summaryrefslogtreecommitdiff
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* connect: defer port selection until connect() timeCristian Rodríguez2020-12-101-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | If supported, defer port selection until connect() time if --interface is given and source port is 0. Reproducer: * start fast webserver on port 80 * starve system of ephemeral ports $ sysctl net.ipv4.ip_local_port_range="60990 60999" * start a curl/libcurl "crawler" $curl --keepalive --parallel --parallel-immediate --head --interface 127.0.0.2 "http://127.0.0.[1-254]/file[001-002].txt" current result: (possible some successful data) curl: (45) bind failed with errno 98: Address already in use result after patch: (complete success or few connections failing, higlhy depending on load) Fail only when all the possible 4-tuple combinations are exhausted, which is impossible to do when port is selected at bind() time becuse the kernel does not know if socket will be listen()'ed on or connect'ed yet. Closes #6295
* connect: zero variable on stack to silence valgrind complaintHans-Christian Noren Egtvedt2020-12-091-0/+1
| | | | | | | | | | | | Valgrind will complain that ssrem buffer usage if not explicit initialized, hence initialize it to zero. This completes the change intially started in commit 2c0d7212151 ('ftp: retry getpeername for FTP with TCP_FASTOPEN') where the ssloc buffer has a similar memset to zero. Signed-off-by: Hans-Christian Noren Egtvedt <hegtvedt@cisco.com> Closes #6289
* urldata: restore comment on ssl_connect_data.useJacob Hoffman-Andrews2020-12-071-3/+3
| | | | | | | This comment was originally on the `use` field, but was separated from its field in 62a2534. Closes https://github.com/curl/curl/pull/6287
* openssl: make the OCSP verification verify the certificate idDaniel Stenberg2020-12-071-29/+54
| | | | | | | | CVE-2020-8286 Reported by anonymous Bug: https://curl.se/docs/CVE-2020-8286.html
* ftp: make wc_statemach loop instead of recurseDaniel Stenberg2020-12-071-100/+102
| | | | | | | | CVE-2020-8285 Fixes #6255 Bug: https://curl.se/docs/CVE-2020-8285.html Reported-by: xnynx on github
* ftp: CURLOPT_FTP_SKIP_PASV_IP by defaultDaniel Stenberg2020-12-071-0/+1
| | | | | | | | | | | | The command line tool also independently sets --ftp-skip-pasv-ip by default. Ten test cases updated to adapt the modified --libcurl output. Bug: https://curl.se/docs/CVE-2020-8284.html CVE-2020-8284 Reported-by: Varnavas Papaioannou
* urlapi: don't accept blank port number field without schemeDaniel Stenberg2020-12-072-5/+10
| | | | | | | | | | ... as it makes the URL parser accept "very-long-hostname://" as a valid host name and we don't want that. The parser now only accepts a blank (no digits) after the colon if the URL starts with a scheme. Reported-by: d4d on hackerone Closes #6283
* Revert "multi: implement wait using winsock events"Daniel Stenberg2020-12-062-153/+3
| | | | | | | | | | | This reverts commit d2a7d7c185f98df8f3e585e5620cbc0482e45fac. This commit also reverts the subsequent follow-ups to that commit, which were all done within windows #ifdefs that are removed in this change. Marc helped me verify this. Fixes #6146 Closes #6281
* ftp: retry getpeername for FTP with TCP_FASTOPENKlaus Crusius2020-12-063-45/+70
| | | | | | | | | | | | In the case of TFO, the remote host name is not resolved at the connetion time. For FTP that has lead to missing hostname for the secondary connection. Therefore the name resolution is done at the time, when FTP requires it. Fixes #6252 Closes #6265 Closes #6282
* openssl: use OPENSSL_init_ssl() with >= 1.1.0Daniel Stenberg2020-12-031-4/+15
| | | | | | | Reported-by: Kovalkov Dmitrii and Per Nilsson Fixes #6254 Fixes #6256 Closes #6260
* quiche: close the connectionDaniel Stenberg2020-12-022-8/+15
| | | | | | Reported-by: Junho Choi Fixes #6213 Closes #6217
* ngtcp2: Fix build error due to symbol name changeJay Satiro2020-12-021-4/+4
| | | | | | | | | | - NGTCP2_CRYPTO_LEVEL_APP -> NGTCP2_CRYPTO_LEVEL_APPLICATION ngtcp2/ngtcp2@76232e9 changed the name. ngtcp2 master is required to build curl with http3 support. Closes https://github.com/curl/curl/pull/6271
* cmake: check for linux/tcp.hKlaus Crusius2020-12-013-0/+7
| | | | | | The HAVE_LINUX_TCP_H define was not set by cmake. Closes #6252
