1
0
mirror of https://github.com/moparisthebest/curl synced 2024-12-24 09:08:49 -05:00
Commit Graph

9728 Commits

Author SHA1 Message Date
Viktor Szakats
6f86022df2 ntlm: use strict order for SSL backend #if branches
With the recently introduced MultiSSL support multiple SSL backends
can be compiled into cURL That means that now the order of the SSL

One option would be to use the same SSL backend as was configured
via `curl_global_sslset()`, however, NTLMv2 support would appear
to be available only with some SSL backends. For example, when
eb88d778e (ntlm: Use Windows Crypt API, 2014-12-02) introduced
support for NTLMv1 using Windows' Crypt API, it specifically did
*not* introduce NTLMv2 support using Crypt API at the same time.

So let's select one specific SSL backend for NTLM support when
compiled with multiple SSL backends, using a priority order such
that we support NTLMv2 even if only one compiled-in SSL backend can
be used for that.

Ref: https://github.com/curl/curl/pull/1848
2017-09-22 19:01:28 +00:00
Daniel Stenberg
3b05f79ef8
imap: quote atoms properly when escaping characters
Updates test 800 to verify

Fixes #1902
Closes #1903
2017-09-22 14:43:37 +02:00
Daniel Stenberg
b8e0fe19ec
vtls: provide curl_global_sslset() even in non-SSL builds
... it just returns error:

Bug: 1328f69d53 (commitcomment-24470367)
Reported-by: Marcel Raad

Closes #1906
2017-09-22 12:09:13 +02:00
Patrick Monnerat
ee56fdb691 form/mime: field names are not allowed to contain zero-valued bytes.
Also suppress length argument of curl_mime_name() (names are always
zero-terminated).
2017-09-22 01:08:29 +01:00
Dirk Feytons
fa9482ab09
openssl: only verify RSA private key if supported
In some cases the RSA key does not support verifying it because it's
located on a smart card, an engine wants to hide it, ...
Check the flags on the key before trying to verify it.
OpenSSL does the same thing internally; see ssl/ssl_rsa.c

Closes #1904
2017-09-21 20:17:06 +02:00
Patrick Monnerat
a7bcf274cc mime: rephrase the multipart output state machine (#1898) ...
... in hope coverity will like it much.
2017-09-20 14:06:47 +01:00
Patrick Monnerat
f304201868 mime: fix an explicit null dereference (#1899) 2017-09-20 12:01:11 +01:00
Daniel Stenberg
1e548f7784
smtp: fix memory leak in OOM
Regression since ce0881edee

Coverity CID 1418139 and CID 1418136 found it, but it was also seen in
torture testing.
2017-09-20 11:33:46 +02:00
Pavel P
5fe85587cc
cookies: use lock when using CURLINFO_COOKIELIST
Closes #1896
2017-09-19 23:48:48 +02:00
Daniel Stenberg
bec50cc285
mime:escape_string minor clarification change
... as it also removes a warning with old gcc versions.

Bug: https://curl.haxx.se/mail/lib-2017-09/0049.html
Reported-by: Ben Greear
2017-09-18 23:15:41 +02:00
Daniel Stenberg
2bc230de63
cookies: reject oversized cookies
... instead of truncating them.

There's no fixed limit for acceptable cookie names in RFC 6265, but the
entire cookie is said to be less than 4096 bytes (section 6.1). This is
also what browsers seem to implement.

We now allow max 5000 bytes cookie header. Max 4095 bytes length per
cookie name and value. Name + value together may not exceed 4096 bytes.

Added test 1151 to verify

Bug: https://curl.haxx.se/mail/lib-2017-09/0062.html
Reported-by: Kevin Smith

Closes #1894
2017-09-18 22:55:50 +02:00
Jay Satiro
6d436642dd socks: fix incorrect port number in SOCKS4 error message
Prior to this change it appears the SOCKS5 port parsing was erroneously
used for the SOCKS4 error message, and as a result an incorrect port
would be shown in the error message.

Bug: https://github.com/curl/curl/issues/1892
Reported-by: Jackarain@users.noreply.github.com
2017-09-18 03:07:57 -04:00
Marc Aldorasi
c8666089c8 schannel: Support partial send for when data is too large
Schannel can only encrypt a certain amount of data at once.  Instead of
failing when too much data is to be sent at once, send as much data as
we can and let the caller send the remaining data by calling send again.

Bug: https://curl.haxx.se/mail/lib-2014-07/0033.html

Closes https://github.com/curl/curl/pull/1890
2017-09-16 03:19:35 -04:00
David Benjamin
843200c5b9 openssl: add missing includes
lib/vtls/openssl.c uses OpenSSL APIs from BUF_MEM and BIO APIs. Include
their headers directly rather than relying on other OpenSSL headers
including things.

Closes https://github.com/curl/curl/pull/1891
2017-09-16 03:11:18 -04:00
Daniel Stenberg
93843c372f
conversions: fix several compiler warnings 2017-09-15 16:58:35 +02:00
Daniel Stenberg
46e14b6942
non-ascii: use iconv() with 'char **' argument
Bug: https://curl.haxx.se/mail/lib-2017-09/0031.html
2017-09-15 16:56:23 +02:00
Daniel Stenberg
2fc1db56cd
escape.c: error: pointer targets differ in signedness 2017-09-15 16:56:23 +02:00
Max Dymond
08dbed31d5
rtsp: Segfault in rtsp.c when using WRITEDATA
If the INTERLEAVEFUNCTION is defined, then use that plus the
INTERLEAVEDATA information when writing RTP. Otherwise, use
WRITEFUNCTION and WRITEDATA.

Fixes #1880
Closes #1884
2017-09-15 15:43:48 +02:00
Daniel Stenberg
22708eae40
URL: on connection re-use, still pick the new remote port
... as when a proxy connection is being re-used, it can still get a
different remote port.

Fixes #1887
Reported-by: Oli Kingshott
2017-09-14 16:49:40 +02:00
Daniel Stenberg
87501e57f1
code style: remove wrong uses of multiple spaces
Closes #1878
2017-09-12 13:54:54 +02:00
Daniel Stenberg
59813726d1
checksrc: detect and warn for multiple spaces 2017-09-12 09:50:24 +02:00
Daniel Stenberg
20acb58a38
code style: use space after semicolon 2017-09-12 09:50:24 +02:00
Daniel Stenberg
67ade28571
checksrc: verify space after semicolons 2017-09-12 09:50:24 +02:00
Daniel Stenberg
e5743f08e7
code style: use spaces around pluses 2017-09-11 09:29:50 +02:00
Daniel Stenberg
ca86006deb
checksrc: detect and warn for lack of spaces next to plus signs 2017-09-11 09:29:50 +02:00
Daniel Stenberg
6b84438d9a
code style: use spaces around equals signs 2017-09-11 09:29:50 +02:00
Daniel Stenberg
e155f38d1e
checksrc: verify spaces around equals signs
... as the code style mandates.
2017-09-11 09:27:28 +02:00
Daniel Stenberg
02eb6184ad
Curl_checkheaders: make it available for IMAP and SMTP too
... not only HTTP uses this now.

Closes #1875
2017-09-11 00:26:17 +02:00
Jay Satiro
64bb7ae6ae mbedtls: enable CA path processing
CA path processing was implemented when mbedtls.c was added to libcurl
in fe7590f, but it was never enabled.

Bug: https://github.com/curl/curl/issues/1877
Reported-by: SBKarr@users.noreply.github.com
2017-09-10 03:22:05 -04:00
Daniel Stenberg
a14f7152ce
rtsp: do not call fwrite() with NULL pointer FILE *
If the default write callback is used and no destination has been set, a
NULL pointer would be passed to fwrite()'s 4th argument.

OSS-fuzz bug https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3327
(not publicly open yet)

Detected by OSS-fuzz
Closes #1874
2017-09-08 23:56:02 +02:00
Daniel Stenberg
9ef50ee0a4
http-proxy: when not doing CONNECT, that phase is done immediately
`conn->connect_state` is NULL when doing a regular non-CONNECT request
over the proxy and should therefor be considered complete at once.

Fixes #1853
Closes #1862
Reported-by: Lawrence Wagerfield
2017-09-07 16:11:38 +02:00
Johannes Schindelin
f4a623825b
OpenSSL: fix yet another mistake while encapsulating SSL backend data
Another mistake in my manual fixups of the largely mechanical
search-and-replace ("connssl->" -> "BACKEND->"), just like the previous
commit concerning HTTPS proxies (and hence not caught during my
earlier testing).

Fixes #1855
Closes #1871

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-09-07 16:08:24 +02:00
Johannes Schindelin
dde4f5c81a
OpenSSL: fix erroneous SSL backend encapsulation
In d65e6cc4f (vtls: prepare the SSL backends for encapsulated private
data, 2017-06-21), this developer prepared for a separation of the
private data of the SSL backends from the general connection data.

This conversion was partially automated (search-and-replace) and
partially manual (e.g. proxy_ssl's backend data).

Sadly, there was a crucial error in the manual part, where the wrong
handle was used: rather than connecting ssl[sockindex]' BIO to the
proxy_ssl[sockindex]', we reconnected proxy_ssl[sockindex]. The reason
was an incorrect location to paste "BACKEND->"... d'oh.

Reported by Jay Satiro in https://github.com/curl/curl/issues/1855.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-09-07 16:06:50 +02:00
Jay Satiro
955c21939e
vtls: fix memory corruption
Ever since 70f1db321 (vtls: encapsulate SSL backend-specific data,
2017-07-28), the code handling HTTPS proxies was broken because the
pointer to the SSL backend data was not swapped between
conn->ssl[sockindex] and conn->proxy_ssl[sockindex] as intended, but
instead set to NULL (causing segmentation faults).

[jes: provided the commit message, tested and verified the patch]

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-09-07 16:06:50 +02:00
Daniel Stenberg
4bb80d532e
vtls: switch to CURL_SHA256_DIGEST_LENGTH define
... instead of the prefix-less version since WolfSSL 3.12 now uses an
enum with that name that causes build failures for us.

