summaryrefslogtreecommitdiff
path: root/lib/http.c
Commit message (Collapse)AuthorAgeFilesLines
* http: free the url before storing a new copyDaniel Stenberg2023-05-091-1/+1
| | | | | | | | To avoid a memory-leak. Reported-by: Hiroki Kurosawa Closes #11093
* lib: unify the upload/method handlingDaniel Stenberg2023-04-251-2/+2
| | | | | | | | By making sure we set state.upload based on the set.method value and not independently as set.upload, we reduce confusion and mixup risks, both internally and externally. Closes #11017
* http: store the password in the correct variableDaniel Stenberg2023-04-241-1/+1
| | | | | | | Typo from fc2f1e547a4a, detected by Coverity (because there's dead code due to this). Closes #11002
* http2: support HTTP/2 to forward proxies, non-tunnelingStefan Eissing2023-04-171-12/+280
| | | | | | | | | | | | | | | | | | | - with `--proxy-http2` allow h2 ALPN negotiation to forward proxies - applies to http: requests against a https: proxy only, as https: requests will auto-tunnel - adding a HTTP/1 request parser in http1.c - removed h2h3.c - using new request parser in nghttp2 and all h3 backends - adding test 2603 for request parser - adding h2 proxy test cases to test_10_* scorecard.py: request scoring accidentally always run curl with '-v'. Removed that, expect double numbers. labeller: added http1.* and h2-proxy sources to detection Closes #10967
* http: skip a double NULL assignDaniel Stenberg2023-04-131-18/+12
| | | | | | | | and also use a local variable to shorten the long names and increase readability in the function. Pointed out by PVS. Ref: #10929 Closes #10950
* CURLPROXY_HTTPS2: for HTTPS proxy that may speak HTTP/2Daniel Stenberg2023-04-081-1/+1
| | | | | | | Setting this proxy type allows curl to negotiate and use HTTP/2 with HTTPS proxies. Closes #10900
* content_encoding: only do tranfer-encoding compression if asked toDaniel Stenberg2023-04-071-1/+1
| | | | | | To reduce surprises. Update test 387 and 418 accordingly. Closes #10899
* http2: flow control and buffer improvementsStefan Eissing2023-03-301-2/+6
| | | | | | | | | | | | | | | | | - use bufq for send/receive of network data - usd bufq for send/receive of stream data - use HTTP/2 flow control with no-auto updates to control the amount of data we are buffering for a stream HTTP/2 stream window set to 128K after local tests, defined code constant for now - elminiating PAUSEing nghttp2 processing when receiving data since a stream can now take in all DATA nghttp2 forwards Improved scorecard and adjuste http2 stream window sizes - scorecard improved output formatting and options default - scorecard now also benchmarks small requests / second Closes #10771
* lib: add `bufq` and `dynhds`Stefan Eissing2023-03-301-0/+271
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adding `bufq`: - at init() time configured to hold up to `n` chunks of `m` bytes each. - various methods for reading from and writing to it. - `peek` support to get access to buffered data without copy - `pass` support to allow buffer flushing on write if it becomes full - use case: IO buffers for dynamic reads and writes that do not blow up - distinct from `dynbuf` in that: - it maintains a read position - writes on a full bufq return CURLE_AGAIN instead of nuking itself - Init options: - SOFT_LIMIT: allow writes into a full bufq - NO_SPARES: free empty chunks right away - a `bufc_pool` that can keep a number of spare chunks to be shared between different `bufq` instances Adding `dynhds`: - a straightforward list of name+value pairs as used for HTTP headers - headers can be appended dynamically - headers can be removed again - headers can be replaced - headers can be looked up - http/1.1 formatting into a `dynbuf` - configured at init() with limits on header counts and total string sizes - use case: pass a HTTP request or response around without being version specific - express a HTTP request without a curl easy handle (used in h2 proxy tunnels) - future extension possibilities: - conversions of `dynhds` to nghttp2/nghttp3 name+value arrays Closes #10720
* http: don't send 100-continue for short PUT requestsDan Fandrich2023-03-111-1/+10
| | | | | | | | | This is already how curl is documented to behave in Everything curl, but in actuality only short POSTs skip this. This should knock 30 seconds off a full run of the test suite since the 100-continue timeout will no longer be hit. Closes #10740
