summaryrefslogtreecommitdiff
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* darwinssl: reform OS-specific #definesNick Zitzmann2013-06-221-64/+99
| | | | | | | | This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
* dotdot: introducing dot file path cleanupDaniel Stenberg2013-06-224-12/+223
| | | | | | | | | | RFC3986 details how a path part passed in as part of a URI should be "cleaned" from dot sequences before getting used. The described algorithm is now implemented in lib/dotdot.c with the accompanied test case in test 1395. Bug: http://curl.haxx.se/bug/view.cgi?id=1200 Reported-by: Alex Vinnik
* Curl_urldecode: no peeking beyond end of input bufferDaniel Stenberg2013-06-221-2/+3
| | | | | | | | | | | | | | | | Security problem: CVE-2013-2174 If a program would give a string like "%FF" to curl_easy_unescape() but ask for it to decode only the first byte, it would still parse and decode the full hex sequence. The function then not only read beyond the allowed buffer but it would also deduct the *unsigned* counter variable for how many more bytes there's left to read in the buffer by two, making the counter wrap. Continuing this, the function would go on reading beyond the buffer and soon writing beyond the allocated target buffer... Bug: http://curl.haxx.se/docs/adv_20130622.html Reported-by: Timo Sirainen
* multi_socket: react on socket close immediatelyDaniel Stenberg2013-06-203-2/+53
| | | | | | | | | | | | As a remedy to the problem when a socket gets closed and a new one is opened with the same file descriptor number and as a result multi.c:singlesocket() doesn't detect the difference, the new function Curl_multi_closed() gets told when a socket is closed so that it can be removed from the socket hash. When the old one has been removed, a new socket should be detected fine by the singlesocket() on next invoke. Bug: http://curl.haxx.se/bug/view.cgi?id=1248 Reported-by: Erik Johansson
* CURLOPT_COOKIELIST: take cookie share lockDaniel Stenberg2013-06-171-18/+21
| | | | | | | | | | When performing COOKIELIST operations the cookie lock needs to be taken for the cases where the cookies are shared among multiple handles! Verified by Benjamin Gilbert's updated test 506 Bug: http://curl.haxx.se/bug/view.cgi?id=1215 Reported-by: Benjamin Gilbert
* curl_easy_perform: avoid busy-loopingDaniel Stenberg2013-06-131-0/+25
| | | | | | | | | | | When curl_multi_wait() finds no file descriptor to wait for, it returns instantly and this must be handled gracefully within curl_easy_perform() or cause a busy-loop. Starting now, repeated fast returns without any file descriptors is detected and a gradually increasing sleep will be used (up to a max of 1000 milliseconds) before continuing the loop. Bug: http://curl.haxx.se/bug/view.cgi?id=1238 Reported-by: Miguel Angel
* cookies: follow-up fix for path checkingYAMADA Yasuharu2013-06-122-21/+125
| | | | | | | The initial fix to only compare full path names were done in commit 04f52e9b4db0 but found out to be incomplete. This takes should make the change more complete and there's now two additional tests to verify (test 31 and 62).
* axtls: now done non-blockingEric Hu2013-06-123-81/+177
|
* Curl_output_digest: support auth-int for empty entity bodyDaniel Stenberg2013-06-111-5/+9
| | | | | | | | By always returning the md5 for an empty body when auth-int is asked for, libcurl now at least sometimes does the right thing. Bug: http://curl.haxx.se/bug/view.cgi?id=1235 Patched-by: Nach M. S.
