From owner-svn-src-vendor@freebsd.org Sun Aug 9 04:35:15 2015 Return-Path: Delivered-To: svn-src-vendor@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 4438199D91D; Sun, 9 Aug 2015 04:35:15 +0000 (UTC) (envelope-from peter@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 340A8622; Sun, 9 Aug 2015 04:35:15 +0000 (UTC) (envelope-from peter@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.70]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id t794ZFp7050971; Sun, 9 Aug 2015 04:35:15 GMT (envelope-from peter@FreeBSD.org) Received: (from peter@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id t794ZDrc050966; Sun, 9 Aug 2015 04:35:13 GMT (envelope-from peter@FreeBSD.org) Message-Id: <201508090435.t794ZDrc050966@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: peter set sender to peter@FreeBSD.org using -f From: Peter Wemm Date: Sun, 9 Aug 2015 04:35:13 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-vendor@freebsd.org Subject: svn commit: r286499 - in vendor/serf/dist: . auth buckets X-SVN-Group: vendor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-vendor@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the vendor work area tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Aug 2015 04:35:15 -0000 Author: peter Date: Sun Aug 9 04:35:12 2015 New Revision: 286499 URL: https://svnweb.freebsd.org/changeset/base/286499 Log: Vendor import serf-1.3.8 Modified: vendor/serf/dist/CHANGES vendor/serf/dist/auth/auth_spnego_sspi.c vendor/serf/dist/buckets/deflate_buckets.c vendor/serf/dist/buckets/ssl_buckets.c vendor/serf/dist/serf.h Modified: vendor/serf/dist/CHANGES ============================================================================== --- vendor/serf/dist/CHANGES Sun Aug 9 04:33:42 2015 (r286498) +++ vendor/serf/dist/CHANGES Sun Aug 9 04:35:12 2015 (r286499) @@ -1,10 +1,18 @@ +Serf 1.3.8 [2014-10-20, from /tags/1.3.8, rxxxx] +Fix issue #152: CRC calculation error for gzipped http reponses > 4GB. +Fix issue #153: SSPI CredHandle not freed when APR pool is destroyed. +Fix issue #154: Disable SSLv2 and SSLv3 as both or broken. + + Serf 1.3.7 [2014-08-11, from /tags/1.3.7, r2411] Handle NUL bytes in fields of an X.509 certificate. (r2393, r2399) + Serf 1.3.6 [2014-06-09, from /tags/1.3.6, r2372] Revert r2319 from serf 1.3.5: this change was making serf call handle_response multiple times in case of an error response, leading to unexpected behavior. + Serf 1.3.5 [2014-04-27, from /tags/1.3.5, r2355] Fix issue #125: no reverse lookup during Negotiate authentication for proxies. Fix a crash caused by incorrect reuse of the ssltunnel CONNECT request (r2316) Modified: vendor/serf/dist/auth/auth_spnego_sspi.c ============================================================================== --- vendor/serf/dist/auth/auth_spnego_sspi.c Sun Aug 9 04:33:42 2015 (r286498) +++ vendor/serf/dist/auth/auth_spnego_sspi.c Sun Aug 9 04:35:12 2015 (r286499) @@ -95,8 +95,8 @@ cleanup_ctx(void *data) } if (SecIsValidHandle(&ctx->sspi_credentials)) { - FreeCredentialsHandle(&ctx->sspi_context); - SecInvalidateHandle(&ctx->sspi_context); + FreeCredentialsHandle(&ctx->sspi_credentials); + SecInvalidateHandle(&ctx->sspi_credentials); } return APR_SUCCESS; Modified: vendor/serf/dist/buckets/deflate_buckets.c ============================================================================== --- vendor/serf/dist/buckets/deflate_buckets.c Sun Aug 9 04:33:42 2015 (r286498) +++ vendor/serf/dist/buckets/deflate_buckets.c Sun Aug 9 04:35:12 2015 (r286499) @@ -141,7 +141,6 @@ static apr_status_t serf_deflate_read(se const char **data, apr_size_t *len) { deflate_context_t *ctx = bucket->data; - unsigned long compCRC, compLen; apr_status_t status; const char *private_data; apr_size_t