diff options
37 files changed, 3196 insertions, 1121 deletions
diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ec30f2a --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +curl-7.*.tar.lzma diff --git a/0001-curl-7.27.0-1f8518c5.patch b/0001-curl-7.27.0-1f8518c5.patch deleted file mode 100644 index 02e2e6e..0000000 --- a/0001-curl-7.27.0-1f8518c5.patch +++ /dev/null @@ -1,34 +0,0 @@ -From e693b8e6591366ef2c077ba90fe0315a8a0b00c5 Mon Sep 17 00:00:00 2001 -From: Kamil Dudka <kdudka@redhat.com> -Date: Mon, 30 Jul 2012 14:20:07 +0200 -Subject: [PATCH] file: use fdopen() for uploaded files if available - -It eliminates noisy events when using inotify and fixes a TOCTOU issue. - -Bug: https://bugzilla.redhat.com/844385 - -[upstream commit 1f8518c5d9aaa369dae85620973f9b5c1add3277] ---- - lib/file.c | 4 ++++ - 1 files changed, 4 insertions(+), 0 deletions(-) - -diff --git a/lib/file.c b/lib/file.c -index 4447c73..1025022 100644 ---- a/lib/file.c -+++ b/lib/file.c -@@ -351,8 +351,12 @@ static CURLcode file_upload(struct connectdata *conn) - failf(data, "Can't open %s for writing", file->path); - return CURLE_WRITE_ERROR; - } -+#ifdef HAVE_FDOPEN -+ fp = fdopen(fd, "wb"); -+#else - close(fd); - fp = fopen(file->path, "wb"); -+#endif - } - - if(!fp) { --- -1.7.1 - diff --git a/0001-curl-7.29.0-da3fc1ee.patch b/0001-curl-7.29.0-da3fc1ee.patch new file mode 100644 index 0000000..bebcb95 --- /dev/null +++ b/0001-curl-7.29.0-da3fc1ee.patch @@ -0,0 +1,321 @@ +From 48b69def52771149ed19189284b8c6d1ba667ef7 Mon Sep 17 00:00:00 2001 +From: Linus Nielsen Feltzing <linus@haxx.se> +Date: Sun, 10 Feb 2013 22:57:58 +0100 +Subject: [PATCH] Fix NULL pointer reference when closing an unused multi handle. + +[upstream commit da3fc1ee91de656a30f3a12de394bcba55119872] + +Signed-off-by: Kamil Dudka <kdudka@redhat.com> +--- + lib/multi.c | 8 +++-- + tests/data/Makefile.am | 2 +- + tests/data/Makefile.in | 2 +- + tests/data/test1508 | 31 +++++++++++++++++ + tests/libtest/Makefile.in | 79 ++++++++++++++++++++++++++++++++++++++++++-- + tests/libtest/Makefile.inc | 6 +++- + tests/libtest/lib1508.c | 49 +++++++++++++++++++++++++++ + 7 files changed, 168 insertions(+), 9 deletions(-) + create mode 100644 tests/data/test1508 + create mode 100644 tests/libtest/lib1508.c + +diff --git a/lib/multi.c b/lib/multi.c +index fa0afb9..706df23 100644 +--- a/lib/multi.c ++++ b/lib/multi.c +@@ -1773,10 +1773,12 @@ CURLMcode curl_multi_cleanup(CURLM *multi_handle) + /* Close all the connections in the connection cache */ + close_all_connections(multi); + +- multi->closure_handle->dns.hostcache = multi->hostcache; +- Curl_hostcache_clean(multi->closure_handle); ++ if(multi->closure_handle) { ++ multi->closure_handle->dns.hostcache = multi->hostcache; ++ Curl_hostcache_clean(multi->closure_handle); + +- Curl_close(multi->closure_handle); ++ Curl_close(multi->closure_handle); ++ } + multi->closure_handle = NULL; + + Curl_hash_destroy(multi->sockhash); +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index d82534d..9f569a3 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -93,7 +93,7 @@ test1379 test1380 test1381 test1382 test1383 test1384 test1385 test1386 \ + test1387 test1388 test1389 test1390 test1391 test1392 test1393 \ + test1400 test1401 test1402 test1403 test1404 test1405 test1406 test1407 \ + test1408 test1409 test1410 test1411 test1412 test1413 \ +-test1500 test1501 test1502 test1503 test1504 test1505 test1506 \ ++test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1508 \ + test2000 test2001 test2002 test2003 test2004 test2005 test2006 test2007 \ + test2008 test2009 test2010 test2011 test2012 test2013 test2014 test2015 \ + test2016 test2017 test2018 test2019 test2020 test2021 test2022 \ +diff --git a/tests/data/Makefile.in b/tests/data/Makefile.in +index df52421..d5b0918 100644 +--- a/tests/data/Makefile.in ++++ b/tests/data/Makefile.in +@@ -357,7 +357,7 @@ test1379 test1380 test1381 test1382 test1383 test1384 test1385 test1386 \ + test1387 test1388 test1389 test1390 test1391 test1392 test1393 \ + test1400 test1401 test1402 test1403 test1404 test1405 test1406 test1407 \ + test1408 test1409 test1410 test1411 test1412 test1413 \ +-test1500 test1501 test1502 test1503 test1504 test1505 test1506 \ ++test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1508 \ + test2000 test2001 test2002 test2003 test2004 test2005 test2006 test2007 \ + test2008 test2009 test2010 test2011 test2012 test2013 test2014 test2015 \ + test2016 test2017 test2018 test2019 test2020 test2021 test2022 \ +diff --git a/tests/data/test1508 b/tests/data/test1508 +new file mode 100644 +index 0000000..f8607e5 +--- /dev/null ++++ b/tests/data/test1508 +@@ -0,0 +1,31 @@ ++<testcase> ++<info> ++<keywords> ++HTTP ++multi ++</keywords> ++</info> ++ ++# Client-side ++<client> ++<server> ++none ++</server> ++<tool> ++lib1508 ++</tool> ++ <name> ++Close a multi handle without using it ++ </name> ++ <command> ++http://%HOSTIP:%HTTPPORT/path/1508 ++</command> ++</client> ++ ++# Verify data after the test has been "shot" ++<verify> ++<file name="log/stdout1508" mode="text"> ++We are done ++</file> ++</verify> ++</testcase> +diff --git a/tests/libtest/Makefile.in b/tests/libtest/Makefile.in +index 406b457..7683c09 100644 +--- a/tests/libtest/Makefile.in ++++ b/tests/libtest/Makefile.in +@@ -85,7 +85,7 @@ noinst_PROGRAMS = chkhostname$(EXEEXT) libauthretry$(EXEEXT) \ + lib591$(EXEEXT) lib597$(EXEEXT) lib598$(EXEEXT) \ + lib599$(EXEEXT) lib1500$(EXEEXT) lib1501$(EXEEXT) \ + lib1502$(EXEEXT) lib1503$(EXEEXT) lib1504$(EXEEXT) \ +- lib1505$(EXEEXT) lib1506$(EXEEXT) ++ lib1505$(EXEEXT) lib1506$(EXEEXT) lib1508$(EXEEXT) + subdir = tests/libtest + ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 + am__aclocal_m4_deps = $(top_srcdir)/m4/curl-compilers.m4 \ +@@ -173,6 +173,13 @@ am_lib1506_OBJECTS = lib1506-lib1506.$(OBJEXT) $(am__objects_18) \ + $(am__objects_19) $(am__objects_20) + lib1506_OBJECTS = $(am_lib1506_OBJECTS) + lib1506_DEPENDENCIES = $(am__DEPENDENCIES_1) ++am__objects_151 = lib1508-first.$(OBJEXT) ++am__objects_152 = lib1508-testutil.$(OBJEXT) ++am__objects_153 = lib1508-warnless.$(OBJEXT) ++am_lib1508_OBJECTS = lib1508-lib1508.$(OBJEXT) $(am__objects_151) \ ++ $(am__objects_152) $(am__objects_153) ++lib1508_OBJECTS = $(am_lib1508_OBJECTS) ++lib1508_DEPENDENCIES = $(am__DEPENDENCIES_1) + am__objects_21 = lib500-first.$(OBJEXT) + am__objects_22 = lib500-testutil.$(OBJEXT) + am__objects_23 = lib500-testtrace.$(OBJEXT) +@@ -632,7 +639,7 @@ LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ + SOURCES = $(libhostname_la_SOURCES) $(chkhostname_SOURCES) \ + $(lib1500_SOURCES) $(lib1501_SOURCES) $(lib1502_SOURCES) \ + $(lib1503_SOURCES) $(lib1504_SOURCES) $(lib1505_SOURCES) \ +- $(lib1506_SOURCES) $(lib500_SOURCES) $(lib501_SOURCES) \ ++ $(lib1506_SOURCES) $(lib1508_SOURCES) $(lib500_SOURCES) $(lib501_SOURCES) \ + $(lib502_SOURCES) $(lib503_SOURCES) $(lib504_SOURCES) \ + $(lib505_SOURCES) $(lib506_SOURCES) $(lib507_SOURCES) \ + $(lib508_SOURCES) $(lib510_SOURCES) $(lib511_SOURCES) \ +@@ -662,7 +669,7 @@ SOURCES = $(libhostname_la_SOURCES) $(chkhostname_SOURCES) \ + DIST_SOURCES = $(libhostname_la_SOURCES) $(chkhostname_SOURCES) \ + $(lib1500_SOURCES) $(lib1501_SOURCES) $(lib1502_SOURCES) \ + $(lib1503_SOURCES) $(lib1504_SOURCES) $(lib1505_SOURCES) \ +- $(lib1506_SOURCES) $(lib500_SOURCES) $(lib501_SOURCES) \ ++ $(lib1506_SOURCES) $(lib1508_SOURCES) $(lib500_SOURCES) $(lib501_SOURCES) \ + $(lib502_SOURCES) $(lib503_SOURCES) $(lib504_SOURCES) \ + $(lib505_SOURCES) $(lib506_SOURCES) $(lib507_SOURCES) \ + $(lib508_SOURCES) $(lib510_SOURCES) $(lib511_SOURCES) \ +@@ -1155,6 +1162,9 @@ lib1505_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1505 + lib1506_SOURCES = lib1506.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib1506_LDADD = $(TESTUTIL_LIBS) + lib1506_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1506 ++lib1508_SOURCES = lib1508.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) ++lib1508_LDADD = $(TESTUTIL_LIBS) ++lib1508_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1508 + @BUILD_LIBHOSTNAME_FALSE@noinst_LTLIBRARIES = + + # Makefile.inc provides the source defines (TESTUTIL, SUPPORTFILES, +@@ -1253,6 +1263,9 @@ lib1505$(EXEEXT): $(lib1505_OBJECTS) $(lib1505_DEPENDENCIES) $(EXTRA_lib1505_DEP + lib1506$(EXEEXT): $(lib1506_OBJECTS) $(lib1506_DEPENDENCIES) $(EXTRA_lib1506_DEPENDENCIES) + @rm -f lib1506$(EXEEXT) + $(LINK) $(lib1506_OBJECTS) $(lib1506_LDADD) $(LIBS) ++lib1508$(EXEEXT): $(lib1508_OBJECTS) $(lib1508_DEPENDENCIES) $(EXTRA_lib1508_DEPENDENCIES) ++ @rm -f lib1508$(EXEEXT) ++ $(LINK) $(lib1508_OBJECTS) $(lib1508_LDADD) $(LIBS) + lib500$(EXEEXT): $(lib500_OBJECTS) $(lib500_DEPENDENCIES) $(EXTRA_lib500_DEPENDENCIES) + @rm -f lib500$(EXEEXT) + $(LINK) $(lib500_OBJECTS) $(lib500_LDADD) $(LIBS) +@@ -1520,6 +1533,10 @@ distclean-compile: + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1506-lib1506.Po@am__quote@ + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1506-testutil.Po@am__quote@ + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1506-warnless.Po@am__quote@ ++@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1508-first.Po@am__quote@ ++@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1508-lib1508.Po@am__quote@ ++@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1508-testutil.Po@am__quote@ ++@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1508-warnless.Po@am__quote@ + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib500-first.Po@am__quote@ + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib500-lib500.Po@am__quote@ + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib500-testtrace.Po@am__quote@ +@@ -2163,6 +2180,62 @@ lib1506-warnless.obj: ../../lib/warnless.c + @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ + @am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1506_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1506-warnless.obj `if test -f '../../lib/warnless.c'; then $(CYGPATH_W) '../../lib/warnless.c'; else $(CYGPATH_W) '$(srcdir)/../../lib/warnless.c'; fi` + ++lib1508-lib1508.o: lib1508.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1508-lib1508.o -MD -MP -MF $(DEPDIR)/lib1508-lib1508.Tpo -c -o lib1508-lib1508.o `test -f 'lib1508.c' || echo '$(srcdir)/'`lib1508.c ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1508-lib1508.Tpo $(DEPDIR)/lib1508-lib1508.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='lib1508.c' object='lib1508-lib1508.o' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1508-lib1508.o `test -f 'lib1508.c' || echo '$(srcdir)/'`lib1508.c ++ ++lib1508-lib1508.obj: lib1508.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1508-lib1508.obj -MD -MP -MF $(DEPDIR)/lib1508-lib1508.Tpo -c -o lib1508-lib1508.obj `if test -f 'lib1508.c'; then $(CYGPATH_W) 'lib1508.c'; else $(CYGPATH_W) '$(srcdir)/lib1508.c'; fi` ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1508-lib1508.Tpo $(DEPDIR)/lib1508-lib1508.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='lib1508.c' object='lib1508-lib1508.obj' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1508-lib1508.obj `if test -f 'lib1508.c'; then $(CYGPATH_W) 'lib1508.c'; else $(CYGPATH_W) '$(srcdir)/lib1508.c'; fi` ++ ++lib1508-first.o: first.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1508-first.o -MD -MP -MF $(DEPDIR)/lib1508-first.Tpo -c -o lib1508-first.o `test -f 'first.c' || echo '$(srcdir)/'`first.c ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1508-first.Tpo $(DEPDIR)/lib1508-first.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='first.c' object='lib1508-first.o' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1508-first.o `test -f 'first.c' || echo '$(srcdir)/'`first.c ++ ++lib1508-first.obj: first.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1508-first.obj -MD -MP -MF $(DEPDIR)/lib1508-first.Tpo -c -o lib1508-first.obj `if test -f 'first.c'; then $(CYGPATH_W) 'first.c'; else $(CYGPATH_W) '$(srcdir)/first.c'; fi` ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1508-first.Tpo $(DEPDIR)/lib1508-first.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='first.c' object='lib1508-first.obj' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1508-first.obj `if test -f 'first.c'; then $(CYGPATH_W) 'first.c'; else $(CYGPATH_W) '$(srcdir)/first.c'; fi` ++ ++lib1508-testutil.o: testutil.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1508-testutil.o -MD -MP -MF $(DEPDIR)/lib1508-testutil.Tpo -c -o lib1508-testutil.o `test -f 'testutil.c' || echo '$(srcdir)/'`testutil.c ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1508-testutil.Tpo $(DEPDIR)/lib1508-testutil.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='testutil.c' object='lib1508-testutil.o' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1508-testutil.o `test -f 'testutil.c' || echo '$(srcdir)/'`testutil.c ++ ++lib1508-testutil.obj: testutil.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1508-testutil.obj -MD -MP -MF $(DEPDIR)/lib1508-testutil.Tpo -c -o lib1508-testutil.obj `if test -f 'testutil.c'; then $(CYGPATH_W) 'testutil.c'; else $(CYGPATH_W) '$(srcdir)/testutil.c'; fi` ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1508-testutil.Tpo $(DEPDIR)/lib1508-testutil.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='testutil.c' object='lib1508-testutil.obj' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1508-testutil.obj `if test -f 'testutil.c'; then $(CYGPATH_W) 'testutil.c'; else $(CYGPATH_W) '$(srcdir)/testutil.c'; fi` ++ ++lib1508-warnless.o: ../../lib/warnless.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1508-warnless.o -MD -MP -MF $(DEPDIR)/lib1508-warnless.Tpo -c -o lib1508-warnless.o `test -f '../../lib/warnless.c' || echo '$(srcdir)/'`../../lib/warnless.c ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1508-warnless.Tpo $(DEPDIR)/lib1508-warnless.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='../../lib/warnless.c' object='lib1508-warnless.o' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1508-warnless.o `test -f '../../lib/warnless.c' || echo '$(srcdir)/'`../../lib/warnless.c ++ ++lib1508-warnless.obj: ../../lib/warnless.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1508-warnless.obj -MD -MP -MF $(DEPDIR)/lib1508-warnless.Tpo -c -o lib1508-warnless.obj `if test -f '../../lib/warnless.c'; then $(CYGPATH_W) '../../lib/warnless.c'; else $(CYGPATH_W) '$(srcdir)/../../lib/warnless.c'; fi` ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1508-warnless.Tpo $(DEPDIR)/lib1508-warnless.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='../../lib/warnless.c' object='lib1508-warnless.obj' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1508-warnless.obj `if test -f '../../lib/warnless.c'; then $(CYGPATH_W) '../../lib/warnless.c'; else $(CYGPATH_W) '$(srcdir)/../../lib/warnless.c'; fi` ++ + lib500-lib500.o: lib500.c + @am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib500_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib500-lib500.o -MD -MP -MF $(DEPDIR)/lib500-lib500.Tpo -c -o lib500-lib500.o `test -f 'lib500.c' || echo '$(srcdir)/'`lib500.c + @am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib500-lib500.Tpo $(DEPDIR)/lib500-lib500.Po +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc +index 82c265d..8bf2be4 100644 +--- a/tests/libtest/Makefile.inc ++++ b/tests/libtest/Makefile.inc +@@ -23,7 +23,7 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect \ + lib582 lib583 lib585 lib586 lib587 \ + lib590 lib591 lib597 lib598 lib599 \ + \ +- lib1500 lib1501 lib1502 lib1503 lib1504 lib1505 lib1506 ++ lib1500 lib1501 lib1502 lib1503 lib1504 lib1505 lib1506 lib1508 + + chkhostname_SOURCES = chkhostname.c ../../lib/curl_gethostname.c + chkhostname_LDADD = @CURL_NETWORK_LIBS@ +@@ -312,3 +312,7 @@ lib1505_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1505 + lib1506_SOURCES = lib1506.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib1506_LDADD = $(TESTUTIL_LIBS) + lib1506_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1506 ++ ++lib1508_SOURCES = lib1508.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) ++lib1508_LDADD = $(TESTUTIL_LIBS) ++lib1508_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1508 +diff --git a/tests/libtest/lib1508.c b/tests/libtest/lib1508.c +new file mode 100644 +index 0000000..72f26d1 +--- /dev/null ++++ b/tests/libtest/lib1508.c +@@ -0,0 +1,49 @@ ++/*************************************************************************** ++ * _ _ ____ _ ++ * Project ___| | | | _ \| | ++ * / __| | | | |_) | | ++ * | (__| |_| | _ <| |___ ++ * \___|\___/|_| \_\_____| ++ * ++ * Copyright (C) 2013, Linus Nielsen Feltzing <linus@haxx.se> ++ * ++ * This software is licensed as described in the file COPYING, which ++ * you should have received as part of this distribution. The terms ++ * are also available at http://curl.haxx.se/docs/copyright.html. ++ * ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell ++ * copies of the Software, and permit persons to whom the Software is ++ * furnished to do so, under the terms of the COPYING file. ++ * ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY ++ * KIND, either express or implied. ++ * ++ ***************************************************************************/ ++#include "test.h" ++ ++#include "testutil.h" ++#include "warnless.h" ++#include "memdebug.h" ++ ++int test(char *URL) ++{ ++ int res = 0; ++ CURLM *m = NULL; ++ ++ (void)URL; ++ ++ global_init(CURL_GLOBAL_ALL); ++ ++ multi_init(m); ++ ++test_cleanup: ++ ++ /* proper cleanup sequence - type PB */ ++ ++ curl_multi_cleanup(m); ++ curl_global_cleanup(); ++ ++ printf("We are done\n"); ++ ++ return res; ++} +-- +1.7.1 + diff --git a/0002-curl-7.27.0-f05e5136.patch b/0002-curl-7.27.0-f05e5136.patch deleted file mode 100644 index 7413ed6..0000000 --- a/0002-curl-7.27.0-f05e5136.patch +++ /dev/null @@ -1,197 +0,0 @@ -From ce515e993fe7bc7e95549317fe5180b196454d4c Mon Sep 17 00:00:00 2001 -From: Kamil Dudka <kdudka@redhat.com> -Date: Wed, 12 Sep 2012 16:06:18 +0200 -Subject: [PATCH 1/3] ssh: move the fingerprint checking code to a separate fnc - ---- - lib/ssh.c | 71 +++++++++++++++++++++++++++++++++--------------------------- - 1 files changed, 39 insertions(+), 32 deletions(-) - -diff --git a/lib/ssh.c b/lib/ssh.c -index c76a48e..4455d44 100644 ---- a/lib/ssh.c -+++ b/lib/ssh.c -@@ -635,6 +635,43 @@ static CURLcode ssh_knownhost(struct connectdata *conn) - return result; - } - -+static bool ssh_check_fingerprint(struct connectdata *conn) -+{ -+ struct ssh_conn *sshc = &conn->proto.sshc; -+ struct SessionHandle *data = conn->data; -+ const char *pubkey_md5 = data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5]; -+ char md5buffer[33]; -+ int i; -+ -+ const char *fingerprint = libssh2_hostkey_hash(sshc->ssh_session, -+ LIBSSH2_HOSTKEY_HASH_MD5); -+ -+ /* The fingerprint points to static storage (!), don't free() it. */ -+ for(i = 0; i < 16; i++) -+ snprintf(&md5buffer[i*2], 3, "%02x", (unsigned char) fingerprint[i]); -+ infof(data, "SSH MD5 fingerprint: %s\n", md5buffer); -+ -+ /* Before we authenticate we check the hostkey's MD5 fingerprint -+ * against a known fingerprint, if available. -+ */ -+ if(pubkey_md5 && strlen(pubkey_md5) == 32) { -+ if(!strequal(md5buffer, pubkey_md5)) { -+ failf(data, -+ "Denied establishing ssh session: mismatch md5 fingerprint. " -+ "Remote %s is not equal to %s", md5buffer, pubkey_md5); -+ state(conn, SSH_SESSION_FREE); -+ sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION; -+ return sshc->actualcode; -+ } -+ else { -+ infof(data, "MD5 checksum match!\n"); -+ /* as we already matched, we skip the check for known hosts */ -+ return CURLE_OK; -+ } -+ } -+ else -+ return ssh_knownhost(conn); -+} - - /* - * ssh_statemach_act() runs the SSH state machine as far as it can without -@@ -650,10 +687,8 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block) - struct SSHPROTO *sftp_scp = data->state.proto.ssh; - struct ssh_conn *sshc = &conn->proto.sshc; - curl_socket_t sock = conn->sock[FIRSTSOCKET]; -- const char *fingerprint; -- char md5buffer[33]; - char *new_readdir_line; -- int rc = LIBSSH2_ERROR_NONE, i; -+ int rc = LIBSSH2_ERROR_NONE; - int err; - int seekerr = CURL_SEEKFUNC_OK; - *block = 0; /* we're not blocking by default */ -@@ -694,35 +729,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block) - * against our known hosts. How that is handled (reading from file, - * whatever) is up to us. - */ -- fingerprint = libssh2_hostkey_hash(sshc->ssh_session, -- LIBSSH2_HOSTKEY_HASH_MD5); -- -- /* The fingerprint points to static storage (!), don't free() it. */ -- for(i = 0; i < 16; i++) -- snprintf(&md5buffer[i*2], 3, "%02x", (unsigned char) fingerprint[i]); -- infof(data, "SSH MD5 fingerprint: %s\n", md5buffer); -- -- /* Before we authenticate we check the hostkey's MD5 fingerprint -- * against a known fingerprint, if available. -- */ -- if(data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5] && -- strlen(data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5]) == 32) { -- if(!strequal(md5buffer, -- data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5])) { -- failf(data, -- "Denied establishing ssh session: mismatch md5 fingerprint. " -- "Remote %s is not equal to %s", -- md5buffer, data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5]); -- state(conn, SSH_SESSION_FREE); -- result = sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION; -- } -- else -- infof(data, "MD5 checksum match!