Commit Graph

7715 Commits

Author SHA1 Message Date
Steve Holme
a10976b961 sspi: Fixed missing definition of ISC_REQ_USE_HTTP_STYLE
Some versions of Microsoft's sspi.h don't define this.
2014-11-06 13:04:24 +00:00
Steve Holme
93859e2c9a sasl: Removed non-SSPI Digest functions and defines from SSPI based builds
Introduced in commit 7e6d51a73c these functions and definitions are only
required by the internal challenge-response functions now.
2014-11-06 12:37:59 +00:00
Steve Holme
2d2a62e3d9 sasl_sspi: Added HTTP digest response generation code 2014-11-06 12:07:04 +00:00
Steve Holme
f0d3be29f2 http_digest: Added SSPI based challenge decoding code 2014-11-06 11:53:02 +00:00
Steve Holme
21fa0d86b1 http_digest: Added SSPI based clean-up code 2014-11-06 11:36:55 +00:00
Steve Holme
3d6b865654 http_digest: Added SSPI based authentication functions
This temporarily breaks HTTP digest authentication in SSPI based builds,
causing CURLE_NOT_BUILT_IN to be returned. A follow up commit will
resume normal operation.
2014-11-06 11:10:10 +00:00
Steve Holme
1033acd92d http_digest: Added required SSPI based variables to digest structure 2014-11-06 11:10:08 +00:00
Steve Holme
783c7f97ba http_digest: Fixed memory leaks from commit 6f8d8131b1 2014-11-05 21:45:10 +00:00
Steve Holme
f4af38120a sasl: Fixed compilation warning from commit 25264131e2
Added forward declaration of digestdata to overcome the following
compilation warning:

warning: 'struct digestdata' declared inside parameter list

Additionally made the ntlmdata forward declaration dependent on
USE_NTLM similar to how digestdata and kerberosdata are.
2014-11-05 18:36:57 +00:00
Steve Holme
259f4f3d01 sasl: Fixed HTTP digest challenges with spaces between auth parameters
Broken as part of the rework, in commit 7e6d51a73c, to assist with the
addition of HTTP digest via Windows SSPI.
2014-11-05 17:58:07 +00:00
Steve Holme
f697d7fdd5 http_digest: Fixed compilation errors from commit 6f8d8131b1
error: invalid operands to binary
warning: pointer targets in assignment differ in signedness
2014-11-05 15:48:19 +00:00
Steve Holme
6f8d8131b1 http_digest: Moved response generation into SASL module 2014-11-05 15:33:21 +00:00
Steve Holme
7e6d51a73c http_digest: Moved challenge decoding into SASL module 2014-11-05 14:39:13 +00:00
Steve Holme
25264131e2 http_digest: Moved clean-up function into SASL module 2014-11-05 13:51:11 +00:00
Steve Holme
d7bfce3951 http_digest: Moved algorithm definitions to SASL module 2014-11-05 13:40:08 +00:00
Gisle Vanem
3cfe3bc001 ssh: Fixed build on platforms where R_OK is not defined
Bug: http://curl.haxx.se/mail/lib-2014-11/0035.html
Reported-by: Jan Ehrhardt
2014-11-05 13:09:08 +00:00
Steve Holme
92e7e346f3 strdup: Removed irrelevant comment
...as Curl_memdup() duplicates an area of fix size memory, that may be
binary, and not a null terminated string.
2014-11-05 12:53:06 +00:00
Steve Holme
e8cea8d70f url.c: Fixed compilation warning
conversion from 'curl_off_t' to 'size_t', possible loss of data
2014-11-05 12:42:35 +00:00
Steve Holme
efe4bab29b http_digest: Use CURLcode instead of CURLdigest
To provide consistent behaviour between the various HTTP authentication
functions use CURLcode based error codes for Curl_input_digest()
especially as the calling code doesn't use the specific error code just
that it failed.
2014-11-05 12:13:47 +00:00
Steve Holme
d62cb0f5d0 sspi: Define authentication package name constants
These were previously hard coded, and whilst defined in security.h,
they may or may not be present in old header files given that these
defines were never used in the original code.

