summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* curl: cap the maximum allowed values for retry time argumentsbagder/retry-time-maxDaniel Stenberg2019-07-295-4/+61
| | | | | | | | | ... to avoid integer overflows later when multiplying with 1000 to convert seconds to milliseconds. Added test 1269 to verify. Reported-by: Jason Lee
* curl: avoid uncessary libcurl timeouts (in parallel mode)Daniel Stenberg2019-07-291-2/+5
| | | | | | | When curl_multi_wait() returns OK without file descriptors to wait for, it might already have done a long timeout. Closes #4159
* HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknownBalazs Kovacsics2019-07-293-5/+22
| | | | | | | | | If using the read callback for HTTP_POST, and POSTFIELDSIZE is not set, automatically add a Transfer-Encoding: chunked header, same as it is already done for HTTP_PUT, HTTP_POST_FORM and HTTP_POST_MIME. Update test 1514 according to the new behaviour. Closes #4138
* winbuild: add vquic to list of build directoriesDaniel Stenberg2019-07-291-0/+4
| | | | | | | | | This fixes the winbuild build method which broke several days ago when experimental quic support was added in 3af0e76. Reported-by: Michael Lee Fixes https://github.com/curl/curl/issues/4158
* easy: resize receive buffer on easy handle resetJay Satiro2019-07-251-0/+14
| | | | | | | | | | | | | | | | | | | - In curl_easy_reset attempt to resize the receive buffer to its default size. If realloc fails then continue using the previous size. Prior to this change curl_easy_reset did not properly handle resetting the receive buffer (data->state.buffer). It reset the variable holding its size (data->set.buffer_size) to the default size (READBUFFER_SIZE) but then did not actually resize the buffer. If a user resized the buffer by using CURLOPT_BUFFERSIZE to set the size smaller than the default, later called curl_easy_reset and attempted to reuse the handle then a heap overflow would very likely occur during that handle's next transfer. Reported-by: Felix Hädicke Fixes https://github.com/curl/curl/issues/4143 Closes https://github.com/curl/curl/pull/4145
* examples: Avoid reserved names in hiperfifo examplesBrad Spencer2019-07-252-33/+29
| | | | | | | | | | | | | | | - Trade in __attribute__((unused)) for the classic (void)x to silence unused symbols. Because the classic way is not gcc specific. Also because the prior method mapped to symbol _Unused, which starts with _ and a capital letter which is reserved. Assisted-by: The Infinnovation team Bug: https://github.com/curl/curl/issues/4120#issuecomment-512542108 Closes https://github.com/curl/curl/pull/4153
* RELEASE-NOTES: syncedDaniel Stenberg2019-07-251-3/+20
|
* ssh-libssh: do not specify O_APPEND when not in append modeFelix Hädicke2019-07-251-1/+1
| | | | | | | | | Specifying O_APPEND in conjunction with O_TRUNC and O_CREAT does not make much sense. And this combination of flags is not accepted by all SFTP servers (at least not Apache SSHD). Fixes #4147 Closes #4148
* multi: call detach_connection before Curl_disconnectGergely Nagy2019-07-251-2/+4
| | | | | | | | Curl_disconnect bails out if conn->easyq is not empty, detach_connection needs to be called first to remove the current easy from the queue. Fixes #4144 Closes #4151
* tool_operate: fix implicit call to easysrc_cleanupJay Satiro2019-07-231-2/+6
| | | | | | | | | | easysrc_cleanup is only defined when CURL_DISABLE_LIBCURL_OPTION is not defined, and prior to this change would be called regardless. Bug: https://github.com/curl/curl/pull/3804#issuecomment-513922637 Reported-by: Marcel Raad Closes https://github.com/curl/curl/pull/4142
* curl:create_transfers check return code from curl_easy_setoptDaniel Stenberg2019-07-221-1/+3
| | | | | | | | From commit b8894085 Pointed out by Coverity CID 1451703 Closes #4134
* HTTP3: initial (experimental) supportDaniel Stenberg2019-07-2133-23/+2520
| | | | | | | | | USe configure --with-ngtcp2 or --with-quiche Using either option will enable a HTTP3 build. Co-authored-by: Alessandro Ghedini <alessandro@ghedini.me> Closes #3500
* curl: remove dead codeDaniel Stenberg2019-07-211-25/+19
| | | | | | | The loop never loops (since b889408500), pointed out by Coverity (CID 1451702) Closes #4133
* docs/PARALLEL-TRANSFERS: correct the version numberDaniel Stenberg2019-07-201-1/+1
|
* docs/PARALLEL-TRANSFERS: addedDaniel Stenberg2019-07-202-0/+59
|
* curl: support parallel transfersDaniel Stenberg2019-07-2034-784/+1501
