10701 Commits

Author	SHA1	Message	Date
Daniel Stenberg	3ab45650e2	url: part of expression is always true: (bundle->multiuse == 0) ... Fixes warning detected by PVS-Studio Fixes #4374	2019-09-20 08:07:11 +02:00
Daniel Stenberg	e3c41ebd7c	ftp: the conditional expression is always true ... ... both !result and (ftp->transfer != FTPTRANSFER_BODY)! Fixes warning detected by PVS-Studio Fixes #4374	2019-09-20 08:07:06 +02:00
Daniel Stenberg	49f3117a23	ftp: Expression 'ftpc->wait_data_conn' is always false ... Fixes warning detected by PVS-Studio Fixes #4374	2019-09-20 08:07:03 +02:00
Daniel Stenberg	a50c3d7fa0	ftp: Expression 'ftpc->wait_data_conn' is always true ... Fixes warning detected by PVS-Studio Fixes #4374	2019-09-20 08:07:00 +02:00
Daniel Stenberg	97c17e9fcb	ftp: part of conditional expression is always true: !result ... Fixes warning detected by PVS-Studio Fixes #4374	2019-09-20 08:06:58 +02:00
Daniel Stenberg	69ea985d4c	http: fix Expression 'http->postdata' is always false ... Fixes warning detected by PVS-Studio Fixes #4374 Reported-by: Valerii Zapodovnikov	2019-09-20 08:06:47 +02:00
Niall O'Reilly	0d59addff6	doh: avoid truncating DNS QTYPE to lower octet ... Closes #4381	2019-09-19 22:50:38 +02:00
Jens Finkhaeuser	0a4ecbdf1c	urlapi: CURLU_NO_AUTHORITY allows empty authority/host part ... CURLU_NO_AUTHORITY is intended for use with unknown schemes (i.e. not "file:///") to override cURL's default demand that an authority exists. Closes #4349	2019-09-19 15:57:28 +02:00
Daniel Stenberg	3c5f9ba899	url: only reuse TLS connections with matching pinning ... If the requests have different CURLOPT_PINNEDPUBLICKEY strings set, the connection should not be reused. Bug: https://curl.haxx.se/mail/lib-2019-09/0061.html Reported-by: Sebastian Haglund Closes #4347	2019-09-19 14:58:24 +02:00
Michael Kaufmann	2a2404153b	http: merge two "case" statements	2019-09-18 13:45:41 +02:00
Zenju	1c02a4e874	FTP: remove trailing slash from path for LIST/MLSD ... Closes #4348	2019-09-18 09:27:21 +02:00
Daniel Stenberg	ac58c51b29	mime: when disabled, avoid C99 macro ... Closes #4368	2019-09-18 08:08:41 +02:00
Daniel Stenberg	beb4350917	url: cleanup dangling DOH request headers too ... Follow-up to 9bc44ff64d Credit to OSS-Fuzz Bug: https://crbug.com/oss-fuzz/17269 Closes #4372	2019-09-18 07:48:49 +02:00
Christoph M. Becker	7c596f5dea	http2: relax verification of :authority in push promise requests ... If the :authority pseudo header field doesn't contain an explicit port, we assume it is valid for the default port, instead of rejecting the request for all ports. Ref: https://curl.haxx.se/mail/lib-2019-09/0041.html Closes #4365	2019-09-16 23:36:22 +02:00
Daniel Stenberg	9bc44ff64d	doh: clean up dangling DOH handles and memory on easy close ... If you set the same URL for target as for DoH (and it isn't a DoH server), like "https://example.com" in both, the easy handles used for the DoH requests could be left "dangling" and end up not getting freed. Reported-by: Paul Dreik Closes #4366	2019-09-16 17:31:56 +02:00
Daniel Stenberg	6de1053692	smb: check for full size message before reading message details ... To avoid reading of uninitialized data. Assisted-by: Max Dymond Bug: https://crbug.com/oss-fuzz/16907 Closes #4363	2019-09-16 14:16:06 +02:00
