]> granicus.if.org Git - curl/log
curl
6 years agomulti: remove a DEBUGF()
Daniel Stenberg [Fri, 1 Jun 2018 10:55:41 +0000 (12:55 +0200)]
multi: remove a DEBUGF()

... it might call infof() with a NULL first argument that isn't harmful
but makes it not do anything. The infof() line is not very useful
anymore, it has served it purpose. Good riddance!

Fixes #2627

6 years agoCURLOPT_RESOLVE: always purge old entry first
Alibek.Jorajev [Wed, 30 May 2018 14:23:35 +0000 (15:23 +0100)]
CURLOPT_RESOLVE: always purge old entry first

If there's an existing entry using the selected name.

Closes #2622

6 years agofnmatch: use the system one if available
Daniel Stenberg [Thu, 31 May 2018 13:57:54 +0000 (15:57 +0200)]
fnmatch: use the system one if available

If configure detects fnmatch to be available, use that instead of our
custom one for FTP wildcard pattern matching. For standard compliance,
to reduce our footprint and to use already well tested and well
exercised code.

A POSIX fnmatch behaves slightly different than the internal function
for a few test patterns currently and the macOS one yet slightly
different. Test case 1307 is adjusted for these differences.

Closes #2626

6 years agoos400: add new option in ILE/RPG binding
Patrick Monnerat [Thu, 31 May 2018 17:08:03 +0000 (19:08 +0200)]
os400: add new option in ILE/RPG binding

Follow-up to commit 946ce5b

6 years agotests/libtest/.gitignore: follow-up fix to ignore lib5* too
Daniel Stenberg [Thu, 31 May 2018 15:42:52 +0000 (17:42 +0200)]
tests/libtest/.gitignore: follow-up fix to ignore lib5* too

6 years agoKNOWN_BUGS: CURL_GLOBAL_SSL
Daniel Stenberg [Thu, 31 May 2018 15:41:42 +0000 (17:41 +0200)]
KNOWN_BUGS: CURL_GLOBAL_SSL

Closes #2276

6 years agoconfigure: check for declaration of getpwuid_r
Bernhard Walle [Sun, 27 May 2018 17:51:04 +0000 (19:51 +0200)]
configure: check for declaration of getpwuid_r

On our x86 Android toolchain, getpwuid_r is implemented but the header
is missing:

 netrc.c:81:7: error: implicit declaration of function 'getpwuid_r' [-Werror=implicit-function-declaration]

Unfortunately, the function is used in curl_ntlm_wb.c, too, so I moved
the prototype to curl_setup.h.

Signed-off-by: Bernhard Walle <bernhard@bwalle.de>
Closes #2609

6 years agotests: update .gitignore for libtests
Rikard Falkeborn [Wed, 30 May 2018 21:35:27 +0000 (23:35 +0200)]
tests: update .gitignore for libtests

Closes #2624

6 years agostrictness: correct {infof, failf} format specifiers
Rikard Falkeborn [Mon, 28 May 2018 19:46:22 +0000 (21:46 +0200)]
strictness: correct {infof, failf} format specifiers

Closes #2623

6 years agooption: disallow username in URL
Björn Stenberg [Sun, 25 Feb 2018 19:17:25 +0000 (20:17 +0100)]
option: disallow username in URL

Adds CURLOPT_DISALLOW_USERNAME_IN_URL and --disallow-username-in-url. Makes
libcurl reject URLs with a username in them.

Closes #2340

6 years agolibcurl-security.3: improved layout for two rememdy lists
Daniel Stenberg [Thu, 31 May 2018 09:19:05 +0000 (11:19 +0200)]
libcurl-security.3: improved layout for two rememdy lists

6 years agolibcurl-security.3: refer to URL instead of in-source markdown file
Daniel Stenberg [Thu, 31 May 2018 09:11:38 +0000 (11:11 +0200)]
libcurl-security.3: refer to URL instead of in-source markdown file

6 years agocurl.rc: embed manifest for correct Windows version detection
Viktor Szakats [Wed, 30 May 2018 12:08:26 +0000 (12:08 +0000)]
curl.rc: embed manifest for correct Windows version detection

* enable it in `src/Makefile.m32`
* enable it in `winbuild/MakefileBuild.vc` if a custom manifest is
  _not_ enabled via the existing `EMBED_MANIFEST` option
* enable it for all Windows CMake builds (also disable the built-in
  minimal manifest, added by CMake by default.)

