1
0
mirror of https://github.com/moparisthebest/curl synced 2024-12-23 08:38:49 -05:00
Commit Graph

24426 Commits

Author SHA1 Message Date
Daniel Stenberg
5c8783d77f
process_pending_handles: mark queued transfers as previously pending
With transfers being queued up, we only move one at a a time back to the
CONNECT state but now we mark moved transfers so that when a moved
transfer is confirmed "successful" (it connected) it will trigger the
move of another pending transfer. Previously, it would otherwise wait
until the transfer was done before doing this. This makes queued up
pending transfers get processed (much) faster.
2019-05-01 22:51:23 +02:00
Daniel Stenberg
c32248f17d
http: mark bundle as not for multiuse on < HTTP/2 response
Fixes #3813
Closes #3815
2019-05-01 22:51:23 +02:00
Daniel Gustafsson
b45fd8938e cookie: Guard against possible NULL ptr deref
In case the name pointer isn't set (due to memory pressure most likely)
we need to skip the prefix matching and reject with a badcookie to avoid
a possible NULL pointer dereference.

Closes #3820 #3821
Reported-by: Jonathan Moerman
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2019-05-01 13:14:15 +02:00
Patrick Monnerat
b898b4c06c os400: Add CURLOPT_MAXAGE_CONN to ILE/RPG bindings 2019-04-30 14:29:16 +02:00
Kamil Dudka
9e8f28a8f1 nss: provide more specific error messages on failed init
Closes #3808
2019-04-29 10:29:53 +02:00
Reed Loden
361f9957cb
docs: minor polish to the bug bounty / security docs
Closes #3811
2019-04-29 08:09:10 +02:00
Daniel Stenberg
5fc28510a4
CURL_MAX_INPUT_LENGTH: largest acceptable string input size
This limits all accepted input strings passed to libcurl to be less than
CURL_MAX_INPUT_LENGTH (8000000) bytes, for these API calls:
curl_easy_setopt() and curl_url_set().

The 8000000 number is arbitrary picked and is meant to detect mistakes
or abuse, not to limit actual practical use cases. By limiting the
acceptable string lengths we also reduce the risk of integer overflows
all over.

NOTE: This does not apply to `CURLOPT_POSTFIELDS`.

Test 1559 verifies.

Closes #3805
2019-04-29 08:02:44 +02:00
Tseng Jun
2fe2da9f1a
curlver.h: use parenthesis in CURL_VERSION_BITS macro
Closes #3809
2019-04-28 11:20:22 +02:00
Simon Warta
dc5ac786d9
cmake: rename CMAKE_USE_DARWINSSL to CMAKE_USE_SECTRANSP
Closes https://github.com/curl/curl/pull/3769
2019-04-27 11:51:23 +02:00
Steve Holme
e7d3f65ab9 ntlm: Missed pre-processor || (or) during rebase for cd15acd0 2019-04-23 20:26:02 +01:00
Steve Holme
cd15acd0ec ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4
Just like we do for mbed TLS, use our local implementation of MD4 when
OpenSSL doesn't support it. This allows a type-3 message to include the
NT response.
2019-04-23 20:00:33 +01:00
Daniel Gustafsson
7794cacf7e INTERNALS: fix misindentation of ToC item
Kerberos was incorrectly indented as a subsection under FTP, which is
incorrect as they are both top level sections. A fix for this was first
attempted in commit fef38a0898 but that
was a few paddles short of being complete.
2019-04-23 13:11:19 +02:00
Aron Bergman
c3666e431f INTERNALS: Add structs to ToC
Add the subsections under "Structs in libcurl" to the table of contents.

Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
2019-04-23 13:10:32 +02:00
Aron Bergman
927ee2cc60 INTERNALS: Add code highlighting
Make all struct members under the Curl_handler section
print in monospace font.

Closes #3801
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
2019-04-23 13:09:35 +02:00
Daniel Stenberg
10e4dd6a7b
docs/BUG-BOUNTY: bug bounty time [skip ci]
Introducing the curl bug bounty program on hackerone. We now recommend
filing security issues directly in the hackerone ticket system which
only is readable to curl security team members.

Assisted-by: Daniel Gustafsson

Closes #3488
2019-04-22 17:19:19 +02:00
Steve Holme
eb84ca3ea8 sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616
RFC 4616 specifies the authzid is optional in the client authentication
message and that the server will derive the authorisation identity
(authzid) from the authentication identity (authcid) when not specified
by the client.
2019-04-22 12:29:49 +01:00
Gisle Vanem
b21701c54b memdebug: fix variable name
Follow-up to 76b6348 which renamed logfile as curl_dbg_logfile.

