Daniel Stenberg [Mon, 24 Aug 2009 10:57:17 +0000 (10:57 +0000)]
- Eric Wong introduced support for the new option -T. (dot) that makes curl
read stdin in a non-blocking fashion. This also brings back -T- (minus) to
the previous blocking behavior since it could break stuff for people at
times.
Daniel Stenberg [Mon, 24 Aug 2009 08:41:17 +0000 (08:41 +0000)]
clarify the code by initing newurl to NULL
Michal Marek [Fri, 21 Aug 2009 12:15:35 +0000 (12:15 +0000)]
With CURLOPT_PROXY_TRANSFER_MODE, avoid sending invalid URLs like
ftp://example.com;type=i if the user specified ftp://example.com without the
slash.
Daniel Stenberg [Fri, 21 Aug 2009 12:01:36 +0000 (12:01 +0000)]
- Andre Guibert de Bruet pointed out a missing return code check for a
strdup() that could lead to segfault if it returned NULL. I extended his
suggest patch to now have Curl_retry_request() return a regular return code
and better check that.
Daniel Stenberg [Fri, 21 Aug 2009 07:11:20 +0000 (07:11 +0000)]
- Lots of good work by Krister Johansen, mostly related to pipelining:
Fix SIGSEGV on free'd easy_conn when pipe unexpectedly breaks
Fix data corruption issue with re-connected transfers
Fix use after free if we're completed but easy_conn not NULL
Daniel Stenberg [Wed, 19 Aug 2009 07:09:13 +0000 (07:09 +0000)]
5.3 Sort outgoing cookies
5.4 Rearrange request header order
Things to play with when you're bored
Daniel Stenberg [Tue, 18 Aug 2009 19:51:18 +0000 (19:51 +0000)]
the mozilla browser is called Firefox...
Dan Fandrich [Tue, 18 Aug 2009 00:18:54 +0000 (00:18 +0000)]
Pull the certificate files from the source directory. Ensure that the
certificate tests only run on a localhost-hosted test server since the
host name is explicitly checked.
Gunter Knauf [Sun, 16 Aug 2009 15:03:58 +0000 (15:03 +0000)]
added missing curl_easy_pause to export list.
Daniel Stenberg [Fri, 14 Aug 2009 18:09:42 +0000 (18:09 +0000)]
I think it's worth clarifying that curl DOES NOT validate a given URL more
than what's absolutely necessary:
curl will do its best to use what you pass to it as a URL. It is not trying to
validate it as a syntactically correct URL by any means but is instead
VERY liberal with what it accepts.
Kamil Dudka [Thu, 13 Aug 2009 16:04:51 +0000 (16:04 +0000)]
- Changed NSS code to not ignore the value of ssl.verifyhost and produce more
verbose error messages. Originally reported at:
https://bugzilla.redhat.com/show_bug.cgi?id=516056
Daniel Stenberg [Thu, 13 Aug 2009 08:51:45 +0000 (08:51 +0000)]
mention yesterday's changes
Daniel Stenberg [Wed, 12 Aug 2009 17:25:16 +0000 (17:25 +0000)]
add missing file, as pointed out by Karl M
Daniel Stenberg [Wed, 12 Aug 2009 11:24:52 +0000 (11:24 +0000)]
start over fresh again towards 7.19.7
Daniel Stenberg [Wed, 12 Aug 2009 11:24:09 +0000 (11:24 +0000)]
imported names from the 7.19.6 RELEASE-NOTES
Daniel Stenberg [Wed, 12 Aug 2009 11:18:55 +0000 (11:18 +0000)]
Added a range of new fun date strings to try. This set of dates come from a
mail posted to the http-state mailing list, from Adam Barth, and is said to be
the set of date formats the Chrome browser code is tested against:
http://www.ietf.org/mail-archive/web/http-state/current/msg00129.html
libcurl parses most of them identically, but not all of them.