For other build systems, add the `-DCURL_EMBED_MANIFEST` option to
the list of RC (Resource Compiler) flags to enable the manifest
included in `src/curl.rc`. This may require to disable whatever
automatic or other means in which way another manifest is added to
`curl.exe`.

Notice that Borland C doesn't support this method due to a
long-pending resource compiler bug. Watcom C may also not handle
it correctly when the `-zm` `wrc` option is used (this option may
be unnecessary though) and regardless of options in certain earlier
revisions of the 2.0 beta version.

Closes https://github.com/curl/curl/pull/1221
Fixes https://github.com/curl/curl/issues/2591

6 years agoos400: sync EBCDIC wrappers and ILE/RPG binding with latest options
Patrick Monnerat [Tue, 29 May 2018 23:45:40 +0000 (01:45 +0200)]
os400: sync EBCDIC wrappers and ILE/RPG binding with latest options

6 years agoos400: implement mime api EBCDIC wrappers
Patrick Monnerat [Tue, 29 May 2018 22:38:37 +0000 (00:38 +0200)]
os400: implement mime api EBCDIC wrappers

Also sync ILE/RPG binding to define the new functions.

6 years agosetopt: add TLS 1.3 ciphersuites
Daniel Stenberg [Tue, 29 May 2018 14:12:52 +0000 (16:12 +0200)]
setopt: add TLS 1.3 ciphersuites

Adds CURLOPT_TLS13_CIPHERS and CURLOPT_PROXY_TLS13_CIPHERS.

curl: added --tls13-ciphers and --proxy-tls13-ciphers

Fixes #2435
Reported-by: zzq1015 on github
Closes #2607

6 years agoconfigure: override AR_FLAGS to silence warning
Daniel Stenberg [Tue, 29 May 2018 08:26:06 +0000 (10:26 +0200)]
configure: override AR_FLAGS to silence warning

The automake default ar flags are 'cru', but the 'u' flag in there
causes warnings on many modern Linux distros. Removing 'u' may have a
minor performance impact on older distros but should not cause harm.

Explained on the automake mailing list already back in April 2015:

https://www.mail-archive.com/automake-patches@gnu.org/msg07705.html

Reported-by: elephoenix on github
Fixes #2617
Closes #2619

6 years agocmake: fixed comments in compile checks code
Sergei Nikulov [Mon, 28 May 2018 06:01:48 +0000 (09:01 +0300)]
cmake: fixed comments in compile checks code

6 years agoINSTALL: LDFLAGS=-Wl,-R/usr/local/ssl/lib
Daniel Stenberg [Mon, 28 May 2018 21:54:19 +0000 (23:54 +0200)]
INSTALL: LDFLAGS=-Wl,-R/usr/local/ssl/lib

... the older description doesn't work

Reported-by: Peter Varga
Fixes #2615
Closes #2616

6 years agoKNOWN_BUGS: restore text regarding #2101.
Will Dietz [Tue, 29 May 2018 03:17:07 +0000 (22:17 -0500)]
KNOWN_BUGS: restore text regarding #2101.

This was added earlier but appears to have been removed accidentally.

AFAICT this is very much still an issue.

-----

I say "accidentally" because the text seems to have harmlessly snuck
into [1] (which makes no mention of it).  [1] was later reverted for
unspecified reasons in [2], presumably because the mentioned issue was
fixed or invalid.

[1] de9fac00c40db321d44fa6fbab6eb62ec4c83998
[2] 16d1f369403cbb04bd7b085eabbeebf159473fc2

Closes #2618

6 years agofnmatch: insist on escaped bracket to match
Daniel Stenberg [Sun, 27 May 2018 21:24:27 +0000 (23:24 +0200)]
fnmatch: insist on escaped bracket to match

A non-escaped bracket ([) is for a character group - as documented. It
will *not* match an individual bracket anymore. Test case 1307 updated
accordingly to match.

Problem detected by OSS-Fuzz, although this fix is probably not a final
fix for the notorious timeout issues.

Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8525
Closes #2614

6 years agopsl: use latest psl and refresh it periodically
Patrick Monnerat [Mon, 28 May 2018 18:29:15 +0000 (20:29 +0200)]
psl: use latest psl and refresh it periodically

The latest psl is cached in the multi or share handle. It is refreshed
before use after 72 hours.
New share lock CURL_LOCK_DATA_PSL controls the psl cache sharing.
If the latest psl is not available, the builtin psl is used.

