summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* test1660: check the created HSTS file as text modebagder/test-1660-windowsDaniel Stenberg2021-04-211-1/+1
|
* RELEASE-NOTES: syncedDaniel Stenberg2021-04-201-3/+30
|
* test 493: require https in curl to runDaniel Stenberg2021-04-201-0/+1
| | | | Closes #6927
* tool_operate: don't discard failed parallel transfer resultJay Satiro2021-04-201-6/+11
| | | | | | | | | | | | | | | | | | | | | | | - Save a parallel transfer's result code only when it fails and the transfer is not being retried. Prior to this change the result code was always set which meant that a failed result could be erroneously discarded if a different transfer later had a successful result (CURLE_OK). Before: > curl --fail -Z https://httpbin.org/status/404 https://httpbin.org/delay/10 > echo %ERRORLEVEL% 0 After: > curl --fail -Z https://httpbin.org/status/404 https://httpbin.org/delay/10 > echo %ERRORLEVEL% 22 Closes #xxxx
* openssl: fix build error with OpenSSL < 1.0.2Georeth Zhou2021-04-201-2/+2
| | | | Closes https://github.com/curl/curl/pull/6920
* README.md: delete Codacy UTM parameters & follow permanent redirect [ci skip]Viktor Szakats2021-04-191-1/+1
| | | | | | | | | | | UTM parameters leak referrer and various marketing/tracking information even if these would normally be stripped by website or client policy. This link also works fine without them. Also took the opportunity to update the URL to the one pointed to by the previous one via permanent redirect. Reviewed-by: Daniel Stenberg Closes #6919
* urlapi: "normalize" numerical IPv4 host namesDaniel Stenberg2021-04-192-3/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the host name in a URL is given as an IPv4 numerical address, the address can be specified with dotted numericals in four different ways: a32, a.b24, a.b.c16 or a.b.c.d and each part can be specified in decimal, octal (0-prefixed) or hexadecimal (0x-prefixed). Instead of passing on the name as-is and leaving the handling to the underlying name functions, which made them not work with c-ares but work with getaddrinfo, this change now makes the curl URL API itself detect and "normalize" host names specified as IPv4 numericals. The WHATWG URL Spec says this is an okay way to specify a host name in a URL. RFC 3896 does not allow them, but curl didn't prevent them before and it seems other RFC 3896-using tools have not either. Host names used like this are widely supported by other tools as well due to the handling being done by getaddrinfo and friends. I decided to add the functionality into the URL API itself so that all users of these functions get the benefits, when for example wanting to compare two URLs. Also, it makes curl built to use c-ares now support them as well and make curl builds more consistent. The normalization makes HTTPS and virtual hosted HTTP work fine even when curl gets the address specified using one of the "obscure" formats. Test 1560 is extended to verify. Fixes #6863 Closes #6871
* libssh: fix "empty expression statement has no effect" warningsDaniel Stenberg2021-04-191-39/+63
| | | | | | | | | | ... by fixing macros to do-while constructs and moving out the calls to "break" outside of the actual macro. It also fixes the problem where the macro was used witin a loop and the break didn't do right. Reported-by: Emil Engler Fixes #6847 Closes #6909
* hsts: enable by defaultDaniel Stenberg2021-04-1915-40/+65
| | | | | | No longer considered experimental. Closes #6700
* vtls: refuse setting any SSL versionDaniel Stenberg2021-04-198-147/+25
| | | | | | | | | ... previously they were supported if a TLS library would (unexpectedly) still support them, but from this change they will be refused already in curl_easy_setopt(). SSLv2 and SSLv3 have been known to be insecure for many years now. Closes #6773
* curl: ignore options asking for SSLv2 or SSLv3Daniel Stenberg2021-04-193-8/+7
| | | | | | | | | | | | | Instead output a warning about it and continue with the defaults. These SSL versions are typically not supported by the TLS libraries since a long time back already since they are inherently insecure and broken. Asking for them to be used will just cause an error to be returned slightly later. In the unlikely event that a user's TLS library actually still supports these protocol versions, this change might make the request a little less insecure. Closes #6772
* test972: verify the json output with jsonlintbagder/test-jsonDaniel Stenberg2021-04-174-1/+68
| | | | | | | Make sure one of the azure jobs has jsonlint installed so that the test runs there. Ref: #6905
* tool_writeout: fix the HTTP_CODE json outputJay Satiro2021-04-172-7/+8
