1
0
mirror of https://github.com/moparisthebest/curl synced 2024-12-22 16:18:48 -05:00
Commit Graph

9308 Commits

Author SHA1 Message Date
Daniel Stenberg
5f1163517e multi: make curl_multi_wait avoid malloc in the typical case
When only a few additional file descriptors are used, avoid the malloc.

Closes #1377
2017-04-03 23:20:02 +02:00
Daniel Stenberg
76c21ed3fd telnet: (win32) fix read callback return variable
telnet.c(1427,21): warning: comparison of constant 268435456 with
expression of type 'CURLcode' is always false

telnet.c(1433,21): warning: comparison of constant 268435457 with
expression of type 'CURLcode' is always false

Reviewed-by: Jay Satiro
Reported-by: Gisle Vanem
Bug: https://github.com/curl/curl/issues/1225#issuecomment-290340890

Closes #1374
2017-04-01 00:14:05 +02:00
Daniel Stenberg
9bd7f004d0 libcurl.def: removed, unused 2017-03-31 00:09:11 +02:00
Marcel Raad
e358a626f8
ssh: fix narrowing conversion warning
'left' is used as time_t but declared as long.
MinGW complains:
error: conversion to 'long int' from 'time_t {aka long long int}' may alter
its value [-Werror=conversion]
Changed the declaration to time_t.
2017-03-30 18:45:28 +02:00
Marcel Raad
4a5b900cb1
http2: silence unused parameter warnings
In release mode, MinGW complains:
error: unused parameter 'lib_error_code' [-Werror=unused-parameter]
2017-03-30 18:13:20 +02:00
Marcel Raad
f104f7d914
schannel: fix unused variable warning
If CURL_DISABLE_VERBOSE_STRINGS is defined, hostname is not used in
schannel_connect_step3.
2017-03-30 10:35:46 +02:00
Marcel Raad
a8e523f086
connect: fix unreferenced parameter warning
When CURL_DISABLE_VERBOSE_STRINGS is defined, the reason parameter in
Curl_conncontrol is not used as the infof macro expands to nothing.
2017-03-30 10:14:34 +02:00
Marcel Raad
1b4b2c1a59
select: use correct SIZEOF_ constant
At least under Windows, there is no SIZEOF_LONG, so it evaluates to 0 even
though sizeof(int) == sizeof(long). This should probably have been
CURL_SIZEOF_LONG, but the type of timeout_ms changed from long to time_t
anyway.
This triggered MSVC warning C4668 about implicitly replacing undefined
macros with '0'.

Closes https://github.com/curl/curl/pull/1362
2017-03-30 08:49:30 +02:00
Marcel Raad
9bc92eeb0e
NTLM: check for features with #ifdef instead of #if
Feature defines are normally checked with #ifdef instead of #if in the rest of
the codebase. Additionally, some compilers warn when a macro is implicitly
evaluated to 0 because it is not defined, which was the case here.

Ref: https://github.com/curl/curl/pull/1362#discussion_r108605101
Closes https://github.com/curl/curl/pull/1367
2017-03-29 20:16:09 +02:00
Daniel Stenberg
2066072ff2 conncache: make hashkey avoid malloc
... to make it much faster. Idea developed with primepie on IRC.

Closes #1365
2017-03-29 00:15:46 +02:00
Kamil Dudka
2549831daa http: do not treat FTPS over CONNECT as HTTPS
If we use FTPS over CONNECT, the TLS handshake for the FTPS control
connection needs to be initiated in the SENDPROTOCONNECT state, not
the WAITPROXYCONNECT state.  Otherwise, if the TLS handshake completed
without blocking, the information about the completed TLS handshake
would be saved to a wrong flag.  Consequently, the TLS handshake would
be initiated in the SENDPROTOCONNECT state once again on the same
connection, resulting in a failure of the TLS handshake.  I was able to
observe the failure with the NSS backend if curl ran through valgrind.

Note that this commit partially reverts curl-7_21_6-52-ge34131d.
2017-03-28 17:04:16 +02:00
Daniel Stenberg
452203341d pause: handle mixed types of data when paused
When receiving chunked encoded data with trailers, and the write
callback returns PAUSE, there might be both body and header to store to
resend on unpause. Previously libcurl returned error for that case.

Added test case 1540 to verify.

Reported-by: Stephen Toub
Fixes #1354
Closes #1357
2017-03-28 13:27:49 +02:00
Isaac Boukris
7975d10cf8 http: Fix proxy connection reuse with basic-auth
When using basic-auth, connections and proxy connections
can be re-used with different Authorization headers since
it does not authenticate the connection (like NTLM does).

For instance, the below command should re-use the proxy
connection, but it currently doesn't:
curl -v -U alice:a -x http://localhost:8181 http://localhost/
  --next -U bob:b -x http://localhost:8181 http://localhost/

This is a regression since refactoring of ConnectionExists()
as part of: cb4e2be7c6

Fix the above by removing the username and password compare
when re-using proxy connection at proxy_info_matches().

However, this fix brings back another bug would make curl
to re-print the old proxy-authorization header of previous
proxy basic-auth connection because it wasn't cleared.

For instance, in the below command the second request should
fail if the proxy requires authentication, but would succeed
after the above fix (and before aforementioned commit):
curl -v -U alice:a -x http://localhost:8181 http://localhost/
  --next -x http://localhost:8181 http://localhost/

Fix this by clearing conn->allocptr.proxyuserpwd after use
unconditionally, same as we do for conn->allocptr.userpwd.

Also fix test 540 to not expect digest auth header to be
resent when connection is reused.