Reported-by: Yaakov Selkowitz
Fixes #2553
Closes #2601

6 years agoconfigure: fix ssh2 linking when built with a static mbedtls
Fabrice Fontaine [Mon, 21 May 2018 10:07:00 +0000 (12:07 +0200)]
configure: fix ssh2 linking when built with a static mbedtls

The ssh2 pkg-config file could contain the following lines when build
with a static version of mbedtls:
   Libs: -L${libdir} -lssh2 /xxx/libmbedcrypto.a
   Libs.private: /xxx/libmbedcrypto.a

This static mbedtls library must be used to correctly detect ssh2
support and this library must be copied in libcurl.pc otherwise
compilation of any application (such as upmpdcli) with libcurl will fail
when trying to found mbedtls functions included in libssh2.  So, replace
pkg-config --libs-only-l by pkg-config --libs.

Fixes:
 - http://autobuild.buildroot.net/results/43e24b22a77f616d6198c10435dcc23cc3b9088a

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Closes #2613

6 years agoRELEASE-NOTES: synced
Daniel Stenberg [Mon, 28 May 2018 15:44:38 +0000 (17:44 +0200)]
RELEASE-NOTES: synced

6 years agocmake: check for getpwuid_r
Bernhard Walle [Sun, 27 May 2018 08:38:07 +0000 (10:38 +0200)]
cmake: check for getpwuid_r

The autotools-based build system does it, so we do it also in CMake.

Bug: #2609
Signed-off-by: Bernhard Walle <bernhard@bwalle.de>
6 years agocmdline-opts/gen.pl: warn if mutexes: or see-also: list non-existing options
Daniel Stenberg [Mon, 28 May 2018 12:59:37 +0000 (14:59 +0200)]
cmdline-opts/gen.pl: warn if mutexes: or see-also: list non-existing options

6 years agocurl.1: Fix cmdline-opts reference errors.
Frank Gevaerts [Mon, 28 May 2018 12:17:51 +0000 (14:17 +0200)]
curl.1: Fix cmdline-opts reference errors.

--data, --form, and --ntlm were declared to be mutually exclusive with
non-existing options. --data and --form referred to --upload (which is
short for --upload-file and therefore did work, so this one was merely
a bit confusing), --ntlm referred to --negotiated instead of --negotiate.

Closes #2612

6 years agodocs: fix cmdline-opts metadata headers case consistency.
Frank Gevaerts [Mon, 28 May 2018 12:16:27 +0000 (14:16 +0200)]
docs: fix cmdline-opts metadata headers case consistency.

Almost all headers start with an uppercase letter, but some didn't.

6 years agomailmap: Max Savenkov
Daniel Stenberg [Mon, 28 May 2018 05:45:51 +0000 (07:45 +0200)]
mailmap: Max Savenkov

6 years agoFix the test for fsetxattr and strerror_r tests in CMake to work without compiling
maxed [Sat, 31 Mar 2018 10:17:45 +0000 (13:17 +0300)]
Fix the test for fsetxattr and strerror_r tests in CMake to work without compiling

6 years agomailmap: a Richard Alcock fixup
Daniel Stenberg [Sun, 27 May 2018 21:32:47 +0000 (23:32 +0200)]
mailmap: a Richard Alcock fixup

6 years agoschannel: add failf calls for client certificate failures
ralcock [Thu, 24 May 2018 15:00:19 +0000 (16:00 +0100)]
schannel: add failf calls for client certificate failures

Closes #2604

6 years agowinbuild: In MakefileBuild.vc fix typo DISTDIR->DIRDIST
richardthe3rd [Thu, 24 May 2018 20:35:38 +0000 (21:35 +0100)]
winbuild: In MakefileBuild.vc fix typo DISTDIR->DIRDIST

Change requirement from $(DISTDIR) to $(DIRDIST)

closes #2603

6 years agowinbuild: only delete OUTFILE if it exists
richardthe3rd [Thu, 24 May 2018 14:11:44 +0000 (15:11 +0100)]
winbuild: only delete OUTFILE if it exists

This removes the slightly annoying "Could not file LIBCURL_OBJS.inc" and
"Could not find CURL_OBJS.inc.inc" message when building into a clean
folder.

closes #2602

6 years agocontent_encoding: handle zlib versions too old for Z_BLOCK
Alejandro R. Sedeño [Fri, 25 May 2018 02:08:04 +0000 (22:08 -0400)]
content_encoding: handle zlib versions too old for Z_BLOCK

Fallback on Z_SYNC_FLUSH when Z_BLOCK is not available.