\n"); -- /* as we already matched, we skip the check for known hosts */ -- } -- else -- result = ssh_knownhost(conn); -- -+ result = ssh_check_fingerprint(conn); - if(!result) - state(conn, SSH_AUTHLIST); - break; --- -1.7.1 - - -From f05e51362f310cb04b0ad8d086b9cf693aad5c9d Mon Sep 17 00:00:00 2001 -From: Kamil Dudka <kdudka@redhat.com> -Date: Wed, 12 Sep 2012 16:18:36 +0200 -Subject: [PATCH 2/3] ssh: do not crash if MD5 fingerprint is not provided by libssh2 - -The MD5 fingerprint cannot be computed when running in FIPS mode. ---- - lib/ssh.c | 22 ++++++++++++++-------- - 1 files changed, 14 insertions(+), 8 deletions(-) - -diff --git a/lib/ssh.c b/lib/ssh.c -index 4455d44..466566c 100644 ---- a/lib/ssh.c -+++ b/lib/ssh.c -@@ -646,19 +646,25 @@ static bool ssh_check_fingerprint(struct connectdata *conn) - const char *fingerprint = libssh2_hostkey_hash(sshc->ssh_session, - LIBSSH2_HOSTKEY_HASH_MD5); - -- /* The fingerprint points to static storage (!), don't free() it. */ -- for(i = 0; i < 16; i++) -- snprintf(&md5buffer[i*2], 3, "%02x", (unsigned char) fingerprint[i]); -- infof(data, "SSH MD5 fingerprint: %s\n", md5buffer); -+ if(fingerprint) { -+ /* The fingerprint points to static storage (!), don't free() it. */ -+ for(i = 0; i < 16; i++) -+ snprintf(&md5buffer[i*2], 3, "%02x", (unsigned char) fingerprint[i]); -+ infof(data, "SSH MD5 fingerprint: %s\n", md5buffer); -+ } - - /* Before we authenticate we check the hostkey's MD5 fingerprint - * against a known fingerprint, if available. - */ - if(pubkey_md5 && strlen(pubkey_md5) == 32) { -- if(!strequal(md5buffer, pubkey_md5)) { -- failf(data, -- "Denied establishing ssh session: mismatch md5 fingerprint. " -- "Remote %s is not equal to %s", md5buffer, pubkey_md5); -+ if(!fingerprint || !strequal(md5buffer, pubkey_md5)) { -+ if(fingerprint) -+ failf(data, -+ "Denied establishing ssh session: mismatch md5 fingerprint. " -+ "Remote %s is not equal to %s", md5buffer, pubkey_md5); -+ else -+ failf(data, -+ "Denied establishing ssh session: md5 fingerprint not available"); - state(conn, SSH_SESSION_FREE); - sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION; - return sshc->actualcode; --- -1.7.1 - - -From 1ab6c353635760e8e25bacc13ae0cab2f97f7338 Mon Sep 17 00:00:00 2001 -From: Marc Hoersken <info@marc-hoersken.de> -Date: Fri, 14 Sep 2012 14:48:55 +0200 -Subject: [PATCH 3/3] ssh.c: Fixed warning: implicit conversion from enumeration type - -Signed-off-by: Kamil Dudka <kdudka@redhat.com> ---- - lib/ssh.c | 4 ++-- - 1 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/lib/ssh.c b/lib/ssh.c -index 466566c..e8b7172 100644 ---- a/lib/ssh.c -+++ b/lib/ssh.c -@@ -635,7 +635,7 @@ static CURLcode ssh_knownhost(struct connectdata *conn) - return result; - } - --static bool ssh_check_fingerprint(struct connectdata *conn) -+static CURLcode ssh_check_fingerprint(struct connectdata *conn) - { - struct ssh_conn *sshc = &conn->proto.sshc; - struct SessionHandle *data = conn->data; -@@ -736,7 +736,7 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block) - * whatever) is up to us. - */ - result = ssh_check_fingerprint(conn); -- if(!result) -+ if(result == CURLE_OK) - state(conn, SSH_AUTHLIST); - break; - --- -1.7.1 - diff --git a/0002-curl-7.29.0-9d0af301.patch b/0002-curl-7.29.0-9d0af301.patch new file mode 100644 index 0000000..0b9f7aa --- /dev/null +++ b/0002-curl-7.29.0-9d0af301.patch @@ -0,0 +1,47 @@ +From 8d25353ae1661ce50fe564e733f3ef45004f4bdf Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Tue, 5 Mar 2013 17:51:01 +0100 +Subject: [PATCH] nss: fix misplaced code enabling non-blocking socket mode + +The option needs to be set on the SSL socket. Setting it on the model +takes no effect. Note that the non-blocking mode is still not enabled +for the handshake because the code is not yet ready for that. + +[upstream commit 9d0af3018c5db25f5adda216dbcad6056b4a3107] +--- + lib/nss.c | 12 ++++++------ + 1 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/lib/nss.c b/lib/nss.c +index 8a2cb09..a2c5c63 100644 +--- a/lib/nss.c ++++ b/lib/nss.c +@@ -1237,12 +1237,6 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) + goto error; + model = SSL_ImportFD(NULL, model); + +- /* make the socket nonblocking */ +- sock_opt.option = PR_SockOpt_Nonblocking; +- sock_opt.value.non_blocking = PR_TRUE; +- if(PR_SetSocketOption(model, &sock_opt) != PR_SUCCESS) +- goto error; +- + if(SSL_OptionSet(model, SSL_SECURITY, PR_TRUE) != SECSuccess) + goto error; + if(SSL_OptionSet(model, SSL_HANDSHAKE_AS_SERVER, PR_FALSE) != SECSuccess) +@@ -1415,6 +1409,12 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) + goto error; + } + ++ /* switch the SSL socket into non-blocking mode */ ++ sock_opt.option = PR_SockOpt_Nonblocking; ++ sock_opt.value.non_blocking = PR_TRUE; ++ if(PR_SetSocketOption(connssl->handle, &sock_opt) != PR_SUCCESS) ++ goto error; ++ + connssl->state = ssl_connection_complete; + conn->recv[sockindex] = nss_recv; + conn->send[sockindex] = nss_send; +-- +1.7.1 + diff --git a/0003-curl-7.27.0-382429e7.patch b/0003-curl-7.27.0-382429e7.patch deleted file mode 100644 index f25fe71..0000000 --- a/0003-curl-7.27.0-382429e7.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 382429e7601de68564f08a88cc867dbcd6e2556a Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg <daniel@haxx.se> -Date: Tue, 7 Aug 2012 14:13:09 +0200 -Subject: [PATCH] curl-config: parentheses fix - -Braces, not parentheses, should be used for shell variable names. - -Bug: http://curl.haxx.se/bug/view.cgi?id=3551460 -Reported by: Edward Sheldrake ---- - curl-config.in | 4 ++-- - 1 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/curl-config.in b/curl-config.in -index a3ca8b5..731761c 100644 ---- a/curl-config.in -+++ b/curl-config.in -@@ -135,9 +135,9 @@ while test $# -gt 0; do - CPPFLAG_CURL_STATICLIB="" - fi - if test "X@includedir@" = "X/usr/include"; then -- echo "$(CPPFLAG_CURL_STATICLIB)" -+ echo "$CPPFLAG_CURL_STATICLIB" - else -- echo "$(CPPFLAG_CURL_STATICLIB)-I@includedir@" -+ echo "${CPPFLAG_CURL_STATICLIB}-I@includedir@" - fi - ;; - --- -1.7.1 - diff --git a/0003-curl-7.29.0-491e026c.patch b/0003-curl-7.29.0-491e026c.patch new file mode 100644 index 0000000..c136e34 --- /dev/null +++ b/0003-curl-7.29.0-491e026c.patch @@ -0,0 +1,39 @@ +From a2e6eadf6a72f7587eb9bc1ad52383e4c5507b12 Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Mon, 11 Mar 2013 16:57:25 +0100 +Subject: [PATCH 1/2] easy: do not ignore poll() failures other than EINTR + +[upstream commit 491e026ccda0e60975fa6e2e9cf3ccca37e18f7b] +--- + lib/easy.c | 12 ++++++++++-- + 1 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/lib/easy.c b/lib/easy.c +index c27deff..2e747bb 100644 +--- a/lib/easy.c ++++ b/lib/easy.c +@@ -441,11 +441,19 @@ CURLcode curl_easy_perform(CURL *easy) + + while(!done && !mcode) { + int still_running; ++ int ret; + +- mcode = curl_multi_wait(multi, NULL, 0, 1000, NULL); ++ mcode = curl_multi_wait(multi, NULL, 0, 1000, &ret); ++ ++ if(mcode == CURLM_OK) { ++ if(ret == -1) { ++ /* poll() failed not on EINTR, indicate a network problem */ ++ code = CURLE_RECV_ERROR; ++ break; ++ } + +- if(mcode == CURLM_OK) + mcode = curl_multi_perform(multi, &still_running); ++ } + + /* only read 'still_running' if curl_multi_perform() return OK */ + if((mcode == CURLM_OK) && !still_running) { +-- +1.7.1 + diff --git a/0004-curl-7.27.0-52b6eda4.patch b/0004-curl-7.27.0-52b6eda4.patch deleted file mode 100644 index a6b751b..0000000 --- a/0004-curl-7.27.0-52b6eda4.patch +++ /dev/null @@ -1,115 +0,0 @@ -From fea7914a32b7d7a8ec4bbf4de0c2be74a32969bb Mon Sep 17 00:00:00 2001 -From: Kamil Dudka <kdudka@redhat.com> -Date: Thu, 9 Aug 2012 09:40:00 +0200 -Subject: [PATCH 1/2] nss: do not print misleading NSS error codes - -[upstream commit 52b6eda4f2a006e33358c6964ef6a00b09ae59ab] ---- - lib/nss.c | 42 ++++++++++++++++++++++++++++++------------ - 1 files changed, 30 insertions(+), 12 deletions(-) - -diff --git a/lib/nss.c b/lib/nss.c -index b11796c..a8e08f4 100644 ---- a/lib/nss.c -+++ b/lib/nss.c -@@ -1084,17 +1084,31 @@ int Curl_nss_close_all(struct SessionHandle *data) - return 0; - } - --/* return true if the given error code is related to a client certificate */ --static bool is_cc_error(PRInt32 err) -+/* return true if NSS can provide error code (and possibly msg) for the error */ -+static bool is_nss_error(CURLcode err) - { - switch(err) { -- case SSL_ERROR_BAD_CERT_ALERT: -+ case CURLE_PEER_FAILED_VERIFICATION: -+ case CURLE_SSL_CACERT: -+ case CURLE_SSL_CACERT_BADFILE: -+ case CURLE_SSL_CERTPROBLEM: -+ case CURLE_SSL_CONNECT_ERROR: -+ case CURLE_SSL_CRL_BADFILE: -+ case CURLE_SSL_ISSUER_ERROR: - return true; - -- case SSL_ERROR_REVOKED_CERT_ALERT: -- return true; -+ default: -+ return false; -+ } -+} - -+/* return true if the given error code is related to a client certificate */ -+static bool is_cc_error(PRInt32 err) -+{ -+ switch(err) { -+ case SSL_ERROR_BAD_CERT_ALERT: - case SSL_ERROR_EXPIRED_CERT_ALERT: -+ case SSL_ERROR_REVOKED_CERT_ALERT: - return true; - - default: -@@ -1388,6 +1402,7 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) - time_left = Curl_timeleft(data, NULL, TRUE); - if(time_left < 0L) { - failf(data, "timed out before SSL handshake"); -+ curlerr = CURLE_OPERATION_TIMEDOUT; - goto error; - } - timeout = PR_MillisecondsToInterval((PRUint32) time_left); -@@ -1432,15 +1447,18 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) - /* reset the flag to avoid an infinite loop */ - data->state.ssl_connect_retry = FALSE; - -- err = PR_GetError(); -- if(is_cc_error(err)) -- curlerr = CURLE_SSL_CERTPROBLEM; -+ if(is_nss_error(curlerr)) { -+ /* read NSPR error code */ -+ err = PR_GetError(); -+ if(is_cc_error(err)) -+ curlerr = CURLE_SSL_CERTPROBLEM; - -- /* print the error number and error string */ -- infof(data, "NSS error %d (%s)\n", err, nss_error_to_name(err)); -+ /* print the error number and error string */ -+ infof(data, "NSS error %d (%s)\n", err, nss_error_to_name(err)); - -- /* print a human-readable message describing the error if available */ -- nss_print_error_message(data, err); -+ /* print a human-readable message describing the error if available */ -+ nss_print_error_message(data, err); -+ } - - if(model) - PR_Close(model); --- -1.7.1 - - -From b00ba010d0cd0a6ee77692fd4e38e6680b07a82e Mon Sep 17 00:00:00 2001 -From: Marc Hoersken <info@marc-hoersken.de> -Date: Tue, 11 Sep 2012 09:49:23 +0200 -Subject: [PATCH 2/2] nss.c: Fixed warning: 'err' may be used uninitialized in this function - -[upstream commit e6ba0487013085afc5bc1ca7d7c8a15a13367ba6] ---- - lib/nss.c | 2 +- - 1 files changed, 1 insertions(+), 1 deletions(-) - -diff --git a/lib/nss.c b/lib/nss.c -index a8e08f4..fef7c3d 100644 ---- a/lib/nss.c -+++ b/lib/nss.c -@@ -1173,7 +1173,7 @@ static CURLcode nss_load_ca_certificates(struct connectdata *conn, - - CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) - { -- PRInt32 err; -+ PRErrorCode err = 0; - PRFileDesc *model = NULL; - PRBool ssl2 = PR_FALSE; - PRBool ssl3 = PR_FALSE; --- -1.7.1 - diff --git a/0010-curl-7.27.0-57ccdfa8.patch b/0004-curl-7.29.0-57ccdfa8.patch index cc4be82..1448d64 100644 --- a/0010-curl-7.27.0-57ccdfa8.patch +++ b/0004-curl-7.29.0-57ccdfa8.patch @@ -1,7 +1,7 @@ -From fba5ed6d23b8fab97150da2b49a35236a8f4684c Mon Sep 17 00:00:00 2001 +From 37a515d9933a3160a8a868d5a697a42b28f6d792 Mon Sep 17 00:00:00 2001 From: Zdenek Pavlas <zpavlas@redhat.com> Date: Mon, 11 Mar 2013 14:57:07 +0100 -Subject: [PATCH] curl_global_init: accept the CURL_GLOBAL_ACK_EINTR flag +Subject: [PATCH 2/2] curl_global_init: accept the CURL_GLOBAL_ACK_EINTR flag The flag can be used in pycurl-based applications where using the multi interface would not be acceptable because of the performance lost caused @@ -11,16 +11,14 @@ Bug: http://curl.haxx.se/bug/view.cgi?id=1168 Downstream Bug: https://bugzilla.redhat.com/919127 [upstream commit 57ccdfa8d2bb6275388223f4676cd623ebd01697] - -Signed-off-by: Kamil Dudka <kdudka@redhat.com> --- docs/libcurl/curl_global_init.3 | 4 ++++ docs/libcurl/symbols-in-versions | 1 + include/curl/curl.h | 1 + - lib/easy.c | 6 +++++- + lib/easy.c | 2 ++ lib/select.c | 17 ++--------------- lib/select.h | 6 ++++++ - 6 files changed, 19 insertions(+), 16 deletions(-) + 6 files changed, 16 insertions(+), 15 deletions(-) diff --git a/docs/libcurl/curl_global_init.3 b/docs/libcurl/curl_global_init.3 index d91e1bd..6a08383 100644 @@ -38,10 +36,10 @@ index d91e1bd..6a08383 100644 If this function returns non-zero, something went wrong and you cannot use the other curl functions. diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions -index 41705fd..c528208 100644 +index 1de1ace..37b5e27 100644 --- a/docs/libcurl/symbols-in-versions +++ b/docs/libcurl/symbols-in-versions -@@ -612,6 +612,7 @@ CURL_GLOBAL_DEFAULT 7.8 +@@ -614,6 +614,7 @@ CURL_GLOBAL_DEFAULT 7.8 CURL_GLOBAL_NOTHING 7.8 CURL_GLOBAL_SSL 7.8 CURL_GLOBAL_WIN32 7.8.1 @@ -50,10 +48,10 @@ index 41705fd..c528208 100644 CURL_HTTP_VERSION_1_1 7.9.1 CURL_HTTP_VERSION_NONE 7.9.1 diff --git a/include/curl/curl.h b/include/curl/curl.h -index 2cad282..63e7056 100644 +index 5b39a24..80e4cf5 100644 --- a/include/curl/curl.h +++ b/include/curl/curl.h -@@ -2022,6 +2022,7 @@ typedef enum { +@@ -2023,6 +2023,7 @@ typedef enum { #define CURL_GLOBAL_ALL (CURL_GLOBAL_SSL|CURL_GLOBAL_WIN32) #define CURL_GLOBAL_NOTHING 0 #define CURL_GLOBAL_DEFAULT CURL_GLOBAL_ALL @@ -62,10 +60,10 @@ index 2cad282..63e7056 100644 /***************************************************************************** diff --git a/lib/easy.c b/lib/easy.c -index 6e8ff77..88f4a60 100644 +index 2e747bb..2739598 100644 --- a/lib/easy.c +++ b/lib/easy.c -@@ -267,6 +267,8 @@ CURLcode curl_global_init(long flags) +@@ -262,6 +262,8 @@ CURLcode curl_global_init(long flags) } #endif @@ -74,21 +72,8 @@ index 6e8ff77..88f4a60 100644 init_flags = flags; /* Preset pseudo-random number sequence. */ -@@ -459,9 +461,11 @@ CURLcode curl_easy_perform(CURL *easy) - select. This whole alternative version should probably rather use the - curl_multi_socket() approach. */ - -- if(rc == -1) -+ if(rc == -1) { - /* select error */ -+ code = CURLE_RECV_ERROR; - break; -+ } - - /* timeout or data to send/receive => loop! */ - } while(still_running); diff --git a/lib/select.c b/lib/select.c -index 40673ec..bb8b773 100644 +index d13e122..db7fb6d 100644 --- a/lib/select.c +++ b/lib/select.c @@ -50,11 +50,8 @@ @@ -126,7 +111,7 @@ index 40673ec..bb8b773 100644 * * Return values: * -1 = system call error or fd >= FD_SETSIZE -@@ -347,9 +337,6 @@ int Curl_socket_check(curl_socket_t readfd0, /* two sockets to read from */ +@@ -351,9 +341,6 @@ int Curl_socket_check(curl_socket_t readfd0, /* two sockets to read from */ * A negative timeout value makes this function wait indefinitely, * unles no valid file descriptor is given, when this happens the * negative timeout is ignored and the function times out immediately. @@ -137,10 +122,10 @@ index 40673ec..bb8b773 100644 * Return values: * -1 = system call error or fd >= FD_SETSIZE diff --git a/lib/select.h b/lib/select.h -index b50604b..4f0e464 100644 +index 00789bb..c00afe1 100644 --- a/lib/select.h +++ b/lib/select.h -@@ -99,6 +99,12 @@ int Curl_socket_check(curl_socket_t readfd, curl_socket_t readfd2, +@@ -81,6 +81,12 @@ int Curl_socket_check(curl_socket_t readfd, curl_socket_t readfd2, int Curl_poll(struct pollfd ufds[], unsigned int nfds, int timeout_ms); diff --git a/0005-curl-7.27.0-f208bf5a.patch b/0005-curl-7.27.0-f208bf5a.patch deleted file mode 100644 index c164fd0..0000000 --- a/0005-curl-7.27.0-f208bf5a.patch +++ /dev/null @@ -1,190 +0,0 @@ -From c78462408b8033c99cb45e70f34586ceb8fa8276 Mon Sep 17 00:00:00 2001 -From: Kamil Dudka <kdudka@redhat.com> -Date: Thu, 9 Aug 2012 14:08:11 +0200 -Subject: [PATCH] docs: update the links to cipher-suites supported by NSS - -... and make the list of cipher-suites in nss.c readable by humans. - -Bug: http://curl.haxx.se/mail/archive-2012-08/0016.html - -[upstream commit f208bf5a2d622ae525690dfba2ab58abd8d72264] ---- - docs/curl.1 | 2 +- - docs/libcurl/curl_easy_setopt.3 | 2 +- - lib/nss.c | 105 +++++++++++++++++++-------------------- - 3 files changed, 53 insertions(+), 56 deletions(-) - -diff --git a/docs/curl.1 b/docs/curl.1 -index 0e29ed5..5ba3d56 100644 ---- a/docs/curl.1 -+++ b/docs/curl.1 -@@ -223,7 +223,7 @@ must specify valid ciphers. Read up on SSL cipher list details on this URL: - - NSS ciphers are done differently than OpenSSL and GnuTLS. The full list of - NSS ciphers is in the NSSCipherSuite entry at this URL: --\fIhttp://directory.fedora.redhat.com/docs/mod_nss.html#Directives\fP -+\fIhttp://git.fedorahosted.org/cgit/mod_nss.git/plain/docs/mod_nss.html#Directives\fP - - If this option is used several times, the last one will override the others. - .IP "--compressed" -diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3 -index 25a7d5e..d83afe8 100644 ---- a/docs/libcurl/curl_easy_setopt.3 -+++ b/docs/libcurl/curl_easy_setopt.3 -@@ -2367,7 +2367,7 @@ this option then all known ciphers are disabled and only those passed in - are enabled. - - You'll find more details about the NSS cipher lists on this URL: --\fIhttp://directory.fedora.redhat.com/docs/mod_nss.html#Directives\fP -+\fIhttp://git.fedorahosted.org/cgit/mod_nss.git/plain/docs/mod_nss.html#Directives\fP - - .IP CURLOPT_SSL_SESSIONID_CACHE - Pass a long set to 0 to disable libcurl's use of SSL session-ID caching. Set -diff --git a/lib/nss.c b/lib/nss.c -index fef7c3d..705a625 100644 ---- a/lib/nss.c -+++ b/lib/nss.c -@@ -89,7 +89,6 @@ volatile int initialized = 0; - typedef struct { - const char *name; - int num; -- PRInt32 version; /* protocol version valid for this cipher */ - } cipher_s; - - #define PK11_SETATTRS(_attr, _idx, _type, _val, _len) do { \ -@@ -101,65 +100,63 @@ typedef struct { - - #define CERT_NewTempCertificate __CERT_NewTempCertificate - --enum sslversion { SSL2 = 1, SSL3 = 2, TLS = 4 }; -- - #define NUM_OF_CIPHERS sizeof(cipherlist)/sizeof(cipherlist[0]) - static const cipher_s cipherlist[] = { - /* SSL2 cipher suites */ -- {"rc4", SSL_EN_RC4_128_WITH_MD5, SSL2}, -- {"rc4-md5", SSL_EN_RC4_128_WITH_MD5, SSL2}, -- {"rc4export", SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL2}, -- {"rc2", SSL_EN_RC2_128_CBC_WITH_MD5, SSL2}, -- {"rc2export", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL2}, -- {"des", SSL_EN_DES_64_CBC_WITH_MD5, SSL2}, -- {"desede3", SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL2}, -+ {"rc4", SSL_EN_RC4_128_WITH_MD5}, -+ {"rc4-md5", SSL_EN_RC4_128_WITH_MD5}, -+ {"rc4export", SSL_EN_RC4_128_EXPORT40_WITH_MD5}, -+ {"rc2", SSL_EN_RC2_128_CBC_WITH_MD5}, -+ {"rc2export", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5}, -+ {"des", SSL_EN_DES_64_CBC_WITH_MD5}, -+ {"desede3", SSL_EN_DES_192_EDE3_CBC_WITH_MD5}, - /* SSL3/TLS cipher suites */ -- {"rsa_rc4_128_md5", SSL_RSA_WITH_RC4_128_MD5, SSL3 | TLS}, -- {"rsa_rc4_128_sha", SSL_RSA_WITH_RC4_128_SHA, SSL3 | TLS}, -- {"rsa_3des_sha", SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL3 | TLS}, -- {"rsa_des_sha", SSL_RSA_WITH_DES_CBC_SHA, SSL3 | TLS}, -- {"rsa_rc4_40_md5", SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL3 | TLS}, -- {"rsa_rc2_40_md5", SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL3 | TLS}, -- {"rsa_null_md5", SSL_RSA_WITH_NULL_MD5, SSL3 | TLS}, -- {"rsa_null_sha", SSL_RSA_WITH_NULL_SHA, SSL3 | TLS}, -- {"fips_3des_sha", SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, SSL3 | TLS}, -- {"fips_des_sha", SSL_RSA_FIPS_WITH_DES_CBC_SHA, SSL3 | TLS}, -- {"fortezza", SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA, SSL3 | TLS}, -- {"fortezza_rc4_128_sha", SSL_FORTEZZA_DMS_WITH_RC4_128_SHA, SSL3 | TLS}, -- {"fortezza_null", SSL_FORTEZZA_DMS_WITH_NULL_SHA, SSL3 | TLS}, -+ {"rsa_rc4_128_md5", SSL_RSA_WITH_RC4_128_MD5}, -+ {"rsa_rc4_128_sha", SSL_RSA_WITH_RC4_128_SHA}, -+ {"rsa_3des_sha", SSL_RSA_WITH_3DES_EDE_CBC_SHA}, -+ {"rsa_des_sha", SSL_RSA_WITH_DES_CBC_SHA}, -+ {"rsa_rc4_40_md5", SSL_RSA_EXPORT_WITH_RC4_40_MD5}, -+ {"rsa_rc2_40_md5", SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5}, -+ {"rsa_null_md5", SSL_RSA_WITH_NULL_MD5}, -+ {"rsa_null_sha", SSL_RSA_WITH_NULL_SHA}, -+ {"fips_3des_sha", SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA}, -+ {"fips_des_sha", SSL_RSA_FIPS_WITH_DES_CBC_SHA}, -+ {"fortezza", SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA}, -+ {"fortezza_rc4_128_sha", SSL_FORTEZZA_DMS_WITH_RC4_128_SHA}, -+ {"fortezza_null", SSL_FORTEZZA_DMS_WITH_NULL_SHA}, - /* TLS 1.0: Exportable 56-bit Cipher Suites. */ -- {"rsa_des_56_sha", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL3 | TLS}, -- {"rsa_rc4_56_sha", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL3 | TLS}, -+ {"rsa_des_56_sha", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA}, -+ {"rsa_rc4_56_sha", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA}, - /* AES ciphers. */ -- {"rsa_aes_128_sha", TLS_RSA_WITH_AES_128_CBC_SHA, SSL3 | TLS}, -- {"rsa_aes_256_sha", TLS_RSA_WITH_AES_256_CBC_SHA, SSL3 | TLS}, -+ {"rsa_aes_128_sha", TLS_RSA_WITH_AES_128_CBC_SHA}, -+ {"rsa_aes_256_sha", TLS_RSA_WITH_AES_256_CBC_SHA}, - #ifdef NSS_ENABLE_ECC - /* ECC ciphers. */ -- {"ecdh_ecdsa_null_sha", TLS_ECDH_ECDSA_WITH_NULL_SHA, TLS}, -- {"ecdh_ecdsa_rc4_128_sha", TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS}, -- {"ecdh_ecdsa_3des_sha", TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS}, -- {"ecdh_ecdsa_aes_128_sha", TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS}, -- {"ecdh_ecdsa_aes_256_sha", TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS}, -- {"ecdhe_ecdsa_null_sha", TLS_ECDHE_ECDSA_WITH_NULL_SHA, TLS}, -- {"ecdhe_ecdsa_rc4_128_sha", TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS}, -- {"ecdhe_ecdsa_3des_sha", TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS}, -- {"ecdhe_ecdsa_aes_128_sha", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS}, -- {"ecdhe_ecdsa_aes_256_sha", TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS}, -- {"ecdh_rsa_null_sha", TLS_ECDH_RSA_WITH_NULL_SHA, TLS}, -- {"ecdh_rsa_128_sha", TLS_ECDH_RSA_WITH_RC4_128_SHA, TLS}, -- {"ecdh_rsa_3des_sha", TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, TLS}, -- {"ecdh_rsa_aes_128_sha", TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS}, -- {"ecdh_rsa_aes_256_sha", TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS}, -- {"echde_rsa_null", TLS_ECDHE_RSA_WITH_NULL_SHA, TLS}, -- {"ecdhe_rsa_rc4_128_sha", TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS}, -- {"ecdhe_rsa_3des_sha", TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS}, -- {"ecdhe_rsa_aes_128_sha", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS}, -- {"ecdhe_rsa_aes_256_sha", TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS}, -- {"ecdh_anon_null_sha", TLS_ECDH_anon_WITH_NULL_SHA, TLS}, -- {"ecdh_anon_rc4_128sha", TLS_ECDH_anon_WITH_RC4_128_SHA, TLS}, -- {"ecdh_anon_3des_sha", TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA, TLS}, -- {"ecdh_anon_aes_128_sha", TLS_ECDH_anon_WITH_AES_128_CBC_SHA, TLS}, -- {"ecdh_anon_aes_256_sha", TLS_ECDH_anon_WITH_AES_256_CBC_SHA, TLS}, -+ {"ecdh_ecdsa_null_sha", TLS_ECDH_ECDSA_WITH_NULL_SHA}, -+ {"ecdh_ecdsa_rc4_128_sha", TLS_ECDH_ECDSA_WITH_RC4_128_SHA}, -+ {"ecdh_ecdsa_3des_sha", TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA}, -+ {"ecdh_ecdsa_aes_128_sha", TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA}, -+ {"ecdh_ecdsa_aes_256_sha", TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA}, -+ {"ecdhe_ecdsa_null_sha", TLS_ECDHE_ECDSA_WITH_NULL_SHA}, -+ {"ecdhe_ecdsa_rc4_128_sha", TLS_ECDHE_ECDSA_WITH_RC4_128_SHA}, -+ {"ecdhe_ecdsa_3des_sha", TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA}, -+ {"ecdhe_ecdsa_aes_128_sha", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA}, -+ {"ecdhe_ecdsa_aes_256_sha", TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA}, -+ {"ecdh_rsa_null_sha", TLS_ECDH_RSA_WITH_NULL_SHA}, -+ {"ecdh_rsa_128_sha", TLS_ECDH_RSA_WITH_RC4_128_SHA}, -+ {"ecdh_rsa_3des_sha", TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA}, -+ {"ecdh_rsa_aes_128_sha", TLS_ECDH_RSA_WITH_AES_128_CBC_SHA}, -+ {"ecdh_rsa_aes_256_sha", TLS_ECDH_RSA_WITH_AES_256_CBC_SHA}, -+ {"echde_rsa_null", TLS_ECDHE_RSA_WITH_NULL_SHA}, -+ {"ecdhe_rsa_rc4_128_sha", TLS_ECDHE_RSA_WITH_RC4_128_SHA}, -+ {"ecdhe_rsa_3des_sha", TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA}, -+ {"ecdhe_rsa_aes_128_sha", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA}, -+ {"ecdhe_rsa_aes_256_sha", TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA}, -+ {"ecdh_anon_null_sha", TLS_ECDH_anon_WITH_NULL_SHA}, -+ {"ecdh_anon_rc4_128sha", TLS_ECDH_anon_WITH_RC4_128_SHA}, -+ {"ecdh_anon_3des_sha", TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA}, -+ {"ecdh_anon_aes_128_sha", TLS_ECDH_anon_WITH_AES_128_CBC_SHA}, -+ {"ecdh_anon_aes_256_sha", TLS_ECDH_anon_WITH_AES_256_CBC_SHA}, - #endif - }; - -@@ -248,7 +245,7 @@ static SECStatus set_ciphers(struct SessionHandle *data, PRFileDesc * model, - for(i=0; i<NUM_OF_CIPHERS; i++) { - rv = SSL_CipherPrefSet(model, cipherlist[i].num, cipher_state[i]); - if(rv != SECSuccess) { -- failf(data, "Unknown cipher in cipher list"); -+ failf(data, "cipher-suite not supported by NSS: %s", cipherlist[i].name); - return SECFailure; - } - } -@@ -1084,7 +1081,7 @@ int Curl_nss_close_all(struct SessionHandle *data) - return 0; - } - --/* return true if NSS can provide error code (and possibly msg) for the error */ -+/* true if NSS can provide error code (and possibly a message) for the error */ - static bool is_nss_error(CURLcode err) - { - switch(err) { --- -1.7.1 - diff --git a/0011-curl-7.27.0-2eb8dcf2.patch b/0005-curl-7.29.0-2eb8dcf2.patch index f77f104..d0fbbce 100644 --- a/0011-curl-7.27.0-2eb8dcf2.patch +++ b/0005-curl-7.29.0-2eb8dcf2.patch @@ -1,6 +1,6 @@ -From 5ceda5fa61a87015275ab94f99da4f92f49ac802 Mon Sep 17 00:00:00 2001 +From 0b7dd36575821bd6e4e86f7b51ac001e69abddf9 Mon Sep 17 00:00:00 2001 From: Kamil Dudka <kdudka@redhat.com> -Date: Fri, 12 Apr 2013 16:49:32 +0200 +Date: Fri, 12 Apr 2013 15:53:39 +0200 Subject: [PATCH 1/3] test1216: test tailmatching cookie domains This test is an attempt to repeat the problem YAMADA Yasuharu reported @@ -19,31 +19,31 @@ Signed-off-by: Kamil Dudka <kdudka@redhat.com> create mode 100644 tests/data/test1216 diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index 372f127..9321d61 100644 +index 9f569a3..d714e5d 100644 --- a/tests/data/Makefile.am +++ b/tests/data/Makefile.am -@@ -78,7 +78,7 @@ test1118 test1119 test1120 test1121 test1122 test1123 test1124 test1125 \ - test1126 test1127 test1128 test1129 test1130 test1131 \ +@@ -77,7 +77,7 @@ test1110 test1111 test1112 test1113 test1114 test1115 test1116 test1117 \ + test1118 test1119 test1120 test1121 test1122 test1123 test1124 test1125 \ + test1126 test1127 test1128 test1129 test1130 test1131 test1132 test1133 \ test1200 test1201 test1202 test1203 test1204 test1205 test1206 test1207 \ - test1208 test1209 test1210 test1211 \ --test1220 \ -+test1220 test1216 \ +-test1208 test1209 test1210 test1211 \ ++test1208 test1209 test1210 test1211 test1216 \ + test1220 test1221 test1222 test1223 \ test1300 test1301 test1302 test1303 test1304 test1305 \ test1306 test1307 test1308 test1309 test1310 test1311 test1312 test1313 \ - test1314 test1315 test1316 test1317 test1318 test1319 test1320 test1321 \ diff --git a/tests/data/Makefile.in b/tests/data/Makefile.in -index e0a554a..0c18cb5 100644 +index d5b0918..a070266 100644 --- a/tests/data/Makefile.in +++ b/tests/data/Makefile.in -@@ -343,7 +343,7 @@ test1118 test1119 test1120 test1121 test1122 test1123 test1124 test1125 \ - test1126 test1127 test1128 test1129 test1130 test1131 \ +@@ -341,7 +341,7 @@ test1110 test1111 test1112 test1113 test1114 test1115 test1116 test1117 \ + test1118 test1119 test1120 test1121 test1122 test1123 test1124 test1125 \ + test1126 test1127 test1128 test1129 test1130 test1131 test1132 test1133 \ test1200 test1201 test1202 test1203 test1204 test1205 test1206 test1207 \ - test1208 test1209 test1210 test1211 \ --test1220 \ -+test1220 test1216 \ +-test1208 test1209 test1210 test1211 \ ++test1208 test1209 test1210 test1211 test1216 \ + test1220 test1221 test1222 test1223 \ test1300 test1301 test1302 test1303 test1304 test1305 \ test1306 test1307 test1308 test1309 test1310 test1311 test1312 test1313 \ - test1314 test1315 test1316 test1317 test1318 test1319 test1320 test1321 \ diff --git a/tests/data/test1216 b/tests/data/test1216 new file mode 100644 index 0000000..e63fe92 @@ -116,7 +116,7 @@ index 0000000..e63fe92 1.7.1 -From 3cf21844356a152df3af92530bb607ef880588af Mon Sep 17 00:00:00 2001 +From 6c5a78d0407788b1092bbc8a19b68b01ccb75f8a Mon Sep 17 00:00:00 2001 From: YAMADA Yasuharu <yasuharu.yamada@access-company.com> Date: Thu, 11 Apr 2013 00:17:15 +0200 Subject: [PATCH 2/3] cookie: fix tailmatching to prevent cross-domain leakage @@ -134,7 +134,7 @@ Signed-off-by: Kamil Dudka <kdudka@redhat.com> 1 files changed, 19 insertions(+), 5 deletions(-) diff --git a/lib/cookie.c b/lib/cookie.c -index 644b33a..760a931 100644 +index 18b9155..d4fd78a 100644 --- a/lib/cookie.c +++ b/lib/cookie.c @@ -118,15 +118,29 @@ static void freecookie(struct Cookie *co) @@ -176,9 +176,9 @@ index 644b33a..760a931 100644 1.7.1 -From cb95277d4732d7e9a50df7cca2ce0aa8dc0aa5b9 Mon Sep 17 00:00:00 2001 +From 6284e78c9421911a24349621c5b63684823d12f7 Mon Sep 17 00:00:00 2001 From: Kamil Dudka <kdudka@redhat.com> -Date: Fri, 12 Apr 2013 16:50:11 +0200 +Date: Fri, 12 Apr 2013 15:55:57 +0200 Subject: [PATCH 3/3] test1218: another cookie tailmatch test These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie @@ -198,31 +198,31 @@ Signed-off-by: Kamil Dudka <kdudka@redhat.com> create mode 100644 tests/data/test1218 diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index 9321d61..c8295c3 100644 +index d714e5d..3e8dae0 100644 --- a/tests/data/Makefile.am +++ b/tests/data/Makefile.am -@@ -78,7 +78,7 @@ test1118 test1119 test1120 test1121 test1122 test1123 test1124 test1125 \ - test1126 test1127 test1128 test1129 test1130 test1131 \ +@@ -77,7 +77,7 @@ test1110 test1111 test1112 test1113 test1114 test1115 test1116 test1117 \ + test1118 test1119 test1120 test1121 test1122 test1123 test1124 test1125 \ + test1126 test1127 test1128 test1129 test1130 test1131 test1132 test1133 \ test1200 test1201 test1202 test1203 test1204 test1205 test1206 test1207 \ - test1208 test1209 test1210 test1211 \ --test1220 test1216 \ -+test1220 test1216 test1218 \ +-test1208 test1209 test1210 test1211 test1216 \ ++test1208 test1209 test1210 test1211 test1216 test1218 \ + test1220 test1221 test1222 test1223 \ test1300 test1301 test1302 test1303 test1304 test1305 \ test1306 test1307 test1308 test1309 test1310 test1311 test1312 test1313 \ - test1314 test1315 test1316 test1317 test1318 test1319 test1320 test1321 \ diff --git a/tests/data/Makefile.in b/tests/data/Makefile.in -index 0c18cb5..96678cd 100644 +index a070266..71c9422 100644 --- a/tests/data/Makefile.in +++ b/tests/data/Makefile.in -@@ -343,7 +343,7 @@ test1118 test1119 test1120 test1121 test1122 test1123 test1124 test1125 \ - test1126 test1127 test1128 test1129 test1130 test1131 \ +@@ -341,7 +341,7 @@ test1110 test1111 test1112 test1113 test1114 test1115 test1116 test1117 \ + test1118 test1119 test1120 test1121 test1122 test1123 test1124 test1125 \ + test1126 test1127 test1128 test1129 test1130 test1131 test1132 test1133 \ test1200 test1201 test1202 test1203 test1204 test1205 test1206 test1207 \ - test1208 test1209 test1210 test1211 \ --test1220 test1216 \ -+test1220 test1216 test1218 \ +-test1208 test1209 test1210 test1211 test1216 \ ++test1208 test1209 test1210 test1211 test1216 test1218 \ + test1220 test1221 test1222 test1223 \ test1300 test1301 test1302 test1303 test1304 test1305 \ test1306 test1307 test1308 test1309 test1310 test1311 test1312 test1313 \ - test1314 test1315 test1316 test1317 test1318 test1319 test1320 test1321 \ diff --git a/tests/data/test1218 b/tests/data/test1218 new file mode 100644 index 0000000..7d86547 diff --git a/0006-curl-7.27.0-68d2830e.patch b/0006-curl-7.27.0-68d2830e.patch deleted file mode 100644 index be8c558..0000000 --- a/0006-curl-7.27.0-68d2830e.patch +++ /dev/null @@ -1,68 +0,0 @@ -From c011938e10bf3af5896d0f7f5ecffc22150303f3 Mon Sep 17 00:00:00 2001 -From: Kamil Dudka <kdudka@redhat.com> -Date: Mon, 3 Dec 2012 13:17:50 +0100 -Subject: [PATCH 1/3] nss: prevent NSS from crashing on client auth hook failure - -Although it is not explicitly stated in the documentation, NSS uses -*pRetCert and *pRetKey even if the client authentication hook returns -a failure. Namely, if we destroy *pRetCert without clearing *pRetCert -afterwards, NSS destroys the certificate once again, which causes a -double free. - -Reported by: Bob Relyea - -[upstream commit 68d2830ee9df50961e481e81c1baaa290c33f03e] ---- - lib/nss.c | 17 +++++++++++------ - 1 files changed, 11 insertions(+), 6 deletions(-) - -diff --git a/lib/nss.c b/lib/nss.c -index 22b53bf..794eccb 100644 ---- a/lib/nss.c -+++ b/lib/nss.c -@@ -757,6 +757,8 @@ static SECStatus SelectClientCert(void *arg, PRFileDesc *sock, - static const char pem_slotname[] = "PEM Token #1"; - SECItem cert_der = { 0, NULL, 0 }; - void *proto_win = SSL_RevealPinArg(sock); -+ struct CERTCertificateStr *cert; -+ struct SECKEYPrivateKeyStr *key; - - PK11SlotInfo *slot = PK11_FindSlotByName(pem_slotname); - if(NULL == slot) { -@@ -771,24 +773,27 @@ static SECStatus SelectClientCert(void *arg, PRFileDesc *sock, - return SECFailure; - } - -- *pRetCert = PK11_FindCertFromDERCertItem(slot, &cert_der, proto_win); -+ cert = PK11_FindCertFromDERCertItem(slot, &cert_der, proto_win); - SECITEM_FreeItem(&cert_der, PR_FALSE); -- if(NULL == *pRetCert) { -+ if(NULL == cert) { - failf(data, "NSS: client certificate from file not found"); - PK11_FreeSlot(slot); - return SECFailure; - } - -- *pRetKey = PK11_FindPrivateKeyFromCert(slot, *pRetCert, NULL); -+ key = PK11_FindPrivateKeyFromCert(slot, cert, NULL); - PK11_FreeSlot(slot); -- if(NULL == *pRetKey) { -+ if(NULL == key) { - failf(data, "NSS: private key from file not found"); -- CERT_DestroyCertificate(*pRetCert); -+ CERT_DestroyCertificate(cert); - return SECFailure; - } - - infof(data, "NSS: client certificate from file\n"); -- display_cert_info(data, *pRetCert); -+ display_cert_info(data, cert); -+ -+ *pRetCert = cert; -+ *pRetKey = key; - return SECSuccess; - } - --- -1.7.1 - diff --git a/0012-curl-7.27.0-25e577b3.patch b/0006-curl-7.29.0-25e577b3.patch index 4b6ec7d..2b6a786 100644 --- a/0012-curl-7.27.0-25e577b3.patch +++ b/0006-curl-7.29.0-25e577b3.patch @@ -1,7 +1,7 @@ -From 461a96d26c08fcd27fc0ab2c94574461a85782bf Mon Sep 17 00:00:00 2001 +From 74d01a8e4d48eedc526cffaf6a6bc782b139e068 Mon Sep 17 00:00:00 2001 From: Kim Vandry <vandry@users.sf.net> Date: Mon, 18 Feb 2013 21:36:34 +0100 -Subject: [PATCH] Curl_resolver_is_resolved: show proper host name on failed resolve +Subject: [PATCH 1/2] Curl_resolver_is_resolved: show proper host name on failed resolve [upstream commit 25e577b33d00afb6630cf2cac98d6baa319e9aef] @@ -11,10 +11,10 @@ Signed-off-by: Kamil Dudka <kdudka@redhat.com> 1 files changed, 20 insertions(+), 15 deletions(-) diff --git a/lib/asyn-thread.c b/lib/asyn-thread.c -index b027144..5552810 100644 +index 7a8294d..c392b21 100644 --- a/lib/asyn-thread.c +++ b/lib/asyn-thread.c -@@ -436,8 +436,19 @@ static const char *gai_strerror(int ecode) +@@ -430,8 +430,19 @@ static const char *gai_strerror(int ecode) * error */ @@ -35,7 +35,7 @@ index b027144..5552810 100644 failf(conn->data, "Could not resolve %s: %s; %s", host_or_proxy, conn->async.hostname, #ifdef HAVE_GAI_STRERROR -@@ -448,6 +459,7 @@ static void resolver_error(struct connectdata *conn, const char *host_or_proxy) +@@ -442,6 +453,7 @@ static void resolver_error(struct connectdata *conn, const char *host_or_proxy) Curl_strerror(conn, conn->async.status) #endif ); @@ -43,7 +43,7 @@ index b027144..5552810 100644 } /* -@@ -479,17 +491,9 @@ CURLcode Curl_resolver_wait_resolv(struct connectdata *conn, +@@ -473,17 +485,9 @@ CURLcode Curl_resolver_wait_resolv(struct connectdata *conn, if(entry) *entry = conn->async.dns; @@ -64,7 +64,7 @@ index b027144..5552810 100644 destroy_async_data(&conn->async); -@@ -524,12 +528,13 @@ CURLcode Curl_resolver_is_resolved(struct connectdata *conn, +@@ -518,12 +522,13 @@ CURLcode Curl_resolver_is_resolved(struct connectdata *conn, if(done) { getaddrinfo_complete(conn); diff --git a/0007-curl-7.27.0-b36f1d26.patch b/0007-curl-7.27.0-b36f1d26.patch deleted file mode 100644 index c712da0..0000000 --- a/0007-curl-7.27.0-b36f1d26.patch +++ /dev/null @@ -1,55 +0,0 @@ -From fefd7cdcde39c56651f6e2c32be9cd79354ffdc4 Mon Sep 17 00:00:00 2001 -From: Kamil Dudka <kdudka@redhat.com> -Date: Fri, 11 Jan 2013 10:24:21 +0100 -Subject: [PATCH 2/3] nss: clear session cache if a client cert from file is used - -This commit fixes a regression introduced in 052a08ff. - -NSS caches certs/keys returned by the SSL_GetClientAuthDataHook callback -and if we connect second time to the same server, the cached cert/key -pair is used. If we use multiple client certificates for different -paths on the same server, we need to clear the session cache to force -NSS to call the hook again. The commit 052a08ff prevented the session -cache from being cleared if a client certificate from file was used. - -The condition is now fixed to cover both cases: consssl->client_nickname -is not NULL if a client certificate from the NSS database is used and -connssl->obj_clicert is not NULL if a client certificate from file is -used. - -Review by: Kai Engert - -[upstream commit b36f1d26f830453ebaa17238f9bd1e396f618720] ---- - lib/nss.c | 12 ++++++++---- - 1 files changed, 8 insertions(+), 4 deletions(-) - -diff --git a/lib/nss.c b/lib/nss.c -index 794eccb..f97090a 100644 ---- a/lib/nss.c -+++ b/lib/nss.c -@@ -1058,13 +1058,17 @@ void Curl_nss_close(struct connectdata *conn, int sockindex) - as closed to avoid double close */ - fake_sclose(conn->sock[sockindex]); - conn->sock[sockindex] = CURL_SOCKET_BAD; -+ -+ if((connssl->client_nickname != NULL) || (connssl->obj_clicert != NULL)) -+ /* A server might require different authentication based on the -+ * particular path being requested by the client. To support this -+ * scenario, we must ensure that a connection will never reuse the -+ * authentication data from a previous connection. */ -+ SSL_InvalidateSession(connssl->handle); -+ - if(connssl->client_nickname != NULL) { - free(connssl->client_nickname); - connssl->client_nickname = NULL; -- -- /* force NSS to ask again for a client cert when connecting -- * next time to the same server */ -- SSL_InvalidateSession(connssl->handle); - } - /* destroy all NSS objects in order to avoid failure of NSS shutdown */ - Curl_llist_destroy(connssl->obj_list, NULL); --- -1.7.1 - diff --git a/0013-curl-7.27.0-b37b5233.patch b/0007-curl-7.29.0-b37b5233.patch index 63c2779..0f6a0c1 100644 --- a/0013-curl-7.27.0-b37b5233.patch +++ b/0007-curl-7.29.0-b37b5233.patch @@ -1,7 +1,7 @@ -From a0d7db27c1cf8edbde1d468d655be942bcacb39c Mon Sep 17 00:00:00 2001 +From fd5664bc7322ebffb8d5532d17a743ace8a5449e Mon Sep 17 00:00:00 2001 From: Zdenek Pavlas <zpavlas@redhat.com> Date: Fri, 26 Apr 2013 14:56:38 +0200 -Subject: [PATCH] url: initialize speed-check data for file:// protocol +Subject: [PATCH 2/2] url: initialize speed-check data for file:// protocol ... in order to prevent an artificial timeout event based on stale speed-check data from a previous network transfer. This commit fixes @@ -17,10 +17,10 @@ Signed-off-by: Kamil Dudka <kdudka@redhat.com> 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/lib/url.c b/lib/url.c -index 87b8701..da53086 100644 +index 918ce58..b269027 100644 --- a/lib/url.c +++ b/lib/url.c -@@ -5058,6 +5058,9 @@ static CURLcode create_conn(struct SessionHandle *data, +@@ -4895,6 +4895,9 @@ static CURLcode create_conn(struct SessionHandle *data, -1, NULL); /* no upload */ } diff --git a/0008-curl-7.27.0-26613d78.patch b/0008-curl-7.27.0-26613d78.patch deleted file mode 100644 index 27e381c..0000000 --- a/0008-curl-7.27.0-26613d78.patch +++ /dev/null @@ -1,30 +0,0 @@ -From afd2d98b4a9c69fb47048122629fd4be1d40f906 Mon Sep 17 00:00:00 2001 -From: Kamil Dudka <kdudka@redhat.com> -Date: Tue, 15 Jan 2013 12:58:08 +0100 -Subject: [PATCH 3/3] nss: fix error messages for CURLE_SSL_{CACERT,CRL}_BADFILE - -Do not use the error messages from NSS for errors not occurring in NSS. - -[upstream commit 26613d781725e39b0f601301a65c64e146977d8f] ---- - lib/nss.c | 2 -- - 1 files changed, 0 insertions(+), 2 deletions(-) - -diff --git a/lib/nss.c b/lib/nss.c -index f97090a..c5dcf52 100644 ---- a/lib/nss.c -+++ b/lib/nss.c -@@ -1096,10 +1096,8 @@ static bool is_nss_error(CURLcode err) - switch(err) { - case CURLE_PEER_FAILED_VERIFICATION: - case CURLE_SSL_CACERT: -- case CURLE_SSL_CACERT_BADFILE: - case CURLE_SSL_CERTPROBLEM: - case CURLE_SSL_CONNECT_ERROR: -- case CURLE_SSL_CRL_BADFILE: - case CURLE_SSL_ISSUER_ERROR: - return true; - --- -1.7.1 - diff --git a/0015-curl-7.27.0-192c4f78.patch b/0008-curl-7.29.0-192c4f78.patch index 299f386..299f386 100644 --- a/0015-curl-7.27.0-192c4f78.patch +++ b/0008-curl-7.29.0-192c4f78.patch diff --git a/0009-curl-7.27.0-f206d6c0.patch b/0009-curl-7.27.0-f206d6c0.patch deleted file mode 100644 index f904907..0000000 --- a/0009-curl-7.27.0-f206d6c0.