1
0
mirror of https://github.com/moparisthebest/curl synced 2024-12-22 16:18:48 -05:00
Commit Graph

1756 Commits

Author SHA1 Message Date
Guenter Knauf
cf510ad781 build: in Makefile.m32 moved target autodetection.
Moved target autodetection block after defining CC macro.
2014-11-19 12:39:20 +01:00
Guenter Knauf
140ca2dcc2 build: in Makefile.m32 simplify platform flags. 2014-11-19 11:46:02 +01:00
Guenter Knauf
a08decdfed build: in Makefile.m32 try to detect 64bit target. 2014-11-19 11:40:04 +01:00
Guenter Knauf
4bc47bec57 build: in Makefile.m32 add -m32 flag for 32bit. 2014-11-18 14:25:41 +01:00
Guenter Knauf
46ae340f24 build: in Makefile.m32 pass -F flag to windres. 2014-11-18 13:44:03 +01:00
Steve Holme
532efa9ce9 tool: Removed krb4 from the supported features
Although libcurl would never return CURL_VERSION_KERBEROS4 after 7.33,
so would not be output with --version, removed krb4 from the supported
features output.
2014-11-15 15:27:53 +00:00
Michael Osipov
a4b7f716d3 tool: Use Kerberos for supported features 2014-11-15 14:43:35 +00:00
Steve Holme
dc867bbf3a Makefile.vc6: Added support for WinIDN 2014-11-08 18:31:29 +00:00
Steve Holme
e7bcfb368c curl_tool: Added krb5 to the supported features 2014-11-07 10:57:23 +00:00
Daniel Stenberg
8a2dda312c tool_strdup.c: include the tool strdup.h
... not the lib/ one that the tool no longer uses!
2014-11-05 23:33:22 +01:00
Daniel Stenberg
b387560692 curl_easy_duphandle: CURLOPT_COPYPOSTFIELDS read out of bounds
When duplicating a handle, the data to post was duplicated using
strdup() when it could be binary and contain zeroes and it was not even
zero terminated! This caused read out of bounds crashes/segfaults.

Since the lib/strdup.c file no longer is easily shared with the curl
tool with this change, it now uses its own version instead.

Bug: http://curl.haxx.se/docs/adv_20141105.html
CVE: CVE-2014-3707
Reported-By: Symeon Paraschoudis
2014-11-05 08:05:14 +01:00
Guenter Knauf
b5ed5843a4 Added NetWare support to build with nghttp2. 2014-10-29 03:31:34 +01:00
Daniel Stenberg
ad88a4bbba src/: remove version.h.dist from gitignore
It has not been used since commit f7bfdbab in 2011
2014-10-26 23:17:47 +01:00
Guenter Knauf
ede9884c59 Added MinGW support to build with nghttp2. 2014-10-24 04:22:04 +02:00
Peter Wu
b55502cdae cmake: build tool_hugehelp (ENABLE_MANUAL)
Rather than always outputting an empty manual page for the '-M' option,
generate a full manual page as done by autotools. For simplicity in
CMake, always generate the gzipped page as it will not be used anyway
when zlib is not available.

Signed-off-by: Peter Wu <peter@lekensteyn.nl>
2014-10-12 14:11:42 +02:00
Daniel Stenberg
b546c7c926 get_url_file_name: make no slash equal empty string 2014-10-09 16:42:17 +02:00
Daniel Stenberg
199b3e46f9 get_url_file_name: never return a NULL string *and* OK
Change 987a4a73 assumes that as it simplifies life in the calling
function.

Reported-by: Fabian Keil
2014-10-09 16:37:11 +02:00
Jakub Zakrzewski
a3154295c5 Cmake: Got rid of setup_curl_dependencies
There is no need for such function. Include_directories propagate by
themselves and having a function with one simple link statement makes
little sense.
2014-10-09 13:48:30 +02:00
Daniel Stenberg
eb1e3a3985 operate: avoid NULL dereference
Coverity CID 1241948. dumpeasysrc() would get called with
config->current set to NULL which could be dereferenced by a warnf()
call.
2014-10-08 13:18:55 +02:00
Daniel Stenberg
987a4a7367 operate_do: skip superfluous check for NULL pointer
Coverity CID 1243583. get_url_file_name() cannot fail and return a NULL
file name pointer so skip the check for that - it tricks coverity into
believing it can happen and it then warns later on when we use 'outfile'
without checking for NULL.
2014-10-08 12:21:39 +02:00
93e450793c SSL: implement public key pinning
Option --pinnedpubkey takes a path to a public key in DER format and
only connect if it matches (currently only implemented with OpenSSL).