Fixes #2606
Closes #2608

6 years agomulti: provide a socket to wait for in Curl_protocol_getsock
Daniel Stenberg [Wed, 23 May 2018 22:21:37 +0000 (00:21 +0200)]
multi: provide a socket to wait for in Curl_protocol_getsock

... even when there's no protocol specific handler setup.

Bug: https://curl.haxx.se/mail/lib-2018-05/0062.html
Reported-by: Sean Miller
Closes #2600

6 years agohttpauth: add support for Bearer tokens
Linus Lewandowski [Tue, 22 May 2018 10:28:41 +0000 (12:28 +0200)]
httpauth: add support for Bearer tokens

Closes #2102

6 years agoTODO: CURLINFO_PAUSE_STATE
Daniel Stenberg [Thu, 24 May 2018 18:35:39 +0000 (20:35 +0200)]
TODO: CURLINFO_PAUSE_STATE

Closes #2588

6 years agocmake: set -d postfix for debug builds if not specified
Sergei Nikulov [Wed, 23 May 2018 21:37:53 +0000 (00:37 +0300)]
cmake: set -d postfix for debug builds if not specified
       using -DCMAKE_DEBUG_POSTFIX explicitly

       fixes #2121, obsoletes #2384

6 years agoconfigure: add basic test of --with-ssl prefix
Daniel Stenberg [Wed, 23 May 2018 12:26:49 +0000 (14:26 +0200)]
configure: add basic test of --with-ssl prefix

When given a prefix, the $PREFIX_OPENSSL/lib/openssl.pc or
$PREFIX_OPENSSL/include/openssl/ssl.h files must be present or cause an
error. Helps users detect when giving configure the wrong path.

Reported-by: Oleg Pudeyev
Assisted-by: Per Malmberg
Fixes #2580

6 years agohttp resume: skip body if http code 416 (range error) is ignored.
Patrick Monnerat [Tue, 22 May 2018 11:23:02 +0000 (13:23 +0200)]
http resume: skip body if http code 416 (range error) is ignored.

This avoids appending error data to already existing good data.

Test 92 is updated to match this change.
New test 1156 checks all combinations of --range/--resume, --fail,
Content-Range header and http status code 200/416.

Fixes #1163
Reported-By: Ithubg on github
Closes #2578

6 years agotftp: make sure error is zero terminated before printfing it
Daniel Stenberg [Tue, 22 May 2018 08:10:39 +0000 (10:10 +0200)]
tftp: make sure error is zero terminated before printfing it

6 years agoconfigure: add missing m4/ax_compile_check_sizeof.m4
Daniel Stenberg [Tue, 22 May 2018 06:03:06 +0000 (08:03 +0200)]
configure: add missing m4/ax_compile_check_sizeof.m4

follow-up to mistake in 6876ccf90b4

6 years agoschannel: make CAinfo parsing resilient to CR/LF
Johannes Schindelin [Mon, 21 May 2018 22:01:08 +0000 (00:01 +0200)]
schannel: make CAinfo parsing resilient to CR/LF

OpenSSL has supported --cacert for ages, always accepting LF-only line
endings ("Unix line endings") as well as CR/LF line endings ("Windows
line endings").

When we introduced support for --cacert also with Secure Channel (or in
cURL speak: "WinSSL"), we did not take care to support CR/LF line
endings, too, even if we are much more likely to receive input in that
form when using Windows.

Let's fix that.

