1
0
mirror of https://github.com/moparisthebest/curl synced 2024-08-13 17:03:50 -04:00
Commit Graph

10978 Commits

Author SHA1 Message Date
Daniel Stenberg
5076b8668f
wolfssl: remove the BACKEND define kludge 2020-03-19 13:22:34 +01:00
Daniel Stenberg
259d62c7c0
nss: remove the BACKEND define kludge 2020-03-19 13:22:34 +01:00
Daniel Stenberg
89865c149d
gnutls: remove the BACKEND define kludge 2020-03-19 13:22:34 +01:00
Daniel Stenberg
aec0b49df3
openssl: remove the BACKEND define kludge
Use a proper variable instead to make it easier to use a debugger and
read the code.
2020-03-19 13:22:34 +01:00
Jay Satiro
347a374c56 http2: Fix erroneous debug message that h2 connection closed
Prior to this change in libcurl debug builds http2 stream closure was
erroneously referred to as connection closure.

Before:
* nread <= 0, server closed connection, bailing

After:
* nread == 0, stream closed, bailing

Closes https://github.com/curl/curl/pull/5118
2020-03-18 03:39:27 -04:00
Johannes Schindelin
5450428491 schannel: add "best effort" revocation check option
- Implement new option CURLSSLOPT_REVOKE_BEST_EFFORT and
  --ssl-revoke-best-effort to allow a "best effort" revocation check.

A best effort revocation check ignores errors that the revocation check
was unable to take place. The reasoning is described in detail below and
discussed further in the PR.

---

When running e.g. with Fiddler, the schannel backend fails with an
unhelpful error message:

	Unknown error (0x80092012) - The revocation function was unable
	to check revocation for the certificate.

Sadly, many enterprise users who are stuck behind MITM proxies suffer
the very same problem.

This has been discussed in plenty of issues:
https://github.com/curl/curl/issues/3727,
https://github.com/curl/curl/issues/264, for example.

In the latter, a Microsoft Edge developer even made the case that the
common behavior is to ignore issues when a certificate has no recorded
distribution point for revocation lists, or when the server is offline.
This is also known as "best effort" strategy and addresses the Fiddler
issue.

Unfortunately, this strategy was not chosen as the default for schannel
(and is therefore a backend-specific behavior: OpenSSL seems to happily
ignore the offline servers and missing distribution points).

To maintain backward-compatibility, we therefore add a new flag
(`CURLSSLOPT_REVOKE_BEST_EFFORT`) and a new option
(`--ssl-revoke-best-effort`) to select the new behavior.

Due to the many related issues Git for Windows and GitHub Desktop, the
plan is to make this behavior the default in these software packages.

The test 2070 was added to verify this behavior, adapted from 310.

Based-on-work-by: georgeok <giorgos.n.oikonomou@gmail.com>
Co-authored-by: Markus Olsson <j.markus.olsson@gmail.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Closes https://github.com/curl/curl/pull/4981
2020-03-18 03:23:39 -04:00
Jay Satiro
a268ad5d7e multi: Improve parameter check for curl_multi_remove_handle
- If an easy handle is owned by a multi different from the one specified
  then return CURLM_BAD_EASY_HANDLE.

Prior to this change I assume user error could cause corruption.

Closes https://github.com/curl/curl/pull/5116
2020-03-18 02:58:42 -04:00
Viktor Szakats
7284061361 windows: suppress UI in all CryptAcquireContext() calls
Ref: https://docs.microsoft.com/windows/win32/api/wincrypt/nf-wincrypt-cryptacquirecontexta#parameters
Reviewed-by: Marc Hörsken
Closes https://github.com/curl/curl/pull/5088
2020-03-17 23:08:02 +00:00
Daniel Stenberg
7631f2b752
test 970: verify --write-out '%{json}'
Makes curl_easy_getinfo() of "variable" numerical content instead return
the number set in the env variable `CURL_TIME`.

