config LIBCURL_MBEDTLS
bool "mbed TLS"
- config LIBCURL_CYASSL
- bool "CyaSSL"
+ config LIBCURL_WOLFSSL
+ bool "wolfSSL"
config LIBCURL_OPENSSL
bool "OpenSSL"
bool "TFTP protocol"
default n
+config LIBCURL_NGHTTP2
+ bool "HTTP2 protocol"
+ default n
+
comment "Miscellaneous"
config LIBCURL_PROXY
bool "Enable TLS-SRP authentication"
default n
-config LIBCURL_LIBIDN
- bool "Enable IDN support"
+config LIBCURL_LIBIDN2
+ bool "Enable IDN2 support"
default n
config LIBCURL_THREADED_RESOLVER
include $(TOPDIR)/rules.mk
PKG_NAME:=curl
-PKG_VERSION:=7.52.1
-PKG_RELEASE:=8
-
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
-PKG_SOURCE_URL:=http://curl.haxx.se/download/ \
- http://www.mirrorspace.org/curl/ \
- ftp://ftp.sunet.se/pub/www/utilities/curl/ \
- ftp://ftp.planetmirror.com/pub/curl/ \
- http://www.mirrormonster.com/curl/download/ \
- http://curl.mirrors.cyberservers.net/download/
-PKG_HASH:=d16185a767cb2c1ba3d5b9096ec54e5ec198b213f45864a38b3bda4bbf87389b
+PKG_VERSION:=7.60.0
+PKG_RELEASE:=3
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=https://dl.uxnr.de/mirror/curl/ \
+ http://curl.mirror.anstey.ca/ \
+ http://curl.askapache.com/download/ \
+ https://curl.haxx.se/download/
+PKG_HASH:=8736ff8ded89ddf7e926eec7b16f82597d029fc1469f3a551f1fafaac164e6a0
PKG_LICENSE:=MIT
PKG_LICENSE_FILES:=COPYING
+PKG_CPE_ID:=cpe:/a:haxx:libcurl
PKG_FIXUP:=autoreconf
PKG_BUILD_PARALLEL:=1
PKG_CONFIG_DEPENDS:= \
CONFIG_IPV6 \
\
- CONFIG_LIBCURL_CYASSL \
+ CONFIG_LIBCURL_WOLFSSL \
CONFIG_LIBCURL_GNUTLS \
CONFIG_LIBCURL_OPENSSL \
CONFIG_LIBCURL_MBEDTLS \
CONFIG_LIBCURL_NOSSL \
\
- CONFIG_LIBCURL_LIBIDN \
+ CONFIG_LIBCURL_LIBIDN2 \
CONFIG_LIBCURL_SSH2 \
CONFIG_LIBCURL_ZLIB \
\
CONFIG_LIBCURL_SMTP \
CONFIG_LIBCURL_TELNET \
CONFIG_LIBCURL_TFTP \
+ CONFIG_LIBCURL_NGHTTP2 \
\
CONFIG_LIBCURL_COOKIES \
CONFIG_LIBCURL_CRYPTO_AUTH \
$(call Package/curl/Default)
SECTION:=libs
CATEGORY:=Libraries
- DEPENDS:= +LIBCURL_CYASSL:libcyassl +LIBCURL_OPENSSL:libopenssl +LIBCURL_GNUTLS:libgnutls +LIBCURL_MBEDTLS:libmbedtls
- DEPENDS += +LIBCURL_ZLIB:zlib +LIBCURL_THREADED_RESOLVER:libpthread +LIBCURL_LDAP:libopenldap +LIBCURL_LIBIDN:libidn +LIBCURL_SSH2:libssh2
+ DEPENDS:= +LIBCURL_WOLFSSL:libwolfssl +LIBCURL_OPENSSL:libopenssl +LIBCURL_GNUTLS:libgnutls +LIBCURL_MBEDTLS:libmbedtls
+ DEPENDS += +LIBCURL_ZLIB:zlib +LIBCURL_THREADED_RESOLVER:libpthread +LIBCURL_LDAP:libopenldap +LIBCURL_LIBIDN2:libidn2
+ DEPENDS += +LIBCURL_SSH2:libssh2 +LIBCURL_NGHTTP2:libnghttp2
TITLE:=A client-side URL transfer library
MENU:=1
endef
--without-nss \
--without-libmetalink \
--without-librtmp \
+ --without-libidn \
\
$(call autoconf_bool,CONFIG_IPV6,ipv6) \
\
- $(if $(CONFIG_LIBCURL_CYASSL),--with-cyassl="$(STAGING_DIR)/usr" --without-ca-path --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt,--without-cyassl) \
+ $(if $(CONFIG_LIBCURL_WOLFSSL),--with-cyassl="$(STAGING_DIR)/usr" --without-ca-path --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt,--without-cyassl) \
$(if $(CONFIG_LIBCURL_GNUTLS),--with-gnutls="$(STAGING_DIR)/usr" --without-ca-bundle --with-ca-path=/etc/ssl/certs,--without-gnutls) \
$(if $(CONFIG_LIBCURL_OPENSSL),--with-ssl="$(STAGING_DIR)/usr" --without-ca-bundle --with-ca-path=/etc/ssl/certs,--without-ssl) \
$(if $(CONFIG_LIBCURL_MBEDTLS),--with-mbedtls="$(STAGING_DIR)/usr" --without-ca-path --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt,--without-mbedtls) \
\
