summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* curl_global_sslset.3: clarify the openssl situationDaniel Stenberg2023-01-011-4/+14
| | | | | | and add rustls Closes #10188
* http: add additional condition for including stdint.hCameron Blomquist2023-01-011-2/+2
| | | | | | | | stdint.h was only included in http.h when ENABLE_QUIC was defined, but symbols from stdint.h are also used when USE_NGHTTP2 is defined. This causes build errors when USE_NGHTTP2 is defined but ENABLE_QUIC is not. Closes #10185
* urldata: cease storing TLS auth typeDaniel Stenberg2022-12-316-48/+12
| | | | | | | | | | The only TLS auth type libcurl ever supported is SRP and that is the default type. Since nobody ever sets any other type, there is no point in wasting space to store the set type and code to check the type. If TLS auth is used, SRP is now implied. Closes #10181
* vtls: use ALPN HTTP/1.0 when HTTP/1.0 is usedDaniel Stenberg2022-12-3110-81/+153
| | | | | | | | Previously libcurl would use the HTTP/1.1 ALPN id even when the application specified HTTP/1.0. Reported-by: William Tang Ref: #10183
* lib670: make test.h the first includeMarcel Raad2022-12-301-2/+2
| | | | | | | As in all other lib tests. This avoids a macro redefinition warning for `_FILE_OFFSET_BITS` visible in the autobuilds. Closes https://github.com/curl/curl/pull/10182
* lib: connect/h2/h3 refactorStefan Eissing2022-12-3048-4557/+6790
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Refactoring of connection setup and happy eyeballing. Move nghttp2. ngtcp2, quiche and msh3 into connection filters. - eyeballing cfilter that uses sub-filters for performing parallel connects - socket cfilter for all transport types, including QUIC - QUIC implementations in cfilter, can now participate in eyeballing - connection setup is more dynamic in order to adapt to what filter did really connect. Relevant to see if a SSL filter needs to be added or if SSL has already been provided - HTTP/3 test cases similar to HTTP/2 - multiuse of parallel transfers for HTTP/3, tested for ngtcp2 and quiche - Fix for data attach/detach in VTLS filters that could lead to crashes during parallel transfers. - Eliminating setup() methods in cfilters, no longer needed. - Improving Curl_conn_is_alive() to replace Curl_connalive() and integrated ssl alive checks into cfilter. - Adding CF_CNTRL_CONN_INFO_UPDATE to tell filters to update connection into and persist it at the easy handle. - Several more cfilter related cleanups and moves: - stream_weigth and dependency info is now wrapped in struct Curl_data_priority - Curl_data_priority members depend is available in HTTP2|HTTP3 - Curl_data_priority members depend on NGHTTP2 support - handling init/reset/cleanup of priority part of url.c - data->state.priority same struct, but shallow copy for compares only - PROTOPT_STREAM has been removed - Curl_conn_is_mulitplex() now available to check on capability - Adding query method to connection filters. - ngtcp2+quiche: implementing query for max concurrent transfers. - Adding is_alive and keep_alive cfilter methods. Adding DATA_SETUP event. - setting keepalive timestamp on connect - DATA_SETUP is called after the connection has been completely setup (but may not connected yet) to allow filters to initialize data members they use. - there is no socket to be had with msh3, it is unclear how select shall work - manual test via "curl --http3 https://curl.se" fail with "empty reply from server". - Various socket/conn related cleanups: - Curl_socket is now Curl_socket_open and in cf-socket.c - Curl_closesocket is now Curl_socket_close and in cf-socket.c - Curl_ssl_use has been replaced with Cur_conn_is_ssl - Curl_conn_tcp_accepted_set has been split into Curl_conn_tcp_listen_set and Curl_conn_tcp_accepted_set with a clearer purpose Closes #10141
* RELEASE-NOTES: syncedDaniel Stenberg2022-12-301-5/+25
|
* docs/libcurl/curl_getdate.3: minor whitespace editDaniel Stenberg2022-12-301-2/+3
| | | | To avoid a fccp quirk that made it render wrongly on the website
* transfer: break the read loop when RECV is clearedDaniel Stenberg2022-12-301-2/+2
| | | | | | | | | | When the RECV bit is cleared because the response reading for this transfer is complete, the read loop should be stopped. data_pending() can otherwise still return TRUE and another read would be attempted. Reported-by: Hide Ishikawa Fixes #10172 Closes #10174
* multihandle: turn bool struct fields into bitsDaniel Stenberg2022-12-302-6/+6
| | | | Closes #10179
* ftpserver: lower the normal DATA connect timeout to speed up torture testsStefan Eissing2022-12-301-1/+1