Fixes #1865
Closes #1867
Reported-by: Gisle Vanem
2017-09-07 15:59:42 +02:00
Jay Satiro
70a69f3718 SSL: fix unused parameter warnings 2017-09-06 15:11:55 -04:00
Patrick Monnerat
c96d96bc5f mime: drop internal FILE * support.
- The part kind MIMEKIND_FILE and associated code are suppressed.
- Seek data origin offset not used anymore: suppressed.
- MIMEKIND_NAMEDFILE renamed MIMEKIND_FILE; associated fields/functions
  renamed accordingly.
- Curl_getformdata() processes stdin via a callback.
2017-09-06 13:42:03 +01:00
Daniel Stenberg
d1da545a68
configure: remove --enable-soname-bump and SONAME_BUMP
Back in 2008, (and commit 3f3d6ebe66) we changed the logic in how we
determine the native type for `curl_off_t`. To really make sure we
didn't break ABI without bumping SONAME, we introduced logic that
attempted to detect that it would use a different size and thus not be
compatible. We also provided a manual switch that allowed users to tell
configure to bump SONAME by force.

Today, we know of no one who ever got a SONAME bump auto-detected and we
don't know of anyone who's using the manual bump feature. The auto-
detection is also no longer working since we introduced defining
curl_off_t in system.h (7.55.0).

Finally, this bumping logic is not present in the cmake build.

Closes #1861
2017-09-06 08:43:36 +02:00
Gisle Vanem
61825be02b vtls: select ssl backend case-insensitive (follow-up)
- Do a case-insensitive comparison of CURL_SSL_BACKEND env as well.

- Change Curl_strcasecompare calls to strcasecompare
  (maps to the former but shorter).

Follow-up to c290b8f.

Bug: https://github.com/curl/curl/commit/c290b8f#commitcomment-24094313

Co-authored-by: Jay Satiro
2017-09-06 02:27:33 -04:00
Jay Satiro
6cdba64e13 openssl: Integrate Peter Wu's SSLKEYLOGFILE implementation
This is an adaptation of 2 of Peter Wu's SSLKEYLOGFILE implementations.

The first one, written for old OpenSSL versions:
https://git.lekensteyn.nl/peter/wireshark-notes/tree/src/sslkeylog.c

The second one, written for BoringSSL and new OpenSSL versions:
https://github.com/curl/curl/pull/1346

Note the first one is GPL licensed but the author gave permission to
waive that license for libcurl.

As of right now this feature is disabled by default, and does not have
a configure option to enable it. To enable this feature define
ENABLE_SSLKEYLOGFILE when building libcurl and set environment
variable SSLKEYLOGFILE to a pathname that will receive the keys.

And in Wireshark change your preferences to point to that key file:
Edit > Preferences > Protocols > SSL > Master-Secret

Co-authored-by: Peter Wu

Ref: https://github.com/curl/curl/pull/1030
Ref: https://github.com/curl/curl/pull/1346

Closes https://github.com/curl/curl/pull/1866
2017-09-05 23:56:54 -04:00
Patrick Monnerat
ee5725fb5e mime: fix a trivial warning. 2017-09-05 18:38:31 +01:00
Patrick Monnerat
c1d0b6f98e mime: replace 'struct Curl_mimepart' by 'curl_mimepart' in encoder code.
mime_state is now a typedef.
2017-09-05 18:20:06 +01:00
Patrick Monnerat
63ef436ea1 mime: implement encoders.
curl_mime_encoder() is operational and documented.
curl tool -F option is extended with ";encoder=".
curl tool --libcurl option generates calls to curl_mime_encoder().
New encoder tests 648 & 649.
Test 1404 extended with an encoder specification.
2017-09-05 17:55:51 +01:00
Daniel Stenberg
9926357b42 mime: unified to use the typedef'd mime structs everywhere
... and slightly edited to follow our code style better.
2017-09-05 17:33:16 +01:00
Kamil Dudka
ea142a837e openssl: use OpenSSL's default ciphers by default
Up2date versions of OpenSSL maintain the default reasonably secure
without breaking compatibility, so it is better not to override the
default by curl.  Suggested at https://bugzilla.redhat.com/1483972

Closes #1846
2017-09-05 12:13:38 +02:00
Daniel Stenberg
3130414ce7
http-proxy: treat all 2xx as CONNECT success
Added test 1904 to verify.

Reported-by: Lawrence Wagerfield
Fixes #1859
Closes #1860
2017-09-05 09:47:46 +02:00
Viktor Szakats
841a09ea19 mime: use CURL_ZERO_TERMINATED in examples
and some minor whitespace fixes
2017-09-04 13:58:10 +00:00
Daniel Stenberg
202c1cc22f
schannel: return CURLE_SSL_CACERT on failed verification
... not *CACERT_BADFILE as it isn't really because of a bad file.

Bug: https://curl.haxx.se/mail/lib-2017-09/0002.html
Closes #1858
2017-09-04 11:48:38 +02:00
Patrick Monnerat
1ab9e9b50a lib: bump version info (soname). Adapt and reenable test 1135. 2017-09-04 00:35:53 +01:00
Patrick Monnerat
efd9301426 mime: use size_t instead of ssize_t in public API interface.
To support telling a string is nul-terminated, symbol CURL_ZERO_TERMINATED
has been introduced.

Documentation updated accordingly.

symbols in versions updated. Added form API symbols deprecation info.
2017-09-03 16:10:55 +01:00
Patrick Monnerat
1a3f4c1991 mime: remove support "-" stdin pseudo-file name in curl_mime_filedata().
This feature is badly supported in Windows: as a replacement, a caller has
to use curl_mime_data_cb() with fread, fseek and possibly fclose
callbacks to process opened files.

The cli tool and documentation are updated accordingly.

The feature is however kept internally for form API compatibility, with
the known caveats it always had.

As a side effect, stdin size is not determined by the cli tool even if
possible and this results in a chunked transfer encoding. Test 173 is
updated accordingly.
2017-09-03 14:45:43 +01:00
Patrick Monnerat
045b076ae8 mime: fix some implicit curl_off_t --> size_t conversion warnings. 2017-09-03 10:18:58 +01:00
Patrick Monnerat
ce0881edee mime: new MIME API.
Available in HTTP, SMTP and IMAP.
Deprecates the FORM API.
See CURLOPT_MIMEPOST.
Lib code and associated documentation.
2017-09-02 17:47:10 +01:00
Patrick Monnerat
ea4e7bdc81 checksrc: disable SPACEBEFOREPAREN for case statement.
The case keyword may be followed by a constant expression and thus should
allow it to start with an open parenthesis.
2017-09-02 12:58:55 +01:00
Patrick Monnerat
6869d65f54 Curl_base64_encode: always call with a real data handle.
Some calls in different modules were setting the data handle to NULL, causing
segmentation faults when using builds that enable character code conversions.
2017-09-02 12:49:59 +01:00
Patrick Monnerat
70231d6a65 non-ascii: allow conversion functions to be called with a NULL data handle. 2017-09-02 12:45:21 +01:00
Patrick Monnerat
3b51fa6285 http: fix a memory leakage in checkrtspprefix(). 2017-09-02 12:40:19 +01:00
Daniel Stenberg
c290b8fb23
curl_global_sslset: select backend by name case insensitively
Closes #1849
2017-09-01 11:51:32 +02:00
Daniel Stenberg
222e65fd78
strcase: corrected comment header for Curl_strcasecompare() 2017-08-31 11:37:36 +02:00
Jay Satiro
aa2ea66cda darwinssl: handle long strings in TLS certs (follow-up)
- Fix handling certificate subjects that are already UTF-8 encoded.

Follow-up to b3b75d1 from two days ago. Since then a copy would be
skipped if the subject was already UTF-8, possibly resulting in a NULL
deref later on.

Ref: https://github.com/curl/curl/issues/1823
Ref: https://github.com/curl/curl/pull/1831

Closes https://github.com/curl/curl/pull/1836
2017-08-31 02:37:35 -04:00
Daniel Stenberg
410bf6b7b1
cyassl: call it the "WolfSSL" backend
... instead of cyassl, as this is the current name for it.

Closes #1844
2017-08-31 00:55:36 +02:00
Daniel Stenberg
5734f73f0d
polarssl: fix multissl breakage
Reported-by: Dan Fandrich
Bug: https://curl.haxx.se/mail/lib-2017-08/0121.html
Closes #1843
2017-08-31 00:53:05 +02:00
Viktor Szakats
c86e21b624 makefile.m32: add multissl support
Closes https://github.com/curl/curl/pull/1840
2017-08-30 10:44:50 +00:00
Dan Fandrich
df29455dbc asyn-thread: Fixed cleanup after OOM
destroy_async_data() assumes that if the flag "done" is not set yet, the
thread itself will clean up once the request is complete.  But if an
error (generally OOM) occurs before the thread even has a chance to
start, it will never get a chance to clean up and memory will be leaked.
By clearing "done" only just before starting the thread, the correct
cleanup sequence will happen in all cases.
2017-08-29 00:35:19 +02:00
Dan Fandrich
d5d736726c asyn-thread: Improved cleanup after OOM situations 2017-08-28 23:55:55 +02:00
Dan Fandrich
11a8778e0b asyn-thread: Set errno to the proper value ENOMEM in OOM situation
This used to be set in some configurations to EAI_MEMORY which is not a
valid value for errno and caused Curl_strerror to fail an assertion.
2017-08-28 23:55:55 +02:00
Johannes Schindelin
c7170e20d0
configure: allow setting the default SSL backend
Previously, we used as default SSL backend whatever was first in the
`available_backends` array.

However, some users may want to override that default without patching
the source code.

Now they can: with the --with-default-ssl-backend=<backend> option of
the ./configure script.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 22:56:50 +02:00
Johannes Schindelin
3063254e32
vtls: use Curl_ssl_multi pseudo backend only when needed
When only one SSL backend is configured, it is totally unnecessary to
let multissl_init() configure the backend at runtime, we can select the
correct backend at build time already.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 22:56:49 +02:00
Johannes Schindelin
81d318fa95
version: if built with more than one SSL backend, report all of them
To discern the active one from the inactive ones, put the latter into
parentheses.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 22:56:49 +02:00
Johannes Schindelin
9d96a5f0b5
version: add the CURL_VERSION_MULTI_SSL feature flag
This new feature flag reports When cURL was built with multiple SSL
backends.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 22:56:49 +02:00
Johannes Schindelin
1328f69d53
vtls: introduce curl_global_sslset()
Let's add a compile time safe API to select an SSL backend. This
function needs to be called *before* curl_global_init(), and can be
called only once.