* multi_socket: reduce timeout inaccuracy marginDaniel Stenberg2013-06-111-2/+24
| | | | | | | | | | Allow less room for "triggered too early" mistakes by applications / timers on non-windows platforms. Starting now, we assume that a timeout call is never made earlier than 3 milliseconds before the actual timeout. This greatly improves timeout accuracy on Linux. Bug: http://curl.haxx.se/bug/view.cgi?id=1228 Reported-by: Hang Su
* cert_stuff: avoid double free in the PKCS12 codeDaniel Stenberg2013-06-101-2/+13
| | | | | | | | | | | | | In the pkcs12 code, we get a list of x509 records returned from PKCS12_parse but when iterating over the list and passing each to SSL_CTX_add_extra_chain_cert() we didn't also properly remove them from the "stack", which made them get freed twice (both in sk_X509_pop_free() and then later in SSL_CTX_free). This isn't really documented anywhere... Bug: http://curl.haxx.se/bug/view.cgi?id=1236 Reported-by: Nikaiw
* cert_stuff: remove code duplication in the pkcs12 logicDaniel Stenberg2013-06-101-24/+12
|
* axtls: honor disabled VERIFYHOSTAleksey Tulinov2013-06-081-10/+18
| | | | When VERIFYHOST == 0, libcurl should let invalid certificates to pass.
* curl_multi_wait: only use internal timer if not -1Daniel Stenberg2013-06-041-2/+3
| | | | | | | | | commit 29bf0598aad5 introduced a problem when the "internal" timeout is prefered to the given if shorter, as it didn't consider the case where -1 was returned. Now the internal timeout is only considered if not -1. Reported-by: Tor Arntsen Bug: http://curl.haxx.se/mail/lib-2013-06/0015.html
* curl_multi_wait: reduce timeout if the multi handle wants toDaniel Stenberg2013-06-031-0/+9
| | | | | | | | | | | | | | If the multi handle's pending timeout is less than what is passed into this function, it will now opt to use the shorter time anyway since it is a very good hint that the handle wants to process something in a shorter time than what otherwise would happen. curl_multi_wait.3 was updated accordingly to clarify This is the reason for bug #1224 Bug: http://curl.haxx.se/bug/view.cgi?id=1224 Reported-by: Andrii Moiseiev
* multi_runsingle: switch an if() condition for readabilityDaniel Stenberg2013-06-031-1/+1
| | | | | ... because there's an identical check right next to it so using the operators in the check in the same order increases readability.
* curl_schannel.c: Removed variable unused since 35874298e4Marc Hoersken2013-06-021-1/+0
|
* curl_setup.h: Fixed redefinition warning using mingw-w64Marc Hoersken2013-06-021-0/+2
|
* multi_runsingle: add braces to clarify the codeDaniel Stenberg2013-05-301-7/+8
|
* Digest auth: escape user names with \ or " in themDaniel Stenberg2013-05-271-2/+47
| | | | | | | | | | When sending the HTTP Authorization: header for digest, the user name needs to be escaped if it contains a double-quote or backslash. Test 1229 was added to verify Reported and fixed by: Nach M. S Bug: http://curl.haxx.se/bug/view.cgi?id=1230
* ossl_recv: SSL_read() returning 0 is an error tooMike Giancola2013-05-221-1/+1
| | | | | SSL_read can return 0 for "not successful", according to the open SSL documentation: http://www.openssl.org/docs/ssl/SSL_read.html
* ossl_send: SSL_write() returning 0 is an error tooMike Giancola2013-05-221-1/+1
| | | | | | | | | | | | | | | | | | | | We found that in specific cases if the connection is abruptly closed, the underlying socket is listed in a close_wait state. We continue to call the curl_multi_perform, curl_mutli_fdset etc. None of these APIs report the socket closed / connection finished. Since we have cases where the multi connection is only used once, this can pose a problem for us. I've read that if another connection was to come in, curl would see the socket as bad and attempt to close it at that time - unfortunately, this does not work for us. I found that in specific situations, if SSL_write returns 0, curl did not recognize the socket as closed (or errored out) and did not report it to the application. I believe we need to change the code slightly, to check if ssl_write returns 0. If so, treat it as an error - the same as a negative return code. For OpenSSL - the ssl_write documentation is here: http://www.openssl.org/docs/ssl/SSL_write.html
