summaryrefslogtreecommitdiff
path: root/lib/url.c
Commit message (Collapse)AuthorAgeFilesLines
* url.c: use consistent error message for failed resolveDaniel Stenberg2021-02-181-1/+1
|
* parse_proxy: fix a memory leak in the OOM pathDaniel Stenberg2021-02-171-6/+13
| | | | | | | | | Reported-by: Jay Satiro Reviewed-by: Jay Satiro Reviewed-by: Emil Engler Closes #6614 Bug: https://github.com/curl/curl/pull/6591#issuecomment-780396541
* url: fix possible use-after-free in default protocolJay Satiro2021-02-171-5/+4
| | | | | | | | | | | Prior to this change if the user specified a default protocol and a separately allocated non-absolute URL was used then it was freed prematurely, before it was then used to make the replacement URL. Bug: https://github.com/curl/curl/issues/6604#issuecomment-780138219 Reported-by: arvids-kokins-bidstack@users.noreply.github.com Closes https://github.com/curl/curl/pull/6613
* lib: remove 'conn->data' completelyDaniel Stenberg2021-02-161-25/+17
| | | | | | | | The Curl_easy pointer struct entry in connectdata is now gone. Just before commit 215db086e0 landed on January 8, 2021 there were 919 references to conn->data. Closes #6608
* doh: add options to disable ssl verificationJay Satiro2021-02-141-0/+2
| | | | | | | | | | | | | | | | | | | | | | - New libcurl options CURLOPT_DOH_SSL_VERIFYHOST, CURLOPT_DOH_SSL_VERIFYPEER and CURLOPT_DOH_SSL_VERIFYSTATUS do the same as their respective counterparts. - New curl tool options --doh-insecure and --doh-cert-status do the same as their respective counterparts. Prior to this change DOH SSL certificate verification settings for verifyhost and verifypeer were supposed to be inherited respectively from CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER, but due to a bug were not. As a result DOH verification remained at the default, ie enabled, and it was not possible to disable. This commit changes behavior so that the DOH verification settings are independent and not inherited. Ref: https://github.com/curl/curl/pull/4579#issuecomment-554723676 Fixes https://github.com/curl/curl/issues/4578 Closes https://github.com/curl/curl/pull/6597
* http: use credentials from transfer, not connectionDaniel Stenberg2021-02-131-84/+106
| | | | | | | | | | | | | | | | | | | HTTP auth "accidentally" worked before this cleanup since the code would always overwrite the connection credentials with the credentials from the most recent transfer and since HTTP auth is typically done first thing, this has not been an issue. It was still wrong and subject to possible race conditions or future breakage if the sequence of functions would change. The data.set.str[] strings MUST remain unmodified exactly as set by the user, and the credentials to use internally are instead set/updated in state.aptr.* Added test 675 to verify different credentials used in two requests done over a reused HTTP connection, which previously behaved wrongly. Fixes #6542 Closes #6545
* urldata: don't touch data->set.httpversion at run-timeDaniel Stenberg2021-02-121-2/+2
| | | | | | | | | Rename it to 'httpwant' and make a cloned field in the state struct as well for run-time updates. Also: refuse non-supported HTTP versions. Verified with test 129. Closes #6585
* lib: use int type for more port variablesJay Satiro2021-02-091-1/+1
| | | | | | | This is a follow-up to 764c6bd. Prior to that change port variables were usually type long. Closes https://github.com/curl/curl/pull/6553
* urldata: remove duplicate 'upkeep_interval_ms' from connectdataDaniel Stenberg2021-01-271-3/+0
| | | | | | ... and rely only on the value already set in Curl_easy. Closes #6534
* urldata: remove 'local_ip' from the connectdata structDaniel Stenberg2021-01-271-2/+11
| | | | | | | As the info is already stored in the transfer handle anyway, there's no need to carry around a duplicate buffer for the life-time of the handle. Closes #6534
* urldata: remove duplicate port number storageDaniel Stenberg2021-01-271-3/+3
| | | | | | | | ... and use 'int' for ports. We don't use 'unsigned short' since -1 is still often used internally to signify "unknown value" and 0 - 65535 are all valid port numbers. Closes #6534
* urldata: remove the duplicate 'ip_addr_str' fieldDaniel Stenberg2021-01-271-3/+3
| | | | | | ... as the numerical IP address is already stored and kept in 'primary_ip'. Closes #6534
* url: reduce conn->data referencesDaniel Stenberg2021-01-261-35/+37
| | | | | | ... there are a few left but let's keep them to last Closes #6512
* hostip: remove conn->data from resolver functionsDaniel Stenberg2021-01-221-6/+6
| | | | | | | This also moves the 'async' struct from the connectdata struct into the Curl_easy struct, which seems like a better home for it. Closes #6497
* doh: allocate state struct on demandDaniel Stenberg2021-01-201-5/+10
| | | | | | | | ... instead of having it static within the Curl_easy struct. This takes away 1176 bytes (18%) from the Curl_easy struct that aren't used very often and instead makes the code allocate it when needed. Closes #6492
* lib: more conn->data cleanupsDaniel Stenberg2021-01-191-16/+13
| | | | Closes #6479
