Commit Graph

29013 Commits

Author SHA1 Message Date
Daniel Stenberg
cafb356e19
cmake: set feature PSL if present
... make test 1014 pass when libpsl is used.

Closes #9391
2022-08-30 15:39:12 +02:00
Daniel Stenberg
592290ed75
lib530: simplify realloc failure exit path
To make code analyzers happier

Closes #9392
2022-08-30 15:38:20 +02:00
Orgad Shaneh
56f1bbdd0c
tests: add tests for netrc login/password combinations
Covers the following PRs:

- #9066
- #9247
- #9248

Closes #9256
2022-08-29 17:26:21 +02:00
Orgad Shaneh
c40ec3178f
url: really use the user provided in the url when netrc entry exists
If the user is specified as part of the URL, and the same user exists
in .netrc, Authorization header was not sent at all.

The user and password fields were assigned in conn->user and password
but the user was not assigned to data->state.aptr, which is the field
that is used in output_auth_headers and friends.

Fix by assigning the user also to aptr.

Amends commit d1237ac906.

Fixes #9243
2022-08-29 17:25:29 +02:00
Orgad Shaneh
943fb2b26a
netrc: Use the password from lines without login
If netrc entry has password with empty login, use it for any username.

Example:
.netrc:
machine example.com password 123456

curl -vn http://user@example.com/

Fix it by initializing state_our_login to TRUE, and reset it only when
finding an entry with the same host and different login.

Closes #9248
2022-08-29 17:24:59 +02:00
Jay Satiro
8bd03516d6
url: treat missing usernames in netrc as empty
- If, after parsing netrc, there is a password with no username then
  set a blank username.

This used to be the case prior to 7d600ad (precedes 7.82). Note
parseurlandfillconn already does the same thing for URLs.

Reported-by: Raivis <standsed@users.noreply.github.com>
Testing-by: Domen Kožar

Fixes https://github.com/curl/curl/issues/8653
Closes #9334
Closes #9066
2022-08-29 17:24:22 +02:00
Daniel Stenberg
2fc031d834
test8: verify that "ctrl-byte cookies" are ignored 2022-08-29 11:20:53 +02:00
Daniel Stenberg
8dfc93e573
cookie: reject cookies with "control bytes"
Rejects 0x01 - 0x1f (except 0x09) plus 0x7f

Reported-by: Axel Chong

Bug: https://curl.se/docs/CVE-2022-35252.html

CVE-2022-35252

Closes #9381
2022-08-29 11:20:37 +02:00
Daniel Stenberg
74e156d00f
libssh: ignore deprecation warnings
libssh 0.10.0 marks all SCP functions as "deprecated" which causes
compiler warnings and errors in our CI jobs and elsewhere. Ignore
deprecation warnings if 0.10.0 or later is found in the build.

If they actually remove the functions at a later point, then someone can
deal with that pain and functionality break then.

Fixes #9382
Closes #9383
2022-08-29 10:54:39 +02:00
Daniel Stenberg
aec8d30624
Revert "schannel: when importing PFX, disable key persistence"
This reverts commit 70d010d285.

Due to further reports in #9300 that indicate this commit might
introduce problems.
2022-08-29 08:16:20 +02:00
Daniel Stenberg
7632c0d25a
multi: use larger dns hash table for multi interface
Have curl_multi_init() use a much larger DNS hash table than used for
the easy interface to scale and perform better when used with _many_
host names.

curl_share_init() sets an in-between size.

Inspired-by: Ivan Tsybulin
See #9340
Closes #9376
2022-08-29 00:07:09 +02:00
Marc Hoersken
c5c6e86783
CI/runtests.pl: add param for dedicated curl to talk to APIs
This should make it possible to also report test failures
if our freshly build curl binary is not fully functional.

Reviewed-by: Daniel Stenberg
Closes #9360
2022-08-28 19:18:22 +02:00
Jacob Tolar
65bbb5e6f4
openssl: add cert path in error message
Closes #9349
2022-08-27 23:26:42 +02:00
Jacob Tolar
74af81ca03
cert.d: clarify that escape character works for file paths
Closes #9349
2022-08-27 23:25:32 +02:00
Daniel Stenberg
313e606d99
gha: move over ngtcp2-gnutls CI job from zuul
Closes #9331
2022-08-27 14:43:26 +02:00
Marc Hoersken
109e9730ee
cmake: add detection of threadsafe feature
Avoids failing test 1014 by replicating configure checks
for HAVE_ATOMIC and _WIN32_WINNT with custom CMake tests.

Reviewed-by: Marcel Raad

Follow up to #8680
Closes #9312
2022-08-26 21:09:32 +02:00
Daniel Stenberg
8c98d14b88
RELEASE-NOTES: synced 2022-08-26 16:23:20 +02:00
Marc Hoersken
d80b4f1ef0
CI/azure: align torture shallowness with GHA
There 25 is used with FTP tests skipped, and 20 for FTP tests.
This should make torture tests stay within the 60min timeout.

