Commit Graph

16519 Commits

Author SHA1 Message Date
Daniel Stenberg
61d259f950 FTP: access files in root dir correctly
Accessing a file with an absolute path in the root dir but with no
directory specified was not handled correctly. This fix comes with four
new test cases that verify it.

Bug: http://curl.haxx.se/mail/lib-2013-04/0142.html
Reported by: Sam Deane
2013-04-12 22:43:13 +02:00
Steve Holme
c01735865f pop3: Reworked the function description for Curl_pop3_write() 2013-04-12 20:22:14 +01:00
Steve Holme
ca46c5dbe2 pop3: Added function description to pop3_parse_custom_request() 2013-04-12 20:22:12 +01:00
Steve Holme
2da127abb5 pop3: Moved utility functions to end of pop3.c 2013-04-12 20:22:10 +01:00
Nick Zitzmann
bc33f2200d darwinssl: add TLS session resumption
This ought to speed up additional TLS handshakes, at least in theory.
2013-04-12 12:20:10 -06:00
Steve Holme
fd399cde00 imap: Added function description to imap_parse_custom_request() 2013-04-12 18:27:51 +01:00
Steve Holme
00c74019f4 imap: Moved utility functions to end of imap.c (Part 3/3)
Moved imap_is_bchar() be with the other utility based functions.
2013-04-12 18:24:46 +01:00
Steve Holme
9d0063befa imap: Moved utility functions to end of imap.c (Part 2/3)
Moved imap_parse_url_path() and imap_parse_custom_request() to the end of the
file allowing all utility functions to be grouped together.
2013-04-12 18:24:44 +01:00
Steve Holme
01e55ebb26 imap: Moved utility functions to end of imap.c (Part 1/3)
Moved imap_atom() and imap_sendf() to the end of the file allowing all
utility functions to be grouped together.
2013-04-12 18:24:43 +01:00
Steve Holme
4bbad1dac7 imap: Corrected function description for imap_connect() 2013-04-12 18:14:43 +01:00
Kamil Dudka
ddbda328b3 tests: prevent test206, test1060, and test1061 from failing
... in case runtests.pl is invoked with non-default -b option

Fixes a regression caused by 1e29d275c6.
2013-04-12 14:25:58 +02:00
David Strauss
8ffbeeda80 libcurl-share.3: update what it does and does not share.
Update sharing interface documentation to provide exhaustive list of
what it does and does not share.
2013-04-12 13:35:29 +02:00
Daniel Stenberg
1d1ffaf912 THANKS: remove duplicated names 2013-04-12 12:37:47 +02:00
Daniel Stenberg
e0cff02061 bump: start working towards next release 2013-04-12 11:30:32 +02:00
Daniel Stenberg
7fe95bb0d5 THANKS: added people from the 7.30.0 RELEASE-NOTES 2013-04-12 11:30:12 +02:00
Daniel Stenberg
80d241046e RELEASE-NOTES: cleaned up for 7.30 (synced with 5c5e1a1cd2)
Most notable the security advisory:
http://curl.haxx.se/docs/adv_20130412.html
2013-04-12 00:05:39 +02:00
Daniel Stenberg
5c5e1a1cd2 test1218: another cookie tailmatch test
... and make 1216 also verify it with a file input

These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie
domain tailmatch" vulnerability. See
http://curl.haxx.se/docs/adv_20130412.html
2013-04-11 23:52:12 +02:00
YAMADA Yasuharu
2eb8dcf26c cookie: fix tailmatching to prevent cross-domain leakage
Cookies set for 'example.com' could accidentaly also be sent by libcurl
to the 'bexample.com' (ie with a prefix to the first domain name).

This is a security vulnerabilty, CVE-2013-1944.

