Commit Graph

3277 Commits

Author SHA1 Message Date
Yousuke Kimoto
b10a838a7a CURLOPT_COOKIELIST: Added "RELOAD" command 2014-09-25 16:28:17 +02:00
Daniel Stenberg
a76825a5ef cookies: reject incoming cookies set for TLDs
Test 61 was modified to verify this.

CVE-2014-3620

Reported-by: Tim Ruehsen
URL: http://curl.haxx.se/docs/adv_20140910B.html
2014-09-10 07:32:36 +02:00
Tim Ruehsen
8a75dbeb23 cookies: only use full host matches for hosts used as IP address
By not detecting and rejecting domain names for partial literal IP
addresses properly when parsing received HTTP cookies, libcurl can be
fooled to both send cookies to wrong sites and to allow arbitrary sites
to set cookies for others.

CVE-2014-3613

Bug: http://curl.haxx.se/docs/adv_20140910A.html
2014-09-10 07:32:36 +02:00
Brandon Casey
6beb0eeea1 Ensure progress.size_dl/progress.size_ul are always >= 0
Historically the default "unknown" value for progress.size_dl and
progress.size_ul has been zero, since these values are initialized
implicitly by the calloc that allocates the curl handle that these
variables are a part of.  Users of curl that install progress
callbacks may expect these values to always be >= 0.

Currently it is possible for progress.size_dl and progress.size_ul
to by set to a value of -1, if Curl_pgrsSetDownloadSize() or
Curl_pgrsSetUploadSize() are passed a "size" of -1 (which a few
places currently do, and a following patch will add more).  So
lets update Curl_pgrsSetDownloadSize() and Curl_pgrsSetUploadSize()
so they make sure that these variables always contain a value that
is >= 0.

Updates test579 and test599.

Signed-off-by: Brandon Casey <drafnel@gmail.com>
2014-09-07 23:23:12 +02:00
Steve Holme
8acbb074f8 tests: Added test1420 to the makefile 2014-09-07 12:13:34 +01:00
Steve Holme
be83356e5e test1420: Removed unnecessary CURLOPT setting 2014-09-07 12:09:29 +01:00
Steve Holme
797d56cbd8 tests: Added more "Clear Text" authentication keywords 2014-09-07 11:37:10 +01:00
Steve Holme
9ee502ac6b tests: Updated "based on" text due to email test renumbering 2014-09-07 11:19:10 +01:00
Steve Holme
ed285ae5c9 tests: For consistency added --libcurl to test name 2014-09-07 11:19:08 +01:00
Steve Holme
436a841354 tests: Added --libcurl for IMAP test case 2014-09-07 11:19:05 +01:00
Daniel Stenberg
0187c9e11d http: fix the Content-Range: parser
... to handle "*/[total]". Also, removed the strange hack that made
CURLOPT_FAILONERROR on a 416 response after a *RESUME_FROM return
CURLE_OK.

Reported-by: Dimitrios Siganos
Bug: http://curl.haxx.se/mail/lib-2014-06/0221.html
2014-08-15 10:02:47 +02:00
Fabian Keil
40e13829af runtests.pl: Pad test case numbers with up to three zeroes
Test case numbers with four digits have been available for a
while now.
2014-08-07 10:17:25 +02:00
Fabian Keil
6543f6e36c tests: Fix a couple of incomplete response lines 2014-07-26 23:12:53 +02:00
Fabian Keil
2fab0d45a9 runtests.pl: Remove filteroff() which hasn't been used since 2001 2014-07-26 23:02:50 +02:00
Fabian Keil
dc7a598126 runtests.pl: Don't expect $TESTDIR/DISABLED to exist
If a non-standard $TESTDIR is used the file may not be necessary.