Daniel Stenberg [Wed, 12 Aug 2009 08:59:30 +0000 (08:59 +0000)]
7.19.6
Daniel Stenberg [Wed, 12 Aug 2009 08:19:39 +0000 (08:19 +0000)]
- Carsten Lange reported a bug and provided a patch for TFTP upload and the
sending of the TSIZE option. I don't like fixing bugs just hours before
a release, but since it was broken and the patch fixes this for him I decided
to get it in anyway.
Daniel Stenberg [Wed, 12 Aug 2009 08:14:53 +0000 (08:14 +0000)]
use --insecure to allow non-matching known hosts for SSH-based protocols
Daniel Stenberg [Wed, 12 Aug 2009 08:02:42 +0000 (08:02 +0000)]
pasted here (and renumbered) from the TODO-RELEASE since they are in fact
bugs we know about that will appear in the next release (too)
Daniel Stenberg [Tue, 11 Aug 2009 21:48:58 +0000 (21:48 +0000)]
- Peter Sylvester made the HTTPS test server use specific certificates for
each test, so that the test suite can now be used to actually test the
verification of cert names etc. This made an error show up in the OpenSSL-
specific code where it would attempt to match the CN field even if a
subjectAltName exists that doesn't match. This is now fixed and verified
in test 311.
Daniel Stenberg [Tue, 11 Aug 2009 20:57:15 +0000 (20:57 +0000)]
credit
Daniel Stenberg [Tue, 11 Aug 2009 20:43:12 +0000 (20:43 +0000)]
- Benbuck Nason posted the bug report #2835196
(http://curl.haxx.se/bug/view.cgi?id=2835196), fixing a few compiler
warnings when mixing ints and bools.
Dan Fandrich [Tue, 11 Aug 2009 18:11:40 +0000 (18:11 +0000)]
Include the Android make file in the source package even though the
config.h issue hasn't been completely solved. This will save some effort
for someone desperate to use curl on Android.
Patrick Monnerat [Tue, 11 Aug 2009 14:07:08 +0000 (14:07 +0000)]
Fix definition of CURLOPT_SOCKS5_GSSAPI_SERVICE from LONG to OBJECTPOINT
Fix OS400 makefile for tests to use the new Makefile.inc in libtest
Update the OS400 wrappers and RPG binding according to the current CVS source state
Daniel Stenberg [Tue, 11 Aug 2009 07:56:16 +0000 (07:56 +0000)]
Added links to more details on most issues. Moved all these issues to 7.19.7
now since we won't manage to get them done for 7.19.6.
Dan Fandrich [Tue, 11 Aug 2009 02:30:53 +0000 (02:30 +0000)]
Fixed a memory leak in the FTP code and an off-by-one heap buffer overflow.
Dan Fandrich [Sun, 9 Aug 2009 23:15:20 +0000 (23:15 +0000)]
Fixed some memory leaks in the command-line tool that caused most of the
torture tests to fail.
Gunter Knauf [Fri, 7 Aug 2009 23:32:38 +0000 (23:32 +0000)]
fix cast for some systems which are broken due to absense of socklen_t, therefore now use curl_socklen_t.
Gunter Knauf [Thu, 6 Aug 2009 13:23:00 +0000 (13:23 +0000)]
added a cast to silent compiler warning with 64bit systems.
Gunter Knauf [Thu, 6 Aug 2009 12:02:00 +0000 (12:02 +0000)]
fixed cast added with last commit.
Gunter Knauf [Thu, 6 Aug 2009 11:10:30 +0000 (11:10 +0000)]
cast to fix 64bit build warnings. From manpage:
POSIX.1-2001. Note that RFC 2553 defines a prototype where the last parameter cnt is of type size_t.
Many systems follow RFC 2553. Glibc 2.0 and 2.1 have size_t, but 2.2 has socklen_t.