Signed-off-by: Isaac Boukris <iboukris@gmail.com>

Closes https://github.com/curl/curl/pull/1350
2017-03-28 03:54:43 -04:00
Jay Satiro
b04e4ebdd8 openssl: exclude DSA code when OPENSSL_NO_DSA is defined
- Fix compile errors that occur in openssl.c when OpenSSL lib was
  built without DSA support.

Bug: https://github.com/curl/curl/issues/1361
Reported-by: neheb@users.noreply.github.com
2017-03-28 03:54:31 -04:00
Marcel Raad
23d48c35cb
schannel: fix variable shadowing warning
No need to redeclare the variable.
2017-03-28 01:16:12 +02:00
Marcel Raad
068cd1ad4c
multi: fix MinGW-w64 compiler warnings
error: conversion to 'long int' from 'time_t {aka long long int}' may alter
its value [-Werror=conversion]
2017-03-27 22:50:59 +02:00
klemens
f7df67cff0 spelling fixes
Closes #1356
2017-03-26 23:56:23 +02:00
Daniel Stenberg
68aac9a831 openssl: fix comparison between signed and unsigned integer expressions 2017-03-23 23:04:38 +01:00
Dan Fandrich
f99fcb0fee openssl: made the error table static const 2017-03-23 22:50:58 +01:00
Jay Satiro
b999d35c71 openssl: fall back on SSL_ERROR_* string when no error detail
- If SSL_get_error is called but no extended error detail is available
  then show that SSL_ERROR_* as a string.

Prior to this change there was some inconsistency in that case: the
SSL_ERROR_* code may or may not have been shown, or may have been shown
as unknown even if it was known.

Ref: https://github.com/curl/curl/issues/1300

Closes https://github.com/curl/curl/pull/1348
2017-03-23 16:48:29 -04:00
Ales Mlakar
a360906de6 mbedtls: add support for CURLOPT_SSL_CTX_FUNCTION
Ref: https://curl.haxx.se/mail/lib-2017-02/0097.html

Closes https://github.com/curl/curl/pull/1272
2017-03-21 23:51:44 -04:00
Daniel Stenberg
6e0f26c8a8 multi: fix streamclose() crash in debug mode
The code would refer to the wrong data pointer. Only debug builds do
this - for verbosity.

Reported-by: zelinchen@users.noreply.github.com
Fixes #1329
2017-03-21 10:09:11 +01:00
Palo Markovic
9873431c6f darwinssl: fix typo in variable name
Broken a week ago in 6448f98.

Closes https://github.com/curl/curl/pull/1337
2017-03-18 12:52:37 -04:00
Sylvestre Ledru
66de563482 Improve code readbility
... by removing the else branch after a return, break or continue.

Closes #1310
2017-03-13 23:11:45 +01:00
Desmond O. Chang
d2bcf1e3e2 url: add option CURLOPT_SUPPRESS_CONNECT_HEADERS
- Add new option CURLOPT_SUPPRESS_CONNECT_HEADERS to allow suppressing
  proxy CONNECT response headers from the user callback functions
  CURLOPT_HEADERFUNCTION and CURLOPT_WRITEFUNCTION.

- Add new tool option --suppress-connect-headers to expose
  CURLOPT_SUPPRESS_CONNECT_HEADERS and allow suppressing proxy CONNECT
  response headers from --dump-header and --include.

Assisted-by: Jay Satiro
Assisted-by: CarloCannas@users.noreply.github.com
Closes https://github.com/curl/curl/pull/783
2017-03-12 01:32:33 -05:00
Jay Satiro
ec1d0ed1c1 http_proxy: Ignore TE and CL in CONNECT 2xx responses
A client MUST ignore any Content-Length or Transfer-Encoding header
fields received in a successful response to CONNECT.
"Successful" described as: 2xx (Successful). RFC 7231 4.3.6

Prior to this change such a case would cause an error.

In some ways this bug appears to be a regression since c50b878. Prior to
that libcurl may have appeared to function correctly in such cases by
acting on those headers instead of causing an error. But that behavior
was also incorrect.

Bug: https://github.com/curl/curl/issues/1317
Reported-by: mkzero@users.noreply.github.com
2017-03-11 18:22:42 -05:00
Thomas Glanzmann
e08c0cd327 mbedtls: fix typo in variable name
Broken a few days ago in 6448f98.

Bug: https://curl.haxx.se/mail/lib-2017-03/0015.html
2017-03-11 17:19:59 -05:00
Michael Kaufmann
e84a863dc3 proxy: skip SSL initialization for closed connections
This prevents a "Descriptor is not a socket" error for WinSSL.

Reported-by: Antony74@users.noreply.github.com
Reviewed-by: Jay Satiro

Fixes https://github.com/curl/curl/issues/1239
2017-03-11 18:59:01 +01:00
Michael Kaufmann
0afbcfd800 curl_easy_reset: Also reset the authentication state
Follow-up to 5278462
See https://github.com/curl/curl/issues/1095
2017-03-11 18:26:04 +01:00
Isaac Boukris
5278462c32 authneg: clear auth.multi flag at http_done
This flag is meant for the current request based on authentication
state, once the request is done we can clear the flag.

Also change auth.multi to auth.multipass for better readability.