Previously a "missing" file resulted in the warning:
readline() on closed filehandle D at ./runtests.pl line 4940.
2014-07-26 23:01:31 +02:00
Fabian Keil
5828e886e6 getpart.pm: Fix a comment typo 2014-07-26 23:01:22 +02:00
Daniel Stenberg
e1b13eba75 Curl_base64url_encode: unit-tested in 1302 2014-07-25 08:38:16 +02:00
Daniel Stenberg
4e11bd156e test1013.pl: GSS-Negotiate doesn't exist as a feature anymore 2014-07-24 23:46:11 +02:00
Sergey Nikulov
64010d603c libtest: fixed duplicated line in Makefile
Bug: https://github.com/bagder/curl/pull/105
2014-07-24 15:19:46 +02:00
Daniel Stenberg
a8206adcad test1013.pl: remove SPNEGO/GSS-API tweaks
No longer necessary after Michael Osipov's rework
2014-07-23 00:01:39 +02:00
Dan Fandrich
6ffc113ceb testcurl.pl: log the value of --runtestopts in the test header 2014-07-17 00:00:23 +02:00
Daniel Stenberg
4cb2521595 test506: verify aa68848451
After the fixed cookie lock deadlock, this test now passes and it
detects double-locking and double-unlocking of mutexes.
2014-07-16 00:09:58 +02:00
Dan Fandrich
4da6e0c966 test320: strip off the actual negotiated cipher width
It's irrelevant to the test, and will change depending on which SSL
library is being used by libcurl.
2014-07-15 01:01:39 +02:00
Dan Fandrich
816979e3b8 tests: added globbing keyword to URL globbing tests 2014-07-12 01:52:07 +02:00
Dan Fandrich
45c93dad1d Fixed some "statement not reached" warnings 2014-07-12 01:45:26 +02:00
Dan Fandrich
447c31ce9d gnutls: explicitly added SRP to the priority string
This seems to have become necessary for SRP support to work starting
with GnuTLS ver. 2.99.0. Since support for SRP was added to GnuTLS
before the function that takes this priority string, there should be no
issue with backward compatibility.
2014-07-12 00:11:44 +02:00
Dan Fandrich
d582c272a6 tests: adjust for capitalization differences in newer gnutls-serv 2014-07-11 23:47:48 +02:00
Dan Fandrich
4dc3a57718 test320/1/2/4: fix the port number substitution variables
These tests have been broken since commit 1958fe57 in Oct. 2011
2014-07-11 23:47:33 +02:00
Dan Fandrich
d033fc8323 tests: document more test identifiers and variables 2014-07-11 23:33:55 +02:00
Dan Fandrich
a6d666e1a6 tests: Use CURLOPT_READDATA instead of the obsolete CURLOPT_INFILE 2014-06-18 01:17:23 +02:00
Dan Fandrich
34d02aff71 sasl: Added back qop argument mistakenly removed in e95ca7ce
This caused segfaults on tests 823 869 907.
2014-06-15 14:11:35 +02:00
Dan Fandrich
ce6c691da1 test1398: Added test to Makefile.am 2014-06-15 12:28:43 +02:00
Daniel Stenberg
e95ca7cec9 NTLM: set a fake entropy for debug builds with CURL_ENTROPY set
Curl_rand() will return a dummy and repatable random value for this
case. Makes it possible to write test cases that verify output.

Also, fake timestamp with CURL_FORCETIME set.

Only when built debug enabled of course.

Curl_ssl_random() was not used anymore so it has been
removed. Curl_rand() is enough.

create_digest_md5_message: generate base64 instead of hex string

curl_sasl: also fix memory leaks in some OOM situations
2014-06-11 23:15:48 +02:00
Steve Holme
ceacbacd14 tests: Disabled NTLM tests for non-debug builds
Added required "debug" feature, missed in commit 1c9aaa0bac, as NTLMv2
calls Curl_rand() which can only be fixed to a specific entropy in
debug builds.
2014-06-11 21:24:59 +01:00
Steve Holme
51bb067a42 Curl_rand: Use a fake entropy for debug builds when CURL_ENTROPY set 2014-06-11 21:13:40 +01:00
Steve Holme
e8c1bf8840 tests: Fixed up DIGEST-MD5 tests following commit eefeb73af4 2014-06-01 12:18:05 +01:00
Dan Fandrich
9597b0ebcb tests: Fix portability issue with the tftpd server and timeouts
gcc spit out warning: variable 'x' might be clobbered by 'longjmp' or
'vfork' messages for a few variables.  These automatic variables were
expected to be changed between a setjmp/longjmp and hold their values,
so are now marked volatile.
2014-05-29 09:39:39 +02:00
Daniel Stenberg
71ea31ae74 test1014: GSS-API is only in curl-config. not in curl
Follow-up to commit 121bcfee5d. curl-config --features now lists
GSS-API but it is not a listed feature in curl -V. This should probably
be synchronized.
2014-05-18 17:07:29 +02:00
Daniel Stenberg
313b274b9d test1134: verify CREDSPERREQUEST for HTTP
Verifies that the change in 68f0166a92 works as intended and that
different HTTP auth credentials to the same host still re-uses the
connection properly.
2014-05-18 16:55:03 +02:00
Daniel Stenberg
84bd19ffd4 timers: fix timer regression involving redirects / reconnects
In commit 0b3750b5c2 (released in 7.36.0) we fixed a timeout issue
but instead broke the timings.