Bug: http://curl.haxx.se/docs/adv_20130412.html
2013-04-11 23:52:12 +02:00
Guenter Knauf
96ffe645fd Enabled MinGW sync resolver builds. 2013-04-11 14:05:08 +02:00
Yang Tse
c86ea58304 if2ip.c: fix compiler warning 2013-04-10 16:44:54 +02:00
Guenter Knauf
577703495e Fixed lost OpenSSL output with "-t" - followup.
The previously applied patch didnt work on Windows; we cant rely
on shell commands like 'echo' since they act diffently on each
platform and each shell.
In order to keep this script platform-independent the code must
only use pure Perl.
2013-04-10 00:20:37 +02:00
Daniel Stenberg
f8da49eec0 test1217: verify parsing 257 responses with "rubbish" before path
Test 1217 verifies commit e0fb2d86c9, and without that change this
test fails.
2013-04-09 22:21:49 +02:00
Bill Middlecamp
e0fb2d86c9 FTP: handle "rubbish" in front of directory name in 257 responses
When doing PWD, there's a 257 response which apparently some servers
prefix with a comment before the path instead of after it as is
otherwise the norm.

Failing to parse this, several otherwise legitimate use cases break.

Bug: http://curl.haxx.se/mail/lib-2013-04/0113.html
2013-04-09 22:18:33 +02:00
Guenter Knauf
658ec97055 Fixed ares-enabled builds with static makefiles. 2013-04-09 17:44:51 +02:00
Guenter Knauf
88535d593e Fixed lost OpenSSL output with "-t".
The OpenSSL pipe wrote to the final CA bundle file, but the encoded PEM
output wrote to a temporary file.  Consequently, the OpenSSL output was
lost when the temp file was renamed to the final file at script finish
(overwriting the final file written earlier by openssl).
Patch posted to the list by Richard Michael (rmichael edgeofthenet org).
2013-04-09 16:59:57 +02:00
Daniel Stenberg
11dee0bfae test1216: test tailmatching cookie domains
This test is an attempt to repeat the problem YAMADA Yasuharu reported
at http://curl.haxx.se/mail/lib-2013-04/0108.html
2013-04-09 15:45:27 +02:00
Daniel Stenberg
4594ee5e14 RELEASe-NOTES: synced with 29fdb2700f
added "tcpkeepalive on Mac OS X"
2013-04-09 14:49:27 +02:00
Nick Zitzmann
d7f4c3772e darwinssl: disable insecure ciphers by default
I noticed that aria2's SecureTransport code disables insecure ciphers such
as NULL, anonymous, IDEA, and weak-key ciphers used by SSLv3 and later.
That's a good idea, and now we do the same thing in order to prevent curl
from accessing a "secure" site that only negotiates insecure ciphersuites.
2013-04-08 17:07:20 -06:00
Robert Wruck
29fdb2700f tcpkeepalive: Support CURLOPT_TCP_KEEPIDLE on OSX
MacOS X doesn't have TCP_KEEPIDLE/TCP_KEEPINTVL but only a single
TCP_KEEPALIVE (see
http://developer.apple.com/library/mac/#DOCUMENTATION/Darwin/Reference/ManPages/man4/tcp.4.html).
Here is a patch for CURLOPT_TCP_KEEPIDLE on OSX platforms.
2013-04-08 23:13:05 +02:00
Daniel Stenberg
32144ca241 configure: remove CURL_CHECK_FUNC_RECVFROM
1 - We don't use the results from the test and we never did. recvfrom()
is only used by the TFTP code and it has not caused any problems.

2 - the CURL_CHECK_FUNC_RECVFROM function is extremely slow
2013-04-08 22:22:43 +02:00
Steve Holme
4990f46856 RELEASE-NOTES: Corrected duplicate NTLM memory leaks 2013-04-08 20:59:50 +01:00
Steve Holme
5e24db0cba RELEASE-NOTES: Removed trailing full stop 2013-04-08 20:34:29 +01:00
Fabian Keil
638c6da9db proxy: make ConnectionExists() check credential of proxyconnections too
Previously it only compared credentials if the requested needle
connection wasn't using a proxy. This caused NTLM authentication
failures when using proxies as the authentication code wasn't send on
the connection where the challenge arrived.