- $(if $(CONFIG_LIBCURL_LIBIDN),--with-libidn="$(STAGING_DIR)/usr",--without-libidn) \
+ $(if $(CONFIG_LIBCURL_LIBIDN2),--with-libidn2="$(STAGING_DIR)/usr",--without-libidn2) \
$(if $(CONFIG_LIBCURL_SSH2),--with-libssh2="$(STAGING_DIR)/usr",--without-libssh2) \
$(if $(CONFIG_LIBCURL_ZLIB),--with-zlib="$(STAGING_DIR)/usr",--without-zlib) \
+ $(if $(CONFIG_LIBCURL_NGHTTP2),--with-nghttp2="$(STAGING_DIR)/usr",--without-nghttp2) \
\
$(call autoconf_bool,CONFIG_LIBCURL_DICT,dict) \
$(call autoconf_bool,CONFIG_LIBCURL_FILE,file) \
+++ /dev/null
-From a7b38c9dc98481e4a5fc37e51a8690337c674dfb Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Mon, 26 Dec 2016 00:06:33 +0100
-Subject: [PATCH] vtls: s/SSLEAY/OPENSSL
-
-Fixed an old leftover use of the USE_SSLEAY define which would make a
-socket get removed from the applications sockets to monitor when the
-multi_socket API was used, leading to timeouts.
-
-Bug: #1174
----
- lib/vtls/vtls.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/lib/vtls/vtls.c
-+++ b/lib/vtls/vtls.c
-@@ -484,7 +484,7 @@ void Curl_ssl_close_all(struct Curl_easy
- curlssl_close_all(data);
- }
-
--#if defined(USE_SSLEAY) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \
-+#if defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \
- defined(USE_DARWINSSL) || defined(USE_NSS)
- /* This function is for OpenSSL, GnuTLS, darwinssl, and schannel only. */
- int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks,
-@@ -518,7 +518,7 @@ int Curl_ssl_getsock(struct connectdata
- (void)numsocks;
- return GETSOCK_BLANK;
- }
--/* USE_SSLEAY || USE_GNUTLS || USE_SCHANNEL || USE_DARWINSSL || USE_NSS */
-+/* USE_OPENSSL || USE_GNUTLS || USE_SCHANNEL || USE_DARWINSSL || USE_NSS */
- #endif
-
- void Curl_ssl_close(struct connectdata *conn, int sockindex)
+++ /dev/null
-From a00a42b4abe8363a46071bb3b43b1b7138f5259b Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Sun, 22 Jan 2017 18:11:55 +0100
-Subject: [PATCH] TLS: make SSL_VERIFYSTATUS work again
-
-The CURLOPT_SSL_VERIFYSTATUS option was not properly handled by libcurl
-and thus even if the status couldn't be verified, the connection would
-be allowed and the user would not be told about the failed verification.
-
-Regression since cb4e2be7c6d42ca
-
-CVE-2017-2629
-Bug: https://curl.haxx.se/docs/adv_20170222.html
-
-Reported-by: Marcus Hoffmann
----
- lib/url.c | 3 +++
- 1 file changed, 3 insertions(+)
-
---- a/lib/url.c
-+++ b/lib/url.c
-@@ -4141,8 +4141,11 @@ static struct connectdata *allocate_conn
- conn->bits.ftp_use_epsv = data->set.ftp_use_epsv;
- conn->bits.ftp_use_eprt = data->set.ftp_use_eprt;
-
-+ conn->ssl_config.verifystatus = data->set.ssl.primary.verifystatus;
- conn->ssl_config.verifypeer = data->set.ssl.primary.verifypeer;
- conn->ssl_config.verifyhost = data->set.ssl.primary.verifyhost;
-+ conn->proxy_ssl_config.verifystatus =
-+ data->set.proxy_ssl.primary.verifystatus;
- conn->proxy_ssl_config.verifypeer = data->set.proxy_ssl.primary.verifypeer;
- conn->proxy_ssl_config.verifyhost = data->set.proxy_ssl.primary.verifyhost;
-
+++ /dev/null
-From 6019f1795b4e3b72507b84b0e02dc8c32024f562 Mon Sep 17 00:00:00 2001
-From: Dan Fandrich <dan@coneharvesters.com>
-Date: Sat, 11 Mar 2017 10:59:34 +0100
-Subject: [PATCH] CVE-2017-7407: fixed
-
-Bug: https://curl.haxx.se/docs/adv_20170403.html
-
-Reported-by: Brian Carpenter
----
- src/tool_writeout.c | 6 +++---
- tests/data/Makefile.inc | 2 +-
- tests/data/test1440 | 31 +++++++++++++++++++++++++++++++