Provides CURLOPT_PINNEDPUBLICKEY for curl_easy_setopt().

Extract a public RSA key from a website like so:
openssl s_client -connect google.com:443 2>&1 < /dev/null | \
sed -n '/-----BEGIN/,/-----END/p' | openssl x509 -noout -pubkey \
| openssl rsa -pubin -outform DER > google.com.der
2014-10-07 14:44:19 +02:00
Daniel Stenberg
dddb2aab8d parseconfig: skip a NULL check
Coverity CID 1154198. This NULL check implies that the pointer _can_ be
NULL at this point, which it can't. Thus it is dead code. It tricks
static analyzers to warn about dereferencing the pointer since the code
seems to imply it can be NULL.
2014-10-07 10:29:06 +02:00
Daniel Stenberg
061cea1cf3 tool_go_sleep: use (void) to spell out we ignore the return value
Coverity CID 1222080.
2014-10-06 08:53:35 +02:00
Daniel Stenberg
8128db9ec1 getparameter: remove dead code
Coverity CID 1061126. 'parse' will always be non-NULL here.
2014-10-04 16:16:12 +02:00
Daniel Stenberg
55678c6951 getparameter: comment a switch FALLTHROUGH
Coverity CID 1061118. Point out that it is on purpose.
2014-10-04 16:15:47 +02:00
Daniel Stenberg
f854130b7b help output: minor whitespace edits
Should've been amended in the previous commit but wasn't due to a
mistake.
2014-08-19 23:45:34 +02:00
Zearin
2f2d84033b help output: use ≥2 spaces between option and description
... and some other cleanups
2014-08-19 23:38:02 +02:00
Steve Holme
2384c11ff1 tool_hugehelp.c.cvs: Added copyright
Added copyright due to warning from checksrc.pl.
2014-08-10 20:38:06 +01:00
Steve Holme
ea864fb24d tool_getparam.c: Fixed compilation warning
warning: `orig_opt' might be used uninitialized in this function
2014-08-08 11:24:43 +01:00
Michael Osipov
eed1c63c70 docs: Improve inline GSS-API naming in code documentation 2014-07-23 00:01:39 +02:00
Michael Osipov
e38ba43014 curl.h/features: Deprecate GSS-Negotiate macros due to bad naming
- Replace CURLAUTH_GSSNEGOTIATE with CURLAUTH_NEGOTIATE
- CURL_VERSION_GSSNEGOTIATE is deprecated which
  is served by CURL_VERSION_SSPI, CURL_VERSION_GSSAPI and
  CURUL_VERSION_SPNEGO now.
- Remove display of feature 'GSS-Negotiate'
2014-07-23 00:01:39 +02:00
Michael Osipov
46750c39bd configure/features: Add feature and version info for GSS-API and SPNEGO 2014-07-23 00:01:39 +02:00
Alessandro Ghedini
c6e7cbb94e build: link curl to NSS libraries when NSS support is enabled
This fixes a build failure on Debian caused by commit
24c3cdce88.

Bug: http://curl.haxx.se/mail/lib-2014-07/0209.html
2014-07-18 14:20:42 +02:00
Dave Reisner
fb93fa9216 src/Makefile.am: add .DELETE_ON_ERROR
This prevents targets like tool_hugehelp.c from leaving around
half-constructed files if the rule fails with GNU make.

Reported-by: Rafaël Carré <funman@videolan.org>
2014-07-17 15:11:47 +02:00
David Woodhouse
9ad282b1ae Remove all traces of FBOpenSSL SPNEGO support
This is just fundamentally broken. SPNEGO (RFC4178) is a protocol which
allows client and server to negotiate the underlying mechanism which will
actually be used to authenticate. This is *often* Kerberos, and can also
be NTLM and other things. And to complicate matters, there are various
different OIDs which can be used to specify the Kerberos mechanism too.

A SPNEGO exchange will identify *which* GSSAPI mechanism is being used,
and will exchange GSSAPI tokens which are appropriate for that mechanism.