Reviewed-by: Daniel Stenberg
Closes #9371
2022-08-26 11:37:46 +02:00
Marc Hoersken
bc25c9e3ee
multi_wait: fix and improve Curl_poll error handling on Windows
First check for errors and return CURLM_UNRECOVERABLE_POLL
before moving forward and waiting on socket readiness events.

Reviewed-by: Jay Satiro
Reviewed-by: Marcel Raad

Reported-by: Daniel Stenberg
Ref: #9361

Follow up to #8961
Closes #9372
2022-08-26 11:36:42 +02:00
Marc Hoersken
a71fe41d2f
multi_wait: fix skipping to populate revents for extra_fds
On Windows revents was not populated for extra_fds if
multi_wait had to wait due to the Curl_poll pre-check
not signalling any readiness. This commit fixes that.

Reviewed-by: Marcel Raad
Reviewed-by: Jay Satiro

Closes #9361
2022-08-25 23:31:24 +02:00
Marc Hoersken
52484bf383
CI/appveyor: disable TLS in msys2-native autotools builds
Schannel cannot be used from msys2-native Linux-emulated builds.

Reviewed-by: Marcel Raad
Reviewed-by: Daniel Stenberg

Follow up to #9367
Closes #9370
2022-08-25 23:31:13 +02:00
Jay Satiro
ef121401d6 tests: fix http2 tests to use CRLF headers
Prior to this change some tests that rely on nghttpx proxy did not use
CRLF headers everywhere. A recent change in nghttp2, which updated its
version of llhttp (HTTP parser), requires curl's HTTP/1.1 test server to
use CRLF headers.

Ref: https://github.com/nghttp2/nghttp2/commit/9d389e8

Fixes https://github.com/curl/curl/issues/9364
Closes https://github.com/curl/curl/pull/9365
2022-08-25 12:05:30 -04:00
rcombs
07f80f968d
multi: use a pipe instead of a socketpair on apple platforms
Sockets may be shut down by the kernel when the app is moved to the
background, but pipes are not.

Removed from KNOWN_BUGS

Fixes #6132
Closes #9368
2022-08-25 17:43:08 +02:00
Somnath Kundu
89d204036a
libssh2: provide symlink name in SFTP dir listing
When reading the symbolic link name for a file, we need to add the file
name to base path name.

Closes #9369
2022-08-25 17:37:10 +02:00
Daniel Stenberg
576e507c78
configure: if asked to use TLS, fail if no TLS lib was detected
Previously the configure script would just warn about this fact and
continue with TLS disabled build which is not always helpful. TLS should
be explicitly disabled if that is what the user wants.

Closes #9367
2022-08-25 17:29:50 +02:00
Dustin Howett
70d010d285
schannel: when importing PFX, disable key persistence
By default, the PFXImportCertStore API persists the key in the user's
key store (as though the certificate was being imported for permanent,
ongoing use.)

The documentation specifies that keys that are not to be persisted
should be imported with the flag `PKCS12_NO_PERSIST_KEY`.
NOTE: this flag is only supported on versions of Windows newer than XP
and Server 2003.

Fixes #9300
Closes #9363
2022-08-25 13:47:27 +02:00
Daniel Stenberg
3f98eaafa0
unit1303: four tests should have TRUE for 'connecting'
To match the comments.

Reported-by: Wu Zheng

See #9355
Closes #9356
2022-08-23 17:39:37 +02:00
Daniel Stenberg
cf6e9ce80b
CURLOPT_BUFFERSIZE.3: add upload buffersize to see also
Closes #9354
2022-08-23 14:54:55 +02:00
Fabian Fischer
75ca89856c
HTTP3.md: add missing autoreconf command for building with wolfssl
Closes #9353
2022-08-23 14:17:20 +02:00
Daniel Stenberg
1e0f67f82b
RELEASE-NOTES: synced 2022-08-23 13:48:35 +02:00
Daniel Stenberg
31a41d45b7
multi: have curl_multi_remove_handle close CONNECT_ONLY transfer
Ẃhen it has been used in the multi interface, it is otherwise left in
the connection cache, can't be reused and nothing will close them since
the easy handle loses the association with the multi handle and thus the
connection cache - until the multi handle is closed or it gets pruned
because the cache is full.

Reported-by: Dominik Thalhammer
Fixes #9335
Closes #9342
2022-08-23 13:44:11 +02:00
Daniel Stenberg
fdbcd39488
docs/cmdline-opts: remove \& escapes from all .d files
gen.pl escapes them itself now
2022-08-23 13:43:10 +02:00
Daniel Stenberg
567693196a
docs/cmdline-opts/gen.pl: encode leading single and double quotes
As "(aq" and "(dq" to prevent them from implying a meaning in the nroff
output. This removes the need for using \& escapes in the .d files'
description parts.

