- Jul 11, 2013
- Jul 09, 2013
-
-
Kamil Dudka authored
This reverts commit 3a0e931f because the documentation of --time-cond was duplicated by mistake. Reported by: Dave Reisner
-
Kamil Dudka authored
-
Kamil Dudka authored
-
Kamil Dudka authored
-
- Jul 08, 2013
-
-
Yang Tse authored
-
Yang Tse authored
-
Guenter Knauf authored
-
Guenter Knauf authored
Issue posted to the list by malinowsky AT FTW DOT at.
-
- Jul 04, 2013
-
-
Guenter Knauf authored
-
- Jul 03, 2013
-
-
Dan Fandrich authored
This prevents it from being built during a "make check" since it depends on OpenSSL.
-
-
Nick Zitzmann authored
I just noticed that OS X no longer supports SSLv2. Other TLS engines return an error if the requested protocol isn't supported by the underlying engine, so we do that now for SSLv2 if the framework returns an error when trying to turn on SSLv2 support. (Note: As always, SSLv2 support is only enabled in curl when starting the app with the -2 argument; it's off by default. SSLv2 is really old and insecure.)
-
- Jul 01, 2013
-
-
Marc Hoersken authored
-
- Jun 30, 2013
-
-
Kamil Dudka authored
This commit fixes a regression introduced in fddb7b44. Reported by: Markus Moeller Bug: http://curl.haxx.se/mail/archive-2013-06/0052.html
-
- Jun 25, 2013
-
-
Daniel Stenberg authored
-
Daniel Stenberg authored
Use the new improved Curl_rand() to generate better random nonce for Digest auth.
-
Daniel Stenberg authored
Bug: http://curl.haxx.se/bug/view.cgi?id=1252 Reported-by: Jean-Noël Rouvignac
-
Daniel Stenberg authored
The 10 first bug fixes for the pending release...
-
Daniel Stenberg authored
When doing multi-part formposts, libcurl used a pseudo-random value that was seeded with time(). This turns out to be bad for users who formpost data that is provided with users who then can guess how the boundary string will look like and then they can forge a different formpost part and trick the receiver. My advice to such implementors is (still even after this change) to not rely on the boundary strings being cryptographically strong. Fix your code and logic to not depend on them that much! I moved the Curl_rand() function into the sslgen.c source file now to be able to take advantage of the SSL library's random function if it provides one. If not, try to use the RANDOM_FILE for seeding and as a last resort keep the old logic, just modified to also add microseconds which makes it harder to properly guess the exact seed. The formboundary() function in formdata.c is now using 64 bit entropy for the boundary and therefore the string of dashes was reduced by 4 letters and there are 16 hex digits following it. The total length is thus still the same. Bug: http://curl.haxx.se/bug/view.cgi?id=1251 Reported-by: "Floris"
-
Daniel Stenberg authored
When using %x, the number must be treated as unsigned as otherwise it would get sign-extended on for example 64bit machines and do wrong output. This problem showed when doing printf("%08x", 0xffeeddcc) on a 64bit host.
-
- Jun 24, 2013
-
-
Daniel Stenberg authored
-
Daniel Stenberg authored
Follow-up fix from 7d80ed64. The SessionHandle may not be around to use when we restore the sigpipe sighandler so we store the no_signal boolean in the local struct to know if/how to restore.
-
- Jun 23, 2013
-
-
Daniel Stenberg authored
Thoughts around buffer sizes and what might be possible to do...
-
Daniel Stenberg authored
When the c-ares based resolver backend failed to resolve a name, it tried to show the name that failed from existing structs. This caused the wrong output and shown hostname when for example --interface [hostname] was used and that name resolving failed. Now we use the hostname used in the actual resolve attempt in the error message as well. Bug: http://curl.haxx.se/bug/view.cgi?id=1191 Reported-by: Kim Vandry
-
Daniel Stenberg authored
When we recently started to treat a zero return code from SSL_read() as an error we also got false positives - which primarily looks to be because the OpenSSL documentation is wrong and a zero return code is not at all an error case in many situations. Now ossl_recv() will check with ERR_get_error() to see if there is a stored error and only then consider it to be a true error if SSL_read() returned zero. Bug: http://curl.haxx.se/bug/view.cgi?id=1249 Reported-by: Nach M. S. Patch-by: Nach M. S.
-
- Jun 22, 2013
-
-
-
Nick Zitzmann authored
Something (a recent security update maybe?) changed in Lion, and now it has changed SSLCopyPeerTrust such that it may return noErr but also give us a null trust, which caught us off guard and caused an eventual crash.
-
Daniel Stenberg authored
... and restore the ordinary handling again when it returns. This is done for curl_easy_perform() and curl_easy_cleanup() only for now - and only when built to use OpenSSL as backend as this is the known culprit for the spurious SIGPIPEs people have received. Bug: http://curl.haxx.se/bug/view.cgi?id=1180 Reported by: Lluís Batlle i Rossell
-
Daniel Stenberg authored
-
Daniel Stenberg authored
This erroneously run unit test 1310 instead of 1396!
-
Kamil Dudka authored
... to prevent failure when a non-default -b option is given
-
Kamil Dudka authored
-
Nick Zitzmann authored
This doesn't need to be in the release notes. I cleaned up a lot of the #if lines in the code to use MAC_OS_X_VERSION_MIN_REQUIRED and MAC_OS_X_VERSION_MAX_ALLOWED instead of checking for whether things like __MAC_10_6 or whatever were defined, because for some SDKs Apple has released they were defined out of place.
-
Alessandro Ghedini authored
-
Daniel Stenberg authored
RFC3986 details how a path part passed in as part of a URI should be "cleaned" from dot sequences before getting used. The described algorithm is now implemented in lib/dotdot.c with the accompanied test case in test 1395. Bug: http://curl.haxx.se/bug/view.cgi?id=1200 Reported-by: Alex Vinnik
-
Daniel Stenberg authored
-
Daniel Stenberg authored
-