summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* tool_cb_prg: make resumed upload progress bar show betterbagder/upload-resumed-progressDaniel Stenberg2021-09-271-13/+18
| | | | | | | | This is a regression that was *probably* injected in the larger progress bar overhaul in 2018. Reported-by: beslick5 on github Fixes #7760
* urlapi: support UNC paths in file: URLs on WindowsSergey Markelov2021-09-273-6/+38
| | | | | | | | | | - file://host.name/path/file.txt is a valid UNC path \\host.name\path\files.txt to a non-local file transformed into URI (RFC 8089 Appendix E.3) - UNC paths on other OSs must be smb: URLs Closes #7366
* urlapi: add curl_url_strerror()i-ky2021-09-2725-72/+233
| | | | | | | | | | Add curl_url_strerror() to convert CURLUcode into readable string and facilitate easier troubleshooting in programs using URL API. Extend CURLUcode with CURLU_LAST for iteration in unit tests. Update man pages with a mention of new function. Update example code and tests with new functionality where it fits. Closes #7605
* RELEASE-NOTES: syncedDaniel Stenberg2021-09-261-3/+24
|
* libssh2: add SHA256 fingerprint supportMats Lindestam2021-09-2627-38/+360
| | | | | | | Added support for SHA256 fingerprint in command line curl and in libcurl. Closes #7646
* libcurl.rc: switch out the copyright symbol for plain ASCIIDaniel Stenberg2021-09-261-2/+2
| | | | | | | Reported-by: Vitaly Varyvdin Assisted-by: Viktor Szakats Fixes #7765 Closes #7776
* ngtcp2: fix QUIC transport parameter versionJun-ya Kato2021-09-251-6/+5
| | | | | | | fix inappropriate version setting for QUIC transport parameters. this patch keeps curl with ngtcp2 uses QUIC draft version (h3-29). Closes #7771
* examples/imap-append: fix end-of-data checkDaniel Stenberg2021-09-251-1/+1
| | | | | | Reported-by: Alexander Chuykov Fixes #7774 Closes #7775
* vtls: Fix a memory leak if an SSL session cannot be added to the cacheMichael Kaufmann2021-09-2410-16/+36
| | | | | | | | | | | | | | | On connection shutdown, a new TLS session ticket may arrive after the SSL session cache has already been destructed. In this case, the new SSL session cannot be added to the SSL session cache. The callers of Curl_ssl_addsessionid() need to know whether the SSL session has been added to the cache. If it has not been added, the reference counter of the SSL session must not be incremented, or memory used by the SSL session must be freed. This is now possible with the new output parameter "added" of Curl_ssl_addsessionid(). Fixes #7683 Closes #7752
* HTTP3.md: use 'autoreconf -fi' instead of buildconfMomoka Yamamoto2021-09-241-3/+3
| | | | | | buildconf is not used since #5853 Closes #7746
* GIT-INFO: rephrase to adapt to s/buildconf/autoreconfDaniel Stenberg2021-09-241-2/+2
|
* llist: remove redundant code, branch will not be executedh1zzz2021-09-241-3/+1
| | | | Closes #7770
* HTTP-COOKIES.md: remove duplicate 'each'tlahn2021-09-241-1/+1
| | | | Closes #7772
* libssh2: Get the version at runtime if possibleJoel Depooter2021-09-241-1/+1
| | | | | | | | | | | Previously this code used a compile time constant, meaning that libcurl always reported the libssh2 version that libcurl was built with. This could differ from the libssh2 version actually being used. The new code uses the CURL_LIBSSH2_VERSION macro, which is defined in ssh.h. The macro calls the libssh2_version function if it is available, otherwise it falls back to the compile time version. Closes https://github.com/curl/curl/pull/7768
* schannel: fix typoJoel Depooter2021-09-241-2/+2
| | | | Closes https://github.com/curl/curl/pull/7769
* cmake: with OpenSSL, define OPENSSL_SUPPRESS_DEPRECATEDDaniel Stenberg2021-09-231-0/+2
| | | | | | | | To avoid the "... is deprecated" warnings brought by OpenSSL v3. (We need to address the underlying code at some point of course.) Assisted-by: Jakub Zakrzewski Closes #7767
* curl-openssl: pass argument to sed single-quotedDaniel Stenberg2021-09-231-1/+1
| | | | | | | | | | ... instead of using an escaped double-quote. This is an attempt to make this work better with ksh that otherwise would insist on a double escape! Reported-by: Randall S. Becker Fixes #7758 Closes #7764
* RELEASE-NOTES: syncedDaniel Stenberg2021-09-232-29/+18
| | | | Bumped curlver to 7.80.0-dev