* splay: rename Curl_splayremovebyaddr to Curl_splayremoveDaniel Stenberg2020-12-013-18/+10
| | | | | | | ... and remove the old unused proto for the old Curl_splayremove version. Closes #6269
* openssl: free mem_buf in error pathDaniel Stenberg2020-12-011-9/+9
| | | | | | To fix a memory-leak. Closes #6267
* openssl: remove #if 0 leftoverDaniel Stenberg2020-11-301-4/+0
| | | | | | Follow-up to 4c9768565ec3a9 (from Sep 2008) Closes #6268
* ntlm: avoid malloc(0) on zero length user and domainDaniel Stenberg2020-11-291-6/+2
| | | | | | | | ... and simplify the too-long checks somewhat. Detected by OSS-Fuzz Closes #6264
* ngtcp2: use the minimal version of QUIC supported by ngtcp2Daiki Ueno2020-11-261-1/+1
| | | | Closes #6250
* ngtcp2: advertise h3 ALPN unconditionallyDaiki Ueno2020-11-261-17/+5
| | | | Closes #6250
* vquic/ngtcp2.h: define local_addr as sockaddr_storageDaiki Ueno2020-11-262-4/+5
| | | | | | | | | | | | This field needs to be wide enough to hold sockaddr_in6 when connecting via IPv6. Otherwise, ngtcp2_conn_read_pkt will drop the packets because of the address mismatch: I00000022 [...] con ignore packet from unknown path We can safely assume that struct sockaddr_storage is available, as it is used in the public interface of ngtcp2. Closes #6250
* socks: check for DNS entries with the right port numberDaniel Stenberg2020-11-261-1/+1
| | | | | | | | | | The resolve call is done with the right port number, but the subsequent check used the wrong one, which then could find a previous resolve which would return and leave the fresh resolve "incomplete" and leaking memory. Fixes #6247 Closes #6253
* curl_setup: USE_RESOLVE_ON_IPS is for Apple native resolver useDaniel Stenberg2020-11-261-1/+1
| | | | ... so don't define it when instructed to use c-ares!
* file: avoid duplicated code sequenceEmil Engler2020-11-251-11/+1
| | | | | | | | | file_disconnect() is identical with file_do() except the function header but as the arguments are unused anyway so why not just return file_do() directly! Reviewed-by: Daniel Stenberg Closes #6249
* infof/failf calls: fix format specifiersRikard Falkeborn2020-11-248-15/+15
| | | | | | Update a few format specifiers to match what is being printed. Closes #6241
* docs/INTERNALS: remove reference to Curl_sendf()Daniel Stenberg2020-11-241-2/+0
| | | | | | | | | The function has been removed from common usage. Also removed comment in gopher.c that still referenced it. Reported-by: Rikard Falkeborn Fixes #6242 Closes #6243
* asyn: use 'struct thread_data *' instead of 'void *'Daniel Stenberg2020-11-233-25/+24
| | | | | | | | | | To reduce use of types that can't be checked at compile time. Also removes several typecasts. ... and rename the struct field from 'os_specific' to 'tdata'. Closes #6239 Reviewed-by: Jay Satiro
* Makefile.m32: add support for UNICODE buildsViktor Szakats2020-11-231-0/+6
| | | | | | | | | | | | | It requires the linker to support the `-municode` option. This is available in more recent mingw-w64 releases. Ref: https://gcc.gnu.org/onlinedocs/gcc/x86-Windows-Options.html Ref: https://stackoverflow.com/questions/3571250/wwinmain-unicode-and-mingw/11706847#11706847 Reviewed-by: Jay Satiro Reviewed-by: Marcel Raad Closes #6228
* urldata: remove 'void *protop' and create the union 'p'Daniel Stenberg2020-11-2321-166/+181
| | | | | | | ... to avoid the use of 'void *' for the protocol specific structs done per transfer. Closes #6238
* curl: add compatibility for Amiga and GCC 6.5Oliver Urbann2020-11-201-0/+6
| | | | | | | Changes are mainly reordering and adding of includes required to compile with a more recent version of GCC. Closes #6220
* openssl: guard against OOM on context creationDaniel Gustafsson2020-11-191-2/+6
| | | | | | | | | | | | | EVP_MD_CTX_create will allocate memory for the context and returns NULL in case the allocation fails. Make sure to catch any allocation failures and exit early if so. In passing, also move to EVP_DigestInit rather than EVP_DigestInit_ex as the latter is intended for ENGINE selection which we don't do. Closes #6224 Reviewed-by: Daniel Stenberg <daniel@haxx.se> Reviewed-by: Emil Engler <me@emilengler.com>
* cmake: use libcurl.rc in all Windows buildsVincent Torri2020-11-191-1/+1
| | | | | Reviewed-by: Marcel Raad Closes #6215