Fixes https://github.com/curl/curl/issues/1095
Closes https://github.com/curl/curl/pull/1326

Signed-off-by: Isaac Boukris <iboukris@gmail.com>
Reported-by: Michael Kaufmann
2017-03-11 18:12:08 +01:00
Dan Fandrich
381aff0385 url: don't compile detect_proxy if HTTP support is disabled 2017-03-11 18:02:34 +01:00
Daniel Stenberg
12f04142c1 openssl: add two /* FALLTHROUGH */ to satisfy coverity
CID 1402159 and 1402158
2017-03-10 08:46:54 +01:00
Dan Fandrich
7d62502d6c polarssl: fixed compile errors introduced in 6448f98c 2017-03-09 09:07:53 +01:00
Daniel Stenberg
6733acc903 openssl: unbreak the build after 6448f98c18
Verified with OpenSSL 1.1.0e and OpenSSL master (1.1.1)
2017-03-08 23:38:26 +01:00
Jozef Kralik
6448f98c18 vtls: add options to specify range of enabled TLS versions
This commit introduces the CURL_SSLVERSION_MAX_* constants as well as
the --tls-max option of the curl tool.

Closes https://github.com/curl/curl/pull/1166
2017-03-08 15:54:07 +01:00
Tatsuhiro Tsujikawa
475c2583d5 http2: Fix assertion error on redirect with CL=0
This fixes assertion error which occurs when redirect is done with 0
length body via HTTP/2, and the easy handle is reused, but new
connection is established due to hostname change:

    curl: http2.c:1572: ssize_t http2_recv(struct connectdata *,
      int, char *, size_t, CURLcode *):
    Assertion `httpc->drain_total >= data->state.drain' failed.

To fix this bug, ensure that http2_handle_stream is called.

Fixes #1286
Closes #1302
2017-03-07 23:12:41 +01:00
Daniel Stenberg
958e176688 ares: Curl_resolver_wait_resolv: clear *entry first in function 2017-03-07 08:08:55 +01:00
Daniel Stenberg
bfaab3180c ares: better error return on timeouts
Assisted-by: Ray Satiro

Bug: https://curl.haxx.se/mail/lib-2017-03/0009.html
2017-03-07 07:38:29 +01:00
Daniel Stenberg
aadb7c7b62 URL: return error on malformed URLs with junk after port number
... because it causes confusion with users. Example URLs:

"http://[127.0.0.1]:11211:80" which a lot of languages' URL parsers will
parse and claim uses port number 80, while libcurl would use port number
11211.

"http://user@example.com:80@localhost" which by the WHATWG URL spec will
be treated to contain user name 'user@example.com' but according to
RFC3986 is user name 'user' for the host 'example.com' and then port 80
is followed by "@localhost"

Both these formats are now rejected, and verified so in test 1260.

Reported-by: Orange Tsai
2017-03-06 16:08:21 +01:00
Daniel Stenberg
29be83ee74 ares: return error at once if timed out before name resolve starts
Pointed-out-by: Ray Satiro
Bug: https://curl.haxx.se/mail/lib-2017-03/0004.html
2017-03-06 09:21:01 +01:00
Michael Maltese
eb19e89f2e CMake: Add DarwinSSL support
Assisted-by: Simon Warta <simon@kullo.net>
Ref: https://github.com/curl/curl/pull/1228
2017-03-05 14:42:53 +01:00
Andrew Krieger
7b1430c0b4 fix potential use of uninitialized variables
MSVC with LTCG detects this at warning level 4.

Closes #1304
2017-03-04 21:37:03 +01:00
Jay Satiro
9f20333443 url: split off proxy init and parsing from create_conn
Move the proxy parse/init into helper create_conn_helper_init_proxy to
mitigate the chances some non-proxy code will be mistakenly added to it.

Ref: https://github.com/curl/curl/issues/1274#issuecomment-281556510
Ref: https://github.com/curl/curl/pull/1293

Closes https://github.com/curl/curl/pull/1298
2017-03-03 03:14:25 -05:00
Alexis La Goutte
cbff751e95 build: fix gcc7 implicit fallthrough warnings
Mark intended fallthroughs with /* FALLTHROUGH */ so that gcc will know
it's expected and won't warn on [-Wimplicit-fallthrough=].

Closes https://github.com/curl/curl/pull/1297
2017-03-03 03:09:46 -05:00
JDepooter
0966ab5bd4 darwinssl: Warn that disabling host verify also disables SNI
In DarwinSSL the SSLSetPeerDomainName function is used to enable both
sending SNI and verifying the host. When host verification is disabled
the function cannot be called, therefore SNI is disabled as well.

Closes https://github.com/curl/curl/pull/1240
2017-03-02 02:42:15 -05:00
Marcel Raad
a162d8b21b
warnless: suppress compiler warning
If size_t is 32 bits, MSVC warns:
warning C4310: cast truncates constant value
The warning is harmless as CURL_MASK_SCOFFT gets
truncated to the maximum value of size_t.
2017-02-28 09:10:18 +01:00
Marcel Raad
727917555d
digest_sspi: fix compilation warning
MSVC complains:
warning C4701: potentially uninitialized local variable 'output_token_len' used
2017-02-27 13:05:22 +01:00
Jay Satiro
a21cae5f97 cyassl: get library version string at runtime
wolfSSL >= 3.6.0 supports getting its library version string at runtime.
2017-02-26 18:49:39 -05:00
Isaac Boukris
1f8023ceb5 url: fix unix-socket support for proxy-disabled builds
Prior to this change if curl was built with Unix Socket support
(--enable-unix-sockets) and without Proxy support (--disable-proxy) then
unix socket options would erroneously be ignored.