To fix this, I introduce a new timestamp to use for the timeouts and
restored the previous timestamp and timestamp position so that the old
timer functionality is restored.

In addition to that, that change also broke connection timeouts for when
more than one connect was used (as it would then count the total time
from the first connect and not for the most recent one). Now
Curl_timeleft() has been modified so that it checks against different
start times depending on which timeout it checks.

Test 1303 is updated accordingly.

Bug: http://curl.haxx.se/mail/lib-2014-05/0147.html
Reported-by: Ryan Braud
2014-05-15 21:28:19 +02:00
Steve Holme
18e4cd1e20 tests: Fixed up DIGEST-MD5 tests following commit 8342b6e1dc 2014-05-11 16:20:52 +01:00
Daniel Stenberg
22ee67a1ca lib1506: make sure the transfers are not within the same ms
Just to make sure the test is properly repeatable.

Bug: http://curl.haxx.se/mail/lib-2014-05/0081.html
Reported-by: Henrik
2014-05-09 16:50:42 +02:00
Daniel Stenberg
9e4f6c5809 libtests: add a wait_ms() function
This allows a libcurl test to portably sleep for a given number of
milliseconds.
2014-05-09 16:50:42 +02:00
Dan Fandrich
f0b2d27f7d test87: Get rid of extraneous square brackets in tag 2014-05-09 11:04:30 +02:00
Dan Fandrich
e673f55c45 tests: Use standard libtest return codes when relevant 2014-05-05 15:30:05 +02:00
Dan Fandrich
40e6af893b test1513: Don't return an uninitialized variable on init failure 2014-05-05 15:29:23 +02:00
Daniel Stenberg
812da4190f mprintf: allow %.s with data not being zero terminated
If the precision is indeed shorter than the string, don't strlen() to
find the end because that's not how the precision operator works.

I also added a unit test for curl_msnprintf to make sure this works and
that the fix doesn't a few other basic use cases. I found a POSIX
compliance problem that I marked TODO in the unit test, and I figure we
need to add more tests in the future.

Reported-by: Török Edwin
2014-05-04 23:39:52 +02:00
Dan Fandrich
c303107345 test585: Fixed NULL pointer dereference in fopen 2014-05-01 11:00:30 +02:00
Steve Holme
78ca3c6830 copyright: Updated following recent edits 2014-04-28 23:20:52 +01:00
Dan Fandrich
a917f30c6b runtests.pl: Improved the check for a crash during torture tests 2014-04-29 00:06:32 +02:00
Dan Fandrich
ef1322df67 Added a few more const where possible 2014-04-29 00:05:19 +02:00
Dan Fandrich
970ce28c12 unit1395: Fixed null pointer dereference on torture test 2014-04-28 17:14:46 +02:00
Daniel Stenberg
2e57c7e0fc test325: verify --proto-redir https=>http 2014-04-23 22:36:01 +02:00
Dan Fandrich
c1d6158789 tests: Fixed torture test for tests 1526 & 1527 2014-04-22 22:43:57 +02:00
Marc Hoersken
42c04eb1d1 sockfilt.c: clean up threaded approach and add documentation 2014-04-22 17:22:42 +02:00
Marc Hoersken
6fd97fca88 sockfilt.c: zero initialize variable 2014-04-22 17:22:42 +02:00
Marc Hoersken
6a03f6368f sockfilt.c: fixed getting stuck waiting for MinGW stdin pipe 2014-04-22 17:22:41 +02:00
Marc Hoersken
8ce852a279 sockfilt.c: properly handle disk files, pipes and character input 2014-04-20 22:15:36 +02:00
Marc Hoersken
fe1c0176c1 sockfilt.c: ignore non-key-events and continue waiting for input 2014-04-20 18:26:24 +02:00
Marc Hoersken
eb01947e1d sockfilt.c: free memory in case of memory allocation errors 2014-04-20 18:22:28 +02:00
Steve Holme
4c8c3da6e2 test810: Updated to use new IMAP URL query string functionality 2014-04-18 16:51:50 +01:00
Steve Holme
5cdb61abb2 tests: Disabled DIGEST-MD5 tests when running with SSPI enabled 2014-04-06 16:32:59 +01:00
Daniel Stenberg
74851340bd PROXYHEADER: send these headers in "normal" proxy requests too
Updated the docs to clarify and the code accordingly, with test 1528 to
verify:

When CURLHEADER_SEPARATE is set and libcurl is asked to send a request
to a proxy but it isn't CONNECT, then _both_ header lists
(CURLOPT_HTTPHEADER and CURLOPT_PROXYHEADER) will be used since the
single request is then made for both the proxy and the server.
2014-04-04 17:03:43 +02:00
Daniel Stenberg
d3d27551e7 test1428: verify --proxy-header 2014-04-04 17:03:43 +02:00
Daniel Stenberg
ef6be35bae CURLOPT_HEADEROPT: added
Modified the logic so that CURLOPT_HEADEROPT now controls if PROXYHEADER
is actually used or not.
2014-04-04 17:03:43 +02:00
Daniel Stenberg
ac887eedbc CURLOPT_PROXYHEADER: set headers for proxy-only
Includes docs and new test cases: 1525, 1526 and 1527

Co-written-by: Vijay Panghal
2014-04-04 17:03:43 +02:00
Daniel Stenberg
42937f87e6 HTTP: don't send Content-Length: 0 _and_ Expect: 100-continue
Without request body there's no point in asking for 100-continue.

Bug: http://curl.haxx.se/bug/view.cgi?id=1349
Reported-by: JimS
2014-04-04 15:46:35 +02:00
Dan Fandrich
c57166b575 tests: unified use of some keywords 2014-04-03 11:49:49 +02:00
Dan Fandrich
ff35e74bcd tests: added some missing closing tags 2014-04-03 11:49:48 +02:00
Daniel Stenberg
d73d633885 runtests: insist on a <keywords> section
Since all present tests now have <keywords> listed, this script will now
refuse to run a given test case if no such section is provided.
Hopefully this will help us make sure new test cases get keywords added
at start.
2014-04-03 11:33:41 +02:00
Daniel Stenberg
1432b22e62 tests: add keywords to the last 7 tests lacking them 2014-04-03 11:06:24 +02:00
Steve Holme
b201d9adb8 tests: Added SMTP with credientials test when not supported by server 2014-04-01 07:19:29 +01:00
Steve Holme
dd07e79023 tests: Added SMTP with credentials test for RFC-821 based server
Added SMTP (RFC-821 only) based test case as a reference for the fix
provided by commit fe260b75e7.
2014-03-31 20:55:58 +01:00
Paul Marks
0bc4938eec curl: stop interpreting IPv6 literals as glob patterns.
This makes it possible to fetch from an IPv6 literal without specifying
the -g option.  Globbing remains available elsehwere in the URL.

For example:
  curl http://[::1]/file[1-3].txt

This creates no ambiguity, because there is no overlap between the
syntax of valid globs and valid IPv6 literals.  Globs contain hyphens
and at most 1 colon, while IPv6 literals have no hyphens, and at least 2
colons.

The peek_ipv6() parser simply whitelists a set of characters and counts
colons, because the real validation happens later on.  The character set
includes A-Z, in case someone decides to implement support for scopes
like [fe80::1%25eth0] in the future.

