1
0
mirror of https://github.com/moparisthebest/curl synced 2024-11-04 08:35:05 -05:00
Commit Graph

16064 Commits

Author SHA1 Message Date
Steve Holme
62bd217464 smtp: Fixed an issue when processing EHLO failure responses (Part 2)
Follow up fix to commit 23d17190ee as EHLO capabilities can exist
within a positive response line.
2013-02-09 14:32:20 +00:00
Steve Holme
f0bfc0fbd7 smtp: Fixed an issue with missing capabilities after the AUTH line
Follow up to commit 40f9bb787f to fix missing capabilities after an
AUTH line.
2013-02-09 14:26:22 +00:00
Nick Zitzmann
7f266f1c99 darwinssl: Make certificate errors less techy
Previously if a problem was found with one of the server's certificates,
we'd log an OSStatus for the end user to look up. Now we explain what
was wrong with the site's certificate chain. Also un-did part of the
previous commit where the code wouldn't catch errSSLServerAuthCompleted
if built under Leopard.
2013-02-08 18:34:11 -07:00
Guenter Knauf
5be2499e16 Updated dependency libs. 2013-02-09 01:35:11 +01:00
Steve Holme
f44d0aedc1 imap: Corrected some comments 2013-02-09 00:26:40 +00:00
Steve Holme
23d17190ee smtp: Fixed an issue when processing EHLO failure responses
Fixed a small issue where smtp_endofresp() would look for capabilities
in the description part of a failure response. In theory a server
shouldn't respond with SIZE or AUTH in an EHLO command's failure
response but if it did then capabilities would be unnecessarily set
before eventually failing.
2013-02-09 00:22:25 +00:00
Steve Holme
21657823ea pop3: Reworked pop3_endofresp() to simplify it little
Reworked pop3_endofresp() to simplify it and provide consistency between
imap and smtp.
2013-02-08 23:07:20 +00:00
Steve Holme
3bb45aa7f5 imap: Renamed state variables in imap_authenticate()
Renamed the authstate1 and authstate2 variables in imap_authenticate()
as the old name was a left over from when there was only one state
variable which was named due to a clash with the state() function.

Additionally this provides consistency with the smtp module.
2013-02-08 21:40:54 +00:00
Steve Holme
40f9bb787f smtp: Reworked smtp_endofresp() to allow for extra capability detection 2013-02-08 21:19:34 +00:00
Steve Holme
dda53476ca smtp: Renamed smtp_state_auth_passwd_resp() function
Renamed the login password response function to better describe it's
purpose as well as for consistency with the imap and pop3 modules.
2013-02-08 20:54:03 +00:00
Gisle Vanem
463082bea4 ntlm: fix memory leak
Running tests\libtest\libntlmconnect.exe reveals a 1 byte (!) leak in
./lib/curl_ntlm_msgs.c:

perl ..\memanalyze.pl c:memdebug.curl
Leak detected: memory still allocated: 1 bytes
At 9771e8, there's 1 bytes.
allocated by curl_ntlm_msgs.c:399

Snippet from curl_ntlm_msgs.c:
   /* setup ntlm identity's domain and length */
   dup_domain.tchar_ptr = malloc(sizeof(TCHAR) * (domlen + 1));

(my domlen == 0).

'dup_domain.tbyte_ptr' looks to be freed in Curl_ntlm_sspi_cleanup() via
'ntlm->identity.Domain'. But I see no freeing of 'dup_domain.tchar_ptr'.
2013-02-08 15:51:27 +01:00
Daniel Stenberg
72688317ad DONE: consider callback-aborted transfers premature
This bug report properly identified that when doing SMTP and aborting
the transfer with a callback, it must be considered aborted prematurely
by the code to avoid QUIT etc to be attempted as that would cause a
hang.

The new test case 1507 verifies this behavior.