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 46890e837c3b27195e4b0285d221d900f2ad48cc Mon Sep 17 00:00:00 2001 -From: Eldar Zaitov <kyprizel@volema.com> -Date: Wed, 30 Jan 2013 23:22:27 +0100 -Subject: [PATCH] Curl_sasl_create_digest_md5_message: fix buffer overflow - -When negotiating SASL DIGEST-MD5 authentication, the function -Curl_sasl_create_digest_md5_message() uses the data provided from the -server without doing the proper length checks and that data is then -appended to a local fixed-size buffer on the stack. - -This vulnerability can be exploited by someone who is in control of a -server that a libcurl based program is accessing with POP3, SMTP or -IMAP. For applications that accept user provided URLs, it is also -thinkable that a malicious user would feed an application with a URL to -a server hosting code targetting this flaw. - -Bug: http://curl.haxx.se/docs/adv_20130206.html - -[upstream commit f206d6c055d1008f0edb6d5d5920f0f300b9983a] - -Signed-off-by: Kamil Dudka <kdudka@redhat.com> ---- - lib/curl_sasl.c | 23 ++++++----------------- - 1 files changed, 6 insertions(+), 17 deletions(-) - -diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c -index ccb54a8..e42b850 100644 ---- a/lib/curl_sasl.c -+++ b/lib/curl_sasl.c -@@ -345,9 +345,7 @@ CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data, - snprintf(&HA1_hex[2 * i], 3, "%02x", digest[i]); - - /* Prepare the URL string */ -- strcpy(uri, service); -- strcat(uri, "/"); -- strcat(uri, realm); -+ snprintf(uri, sizeof(uri), "%s/%s", service, realm); - - /* Calculate H(A2) */ - ctxt = Curl_MD5_init(Curl_DIGEST_MD5); -@@ -391,20 +389,11 @@ CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data, - for(i = 0; i < MD5_DIGEST_LEN; i++) - snprintf(&resp_hash_hex[2 * i], 3, "%02x", digest[i]); - -- strcpy(response, "username=\""); -- strcat(response, userp); -- strcat(response, "\",realm=\""); -- strcat(response, realm); -- strcat(response, "\",nonce=\""); -- strcat(response, nonce); -- strcat(response, "\",cnonce=\""); -- strcat(response, cnonce); -- strcat(response, "\",nc="); -- strcat(response, nonceCount); -- strcat(response, ",digest-uri=\""); -- strcat(response, uri); -- strcat(response, "\",response="); -- strcat(response, resp_hash_hex); -+ snprintf(response, sizeof(response), -+ "username=\"%s\",realm=\"%s\",nonce=\"%s\"," -+ "cnonce=\"%s\",nc=\"%s\",digest-uri=\"%s\",response=%s", -+ userp, realm, nonce, -+ cnonce, nonceCount, uri, resp_hash_hex); - - /* Base64 encode the reply */ - return Curl_base64_encode(data, response, 0, outptr, outlen); --- -1.7.1 - diff --git a/0009-curl-7.29.0-3a0e931f.patch b/0009-curl-7.29.0-3a0e931f.patch new file mode 100644 index 0000000..0849d9d --- /dev/null +++ b/0009-curl-7.29.0-3a0e931f.patch @@ -0,0 +1,101 @@ +From b49d54103a4f011998195263de850642fa21f705 Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Tue, 9 Jul 2013 14:59:01 +0200 +Subject: [PATCH 1/3] curl.1: document the --time-cond option in the man page + +[upstream commit 3a0e931fc715a80004958794a96b12cf90503f99] +--- + docs/curl.1 | 3 +++ + 1 files changed, 3 insertions(+), 0 deletions(-) + +diff --git a/docs/curl.1 b/docs/curl.1 +index 1aeeb46..4b12c3f 100644 +--- a/docs/curl.1 ++++ b/docs/curl.1 +@@ -1407,6 +1407,9 @@ default 512 bytes will be used. + If this option is used several times, the last one will be used. + + (Added in 7.20.0) ++.IP " -z, --time-cond TIME" ++Transfer based on a time condition. TIME may to be preceded by -, +, or =. ++See the corresponding sections 14.24, 14.28, and 14.29 of RFC 2068. + .IP "--tlsauthtype <authtype>" + Set TLS authentication type. Currently, the only supported option is "SRP", + for TLS-SRP (RFC 5054). If \fI--tlsuser\fP and \fI--tlspassword\fP are +-- +1.7.1 + + +From fdc89d82464d90560aa5da857374906338472ed6 Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Tue, 9 Jul 2013 14:59:01 +0200 +Subject: [PATCH 2/3] curl.1: document the --post303 option in the man page + +[upstream commit 39e85d99feede7cc573902e8ab6b3dd759022d9c] +--- + docs/curl.1 | 7 +++++++ + 1 files changed, 7 insertions(+), 0 deletions(-) + +diff --git a/docs/curl.1 b/docs/curl.1 +index 4b12c3f..5dd6579 100644 +--- a/docs/curl.1 ++++ b/docs/curl.1 +@@ -1038,6 +1038,13 @@ ubiquitous in web browsers, so curl does the conversion by default to maintain + consistency. However, a server may require a POST to remain a POST after such + a redirection. This option is meaningful only when using \fI-L, --location\fP + (Added in 7.19.1) ++.IP "--post303" ++(HTTP) Tells curl to respect RFC 2616/10.3.2 and not convert POST requests ++into GET requests when following a 303 redirection. The non-RFC behaviour is ++ubiquitous in web browsers, so curl does the conversion by default to maintain ++consistency. However, a server may require a POST to remain a POST after such ++a redirection. This option is meaningful only when using \fI-L, --location\fP ++(Added in 7.26.0) + .IP "--proto <protocols>" + Tells curl to use the listed protocols for its initial retrieval. Protocols + are evaluated left to right, are comma separated, and are each a protocol +-- +1.7.1 + + +From 31102c7190a0a009cf0c06b23f98880cb43d4f55 Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Tue, 9 Jul 2013 15:45:36 +0200 +Subject: [PATCH 3/3] Revert "curl.1: document the --time-cond option in the man page" + +This reverts commit 3a0e931fc715a80004958794a96b12cf90503f99 because +the documentation of --time-cond was duplicated by mistake. + +Reported by: Dave Reisner + +[upstream commit 45339625bc85b29225a2035a57eceda43206dd1e] +--- + docs/curl.1 | 5 +---- + 1 files changed, 1 insertions(+), 4 deletions(-) + +diff --git a/docs/curl.1 b/docs/curl.1 +index 5dd6579..b350865 100644 +--- a/docs/curl.1 ++++ b/docs/curl.1 +@@ -1414,9 +1414,6 @@ default 512 bytes will be used. + If this option is used several times, the last one will be used. + + (Added in 7.20.0) +-.IP " -z, --time-cond TIME" +-Transfer based on a time condition. TIME may to be preceded by -, +, or =. +-See the corresponding sections 14.24, 14.28, and 14.29 of RFC 2068. + .IP "--tlsauthtype <authtype>" + Set TLS authentication type. Currently, the only supported option is "SRP", + for TLS-SRP (RFC 5054). If \fI--tlsuser\fP and \fI--tlspassword\fP are +@@ -1699,7 +1696,7 @@ speed-time seconds it gets aborted. speed-time is set with \fI-y\fP and is 30 + if not set. + + If this option is used several times, the last one will be used. +-.IP "-z/--time-cond <date expression>|<file>" ++.IP "-z, --time-cond <date expression>|<file>" + (HTTP/FTP) Request a file that has been modified later than the given time and + date, or one that has been modified before that time. The <date expression> + can be all sorts of date strings or if it doesn't match any internal ones, it +-- +1.7.1 + diff --git a/0010-curl-7.29.0-7cc00d9a.patch b/0010-curl-7.29.0-7cc00d9a.patch new file mode 100644 index 0000000..fb44274 --- /dev/null +++ b/0010-curl-7.29.0-7cc00d9a.patch @@ -0,0 +1,395 @@ +From 3f411052825386a95d039435eb139a63859c3c73 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Mon, 5 Aug 2013 23:49:53 +0200 +Subject: [PATCH] FTP: when EPSV gets a 229 but fails to connect, retry with PASV + +This is a regression as this logic used to work. It isn't clear when it +broke, but I'm assuming in 7.28.0 when we went all-multi internally. + +This likely never worked with the multi interface. As the failed +connection is detected once the multi state has reached DO_MORE, the +Curl_do_more() function was now expanded somewhat so that the +ftp_do_more() function can request to go "back" to the previous state +when it makes another attempt - using PASV. + +Added test case 1233 to verify this fix. It has the little issue that it +assumes no service is listening/accepting connections on port 1... + +Reported-by: byte_bucket in the #curl IRC channel + +[upstream commit 7cc00d9a832c42a330888aa5c11a2abad1bd5ac0] + +Signed-off-by: Kamil Dudka <kdudka@redhat.com> +--- + lib/ftp.c | 64 ++++++++++++++++++++++++++++------------------- + lib/multi.c | 11 ++++++-- + lib/url.c | 10 ++++--- + lib/url.h | 4 +- + lib/urldata.h | 2 +- + tests/data/Makefile.am | 2 +- + tests/data/test1233 | 46 ++++++++++++++++++++++++++++++++++ + 7 files changed, 102 insertions(+), 37 deletions(-) + create mode 100644 tests/data/test1233 + +diff --git a/lib/ftp.c b/lib/ftp.c +index 469b887..4501116 100644 +--- a/lib/ftp.c ++++ b/lib/ftp.c +@@ -136,7 +136,7 @@ static CURLcode ftp_done(struct connectdata *conn, + CURLcode, bool premature); + static CURLcode ftp_connect(struct connectdata *conn, bool *done); + static CURLcode ftp_disconnect(struct connectdata *conn, bool dead_connection); +-static CURLcode ftp_do_more(struct connectdata *conn, bool *completed); ++static CURLcode ftp_do_more(struct connectdata *conn, int *completed); + static CURLcode ftp_multi_statemach(struct connectdata *conn, bool *done); + static int ftp_getsock(struct connectdata *conn, curl_socket_t *socks, + int numsocks); +@@ -1794,15 +1794,15 @@ static CURLcode ftp_state_quote(struct connectdata *conn, + static CURLcode ftp_epsv_disable(struct connectdata *conn) + { + CURLcode result = CURLE_OK; +- infof(conn->data, "got positive EPSV response, but can't connect. " +- "Disabling EPSV\n"); ++ infof(conn->data, "Failed EPSV attempt. Disabling EPSV\n"); + /* disable it for next transfer */ + conn->bits.ftp_use_epsv = FALSE; + conn->data->state.errorbuf = FALSE; /* allow error message to get + rewritten */ + PPSENDF(&conn->proto.ftpc.pp, "PASV", NULL); + conn->proto.ftpc.count1++; +- /* remain in the FTP_PASV state */ ++ /* remain in/go to the FTP_PASV state */ ++ state(conn, FTP_PASV); + return result; + } + +@@ -1931,15 +1931,7 @@ static CURLcode ftp_state_pasv_resp(struct connectdata *conn, + } + else if(ftpc->count1 == 0) { + /* EPSV failed, move on to PASV */ +- +- /* disable it for next transfer */ +- conn->bits.ftp_use_epsv = FALSE; +- infof(data, "disabling EPSV usage\n"); +- +- PPSENDF(&ftpc->pp, "PASV", NULL); +- ftpc->count1++; +- /* remain in the FTP_PASV state */ +- return result; ++ return ftp_epsv_disable(conn); + } + else { + failf(data, "Bad PASV/EPSV response: %03d", ftpcode); +@@ -2018,14 +2010,17 @@ static CURLcode ftp_state_pasv_resp(struct connectdata *conn, + case CURLPROXY_SOCKS5_HOSTNAME: + result = Curl_SOCKS5(conn->proxyuser, conn->proxypasswd, newhost, newport, + SECONDARYSOCKET, conn); ++ connected = TRUE; + break; + case CURLPROXY_SOCKS4: + result = Curl_SOCKS4(conn->proxyuser, newhost, newport, + SECONDARYSOCKET, conn, FALSE); ++ connected = TRUE; + break; + case CURLPROXY_SOCKS4A: + result = Curl_SOCKS4(conn->proxyuser, newhost, newport, + SECONDARYSOCKET, conn, TRUE); ++ connected = TRUE; + break; + case CURLPROXY_HTTP: + case CURLPROXY_HTTP_1_0: +@@ -2077,8 +2072,7 @@ static CURLcode ftp_state_pasv_resp(struct connectdata *conn, + } + } + +- conn->bits.tcpconnect[SECONDARYSOCKET] = TRUE; +- ++ conn->bits.tcpconnect[SECONDARYSOCKET] = connected; + conn->bits.do_more = TRUE; + state(conn, FTP_STOP); /* this phase is completed */ + +@@ -3664,20 +3658,23 @@ static CURLcode ftp_range(struct connectdata *conn) + * + * This function shall be called when the second FTP (data) connection is + * connected. ++ * ++ * 'complete' can return 0 for incomplete, 1 for done and -1 for go back ++ * (which basically is only for when PASV is being sent to retry a failed ++ * EPSV). + */ + +-static CURLcode ftp_do_more(struct connectdata *conn, bool *complete) ++static CURLcode ftp_do_more(struct connectdata *conn, int *completep) + { + struct SessionHandle *data=conn->data; + struct ftp_conn *ftpc = &conn->proto.ftpc; + CURLcode result = CURLE_OK; + bool connected = FALSE; ++ bool complete = FALSE; + + /* the ftp struct is inited in ftp_connect() */ + struct FTP *ftp = data->state.proto.ftp; + +- *complete = FALSE; +- + /* if the second connection isn't done yet, wait for it */ + if(!conn->bits.tcpconnect[SECONDARYSOCKET]) { + if(conn->tunnel_state[SECONDARYSOCKET] == TUNNEL_CONNECT) { +@@ -3694,14 +3691,22 @@ static CURLcode ftp_do_more(struct connectdata *conn, bool *complete) + if(connected) { + DEBUGF(infof(data, "DO-MORE connected phase starts\n")); + } +- else ++ else { ++ if(result && (ftpc->count1 == 0)) { ++ *completep = -1; /* go back to DOING please */ ++ /* this is a EPSV connect failing, try PASV instead */ ++ return ftp_epsv_disable(conn); ++ } + return result; ++ } + } + + if(ftpc->state) { + /* already in a state so skip the intial commands. + They are only done to kickstart the do_more state */ +- result = ftp_multi_statemach(conn, complete); ++ result = ftp_multi_statemach(conn, &complete); ++ ++ *completep = (int)complete; + + /* if we got an error or if we don't wait for a data connection return + immediately */ +@@ -3712,7 +3717,7 @@ static CURLcode ftp_do_more(struct connectdata *conn, bool *complete) + /* if we reach the end of the FTP state machine here, *complete will be + TRUE but so is ftpc->wait_data_conn, which says we need to wait for + the data connection and therefore we're not actually complete */ +- *complete = FALSE; ++ *completep = 0; + } + + if(ftp->transfer <= FTPTRANSFER_INFO) { +@@ -3735,6 +3740,9 @@ static CURLcode ftp_do_more(struct connectdata *conn, bool *complete) + + if(result) + return result; ++ ++ *completep = 1; /* this state is now complete when the server has ++ connected back to us */ + } + } + else if(data->set.upload) { +@@ -3742,7 +3750,8 @@ static CURLcode ftp_do_more(struct connectdata *conn, bool *complete) + if(result) + return result; + +- result = ftp_multi_statemach(conn, complete); ++ result = ftp_multi_statemach(conn, &complete); ++ *completep = (int)complete; + } + else { + /* download */ +@@ -3770,7 +3779,8 @@ static CURLcode ftp_do_more(struct connectdata *conn, bool *complete) + return result; + } + +- result = ftp_multi_statemach(conn, complete); ++ result = ftp_multi_statemach(conn, &complete); ++ *completep = (int)complete; + } + return result; + } +@@ -3782,7 +3792,7 @@ static CURLcode ftp_do_more(struct connectdata *conn, bool *complete) + + if(!ftpc->wait_data_conn) { + /* no waiting for the data connection so this is now complete */ +- *complete = TRUE; ++ *completep = 1; + DEBUGF(infof(data, "DO-MORE phase ends with %d\n", (int)result)); + } + +@@ -3825,7 +3835,9 @@ CURLcode ftp_perform(struct connectdata *conn, + /* run the state-machine */ + result = ftp_multi_statemach(conn, dophase_done); + +- *connected = conn->bits.tcpconnect[FIRSTSOCKET]; ++ *connected = conn->bits.tcpconnect[SECONDARYSOCKET]; ++ ++ infof(conn->data, "ftp_perform ends with SECONDARY: %d\n", *connected); + + if(*dophase_done) + DEBUGF(infof(conn->data, "DO phase is complete1\n")); +@@ -4445,7 +4457,7 @@ static CURLcode ftp_dophase_done(struct connectdata *conn, + struct ftp_conn *ftpc = &conn->proto.ftpc; + + if(connected) { +- bool completed; ++ int completed; + CURLcode result = ftp_do_more(conn, &completed); + + if(result) { +diff --git a/lib/multi.c b/lib/multi.c +index 706df23..9a8e68e 100644 +--- a/lib/multi.c ++++ b/lib/multi.c +@@ -906,6 +906,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi, + struct SingleRequest *k; + struct SessionHandle *data; + long timeout_ms; ++ int control; + + if(!GOOD_EASY_HANDLE(easy->easy_handle)) + return CURLM_BAD_EASY_HANDLE; +@@ -1323,13 +1324,17 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi, + /* + * When we are connected, DO MORE and then go DO_DONE + */ +- easy->result = Curl_do_more(easy->easy_conn, &dophase_done); ++ easy->result = Curl_do_more(easy->easy_conn, &control); + + /* No need to remove this handle from the send pipeline here since that + is done in Curl_done() */ + if(CURLE_OK == easy->result) { +- if(dophase_done) { +- multistate(easy, CURLM_STATE_DO_DONE); ++ if(control) { ++ /* if positive, advance to DO_DONE ++ if negative, go back to DOING */ ++ multistate(easy, control==1? ++ CURLM_STATE_DO_DONE: ++ CURLM_STATE_DOING); + result = CURLM_CALL_MULTI_PERFORM; + } + else +diff --git a/lib/url.c b/lib/url.c +index b269027..52f7e27 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -5394,18 +5394,20 @@ CURLcode Curl_do(struct connectdata **connp, bool *done) + * + * TODO: A future libcurl should be able to work away this state. + * ++ * 'complete' can return 0 for incomplete, 1 for done and -1 for go back to ++ * DOING state there's more work to do! + */ + +-CURLcode Curl_do_more(struct connectdata *conn, bool *completed) ++CURLcode Curl_do_more(struct connectdata *conn, int *complete) + { + CURLcode result=CURLE_OK; + +- *completed = FALSE; ++ *complete = 0; + + if(conn->handler->do_more) +- result = conn->handler->do_more(conn, completed); ++ result = conn->handler->do_more(conn, complete); + +- if(!result && *completed) ++ if(!result && (*complete == 1)) + /* do_complete must be called after the protocol-specific DO function */ + do_complete(conn); + +diff --git a/lib/url.h b/lib/url.h +index a026e90..c0d9c38 100644 +--- a/lib/url.h ++++ b/lib/url.h +@@ -7,7 +7,7 @@ + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * +- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al. ++ * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms +@@ -37,7 +37,7 @@ CURLcode Curl_close(struct SessionHandle *data); /* opposite of curl_open() */ + CURLcode Curl_connect(struct SessionHandle *, struct connectdata **, + bool *async, bool *protocol_connect); + CURLcode Curl_do(struct connectdata **, bool *done); +-CURLcode Curl_do_more(struct connectdata *, bool *completed); ++CURLcode Curl_do_more(struct connectdata *, int *completed); + CURLcode Curl_done(struct connectdata **, CURLcode, bool premature); + CURLcode Curl_disconnect(struct connectdata *, bool dead_connection); + CURLcode Curl_protocol_connect(struct connectdata *conn, bool *done); +diff --git a/lib/urldata.h b/lib/urldata.h +index 7a275da..2be467b 100644 +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -550,7 +550,7 @@ struct Curl_async { + /* These function pointer types are here only to allow easier typecasting + within the source when we need to cast between data pointers (such as NULL) + and function pointers. */ +-typedef CURLcode (*Curl_do_more_func)(struct connectdata *, bool *); ++typedef CURLcode (*Curl_do_more_func)(struct connectdata *, int *); + typedef CURLcode (*Curl_done_func)(struct connectdata *, CURLcode, bool); + + +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index 3e8dae0..3f6a047 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -78,7 +78,7 @@ test1118 test1119 test1120 test1121 test1122 test1123 test1124 test1125 \ + test1126 test1127 test1128 test1129 test1130 test1131 test1132 test1133 \ + test1200 test1201 test1202 test1203 test1204 test1205 test1206 test1207 \ + test1208 test1209 test1210 test1211 test1216 test1218 \ +-test1220 test1221 test1222 test1223 \ ++test1220 test1221 test1222 test1223 test1233 \ + test1300 test1301 test1302 test1303 test1304 test1305 \ + test1306 test1307 test1308 test1309 test1310 test1311 test1312 test1313 \ + test1314 test1315 test1316 test1317 test1318 test1319 test1320 test1321 \ +diff --git a/tests/data/test1233 b/tests/data/test1233 +new file mode 100644 +index 0000000..caf0527 +--- /dev/null ++++ b/tests/data/test1233 +@@ -0,0 +1,46 @@ ++<testcase> ++<info> ++<keywords> ++FTP ++</keywords> ++</info> ++ ++# Server-side ++<reply> ++<servercmd> ++# Assuming there's nothing listening on port 1 ++REPLY EPSV 229 Entering Passiv Mode (|||1|) ++</servercmd> ++<data> ++here are some bytes ++</data> ++</reply> ++ ++# Client-side ++<client> ++<server> ++ftp ++</server> ++ <name> ++FTP failing to connect to EPSV port, switching to PASV ++ </name> ++ <command> ++ftp://%HOSTIP:%FTPPORT/1233 ++</command> ++</client> ++ ++# Verify data after the test has been "shot" ++<verify> ++<protocol> ++USER anonymous
++PASS ftp@example.com
++PWD
++EPSV
++PASV
++TYPE I
++SIZE 1233
++RETR 1233
++QUIT
++</protocol> ++</verify> ++</testcase> +-- +1.7.1 + diff --git a/0011-curl-7.29.0-0feeab78.patch b/0011-curl-7.29.0-0feeab78.patch new file mode 100644 index 0000000..bd6b8b3 --- /dev/null +++ b/0011-curl-7.29.0-0feeab78.patch @@ -0,0 +1,74 @@ +From d3036f34cce421990e8268ee4bbfc0d9f5ceb054 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Thu, 13 Jun 2013 19:27:12 +0200 +Subject: [PATCH] curl_easy_perform: avoid busy-looping + +When curl_multi_wait() finds no file descriptor to wait for, it returns +instantly and this must be handled gracefully within curl_easy_perform() +or cause a busy-loop. Starting now, repeated fast returns without any +file descriptors is detected and a gradually increasing sleep will be +used (up to a max of 1000 milliseconds) before continuing the loop. + +Bug: http://curl.haxx.se/bug/view.cgi?id=1238 +Reported-by: Miguel Angel + +[upstream commit 0feeab7802dd2a6465d22d153d8d36b2cca99b96] + +Signed-off-by: Kamil Dudka <kdudka@redhat.com> +--- + lib/easy.c | 25 +++++++++++++++++++++++++ + 1 files changed, 25 insertions(+), 0 deletions(-) + +diff --git a/lib/easy.c b/lib/easy.c +index 2739598..a7051dd 100644 +--- a/lib/easy.c ++++ b/lib/easy.c +@@ -410,6 +410,9 @@ CURLcode curl_easy_perform(CURL *easy) + bool done = FALSE; + int rc; + struct SessionHandle *data = easy; ++ int without_fds = 0; /* count number of consecutive returns from ++ curl_multi_wait() without any filedescriptors */ ++ struct timeval before; + + if(!easy) + return CURLE_BAD_FUNCTION_ARGUMENT; +@@ -445,6 +448,7 @@ CURLcode curl_easy_perform(CURL *easy) + int still_running; + int ret; + ++ before = curlx_tvnow(); + mcode = curl_multi_wait(multi, NULL, 0, 1000, &ret); + + if(mcode == CURLM_OK) { +@@ -453,6 +457,27 @@ CURLcode curl_easy_perform(CURL *easy) + code = CURLE_RECV_ERROR; + break; + } ++ else if(ret == 0) { ++ struct timeval after = curlx_tvnow(); ++ /* If it returns without any filedescriptor instantly, we need to ++ avoid busy-looping during periods where it has nothing particular ++ to wait for */ ++ if(curlx_tvdiff(after, before) <= 10) { ++ without_fds++; ++ if(without_fds > 2) { ++ int sleep_ms = without_fds * 50; ++ if(sleep_ms > 1000) ++ sleep_ms = 1000; ++ Curl_wait_ms(sleep_ms); ++ } ++ } ++ else ++ /* it wasn't "instant", restart counter */ ++ without_fds = 0; ++ } ++ else ++ /* got file descriptor, restart counter */ ++ without_fds = 0; + + mcode = curl_multi_perform(multi, &still_running); + } +-- +1.7.1 + diff --git a/0012-curl-7.29.0-c639d725.patch b/0012-curl-7.29.0-c639d725.patch new file mode 100644 index 0000000..16d1eac --- /dev/null +++ b/0012-curl-7.29.0-c639d725.patch @@ -0,0 +1,519 @@ +From 9b675516d5fb09a455d1f7b7aa98e253361bedf3 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Fri, 8 Feb 2013 13:48:56 +0100 +Subject: [PATCH 1/2] DONE: consider callback-aborted transfers premature + +This bug report properly identified that when doing SMTP and aborting +the transfer with a callback, it must be considered aborted prematurely +by the code to avoid QUIT etc to be attempted as that would cause a +hang. + +The new test case 1507 verifies this behavior. + +Reported by: Patricia Muscalu +Bug: http://curl.haxx.se/bug/view.cgi?id=1184 + +[upstream commit 72688317adcedb9508fd2189e6c6d3945e06a004] + +Signed-off-by: Kamil Dudka <kdudka@redhat.com> +--- + lib/url.c | 7 ++ + tests/data/Makefile.am | 3 +- + tests/data/Makefile.in | 3 +- + tests/data/test1507 | 51 +++++++++++++ + tests/libtest/Makefile.in | 82 +++++++++++++++++++++- + tests/libtest/Makefile.inc | 6 ++- + tests/libtest/lib1507.c | 167 ++++++++++++++++++++++++++++++++++++++++++++ + 7 files changed, 313 insertions(+), 6 deletions(-) + create mode 100644 tests/data/test1507 + create mode 100644 tests/libtest/lib1507.c + +diff --git a/lib/url.c b/lib/url.c +index 52f7e27..a6375a2 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -5222,6 +5222,13 @@ CURLcode Curl_done(struct connectdata **connp, + conn->dns_entry = NULL; + } + ++ if(status == CURLE_ABORTED_BY_CALLBACK) ++ /* When we're aborted due to a callback return code it basically have to ++ be counted as premature as there is trouble ahead if we don't. We have ++ many callbacks and protocols work differently, we could potentially do ++ this more fine-grained in the future. */ ++ premature = TRUE; ++ + /* this calls the protocol-specific function pointer previously set */ + if(conn->handler->done) + result = conn->handler->done(conn, status, premature); +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index 3f6a047..805955c 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -93,7 +93,8 @@ test1379 test1380 test1381 test1382 test1383 test1384 test1385 test1386 \ + test1387 test1388 test1389 test1390 test1391 test1392 test1393 \ + test1400 test1401 test1402 test1403 test1404 test1405 test1406 test1407 \ + test1408 test1409 test1410 test1411 test1412 test1413 \ +-test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1508 \ ++test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \ ++test1508 \ + test2000 test2001 test2002 test2003 test2004 test2005 test2006 test2007 \ + test2008 test2009 test2010 test2011 test2012 test2013 test2014 test2015 \ + test2016 test2017 test2018 test2019 test2020 test2021 test2022 \ +diff --git a/tests/data/Makefile.in b/tests/data/Makefile.in +index 71c9422..1e6d679 100644 +--- a/tests/data/Makefile.in ++++ b/tests/data/Makefile.in +@@ -357,7 +357,8 @@ test1379 test1380 test1381 test1382 test1383 test1384 test1385 test1386 \ + test1387 test1388 test1389 test1390 test1391 test1392 test1393 \ + test1400 test1401 test1402 test1403 test1404 test1405 test1406 test1407 \ + test1408 test1409 test1410 test1411 test1412 test1413 \ +-test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1508 \ ++test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \ ++test1508 \ + test2000 test2001 test2002 test2003 test2004 test2005 test2006 test2007 \ + test2008 test2009 test2010 test2011 test2012 test2013 test2014 test2015 \ + test2016 test2017 test2018 test2019 test2020 test2021 test2022 \ +diff --git a/tests/data/test1507 b/tests/data/test1507 +new file mode 100644 +index 0000000..b66e71d +--- /dev/null ++++ b/tests/data/test1507 +@@ -0,0 +1,51 @@ ++<testcase> ++<info> ++<keywords> ++SMTP ++multi ++</keywords> ++</info> ++ ++# ++# Server-side ++<reply> ++</reply> ++ ++# ++# Client-side ++<client> ++<server> ++smtp ++</server> ++<tool> ++lib1507 ++</tool> ++ ++# based on bug report #1184 ++ <name> ++SMTP with multi interface and CURLE_ABORTED_BY_CALLBACK ++ </name> ++<stdin> ++From: different ++To: another ++ ++body ++</stdin> ++ <command> ++smtp://%HOSTIP:%SMTPPORT/user ++</command> ++</client> ++ ++# ++# Verify data after the test has been "shot" ++<verify> ++<protocol> ++EHLO user
