summaryrefslogtreecommitdiff
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* cookie: do not refuse cookies for localhostTim Rühsen2016-03-081-4/+6
| | | | Closes #658
* ftp_done: clear tunnel_state when secondary socket closesDaniel Stenberg2016-03-081-15/+15
| | | | | | | | Introducing a function for closing the secondary connection to make this bug less likely to happen again. Reported-by: daboul Closes #701
* openssl: use the correct OpenSSL/BoringSSL/LibreSSL in messagesGisle Vanem2016-03-081-15/+24
|
* pipeline: Sanity check pipeline pointer before accessing it.Anders Bakken2016-03-082-11/+14
| | | | | | | | | | | | I got a crash with this stack: curl/lib/url.c:2873 (Curl_removeHandleFromPipeline) curl/lib/url.c:2919 (Curl_getoff_all_pipelines) curl/lib/multi.c:561 (curl_multi_remove_handle) curl/lib/url.c:415 (Curl_close) curl/lib/easy.c:859 (curl_easy_cleanup) Closes #704
* mprintf: update trio project linkJay Satiro2016-03-061-1/+1
|
* makefile.m32: add missing libs for static -winssl-ssh2 buildsViktor Szakats2016-03-051-0/+5
| | | | Bug: https://github.com/curl/curl/pull/693
* mbedtls: fix user-specified SSL protocol versionJay Satiro2016-03-051-4/+21
| | | | | | Prior to this change when a single protocol CURL_SSLVERSION_ was specified by the user that version was set only as the minimum version but not as the maximum version as well.
* makefile.m32: fix to allow -ssh2-winssl combinationViktor Szakats2016-03-051-0/+2
| | | | | | | In makefile.m32, option -ssh2 (libssh2) automatically implied -ssl (OpenSSL) option, with no way to override it with -winssl. Since both libssh2 and curl support using Windows's built-in SSL backend, modify the logic to allow that combination.
* cookie: Don't expire session cookies in remove_expiredJay Satiro2016-03-051-1/+1
| | | | | | | | Prior to this change cookies with an expiry date that failed parsing and were converted to session cookies could be purged in remove_expired. Bug: https://github.com/curl/curl/issues/697 Reported-by: Seth Mos
* cookie: remove redundant checkDaniel Stenberg2016-03-031-18/+15
| | | | | | | ... as it was already checked previously within the function. Reported-by: Dmitry-Me Closes #695
* url: if Curl_done is premature then pipeline not in useAnders Bakken2016-03-011-1/+2
| | | | | | | Prevent a crash if 2 (or more) requests are made to the same host and pipelining is enabled and the connection does not complete. Bug: https://github.com/curl/curl/pull/690
* makefile.m32: allow to pass .dll/.exe-specific LDFLAGSViktor Szakats2016-03-011-1/+1
| | | | | | | | | | | | using envvars `CURL_LDFLAG_EXTRAS_DLL` and `CURL_LDFLAG_EXTRAS_EXE` respectively. This is useful f.e. to pass ASLR-related extra options, that are required to make this feature work when using the mingw toolchain. Ref: https://github.com/curl/curl/pull/670#issuecomment-190863985 Closes https://github.com/curl/curl/pull/689
* formpost: fix memory leaks in AddFormData error branchesDaniel Stenberg2016-02-291-11/+25
| | | | | Reported-by: Dmitry-Me Fixes #688
* getinfo: Fix syntax error when mbedTLSJay Satiro2016-02-281-1/+1
| | | | | The assignment of the mbedTLS TLS session info in the parent commit was incorrect. Change the assignment to a pointer to the session structure.
* getinfo: Add support for mbedTLS TLS session infoJay Satiro2016-02-271-17/+13
| | | | .. and preprocessor check TLS session info is defined for all backends.
