luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
27,647 Commits 20 Branches 224 Tags 202 MiB
8ef147c436
Commit Graph

2237 Commits

Author SHA1 Message Date
Patrick Monnerat
8ef147c436
ftp,imap,pop3,smtp: reject STARTTLS server response pipelining 
If a server pipelines future responses within the STARTTLS response, the
former are preserved in the pingpong cache across TLS negotiation and
used as responses to the encrypted commands.

This fix detects pipelined STARTTLS responses and rejects them with an
error.

CVE-2021-22947

Bug: https://curl.se/docs/CVE-2021-22947.html
 2021-09-13 16:51:31 +02:00
Patrick Monnerat
364f174724
ftp,imap,pop3: do not ignore --ssl-reqd 
In imap and pop3, check if TLS is required even when capabilities
request has failed.

In ftp, ignore preauthentication (230 status of server greeting) if TLS
is required.

Bug: https://curl.se/docs/CVE-2021-22946.html

CVE-2021-22946
 2021-09-13 16:51:31 +02:00
Daniel Stenberg
4a8fa48946
http_proxy: fix the User-Agent inclusion in CONNECT 
It should not refer to the uagent string that is allocated and created
for the end server http request, as that pointer may be cleared on
subsequent CONNECT requests.

Added test case 1184 to verify.

Reported-by: T200proX7 on github
Fixes #7705
Closes #7707
 2021-09-13 12:29:59 +02:00
Daniel Stenberg
eb2a5171da
curl: stop retry if Retry-After: is longer than allowed 
If Retry-After: specifies a period that is longer than what fits within
--retry-max-time, then stop retrying immediately.

Added test 366 to verify.

Reported-by: Kari Pahula
Fixes #7675
Closes #7676
 2021-09-06 14:46:45 +02:00
Daniel Stenberg
8fbdf8331e
test1173: check references to libcurl options 
... that they refer to actual existing libcurl options.

Reviewed-by: Daniel Gustafsson
Closes #7656
 2021-09-04 11:27:56 +02:00
Daniel Stenberg
424051d78b
connect: get local port + ip also when reusing connections 
Regression. In d6a37c23a3 (7.75.0) we removed the duplicated storage
(connection + easy handle), so this info needs be extracted again even
for re-used connections.

Add test 435 to verify

Reported-by: Max Dymond
Fixes #7660
Closes #7662
 2021-09-02 23:42:18 +02:00
Daniel Stenberg
3f4b1b4ee5
tests: adjust the tftpd output to work with hyper mode 
By making them look less like http headers, the hyper mode "tweak"
doesn't interfere.

Enable test 2002 and 2003 in hyper builds (and 1280 which is unrelated
but should be enabled).

Closes #7658
 2021-09-01 23:40:28 +02:00
Daniel Stenberg
e8c8775eaa
test365: verify response with chunked AND Content-Length headers 2021-08-31 10:04:03 +02:00
Daniel Stenberg
8a16e54c0c
http: ignore content-length if any transfer-encoding is used 
Fixes #7643
Closes #7649
 2021-08-31 10:04:03 +02:00
Daniel Stenberg
5dc594e44f
http: disallow >3-digit response codes 
Make the built-in HTTP parser behave similar to hyper and reject any
HTTP response using more than 3 digits for the response code.

Updated test 1432 accordingly.
Enabled test 1432 in the hyper builds.

Closes #7641
 2021-08-26 22:43:38 +02:00
Daniel Stenberg
9df52bf17a
test1280: CRLFify the response to please hyper 
Closes #7639
 2021-08-26 16:17:10 +02:00
Daniel Stenberg
9a30ac0957
tests: enable test 1129 for hyper builds 
Closes #7638
 2021-08-26 16:15:48 +02:00
Daniel Stenberg
e5d77dc2ca
c-hyper: handle HTTP/1.1 => HTTP/1.0 downgrade on reused connection 
Enable test 1074

Closes #7617
 2021-08-23 16:12:33 +02:00
Daniel Stenberg
38941ad6f3
c-hyper: deal with Expect: 100-continue combined with POSTFIELDS 
Enable test 1130 and 1131

Closes #7616
 2021-08-23 16:10:15 +02:00
Daniel Stenberg
473b893c7e
DISABLED: enable 11 more tests for hyper builds 
Closes #7612
 2021-08-23 11:24:25 +02:00
Daniel Stenberg
46d4373ea7
setopt: enable CURLOPT_IGNORE_CONTENT_LENGTH for hyper 
Since this option is also used for FTP, it needs to work to set for
applications even if hyper doesn't support it for HTTP. Verified by test
1137.

Updated docs to specify that the option doesn't work for HTTP when using
the hyper backend.

Closes #7614
 2021-08-23 11:23:17 +02:00
Daniel Stenberg
0854781c18
test1138: remove trailing space to make work with hyper 
Closes #7613
 2021-08-23 11:21:38 +02:00
Daniel Stenberg
4e53b9430c
man pages: remove trailing whitespaces 
Extended test 1173 (via the manpage-syntax.pl script) to detect and warn
for them.

