Commit Graph

5753 Commits

Author SHA1 Message Date
Daniel Stenberg
5ddd5f2619
data.d: emphasize no conversion
When asking curl to send a POST, curl does not encode or change the data.

Ref: #10820
Closes #10823
2023-03-23 15:35:25 +01:00
Daniel Stenberg
370dcf0b96
THANKS: from the 8.0.0 release 2023-03-20 08:04:43 +01:00
Daniel Stenberg
bb334dfdde
SECURITY-PROCESS.md: Busy-loops are not security problems
Closes #10790
2023-03-18 09:59:23 +01:00
Daniel Stenberg
f24014c3eb
lib2305: deal with CURLE_AGAIN
The test does a slightly ugly busy-loop for this case but should be
managable due to it likely being a very short moment.

Mention CURLE_AGAIN in curl_ws_recv.3

Fixes #10760
Reported-by: Jay Satiro
Closes #10781
2023-03-16 23:29:12 +01:00
Casey Bodley
495d09810a
aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
all s3 requests default to UNSIGNED-PAYLOAD and add the required
x-amz-content-sha256 header. this allows CURLAUTH_AWS_SIGV4 to correctly
sign s3 requests to amazon with no additional configuration

Signed-off-by: Casey Bodley <cbodley@redhat.com>

Closes #9995
2023-03-14 17:04:47 +01:00
Daniel Stenberg
c977fecf52
RELEASE-PROCEDURE.md: update coming release dates 2023-03-13 16:43:42 +01:00
Dan Fandrich
ee521a1c88 http: don't send 100-continue for short PUT requests
This is already how curl is documented to behave in Everything curl, but
in actuality only short POSTs skip this. This should knock 30 seconds
off a full run of the test suite since the 100-continue timeout will no
longer be hit.

Closes #10740
2023-03-11 18:57:19 -08:00
Daniel Stenberg
fcee070cb1
CURLOPT_PROXY.3: curl+NSS does not handle HTTPS over unix domain socket
It results in error "NSS error -5985 (PR_ADDRESS_NOT_SUPPORTED_ERROR)"

Disabled test 1470 for NSS builds and documented the restriction.

Reported-by: Dan Fandrich
Fixes #10723
Closes #10734
2023-03-10 17:50:20 +01:00
Daniel Stenberg
dca4cdf071
CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
Reported-by: Hiroki Kurosawa
Closes #10732
2023-03-10 17:45:55 +01:00
Daniel Stenberg
56f306a5a6
docs/SECURITY-PROCESS.md: updates
- allow Low+Medium issues to be managed through plain PRs
- update the bug-bounty part to reflect current reality

Closes #10719
2023-03-10 08:00:38 +01:00
Evgeny Grin (Karlson2k)
372b95f77f
doc: fix compiler warning in libcurl.m4
Current test for curl_free() may produce warnings with strict compiler
flags or even with default compiler flags with upcoming versions.
These warning could turned into errors by -Werror or similar flags.
Such warnings/errors are avoided by this patch.

Closes #10710
2023-03-08 14:24:08 +01:00
Viktor Szakats
75087c3baa
misc: fix typos
Closes #10706
2023-03-08 08:00:35 +00:00
Daniel Stenberg
2a31086f39
docs: extend the URL API descriptions
Closes #10701
2023-03-07 13:36:10 +01:00
andy5995
7c3822fe45
docs: note '--data-urlencode' option
Closes #10687
2023-03-06 15:35:48 +01:00
Daniel Stenberg
e4d5685cb5
DEPRECATE: the original legacy mingw version 1
Remove completely in September 2023

Closes #10667
2023-03-06 11:31:33 +01:00
Viktor Szakats
8cfc936f5c
cmake: fix enabling LDAPS on Windows
Before this patch, enabling LDAPS required a manual C flag:
c1cfc31cfc/curl-cmake.sh (L105)

Fix this and enable LDAPS automatically when using `wldap32` (and
when not explicitly disabled). This matches autotools and `Makefile.mk`
behavior. Also remove issue from KNOWN_BUGS.

