Commit Graph

29182 Commits

Author SHA1 Message Date
Daniel Stenberg
eb0167ff7d
urlapi: reject more bad characters from the host name field
Extended test 1560 to verify

Report from the ongoing source code audit by Trail of Bits.

Closes #9608
2022-09-28 08:22:42 +02:00
Daniel Stenberg
267668308b
configure: deprecate builds with small curl_off_t
If curl_off_t turns out to be smaller than 8 bytes,
--with-n64-deprecated needs to be used to allow the build to
continue. This is to highlight the fact that support for such builds is
going away next year.

Also mentioned in DEPRECATED.md

Closes #9605
2022-09-28 08:19:06 +02:00
Patrick Monnerat
72652c0613
http, vauth: always provide Curl_allow_auth_to_host() functionality
This function is currently located in the lib/http.c module and is
therefore disabled by the CURL_DISABLE_HTTP conditional token.

As it may be called by TLS backends, disabling HTTP results in an
undefined reference error at link time.

Move this function to vauth/vauth.c to always provide it and rename it
as Curl_auth_allowed_to_host() to respect the vauth module naming
convention.

Closes #9600
2022-09-27 14:05:37 +02:00
Daniel Stenberg
4adee03cd4
ngtcp2: fix C89 compliance nit 2022-09-27 14:02:27 +02:00
Daniel Stenberg
58acc69e10
openssl: make certinfo available for QUIC
Curl_ossl_certchain() is now an exported function in lib/vtls/openssl.c that
can also be used from quiche.c and ngtcp2.c to get the cert chain for QUIC
connections as well.

The *certchain function was moved to the top of the file for this reason.

Reported-by: Eloy Degen
Fixes #9584
Closes #9597
2022-09-27 14:02:27 +02:00
Daniel Stenberg
35cb4e0997
RELEASE-NOTES: synced 2022-09-27 13:09:44 +02:00
Daniel Stenberg
8ac54a992f
DEPRECATE.md: Support for systems without 64 bit data types
Closes #9604
2022-09-27 12:51:49 +02:00
Patrick Monnerat
d08c01e50f
tests: skip mime/form tests when mime is not built-in
Closes #9596
2022-09-27 09:41:05 +02:00
Daniel Stenberg
99d3682303
url: rename function due to name-clash in Watt-32
Follow-up to 2481dbe5f4 and applies the change the way it was
intended.
2022-09-27 09:34:22 +02:00
Viktor Szakats
92b9624a68
windows: adjust name of two internal public functions
According to `docs/INTERNALS.md`, internal function names spanning source
files start with uppercase `Curl_`. Bring these two functions in
alignment with this.

This also stops exporting them from `libcurl.dll` in autotools builds.

Reviewed-by: Daniel Stenberg

Closes #9598
2022-09-26 22:32:23 +00:00
Gisle Vanem
2481dbe5f4
url: rename function due to name-clash in Watt-32
Since the commit 764c958c52, there was a new function called
resolve_ip(). This clashes with an internal function in Watt-32.

Closes #9585
2022-09-26 13:20:49 +02:00
Jay Satiro
5c0d02b7a7 schannel: ban server ALPN change during recv renegotiation
By the time schannel_recv is renegotiating the connection, libcurl has
already decided on a protocol and it is too late for the server to
select a protocol via ALPN except for the originally selected protocol.

Ref: https://github.com/curl/curl/issues/9451

Closes https://github.com/curl/curl/pull/9463
2022-09-26 03:26:49 -04:00
Daniel Stenberg
1a87a1efba
url: a zero-length userinfo part in the URL is still a (blank) user
Adjusted test 1560 to verify

Reported-by: Jay Satiro

Fixes #9088
Closes #9590
2022-09-26 07:45:53 +02:00
Viktor Szakats
61c7ccab83
autotools: allow --enable-symbol-hiding with windows
This local autotools logic was put in place in
9e24b9c7af (in 2012) which disabled it for
Windows unconditionally. Testing reveals that it actually works with
tested toolchains (mingw-w64 and CI ones), so let's allow this build
feature on that platform. Bringing this in sync with CMake, which already
supported this.

