summaryrefslogtreecommitdiff
path: root/lib/http.c
Commit message (Collapse)AuthorAgeFilesLines
* transfer: init the infilesize from the postfields...Daniel Stenberg2017-05-301-8/+3
| | | | | | | | | ... with a strlen() if no size was set, and do this in the pretransfer function so that the info is set early. Otherwise, the default strlen() done on the POSTFIELDS data never sets state.infilesize. Reported-by: Vincas Razma Bug: #1294
* multi: use a fixed array of timers instead of mallocDaniel Stenberg2017-05-101-0/+3
| | | | | | | | | | ... since the total amount is low this is faster, easier and reduces memory overhead. Also, Curl_expire_done() can now mark an expire timeout as done so that it never times out. Closes #1472
* buffer: use data->set.buffer_size instead of BUFSIZEDaniel Stenberg2017-05-011-3/+4
| | | | ... to properly use the dynamically set buffer size!
* http: don't clobber the receive buffer for timecondDaniel Stenberg2017-05-011-19/+21
|
* http: use private user:password output bufferDaniel Stenberg2017-05-011-11/+17
| | | | Don't clobber the receive buffer.
* http: do not treat FTPS over CONNECT as HTTPSKamil Dudka2017-03-281-1/+1
| | | | | | | | | | | | | If we use FTPS over CONNECT, the TLS handshake for the FTPS control connection needs to be initiated in the SENDPROTOCONNECT state, not the WAITPROXYCONNECT state. Otherwise, if the TLS handshake completed without blocking, the information about the completed TLS handshake would be saved to a wrong flag. Consequently, the TLS handshake would be initiated in the SENDPROTOCONNECT state once again on the same connection, resulting in a failure of the TLS handshake. I was able to observe the failure with the NSS backend if curl ran through valgrind. Note that this commit partially reverts curl-7_21_6-52-ge34131d.
* http: Fix proxy connection reuse with basic-authIsaac Boukris2017-03-281-13/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When using basic-auth, connections and proxy connections can be re-used with different Authorization headers since it does not authenticate the connection (like NTLM does). For instance, the below command should re-use the proxy connection, but it currently doesn't: curl -v -U alice:a -x http://localhost:8181 http://localhost/ --next -U bob:b -x http://localhost:8181 http://localhost/ This is a regression since refactoring of ConnectionExists() as part of: cb4e2be7c6d42ca0780f8e0a747cecf9ba45f151 Fix the above by removing the username and password compare when re-using proxy connection at proxy_info_matches(). However, this fix brings back another bug would make curl to re-print the old proxy-authorization header of previous proxy basic-auth connection because it wasn't cleared. For instance, in the below command the second request should fail if the proxy requires authentication, but would succeed after the above fix (and before aforementioned commit): curl -v -U alice:a -x http://localhost:8181 http://localhost/ --next -x http://localhost:8181 http://localhost/ Fix this by clearing conn->allocptr.proxyuserpwd after use unconditionally, same as we do for conn->allocptr.userpwd. Also fix test 540 to not expect digest auth header to be resent when connection is reused. Signed-off-by: Isaac Boukris <iboukris@gmail.com> Closes https://github.com/curl/curl/pull/1350
* spelling fixesklemens2017-03-261-2/+2
| | | | Closes #1356
* Improve code readbilitySylvestre Ledru2017-03-131-25/+22
| | | | | | ... by removing the else branch after a return, break or continue. Closes #1310
* proxy: skip SSL initialization for closed connectionsMichael Kaufmann2017-03-111-0/+4
| | | | | | | | | This prevents a "Descriptor is not a socket" error for WinSSL. Reported-by: Antony74@users.noreply.github.com Reviewed-by: Jay Satiro Fixes https://github.com/curl/curl/issues/1239
* authneg: clear auth.multi flag at http_doneIsaac Boukris2017-03-111-3/+8
| | | | | | | | | | | | | This flag is meant for the current request based on authentication state, once the request is done we can clear the flag. Also change auth.multi to auth.multipass for better readability. Fixes https://github.com/curl/curl/issues/1095 Closes https://github.com/curl/curl/pull/1326 Signed-off-by: Isaac Boukris <iboukris@gmail.com> Reported-by: Michael Kaufmann
* http2: Fix assertion error on redirect with CL=0Tatsuhiro Tsujikawa2017-03-071-3/+11
| | | | | | | | | | | | | | | This fixes assertion error which occurs when redirect is done with 0 length body via HTTP/2, and the easy handle is reused, but new connection is established due to hostname change: curl: http2.c:1572: ssize_t http2_recv(struct connectdata *, int, char *, size_t, CURLcode *): Assertion `httpc->drain_total >= data->state.drain' failed. To fix this bug, ensure that http2_handle_stream is called. Fixes #1286 Closes #1302