Add workaround for MSVS 2010 warning triggered by LDAPS now enabled
in more CI tests:
`ldap.c(360): warning C4306: 'type cast' : conversion from 'int' to 'void *' of greater size`
Ref: https://ci.appveyor.com/project/curlorg/curl/builds/46408284/job/v8mwl9yfbmoeqwlr#L312

Reported-by: JackBoosY on github
Reviewed-by: Jay Satiro
Reviewed-by: Marcel Raad
Fixes #6284
Closes #10674
2023-03-05 19:55:14 +00:00
Viktor Szakats
016c62c4d5
cmake: skip CA-path/bundle auto-detection in cross-builds
Also remove issue from KNOWN_BUGS.

Reported-by: Cristian Morales Vega
Reviewed-by: Marcel Raad
Fixes #6178
Closes #10676
2023-03-05 19:51:52 +00:00
Brad Spencer
ad4997e5b2
urlapi: parse IPv6 literals without ENABLE_IPV6
This makes the URL parser API stable and working the same way
independently of libcurl supporting IPv6 transfers or not.

Closes #10660
2023-03-03 10:05:08 +01:00
Jay Satiro
d36c632c86 DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
This is the existing behavior and it has been widely assumed in the
codebase.

Closes https://github.com/curl/curl/pull/10645
2023-03-01 04:18:15 -05:00
Daniel Stenberg
13afb87268
page-footer: add explanation for three missing exit codes
Added in 7.73.0, 7.77.0 and 7.84.0

Closes #10630
2023-02-28 08:26:36 +01:00
積丹尼 Dan Jacobson
8d708e4cad
rate.c: single URLs make no sense in --rate example
Here somehow you need to put more than one URL in these examples, else
they will make no sense, as --rate only affects the second and beyond
URLs. The first URL will always finish the same time no matter what
--rate is given.

Closes #10638
2023-02-28 08:24:23 +01:00
Daniel Stenberg
26c6d822bc
libcurl-errors.3: add the CURLHcode errors from curl_easy_header.3
Closes #10629
2023-02-28 08:21:34 +01:00
Daniel Stenberg
c5168365c7
PARALLEL-TRANSFERS.md: not "early days" for this anymore
Refresh the language as the support is now over three years old

Closes #10624
2023-02-27 20:08:54 +01:00
Daniel Stenberg
49a9f13c39
examples/http3.c: use CURL_HTTP_VERSION_3
and update the comment

Closes #10619
2023-02-27 15:11:13 +01:00
andy5995
9fcc91006a
INTERNALS.md: grammar
Closes #10607
2023-02-25 10:54:49 +01:00
Daniel Stenberg
835682661c
misc: remove support for curl_off_t < 8 bytes
Closes #10597
2023-02-24 17:05:33 +01:00
Philipp Engel
c52f7a8946
BINDINGS: add Fortran binding
Closes #10589
2023-02-22 16:45:32 +01:00
Daniel Stenberg
ddff8ef706
gen.pl: add '%GLOBALS' as a variable for mainpage
And use it in page-header to list all global command line options.
2023-02-22 08:36:21 +01:00
Daniel Stenberg
86ec17b856
docs/cmdline-opts: mark all global options
gen.pl now outputs a generic explanations for them for each option

Fixes #10566
Reported-by: u20221022 on github
Closes #10584
2023-02-22 08:35:45 +01:00
Daniel Stenberg
862fc420e0
THANKS: add contributors from 7.88.1 2023-02-20 08:24:46 +01:00
Daniel Stenberg
bf54c9382f
remote-header-name.d: mention that filename* is not supported
and that you can use --clobber to allow overwriting.

Ref: #10533
Closes #10555

Co-authored-by: Jay Satiro <raysatiro@yahoo.com>
2023-02-19 00:11:22 +01:00
Pierrick Charron
cffe301299
CURLOPT_WS_OPTIONS.3: fix the availability version
Closes #10557
2023-02-18 23:45:14 +01:00
Jacob Hoffman-Andrews
30411d7278
GHA: update rustls dependency to 0.9.2
This allows re-enabling test 312 for the rustls backend.

Closes #10553
2023-02-18 09:53:58 +01:00
Philip H
e665415a0e
HTTP3.md: update git branches
Closes #10554
2023-02-18 09:52:11 +01:00
Daniel Stenberg
e248439004
THANKS: added contributors from 7.88.0 2023-02-15 08:10:15 +01:00
Dan Fandrich
1807eb5e1f CONTRIBUTE: More formally specify the commit description
This codifies what people have actually used in git commits over the
past 6 years. I've left off some lesser-used headers that appear to
duplicate others and tried to describe a consistent use for several
others that were used more arbitrarily.