Reviewed-by: Jay Satiro

Closes #9586
2022-09-25 22:19:13 +00:00
Viktor Szakats
6adcff68b8
autotools: reduce brute-force when detecting recv/send arg list
autotools uses brute-force to detect `recv`/`send`/`select` argument
lists, by interating through _all_ argument type combinations on each
`./configure` run. This logic exists since
01fa02d0b5 (from 2006) and was a bit later
extended with Windows support.

This results in a worst-case number of compile + link cycles as below:
- `recv`: 96
- `send`: 192
- `select`: 60
Total: 348 (the number of curl C source files is 195, for comparison)

Notice that e.g. curl-for-win autotools builds require two `./configure`
invocations, doubling these numbers.

`recv` on Windows was especially unlucky because `SOCKET` (the correct
choice there) was listed _last_ in one of the outer trial loops. This
resulted in lengthy waits while autotools was trying all invalid
combinations first, wasting cycles, disk writes and slowing down
iteration.

This patch reduces the amount of idle work by reordering the tests in
a way to succeed first on a well-known platform such as Windows, and
also on non-Windows by testing for POSIX prototypes first, on the
assumption that these are the most likely candidates these days. (We do
not touch `select`, where the order was already optimal for these
platforms.)

For non-Windows, this means to try a return value of `ssize_t` first,
then `int`, reordering the buffer argument type to try `void *` first,
then `byte *`, and prefer the `const` flavor with `send`. If we are
here, also stop testing for `SOCKET` type in non-Windows builds.

After the patch, detection on Windows is instantaneous. It should also be
faster on popular platforms such as Linux and BSD-based ones.

If there are known-good variations for other platforms, they can also be
fast-tracked like above, given a way to check for that platform inside
the autotools logic.

Reviewed-by: Daniel Stenberg

Closes #9591
2022-09-25 21:58:21 +00:00
Daniel Stenberg
a6fc1f544d
TODO: Provide the error body from a CONNECT response
Spellchecked-by: Jay Satiro

Closes #9513
Closes #9581
2022-09-23 23:31:08 +02:00
Viktor Szakats
9325ab2cf9
windows: autotools .rc warnings fixup
Move `LT_LANG([Windows Resource])` after `XC_LIBTOOL`, fixing:

- Warnings when running `autoreconf -fi`.

- Warning when compiling .rc files:
  libtool: compile: unable to infer tagged configuration
  libtool:   error: specify a tag with '--tag'

Follow up to 6de7322c03
Ref: https://github.com/curl/curl/pull/9521#issuecomment-1256291156

Suggested-by: Patrick Monnerat
Closes #9582
2022-09-23 19:39:18 +00:00
Randall S. Becker
7801cb9fd9
curl_setup: disable use of FLOSS for 64-bit NonStop builds
Older 32-bit builds currently need FLOSS. This dependency may be removed
in future OS releases.

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Closes #9575
2022-09-23 13:57:32 +02:00
Patrick Monnerat
ce30d518de
tool: remove dead code
Add a debug assertion to verify protocols included/excluded in a set
are always tokenized.

Follow-up to commit 677266c.

Closes #9576
2022-09-23 13:55:52 +02:00
Patrick Monnerat
91e06e687a
lib: prepare the incoming of additional protocols
Move the curl_prot_t to its own conditional block. Introduce symbol
PROTO_TYPE_SMALL to control it.

Fix a cast in a curl_prot_t assignment.
Remove an outdated comment.

Follow-up to cd5ca80.

