Commit Graph

1028 Commits

Author SHA1 Message Date
Dan Fandrich
1fe081ab42 tests: fix lib tests to run with a dynamic log directory
Ref: #10818
2023-03-30 09:53:57 -07:00
dengjfzh
6c6306f300
rtsp: skip malformed RTSP interleaved frame data
Some IP cameras send malformed RTSP interleaved frames sometimes, which
can cause curl_easy_perform return 1 (CURLE_UNSUPPORTED_PROTOCOL).  This
change attempts to skip clearly incorrect RTSP interleaving frame data.

Closes #10808
2023-03-30 09:59:09 +02:00
Daniel Stenberg
f24014c3eb
lib2305: deal with CURLE_AGAIN
The test does a slightly ugly busy-loop for this case but should be
managable due to it likely being a very short moment.

Mention CURLE_AGAIN in curl_ws_recv.3

Fixes #10760
Reported-by: Jay Satiro
Closes #10781
2023-03-16 23:29:12 +01:00
Daniel Stenberg
5ec15ea48f
lib643: LIB644 is never defined, this is dead code
Closes #10765
2023-03-15 00:08:09 +01:00
Daniel Stenberg
7ce1a6ae75
libtest/Makefile.inc: remove superfluous variables
Rely on the defaults when possible.

Closes #10765
2023-03-15 00:08:01 +01:00
Casey Bodley
495d09810a
aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
all s3 requests default to UNSIGNED-PAYLOAD and add the required
x-amz-content-sha256 header. this allows CURLAUTH_AWS_SIGV4 to correctly
sign s3 requests to amazon with no additional configuration

Signed-off-by: Casey Bodley <cbodley@redhat.com>

Closes #9995
2023-03-14 17:04:47 +01:00
Dan Fandrich
0cbfe32fb1 tests: make first.c the same for both lib tests and unit tests
The only difference used to be global variable used in unittest tests.
After cb7ed5a removed individual flag overrides for the unittests, first.c
was no longer recompiled for unit tests to include the flag, so whether it
worked or gave a link error depended on whether it was compiled in
libtest or unittest first. This way also speeds up the build by
eliminating 40 identical compile invocations.

Fixes #10749
2023-03-12 19:14:59 -07:00
Daniel Stenberg
674a0662cf test1903: test use of COOKIEFILE - reset - COOKIEFILE
This also tests for the memory leak bug fixed by parent commit b559ef6f.

Ref: #10694

Closes https://github.com/curl/curl/pull/10712
2023-03-10 03:56:59 -05:00
Daniel Stenberg
0a0c9b6dfa
urlapi: '%' is illegal in host names
Update test 1560 to verify

Ref: #10708
Closes #10711
2023-03-08 15:33:43 +01:00
Daniel Stenberg
54605666ed
lib1560: fix enumerated type mixed with another type
Follow-up to c84c0f9aa3

Closes #10684
2023-03-06 08:14:42 +01:00
Daniel Stenberg
c84c0f9aa3
lib1560: test parsing URLs with ridiculously large fields
In the order of 120K.

Closes #10665
2023-03-03 23:23:53 +01:00
Daniel Stenberg
e4dfe6fc2f
test1960: verify CURL_SOCKOPT_ALREADY_CONNECTED
When returned from the CURLOPT_SOCKOPTFUNCTION, like when we have a
custom socket connected in the app, passed in to libcurl.

Verifies the fix in #10648

Closes #10651
2023-03-03 08:36:25 +01:00
Daniel Stenberg
835682661c
misc: remove support for curl_off_t < 8 bytes
Closes #10597
2023-02-24 17:05:33 +01:00
Daniel Stenberg
bb11969838
lib1560: add a test using %25 in the userinfo in a URL
Closes #10578
2023-02-21 16:10:13 +01:00
Daniel Stenberg
f074602072
lib517: verify time stamps without leading zeroes plus some more 2023-02-20 23:48:25 +01:00
Daniel Stenberg
b30b0c3840
lib1560: add IPv6 canonicalization tests
Closes #10552
2023-02-17 23:22:05 +01:00
Daniel Stenberg
8b27799f8c
urlapi: do the port number extraction without using sscanf()
- sscanf() is rather complex and slow, strchr() much simpler

- the port number function does not need to fully verify the IPv6 address
  anyway as it is done later in the hostname_check() function and doing
  it twice is unnecessary.

Closes #10541
2023-02-17 16:21:26 +01:00
Daniel Stenberg
36fca647a4
libtest: build lib2305 with multibyte as well
Fixes a build regression.