Side note: we do not explicitly test that it is called before
curl_global_init(), but we do verify that it is not called multiple times
(even implicitly).

If SSL is used before the function was called, it will use whatever the
CURL_SSL_BACKEND environment variable says (or default to the first
available SSL backend), and if a subsequent call to
curl_global_sslset() disagrees with the previous choice, it will fail
with CURLSSLSET_TOO_LATE.

The function also accepts an "avail" parameter to point to a (read-only)
NULL-terminated list of available backends. This comes in real handy if
an application wants to let the user choose between whatever SSL backends
the currently available libcurl has to offer: simply call

	curl_global_sslset(-1, NULL, &avail);

which will return CURLSSLSET_UNKNOWN_BACKEND and populate the avail
variable to point to the relevant information to present to the user.

Just like with the HTTP/2 push functions, we have to add the function
declaration of curl_global_sslset() function to the header file
*multi.h* because VMS and OS/400 require a stable order of functions
declared in include/curl/*.h (where the header files are sorted
alphabetically). This looks a bit funny, but it cannot be helped.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:59 +02:00
Johannes Schindelin
b59288f881
vtls: refactor out essential information about the SSL backends
There is information about the compiled-in SSL backends that is really
no concern of any code other than the SSL backend itself, such as which
function (if any) implements SHA-256 summing.

And there is information that is really interesting to the user, such as
the name, or the curl_sslbackend value.

Let's factor out the latter into a publicly visible struct. This
information will be used in the upcoming API to set the SSL backend
globally.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:58 +02:00
Johannes Schindelin
b0989cd3ab
vtls: allow selecting which SSL backend to use at runtime
When building software for the masses, it is sometimes not possible to
decide for all users which SSL backend is appropriate.

Git for Windows, for example,  uses cURL to perform clones, fetches and
pushes via HTTPS, and some users strongly prefer OpenSSL, while other
users really need to use Secure Channel because it offers
enterprise-ready tools to manage credentials via Windows' Credential
Store.

The current Git for Windows versions use the ugly work-around of
building libcurl once with OpenSSL support and once with Secure Channel
support, and switching out the binaries in the installer depending on
the user's choice.

Needless to say, this is a super ugly workaround that actually only
works in some cases: Git for Windows also comes in a portable form, and
in a form intended for third-party applications requiring Git
functionality, in which cases this "swap out libcurl-4.dll" simply is
not an option.

Therefore, the Git for Windows project has a vested interest in teaching
cURL to make the SSL backend a *runtime* option.

This patch makes that possible.

By running ./configure with multiple --with-<backend> options, cURL will
be built with multiple backends.

For the moment, the backend can be configured using the environment
variable CURL_SSL_BACKEND (valid values are e.g. "openssl" and
"schannel").

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:58 +02:00
Johannes Schindelin
a53bda35e9
vtls: fold the backend ID into the Curl_ssl structure
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:58 +02:00
Johannes Schindelin
a243ce7ab2
curl_ntlm_core: don't complain but #include OpenSSL header if needed
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:58 +02:00
Johannes Schindelin
70f1db321a
vtls: encapsulate SSL backend-specific data
So far, all of the SSL backends' private data has been declared as
part of the ssl_connect_data struct, in one big #if .. #elif .. #endif
block.

This can only work as long as the SSL backend is a compile-time option,
something we want to change in the next commits.

Therefore, let's encapsulate the exact data needed by each SSL backend
into a private struct, and let's avoid bleeding any SSL backend-specific
information into urldata.h. This is also necessary to allow multiple SSL
backends to be compiled in at the same time, as e.g. OpenSSL's and
CyaSSL's headers cannot be included in the same .c file.

To avoid too many malloc() calls, we simply append the private structs
to the connectdata struct in allocate_conn().

This requires us to take extra care of alignment issues: struct fields
often need to be aligned on certain boundaries e.g. 32-bit values need to
be stored at addresses that divide evenly by 4 (= 32 bit / 8
bit-per-byte).

We do that by assuming that no SSL backend's private data contains any
fields that need to be aligned on boundaries larger than `long long`
(typically 64-bit) would need. Under this assumption, we simply add a
dummy field of type `long long` to the `struct connectdata` struct. This
field will never be accessed but acts as a placeholder for the four
instances of ssl_backend_data instead. the size of each ssl_backend_data
struct is stored in the SSL backend-specific metadata, to allow
allocate_conn() to know how much extra space to allocate, and how to
initialize the ssl[sockindex]->backend and proxy_ssl[sockindex]->backend
pointers.

This would appear to be a little complicated at first, but is really
necessary to encapsulate the private data of each SSL backend correctly.
And we need to encapsulate thusly if we ever want to allow selecting
CyaSSL and OpenSSL at runtime, as their headers cannot be included within
the same .c file (there are just too many conflicting definitions and
declarations for that).

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:58 +02:00
Johannes Schindelin
d65e6cc4fc
vtls: prepare the SSL backends for encapsulated private data
At the moment, cURL's SSL backend needs to be configured at build time.
As such, it is totally okay for them to hard-code their backend-specific
data in the ssl_connect_data struct.

In preparation for making the SSL backend a runtime option, let's make
the access of said private data a bit more abstract so that it can be
adjusted later in an easy manner.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:58 +02:00
Johannes Schindelin
20c6cf7e95
urldata.h: move SSPI-specific #include to correct location
In 86b889485 (sasl_gssapi: Added GSS-API based Kerberos V5 variables,
2014-12-03), an SSPI-specific field was added to the kerberos5data
struct without moving the #include "curl_sspi.h" later in the same file.

This broke the build when SSPI was enabled, unless Secure Channel was
used as SSL backend, because it just so happens that Secure Channel also
requires "curl_sspi.h" to be #included.

In f4739f639 (urldata: include curl_sspi.h when Windows SSPI is enabled,
2017-02-21), this bug was fixed incorrectly: Instead of moving the
appropriate conditional #include, the Secure Channel-conditional part
was now also SSPI-conditional.

Fix this problem by moving the correct #include instead.

This is also required for an upcoming patch that moves all the Secure
Channel-specific stuff out of urldata.h and encapsulates it properly in
vtls/schannel.c instead.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:58 +02:00
Johannes Schindelin
583cb03f91
urldata.h: remove support for obsolete PolarSSL version
Since 5017d5ada (polarssl: now require 1.3.0+, 2014-03-17), we require
a newer PolarSSL version. No need to keep code trying to support any
older version.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:57 +02:00
Johannes Schindelin
69039fd1fa
getinfo: access SSL internals via Curl_ssl
In the ongoing endeavor to abstract out all SSL backend-specific
functionality, this is the next step: Instead of hard-coding how the
different SSL backends access their internal data in getinfo.c, let's
implement backend-specific functions to do that task.

This will also allow for switching SSL backends as a runtime option.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:57 +02:00
Johannes Schindelin
118b074fba
vtls: move SSL backends' private constants out of their header files
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:57 +02:00
Johannes Schindelin
5d9fcd2165
axtls: use Curl_none_* versions of init() and cleanup()
There are convenient no-op versions of the init/cleanup functions now,
no need to define private ones for axTLS.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:57 +02:00
Johannes Schindelin
6f1eec14e0
vtls: remove obsolete declarations of SSL backend functionality
These functions are all available via the Curl_ssl struct now, no need
to declare them separately anymore.

As the global declarations are removed, the corresponding function
definitions are marked as file-local. The only two exceptions here are
Curl_mbedtls_shutdown() and Curl_polarssl_shutdown(): only the
declarations were removed, there are no function definitions to mark
file-local.

Please note that Curl_nss_force_init() is *still* declared globally, as
the only SSL backend-specific function, because it was introduced
specifically for the use case where cURL was compiled with
`--without-ssl --with-nss`. For details, see f3b77e561 (http_ntlm: add
support for NSS, 2010-06-27).

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:57 +02:00
Johannes Schindelin
742ddc9d8f
schannel: reorder functions topologically
The _shutdown() function calls the _session_free() function; While this
is not a problem now (because schannel.h declares both functions), a
patch looming in the immediate future with make all of these functions
file-local.

So let's just move the _session_free() function's definition before it
is called.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:57 +02:00
Johannes Schindelin
3ea5461d4e
axtls: reorder functions topologically
The connect_finish() function (like many other functions after it) calls
the Curl_axtls_close() function; While this is not a problem now
(because axtls.h declares the latter function), a patch looming in the
immediate future with make all of these functions file-local.

So let's just move the Curl_axtls_close() function's definition before
it is called.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:57 +02:00
Johannes Schindelin
f0b4db1ab0
vtls: move the SUPPORT_HTTPS_PROXY flag into the Curl_ssl struct
That will allow us to choose the SSL backend at runtime.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:56 +02:00
Johannes Schindelin
937899a3b8
vtls: convert the have_curlssl_* constants to runtime flags
The entire idea of introducing the Curl_ssl struct to describe SSL
backends is to prepare for choosing the SSL backend at runtime.

To that end, convert all the #ifdef have_curlssl_* style conditionals
to use bit flags instead.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:56 +02:00
Johannes Schindelin
0a083a66bc
vtls: move sha256sum into the Curl_ssl struct
The SHA-256 checksumming is also an SSL backend-specific function.
Let's include it in the struct declaring the functionality of SSL
backends.

In contrast to MD5, there is no fall-back code. To indicate this, the
respective entries are NULL for those backends that offer no support for
SHA-256 checksumming.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:56 +02:00
Johannes Schindelin
e35205a0c4
vtls: move md5sum into the Curl_ssl struct
The MD5 summing is also an SSL backend-specific function. So let's
include it, offering the previous fall-back code as a separate function
now: Curl_none_md5sum(). To allow for that, the signature had to be
changed so that an error could be returned from the implementation
(Curl_none_md5sum() can run out of memory).

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:56 +02:00
Johannes Schindelin
52e8237bfc
vtls: use the Curl_ssl struct to access all SSL backends' functionality
This is the first step to unify the SSL backend handling. Now all the
SSL backend-specific functionality is accessed via a global instance of
the Curl_ssl struct.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:56 +02:00
Johannes Schindelin
e09bb63ed8
vtls: declare Curl_ssl structs for every SSL backend
The idea of introducing the Curl_ssl struct was to unify how the SSL
backends are declared and called. To this end, we now provide an
instance of the Curl_ssl struct for each and every SSL backend.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:56 +02:00
Johannes Schindelin
e7e03e47d4
vtls: introduce a new struct for SSL backends
This new struct is similar in nature to Curl_handler: it will define the
functions and capabilities of all the SSL backends (where Curl_handler
defines the functions and capabilities of protocol handlers).