Daniel Stenberg	00da834156	quiche: persist connection details ... ... like we do for other protocols at connect time. This makes "curl -I" and other things work. Reported-by: George Liu Fixes #4358 Closes #4360	2019-09-16 13:37:26 +02:00
Daniel Stenberg	a0f8fccb1e	openssl: fix warning with boringssl and SSL_CTX_set_min_proto_version ... Follow-up to ffe34b7b59 Closes #4359	2019-09-16 08:49:51 +02:00
Paul Dreik	dda418266c	doh: fix undefined behaviour and open up for gcc and clang optimization ... The undefined behaviour is annoying when running fuzzing with sanitizers. The codegen is the same, but the meaning is now not up for dispute. See https://cppinsights.io/s/516a2ff4 By incrementing the pointer first, both gcc and clang recognize this as a bswap and optimizes it to a single instruction. See https://godbolt.org/z/994Zpx Closes #4350	2019-09-15 23:27:45 +02:00
Paul Dreik	b766602729	doh: fix (harmless) buffer overrun ... Added unit test case 1655 to verify. Close #4352 the code correctly finds the flaws in the old code, if one temporarily restores doh.c to the old version.	2019-09-15 23:25:24 +02:00
Daniel Stenberg	65f5b958c9	FTP: allow "rubbish" prepended to the SIZE response ... This is a protocol violation but apparently there are legacy proprietary servers doing this. Added test 336 and 337 to verify. Reported-by: Philippe Marguinaud Closes #4339	2019-09-13 14:21:00 +02:00
Zenju	acf1d2acd1	FTP: skip CWD to entry dir when target is absolute ... Closes #4332	2019-09-13 14:05:34 +02:00
Daniel Stenberg	83b4cfacba	parsedate: still provide the name arrays when disabled ... If FILE or FTP are enabled, since they also use them! Reported-by: Roland Hieber Fixes #4325 Closes #4343	2019-09-13 08:25:14 +02:00
Daniel Stenberg	a56a47ac33	openssl: close_notify on the FTP data connection doesn't mean closure ... For FTPS transfers, curl gets close_notify on the data connection without that being a signal to close the control connection! Regression since 3f5da4e59a (7.65.0) Reported-by: Zenju on github Reviewed-by: Jay Satiro Fixes #4329 Closes #4340	2019-09-13 00:10:47 +02:00
Zenju	0aef91411e	setopt: make it easier to add new enum values ... ... by using the *_LAST define names better. Closes #4321	2019-09-12 09:42:54 +02:00
Daniel Stenberg	e34ec7de59	asyn-thread: s/AF_LOCAL/AF_UNIX for Solaris ... Reported-by: Dagobert Michelsen Fixes #4328 Closes #4333	2019-09-12 09:37:11 +02:00
Jay Satiro	08f96982a9	ldap: Stop using wide char version of ldapp_err2string ... Despite ldapp_err2string being documented by MS as returning a PCHAR (char *), when UNICODE it is mapped to ldap_err2stringW and returns PWCHAR (wchar_t *). We have lots of code that expects ldap_err2string to return char *, most of it failf used like this: failf(data, "LDAP local: Some error: %s", ldap_err2string(rc)); Closes https://github.com/curl/curl/pull/4272	2019-09-11 02:44:47 -04:00
Daniel Stenberg	9637dbfffd	urlapi: one colon is enough for the strspn() input (typo)	2019-09-10 11:51:51 +02:00