* Curl_cookie_add: handle IPv6 hostsDaniel Stenberg2013-05-211-65/+24
| | | | | | | | | | | | | | | 1 - don't skip host names with a colon in them in an attempt to bail out on HTTP headers in the cookie file parser. It was only a shortcut anyway and trying to parse a file with HTTP headers will still be handled, only slightly slower. 2 - don't skip domain names based on number of dots. The original netscape cookie spec had this oddity mentioned and while our code decreased the check to only check for two, the existing cookie spec has no such dot counting required. Bug: http://curl.haxx.se/bug/view.cgi?id=1221 Reported-by: Stefan Neis
* cookies: only consider full path matchesYAMADA Yasuharu2013-05-181-4/+29
| | | | | | | | | | | | | | | | I found a bug which cURL sends cookies to the path not to aim at. For example: - cURL sends a request to http://example.fake/hoge/ - server returns cookie which with path=/hoge; the point is there is NOT the '/' end of path string. - cURL sends a request to http://example.fake/hogege/ with the cookie. The reason for this old "feature" is because that behavior is what is described in the original netscape cookie spec: http://curl.haxx.se/rfc/cookie_spec.html The current cookie spec (RFC6265) clarifies the situation: http://tools.ietf.org/html/rfc6265#section-5.2.4
* axtls: prevent memleaks on SSL handshake failuresEric Hu2013-05-161-1/+19
|
* Revert "WIN32 MemoryTracking: track wcsdup() _wcsdup() and _tcsdup() usage"Daniel Stenberg2013-05-125-69/+2
| | | | | | | | | | | This reverts commit 8ec2cb5544b86306b702484ea785b6b9596562ab. We don't have any code anywhere in libcurl (or the curl tool) that use wcsdup so there's no such memory use to track. It seems to cause mild problems with the Borland compiler though that we may avoid by reverting this change again. Bug: http://curl.haxx.se/mail/lib-2013-05/0070.html
* Updated zlib version in build files.Guenter Knauf2013-05-116-8/+8
|
* nss: give PR_INTERVAL_NO_WAIT instead of -1 to PR_Recv/PR_SendDaniel Stenberg2013-05-091-7/+4
| | | | | Reported by: David Strauss Bug: http://curl.haxx.se/mail/lib-2013-05/0088.html
* servercert: allow empty subjectDaniel Stenberg2013-05-071-8/+1
| | | | | Bug: http://curl.haxx.se/bug/view.cgi?id=1220 Patch by: John Gardiner Myers
* curl_schannel.c: Fixed invalid memory access during SSL shutdownMarc Hoersken2013-05-052-12/+8
|
* smtp: Fix trailing whitespace warningSteve Holme2013-05-041-1/+1
|
* smtp: Fix compilation warningSteve Holme2013-05-041-1/+1
| | | | comparison between signed and unsigned integer expressions
* smtp: Updated RFC-2821 references to RFC-5321Steve Holme2013-05-041-3/+3
|
* smtp: Fixed sending of double CRLF caused by first in EOBSteve Holme2013-05-042-13/+29
| | | | | | | | If the mail sent during the transfer contains a terminating <CRLF> then we should not send the first <CRLF> of the EOB as specified in RFC-5321. Additionally don't send the <CRLF> if there is "no mail data" as the DATA command already includes it.
* bindlocal: move brace out of #ifdefLars Johannesen2013-05-011-10/+9
| | | | | | | | The code within #ifdef HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID wrongly had two closing braces when it should only have one, so builds without that define would fail. Bug: http://curl.haxx.se/mail/lib-2013-05/0000.html
* smtp: Tidy up to move the eob counter to the per-request structureSteve Holme2013-04-302-17/+17
| | | | | Move the eob counter from the smtp_conn structure to the SMTP structure as it is associated with a SMTP payload on a per-request basis.
* smtp: Fixed unknown percentage complete in progress barSteve Holme2013-04-291-1/+6
| | | | | | The curl command line utility would display the the completed progress bar with a percentage of zero as the progress routines didn't know the size of the transfer.
