Daniel Stenberg [Tue, 12 May 2015 21:40:10 +0000 (23:40 +0200)]
conncache: keep bundles on host+port bases, not only host names
Previously we counted all connections to a specific host name and that
would be used for the CURLMOPT_MAX_HOST_CONNECTIONS check for example,
while servers on different port numbers are normally considered
different "origins" on the web and should thus be considered different
hosts.
Daniel Stenberg [Tue, 12 May 2015 21:06:11 +0000 (23:06 +0200)]
bundles: merged into conncache.c
All the existing Curl_bundle* functions were only ever used from within
the conncache.c file, so I moved them over and made them static (and
removed the Curl_ prefix).
Daniel Stenberg [Tue, 12 May 2015 07:46:53 +0000 (09:46 +0200)]
hostcache: made all host caches use structs, not pointers
This avoids unnecessary dynamic allocs and as this also removed the last
users of *hash_alloc() and *hash_destroy(), those two functions are now
removed.
FTP: Make EPSV use the control IP address rather than the original host.
This ensures an alternate address is not used.
Does not apply to proxy tunnel.
Daniel Stenberg [Mon, 4 May 2015 10:27:59 +0000 (12:27 +0200)]
openssl: skip trace outputs for ssl_ver == 0
The OpenSSL trace callback is wonderfully undocumented but given a
journey in the source code, it seems the cases were ssl_ver is zero
doesn't follow the same pattern and thus turned out confusing and
misleading. For now, we skip doing any CURLINFO_TEXT logging on those
but keep sending them as CURLINFO_SSL_DATA_OUT/IN.
Also, I added direction to the text info and I edited some functions
slightly.
Bug: https://github.com/bagder/curl/issues/219 Reported-by: Jay Satiro, Ashish Shukla
Michael Osipov [Thu, 30 Apr 2015 08:06:09 +0000 (10:06 +0200)]
configure: remove missing and make it autogenerate
The missing file has not been autogenerated because a temporary fix was
employed in acinclude.m4 which blocked update. Removed that fix and a recent
version of missing is copied to build root.
Viktor Szakats [Thu, 30 Apr 2015 06:29:00 +0000 (08:29 +0200)]
build: update depedency versions, urls, example makefiles
- update default versions of dependencies (except for rare/old platforms)
- update urls
- sync examples makefiles with main ones
- remove line ending space
Michael Osipov [Wed, 29 Apr 2015 20:51:04 +0000 (22:51 +0200)]
configure: remove autogenerated files by autoconf
* install-sh is always regenerated
* mkinstalldirs was already redudant years ago. Automake uses install for
that. See: http://lists.gnu.org/archive/html/automake/2007-03/msg00015.html
Anthony Avina [Sat, 25 Apr 2015 18:49:39 +0000 (14:49 -0400)]
tool: New option --data-raw to HTTP POST data, '@' allowed.
Add new option --data-raw which is almost the same as --data but does
not have a special interpretation of the @ character.
Prior to this change there was no (easy) way to pass the @ character as
the first character in POST data without it being interpreted as a
special character.
Daniel Stenberg [Fri, 24 Apr 2015 08:49:31 +0000 (10:49 +0200)]
ROADMAP.md: extended the HTTP/2 section, reformatted
Elaborated on several of the remaining HTTP/2 parts and made document
use a format that ends up nicer on the web page:
http://curl.haxx.se/dev/roadmap.html
Daniel Stenberg [Sat, 18 Apr 2015 21:50:16 +0000 (23:50 +0200)]
http_done: close Negotiate connections when done
When doing HTTP requests Negotiate authenticated, the entire connnection
may become authenticated and not just the specific HTTP request which is
otherwise how HTTP works, as Negotiate can basically use NTLM under the
hood. curl was not adhering to this fact but would assume that such
requests would also be authenticated per request.
CVE-2015-3148
Bug: http://curl.haxx.se/docs/adv_20150422B.html Reported-by: Isaac Boukris
Daniel Stenberg [Thu, 16 Apr 2015 21:52:04 +0000 (23:52 +0200)]
fix_hostname: zero length host name caused -1 index offset
If a URL is given with a zero-length host name, like in "http://:80" or
just ":80", `fix_hostname()` will index the host name pointer with a -1
offset (as it blindly assumes a non-zero length) and both read and
assign that address.
CVE-2015-3144
Bug: http://curl.haxx.se/docs/adv_20150422D.html Reported-by: Hanno Böck
Daniel Stenberg [Thu, 16 Apr 2015 14:37:40 +0000 (16:37 +0200)]
cookie: cookie parser out of boundary memory access
The internal libcurl function called sanitize_cookie_path() that cleans
up the path element as given to it from a remote site or when read from
a file, did not properly validate the input. If given a path that
consisted of a single double-quote, libcurl would index a newly
allocated memory area with index -1 and assign a zero to it, thus
destroying heap memory it wasn't supposed to.
CVE-2015-3145
Bug: http://curl.haxx.se/docs/adv_20150422C.html Reported-by: Hanno Böck
projects / curl / log