This makes it easier for new committers to find out the kinds of things
we want to acknowledge, makes it easier to perform statistical analysis
on commits, and opens the possibility of performing lint checks on
descriptions before submission.

Reviewed-by: Daniel Stenberg
Reviewed-by: Jay Satiro

Closes #10478
2023-02-13 12:15:26 -08:00
Daniel Stenberg
17153e173d
cmdline-opts/Makefile: on error, do not leave a partial
And support 'make V=1' to show the full command line

Closes #10497
2023-02-13 20:53:45 +01:00
Daniel Stenberg
daf4e6a3a1
curl.1: make help, version and manual sections "custom"
Instead of using "multi: boolean", as these are slightly special as in
they do are not enable/disable ones.

Fixes #10490
Reported-by: u20221022 on github
Closes #10497
2023-02-13 20:52:11 +01:00
Daniel Stenberg
a6ae169540
KNOW_BUGS: cleanups with some changed to TODOs
- remove "Excessive HTTP/2 packets with TCP_NODELAY"

  This is not a bug. Rather room for improvement.

I believe these have been fixed:

- 17.4 Connection failures with parallel HTTP/2
- 17.5 HTTP/2 connections through HTTPS proxy frequently stall

- remove "FTPS needs session reuse"

That is still true, but curl should also do session reuse now.

- remove "ASCII FTP"

It is documented behavior, and not single user has asked for extended
functionality here the last decade or so.

- remove "Passive transfer tries only one IP address"

add as a TODO

- remove "DoH leaks memory after followlocation"

With a recipe on how to reproduce, this is pointless to keep around

- remove "DoH does not inherit all transfer options"

add it as a TODO

Closes #10487
2023-02-13 17:10:57 +01:00
Daniel Stenberg
efbf02111a
smb: return error on upload without size
The protocol needs to know the size ahead of time, this is now a known
restriction and not a bug.

Also output a clearer error if the URL path does not contain proper
share.

Ref: #7896
Closes #10484
2023-02-12 18:04:41 +01:00
Gregory Panakkal
01772a3c39
WEBSOCKET.md: typo
Fixing missing slash for ws protocol scheme

Closes #10464
2023-02-10 10:28:40 +01:00
Daniel Stenberg
33866a31c3
no-clobber.d: only use long form options in man page text
... since they are expanded and the short-form gets mentioned
automatically so if the short form is mentioned as well, it gets
repeated.

Fixes #10461
Closes #10462
Reported-by: Dan Fandrich
2023-02-09 23:38:44 +01:00
Daniel Stenberg
458b85be27
header.d: add a header file example
Closes #10455
2023-02-09 15:45:19 +01:00
John Bampton
0065b146eb
misc: fix spelling
Closes #10437
2023-02-08 08:30:05 +01:00
Daniel Stenberg
1695fcf57d
man pages: call the custom user pointer 'clientp' consistently
The variable had a few different names. Now try to use 'clientp'
consistently for all man pages using a custom pointer set by the
application.

Reported-by: Gerrit Renker

Fixes #10434
Closes #10435
2023-02-07 22:33:47 +01:00
Daniel Stenberg
ff7c390b29
curl_ws_send.3: clarify how to send multi-frame messages 2023-02-06 17:27:51 +01:00
Thomas1664
c29ccb35ff
CURLOPT_WRITEFUNCTION.3: fix memory leak in example
Closes #10390
2023-02-03 10:02:47 +01:00
Stefan Eissing
671158242d
connections: introduce http/3 happy eyeballs
New cfilter HTTP-CONNECT for h3/h2/http1.1 eyeballing.
- filter is installed when `--http3` in the tool is used (or
  the equivalent CURLOPT_ done in the library)
- starts a QUIC/HTTP/3 connect right away. Should that not
  succeed after 100ms (subject to change), a parallel attempt
  is started for HTTP/2 and HTTP/1.1 via TCP
- both attempts are subject to IPv6/IPv4 eyeballing, same
  as happens for other connections
- tie timeout to the ip-version HAPPY_EYEBALLS_TIMEOUT
- use a `soft` timeout at half the value. When the soft timeout
  expires, the HTTPS-CONNECT filter checks if the QUIC filter
  has received any data from the server. If not, it will start
  the HTTP/2 attempt.