Reported by: Patricia Muscalu
Bug: http://curl.haxx.se/bug/view.cgi?id=1184
2013-02-08 13:57:01 +01:00
Daniel Stenberg
07f97809b8 FAQ: refreshed some phrases 2013-02-08 09:58:23 +01:00
Nick Zitzmann
9613cf7211 darwinssl: Fix build under Leopard
It turns out that Leopard (OS X 10.5) doesn't have constants for the ECDH
ciphers in its headers, so the cases for them have been taken out of the
build when building under Leopard. Also added a standard function for
getting a string description of a SecCertificateRef.
2013-02-07 18:57:53 -07:00
Steve Holme
ce4b554e5d RELEASE-NOTES: Added new imap features 2013-02-07 21:20:11 +00:00
Steve Holme
6da7dc026c imap: Added support for SASL-IR extension (Part 2)
Modified imap_authenticate() to add support for sending the initial
response with the AUTHENTICATE command, as per RFC4959.
2013-02-07 21:06:53 +00:00
Steve Holme
e07385f853 smtp: Updated SMTP_AUTH_PASSWD state constant
Changed the SMTP_AUTH_PASSWD state constant to SMTP_AUTH_LOGIN_PASSWD to
better describe the state as the second part of an AUTH LOGIN command,
as well as for consistency with the imap and pop3 modules.
2013-02-07 20:37:11 +00:00
Steve Holme
86dfcf737d imap: Added support for SASL-IR extension (Part 1)
Introduced detection of the SASL-IR capability, in order to add support
for sending the initial response with the AUTHENTICATE command, as per
RFC4959.
2013-02-07 20:02:06 +00:00
Daniel Stenberg
4ed469a56f Revert "vc: remove explicit MSVC6 IDE project file and documentation"
This reverts commit 0e66d5878e.
2013-02-07 14:58:01 +01:00
Steve Holme
7704621f4c imap: Changed response tag generation to be completely unique
Updated the automatic response tag generation to follow the examples
given in RC3501, which list a 4 character string such as A001, A002,
etc.

As a unique identifier should be generated for each command the string
generation is based on the connection id and the incrementing command
id.
2013-02-07 00:18:23 +00:00
Dan Fandrich
542507f316 Tweak the Android.mk file for its new location
This is untested, but ought to be enough to still allow it
to work automatically when the entire curl source tree is
dropped into a full Android source tree.
2013-02-06 23:44:49 +01:00
Daniel Stenberg
0e66d5878e vc: remove explicit MSVC6 IDE project file and documentation
VC6 is _very_ old and we provide working makefiles even for that
compiler. Users who build with the IDE never use that method and project
file anyway and it was just lingering in the root dir.
2013-02-06 23:30:41 +01:00
Steve Holme
cecb9c0f71 imap: Small variable rename in preparation for upcoming change
Renamed a couple of variables and updated some comments in
preparation for upcoming command id / response tag change.
2013-02-06 22:22:57 +00:00
Daniel Stenberg
632e50ca8d msvc: move Makefile.msvc.names into winbuild/
In an attempt to clear up misc files from the root dir
2013-02-06 23:14:11 +01:00
Daniel Stenberg
7be925aefc build: move Android.mk to packages/Android/ 2013-02-06 23:08:05 +01:00
Daniel Stenberg
611ec0a190 emacs files: remove from git and dist
We don't need them and I doubt many people used them. We also don't have
any configs for other editors and we wouldn't want that.
2013-02-06 23:04:02 +01:00
Steve Holme
de0410fe9a email: Moved starttls code in separate functions
To help maintain the readability of the code in imap.c, pop3.c and
smtp.c moved the starttls code into state_starttls() functions.
2013-02-06 20:02:36 +00:00
Nick Zitzmann
12dbb8aedc FEATURES: More NTLM and SSL changes, added two others, fixed typo
Added IDN and HTTP data compression as they were left out of the
document until now.

Added notes for qssl, schannel and Secure Transport supporting SSLv2,
Secure Transport supports NTLM, and axTLS does not support SSLv3.

There was also a typo; "AUTH TSL" should be "AUTH TLS".
2013-02-06 19:42:44 +00:00
Kamil Dudka
d23d69e14e curl-config.in: do not randomly mix tabs and spaces 2013-02-06 15:04:57 +01:00
Daniel Stenberg
2488a01337 7.29.1: onwards! 2013-02-06 14:50:39 +01:00
Daniel Stenberg
0a4bb75bc5 THANKS: 12 contributors from 7.29.0 2013-02-06 11:52:22 +01:00
Daniel Stenberg
bf633a584d vms: config-vms.h is removed, no use trying to distribute it 2013-02-06 11:11:55 +01:00
Daniel Stenberg
0f1deac71e RELEASE-NOTES: mention the SASL buffer overflow 2013-02-06 11:06:33 +01:00
Eldar Zaitov
f206d6c055 Curl_sasl_create_digest_md5_message: fix buffer overflow
When negotiating SASL DIGEST-MD5 authentication, the function
Curl_sasl_create_digest_md5_message() uses the data provided from the
server without doing the proper length checks and that data is then
appended to a local fixed-size buffer on the stack.

This vulnerability can be exploited by someone who is in control of a
server that a libcurl based program is accessing with POP3, SMTP or
IMAP. For applications that accept user provided URLs, it is also
thinkable that a malicious user would feed an application with a URL to
a server hosting code targetting this flaw.