| | | | | | | | Update test 970 accordingly. Reported-by: Michal Rus Fixes #6905 Closes #6906
* openldap: protect SSL-specific code with proper #ifdefDaniel Stenberg2021-04-151-0/+2
| | | | Closes #6901
* libssh2: fix Value stored to 'sshp' is never readDaniel Stenberg2021-04-151-3/+1
| | | | | | Pointed out by scan-build Closes #6900
* tool_getparam: replace (in-place) '%20' by '+' according to RFC1866Victor Vieux2021-04-153-11/+33
| | | | | | Signed-off-by: Victor Vieux <victorvieux@gmail.com> Closes #6895
* configure: provide --with-openssl, deprecate --with-sslDaniel Stenberg2021-04-158-49/+57
| | | | | | Makes the option more explicit. Closes #6887
* RELEASE-NOTES: syncedDaniel Stenberg2021-04-152-56/+13
| | | | and bumped curlver to 7.77.0
* rustls: only return CURLE_AGAIN when TLS session is fully drainedJavier Blazquez2021-04-151-5/+8
| | | | | | | | | | | | | | The code in cr_recv was returning prematurely as soon as the socket reported no more data to read. However, this could be leaving some unread plaintext data in the rustls session from a previous call, causing causing the transfer to hang if the socket never receives further data. We need to ensure that the session is fully drained of plaintext data before returning CURLE_AGAIN to the caller. Reviewed-by: Jacob Hoffman-Andrews Closes #6894
* cookie: CURLOPT_COOKIEFILE set to NULL switches off cookiesDaniel Stenberg2021-04-146-3/+175
| | | | | | | | | Add test 676 to verify that setting CURLOPT_COOKIEFILE to NULL again clears the cookiejar from memory. Reported-by: Stefan Karpinski Fixes #6889 Closes #6891
* RELEASE-NOTES: syncedcurl-7_76_1Daniel Stenberg2021-04-141-6/+30
| | | | curl 7.76.1 release
* THANKS: add names from 7.76.1Daniel Stenberg2021-04-131-0/+10
|
* misc: update copyright year ranges to match latest updatesDaniel Stenberg2021-04-132-2/+2
|
* ngtcp2: Use ALPN h3-29 for nowTatsuhiro Tsujikawa2021-04-131-4/+6
| | | | | Fixes #6864 Cloes #6886
* TODO: remove 18.22 --fail-with-bodyJay Satiro2021-04-111-9/+0
| | | | --fail-with-body was added in 8a964cb (precedes curl-7_76_0).
* src/tool_vms.c: remove duplicated word in commentJürgen Gmach2021-04-101-1/+1
| | | | Closes #6881
* configure: fix CURL_DARWIN_CFLAGS useDaniel Stenberg2021-04-091-1/+1
| | | | | | | | | The macro name change was not completely done. Follow-up to 5d2c384452543c Bug: https://github.com/curl/curl/commit/5d2c384452543c7b6c9fb02eaa0afc84fd5ab941#commitcomment-49315187 Reported-by: Marcel Raad Closes #6878
* github/workflow: add "security-extended" to codeql-analysis.ymlAnthony Shaw2021-04-091-0/+1
| | | | | | Extends the CodeQL code scan. Closes #6815
* examples/hiperfifo.c: check event_initialized before deleteJochem Broekhoff2021-04-091-2/+6
| | | | | | | | If event_del is called with the event struct (still) zeroed out, a segmentation fault may occur. event_initialized checks whether the event struct is nonzero. Closes #6876
* ntlm: fix negotiated flags usagePatrick Monnerat2021-04-0931-51/+57
| | | | | | | | | | | | | | | | | According to Microsoft document MS-NLMP, current flags usage is not accurate: flag NTLMFLAG_NEGOTIATE_NTLM2_KEY controls the use of extended security in an NTLM authentication message and NTLM version 2 cannot be negotiated within the protocol. The solution implemented here is: if the extended security flag is set, prefer using NTLM version 2 (as a server featuring extended security should also support version 2). If version 2 has been disabled at compile time, use extended security. Tests involving NTLM are adjusted to this new behavior. Fixes #6813 Closes #6849
* ntlm: support version 2 on 32-bit platformsPatrick Monnerat2021-04-093-19/+66
| | | | Closes #6849
* curl_ntlm_core.h: simplify conditionals for USE_NTLM2SESSIONPatrick Monnerat2021-04-091-3/+2
| | | | | | | ... as !defined(CURL_DISABLE_CRYPTO_AUTH) is a prerequisite for the whole NTLM. Closes #6849
* lib: remove unused HAVE_INET_NTOA_R* definesDaniel Stenberg2021-04-082-18/+0
| | | | Closes #6867
* configure: include <time.h> unconditionallyMichael Forney2021-04-074-54/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | In 2682e5f5, several instances of AC_HEADER_TIME were removed since it is a deprecated autoconf macro. However, this was the macro that defined TIME_WITH_SYS_TIME, which was used to indicate that <time.h> can be included alongside <sys/time.h>. TIME_WITH_SYS_TIME is still used in the configure test body and since it is no longer defined, <time.h> is *not* included on systems that have <sys/time.h>. In particular, at least on musl libc and glibc, <sys/time.h> does not implicitly include <time.h> and does not declare clock_gettime, gmtime_r, or localtime_r. This causes configure to fail to detect those functions. The AC_HEADER_TIME macro deprecation text says > All current systems provide time.h; it need not be checked for. > Not all systems provide sys/time.h, but those that do, all allow > you to include it and time.h simultaneously. So, to fix this issue, simply include <time.h> unconditionally when testing for time-related functions and in libcurl, and don't bother checking for it. Closes #6859