Follow-up to 5a9a04d556
Reported-by: Viktor Szakats
Ref: https://github.com/curl/curl/pull/10475#issuecomment-1426831800

Closes #10477
2023-02-12 11:20:34 +01:00
Daniel Stenberg
5a9a04d556
test2305: send 3 frames, 4097 bytes each, as one message
Receive them using a 256 bytes buffer in a loop.
2023-02-10 08:28:59 +01:00
Jay Satiro
b4b6e4f1fa curl_setup: Disable by default recv-before-send in Windows
Prior to this change a workaround for Windows to recv before every send
was enabled by default. The way it works is a recv is called before
every send and saves the received data, in case send fails because in
Windows apparently that can wipe out the socket's internal received
data buffer.

This feature has led to several bugs because the way libcurl operates
it waits on a socket to read or to write, and may not at all times
check for buffered receive data.

Two recent significant bugs this workaround caused:
- Broken Schannel TLS 1.3 connections (#9431)
- HTTP/2 arbitrary hangs (#10253)

The actual code remains though it is disabled by default. Though future
changes to connection filter buffering could improve the situation IMO
it's just not tenable to manage this workaround.

Ref: https://github.com/curl/curl/issues/657
Ref: https://github.com/curl/curl/pull/668
Ref: https://github.com/curl/curl/pull/720

Ref: https://github.com/curl/curl/issues/9431
Ref: https://github.com/curl/curl/issues/10253

Closes https://github.com/curl/curl/pull/10409
2023-02-09 01:30:10 -05:00
John Bampton
0065b146eb
misc: fix spelling
Closes #10437
2023-02-08 08:30:05 +01:00
Gisle Vanem
62097a7ea4 libtest: add a sleep macro for Windows
.. because sleep() is used in some libtests.

Closes https://github.com/curl/curl/pull/10295
2023-02-05 03:15:07 -05:00
Stefan Eissing
671158242d
connections: introduce http/3 happy eyeballs
New cfilter HTTP-CONNECT for h3/h2/http1.1 eyeballing.
- filter is installed when `--http3` in the tool is used (or
  the equivalent CURLOPT_ done in the library)
- starts a QUIC/HTTP/3 connect right away. Should that not
  succeed after 100ms (subject to change), a parallel attempt
  is started for HTTP/2 and HTTP/1.1 via TCP
- both attempts are subject to IPv6/IPv4 eyeballing, same
  as happens for other connections
- tie timeout to the ip-version HAPPY_EYEBALLS_TIMEOUT
- use a `soft` timeout at half the value. When the soft timeout
  expires, the HTTPS-CONNECT filter checks if the QUIC filter
  has received any data from the server. If not, it will start
  the HTTP/2 attempt.

HTTP/3(ngtcp2) improvements.
- setting call_data in all cfilter calls similar to http/2 and vtls filters
  for use in callback where no stream data is available.
- returning CURLE_PARTIAL_FILE for prematurely terminated transfers
- enabling pytest test_05 for h3
- shifting functionality to "connect" UDP sockets from ngtcp2
  implementation into the udp socket cfilter. Because unconnected
  UDP sockets are weird. For example they error when adding to a
  pollset.

HTTP/3(quiche) improvements.
- fixed upload bug in quiche implementation, now passes 251 and pytest
- error codes on stream RESET
- improved debug logs
- handling of DRAIN during connect
- limiting pending event queue

HTTP/2 cfilter improvements.
- use LOG_CF macros for dynamic logging in debug build
- fix CURLcode on RST streams to be CURLE_PARTIAL_FILE
- enable pytest test_05 for h2
- fix upload pytests and improve parallel transfer performance.

GOAWAY handling for ngtcp2/quiche
- during connect, when the remote server refuses to accept new connections
  and closes immediately (so the local conn goes into DRAIN phase), the
  connection is torn down and a another attempt is made after a short grace
  period.
  This is the behaviour observed with nghttpx when we tell it to  shut
  down gracefully. Tested in pytest test_03_02.

TLS improvements
- ALPN selection for SSL/SSL-PROXY filters in one vtls set of functions, replaces
  copy of logic in all tls backends.
- standardized the infof logging of offered ALPNs
- ALPN negotiated: have common function for all backends that sets alpn proprty
  and connection related things based on the negotiated protocol (or lack thereof).

- new tests/tests-httpd/scorecard.py for testing h3/h2 protocol implementation.
  Invoke:
    python3 tests/tests-httpd/scorecard.py --help
  for usage.