* http: fix missing 'Content-Length: 0' while negotiating authIsaac Boukris2017-02-171-2/+2
| | | | | | | | | | | | | | | | - While negotiating auth during PUT/POST if a user-specified Content-Length header is set send 'Content-Length: 0'. This is what we do already in HTTPREQ_POST_FORM and what we did in the HTTPREQ_POST case (regression since afd288b). Prior to this change no Content-Length header would be sent in such a case. Bug: https://curl.haxx.se/mail/lib-2017-02/0006.html Reported-by: Dominik Hölzl Closes https://github.com/curl/curl/pull/1242
* CURLOPT_BUFFERSIZE: support enlarging receive bufferRichy Kim2017-01-191-1/+2
| | | | | | | | | | Replace use of fixed macro BUFSIZE to define the size of the receive buffer. Reappropriate CURLOPT_BUFFERSIZE to include enlarging receive buffer size. Upon setting, resize buffer if larger than the current default size up to a MAX_BUFSIZE (512KB). This can benefit protocols like SFTP. Closes #1222
* http: print correct HTTP string in verbose output when using HTTP/2http2_outputAlessandro Ghedini2017-01-141-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | Before: ``` % src/curl https://sigsegv.ninja/ -v --http2 ... > GET / HTTP/1.1 > Host: sigsegv.ninja > User-Agent: curl/7.52.2-DEV > Accept: */* > ... ``` After: ``` % src/curl https://sigsegv.ninja/ -v --http2 ... > GET / HTTP/2 > Host: sigsegv.ninja > User-Agent: curl/7.52.2-DEV > Accept: */* > ```
* http: remove "Curl_http_done: called premature" messageDaniel Stenberg2016-12-231-2/+0
| | | | ... it only confuses people.
* checksrc: warn for assignments within if() expressionsDaniel Stenberg2016-12-141-2/+4
| | | | | ... they're already frowned upon in our source code style guide, this now enforces the rule harder.
* checksrc: stricter no-space-before-paren enforcementDaniel Stenberg2016-12-131-11/+11
| | | | In order to make the code style more uniform everywhere
* proxy: Support HTTPS proxy and SOCKS+HTTP(s)Alex Rousskov2016-11-241-41/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * HTTPS proxies: An HTTPS proxy receives all transactions over an SSL/TLS connection. Once a secure connection with the proxy is established, the user agent uses the proxy as usual, including sending CONNECT requests to instruct the proxy to establish a [usually secure] TCP tunnel with an origin server. HTTPS proxies protect nearly all aspects of user-proxy communications as opposed to HTTP proxies that receive all requests (including CONNECT requests) in vulnerable clear text. With HTTPS proxies, it is possible to have two concurrent _nested_ SSL/TLS sessions: the "outer" one between the user agent and the proxy and the "inner" one between the user agent and the origin server (through the proxy). This change adds supports for such nested sessions as well. A secure connection with a proxy requires its own set of the usual SSL options (their actual descriptions differ and need polishing, see TODO): --proxy-cacert FILE CA certificate to verify peer against --proxy-capath DIR CA directory to verify peer against --proxy-cert CERT[:PASSWD] Client certificate file and password --proxy-cert-type TYPE Certificate file type (DER/PEM/ENG) --proxy-ciphers LIST SSL ciphers to use --proxy-crlfile FILE Get a CRL list in PEM format from the file --proxy-insecure Allow connections to proxies with bad certs --proxy-key KEY Private key file name --proxy-key-type TYPE Private key file type (DER/PEM/ENG) --proxy-pass PASS Pass phrase for the private key --proxy-ssl-allow-beast Allow security flaw to improve interop --proxy-sslv2 Use SSLv2 --proxy-sslv3 Use SSLv3 --proxy-tlsv1 Use TLSv1 --proxy-tlsuser USER TLS username --proxy-tlspassword STRING TLS password --proxy-tlsauthtype STRING TLS authentication type (default SRP) All --proxy-foo options are independent from their --foo counterparts, except --proxy-crlfile which defaults to --crlfile and --proxy-capath which defaults to --capath. Curl now also supports %{proxy_ssl_verify_result} --write-out variable, similar to the existing %{ssl_verify_result} variable. Supported backends: OpenSSL, GnuTLS, and NSS. * A SOCKS proxy + HTTP/HTTPS proxy combination: If both --socks* and --proxy options are given, Curl first connects to the SOCKS proxy and then connects (through SOCKS) to the HTTP or HTTPS proxy. TODO: Update documentation for the new APIs and --proxy-* options. Look for "Added in 7.XXX" marks.