Makes curl_version() of "variable" textual content. This guarantees a
stable version string which can be tested against. Environment variable
`CURL_VERSION` defines the content.

Assisted-by: Mathias Gumz
2020-03-17 15:04:24 +01:00
Mathias Gumz
04c03416e6
writeout: support to generate JSON output
This commit adds support to generate JSON via the writeout feature:

    -w "%{json}"

It leverages the existing infrastructure as much as possible. Thus,
generating the JSON on STDERR is possible by:

    -w "%{stderr}%{json}"

This implements a variant of
https://github.com/curl/curl/wiki/JSON#--write-out-json.

Closes #4870
2020-03-17 15:01:28 +01:00
Daniel Stenberg
37a0541882
cmake: add support for building with wolfSSL
My working build cmdline:

$ cmake -DCMAKE_PREFIX_PATH=$HOME/build-wolfssl -DCMAKE_USE_WOLFSSL=ON .

Assisted-by: Brad King
Closes #5095
2020-03-16 22:56:50 +01:00
Daniel Stenberg
2eba5e4c7b
vtls: free ssl_config leftovers on out-of-memory
Torture testing 2034 and 2037 found this.

Reported-by: Marc Hörsken
Fixes #5108
Closes #5109
2020-03-16 08:10:30 +01:00
Daniel Stenberg
92c152c2ef
gskit: update the copyright year range
Follow-up from 083603c63a
2020-03-15 23:43:50 +01:00
Marc Hoersken
083603c63a
gskit: use our internal select wrapper for portability
Follow up to c52b342
Closes #5106
2020-03-15 23:39:40 +01:00
Daniel Stenberg
f38c7290b1
transfer: cap retries of "dead connections" to 5
When libcurl retries a connection due to it being "seemingly dead" or by
REFUSED_STREAM, it will now only do it up five times before giving up,
to avoid never-ending loops.

Reported-by: Dima Tisnek
Bug: https://curl.haxx.se/mail/lib-2020-03/0044.html
Closes #5074
2020-03-15 11:43:47 +01:00
Marc Hoersken
696cfc0f6c
select: add 'timeout_ms' wrap-around precaution to Curl_select 2020-03-15 11:08:27 +01:00
Marc Hoersken
041e778f1e
select: fix 'pending_ms' is assigned a value that is never used
Detected by Codacy
2020-03-15 11:08:27 +01:00
Marc Hoersken
c52b342051
select: move duplicate select preparation code into Curl_select
Reviewed by Daniel Stenberg
Reviewed by Marcel Raad
Closes #5078
2020-03-15 11:08:27 +01:00
Daniel Stenberg
dbd16c3e25
connect: happy eyeballs cleanup
Make sure each separate index in connn->tempaddr[] is used for a fixed
family (and only that family) during the connection process.

If family one takes a long time and family two fails immediately, the
previous logic could misbehave and retry the same family two address
repeatedly.

Reported-by: Paul Vixie
Reported-by: Jay Satiro
Fixes #5083
Fixes #4954
Closes #5089
2020-03-15 11:03:11 +01:00
Jay Satiro
67f3f6cff1 Makefile.m32: Improve windres parameter compatibility
- s/COFF/coff/

Some versions of windres do not recognize uppercase COFF as a valid
way to specify the COFF output format.

Reported-by: Steven Penny

Fixes https://github.com/curl/curl/issues/5099
Closes https://github.com/curl/curl/pull/5101
2020-03-14 19:08:17 -04:00
Jay Satiro
3bfda07004 easy: Fix curl_easy_duphandle for builds missing IPv6 that use c-ares
- Ignore CURLE_NOT_BUILT_IN errors returned by c-ares functions in
  curl_easy_duphandle.

Prior to this change if c-ares was used as the resolver backend and
either it was too old or libcurl was built without IPv6 support then
some of our resolver functions could return CURLE_NOT_BUILT_IN to
curl_easy_duphandle causing it to fail.

Caused by c8f086b which shipped in 7.69.1.