Regression introduced in:
0b8d682f81

Bug: https://github.com/curl/curl/issues/1274
Reported-by: mccormickt12@users.noreply.github.com

Closes https://github.com/curl/curl/pull/1289
2017-02-25 18:21:15 -05:00
Dan Fandrich
f7285cc02b gopher: fixed detection of an error condition from Curl_urldecode 2017-02-26 00:10:30 +01:00
Dan Fandrich
516e60aa8e ftp: fixed a NULL pointer dereference on OOM 2017-02-25 22:55:46 +01:00
Dan Fandrich
79221d8d50 ftp: removed an erroneous free in an OOM path 2017-02-25 21:47:27 +01:00
Dan Fandrich
ce9ba3ba10 proxy: fixed a memory leak on OOM 2017-02-25 21:36:39 +01:00
Jay Satiro
93cce2489d url: Default the CA proxy bundle location to CURL_CA_BUNDLE
If the compile-time CURL_CA_BUNDLE location is defined use it as the
default value for the proxy CA bundle location, which is the same as
what we already do for the regular CA bundle location.

Ref: https://github.com/curl/curl/pull/1257
2017-02-23 17:06:11 -05:00
Sergii Pylypenko
53ab183c1a rand: added missing #ifdef HAVE_FCNTL_H around fcntl.h header
Closes #1285
2017-02-23 22:44:16 +01:00
Daniel Stenberg
86f566078b formdata: check for EOF when reading from stdin
Reported-by: shachaf@users.noreply.github.com

Fixes #1281
2017-02-23 10:47:44 +01:00
Viktor Szakats
f4739f639f urldata: include curl_sspi.h when Windows SSPI is enabled
f77dabe broke builds in Windows using Windows SSPI but not Windows SSL.

Bug: https://github.com/curl/curl/issues/1276
Reported-by: jveazey@users.noreply.github.com
2017-02-21 23:06:43 -05:00
Jay Satiro
b259646ea1 url: Improve CURLOPT_PROXY_CAPATH error handling
- Change CURLOPT_PROXY_CAPATH to return CURLE_NOT_BUILT_IN if the option
  is not supported, which is the same as what we already do for
  CURLOPT_CAPATH.

- Change the curl tool to handle CURLOPT_PROXY_CAPATH error
  CURLE_NOT_BUILT_IN as a warning instead of as an error, which is the
  same as what we already do for CURLOPT_CAPATH.

- Fix CAPATH docs to show that CURLE_NOT_BUILT_IN is returned when the
  respective CAPATH option is not supported by the SSL library.

Ref: https://github.com/curl/curl/pull/1257
2017-02-21 22:24:40 -05:00
Jay Satiro
0e8d3e838e cyassl: fix typo 2017-02-21 22:24:39 -05:00
Daniel Stenberg
588960be2c cookie: fix declaration of 'dup' shadows a global declaration 2017-02-21 17:44:02 +01:00
Daniel Stenberg
ca6ea6d9be TLS: make SSL_VERIFYSTATUS work again
The CURLOPT_SSL_VERIFYSTATUS option was not properly handled by libcurl
and thus even if the status couldn't be verified, the connection would
be allowed and the user would not be told about the failed verification.

Regression since cb4e2be7c6

CVE-2017-2629
Bug: https://curl.haxx.se/docs/adv_20170222.html

Reported-by: Marcus Hoffmann
2017-02-21 08:33:18 +01:00
Jay Satiro
af5fbb14bb digest_sspi: Handle 'stale=TRUE' directive in HTTP digest
- If the server has provided another challenge use it as the replacement
  input token if stale=TRUE. Otherwise previous credentials have failed
  so return CURLE_LOGIN_DENIED.

Prior to this change the stale directive was ignored and if another
challenge was received it would cause error CURLE_BAD_CONTENT_ENCODING.

Ref: https://tools.ietf.org/html/rfc2617#page-10

Bug: https://github.com/curl/curl/issues/928
Reported-by: tarek112@users.noreply.github.com
2017-02-21 01:04:59 -05:00
Daniel Stenberg
de1c1a8d85 smb: use getpid replacement for windows UWP builds
Source: 7676b8780d/ports/curl/0002_fix_uwp.patch
2017-02-20 10:27:51 +01:00
Jean Gressmann
af30f1152d sftp: improved checks for create dir failures
Since negative values are errors and not only -1. This makes SFTP upload
with --create-dirs work (again).

Closes #1269
2017-02-20 08:01:53 +01:00
Max Khon
f77dabefd8 digest_sspi: Fix nonce-count generation in HTTP digest
- on the first invocation: keep security context returned by
  InitializeSecurityContext()

- on subsequent invocations: use MakeSignature() instead of
  InitializeSecurityContext() to generate HTTP digest response

Bug: https://github.com/curl/curl/issues/870
Reported-by: Andreas Roth

Closes https://github.com/curl/curl/pull/1251
2017-02-20 00:53:01 -05:00
Michael Kaufmann
ddedc1b3f3 string formatting: fix 4 printf-style format strings 2017-02-19 14:13:42 +01:00
Michael Kaufmann
a5e8fcbc17 speed caps: update the timeouts if the speed is too low/high
Follow-up to 4b86113

Fixes https://github.com/curl/curl/issues/793
Fixes https://github.com/curl/curl/issues/942
2017-02-18 18:09:17 +01:00
Michael Kaufmann
2f8d0df085 proxy: fix hostname resolution and IDN conversion
Properly resolve, convert and log the proxy host names.
Support the "--connect-to" feature for SOCKS proxies and for passive FTP
data transfers.