- tests/data/test1441 | 31 +++++++++++++++++++++++++++++++
- tests/data/test1442 | 35 +++++++++++++++++++++++++++++++++++
- 5 files changed, 101 insertions(+), 4 deletions(-)
- create mode 100644 tests/data/test1440
- create mode 100644 tests/data/test1441
- create mode 100644 tests/data/test1442
-
---- a/src/tool_writeout.c
-+++ b/src/tool_writeout.c
-@@ -5,7 +5,7 @@
- * | (__| |_| | _ <| |___
- * \___|\___/|_| \_\_____|
- *
-- * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
-+ * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
-@@ -113,7 +113,7 @@ void ourWriteOut(CURL *curl, struct OutS
- double doubleinfo;
-
- while(ptr && *ptr) {
-- if('%' == *ptr) {
-+ if('%' == *ptr && ptr[1]) {
- if('%' == ptr[1]) {
- /* an escaped %-letter */
- fputc('%', stream);
-@@ -341,7 +341,7 @@ void ourWriteOut(CURL *curl, struct OutS
- }
- }
- }
-- else if('\\' == *ptr) {
-+ else if('\\' == *ptr && ptr[1]) {
- switch(ptr[1]) {
- case 'r':
- fputc('\r', stream);
---- a/tests/data/Makefile.inc
-+++ b/tests/data/Makefile.inc
-@@ -150,7 +150,7 @@ test1408 test1409 test1410 test1411 test
- test1416 test1417 test1418 test1419 test1420 test1421 test1422 test1423 \
- test1424 \
- test1428 test1429 test1430 test1431 test1432 test1433 test1434 test1435 \
--test1436 test1437 test1438 test1439 \
-+test1436 test1437 test1438 test1439 test1440 test1441 test1442 \
- \
- test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \
- test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \
---- /dev/null
-+++ b/tests/data/test1440
-@@ -0,0 +1,31 @@
-+<testcase>
-+<info>
-+<keywords>
-+--write-out
-+</keywords>
-+</info>
-+# Server-side
-+<reply>
-+</reply>
-+
-+# Client-side
-+<client>
-+<server>
-+file
-+</server>
-+
-+<name>
-+Check --write-out with trailing %{
-+</name>
-+<command>
-+file://localhost/%PWD/log/ --write-out '%{'
-+</command>
-+</client>
-+
-+# Verify data
-+<verify>
-+<stdout nonewline="yes">
-+%{
-+</stdout>
-+</verify>
-+</testcase>
---- /dev/null
-+++ b/tests/data/test1441
-@@ -0,0 +1,31 @@
-+<testcase>
-+<info>
-+<keywords>
-+--write-out
-+</keywords>
-+</info>
-+# Server-side
-+<reply>
-+</reply>
-+
-+# Client-side
-+<client>
-+<server>
-+file
-+</server>
-+
-+<name>
-+Check --write-out with trailing %
-+</name>
-+<command>
-+file://localhost/%PWD/log/ --write-out '%'
-+</command>
-+</client>
-+
-+# Verify data
-+<verify>
-+<stdout nonewline="yes">
-+%
-+</stdout>
-+</verify>
-+</testcase>
---- /dev/null
-+++ b/tests/data/test1442
-@@ -0,0 +1,35 @@
-+<testcase>
-+<info>
-+<keywords>
-+--write-out
-+FILE
-+</keywords>
-+</info>
-+# Server-side
-+<reply>
-+</reply>
-+
-+# Client-side
-+<client>
-+<server>
-+file
-+</server>
-+
-+<name>
-+Check --write-out with trailing \
-+</name>
-+<command>
-+file://localhost/%PWD/log/non-existent-file.txt --write-out '\'
-+</command>
-+</client>
-+
-+# Verify data
-+<verify>
-+<errorcode>
-+37
-+</errorcode>
-+<stdout nonewline="yes">
-+\
-+</stdout>
-+</verify>
-+</testcase>
+++ /dev/null
-From 8166b637bce299f4ac64d371c20cd5afea72c364 Mon Sep 17 00:00:00 2001
-From: Jay Satiro <raysatiro@yahoo.com>
-Date: Wed, 22 Mar 2017 01:59:49 -0400
-Subject: [PATCH] TLS: Fix switching off SSL session id when client cert is
- used
-
-- Move the sessionid flag to ssl_primary_config so that ssl and
- proxy_ssl will each have their own sessionid flag.
-
-Regression since HTTPS-Proxy support was added in cb4e2be. Prior to that
-this issue had been fixed in 247d890, CVE-2016-5419.