Signed-off-by: Paul Marks <pmarks@google.com>
2014-03-30 23:45:29 +02:00
Steve Holme
4043d7b67b test938: Updated to use file input for upload
As the second URL won't be passed input from stdin.
2014-03-30 22:40:34 +01:00
Steve Holme
7dd494c6e7 test836: Fixed incorrect username in expected output 2014-03-30 22:40:21 +01:00
Daniel Stenberg
fbb6e0478b DISABLED: 836, 882 and 938 hang 2014-03-30 23:36:57 +02:00
Daniel Stenberg
c1f7da1570 runtests: check protocol before data
When the protocol part fails, the data usually does too but the protocol
part is often more fundamental and often provide the clues you need to
fix the test case.
2014-03-30 23:16:21 +02:00
Steve Holme
acefed139f ftpserver.pl: Extended the full text reply regular expression
Extended the regex to include other valid characters such as those used
in the reply text of Test 836.
2014-03-30 22:00:04 +01:00
Daniel Stenberg
8fdb87d0df keywords: sort case insensitive 2014-03-30 17:09:11 +02:00
Daniel Stenberg
c38b573ff5 tests: remove trailing CRs from keywords 2014-03-30 17:05:22 +02:00
Daniel Stenberg
c09f6c72e9 keywords: sort keywords alphabetically 2014-03-30 17:04:56 +02:00
Daniel Stenberg
7dbed6a2f5 keywords: don't use STDERR for good info 2014-03-30 17:00:32 +02:00
Steve Holme
afbcfc4f46 tests: Added email unit tests to verify login credential connection re-use 2014-03-30 15:13:31 +01:00
Steve Holme
b3e55bf989 tests: Corrected "APOP" authentication keyword 2014-03-30 12:00:33 +01:00
Steve Holme
6876b35ad6 tests: Replaced email authentication keywords with SASL based keywords
As the email protocols implement SASL authentication rather than IMAP,
POP3 and SMTP specific authentication, updated the authentication
keywords to reflect this.
2014-03-30 11:56:42 +01:00
Steve Holme
82bcc7c615 tests: Added "Clear Text" authentication keyword 2014-03-30 11:34:23 +01:00
Steve Holme
dfa481a7c5 tests: Added "SASL" authentication keyword 2014-03-30 11:31:38 +01:00
Steve Holme
54ef196db8 ftpserver.pl: Removed some unused variables 2014-03-30 10:37:45 +01:00
Steve Holme
5b773658a8 ftpserver.pl: Reworked some variable names to be more meaningful 2014-03-30 00:12:38 +00:00
Steve Holme
f559611aa1 ftpserver.pl: Corrected some indentation in senddata() 2014-03-29 23:17:16 +00:00
Daniel Stenberg
713402982f lib1513: fix callback proto to silence warning 2014-03-29 23:14:42 +01:00
Steve Holme
2baf38f7c3 ftpserver.pl: Added fallback to <data> support when using multiple URLs
Added support for falling back to <data> when <data1>, <data2>, etc...
don't exist in the <reply> section of a unit test.
2014-03-29 20:50:27 +00:00
Steve Holme
8293691b88 ftpserver.pl: Updated email based get reply data code to use new method 2014-03-29 17:30:19 +00:00
Steve Holme
fdb13d885a ftpserver.pl: Fixed syntax error from commit 3a29ee41 2014-03-29 12:32:03 +00:00
Steve Holme
8541f2d39d ftpserver.pl: Updated argument code in STATUS_imap() to be more meaningful 2014-03-29 11:15:19 +00:00
Steve Holme
3a29ee41ef ftpserver.pl: Introduced common method for getting a test's reply data 2014-03-29 10:29:17 +00:00
Dan Fandrich
7cb763cf57 test1397: Fixed compilation with some SSL backends
The test is only valid when one of four SSL backends is in use,
and must otherwise return success.
2014-03-26 22:08:53 +01:00
Dan Fandrich
f82e0edc17 test815/816: Use authentication for both URLs
The improved connection reuse logic would otherwise create a new
connection for each one, which isn't supported by the test
server, nor expected by the test.
2014-03-26 22:06:26 +01:00
Richard J. Moore
4d06b27921 test1397: unit test for certificate name wildcard handling 2014-03-25 23:01:37 +01:00