HTTP/3(ngtcp2) improvements.
- setting call_data in all cfilter calls similar to http/2 and vtls filters
  for use in callback where no stream data is available.
- returning CURLE_PARTIAL_FILE for prematurely terminated transfers
- enabling pytest test_05 for h3
- shifting functionality to "connect" UDP sockets from ngtcp2
  implementation into the udp socket cfilter. Because unconnected
  UDP sockets are weird. For example they error when adding to a
  pollset.

HTTP/3(quiche) improvements.
- fixed upload bug in quiche implementation, now passes 251 and pytest
- error codes on stream RESET
- improved debug logs
- handling of DRAIN during connect
- limiting pending event queue

HTTP/2 cfilter improvements.
- use LOG_CF macros for dynamic logging in debug build
- fix CURLcode on RST streams to be CURLE_PARTIAL_FILE
- enable pytest test_05 for h2
- fix upload pytests and improve parallel transfer performance.

GOAWAY handling for ngtcp2/quiche
- during connect, when the remote server refuses to accept new connections
  and closes immediately (so the local conn goes into DRAIN phase), the
  connection is torn down and a another attempt is made after a short grace
  period.
  This is the behaviour observed with nghttpx when we tell it to  shut
  down gracefully. Tested in pytest test_03_02.

TLS improvements
- ALPN selection for SSL/SSL-PROXY filters in one vtls set of functions, replaces
  copy of logic in all tls backends.
- standardized the infof logging of offered ALPNs
- ALPN negotiated: have common function for all backends that sets alpn proprty
  and connection related things based on the negotiated protocol (or lack thereof).

- new tests/tests-httpd/scorecard.py for testing h3/h2 protocol implementation.
  Invoke:
    python3 tests/tests-httpd/scorecard.py --help
  for usage.

Improvements on gathering connect statistics and socket access.
- new CF_CTRL_CONN_REPORT_STATS cfilter control for having cfilters
  report connection statistics. This is triggered when the connection
  has completely connected.
- new void Curl_pgrsTimeWas(..) method to report a timer update with
  a timestamp of when it happend. This allows for updating timers
  "later", e.g. a connect statistic after full connectivity has been
  reached.
- in case of HTTP eyeballing, the previous changes will update
  statistics only from the filter chain that "won" the eyeballing.
- new cfilter query CF_QUERY_SOCKET for retrieving the socket used
  by a filter chain.
  Added methods Curl_conn_cf_get_socket() and Curl_conn_get_socket()
  for convenient use of this query.
- Change VTLS backend to query their sub-filters for the socket when
  checks during the handshake are made.

HTTP/3 documentation on how https eyeballing works.

TLS improvements
- ALPN selection for SSL/SSL-PROXY filters in one vtls set of functions, replaces
  copy of logic in all tls backends.
- standardized the infof logging of offered ALPNs
- ALPN negotiated: have common function for all backends that sets alpn proprty
  and connection related things based on the negotiated protocol (or lack thereof).

Scorecard with Caddy.
- configure can be run with `--with-test-caddy=path` to specify which caddy to use for testing
- tests/tests-httpd/scorecard.py now measures download speeds with caddy

pytest improvements
- adding Makfile to clean gen dir
- adding nghttpx rundir creation on start
- checking httpd version 2.4.55 for test_05 cases where it is needed. Skipping with message if too old.
- catch exception when checking for caddy existance on system.

Closes #10349
2023-02-02 09:57:34 +01:00
Martin D'Aloia
3cc9df1817
write-out.d: add 'since version' to %{header_json} documentation
The documentation of `%{header_json}` missed to mention since which
version this variable for `--write-out` is present.

Based on commit https://github.com/curl/curl/commit/4133a69f2daa476bb
we can determine from the tags were this commit is present that the
first version to include it was `7.83.0`.
This could be also checked with:
`git tag --contains 4133a69f2daa476bb6d902687f1dd6660ea9c3c5`

Closes #10395
2023-02-02 08:31:41 +01:00
Daniel Stenberg
886861b38f
docs/INSTALL: document how to use multiple TLS backends
And document how OpenSSL forks and wolfSSL cannot be used at the same
time.

Reported-by: Mark Roszko
Fixes #10321
Closes #10382
2023-02-01 08:00:55 +01:00