Daniel Stenberg [Tue, 4 Aug 2009 12:02:27 +0000 (12:02 +0000)]
RFC1867 was updated by RFC2388
Daniel Stenberg [Mon, 3 Aug 2009 14:07:57 +0000 (14:07 +0000)]
avoid possible NULL dereference caused by my previous fix
Gisle Vanem [Mon, 3 Aug 2009 12:20:03 +0000 (12:20 +0000)]
Remove call to LoadLibrary(). (leftover from debugging).
Gisle Vanem [Mon, 3 Aug 2009 12:16:00 +0000 (12:16 +0000)]
Fix bad sentence.
Daniel Stenberg [Mon, 3 Aug 2009 11:51:06 +0000 (11:51 +0000)]
- Timo Teras changed the reason code used in the resolve callback done when
ares_cancel() is used, to be ARES_ECANCELLED instead of ARES_ETIMEOUT to
better allow the callback to know what's happening.
Daniel Stenberg [Mon, 3 Aug 2009 11:39:43 +0000 (11:39 +0000)]
256 - "More questions about ares behavior"
yet another issue not yet sorted out
Daniel Stenberg [Mon, 3 Aug 2009 11:32:55 +0000 (11:32 +0000)]
indentation fixes only
Daniel Stenberg [Mon, 3 Aug 2009 11:29:17 +0000 (11:29 +0000)]
- Joshua Kwan fixed the init routine to fill in the defaults for stuff that
fails to get inited by other means. This fixes a case of when the c-ares
init fails when internet access is fone.
Daniel Stenberg [Mon, 3 Aug 2009 09:06:35 +0000 (09:06 +0000)]
respect error code from ftruncate(), mentioned by Peter Sylvester
Daniel Stenberg [Mon, 3 Aug 2009 08:45:19 +0000 (08:45 +0000)]
Reverted the zero-byte-in-name check to instead rely on the fact that strlen
and the name length differ in those cases and thus leave the matching function
unmodified from before, as the matching functions never have to bother with
the zero bytes in legitimate cases. Peter Sylvester helped me realize that
this fix is slightly better as it leaves more code unmodified and makes the
detection a bit more obvious in the code.
Daniel Stenberg [Sun, 2 Aug 2009 22:38:15 +0000 (22:38 +0000)]
clarified configure detection of GnuTLS
Daniel Stenberg [Sun, 2 Aug 2009 22:34:00 +0000 (22:34 +0000)]
Extended my embedded-zero-in-cert-name fix based on a comment from Scott
Cantor. My previous attempt was half-baked and didn't cover the normal CN
case.
Daniel Stenberg [Sun, 2 Aug 2009 21:43:04 +0000 (21:43 +0000)]
mention two crashing bugs we'd like fixed
Daniel Stenberg [Sat, 1 Aug 2009 22:18:37 +0000 (22:18 +0000)]
clarify the description of the null byte in cert name fix
Daniel Stenberg [Sat, 1 Aug 2009 22:11:58 +0000 (22:11 +0000)]
- Curt Bogmine reported a problem with SNI enabled on a particular server. We
should introduce an option to disable SNI, but as we're in feature freeze
now I've addressed the obvious bug here (pointed out by Peter Sylvester): we
shouldn't try to enable SNI when SSLv2 or SSLv3 is explicitly selected.
Code for OpenSSL and GnuTLS was fixed. NSS doesn't seem to have a particular
option for SNI, or are we simply not using it?
Daniel Stenberg [Sat, 1 Aug 2009 21:56:59 +0000 (21:56 +0000)]
- Scott Cantor posted the bug report #2829955
(http://curl.haxx.se/bug/view.cgi?id=2829955) mentioning the recent SSL cert
verification flaw found and exploited by Moxie Marlinspike. The presentation
he did at Black Hat is available here:
https://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Marlinspike
Apparently at least one CA allowed a subjectAltName or CN that contain a
zero byte, and thus clients that assumed they would never have zero bytes
were exploited to OK a certificate that didn't actually match the site. Like
if the name in the cert was "example.com\0theatualsite.com", libcurl would
happily verify that cert for example.com.
libcurl now better use the length of the extracted name, not assuming it is
zero terminated.