Happily, CryptQueryObject(), the function we use to parse the ca-bundle,
accepts CR/LF input already, and the trailing LF before the END
CERTIFICATE marker catches naturally any CR/LF line ending, too. So all
we need to care about is the BEGIN CERTIFICATE marker. We do not
actually need to verify here that the line ending is CR/LF. Just
checking for a CR or an LF is really plenty enough.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Closes https://github.com/curl/curl/pull/2592

6 years agoCURLOPT_ACCEPT_ENCODING.3: add brotli and clarify a bit
Daniel Stenberg [Tue, 22 May 2018 06:23:30 +0000 (08:23 +0200)]
CURLOPT_ACCEPT_ENCODING.3: add brotli and clarify a bit

6 years agoRELEASE-NOTES: synced
Daniel Stenberg [Mon, 21 May 2018 22:01:13 +0000 (00:01 +0200)]
RELEASE-NOTES: synced

6 years agoKNOWN_BUGS: mention the -O with %-encoded file names
Daniel Stenberg [Mon, 21 May 2018 21:43:36 +0000 (23:43 +0200)]
KNOWN_BUGS: mention the -O with %-encoded file names

Closes #2573

6 years agochecksrc: make sure sizeof() is used *with* parentheses
Daniel Stenberg [Fri, 11 May 2018 21:40:58 +0000 (23:40 +0200)]
checksrc: make sure sizeof() is used *with* parentheses

... and unify the source code to adhere.

Closes #2563

6 years agocurl: added --styled-output
Daniel Stenberg [Thu, 17 May 2018 12:09:17 +0000 (14:09 +0200)]
curl: added --styled-output

It is enabled by default, so --no-styled-output will switch off the
detection/use of bold headers.

Closes #2538

6 years agocurl: show headers in bold
Daniel Stenberg [Thu, 17 May 2018 11:56:35 +0000 (13:56 +0200)]
curl: show headers in bold

The feature is only enabled if the output is believed to be a tty.

-J: There's some minor differences and improvements in -J handling, as
now J should work with -i and it actually creates a file first using the
initial name and then *renames* that to the one found in
Content-Disposition (if any).

-i: only shows headers for HTTP transfers now (as documented).
Previously it would also show for pieces of the transfer that were HTTP
(for example when doing FTP over a HTTP proxy).

-i: now shows trailers as well. Previously they were not shown at all.

--libcurl: the CURLOPT_HEADER is no longer set, as the header output is
now done in the header callback.

6 years agoconfigure: compile-time SIZEOF checks
Daniel Stenberg [Mon, 21 May 2018 17:54:16 +0000 (19:54 +0200)]
configure: compile-time SIZEOF checks

... instead of exeucting code to get the size. Removes the use of
LD_LIBRARY_PATH for this.

Fixes #2586
Closes #2589
Reported-by: Bernhard Walle
6 years agoconfigure: replace AC_TRY_RUN with CURL_RUN_IFELSE
Daniel Stenberg [Sat, 19 May 2018 09:24:33 +0000 (11:24 +0200)]
configure: replace AC_TRY_RUN with CURL_RUN_IFELSE

... and export LD_LIBRARY_PATH properly. This is a follow-up from
2d4c215.

Fixes #2586
Reported-by: Bernhard Walle
6 years agodocs: clarify CURLOPT_HTTPGET somewhat
Daniel Stenberg [Mon, 21 May 2018 08:26:24 +0000 (10:26 +0200)]
docs: clarify CURLOPT_HTTPGET somewhat

Reported-by: bsammon on github
Fixes #2590

6 years agocurl_fnmatch: only allow two asterisks for matching
Daniel Stenberg [Fri, 18 May 2018 14:48:13 +0000 (16:48 +0200)]
curl_fnmatch: only allow two asterisks for matching

The previous limit of 5 can still end up in situation that takes a very
long time and consumes a lot of CPU.

If there is still a rare use case for this, a user can provide their own
fnmatch callback for a version that allows a larger set of wildcards.

This commit was triggered by yet another OSS-Fuzz timeout due to this.
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8369

Closes #2587

6 years agochecksrc: fix too long line
Daniel Stenberg [Fri, 18 May 2018 15:56:18 +0000 (17:56 +0200)]
checksrc: fix too long line

follow-up to e05ad5d

6 years agodocs: mention HAproxy protocol "version 1"
Aleks [Fri, 18 May 2018 15:47:47 +0000 (17:47 +0200)]
docs: mention HAproxy protocol "version 1"

...as there's also a version 2.

Closes #2579

6 years agoexamples/progressfunc: make it build on older libcurls
Daniel Stenberg [Fri, 18 May 2018 08:28:17 +0000 (10:28 +0200)]
examples/progressfunc: make it build on older libcurls

This example was changed in ce2140a8c1 to use the new microsecond based
getinfo option. This change makes it conditionally keep using the older
option so that the example still builds with older libcurl versions.