* file: try reading from files with no sizeDaniel Stenberg2016-02-251-8/+18
| | | | | | | | | | | Some systems have special files that report as 0 bytes big, but still contain data that can be read (for example /proc/cpuinfo on Linux). Starting now, a zero byte size is considered "unknown" size and will be read as far as possible anyway. Reported-by: Jesse Tan Closes #681
* Curl_read: check for activated HTTP/1 pipelining, not only requestedDaniel Stenberg2016-02-241-2/+5
| | | | | | | | | ... as when pipelining is used, we read things into a unified buffer and we don't do that with HTTP/2. This could then easily make programs that set CURLMOPT_PIPELINING = CURLPIPE_HTTP1|CURLPIPE_MULTIPLEX to get data intermixed or plain broken between HTTP/2 streams. Reported-by: Anders Bakken
* getinfo: CURLINFO_TLS_SSL_PTR supersedes CURLINFO_TLS_SESSIONJay Satiro2016-02-231-25/+32
| | | | | | | | | | | | | | | | | | | | | The two options are almost the same, except in the case of OpenSSL: CURLINFO_TLS_SESSION OpenSSL session internals is SSL_CTX *. CURLINFO_TLS_SSL_PTR OpenSSL session internals is SSL *. For backwards compatibility we couldn't modify CURLINFO_TLS_SESSION to return an SSL pointer for OpenSSL. Also, add support for the 'internals' member to point to SSL object for the other backends axTLS, PolarSSL, Secure Channel, Secure Transport and wolfSSL. Bug: https://github.com/curl/curl/issues/234 Reported-by: dkjjr89@users.noreply.github.com Bug: https://curl.haxx.se/mail/lib-2015-09/0127.html Reported-by: Michael König
* multi_remove_handle: keep the timeout list until after disconnectDaniel Stenberg2016-02-231-7/+8
| | | | | | | | | The internal Curl_done() function uses Curl_expire() at times and that uses the timeout list. Better clean up the list once we're done using it. This caused a segfault. Reported-by: 蔡文凱 Bug: https://curl.haxx.se/mail/lib-2016-02/0097.html
* TFTP: add option to suppress TFTP option requests (Part 2)Jay Satiro2016-02-231-1/+1
| | | | | | | | | | - Add tests. - Add an example to CURLOPT_TFTP_NO_OPTIONS.3. - Add --tftp-no-options to expose CURLOPT_TFTP_NO_OPTIONS. Bug: https://github.com/curl/curl/issues/481
* TFTP: add option to suppress TFTP option requests (Part 1)Michael Koenig2016-02-233-29/+40
| | | | | | | | | | | Some TFTP server implementations ignore the "TFTP Option extension" (RFC 1782-1784, 2347-2349), or implement it in a flawed way, causing problems with libcurl. Another switch for curl_easy_setopt "CURLOPT_TFTP_NO_OPTIONS" is introduced which prevents libcurl from sending TFTP option requests to a server, avoiding many problems caused by faulty implementations. Bug: https://github.com/curl/curl/issues/481
* curl_sasl: Fix memory leak in digest parserEmil Lerner2016-02-191-0/+6
| | | | | | | If any parameter in a HTTP DIGEST challenge message is present multiple times, memory allocated for all but the last entry should be freed. Bug: https://github.com/curl/curl/pull/667
* http2: don't decompress gzip decoding automaticallyDaniel Stenberg2016-02-171-2/+1
| | | | | | | | | | | At one point during the development of HTTP/2, the commit 133cdd29ea0 introduced automatic decompression of Content-Encoding as that was what the spec said then. Now however, HTTP/2 should work the same way as HTTP/1 in this regard. Reported-by: Kazuho Oku Closes #661
* http: Don't break the header into chunks if HTTP/2Tatsuhiro Tsujikawa2016-02-161-1/+1
| | | | | | | | nghttp2 callback deals with TLS layer and therefore the header does not need to be broken into chunks. Bug: https://github.com/curl/curl/issues/659 Reported-by: Kazuho Oku
* openssl: use macro to guard the opaque EVP_PKEY branchViktor Szakats2016-02-161-8/+5
|
* openssl: avoid direct PKEY access with OpenSSL 1.1.0Viktor Szakats2016-02-161-4/+38
| | | | | | | by using API instead of accessing an internal structure. This is required starting OpenSSL 1.1.0-pre3. Closes #650
* SCP: use libssh2_scp_recv2 to support > 2GB files on windowsDavid Byron2016-02-141-4/+15
| | | | | | | libssh2_scp_recv2 is introduced in libssh2 1.7.0 - to be released "any day now. Closes #451
* gtls: fix for builds lacking encrypted key file supportShine Fan2016-02-131-3/+3
| | | | Bug: https://github.com/curl/curl/pull/651
* curlx_tvdiff: handle 32bit time_t overflowsDaniel Stenberg2016-02-121-2/+10
| | | | | | | | | On 32bit systems, make sure we don't overflow and return funky values for very large time differences. Reported-by: Anders Bakken Closes #646
* nss: search slash in forward direction in dup_nickname()Kamil Dudka2016-02-101-8/+2
| | | | It is wasteful to search it backwards if we look for _any_ slash.
* nss: do not count enabled cipher-suitesKamil Dudka2016-02-101-7/+7
| | | | | | We only care if at least one cipher-suite is enabled, so it does not make any sense to iterate till the end and count all enabled cipher-suites.