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:56 +02:00
Johannes Schindelin
c9d526cdbf
vtls: make sure every _sha256sum()'s first arg is const
This patch makes the signature of the _sha256sum() functions consistent
among the SSL backends, in preparation for unifying the way all SSL
backends are accessed.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:55 +02:00
Johannes Schindelin
2568cfed2d
vtls: make sure all _data_pending() functions return bool
This patch makes the signature of the _data_pending() functions
consistent among the SSL backends, in preparation for unifying the way
all SSL backends are accessed.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:55 +02:00
Johannes Schindelin
b31d1dcddb
vtls: make sure all _cleanup() functions return void
This patch makes the signature of the _cleanup() functions consistent
among the SSL backends, in preparation for unifying the way all SSL
backends are accessed.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:55 +02:00
Johannes Schindelin
dd02a9a341
vtls: use consistent signature for _random() implementations
This will make the upcoming multissl backend much easier to implement.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-08-28 14:56:55 +02:00
Daniel Stenberg
78b863de7d
strtooff: fix build for systems with long long but no strtoll option
Closes #1829

Reported-by: Dan Fandrich
Bug: https://github.com/curl/curl/pull/1758#issuecomment-324861615
2017-08-27 19:07:38 +02:00
Daniel Stenberg
b3b75d1778
darwinssl: handle long strings in TLS certs
... as the previous fixed length 128 bytes buffer was sometimes too
small.

Fixes #1823
Closes #1831

Reported-by: Benjamin Sergeant
Assisted-by: Bill Pyne, Ray Satiro, Nick Zitzmann
2017-08-27 19:06:02 +02:00
Daniel Stenberg
dff069fdf5
imap: use defined names for response codes
When working on this code I found the previous setup a bit weird while
using proper defines increases readability.

Closes #1824
2017-08-24 16:16:27 +02:00
Daniel Stenberg
befaa7b14f
imap: support PREAUTH
It is a defined possible greeting at server startup that means the
connection is already authenticated. See
https://tools.ietf.org/html/rfc3501#section-7.1.4

Test 846 added to verify.

Fixes #1818
Closes #1820
2017-08-23 23:58:49 +02:00
Jay Satiro
00da16ca5b config-tpf: define SIZEOF_LONG
Recent changes that replaced CURL_SIZEOF_LONG in the source with
SIZEOF_LONG broke builds that use the premade configuration files and
don't have SIZEOF_LONG defined.

Bug: https://github.com/curl/curl/issues/1816
2017-08-23 03:17:10 -04:00
Gisle Vanem
beda1dbe11
config-dos: add missing defines, SIZEOF_* and two others
Bug: #1816
2017-08-22 23:34:47 +02:00
Viktor Szakats
43fb867a58 makefile.m32: add support for libidn2
libidn was replaced with libidn2 last year in configure.
Caveat: libidn2 may depend on a list of further libs.
These can be manually specified via CURL_LDFLAG_EXTRAS.

Closes https://github.com/curl/curl/pull/1815
2017-08-22 07:13:20 +00:00
Viktor Szakats
ebf46317ee config-win32: define SIZEOF_LONG
Recent changes that replaced CURL_SIZEOF_LONG in the source with
SIZEOF_LONG broke builds that use the premade configuration files and
don't have SIZEOF_LONG defined.

Closes https://github.com/curl/curl/pull/1814
2017-08-22 02:24:09 -04:00
Even Rouault
16c71fafb9
tftp: fix memory leak on too long filename
Fixes

$ valgrind --leak-check=full ~/install-curl-git/bin/curl tftp://localhost/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaz

==9752== Memcheck, a memory error detector
==9752== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==9752== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==9752== Command: /home/even/install-curl-git/bin/curl tftp://localhost/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaz
==9752==
curl: (71) TFTP file name too long

==9752==
==9752== HEAP SUMMARY:
==9752== 505 bytes in 1 blocks are definitely lost in loss record 11 of 11
==9752==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==9752==    by 0x4E61CED: Curl_urldecode (in /home/even/install-curl-git/lib/libcurl.so.4.4.0)
==9752==    by 0x4E75868: tftp_state_machine (in /home/even/install-curl-git/lib/libcurl.so.4.4.0)
==9752==    by 0x4E761B6: tftp_do (in /home/even/install-curl-git/lib/libcurl.so.4.4.0)
==9752==    by 0x4E711B6: multi_runsingle (in /home/even/install-curl-git/lib/libcurl.so.4.4.0)
==9752==    by 0x4E71D00: curl_multi_perform (in /home/even/install-curl-git/lib/libcurl.so.4.4.0)
==9752==    by 0x4E6950D: curl_easy_perform (in /home/even/install-curl-git/lib/libcurl.so.4.4.0)
==9752==    by 0x40E0B7: operate_do (in /home/even/install-curl-git/bin/curl)
==9752==    by 0x40E849: operate (in /home/even/install-curl-git/bin/curl)
==9752==    by 0x402693: main (in /home/even/install-curl-git/bin/curl)

Fixes https://oss-fuzz.com/v2/testcase-detail/5232311106797568
Credit to OSS Fuzz

Closes #1808
2017-08-19 23:26:30 +02:00
Daniel Stenberg
9e82d125e6
http2_recv: return error better on fatal h2 errors
Ref #1012
Figured-out-by: Tatsuhiro Tsujikawa
2017-08-18 16:30:36 +02:00
Jan Alexander Steffens (heftig)
74dac344b2
http: Don't wait on CONNECT when there is no proxy
Since curl 7.55.0, NetworkManager almost always failed its connectivity
check by timeout. I bisected this to 5113ad04 (http-proxy: do the HTTP
CONNECT process entirely non-blocking).

This patch replaces !Curl_connect_complete with Curl_connect_ongoing,
which returns false if the CONNECT state was left uninitialized and lets
the connection continue.

Closes #1803
Fixes #1804

Also-fixed-by: Gergely Nagy
2017-08-18 15:25:22 +02:00
Daniel Stenberg
6b9bc5a4fe
CURL_SIZEOF_LONG: removed, use only SIZEOF_LONG 2017-08-17 10:27:00 +02:00
Daniel Stenberg
ae41dd85ed
config-win32: define SIZEOF_CURL_OFF_T 2017-08-17 10:26:59 +02:00
Daniel Stenberg
1286b7c09e
cmake: sizeof curl_off_t, remove unused detections 2017-08-17 10:26:59 +02:00
Daniel Stenberg
80d9e35598
system.h: remove all CURL_SIZEOF_* defines
... as they're not used externally and internally we check for the sizes
already in configure etc.

Closes #1767
2017-08-17 10:26:53 +02:00
Daniel Stenberg
c95eff4a11
ftp: fix CWD when doing multicwd then nocwd on same connection
Fixes #1782
Closes #1787
Reported-by: Peter Lamare
2017-08-17 10:08:11 +02:00
Viktor Szakats
b7b4dc0d49 ssh: add the ability to enable compression (for SCP/SFTP)
The required low-level logic was already available as part of
`libssh2` (via `LIBSSH2_FLAG_COMPRESS` `libssh2_session_flag()`[1]
option.)

This patch adds the new `libcurl` option `CURLOPT_SSH_COMPRESSION`
(boolean) and the new `curl` command-line option `--compressed-ssh`
to request this `libssh2` feature. To have compression enabled, it
is required that the SSH server supports a (zlib) compatible
compression method and that `libssh2` was built with `zlib` support
enabled.

[1] https://www.libssh2.org/libssh2_session_flag.html

Ref: https://github.com/curl/curl/issues/1732
Closes https://github.com/curl/curl/pull/1735
2017-08-17 03:32:00 -04:00
Maksim Stsepanenka
801d8765ca http_proxy: fix build error for CURL_DOES_CONVERSIONS
Closes https://github.com/curl/curl/pull/1793
2017-08-16 14:41:31 -04:00
Nick Zitzmann
870d849d48 configure: check for __builtin_available() availability (#1788)
This change does two things:
1. It un-breaks the build in Xcode 9.0. (Xcode 9.0 is currently
   failing trying to compile connectx() in lib/connect.c.)
2. It finally weak-links the connectx() function, and falls back on
   connect() when run on older operating systems.
2017-08-16 12:24:39 -05:00
Daniel Stenberg
75536e529a
darwinssi: fix error: variable length array used 2017-08-16 07:58:44 +02:00
Benbuck Nason
774d49af52
cmake: remove dead code for DISABLED_THREADSAFE
Closes #1786
2017-08-15 23:40:54 +02:00
Ryan Winograd
43d036e724
progress: Track total times following redirects
Update the progress timers `t_nslookup`, `t_connect`, `t_appconnect`,
`t_pretransfer`, and `t_starttransfer` to track the total times for
these activities when a redirect is followed. Previously, only the times
for the most recent request would be tracked.

Related changes:

  - Rename `Curl_pgrsResetTimesSizes` to `Curl_pgrsResetTransferSizes`
    now that the function only resets transfer sizes and no longer
    modifies any of the progress timers.

  - Add a bool to the `Progress` struct that is used to prevent
    double-counting `t_starttransfer` times.

Added test case 1399.

Fixes #522 and Known Bug 1.8
Closes #1602
Reported-by: joshhe on github
2017-08-15 18:58:31 +02:00
Benbuck Nason
0969901eb9
cmake: remove dead code for CURL_DISABLE_RTMP
Closes #1785
2017-08-15 18:50:21 +02:00
Daniel Stenberg
ff50fe0348
strtoofft: reduce integer overflow risks globally
... make sure we bail out on overflows.