Closes #2584

6 years agostub_gssapi: fix numerous 'unused parameter' warnings
Daniel Stenberg [Thu, 17 May 2018 22:06:59 +0000 (00:06 +0200)]
stub_gssapi: fix numerous 'unused parameter' warnings

follow-up to d9e92fd9fd1d

6 years agogetinfo: add microsecond precise timers for various intervals
Philip Prindeville [Thu, 17 May 2018 11:37:36 +0000 (13:37 +0200)]
getinfo: add microsecond precise timers for various intervals

Provide a set of new timers that return the time intervals using integer
number of microseconds instead of floats.

The new info names are as following:

CURLINFO_APPCONNECT_TIME_T
CURLINFO_CONNECT_TIME_T
CURLINFO_NAMELOOKUP_TIME_T
CURLINFO_PRETRANSFER_TIME_T
CURLINFO_REDIRECT_TIME_T
CURLINFO_STARTTRANSFER_TIME_T
CURLINFO_TOTAL_TIME_T

Closes #2495

6 years agoopenssl: acknowledge --tls-max for default version too
Daniel Stenberg [Tue, 15 May 2018 08:41:25 +0000 (10:41 +0200)]
openssl: acknowledge --tls-max for default version too

... previously it only used the max setting if a TLS version was also
explicitly asked for.

Reported-by: byte_bucket
Fixes #2571
Closes #2572

6 years agobump: start working on the pending 7.61.0
Daniel Stenberg [Thu, 17 May 2018 07:42:44 +0000 (09:42 +0200)]
bump: start working on the pending 7.61.0

6 years agotests/libtest/Makefile: Do not unconditionally add gcc-specific flags
Dagobert Michelsen [Wed, 16 May 2018 07:42:39 +0000 (09:42 +0200)]
tests/libtest/Makefile: Do not unconditionally add gcc-specific flags

The warning flag leads e.g. Sun Studio compiler to bail out.

Closes #2576

6 years agoschannel_verify: fix build for non-schannel
Daniel Stenberg [Wed, 16 May 2018 08:12:13 +0000 (10:12 +0200)]
schannel_verify: fix build for non-schannel

6 years agorand: fix typo
Jay Satiro [Wed, 16 May 2018 06:18:50 +0000 (02:18 -0400)]
rand: fix typo

6 years agoschannel: disable manual verify if APIs not available
Jay Satiro [Wed, 16 May 2018 06:02:29 +0000 (02:02 -0400)]
schannel: disable manual verify if APIs not available

.. because original MinGW and old compilers do not have the Windows API
definitions needed to support manual verification.

6 years agoschannel: disable client cert option if APIs not available
Archangel_SDY [Mon, 23 Apr 2018 14:12:43 +0000 (22:12 +0800)]
schannel: disable client cert option if APIs not available

Original MinGW targets Windows 2000 by default, which lacks some APIs and
definitions for this feature. Disable it if these APIs are not available.

Closes https://github.com/curl/curl/pull/2522

6 years agoRELEASE-NOTES: 7.60.0 release curl-7_60_0
Daniel Stenberg [Sun, 13 May 2018 21:33:37 +0000 (23:33 +0200)]
RELEASE-NOTES: 7.60.0 release

6 years agoTHANKS: added people from the curl 7.60.0 release
Daniel Stenberg [Sun, 13 May 2018 21:32:42 +0000 (23:32 +0200)]
THANKS: added people from the curl 7.60.0 release

6 years agodocs/libcurl/index.html: removed
Daniel Stenberg [Tue, 15 May 2018 14:41:55 +0000 (16:41 +0200)]
docs/libcurl/index.html: removed

The HTML files are long gone from the dist, now remove the last HTML
file pointing to those missing files.

d

6 years agohttp2: remove unused variable
steini2000 [Mon, 14 May 2018 15:49:06 +0000 (17:49 +0200)]
http2: remove unused variable

Closes #2570

6 years agohttp2: use easy handle of stream for logging
steini2000 [Mon, 14 May 2018 15:40:48 +0000 (17:40 +0200)]
http2: use easy handle of stream for logging

6 years agogcc: disable picky gcc-8 function pointer warnings in two places
Daniel Stenberg [Mon, 14 May 2018 07:55:34 +0000 (09:55 +0200)]
gcc: disable picky gcc-8 function pointer warnings in two places