Follow-up to cb4e2be

Reported-by: Jay Satiro
Fixes https://github.com/curl/curl/issues/1248
2017-02-18 15:04:43 +01:00
Isaac Boukris
13e3a18b34 http: fix missing 'Content-Length: 0' while negotiating auth
- While negotiating auth during PUT/POST if a user-specified
  Content-Length header is set send 'Content-Length: 0'.

This is what we do already in HTTPREQ_POST_FORM and what we did in the
HTTPREQ_POST case (regression since afd288b).

Prior to this change no Content-Length header would be sent in such a
case.

Bug: https://curl.haxx.se/mail/lib-2017-02/0006.html
Reported-by: Dominik Hölzl

Closes https://github.com/curl/curl/pull/1242
2017-02-17 02:32:16 -05:00
Daniel Stenberg
a08db49642 axtls: adapt to API changes
Builds with axTLS 2.1.2. This then also breaks compatibility with axTLS
< 2.1.0 (the older API)

... and fix the session_id mixup brought in 04b4ee549

Fixes #1220
2017-02-15 08:27:35 +01:00
Daniel Stenberg
97c7591a57 smb: code indent 2017-02-14 15:10:31 +01:00
Daniel Stenberg
bde1e2e09b http2: fix memory-leak when denying push streams
Reported-by: zelinchen@users.noreply.github.com
Fixes #1229
2017-02-13 10:35:18 +01:00
Daniel Stenberg
c5c4e816b4 URL: only accept ";options" in SMTP/POP3/IMAP URL schemes
Fixes #1252
2017-02-10 14:51:53 +01:00
Kamil Dudka
8fa5409800 nss: make FTPS work with --proxytunnel
If the NSS code was in the middle of a non-blocking handshake and it
was asked to finish the handshake in blocking mode, it unexpectedly
continued in the non-blocking mode, which caused a FTPS connection
over CONNECT to fail with "(81) Socket not ready for send/recv".

Bug: https://bugzilla.redhat.com/1420327
2017-02-09 17:34:14 +01:00
Daniel Stenberg
e2e182227a http_proxy: avoid freeing static memory
Follow up to 7fe81ec298: make sure 'host' is either NULL or malloced.
2017-02-09 10:13:28 +01:00
Cameron MacMinn
7fe81ec298 http_proxy: Fix tiny memory leak upon edge case connecting to proxy
Fixes #1255
2017-02-09 09:51:42 +01:00
Michael Kaufmann
a7e4348cf8 polarssl, mbedtls: Fix detection of pending data
Reported-by: Dan Fandrich
Bug: https://curl.haxx.se/mail/lib-2017-02/0032.html
2017-02-08 22:24:21 +01:00
Daniel Stenberg
d83612376c http2: reset push header counter fixes crash
When removing an easy handler from a multi before it completed its
transfer, and it had pushed streams, it would segfault due to the pushed
counted not being cleared.

Fixed-by: zelinchen@users.noreply.github.com
Fixes #1249
2017-02-07 09:20:08 +01:00
Markus Westerlind
6ffe0f5d96 transfer: only retry nobody-requests for HTTP
Using sftp to delete a file with CURLOPT_NOBODY set with a reused
connection would fail as curl expected to get some data. Thus it would
retry the command again which fails as the file has already been
deleted.

Fixes #1243
2017-02-07 08:57:33 +01:00
Daniel Gustafsson
3c5bfe4893 telnet: Fix typos
Ref: https://github.com/curl/curl/pull/1245
2017-02-07 02:39:16 -05:00
Daniel Gustafsson
3509aa8023 darwinssl: Avoid parsing certificates when not in verbose mode
The information extracted from the server certificates in step 3 is only
used when in verbose mode, and there is no error handling or validation
performed as that has already been done. Only run the certificate
information extraction when in verbose mode and libcurl was built with
verbose strings.

Closes https://github.com/curl/curl/pull/1246
2017-02-07 02:39:14 -05:00
JDepooter
18495ecacc schannel: Remove incorrect SNI disabled message
- Remove the SNI disabled when host verification disabled message
  since that is incorrect.

- Show a message for legacy versions of Windows <= XP that connections
  may fail since those versions of WinSSL lack SNI, algorithms, etc.

Bug: https://github.com/curl/curl/pull/1240
2017-02-07 02:39:13 -05:00
Viktor Szakats
88bdd7cf6f use *.sourceforge.io and misc URL updates
Ref: https://sourceforge.net/blog/introducing-https-for-project-websites/
Closes: https://github.com/curl/curl/pull/1247
2017-02-06 19:21:05 +00:00
Sean Burford
1c877a0712 cmake: Support curl --xattr when built with cmake
- Test for and set HAVE_FSETXATTR when support for extended file
  attributes is present.

Closes https://github.com/curl/curl/pull/1176
2017-02-01 01:11:52 -05:00
Adam Langley
028391df5d openssl: Don't use certificate after transferring ownership
SSL_CTX_add_extra_chain_cert takes ownership of the given certificate
while, despite the similar name, SSL_CTX_add_client_CA does not. Thus
it's best to call SSL_CTX_add_client_CA before
SSL_CTX_add_extra_chain_cert, while the code still has ownership of the
argument.

Closes https://github.com/curl/curl/pull/1236
2017-01-31 21:04:31 -05:00
Antoine Aubert
a90a5bccd4 mbedtls: implement CTR-DRBG and HAVEGE random generators
closes #1227
2017-01-29 11:37:22 +01:00
Michael Kaufmann
ab08d82648 mbedtls: disable TLS session tickets
SSL session reuse with TLS session tickets is not supported yet.
Use SSL session IDs instead.