* email: Tidy up of *_perform_authenticate()Steve Holme2013-04-283-69/+68
| | | | | | | Removed the hard returns from imap and pop3 by using the same style for sending the authentication string as smtp. Moved the "Other mechanisms not supported" check in smtp to match that of imap and pop3 to provide consistency between the three email protocols.
* smtp: Updated limit check to be more readable like the check in pop3Steve Holme2013-04-281-1/+1
|
* pop3: Added 255 octet limit check when sending initial responseSteve Holme2013-04-281-1/+2
| | | | Added 255 octet limit check as per Section 4. Paragraph 8 of RFC-5034.
* darwinssl: add TLS crypto authenticationNick Zitzmann2013-04-271-2/+160
| | | | | | | | | | Users using the Secure Transport (darwinssl) back-end can now use a certificate and private key to authenticate with a site using TLS. Because Apple's security system is based around the keychain and does not have any non-public function to create a SecIdentityRef data structure from data loaded outside of the Keychain, the certificate and private key have to be loaded into the Keychain first (using the certtool command line tool or the Security framework's C API) before we can find it and use it.
* imap: Added support for overriding the SASL initial responseSteve Holme2013-04-271-3/+4
| | | | | | | In addition to checking for the SASL-IR capability the user can override the sending of the client's initial response in the AUTHENTICATION command with the use of CURLOPT_SASL_IR should the server erroneously not report SASL-IR when it does support it.
* smtp: Added support for disabling the SASL initial responseSteve Holme2013-04-271-8/+15
| | | | | | | | | Updated the default behaviour of sending the client's initial response in the AUTH command to not send it and added support for CURLOPT_SASL_IR to allow the user to specify including the response. Related Bug: http://curl.haxx.se/mail/lib-2012-03/0114.html Reported-by: Gokhan Sengun
* pop3: Added support for enabling the SASL initial responseSteve Holme2013-04-271-12/+47
| | | | | Allowed the user to specify whether to send the client's intial response in the AUTH command via CURLOPT_SASL_IR.
* sasl-ir: Added CURLOPT_SASL_IR to enable/disable the SASL initial responseSteve Holme2013-04-272-1/+9
|
* curl_easy_init: use less mallocsDaniel Stenberg2013-04-265-12/+28
| | | | | | | | | | | By introducing an internal alternative to curl_multi_init() that accepts parameters to set the hash sizes, easy handles will now use tiny socket and connection hash tables since it will only ever add a single easy handle to that multi handle. This decreased the number mallocs in test 40 (which is a rather simple and typical easy interface use case) from 1142 to 138. The maximum amount of memory allocated used went down from 118969 to 78805.
* ftp_state_pasv_resp: connect through proxy also when set by envDaniel Stenberg2013-04-261-6/+4
| | | | | | | | | | | | | | | | | When connecting back to an FTP server after having sent PASV/EPSV, libcurl sometimes didn't use the proxy properly even though the proxy was used for the initial connect. The function wrongly checked for the CURLOPT_PROXY variable to be set, which made it act wrongly if the proxy information was set with an environment variable. Added test case 711 to verify (based on 707 which uses --socks5). Also added test712 to verify another variation of setting the proxy: with --proxy socks5:// Bug: http://curl.haxx.se/bug/view.cgi?id=1218 Reported-by: Zekun Ni
* url: initialize speed-check data for file:// protocolZdenek Pavlas2013-04-261-0/+3
| | | | | | | | ... in order to prevent an artificial timeout event based on stale speed-check data from a previous network transfer. This commit fixes a regression caused by 9dd85bced56f6951107f69e581c872c1e7e3e58e. Bug: https://bugzilla.redhat.com/906031
* url: Added smtp and pop3 hostnames to the protocol detection listSteve Holme2013-04-231-0/+4
|
* getinfo.c: reset timecond when clearing session-info variablesAlessandro Ghedini2013-04-221-0/+1
| | | | | Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=705783 Reported-by: Ludovico Cavedon <cavedon@debian.org>
View Lorry Controller Status