Reported-by: Rikard Falkeborn
Bug: #2560
Closes #2569

6 years agohttp2: use the correct function pointer typedef
Daniel Stenberg [Mon, 14 May 2018 07:38:56 +0000 (09:38 +0200)]
http2: use the correct function pointer typedef

Fixes gcc-8 picky compiler warnings
Reported-by: Rikard Falkeborn
Bug: #2560
Closes #2568

6 years agoCODE_STYLE: mention return w/o parens, but sizeof with
Daniel Stenberg [Mon, 14 May 2018 08:19:52 +0000 (10:19 +0200)]
CODE_STYLE: mention return w/o parens, but sizeof with

... and remove the github markdown syntax so that it renders better on
the web site. Also, don't use back-ticks inlined to allow the CSS to
highlight source code better.

6 years agoexamples: Fix format specifiers
Rikard Falkeborn [Sun, 6 May 2018 17:44:03 +0000 (19:44 +0200)]
examples: Fix format specifiers

Closes #2561

6 years agotool: Fix format specifiers
Rikard Falkeborn [Fri, 11 May 2018 15:34:55 +0000 (17:34 +0200)]
tool: Fix format specifiers

6 years agontlm: Fix format specifiers
Rikard Falkeborn [Sat, 5 May 2018 20:09:04 +0000 (22:09 +0200)]
ntlm: Fix format specifiers

6 years agotests: Fix format specifiers
Rikard Falkeborn [Sun, 6 May 2018 19:20:32 +0000 (21:20 +0200)]
tests: Fix format specifiers

6 years agolib: Fix format specifiers
Rikard Falkeborn [Sun, 6 May 2018 18:32:24 +0000 (20:32 +0200)]
lib: Fix format specifiers

6 years agocontributors.sh: use "on github", not at
Daniel Stenberg [Mon, 14 May 2018 06:52:41 +0000 (08:52 +0200)]
contributors.sh: use "on github", not at

6 years agohttp2: getsock fix for uploads
Daniel Stenberg [Sat, 12 May 2018 19:58:46 +0000 (21:58 +0200)]
http2: getsock fix for uploads

When there's an upload in progress, make sure to wait for the socket to
become writable.

Detected-by: steini2000 on github
Bug: #2520
Closes #2567

6 years agopingpong: fix response cache memcpy overflow
Daniel Stenberg [Fri, 23 Mar 2018 22:30:04 +0000 (23:30 +0100)]
pingpong: fix response cache memcpy overflow

Response data for a handle with a large buffer might be cached and then
used with the "closure" handle when it has a smaller buffer and then the
larger cache will be copied and overflow the new smaller heap based
buffer.

Reported-by: Dario Weisser
CVE: CVE-2018-1000300
Bug: https://curl.haxx.se/docs/adv_2018-82c2.html

6 years agohttp: restore buffer pointer when bad response-line is parsed
Daniel Stenberg [Sat, 24 Mar 2018 22:47:41 +0000 (23:47 +0100)]
http: restore buffer pointer when bad response-line is parsed

... leaving the k->str could lead to buffer over-reads later on.

CVE: CVE-2018-1000301
Assisted-by: Max Dymond
Detected by OSS-Fuzz.
Bug: https://curl.haxx.se/docs/adv_2018-b138.html
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7105

6 years agocookies: do not take cookie name as a parameter
Patrick Monnerat [Sat, 12 May 2018 23:23:10 +0000 (01:23 +0200)]
cookies: do not take cookie name as a parameter

RFC 6265 section 4.2.1 does not set restrictions on cookie names.
This is a follow-up to commit 7f7fcd0.
Also explicitly check proper syntax of cookie name/value pair.

New test 1155 checks that cookie names are not reserved words.

Reported-By: anshnd at github
Fixes #2564
Closes #2566

6 years agosmb: reject negative file sizes
Daniel Stenberg [Sat, 12 May 2018 20:24:25 +0000 (22:24 +0200)]
smb: reject negative file sizes

Assisted-by: Max Dymond
Detected by OSS-Fuzz
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8245

6 years agosetup_transfer: deal with both sockets being -1
Daniel Stenberg [Fri, 11 May 2018 21:54:26 +0000 (23:54 +0200)]
setup_transfer: deal with both sockets being -1

Detected by Coverity; CID 1435559.  Follow-up to f8d608f38d00. It would
index the array with -1 if neither index was a socket.

