Commit Graph

12289 Commits

Author SHA1 Message Date
Yusuke Nakamura
279dfb620b
msh3: psss remote_port to MsH3ConnectionOpen
MsH3 supported additional "Port" parameter to connect not hosted on
443 port QUIC website.

* https://github.com/nibanks/msh3/releases/tag/v0.3.0
* https://github.com/nibanks/msh3/pull/37

Closes #8762
2022-04-30 10:51:09 +02:00
Christian Weisgerber
a3cf94f3ef
openssl: define HAVE_SSL_CTX_SET_EC_CURVES for libressl
SSL_CTX_set1_curves_list() has been available since LibreSSL 2.5.3,
released five years ago.

Bug: https://curl.se/mail/lib-2022-04/0059.html
Closes #8773
2022-04-29 23:02:45 +02:00
Daniel Stenberg
d7b970e46b
http: move Curl_allow_auth_to_host()
It was mistakenly put within the CURL_DISABLE_HTTP_AUTH #ifdef

Reported-by: Michael Olbrich
Fixes #8772
Closes #8775
2022-04-29 22:56:47 +02:00
Daniel Gustafsson
59d89286d4 msh3: print boolean value as text representation
Print the boolean value as its string representation instead of with
%hhu which isn't a format we typically use.

Closes: #8763
Reviewed-by: Nick Banks <nibanks@microsoft.com>
2022-04-29 11:40:25 +02:00
Daniel Stenberg
6eb7fb37d9
mbedtls: fix compile when h2-enabled
Fixes #8766
Reported-by: LigH-de on github
Closes #8768
2022-04-28 17:11:50 +02:00
Adam Rosenfield
e07a9b668a
conn: fix typo 'connnection' -> 'connection' in two function names
Closes #8759
2022-04-27 11:50:13 +02:00
Daniel Stenberg
0935315562
gnutls: don't leak the SRP credentials in redirects
Follow-up to 620ea21410 and 139a54ed0a

Reported-by: Harry Sintonen
Closes #8752
2022-04-26 07:46:20 +02:00
Daniel Stenberg
139a54ed0a
openssl: don't leak the SRP credentials in redirects either
Follow-up to 620ea21410

Reported-by: Harry Sintonen
Closes #8751
2022-04-25 22:34:40 +02:00
Liam Warfield
aad7d9f9a6
hyper: fix tests 580 and 581 for hyper
Hyper now has the ability to preserve header order. This commit adds a
few lines setting the connection options for this feature.

Related to issue #8617
Closes #8707
2022-04-25 17:33:08 +02:00
Daniel Stenberg
030adbceeb
conncache: remove name arg from Curl_conncache_find_bundle
To simplify, and also since the returned name is not the full actual
name used for the check. The port number and zone id is also involved,
so just showing the name is misleading.

Closes #8750
2022-04-25 16:25:42 +02:00
Daniel Stenberg
620ea21410
transfer: redirects to other protocols or ports clear auth
... unless explicitly permitted.

Bug: https://curl.se/docs/CVE-2022-27774.html
Reported-by: Harry Sintonen
Closes #8748
2022-04-25 16:24:33 +02:00
Daniel Stenberg
08b8ef4e72
connect: store "conn_remote_port" in the info struct
To make it available after the connection ended.
2022-04-25 16:24:33 +02:00
Daniel Stenberg
6e65999395
http: avoid auth/cookie on redirects same host diff port
CVE-2022-27776

Reported-by: Harry Sintonen
Bug: https://curl.se/docs/CVE-2022-27776.html
Closes #8749
2022-04-25 13:05:40 +02:00
Daniel Stenberg
8f2079154f
libssh2: make the md5 comparison fail if wrong length
Making it just skip the check unless exactly 32 is too brittle. Even if
the docs says it needs to be exactly 32, it is be safer to make the
comparison fail here instead.

Reported-by: Harry Sintonen
Bug: https://hackerone.com/reports/1549461
Closes #8745
2022-04-25 13:01:20 +02:00
Daniel Stenberg
058f98dc3f
conncache: include the zone id in the "bundle" hashkey
Make connections to two separate IPv6 zone ids create separate
connections.

Reported-by: Harry Sintonen
Bug: https://curl.se/docs/CVE-2022-27775.html
Closes #8747
2022-04-25 11:48:00 +02:00
Patrick Monnerat
852aa5ad35
url: check sasl additional parameters for connection reuse.
Also move static function safecmp() as non-static Curl_safecmp() since
its purpose is needed at several places.