-
-Bug: https://github.com/curl/curl/issues/1341
-Reported-by: lijian996@users.noreply.github.com
----
- lib/url.c | 5 +++--
- lib/urldata.h | 2 +-
- lib/vtls/axtls.c | 4 ++--
- lib/vtls/cyassl.c | 4 ++--
- lib/vtls/darwinssl.c | 2 +-
- lib/vtls/gtls.c | 4 ++--
- lib/vtls/mbedtls.c | 4 ++--
- lib/vtls/nss.c | 2 +-
- lib/vtls/openssl.c | 4 ++--
- lib/vtls/polarssl.c | 4 ++--
- lib/vtls/schannel.c | 4 ++--
- lib/vtls/vtls.c | 9 ++++++---
- 12 files changed, 26 insertions(+), 22 deletions(-)
-
---- a/lib/url.c
-+++ b/lib/url.c
-@@ -548,7 +548,7 @@ CURLcode Curl_init_userdefined(struct Us
- #endif
- set->ssh_auth_types = CURLSSH_AUTH_DEFAULT; /* defaults to any auth
- type */
-- set->general_ssl.sessionid = TRUE; /* session ID caching enabled by
-+ set->ssl.primary.sessionid = TRUE; /* session ID caching enabled by
- default */
- set->proxy_ssl = set->ssl;
-
-@@ -2470,8 +2470,9 @@ CURLcode Curl_setopt(struct Curl_easy *d
- break;
-
- case CURLOPT_SSL_SESSIONID_CACHE:
-- data->set.general_ssl.sessionid = (0 != va_arg(param, long)) ?
-+ data->set.ssl.primary.sessionid = (0 != va_arg(param, long)) ?
- TRUE : FALSE;
-+ data->set.proxy_ssl.primary.sessionid = data->set.ssl.primary.sessionid;
- break;
-
- #ifdef USE_LIBSSH2
---- a/lib/urldata.h
-+++ b/lib/urldata.h
-@@ -354,6 +354,7 @@ struct ssl_primary_config {
- char *random_file; /* path to file containing "random" data */
- char *egdsocket; /* path to file containing the EGD daemon socket */
- char *cipher_list; /* list of ciphers to use */
-+ bool sessionid; /* cache session IDs or not */
- };
-
- struct ssl_config_data {
-@@ -383,7 +384,6 @@ struct ssl_config_data {
- };
-
- struct ssl_general_config {
-- bool sessionid; /* cache session IDs or not */
- size_t max_ssl_sessions; /* SSL session id cache size */
- };
-
---- a/lib/vtls/axtls.c
-+++ b/lib/vtls/axtls.c
-@@ -256,7 +256,7 @@ static CURLcode connect_prep(struct conn
- * 2) setting up callbacks. these seem gnutls specific
- */
-
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- const uint8_t *ssl_sessionid;
- size_t ssl_idsize;
-
-@@ -386,7 +386,7 @@ static CURLcode connect_finish(struct co
- conn->send[sockindex] = axtls_send;
-
- /* Put our freshly minted SSL session in cache */
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- const uint8_t *ssl_sessionid = ssl_get_session_id_size(ssl);
- size_t ssl_idsize = ssl_get_session_id(ssl);
- Curl_ssl_sessionid_lock(conn);
---- a/lib/vtls/cyassl.c
-+++ b/lib/vtls/cyassl.c
-@@ -383,7 +383,7 @@ cyassl_connect_step1(struct connectdata
- #endif /* HAVE_ALPN */
-
- /* Check if there's a cached ID we can/should use here! */
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- void *ssl_sessionid = NULL;
-
- Curl_ssl_sessionid_lock(conn);
-@@ -597,7 +597,7 @@ cyassl_connect_step3(struct connectdata
-
- DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
-
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- bool incache;
- SSL_SESSION *our_ssl_sessionid;
- void *old_ssl_sessionid = NULL;
---- a/lib/vtls/darwinssl.c
-+++ b/lib/vtls/darwinssl.c
-@@ -1541,7 +1541,7 @@ static CURLcode darwinssl_connect_step1(
- #endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */
-
- /* Check if there's a cached ID we can/should use here! */
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- char *ssl_sessionid;
- size_t ssl_sessionid_len;
-
---- a/lib/vtls/gtls.c
-+++ b/lib/vtls/gtls.c
-@@ -782,7 +782,7 @@ gtls_connect_step1(struct connectdata *c
-
- /* This might be a reconnect, so we check for a session ID in the cache
- to speed up things */
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- void *ssl_sessionid;
- size_t ssl_idsize;
-
-@@ -1311,7 +1311,7 @@ gtls_connect_step3(struct connectdata *c
- conn->recv[sockindex] = gtls_recv;
- conn->send[sockindex] = gtls_send;
-
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- /* we always unconditionally get the session id here, as even if we
- already got it from the cache and asked to use it in the connection, it
- might've been rejected and then a new one is in use now and we need to
---- a/lib/vtls/mbedtls.c
-+++ b/lib/vtls/mbedtls.c
-@@ -374,7 +374,7 @@ mbed_connect_step1(struct connectdata *c
- mbedtls_ssl_list_ciphersuites());
-
- /* Check if there's a cached ID we can/should use here! */
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- void *old_session = NULL;
-
- Curl_ssl_sessionid_lock(conn);
-@@ -618,7 +618,7 @@ mbed_connect_step3(struct connectdata *c
-
- DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
-
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- int ret;
- mbedtls_ssl_session *our_ssl_sessionid;
- void *old_ssl_sessionid = NULL;
---- a/lib/vtls/nss.c
-+++ b/lib/vtls/nss.c