Closes #9534
2022-09-23 08:39:44 +02:00
Daniel Stenberg
d4b1ad59a3
msh3: change the static_assert to make the code C89 2022-09-23 08:27:50 +02:00
Daniel Stenberg
5263bbb316
bearssl: make it proper C89 compliant 2022-09-23 08:27:50 +02:00
Daniel Stenberg
b23ce2cee7
curl-compilers.m4: for gcc + want warnings, set gnu89 standard
To better verify that the code is C89

Closes #9542
2022-09-23 08:27:43 +02:00
Patrick Monnerat
549032df41
lib517: fix C89 constant signedness
In C89, positive integer literals that overflow an int but not an
unsigned int may be understood as a negative int.

lib517.c:129:3: warning: this decimal constant is unsigned only in ISO C90
   {"Sun, 06 Nov 2044 08:49:37 GMT", 2362034977 },
   ^

Closes #9572
2022-09-22 23:08:08 +02:00
Daniel Stenberg
935b1bd454
mprintf: use snprintf if available
This is the single place in libcurl code where it uses the "native"
s(n)printf() function. Used for writing floats. The use has been
reviewed and vetted and uses a HUGE target buffer, but switching to
snprintf() still makes this safer and removes build-time warnings.

Reported-by: Philip Heiduck

Fixes #9569
Closes #9570
2022-09-22 23:06:26 +02:00
Daniel Stenberg
bf1571eb6f
docs: tag curl options better in man pages
As it makes them links in the HTML versions.

Verified by the extended test 1176
2022-09-22 17:36:28 +02:00
Daniel Stenberg
70b6c701f8
symbols-in-versions: CURLOPT_ENCODING is deprecated since 7.21.6 2022-09-22 17:35:23 +02:00
Daniel Stenberg
a34610b92e
manpage-syntax.pl: all libcurl option symbols should be \fI-tagged
... as that makes them links to their corresponding man page.

This script is used for test 1173.

Closes #9574
2022-09-22 17:35:08 +02:00
Daniel Stenberg
a068818528
RELEASE-NOTES: synced 2022-09-22 14:14:28 +02:00
Patrick Monnerat
677266c769
tool: remove protocol count limitation
Replace bit mask protocol sets by null-terminated arrays of protocol
tokens. These are the addresses of the protocol names returned by
curl_version_info().

Protocol names are sorted case-insensitively before output to satisfy CI
tests matches consistency.

The protocol list returned by curl_version_info() is augmented with all
RTMP protocol variants.

Test 1401 adjusted for new alpha ordered output.

Closes #9546
2022-09-22 13:49:10 +02:00
Daniel Stenberg
fb11e45f9c
test972: verify the output without using external tool
It seems too restrictive to assume and use an external tool to verify
the JSON. This now verifies the outut byte per byte. We could consider
building a local "JSON verifyer" in a future.

Remove 'jsonlint' from the CI job.

Reported-by: Marcel Raad
Fixes #9563
Closes #9564
2022-09-22 13:46:40 +02:00
Daniel Stenberg
46f3fe0e75
hostip: lazily wait to figure out if IPv6 works until needed
The check may take many milliseconds, so now it is performed once the
value is first needed. Also, this change makes sure that the value is
not used if the resolve is set to be IPv4-only.

Closes #9553
2022-09-22 09:47:59 +02:00
Daniel Stenberg
7295e62c66
curl.h: fix mention of wrong error code in comment
The same error and comment were also used and is now corrected in
CURLOPT_SSH_KEYFUNCTION.3
2022-09-22 09:43:39 +02:00
Daniel Stenberg
34c598a9b3
symbol-scan.pl: scan and verify .3 man pages
This script now also finds all .3 man pages in docs/include and
docs/include/opts, extracts all uses of CURL* symbols and verifies that all
symbols mentioned in docs are defined in public headers.

A "global symbol" is one of those matching a known prefix and the script makes
an attempt to check all/most of them. Just using *all* symbols that match
CURL* proved matching a little too many other references as well and turned
difficult turning into something useful.

Closes #9544
2022-09-22 09:43:34 +02:00
Daniel Stenberg
16814d8f8c
symbols-in-versions: add missing LIBCURL* symbols 2022-09-22 09:43:34 +02:00
Daniel Stenberg
c3feb8e165
symbol-scan.pl: also check for LIBCURL* symbols
Closes #9544
2022-09-22 09:43:30 +02:00
Daniel Stenberg
4c8d180354
docs/libcurl/symbols-in-versions: add several missing symbols 2022-09-22 09:43:22 +02:00
Daniel Stenberg
6c951c427f
test1119: scan all public headers
Previously this test only scanned a subset of the headers, which made us
accidentally miss symbols that were provided in the others. Now, the script
iterates over all headers present in include/curl.