* realloc: use Curl_saferealloc to avoid common mistakesDaniel Stenberg2016-11-111-2/+2
| | | | Discussed: https://curl.haxx.se/mail/lib-2016-11/0087.html
* strcasecompare: all case insensitive string compares ignore locale nowDaniel Stenberg2016-10-311-7/+7
| | | | | We had some confusions on when each function was used. We should not act differently on different locales anyway.
* strcasecompare: is the new name for strequal()Daniel Stenberg2016-10-311-1/+0
| | | | | | | ... to make it less likely that we forget that the function actually does case insentive compares. Also replaced several invokes of the function with a plain strcmp when case sensitivity is not an issue (like comparing with "-").
* cookies: getlist() now holds deep copies of all cookiesDaniel Stenberg2016-10-311-1/+1
| | | | | | | | | | | Previously it only held references to them, which was reckless as the thread lock was released so the cookies could get modified by other handles that share the same cookie jar over the share interface. CVE-2016-8623 Bug: https://curl.haxx.se/docs/adv_20161102I.html Reported-by: Cure53
* New libcurl option to keep sending on errorMichael Kaufmann2016-09-221-6/+15
| | | | | | | | | | | | Add the new option CURLOPT_KEEP_SENDING_ON_ERROR to control whether sending the request body shall be completed when the server responds early with an error status code. This is suitable for manual NTLM authentication. Reviewed-by: Jay Satiro Closes https://github.com/curl/curl/pull/904
* http: accept "Transfer-Encoding: chunked" for HTTP/2 as wellDaniel Stenberg2016-09-161-30/+34
| | | | | | | | ... but don't send the actual header over the wire as it isn't accepted. Chunked uploading is still triggered using this method. Fixes #1013 Fixes #662
* http2: make sure stream errors don't needlessly close the connectionDaniel Stenberg2016-08-281-30/+9
| | | | | | | | With HTTP/2 each transfer is made in an indivial logical stream over the connection, making most previous errors that caused the connection to get forced-closed now instead just kill the stream and not the connection. Fixes #941
* HTTP: stop parsing headers when switching to unknown protocolsMichael Kaufmann2016-08-251-10/+23
| | | | | | | - unknown protocols probably won't send more headers (e.g. WebSocket) - improved comments and moved them to the correct case statements Closes #899
* http.c: Remove duplicate (authp->avail & CURLAUTH_DIGEST) checkSteve Holme2016-08-211-4/+2
| | | | From commit 2708d4259b.
* http.c: Corrected indentation change from commit 2708d4259bSteve Holme2016-08-201-3/+3
| | | | | Made by Visual Studio's auto-correct feature and missed by me in my own code reviews!
* http: Added calls to Curl_auth_is_<mechansism>_supported()Steve Holme2016-08-201-48/+59
| | | | | | | Hooked up the HTTP authentication layer to query the new 'is mechanism supported' functions when deciding what mechanism to use. As per commit 00417fd66c existing functionality is maintained for now.
* Revert "Proxy-Connection: stop sending this header by default"Daniel Stenberg2016-08-161-1/+6
| | | | This reverts commit 113f04e664b16b944e64498a73a4dab990fe9a68.