Not only that, but there appears to be some ambiguity between the ANSI
and UNICODE NTLM definition name in security.h.
2014-11-05 11:54:02 +00:00
Daniel Stenberg
b387560692 curl_easy_duphandle: CURLOPT_COPYPOSTFIELDS read out of bounds
When duplicating a handle, the data to post was duplicated using
strdup() when it could be binary and contain zeroes and it was not even
zero terminated! This caused read out of bounds crashes/segfaults.

Since the lib/strdup.c file no longer is easily shared with the curl
tool with this change, it now uses its own version instead.

Bug: http://curl.haxx.se/docs/adv_20141105.html
CVE: CVE-2014-3707
Reported-By: Symeon Paraschoudis
2014-11-05 08:05:14 +01:00
Jay Satiro
e819c3a4ca SSL: PolarSSL default min SSL version TLS 1.0
- Prior to this change no SSL minimum version was set by default at
runtime for PolarSSL. Therefore in most cases PolarSSL would probably
have defaulted to a minimum version of SSLv3 which is no longer secure.
2014-11-04 11:40:51 +01:00
Carlo Wood
15c4d51d39 Curl_single_getsock: fix hold/pause sock handling
The previous condition that checked if the socket was marked as readable
when also adding a writable one, was incorrect and didn't take the pause
bits properly into account.
2014-11-03 09:40:13 +01:00
Peter Wu
b2bb51f339 cmake: drop _BSD_SOURCE macro usage
autotools does not use features.h nor _BSD_SOURCE. As this macro
triggers warnings since glibc 2.20, remove it. It should not have
functional differences.

Signed-off-by: Peter Wu <peter@lekensteyn.nl>
2014-11-03 09:10:54 +01:00
Steve Holme
b6821dbb91 sasl: Fixed Kerberos V5 inclusion when CURL_DISABLE_CRYPTO_AUTH is used
Typically the USE_WINDOWS_SSPI definition would not be used when the
CURL_DISABLE_CRYPTO_AUTH define is, however, it is still a valid build
configuration and, as such, the SASL Kerberos V5 (GSSAPI) authentication
data structures and functions would incorrectly be used when they
shouldn't be.

Introduced a new USE_KRB5 definition that takes into account the use of
CURL_DISABLE_CRYPTO_AUTH like USE_SPNEGO and USE_NTLM do.
2014-11-02 00:35:16 +00:00
Steve Holme
b04eef1318 openssl: Use 'CURLcode result'
More CURLcode fixes.
2014-11-02 00:14:07 +00:00
Daniel Stenberg
9bc2582c31 resume: consider a resume from [content-length] to be OK
Basically since servers often then don't respond well to this and
instead send the full contents and then libcurl would instead error out
with the assumption that the server doesn't support resume. As the data
is then already transfered, this is now considered fine.

Test case 1434 added to verify this. Test case 1042 slightly modified.

Reported-by: hugo
Bug: http://curl.haxx.se/bug/view.cgi?id=1443
2014-11-01 23:09:24 +01:00
Steve Holme
f0b4bc12f8 openssl: Use 'CURLcode result'
More standardisation of CURLcode usage and coding style.
2014-11-01 17:16:42 +00:00
Steve Holme
14b4707d9a openssl: Use 'CURLcode result'
...and some minor code style changes.
2014-11-01 16:14:05 +00:00
Steve Holme
beb478a24b ftplistparser: We prefer 'CURLcode result' 2014-11-01 12:12:09 +00:00
Steve Holme
befbc8f56b code cleanup: Use 'CURLcode result' 2014-10-30 23:14:45 +00:00
Guenter Knauf
f29b88c246 build: added Watcom support to build with WinSSL. 2014-10-30 16:43:29 +01:00
Daniel Stenberg
697aa67d18 openssl: enable NPN separately from ALPN
... and allow building with nghttp2 but completely without NPN and ALPN,
as nghttp2 can still be used for plain-text HTTP.