++MAIL FROM:<1507-realuser@example.com>
++RCPT TO:<1507-recipient@example.com>
++DATA
++</protocol> ++<upload> ++</upload> ++</verify> ++</testcase> +diff --git a/tests/libtest/Makefile.in b/tests/libtest/Makefile.in +index 7683c09..e6826c0 100644 +--- a/tests/libtest/Makefile.in ++++ b/tests/libtest/Makefile.in +@@ -85,7 +85,8 @@ noinst_PROGRAMS = chkhostname$(EXEEXT) libauthretry$(EXEEXT) \ + lib591$(EXEEXT) lib597$(EXEEXT) lib598$(EXEEXT) \ + lib599$(EXEEXT) lib1500$(EXEEXT) lib1501$(EXEEXT) \ + lib1502$(EXEEXT) lib1503$(EXEEXT) lib1504$(EXEEXT) \ +- lib1505$(EXEEXT) lib1506$(EXEEXT) lib1508$(EXEEXT) ++ lib1505$(EXEEXT) lib1506$(EXEEXT) lib1507$(EXEEXT) \ ++ lib1508$(EXEEXT) + subdir = tests/libtest + ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 + am__aclocal_m4_deps = $(top_srcdir)/m4/curl-compilers.m4 \ +@@ -173,6 +174,13 @@ am_lib1506_OBJECTS = lib1506-lib1506.$(OBJEXT) $(am__objects_18) \ + $(am__objects_19) $(am__objects_20) + lib1506_OBJECTS = $(am_lib1506_OBJECTS) + lib1506_DEPENDENCIES = $(am__DEPENDENCIES_1) ++am__objects_154 = lib1507-first.$(OBJEXT) ++am__objects_155 = lib1507-testutil.$(OBJEXT) ++am__objects_156 = lib1507-warnless.$(OBJEXT) ++am_lib1507_OBJECTS = lib1507-lib1507.$(OBJEXT) $(am__objects_154) \ ++ $(am__objects_155) $(am__objects_156) ++lib1507_OBJECTS = $(am_lib1507_OBJECTS) ++lib1507_DEPENDENCIES = $(am__DEPENDENCIES_1) + am__objects_151 = lib1508-first.$(OBJEXT) + am__objects_152 = lib1508-testutil.$(OBJEXT) + am__objects_153 = lib1508-warnless.$(OBJEXT) +@@ -639,7 +647,8 @@ LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ + SOURCES = $(libhostname_la_SOURCES) $(chkhostname_SOURCES) \ + $(lib1500_SOURCES) $(lib1501_SOURCES) $(lib1502_SOURCES) \ + $(lib1503_SOURCES) $(lib1504_SOURCES) $(lib1505_SOURCES) \ +- $(lib1506_SOURCES) $(lib1508_SOURCES) $(lib500_SOURCES) $(lib501_SOURCES) \ ++ $(lib1506_SOURCES) $(lib1507_SOURCES) $(lib1508_SOURCES) \ ++ $(lib500_SOURCES) $(lib501_SOURCES) \ + $(lib502_SOURCES) $(lib503_SOURCES) $(lib504_SOURCES) \ + $(lib505_SOURCES) $(lib506_SOURCES) $(lib507_SOURCES) \ + $(lib508_SOURCES) $(lib510_SOURCES) $(lib511_SOURCES) \ +@@ -669,7 +678,8 @@ SOURCES = $(libhostname_la_SOURCES) $(chkhostname_SOURCES) \ + DIST_SOURCES = $(libhostname_la_SOURCES) $(chkhostname_SOURCES) \ + $(lib1500_SOURCES) $(lib1501_SOURCES) $(lib1502_SOURCES) \ + $(lib1503_SOURCES) $(lib1504_SOURCES) $(lib1505_SOURCES) \ +- $(lib1506_SOURCES) $(lib1508_SOURCES) $(lib500_SOURCES) $(lib501_SOURCES) \ ++ $(lib1506_SOURCES) $(lib1507_SOURCES) $(lib1508_SOURCES) \ ++ $(lib500_SOURCES) $(lib501_SOURCES) \ + $(lib502_SOURCES) $(lib503_SOURCES) $(lib504_SOURCES) \ + $(lib505_SOURCES) $(lib506_SOURCES) $(lib507_SOURCES) \ + $(lib508_SOURCES) $(lib510_SOURCES) $(lib511_SOURCES) \ +@@ -1162,6 +1172,9 @@ lib1505_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1505 + lib1506_SOURCES = lib1506.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib1506_LDADD = $(TESTUTIL_LIBS) + lib1506_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1506 ++lib1507_SOURCES = lib1507.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) ++lib1507_LDADD = $(TESTUTIL_LIBS) ++lib1507_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1507 + lib1508_SOURCES = lib1508.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib1508_LDADD = $(TESTUTIL_LIBS) + lib1508_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1508 +@@ -1263,6 +1276,9 @@ lib1505$(EXEEXT): $(lib1505_OBJECTS) $(lib1505_DEPENDENCIES) $(EXTRA_lib1505_DEP + lib1506$(EXEEXT): $(lib1506_OBJECTS) $(lib1506_DEPENDENCIES) $(EXTRA_lib1506_DEPENDENCIES) + @rm -f lib1506$(EXEEXT) + $(LINK) $(lib1506_OBJECTS) $(lib1506_LDADD) $(LIBS) ++lib1507$(EXEEXT): $(lib1507_OBJECTS) $(lib1507_DEPENDENCIES) $(EXTRA_lib1507_DEPENDENCIES) ++ @rm -f lib1507$(EXEEXT) ++ $(LINK) $(lib1507_OBJECTS) $(lib1507_LDADD) $(LIBS) + lib1508$(EXEEXT): $(lib1508_OBJECTS) $(lib1508_DEPENDENCIES) $(EXTRA_lib1508_DEPENDENCIES) + @rm -f lib1508$(EXEEXT) + $(LINK) $(lib1508_OBJECTS) $(lib1508_LDADD) $(LIBS) +@@ -1533,6 +1549,10 @@ distclean-compile: + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1506-lib1506.Po@am__quote@ + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1506-testutil.Po@am__quote@ + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1506-warnless.Po@am__quote@ ++@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1507-first.Po@am__quote@ ++@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1507-lib1507.Po@am__quote@ ++@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1507-testutil.Po@am__quote@ ++@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1507-warnless.Po@am__quote@ + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1508-first.Po@am__quote@ + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1508-lib1508.Po@am__quote@ + @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lib1508-testutil.Po@am__quote@ +@@ -2180,6 +2200,62 @@ lib1506-warnless.obj: ../../lib/warnless.c + @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ + @am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1506_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1506-warnless.obj `if test -f '../../lib/warnless.c'; then $(CYGPATH_W) '../../lib/warnless.c'; else $(CYGPATH_W) '$(srcdir)/../../lib/warnless.c'; fi` + ++lib1507-lib1507.o: lib1507.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1507-lib1507.o -MD -MP -MF $(DEPDIR)/lib1507-lib1507.Tpo -c -o lib1507-lib1507.o `test -f 'lib1507.c' || echo '$(srcdir)/'`lib1507.c ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1507-lib1507.Tpo $(DEPDIR)/lib1507-lib1507.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='lib1507.c' object='lib1507-lib1507.o' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1507-lib1507.o `test -f 'lib1507.c' || echo '$(srcdir)/'`lib1507.c ++ ++lib1507-lib1507.obj: lib1507.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1507-lib1507.obj -MD -MP -MF $(DEPDIR)/lib1507-lib1507.Tpo -c -o lib1507-lib1507.obj `if test -f 'lib1507.c'; then $(CYGPATH_W) 'lib1507.c'; else $(CYGPATH_W) '$(srcdir)/lib1507.c'; fi` ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1507-lib1507.Tpo $(DEPDIR)/lib1507-lib1507.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='lib1507.c' object='lib1507-lib1507.obj' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1507-lib1507.obj `if test -f 'lib1507.c'; then $(CYGPATH_W) 'lib1507.c'; else $(CYGPATH_W) '$(srcdir)/lib1507.c'; fi` ++ ++lib1507-first.o: first.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1507-first.o -MD -MP -MF $(DEPDIR)/lib1507-first.Tpo -c -o lib1507-first.o `test -f 'first.c' || echo '$(srcdir)/'`first.c ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1507-first.Tpo $(DEPDIR)/lib1507-first.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='first.c' object='lib1507-first.o' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1507-first.o `test -f 'first.c' || echo '$(srcdir)/'`first.c ++ ++lib1507-first.obj: first.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1507-first.obj -MD -MP -MF $(DEPDIR)/lib1507-first.Tpo -c -o lib1507-first.obj `if test -f 'first.c'; then $(CYGPATH_W) 'first.c'; else $(CYGPATH_W) '$(srcdir)/first.c'; fi` ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1507-first.Tpo $(DEPDIR)/lib1507-first.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='first.c' object='lib1507-first.obj' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1507-first.obj `if test -f 'first.c'; then $(CYGPATH_W) 'first.c'; else $(CYGPATH_W) '$(srcdir)/first.c'; fi` ++ ++lib1507-testutil.o: testutil.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1507-testutil.o -MD -MP -MF $(DEPDIR)/lib1507-testutil.Tpo -c -o lib1507-testutil.o `test -f 'testutil.c' || echo '$(srcdir)/'`testutil.c ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1507-testutil.Tpo $(DEPDIR)/lib1507-testutil.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='testutil.c' object='lib1507-testutil.o' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1507-testutil.o `test -f 'testutil.c' || echo '$(srcdir)/'`testutil.c ++ ++lib1507-testutil.obj: testutil.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1507-testutil.obj -MD -MP -MF $(DEPDIR)/lib1507-testutil.Tpo -c -o lib1507-testutil.obj `if test -f 'testutil.c'; then $(CYGPATH_W) 'testutil.c'; else $(CYGPATH_W) '$(srcdir)/testutil.c'; fi` ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1507-testutil.Tpo $(DEPDIR)/lib1507-testutil.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='testutil.c' object='lib1507-testutil.obj' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1507-testutil.obj `if test -f 'testutil.c'; then $(CYGPATH_W) 'testutil.c'; else $(CYGPATH_W) '$(srcdir)/testutil.c'; fi` ++ ++lib1507-warnless.o: ../../lib/warnless.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1507-warnless.o -MD -MP -MF $(DEPDIR)/lib1507-warnless.Tpo -c -o lib1507-warnless.o `test -f '../../lib/warnless.c' || echo '$(srcdir)/'`../../lib/warnless.c ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1507-warnless.Tpo $(DEPDIR)/lib1507-warnless.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='../../lib/warnless.c' object='lib1507-warnless.o' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1507-warnless.o `test -f '../../lib/warnless.c' || echo '$(srcdir)/'`../../lib/warnless.c ++ ++lib1507-warnless.obj: ../../lib/warnless.c ++@am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1507-warnless.obj -MD -MP -MF $(DEPDIR)/lib1507-warnless.Tpo -c -o lib1507-warnless.obj `if test -f '../../lib/warnless.c'; then $(CYGPATH_W) '../../lib/warnless.c'; else $(CYGPATH_W) '$(srcdir)/../../lib/warnless.c'; fi` ++@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1507-warnless.Tpo $(DEPDIR)/lib1507-warnless.Po ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='../../lib/warnless.c' object='lib1507-warnless.obj' libtool=no @AMDEPBACKSLASH@ ++@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ ++@am__fastdepCC_FALSE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1507_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o lib1507-warnless.obj `if test -f '../../lib/warnless.c'; then $(CYGPATH_W) '../../lib/warnless.c'; else $(CYGPATH_W) '$(srcdir)/../../lib/warnless.c'; fi` ++ + lib1508-lib1508.o: lib1508.c + @am__fastdepCC_TRUE@ $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(lib1508_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT lib1508-lib1508.o -MD -MP -MF $(DEPDIR)/lib1508-lib1508.Tpo -c -o lib1508-lib1508.o `test -f 'lib1508.c' || echo '$(srcdir)/'`lib1508.c + @am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/lib1508-lib1508.Tpo $(DEPDIR)/lib1508-lib1508.Po +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc +index 8bf2be4..5e377d3 100644 +--- a/tests/libtest/Makefile.inc ++++ b/tests/libtest/Makefile.inc +@@ -23,7 +23,7 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect \ + lib582 lib583 lib585 lib586 lib587 \ + lib590 lib591 lib597 lib598 lib599 \ + \ +- lib1500 lib1501 lib1502 lib1503 lib1504 lib1505 lib1506 lib1508 ++ lib1500 lib1501 lib1502 lib1503 lib1504 lib1505 lib1506 lib1507 lib1508 + + chkhostname_SOURCES = chkhostname.c ../../lib/curl_gethostname.c + chkhostname_LDADD = @CURL_NETWORK_LIBS@ +@@ -313,6 +313,10 @@ lib1506_SOURCES = lib1506.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib1506_LDADD = $(TESTUTIL_LIBS) + lib1506_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1506 + ++lib1507_SOURCES = lib1507.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) ++lib1507_LDADD = $(TESTUTIL_LIBS) ++lib1507_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1507 ++ + lib1508_SOURCES = lib1508.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib1508_LDADD = $(TESTUTIL_LIBS) + lib1508_CPPFLAGS = $(AM_CPPFLAGS) -DLIB1508 +diff --git a/tests/libtest/lib1507.c b/tests/libtest/lib1507.c +new file mode 100644 +index 0000000..7c4e6ed +--- /dev/null ++++ b/tests/libtest/lib1507.c +@@ -0,0 +1,167 @@ ++/*************************************************************************** ++ * _ _ ____ _ ++ * Project ___| | | | _ \| | ++ * / __| | | | |_) | | ++ * | (__| |_| | _ <| |___ ++ * \___|\___/|_| \_\_____| ++ * ++ * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al. ++ * ++ * This software is licensed as described in the file COPYING, which ++ * you should have received as part of this distribution. The terms ++ * are also available at http://curl.haxx.se/docs/copyright.html. ++ * ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell ++ * copies of the Software, and permit persons to whom the Software is ++ * furnished to do so, under the terms of the COPYING file. ++ * ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY ++ * KIND, either express or implied. ++ * ++ ***************************************************************************/ ++#include "test.h" ++ ++#include "testutil.h" ++#include "warnless.h" ++#include "memdebug.h" ++ ++/* ++ * This is the list of basic details you need to tweak to get things right. ++ */ ++#define USERNAME "user@example.com" ++#define PASSWORD "123qwerty" ++#define RECIPIENT "<1507-recipient@example.com>" ++#define MAILFROM "<1507-realuser@example.com>" ++ ++#define MULTI_PERFORM_HANG_TIMEOUT 60 * 1000 ++ ++static size_t read_callback(void *ptr, size_t size, size_t nmemb, void *userp) ++{ ++ (void)ptr; ++ (void)size; ++ (void)nmemb; ++ (void)userp; ++ return CURL_READFUNC_ABORT; ++} ++ ++static struct timeval tvnow(void) ++{ ++ /* ++ ** time() returns the value of time in seconds since the Epoch. ++ */ ++ struct timeval now; ++ now.tv_sec = (long)time(NULL); ++ now.tv_usec = 0; ++ return now; ++} ++ ++static long tvdiff(struct timeval newer, struct timeval older) ++{ ++ return (newer.tv_sec-older.tv_sec)*1000+ ++ (newer.tv_usec-older.tv_usec)/1000; ++} ++ ++int test(char *URL) ++{ ++ CURL *curl; ++ CURLM *mcurl; ++ int still_running = 1; ++ struct timeval mp_start; ++ struct curl_slist* rcpt_list = NULL; ++ ++ curl_global_init(CURL_GLOBAL_DEFAULT); ++ ++ curl = curl_easy_init(); ++ if(!curl) ++ return 1; ++ ++ mcurl = curl_multi_init(); ++ if(!mcurl) ++ return 2; ++ ++ rcpt_list = curl_slist_append(rcpt_list, RECIPIENT); ++ /* more addresses can be added here ++ rcpt_list = curl_slist_append(rcpt_list, "<others@example.com>"); ++ */ ++ ++ curl_easy_setopt(curl, CURLOPT_URL, URL); ++#if 0 ++ curl_easy_setopt(curl, CURLOPT_USERNAME, USERNAME); ++ curl_easy_setopt(curl, CURLOPT_PASSWORD, PASSWORD); ++#endif ++ curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback); ++ curl_easy_setopt(curl, CURLOPT_MAIL_FROM, MAILFROM); ++ curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, rcpt_list); ++ curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); ++ curl_multi_add_handle(mcurl, curl); ++ ++ mp_start = tvnow(); ++ ++ /* we start some action by calling perform right away */ ++ curl_multi_perform(mcurl, &still_running); ++ ++ while(still_running) { ++ struct timeval timeout; ++ int rc; /* select() return code */ ++ ++ fd_set fdread; ++ fd_set fdwrite; ++ fd_set fdexcep; ++ int maxfd = -1; ++ ++ long curl_timeo = -1; ++ ++ FD_ZERO(&fdread); ++ FD_ZERO(&fdwrite); ++ FD_ZERO(&fdexcep); ++ ++ /* set a suitable timeout to play around with */ ++ timeout.tv_sec = 1; ++ timeout.tv_usec = 0; ++ ++ curl_multi_timeout(mcurl, &curl_timeo); ++ if(curl_timeo >= 0) { ++ timeout.tv_sec = curl_timeo / 1000; ++ if(timeout.tv_sec > 1) ++ timeout.tv_sec = 1; ++ else ++ timeout.tv_usec = (curl_timeo % 1000) * 1000; ++ } ++ ++ /* get file descriptors from the transfers */ ++ curl_multi_fdset(mcurl, &fdread, &fdwrite, &fdexcep, &maxfd); ++ ++ /* In a real-world program you OF COURSE check the return code of the ++ function calls. On success, the value of maxfd is guaranteed to be ++ greater or equal than -1. We call select(maxfd + 1, ...), specially in ++ case of (maxfd == -1), we call select(0, ...), which is basically equal ++ to sleep. */ ++ ++ rc = select(maxfd+1, &fdread, &fdwrite, &fdexcep, &timeout); ++ ++ if (tvdiff(tvnow(), mp_start) > MULTI_PERFORM_HANG_TIMEOUT) { ++ fprintf(stderr, "ABORTING TEST, since it seems " ++ "that it would have run forever.\n"); ++ break; ++ } ++ ++ switch(rc) { ++ case -1: ++ /* select error */ ++ break; ++ case 0: /* timeout */ ++ default: /* action */ ++ curl_multi_perform(mcurl, &still_running); ++ break; ++ } ++ } ++ ++ curl_slist_free_all(rcpt_list); ++ curl_multi_remove_handle(mcurl, curl); ++ curl_multi_cleanup(mcurl); ++ curl_easy_cleanup(curl); ++ curl_global_cleanup(); ++ return 0; ++} ++ ++ +-- +1.7.1 + + +From 55004df420d1e520d84fded41a4d16f36acee119 Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Mon, 9 Sep 2013 13:10:53 +0200 +Subject: [PATCH 2/2] url: handle abortion by read/write callbacks, too + +Otherwise, the FTP protocol would unnecessarily hang 60 seconds if +aborted in the CURLOPT_HEADERFUNCTION callback. + +Reported by: Tomas Mlcoch +Bug: https://bugzilla.redhat.com/1005686 + +[upstream commit c639d725a37c91fb49bb3a689cb2596fad3a0645] +--- + lib/url.c | 8 +++++++- + 1 files changed, 7 insertions(+), 1 deletions(-) + +diff --git a/lib/url.c b/lib/url.c +index a6375a2..bddbd91 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -5222,12 +5222,18 @@ CURLcode Curl_done(struct connectdata **connp, + conn->dns_entry = NULL; + } + +- if(status == CURLE_ABORTED_BY_CALLBACK) ++ switch(status) { ++ case CURLE_ABORTED_BY_CALLBACK: ++ case CURLE_READ_ERROR: ++ case CURLE_WRITE_ERROR: + /* When we're aborted due to a callback return code it basically have to + be counted as premature as there is trouble ahead if we don't. We have + many callbacks and protocols work differently, we could potentially do + this more fine-grained in the future. */ + premature = TRUE; ++ default: ++ break; ++ } + + /* this calls the protocol-specific function pointer previously set */ + if(conn->handler->done) +-- +1.7.1 + diff --git a/0013-curl-7.29.0-665c160f.patch b/0013-curl-7.29.0-665c160f.patch new file mode 100644 index 0000000..d7c2ddf --- /dev/null +++ b/0013-curl-7.29.0-665c160f.patch @@ -0,0 +1,86 @@ +From 311a22b801693bf8b748169f35bde7bef744da8c Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Wed, 29 Jan 2014 12:55:36 +0100 +Subject: [PATCH 1/2] nss: do not fail if NSS does not implement a cipher + +... that the user does not ask for + +[upstream commit e15e73b741a2ddc88d166d2cec86d2bebb5d349e] +--- + lib/nss.c | 9 +++++---- + 1 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/lib/nss.c b/lib/nss.c +index a2c5c63..c4ffe7b 100644 +--- a/lib/nss.c ++++ b/lib/nss.c +@@ -192,14 +192,13 @@ static SECStatus set_ciphers(struct SessionHandle *data, PRFileDesc * model, + PRBool cipher_state[NUM_OF_CIPHERS]; + PRBool found; + char *cipher; +- SECStatus rv; + + /* First disable all ciphers. This uses a different max value in case + * NSS adds more ciphers later we don't want them available by + * accident + */ + for(i=0; i<SSL_NumImplementedCiphers; i++) { +- SSL_CipherPrefSet(model, SSL_ImplementedCiphers[i], SSL_NOT_ALLOWED); ++ SSL_CipherPrefSet(model, SSL_ImplementedCiphers[i], PR_FALSE); + } + + /* Set every entry in our list to false */ +@@ -239,8 +238,10 @@ static SECStatus set_ciphers(struct SessionHandle *data, PRFileDesc * model, + + /* Finally actually enable the selected ciphers */ + for(i=0; i<NUM_OF_CIPHERS; i++) { +- rv = SSL_CipherPrefSet(model, cipherlist[i].num, cipher_state[i]); +- if(rv != SECSuccess) { ++ if(!cipher_state[i]) ++ continue; ++ ++ if(SSL_CipherPrefSet(model, cipherlist[i].num, PR_TRUE) != SECSuccess) { + failf(data, "cipher-suite not supported by NSS: %s", cipherlist[i].name); + return SECFailure; + } +-- +1.7.1 + + +From 9fe38c72787ba6658456a30477d48fe7960947ed Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Wed, 29 Jan 2014 