Improvements on gathering connect statistics and socket access.
- new CF_CTRL_CONN_REPORT_STATS cfilter control for having cfilters
  report connection statistics. This is triggered when the connection
  has completely connected.
- new void Curl_pgrsTimeWas(..) method to report a timer update with
  a timestamp of when it happend. This allows for updating timers
  "later", e.g. a connect statistic after full connectivity has been
  reached.
- in case of HTTP eyeballing, the previous changes will update
  statistics only from the filter chain that "won" the eyeballing.
- new cfilter query CF_QUERY_SOCKET for retrieving the socket used
  by a filter chain.
  Added methods Curl_conn_cf_get_socket() and Curl_conn_get_socket()
  for convenient use of this query.
- Change VTLS backend to query their sub-filters for the socket when
  checks during the handshake are made.

HTTP/3 documentation on how https eyeballing works.

TLS improvements
- ALPN selection for SSL/SSL-PROXY filters in one vtls set of functions, replaces
  copy of logic in all tls backends.
- standardized the infof logging of offered ALPNs
- ALPN negotiated: have common function for all backends that sets alpn proprty
  and connection related things based on the negotiated protocol (or lack thereof).

Scorecard with Caddy.
- configure can be run with `--with-test-caddy=path` to specify which caddy to use for testing
- tests/tests-httpd/scorecard.py now measures download speeds with caddy

pytest improvements
- adding Makfile to clean gen dir
- adding nghttpx rundir creation on start
- checking httpd version 2.4.55 for test_05 cases where it is needed. Skipping with message if too old.
- catch exception when checking for caddy existance on system.

Closes #10349
2023-02-02 09:57:34 +01:00
Daniel Stenberg
2bc1d775f5
copyright: update all copyright lines and remove year ranges
- they are mostly pointless in all major jurisdictions
- many big corporations and projects already don't use them
- saves us from pointless churn
- git keeps history for us
- the year range is kept in COPYING

checksrc is updated to allow non-year using copyright statements

Closes #10205
2023-01-03 09:19:21 +01:00
Marcel Raad
49f39dfac9
lib670: make test.h the first include
As in all other lib tests. This avoids a macro redefinition warning for
`_FILE_OFFSET_BITS` visible in the autobuilds.

Closes https://github.com/curl/curl/pull/10182
2022-12-30 21:57:35 +01:00
Stefan Eissing
71b7e01610
lib: connect/h2/h3 refactor
Refactoring of connection setup and happy eyeballing. Move
nghttp2. ngtcp2, quiche and msh3 into connection filters.

 - eyeballing cfilter that uses sub-filters for performing parallel connects
 - socket cfilter for all transport types, including QUIC
 - QUIC implementations in cfilter, can now participate in eyeballing
 - connection setup is more dynamic in order to adapt to what filter did
   really connect.  Relevant to see if a SSL filter needs to be added or
   if SSL has already been provided
 - HTTP/3 test cases similar to HTTP/2
 - multiuse of parallel transfers for HTTP/3, tested for ngtcp2 and quiche

 - Fix for data attach/detach in VTLS filters that could lead to crashes
   during parallel transfers.
 - Eliminating setup() methods in cfilters, no longer needed.
 - Improving Curl_conn_is_alive() to replace Curl_connalive() and
   integrated ssl alive checks into cfilter.
 - Adding CF_CNTRL_CONN_INFO_UPDATE to tell filters to update
   connection into and persist it at the easy handle.

 - Several more cfilter related cleanups and moves:
   - stream_weigth and dependency info is now wrapped in struct
     Curl_data_priority
   - Curl_data_priority members depend is available in HTTP2|HTTP3
   - Curl_data_priority members depend on NGHTTP2 support
   - handling init/reset/cleanup of priority part of url.c
   - data->state.priority same struct, but shallow copy for compares only

 - PROTOPT_STREAM has been removed
   - Curl_conn_is_mulitplex() now available to check on capability

 - Adding query method to connection filters.
   - ngtcp2+quiche: implementing query for max concurrent transfers.

 - Adding is_alive and keep_alive cfilter methods. Adding DATA_SETUP event.
   - setting keepalive timestamp on connect
   - DATA_SETUP is called after the connection has been completely
     setup (but may not connected yet) to allow filters to initialize
     data members they use.

 - there is no socket to be had with msh3, it is unclear how select
   shall work

 - manual test via "curl --http3 https://curl.se" fail with "empty
   reply from server".

