel Stenberg2021-09-041-7/+33
|
* test1173: check references to libcurl optionsDaniel Stenberg2021-09-042-17/+65
| | | | | | | ... that they refer to actual existing libcurl options. Reviewed-by: Daniel Gustafsson Closes #7656
* CURLOPT_UNIX_SOCKET_PATH.3: remove nginx reference, add see alsoDaniel Stenberg2021-09-041-4/+5
| | | | Closes #7656
* opt-docs: verify man page sections + orderDaniel Stenberg2021-09-0416-59/+149
| | | | | | | | | | | | | | | | | | | | In every libcurl option man page there are now 8 mandatory sections that must use the right name in the correct order and test 1173 verifies this. Only 14 man pages needed adjustments. The sections and the order is as follows: - NAME - SYNOPSIS - DESCRIPTION - PROTOCOLS - EXAMPLE - AVAILABILITY - RETURN VALUE - SEE ALSO Reviewed-by: Daniel Gustafsson Closes #7656
* opt-docs: make sure all man pages have examplesDaniel Stenberg2021-09-0411-16/+237
| | | | | | | | | Extended manpage-syntax.pl (run by test 1173) to check that every man page for a libcurl option has an EXAMPLE section that is more than two lines. Then fixed all errors it found and added examples. Reviewed-by: Daniel Gustafsson Closes #7656
* get.d: provide more useful examplesDaniel Stenberg2021-09-041-0/+2
| | | | Closes #7668
* page-header: add GOPHERS, simplify wording in the 1st paraDaniel Stenberg2021-09-031-6/+5
| | | | Closes #7665
* connect: get local port + ip also when reusing connectionsDaniel Stenberg2021-09-023-4/+74
| | | | | | | | | | | | Regression. In d6a37c23a3c (7.75.0) we removed the duplicated storage (connection + easy handle), so this info needs be extracted again even for re-used connections. Add test 435 to verify Reported-by: Max Dymond Fixes #7660 Closes #7662
View Lorry Controller Status