| | | | | | | | This is done by making sure each individual transfer is first added to a linked list as then they can be performed serially, or at will, in parallel. Closes #3804
* docs/MANUAL.md: converted to markdown from plain textDaniel Stenberg2019-07-202-1058/+1011
| | | | | | ... will make it render as a nicer web page. Closes #4131
* curl_version_info: provide nghttp2 detailsDaniel Stenberg2019-07-203-2/+18
| | | | | | Introducing CURLVERSION_SIXTH with nghttp2 info. Closes #4121
* bump: start working on 7.66.0Daniel Stenberg2019-07-192-10/+9
|
* source: remove names from source commentsDaniel Stenberg2019-07-192-27/+12
| | | | | | | | | | | | | | Several reasons: - we can't add everyone who's helping out so its unfair to just a few selected ones. - we already list all helpers in THANKS and in RELEASE-NOTES for each release - we don't want to give the impression that some parts of the code is "owned" or "controlled" by specific persons Assisted-by: Daniel Gustafsson Closes #4129
* RELEASE-NOTES: 7.65.3curl-7_65_3Daniel Stenberg2019-07-191-7/+6
|
* THANKS: 7.65.3 statusDaniel Stenberg2019-07-191-0/+1
|
* progress: make the progress meter appear againDaniel Stenberg2019-07-191-118/+108
| | | | | | | | Fix regression caused by 21080e1 Reported-by: Chih-Hsuan Yen Fixes #4122 Closes #4124
* version: bump to 7.65.3Daniel Stenberg2019-07-192-167/+11
|
* RELEASE-NOTES: Contributors or now 1990Daniel Stenberg2019-07-171-1/+1
|
* RELEASE-NOTES: 7.65.2curl-7_65_2Daniel Stenberg2019-07-171-56/+92
|
* THANKS: add contributors from 7.65.2Daniel Stenberg2019-07-171-0/+25
|
* cmake: Fix finding Brotli on case-sensitive file systemsaasivov2019-07-171-1/+1
| | | | | | | | - Find package "Brotli" instead of "BROTLI" since the former is the casing used for CMake/FindBrotli.cmake, and otherwise find_package may fail on a case-sensitive file system. Fixes https://github.com/curl/curl/issues/4117
* CURLOPT_RANGE.3: Caution against using it for HTTP PUTJay Satiro2019-07-171-0/+8
| | | | | | | | | | AFAICT CURLOPT_RANGE does not support ranged HTTP PUT uploads so I've cautioned against using it for that purpose and included a workaround. Bug: https://curl.haxx.se/mail/lib-2019-04/0075.html Reported-by: Christopher Head Closes https://github.com/curl/curl/issues/3814
* CURLOPT_SEEKDATA.3: fix variable nameStefano Simonelli2019-07-171-1/+1
| | | | Closes https://github.com/curl/curl/pull/4118
* CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCHgeorgeok2019-07-171-0/+6
| | | | | | | | | If the SSL backend is Schannel and the user specifies an Schannel CALG_ that is not supported by the protocol or the server then curl returns CURLE_SSL_CONNECT_ERROR (35) SEC_E_ALGORITHM_MISMATCH. Fixes https://github.com/curl/curl/issues/3389 Closes https://github.com/curl/curl/pull/4106
* nss: inspect returnvalue of token checkDaniel Gustafsson2019-07-171-1/+4
| | | | | | | | PK11_IsPresent() checks for the token for the given slot is available, and sets needlogin flags for the PK11_Authenticate() call. Should it return false, we should however treat it as an error and bail out. Closes https://github.com/curl/curl/pull/4110
* docs: Explain behavior change in --tlsv1. options since 7.54Jay Satiro2019-07-175-0/+22
| | | | | | | | | | | Since 7.54 --tlsv1. options use the specified version or later, however older versions of curl documented it as using just the specified version which may or may not have happened depending on the TLS library. Document this discrepancy to allay confusion for users familiar with the old documentation that expect just the specified version. Fixes https://github.com/curl/curl/issues/4097 Closes https://github.com/curl/curl/pull/4119
* libcurl: Restrict redirect schemes (follow-up)Jay Satiro2019-07-177-16/+18
| | | | | | | | | | | | - Allow FTPS on redirect. - Update default allowed redirect protocols in documentation. Follow-up to 6080ea0. Ref: https://github.com/curl/curl/pull/4094 Closes https://github.com/curl/curl/pull/4115
* test1173: make it also check all libcurl option man pagesDaniel Stenberg2019-07-167-39/+35
| | | | | | ... and adjust those that cause errors Closes #4116
* curl: only accept COLUMNS less than 10000Daniel Stenberg2019-07-161-1/+2
| | | | | | | | ... as larger values would rather indicate something silly (and could potentially cause buffer problems). Reported-by: pendrek at hackerone Closes #4114
* dist: add manpage-syntax.plDaniel Stenberg2019-07-151-1/+1
| | | | follow-up to 7fb66c403
* test1173: detect some basic man page format mistakesDaniel Stenberg2019-07-153-1/+90
| | | | | | Triggered by PR #4111 Closes #4113