Bug: https://curl.se/docs/CVE-2022-22576.html

CVE-2022-22576

Closes #8746
2022-04-25 11:44:05 +02:00
Daniel Stenberg
ff2f3e8367
libssh2: compare sha256 strings case sensitively
Reported-by: Harry Sintonen
Bug: https://hackerone.com/reports/1549435
Closes #8744
2022-04-25 11:41:20 +02:00
Tatsuhiro Tsujikawa
ca94497a82
ngtcp2: deal with sub-millisecond timeout
Closes #8738
2022-04-25 11:37:18 +02:00
Daniel Stenberg
4ec0549c39
misc: update copyright year ranges 2022-04-25 09:31:09 +02:00
Tatsuhiro Tsujikawa
458c4b1df7
ngtcp2: avoid busy loop in low CWND situation
Closes #8739
2022-04-24 23:21:27 +02:00
Daniel Gustafsson
e498a9b1fe macos: set .plist version in autoconf
Set the libcurl version in libcurl.plist like how libcurl.vers is
created.

Closes: #8692
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Reviewed-by: Nick Zitzmann <nickzman@gmail.com>
2022-04-20 15:26:13 +02:00
Daniel Gustafsson
a6cdfd24ee cookies: Improve errorhandling for reading cookiefile
The existing programming had some issues with errorhandling for reading
the cookie file. If the file failed to open, we would silently ignore it
and continue as if there was no file (or stdin) passed. In this case, we
would also call fclose() on the NULL FILE pointer, which is undefined
behavior. Fix by ensuring that the FILE pointer is set before calling
fclose on it, and issue a warning in case the file cannot be opened.
Erroring out on nonexisting file would break backwards compatibility of
very old behavior so we can't really go there.

Closes: #8699
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Reviewed-by: Jay Satiro <raysatiro@yahoo.com>
2022-04-20 14:17:29 +02:00
Jay Dommaschk
c4d032af2a
libssh: fix double close
libssh closes the socket in ssh_diconnect() so make sure that libcurl
does not also close it.

Fixes #8708
Closes #8718
2022-04-20 09:12:36 +02:00
Marc Hoersken
68035af29d
timediff.[ch]: add curlx helper functions for timeval conversions
Also move timediff_t definitions from timeval.h to timediff.h and
then make timeval.h include the new standalone-capable timediff.h.

Reviewed-by: Jay Satiro
Reviewed-by: Daniel Stenberg

Supersedes #5888
Closes #8595
2022-04-17 13:11:27 +02:00
Daniel Stenberg
6968fb9d54
lib: remove exclamation marks
... from infof() and failf() calls. Make them less attention seeking.

Closes #8713
2022-04-16 11:55:05 +02:00
Daniel Gustafsson
34bbf96475 infof: consistent capitalization of warning messages
Ensure that all infof calls with a warning message are capitalized
in the same way.  At some point we should probably set up a style-
guide for infof but until then let's aim for a little consistenncy
where we can.

Closes: #8711
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2022-04-14 21:13:29 +02:00
Tatsuhiro Tsujikawa
cd29c1651e
ngtcp2: fix memory leak
Closes #8691
2022-04-10 23:10:21 +02:00
Tatsuhiro Tsujikawa
fa25dab7fd
ngtcp2: remove remote_addr which is not used in a meaningful way
Closes #8689
2022-04-10 23:09:41 +02:00
Tatsuhiro Tsujikawa
f15beb6f30
ngtcp2: enlarge H3_SEND_SIZE
Make h3_SEND_SIZE larger because current value (20KiB) is too small
for the high latency environment.

Closes #8690
2022-04-10 23:08:33 +02:00
Tatsuhiro Tsujikawa
990bfdd7bc
ngtcp2: fix HTTP/3 upload stall and avoid busy loop
This commit fixes HTTP/3 upload stall if upload data is larger than
H3_SEND_SIZE.  Only check writability of socket if a stream is
writable to avoid busy loop when QUIC flow control window is filled
up, or upload buffer is full.

Closes #8688
2022-04-10 23:07:42 +02:00
Nick Banks
37492ebbfa
msh3: add support for QUIC and HTTP/3 using msh3
Considered experimental, as the other HTTP/3 backends.