Daniel Stenberg	eab3c580f9	urlapi: verify the IPv6 numerical address ... It needs to parse correctly. Otherwise it could be tricked into letting through a-f using host names that libcurl would then resolve. Like '[ab.be]'. Reported-by: Thomas Vegas Closes #4315	2019-09-10 11:32:12 +02:00
Clément Notin	ffe34b7b59	openssl: use SSL_CTX_set_<min|max>_proto_version() when available ... OpenSSL 1.1.0 adds SSL_CTX_set_<min|max>_proto_version() that we now use when available. Existing code is preserved for older versions of OpenSSL. Closes #4304	2019-09-10 08:11:42 +02:00
Clément Notin	9136542d33	openssl: indent, re-organize and add comments	2019-09-10 08:08:44 +02:00
migueljcrum	67b30b3418	sspi: fix memory leaks ... Closes #4299	2019-09-10 08:06:05 +02:00
Daniel Stenberg	c4c9e070f3	Curl_fillreadbuffer: avoid double-free trailer buf on error ... Reviewed-by: Jay Satiro Reported-by: Thomas Vegas Closes #4307	2019-09-09 09:36:27 +02:00
Daniel Stenberg	9069838b30	security:read_data fix bad realloc() ... ... that could end up a double-free CVE-2019-5481 Bug: https://curl.haxx.se/docs/CVE-2019-5481.html	2019-09-09 08:14:34 +02:00
Thomas Vegas	facb0e4662	tftp: Alloc maximum blksize, and use default unless OACK is received ... Fixes potential buffer overflow from 'recvfrom()', should the server return an OACK without blksize. Bug: https://curl.haxx.se/docs/CVE-2019-5482.html CVE-2019-5482	2019-09-09 08:14:34 +02:00
Thomas Vegas	82f3ba3806	tftp: return error when packet is too small for options	2019-09-09 08:14:34 +02:00
Daniel Stenberg	158dcb9f86	netrc: free 'home' on error ... Follow-up to f9c7ba9096 Coverity CID 1453474 Closes #4291	2019-09-03 23:00:51 +02:00
Daniel Stenberg	4ac2884003	urldata: avoid 'generic', use dedicated pointers ... For the 'proto' union within the connectdata struct. Closes #4290	2019-09-03 23:00:51 +02:00
Daniel Stenberg	5050edb124	cleanup: move functions out of url.c and make them static ... Closes #4289	2019-09-03 13:11:12 +02:00
Daniel Stenberg	4d0306c698	smtp: check for and bail out on too short EHLO response ... Otherwise, a three byte response would make the smtp_state_ehlo_resp() function misbehave. Credit to OSS-Fuzz Bug: https://crbug.com/oss-fuzz/16918 Assisted-by: Max Dymond Closes #4287	2019-09-03 08:25:23 +02:00
Daniel Stenberg	198b73d12c	smb: init *msg to NULL in smb_send_and_recv() ... ... it might otherwise return OK from this function leaving that pointer uninitialized. Bug: https://crbug.com/oss-fuzz/16907 Closes #4286	2019-09-02 23:06:48 +02:00
Daniel Stenberg	84ced9389e	Curl_addr2string: take an addrlen argument too ... This allows the function to figure out if a unix domain socket has a file name or not associated with it! When a socket is created with socketpair(), as done in the fuzzer testing, the path struct member is uninitialized and must not be accessed. Bug: https://crbug.com/oss-fuzz/16699 Closes #4283	2019-08-31 11:41:56 +02:00
Daniel Stenberg	c30aff4f88	quiche: expire when poll returned data ... ... to make sure we continue draining the queue until empty Closes #4281	2019-08-30 17:41:16 +02:00
Daniel Stenberg	4d9e324771	quiche: decrease available buffer size, don't assign it! ... Found-by: Jeremy Lainé	2019-08-30 17:41:11 +02:00