13:03:46 +0100 +Subject: [PATCH 2/2] nss: do not use the NSS_ENABLE_ECC define + +It is not provided by NSS public headers. + +Bug: https://bugzilla.redhat.com/1058776 + +[upstream commit 665c160f0a4635565b44704ca281d2a03e715d6d] +--- + lib/nss.c | 2 -- + 1 files changed, 0 insertions(+), 2 deletions(-) + +diff --git a/lib/nss.c b/lib/nss.c +index c4ffe7b..111982f 100644 +--- a/lib/nss.c ++++ b/lib/nss.c +@@ -126,7 +126,6 @@ static const cipher_s cipherlist[] = { + /* AES ciphers. */ + {"rsa_aes_128_sha", TLS_RSA_WITH_AES_128_CBC_SHA}, + {"rsa_aes_256_sha", TLS_RSA_WITH_AES_256_CBC_SHA}, +-#ifdef NSS_ENABLE_ECC + /* ECC ciphers. */ + {"ecdh_ecdsa_null_sha", TLS_ECDH_ECDSA_WITH_NULL_SHA}, + {"ecdh_ecdsa_rc4_128_sha", TLS_ECDH_ECDSA_WITH_RC4_128_SHA}, +@@ -153,7 +152,6 @@ static const cipher_s cipherlist[] = { + {"ecdh_anon_3des_sha", TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA}, + {"ecdh_anon_aes_128_sha", TLS_ECDH_anon_WITH_AES_128_CBC_SHA}, + {"ecdh_anon_aes_256_sha", TLS_ECDH_anon_WITH_AES_256_CBC_SHA}, +-#endif + }; + + /* following ciphers are new in NSS 3.4 and not enabled by default, therefore +-- +1.7.1 + diff --git a/0014-curl-7.27.0-9d0af301.patch b/0014-curl-7.27.0-9d0af301.patch deleted file mode 100644 index 739bbe7..0000000 --- a/0014-curl-7.27.0-9d0af301.patch +++ /dev/null @@ -1,95 +0,0 @@ -From c7bd0361565f70caf621f588e38bfc6cc196c432 Mon Sep 17 00:00:00 2001 -From: Kamil Dudka <kdudka@redhat.com> -Date: Tue, 5 Mar 2013 17:51:01 +0100 -Subject: [PATCH 1/2] nss: fix misplaced code enabling non-blocking socket mode - -The option needs to be set on the SSL socket. Setting it on the model -takes no effect. Note that the non-blocking mode is still not enabled -for the handshake because the code is not yet ready for that. - -[upstream commit 9d0af3018c5db25f5adda216dbcad6056b4a3107] ---- - lib/nss.c | 12 ++++++------ - 1 files changed, 6 insertions(+), 6 deletions(-) - -diff --git a/lib/nss.c b/lib/nss.c -index efa578c..0ad1863 100644 ---- a/lib/nss.c -+++ b/lib/nss.c -@@ -1240,12 +1240,6 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) - goto error; - model = SSL_ImportFD(NULL, model); - -- /* make the socket nonblocking */ -- sock_opt.option = PR_SockOpt_Nonblocking; -- sock_opt.value.non_blocking = PR_TRUE; -- if(PR_SetSocketOption(model, &sock_opt) != PR_SUCCESS) -- goto error; -- - if(SSL_OptionSet(model, SSL_SECURITY, PR_TRUE) != SECSuccess) - goto error; - if(SSL_OptionSet(model, SSL_HANDSHAKE_AS_SERVER, PR_FALSE) != SECSuccess) -@@ -1420,6 +1414,12 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) - goto error; - } - -+ /* switch the SSL socket into non-blocking mode */ -+ sock_opt.option = PR_SockOpt_Nonblocking; -+ sock_opt.value.non_blocking = PR_TRUE; -+ if(PR_SetSocketOption(connssl->handle, &sock_opt) != PR_SUCCESS) -+ goto error; -+ - connssl->state = ssl_connection_complete; - conn->recv[sockindex] = nss_recv; - conn->send[sockindex] = nss_send; --- -1.7.1 - - -From f3a5d46280264965ca096c9b3efba481d4883d0e Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg <daniel@haxx.se> -Date: Tue, 7 May 2013 23:30:52 +0200 -Subject: [PATCH 2/2] nss: give PR_INTERVAL_NO_WAIT instead of -1 to PR_Recv/PR_Send - -Reported by: David Strauss -Bug: http://curl.haxx.se/mail/lib-2013-05/0088.html - -[upstream commit 01a2abedd7e3a2075de70979003302313570c58c] - -Signed-off-by: Kamil Dudka <kdudka@redhat.com> ---- - lib/nss.c | 11 ++++------- - 1 files changed, 4 insertions(+), 7 deletions(-) - -diff --git a/lib/nss.c b/lib/nss.c -index 0ad1863..f69a888 100644 ---- a/lib/nss.c -+++ b/lib/nss.c -@@ -1487,10 +1487,8 @@ static ssize_t nss_send(struct connectdata *conn, /* connection data */ - size_t len, /* amount to write */ - CURLcode *curlcode) - { -- int rc; -- -- rc = PR_Send(conn->ssl[sockindex].handle, mem, (int)len, 0, -1); -- -+ ssize_t rc = PR_Send(conn->ssl[sockindex].handle, mem, (int)len, 0, -+ PR_INTERVAL_NO_WAIT); - if(rc < 0) { - PRInt32 err = PR_GetError(); - if(err == PR_WOULD_BLOCK_ERROR) -@@ -1518,9 +1516,8 @@ static ssize_t nss_recv(struct connectdata * conn, /* connection data */ - size_t buffersize, /* max amount to read */ - CURLcode *curlcode) - { -- ssize_t nread; -- -- nread = PR_Recv(conn->ssl[num].handle, buf, (int)buffersize, 0, -1); -+ ssize_t nread = PR_Recv(conn->ssl[num].handle, buf, (int)buffersize, 0, -+ PR_INTERVAL_NO_WAIT); - if(nread < 0) { - /* failed SSL read */ - PRInt32 err = PR_GetError(); --- -1.7.1 - diff --git a/0014-curl-7.29.0-8ae35102.patch b/0014-curl-7.29.0-8ae35102.patch new file mode 100644 index 0000000..9daa26d --- /dev/null +++ b/0014-curl-7.29.0-8ae35102.patch @@ -0,0 +1,42 @@ +From 8683703ef3978983e61329801aecc554aec06055 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Tue, 7 Jan 2014 09:33:54 +0100 +Subject: [PATCH] ConnectionExists: fix NTLM check for new connection + +When the requested authentication bitmask includes NTLM, we cannot +re-use a connection for another username/password as we then risk +re-using NTLM (connection-based auth). + +This has the unfortunate downside that if you include NTLM as a possible +auth, you cannot re-use connections for other usernames/passwords even +if NTLM doesn't end up the auth type used. + +Reported-by: Paras S +Patched-by: Paras S +Bug: http://curl.haxx.se/mail/lib-2014-01/0046.html + +[upstream commit 8ae35102c43d8d06572c3a1292eb6e27e663c78d] + +Signed-off-by: Kamil Dudka <kdudka@redhat.com> +--- + lib/url.c | 4 ++-- + 1 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/url.c b/lib/url.c +index bddbd91..313ec3e 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -2782,8 +2782,8 @@ ConnectionExists(struct SessionHandle *data, + struct connectdata *check; + struct connectdata *chosen = 0; + bool canPipeline = IsPipeliningPossible(data, needle); +- bool wantNTLM = (data->state.authhost.want==CURLAUTH_NTLM) || +- (data->state.authhost.want==CURLAUTH_NTLM_WB) ? TRUE : FALSE; ++ bool wantNTLM = (data->state.authhost.want & CURLAUTH_NTLM) || ++ (data->state.authhost.want & CURLAUTH_NTLM_WB) ? TRUE : FALSE; + struct connectbundle *bundle; + + /* Look up the bundle with all the connections to this +-- +1.7.1 + diff --git a/0015-curl-7.29.0-7fc9325a.patch b/0015-curl-7.29.0-7fc9325a.patch new file mode 100644 index 0000000..7b6c5fe --- /dev/null +++ b/0015-curl-7.29.0-7fc9325a.patch @@ -0,0 +1,1090 @@ +From a7b1ea3537b30450ad82d2c64d31dcecaed60fca Mon Sep 17 00:00:00 2001 +From: Gergely Nagy <ngg@tresorit.com> +Date: Thu, 19 Sep 2013 15:17:13 +0200 +Subject: [PATCH 1/9] SSL: protocol version can be specified more precisely + +CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, +CURL_SSLVERSION_TLSv1_2 enum values are added to force exact TLS version +(CURL_SSLVERSION_TLSv1 means TLS 1.x). + +axTLS: +axTLS only supports TLS 1.0 and 1.1 but it cannot be set that only one +of these should be used, so we don't allow the new enum values. + +darwinssl: +Added support for the new enum values. + +SChannel: +Added support for the new enum values. + +CyaSSL: +Added support for the new enum values. +Bug: The original CURL_SSLVERSION_TLSv1 value enables only TLS 1.0 (it +did the same before this commit), because CyaSSL cannot be configured to +use TLS 1.0-1.2. + +GSKit: +GSKit doesn't seem to support TLS 1.1 and TLS 1.2, so we do not allow +those values. +Bugfix: There was a typo that caused wrong SSL versions to be passed to +GSKit. + +NSS: +TLS minor version cannot be set, so we don't allow the new enum values. + +QsoSSL: +TLS minor version cannot be set, so we don't allow the new enum values. + +OpenSSL: +Added support for the new enum values. +Bugfix: The original CURL_SSLVERSION_TLSv1 value enabled only TLS 1.0, +now it enables 1.0-1.2. + +Command-line tool: +Added command line options for the new values. + +[upstream commit ad34a2d5c87c7f4b14e8dded34569395de0d8c5b] +--- + docs/libcurl/curl_easy_setopt.3 | 8 +++++- + docs/libcurl/symbols-in-versions | 3 ++ + include/curl/curl.h | 5 +++- + lib/axtls.c | 3 +- + lib/curl_darwinssl.c | 34 +++++++++++++++++++++++++ + lib/curl_schannel.c | 9 ++++++ + lib/cyassl.c | 13 +++++++++- + lib/nss.c | 6 ++++ + lib/qssl.c | 6 ++++ + lib/ssluse.c | 51 +++++++++++++++++++++++++++---------- + packages/OS400/curl.inc.in | 6 ++++ + src/tool_getparam.c | 25 ++++++++++++++++-- + src/tool_setopt.c | 3 ++ + 13 files changed, 151 insertions(+), 21 deletions(-) + +diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3 +index 3d31aef..92db8f4 100644 +--- a/docs/libcurl/curl_easy_setopt.3 ++++ b/docs/libcurl/curl_easy_setopt.3 +@@ -2219,11 +2219,17 @@ The default action. This will attempt to figure out the remote SSL protocol + version, i.e. either SSLv3 or TLSv1 (but not SSLv2, which became disabled + by default with 7.18.1). + .IP CURL_SSLVERSION_TLSv1 +-Force TLSv1 ++Force TLSv1.x + .IP CURL_SSLVERSION_SSLv2 + Force SSLv2 + .IP CURL_SSLVERSION_SSLv3 + Force SSLv3 ++.IP CURL_SSLVERSION_TLSv1_0 ++Force TLSv1.0 ++.IP CURL_SSLVERSION_TLSv1_1 ++Force TLSv1.1 ++.IP CURL_SSLVERSION_TLSv1_2 ++Force TLSv1.2 + .RE + .IP CURLOPT_SSL_VERIFYPEER + Pass a long as parameter. By default, curl assumes a value of 1. +diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions +index 37b5e27..57fa6eb 100644 +--- a/docs/libcurl/symbols-in-versions ++++ b/docs/libcurl/symbols-in-versions +@@ -678,6 +678,9 @@ CURL_SSLVERSION_DEFAULT 7.9.2 + CURL_SSLVERSION_SSLv2 7.9.2 + CURL_SSLVERSION_SSLv3 7.9.2 + CURL_SSLVERSION_TLSv1 7.9.2 ++CURL_SSLVERSION_TLSv1_0 7.33.0 ++CURL_SSLVERSION_TLSv1_1 7.33.0 ++CURL_SSLVERSION_TLSv1_2 7.33.0 + CURL_TIMECOND_IFMODSINCE 7.9.7 + CURL_TIMECOND_IFUNMODSINCE 7.9.7 + CURL_TIMECOND_LASTMOD 7.9.7 +diff --git a/include/curl/curl.h b/include/curl/curl.h +index 80e4cf5..8e548e3 100644 +--- a/include/curl/curl.h ++++ b/include/curl/curl.h +@@ -1625,9 +1625,12 @@ enum CURL_NETRC_OPTION { + + enum { + CURL_SSLVERSION_DEFAULT, +- CURL_SSLVERSION_TLSv1, ++ CURL_SSLVERSION_TLSv1, /* TLS 1.x */ + CURL_SSLVERSION_SSLv2, + CURL_SSLVERSION_SSLv3, ++ CURL_SSLVERSION_TLSv1_0, ++ CURL_SSLVERSION_TLSv1_1, ++ CURL_SSLVERSION_TLSv1_2, + + CURL_SSLVERSION_LAST /* never use, keep last */ + }; +diff --git a/lib/axtls.c b/lib/axtls.c +index d512950..68794b5 100644 +--- a/lib/axtls.c ++++ b/lib/axtls.c +@@ -169,7 +169,8 @@ Curl_axtls_connect(struct connectdata *conn, + case CURL_SSLVERSION_TLSv1: + break; + default: +- failf(data, "axTLS only supports TLSv1"); ++ failf(data, "axTLS only supports TLS 1.0 and 1.1, " ++ "and it cannot be specified which one to use"); + return CURLE_SSL_CONNECT_ERROR; + } + +diff --git a/lib/curl_darwinssl.c b/lib/curl_darwinssl.c +index 827c876..69eff8a 100644 +--- a/lib/curl_darwinssl.c ++++ b/lib/curl_darwinssl.c +@@ -719,6 +719,18 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn, + (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol1); + (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol12); + break; ++ case CURL_SSLVERSION_TLSv1_0: ++ (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol1); ++ (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol1); ++ break; ++ case CURL_SSLVERSION_TLSv1_1: ++ (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol11); ++ (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol11); ++ break; ++ case CURL_SSLVERSION_TLSv1_2: ++ (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kTLSProtocol12); ++ (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kTLSProtocol12); ++ break; + case CURL_SSLVERSION_SSLv3: + (void)SSLSetProtocolVersionMin(connssl->ssl_ctx, kSSLProtocol3); + (void)SSLSetProtocolVersionMax(connssl->ssl_ctx, kSSLProtocol3); +@@ -759,6 +771,21 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn, + kTLSProtocol12, + true); + break; ++ case CURL_SSLVERSION_TLSv1_0: ++ (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, ++ kTLSProtocol1, ++ true); ++ break; ++ case CURL_SSLVERSION_TLSv1_1: ++ (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, ++ kTLSProtocol11, ++ true); ++ break; ++ case CURL_SSLVERSION_TLSv1_2: ++ (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, ++ kTLSProtocol12, ++ true); ++ break; + case CURL_SSLVERSION_SSLv3: + (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, + kSSLProtocol3, +@@ -785,10 +812,17 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn, + true); + break; + case CURL_SSLVERSION_TLSv1: ++ case CURL_SSLVERSION_TLSv1_0: + (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, + kTLSProtocol1, + true); + break; ++ case CURL_SSLVERSION_TLSv1_1: ++ failf(data, "Your version of the OS does not support TLSv1.1"); ++ return CURLE_SSL_CONNECT_ERROR; ++ case CURL_SSLVERSION_TLSv1_2: ++ failf(data, "Your version of the OS does not support TLSv1.2"); ++ return CURLE_SSL_CONNECT_ERROR; + case CURL_SSLVERSION_SSLv2: + (void)SSLSetProtocolVersionEnabled(connssl->ssl_ctx, + kSSLProtocol2, +diff --git a/lib/curl_schannel.c b/lib/curl_schannel.c +index a615f57..19b7f71 100644 +--- a/lib/curl_schannel.c ++++ b/lib/curl_schannel.c +@@ -180,6 +180,15 @@ schannel_connect_step1(struct connectdata *conn, int sockindex) + SP_PROT_TLS1_1_CLIENT | + SP_PROT_TLS1_2_CLIENT; + break; ++ case CURL_SSLVERSION_TLSv1_0: ++ schannel_cred.grbitEnabledProtocols = SP_PROT_TLS1_0_CLIENT; ++ break; ++ case CURL_SSLVERSION_TLSv1_1: ++ schannel_cred.grbitEnabledProtocols = SP_PROT_TLS1_1_CLIENT; ++ break; ++ case CURL_SSLVERSION_TLSv1_2: ++ schannel_cred.grbitEnabledProtocols = SP_PROT_TLS1_2_CLIENT; ++ break; + case CURL_SSLVERSION_SSLv3: + schannel_cred.grbitEnabledProtocols = SP_PROT_SSL3_CLIENT; + break; +diff --git a/lib/cyassl.c b/lib/cyassl.c +index 7c78464..ff11bdd 100644 +--- a/lib/cyassl.c ++++ b/lib/cyassl.c +@@ -5,7 +5,7 @@ + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * +- * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al. ++ * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms +@@ -98,8 +98,19 @@ cyassl_connect_step1(struct connectdata *conn, + req_method = SSLv23_client_method(); + break; + case CURL_SSLVERSION_TLSv1: ++ infof(data, "CyaSSL cannot be configured to use TLS 1.0-1.2, " ++ "TLS 1.0 is used exclusively\n"); + req_method = TLSv1_client_method(); + break; ++ case CURL_SSLVERSION_TLSv1_0: ++ req_method = TLSv1_client_method(); ++ break; ++ case CURL_SSLVERSION_TLSv1_1: ++ req_method = TLSv1_1_client_method(); ++ break; ++ case CURL_SSLVERSION_TLSv1_2: ++ req_method = TLSv1_2_client_method(); ++ break; + case CURL_SSLVERSION_SSLv3: + req_method = SSLv3_client_method(); + break; +diff --git a/lib/nss.c b/lib/nss.c +index 111982f..ff93a38 100644 +--- a/lib/nss.c ++++ b/lib/nss.c +@@ -1266,6 +1266,12 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) + case CURL_SSLVERSION_SSLv3: + ssl3 = PR_TRUE; + break; ++ case CURL_SSLVERSION_TLSv1_0: ++ case CURL_SSLVERSION_TLSv1_1: ++ case CURL_SSLVERSION_TLSv1_2: ++ failf(data, "TLS minor version cannot be set\n"); ++ curlerr = CURLE_SSL_CONNECT_ERROR; ++ goto error; + } + + if(SSL_OptionSet(model, SSL_ENABLE_SSL2, ssl2) != SECSuccess) +diff --git a/lib/qssl.c b/lib/qssl.c +index 8ef6fec..8b5e499 100644 +--- a/lib/qssl.c ++++ b/lib/qssl.c +@@ -206,6 +206,12 @@ static CURLcode Curl_qsossl_handshake(struct connectdata * conn, int sockindex) + case CURL_SSLVERSION_SSLv3: + h->protocol = SSL_VERSION_3; + break; ++ ++ case CURL_SSLVERSION_TLSv1_0: ++ case CURL_SSLVERSION_TLSv1_1: ++ case CURL_SSLVERSION_TLSv1_2: ++ failf(data, "TLS minor version cannot be set"); ++ return CURLE_SSL_CONNECT_ERROR; + } + + rc = SSL_Handshake(h, SSL_HANDSHAKE_AS_CLIENT); +diff --git a/lib/ssluse.c b/lib/ssluse.c +index 4a0dba7..dd99435 100644 +--- a/lib/ssluse.c ++++ b/lib/ssluse.c +@@ -1389,19 +1389,12 @@ ossl_connect_step1(struct connectdata *conn, + switch(data->set.ssl.version) { + default: + case CURL_SSLVERSION_DEFAULT: +-#ifdef USE_TLS_SRP +- if(data->set.ssl.authtype == CURL_TLSAUTH_SRP) { +- infof(data, "Set version TLSv1 for SRP authorisation\n"); +- req_method = TLSv1_client_method() ; +- } +- else +-#endif +- /* we try to figure out version */ +- req_method = SSLv23_client_method(); +- use_sni(TRUE); +- break; + case CURL_SSLVERSION_TLSv1: +- req_method = TLSv1_client_method(); ++ case CURL_SSLVERSION_TLSv1_0: ++ case CURL_SSLVERSION_TLSv1_1: ++ case CURL_SSLVERSION_TLSv1_2: ++ /* it will be handled later with the context options */ ++ req_method = SSLv23_client_method(); + use_sni(TRUE); + break; + case CURL_SSLVERSION_SSLv2: +@@ -1514,9 +1507,39 @@ ossl_connect_step1(struct connectdata *conn, + ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; + #endif + +- /* disable SSLv2 in the default case (i.e. allow SSLv3 and TLSv1) */ +- if(data->set.ssl.version == CURL_SSLVERSION_DEFAULT) ++ switch(data->set.ssl.version) { ++ case CURL_SSLVERSION_DEFAULT: ++ ctx_options |= SSL_OP_NO_SSLv2; ++#ifdef USE_TLS_SRP ++ if(data->set.ssl.authtype == CURL_TLSAUTH_SRP) { ++ infof(data, "Set version TLSv1.x for SRP authorisation\n"); ++ ctx_options |= SSL_OP_NO_SSLv3; ++ } ++#endif ++ break; ++ case CURL_SSLVERSION_TLSv1: ++ ctx_options |= SSL_OP_NO_SSLv2; ++ ctx_options |= SSL_OP_NO_SSLv3; ++ break; ++ case CURL_SSLVERSION_TLSv1_0: + ctx_options |= SSL_OP_NO_SSLv2; ++ ctx_options |= SSL_OP_NO_SSLv3; ++ ctx_options |= SSL_OP_NO_TLSv1_1; ++ ctx_options |= SSL_OP_NO_TLSv1_2; ++ break; ++ case CURL_SSLVERSION_TLSv1_1: ++ ctx_options |= SSL_OP_NO_SSLv2; ++ ctx_options |= SSL_OP_NO_SSLv3; ++ ctx_options |= SSL_OP_NO_TLSv1; ++ ctx_options |= SSL_OP_NO_TLSv1_2; ++ break; ++ case CURL_SSLVERSION_TLSv1_2: ++ ctx_options |= SSL_OP_NO_SSLv2; ++ ctx_options |= SSL_OP_NO_SSLv3; ++ ctx_options |= SSL_OP_NO_TLSv1; ++ ctx_options |= SSL_OP_NO_TLSv1_1; ++ break; ++ } + + SSL_CTX_set_options(connssl->ctx, ctx_options); + +diff --git a/packages/OS400/curl.inc.in b/packages/OS400/curl.inc.in +index 33ca12a..22a5511 100644 +--- a/packages/OS400/curl.inc.in ++++ b/packages/OS400/curl.inc.in +@@ -226,6 +226,12 @@ + d c 2 + d CURL_SSLVERSION_SSLv3... + d c 3 ++ d CURL_SSLVERSION_TLSv1_0... ++ d c 4 ++ d CURL_SSLVERSION_TLSv1_1... ++ d c 5 ++ d CURL_SSLVERSION_TLSv1_2... ++ d c 6 + * + d CURL_TLSAUTH_NONE... + d c 0 +diff --git a/src/tool_getparam.c b/src/tool_getparam.c +index 297b986..98d53a7 100644 +--- a/src/tool_getparam.c ++++ b/src/tool_getparam.c +@@ -175,6 +175,9 @@ static const struct LongShort aliases[]= { + {"$J", "metalink", FALSE}, + {"0", "http1.0", FALSE}, + {"1", "tlsv1", FALSE}, ++ {"10", "tlsv1.0", FALSE}, ++ {"11", "tlsv1.1", FALSE}, ++ {"12", "tlsv1.2", FALSE}, + {"2", "sslv2", FALSE}, + {"3", "sslv3", FALSE}, + {"4", "ipv4", FALSE}, +@@ -873,9 +876,25 @@ ParameterError getparameter(char *flag, /* f or -long-flag */ + /* HTTP version 1.0 */ + config->httpversion = CURL_HTTP_VERSION_1_0; + break; +- case '1': +- /* TLS version 1 */ +- config->ssl_version = CURL_SSLVERSION_TLSv1; ++ case '1': /* --tlsv1* options */ ++ switch(subletter) { ++ case '\0': ++ /* TLS version 1.x */ ++ config->ssl_version = CURL_SSLVERSION_TLSv1; ++ break; ++ case '0': ++ /* TLS version 1.0 */ ++ config->ssl_version = CURL_SSLVERSION_TLSv1_0; ++ break; ++ case '1': ++ /* TLS version 1.1 */ ++ config->ssl_version = CURL_SSLVERSION_TLSv1_1; ++ break; ++ case '2': ++ /* TLS version 1.2 */ ++ config->ssl_version = CURL_SSLVERSION_TLSv1_2; ++ break; ++ } + break; + case '2': + /* SSL version 2 */ +diff --git a/src/tool_setopt.c b/src/tool_setopt.c +index 4014177..9860117 100644 +--- a/src/tool_setopt.c ++++ b/src/tool_setopt.c +@@ -78,6 +78,9 @@ const NameValue setopt_nv_CURL_SSLVERSION[] = { + NV(CURL_SSLVERSION_TLSv1), + NV(CURL_SSLVERSION_SSLv2), + NV(CURL_SSLVERSION_SSLv3), ++ NV(CURL_SSLVERSION_TLSv1_0), ++ NV(CURL_SSLVERSION_TLSv1_1), ++ NV(CURL_SSLVERSION_TLSv1_2), + NVEND, + }; + +-- +1.7.1 + + +From 350765306d7e2946fc8295fa2bfc2fe0c14651fc Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Tue, 15 Oct 2013 20:31:04 +0200 +Subject: [PATCH 2/9] curl: document the new --tlsv1.