Closes #8517
2022-04-10 18:23:04 +02:00
Daniel Stenberg
fbba7dd796
schannel: remove dead code that will never run
As the condition can't ever evaluate true

Reported-by: Andrey Alifanov
Ref: #8675
Closes #8677
2022-04-06 08:33:20 +02:00
Daniel Stenberg
d4cf98bbd1
connecache: remove duplicate connc->closure_handle check
The superfluous extra check could cause analyzer false positives
and doesn't serve any purpose.

Closes #8676
2022-04-06 08:32:04 +02:00
MAntoniak
ba83c522f5
mbedtls: remove server_fd from backend
Closes #8682
2022-04-06 08:31:12 +02:00
Tatsuhiro Tsujikawa
92c0123585
ngtcp2: use token when detecting :status header field
Closes #8679
2022-04-05 16:48:44 +02:00
Tatsuhiro Tsujikawa
913b80d5fd
ngtcp2: make curl 1ms faster
Pass 0 for an already expired timer.

Closes #8678
2022-04-05 16:47:18 +02:00
Tatsuhiro Tsujikawa
1b1443a8ed
ngtcp2: fix QUIC_IDLE_TIMEOUT
QUIC_IDLE_TIMEOUT should be of type ngtcp2_duration which is
nanoseconds resolution.

Closes #8678
2022-04-05 16:47:07 +02:00
Daniel Stenberg
4a8f6869db
English: use American spelling consistently
Authorization, Initialization, Organization etc.

Closes #8673
2022-04-05 14:55:47 +02:00
Daniel Stenberg
854ec76551
http: streamclose "already downloaded"
Instead of connclose()ing, since when HTTP/2 is used it doesn't need to
close the connection as stopping the current transfer is enough.

Reported-by: Evangelos Foutras
Closes #8665
2022-04-01 23:30:43 +02:00
Jay Satiro
9ca6cd924c ftp: fix error message for partial file upload
- Show the count of bytes written on partial file upload.

Prior to this change the error message mistakenly showed the count of
bytes read, not written.

Bug: https://github.com/curl/curl/discussions/8637
Reported-by: Taras Kushnir

Closes https://github.com/curl/curl/pull/8649
2022-04-01 13:52:13 -04:00
Daniel Stenberg
218cc70028
http: correct the header error message to say colon
Not semicolon

Reported-by: Gisle Vanem
Ref: #8666
Closes #8667
2022-04-01 17:00:18 +02:00
Daniel Stenberg
b716b5aa7e
lib: #ifdef on USE_HTTP2 better
... as nghttp2 might not be the library that provides HTTP/2 support.

Closes #8661
2022-04-01 13:45:52 +02:00
MAntoniak
266627b0bc
mbedtls: remove 'protocols' array from backend when ALPN is not used
Closes #8663
2022-04-01 13:43:11 +02:00
Daniel Stenberg
fda4b81635
http2: RST the stream if we stop it on our own will
For the "simulated 304" case the done-call isn't considered "premature"
but since the server didn't close the stream it needs to be reset to
stop delivering data.

Closes #8664
2022-04-01 13:23:04 +02:00
Daniel Stenberg
3fa634a337
http: close the stream (not connection) on time condition abort
Closes #8664
2022-04-01 13:22:59 +02:00
Daniel Stenberg
b5a9680577
http2: handle DONE called for the paused stream
As it could otherwise stall all streams on the connection

Reported-by: Evangelos Foutras
Fixes #8626
Closes #8664
2022-04-01 13:22:58 +02:00
Daniel Stenberg
7c1acaf61e
tls: make mbedtls and NSS check for h2, not nghttp2
This makes them able to also negotiate HTTP/2 even when built to use
hyper for h2.

Closes #8656
2022-03-31 16:04:00 +02:00
Daniel Stenberg
34ebf3f90d
vtls: use a generic "ALPN, server accepted" message
Closes #8657
2022-03-31 14:21:01 +02:00
Daniel Stenberg
55043b40c1
vtls: use a backend standard message for "ALPN: offers %s"
I call it VTLS_INFOF_ALPN_OFFER_1STR, the '1str' meaning that the
infof() call also needs a string argument: the ALPN ID.

Closes #8657
2022-03-31 14:20:56 +02:00
MonkeybreadSoftware
62d5818242
strcase.h: add comment about the return code
Tool often we run into expecting this to work like strcmp, but it
returns 1 instead of 0 for match.

Closes #8658
2022-03-31 11:35:27 +02:00