Daniel Stenberg	7bac3135df	ngtcp2: on h3 stream close, call expire ... ... to trigger a new read to detect the stream close! Closes #4275	2019-08-29 19:23:52 +02:00
Tatsuhiro Tsujikawa	484b6f345f	ngtcp2: build latest ngtcp2 and ngtcp2_crypto_openssl ... Closes #4278	2019-08-29 19:22:16 +02:00
Daniel Stenberg	0690b3330c	ngtcp2: set flow control window to stream buffer size ... Closes #4274	2019-08-28 14:37:19 +02:00
Tatsuhiro Tsujikawa	5b3be0729c	ngtcp2: Build with latest ngtcp2 and ngtcp2_crypto_openssl ... Closes #4270	2019-08-27 16:31:19 +02:00
Daniel Stenberg	c1b6a384f9	http2: when marked for closure and wanted to close == OK ... It could otherwise return an error even when closed correctly if GOAWAY had been received previously. Reported-by: Tom van der Woerdt Fixes #4267 Closes #4268	2019-08-26 22:44:59 +02:00
Kamil Dudka	7e513c1048	vauth: return CURLE_AUTH_ERROR on gss_init_sec_context() failure ... This is a follow-up to https://github.com/curl/curl/pull/3864 . Closes #4224	2019-08-26 13:43:21 +02:00
Daniel Stenberg	48f589893d	quiche: send the HTTP body correctly on callback uploads ... Closes #4265	2019-08-26 11:31:39 +02:00
Daniel Stenberg	aae22fdbd5	ngtcp2: add support for SSLKEYLOGFILE ... Closes #4260	2019-08-25 23:29:46 +02:00
Daniel Stenberg	30a606e066	ngtcp2: improve h3 response receiving ... Closes #4259	2019-08-25 23:29:43 +02:00
Daniel Stenberg	b959c2f775	ngtcp2: use nghttp3_version()	2019-08-25 23:18:17 +02:00
Daniel Stenberg	ff4ef390f6	ngtcp2: sync with upstream API changes ... Assisted-by: Tatsuhiro Tsujikawa	2019-08-25 23:18:14 +02:00
Kyle Abramowitz	25f9621935	scp: fix directory name length used in memcpy ... Fix read off end of array due to bad pointer math in getworkingpath for SCP home directory case. Closes #4258	2019-08-24 18:47:56 +02:00
Daniel Stenberg	65fda739ee	http: the 'closed' struct field is used by both ngh2 and ngh3 ... and remove 'header_recvbuf', not used for anything Reported-by: Jeremy Lainé Closes #4257	2019-08-24 17:21:41 +02:00
Daniel Stenberg	0a5d28fa2e	ngtcp2: accept upload via callback ... Closes #4256	2019-08-23 22:33:29 +02:00
Daniel Stenberg	e59540139a	cleanup: remove DOT_CHAR completely ... Follow-up to f9c7ba9096 The use of DOT_CHAR for ".ssh" was probably a mistake and is removed now. Pointed-out-by: Gisle Vanem Bug: https://github.com/curl/curl/pull/4230#issuecomment-522960638 Closes #4247	2019-08-20 23:07:59 +02:00
Daniel Stenberg	23803aae7b	spnego_sspi: add typecast to fix build warning ... Reported in build "Win32 target on Debian Stretch (64-bit) - i686-w64-mingw32 - gcc-20170516" Closes #4245	2019-08-20 23:06:19 +02:00
Daniel Stenberg	3e8a9bfd17	openssl: build warning free with boringssl ... Closes #4244	2019-08-20 19:55:06 +02:00
Daniel Stenberg	2056175dc2	ngtcp2: make postfields-set posts work ... Closes #4242	2019-08-20 16:53:40 +02:00
Daniel Stenberg	99775438d6	http: remove chunked-encoding and expect header use for HTTP/3	2019-08-20 16:53:40 +02:00
Daniel Stenberg	6a90c9e0c4	CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2 ... For a long time (since 7.28.1) we've returned error when setting the value to 1 to make applications notice that we stopped supported the old behavior for 1. Starting now, we treat 1 and 2 exactly the same. Closes #4241	2019-08-20 14:57:59 +02:00