* http: fix unix domain socket use in https connectsStefan Eissing2023-02-281-5/+1
| | | | | | | | | | | | - when h2/h3 eyeballing was involved, unix domain socket configurations were not honoured - configuring --unix-socket will disable HTTP/3 as candidate for eyeballing - combinatino of --unix-socket and --http3-only will fail during initialisation - adding pytest test_11 to reproduce Reported-by: Jelle van der Waa Fixes #10633 Closes #10641
* http: rewrite the status line parser without sscanfDaniel Stenberg2023-02-231-70/+87
| | | | Closes #10585
* CURLOPT_PIPEWAIT: allow waited reuse also for subsequent connectionsStefan Eissing2023-02-211-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | As tested in test_02_07, when firing off 200 urls with --parallel, 199 wait for the first connection to be established. if that is multiuse, urls are added up to its capacity. The first url over capacity opens another connection. But subsequent urls found the same situation and open a connection too. They should have waited for the second connection to actually connect and make its capacity known. This change fixes that by - setting `connkeep()` early in the HTTP setup handler. as otherwise a new connection is marked as closeit by default and not considered for multiuse at all - checking the "connected" status for a candidate always and continuing to PIPEWAIT if no alternative is found. pytest: - removed "skip" from test_02_07 - added test_02_07b to check that http/1.1 continues to work as before Closes #10456
* ws: fix recv of larger framesDaniel Stenberg2023-02-101-1/+1
| | | | | | | | | + remove 'oleft' from the struct + deal with "overflow data" in a separate dynbuf Reported-by: Mike Duglas Fixes #10438 Closes #10447
* http: fix "part of conditional expression is always false"Kvarec Lezki2023-02-031-2/+3
| | | | | | | | | [CWE-570] V560: A part of conditional expression is always false: conn->bits.authneg. [CWE-570] V560: A part of conditional expression is always false: conn->handler->protocol & (0 | 0). https://pvs-studio.com/en/docs/warnings/v560/ Closes #10399
* connections: introduce http/3 happy eyeballsStefan Eissing2023-02-021-65/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New cfilter HTTP-CONNECT for h3/h2/http1.1 eyeballing. - filter is installed when `--http3` in the tool is used (or the equivalent CURLOPT_ done in the library) - starts a QUIC/HTTP/3 connect right away. Should that not succeed after 100ms (subject to change), a parallel attempt is started for HTTP/2 and HTTP/1.1 via TCP - both attempts are subject to IPv6/IPv4 eyeballing, same as happens for other connections - tie timeout to the ip-version HAPPY_EYEBALLS_TIMEOUT - use a `soft` timeout at half the value. When the soft timeout expires, the HTTPS-CONNECT filter checks if the QUIC filter has received any data from the server. If not, it will start the HTTP/2 attempt. HTTP/3(ngtcp2) improvements. - setting call_data in all cfilter calls similar to http/2 and vtls filters for use in callback where no stream data is available. - returning CURLE_PARTIAL_FILE for prematurely terminated transfers - enabling pytest test_05 for h3 - shifting functionality to "connect" UDP sockets from ngtcp2 implementation into the udp socket cfilter. Because unconnected UDP sockets are weird. For example they error when adding to a pollset. HTTP/3(quiche) improvements. - fixed upload bug in quiche implementation, now passes 251 and pytest - error codes on stream RESET - improved debug logs - handling of DRAIN during connect - limiting pending event queue HTTP/2 cfilter improvements. - use LOG_CF macros for dynamic logging in debug build - fix CURLcode on RST streams to be CURLE_PARTIAL_FILE - enable pytest test_05 for h2 - fix upload pytests and improve parallel transfer performance. GOAWAY handling for ngtcp2/quiche - during connect, when the remote server refuses to accept new connections and closes immediately (so the local conn goes into DRAIN phase), the connection is torn down and a another attempt is made after a short grace period. This is the behaviour observed with nghttpx when we tell it to shut down gracefully. Tested in pytest test_03_02. TLS improvements - ALPN selection for SSL/SSL-PROXY filters in one vtls set of functions, replaces copy of logic in all tls backends. - standardized