 - Various socket/conn related cleanups:
   - Curl_socket is now Curl_socket_open and in cf-socket.c
   - Curl_closesocket is now Curl_socket_close and in cf-socket.c
   - Curl_ssl_use has been replaced with Cur_conn_is_ssl
   - Curl_conn_tcp_accepted_set has been split into
     Curl_conn_tcp_listen_set and Curl_conn_tcp_accepted_set
     with a clearer purpose

Closes #10141
2022-12-30 16:43:19 +01:00
Daniel Stenberg
901392cbb7
urlapi: add CURLU_PUNYCODE
Allows curl_url_get() get the punycode version of host names for the
host name and URL parts.

Extend test 1560 to verify.

Closes #10109
2022-12-26 23:29:23 +01:00
Stefan Eissing
c7fb341c0e
tests: add 3 new HTTP/2 test cases, plus https: support for nghttpx
- a simple https get
- a simple https post
- a multi get of 4 requests and check that same connection was used

Closes #10114
2022-12-23 08:56:53 +01:00
Daniel Stenberg
b151faa083
lib1560: add some basic IDN host name tests
Closes #10094
2022-12-15 22:57:08 +01:00
Daniel Stenberg
c20b35ddae
urlapi: reject more bad letters from the host name: &+()
Follow-up from eb0167ff7d

Extend test 1560 to verify

Closes #10096
2022-12-15 08:23:48 +01:00
Daniel Stenberg
86b4b66c54
test2304: verify websocket handling when connection is closed 2022-12-13 15:13:09 +01:00
Casey Bodley
fcf8f68546
test/aws_sigv4: test cases for content-sha256
1956 adds the sha256 value corresponding to an empty buffer
1957 adds an arbitrary value and confirms that the signature differs from 1956
1958 adds whitespace to 1957 and confirms that the signature matches 1957
1959 adds a value longer than 'char sha_hex[65]' in Curl_output_aws_sigv4()

Signed-off-by: Casey Bodley <cbodley@redhat.com>

Closes #9804
2022-11-25 09:24:43 +01:00
Daniel Stenberg
cde8f28489
test1662: verify formpost, 301 redirect, no rewind possible
Reproduces #9735 and verifies the subsequent fix. The original issue
uses a pipe that cannot be rewound, but this test case instead sets a
callback without rewind ability to get roughly the same properties but
being a much more portable test.
2022-11-25 08:30:29 +01:00
Jay Satiro
856b133f5d test3026: reduce runtime in legacy mingw builds
- Load Windows system libraries secur32 and iphlpapi beforehand, so
  that libcurl's repeated global init/cleanup only increases/decreases
  the library's refcount rather than causing it to load/unload.

Assisted-by: Marc Hoersken

Closes https://github.com/curl/curl/pull/9412
2022-11-18 02:54:57 -05:00
Patrick Monnerat
6967571bf2
lib: feature deprecation warnings in gcc >= 4.3
Add a deprecated attribute to functions and enum values that should not
be used anymore.
This uses a gcc 4.3 dialect, thus is only available for this version of
gcc and newer. Note that the _Pragma() keyword is introduced by C99, but
is available as part of the gcc dialect even when compiling in C89 mode.

It is still possible to disable deprecation at a calling module compile
time by defining CURL_DISABLE_DEPRECATION.

Gcc type checking macros are made aware of possible deprecations.

Some testing support Perl programs are adapted to the extended
declaration syntax.

Several test and unit test C programs intentionally use deprecated
functions/options and are annotated to not generate a warning.

New test 1222 checks the deprecation status in doc and header files.

Closes #9667
2022-11-15 10:57:29 +01:00
Daniel Stenberg
fa0b922761
http: mark it 'this_is_a_follow' in the Location: logic
To make regular auth "reloads" to not count as redirects.

Verified by test 3101

Fixes #9885
Closes #9887
2022-11-12 00:12:46 +01:00
Lorenzo Miniero
0baca08dc9
test3100: RTSP Basic authentication
Closes #9449
2022-11-09 09:40:07 +01:00
Rose
f151ec6c10 lib: fix some type mismatches and remove unneeded typecasts
Many of these castings are unneeded if we change the variables to work
better with each other.