Daniel Stenberg [Sat, 1 Aug 2009 11:09:02 +0000 (11:09 +0000)]
- Tanguy Fautre pointed out that OpenSSL's function RAND_screen() (present
only in some OpenSSL installs - like on Windows) isn't thread-safe and we
agreed that moving it to the global_init() function is a decent way to deal
with this situation.
Daniel Stenberg [Sat, 1 Aug 2009 11:02:10 +0000 (11:02 +0000)]
- Alexander Beedie provided the patch for a noproxy problem: If I have set
CURLOPT_NOPROXY to "*", or to a host that should not use a proxy, I actually
could still end up using a proxy if a proxy environment variable was set.
Daniel Stenberg [Sat, 1 Aug 2009 08:18:33 +0000 (08:18 +0000)]
updated with recent issues
Daniel Stenberg [Fri, 31 Jul 2009 11:16:04 +0000 (11:16 +0000)]
67. When creating multipart formposts. The file name part can be encoded with
something beyond ascii but currently libcurl will only pass in the verbatim
string the app provides. There are several browsers that already do this
encoding. The key seems to be the updated draft to RFC2231:
http://tools.ietf.org/html/draft-reschke-rfc2231-in-http-02
Dan Fandrich [Fri, 31 Jul 2009 00:10:38 +0000 (00:10 +0000)]
Copy the libcurl header files into the right location for Android.
Daniel Stenberg [Tue, 28 Jul 2009 17:55:00 +0000 (17:55 +0000)]
use --insecure for the SFTP and SCP tests
Daniel Stenberg [Mon, 27 Jul 2009 21:14:30 +0000 (21:14 +0000)]
moved the changes that aren't strictly bugfixes until after 7.19.6 since I
can't seem to catch up
243 - ftp QUOTE commands that are allowed to fail but not close the connection
is done
Daniel Stenberg [Mon, 27 Jul 2009 18:36:56 +0000 (18:36 +0000)]
- All the quote options (CURLOPT_QUOTE, CURLOPT_POSTQUOTE and
CURLOPT_PREQUOTE) now accept a preceeding asterisk before the command to
send when using FTP, as a sign that libcurl shall simply ignore the response
from the server instead of treating it as an error. Not treating a 400+ FTP
response code as an error means that failed commands will not abort the
chain of commands, nor will they cause the connection to get disconnected.
Daniel Stenberg [Mon, 27 Jul 2009 18:31:48 +0000 (18:31 +0000)]
From: Johan van Selst
"you replaced the old SSLeay_add_ssl_algorithms() call
with OpenSSL_add_all_algorithms(), however unlike the name suggests,
the second function is not a superset of the first. When using SSL
both these functions will need to be called in order to offer complete
functionality"
Daniel Stenberg [Sun, 26 Jul 2009 17:33:36 +0000 (17:33 +0000)]
- Bug report #2825989 (curl.haxx.se/bug/view.cgi?id=2825989) pointed
out that OpenSSL-powered libcurl didn't support the SHA-2 digest algorithm,
and provided the solution too: to use OpenSSL_add_all_algorithms() instead
of the older SSLeay_* alternative. OpenSSL_add_all_algorithms was added in
OpenSSL 0.9.5
Daniel Stenberg [Sat, 25 Jul 2009 18:09:57 +0000 (18:09 +0000)]
properly free data returned by aprintf(), and bring back the code to be
independent of libssh2 version as the client code isn't really meant to adapt
to such build-time constraints.
Gunter Knauf [Sat, 25 Jul 2009 04:16:00 +0000 (04:16 +0000)]
blocked new stuff with HAVE_LIBSSH2_KNOWNHOST_API to check if this is our current memory leak.
Gunter Knauf [Fri, 24 Jul 2009 22:20:22 +0000 (22:20 +0000)]
changes to silent compiler warnings with 64bit systems.