Reported-by: Brian Carpenter
Closes #1758
2017-08-14 23:33:41 +02:00
Daniel Stenberg
b748d7af7e
ipv6_scope: support unique local addresses
Fixes #1764
Closes #1773
Reported-by: James Slaughter
2017-08-13 17:52:15 +02:00
Salah-Eddin Shaban
d6ecb2c851
redirect: skip URL encoding for host names
This fixes redirects to IDN URLs

Fixes #1441
Closes #1762
Reported by: David Lord
2017-08-13 00:03:54 +02:00
Daniel Stenberg
7973baacea
bagder/Curl_tvdiff_us: fix the math
Regression since adef394ac5 (released in 7.55.0)

Reported-by: Han Qiao
Fixes #1769
Closes #1771
2017-08-12 17:25:50 +02:00
Even Rouault
6e0e152ce5
parse_proxy(): fix memory leak in case of invalid proxy server name
Fixes the below leak:

$ valgrind --leak-check=full ~/install-curl-git/bin/curl --proxy "http://a:b@/x" http://127.0.0.1
curl: (5) Couldn't resolve proxy name
==5048==
==5048== HEAP SUMMARY:
==5048==     in use at exit: 532 bytes in 12 blocks
==5048==   total heap usage: 5,288 allocs, 5,276 frees, 445,271 bytes allocated
==5048==
==5048== 2 bytes in 1 blocks are definitely lost in loss record 1 of 12
==5048==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==5048==    by 0x4E6CB79: parse_login_details (url.c:5614)
==5048==    by 0x4E6BA82: parse_proxy (url.c:5091)
==5048==    by 0x4E6C46D: create_conn_helper_init_proxy (url.c:5346)
==5048==    by 0x4E6EA18: create_conn (url.c:6498)
==5048==    by 0x4E6F9B4: Curl_connect (url.c:6967)
==5048==    by 0x4E86D05: multi_runsingle (multi.c:1436)
==5048==    by 0x4E88432: curl_multi_perform (multi.c:2160)
==5048==    by 0x4E7C515: easy_transfer (easy.c:708)
==5048==    by 0x4E7C74A: easy_perform (easy.c:794)
==5048==    by 0x4E7C7B1: curl_easy_perform (easy.c:813)
==5048==    by 0x414025: operate_do (tool_operate.c:1563)
==5048==
==5048== 2 bytes in 1 blocks are definitely lost in loss record 2 of 12
==5048==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==5048==    by 0x4E6CBB6: parse_login_details (url.c:5621)
==5048==    by 0x4E6BA82: parse_proxy (url.c:5091)
==5048==    by 0x4E6C46D: create_conn_helper_init_proxy (url.c:5346)
==5048==    by 0x4E6EA18: create_conn (url.c:6498)
==5048==    by 0x4E6F9B4: Curl_connect (url.c:6967)
==5048==    by 0x4E86D05: multi_runsingle (multi.c:1436)
==5048==    by 0x4E88432: curl_multi_perform (multi.c:2160)
==5048==    by 0x4E7C515: easy_transfer (easy.c:708)
==5048==    by 0x4E7C74A: easy_perform (easy.c:794)
==5048==    by 0x4E7C7B1: curl_easy_perform (easy.c:813)
==5048==    by 0x414025: operate_do (tool_operate.c:1563)

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2984
Credit to OSS Fuzz for discovery

Closes #1761
2017-08-11 11:52:56 +02:00
Daniel Stenberg
fd07ca1e20
openssl: fix "error: this statement may fall through"
A gcc7 warning.
2017-08-11 08:16:17 +02:00
David Benjamin
f26f6d258f
openssl: remove CONST_ASN1_BIT_STRING.
Just making the pointer as const works for the pre-1.1.0 path too.

Closes #1759
2017-08-11 08:15:58 +02:00
Jay Satiro
0b5665c98a digest_sspi: Don't reuse context if the user/passwd has changed
Bug: https://github.com/curl/curl/issues/1685
Reported-by: paulharris@users.noreply.github.com

Assisted-by: Isaac Boukris

Closes https://github.com/curl/curl/pull/1742
2017-08-10 01:40:05 -04:00
Viktor Szakats
13ef623a81
docs/comments: Update to secure URL versions
Closes #1741
2017-08-08 21:41:07 +02:00
Daniel Stenberg
358b2b131a tftp: reject file name lengths that don't fit
... and thereby avoid telling send() to send off more bytes than the
size of the buffer!

CVE-2017-1000100

Bug: https://curl.haxx.se/docs/adv_20170809B.html
Reported-by: Even Rouault

Credit to OSS-Fuzz for the discovery
2017-08-07 09:24:30 +02:00
Even Rouault
c9332fa5e8 file: output the correct buffer to the user
Regression brought by 7c312f84ea (April 2017)

CVE-2017-1000099

Bug: https://curl.haxx.se/docs/adv_20170809C.html

Credit to OSS-Fuzz for the discovery
2017-08-07 09:24:30 +02:00
Daniel Stenberg
fa48987356
easy_events: make event data static
First: this function is only used in debug-builds and not in
release/real builds. It is used to drive tests using the event-based
API.

A pointer to the local struct is passed to CURLMOPT_TIMERDATA, but the
CURLMOPT_TIMERFUNCTION calback can in fact be called even after this
funtion returns, namely when curl_multi_remove_handle() is called.

Reported-by: Brian Carpenter
2017-08-06 23:42:50 +02:00
Isaac Boukris
0b11660234
gssapi: fix memory leak of output token in multi round context
When multiple rounds are needed to establish a security context
(usually ntlm), we overwrite old token with a new one without free.
Found by proposed gss tests using stub a gss implementation (by
valgrind error), though I have confirmed the leak with a real
gssapi implementation as well.

Closes https://github.com/curl/curl/pull/1733
2017-08-05 00:23:24 +02:00
Marcel Raad
61046e7bd5
darwinssl: fix compiler warning
clang complains:
vtls/darwinssl.c:40:8: error: extra tokens at end of #endif directive
[-Werror,-Wextra-tokens]

This breaks the darwinssl build on Travis. Fix it by making this token
a comment.

Closes https://github.com/curl/curl/pull/1734
2017-08-05 00:11:01 +02:00
Daniel Stenberg
2ccd65af3b FTP: skip unnecessary CWD when in nocwd mode
... when reusing a connection. If it didn't do any CWD previously.

Fixes #1718
2017-08-04 10:01:23 +02:00
Daniel Stenberg
af271ce9b9 darwin: silence compiler warnings
With a clang pragma and three type fixes

Fixes #1722
2017-08-04 00:07:02 +02:00
Daniel Stenberg
fa2f134cbd darwinssl: fix curlssl_sha256sum() compiler warnings on first argument 2017-08-03 10:24:06 +02:00
Gisle Vanem
a8e1c2e466 netrc: skip lines starting with '#'
Bug: https://curl.haxx.se/mail/lib-2017-08/0008.html
2017-08-03 10:04:16 +02:00
Marcel Raad
866e02935d
CMake: set MSVC warning level to 4
The MSVC warning level defaults to 3 in CMake. Change it to 4, which is
consistent with the Visual Studio and NMake builds. Disable level 4
warning C4127 for the library and additionally C4306 for the test
servers to get a clean CURL_WERROR build as that warning is raised in
some macros in older Visual Studio versions.

Ref: https://github.com/curl/curl/pull/1667#issuecomment-314082794
Closes https://github.com/curl/curl/pull/1711
2017-08-03 08:39:23 +02:00
Marcel Raad
0139545607
curl_threads: fix MSVC compiler warning
Use LongToHandle to convert from long to HANDLE in the Win32
implementation.
This should fix the following warning when compiling with
MSVC 11 (2012) in 64-bit mode:
lib\curl_threads.c(113): warning C4306:
'type cast' : conversion from 'long' to 'HANDLE' of greater size

Closes https://github.com/curl/curl/pull/1717
2017-08-01 17:22:30 +02:00
Brad Spencer
164a09368d multi: fix request timer management
There are some bugs in how timers are managed for a single easy handle
that causes the wrong "next timeout" value to be reported to the
application when a new minimum needs to be recomputed and that new
minimum should be an existing timer that isn't currently set for the
easy handle.  When the application drives a set of easy handles via the
`curl_multi_socket_action()` API (for example), it gets told to wait the
wrong amount of time before the next call, which causes requests to
linger for a long time (or, it is my guess, possibly forever).

Bug: https://curl.haxx.se/mail/lib-2017-07/0033.html
2017-08-01 13:39:38 +02:00
Jay Satiro
53d137d94a curl_setup: Define CURL_NO_OLDIES for building libcurl
.. to catch accidental use of deprecated error codes.

Ref: https://github.com/curl/curl/issues/1688#issuecomment-316764237
2017-08-01 02:56:48 -04:00
Daniel Stenberg
909283ae5a http: fix response code parser to avoid integer overflow
test 1429 and 1433 were updated to work with the stricter HTTP status line
parser.

Closes #1714
Reported-by: Brian Carpenter
2017-07-31 18:37:43 +02:00
Dwarakanath Yadavalli
512f8c774a libcurl: Stop using error codes defined under CURL_NO_OLDIES
Fixes https://github.com/curl/curl/issues/1688
Closes https://github.com/curl/curl/pull/1712
2017-07-31 02:59:05 -04:00
Jay Satiro
f8614af527 splay: fix signed/unsigned mismatch warning
Follow-up to 4dee50b.

Ref: https://github.com/curl/curl/pull/1693
2017-07-29 01:13:42 -04:00
Johannes Schindelin
1cfa4cd427 curl_rtmp: fix a compiler warning
The headers of librtmp declare the socket as `int`, and on Windows, that
disagrees with curl_socket_t.

Bug: #1652

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-07-28 16:41:29 +02:00
Daniel Stenberg
4dee50b9c8 timeval: struct curltime is a struct timeval replacement
... to make all libcurl internals able to use the same data types for
the struct members. The timeval struct differs subtly on several
platforms so it makes it cumbersome to use everywhere.

Ref: #1652
Closes #1693
2017-07-28 15:51:25 +02:00
Daniel Stenberg
7551e55d66 darwinssl: fix variable type mistake (regression)
... which made --tlsv1.2 not work because it would blank the max tls
version variable.

Reported-by: Nick Miyake
Bug: #1703
2017-07-27 18:30:11 +02:00
Daniel Stenberg
02c7a2ccab multi: mention integer overflow risk if using > 500 million sockets
Reported-by: ovidiu-benea@users.noreply.github.com

Closes #1675
Closes #1683
2017-07-27 01:13:47 +02:00
Daniel Stenberg
60cf84f7f2 checksrc: escape open brace in regex
... to silence warning.
2017-07-27 01:13:19 +02:00
Kamil Dudka
42a4cd4c78 nss: fix a possible use-after-free in SelectClientCert()
... causing a SIGSEGV in showit() in case the handle used to initiate
the connection has already been freed.

