Commit Graph

11905 Commits

Author SHA1 Message Date
Daniel Stenberg
0da1356060
openssl: when creating a new context, there cannot be an old one
Remove the previous handling that would call SSL_CTX_free(), and instead
add an assert that halts a debug build if there ever is a context
already set at this point.

Closes #7585
2021-08-18 14:11:45 +02:00
Sergey Markelov
1828f6ae2e
sectransp: support CURLINFO_CERTINFO
Fixes #4130
Closes #7372
2021-08-17 08:40:44 +02:00
Daniel Stenberg
44f88e662f
ngtcp2: remove the acked_crypto_offset struct field init
... as it is gone from the API upstream.

Closes #7578
2021-08-16 23:06:36 +02:00
Daniel Stenberg
8c9722bb1c
misc: update incorrect copyright year ranges
Closes #7577
2021-08-16 11:21:47 +02:00
Artur Sinila
ccffb6ec16
http2: revert call the handle-closed function correctly on closed stream
Reverts 252790c533

Assisted-by: Gergely Nagy
Fixes #7400
Closes #7525
2021-08-16 08:44:52 +02:00
Patrick Monnerat
7da2990b19
auth: do not append zero-terminator to authorisation id in kerberos
RFC4752 Section 3.1 states "The authorization identity is not terminated
with a zero-valued (%x00) octet". Although a comment in code said it may
be needed anyway, nothing confirms it. In addition, servers may consider
it as part of the identity, causing a failure.

Closes #7008
2021-08-16 08:36:10 +02:00
Patrick Monnerat
396a2d7fe3
auth: use sasl authzid option in kerberos
... instead of deriving it from active ticket.
Closes #7008
2021-08-16 08:36:06 +02:00
Patrick Monnerat
0a1c85e39b
auth: we do not support a security layer after kerberos authentication
Closes #7008
2021-08-16 08:36:03 +02:00
Patrick Monnerat
3f9b1d0c9d
auth: properly handle byte order in kerberos security message
Closes #7008
2021-08-16 08:35:55 +02:00
z2_
5f3ca7f773
x509asn1: fix heap over-read when parsing x509 certificates
Assisted-by: Patrick Monnerat
Closes #7536
2021-08-16 08:26:50 +02:00
MAntoniak
fd84db600d
build: fix compiler warnings
For when CURL_DISABLE_VERBOSE_STRINGS and DEBUGBUILD flags are both
active.

- socks.c : warning C4100: 'lineno': unreferenced formal parameter
  (co-authored by Daniel Stenberg)

- mbedtls.c: warning C4189: 'port': local variable is initialized but
  not referenced

- schannel.c: warning C4189: 'hostname': local variable is initialized
  but not referenced

Cloes #7528
2021-08-14 23:19:24 +02:00
Daniel Stenberg
32f6812b5a
c-hyper: initial step for 100-continue support
Enabled test 154

Closes #7568
2021-08-13 23:18:21 +02:00
Ikko Ashimine
f67883e55a
vtls: fix typo in schannel_verify.c
occurence -> occurrence

Closes #7566
2021-08-13 17:39:59 +02:00
Daniel Stenberg
1e0b6f705e
c-hyper: fix header value passed to debug callback
Closes #7567
2021-08-13 17:37:02 +02:00
Viktor Szakats
063bfa358e
cleanup: URL updates
- replace broken URL with the one it was most probably pointing to
  when added (lib/tftp.c)
- replace broken URL with archive.org link (lib/curl_ntlm_wb.c)
- delete unnecessary protocol designator from archive.org URL
  (docs/BINDINGS.md)

Closes #7562
2021-08-12 18:41:13 +00:00
Daniel Stenberg
c3fa8c6e76
asyn-ares.c: move all version number checks to the top
... and use #ifdef [feature] in the code as per our guidelines.
2021-08-11 09:53:13 +02:00
Daniel Stenberg
ba904db070
ares: use ares_getaddrinfo()
ares_getaddrinfo() is the getaddrinfo() cloned provided by c-ares, introduced
in version 1.16.0.

With older c-ares versions, curl invokes ares_gethostbyname() twice - once for
IPv4 and once for IPv6 to resolve both addresses, and then combines the
returned results.

Reported-by: jjandesmet
Fixes #7364
Closes #7552
2021-08-11 09:53:06 +02:00
Tatsuhiro Tsujikawa
2bfa57bff1
ngtcp2: utilize crypto API functions to simplify
Closes #7551
2021-08-10 23:17:28 +02:00
megatronking
09cea3fbef
ngtcp2: reset the oustanding send buffer again when drained
Closes #7538
2021-08-10 23:07:42 +02:00
Michael Kaufmann
dd37639df7 progress: fix a compile warning on some systems
lib/progress.c:380:40: warning: conversion to 'long double' from
'curl_off_t {aka long long int}' may alter its value [-Wconversion]

Closes #7549
2021-08-10 22:39:16 +02:00
Daniel Stenberg
c495dcd02e
http: consider cookies over localhost to be secure
Updated test31.
Added test 392 to verify secure cookies used for http://localhost

Reviewed-by: Daniel Gustafsson
Fixes #6733
Closes #7263
2021-08-10 11:20:21 +02:00
Jay Satiro
16e9c8e990 hostip: Make Curl_ipv6works function independent of getaddrinfo
- Do not assume IPv6 is not working when getaddrinfo is not present.