Gunter Knauf [Fri, 24 Jul 2009 22:06:19 +0000 (22:06 +0000)]
changes to silent compiler warnings with 64bit systems.
Gunter Knauf [Thu, 23 Jul 2009 04:53:08 +0000 (04:53 +0000)]
changes to silent compiler warnings with 64bit systems.
Gunter Knauf [Thu, 23 Jul 2009 03:54:01 +0000 (03:54 +0000)]
fixed brace error.
Gunter Knauf [Thu, 23 Jul 2009 02:48:05 +0000 (02:48 +0000)]
changes to silent compiler warnings with 64bit systems.
Gunter Knauf [Thu, 23 Jul 2009 02:15:00 +0000 (02:15 +0000)]
blocked sshkeycallback() with HAVE_LIBSSH2_KNOWNHOST_API to avoid compiler warnings.
Daniel Stenberg [Wed, 22 Jul 2009 22:51:00 +0000 (22:51 +0000)]
242 - SSH knownhost support (powered by libssh2 1.2)
Committed now. Not yet thoroughly degbugged etc, but at least the funtionality
is now present.
Daniel Stenberg [Wed, 22 Jul 2009 22:49:01 +0000 (22:49 +0000)]
- Added CURLOPT_SSH_KNOWNHOSTS, CURLOPT_SSH_KEYFUNCTION, CURLOPT_SSH_KEYDATA.
They introduce known_host support for SSH keys to libcurl. See docs for
details.
Daniel Stenberg [Wed, 22 Jul 2009 22:08:01 +0000 (22:08 +0000)]
don't set READDATA since it isn't used and only confuses readers
Michal Marek [Wed, 22 Jul 2009 09:48:32 +0000 (09:48 +0000)]
- David Binderman found a memory and fd leak in lib/gtls.c:load_file()
(https://bugzilla.novell.com/523919). When looking at the code, I found
that also the ptr pointer can leak.
Daniel Stenberg [Tue, 21 Jul 2009 22:30:31 +0000 (22:30 +0000)]
66. When using telnet, the time limitation options don't work.
http://curl.haxx.se/bug/view.cgi?id=2818950
Kamil Dudka [Mon, 20 Jul 2009 21:50:21 +0000 (21:50 +0000)]
- Claes Jakobsson improved the support for client certificates handling
in NSS-powered libcurl. Now the client certificates can be selected
automatically by a NSS built-in hook. Additionally pre-login to all PKCS11
slots is no more performed. It used to cause problems with HW tokens.
- Fixed reference counting for NSS client certificates. Now the PEM reader
module should be always properly unloaded on Curl_nss_cleanup(). If the unload
fails though, libcurl will try to reuse the already loaded instance.
Gunter Knauf [Fri, 17 Jul 2009 22:34:16 +0000 (22:34 +0000)]
trial to fix a win64 compiler warning.
Gunter Knauf [Thu, 16 Jul 2009 17:39:14 +0000 (17:39 +0000)]
added a cast to silent compiler warning with 64bit systems.
Gunter Knauf [Thu, 16 Jul 2009 12:20:16 +0000 (12:20 +0000)]
test if adding ../lib to includes can fix the current break ...
Dan Fandrich [Wed, 15 Jul 2009 21:49:47 +0000 (21:49 +0000)]
Added nonblock.c to the non-automake makefiles (note that the dependencies
in the Watcom makefiles aren't quite correct).
Bill Hoffman [Wed, 15 Jul 2009 21:30:46 +0000 (21:30 +0000)]
ENH: fix build with ssl
Bill Hoffman [Wed, 15 Jul 2009 19:40:46 +0000 (19:40 +0000)]
ENH: move dashboard location
Bill Hoffman [Wed, 15 Jul 2009 19:25:22 +0000 (19:25 +0000)]
BUG: curl did not build with cmake with VS 2005 for two reasons, ws2tcpip.h requires winsock2.h to be included before it with that compiler, and wldap32 is not available with the default install of the compiler, so disable ldap support if that is not found
Michal Marek [Wed, 15 Jul 2009 11:49:12 +0000 (11:49 +0000)]
- Changed the description of CURLINFO_OS_ERRNO to make it clear that the
errno is not reset on success.