6 years agotravis: add build using NSS
Daniel Stenberg [Thu, 10 May 2018 06:56:46 +0000 (08:56 +0200)]
travis: add build using NSS

Closes #2558

6 years agoopenssl: change FILE ops to BIO ops
Sunny Purushe [Tue, 17 Apr 2018 08:50:09 +0000 (04:50 -0400)]
openssl: change FILE ops to BIO ops

To make builds with VS2015 work. Recent changes in VS2015 _IOB_ENTRIES
handling is causing problems. This fix changes the OpenSSL backend code
to use BIO functions instead of FILE I/O functions to circumvent those
problems.

Closes #2512

6 years agotravis: add a build using WolfSSL
Daniel Stenberg [Tue, 24 Apr 2018 14:16:25 +0000 (16:16 +0200)]
travis: add a build using WolfSSL

Assisted-by: Dan Fandrich
Closes #2528

6 years agoRELEASE-NOTES: typo
Daniel Stenberg [Mon, 7 May 2018 12:30:18 +0000 (14:30 +0200)]
RELEASE-NOTES: typo

6 years agoRELEASE-NOTES: synced
Daniel Stenberg [Mon, 7 May 2018 08:32:42 +0000 (10:32 +0200)]
RELEASE-NOTES: synced

6 years agoURLs: fix one more http url
Daniel Gustafsson [Sat, 5 May 2018 19:27:09 +0000 (21:27 +0200)]
URLs: fix one more http url

This file wasn't included in commit 4af40b3646d3b09 which updated all
haxx.se http urls to https. The file was committed prior to that update,
but may have been merged after it and hence didn't get updated.

Closes #2550

6 years agogithub/lock: auto-lock closed issues after 90 days of inactivity
Daniel Stenberg [Sat, 5 May 2018 12:05:57 +0000 (14:05 +0200)]
github/lock: auto-lock closed issues after 90 days of inactivity

6 years agovtls: fix missing commas
Daniel Stenberg [Fri, 4 May 2018 21:02:36 +0000 (23:02 +0200)]
vtls: fix missing commas

follow-up to e66cca046cef

6 years agovtls: use unified "supports" bitfield member in backends
Daniel Stenberg [Fri, 4 May 2018 10:10:39 +0000 (12:10 +0200)]
vtls: use unified "supports" bitfield member in backends

... instead of previous separate struct fields, to make it easier to
extend and change individual backends without having to modify them all.

closes #2547

6 years agotransfer: don't unset writesockfd on setup of multiplexed conns
Daniel Stenberg [Fri, 4 May 2018 14:41:03 +0000 (16:41 +0200)]
transfer: don't unset writesockfd on setup of multiplexed conns

Curl_setup_transfer() can be called to setup a new individual transfer
over a multiplexed connection so it shouldn't unset writesockfd.

Bug: #2520
Closes #2549

6 years agoconfigure: put CURLDEBUG and DEBUGBUILD in lib/curl_config.h
Frank Gevaerts [Fri, 4 May 2018 12:31:16 +0000 (14:31 +0200)]
configure: put CURLDEBUG and DEBUGBUILD in lib/curl_config.h

They are removed from the compiler flags.

This ensures that make dependency tracking will force a rebuild whenever
configure --enable-debug or --enable-curldebug changes.

Closes #2548

6 years agohttp: don't set the "rewind" flag when not uploading anything
Daniel Stenberg [Fri, 4 May 2018 09:06:26 +0000 (11:06 +0200)]
http: don't set the "rewind" flag when not uploading anything

It triggers an assert.

Detected by OSS-Fuzz
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8144
Closes #2546

6 years agotravis: add an mbedtls build
Daniel Stenberg [Wed, 25 Apr 2018 07:20:08 +0000 (09:20 +0200)]
travis: add an mbedtls build

Closes #2531

6 years agoconfigure: only check for CA bundle for file-using SSL backends
Daniel Stenberg [Thu, 3 May 2018 12:54:10 +0000 (14:54 +0200)]
configure: only check for CA bundle for file-using SSL backends

When only building with SSL backends that don't use the CA bundle file
(by default), skip the check.

Fixes #2543
Fixes #2180
Closes #2545