* configure: remove use of RETSIGTYPEMichael Forney2021-04-0719-85/+12
| | | | | | | | | | | This was previously defined by the obsolete AC_TYPE_SIGNAL macro, which was removed in 2682e5f5. The deprecation text says > Your code may safely assume C89 semantics that RETSIGTYPE is void. So, remove it and just use void instead. Closes #6861
* install: add instructions for Apple Darwin platformsMuhammed Yavuz Nuzumlalı2021-04-071-17/+45
| | | | Closes #6860
* configure: disable min version set for DarwinMuhammed Yavuz Nuzumlalı2021-04-071-24/+5
| | | | | Fixes #6838 Closes #6860
* docs/HTTP3.md: update the build instruction using gnutlsDavid Hu2021-04-071-1/+1
| | | | | | | | In ngtcp2 the `with-gnutls` option is disabled by default, which will cause `curl` unable to be `make` because of lacking the libraries needed. Closes #6857
* RELEASE-NOTES: syncedDaniel Stenberg2021-04-071-6/+22
|
* typecheck-gcc: make the ssl-ctx-cb check use SSL_CTX pointersDaniel Stenberg2021-04-071-6/+6
| | | | | | | | ... and not values. Reported-by: locpyl-tidnyd on github Fixes #6818 Closes #6819
* ngtcp2+gnutls: clear credentials when freedDaniel Stenberg2021-04-071-1/+3
| | | | | | | | ... to avoid double-free. Reported-by: Kenneth Davidson Fixes #6824 Closes #6856
* tool_progress: Fix progress meter in parallel modeCherish982021-04-051-0/+8
| | | | | | | | | | | | | | | | Make sure the total amount of DL/UL bytes are counted before the transfer finalizes. Otherwise if a transfer finishes too quick, its total numbers are not added, and results in a DL%/UL% that goes above 100%. Detail: progress_meter() is called periodically, and it may not catch a transfer's total bytes if the value was unknown during the last call, and the transfer is finished and deleted (i.e., lost) during the next call. Closes https://github.com/curl/curl/pull/6840
* libssh: get rid of PATH_MAXEmil Engler2021-04-051-4/+3
| | | | | | | | This removes the last occurrence of PATH_MAX inside our libssh implementation by calculating the path length from the string length of the two components. Closes #6829
* http_proxy: only loop on 407 + close if we have credentialsDaniel Stenberg2021-04-053-1/+62
| | | | | | | | | | ... to fix the retry-loop. Add test 718 to verify. Reported-by: Daniel Kurečka Fixes #6828 Closes #6850
* h2: allow 100 streams by defaultDaniel Stenberg2021-04-051-1/+1
| | | | | | | | | instead of 13, before the server has told how many streams it accepts. The server can always reject new streams anyway if we go above what it accepts. Ref: #6826 Closes #6852
* file: support GETing directories againLuke Granger-Brown2021-04-053-13/+53
| | | | | | | | | | | | | | After 957bc1881e686f9714c4e6a01bf33535091f0e21, we no longer compute an expected_size for directories. This has the upshot that when we compare even an empty Range with the available size, we fail. This brings back the previous behaviour, which was to succeed, but with empty content. This also removes the "Accept-ranges: bytes" header, which is nonsensical on directories. Adds test 3016 Fixes #6845 Closes #6846
* RELEASE-NOTES: syncedDaniel Stenberg2021-04-042-274/+15
| | | | and bumped to 7.76.1
* TLS: fix HTTP/2 selectionDaniel Stenberg2021-04-027-8/+8
| | | | | | | | | | | for GnuTLS, BearSSL, mbedTLS, NSS, SChannnel, Secure Transport and wolfSSL... Regression since 88dd1a8a115b1f5ece (shipped in 7.76.0) Reported-by: Kenneth Davidson Reported-by: romamik om github Fixes #6825 Closes #6827
* hostip: Fix for builds that disable all asynchronous DNSJay Satiro2021-04-021-0/+2
| | | | | | | | | | | | | | | - Define Curl_resolver_error function only when USE_CURL_ASYNC. Prior to this change building curl without an asynchronous resolver backend (c-ares or threaded) and without DoH (DNS-over-HTTPS, which is also asynchronous but independent of resolver backend) would cause a build error since Curl_resolver_error is called by and evaluates variables only available in asynchronous builds. Reported-by: Benbuck Nason Fixes https://github.com/curl/curl/issues/6831 Closes https://github.com/curl/curl/pull/6832
* openssl: Fix CURLOPT_SSLCERT_BLOB without CURLOPT_SSLCERT_KEYGilles Vollant2021-03-311-52/+56
| | | | | | Reported-by: Christian Schmitz Fixes #6816 Closes #6820
View Lorry Controller Status