-@@ -1696,7 +1696,7 @@ static CURLcode nss_setup_connect(struct
- goto error;
-
- /* do not use SSL cache if disabled or we are not going to verify peer */
-- ssl_no_cache = (data->set.general_ssl.sessionid
-+ ssl_no_cache = (SSL_SET_OPTION(primary.sessionid)
- && SSL_CONN_CONFIG(verifypeer)) ? PR_FALSE : PR_TRUE;
- if(SSL_OptionSet(model, SSL_NO_CACHE, ssl_no_cache) != SECSuccess)
- goto error;
---- a/lib/vtls/openssl.c
-+++ b/lib/vtls/openssl.c
-@@ -2161,7 +2161,7 @@ static CURLcode ossl_connect_step1(struc
- #endif
-
- /* Check if there's a cached ID we can/should use here! */
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- void *ssl_sessionid = NULL;
-
- Curl_ssl_sessionid_lock(conn);
-@@ -2915,7 +2915,7 @@ static CURLcode ossl_connect_step3(struc
-
- DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
-
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- bool incache;
- SSL_SESSION *our_ssl_sessionid;
- void *old_ssl_sessionid = NULL;
---- a/lib/vtls/polarssl.c
-+++ b/lib/vtls/polarssl.c
-@@ -327,7 +327,7 @@ polarssl_connect_step1(struct connectdat
- ssl_set_ciphersuites(&connssl->ssl, ssl_list_ciphersuites());
-
- /* Check if there's a cached ID we can/should use here! */
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- void *old_session = NULL;
-
- Curl_ssl_sessionid_lock(conn);
-@@ -555,7 +555,7 @@ polarssl_connect_step3(struct connectdat
-
- DEBUGASSERT(ssl_connect_3 == connssl->connecting_state);
-
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- int ret;
- ssl_session *our_ssl_sessionid;
- void *old_ssl_sessionid = NULL;
---- a/lib/vtls/schannel.c
-+++ b/lib/vtls/schannel.c
-@@ -145,7 +145,7 @@ schannel_connect_step1(struct connectdat
- connssl->cred = NULL;
-
- /* check for an existing re-usable credential handle */
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- Curl_ssl_sessionid_lock(conn);
- if(!Curl_ssl_getsessionid(conn, (void **)&old_cred, NULL, sockindex)) {
- connssl->cred = old_cred;
-@@ -714,7 +714,7 @@ schannel_connect_step3(struct connectdat
- #endif
-
- /* save the current session data for possible re-use */
-- if(data->set.general_ssl.sessionid) {
-+ if(SSL_SET_OPTION(primary.sessionid)) {
- bool incache;
- struct curl_schannel_cred *old_cred = NULL;
-
---- a/lib/vtls/vtls.c
-+++ b/lib/vtls/vtls.c
-@@ -120,6 +120,9 @@ Curl_clone_primary_ssl_config(struct ssl
- CLONE_STRING(egdsocket);
- CLONE_STRING(random_file);
- CLONE_STRING(clientcert);
-+
-+ /* Disable dest sessionid cache if a client cert is used, CVE-2016-5419. */
-+ dest->sessionid = (dest->clientcert ? false : source->sessionid);
- return TRUE;
- }
-
-@@ -293,9 +296,9 @@ bool Curl_ssl_getsessionid(struct connec
- int port = isProxy ? (int)conn->port : conn->remote_port;
- *ssl_sessionid = NULL;
-
-- DEBUGASSERT(data->set.general_ssl.sessionid);
-+ DEBUGASSERT(SSL_SET_OPTION(primary.sessionid));
-
-- if(!data->set.general_ssl.sessionid)
-+ if(!SSL_SET_OPTION(primary.sessionid))
- /* session ID re-use is disabled */
- return TRUE;
-
-@@ -397,7 +400,7 @@ CURLcode Curl_ssl_addsessionid(struct co
- &conn->proxy_ssl_config :
- &conn->ssl_config;
-
-- DEBUGASSERT(data->set.general_ssl.sessionid);
-+ DEBUGASSERT(SSL_SET_OPTION(primary.sessionid));
-
- clone_host = strdup(isProxy ? conn->http_proxy.host.name : conn->host.name);
- if(!clone_host)
+++ /dev/null
-From 358b2b131ad6c095696f20dcfa62b8305263f898 Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Tue, 1 Aug 2017 17:16:46 +0200
-Subject: [PATCH] tftp: reject file name lengths that don't fit
-
-... and thereby avoid telling send() to send off more bytes than the
-size of the buffer!
-
-CVE-2017-1000100
-
-Bug: https://curl.haxx.se/docs/adv_20170809B.html
-Reported-by: Even Rouault
-
-Credit to OSS-Fuzz for the discovery
----
- lib/tftp.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
---- a/lib/tftp.c
-+++ b/lib/tftp.c
-@@ -5,7 +5,7 @@
- * | (__| |_| | _ <| |___
- * \___|\___/|_| \_\_____|
- *
-- * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
-+ * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
-@@ -490,6 +490,11 @@ static CURLcode tftp_send_first(tftp_sta
- if(result)
- return result;
-
-+ if(strlen(filename) > (state->blksize - strlen(mode) - 4)) {
-+ failf(data, "TFTP file name too long\n");
-+ return CURLE_TFTP_ILLEGAL; /* too long file name field */
-+ }
-+
- snprintf((char *)state->spacket.data+2,
- state->blksize,
- "%s%c%s%c", filename, '\0', mode, '\0');
+++ /dev/null
-From 453e7a7a03a2cec749abd3878a48e728c515cca7 Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Tue, 1 Aug 2017 17:16:07 +0200
-Subject: [PATCH] glob: do not continue parsing after a strtoul() overflow
- range
-
-Added test 1289 to verify.