See https://github.com/curl/curl/issues/1109
2017-01-28 20:15:30 +01:00
Michael Kaufmann
511674ab27 gnutls: disable TLS session tickets
SSL session reuse with TLS session tickets is not supported yet.
Use SSL session IDs instead.

Fixes https://github.com/curl/curl/issues/1109
2017-01-28 20:09:37 +01:00
Michael Kaufmann
bcca842e0d polarssl: fix hangs
This bugfix is similar to commit c111178bd4.
2017-01-28 19:47:08 +01:00
Daniel Stenberg
cbd4e1fa0d cookies: do not assume a valid domain has a dot
This repairs cookies for localhost.

Non-PSL builds will now only accept "localhost" without dots, while PSL
builds okeys everything not listed as PSL.

Added test 1258 to verify.

This was a regression brought in a76825a5ef
2017-01-27 13:32:02 +01:00
Daniel Stenberg
d8a3aa702a telnet: fix windows compiler warnings
Thumbs-up-by: Jay Satiro

Closes #1225
2017-01-24 08:45:25 +01:00
Daniel Stenberg
8611d985ee VC: remove the makefile.vc6 build infra
The winbuild/ build files is now the single MSVC makefile build choice.

Closes #1215
2017-01-23 14:27:32 +01:00
Daniel Stenberg
fd3ca89ced vtls: source indentation fix 2017-01-22 12:00:28 +01:00
Daniel Stenberg
01ab7c30bb vtls: fix PolarSSL non-blocking handling
A regression brought in cb4e2be

Reported-by: Michael Kaufmann
Bug: https://github.com/curl/curl/issues/1174#issuecomment-274018791
2017-01-20 10:46:05 +01:00
Antoine Aubert
06b1197eeb vtls: fix mbedtls multi non blocking handshake.
When using multi, mbedtls handshake is in non blocking mode.  vtls must
set wait for read/write flags for the socket.

Closes #1223
2017-01-20 08:31:03 +01:00
Richy Kim
6b7616690e CURLOPT_BUFFERSIZE: support enlarging receive buffer
Replace use of fixed macro BUFSIZE to define the size of the receive
buffer.  Reappropriate CURLOPT_BUFFERSIZE to include enlarging receive
buffer size.  Upon setting, resize buffer if larger than the current
default size up to a MAX_BUFSIZE (512KB). This can benefit protocols
like SFTP.

Closes #1222
2017-01-19 23:38:04 +01:00
Viktor Szakats
df86db7dee *.rc: escape non-ASCII/non-UTF-8 character for clarity
Closes https://github.com/curl/curl/pull/1217
2017-01-19 11:35:48 +00:00
Michael Kaufmann
2d6831b758 CURLOPT_CONNECT_TO: Fix compile warnings
Fix compile warnings that appeared only when curl has been configured
with '--disable-verbose'.
2017-01-18 13:02:25 +01:00
Daniel Stenberg
e9f45aa91b parseurl: move back buffer to function scope
Regression since 1d4202ad, which moved the buffer into a more narrow
scope, but the data in that buffer was used outside of that more narrow
scope.

Reported-by: Dan Fandrich
Bug: https://curl.haxx.se/mail/lib-2017-01/0093.html
2017-01-18 00:01:03 +01:00
Jay Satiro
afd1564215 openssl: Fix random generation
- Fix logic error in Curl_ossl_random.

Broken a few days ago in 807698d.
2017-01-17 02:53:59 -05:00
Kamil Dudka
25ed9ea512 nss: use the correct lock in nss_find_slot_by_name() 2017-01-15 14:46:01 +01:00
Alessandro Ghedini
9ad034e5a1 http2: disable server push if not requested
Ref: https://github.com/curl/curl/pull/1160
2017-01-15 11:45:32 +00:00
Alessandro Ghedini
1ad1a0d186 http: print correct HTTP string in verbose output when using HTTP/2
Before:
```
 % src/curl https://sigsegv.ninja/ -v --http2
...
> GET / HTTP/1.1
> Host: sigsegv.ninja
> User-Agent: curl/7.52.2-DEV
> Accept: */*
>
...
```

After:
```
 % src/curl https://sigsegv.ninja/ -v --http2
...
> GET / HTTP/2
> Host: sigsegv.ninja
> User-Agent: curl/7.52.2-DEV
> Accept: */*
>
```
2017-01-14 12:50:51 +00:00
Daniel Stenberg
6e12bb7cbe addrinfo: fix compiler warning on offsetof() use
curl_addrinfo.c:519:20: error: conversion to ‘curl_socklen_t {aka
unsigned int}’ from ‘long unsigned int’ may alter its value
[-Werror=conversion]

Follow-up to 1d786faee1
2017-01-14 00:00:07 +01:00
Isaac Boukris
1d786faee1 unix_socket: add support for abstract unix domain socket
In addition to unix domain sockets, Linux also supports an
abstract namespace which is independent of the filesystem.

In order to support it, add new CURLOPT_ABSTRACT_UNIX_SOCKET
option which uses the same storage as CURLOPT_UNIX_SOCKET_PATH
internally, along with a flag to specify abstract socket.

On non-supporting platforms, the abstract address will be
interpreted as an empty string and fail gracefully.

Also add new --abstract-unix-socket tool parameter.

Signed-off-by: Isaac Boukris <iboukris@gmail.com>
Reported-by: Chungtsun Li (typeless)
Reviewed-by: Daniel Stenberg
Reviewed-by: Peter Wu
Closes #1197
Fixes #1061
2017-01-13 16:25:20 +01:00
Daniel Stenberg
7d6e3f8cfa IDN: Use TR46 non-transitional
Assisted-by: Tim Rühsen
2017-01-13 14:53:50 +01:00
Daniel Stenberg
ee357664df IDN: revert use of the transitional option
It made the german ß get converted to ss, IDNA2003 style, and we can't
have that for the .de TLD - a primary reason for our switch to IDNA2008.