the infof logging of offered ALPNs - ALPN negotiated: have common function for all backends that sets alpn proprty and connection related things based on the negotiated protocol (or lack thereof). - new tests/tests-httpd/scorecard.py for testing h3/h2 protocol implementation. Invoke: python3 tests/tests-httpd/scorecard.py --help for usage. Improvements on gathering connect statistics and socket access. - new CF_CTRL_CONN_REPORT_STATS cfilter control for having cfilters report connection statistics. This is triggered when the connection has completely connected. - new void Curl_pgrsTimeWas(..) method to report a timer update with a timestamp of when it happend. This allows for updating timers "later", e.g. a connect statistic after full connectivity has been reached. - in case of HTTP eyeballing, the previous changes will update statistics only from the filter chain that "won" the eyeballing. - new cfilter query CF_QUERY_SOCKET for retrieving the socket used by a filter chain. Added methods Curl_conn_cf_get_socket() and Curl_conn_get_socket() for convenient use of this query. - Change VTLS backend to query their sub-filters for the socket when checks during the handshake are made. HTTP/3 documentation on how https eyeballing works. TLS improvements - ALPN selection for SSL/SSL-PROXY filters in one vtls set of functions, replaces copy of logic in all tls backends. - standardized the infof logging of offered ALPNs - ALPN negotiated: have common function for all backends that sets alpn proprty and connection related things based on the negotiated protocol (or lack thereof). Scorecard with Caddy. - configure can be run with `--with-test-caddy=path` to specify which caddy to use for testing - tests/tests-httpd/scorecard.py now measures download speeds with caddy pytest improvements - adding Makfile to clean gen dir - adding nghttpx rundir creation on start - checking httpd version 2.4.55 for test_05 cases where it is needed. Skipping with message if too old. - catch exception when checking for caddy existance on system. Closes #10349
* ws: unstick connect-only shutdownDaniel Stenberg2023-01-301-2/+2
| | | | | | | As this mode uses blocking sockets, it must set them back to non-blocking in disconnect to avoid the risk of getting stuck. Closes #10366
* http_proxy: do not assign data->req.p.http use local copyDaniel Stenberg2023-01-051-14/+18
| | | | | | | | Avoid the tricky reusing of the data->req.p.http pointer for http proxy tunneling. Fixes #10194 Closes #10234
* copyright: update all copyright lines and remove year rangesDaniel Stenberg2023-01-031-1/+1
| | | | | | | | | | | | - they are mostly pointless in all major jurisdictions - many big corporations and projects already don't use them - saves us from pointless churn - git keeps history for us - the year range is kept in COPYING checksrc is updated to allow non-year using copyright statements Closes #10205
* lib: connect/h2/h3 refactorStefan Eissing2022-12-301-69/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Refactoring of connection setup and happy eyeballing. Move nghttp2. ngtcp2, quiche and msh3 into connection filters. - eyeballing cfilter that uses sub-filters for performing parallel connects - socket cfilter for all transport types, including QUIC - QUIC implementations in cfilter, can now participate in eyeballing - connection setup is more dynamic in order to adapt to what filter did really connect. Relevant to see if a SSL filter needs to be added or if SSL has already been provided - HTTP/3 test cases similar to HTTP/2 - multiuse of parallel transfers for HTTP/3, tested for ngtcp2 and quiche - Fix for data attach/detach in VTLS filters that could lead to crashes during parallel transfers. - Eliminating setup() methods in cfilters, no longer needed. - Improving Curl_conn_is_alive() to replace Curl_connalive() and integrated ssl alive checks into cfilter. - Adding CF_CNTRL_CONN_INFO_UPDATE to tell filters to update connection into and persist it at the easy handle. - Several more cfilter related cleanups and moves: - stream_weigth and dependency info is now wrapped in struct Curl_data_priority - Curl_data_priority members depend is available in HTTP2|HTTP3 - Curl_data_priority members depend on NGHTTP2 support - handling init/reset/cleanup of priority part of url.c - data->state.priority same struct, but shallow copy for compares