[012] options + +[upstream commit 076726f1412205622414abd908723c4b33ca12cb] +--- + docs/curl.1 | 20 ++++++++++++++++---- + 1 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/docs/curl.1 b/docs/curl.1 +index b350865..53b378c 100644 +--- a/docs/curl.1 ++++ b/docs/curl.1 +@@ -1419,14 +1419,26 @@ Set TLS authentication type. Currently, the only supported option is "SRP", + for TLS-SRP (RFC 5054). If \fI--tlsuser\fP and \fI--tlspassword\fP are + specified but \fI--tlsauthtype\fP is not, then this option defaults to "SRP". + (Added in 7.21.4) +-.IP "--tlsuser <user>" +-Set username for use with the TLS authentication method specified with +-\fI--tlsauthtype\fP. Requires that \fI--tlspassword\fP also be set. (Added in +-7.21.4) + .IP "--tlspassword <password>" + Set password for use with the TLS authentication method specified with + \fI--tlsauthtype\fP. Requires that \fI--tlsuser\fP also be set. (Added in + 7.21.4) ++.IP "--tlsuser <user>" ++Set username for use with the TLS authentication method specified with ++\fI--tlsauthtype\fP. Requires that \fI--tlspassword\fP also be set. (Added in ++7.21.4) ++.IP "--tlsv1.0" ++(SSL) ++Forces curl to use TLS version 1.0 when negotiating with a remote TLS server. ++(Added in 7.34.0) ++.IP "--tlsv1.1" ++(SSL) ++Forces curl to use TLS version 1.1 when negotiating with a remote TLS server. ++(Added in 7.34.0) ++.IP "--tlsv1.2" ++(SSL) ++Forces curl to use TLS version 1.2 when negotiating with a remote TLS server. ++(Added in 7.34.0) + .IP "--tr-encoding" + (HTTP) Request a compressed Transfer-Encoding response using one of the + algorithms curl supports, and uncompress the data while receiving it. +-- +1.7.1 + + +From ba2b4e87b396faab9ccb5a3ca9aca935a7a78a1b Mon Sep 17 00:00:00 2001 +From: Steve Holme <steve_holme@hotmail.com> +Date: Wed, 16 Oct 2013 20:06:23 +0100 +Subject: [PATCH 3/9] SSL: Corrected version number for new symbols from commit ad34a2d5c87c7f + +[upstream commit 2c84ffe1549ea7d5029ba7863f53013562e6758d] +--- + docs/libcurl/symbols-in-versions | 6 +++--- + 1 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions +index 57fa6eb..b275900 100644 +--- a/docs/libcurl/symbols-in-versions ++++ b/docs/libcurl/symbols-in-versions +@@ -678,9 +678,9 @@ CURL_SSLVERSION_DEFAULT 7.9.2 + CURL_SSLVERSION_SSLv2 7.9.2 + CURL_SSLVERSION_SSLv3 7.9.2 + CURL_SSLVERSION_TLSv1 7.9.2 +-CURL_SSLVERSION_TLSv1_0 7.33.0 +-CURL_SSLVERSION_TLSv1_1 7.33.0 +-CURL_SSLVERSION_TLSv1_2 7.33.0 ++CURL_SSLVERSION_TLSv1_0 7.34.0 ++CURL_SSLVERSION_TLSv1_1 7.34.0 ++CURL_SSLVERSION_TLSv1_2 7.34.0 + CURL_TIMECOND_IFMODSINCE 7.9.7 + CURL_TIMECOND_IFUNMODSINCE 7.9.7 + CURL_TIMECOND_LASTMOD 7.9.7 +-- +1.7.1 + + +From 5f908139b4e56c969bf6ef06c115a0a12353c827 Mon Sep 17 00:00:00 2001 +From: Steve Holme <steve_holme@hotmail.com> +Date: Wed, 16 Oct 2013 20:18:15 +0100 +Subject: [PATCH 4/9] DOCS: Added libcurl version number to CURLOPT_SSLVERSION + +[upstream commit 75b9b26465d5f01b52564293c2d553649f801f70] +--- + docs/libcurl/curl_easy_setopt.3 | 8 +++++--- + 1 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3 +index 92db8f4..d73b664 100644 +--- a/docs/libcurl/curl_easy_setopt.3 ++++ b/docs/libcurl/curl_easy_setopt.3 +@@ -2212,6 +2212,8 @@ Even though this option doesn't need any parameter, in some configurations + arguments. Therefore, it's recommended to pass 1 as parameter to this option. + .IP CURLOPT_SSLVERSION + Pass a long as parameter to control what version of SSL/TLS to attempt to use. ++(Added in 7.9.2) ++ + The available options are: + .RS + .IP CURL_SSLVERSION_DEFAULT +@@ -2225,11 +2227,11 @@ Force SSLv2 + .IP CURL_SSLVERSION_SSLv3 + Force SSLv3 + .IP CURL_SSLVERSION_TLSv1_0 +-Force TLSv1.0 ++Force TLSv1.0 (Added in 7.34.0) + .IP CURL_SSLVERSION_TLSv1_1 +-Force TLSv1.1 ++Force TLSv1.1 (Added in 7.34.0) + .IP CURL_SSLVERSION_TLSv1_2 +-Force TLSv1.2 ++Force TLSv1.2 (Added in 7.34.0) + .RE + .IP CURLOPT_SSL_VERIFYPEER + Pass a long as parameter. By default, curl assumes a value of 1. +-- +1.7.1 + + +From 7940044fc233f626b912b5f51a7a0111a4c145d3 Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Mon, 25 Nov 2013 16:03:52 +0100 +Subject: [PATCH 5/9] nss: use a better API for controlling SSL version + +This change introduces a dependency on NSS 3.14+. + +[upstream commit 30e7e7552ba4397896ecac82ea04f38d52c4cc8f] +--- + configure | 20 ++++++++++---------- + configure.ac | 4 ++-- + docs/INTERNALS | 2 +- + lib/nss.c | 40 +++++++++++++++++++--------------------- + 4 files changed, 32 insertions(+), 34 deletions(-) + +diff --git a/configure b/configure +index 2496b3c..ebde78a 100755 +--- a/configure ++++ b/configure +@@ -23641,9 +23641,9 @@ $as_echo "found" >&6; } + CPPFLAGS="$CPPFLAGS $addcflags" + fi + +- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for PK11_CreateGenericObject in -lnss3" >&5 +-$as_echo_n "checking for PK11_CreateGenericObject in -lnss3... " >&6; } +-if ${ac_cv_lib_nss3_PK11_CreateGenericObject+:} false; then : ++ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for SSL_VersionRangeSet in -lnss3" >&5 ++$as_echo_n "checking for SSL_VersionRangeSet in -lnss3... " >&6; } ++if ${ac_cv_lib_nss3_SSL_VersionRangeSet+:} false; then : + $as_echo_n "(cached) " >&6 + else + ac_check_lib_save_LIBS=$LIBS +@@ -23655,26 +23655,26 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext + #ifdef __cplusplus + extern "C" + #endif +-char PK11_CreateGenericObject (); ++char SSL_VersionRangeSet (); + int main (void) + { +-return PK11_CreateGenericObject (); ++return SSL_VersionRangeSet (); + ; + return 0; + } + _ACEOF + if ac_fn_c_try_link "$LINENO"; then : +- ac_cv_lib_nss3_PK11_CreateGenericObject=yes ++ ac_cv_lib_nss3_SSL_VersionRangeSet=yes + else +- ac_cv_lib_nss3_PK11_CreateGenericObject=no ++ ac_cv_lib_nss3_SSL_VersionRangeSet=no + fi + rm -f core conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext + LIBS=$ac_check_lib_save_LIBS + fi +-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_nss3_PK11_CreateGenericObject" >&5 +-$as_echo "$ac_cv_lib_nss3_PK11_CreateGenericObject" >&6; } +-if test "x$ac_cv_lib_nss3_PK11_CreateGenericObject" = xyes; then : ++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_nss3_SSL_VersionRangeSet" >&5 ++$as_echo "$ac_cv_lib_nss3_SSL_VersionRangeSet" >&6; } ++if test "x$ac_cv_lib_nss3_SSL_VersionRangeSet" = xyes; then : + + + $as_echo "#define USE_NSS 1" >>confdefs.h +diff --git a/configure.ac b/configure.ac +index 5970188..c81c879 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -2194,8 +2194,8 @@ if test "$curl_ssl_msg" = "$init_ssl_msg"; then + CPPFLAGS="$CPPFLAGS $addcflags" + fi + +- dnl The function PK11_CreateGenericObject is needed to load libnsspem.so +- AC_CHECK_LIB(nss3, PK11_CreateGenericObject, ++ dnl The function SSL_VersionRangeSet() is needed to enable TLS > 1.0 ++ AC_CHECK_LIB(nss3, SSL_VersionRangeSet, + [ + AC_DEFINE(USE_NSS, 1, [if NSS is enabled]) + AC_SUBST(USE_NSS, [1]) +diff --git a/docs/INTERNALS b/docs/INTERNALS +index 03839c3..581b22d 100644 +--- a/docs/INTERNALS ++++ b/docs/INTERNALS +@@ -43,7 +43,7 @@ Portability + openldap 2.0 + MIT krb5 lib 1.2.4 + qsossl V5R2M0 +- NSS 3.12.x ++ NSS 3.14.x + axTLS 1.2.7 + Heimdal ? + +diff --git a/lib/nss.c b/lib/nss.c +index ff93a38..14a0b0c 100644 +--- a/lib/nss.c ++++ b/lib/nss.c +@@ -1175,9 +1175,7 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) + { + PRErrorCode err = 0; + PRFileDesc *model = NULL; +- PRBool ssl2 = PR_FALSE; +- PRBool ssl3 = PR_FALSE; +- PRBool tlsv1 = PR_FALSE; ++ SSLVersionRange sslver; + PRBool ssl_no_cache; + PRBool ssl_cbc_random_iv; + struct SessionHandle *data = conn->data; +@@ -1251,20 +1249,25 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) + switch (data->set.ssl.version) { + default: + case CURL_SSLVERSION_DEFAULT: +- ssl3 = PR_TRUE; +- if(data->state.ssl_connect_retry) ++ sslver.min = SSL_LIBRARY_VERSION_3_0; ++ if(data->state.ssl_connect_retry) { + infof(data, "TLS disabled due to previous handshake failure\n"); ++ sslver.max = SSL_LIBRARY_VERSION_3_0; ++ } + else +- tlsv1 = PR_TRUE; ++ sslver.max = SSL_LIBRARY_VERSION_TLS_1_0; + break; + case CURL_SSLVERSION_TLSv1: +- tlsv1 = PR_TRUE; ++ sslver.min = SSL_LIBRARY_VERSION_TLS_1_0; ++ sslver.max = SSL_LIBRARY_VERSION_TLS_1_0; + break; + case CURL_SSLVERSION_SSLv2: +- ssl2 = PR_TRUE; ++ sslver.min = SSL_LIBRARY_VERSION_2; ++ sslver.max = SSL_LIBRARY_VERSION_2; + break; + case CURL_SSLVERSION_SSLv3: +- ssl3 = PR_TRUE; ++ sslver.min = SSL_LIBRARY_VERSION_3_0; ++ sslver.max = SSL_LIBRARY_VERSION_3_0; + break; + case CURL_SSLVERSION_TLSv1_0: + case CURL_SSLVERSION_TLSv1_1: +@@ -1274,14 +1277,7 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) + goto error; + } + +- if(SSL_OptionSet(model, SSL_ENABLE_SSL2, ssl2) != SECSuccess) +- goto error; +- if(SSL_OptionSet(model, SSL_ENABLE_SSL3, ssl3) != SECSuccess) +- goto error; +- if(SSL_OptionSet(model, SSL_ENABLE_TLS, tlsv1) != SECSuccess) +- goto error; +- +- if(SSL_OptionSet(model, SSL_V2_COMPATIBLE_HELLO, ssl2) != SECSuccess) ++ if(SSL_VersionRangeSet(model, &sslver) != SECSuccess) + goto error; + + ssl_cbc_random_iv = !data->set.ssl_enable_beast; +@@ -1467,11 +1463,13 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) + if(model) + PR_Close(model); + +- /* cleanup on connection failure */ +- Curl_llist_destroy(connssl->obj_list, NULL); +- connssl->obj_list = NULL; ++ /* cleanup on connection failure */ ++ Curl_llist_destroy(connssl->obj_list, NULL); ++ connssl->obj_list = NULL; + +- if(ssl3 && tlsv1 && isTLSIntoleranceError(err)) { ++ if((sslver.min == SSL_LIBRARY_VERSION_3_0) ++ && (sslver.max == SSL_LIBRARY_VERSION_TLS_1_0) ++ && isTLSIntoleranceError(err)) { + /* schedule reconnect through Curl_retry_request() */ + data->state.ssl_connect_retry = TRUE; + infof(data, "Error in TLS handshake, trying SSLv3...\n"); +-- +1.7.1 + + +From 08398e7a8a8ba4e6fef1557392e3c0104cc3550f Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Mon, 25 Nov 2013 16:14:55 +0100 +Subject: [PATCH 6/9] nss: put SSL version selection into separate fnc + +[upstream commit 4fb8241add5b68e95fbf44d3c2bf470201a9915d] +--- + lib/nss.c | 72 +++++++++++++++++++++++++++++++++++------------------------- + 1 files changed, 42 insertions(+), 30 deletions(-) + +diff --git a/lib/nss.c b/lib/nss.c +index 14a0b0c..2e2240b 100644 +--- a/lib/nss.c ++++ b/lib/nss.c +@@ -1171,6 +1171,46 @@ static CURLcode nss_load_ca_certificates(struct connectdata *conn, + return CURLE_OK; + } + ++static CURLcode nss_init_sslver(SSLVersionRange *sslver, ++ struct SessionHandle *data) ++{ ++ switch (data->set.ssl.version) { ++ default: ++ case CURL_SSLVERSION_DEFAULT: ++ sslver->min = SSL_LIBRARY_VERSION_3_0; ++ if(data->state.ssl_connect_retry) { ++ infof(data, "TLS disabled due to previous handshake failure\n"); ++ sslver->max = SSL_LIBRARY_VERSION_3_0; ++ } ++ else ++ sslver->max = SSL_LIBRARY_VERSION_TLS_1_0; ++ return CURLE_OK; ++ ++ case CURL_SSLVERSION_TLSv1: ++ sslver->min = SSL_LIBRARY_VERSION_TLS_1_0; ++ sslver->max = SSL_LIBRARY_VERSION_TLS_1_0; ++ return CURLE_OK; ++ ++ case CURL_SSLVERSION_SSLv2: ++ sslver->min = SSL_LIBRARY_VERSION_2; ++ sslver->max = SSL_LIBRARY_VERSION_2; ++ return CURLE_OK; ++ ++ case CURL_SSLVERSION_SSLv3: ++ sslver->min = SSL_LIBRARY_VERSION_3_0; ++ sslver->max = SSL_LIBRARY_VERSION_3_0; ++ return CURLE_OK; ++ ++ case CURL_SSLVERSION_TLSv1_0: ++ case CURL_SSLVERSION_TLSv1_1: ++ case CURL_SSLVERSION_TLSv1_2: ++ break; ++ } ++ ++ failf(data, "TLS minor version cannot be set"); ++ return CURLE_SSL_CONNECT_ERROR; ++} ++ + CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) + { + PRErrorCode err = 0; +@@ -1246,37 +1286,9 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) + if(SSL_OptionSet(model, SSL_NO_CACHE, ssl_no_cache) != SECSuccess) + goto error; + +- switch (data->set.ssl.version) { +- default: +- case CURL_SSLVERSION_DEFAULT: +- sslver.min = SSL_LIBRARY_VERSION_3_0; +- if(data->state.ssl_connect_retry) { +- infof(data, "TLS disabled due to previous handshake failure\n"); +- sslver.max = SSL_LIBRARY_VERSION_3_0; +- } +- else +- sslver.max = SSL_LIBRARY_VERSION_TLS_1_0; +- break; +- case CURL_SSLVERSION_TLSv1: +- sslver.min = SSL_LIBRARY_VERSION_TLS_1_0; +- sslver.max = SSL_LIBRARY_VERSION_TLS_1_0; +- break; +- case CURL_SSLVERSION_SSLv2: +- sslver.min = SSL_LIBRARY_VERSION_2; +- sslver.max = SSL_LIBRARY_VERSION_2; +- break; +- case CURL_SSLVERSION_SSLv3: +- sslver.min = SSL_LIBRARY_VERSION_3_0; +- sslver.max = SSL_LIBRARY_VERSION_3_0; +- break; +- case CURL_SSLVERSION_TLSv1_0: +- case CURL_SSLVERSION_TLSv1_1: +- case CURL_SSLVERSION_TLSv1_2: +- failf(data, "TLS minor version cannot be set\n"); +- curlerr = CURLE_SSL_CONNECT_ERROR; ++ /* enable/disable the requested SSL version(s) */ ++ if(nss_init_sslver(&sslver, data) != CURLE_OK) + goto error; +- } +- + if(SSL_VersionRangeSet(model, &sslver) != SECSuccess) + goto error; + +-- +1.7.1 + + +From 91a3d58fc48f0d08ab81f1e013b2d58a7ccd7146 Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Mon, 25 Nov 2013 16:25:15 +0100 +Subject: [PATCH 7/9] nss: allow to use TLS > 1.0 if built against recent NSS + +Bug: http://curl.haxx.se/mail/lib-2013-11/0162.html + +[upstream commit 7fc9325a52a6dad1f8b859a3269472ffc125edd0] +--- + lib/nss.c | 22 ++++++++++++++++++++++ + 1 files changed, 22 insertions(+), 0 deletions(-) + +diff --git a/lib/nss.c b/lib/nss.c +index 2e2240b..5cd33d8 100644 +--- a/lib/nss.c ++++ b/lib/nss.c +@@ -1188,7 +1188,13 @@ static CURLcode nss_init_sslver(SSLVersionRange *sslver, + + case CURL_SSLVERSION_TLSv1: + sslver->min = SSL_LIBRARY_VERSION_TLS_1_0; ++#ifdef SSL_LIBRARY_VERSION_TLS_1_2 ++ sslver->max = SSL_LIBRARY_VERSION_TLS_1_2; ++#elif defined SSL_LIBRARY_VERSION_TLS_1_1 ++ sslver->max = SSL_LIBRARY_VERSION_TLS_1_1; ++#else + sslver->max = SSL_LIBRARY_VERSION_TLS_1_0; ++#endif + return CURLE_OK; + + case CURL_SSLVERSION_SSLv2: +@@ -1202,8 +1208,24 @@ static CURLcode nss_init_sslver(SSLVersionRange *sslver, + return CURLE_OK; + + case CURL_SSLVERSION_TLSv1_0: ++ sslver->min = SSL_LIBRARY_VERSION_TLS_1_0; ++ sslver->max = SSL_LIBRARY_VERSION_TLS_1_0; ++ return CURLE_OK; ++ + case CURL_SSLVERSION_TLSv1_1: ++#ifdef SSL_LIBRARY_VERSION_TLS_1_1 ++ sslver->min = SSL_LIBRARY_VERSION_TLS_1_1; ++ sslver->max = SSL_LIBRARY_VERSION_TLS_1_1; ++ return CURLE_OK; ++#endif ++ break; ++ + case CURL_SSLVERSION_TLSv1_2: ++#ifdef SSL_LIBRARY_VERSION_TLS_1_2 ++ sslver->min = SSL_LIBRARY_VERSION_TLS_1_2; ++ sslver->max = SSL_LIBRARY_VERSION_TLS_1_2; ++ return CURLE_OK; ++#endif + break; + } + +-- +1.7.1 + + +From 404492a5a815b83fab58ce60434c01c270b6bc73 Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Mon, 2 Dec 2013 14:25:07 +0100 +Subject: [PATCH 8/9] nss: unconditionally require NSS_InitContext() + +... since we depend on NSS 3.14+ because of SSL_VersionRangeSet() anyway + +[upstream commit 865666afca926faa1c721020fc54364540caf734] +--- + configure | 12 ------------ + configure.ac | 8 -------- + lib/nss.c | 26 -------------------------- + 3 files changed, 0 insertions(+), 46 deletions(-) + +diff --git a/configure b/configure +index ebde78a..8741e21 100755 +--- a/configure ++++ b/configure +@@ -23697,18 +23697,6 @@ fi + { $as_echo "$as_me:${as_lineno-$LINENO}: detected NSS version $version" >&5 + $as_echo "$as_me: detected NSS version $version" >&6;} + +- ac_fn_c_check_func "$LINENO" "NSS_InitContext" "ac_cv_func_NSS_InitContext" +-if test "x$ac_cv_func_NSS_InitContext" = xyes; then : +- +- +-$as_echo "#define HAVE_NSS_INITCONTEXT 1" >>confdefs.h +- +- HAVE_NSS_INITCONTEXT=1 +- +- +-fi +- +- + if test "x$cross_compiling" != "xyes"; then + LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$nssprefix/lib$libsuff" + export LD_LIBRARY_PATH +diff --git a/configure.ac b/configure.ac +index c81c879..70ef0b7 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -2211,14 +2211,6 @@ if test "$curl_ssl_msg" = "$init_ssl_msg"; then + if test "x$USE_NSS" = "xyes"; then + AC_MSG_NOTICE([detected NSS version $version]) + +- dnl NSS_InitContext() was introduced in NSS 3.12.5 and helps to prevent +- dnl collisions on NSS initialization/shutdown with other libraries +- AC_CHECK_FUNC(NSS_InitContext, +- [ +- AC_DEFINE(HAVE_NSS_INITCONTEXT, 1, [if you have the NSS_InitContext function]) +- AC_SUBST(HAVE_NSS_INITCONTEXT, [1]) +- ]) +- + dnl when shared libs were found in a path that the run-time + dnl linker doesn't search through, we need to add it to + dnl LD_LIBRARY_PATH to prevent further configure tests to fail +diff --git a/lib/nss.c b/lib/nss.c +index 5cd33d8..7b49c20 100644 +--- a/lib/nss.c ++++ b/lib/nss.c +@@ -76,9 +76,7 @@ PRFileDesc *PR_ImportTCPSocket(PRInt32 osfd); + + PRLock * nss_initlock = NULL; + PRLock * nss_crllock = NULL; +-#ifdef HAVE_NSS_INITCONTEXT + NSSInitContext * nss_context = NULL; +-#endif + + volatile int initialized = 0; + +@@ -853,7 +851,6 @@ isTLSIntoleranceError(PRInt32 err) + + static CURLcode nss_init_core(struct SessionHandle *data, const char *cert_dir) + { +-#ifdef HAVE_NSS_INITCONTEXT + NSSInitParameters initparams; + + if(nss_context != NULL) +@@ -861,12 +858,6 @@ static CURLcode nss_init_core(struct SessionHandle *data, const char *cert_dir) + + memset((void *) &initparams, '\0', sizeof(initparams)); + initparams.length = sizeof(initparams); +-#else /* HAVE_NSS_INITCONTEXT */ +- SECStatus rv; +- +- if(NSS_IsInitialized()) +- return CURLE_OK; +-#endif + + if(cert_dir) { + const bool use_sql = NSS_VersionCheck("3.12.0"); +@@ -875,35 +866,22 @@ static CURLcode nss_init_core(struct SessionHandle *data, const char *cert_dir) + return CURLE_OUT_OF_MEMORY; + + infof(data, "Initializing NSS with certpath: %s\n", certpath); +-#ifdef HAVE_NSS_INITCONTEXT + nss_context = NSS_InitContext(certpath, "", "", "", &initparams, + NSS_INIT_READONLY | NSS_INIT_PK11RELOAD); + free(certpath); + + if(nss_context != NULL) + return CURLE_OK; +-#else /* HAVE_NSS_INITCONTEXT */ +- rv = NSS_Initialize(certpath, "", "", "", NSS_INIT_READONLY); +- free(certpath); +- +- if(rv == SECSuccess) +- return CURLE_OK; +-#endif + + infof(data, "Unable to initialize NSS database\n"); + } + + infof(data, "Initializing NSS with certpath: none\n"); +-#ifdef HAVE_NSS_INITCONTEXT + nss_context = NSS_InitContext("", "", "", "", &initparams, NSS_INIT_READONLY + | NSS_INIT_NOCERTDB | NSS_INIT_NOMODDB | NSS_INIT_FORCEOPEN + | NSS_INIT_NOROOTINIT | NSS_INIT_OPTIMIZESPACE | NSS_INIT_PK11RELOAD); + if(nss_context != NULL) + return CURLE_OK; +-#else /* HAVE_NSS_INITCONTEXT */ +- if(NSS_NoDB_Init(NULL) == SECSuccess) +- return CURLE_OK; +-#endif + + infof(data, "Unable to initialize NSS\n"); + return CURLE_SSL_CACERT_BADFILE; +@@ -999,12 +977,8 @@ void Curl_nss_cleanup(void) + SECMOD_DestroyModule(mod); + mod = NULL; + } +-#ifdef HAVE_NSS_INITCONTEXT + NSS_ShutdownContext(nss_context); + nss_context = NULL; +-#else /* HAVE_NSS_INITCONTEXT */ +- NSS_Shutdown(); +-#endif + } + PR_Unlock(nss_initlock); + +-- +1.7.1 + + +From a643c75662b6909a5be1bed8273ed1273ab2b3f4 Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Mon, 2 Dec 2013 16:09:12 +0100 +Subject: [PATCH 9/9] nss: make sure that 'sslver' is always initialized + +[upstream commit e221b55f67a2e12717e911f25d1bb6c85fcebfab] +--- + lib/nss.c | 9 +++++---- + 1 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/lib/nss.c b/lib/nss.c +index 7b49c20..abc8a91 100644 +--- a/lib/nss.c ++++ b/lib/nss.c +@@ -1151,13 +1151,10 @@ static CURLcode nss_init_sslver(SSLVersionRange *sslver, + switch (data->set.ssl.version) { + default: + case CURL_SSLVERSION_DEFAULT: +- sslver->min = SSL_LIBRARY_VERSION_3_0; + if(data->state.ssl_connect_retry) { + infof(data, "TLS disabled due to previous handshake failure\n"); + sslver->max = SSL_LIBRARY_VERSION_3_0; + } +- else +- sslver->max = SSL_LIBRARY_VERSION_TLS_1_0; + return CURLE_OK; + + case CURL_SSLVERSION_TLSv1: +@@ -1211,7 +1208,6 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) + { + PRErrorCode err = 0; + PRFileDesc *model = NULL; +- SSLVersionRange sslver; + PRBool ssl_no_cache; + PRBool ssl_cbc_random_iv; + struct SessionHandle *data = conn->data; +@@ -1223,6 +1219,11 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex) + long time_left; + PRUint32 timeout; + ++ SSLVersionRange sslver = { ++ SSL_LIBRARY_VERSION_3_0, /* min */ ++ SSL_LIBRARY_VERSION_TLS_1_0 /* max */ ++ }; ++ + if(connssl->state == ssl_connection_complete) + return CURLE_OK; + +-- +1.7.1 + diff --git a/0016-curl-7.29.0-1cf71bd7.patch b/0016-curl-7.29.0-1cf71bd7.patch new file mode 100644 index 0000000..31c4e08 --- /dev/null +++ b/0016-curl-7.29.0-1cf71bd7.patch @@ -0,0 +1,27 @@ +From cf8b6a21f1e9af984cfef417e83ca06b64565215 Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Mon, 20 Jan 2014 20:24:05 +0100 +Subject: [PATCH] Curl_is_connected: use proxy name in error message when proxy is used + +Backport of upstream commit 1cf71bd76e4a330e5b7824014c2605e4bfe1a0a5. +--- + lib/connect.c | 3 ++- + 1 files changed, 2 insertions(+), 1 deletions(-) + +diff --git a/lib/connect.c b/lib/connect.c +index 0afb1ee..ba9ab92 100644 +--- a/lib/connect.c ++++ b/lib/connect.c +@@ -758,7 +758,8 @@ CURLcode Curl_is_connected(struct connectdata *conn, + error = SOCKERRNO; + data->state.os_errno = error; + failf(data, "Failed connect to %s:%ld; %s", +- conn->host.name, conn->port, Curl_strerror(conn, error)); ++ conn->bits.proxy?conn->proxy.name:conn->host.name, ++ conn->port, Curl_strerror(conn, error)); + } + + return code; +-- +1.7.1 + diff --git a/0017-curl-7.29.0-ffb8a21d.patch b/0017-curl-7.29.0-ffb8a21d.patch new file mode 100644 index 0000000..5f35a9a --- /dev/null +++ b/0017-curl-7.29.0-ffb8a21d.patch @@ -0,0 +1,36 @@ +From 93b06606d7ee483567770deda967985e8377debb Mon Sep 17 00:00:00 2001 +From: Steve Holme <steve_holme@hotmail.com> +Date: Sun, 2 Feb 2014 11:01:10 +0000 +Subject: [PATCH] tests: Fixed test172 cookie expiry + +The test contains a cookie jar file where one of the cookies has an +expiry date of 1391252187 -- Sat, 1 Feb 2014 10:56:27 GMT which has +now expired. Updated to Wed, 14 Oct 2037 16:36:33 GMT as per test +179. + +Reported-by: Adam Sampson +Bug: http://curl.haxx.se/bug/view.cgi?id=1330 + +[upstream commit ffb8a21d85bde8b626e5dc52ce25f0447ee49f89] + +Signed-off-by: Kamil Dudka <kdudka@redhat.com> +--- + tests/data/test172 | 2 +- + 1 files changed, 1 insertions(+), 1 deletions(-) + +diff --git a/tests/data/test172 b/tests/data/test172 +index b3efae9..3d53418 100644 +--- a/tests/data/test172 ++++ b/tests/data/test172 +@@ -36,7 +36,7 @@ http://%HOSTIP:%HTTPPORT/we/want/172 -b log/jar172.txt -b "tool=curl; name=fool" + + .%HOSTIP TRUE /silly/ FALSE 0 ismatch this + .%HOSTIP TRUE / FALSE 0 partmatch present +-%HOSTIP FALSE /we/want/ FALSE 1391252187 nodomain value ++%HOSTIP FALSE /we/want/ FALSE 2139150993 nodomain value + </file> + </client> + +-- +1.7.1 + diff --git a/0018-curl-7.29.0-03c28820.patch b/0018-curl-7.29.0-03c28820.patch new file mode 100644 index 0000000..09a7391 --- /dev/null +++ b/0018-curl-7.29.0-03c28820.patch @@ -0,0 +1,67 @@ +From fbbbf6a3daa7949cfb0fbd9731a80649ce717e6d Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Fri, 7 Feb 2014 20:28:53 +0100 +Subject: [PATCH 1/2] --help: add missing --tlsv1.x options + +[upstream commit 67d14ab98f8b819ee6f5e6a4a2770d311c6bf13b] + +Signed-off-by: Kamil Dudka <kdudka@redhat.com> +--- + src/tool_help.c | 5 ++++- + 1 files changed, 4 insertions(+), 1 deletions(-) + +diff --git a/src/tool_help.c b/src/tool_help.c +index 124f640..f7cd618 100644 +--- a/src/tool_help.c ++++ b/src/tool_help.c +@@ -199,7 +199,10 @@ static const char *const helptext[] = { + " -t, --telnet-option OPT=VAL Set telnet option", + " --tftp-blksize VALUE Set TFTP BLKSIZE option (must be >512)", + " -z, --time-cond TIME Transfer based on a time condition", +- " -1, --tlsv1 Use TLSv1 (SSL)", ++ " -1, --tlsv1 Use => TLSv1 (SSL)", ++ " --tlsv1.0 Use TLSv1.0 (SSL)", ++ " --tlsv1.1 Use TLSv1.1 (SSL)", ++ " --tlsv1.2 Use TLSv1.2 (SSL)", + " --trace FILE Write a debug trace to the given file", + " --trace-ascii FILE Like --trace but without the hex output", + " --trace-time Add time stamps to trace/verbose output", +-- +1.7.1 + + +From cc28ee70fcc2222646eef4f2b2ab3cc207c6112a Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Mon, 17 Feb 2014 16:55:10 +0100 +Subject: [PATCH 2/2] curl.1: update the description of --tlsv1 + +... and mention the --tlsv1.