Reported-by: Lucas Pardue
2014-10-29 22:42:46 +01:00
Steve Holme
32913182dc vtls.c: Fixed compilation warning
conversion from 'size_t' to 'unsigned int', possible loss of data
2014-10-29 19:12:27 +00:00
Steve Holme
f3fc3d021d sspi: Return CURLE_LOGIN_DENIED on AcquireCredentialsHandle() failure
Return a more appropriate error, rather than CURLE_OUT_OF_MEMORY when
acquiring the credentials handle fails. This is then consistent with
the code prior to commit f7e24683c4 when log-in credentials were empty.
2014-10-29 14:26:48 +00:00
Steve Holme
f7e24683c4 sasl_sspi: Allow DIGEST-MD5 to use current windows credentials
Fixed the ability to use the current log-in credentials with DIGEST-MD5.
I had previously disabled this functionality in commit 607883f13c as I
couldn't get this to work under Windows 8, however, from testing HTTP
Digest authentication through Windows SSPI and then further testing of
this code I have found it works in Windows 7.

Some further investigation is required to see what the differences are
between Windows 7 and 8, but for now enable this functionality as the
code will return an error when AcquireCredentialsHandle() fails.
2014-10-29 14:24:38 +00:00
Kamil Dudka
276741af4d transfer: drop the code handling the ssl_connect_retry flag
Its last use has been removed by the previous commit.
2014-10-29 14:34:46 +01:00
Kamil Dudka
3f430c9c3a nss: drop the code for libcurl-level downgrade to SSLv3
This code was already deactivated by commit
ec783dc142.
2014-10-29 14:34:46 +01:00
Kamil Dudka
07048941a4 openssl: fix a line length warning 2014-10-29 14:34:46 +01:00
Guenter Knauf
b5ed5843a4 Added NetWare support to build with nghttp2. 2014-10-29 03:31:34 +01:00
Guenter Knauf
357a15a649 Fixed error message since we require ALPN support. 2014-10-29 01:37:18 +01:00
Guenter Knauf
e42e3a4fac Check for ALPN via OpenSSL version number.
This check works also with to non-configure platforms.
2014-10-29 00:59:38 +01:00
Steve Holme
2e121fda35 sasl_sspi: Fixed typo in comment 2014-10-28 23:57:46 +00:00
Steve Holme
085081fc6e code cleanup: We prefer 'CURLcode result' 2014-10-28 22:45:32 +00:00
Daniel Stenberg
76b2f53707 mk-ca-bundle: spell fix "version" 2014-10-28 15:21:11 +01:00
Daniel Stenberg
95765567d0 HTTP: return larger than 3 digit response codes too
HTTP 1.1 is clearly specified to only allow three digit response codes,
and libcurl used sscanf("%3d") for that purpose. This made libcurl
support smaller numbers but not larger. It does now, but we will not
make any specific promises nor document this further since it is going
outside of what HTTP is.

Bug: http://curl.haxx.se/bug/view.cgi?id=1441
Reported-by: Balaji
2014-10-27 16:28:10 +01:00
Steve Holme
0811742488 ntlm: We prefer 'CURLcode result'
Continuing commit 0eb3d15ccb more return code variable name changes.
2014-10-26 21:15:20 +00:00
Guenter Knauf
7be56906d6 Cosmetics: lowercase non-special subroutine names. 2014-10-26 19:07:35 +01:00
Steve Holme
07ac29a058 http_negotiate: We prefer 'CURLcode result'
Continuing commit 0eb3d15ccb more return code variable name changes.
2014-10-26 16:38:21 +00:00
Steve Holme
64814739d5 http_negotiate: Fixed missing check for USE_SPNEGO 2014-10-26 16:28:02 +00:00