This commit fixes a bug introduced in curl-7_19_5-204-g5f0cae803.

Reported-by: Rob Sanders
Bug: https://bugzilla.redhat.com/1436158
2017-07-20 08:09:01 +02:00
Kamil Dudka
c89eb6d0f8 nss: unify the coding style of nss_send() and nss_recv()
No changes in behavior intended by this commit.
2017-07-20 08:08:47 +02:00
Jay Satiro
798ad5d924 darwinssl: fix pinnedpubkey build error
- s/SessionHandle/Curl_easy/

Bug: https://github.com/curl/curl/commit/eb16305#commitcomment-23035670
Reported-by: Gisle Vanem
2017-07-17 02:46:07 -04:00
Marcel Raad
ef5cac3d8c
build: remove WIN32_LEAN_AND_MEAN from individual build systems
It's defined for all build systems in curl_setup.h since commit
beb08481d0. This caused macro
redefinition warnings in the configure builds.

Closes https://github.com/curl/curl/pull/1677
2017-07-11 18:16:23 +02:00
Marcel Raad
beb08481d0
curl_setup: always define WIN32_LEAN_AND_MEAN on Windows
Make sure to always define WIN32_LEAN_AND_MEAN before including any
Windows headers to avoid pulling in unnecessary headers. This avoids
unnecessary macro clashes and compiler warnings.

Ref: https://github.com/curl/curl/issues/1562
Closes https://github.com/curl/curl/pull/1672
2017-07-11 11:57:00 +02:00
Jay Satiro
c5e87fdb7a strerror: Preserve Windows error code in some functions
This is a follow-up to af02162 which removed (SET_)ERRNO macros. That
commit was an earlier draft that I committed by mistake, which was then
remedied by a5834e5 and e909de6, and now this commit. With this commit
there is now no difference between the current code and the changes that
were approved in the final draft.

Thanks-to: Max Dymond, Marcel Raad, Daniel Stenberg, Gisle Vanem
Ref: https://github.com/curl/curl/pull/1589
2017-07-11 01:53:23 -04:00
Daniel Stenberg
a5834e525d errno: fix non-windows builds after af0216251b 2017-07-10 13:59:05 +02:00
Marcel Raad
b54e0babd7
ldap: fix MinGW compiler warning
ldap_bind_s is marked as deprecated in w32api's winldap.h shipping with
the latest original MinGW, resulting in compiler warnings since commit
f0fe66f13c. Fix this for the non-SSPI
case by using ldap_simple_bind_s again instead of ldap_bind_s with
LDAP_AUTH_SIMPLE.

Closes https://github.com/curl/curl/pull/1664
2017-07-10 10:22:34 +02:00
Jay Satiro
af0216251b curl_setup_once: Remove ERRNO/SET_ERRNO macros
Prior to this change (SET_)ERRNO mapped to GetLastError/SetLastError
for Win32 and regular errno otherwise.

I reviewed the code and found no justifiable reason for conflating errno
on WIN32 with GetLastError/SetLastError. All Win32 CRTs support errno,
and any Win32 multithreaded CRT supports thread-local errno.

Fixes https://github.com/curl/curl/issues/895
Closes https://github.com/curl/curl/pull/1589
2017-07-10 02:09:27 -04:00
Marcel Raad
59a0fb2439
smb: rename variable to fix shadowing warning
GCC 4.6.3 on travis complains:
smb.c: In function ‘get_posix_time’:
smb.c:725:13: error: declaration of ‘time’ shadows a global declaration
[-Werror=shadow]

Fix this by renaming the variable.
2017-07-09 14:42:13 +02:00
Paul Harris
45f39945ec cmake: offer CMAKE_DEBUG_POSTFIX when building with MSVC
Removes BUILD_RELEASE_DEBUG_DIRS since it wasn't used anywhere.

Closes #1649
2017-07-07 14:29:26 +02:00
Gisle Vanem
0cec0f4615 memdebug: don't setbuf() if the file open failed
Bug: https://github.com/curl/curl/issues/828#issuecomment-313475151
2017-07-06 23:15:00 +02:00
Daniel Stenberg
6b0aa00abb asyn-thread.c: fix unused variable warnings on macOS 2017-07-06 11:49:50 +02:00
Daniel Stenberg
b22f93dbb8 http: s/TINY_INITIAL_POST_SIZE/EXPECT_100_THRESHOLD
Make the name reflect its use better, and add a short comment describing
what it's for.
2017-07-06 11:20:57 +02:00
Daniel Stenberg
7e21e5fd0c select.h: avoid macro redefinition harder
... by checking the POLLIN define, as the header file checks don't work
on Windows.
2017-07-05 13:28:28 +02:00
Daniel Stenberg
21e0705734 inet_pton: fix include on windows to get prototype
inet_pton() exists on Windows and gets used by our cmake builds. Make
sure the correct header file is included to avoid compiler warnings.

Closes #1639
2017-07-05 13:28:19 +02:00
Gisle Vanem
596cfb6c0a smb: add support for CURLOPT_FILETIME
Bug: https://curl.haxx.se/mail/lib-2017-07/0005.html

Closes #1643
2017-07-04 23:12:57 +02:00
Gisle Vanem
f8dba473a8 smb: fix build for djgpp/MSDOS
bug: https://curl.haxx.se/mail/lib-2017-07/0005.html
2017-07-04 15:42:55 +02:00
Daniel Stenberg
909a5bee81 configure: remove checks for 5 functions never used
fork, getprotobyname, inet_addr, perror, uname

closes #1638
2017-07-04 11:32:25 +02:00
Martin Kepplinger
f50124f566 timeval.c: Use long long constant type for timeval assignment
On a 64 bit host, sparse says:

timeval.c:148:15: warning: constant 0x7fffffffffffffff is so big it is long
timeval.c:149:12: warning: constant 0x7fffffffffffffff is so big it is long

so let's use long long constant types in order to prevent undesired overflow
failures.

Bug: https://curl.haxx.se/mail/lib-2017-07/0003.html

Closes #1636

Signed-off-by: Martin Kepplinger <martink@posteo.de>
2017-07-04 07:59:21 +02:00
Daniel Stenberg
b3786f61dc url: make the original string get used on subsequent transfers
... since CURLOPT_URL should follow the same rules as other options:
they remain set until changed or cleared.

Added test 1551 to verify.

Fixes #1631
Closes #1632
Reported-by: Pavel Rochnyak
2017-07-03 23:52:10 +02:00
Johannes Schindelin
c0cdc68c7e gtls: fix build when sizeof(long) < sizeof(void *)
- Change gnutls pointer/int macros to pointer/curl_socket_t.
  Prior to this change they used long type as well.

The size of the `long` data type can be shorter than that of pointer
types. This is the case most notably on Windows.

If C99 were acceptable, we could simply use `intptr_t` here. But we
want to retain C89 compatibility.

Simply use the trick of performing pointer arithmetic with the NULL
pointer: to convert an integer `i` to a pointer, simply take the
address of the `i`th element of a hypothetical character array
starting at address NULL. To convert back, simply cast the pointer
difference.

Thanks to Jay Satiro for the initial modification to use curl_socket_t
instead of int/long.

Closes #1617

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2017-07-03 15:45:25 +02:00
Max Dymond
c98e97e9c3 http2: handle PING frames
Add a connection check function to HTTP2 based off RTSP. This causes
PINGs to be handled the next time the connection is reused.

Closes #1521
2017-06-30 10:27:41 +02:00
Max Dymond
c75f63d7c4 handler: refactor connection checking
Add a new type of callback to Curl_handler which performs checks on
the connection. Alter RTSP so that it uses this callback to do its
own check on connection health.
2017-06-30 10:17:27 +02:00
dmitrykos
192877058e openssl: improve fallback seed of PRNG with a time based hash
Fixes #1620
2017-06-30 09:21:03 +02:00
Ryan Winograd
f8f040e659 progress: prevent resetting t_starttransfer
Prevent `Curl_pgrsTime` from modifying `t_starttransfer` when invoked
with `TIMER_STARTTRANSFER` more than once during a single request.

When a redirect occurs, this is considered a new request and
`t_starttransfer` can be updated to reflect the `t_starttransfer` time
of the redirect request.

Closes #1616

Bug: https://github.com/curl/curl/pull/1602#issuecomment-310267370
2017-06-30 09:05:53 +02:00
Kamil Dudka
8924f58c37 CURLOPT_SOCKS5_AUTH: allowed methods for SOCKS5 proxy auth
If libcurl was built with GSS-API support, it unconditionally advertised
GSS-API authentication while connecting to a SOCKS5 proxy.  This caused
problems in environments with improperly configured Kerberos: a stock
libcurl failed to connect, despite libcurl built without GSS-API
connected fine using username and password.

This commit introduces the CURLOPT_SOCKS5_AUTH option to control the
allowed methods for SOCKS5 authentication at run time.

Note that a new option was preferred over reusing CURLOPT_PROXYAUTH
for compatibility reasons because the set of authentication methods
allowed by default was different for HTTP and SOCKS5 proxies.

Bug: https://curl.haxx.se/mail/lib-2017-01/0005.html
Closes https://github.com/curl/curl/pull/1454
2017-06-28 08:02:58 +02:00
Kamil Dudka
cd1c9f0807 socks: deduplicate the code for auth request 2017-06-28 07:48:34 +02:00
Kamil Dudka
641072b919 socks: use proxy_user instead of proxy_name
... to make it obvious what the data is used for
2017-06-28 07:48:34 +02:00
Daniel Stenberg
cfe3c08f69 progress: progress.timespent needs to be us
follow-up to 64ed44a815 to fix test 500 failures
2017-06-24 21:14:50 +02:00
Daniel Stenberg
64ed44a815 progress: fix "time spent", broke in adef394ac 2017-06-24 01:18:21 +02:00
Daniel Stenberg
9b167fd090 --request-target: instead of --strip-path-slash
... and CURLOPT_REQUEST_TARGET instead of CURLOPT_STRIP_PATH_SLASH.