The check to see if IPv6 actually works is now independent of whether
there is any resolver that can potentially resolve a hostname to IPv6.

Prior to this change if getaddrinfo() was not found at compile time then
Curl_ipv6works() would be defined as a macro that returns FALSE.

When getaddrinfo is not found then libcurl is built with CURLRES_IPV4
defined instead of CURLRES_IPV6, meaning that it cannot do IPv6 lookups
in the traditional way. With this commit if libcurl is built with IPv6
support (ENABLE_IPV6) but without getaddrinfo (CURLRES_IPV6), and the
IPv6 stack is actually working, then it is possible for libcurl to
resolve IPv6 addresses by using DoH.

Ref: https://github.com/curl/curl/issues/7483#issuecomment-890765378

Closes https://github.com/curl/curl/pull/7529
2021-08-10 03:29:49 -04:00
Tatsuhiro Tsujikawa
dff44c2955
ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
Closes #7546
2021-08-09 16:53:32 +02:00
Tatsuhiro Tsujikawa
636006dd36
ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
Rework the return value handling of ngtcp2_conn_writev_stream and treat
NGTCP2_ERR_STREAM_SHUT_WR separately.

Closes #7546
2021-08-09 16:53:11 +02:00
Jeff Mears
76e047fc27
easy: use a custom implementation of wcsdup on Windows
... so that malloc/free overrides from curl_global_init are used for
wcsdup correctly.

Closes #7540
2021-08-09 14:08:42 +02:00
Benau
3f126138be
mbedTLS: initial 3.0.0 support
Closes #7428
2021-08-09 10:25:17 +02:00
modbw
65c1b8ee17
mbedtls_threadlock: fix unused variable warning
Closes #7393
2021-08-08 18:37:56 +02:00
Tatsuhiro Tsujikawa
e3dbdd5468
ngtcp2: compile with the latest ngtcp2 and nghttp3
Closes #7541
2021-08-08 18:02:27 +02:00
Daniel Gustafsson
3df8d08d00 connect: remove superfluous conditional
Commit dbd16c3e2 cleaned up the logic for traversing the addrinfos,
but the move left a conditional on ai which no longer is needed as
the while loop reevaluation will cover it.

Closes #7511
Reviewed-by: Carlo Marcelo Arenas Belón
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2021-07-30 09:40:15 +02:00
Aleksandr Krotov
beb1b1cb03
bearssl: support CURLOPT_CAINFO_BLOB
Closes #7468
2021-07-28 23:04:53 +02:00
Daniel Stenberg
2c688a4aae
c-hyper: remove the hyper_executor_poll() loop from Curl_http
1. it's superfluous
2. it didn't work identically to the Curl_hyper_stream one which could
   cause problems like #7486

Pointed-out-by: David Cook
Closes #7499
2021-07-27 10:42:47 +02:00
Daniel Stenberg
c27a70a591
http_proxy: clear 'sending' when the outgoing request is sent
... so that Curl_connect_getsock() will know how to wait for the socket
to become readable and not writable after the entire CONNECT request has
been issued.

Regression added in 7.77.0

Reported-by: zloi-user on github
Assisted-by: Jay Satiro
Fixes #7155
Closes #7484
2021-07-25 13:24:38 +02:00
Josh Soref
e8cd39345e openssl: fix grammar
Closes https://github.com/curl/curl/pull/7480
2021-07-25 01:42:39 -04:00
Dan Fandrich
83245d9ff3 Get rid of the unused HAVE_SIG_ATOMIC_T et. al.
It was added in 2006 but I see no evidence it was ever used.
2021-07-23 12:40:42 -07:00
Daniel Stenberg
5ea3145850
vtls: fix connection reuse checks for issuer cert and case sensitivity
CVE-2021-22924

Reported-by: Harry Sintonen
Bug: https://curl.se/docs/CVE-2021-22924.html
2021-07-20 09:36:06 +02:00
Daniel Stenberg
fd9b40bf8d
sectransp: check for client certs by name first, then file
CVE-2021-22926

Bug: https://curl.se/docs/CVE-2021-22926.html

Assisted-by: Daniel Gustafsson
Reported-by: Harry Sintonen
2021-07-20 09:36:06 +02:00
Daniel Stenberg
894f6ec730
telnet: fix option parser to not send uninitialized contents
CVS-2021-22925

Reported-by: Red Hat Product Security
Bug: https://curl.se/docs/CVE-2021-22925.html
2021-07-20 09:36:06 +02:00
Jay Satiro
12284e008b connect: fix wrong format specifier in connect error string
0842175 (not in any release) used the wrong format specifier (long int)
for timediff_t. On an OS such as Windows libcurl's timediff_t (usually
64-bit) is bigger than long int (32-bit). In 32-bit Windows builds the
upper 32-bits of the timediff_t were erroneously then used by the next
format specifier. Usually since the timeout isn't larger than 32-bits
this would result in null as a pointer to the string with the reason for
the connection failing. On other OSes or maybe other compilers it could
probably result in garbage values (ie crash on deref).