[0-2] options in the --tslv1 entry + +Reported-by: Hubert Kario + +[upstream commit 03c288202ed159a2a9e953f59e58f69a86eda79b] + +Signed-off-by: Kamil Dudka <kdudka@redhat.com> +--- + docs/curl.1 | 5 ++++- + 1 files changed, 4 insertions(+), 1 deletions(-) + +diff --git a/docs/curl.1 b/docs/curl.1 +index 53b378c..7f3571b 100644 +--- a/docs/curl.1 ++++ b/docs/curl.1 +@@ -117,7 +117,10 @@ more informational, meter. + internally preferred: HTTP 1.1. + .IP "-1, --tlsv1" + (SSL) +-Forces curl to use TLS version 1 when negotiating with a remote TLS server. ++Forces curl to use TLS version 1.x when negotiating with a remote TLS server. ++You can use options \fI--tlsv1.0\fP, \fI--tlsv1.1\fP, and \fI--tlsv1.2\fP to ++control the TLS version more precisely (if the SSL backend in use supports such ++a level of control). + .IP "-2, --sslv2" + (SSL) + Forces curl to use SSL version 2 when negotiating with a remote SSL server. +-- +1.7.1 + diff --git a/0018-curl-7.29.0-517b06d6.patch b/0018-curl-7.29.0-517b06d6.patch new file mode 100644 index 0000000..b56875e --- /dev/null +++ b/0018-curl-7.29.0-517b06d6.patch @@ -0,0 +1,68 @@ +From 46e85fee025964dd9a8ce2d615bc5f8ece530519 Mon Sep 17 00:00:00 2001 +From: Steve Holme <steve_holme@hotmail.com> +Date: Thu, 20 Feb 2014 23:51:36 +0000 +Subject: [PATCH] url: Fixed connection re-use when using different log-in credentials + +In addition to FTP, other connection based protocols such as IMAP, POP3, +SMTP, SCP, SFTP and LDAP require a new connection when different log-in +credentials are specified. Fixed the detection logic to include these +other protocols. + +Bug: http://curl.haxx.se/docs/adv_20140326A.html + +[upstream commit 517b06d657aceb11a234b05cc891170c367ab80d] + +Signed-off-by: Kamil Dudka <kdudka@redhat.com> +--- + lib/http.c | 2 +- + lib/url.c | 6 +++--- + lib/urldata.h | 2 ++ + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/lib/http.c b/lib/http.c +index f4b7a48..c78036b 100644 +--- a/lib/http.c ++++ b/lib/http.c +@@ -142,7 +142,7 @@ const struct Curl_handler Curl_handler_https = { + ZERO_NULL, /* readwrite */ + PORT_HTTPS, /* defport */ + CURLPROTO_HTTP | CURLPROTO_HTTPS, /* protocol */ +- PROTOPT_SSL /* flags */ ++ PROTOPT_SSL | PROTOPT_CREDSPERREQUEST /* flags */ + }; + #endif + +diff --git a/lib/url.c b/lib/url.c +index 9690dfa..0174ff4 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -2961,10 +2961,10 @@ ConnectionExists(struct SessionHandle *data, + continue; + } + } +- if((needle->handler->protocol & CURLPROTO_FTP) || ++ if((!(needle->handler->flags & PROTOPT_CREDSPERREQUEST)) || + ((needle->handler->protocol & CURLPROTO_HTTP) && wantNTLM)) { +- /* This is FTP or HTTP+NTLM, verify that we're using the same name +- and password as well */ ++ /* This protocol requires credentials per connection or is HTTP+NTLM, ++ so verify that we're using the same name and password as well */ + if(!strequal(needle->user, check->user) || + !strequal(needle->passwd, check->passwd)) { + /* one of them was different */ +diff --git a/lib/urldata.h b/lib/urldata.h +index d597c67..cbf4102 100644 +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -755,6 +755,8 @@ struct Curl_handler { + gets a default */ + #define PROTOPT_NOURLQUERY (1<<6) /* protocol can't handle + url query strings (?foo=bar) ! */ ++#define PROTOPT_CREDSPERREQUEST (1<<7) /* requires login creditials per request ++ as opposed to per connection */ + + + /* return the count of bytes sent, or -1 on error */ +-- +1.7.1 + diff --git a/0101-curl-7.27.0-multilib.patch b/0101-curl-7.29.0-multilib.patch index 09acf78..38aa86c 100644 --- a/0101-curl-7.27.0-multilib.patch +++ b/0101-curl-7.29.0-multilib.patch @@ -26,15 +26,15 @@ index 150004d..95d0759 100644 - CURLLIBDIR="" - fi - if test "X@REQUIRE_LIB_DEPS@" = "Xyes"; then -- echo ${CURLLIBDIR}-lcurl @LIBCURL_LIBS@ @LIBS@ +- echo ${CURLLIBDIR}-lcurl @LIBCURL_LIBS@ - else -- echo ${CURLLIBDIR}-lcurl @LIBS@ +- echo ${CURLLIBDIR}-lcurl - fi + pkg-config libcurl --libs ;; --static-libs) -- echo @libdir@/libcurl.@libext@ @LDFLAGS@ @LIBCURL_LIBS@ @LIBS@ +- echo @libdir@/libcurl.@libext@ @LDFLAGS@ @LIBCURL_LIBS@ ;; --configure) diff --git a/0102-curl-7.27.0-debug.patch b/0102-curl-7.29.0-debug.patch index 0f10d40..7f70530 100644 --- a/0102-curl-7.27.0-debug.patch +++ b/0102-curl-7.29.0-debug.patch @@ -1,12 +1,18 @@ - configure | 15 ++++----------- - m4/curl-compilers.m4 | 15 ++++----------- - 2 files changed, 8 insertions(+), 22 deletions(-) +From 6710648c2b270c9ce68a7d9f1bba1222c7be8b58 Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Wed, 31 Oct 2012 11:38:30 +0100 +Subject: [PATCH] prevent configure script from discarding -g in CFLAGS (#496778) + +--- + configure | 13 +++---------- + m4/curl-compilers.m4 | 13 +++---------- + 2 files changed, 6 insertions(+), 20 deletions(-) diff --git a/configure b/configure -index d3ecf69..6d8f085 100755 +index 8f079a3..53b4774 100755 --- a/configure +++ b/configure -@@ -15093,18 +15093,11 @@ $as_echo "yes" >&6; } +@@ -15759,18 +15759,11 @@ $as_echo "yes" >&6; } gccvhi=`echo $gccver | cut -d . -f1` gccvlo=`echo $gccver | cut -d . -f2` compiler_num=`(expr $gccvhi "*" 100 + $gccvlo) 2>/dev/null` @@ -20,17 +26,16 @@ index d3ecf69..6d8f085 100755 - flags_dbg_all="$flags_dbg_all -gvms" + flags_dbg_all="" flags_dbg_yes="-g" -- flags_dbg_off="-g0" + flags_dbg_off="" - flags_opt_all="-O -O0 -O1 -O2 -O3 -Os" - flags_opt_yes="-O2" -+ flags_dbg_off="" + flags_opt_all="" + flags_opt_yes="" flags_opt_off="-O0" if test -z "$SED"; then diff --git a/m4/curl-compilers.m4 b/m4/curl-compilers.m4 -index 1ea4d17..868d65a 100644 +index 0cbba7a..9175b5b 100644 --- a/m4/curl-compilers.m4 +++ b/m4/curl-compilers.m4 @@ -148,18 +148,11 @@ AC_DEFUN([CURL_CHECK_COMPILER_GNU_C], [ @@ -47,12 +52,14 @@ index 1ea4d17..868d65a 100644 - flags_dbg_all="$flags_dbg_all -gvms" + flags_dbg_all="" flags_dbg_yes="-g" -- flags_dbg_off="-g0" + flags_dbg_off="" - flags_opt_all="-O -O0 -O1 -O2 -O3 -Os" - flags_opt_yes="-O2" -+ flags_dbg_off="" + flags_opt_all="" + flags_opt_yes="" flags_opt_off="-O0" CURL_CHECK_DEF([_WIN32], [], [silent]) else +-- +1.7.1 + diff --git a/0105-curl-7.32.0-scp-upload.patch b/0105-curl-7.32.0-scp-upload.patch new file mode 100644 index 0000000..c0fb0bf --- /dev/null +++ b/0105-curl-7.32.0-scp-upload.patch @@ -0,0 +1,42 @@ +From 2e973be50f75d0a85dcb995f7823f00b1fc85c2f Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Mon, 7 Oct 2013 16:07:50 +0200 +Subject: [PATCH] ssh: improve the logic for detecting blocking direction + +This fixes a regression introduced by commit 0feeab78 limiting the speed +of SCP upload to 16384 B/s on a fast connection (such as localhost). + +[upstream commit d015f4ccac627852869cb45e31ccdc9fbd97dc47] +--- + lib/ssh.c | 8 +++++--- + 1 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/lib/ssh.c b/lib/ssh.c +index 422357b..93c65c3 100644 +--- a/lib/ssh.c ++++ b/lib/ssh.c +@@ -2287,6 +2287,10 @@ static CURLcode ssh_statemach_act(struct connectdata *conn, bool *block) + sshc->actualcode = result; + } + else { ++ /* store this original bitmask setup to use later on if we can't ++ figure out a "real" bitmask */ ++ sshc->orig_waitfor = data->req.keepon; ++ + /* we want to use the _sending_ function even when the socket turns + out readable as the underlying libssh2 scp send function will deal + with both accordingly */ +@@ -2603,9 +2607,7 @@ static void ssh_block2waitfor(struct connectdata *conn, bool block) + { + struct ssh_conn *sshc = &conn->proto.sshc; + int dir; +- if(!block) +- conn->waitfor = 0; +- else if((dir = libssh2_session_block_directions(sshc->ssh_session))) { ++ if(block && (dir = libssh2_session_block_directions(sshc->ssh_session))) { + /* translate the libssh2 define bits into our own bit defines */ + conn->waitfor = ((dir&LIBSSH2_SESSION_BLOCK_INBOUND)?KEEP_RECV:0) | + ((dir&LIBSSH2_SESSION_BLOCK_OUTBOUND)?KEEP_SEND:0); +-- +1.7.1 + diff --git a/0108-curl-7.27.0-utf8.patch b/0108-curl-7.27.0-utf8.patch deleted file mode 100644 index b740b17..0000000 --- a/0108-curl-7.27.0-utf8.patch +++ /dev/null @@ -1,86 +0,0 @@ - CHANGES | 16 ++++++++-------- - README | 2 +- - 2 files changed, 9 insertions(+), 9 deletions(-) - -diff --git a/CHANGES b/CHANGES -index 2335841..d4d37c2 100644 ---- a/CHANGES -+++ b/CHANGES -@@ -272,7 +272,7 @@ Daniel Stenberg (9 Jul 2012) - - - cookie: fixed typo in comment - --- [Christian Hägele brought this change] -+- [Christian Hägele brought this change] - - https_getsock: provided for schannel backend as well - -@@ -454,7 +454,7 @@ Yang Tse (3 Jul 2012) - testcurl.pl: fix missing semicolon - - Daniel Stenberg (2 Jul 2012) --- [Christian Hägele brought this change] -+- [Christian Hägele brought this change] - - unicode NTLM SSPI: heap corruption fixed - -@@ -2563,18 +2563,18 @@ Daniel Stenberg (1 Apr 2012) - Reported by: Michael Wallner - - Steve Holme (31 Mar 2012) --- [Gökhan Şengün brought this change] -+- [Gökhan Åengün brought this change] - - smtp: Add support for DIGEST-MD5 authentication - --- [Gökhan Şengün brought this change] -+- [Gökhan Åengün brought this change] - - smtp: Cody tidy up of md5 digest length - - Replaced the hard coded md5 digest length (16) with a preprocessor - constant - --- [Gökhan Şengün brought this change] -+- [Gökhan Åengün brought this change] - - md5: Add support for calculating the md5 sum of buffers incrementally - -@@ -3866,7 +3866,7 @@ Daniel Stenberg (20 Dec 2011) - This offers an alternative to the existing Curl_socket_ready() API which - only checks one socket for read and one for write. - --- [Cédric Deltheil brought this change] -+- [CeÌdric Deltheil brought this change] - - curl.h: add __ANDROID__ macro check - -@@ -4079,7 +4079,7 @@ Daniel Stenberg (12 Dec 2011) - linking with a static openssl requires a set of more libs to be linked - on Windows. - -- Thanks also to Steve Holme and Martin Storsj for additional feedback. -+ Thanks also to Steve Holme and Martin Storsjö for additional feedback. - - Bug: http://curl.haxx.se/mail/lib-2011-12/0063.html - Reported by: Ward Willats -@@ -5333,7 +5333,7 @@ Daniel Stenberg (25 Sep 2011) - damaging. - - Bug: http://curl.haxx.se/bug/view.cgi?id=3413181 -- Reported by: Taneli Vhkangas -+ Reported by: Taneli Vähäkangas - - Yang Tse (24 Sep 2011) - - curl tool: fix a compiler warning -diff --git a/README b/README -index 2ffacc3..cfd6760 100644 ---- a/README -+++ b/README -@@ -45,5 +45,5 @@ GIT - NOTICE - - Curl contains pieces of source code that is Copyright (c) 1998, 1999 -- Kungliga Tekniska Hgskolan. This notice is included here to comply with the -+ Kungliga Tekniska Högskolan. This notice is included here to comply with the - distribution terms. diff --git a/0108-curl-7.29.0-utf8.patch b/0108-curl-7.29.0-utf8.patch new file mode 100644 index 0000000..4829d1f --- /dev/null +++ b/0108-curl-7.29.0-utf8.patch @@ -0,0 +1,39 @@ +From c6246783cf347652f70d95c0562dd411747e9d53 Mon Sep 17 00:00:00 2001 +From: Kamil Dudka <kdudka@redhat.com> +Date: Wed, 31 Oct 2012 11:40:30 +0100 +Subject: [PATCH] Fix character encoding of docs + +..., which are of mixed encoding originally so a simple iconv can't +fix them. +--- + CHANGES | 2 +- + README | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/CHANGES b/CHANGES +index 4568408..5fc1652 100644 +--- a/CHANGES ++++ b/CHANGES +@@ -1910,7 +1910,7 @@ Daniel Stenberg (12 Nov 2012) + + - [Gabriel Sjoberg brought this change] + +- Digst: Add microseconds into nounce calculation ++ Digest: Add microseconds into nounce calculation + + When using only 1 second precision, curl doesn't create new cnonce + values quickly enough for all uses. +diff --git a/README b/README +index 2ffacc3..cfd6760 100644 +--- a/README ++++ b/README +@@ -45,5 +45,5 @@ GIT + NOTICE + + Curl contains pieces of source code that is Copyright (c) 1998, 1999 +- Kungliga Tekniska Hgskolan. This notice is included here to comply with the ++ Kungliga Tekniska Högskolan. This notice is included here to comply with the + distribution terms. +-- +1.7.1 + diff --git a/0201-curl-7.29.0-openssl.patch b/0201-curl-7.29.0-openssl.patch new file mode 100644 index 0000000..984d916 --- /dev/null +++ b/0201-curl-7.29.0-openssl.patch @@ -0,0 +1,31 @@ +--- ./lib/ssluse.c.old 2014-12-20 08:10:34.590020955 +0100 ++++ ./lib/ssluse.c 2014-12-20 08:12:24.143382067 +0100 +@@ -1524,20 +1524,28 @@ + case CURL_SSLVERSION_TLSv1_0: + ctx_options |= SSL_OP_NO_SSLv2; + ctx_options |= SSL_OP_NO_SSLv3; ++#ifdef SSL_OP_NO_TLSv1_1 + ctx_options |= SSL_OP_NO_TLSv1_1; ++#endif ++#ifdef SSL_OP_NO_TLSv1_2 + ctx_options |= SSL_OP_NO_TLSv1_2; ++#endif + break; + case CURL_SSLVERSION_TLSv1_1: + ctx_options |= SSL_OP_NO_SSLv2; + ctx_options |= SSL_OP_NO_SSLv3; + ctx_options |= SSL_OP_NO_TLSv1; ++#ifdef SSL_OP_NO_TLSv1_2 + ctx_options |= SSL_OP_NO_TLSv1_2; ++#endif + break; + case CURL_SSLVERSION_TLSv1_2: + ctx_options |= SSL_OP_NO_SSLv2; + ctx_options |= SSL_OP_NO_SSLv3; + ctx_options |= SSL_OP_NO_TLSv1; ++#ifdef SSL_OP_NO_TLSv1_1 + ctx_options |= SSL_OP_NO_TLSv1_1; ++#endif + break; + } + @@ -1,63 +1,77 @@ +# Define %%{__isa_bits} for old releases +%{!?__isa_bits: %global __isa_bits %((echo '#include <bits/wordsize.h>'; echo __WORDSIZE) | cpp - | grep -Ex '32|64')} + Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Name: curl -Version: 7.27.0 -Release: 11%{?dist} +Version: 7.29.0 +Release: 19%{?dist} License: MIT Group: Applications/Internet -Source: http://curl.haxx.se/download/%{name}-%{version}.tar.bz2 +Source: http://curl.haxx.se/download/%{name}-%{version}.tar.lzma Source2: curlbuild.h -Source3: hide_selinux.c -# eliminate unnecessary inotify events on upload via file protocol (#844385) -Patch1: 0001-curl-7.27.0-1f8518c5.patch +# fix a SIGSEGV when closing an unused multi handle (#914411) +Patch1: 0001-curl-7.29.0-da3fc1ee.patch -# do not crash if MD5 fingerprint is not provided by libssh2 -Patch2: 0002-curl-7.27.0-f05e5136.patch +# switch SSL socket into non-blocking mode after handshake +Patch2: 0002-curl-7.29.0-9d0af301.patch -# fix a syntax error in curl-config (#871317) -Patch3: 0003-curl-7.27.0-382429e7.patch +# do not ignore poll() failures other than EINTR +Patch3: 0003-curl-7.29.0-491e026c.patch -# do not print misleading NSS error codes -Patch4: 0004-curl-7.27.0-52b6eda4.patch +# curl_global_init() now accepts the CURL_GLOBAL_ACK_EINTR flag +Patch4: 0004-curl-7.29.0-57ccdfa8.patch -# update the links to cipher-suites supported by NSS -Patch5: 0005-curl-7.27.0-f208bf5a.patch +# fix cookie tailmatching to prevent cross-domain leakage (CVE-2013-1944) +Patch5: 0005-curl-7.29.0-2eb8dcf2.patch -# prevent NSS from crashing on client auth hook failure -Patch6: 0006-curl-7.27.0-68d2830e.patch +# show proper host name on failed resolve (#957173) +Patch6: 0006-curl-7.29.0-25e577b3.patch -# clear session cache if a client cert from file is used -Patch7: 0007-curl-7.27.0-b36f1d26.patch +# prevent an artificial timeout event due to stale speed-check data (#906031) +Patch7: 0007-curl-7.29.0-b37b5233.patch -# fix error messages for CURLE_SSL_{CACERT,CRL}_BADFILE -Patch8: 0008-curl-7.27.0-26613d78.patch +# fix heap-based buffer overflow in curl_easy_unescape() (CVE-2013-2174) +Patch8: 0008-curl-7.29.0-192c4f78.patch -# fix buffer overflow when negotiating SASL DIGEST-MD5 auth (CVE-2013-0249) -Patch9: 0009-curl-7.27.0-f206d6c0.patch +# mention all option listed in 'curl --help' in curl.1 man page +Patch9: 0009-curl-7.29.0-3a0e931f.patch -# curl_global_init() now accepts the CURL_GLOBAL_ACK_EINTR flag -Patch10: 0010-curl-7.27.0-57ccdfa8.patch +# FTP: when EPSV gets a 229 but fails to connect, retry with PASV (#1002815) +Patch10: 0010-curl-7.29.0-7cc00d9a.patch -# fix cookie tailmatching to prevent cross-domain leakage (CVE-2013-1944) -Patch11: 0011-curl-7.27.0-2eb8dcf2.patch +# avoid a busy-loop in curl_easy_perform() +Patch11: 0011-curl-7.29.0-0feeab78.patch -# show proper host name on failed resolve (#957173) -Patch12: 0012-curl-7.27.0-25e577b3.patch +# avoid delay if FTP is aborted in CURLOPT_HEADERFUNCTION callback (#1005686) +Patch12: 0012-curl-7.29.0-c639d725.patch -# prevent an artificial timeout event due to stale speed-check data (#906031) -Patch13: 0013-curl-7.27.0-b37b5233.patch +# allow to use ECC ciphers if NSS implements them (#1058776) +Patch13: 0013-curl-7.29.0-665c160f.patch -# switch SSL socket into non-blocking mode after handshake (#960765) -Patch14: 0014-curl-7.27.0-9d0af301.patch +# re-use of wrong HTTP NTLM connection in libcurl (CVE-2014-0015) +Patch14: 0014-curl-7.29.0-8ae35102.patch -# fix heap-based buffer overflow in curl_easy_unescape() (CVE-2013-2174) -Patch15: 0015-curl-7.27.0-192c4f78.patch +# allow to use TLS > 1.0 if built against recent NSS (#1036789) +Patch15: 0015-curl-7.29.0-7fc9325a.patch + +# use proxy name in error message when proxy is used (#1042831) +Patch16: 0016-curl-7.29.0-1cf71bd7.patch + +# refresh expired cookie in test172 from upstream test-suite (#1063693) +Patch17: 0017-curl-7.29.0-ffb8a21d.patch + +# fix documentation of curl's options --tlsv1.[0-2] (#1066364) +Patch18: 0018-curl-7.29.0-03c28820.patch + +# fix connection re-use when using different log-in credentials (CVE-2014-0138) +Patch19: 0018-curl-7.29.0-517b06d6.patch # patch making libcurl multilib ready -Patch101: 0101-curl-7.27.0-multilib.patch +Patch101: 0101-curl-7.29.0-multilib.patch # prevent configure script from discarding -g in CFLAGS (#496778) -Patch102: 0102-curl-7.27.0-debug.patch +Patch102: 0102-curl-7.29.0-debug.patch # use localhost6 instead of ip6-localhost in the curl test-suite Patch104: 0104-curl-7.19.7-localhost6.patch @@ -65,20 +79,26 @@ Patch104: 0104-curl-7.19.7-localhost6.patch # disable valgrind for certain test-cases (libssh2 problem) Patch106: 0106-curl-7.21.0-libssh2-valgrind.patch +# http://thread.gmane.org/gmane.comp.web.curl.library/40551/focus=40561 +Patch105: 0105-curl-7.32.0-scp-upload.patch + # work around valgrind bug (#678518) Patch107: 0107-curl-7.21.4-libidn-valgrind.patch # Fix character encoding of docs, which are of mixed encoding originally so # a simple iconv can't fix them -Patch108: 0108-curl-7.27.0-utf8.patch +Patch108: 0108-curl-7.29.0-utf8.patch + +# For old openssl in EL-5 +Patch201: 0201-curl-7.29.0-openssl.patch Provides: webclient URL: http://curl.haxx.se/ -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(id -nu) BuildRequires: groff BuildRequires: krb5-devel BuildRequires: libidn-devel -BuildRequires: libssh2-devel >= 1.2.0 +BuildRequires: libssh2-devel BuildRequires: openssl-devel BuildRequires: openldap-devel >= %{openldap_version} BuildRequires: openssh-clients @@ -87,8 +107,23 @@ BuildRequires: pkgconfig BuildRequires: stunnel BuildRequires: zlib-devel -# valgrind is not available on s390(x), sparc or arm5 -%ifnarch s390 s390x %{sparc} %{arm} ppc +# perl modules used in the test suite +BuildRequires: perl(Cwd) +BuildRequires: perl(Digest::MD5) +BuildRequires: perl(Exporter) +BuildRequires: perl(File::Basename) +BuildRequires: perl(File::Copy) +BuildRequires: perl(File::Spec) +BuildRequires: perl(IPC::Open2) +BuildRequires: perl(MIME::Base64) +BuildRequires: perl(strict) +BuildRequires: perl(Time::Local) +BuildRequires: perl(Time::HiRes) +BuildRequires: perl(warnings) +BuildRequires: perl(vars) + +# require valgrind to boost test coverage on i386 and x86_64 +%ifarch %{ix86} x86_64 BuildRequires: valgrind %endif @@ -165,6 +200,11 @@ documentation of the library, too. %patch13 -p1 %patch14 -p1 %patch15 -p1 +%patch16 -p1 +%patch17 -p1 +%patch18 -p1 +%patch105 -p1 +%patch19 -p1 # Fedora patches %patch101 -p1 @@ -174,12 +214,13 @@ documentation of the library, too. %patch107 -p1 %patch108 -p1 +# For EL-5 with old openssl +%patch201 -p1 + # replace hard wired port numbers in the test suite -%ifarch x86_64 -sed -i s/899\\\([0-9]\\\)/649\\1/ tests/data/test* -%else -sed -i s/899\\\([0-9]\\\)/329\\1/ tests/data/test* -%endif +cd tests/data/ +sed -i s/899\\\([0-9]\\\)/%{?__isa_bits}9\\1/ test* +cd - # disable test 1112 (#565305) printf "1112\n" >> tests/data/DISABLED @@ -189,7 +230,6 @@ printf "1112\n" >> tests/data/DISABLED echo "1319" >> tests/data/DISABLED %endif - %build [ -x /usr/kerberos/bin/krb5-config ] && KRB5_PREFIX="=/usr/kerberos" %configure --disable-static \ @@ -224,23 +264,9 @@ export LD_LIBRARY_PATH cd tests make %{?_smp_mflags} -# make it possible to start a testing OpenSSH server with SELinux -# in the enforcing mode (#521087) -gcc -o hide_selinux.so -fPIC -shared %{SOURCE3} -LD_PRELOAD="`readlink -f ./hide_selinux.so`:$LD_PRELOAD" -export LD_PRELOAD - -# Ignore this tests for now (use !xxx) -DISABLED= - # use different port range for 32bit and 64bit build, thus make it possible # to run both in parallel on the same machine -%ifarch x86_64 -./runtests.pl -a -b6490 -p -v $DISABLED -%else -./runtests.pl -a -b3290 -p -v $DISABLED -%endif - +./runtests.pl -a -b%{?__isa_bits}90 -p -v %install rm -rf $RPM_BUILD_ROOT @@ -256,7 +282,7 @@ install -m 644 docs/libcurl/libcurl.m4 $RPM_BUILD_ROOT%{_datadir}/aclocal rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/mk-ca-bundle.1 # Make libcurl-devel multilib-ready (bug #488922) -%ifarch x86_64 +%if 0%{?__isa_bits} == 64 %define _curlbuild_h curlbuild-64.h %else %define _curlbuild_h curlbuild-32.h @@ -299,6 +325,9 @@ rm -rf $RPM_BUILD_ROOT %{_datadir}/aclocal/libcurl.m4 %changelog +* Sat Dec 20 2014 Remi Collet <RPMS@FamilleCollet.com> - 7.29.0-19 +- sync with 7.29.0-19 from RHEL-7: + * Mon Jun 24 2013 Remi Collet <RPMS@FamilleCollet.com> - 7.27.0-11 - sync with 7.27.0-11 from F18: fix heap-based buffer overflow in curl_easy_unescape() (CVE-2013-2174) |