Gunter Knauf [Wed, 15 Jul 2009 01:10:18 +0000 (01:10 +0000)]
fixed typo.
Bill Hoffman [Tue, 14 Jul 2009 19:03:31 +0000 (19:03 +0000)]
ENH: add optional support for c-ares
Gunter Knauf [Tue, 14 Jul 2009 15:36:12 +0000 (15:36 +0000)]
renamed generated config.h to curl_config.h in order to avoid clashes when libcurl is used with other projects which also have a config.h (missing bits)
Gunter Knauf [Tue, 14 Jul 2009 14:01:11 +0000 (14:01 +0000)]
updated openssl version to latest; removed obsolete link to openssl patch since its now in the openssl releases.
Bill Hoffman [Tue, 14 Jul 2009 13:46:45 +0000 (13:46 +0000)]
ENH: move config.h.cmake to curl_config.h.cmake so it builds again
Gunter Knauf [Tue, 14 Jul 2009 13:38:50 +0000 (13:38 +0000)]
renamed generated config.h to ares_config.h in order to avoid clashes when libcurl is used with other projects which also have a config.h.
Bill Hoffman [Tue, 14 Jul 2009 13:35:10 +0000 (13:35 +0000)]
ENH: add nonblock.c to build for CMake
Bill Hoffman [Tue, 14 Jul 2009 13:34:37 +0000 (13:34 +0000)]
ENH: do not report if zlib is not found as it still works
Gunter Knauf [Tue, 14 Jul 2009 13:30:24 +0000 (13:30 +0000)]
renamed generated config.h to curl_config.h in order to avoid clashes when libcurl is used with other projects which also have a config.h.
Gunter Knauf [Tue, 14 Jul 2009 13:25:14 +0000 (13:25 +0000)]
renamed generated config.h to curl_config.h in order to avoid clashes when libcurl is used with other projects which also have a config.h.
Gunter Knauf [Mon, 13 Jul 2009 23:33:57 +0000 (23:33 +0000)]
added PKG_CONFIG_PATH to output to better verify if it gets properly set with cross compiles.
Daniel Stenberg [Sat, 11 Jul 2009 09:57:54 +0000 (09:57 +0000)]
silence a compiler warning
Daniel Stenberg [Thu, 9 Jul 2009 21:55:26 +0000 (21:55 +0000)]
add these new files to CVS as well
Daniel Stenberg [Thu, 9 Jul 2009 21:50:33 +0000 (21:50 +0000)]
241 - expose Curl_nonblock as curlx_nonblock
done
Daniel Stenberg [Thu, 9 Jul 2009 21:47:24 +0000 (21:47 +0000)]
- Eric Wong introduced curlx_nonblock() that the curl tool now (re-)uses for
setting a file descriptor non-blocking. Used by the functionality Eric
himself brough on June 15th.
Daniel Stenberg [Thu, 9 Jul 2009 21:15:12 +0000 (21:15 +0000)]
240 - GnuTLS configure fix to find older installations
done
Daniel Stenberg [Thu, 9 Jul 2009 18:10:25 +0000 (18:10 +0000)]
bring back the libgnutls-config use for checking for GnuTLS if pkg-config
doesn't work, to better fine older gnutls installs
Daniel Stenberg [Thu, 9 Jul 2009 16:39:38 +0000 (16:39 +0000)]
two more pending issues
Daniel Stenberg [Wed, 8 Jul 2009 16:59:11 +0000 (16:59 +0000)]
245 - HTTP version getinfo
Daniel Stenberg [Wed, 8 Jul 2009 08:51:32 +0000 (08:51 +0000)]
updated with the actions I want to have done before the 7.19.6 release