about summary refs log tree commit
DateCommit message (Collapse)
2019-07-02Net::Cmd: fix ->getline if SSL_read overreads read-early
sysread may call SSL_read, and SSL_read may buffer extra data in userspace which can be returned via sysread without making another read(2) syscall. This makes it it possible for select() to block indefinitely since select() only knows about buffers in the kernel, not userspace. This problem was exposed by a forthcoming patch to support NNTP compression, but it is theoretically possible to trigger with use of TLS alone, especially if compression is done by the TLS layer. Fortunately for existing users, TLS compression isn't widely used anymore because of CRIME and other vulnerabilities. So, flip the socket to non-blocking, perform the sysread, using select() to wait only if the kernel requires it, and reset the original blocking state of the socket when done to maintain compatibility with existing users. Thread-safety with flipping the O_NONBLOCK flag like this should not be a concern, because any application sharing connected TCP sockets across threads is buggy, anyways.
2019-07-02Net::Cmd: append directly to partial buf on sysread
sysread allow an offset argument to insert new data at a certain place, use it to simplify our code, slightly.
2017-12-15Use L<> for links HEAD master
2017-12-15Use L<> rather than F<> for email addresses
2017-11-14Bump version
2017-11-14Release 3.11 v3.11
2017-11-14Bump copyright date
2017-11-14Changes entry for previous commit
2017-11-14Merge pull request #32 from bk2204/mlsd-insensitive
Treat FTP MLSD commands case-insensitively
2017-11-14Sort MANIFEST and fill in descriptions
2017-03-07Treat FTP MLSD commands case-insensitively
RFC 3659 states that MLSD fact names and facts are case-insensitive. While most FTP servers prefer lowercase, some choose to use mixed-case, so match MLSD data case-insensitively.
2016-10-27Simplify AUTHOR/copyright notices
2016-09-01Generalize INSTALL instructions regarding "make"
(Perl can be built on Windows with "gmake" as well as "dmake" these days, and doubtless other make programs exist on other systems.)
2016-08-30Bump copyright dates for files changed this year
2016-08-01Bump version
2016-08-01Release 3.10 v3.10
2016-07-29Add Changes entry for previous commit
2016-07-29Merge pull request #29 from tonycoz/cve-2016-1238
CVE-2016-1238: avoid loading Net::LocalCfg from default .
2016-07-28Remove the default Net::Cmd::timeout()
This accidentally overrode the timeout() in Net::FTP's $IOCLASS. Instead, we now document that timeout() needs to be provided by the Net::Cmd sub-class (normally by inheriting from IO::Socket::INET or similar (which in turn inherit from IO::Socket, which provides timeout()), which most users seem to do anyway). Similarly, document that close() most also be provided (normally by inheriting from IO::Handle, which IO::Socket::INET or similar also do, via IO::Socket). This fixes CPAN RT#116345. Thanks to ppisar@redhat.com for the analysis.
2016-07-28CVE-2016-1238: avoid loading Net::LocalCfg from default .
Net::Cfg treats Net::LocalCfg as an optional load, if a site does not have Net::LocalCfg in the standard places perl will attempt to load it from the . entry in @INC. If the current directory happens to be world writable (like /tmp) an attacker can create Net/LocalCfg.pm to run code as any user that runs code that loads Net::Cfg in that directory. This patch temporarily removes the default . entry from @INC when loading Net::LocalCfg to prevent that.
2016-07-19Bump version
2016-07-19Release 3.09 v3.09
2016-07-19Fill in Changes file for recent changes
2016-07-07Provide (and document) a default Net::Cmd::timeout()
Previuosly, subclasses were required to provide a timeout() function, but this was not documented anywhere! Fixes CPAN RT#110978.
2016-07-01Require IO::Socket::IP >= 0.25 to hopefully stop t/pop3_ipv6.t hanging
See https://rt.cpan.org/Ticket/Display.html?id=104545
2016-06-30Merge pull request #27 from pprindeville/master
Include decoded (from base64) negotiation for SASL.
2016-06-30Fix/update some links in README
Adapted from PR#26.
2016-06-28Merge pull request #25 from jmdh/nntp_docs
Correct innd/nnrpd confusion in relation to Reader option
2016-06-28Merge pull request #28 from jkeenan/uninit_value_in_ipv6_tests
Adapt tests to Test2 revision of Test::More::note().
2016-06-22Adapt tests to Test2 revision of Test::More::note().
In each of the three t/*_ipv6.t test files, a helper subroutine was defined whose last statement was an invocation of Test::More::note(). Under the old Test::Builder framework, note() would always have returned a defined value of 0. However, in the Test2 framework -- which is in Perl 5 blead as of 5.25.2 -- note() calls the release() method from lib/Test2/API/Context.pm -- and release() has a bare return, which is treated as 'undef' in scalar context. Perl's exit function wants to return a non-negative integer value. Hence, we should guarantee that these helper subroutines -- which are invoked by exit() calls in each of the three files -- explicitly return 0 upon success.
2016-06-13Include decoded (from base64) negotiation for SASL.
Text is prefixed with (decoded) and appears before on sends and after on receives.
2016-04-02Correct innd/nnrpd confusion in relation to Reader option
In the 'Reader' paragraph of the 'Constructor' section, the text has nnrpd and innd the wrong way round Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=51962
2016-01-05Bump version
2016-01-05Release 3.08 v3.08
2015-12-27Add Changes entry for the syswrite() fix
2015-12-27Fix _set_status_closed() calls following commit 852982580b
2015-12-27Merge pull request #24 from dagolden/fix-syswrite
Fix syswrite in Net::Cmd
2015-12-27Merge pull request #23 from daleevans/patch-3
POD fix escape of > character
2015-12-27Merge pull request #22 from daleevans/patch-4
fix pop3 demo program
2015-12-27Merge pull request #21 from daleevans/patch-2
minor POD error
2015-12-27Merge pull request #20 from daleevans/patch-1
fix smtp demo program
2015-12-26Fix typo
2015-12-25Make other syswrites use _syswrite_with_timeout
Two other methods in Net::Cmd did syswrite() calls, both without a loop or timeout. This replaces those with a call to the new, common _syswrite_with_timeout() method, which does both correctly and restarts after EINTR.
2015-12-25Refactor syswrite with timeout
2015-12-25POD fix escape of > character
C<Debug => 1> doesn't render correctly because of the embedded ">".
2015-12-25fix pop3 demo program
Getopt::Long requires that implicit option variables ($opt_XXX) be declared with "our" and not "my". At least using Getopt::Long 2.38 / perl 5.14, this results in the $opt_* never getting any values filled in.
2015-12-25minor POD error
should close an =over with a =back before starting a new =head1, or you get the following errors from perldoc: POD ERRORS Hey! The above document had some coding errors, which are explained below: Around line 36: You forgot a '=back' before '=head1' Around line 42: =back without =over
2015-12-25fix smtp demo program
Getopt::Long requires that implicit option variables ($opt_XXX) be declared with "our" and not "my".
2015-09-03Minor tweaks to Changes file formatting
2015-09-03SMTP: document passing of SASL instance to auth()
Based on a patch by Jan Viktorin <viktorin@rehivetech.com>. Fixes CPAN RT#106183.