* misc: fix typos in docs and commentsa13460542021-09-236-6/+6
| | | | | | | No user facing output from curl/libcurl is changed by this, just comments. Closes #7747
* ci: update Lift config to match requirements of curl buildThomas M. DuBuisson2021-09-233-5/+5
| | | | | | Also renamed Muse -> Lift, the new tool name. Closes #7761
* cleanup: constify unmodified static structsRikard Falkeborn2021-09-2310-20/+20
| | | | | | | Constify a number of static structs that are never modified. Make them const to show this. Closes #7759
* RELEASE-NOTES: syncedcurl-7_79_1Daniel Stenberg2021-09-221-4/+0
| | | | curl 7.79.1 release
* THANKS: added names from the 7.79.1 releaseDaniel Stenberg2021-09-221-0/+5
|
* test897: verify delivery of IMAP post-body header contentDaniel Stenberg2021-09-213-2/+79
| | | | | | | | | | | | | The "content" is delivered as "body" by curl, but the envelope continues after the body and the rest of it should be delivered as header. The IMAP server can now get 'POSTFETCH' set to include more data to include after the body and test 897 is done to verify that such "extra" header data is in fact delivered by curl as header. Ref: #7284 but fails to reproduce the issue Closes #7748
* KNOWN_BUGS: connection migration doesn't workDaniel Stenberg2021-09-191-0/+5
| | | | Closes #7695
* RELEASE-NOTES: syncedDaniel Stenberg2021-09-191-5/+19
|
* http: fix the broken >3 digit response code detectionDaniel Stenberg2021-09-173-6/+51
| | | | | | | | | | | | | When the "reason phrase" in the HTTP status line starts with a digit, that was treated as the forth response code digit and curl would claim the response to be non-compliant. Added test 1466 to verify this case. Regression brought by 5dc594e44f73b17 Reported-by: Glenn de boer Fixes #7738 Closes #7739
* strerror: use sys_errlist instead of strerror on WindowsJay Satiro2021-09-171-2/+2
| | | | | | | | | | | | | | | - Change Curl_strerror to use sys_errlist[errnum] instead of strerror to retrieve the error message on Windows. Windows' strerror writes to a static buffer and is not thread-safe. Follow-up to 2f0bb86 which removed most instances of strerror in favor of calling Curl_strerror (which calls strerror_r for other platforms). Ref: https://github.com/curl/curl/pull/7685 Ref: https://github.com/curl/curl/commit/2f0bb86 Closes https://github.com/curl/curl/pull/7735
* dist: provide lib/.checksrc in the tarballDaniel Stenberg2021-09-161-2/+2
| | | | | | | | | So that debug builds work (checksrc really) Reported-by: Marcel Raad Reported-by: tawmoto on github Fixes #7733 Closes #7734
* TODO: Improve documentation about fork safetyDaniel Stenberg2021-09-161-0/+5
| | | | Closes #6968
* hsts: CURLSTS_FAIL from hsts read callback should fail transferDaniel Stenberg2021-09-166-6/+34
| | | | | | | | | | ... and have CURLE_ABORTED_BY_CALLBACK returned. Extended test 1915 to verify. Reported-by: Jonathan Cardoso Fixes #7726 Closes #7729
* test1184: disableDaniel Stenberg2021-09-161-0/+2
| | | | | | | | | The test should be fine and it works for me repeated when run manually, but clearly it causes CI failures and it needs more research. Reported-by: RiderALT on github Fixes #7725 Closes #7732
* Curl_http2_setup: don't change connection data on repeat invokesDaniel Stenberg2021-09-161-6/+6
| | | | | | | | | | Regression from 3cb8a748670ab88c (releasde in 7.79.0). That change moved transfer oriented inits to before the check but also erroneously moved a few connection oriented ones, which causes problems. Reported-by: Evangelos Foutras Fixes #7730 Closes #7731
* RELEASE-NOTES: syncedDaniel Stenberg2021-09-162-274/+15
| | | | and bump to 7.79.1
* tests/sshserver.pl: make it work with openssh-8.7p1Kamil Dudka2021-09-161-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | ... by not using options with no argument where an argument is required: === Start of file tests/log/ssh_server.log curl_sshd_config line 6: no argument after keyword "DenyGroups" curl_sshd_config line 7: no argument after keyword "AllowGroups" curl_sshd_config line 10: Deprecated option AuthorizedKeysFile2 curl_sshd_config line 29: Deprecated option KeyRegenerationInterval curl_sshd_config line 39: Deprecated option RhostsRSAAuthentication curl_sshd_config line 40: Deprecated option RSAAuthentication