24510 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Daniel Stenberg	2576003415	tftp: use the current blksize for recvfrom() ... bug: https://curl.haxx.se/docs/CVE-2019-5436.html Reported-by: l00p3r on hackerone CVE-2019-5436	2019-05-20 07:57:49 +02:00
Daniel Gustafsson	9a87fe704e	version: make ssl_version buffer match for multi_ssl ... When running a multi TLS backend build the version string needs more buffer space. Make the internal ssl_buffer stack buffer match the one in Curl_multissl_version() to allow for the longer string. For single TLS backend builds there is no use in extended to buffer. This is a fallout from #3863 which fixes up the multi_ssl string generation to avoid a buffer overflow when the buffer is too small. Closes #3875 Reviewed-by: Daniel Stenberg <daniel@haxx.se>	2019-05-19 22:06:26 +02:00
Steve Holme	7ca7f82ba7	http_ntlm_wb: Handle auth for only a single request ... Currently when the server responds with 401 on NTLM authenticated connection (re-used) we consider it to have failed. However this is legitimate and may happen when for example IIS is set configured to 'authPersistSingleRequest' or when the request goes thru a proxy (with 'via' header). Implemented by imploying an additional state once a connection is re-used to indicate that if we receive 401 we need to restart authentication. Missed in fe6049f0.	2019-05-18 19:01:11 +01:00
Steve Holme	2697d63363	http_ntlm_wb: Cleanup handshake after clean NTLM failure ... Missed in 50b87c4e.	2019-05-18 19:01:10 +01:00
Steve Holme	bd21fc9d2f	http_ntlm_wb: Return the correct error on receiving an empty auth message ... Missed in fe20826b as it wasn't implemented in http.c in b4d6db83. Closes #3894	2019-05-18 19:00:51 +01:00
Daniel Stenberg	697b1f911b	curl: make code work with protocol-disabled libcurl ... Closes #3844	2019-05-18 16:14:10 +02:00
Daniel Stenberg	e91e481612	libcurl: #ifdef away more code for disabled features/protocols	2019-05-17 23:24:34 +02:00
Daniel Stenberg	3b06e68b77	progress: CURL_DISABLE_PROGRESS_METER	2019-05-17 23:24:34 +02:00
Daniel Stenberg	3cfcdf08d8	hostip: CURL_DISABLE_SHUFFLE_DNS	2019-05-17 23:24:34 +02:00
Daniel Stenberg	1f8a584f6a	netrc: CURL_DISABLE_NETRC	2019-05-17 23:24:34 +02:00
Viktor Szakats	f3e0f071b1	docs: Markdown and misc improvements [ci skip] ... Approved-by: Daniel Stenberg Closes #3896	2019-05-16 22:11:27 +00:00
Viktor Szakats	196ae60402	docs/RELEASE-PROCEDURE: link to live iCalendar [ci skip] ... Ref: 0af41b40b2 (commitcomment-33563135) Approved-by: Daniel Stenberg Closes #3895	2019-05-16 18:56:42 +00:00
Daniel Stenberg	eeb37d7191	travis: add an osx http-only build ... Closes #3887	2019-05-16 15:32:42 +02:00
Daniel Stenberg	8ece8177f1	cleanup: remove FIXME and TODO comments ... They serve very little purpose and mostly just add noise. Most of them have been around for a very long time. I read them all before removing or rephrasing them. Ref: #3876 Closes #3883	2019-05-16 09:16:56 +02:00
Daniel Stenberg	f506ce099f	curl: don't set FTP options for FTP-disabled builds ... ... since libcurl has started to be totally unaware of options for disabled protocols they now return error. Bug: c9c5304dd4 (commitcomment-33533937) Reported-by: Marcel Raad Closes #3886	2019-05-16 08:11:37 +02:00
Steve Holme	fe20826b58	http_ntlm_wb: Move the type-2 message processing into a dedicated function ... This brings the code inline with the other HTTP authentication mechanisms. Closes #3890	2019-05-16 00:03:30 +01:00
Daniel Stenberg	ab4616f8cb	RELEASE-NOTES: synced	2019-05-15 14:35:00 +02:00
Daniel Stenberg	0af41b40b2	docs/RELEASE-PROCEDURE: updated coming releases dates [ci skip]	2019-05-15 13:56:19 +02:00
Daniel Stenberg	f778c356a8	CURLOPT_READFUNCTION.3: see also CURLOPT_UPLOAD_BUFFERSIZE [ci skip] ... Reported-by: Roy Bellingan Bug: #3885	2019-05-15 12:05:49 +02:00
Daniel Stenberg	ee68bbe29c	parse_proxy: use the URL parser API ... As we treat a given proxy as a URL we should use the unified URL parser to extract the parts out of it. Closes #3878	2019-05-15 12:02:05 +02:00
Steve Holme	e832d1ef74	http_negotiate: Move the Negotiate state out of the negotiatedata structure ... Given that this member variable is not used by the SASL based protocols there is no need to have it here. Closes #3882	2019-05-15 00:32:42 +01:00
Steve Holme	85bef18ca1	http_ntlm: Move the NTLM state out of the ntlmdata structure ... Given that this member variable is not used by the SASL based protocols there is no need to have it here.	2019-05-15 00:31:45 +01:00