Closes #9544
2022-09-22 09:43:13 +02:00
Patrick Monnerat
c3e634d066
examples/chkspeed: improve portability
The example program chkspeed uses strncasecmp() which is not portable
across systems. Replace calls to this function by tests on characters.

Closes #9562
2022-09-21 23:52:34 +02:00
Daniel Stenberg
1998f34d54
easy: fix the #include order
The mentioned "last 3 includes" order should be respected. easy_lock.h should
be included before those three.

Reported-by: Yuriy Chernyshov
Fixes #9560
Closes #9561
2022-09-21 23:15:15 +02:00
Daniel Stenberg
fd1ce3d4b0
docs: spellfixes
Pointed by the new CI job
2022-09-21 15:20:08 +02:00
Daniel Stenberg
72c41f7c8b
GHA: spellcheck
This spellchecker checks markdown files. For this reason this job
converts all man pages in the repository to markdown with pandoc before
the check runs.

The perl script 'cleanspell' filters out details from the man page in
the process, to avoid the spellchecker trying to spellcheck things it
can't. Like curl specific symbols and the SYNOPSIS and EXAMPLE sections
of libcurl man pages.

The spell checker does not check words in sections that are within pre,
strong and em tags.

'spellcheck.words' is a custom word list with additional accepted words.

Closes #9523
2022-09-21 15:20:07 +02:00
Daniel Stenberg
6267244161
connect: fix the wrong error message on connect failures
The "Failed to connect to" message after a connection failure would
include the strerror message based on the presumed previous socket
error, but in times it seems that error number is not set when reaching
this code and therefore it would include the wrong error message.

The strerror message is now removed from here and the curl_easy_strerror
error is used instead.

Reported-by: Edoardo Lolletti
Fixes #9549
Closes #9554
2022-09-21 14:23:37 +02:00
Daniel Stenberg
9eec75452c
httpput-postfields.c: shorten string for C89 compliance
httpput-postfields.c:41:3: error: string length ‘522’ is greater than the length ‘509’ ISO C90 compilers are required to support [-Woverlength-strings]
   41 |   "this chapter.";
      |   ^~~~~~~~~~~~~~~

Closes #9555
2022-09-21 09:59:40 +02:00
Daniel Stenberg
a2fa5f86d6
ws: fix a C89 compliance nit
Closes #9541
2022-09-21 09:19:42 +02:00
Patrick Monnerat
6fbf7d34b5
unit test 1655: make it C89-compliant
Initializations performed in unit test 1655 use automatic variables in
aggregates and thus can only be computed at run-time. Using gcc in C89
dialect mode produces warning messages like:

unit1655.c:96:7: warning: initializer element is not computable at load time [-Wpedantic]
   96 |     { toolong, DOH_DNS_NAME_TOO_LONG },  /* expect early failure */
      |       ^~~~~~~

Fix the problem by converting these automatic pointer variables to
static arrays.

Closes #9551
2022-09-21 09:14:34 +02:00
Tobias Schaefer
8e5b1b66c1
curl_strequal.3: fix typo
Closes #9548
2022-09-20 23:21:47 +02:00
Dmitry Karpov
1902e8fc51
resolve: make forced IPv4 resolve only use A queries
This protects IPv4-only transfers from undesired bad IPv6-related side
effects and make IPv4 transfers in dual-stack libcurl behave the same
way as in IPv4 single-stack libcurl.

Closes #9540
2022-09-20 15:43:27 +02:00
Daniel Stenberg
ae9e713c4e
RELEASE-NOTES: synced 2022-09-20 08:48:18 +02:00
Daniel Stenberg
8bc6a38cef
winbuild/MakefileBuild.vc: handle spaces in libssh(2) include paths
Patched-by: Mark Itzcovitz
Bug: https://curl.se/mail/lib-2022-09/0038.html

Closes #9536
2022-09-20 08:37:27 +02:00