But this SPNEGO implementation just strips the incoming SPNEGO packet
and extracts the token, if any. And completely discards the information
about *which* mechanism is being used. Then we *assume* it was Kerberos,
and feed the token into gss_init_sec_context() with the default
mechanism (GSS_S_NO_OID for the mech_type argument).

Furthermore... broken as this code is, it was never even *used* for input
tokens anyway, because higher layers of curl would just bail out if the
server actually said anything *back* to us in the negotiation. We assume
that we send a single token to the server, and it accepts it. If the server
wants to continue the exchange (as is required for NTLM and for SPNEGO
to do anything useful), then curl was broken anyway.

So the only bit which actually did anything was the bit in
Curl_output_negotiate(), which always generates an *initial* SPNEGO
token saying "Hey, I support only the Kerberos mechanism and this is its
token".

You could have done that by manually just prefixing the Kerberos token
with the appropriate bytes, if you weren't going to do any proper SPNEGO
handling. There's no need for the FBOpenSSL library at all.

The sane way to do SPNEGO is just to *ask* the GSSAPI library to do
SPNEGO. That's what the 'mech_type' argument to gss_init_sec_context()
is for. And then it should all Just Work™.

That 'sane way' will be added in a subsequent patch, as will bug fixes
for our failure to handle any exchange other than a single outbound
token to the server which results in immediate success.
2014-07-16 17:26:08 +02:00
Dan Fandrich
45c93dad1d Fixed some "statement not reached" warnings 2014-07-12 01:45:26 +02:00
Kamil Dudka
0cd368c2ef tool: oops, forgot to include <plarenas.h>
... that contains the declaration of PL_ArenaFinish()
2014-07-03 20:36:49 +02:00
Kamil Dudka
d343033f3d tool: call PL_ArenaFinish() on exit if NSPR is used
This prevents valgrind from reporting still reachable memory allocated
by NSPR arenas (mainly the freelist).

Reported-by: Hubert Kario
2014-07-03 20:27:20 +02:00
Kamil Dudka
24c3cdce88 tool: call PR_Cleanup() on exit if NSPR is used
This prevents valgrind from reporting possibly lost memory that NSPR
uses for file descriptor cache and other globally allocated internal
data structures.
2014-07-02 18:11:05 +02:00
Michał Górny
c3c4fd2671 tool_metalink: Support polarssl as digest provider 2014-06-17 00:42:53 +02:00
Steve Holme
a7999da39e tool_getparam.c: Fixed compilation warnings
There is an implicit conversion from "unsigned long" to "long"
2014-05-22 21:01:51 +01:00
Steve Holme
461d45ea7a build: Fixed incorrect reference to curl_setup.h in Visual Studio files
Fixed a copy / paste error from my 2011 project files.
2014-05-22 01:53:50 +01:00
Steve Holme
491767418b Makefile.inc: Added curlx headers to assist Visual Studio project generation 2014-05-21 23:12:22 +01:00
Steve Holme
e8b7431305 build: Renamed CURLX_ONES file list definition to CURLX_CFILES
Renamed the CURLX_ONES file list definition in order to a) try and be
consistent with other file lists and b) to allow for the addition of
the curlx header files, which will assist with Visual Studio project
files generation rather than hard coding those files.
2014-05-21 23:11:51 +01:00
Steve Holme
b93759291d Makefile.inc: Added resource file to assist Visual Studio project generation 2014-05-17 23:34:02 +01:00
Steve Holme
ba704878bd tool_operate.c: Fixed compilation warning
An enumerated type is mixed with another type.
2014-05-10 09:20:49 +01:00
Steve Holme
5376ed2474 tool_operate.c: Fixed TAB is white space from commit 5b8ae0a985 2014-05-09 15:14:51 +01:00
Steve Holme
952b54095a tool_urlglob.c: Fixed compilation warning
An enumerated type is mixed with another type.
2014-05-09 13:18:57 +01:00
Steve Holme
5b8ae0a985 tool_operate.c: Fixed compilation warnings
An enumerated type is mixed with another type.
2014-05-09 13:18:56 +01:00
Steve Holme
5f68fa4897 tool_help: Fixed missing --login-options option
...and removed ;OPTIONS from --user as that functionality was removed
in 7.34.0.
2014-05-07 17:27:47 +01:00