Bug: http://curl.haxx.se/docs/adv_20130206.html
2013-02-06 11:06:33 +01:00
Steve Holme
add37cc49f FEATURES: Removed erroneous whitespace
Removed whitespace introduced in commit 5f8f20f5e6 that caused
formatting issues when generating the website docs.
2013-02-06 09:29:50 +00:00
Yang Tse
85625c5e28 setup-vms.h: post VMS patch cleanup - III
- rename post-config-vms.h to setup-vms.h
- move its inclusion into proper location in curl_setup.h
2013-02-06 04:53:34 +01:00
Yang Tse
453e821ad7 vms_show: post VMS patch cleanup - II
- remove multiple declarations of vms_show and add comments
2013-02-06 04:51:55 +01:00
Yang Tse
e0c491026f tool_main.c: post VMS patch cleanup - I
- remove header inclusion already done in curl_setup_once.h
2013-02-06 04:51:00 +01:00
Steve Holme
12f4ea50f7 FEATURES: Added SSPI to list of NTLM libraries 2013-02-06 00:36:54 +00:00
Steve Holme
ae6b5f1772 FEATURES: Added Secure Transport and qssl to list of SSL libraries 2013-02-06 00:30:08 +00:00
Steve Holme
5f8f20f5e6 FEATURES: Added email feature set
Added SMTP, SMTPS, POP3, POP3S, IMAP and IMAPS features.
2013-02-06 00:28:50 +00:00
Steve Holme
33a182e6c2 imap.h: Corrected incorrect comment clarification
Corrected comment clarification made in commit 167717b806.
2013-02-05 23:59:47 +00:00
Steve Holme
68de6a0b3e COPYING: Updated copyright year to include 2013 2013-02-05 23:05:50 +00:00
Daniel Stenberg
25d13822ae RELEASE-NOTES: synced with 25f351424b
8 more bug fixes mentioned
2013-02-05 23:19:19 +01:00
John E. Malmberg
25f351424b VMS: fix and generate the VMS build config
config_h.com is a new file that generates a config.h file based on the
curl_config.h.in file and a quick scan of the configure script.  This is
actually a generic procedure that is shared with other VMS packages.

The existing pre-built config-vms.h had over 100 entries that were not
correct and in some cases conflicted with the build options available in
the build_vms.com.

generate_config_vms_h_curl.com is a helper procedure to the
config_h.com.  It covers the cases that the generic config_h.com is not
able to figure out, and accepts input from the build_vms.com procedure.

build_curlbuild_h.com is a new file to generate the curlbuild.h file
that Curl is now using when it is using a curl_config.h file.

post-config-vms.h is a new file that is needed to provide VMS specific
definitions, and most of them need to be set before the system header
files are included.

The VMS build procedure is fixed:

   1. Fixed to link in the correct HP ssl library.
   2. Fixed to detect if HP Kerberos is installed.
   3. Fixed to detect if HP LDAP is installed.
   4. Fixed to detect if gnv$libzshr is installed.
   5. Simplified the input parameter parsing to not use a loop.
   6. Warn that 64 bit pointer option support is not complete
      in comments.
   7. Default to IEEE floating if platform supports it so
      resulting libcurl will be compatible with other
      open source projects on VMS.
   8. Default to LARGEFILE if platform supports it.
   9. Default to enable SSL, LDAP, Kerberos, libz
      if the libraries are present.
   10. Build with exact case global symbols for libcurl.
   11. Generate linker option file needed.
   12. Compiler list option only commonly needed items.
   13. fulllist option for those who really want it.
   14. Create debug symbol file on Alpha, IA64.
2013-02-05 23:08:57 +01:00
Daniel Stenberg
cb3e6dfa35 Curl_proxyCONNECT: return once CONNECT is sent
By doing this unconditionally, we infer a simpler and more defined
behavior. This also has the upside that test 1021 no longer fails for me
even if I run with valgrind.

Also fixed some wrong comments.
2013-02-05 23:06:00 +01:00
Steve Holme
1d22407863 email: Reworked comments in the endofresp() functions
Tidied up the comments in the endofresp() functions to be more
meaningful prior to release.
2013-02-05 21:09:34 +00:00
Marc Hoersken
bb7c2ee37c schannel: Removed extended error connection setup flag
According KB975858 this flag may cause problems on Windows 7 and
Windows Server 2008 R2 systems. Extended error information is not
currently used by libcurl and therefore not a requirement.

The flag may improve the SSL-connection shutdown in case of an
error. This means it might be a good improvement in the future.

Fixes bug/issue #1187 - thanks for the report
2013-02-05 22:02:45 +01:00
Tor Arntsen
278ab75e9f singleipconnect: Update *sockp for all CURLE_OK
The 56b7c87c7 change left a case where a good sockfd was not copied to
*sockp before returning with CURLE_OK
2013-02-05 17:58:28 +01:00
Daniel Stenberg
0d1b754376 curl_easy_perform: Value stored to 'mcode' is never read
pointed out by clang-analyzer
2013-02-05 14:09:18 +01:00