curl_sshd_config line 41: Deprecated option ServerKeyBits curl_sshd_config line 45: Deprecated option UseLogin curl_sshd_config line 56: no argument after keyword "AcceptEnv" curl_sshd_config: terminating, 3 bad configuration options === End of file tests/log/ssh_server.log === Start of file log/sftp_server.log curl_sftp_config line 33: Unsupported option "rhostsrsaauthentication" curl_sftp_config line 34: Unsupported option "rsaauthentication" curl_sftp_config line 52: no argument after keyword "sendenv" curl_sftp_config: terminating, 1 bad configuration options Connection closed. Connection closed === End of file log/sftp_server.log Closes #7724
* hsts: handle unlimited expiryDaniel Stenberg2021-09-154-28/+47
| | | | | | | | | | | | | | | | | | | When setting a blank expire string, meaning unlimited, curl would pass TIME_T_MAX to getime_r() when creating the output, while on 64 bit systems such a large value cannot be convetered to a tm struct making curl to exit the loop with an error instead. It can't be converted because the year it would represent doesn't fit in the 'int tm_year' field! Starting now, unlimited expiry is instead handled differently by using a human readable expiry date spelled out as "unlimited" instead of trying to use a distant actual date. Test 1660 and 1915 have been updated to help verify this change. Reported-by: Jonathan Cardoso Fixes #7720 Closes #7721
* curl_multi_fdset: make FD_SET() not operate on sockets out of rangeDaniel Stenberg2021-09-152-13/+21
| | | | | | | | | | The VALID_SOCK() macro was made to only check for FD_SETSIZE if curl was built to use select(), even though the curl_multi_fdset() function always and unconditionally uses FD_SET and needs the check. Reported-by: 0xee on github Fixes #7718 Closes #7719
* FAQ: add GOPHERS + curl works on data, not filesDaniel Stenberg2021-09-151-4/+4
|
* RELEASE-NOTES: syncedcurl-7_79_0Daniel Stenberg2021-09-141-7/+39
| | | | For the 7.79.0 release
* THANKS: add contributors from 7.79.0 release cycleDaniel Stenberg2021-09-141-0/+26
|
* FAQ: add two dev related questionsDaniel Stenberg2021-09-141-0/+41
| | | | | | | | 8.1 Why does curl use C89? 8.2 Will curl be rewritten? Spell-checked-by: Paul Johnson Closes #7715
* zuul.d/jobs: disable three tests for *-openssl-disable-proxyDaniel Stenberg2021-09-131-0/+1
| | | | | | | ... as they mysteriously seem to permfail without being related to proxy. Closes #7714
* ftp,imap,pop3,smtp: reject STARTTLS server response pipeliningPatrick Monnerat2021-09-139-1/+236
| | | | | | | | | | | | | If a server pipelines future responses within the STARTTLS response, the former are preserved in the pingpong cache across TLS negotiation and used as responses to the encrypted commands. This fix detects pipelined STARTTLS responses and rejects them with an error. CVE-2021-22947 Bug: https://curl.se/docs/CVE-2021-22947.html
* ftp,imap,pop3: do not ignore --ssl-reqdPatrick Monnerat2021-09-137-36/+195
| | | | | | | | | | | | In imap and pop3, check if TLS is required even when capabilities request has failed. In ftp, ignore preauthentication (230 status of server greeting) if TLS is required. Bug: https://curl.se/docs/CVE-2021-22946.html CVE-2021-22946
* mqtt: clear the leftovers pointer when sending succeedsz2_ on hackerone2021-09-131-0/+4
| | | | | | CVE-2021-22945 Bug: https://curl.se/docs/CVE-2021-22945.html
* zuul: bump the rustls job to use v0.7.2Daniel Stenberg2021-09-131-1/+2
| | | | | | ... and add -lm when using a rust library. Closes #7701
* RELEASE-PROCEDURE: add release dates from now to 8.0.0 in 2023Daniel Stenberg2021-09-131-4/+5
|
* SECURITY-PROCESS: tweak a little to match current practicesDaniel Stenberg2021-09-131-10/+11
| | | | Closes #7713
* http_proxy: fix the User-Agent inclusion in CONNECTDaniel Stenberg2021-09-133-19/+130
| | | | | | | | | | | | It should not refer to the uagent string that is allocated and created for the end server http request, as that pointer may be cleared on subsequent CONNECT requests. Added test case 1184 to verify. Reported-by: T200proX7 on github Fixes #7705 Closes #7707
* Curl_hsts_loadcb: don't attempt to load if hsts wasn't initedDaniel Stenberg2021-09-121-1/+3
| | | | | | Reported-by: Jonathan Cardoso Fixes #7710 Closes #7711
View Lorry Controller Status