only - PROTOPT_STREAM has been removed - Curl_conn_is_mulitplex() now available to check on capability - Adding query method to connection filters. - ngtcp2+quiche: implementing query for max concurrent transfers. - Adding is_alive and keep_alive cfilter methods. Adding DATA_SETUP event. - setting keepalive timestamp on connect - DATA_SETUP is called after the connection has been completely setup (but may not connected yet) to allow filters to initialize data members they use. - there is no socket to be had with msh3, it is unclear how select shall work - manual test via "curl --http3 https://curl.se" fail with "empty reply from server". - Various socket/conn related cleanups: - Curl_socket is now Curl_socket_open and in cf-socket.c - Curl_closesocket is now Curl_socket_close and in cf-socket.c - Curl_ssl_use has been replaced with Cur_conn_is_ssl - Curl_conn_tcp_accepted_set has been split into Curl_conn_tcp_listen_set and Curl_conn_tcp_accepted_set with a clearer purpose Closes #10141
* http: remove the trace message "Mark bundle... multiuse"Radu Hociung2022-12-261-1/+0
| | | | | | | | | | | | | | | | | | | | | The message "Mark bundle as not supporting multiuse" was added at commit 29364d93 when an http/2-related bug was fixed, and it appears to be a leftover trace message. This message should be removed because: * it conveys no information to the user * it is enabled in the default build (--enable-verbose) * it reads like a warning/unexpected condition * it is equivalent to "Detected http proto < 2", which is not a useful message. * it is a time-wasting red-herring for anyone who encounters it for the first time while investigating some other, real problem. This commit removes the trace message "Mark bundle as not supporting multiuse" Closes #10159
* http: fix the ::1 comparison for IPv6 localhost for cookiesDaniel Stenberg2022-12-201-2/+2
| | | | | | | | | | | When checking if there is a "secure context", which it is if the connection is to localhost even if the protocol is HTTP, the comparison for ::1 was done incorrectly and included brackets. Reported-by: BratSinot on github Fixes #10120 Closes #10121
* http: use the IDN decoded name in HSTS checksDaniel Stenberg2022-12-191-1/+1
| | | | | | | | | | Otherwise it stores the info HSTS into the persistent cache for the IDN name which will not match when the HSTS status is later checked for using the decoded name. Reported-by: Hiroki Kurosawa Closes #10111
* mime: relax easy/mime structures bindingPatrick Monnerat2022-11-281-2/+2
| | | | | | | | | | | | | | | | | | | Deprecation and removal of codeset conversion support from the library have released the strict need for an early binding of mime structures to an easy handle (https://github.com/curl/curl/commit/2610142). This constraint currently forces to create the handle before the mime structure and the latter cannot be attached to another handle once created (see https://curl.se/mail/lib-2022-08/0027.html). This commit removes the handle pointers from the mime structures allowing more flexibility on their use. When an easy handle is duplicated, bound mime structures must however still be duplicated too as their components hold send-time dynamic information. Closes #9927
* cfilter: re-add `conn` as parameter to cfilter setup methodsStefan Eissing2022-11-261-2/+2
| | | | | | | | | | | - `Curl_ssl_get_config()` now returns the first config if no SSL proxy filter is active - socket filter starts connection only on first invocation of its connect method Fixes #9982 Closes #9983
* lib: rewind BEFORE request instead of AFTER previousDaniel Stenberg2022-11-251-14/+16
| | | | | | | | | | | | This makes a big difference for cases when the rewind is not actually necessary to perofm (for example HTTP response code 301 converts to GET) and therefore the rewind can be avoided. In particular for situations when that rewind fails, for example when reading from a pipe or similar. Reported-by: Ali Utku Selen Fixes #9735 Closes #9958