Ref: https://github.com/curl/curl/pull/9823

Closes https://github.com/curl/curl/pull/9835
2022-11-08 03:11:01 -05:00
Daniel Stenberg
480ac6e54d
lib1301: unit103 turned into a libtest
It is not a unit test so moved over to libtests.
2022-11-01 17:01:26 +01:00
Daniel Stenberg
52cc4a85fd
style: use space after comment start and before comment end
/* like this */

/*not this*/

checksrc is updated accordingly

Closes #9828
2022-10-30 22:31:29 +01:00
Ayesh Karunaratne
4484270afc
misc: typo and grammar fixes
- Replace `Github` with `GitHub`.
- Replace `windows` with `Windows`
- Replace `advice` with `advise` where a verb is used.
- A few fixes on removing repeated words.
- Replace `a HTTP` with `an HTTP`

Closes #9802
2022-10-27 10:01:30 +02:00
Daniel Stenberg
7d6cf06f57
urlapi: fix parsing URL without slash with CURLU_URLENCODE
When CURLU_URLENCODE is set, the parser would mistreat the path
component if the URL was specified without a slash like in
http://local.test:80?-123

Extended test 1560 to reproduce and verify the fix.

Reported-by: Trail of Bits

Closes #9763
2022-10-20 08:56:53 +02:00
Marc Hoersken
81094cb492
tests: avoid CreateThread if _beginthreadex is available
CreateThread is not threadsafe if mixed with CRT calls.
_beginthreadex on the other hand can be mixed with CRT.

Reviewed-by: Marcel Raad
Closes #9705
2022-10-19 11:59:00 +02:00
Matthias Gatto
29c4aa00a1
aws_sigv4: fix header computation
Handle canonical headers and signed headers creation as explained here:
https://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html

The algo tells that signed and canonical must contain at last host and
x-amz-date.

So we check whatever thoses are present in the curl http headers list.
If they are, we use the one enter by curl user, otherwise we generate
them.  then we to lower, and remove space from each http headers plus
host and x-amz-date, then sort them all by alphabetical order.

This patch also fix a bug with host header, which was ignoring the port.

Closes #7966
2022-10-11 14:33:46 +02:00
Daniel Stenberg
e3f335148a
websockets: remodeled API to support 63 bit frame sizes
curl_ws_recv() now receives data to fill up the provided buffer, but can
return a partial fragment. The function now also get a pointer to a
curl_ws_frame struct with metadata that also mentions the offset and
total size of the fragment (of which you might be receiving a smaller
piece). This way, large incoming fragments will be "streamed" to the
application. When the curl_ws_frame struct field 'bytesleft' is 0, the
final fragment piece has been delivered.

curl_ws_recv() was also adjusted to work with a buffer size smaller than
the fragment size. (Possibly needless to say as the fragment size can
now be 63 bit large).

curl_ws_send() now supports sending a piece of a fragment, in a
streaming manner, in addition to sending the entire fragment in a single
call if it is small enough. To send a huge fragment, curl_ws_send() can
be used to send it in many small calls by first telling libcurl about
the total expected fragment size, and then send the payload in N number
of separate invokes and libcurl will stream those over the wire.

The struct curl_ws_meta() returns is now called 'curl_ws_frame' and it
has been extended with two new fields: *offset* and *bytesleft*. To help
describe the passed on data chunk when a fragment is delivered in many
smaller pieces.

The documentation has been updated accordingly.

Closes #9636
2022-10-07 12:50:58 +02:00
Daniel Stenberg
eb0167ff7d
urlapi: reject more bad characters from the host name field
Extended test 1560 to verify

Report from the ongoing source code audit by Trail of Bits.

Closes #9608
2022-09-28 08:22:42 +02:00
Daniel Stenberg
1a87a1efba
url: a zero-length userinfo part in the URL is still a (blank) user
Adjusted test 1560 to verify

Reported-by: Jay Satiro

Fixes #9088
Closes #9590
2022-09-26 07:45:53 +02:00
Patrick Monnerat
549032df41
lib517: fix C89 constant signedness
In C89, positive integer literals that overflow an int but not an
unsigned int may be understood as a negative int.

lib517.c:129:3: warning: this decimal constant is unsigned only in ISO C90
   {"Sun, 06 Nov 2044 08:49:37 GMT", 2362034977 },
   ^

Closes #9572
2022-09-22 23:08:08 +02:00
Daniel Stenberg
307b7543ea
misc: null-terminate
Make use of this term consistently.

Closes #9527
2022-09-17 23:19:29 +02:00
Patrick Monnerat
7ca36f4956
lib1597: make it C89-compliant again
Automatic variable addresses cannot be used in an initialisation
aggregate.

Follow-up to 9d51329

Reported-by: Daniel Stenberg
Fixes: #9524
Closes #9525
2022-09-17 17:26:43 +02:00