-
-CVE-2017-1000101
-
-Bug: https://curl.haxx.se/docs/adv_20170809A.html
-Reported-by: Brian Carpenter
----
- src/tool_urlglob.c | 5 ++++-
- tests/data/Makefile.inc | 2 +-
- tests/data/test1289 | 35 +++++++++++++++++++++++++++++++++++
- 3 files changed, 40 insertions(+), 2 deletions(-)
- create mode 100644 tests/data/test1289
-
---- a/src/tool_urlglob.c
-+++ b/src/tool_urlglob.c
-@@ -272,7 +272,10 @@ static CURLcode glob_range(URLGlob *glob
- }
- errno = 0;
- max_n = strtoul(pattern, &endp, 10);
-- if(errno || (*endp == ':')) {
-+ if(errno)
-+ /* overflow */
-+ endp = NULL;
-+ else if(*endp == ':') {
- pattern = endp+1;
- errno = 0;
- step_n = strtoul(pattern, &endp, 10);
+++ /dev/null
-From 7947c50bcd09cf471c95511739bc66d2cb506ee2 Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Mon, 6 Nov 2017 23:51:52 +0100
-Subject: [PATCH] ntlm: avoid integer overflow for malloc size
-
-Reported-by: Alex Nichols
-Assisted-by: Kamil Dudka and Max Dymond
-
-CVE-2017-8816
-
-Bug: https://curl.haxx.se/docs/adv_2017-11e7.html
----
- lib/curl_ntlm_core.c | 23 +++++++++++++++++++++--
- 1 file changed, 21 insertions(+), 2 deletions(-)
-
-diff --git a/lib/curl_ntlm_core.c b/lib/curl_ntlm_core.c
-index 1309bf0d9..e8962769c 100644
---- a/lib/curl_ntlm_core.c
-+++ b/lib/curl_ntlm_core.c
-@@ -616,23 +616,42 @@ CURLcode Curl_hmac_md5(const unsigned char *key, unsigned int keylen,
- Curl_HMAC_final(ctxt, output);
-
- return CURLE_OK;
- }
-
-+#ifndef SIZE_T_MAX
-+/* some limits.h headers have this defined, some don't */
-+#if defined(_LP64) || defined(_I32LPx)
-+#define SIZE_T_MAX 18446744073709551615U
-+#else
-+#define SIZE_T_MAX 4294967295U
-+#endif
-+#endif
-+
- /* This creates the NTLMv2 hash by using NTLM hash as the key and Unicode
- * (uppercase UserName + Domain) as the data
- */
- CURLcode Curl_ntlm_core_mk_ntlmv2_hash(const char *user, size_t userlen,
- const char *domain, size_t domlen,
- unsigned char *ntlmhash,
- unsigned char *ntlmv2hash)
- {
- /* Unicode representation */
-- size_t identity_len = (userlen + domlen) * 2;
-- unsigned char *identity = malloc(identity_len);
-+ size_t identity_len;
-+ unsigned char *identity;
- CURLcode result = CURLE_OK;
-
-+ /* we do the length checks below separately to avoid integer overflow risk
-+ on extreme data lengths */
-+ if((userlen > SIZE_T_MAX/2) ||
-+ (domlen > SIZE_T_MAX/2) ||
-+ ((userlen + domlen) > SIZE_T_MAX/2))
-+ return CURLE_OUT_OF_MEMORY;
-+
-+ identity_len = (userlen + domlen) * 2;
-+ identity = malloc(identity_len);
-+
- if(!identity)
- return CURLE_OUT_OF_MEMORY;
-
- ascii_uppercase_to_unicode_le(identity, user, userlen);
- ascii_to_unicode_le(identity + (userlen << 1), domain, domlen);
---
-2.15.0
-
+++ /dev/null
-From 0acc0c7c120afa6d60bfc7932c04361720b6e74d Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Fri, 10 Nov 2017 08:52:45 +0100
-Subject: [PATCH] wildcardmatch: fix heap buffer overflow in setcharset
-
-The code would previous read beyond the end of the pattern string if the
-match pattern ends with an open bracket when the default pattern
-matching function is used.