* docs: Fix missing lines caused by undefined macrosBjarni Ingi Gislason2019-07-153-3/+3
| | | | | | | | | | | | | | | | | - Escape apostrophes at line start. Some lines begin with a "'" (apostrophe, single quote), which is then interpreted as a control character in *roff. Such lines are interpreted as being a call to a macro, and if undefined, the lines are removed from the output. Bug: https://bugs.debian.org/926352 Signed-off-by: Bjarni Ingi Gislason <bjarniig@rhi.hi.is> Submitted-by: Alessandro Ghedini Closes https://github.com/curl/curl/pull/4111
* libcurl-security.3: update to new CURLOPT_REDIR_PROTOCOLS defaultsDaniel Stenberg2019-07-141-3/+3
| | | | follow-up to 6080ea098
* libcurl: Add testcase for gopher redirectsLinos Giannopoulos2019-07-142-1/+52
| | | | | | | | | | | The testcase ensures that redirects to CURLPROTO_GOPHER won't be allowed, by default, in the future. Also, curl is being used for convenience while keeping the testcases DRY. The expected error code is CURLE_UNSUPPORTED_PROTOCOL when the client is redirected to CURLPROTO_GOPHER Signed-off-by: Linos Giannopoulos <lgian@skroutz.gr>
* libcurl: Restrict redirect schemesLinos Giannopoulos2019-07-141-3/+1
| | | | | | | | | | | | | | | | | | | | All protocols except for CURLPROTO_FILE/CURLPROTO_SMB and their TLS counterpart were allowed for redirect. This vastly broadens the exploitation surface in case of a vulnerability such as SSRF [1], where libcurl-based clients are forced to make requests to arbitrary hosts. For instance, CURLPROTO_GOPHER can be used to smuggle any TCP-based protocol by URL-encoding a payload in the URI. Gopher will open a TCP connection and send the payload. Only HTTP/HTTPS and FTP are allowed. All other protocols have to be explicitly enabled for redirects through CURLOPT_REDIR_PROTOCOLS. [1]: https://www.acunetix.com/blog/articles/server-side-request-forgery-vulnerability/ Signed-off-by: Linos Giannopoulos <lgian@skroutz.gr> Closes #4094
* openssl: define HAVE_SSL_GET_SHUTDOWN based on version numberZenju2019-07-146-27/+5
| | | | Closes #4100
* http: allow overriding timecond with custom headerPeter Simonyi2019-07-147-8/+145
| | | | | | | | | With CURLOPT_TIMECONDITION set, a header is automatically added (e.g. If-Modified-Since). Allow this to be replaced or suppressed with CURLOPT_HTTPHEADER. Fixes #4103 Closes #4109
* smb: Use the correct error code for access denied on file openJuergen Hoetzel2019-07-111-0/+2
| | | | | | | | - Return CURLE_REMOTE_ACCESS_DENIED for SMB access denied on file open. Prior to this change CURLE_REMOTE_FILE_NOT_FOUND was returned instead. Closes https://github.com/curl/curl/pull/4095
* DEPRECATE: fixup versions and spellingDaniel Gustafsson2019-07-111-3/+4
| | | | | | | Correctly set the July 17 version to 7.65.2, and update spelling to be consistent. Also fix a typo. Closes https://github.com/curl/curl/pull/4107
* system_win32: fix clang warningGisle Vanem2019-07-111-1/+1
| | | | | | - Declare variable in header as extern. Bug: https://github.com/curl/curl/commit/48b9ea4#commitcomment-34084597
* headers: Remove no longer exported functionsDaniel Gustafsson2019-07-1011-37/+6
| | | | | | | | | | | | | | | | | | | | There were a leftover few prototypes of Curl_ functions that we used to export but no longer do, this removes those prototypes and cleans up any comments still referring to them. Curl_write32_le(), Curl_strcpy_url(), Curl_strlen_url(), Curl_up_free() Curl_concat_url(), Curl_detach_connnection(), Curl_http_setup_conn() were made static in 05b100aee247bb9bec8e9a1b0166496aa4248d1c. Curl_http_perhapsrewind() made static in 574aecee208f79d391f10d57520b3. For the remainder, I didn't trawl the Git logs hard enough to capture their exact time of deletion, but they were all gone: Curl_splayprint(), Curl_http2_send_request(), Curl_global_host_cache_dtor(), Curl_scan_cache_used(), Curl_hostcache_destroy(), Curl_second_connect(), Curl_http_auth_stage() and Curl_close_connections(). Closes #4096 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* CMake: fix typos and spellingDaniel Gustafsson2019-07-092-3/+3
|
* CMake: Convert errant elseif() to else()Kyle Edwards2019-07-091-1/+1
| | | | | | | | | | | CMake interprets an elseif() with no arguments as elseif(FALSE), resulting in the elseif() block not being executed. That is not what was intended here. Change the empty elseif() to an else() as it was intended. Closes #4101 Reported-by: Artalus <artalus-mail@yandex.ru> Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
View Lorry Controller Status