| | | | | | | | | | | | - tests/ftpserver.pl blocks when expecting a DATA connection from the client. - the previous 10 seconds were encountered repeatedly in torture tests and let to long waits. - 2 seconds should still be sufficient for current hw, but CI will show. Closes #10178
* msh3: add support for request payloadNick Banks2022-12-286-8/+40
| | | | Closes #10136
* openssl: remove attached easy handles from SSL instancesStefan Eissing2022-12-282-144/+41
| | | | | | | | | | - keeping the "current" easy handle registered at SSL* is no longer necessary, since the "calling" data object is already stored in the cfilter's context (and used by other SSL backends from there). - The "detach" of an easy handle that goes out of scope is then avoided. - using SSL_set0_wbio for clear reference counting where available. Closes #10151
* socketpair: allow localhost MITM sniffersDaniel Stenberg2022-12-281-15/+12
| | | | | | | | | | Windows allow programs to MITM connections to localhost. The previous check here would detect that and error out. This new method writes data to verify the pipe thus allowing MITM. Reported-by: SerusDev on github Fixes #10144 Closes #10169
* HTTP3: mention what needs to be in place to remove EXPERIMENTAL labelDaniel Stenberg2022-12-282-0/+9
| | | | Closes #10168
* MANUAL.md: add pipe to apt-key exampleandy59952022-12-281-0/+10
| | | | Closes #10170
* test417: verify %{certs} outputDaniel Stenberg2022-12-272-0/+84
|
* runtests: make 'mbedtls' a testable featureDaniel Stenberg2022-12-272-0/+2
| | | | Also add to FILEFORMAT.md
* writeout: add %{certs} and %{num_certs}Daniel Stenberg2022-12-277-2/+77
| | | | | | Let users get the server certificate chain using the command line Closes #10019
* haxproxy: send before TLS handhshakeStefan Eissing2022-12-273-11/+15
| | | | | | | | | | | - reverse order of haproxy and final ssl cfilter - make haproxy avaiable on PROXY builds, independent of HTTP support as it can be used with any protocol. Reported-by: Sergio-IME on github Fixes #10165 Closes #10167
* RELEASE-NOTES: syncedDaniel Stenberg2022-12-271-4/+16
|
* test446: verify hsts with two URLsDaniel Stenberg2022-12-272-1/+85
|
* runtests: support crlf="yes" for verify/proxyDaniel Stenberg2022-12-272-2/+7
|
* hsts: handle adding the same host name againDaniel Stenberg2022-12-271-2/+11
| | | | It will then use the largest expire time of the two entries.
* tool_operate: share HSTS between handlesDaniel Stenberg2022-12-271-0/+1
|
* share: add sharing of HSTS cache among handlesDaniel Stenberg2022-12-2711-11/+109
| | | | Closes #10138
* Makefile.mk: fix wolfssl and mbedtls default pathsViktor Szakats2022-12-271-2/+2
| | | | | | | | | | Fix the defaults for `WOLFSSL_PATH` and `MBEDTLS_PATH` to have meaningful values instead of the copy-pasted wrong ones. Ref: https://github.com/curl/curl/commit/66e68ca47f7fd00dff2cb7c45ba6725d40099585#r94275172 Reported-by: Ryan Schmidt Closes #10164
* INTERNALS: cleanupDaniel Stenberg2022-12-271-15/+4
| | | | | | | | - remove "operating systems" (mostly outdated) - upodate the "build tools" Closes #10162
* cmake: bump requirement to 3.7Daniel Stenberg2022-12-271-1/+1
| | | | | | | | | Because this is the cmake version (released in November 2016) that introduced GREATER_EQUAL, which is used already. Reported-by: nick-telia on github Fixes #10128 Closes #10161
* cfilters:Curl_conn_get_select_socks: use the first non-connected filterDaniel Stenberg2022-12-271-0/+4
| | | | | | | | | | | | When there are filters addded for both socket and SSL, the code previously checked the SSL sockets during connect when it *should* first check the socket layer until that has connected. Fixes #10157 Fixes #10146 Closes #10160 Reviewed-by: Stefan Eissing
* urlapi: add CURLU_PUNYCODEDaniel Stenberg2022-12-2610-14/+90
| | | | | | | | | Allows curl_url_get() get the punycode version of host names for the host name and URL parts. Extend test 1560 to verify. Closes #10109
* RELEASE-NOTES: syncedDaniel Stenberg2022-12-261-3/+42
|
* libssh2: try sha2 algos for hostkey methodsDaniel Stenberg2022-12-261-1/+12
| | | | | | | | | | As is supported by recent libssh2, but should just be ignored by older versions. Reported-by: norbertmm on github Assisted-by: norbertmm on github Fixes #10143 Closes #10145
* typecheck: accept expressions for option/info parametersPatrick Monnerat2022-12-261-4/+2
| | | | | | | | | | | | | | | | | As expressions can have side effects, evaluate only once. To enable deprecation reporting only once, get rid of the __typeof__ use to define the local temporary variable and use the target type (CURLoption/CURLINFO). This also avoids multiple reports on type conflicts (if some) by the curlcheck_* macros. Note that CURLOPT_* and CURLINFO_* symbols may be deprecated, but not their values: a curl_easy_setopt call with an integer constant as option will never report a deprecation. Reported-by: Thomas Klausner Fixes #10148 Closes #10149