* cleanup: minor code cleanup in Curl_http_readwrite_headers()Michael Kaufmann2016-06-281-45/+43
| | | | | | | | | - the expression of an 'if' was always true - a 'while' contained a condition that was always true - use 'if(k->exp100 > EXP100_SEND_DATA)' instead of 'if(k->exp100)' - fixed a typo Closes #889
* internals: rename the SessionHandle struct to Curl_easyDaniel Stenberg2016-06-221-23/+23
|
* cleanup: fix method names in code commentsMichael Kaufmann2016-06-211-1/+1
| | | | Closes #887
* http: Fix HTTP/2 connection reuseJay Satiro2016-06-051-0/+7
| | | | | | | | | | - Change the parser to not require a minor version for HTTP/2. HTTP/2 connection reuse broke when we changed from HTTP/2.0 to HTTP/2 in 8243a95 because the parser still expected a minor version. Bug: https://github.com/curl/curl/issues/855 Reported-by: Andrew Robbins, Frank Gevaerts
* TLS: move the ALPN/NPN enable bits to the connectionDaniel Stenberg2016-05-091-1/+1
| | | | | | | | | | | | Only protocols that actually have a protocol registered for ALPN and NPN should try to get that negotiated in the TLS handshake. That is only HTTPS (well, http/1.1 and http/2) right now. Previously ALPN and NPN would wrongly be used in all handshakes if libcurl was built with it enabled. Reported-by: Jay Satiro Fixes #789
* http: make sure a blank header overrides accept_decodingDaniel Stenberg2016-05-021-0/+4
| | | | | | Reported-by: rcanavan Assisted-by: Isaac Boukris Closes #785
* lib: include curl_printf.h as one of the last headersDaniel Stenberg2016-04-291-2/+2
| | | | | | | | | | | | | | | | | | | | curl_printf.h defines printf to curl_mprintf, etc. This can cause problems with external headers which may use __attribute__((format(printf, ...))) markers etc. To avoid that they cause problems with system includes, we include curl_printf.h after any system headers. That makes the three last headers to always be, and we keep them in this order: curl_printf.h curl_memory.h memdebug.h None of them include system headers, they all do funny #defines. Reported-by: David Benjamin Fixes #743
* CONNECT_ONLY: don't close connection on GSS 401/407 reponsesMarcel Raad2016-04-261-2/+4
| | | | | | | | | | | Previously, connections were closed immediately before the user had a chance to extract the socket when the proxy required Negotiate authentication. This regression was brought in with the security fix in commit 79b9d5f1a42578f Closes #655
* news: CURLOPT_CONNECT_TO and --connect-toMichael Kaufmann2016-04-171-0/+2
| | | | | Makes curl connect to the given host+port instead of the host+port found in the URL.
* code: style updatesDaniel Stenberg2016-04-031-1/+1
|
* http2: support "prior knowledge", no upgrade from HTTP/1.1Diego Bes2016-03-311-8/+12
| | | | | | | | | | | | | Supports HTTP/2 over clear TCP - Optimize switching to HTTP/2 by removing calls to init and setup before switching. Switching will eventually call setup and setup calls init. - Supports new version to “force” the use of HTTP/2 over clean TCP - Add common line parameter “--http2-prior-knowledge” to the Curl command line tool.
* http: remove ((expression)) double parenthesesDaniel Stenberg2016-03-311-3/+3
|
* Curl_add_buffer_send: avoid possible NULL dereferenceDaniel Stenberg2016-03-311-4/+4
| | | | | | | ... as we check for a NULL pointer below, we move the derefence to after the check. Detected by PVS Studio. Reported-by: Alexis La Goutte
* multi: turn Curl_done into file local multi_doneDaniel Stenberg2016-03-301-2/+2
| | | | ... as it now is used by multi.c only.
* http_ntlm: Renamed from curl_ntlm.[c|h]Steve Holme2016-03-271-1/+1
| | | | | | | | | | | Renamed the header and source files for this module as they are HTTP specific and as such, they should use the naming convention as other HTTP authentication source files do - this revert commit 260ee6b7bf. Note: We could also rename curl_ntlm_wb.[c|h], however, the Winbind code needs separating from the HTTP protocol and migrating into the vauth directory, thus adding support for Winbind to the SASL based protocols such as IMAP, POP3 and SMTP.
* vauth: Moved the Negotiate authentication code to the new vauth directorySteve Holme2016-03-261-0/+1
| | | | Part 1 of 2 - Moved the SSPI based Negotiate authentication code.
* http: Minor update based on CODE_STYLE guidelinesSteve Holme2016-03-241-27/+25
|
* connect/ntlm/http: Fixed compilation warnings when verbose strings disabledSteve Holme2016-03-201-2/+4
| | | | warning C4189: 'data': local variable is initialized but not referenced
* http2: don't decompress gzip decoding automaticallyDaniel Stenberg2016-02-171-2/+1
| | | | | | | | | | | At one point during the development of HTTP/2, the commit 133cdd29ea0 introduced automatic decompression of Content-Encoding as that was what the spec said then. Now however, HTTP/2 should work the same way as HTTP/1 in this regard. Reported-by: Kazuho Oku Closes #661
View Lorry Controller Status