Ref: #7602
Reported-by: a1346054 on github
Closes #7604
 2021-08-21 16:44:03 +02:00
Daniel Stenberg
059379d20c
http_proxy: fix user-agent and custom headers for CONNECT with hyper 
Enable test 287

Closes #7598
 2021-08-20 13:51:06 +02:00
Daniel Stenberg
f46b83fc94
c-hyper: initial support for "dumping" 1xx HTTP responses 
With the use hyper_request_on_informational()

Enable test 155 and 158

Closes #7597
 2021-08-20 13:37:43 +02:00
Daniel Stenberg
32f6812b5a
c-hyper: initial step for 100-continue support 
Enabled test 154

Closes #7568
 2021-08-13 23:18:21 +02:00
Daniel Stenberg
c495dcd02e
http: consider cookies over localhost to be secure 
Updated test31.
Added test 392 to verify secure cookies used for http://localhost

Reviewed-by: Daniel Gustafsson
Fixes #6733
Closes #7263
 2021-08-10 11:20:21 +02:00
Bernhard M. Wiedemann
8d0c1137c1
tests: make three tests pass until 2037 
after 2038 something in test1915 fails on 32-bit OSes

Closes #7512
 2021-07-30 12:39:34 +02:00
Josh Soref
de1004eb0f
cleanup: spell DoH with a lowercase o 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>

Closes #7413
 2021-07-16 23:53:13 +02:00
Daniel Stenberg
c3d612662d
test1147: hyper doesn't allow "crazy" request headers like built-in 
... so strip that from the test.

Closes #7349
 2021-07-05 22:51:13 +02:00
Daniel Stenberg
a62ece3f57
c-hyper: bail on too long response headers 
To match with built-in behaviors. Makes test 1154 work.

Closes #7350
 2021-07-05 22:49:12 +02:00
Daniel Stenberg
0965348cd8
test1151: added missing CRLF to work with hyper 
Closes #7350
 2021-07-05 22:49:02 +02:00
Daniel Stenberg
e41feede34
test1116: hyper doesn't pass through "surprise-trailers" 
Closes #7344
 2021-07-05 22:39:42 +02:00
Daniel Stenberg
07fa74d34a
test1519: adjusted to work with hyper 
Closes #7333
 2021-07-01 14:26:06 +02:00
Daniel Stenberg
a80f8ea182
test1518: adjusted to work with hyper 
... by making sure the stdout output doesn't look like HTTP headers.

Closes #7333
 2021-07-01 14:25:57 +02:00
Daniel Stenberg
7f11282d5f
test1514: add a CRLF to the response to make it correct 
Makes hyper accept it fine instead returning HYPERE_UNEXPECTED_EOF on
us.

Closes #7334
 2021-07-01 14:19:55 +02:00
Daniel Stenberg
a5ab72d5ed
test677: IMAP CONNECT_ONLY, custom command and then exit 
Adjusted ftpserver.pl to add support for the IMAP IDLE command

Adjusted test 660 to sync with the fix
 2021-06-24 09:07:40 +02:00
Daniel Stenberg
80e1054fe5
hyper: propagate errors back up from read callbacks 
Makes test 513 work with hyper

Closes #7266
 2021-06-17 08:19:31 +02:00
Daniel Stenberg
b67d3ba73e
curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE 
They were never officially allowed and slipped in only due to sloppy
parsing. Spaces (ascii 32) should be correctly encoded (to %20) before
being part of a URL.

The new flag bit CURLU_ALLOW_SPACE when a full URL is set, makes libcurl
allow spaces.

Updated test 1560 to verify.

Closes #7073
 2021-06-15 10:49:49 +02:00
Daniel Stenberg
bbbc5de93f
netrc: skip 'macdef' definitions 
Add test 494 to verify

Reported-by: Harry Sintonen
Fixes #7238
Closes #7244
 2021-06-13 23:44:41 +02:00
Gealber Morales
791937b881
mqtt: add support for username and password 
Minor-edits-by: Daniel Stenberg
Added test 2200 to 2205

Closes #7243
 2021-06-12 23:50:13 +02:00
Daniel Stenberg
7cfd8f037a
tests/data/DISABLED: add tests not working with hyper 
The goal is to remove them all from here over time.

Closes #7209
 2021-06-10 08:42:55 +02:00
Daniel Stenberg
77ae8f26ad
test3010: work with hyper mode 
Closes #7209
 2021-06-10 08:42:50 +02:00
Daniel Stenberg
75391045cf
test1594/1595/1596: fix to work in hyper mode 
Closes #7209
 2021-06-10 08:42:44 +02:00
Daniel Stenberg
30e50de53e
test1438/1457: add HTTP keyword to make hyper mode work 
Closes #7209
 2021-06-10 08:42:41 +02:00
Daniel Stenberg
5f70cb6461
test1340/1341: adjusted for hyper mode 
Closes #7209
 2021-06-10 08:42:38 +02:00
Daniel Stenberg
769d9176e3
test1218: adjusted for hyper mode 
Closes #7209
 2021-06-10 08:42:35 +02:00
Daniel Stenberg
6101ddc24e
test1216: adjusted for hyper mode 
Closes #7209
 2021-06-10 08:42:33 +02:00
Daniel Stenberg
340d6b4589
test1230: adjust to work in hyper mode 
Closes #7209
 2021-06-10 08:42:30 +02:00
Daniel Stenberg
c214a6a17b
c-hyper: abort CONNECT response reading early on non 2xx responses 
Fixes test 493

Closes #7209
 2021-06-10 08:42:27 +02:00
Daniel Stenberg
aeb064db03
test434: add HTTP keyword 
Closes #7209
 2021-06-10 08:42:23 +02:00
Daniel Stenberg
e7ae6f013d
test599: adjusted to work in hyper mode 
Closes #7209
 2021-06-10 08:42:19 +02:00
Daniel Stenberg
cd5ca9bb38
test566: adjust to work with hyper mode 
Closes #7209
 2021-06-10 08:42:13 +02:00
Daniel Stenberg
3ac9b80525
test644: remove as duplicate of test 587 
Closes #7208
 2021-06-08 16:07:56 +02:00
Daniel Stenberg
48b0cca65e
test500: adjust to work with hyper mode 2021-06-07 23:54:54 +02:00