* tests: avoid use of sha1 in certificatesPaul Howarth2022-12-2665-1490/+1443
| | | | | | | | | | | | | | | | | | | | | | The SHA-1 algorithm is deprecated (particularly for security-sensitive applications) in a variety of OS environments. This already affects RHEL-9 and derivatives, which are not willing to use certificates using that algorithm. The fix is to use sha256 instead, which is already used for most of the other certificates in the test suite. Fixes #10135 This gets rid of issues related to sha1 signatures. Manual steps after "make clean-certs" and "make build-certs": - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem (make clean-certs does not remove the original tests/stunnel.pem) - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey options of tests/data/test2041 and tests/data/test2087 Closes #10153
* cmake: fix the snprintf detectionYurii Rashkovskii2022-12-261-1/+1
| | | | | | | | | I haven't had the time to check other configurations, but on my macOS Ventura 13.1 with XCode 14.2 cmake does not find `snprintf`. Solution: ensure stdio.h is checked for definitions Closes #10155
* http: remove the trace message "Mark bundle... multiuse"Radu Hociung2022-12-261-1/+0
| | | | | | | | | | | | | | | | | | | | | The message "Mark bundle as not supporting multiuse" was added at commit 29364d93 when an http/2-related bug was fixed, and it appears to be a leftover trace message. This message should be removed because: * it conveys no information to the user * it is enabled in the default build (--enable-verbose) * it reads like a warning/unexpected condition * it is equivalent to "Detected http proto < 2", which is not a useful message. * it is a time-wasting red-herring for anyone who encounters it for the first time while investigating some other, real problem. This commit removes the trace message "Mark bundle as not supporting multiuse" Closes #10159
* url: fix build with `--disable-cookies`Hannah Schierling2022-12-261-0/+2
| | | | | | | | | Struct `UserDefined` has no member `cookielist` if `CURL_DISABLE_COOKIES` is defined. Follow-up to af5999a Closes #10158
* runtests: also tear down http2/http3 servers when https server is stoppedStefan Eissing2022-12-231-2/+4
| | | | Closes #10114
* tests: add 3 new HTTP/2 test cases, plus https: support for nghttpxStefan Eissing2022-12-238-5/+423
| | | | | | | | - a simple https get - a simple https post - a multi get of 4 requests and check that same connection was used Closes #10114
* urldata: remove unused struct fields, made more conditionalDaniel Stenberg2022-12-233-49/+51
| | | | | | | | | | | | | | | | | | | | | - source_quote, source_prequote and source_postquote have not been used since 5e0d9aea3; September 2006 - make several fields conditional on proxy support - make three quote struct fields conditional on FTP || SSH - make 'mime_options' depend on MIME - make trailer_* fields depend on HTTP - change 'gssapi_delegation' from long to unsigned char - make 'localportrange' unsigned short instead of int - conn->trailer now depends on HTTP Closes #10147
* urldata: make set.http200aliases conditional on HTTP being presentDaniel Stenberg2022-12-223-13/+20
| | | | | | And make a few SSH-only fields depend on SSH Closes #10140
* md4: fix build with GnuTLS + OpenSSL v1Daniel Stenberg2022-12-221-5/+5
| | | | | | | Reported-by: Esdras de Morais da Silva Fixes #10110 Closes #10142
* urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTPDaniel Stenberg2022-12-222-1/+5
| | | | Closes #10139
* misc: fix grammar and spellingJohn Bampton2022-12-225-8/+8
| | | | Closes #10137
* urldata: move the cookefilelist to the 'set' structDaniel Stenberg2022-12-227-37/+24
| | | | | | | | | The cookiefile entries are set into the handle and should remain set for the lifetime of the handle so that duplicating it also duplicates the list. Therefore, the struct field is moved from 'state' to 'set'. Fixes #10133 Closes #10134
* strdup: name it Curl_strdupDaniel Stenberg2022-12-223-3/+3
| | | | | | | It does not belong in the curlx_ name space as it is never used externally. Closes #10132
* msh3: update to v0.5 ReleaseNick Banks2022-12-223-6/+19
| | | | Closes #10125
* workflows/linux.yml: merge 3 common packagesandy59952022-12-221-16/+15
| | | | Closes #10071
* docs: mention indirect effects of --insecureDaniel Stenberg2022-12-213-0/+21
| | | | | | | | Warn users that disabling certficate verification allows servers to "pollute" curl with data it trusts. Reported-by: Harry Sintonen Closes #10126
View Lorry Controller Status