This option instead provides the full "alternative" target to use in the
request, instead of extracting the path from the URL.

Test 1298 and 1299 updated accordingly.

Idea-by: Evert Pot
Suggestion: https://daniel.haxx.se/blog/2017/06/19/options-with-curl/comment-page-1/#comment-18373

Closes #1593
2017-06-21 23:39:10 +02:00
Gisle Vanem
60c655ac07 lib: fix the djgpp build
Bug: 73a2fcea0b (commitcomment-22655993)
2017-06-21 07:46:21 +02:00
Marcel Raad
651e04c4c8
if2ip: fix compiler warning in ISO C90 mode
remote_scope_id is only used when both HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID
and ENABLE_IPV6 are defined instead of only one of them.
2017-06-20 22:33:56 +02:00
Daniel Stenberg
b778ae4c5e http: add --strip-path-slash and CURLOPT_STRIP_PATH_SLASH
... to enable sending "OPTIONS *" which wasn't possible previously.

This option currently only works for HTTP.

Added test cases 1298 + 1299 to verify

Fixes #1280
Closes #1462
2017-06-19 16:39:22 +02:00
Daniel Stenberg
3b80d3ca46 getinfo: return sizes as curl_off_t
This change introduces new alternatives for the existing six
curl_easy_getinfo() options that return sizes or speeds as doubles. The
new versions are named like the old ones but with an appended '_T':

CURLINFO_CONTENT_LENGTH_DOWNLOAD_T
CURLINFO_CONTENT_LENGTH_UPLOAD_T
CURLINFO_SIZE_DOWNLOAD_T
CURLINFO_SIZE_UPLOAD_T
CURLINFO_SPEED_DOWNLOAD_T
CURLINFO_SPEED_UPLOAD_T

Closes #1511
2017-06-19 09:27:42 +02:00
Daniel Stenberg
6208547002 PIPELINING_SERVER_BL: cleanup the internal list use
The list was freed incorrectly since the llist refactor of
cbae73e1dd. Added test 1550 to verify that it works and avoid future
regressions.

Reported-by: Pascal Terjan

Fixes #1584
Closes #1585
2017-06-19 09:14:49 +02:00
Daniel Stenberg
65ca030513 http2: fix OOM crash
torture mode with test 1021 found it
2017-06-18 23:57:45 +02:00
Marcel Raad
edafd52be1
http_proxy: fix build with http and proxy
After deff7de0eb, the build without
CURL_DISABLE_PROXY and CURL_DISABLE_HTTP was failing because of missing
includes.
2017-06-18 15:18:15 +02:00
Marcel Raad
deff7de0eb
http_proxy: fix compiler warning
With CURL_DISABLE_PROXY or CURL_DISABLE_HTTP, GCC complained about a
missing prototype for Curl_connect_free.
2017-06-18 12:53:54 +02:00
Marcel Raad
ce2cc568f8
Makefile.m32: enable -W for MinGW32 build
The configure-based build also has this in addition to -Wall.

Closes https://github.com/curl/curl/pull/1578
2017-06-16 22:32:22 +02:00
Daniel Stenberg
01811b6740 http-proxy: fix chunked-encoded CONNECT responses
Regression since 5113ad0424.

... and remove 'flaky' from test 1061 again

Closes #1579
2017-06-16 21:56:56 +02:00
Daniel Stenberg
12ccaed2a5 http-proxy: deal with EAGAIN
... the previous code would reset the header length wrongly (since
5113ad0424). This makes test 1060 reliable again.

Also: make sws send even smaller chunks of data to increase the
likeliness of this happening.
2017-06-16 17:22:32 +02:00
Jay Satiro
17c5d05285 HTTPS-Proxy: don't offer h2 for https proxy connections
Bug: https://github.com/curl/curl/issues/1254

Closes #1546
2017-06-16 12:16:41 +02:00
Jay Satiro
2a733d6418 url: refactor the check for Windows drive letter in path
- Move the logic to detect a Windows drive letter prefix
  (eg c: in c:foo) into a function-like macro.

Closes https://github.com/curl/curl/pull/1571
2017-06-16 03:03:25 -04:00
Jay Satiro
ec92afc3f4 mk-ca-bundle.pl: Check curl's exit code after certdata download
- No longer allow partial downloads of certdata.

Prior to this change partial downloads were (erroneously?) allowed since
only the server code was checked to be 200.

Bug: https://github.com/curl/curl/pull/1577
Reported-by: Matteo B.
2017-06-16 01:58:23 -04:00
Daniel Stenberg
0d39e5cc95 http-proxy: fix build with --disable-proxy or --disable-http
Reported-by: Dan Fandrich
2017-06-16 00:02:57 +02:00
Daniel Stenberg
efc83d6d54 http-proxy: only attempt FTP over HTTP proxy
... all other non-HTTP protocol schemes are now defaulting to "tunnel
trough" mode if a HTTP proxy is specified. In reality there are no HTTP
proxies out there that allow those other schemes.

Assisted-by: Ray Satiro, Michael Kaufmann

Closes #1505
2017-06-15 13:46:48 +02:00
Daniel Stenberg
7d7346519d curl_setup.h: error out on CURL_WANTS_CA_BUNDLE_ENV use
... to make it really apparent if there's any user using this on purpose.

Suggested-by: Jay Satiro

Closes #1542
2017-06-15 11:11:39 +02:00
Daniel Stenberg
c2aeb1b3ba lib/curl_setup.h: remove CURL_WANTS_CA_BUNDLE_ENV
When this define was set, libcurl would check the environment variable
named CURL_CA_BUNDLE at run-time and use that CA cert bundle. This
feature was only defined by the watcom and m32 makefiles and caused
inconsistent behaviours among libcurls built on different platforms.

The curl tool does already feature its own similar logic and the library
does not really need it, and it isn't documented libcurl behavior. So
this change removes it.

Ref: #1538
2017-06-15 11:11:15 +02:00
Daniel Stenberg
5113ad0424 http-proxy: do the HTTP CONNECT process entirely non-blocking
Mentioned as a problem since 2007 (8f87c15bda) and of course it
existed even before that.

Closes #1547
2017-06-14 23:43:52 +02:00
Daniel Stenberg
1213baba27 progress: let "current speed" be UL + DL speeds combined
Bug #1556
Reported-by: Paul Harris
Closes #1559
2017-06-14 23:30:54 +02:00
Daniel Stenberg
adef394ac5 timers: store internal time stamps as time_t instead of doubles
This gives us accurate precision and it allows us to avoid storing "no
time" for systems with too low timer resolution as we then bump the time
up to 1 microsecond. Should fix test 573 on windows.

Remove the now unused curlx_tvdiff_secs() function.

Maintains the external getinfo() API with using doubles.

Fixes #1531
2017-06-14 15:46:39 +01:00
Daniel Stenberg
73a2fcea0b includes: remove curl/curlbuild.h and curl/curlrules.h
Rely entirely on curl/system.h now.

Introduced in Aug 2008 with commit 14240e9e10. Now gone.

Fixes #1456
2017-06-14 11:07:33 +02:00
Stuart Henderson
9f54ad8f15 libressl: OCSP and intermediate certs workaround no longer needed
lib/vtls/openssl.c has a workaround for a bug with OCSP responses signed
by intermediate certs, this was fixed in LibreSSL in
912c64f68f

Bug: https://curl.haxx.se/mail/lib-2017-06/0038.html
2017-06-13 12:28:22 +02:00
Daniel Stenberg
5d7952f52e url: fix buffer overwrite with file protocol (CVE-2017-9502)
Bug: https://github.com/curl/curl/issues/1540
Advisory: https://curl.haxx.se/docs/adv_20170614.html

Assisted-by: Ray Satiro
Reported-by: Marcel Raad
2017-06-13 09:34:20 +02:00
Daniel Stenberg
844896d064 setopt: check CURLOPT_ADDRESS_SCOPE option range
... and return error instead of triggering an assert() when being way
out of range.
2017-06-09 01:01:55 +02:00
Daniel Stenberg
6c59074528 asyn-ares: s/Curl_expire_latest/Curl_expire 2017-06-08 11:06:19 +02:00
Daniel Stenberg
7fffe97b78 expire: remove Curl_expire_latest()
With the introduction of expire IDs and the fact that existing timers
can be removed now and thus never expire, the concept with adding a
"latest" timer is not working anymore as it risks to not expire at all.

So, to be certain the timers actually are in line and will expire, the
plain Curl_expire() needs to be used. The _latest() function was added
as a sort of shortcut in the past that's quite simply not necessary
anymore.

Follow-up to 31b39c40cf

Reported-by: Paul Harris

Closes #1555
2017-06-08 10:50:47 +02:00
Daniel Stenberg
68c6dcb2cb file: make speedcheck use current time for checks
... as it would previously just get the "now" timestamp before the
transfer starts and then not update it again.

Closes #1550
2017-06-07 23:01:09 +02:00
Daniel Stenberg
cccac4fb2b test1521: test *all* curl_easy_setopt options
mk-lib1521.pl generates a test program (lib1521.c) that calls
curl_easy_setopt() for every known option with a few typical values to
make sure they work (ignoring the return codes).

Some small changes were necessary to avoid asserts and NULL accesses
when doing this.

The perl script needs to be manually rerun when we add new options.

Closes #1543
2017-06-05 14:25:18 +02:00
Marcel Raad
7960442730
curl_ntlm_core: use Curl_raw_toupper instead of toupper
This was the only remaining use of toupper in the entire source code.

Suggested-by: Daniel Stenberg
2017-06-05 00:27:29 +02:00
Marcel Raad
892c5e4cb3
curl_ntlm_core: pass unsigned char to toupper
Otherwise, clang on Cygwin64 warns:
curl_ntlm_core.c:525:35: error: array subscript is of type 'char'
[-Werror,-Wchar-subscripts]
    dest[2 * i] = (unsigned char)(toupper(src[i]));
                                  ^~~~~~~~~~~~~~~
/usr/include/ctype.h:152:25: note: expanded from macro 'toupper'
      (void) __CTYPE_PTR[__x]; (toupper) (__x);})
                        ^~~~
2017-06-04 16:46:03 +02:00
Marcel Raad
15136a5268
x509asn1: fix implicit-fallthrough warning with GCC 7 2017-06-03 20:10:52 +02:00
Marcel Raad
f8518059ce
curl_sasl: fix unused-variable warning
This fixes the following warning with CURL_DISABLE_CRYPTO_AUTH,
as seen in the autobuilds:

curl_sasl.c:417:9: warning: unused variable 'serverdata'
[-Wunused-variable]
2017-06-03 11:59:38 +02:00
Marcel Raad
7207affe28
cyassl: define build macros before including ssl.h
cyassl/ssl.h needs the macros from cyassl/options.h, so define them
before including cyassl/ssl.h the first time, which happens in
urldata.h.
This broke the build on Ubuntu Xenial, which comes with WolfSSL 3.4.8
and therefore redefines the symbols from cyassl/options.h instead of
including the header.