Ref: https://github.com/curl/curl/commit/76b6348#r33259088
2019-04-22 03:10:05 -04:00
Steve Holme
f0950acc07 vauth/cleartext: Don't send the authzid if it is empty
Follow up to 762a292f.
2019-04-21 23:34:21 +01:00
Daniel Stenberg
c8bbfb90ea
test 196,197,198: add 'retry' keyword [skip ci] 2019-04-21 23:28:47 +02:00
Daniel Stenberg
50d2284b91
RELEASE-NOTES: synced 2019-04-21 23:24:55 +02:00
Daniel Stenberg
e649432e72
CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuse
... and disconnect too old ones instead of trying to reuse.

Default max age is set to 118 seconds.

Ref: #3722
Closes #3782
2019-04-21 23:06:23 +02:00
Po-Chuan Hsieh
060f870b85 altsvc: Fix building with cookies disables
ALTSVC requires Curl_get_line which is defined in lib/cookie.c inside a #if
check of HTTP and COOKIES. That makes Curl_get_line undefined if COOKIES is
disabled. Fix by splitting out the function into a separate file which can
be included where needed.

Closes #3717
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>
2019-04-20 22:46:21 +02:00
Daniel Stenberg
e04e974aed
test1002: correct the name [skip ci] 2019-04-20 12:44:31 +02:00
Daniel Stenberg
4225e5db1b
test660: verify CONNECT_ONLY with IMAP
which basically just makes sure LOGOUT is *not* issued on disconnect
2019-04-20 12:40:53 +02:00
Daniel Stenberg
e06b8bdae6
Curl_disconnect: treat all CONNECT_ONLY connections as "dead"
Since the connection has been used by the "outside" we don't know the
state of it anymore and curl should not use it anymore.

Bug: https://curl.haxx.se/mail/lib-2019-04/0052.html

Closes #3795
2019-04-20 12:40:45 +02:00
Daniel Stenberg
31c3111284
multi: fix the statenames (follow-up fix from 2f44e94efb)
The list of names must be in sync with the defined states in the header
file!
2019-04-19 16:56:32 +02:00
Steve Holme
7113e075db openvms: Remove pre-processors for Windows as VMS cannot support them 2019-04-16 21:40:16 +01:00
Steve Holme
7b131a1461 openvms: Remove pre-processor for SecureTransport as VMS cannot support it
Fixes #3768
Closes #3785
2019-04-16 21:40:16 +01:00
Jay Satiro
d69ffec9d8 TODO: Add issue link to an existing entry 2019-04-16 15:45:41 -04:00
Daniel Stenberg
36dc5d66f5
RELEASE-NOTES: synced 2019-04-16 09:34:48 +02:00
Jay Satiro
538db66fe2 tool_help: Warn if curl and libcurl versions do not match
.. because functionality may be affected if the versions differ.

This commit implements TODO 18.7 "warning if curl version is not in sync
with libcurl version".

Ref: https://github.com/curl/curl/blob/curl-7_64_1/docs/TODO#L1028-L1033

Closes https://github.com/curl/curl/pull/3774
2019-04-16 03:09:42 -04:00
Steve Holme
07ba221667 md5: Update the function signature following d84da52d 2019-04-16 00:08:42 +01:00
Steve Holme
0a9f3edeb3 md5: Forgot to update the code alignment in d84da52d 2019-04-15 22:40:43 +01:00
Steve Holme
d84da52d9f md5: Return CURLcode from the internally accessible functions
Following 28f826b3 to return CURLE_OK instead of numeric 0.
2019-04-15 22:38:20 +01:00
Daniel Gustafsson
90d9e9460e tests: Run global cleanup at end of tests
Make sure to run curl_global_cleanup() when shutting down the test
suite to release any resources allocated in the SSL setup. This is
clearly visible when running tests with PolarSSL where the thread
lock calloc() memory which isn't released when not running cleanup.
Below is an excerpt from the autobuild logs:

  ==12368== 96 bytes in 1 blocks are possibly lost in loss record 1 of 2
  ==12368== at 0x4837B65: calloc (vg_replace_malloc.c:752)
  ==12368== by 0x11A76E: curl_dbg_calloc (memdebug.c:205)
  ==12368== by 0x145CDF: Curl_polarsslthreadlock_thread_setup
                         (polarssl_threadlock.c:54)
  ==12368== by 0x145B37: Curl_polarssl_init (polarssl.c:865)
  ==12368== by 0x14129D: Curl_ssl_init (vtls.c:171)
  ==12368== by 0x118B4C: global_init (easy.c:158)
  ==12368== by 0x118BF5: curl_global_init (easy.c:221)
  ==12368== by 0x118D0B: curl_easy_init (easy.c:299)
  ==12368== by 0x114E96: test (lib1906.c:32)
  ==12368== by 0x115495: main (first.c:174)

Closes #3783
Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2019-04-15 15:23:58 +02:00
Marcel Raad
9960ec9003
travis: use mbedtls from Xenial
No need to build it from source anymore.

Closes https://github.com/curl/curl/pull/3779
2019-04-15 11:22:53 +02:00
Marcel Raad
1ef146a8db
travis: use libpsl from Xenial
This makes building libpsl and libidn2 from source unnecessary and
removes the need for the autopoint and libunistring-dev packages.

Closes https://github.com/curl/curl/pull/3779
2019-04-15 11:22:49 +02:00
Daniel Stenberg
a7ae01cb75
runtests: start socksd like other servers
... without a $srcdir prefix. Triggered by the failures in several
autobuilds.

Closes #3781
2019-04-15 11:05:20 +02:00
Daniel Gustafsson
0641086c2f socksd: Fix typos
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2019-04-14 22:06:40 +02:00
Daniel Gustafsson
31238d5fb7 socksd: Properly decorate static variables
Mark global variables static to avoid compiler warning in Clang when
using -Wmissing-variable-declarations.

Closes #3778
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2019-04-14 22:06:09 +02:00
Steve Holme
5a1ba3ccb5 md(4|5): Fixed indentation oddities with the importation of replacement code
The indentation from 211d5329 and 57d6d253 was a little strange as
parts didn't align correctly, uses 4 spaces rather than 2. Checked
the indentation of the original source so it aligns, albeit, using
curl style.
2019-04-14 14:08:15 +01:00
Steve Holme
28f826b3bf md5: Code style to return CURLE_OK rather than numeric 0 2019-04-14 08:42:36 +01:00
Steve Holme
51b81e9b6e md5: Corrected code style for some pointer arguments 2019-04-14 08:36:56 +01:00
Marcel Raad
e507671884
travis: update some builds to xenial
Xenial comes with more up-to-date software versions and more available
packages, some of which we currently build from source. Unfortunately,
some builds would fail with Xenial because of assertion failures in
Valgrind when using OpenSSL, so leave these at Trusty.

Closes https://github.com/curl/curl/pull/3777
2019-04-13 22:33:36 +02:00
Daniel Stenberg
54c784556e
test: make tests and test scripts use socksd for SOCKS
Make all SOCKS tests use socksd instead of ssh.
2019-04-13 11:21:53 +02:00
Daniel Stenberg
04fd67555c
socksd: new SOCKS 4+5 server for tests
Closes #3752
2019-04-13 11:21:35 +02:00
Daniel Stenberg
4f463da6b5
singleipconnect: show port in the verbose "Trying ..." message
To aid debugging better.
2019-04-13 11:21:25 +02:00
tmilburn
c3e38a4250
CURLOPT_ADDRESS_SCOPE: fix range check and more
Commit 9081014 fixed most of the confusing issues between scope id and
scope however 844896d added bad limits checking assuming that the scope
is being set and not the scope id.

I have fixed the documentation so it all refers to scope ids.

In addition Curl_if2ip refered to the scope id as remote_scope_id which
is incorrect, so I renamed it to local_scope_id.

Adjusted-by: Daniel Stenberg

Closes #3655
Closes #3765
Fixes #3713
2019-04-13 11:18:55 +02:00
Daniel Stenberg
d715d2ac89
urlapi: stricter CURLUPART_PORT parsing
Only allow well formed decimal numbers in the input.

Document that the number MUST be between 1 and 65535.

Add tests to test 1560 to verify the above.

Ref: https://github.com/curl/curl/issues/3753
Closes #3762
2019-04-13 11:17:30 +02:00
Jan-E
79c4864a56 winbuild: Support MultiSSL builds
- Remove the lines in winbuild/Makefile.vc that generate an error with
  multiple SSL backends.

- Add /DCURL_WITH_MULTI_SSL in winbuild/MakefileBuild.vc if multiple SSL
  backends are set.

Closes https://github.com/curl/curl/pull/3772
2019-04-13 02:49:14 -04:00