Before:
Failed to connect to localhost port 12345 after 1201 ms: (nil)

After:
Failed to connect to localhost port 12345 after 1203 ms: Connection refused

Closes https://github.com/curl/curl/pull/7449
2021-07-20 02:16:53 -04:00
Daniel Stenberg
9a7a60dbd1
misc: copyright year range updates 2021-07-19 09:20:58 +02:00
MAntoniak
9a47d77126
lib: fix compiler warnings with CURL_DISABLE_NETRC
warning C4189: 'netrc_user_changed': local variable is initialized but
not referenced

warning C4189: 'netrc_passwd_changed': local variable is initialized but
not referenced

Closes #7423
2021-07-18 18:37:05 +02:00
Josie Huddleston
c12ad2d4e8
easy: during upkeep, attach Curl_easy to connections in the cache
During the protocol-specific parts of connection upkeep, some code
assumes that the data->conn pointer already is set correctly.  However,
there's currently no guarantee of that in the code.

This fix temporarily attaches each connection to the Curl_easy object
before performing the protocol-specific connection check on it, in a
similar manner to the connection checking in extract_if_dead().

Fixes #7386
Closes #7387
Reported-by: Josie Huddleston
2021-07-17 23:43:55 +02:00
Josh Soref
de1004eb0f
cleanup: spell DoH with a lowercase o
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>

Closes #7413
2021-07-16 23:53:13 +02:00
MAntoniak
d84fb30681
mbedtls: Remove unnecessary include
- curl_setup.h: all references to mbedtls_md4* functions and structures
  are in the md4.c. This file already includes the <mbedtls/md4.h> file
  along with the file existence control (defined (MBEDTLS_MD4_C))

- curl_ntlm_core.c: unnecessary include - repeated below

Closes #7419
2021-07-16 23:45:50 +02:00
User Sg
6a66f72829 multi: fix crash in curl_multi_wait / curl_multi_poll
Appears to have been caused by 51c0ebc (precedes 7.77.0) which added a
VALID_SOCK check to one of the loops through the sockets but not the
other.

Reported-by: sylgal@users.noreply.github.com
Authored-by: sylgal@users.noreply.github.com

Fixes https://github.com/curl/curl/issues/7379
Closes https://github.com/curl/curl/pull/7389
2021-07-16 14:17:47 -04:00
Sergey Markelov
e919848ead build: fix compiler warnings when CURL_DISABLE_VERBOSE_STRINGS
fix compiler warnings about unused variables and parameters when
built with --disable-verbose.

Closes https://github.com/curl/curl/pull/7377
2021-07-16 13:55:52 -04:00
Gisle Vanem
c6fd7cbf10 [SChannel] Use '_tcsncmp()' instead
Revert previous change for PellesC. 

Instead replace all use of `_tcsnccmp()` with `_tcsncmp()`.
2021-07-16 07:30:35 +02:00
Gisle Vanem
3cd9a23e80 [PellesC] missing '_tcsnccmp'
PellesC compiler does not have this macro in it's `<tchar.h>`
2021-07-16 07:30:35 +02:00
Jonathan Wernberg
9bf79d0a5a
Revert "ftp: Expression 'ftpc->wait_data_conn' is always false"
The reverted commit introduced a logic error in code that was
correct.

The client using libcurl would notice the error since FTP file
uploads in active transfer mode would somtimes complete with
success despite no transfer having been performed and the
"uploaded" file thus not being on the remote server afterwards.

The FTP server would notice the error because it receives a
RST on the data connection it has established with the client
before any data was transferred at all.

The logic error happens if the STOR response from the server have
arrived by the time ftp_multi_statemach() in the affected code path
is called, but the incoming data connection have not arrived yet.
In that case, the processing of the STOR response will cause
'ftpc->wait_data_conn' to be set to TRUE, contradicting the comment
in the code. Since 'complete' will also be set, later logic would
believe the transfer was done.

In most cases, the STOR response will not have arrived yet when
the affected code path is executed, or the incoming connection will
also have arrived, and thus the error would not express itself.
But if the speed difference of the device using libcurl and the
FTP server is exactly right, the error may happen as often as in
one out of hundred file transfers.

This reverts commit 49f3117a23.

Bug: https://curl.se/mail/lib-2021-07/0025.html
Closes #7362
2021-07-08 10:18:25 +02:00
Daniel Stenberg
9053dbbf62
msnprintf: return number of printed characters excluding null byte
... even when the output is "capped" by the maximum length argument.

Clarified in the docs.

Closes #7361
2021-07-08 10:05:39 +02:00
Daniel Stenberg
e7416cfd2b
infof: remove newline from format strings, always append it
- the data needs to be "line-based" anyway since it's also passed to the
  debug callback/application

- it makes infof() work like failf() and consistency is good

- there's an assert that triggers on newlines in the format string

- Also removes a few instances of "..."

- Removes the code that would append "..." to the end of the data *iff*
  it was truncated in infof()

Closes #7357
2021-07-07 22:54:01 +02:00