Closes https://github.com/curl/curl/pull/1536
2017-06-03 00:39:46 +02:00
Daniel Stenberg
cfd3e8f399 dedotdot: fixed output for ".." and "." only input
Found when updating test 1395, which I did to increase test coverage of
this source file...

Closes #1535
2017-06-03 00:11:51 +02:00
Marcel Raad
10e02bc36a
mbedtls: make TU-local variable static
mbedtls_x509_crt_profile_fr is only used locally.
This fixes a missing-variable-declarations warning with clang.
2017-06-02 22:05:01 +02:00
Marcel Raad
769890c7e2
MD(4|5): silence cast-align clang warning
Unaligned access is on purpose here and the warning is harmless on
affected architectures. GCC knows that, while clang warns on all
architectures.
2017-06-02 21:58:48 +02:00
Daniel Stenberg
4ba20a5119 curl_endian: remove unused functions
Closes #1529
2017-06-02 13:30:41 +02:00
Daniel Stenberg
f6e0f4556e build: provide easy code coverage measuring
Closes #1528
2017-06-02 13:15:06 +02:00
Daniel Stenberg
e54db1b053 transfer: init the infilesize from the postfields...
... with a strlen() if no size was set, and do this in the pretransfer
function so that the info is set early. Otherwise, the default strlen()
done on the POSTFIELDS data never sets state.infilesize.

Reported-by: Vincas Razma
Bug: #1294
2017-05-30 11:39:42 +02:00
Jay Satiro
35e9281ef8 mbedtls: fix variable shadow warning
vtls/mbedtls.c:804:69: warning: declaration of 'entropy' shadows a global declaration [-Wshadow]
 CURLcode Curl_mbedtls_random(struct Curl_easy *data, unsigned char *entropy,
                                                                     ^~~~~~~
2017-05-29 17:38:33 -04:00
Daniel Stenberg
59cc0234e5 ssh: fix 'left' may be used uninitialized
follow-up to f31760e63b

Reported-by: Michael Kaufmann
Bug: https://github.com/curl/curl/pull/1495#issuecomment-303982793
2017-05-25 13:02:29 +02:00
Michael Kaufmann
8ab22a7453 time: fix type conversions and compiler warnings
Fix bugs and compiler warnings on systems with 32-bit long and
64-bit time_t.

Reviewed-by: Daniel Stenberg

Closes #1499
2017-05-24 22:56:22 +02:00
Daniel Stenberg
bba59073c5 redirect: store the "would redirect to" URL when max redirs is reached
Test 1261 added to verify.

Reported-by: Lloyd Fournier

Fixes #1489
Closes #1497
2017-05-23 23:27:58 +02:00
Sergei Nikulov
48f2a96a60 LDAP: fixed checksrc issue 2017-05-24 00:14:13 +03:00
Sergei Nikulov
f0fe66f13c LDAP: using ldap_bind_s on Windows with methods (#878)
* LDAP: using ldap_bind_s on Windows with methods(BASIC/DIGEST/NTLM/AUTONEG)

* ldap: updated per build options handling

* ldap: fixed logic for auth selection
2017-05-23 22:45:39 +03:00
Akhil Kedia
b4d6b99445 cmake: fix build on Ubuntu 14.04
Fixed a syntax error with setting cache variables (The type and
docstring were missing), resulting in build errors.  Quoted the
CURL_CA_PATH and CURL_CA_BUNDLE otherwise the path was written without
quotes in C code, resulting in build errors.

Closes #1503

Signed-off-by: Akhil <akhil.kedia@samsung.com>
2017-05-23 10:07:08 +02:00
Daniel Stenberg
a1b3a95c96 url: fix declaration of 'pipe' shadows a global declaration
follow-up to 4cdb1be824
2017-05-23 07:41:52 +02:00
Kamil Dudka
945919db5b memdebug: fix compilation failure
.... caused by a typo in the last commit (fixing issue #1504):

memdebug.c: In function ‘curl_fclose’:
memdebug.c:444:3: error: implicit declaration of function
‘DEBUGDEBUGASSERT’ [-Werror=implicit-function-declaration]
2017-05-22 19:03:16 +02:00
Daniel Stenberg
8589e1fe30 assert: avoid, use DEBUGASSERT instead!
... as it does extra checks to actually work.

Reported-by: jonrumsey at github
Fixes #1504
2017-05-22 13:59:29 +02:00
Simon Warta
5606fcc657 cmake: Add CURL_CA_FALLBACK to curl_config.h.cmake
This is for symmetry with the autoconf generated curl_config.h.in
2017-05-21 23:19:05 +02:00
Daniel Stenberg
f31760e63b ssh: ignore timeouts during disconnect
... as otherwise it risks not cleaning up the libssh2 handle properly
which leads to memory leak!

Assisted-by: Joel Depooter

Closes #1495
Closes #1479

Bug: https://curl.haxx.se/mail/lib-2017-04/0024.html
2017-05-20 11:22:20 +02:00
Nick Zitzmann
c58063b4f8 darwinssl: Fix exception when processing a client-side certificate file
if no error was raised by the API but the SecIdentityRef was null

Fixes #1450
2017-05-16 19:21:12 -05:00
Daniel Stenberg
32c27f9e98 curl_sasl: fix build error with CURL_DISABLE_CRYPTO_AUTH + USE_NTLM
Reported-by: wyattoday at github
Fixes #1487
2017-05-16 16:13:03 +02:00
eb16305e6a SecureTransport/DarwinSSL: Implement public key pinning
Closes #1400
2017-05-15 22:54:33 +02:00
Dan Fandrich
d836c9fee4 url.c: add a compile-time check that CURL_MAX_WRITE_SIZE is large enough
Some code (e.g. Curl_fillreadbuffer) assumes that this buffer is not
exceedingly tiny and will break if it is. This same check is already
done at run time in the CURLOPT_BUFFERSIZE option.
2017-05-13 23:21:27 +02:00
Daniel Stenberg
d6c74ff663 multi: remove leftover debug infof() calls from e9fd794a6 2017-05-12 17:19:30 +02:00
Daniel Stenberg
4cdb1be824 pipeline: fix mistakenly trying to pipeline POSTs
The function IsPipeliningPossible() would return TRUE if either
pipelining OR HTTP/2 were possible on a connection, which would lead to
it returning TRUE even for POSTs on HTTP/1 connections.

It now returns a bitmask so that the caller can differentiate which kind
the connection allows.

Fixes #1481
Closes #1483
Reported-by: stootill at github
2017-05-12 17:01:02 +02:00
Ron Eldor
bc3866e3eb mbedtls: Support server renegotiation request
Tested with servers: IIS 7.5; OpenSSL 1.0.2.

Closes https://github.com/curl/curl/pull/1475
2017-05-12 01:39:10 -04:00
Marcel Raad
b875250e32
formdata: fix -Wcomma warning
clang 5.0 complains:
possible misuse of comma operator here [-Wcomma]

Change the comma to a semicolon to fix that.
2017-05-11 10:04:01 +02:00
Daniel Stenberg
31b39c40cf multi: use a fixed array of timers instead of malloc
... since the total amount is low this is faster, easier and reduces
memory overhead.

Also, Curl_expire_done() can now mark an expire timeout as done so that
it never times out.

Closes #1472
2017-05-10 12:55:36 +02:00
Daniel Stenberg
e9fd794a61 multi: assign IDs to all timers and make each timer singleton
A) reduces the timeout lists drastically

 B) prevents a lot of superfluous loops for timers that expires "in vain"
    when it has actually already been extended to fire later on
2017-05-10 11:02:47 +02:00
Daniel Stenberg
158d701641 formboundary: convert assert into run-time check
... to really make sure the boundary fits in the target buffer.

Fixes unused parameter 'buflen' warning.

Reported-by: Michael Kaufmann
Bug: https://github.com/curl/curl/pull/1468#issuecomment-300078754
2017-05-09 09:08:25 +02:00
Jay Satiro
1cafede9f2 rand: treat fake entropy the same regardless of endianness
When the random seed is purposely made predictable for testing purposes
by using the CURL_ENTROPY environment variable, process that data in an
endian agnostic way so the the initial random seed is the same
regardless of endianness.

- Change Curl_rand to write to a char array instead of int array.

- Add Curl_rand_hex to write random hex characters to a buffer.

Fixes #1315
Closes #1468

Co-authored-by: Daniel Stenberg
Reported-by: Michael Kaufmann
2017-05-08 23:24:29 +02:00
Marcel Raad
ea1b864786
asyn-thread: fix unused macro warnings
Don't do anything in this file if CURLRES_THREADED is not defined.
2017-05-07 19:02:34 +02:00
Marcel Raad
3661c8aeb0
tftp: silence bad-function-cast warning
The cases this warns about are handled elsewhere, so just use an
intermediate variable to silence the warning.
2017-05-07 16:26:19 +02:00
Dan Fandrich
07fd7871b3 schannel: return a more specific error code for SEC_E_UNTRUSTED_ROOT 2017-05-04 18:19:33 +02:00
Marcel Raad
a51ca050fc
curl_setup_once: use SEND_QUAL_ARG2 for swrite
SEND_QUAL_ARG2 had to be set, but was never used. Use it in swrite to
avoid warnings about casting away low-level const.

Closes https://github.com/curl/curl/pull/1464
2017-05-04 09:23:00 +02:00
Marcel Raad
cee39aa3be
lib: fix compiler warnings
Fix the following warnings when building the tests by using the correct
types:
cast from 'const char *' to 'void *' drops const qualifier
[-Wcast-qual]
implicit conversion changes signedness [-Wsign-conversion]
2017-05-03 20:11:13 +02:00