Test 165 verifies.
2017-01-13 14:31:40 +01:00
Tim Rühsen
ba315745f7 IDN: Fix compile time detection of linidn2 TR46
Follow-up to f30cbcac1

Closes #1207
2017-01-13 13:38:12 +01:00
ERAMOTO Masaya
2ac1942c72 url: --noproxy option overrides NO_PROXY environment variable
Under condition using http_proxy env var, noproxy list was the
combination of --noproxy option and NO_PROXY env var previously. Since
this commit, --noproxy option overrides NO_PROXY environment variable
even if use http_proxy env var.

Closes #1140
2017-01-13 11:18:29 +01:00
ERAMOTO Masaya
efdbfde7ca url: Refactor detect_proxy()
If defined CURL_DISABLE_HTTP, detect_proxy() returned NULL. If not
defined CURL_DISABLE_HTTP, detect_proxy() checked noproxy list.

Thus refactor to set proxy to NULL instead of calling detect_proxy() if
define CURL_DISABLE_HTTP, and refactor to call detect_proxy() if not
define CURL_DISABLE_HTTP and the host is not in the noproxy list.
2017-01-13 11:18:11 +01:00
ERAMOTO Masaya
1b57557882 url: Fix NO_PROXY env var to work properly with --proxy option.
The combination of --noproxy option and http_proxy env var works well
both for proxied hosts and non-proxied hosts.

However, when combining NO_PROXY env var with --proxy option,
non-proxied hosts are not reachable while proxied host is OK.

This patch allows us to access non-proxied hosts even if using NO_PROXY
env var with --proxy option.
2017-01-13 11:18:11 +01:00
Tim Rühsen
f30cbcac11 IDN: Use TR46 'transitional' for toASCII translations
References: http://unicode.org/faq/idn.html
            http://unicode.org/reports/tr46

Closes #1206
2017-01-13 10:21:25 +01:00
Marcus Hoffmann
7ba8020c46 gnutls: check for alpn and ocsp in configure
Check for presence of gnutls_alpn_* and gnutls_ocsp_* functions during
configure instead of relying on the version number.  GnuTLS has options
to turn these features off and we ca just work with with such builds
like we work with older versions.

Signed-off-by: Marcus Hoffmann <m.hoffmann@cartelsol.com>

Closes #1204
2017-01-13 09:54:55 +01:00
Jay Satiro
1d4202ade6 url: Fix parsing for when 'file' is the default protocol
Follow-up to 3463408.

Prior to 3463408 file:// hostnames were silently stripped.

Prior to this commit it did not work when a schemeless url was used with
file as the default protocol.

Ref: https://curl.haxx.se/mail/lib-2016-11/0081.html
Closes https://github.com/curl/curl/pull/1124

Also fix for drive letters:

- Support --proto-default file c:/foo/bar.txt

- Support file://c:/foo/bar.txt

- Fail when a file:// drive letter is detected and not MSDOS/Windows.

Bug: https://github.com/curl/curl/issues/1187
Reported-by: Anatol Belski
Assisted-by: Anatol Belski
2017-01-12 15:37:11 -05:00
Daniel Stenberg
807698db02 rand: make it work without TLS backing
Regression introduced in commit f682156a4f

Reported-by: John Kohl
Bug: https://curl.haxx.se/mail/lib-2017-01/0055.html
2017-01-12 17:44:21 +01:00
Jay Satiro
a18db79262 STARTTLS: Don't print response character in denied messages
Both IMAP and POP3 response characters are used internally, but when
appended to the STARTTLS denial message likely could confuse the user.

Closes https://github.com/curl/curl/pull/1203
2017-01-12 02:36:03 -05:00
Jay Satiro
4e6f483d08 smtp: Fix STARTTLS denied error message
- Format the numeric denial code as an integer instead of a character.
2017-01-12 02:06:03 -05:00
Daniel Stenberg
c6778aa46a http2_send: avoid unsigned integer wrap around
... when checking for a too large request.
2017-01-11 12:15:37 +01:00
Dan Fandrich
ba19feba94 wolfssl: display negotiated SSL version and cipher 2017-01-07 00:09:10 +01:00
Dan Fandrich
bbee0d4eee wolfssl: support setting cipher list 2017-01-06 23:02:09 +01:00
Nick Zitzmann
ffbb0f0d37 darwinssl: --insecure overrides --cacert if both settings are in use
Fixes #1184
2017-01-03 17:44:57 -06:00
Daniel Stenberg
ad10eb5fed content_encoding: change return code on a failure
Failure to decompress is now a write error instead of the weird
"function not found".
2016-12-29 11:31:01 +01:00
Max Khon
89b7898846 digest_sspi: copy terminating NUL as well
Curl_auth_decode_digest_http_message(): copy terminating NUL as later
Curl_override_sspi_http_realm() expects a NUL-terminated string.

Fixes #1180
2016-12-29 00:21:14 +01:00
Chris Araman
e53f0736c4 darwinssl: fix CFArrayRef leak
Reviewed-by: Nick Zitzmann
Closes #1173
2016-12-27 22:07:59 +01:00
Chris Araman
8db3afe16c darwinssl: fix iOS build
Reviewed-by: Nick Zitzmann
Fixes #1172
2016-12-27 22:07:28 +01:00
Daniel Stenberg
a7b38c9dc9 vtls: s/SSLEAY/OPENSSL
Fixed an old leftover use of the USE_SSLEAY define which would make a
socket get removed from the applications sockets to monitor when the
multi_socket API was used, leading to timeouts.