-
-Detected by OSS-Fuzz:
-https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4161
-
-CVE-2017-8817
-
-Bug: https://curl.haxx.se/docs/adv_2017-ae72.html
----
- lib/curl_fnmatch.c | 9 +++------
- tests/data/Makefile.inc | 2 +-
- tests/data/test1163 | 52 +++++++++++++++++++++++++++++++++++++++++++++++++
- 3 files changed, 56 insertions(+), 7 deletions(-)
- create mode 100644 tests/data/test1163
-
-diff --git a/lib/curl_fnmatch.c b/lib/curl_fnmatch.c
-index da83393b4..8a1e106c4 100644
---- a/lib/curl_fnmatch.c
-+++ b/lib/curl_fnmatch.c
-@@ -131,10 +131,13 @@ static int setcharset(unsigned char **p, unsigned char *charset)
- unsigned char lastchar = 0;
- bool something_found = FALSE;
- unsigned char c;
- for(;;) {
- c = **p;
-+ if(!c)
-+ return SETCHARSET_FAIL;
-+
- switch(state) {
- case CURLFNM_SCHS_DEFAULT:
- if(ISALNUM(c)) { /* ASCII value */
- rangestart = c;
- charset[c] = 1;
-@@ -195,13 +198,10 @@ static int setcharset(unsigned char **p, unsigned char *charset)
- (*p)++;
- }
- else
- return SETCHARSET_FAIL;
- }
-- else if(c == '\0') {
-- return SETCHARSET_FAIL;
-- }
- else {
- charset[c] = 1;
- (*p)++;
- something_found = TRUE;
- }
-@@ -276,13 +276,10 @@ static int setcharset(unsigned char **p, unsigned char *charset)
- (*p)++;
- }
- else if(c == ']') {
- return SETCHARSET_OK;
- }
-- else if(c == '\0') {
-- return SETCHARSET_FAIL;
-- }
- else if(ISPRINT(c)) {
- charset[c] = 1;
- (*p)++;
- state = CURLFNM_SCHS_DEFAULT;
- }
-diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
-index dc1cc03bc..6eb37d81d 100644
---- a/tests/data/Makefile.inc.1 2017-11-29 20:00:26.126452486 +0000
-+++ b/tests/data/Makefile.inc 2017-11-29 20:01:13.057783732 +0000
-@@ -121,6 +121,7 @@
- test1128 test1129 test1130 test1131 test1132 test1133 test1134 test1135 \
- test1136 test1137 test1138 test1139 test1140 test1141 test1142 test1143 \
- test1144 \
-+test1163 \
- test1200 test1201 test1202 test1203 test1204 test1205 test1206 test1207 \
- test1208 test1209 test1210 test1211 test1212 test1213 test1214 test1215 \
- test1216 test1217 test1218 test1219 \
-diff --git a/tests/data/test1163 b/tests/data/test1163
-new file mode 100644
-index 000000000..a109b511b
---- /dev/null
-+++ b/tests/data/test1163
-@@ -0,0 +1,52 @@
-+<testcase>
-+<info>
-+<keywords>
-+FTP
-+RETR
-+LIST
-+wildcardmatch
-+ftplistparser
-+flaky
-+</keywords>
-+</info>
-+
-+#
-+# Server-side
-+<reply>
-+<data>
-+</data>
-+</reply>
-+
-+# Client-side
-+<client>
-+<server>
-+ftp
-+</server>
-+<tool>
-+lib576
-+</tool>
-+<name>
-+FTP wildcard with pattern ending with an open-bracket
-+</name>
-+<command>
-+"ftp://%HOSTIP:%FTPPORT/fully_simulated/DOS/*[]["
-+</command>
-+</client>
-+<verify>
-+<protocol>
-+USER anonymous
-+PASS ftp@example.com
-+PWD
-+CWD fully_simulated
-+CWD DOS
-+EPSV
-+TYPE A
-+LIST
-+QUIT
-+</protocol>
-+# 78 == CURLE_REMOTE_FILE_NOT_FOUND
-+<errorcode>
-+78
-+</errorcode>
-+</verify>
-+</testcase>
---
-2.15.0
-
--- a/Makefile.am
+++ b/Makefile.am
-@@ -153,7 +153,7 @@ CLEANFILES = $(VC6_LIBDSP) $(VC6_SRCDSP)
+@@ -168,7 +168,7 @@ CLEANFILES = $(VC6_LIBDSP) $(VC6_SRCDSP)
bin_SCRIPTS = curl-config
- SUBDIRS = lib src include
--DIST_SUBDIRS = $(SUBDIRS) tests packages docs scripts
-+DIST_SUBDIRS = $(SUBDIRS) packages
+ SUBDIRS = lib src
+-DIST_SUBDIRS = $(SUBDIRS) tests packages scripts include docs
++DIST_SUBDIRS = $(SUBDIRS) packages include
pkgconfigdir = $(libdir)/pkgconfig
pkgconfig_DATA = libcurl.pc
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -613,7 +613,7 @@ CLEANFILES = $(VC6_LIBDSP) $(VC6_SRCDSP)
+@@ -279,8 +279,8 @@ cygwinbin:
+ # We extend the standard install with a custom hook:
+ install-data-hook:
+ cd include && $(MAKE) install
+- cd docs && $(MAKE) install
+- cd docs/libcurl && $(MAKE) install
++ #cd docs && $(MAKE) install
++ #cd docs/libcurl && $(MAKE) install
- bin_SCRIPTS = curl-config
- SUBDIRS = lib src include
--DIST_SUBDIRS = $(SUBDIRS) tests packages docs scripts
-+DIST_SUBDIRS = $(SUBDIRS) packages
- pkgconfigdir = $(libdir)/pkgconfig
- pkgconfig_DATA = libcurl.pc
- LIB_VAUTH_CFILES = vauth/vauth.c vauth/cleartext.c vauth/cram.c \
+ # We extend the standard uninstall with a custom hook:
+ uninstall-hook:
--- a/lib/vtls/mbedtls.c
+++ b/lib/vtls/mbedtls.c
-@@ -724,7 +724,7 @@ void Curl_mbedtls_session_free(void *ptr
+@@ -814,7 +814,7 @@ static void Curl_mbedtls_session_free(vo
- size_t Curl_mbedtls_version(char *buffer, size_t size)
+ static size_t Curl_mbedtls_version(char *buffer, size_t size)
{
- unsigned int version = mbedtls_version_get_number();
+ unsigned int version = MBEDTLS_VERSION_NUMBER;
- return snprintf(buffer, size, "mbedTLS/%d.%d.%d", version>>24,
+ return snprintf(buffer, size, "mbedTLS/%u.%u.%u", version>>24,
(version>>16)&0xff, (version>>8)&0xff);
}
+++ /dev/null
-From b993d2cca536870ecdf3b4611de9f77215af8eb8 Mon Sep 17 00:00:00 2001
-From: Antoine Aubert <a.aubert@overkiz.com>
-Date: Fri, 20 Jan 2017 08:10:28 +0100
-Subject: [PATCH] vtls: fix mbedtls multi non blocking handshake.