private_len; @@ -186,17 +185,25 @@ static apr_status_t serf_deflate_read(se ctx->state++; break; case STATE_VERIFY: + { + unsigned long compCRC, compLen, actualLen; + /* Do the checksum computation. */ compCRC = getLong((unsigned char*)ctx->hdr_buffer); if (ctx->crc != compCRC) { return SERF_ERROR_DECOMPRESSION_FAILED; } compLen = getLong((unsigned char*)ctx->hdr_buffer + 4); - if (ctx->zstream.total_out != compLen) { + /* The length in the trailer is module 2^32, so do the same for + the actual length. */ + actualLen = ctx->zstream.total_out; + actualLen &= 0xFFFFFFFF; + if (actualLen != compLen) { return SERF_ERROR_DECOMPRESSION_FAILED; } ctx->state++; break; + } case STATE_INIT: zRC = inflateInit2(&ctx->zstream, ctx->windowSize); if (zRC != Z_OK) { @@ -264,10 +271,14 @@ static apr_status_t serf_deflate_read(se ctx->zstream.next_in = (unsigned char*)private_data; ctx->zstream.avail_in = private_len; } - zRC = Z_OK; - while (ctx->zstream.avail_in != 0) { - /* We're full, clear out our buffer, reset, and return. */ - if (ctx->zstream.avail_out == 0) { + + while (1) { + + zRC = inflate(&ctx->zstream, Z_NO_FLUSH); + + /* We're full or zlib requires more space. Either case, clear + out our buffer, reset, and return. */ + if (zRC == Z_BUF_ERROR || ctx->zstream.avail_out == 0) { serf_bucket_t *tmp; ctx->zstream.next_out = ctx->buffer; private_len = ctx->bufferSize - ctx->zstream.avail_out; @@ -283,7 +294,6 @@ static apr_status_t serf_deflate_read(se ctx->zstream.avail_out = ctx->bufferSize; break; } - zRC = inflate(&ctx->zstream, Z_NO_FLUSH); if (zRC == Z_STREAM_END) { serf_bucket_t *tmp; @@ -330,9 +340,13 @@ static apr_status_t serf_deflate_read(se break; } + + /* Any other error? */ if (zRC != Z_OK) { return SERF_ERROR_DECOMPRESSION_FAILED; } + + /* As long as zRC == Z_OK, just keep looping. */ } /* Okay, we've inflated. Try to read. */ status = serf_bucket_read(ctx->inflate_stream, requested, data, @@ -340,8 +354,13 @@ static apr_status_t serf_deflate_read(se /* Hide EOF. */ if (APR_STATUS_IS_EOF(status)) { status = ctx->stream_status; - /* If our stream is finished too, return SUCCESS so - * we'll iterate one more time. + + /* If the inflation wasn't finished, return APR_SUCCESS. */ + if (zRC != Z_STREAM_END) + return APR_SUCCESS; + + /* If our stream is finished too and all data was inflated, + * return SUCCESS so we'll iterate one more time. */ if (APR_STATUS_IS_EOF(status)) { /* No more data to read from the stream, and everything Modified: vendor/serf/dist/buckets/ssl_buckets.c ============================================================================== --- vendor/serf/dist/buckets/ssl_buckets.c Sun Aug 9 04:33:42 2015 (r286498) +++ vendor/serf/dist/buckets/ssl_buckets.c Sun Aug 9 04:35:12 2015 (r286499) @@ -1317,7 +1317,9 @@ static serf_ssl_context_t *ssl_init_cont ssl_ctx->pool = serf_bucket_allocator_get_pool(allocator); ssl_ctx->allocator = allocator; + /* Use the best possible protocol version, but disable the broken SSLv2/3 */ ssl_ctx->ctx = SSL_CTX_new(SSLv23_client_method()); + SSL_CTX_set_options(ssl_ctx->ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); SSL_CTX_set_client_cert_cb(ssl_ctx->ctx, ssl_need_client_cert); ssl_ctx->cached_cert = 0; Modified: vendor/serf/dist/serf.h ============================================================================== --- vendor/serf/dist/serf.h Sun Aug 9 04:33:42 2015 (r286498) +++ vendor/serf/dist/serf.h Sun Aug 9 04:35:12 2015 (r286499) @@ -1062,7 +1062,7 @@ void serf_debug__bucket_alloc_check( /* Version info */ #define SERF_MAJOR_VERSION 1 #define SERF_MINOR_VERSION 3 -#define SERF_PATCH_VERSION 7 +#define SERF_PATCH_VERSION 8 /* Version number string */ #define SERF_VERSION_STRING APR_STRINGIFY(SERF_MAJOR_VERSION) "." \