* quiche: remove 'static' from local bufferDaniel Stenberg2020-11-191-1/+1
| | | | | | For thread-safety Closes #6223
* cmake: correctly handle linker flags for static libsTobias Hieta2020-11-101-4/+0
| | | | | | | | | | | | | curl CMake was setting the the EXE flags for static libraries which made the /manifest:no flag ended up when linking the static library, which is not a valid flag for lib.exe or llvm-lib.exe and caused llvm-lib to exit with an error. The better way to handle this is to make sure that we pass the correct linker flags to CMAKE_STATIC_LINKER_FLAGS instead. Reviewed-by: Jakub Zakrzewski Closes #6195
* http_proxy: use enum with state names for 'keepon'bagder/http-proxy-keeponDaniel Stenberg2020-11-102-11/+15
| | | | | | | | | To make the code clearer, change the 'keepon' from an int to an enum with better state names. Reported-by: Niranjan Hasabnis Bug: https://curl.se/mail/lib-2020-11/0026.html Closes #6193
* curl_easy_escape: limit output string length to 3 * max inputDaniel Stenberg2020-11-091-1/+1
| | | | | | | | | ... instead of the limiting it to just the max input size. As every input byte can be expanded to 3 output bytes, this could limit the input string to 2.66 MB instead of the intended 8 MB. Reported-by: Marc Schlatter Closes #6192
* Curl_pgrsStartNow: init speed limit time stamps at startDaniel Stenberg2020-11-091-4/+2
| | | | | | | | | | By setting the speed limit time stamps unconditionally at transfer start, we can start off a transfer without speed limits and yet allow them to get set during transfer and have an effect. Reported-by: Kael1117 on github Fixes #6162 Closes #6184
* ngtcp2: adapt to recent nghttp3 updatesDaniel Stenberg2020-11-091-0/+1
| | | | | | 'reset_stream' was added to the nghttp3_conn_callbacks struct Closes #6185
* altsvc: minimize variable scope and avoid "DEAD_STORE"Daniel Stenberg2020-11-071-2/+1
| | | | Closes #6182
* url: make sure an HSTS upgrade updates URL and scheme correctlyDaniel Stenberg2020-11-061-2/+20
| | | | Closes #6175
* hsts: remove debug code leftoversDaniel Stenberg2020-11-061-2/+0
| | | | Closes #6175
* hsts: Remove pointless call to free in errorpathDaniel Gustafsson2020-11-051-1/+0
| | | | | | | | The line variable will always be NULL in the error path, so remove the free call since it's pointless. Closes #6170 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* copyright: fix year rangesDaniel Stenberg2020-11-0596-97/+97
| | | | Follow-up from 4d2f8006777
* curl.se: new homeDaniel Stenberg2020-11-04313-323/+323
| | | | Closes #6172
* rtsp: error out on empty Session ID, unified the codeHarry Sintonen2020-11-041-18/+18
|
* rtsp: fixed Session ID comparison to refuse prefixHarry Sintonen2020-11-041-2/+11
| | | | Closes #6161
* hsts: add read/write callbacksDaniel Stenberg2020-11-039-13/+139
| | | | | | | | - read/write callback options - man pages for the 4 new setopts - test 1915 verifies the callbacks Closes #5896
* hsts: add support for Strict-Transport-SecurityDaniel Stenberg2020-11-0311-20/+576
| | | | | | | | | | | | | | | | | | | | | | | | | - enable in the build (configure) - header parsing - host name lookup - unit tests for the above - CI build - CURL_VERSION_HSTS bit - curl_version_info support - curl -V output - curl-config --features - CURLOPT_HSTS_CTRL - man page for CURLOPT_HSTS_CTRL - curl --hsts (sets CURLOPT_HSTS_CTRL and works with --libcurl) - man page for --hsts - save cache to disk - load cache from disk - CURLOPT_HSTS - man page for CURLOPT_HSTS - added docs/HSTS.md - fixed --version docs - adjusted curl_easy_duphandle Closes #5896
* sendf: move the verbose-check into Curl_debugDaniel Stenberg2020-11-0211-138/+103
| | | | | | Saves us from having the same check done everywhere. Closes #6159
* gnutls: fix memory leaks (certfields memory wasn't released)Harry Sintonen2020-11-021-1/+6
| | | | Closes #6153
* http: pass correct header size to debug callback for chunked postDaniel Stenberg2020-10-311-5/+9
| | | | | | | | | | | ... when the chunked framing was added, the size of the "body part" of the data was calculated wrongly so the debug callback would get told a header chunk a few bytes too big that would also contain the first few bytes of the request body. Reported-by: Dirk Wetter Ref: #6144 Closes #6147
View Lorry Controller Status