Closes #9352
2022-08-23 13:43:10 +02:00
Marc Hoersken
91948a9eaf
tests/server/sockfilt.c: avoid race condition without a mutex
Avoid loosing any triggered handles by first aborting and joining
the waiting threads before evaluating the individual signal state.

This removes the race condition and therefore need for a mutex.

Closes #9023
2022-08-23 12:17:20 +02:00
Emil Engler
2c86f1b345
url: output the maximum when rejecting a url
This commit changes the failf message to output the maximum length, when
curl refuses to process a URL because it is too long.

See: #9317
Closes: #9327
2022-08-22 23:36:02 +02:00
Chris Paulson-Ellis
a8f52ce225
configure: fix broken m4 syntax in TLS options
Commit b589696f added lines to some shell within AC_ARG_WITH macros, but
inadvertently failed to move the final closing ).

Quote the script section using braces.

So, if these problems have been around for a while, how did I find them?
Only because I did a configure including these options:

    $ ./configure --with-openssl --without-rustls
      SSL:              enabled (OpenSSL)

Closes #9344
2022-08-22 15:48:05 +02:00
Daniel Stenberg
d162fca69a
tests/data/CMakeLists: remove making the 'show' makefile target
It is not used by runtests since 3c0f462

Closes #9333
2022-08-18 11:40:12 +02:00
Daniel Stenberg
aedd0a7c9b
tests/data/Makefile: remove 'filecheck' target
No practical use anymore since 3c0f4622cd

Closes #9332
2022-08-18 11:39:12 +02:00
Daniel Stenberg
f3c013d38c
libssh2: make atime/mtime date overflow return error
Closes #9328
2022-08-18 00:02:19 +02:00
Daniel Stenberg
c988ec9f41
libssh: make atime/mtime date overflow return error
Closes #9328
2022-08-18 00:02:09 +02:00
Daniel Stenberg
5357686fdf
examples/curlx.c: remove
This example is a bit convoluted to use as an example, combined with the
special license for it makes it unsuitable.

Closes #9330
2022-08-18 00:00:12 +02:00
Tobias Nygren
e761a1d1d9
curl.h: include <sys/select.h> on SunOS
It is needed for fd_set to be visible to downstream consumers that use
<curl/multi.h>. Header is known to exist at least as far back as Solaris
2.6.

Closes #9329
2022-08-17 13:25:02 +02:00
Daniel Stenberg
2ef3a001f5
DEPRECATE.md: push the NSS deprecation date forward one year to 2023
URL: https://curl.se/mail/lib-2022-08/0016.html
2022-08-17 10:07:13 +02:00
Daniel Stenberg
8e88e52ed0
libssh2: setting atime or mtime >32bit on 4-bytes-long systems
Since the libssh2 API uses 'long' to store the timestamp, it cannot
transfer >32bit times on Windows and 32bit architecture builds.

Avoid nasty surprises by instead not setting such time.

Spotted by Coverity

Closes #9325
2022-08-16 23:16:53 +02:00
Daniel Stenberg
44a02d2532
libssh: setting atime or mtime > 32bit is now just skipped
The libssh API used caps the time to an unsigned 32bit variable. Avoid
nasty surprises by instead not setting such time.

Spotted by Coverity.

Closes #9324
2022-08-16 23:15:57 +02:00
Jay Satiro
ebe3fdb0e3 KNOWN_BUGS: Windows Unicode builds use homedir in current locale
Bug: https://github.com/curl/curl/pull/7252
Reported-by: dEajL3kA@users.noreply.github.com

Ref: https://github.com/curl/curl/pull/7281

Closes https://github.com/curl/curl/pull/9305
2022-08-16 11:30:47 -04:00
Daniel Stenberg
04427fc207
test399: switch it to use a config file instead
... as using a 65535 bytes host name in a URL does not fit on the
command line on some systems - like Windows.

Reported-by: Marcel Raad
Fixes #9321
Closes #9322
2022-08-16 16:35:47 +02:00
Daniel Stenberg
d29de2ab80
RELEASE-NOTES: synced 2022-08-16 09:46:33 +02:00
Daniel Stenberg
14d9d79c87
asyn-ares: make a single alloc out of hostname + async data
This saves one alloc per name resolve and simplifies the exit path.

Closes #9310
2022-08-16 08:54:33 +02:00
Daniel Stenberg
37dbbbb6c1
Curl_close: call Curl_resolver_cancel to avoid memory-leak
There might be a pending (c-ares) resolve that isn't free'd up yet.

Closes #9310
2022-08-16 08:54:30 +02:00