Daniel Stenberg	f9c7ba9096	netrc: make the code try ".netrc" on Windows as well ... ... but fall back and try "_netrc" too if the dot version didn't work. Co-Authored-By: Steve Holme	2019-08-20 11:48:42 +02:00
Daniel Stenberg	1a0dc6f6a3	ngtcp2: use ngtcp2_version() to get the run-time version ... ... which of course doesn't have to be the same used at build-time. Function just recently merged in ngtcp2.	2019-08-20 08:52:22 +02:00
Daniel Stenberg	349c3f5a08	ngtcp2: move the h3 initing to immediately after the rx key ... To fix a segfault and to better deal with 0-RTT Assisted-by: Tatsuhiro Tsujikawa	2019-08-20 08:51:23 +02:00
Alessandro Ghedini	e54affa82c	quiche: register debug callback once and earlier ... The quiche debug callback is global and can only be initialized once, so make sure we don't do it multiple times (e.g. if multiple requests are executed). In addition this initializes the callback before the connection is created, so we get logs for the handshake as well. Closes #4236	2019-08-17 17:00:49 +02:00
Daniel Stenberg	ea28a6cb2f	ssh: add a generic Curl_ssh_version function for SSH backends ... Closes #4235	2019-08-17 16:57:58 +02:00
Daniel Stenberg	1a7634e484	base64: check for SSH, not specific SSH backends	2019-08-17 16:57:56 +02:00
Daniel Stenberg	d6dea75af7	vssh: move ssh init/cleanup functions into backend code	2019-08-17 16:57:55 +02:00
Daniel Stenberg	5b2d703fe5	vssh: create directory for SSH backend code	2019-08-17 16:57:55 +02:00
Daniel Stenberg	68fab35c73	http: fix use of credentials from URL when using HTTP proxy ... When a username and password are provided in the URL, they were wrongly removed from the stored URL so that subsequent uses of the same URL wouldn't find the crendentials. This made doing HTTP auth with multiple connections (like Digest) mishave. Regression from 46e164069d (7.62.0) Test case 335 added to verify. Reported-by: Mike Crowe Fixes #4228 Closes #4229	2019-08-16 10:11:22 +02:00
Daniel Stenberg	cec3ef8793	ngtcp2: provide the callbacks as a static struct ... ... instead of having them in quicsocket	2019-08-15 10:20:35 +02:00
Tatsuhiro Tsujikawa	408c758bb8	ngtcp2: add missing nghttp3_conn_add_write_offset call ... Closes #4225	2019-08-15 08:02:52 +02:00
Tatsuhiro Tsujikawa	c47ef9115e	ngtcp2: deal with stream close	2019-08-15 08:02:23 +02:00
Tatsuhiro Tsujikawa	e42bd8a204	ngtcp2: Consume QUIC STREAM data properly	2019-08-15 08:02:20 +02:00
Tatsuhiro Tsujikawa	887ebc384c	ngtcp2: don't reinitialize SSL on Retry	2019-08-15 08:02:15 +02:00
Daniel Stenberg	437bf10cad	multi: getsock improvements for QUIC connecting	2019-08-14 23:14:12 +02:00
Daniel Stenberg	5848f27594	connect: connections are persistent by default for HTTP/3	2019-08-14 23:14:12 +02:00
Daniel Stenberg	baf7860b71	quiche: happy eyeballs ... Closes #4220	2019-08-14 23:14:12 +02:00
Daniel Stenberg	f2cc26456b	ngtcp2: do QUIC connections happy-eyeballs friendly	2019-08-14 23:14:12 +02:00
Daniel Stenberg	1d85e09ccd	curl_version: bump string buffer size to 250 ... With HTTP/3 libs and plenty TLS libs, I manged to hit the limit (which causes a truncated output).	2019-08-14 15:16:07 +02:00