-
-When using multi, mbedtls handshake is in non blocking mode.
-vtls must set wait for read/write flags for the socket.
----
- lib/vtls/vtls.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
-index fad9335bbf..871622fef1 100644
---- a/lib/vtls/vtls.c
-+++ b/lib/vtls/vtls.c
-@@ -485,8 +485,9 @@ void Curl_ssl_close_all(struct Curl_easy *data)
- }
-
- #if defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \
-- defined(USE_DARWINSSL) || defined(USE_NSS)
--/* This function is for OpenSSL, GnuTLS, darwinssl, and schannel only. */
-+ defined(USE_DARWINSSL) || defined(USE_NSS) || defined(USE_MBEDTLS)
-+/* This function is for OpenSSL, GnuTLS, darwinssl, mbedtls, and schannel
-+ only. */
- int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks,
- int numsocks)
- {
--- /dev/null
+From ba1dbd78e5f1ed67c1b8d37ac89d90e5e330b628 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Wed, 13 Jun 2018 12:24:40 +0200
+Subject: [PATCH] smtp: use the upload buffer size for scratch buffer malloc
+
+... not the read buffer size, as that can be set smaller and thus cause
+a buffer overflow! CVE-2018-0500
+
+Reported-by: Peter Wu
+Bug: https://curl.haxx.se/docs/adv_2018-70a2.html
+---
+ lib/smtp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/lib/smtp.c
++++ b/lib/smtp.c
+@@ -1563,13 +1563,14 @@ CURLcode Curl_smtp_escape_eob(struct con
+ if(!scratch || data->set.crlf) {
+ oldscratch = scratch;
+
+- scratch = newscratch = malloc(2 * data->set.buffer_size);
++ scratch = newscratch = malloc(2 * UPLOAD_BUFSIZE);
+ if(!newscratch) {
+ failf(data, "Failed to alloc scratch buffer!");
+
+ return CURLE_OUT_OF_MEMORY;
+ }
+ }
++ DEBUGASSERT(UPLOAD_BUFSIZE >= nread);
+
+ /* Have we already sent part of the EOB? */
+ eob_sent = smtp->eob;
PKG_NAME:=bzip2
PKG_VERSION:=1.0.6
-PKG_RELEASE:=2
+PKG_RELEASE:=4
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=http://www.bzip.org/$(PKG_VERSION)
PKG_LICENSE:=BZIP2
PKG_LICENSE_FILES:=LICENSE
+PKG_CPE_ID:=cpe:/a:bzip:bzip2
include $(INCLUDE_DIR)/host-build.mk
include $(INCLUDE_DIR)/package.mk
define Package/bzip2/install
$(INSTALL_DIR) $(1)/usr/bin/
$(INSTALL_BIN) $(PKG_BUILD_DIR)/bzip2-shared $(1)/usr/bin/bzip2
+ $(INSTALL_DIR) $(1)/bin/
+ $(LN) ../usr/bin/bzip2 $(1)/bin/bzip2
endef
HOST_CFLAGS += \
--- /dev/null
+diff -up ./bzip2recover.c.old ./bzip2recover.c
+--- ./bzip2recover.c.old 2016-03-22 08:49:38.855620000 +0100
++++ ./bzip2recover.c 2016-03-30 10:22:27.341430099 +0200
+@@ -457,6 +457,7 @@ Int32 main ( Int32 argc, Char** argv )
+ bsPutUChar ( bsWr, 0x50 ); bsPutUChar ( bsWr, 0x90 );
+ bsPutUInt32 ( bsWr, blockCRC );
+ bsClose ( bsWr );
++ outFile = NULL;
+ }
+ if (wrBlock >= rbCtr) break;
+ wrBlock++;
projects / librecmc / librecmc.git / commitdiff