* vtls: localization of state data in filtersStefan Eissing2022-11-221-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - almost all backend calls pass the Curl_cfilter intance instead of connectdata+sockindex - ssl_connect_data is remove from struct connectdata and made internal to vtls - ssl_connect_data is allocated in the added filter, kept at cf->ctx - added function to let a ssl filter access its ssl_primary_config and ssl_config_data this selects the propert subfields in conn and data, for filters added as plain or proxy - adjusted all backends to use the changed api - adjusted all backends to access config data via the exposed functions, no longer using conn or data directly cfilter renames for clear purpose: - methods `Curl_conn_*(data, conn, sockindex)` work on the complete filter chain at `sockindex` and connection `conn`. - methods `Curl_cf_*(cf, ...)` work on a specific Curl_cfilter instance. - methods `Curl_conn_cf()` work on/with filter instances at a connection. - rebased and resolved some naming conflicts - hostname validation (und session lookup) on SECONDARY use the same name as on FIRST (again). new debug macros and removing connectdata from function signatures where not needed. adapting schannel for new Curl_read_plain paramter. Closes #9919
* http: restore h3 to working condition after connection filter introductionStefan Eissing2022-11-191-8/+40
| | | | | | | | | | | | | | | | Follow-up to dafdb20a26d0c HTTP/3 needs a special filter chain, since it does the TLS handling itself. This PR adds special setup handling in the HTTP protocol handler that takes are of it. When a handler, in its setup method, installs filters, the default behaviour for managing the filter chain is overridden. Reported-by: Karthikdasari0423 on github Fixes #9931 Closes #9945
* proxy: refactor haproxy protocol handling as connection filterStefan Eissing2022-11-151-58/+1
| | | | Closes #9893
* http: mark it 'this_is_a_follow' in the Location: logicDaniel Stenberg2022-11-121-11/+5
| | | | | | | | | To make regular auth "reloads" to not count as redirects. Verified by test 3101 Fixes #9885 Closes #9887
* lib: remove bad set.opt_no_body assignmentsDaniel Stenberg2022-11-111-2/+2
| | | | | | | | | | This struct field MUST remain what the application set it to, so that handle reuse and handle duplication work. Instead, the request state bit 'no_body' is introduced for code flows that need to change this in run-time. Closes #9888
* lib: connection filters (cfilter) addition to curl:Stefan Eissing2022-11-111-69/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | - general construct/destroy in connectdata - default implementations of callback functions - connect: cfilters for connect and accept - socks: cfilter for socks proxying - http_proxy: cfilter for http proxy tunneling - vtls: cfilters for primary and proxy ssl - change in general handling of data/conn - Curl_cfilter_setup() sets up filter chain based on data settings, if none are installed by the protocol handler setup - Curl_cfilter_connect() boot straps filters into `connected` status, used by handlers and multi to reach further stages - Curl_cfilter_is_connected() to check if a conn is connected, e.g. all filters have done their work - Curl_cfilter_get_select_socks() gets the sockets and READ/WRITE indicators for multi select to work - Curl_cfilter_data_pending() asks filters if the have incoming data pending for recv - Curl_cfilter_recv()/Curl_cfilter_send are the general callbacks installed in conn->recv/conn->send for io handling - Curl_cfilter_attach_data()/Curl_cfilter_detach_data() inform filters and addition/removal of a `data` from their connection - adding vtl functions to prevent use of Curl_ssl globals directly in other parts of the code. Reviewed-by: Daniel Stenberg Closes #9855
* http: do not send PROXY more than onceFata Nugraha2022-11-101-1/+4
| | | | | | | | | Unlike `CONNECT`, currently we don't keep track whether `PROXY` is already sent or not. This causes `PROXY` header to be sent twice during `MSTATE_TUNNELING` and `MSTATE_PROTOCONNECT`. Closes #9878 Fixes #9442
* rtsp: fix RTSP authDaniel Stenberg2022-11-091-0/+9
| | | | | | | Verified with test 3100 Fixes #4750 Closes #9870
* lib: fix some type mismatches and remove unneeded typecastsRose2022-11-081-2/+2
| | | | | | | | | Many of these castings are unneeded if we change the variables to work better with each other. Ref: https://github.com/curl/curl/pull/9823 Closes https://github.com/curl/curl/pull/9835
* style: use space after comment start and before comment endDaniel Stenberg2022-10-301-2/+2
| | | | | | | | | | /* like this */ /*not this*/ checksrc is updated accordingly Closes #9828
* misc: typo and grammar fixesAyesh Karunaratne2022-10-271-10/+10
