apk-tools - Adélie Linux patches for Alpine Package Keeper (apk-tools)

Age	Commit message (Collapse)	Author	Files	Lines
2022-12-21	apk, fetch: implement --no-check-certificate	Timo Teräs	1	-2/+11
	fixes #10650
2021-08-03	libfetch: fix http chunked mode handling	Timo Teräs	1	-1/+1
	Unbreak handling of base 16 in fetch_parseuint(). It is used only in http chunked mode handling. Fixes: "libfetch: fix range checking for http/ftp protocol parsing"
2021-07-26	libfetch: fix range checking for http/ftp protocol parsing	Timo Teräs	1	-0/+24
	Various parsing of numeric strings were not having adequate range checking causing information leak or potential crash. CVE-2021-36159 fixes #10749 Co-authored-by: Ariadne Conill <ariadne@dereferenced.org> Reported-by: Samanta Navarro <ferivoz@riseup.net>
2021-01-19	libfetch: fix connection pooling for proxied http/https requests	Timo Teräs	1	-2/+2
	The connection pooling was broken in two ways: 1. The original URL was always used as the connection pool URL, resulting in duplicate connections to the proxy for http URLs (each http URL would get separate proxy connection) 2. The cache_url stored was always the socket level connect URL. In case of HTTPS, the lookup was done done with the real URL, but the proxy URL was stored as the "cache URL". Thus HTTPS CONNECT connections were never re-used. This fixes the code with following logic: 1. The cache key url is the real URL when no-proxy, or when HTTPS with proxy (the socket is connected to proxy, but logically it is connected to the real URL due to HTTP CONNECT request). And for HTTP with proxy, it's the proxy URL so same proxy connection can be reused for all requests going through it. 2. fetch_connect() now gets cache key URL separately, and it always gets the same value as the fetch_cache_get() calls.
2021-01-19	libfetch: fix use-after-free in connection cache management	Timo Teräs	1	-3/+3
	fixes #10734
2021-01-17	libfetch: support for CIDR subnets in no_proxy/NO_PROXY	Timo Teräs	1	-1/+65
	This enables matching numeric hosts against CIDR style subnet matches in no_proxy environment variable. Based on work by Thermi. Co-authored-by: Noel Kuntze <noel.kuntze@thermi.consulting>
2020-05-29	libfetch: implement default port for HTTPS.	Ariadne Conill	1	-0/+2
	If getservbyname() fails, libfetch will attempt to connect to port 0.
2020-04-01	libfetch: fix no_proxy domain name comparision	Timo Teräs	1	-1/+1
	Fix comparing of the hostname portion that matches exactly. The no_proxy matching is pretty rudimentary though and probably could go through a bit of additional rework. Fixes #10681
2018-01-31	libfetch: support OpenSSL	A. Wilcox	1	-1/+1
	TLS_client_method is a LibreSSL extension. SSLv23_client_method is generic, and doesn't mean SSL v2/v3 only.
2017-10-06	libfetch: fix certificate host name check	Timo Teräs	1	-1/+1
	OpenSSL allows passing zero-length to indicate "use strlen". LibreSSL requires using the real length always, so pass the length.
2017-10-05	libfetch: improve ssl connections	Timo Teräs	1	-6/+108
	loosely based on the freebsd implementation, implement https connection settings to override CA, and use client certificate. new files supported in /etc/apk/: ca.pem - if exists, it contains CAs acceptable for https (otherwise system wide CAs are used) crl.pem - if ca.pem is used, this is the (optional) CRL for it cert.pem - used as client authentication certificate (+ key) cert.key - used as client key (can be also inside cert.pem)
2017-10-05	libfetch: remove unwanted code conditionals	Timo Teräs	1	-43/+5

2017-10-05	libfetch: fix ssl context leak	Timo Teräs	1	-0/+14
	from freebsd
2017-10-05	build and use bundled libfetch natively	Timo Teräs	1	-14/+1

2017-10-05	import libfetch-2.38 from NetBSD	Timo Teräs	1	-0/+1085
	ftp://ftp.fu-berlin.de/unix/NetBSD/packages/current-src/pkgsrc/net/libfetch/files libfetch comes (at least) in netbsd and freebsd flavors which differing functionality. Alpine and Arch package netbsd one, but it's not widely packaged across other distributions. We need NetBSD version as it does not use funopen(3) which is not supported in musl, and supports connection pooling. FreeBSD seems to be the orignal and better maintained version with support for SSL CAs, client certificate authentication, proxy authentication, and improved http redirect handling. So this imports NetBSD version, and future commits will pick up the needed improvements from FreeBSD tree. Incidentally, this also fixes #7857 and likes for good.