Steve Holme	0c73adfad3	url: Move the negotiate state type into a dedicated enum	2019-05-15 00:31:35 +01:00
Steve Holme	be9fd703e0	url: Remove duplicate clean up of the winbind variables in conn_shutdown() ... Given that Curl_disconnect() calls Curl_http_auth_cleanup_ntlm() prior to calling conn_shutdown() and it in turn performs this, there is no need to perform the same action in conn_shutdown(). Closes #3881	2019-05-14 14:35:11 +01:00
Daniel Stenberg	9f9ec7da57	urlapi: require a non-zero host name length when parsing URL ... Updated test 1560 to verify. Closes #3880	2019-05-14 13:39:10 +02:00
Daniel Stenberg	c60042fe09	configure: error out if OpenSSL wasn't detected when asked for ... If --with-ssl is used and configure still couldn't enable SSL this creates an error instead of just silently ignoring the fact. Suggested-by: Isaiah Norton Fixes #3824 Closes #3830	2019-05-14 13:19:47 +02:00
Daniel Gustafsson	bd91e7f340	imap: Fix typo in comment	2019-05-14 12:38:23 +02:00
Steve Holme	b5d1de8e21	url: Remove unnecessary initialisation from allocate_conn() ... No need to set variables to zero as calloc() does this for us. Closes #3879	2019-05-14 09:48:16 +01:00
Daniel Stenberg	6123d718aa	CURLOPT_CAINFO.3: with Schannel, you want Windows 8 or later [ci skip] ... Clues-provided-by: Jay Satiro Clues-provided-by: Jeroen Ooms Fixes #3711 Closes #3874	2019-05-14 08:19:58 +02:00
Daniel Gustafsson	b4bb920405	vtls: fix potential ssl_buffer stack overflow ... In Curl_multissl_version() it was possible to overflow the passed in buffer if the generated version string exceeded the size of the buffer. Fix by inverting the logic, and also make sure to not exceed the local buffer during the string generation. Closes #3863 Reported-by: nevv on HackerOne/curl Reviewed-by: Jay Satiro Reviewed-by: Daniel Stenberg	2019-05-13 20:27:50 +02:00
Daniel Stenberg	ae3f838b9a	RELEASE-NOTES: synced	2019-05-13 19:23:36 +02:00
Daniel Stenberg	c9c5304dd4	appveyor: also build "/ci" branches like travis	2019-05-13 08:17:10 +02:00
Daniel Stenberg	93c4de6974	pingpong: disable more when no pingpong enabled	2019-05-13 08:17:10 +02:00
Daniel Stenberg	6d32b72822	proxy: acknowledge DISABLE_PROXY more	2019-05-13 08:17:10 +02:00
Daniel Stenberg	b084616210	parsedate: CURL_DISABLE_PARSEDATE	2019-05-13 08:17:10 +02:00
Daniel Stenberg	e5b546b339	sasl: only enable if there's a protocol enabled using it	2019-05-13 08:17:10 +02:00
Daniel Stenberg	b95456f4e2	mime: acknowledge CURL_DISABLE_MIME	2019-05-13 08:17:09 +02:00
Daniel Stenberg	0e2208ada6	wildcard: disable from build when FTP isn't present	2019-05-13 08:17:09 +02:00
Daniel Stenberg	7c70a3b1ad	http: CURL_DISABLE_HTTP_AUTH	2019-05-13 08:17:09 +02:00
Daniel Stenberg	bf7303966e	base64: build conditionally if there are users	2019-05-13 08:17:09 +02:00
Daniel Stenberg	ae4adae954	doh: CURL_DISABLE_DOH	2019-05-13 08:17:09 +02:00
Steve Holme	52dfab65d6	auth: Rename the various authentication clean up functions ... For consistency and to a avoid confusion. Closes #3869	2019-05-12 18:37:00 +01:00
Jay Satiro	4d8461ae8a	docs/INSTALL: fix broken link [ci skip] ... Reported-by: Joombalaya on github Fixes #3818	2019-05-12 16:15:14 +02:00
Marcel Raad	15fd9abfea	easy: fix another "clarify calculation precedence" warning ... I missed this one in commit 6b3dde7fe6.	2019-05-12 13:36:45 +02:00
Marcel Raad	6b3dde7fe6	build: fix "clarify calculation precedence" warnings ... Codacy/CppCheck warns about this. Consistently use parentheses as we already do in some places to silence the warning. Closes https://github.com/curl/curl/pull/3866	2019-05-12 09:31:09 +02:00
Marcel Raad	5f8b9fe81d	cmake: restore C89 compatibility of CurlTests.c ... I broke it in d1b5cf830b and 97de97daef. Reported-by: Viktor Szakats Ref: 97de97daef (commitcomment-33499044) Closes https://github.com/curl/curl/pull/3868	2019-05-12 09:23:34 +02:00
Steve Holme	407408f376	http_ntlm: Corrected the name of the include guard ... Missed in f0bdd72c. Closes #3867	2019-05-11 22:25:55 +01:00
Steve Holme	5c2aebe308	http_digest: Don't expose functions when HTTP and Crypto Auth are disabled ... Closes #3861	2019-05-11 17:23:32 +01:00
Steve Holme	fb243b0475	http_negotiate: Don't expose functions when HTTP is disabled	2019-05-11 17:23:27 +01:00
Daniel Stenberg	b4988286a9	SECURITY-PROCESS: fix links [ci skip]	2019-05-11 17:50:37 +02:00