Added test 1215 to verify: NTLM server authentication through a proxy
(This is a modified copy of test 67)
2013-04-08 16:13:27 +02:00
Daniel Stenberg
9141c75bfb RELEASE-NOTES: sync with 704a5dfca9 2013-04-08 08:43:18 +02:00
Daniel Stenberg
704a5dfca9 TODO-RELEASE: cleaned up, not really maintained lately 2013-04-08 08:32:10 +02:00
Marc Hoersken
6b8c36954f if2ip.c: Fixed another warning: unused parameter 'remote_scope' 2013-04-07 21:04:50 +02:00
Marc Hoersken
762961fe35 cookie.c: Made cookie sort function more deterministic
Since qsort implementations vary with regards to handling the order
of similiar elements, this change makes the internal sort function
more deterministic by comparing path length first, then domain length
and finally the cookie name. Spotted with testcase 62 on Windows.
2013-04-07 18:38:49 +02:00
Marc Hoersken
4b643f1ca4 curl_schannel.c: Follow up on memory leak fix ae4558d 2013-04-07 09:44:29 +02:00
Marc Hoersken
e73db5dcbd Revert "getpart.pm: Strip carriage returns to fix Windows support"
This reverts commit e51b23c925.
As discussed on the mailinglist, this was not the correct approach.
2013-04-07 00:28:15 +02:00
Marc Hoersken
25f08de4d6 http_negotiate.c: Fixed passing argument from incompatible pointer type 2013-04-07 00:06:19 +02:00
Marc Hoersken
f3bd2abb61 ftp.c: Added missing brackets around ABOR command logic 2013-04-06 23:11:20 +02:00
Marc Hoersken
4e2ed01a2e sockfilt.c: Fixed detection of client-side connection close
WINSOCK only:
Since FD_CLOSE is only signaled once, it may trigger at the same
time as FD_READ. Data actually being available makes it impossible
to detect that the connection was closed by checking that recv returns
zero. Another recv attempt could block the connection if it was
not closed. This workaround abuses exceptfds in conjunction with
readfds to signal that the connection has actually closed.
2013-04-06 23:09:50 +02:00
Marc Hoersken
ae4558dbb4 curl_schannel.c: Fixed memory leak if connection was not successful 2013-04-06 20:55:27 +02:00
Marc Hoersken
ee7669ba3a if2ip.c: Fixed warning: unused parameter 'remote_scope' 2013-04-06 20:30:13 +02:00
Marc Hoersken
e34bc917d6 runtests.pl: Fixed --verbose parameter passed to http_pipe.py 2013-04-06 20:24:10 +02:00
Marc Hoersken
2ba0f1373c sockfilt.c: Reduce CPU load while running under a Windows PIPE 2013-04-06 19:05:16 +02:00
Marc Hoersken
b4fae9d73f tftpd.c: Apply sread timeout to the whole data transfer session 2013-04-06 19:00:42 +02:00
Marc Hoersken
e51b23c925 getpart.pm: Strip carriage returns to fix Windows support 2013-04-06 18:10:56 +02:00
Daniel Stenberg
18f0ab7bd3 ftp tests: libcurl returns CURLE_FTP_ACCEPT_FAILED better now
Since commit 57aeabcc1a, it handles errors on the control connection
while waiting for the data connection better.

Test 591 and 592 are updated accordingly.
2013-04-06 17:51:03 +02:00
Daniel Stenberg
57aeabcc1a FTP: wait on both connections during active STOR state
When doing PORT and upload (STOR), this function needs to extract the
file descriptor for both connections so that it will respond immediately
when the server eventually connects back.

This flaw caused active connections to become unnecessary slow but they
would still often work due to the normal polling on a timeout. The bug
also would not occur if the server connected back very fast, like when
testing on local networks.

Bug: http://curl.haxx.se/bug/view.cgi?id=1183
Reported by: Daniel Theron
2013-04-06 17:21:38 +02:00