Bug: #1174
2016-12-26 00:10:04 +01:00
Daniel Stenberg
e50abe6478 formdata: use NULL, not 0, when returning pointers 2016-12-25 10:36:29 +01:00
Daniel Stenberg
9314bf8405 ftp: failure to resolve proxy should return that error code 2016-12-25 10:35:34 +01:00
Daniel Stenberg
5fe164a258 ftp-gss: check for init before use
To avoid dereferencing a NULL pointer.

Reported-by: Daniel Romero
2016-12-24 23:35:43 +01:00
Jay Satiro
cdbdef6f9f cyassl: use time_t instead of long for timeout 2016-12-24 13:25:03 -05:00
Daniel Stenberg
9aa259a139 http: remove "Curl_http_done: called premature" message
... it only confuses people.
2016-12-23 23:32:43 +01:00
Daniel Stenberg
00c817068e openssl-random: check return code when asking for random
and fail appropriately if it returns error
2016-12-23 15:29:01 +01:00
Daniel Stenberg
c7834ecd45 gnutls-random: check return code for failed random 2016-12-23 15:01:53 +01:00
Kamil Dudka
f81b2277a8 randit: store the value in the buffer 2016-12-21 23:42:43 +01:00
Marcel Raad
773cef4fae
lib: fix MSVC compiler warnings
Visual C++ complained:
warning C4267: '=': conversion from 'size_t' to 'long', possible loss of data
warning C4701: potentially uninitialized local variable 'path' used
2016-12-21 11:07:26 +01:00
Daniel Stenberg
f44cf7914f ssh: inhibit coverity warning with (void)
CID 1397391 (#1 of 1): Unchecked return value (CHECKED_RETURN)
2016-12-20 14:46:47 +01:00
Daniel Stenberg
21a7a96c90 Curl_recv_has_postponed_data: silence compiler warnings
Follow-up to d00f2a8f2
2016-12-19 09:20:54 +01:00
Jay Satiro
c2402b6e02 tests: checksrc compliance 2016-12-19 02:31:59 -05:00
Jay Satiro
d00f2a8f2e http_proxy: Fix proxy CONNECT hang on pending data
- Check for pending data before waiting on the socket.

Bug: https://github.com/curl/curl/issues/1156
Reported-by: Adam Langley
2016-12-19 02:26:52 -05:00
Dan McNulty
0354eed410 schannel: fix wildcard cert name validation on Win CE
Fixes a few issues in manual wildcard cert name validation in
schannel support code for Win32 CE:
- when comparing the wildcard name to the hostname, the wildcard
  character was removed from the cert name and the hostname
  was checked to see if it ended with the modified cert name.
  This allowed cert names like *.com to match the connection
  hostname. This violates recommendations from RFC 6125.
- when the wildcard name in the certificate is longer than the
  connection hostname, a buffer overread of the connection
  hostname buffer would occur during the comparison of the
  certificate name and the connection hostname.
2016-12-19 07:53:20 +01:00
Daniel Stenberg
3ab3c16db6 printf: fix floating point buffer overflow issues
... and add a bunch of floating point printf tests
2016-12-19 07:53:20 +01:00
Daniel Stenberg
60450d507f config-amigaos.h: (embarrassed) made the line shorter 2016-12-18 23:46:17 +01:00
Daniel Stenberg
c562329996 config-amigaos.h: fix bug report email reference 2016-12-18 23:45:22 +01:00
Michael Kaufmann
f9484d9fb1 openssl: simplify expression in Curl_ossl_version 2016-12-18 13:09:51 +01:00
Isaac Boukris
82245eaa56 Curl_getconnectinfo: avoid checking if the connection is closed
It doesn't benefit us much as the connection could get closed at
any time, and also by checking we lose the ability to determine
if the socket was closed by reading zero bytes.

Reported-by: Michael Kaufmann

Closes https://github.com/curl/curl/pull/1134
2016-12-18 12:47:10 +01:00
Daniel Stenberg
845522cadb preproxy: renamed what was added as SOCKS_PROXY
CURLOPT_SOCKS_PROXY -> CURLOPT_PRE_PROXY

Added the corresponding --preroxy command line option. Sets a SOCKS
proxy to connect to _before_ connecting to a HTTP(S) proxy.
2016-12-16 16:04:23 +01:00
Daniel Stenberg
7907a2bec9 CURLOPT_SOCKS_PROXYTYPE: removed
This was added as part of the SOCKS+HTTPS proxy merge but there's no
need to support this as we prefer to have the protocol specified as a
prefix instead.
2016-12-16 15:10:19 +01:00
Daniel Stenberg
1c3e8bbfed checksrc: warn for assignments within if() expressions
... they're already frowned upon in our source code style guide, this
now enforces the rule harder.
2016-12-14 01:29:44 +01:00
Daniel Stenberg
b228d2952b checksrc: stricter no-space-before-paren enforcement
In order to make the code style more uniform everywhere
2016-12-13 23:39:11 +01:00
Adam Langley
71a55534fa openssl: don't use OpenSSL's ERR_PACK.
ERR_PACK is an internal detail of OpenSSL. Also, when using it, a
function name must be specified which is overly specific: the test will
break whenever OpenSSL internally change things so that a different
function creates the error.

Closes #1157
2016-12-07 23:53:03 +01:00