* mbedtls.c: re-indent to better match curl standardsDaniel Stenberg2016-02-101-44/+44
|
* mbedtls: fix memory leak when destroying SSL connection dataRafael Antonio2016-02-091-5/+11
| | | | Closes #626
* mbedtls: fix ALPN usage segfaultDaniel Stenberg2016-02-092-5/+8
| | | | | | | | Since we didn't keep the input argument around after having called mbedtls, it could end up accessing the wrong memory when figuring out the ALPN protocols. Closes #642
* openssl: remove most BoringSSL #ifdefs.David Benjamin2016-02-096-68/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | As of https://boringssl-review.googlesource.com/#/c/6980/, almost all of BoringSSL #ifdefs in cURL should be unnecessary: - BoringSSL provides no-op stubs for compatibility which replaces most #ifdefs. - DES_set_odd_parity has been in BoringSSL for nearly a year now. Remove the compatibility codepath. - With a small tweak to an extend_key_56_to_64 call, the NTLM code builds fine. - Switch OCSP-related #ifdefs to the more generally useful OPENSSL_NO_OCSP. The only #ifdefs which remain are Curl_ossl_version and the #undefs to work around OpenSSL and wincrypt.h name conflicts. (BoringSSL leaves that to the consumer. The in-header workaround makes things sensitive to include order.) This change errs on the side of removing conditionals despite many of the restored codepaths being no-ops. (BoringSSL generally adds no-op compatibility stubs when possible. OPENSSL_VERSION_NUMBER #ifdefs are bad enough!) Closes #640
* cookies: allow spaces in cookie names, cut of trailing spacesDaniel Stenberg2016-02-081-7/+16
| | | | | | | | | | | | It turns out Firefox and Chrome both allow spaces in cookie names and there are sites out there using that. Turned out the code meant to strip off trailing space from cookie names didn't work. Fixed now. Test case 8 modified to verify both these changes. Closes #639
* configure: --with-ca-fallback: use built-in TLS CA fallbackLudwig Nussel2016-02-082-1/+16
| | | | | | | | When trying to verify a peer without having any root CA certificates set, this makes libcurl use the TLS library's built in default as fallback. Closes #569
* Proxy-Connection: stop sending this header by defaultDaniel Stenberg2016-02-082-15/+4
| | | | | | | | | RFC 7230 says we should stop. Firefox already stopped. Bug: https://github.com/curl/curl/issues/633 Reported-By: Brad Fitzpatrick Closes #633
* openssl: Fix signed/unsigned mismatch warning in X509V3_extJay Satiro2016-02-061-2/+2
| | | | | | | | sk_X509_EXTENSION_num may return an unsigned integer, however the value will fit in an int. Bug: https://github.com/curl/curl/commit/dd1b44c#commitcomment-15913896 Reported-by: Gisle Vanem
* idn_win32: Better error checkingMichael Kaufmann2016-02-061-25/+21
| | | | | | | | | .. also fix a conversion bug in the unused function curl_win32_ascii_to_idn(). And remove wprintfs on error (Jay). Bug: https://github.com/curl/curl/pull/637
* URLs: change more http to httpsViktor Szakats2016-02-0412-19/+21
|
* sasl_sspi: Fix memory leak in domain populateJay Satiro2016-02-041-0/+1
| | | | | | | Free an existing domain before replacing it. Bug: https://github.com/curl/curl/issues/635 Reported-by: silveja1@users.noreply.github.com
* URLs: follow GitHub project rename (also Travis CI)Viktor Szakats2016-02-041-1/+1
| | | | Closes #632
* URLs: Change more haxx.se URLs from http: to https:Dan Fandrich2016-02-033-3/+3
|
* URLs: change all http:// URLs to https://Daniel Stenberg2016-02-03251-259/+259
|
* dotdot: allow an empty input string tooDaniel Stenberg2016-02-021-1/+8
| | | | | | | It isn't used by the code in current conditions but for safety it seems sensible to at least not crash on such input. Extended unit test 1395 to verify this too as well as a plain "/" input.
* urldata: Error on missing SSL backend-specific connect infoGisle Vanem2016-01-291-20/+13
|
* urldata: moved common variable out of ifdefSergei Nikulov2016-01-281-10/+1
| | | | Closes https://github.com/bagder/curl/pull/618
* NTLM: Fix ConnectionExists to compare Proxy credentialsIsaac Boukris2016-01-261-22/+40
| | | | | | | | | | | | | | | Proxy NTLM authentication should compare credentials when re-using a connection similar to host authentication, as it authenticate the connection. Example: curl -v -x http://proxy:port http://host/ -U good_user:good_pwd --proxy-ntlm --next -x http://proxy:port http://host/ [-U fake_user:fake_pwd --proxy-ntlm] CVE-2016-0755 Bug: http://curl.haxx.se/docs/adv_20160127A.html
* mbedtls: Fix pinned key return value on failJay Satiro2016-01-181-49/+66
| | | | | | | | | | | | | | | | | | | | | | | - Switch from verifying a pinned public key in a callback during the certificate verification to inline after the certificate verification. The callback method had three problems: 1. If a pinned public key didn't match, CURLE_SSL_PINNEDPUBKEYNOTMATCH was not returned. 2. If peer certificate verification was disabled the pinned key verification did not take place as it should. 3. (related to #2) If there was no certificate of depth 0 the callback would not have checked the pinned public key. Though all those problems could have been fixed it would have made the code more complex. Instead we now verify inline after the certificate verification in mbedtls_connect_step2. Ref: http://curl.haxx.se/mail/lib-2016-01/0047.html Ref: https://github.com/bagder/curl/pull/601
View Lorry Controller Status