Reported-by: Karl Chen

Fixes https://github.com/curl/curl/issues/5097
Closes https://github.com/curl/curl/pull/5100
2020-03-14 19:07:05 -04:00
Jim Fuller
e96fe70cab
sftp: fix segfault regression introduced by #4747
This fix adds a defensive check for the case where the char *name in
struct libssh2_knownhost is NULL

Fixes #5041
Closes #5062
2020-03-09 15:01:40 +01:00
Daniel Stenberg
f0e8160545
socks4: fix host resolve regression
1. The socks4 state machine was broken in the host resolving phase

2. The code now insists on IPv4-only when using SOCKS4 as the protocol
only supports that.

Regression from #4907 and 4a4b63d, shipped in 7.69.0

Reported-by: amishmm on github
Bug: https://github.com/curl/curl/issues/5053#issuecomment-596191594
Closes #5061
2020-03-08 22:51:47 +01:00
Patrick Monnerat
06a1b82140
cookie: get_top_domain() sets zero length for null domains
This silents a compilation warning with gcc -O3.
2020-03-08 17:30:55 +01:00
Steve Holme
1369b8ad31
sha256: Added WinCrypt implementation
Closed #5030
2020-03-08 11:45:28 +00:00
Steve Holme
92d63a10aa
sha256: Added SecureTransport implementation 2020-03-08 11:45:24 +00:00
Patrick Monnerat
e5b366c0b5
mime: fix the binary encoder to handle large data properly
New test 666 checks this is effective.
As upload buffer size is significant in this kind of tests, shorten it
in similar test 652.

Fixes #4860
Closes #4833
Reported-by: RuurdBeerstra on github
2020-03-07 23:26:15 +01:00
Patrick Monnerat
1e4cb333ef
mime: do not perform more than one read in a row
Input buffer filling may delay the data sending if data reads are slow.
To overcome this problem, file and callback data reads do not accumulate
in buffer anymore. All other data (memory data and mime framing) are
considered as fast and still concatenated in buffer.
As this may highly impact performance in terms of data overhead, an early
end of part data check is added to spare a read call.
When encoding a part's data, an encoder may require more bytes than made
available by a single read. In this case, the above rule does not apply
and reads are performed until the encoder is able to deliver some data.

Tests 643, 644, 645, 650 and 654 have been adapted to the output data
changes, with test data size reduced to avoid the boredom of long lists of
1-byte chunks in verification data.
New test 667 checks mimepost using single-byte read callback with encoder.
New test 668 checks the end of part data early detection.

Fixes #4826
Reported-by: MrdUkk on github
2020-03-07 23:26:00 +01:00
Patrick Monnerat
96972ec1c0
mime: latch last read callback status.
In case a read callback returns a status (pause, abort, eof,
error) instead of a byte count, drain the bytes read so far but
remember this status for further processing.
Takes care of not losing data when pausing, and properly resume a
paused mime structure when requested.
New tests 670-673 check unpausing cases, with easy or multi
interface and mime or form api.

Fixes #4813
Reported-by: MrdUkk on github
2020-03-07 23:26:00 +01:00
Ernst Sjöstrand
c8f086bcc3
ares: store dns parameters for duphandle
With c-ares the dns parameters lives in ares_channel. Store them in the
curl handle and set them again in easy_duphandle.

Regression introduced in #3228 (6765e6d), shipped in curl 7.63.0.

Fixes #4893
Closes #5020
Signed-off-by: Ernst Sjöstrand <ernst.sjostrand@verisure.com>
2020-03-07 13:50:23 +01:00
Daniel Stenberg
e364546fb3
version: make curl_version* thread-safe without using global context
Closes #5010
2020-03-07 12:10:11 +01:00
Marc Hoersken
99c688ba21
perl: align order and completeness of Windows OS checks 2020-03-07 11:02:43 +01:00
Marc Hoersken
2f4c36357b
config-win32: Windows does not have ftruncate 2020-03-07 10:58:42 +01:00
Daniel Stenberg
e040146f22
pause: force a connection (re-)check after unpausing
There might be data available that was already read off the socket, for
example in the TLS layer.