Jay Satiro	dca6f73613	vauth: Use CURLE_AUTH_ERROR for auth function errors ... - Add new error code CURLE_AUTH_ERROR. Prior to this change auth function errors were signaled by CURLE_OUT_OF_MEMORY and CURLE_RECV_ERROR, and neither one was technically correct. Ref: https://github.com/curl/curl/pull/3848 Co-authored-by: Dominik Hölzl Closes https://github.com/curl/curl/pull/3864	2019-08-14 03:14:01 -04:00
Peter Wu	cc5fae5dac	nss: use TLSv1.3 as default if supported ... SSL_VersionRangeGetDefault returns (TLSv1.0, TLSv1.2) as supported range in NSS 3.45. It looks like the intention is to raise the minimum version rather than lowering the maximum, so adjust accordingly. Note that the caller (nss_setup_connect) initializes the version range to (TLSv1.0, TLSv1.3), so there is no need to check for >= TLSv1.0 again. Closes #4187 Reviewed-by: Daniel Stenberg Reviewed-by: Kamil Dudka	2019-08-13 21:59:30 +01:00
Daniel Stenberg	362d59edab	quic.h: remove unused proto	2019-08-13 15:09:07 +02:00
Daniel Stenberg	d6cb1bdf6c	lib/quic.c: unused - removed	2019-08-13 12:41:04 +02:00
Daniel Stenberg	49e6b3857f	altsvc: make it use h3-22 with ngtcp2 as well	2019-08-12 22:30:58 +02:00
Daniel Stenberg	368d444cc6	ngtcp2: initial h3 request work ... Closes #4217	2019-08-12 22:30:52 +02:00
Daniel Stenberg	1a2df1518a	curl_version_info: offer quic (and h3) library info ... Closes #4216	2019-08-12 13:37:08 +02:00
Tatsuhiro Tsujikawa	fb6d46a709	ngtcp2: send HTTP/3 request with nghttp3 ... This commit makes sending HTTP/3 request with nghttp3 work. It minimally receives HTTP response and calls nghttp3 callbacks, but no processing is made at the moment. Closes #4215	2019-08-12 09:20:36 +02:00
Daniel Stenberg	102ebe0459	nghttp3: initial h3 template code added	2019-08-12 00:18:59 +02:00
Daniel Stenberg	d85a1cf11d	nghttp3: required when ngtcp2 is used for QUIC ... - checked for by configure - updated docs/HTTP3.md - shown in the version string Closes #4210	2019-08-12 00:18:53 +02:00
Eric Wong	17d1e27d30	asyn-thread: issue CURL_POLL_REMOVE before closing socket ... This avoids EBADF errors from EPOLL_CTL_DEL operations in the ephiperfifo.c example. EBADF is dangerous in multi-threaded applications where I rely on epoll_ctl to operate on the same epoll description from different threads. Follow-up to eb9a604f8d Bug: https://curl.haxx.se/mail/lib-2019-08/0026.html Closes #4211	2019-08-11 22:58:01 +02:00
Tatsuhiro Tsujikawa	86ae740482	ngtcp2: Send ALPN h3-22 ... Closes #4212	2019-08-11 16:47:29 +02:00
Tatsuhiro Tsujikawa	f49abd1090	ngtcp2: use ngtcp2_settings_default and specify initial_ts	2019-08-11 16:47:21 +02:00
Tatsuhiro Tsujikawa	afce0620a2	ngtcp2: make the QUIC handshake work ... Closes #4209	2019-08-10 16:07:33 +02:00
Daniel Stenberg	084404b8ab	CURLOPT_H3: removed ... There's no use for this anymore and it was never in a release. Closes #4206	2019-08-09 12:26:02 +02:00
Daniel Stenberg	db061571ef	http3: make connection reuse work ... Closes #4204	2019-08-09 12:26:02 +02:00
Daniel Stenberg	4570c22c57	quiche: add SSLKEYLOGFILE support	2019-08-09 12:23:18 +02:00