| | | | | | | | | | - Replace `Github` with `GitHub`. - Replace `windows` with `Windows` - Replace `advice` with `advise` where a verb is used. - A few fixes on removing repeated words. - Replace `a HTTP` with `an HTTP` Closes #9802
* url: allow non-HTTPS HSTS-matching for debug buildsShaun Mirani2022-10-131-1/+8
| | | | Closes #9728
* http: try parsing Retry-After: as a number firstDaniel Stenberg2022-10-131-8/+8
| | | | | | | | | | | | | | | Since the date parser allows YYYYMMDD as a date format (due to it being a bit too generic for parsing this particular header), a large integer number could wrongly match that pattern and cause the parser to generate a wrong value. No date format accepted for this header starts with a decimal number, so by reversing the check and trying a number first we can deduct that if that works, it was not a date. Reported-by Trail of Bits Closes #9718
* http, vauth: always provide Curl_allow_auth_to_host() functionalityPatrick Monnerat2022-09-271-17/+2
| | | | | | | | | | | | | | This function is currently located in the lib/http.c module and is therefore disabled by the CURL_DISABLE_HTTP conditional token. As it may be called by TLS backends, disabling HTTP results in an undefined reference error at link time. Move this function to vauth/vauth.c to always provide it and rename it as Curl_auth_allowed_to_host() to respect the vauth module naming convention. Closes #9600
* lib: the number four in a sequence is the "fourth"Daniel Stenberg2022-09-191-1/+1
| | | | | | Spelling is hard Closes #9535
* ws: initial websockets supportDaniel Stenberg2022-09-091-9/+110
| | | | Closes #8995
* NPN: remove support for and use ofDaniel Stenberg2022-09-051-2/+2
| | | | | | | | | | | | | | | | | | | | | | Next Protocol Negotiation is a TLS extension that was created and used for agreeing to use the SPDY protocol (the precursor to HTTP/2) for HTTPS. In the early days of HTTP/2, before the spec was finalized and shipped, the protocol could be enabled using this extension with some servers. curl supports the NPN extension with some TLS backends since then, with a command line option `--npn` and in libcurl with `CURLOPT_SSL_ENABLE_NPN`. HTTP/2 proper is made to use the ALPN (Application-Layer Protocol Negotiation) extension and the NPN extension has no purposes anymore. The HTTP/2 spec was published in May 2015. Today, use of NPN in the wild should be extremely rare and most likely totally extinct. Chrome removed NPN support in Chrome 51, shipped in June 2016. Removed in Firefox 53, April 2017. Closes #9307
* http: typecast the httpreq assignment to avoid icc compiler warningDaniel Stenberg2022-07-231-1/+1
| | | | | | error #188: enumerated type mixed with another type Closes #9179
* cookie: apply limitsDaniel Stenberg2022-06-261-2/+11
| | | | | | | | | | | - Send no more than 150 cookies per request - Cap the max length used for a cookie: header to 8K - Cap the max number of received Set-Cookie: headers to 50 Bug: https://curl.se/docs/CVE-2022-32205.html CVE-2022-32205 Reported-by: Harry Sintonen Closes #9048
* copyright: make repository REUSE compliantmax.mehl2022-06-131-0/+2
| | | | | | | | | | | Add licensing and copyright information for all files in this repository. This either happens in the file itself as a comment header or in the file `.reuse/dep5`. This commit also adds a Github workflow to check pull requests and adapts copyright.pl to the changes. Closes #8869
* http: restore header folding behaviorDaniel Stenberg2022-05-241-5/+10
| | | | | | | | | | | Folded header lines will now get passed through like before. The headers API is adapted and will provide the content unfolded. Added test 1274 and extended test 1940 to verify. Reported-by: Petr Pisar Fixes #8844 Closes #8899
* http: move Curl_allow_auth_to_host()Daniel Stenberg2022-04-291-15/+15
| | | | | | | | It was mistakenly put within the CURL_DISABLE_HTTP_AUTH #ifdef Reported-by: Michael Olbrich Fixes #8772 Closes #8775
* openssl: don't leak the SRP credentials in redirects eitherDaniel Stenberg2022-04-251-5/+5
| | | | | | | Follow-up to 620ea21410030 Reported-by: Harry Sintonen Closes #8751
* http: avoid auth/cookie on redirects same host diff portDaniel Stenberg2022-04-251-12/+22
| | | | | | | | CVE-2022-27776 Reported-by: Harry Sintonen Bug: https://curl.se/docs/CVE-2022-27776.html Closes #8749
View Lorry Controller Status