Reported-by: Anders Berg
Fixes #4966
Closes #5049
2020-03-07 10:49:51 +01:00
Daniel Stenberg
4b786abc43
socks5: switch state properly when the resolve is done
Regression from 4a4b63d (and #4907)
Reported-by: vitaha85 on github
Fixes #5053
Closes #5056
2020-03-07 10:47:44 +01:00
Jay Satiro
09aa807240 libssh: Fix matching user-specified MD5 hex key
Prior to this change a match would never be successful because it
was mistakenly coded to compare binary data from libssh to a
user-specified hex string (ie CURLOPT_SSH_HOST_PUBLIC_KEY_MD5).

Reported-by: fds242@users.noreply.github.com

Fixes https://github.com/curl/curl/issues/4971
Closes https://github.com/curl/curl/pull/4974
2020-03-07 03:06:11 -05:00
Daniel Stenberg
e54b1885d1
pause: bail out on bad input
A NULL easy handle or an easy handle without an associated connection
cannot be paused or unpaused.

Closes #5050
2020-03-06 17:31:01 +01:00
Daniel Stenberg
64258bd0aa
pause: return early for calls that don't change pause state
Reviewed-by: Patrick Monnerat
Ref: #4833
Closes #5026
2020-03-06 10:25:40 +01:00
Jay Satiro
2258b7bcc2 multi: skip EINTR check on wakeup socket if it was closed
- Don't check errno on wakeup socket if sread returned 0 since sread
  doesn't set errno in that case.

This is a follow-up to cf7760a from several days ago which fixed
Curl_multi_wait to stop busy looping sread on the non-blocking wakeup
socket if it was closed (ie sread returns 0). Due to a logic error it
was still possible to busy loop in that case if errno == EINTR.

Closes https://github.com/curl/curl/pull/5047
2020-03-06 02:56:21 -05:00
Daniel Stenberg
0b7735c45b
transfer: set correct copyright year range 2020-03-06 08:16:38 +01:00
Daniel Stenberg
6f17df7a6a
urldata: remove the 'stream_was_rewound' connectdata struct member
... as it is never set anywhere.

Follow-up to 2f44e94ef
Closes #5046
2020-03-06 08:15:35 +01:00
Daniel Stenberg
8aa04e9a24
Revert "pause: force-drain the transfer on unpause"
This reverts commit fa0216b294 (from #5000)

Clearly that didn't solve the problem correctly.

Reported-by: Christopher Reid
Reopens #4966
Fixes #5044
2020-03-05 23:45:41 +01:00
Daniel Stenberg
52d302ed64
polarssl: remove more references and mentions
Assisted-by: Jay Satiro
Follow-up to 6357a19ff2
Closes #5036
2020-03-05 07:57:45 +01:00
Daniel Stenberg
b572e0be59
Revert "sha256: Added SecureTransport implementation"
This reverts commit 4feb38deed (from #4956)

That commit broke test 1610 on macos builds without TLS.

Closes #5027
2020-03-03 09:36:40 +01:00
Steve Holme
e6322feb3a
sha256: Tidy up following recent changes
Reviewed-by: Daniel Stenberg
Closes #4956
2020-03-03 00:37:23 +00:00
Steve Holme
f22a5c35e0
sha256: Added WinCrypt implementation 2020-03-03 00:37:23 +00:00
Steve Holme
4feb38deed
sha256: Added SecureTransport implementation 2020-03-03 00:37:22 +00:00
Steve Holme
425ceb0150
sha256: Added mbedtls implementation 2020-03-03 00:37:22 +00:00
Steve Holme
8fbd937248
sha256: Added GNU TLS gcrypt implementation 2020-03-03 00:37:21 +00:00
Steve Holme
365f4ea53d
sha256: Added GNU TLS Nettle implementation 2020-03-03 00:37:17 +00:00