* vtls: reduce conn->data usePatrick Monnerat2021-01-191-2/+2
| | | | Closes #6474
* lib: pass in 'struct Curl_easy *' to most functionsDaniel Stenberg2021-01-171-38/+59
| | | | | | | | | | | | | | | | | | | | | ... in most cases instead of 'struct connectdata *' but in some cases in addition to. - We mostly operate on transfers and not connections. - We need the transfer handle to log, store data and more. Everything in libcurl is driven by a transfer (the CURL * in the public API). - This work clarifies and separates the transfers from the connections better. - We should avoid "conn->data". Since individual connections can be used by many transfers when multiplexing, making sure that conn->data points to the current and correct transfer at all times is difficult and has been notoriously error-prone over the years. The goal is to ultimately remove the conn->data pointer for this reason. Closes #6425
* url: if IDNA conversion fails, fallback to TransitionalDaniel Stenberg2021-01-111-0/+5
| | | | | | | | This improves IDNA2003 compatiblity. Reported-by: Bubu on github Fixes #6423 Closes #6428
* pretransfer: setup the User-Agent header hereDaniel Stenberg2021-01-051-14/+0
| | | | | | | | | | | | | ... and not in the connection setup, as for multiplexed transfers the connection setup might be skipped and then the transfer would end up without the set user-agent! Reported-by: Flameborn on github Assisted-by: Andrey Gursky Assisted-by: Jay Satiro Assisted-by: Mike Gelfand Fixes #6312 Closes #6417
* httpauth: make multi-request auth work with custom portDaniel Stenberg2021-01-021-1/+3
| | | | | | | | | | | | When doing HTTP authentication and a port number set with CURLOPT_PORT, the code would previously have the URL's port number override as if it had been a redirect to an absolute URL. Added test 1568 to verify. Reported-by: UrsusArctos on github Fixes #6397 Closes #6400
* language: s/behaviour/behavior/gEmil Engler2021-01-021-2/+2
| | | | | | | | We currently use both spellings the british "behaviour" and the american "behavior". However "behavior" is more used in the project so I think it's worth dropping the british name. Closes #6395
* misc: fix "warning: empty expression statement has no effect"Daniel Stenberg2020-12-261-4/+1
| | | | | | | | | | Turned several macros into do-while(0) style to allow their use to work find with semicolon. Bug: https://github.com/curl/curl/commit/08e8455dddc5e48e58a12ade3815c01ae3da3b64#commitcomment-45433279 Follow-up to 08e8455dddc5e4 Reported-by: Gisle Vanem Closes #6376
* failf: remove newline from formatting stringsDaniel Stenberg2020-12-251-2/+2
| | | | | | | | | ... as failf adds one itself. Also: add an assert() to failf() that triggers on a newline in the format string! Closes #6365
* gopher: Implement secure gopher protocol.parazyd2020-12-151-0/+3
| | | | | | | | | | | | | | | | | | This commit introduces a "gophers" handler inside the gopher protocol if USE_SSL is defined. This protocol is no different than the usual gopher prococol, with the added TLS encapsulation upon connecting. The protocol has been adopted in the gopher community, and many people have enabled TLS in their gopher daemons like geomyidae(8), and clients, like clic(1) and hurl(1). I have not implemented test units for this protocol because my knowledge of Perl is sub-par. However, for someone more knowledgeable it might be fairly trivial, because the same test that tests the plain gopher protocol can be used for "gophers" just by adding a TLS listener. Signed-off-by: parazyd <parazyd@dyne.org> Closes #6208
* ftp: CURLOPT_FTP_SKIP_PASV_IP by defaultDaniel Stenberg2020-12-071-0/+1
| | | | | | | | | | | | The command line tool also independently sets --ftp-skip-pasv-ip by default. Ten test cases updated to adapt the modified --libcurl output. Bug: https://curl.se/docs/CVE-2020-8284.html CVE-2020-8284 Reported-by: Varnavas Papaioannou
* urldata: remove 'void *protop' and create the union 'p'Daniel Stenberg2020-11-231-1/+1
| | | | | | | ... to avoid the use of 'void *' for the protocol specific structs done per transfer. Closes #6238
* url: make sure an HSTS upgrade updates URL and scheme correctlyDaniel Stenberg2020-11-061-2/+20
| | | | Closes #6175
* curl.se: new homeDaniel Stenberg2020-11-041-1/+1
| | | | Closes #6172
* hsts: add read/write callbacksDaniel Stenberg2020-11-031-0/+1
| | | | | | | | - read/write callback options - man pages for the 4 new setopts - test 1915 verifies the callbacks Closes #5896
* hsts: add support for Strict-Transport-SecurityDaniel Stenberg2020-11-031-6/+15
| | | | | | | | | | | | | | | | | | | | | | | | | - enable in the build (configure) - header parsing - host name lookup - unit tests for the above - CI build - CURL_VERSION_HSTS bit - curl_version_info support - curl -V output - curl-config --features - CURLOPT_HSTS_CTRL - man page for CURLOPT_HSTS_CTRL - curl --hsts (sets CURLOPT_HSTS_CTRL and works with --libcurl) - man page for --hsts - save cache to disk - load cache from disk - CURLOPT_HSTS - man page for CURLOPT_HSTS - added docs/HSTS.md - fixed --version docs - adjusted curl_easy_duphandle Closes #5896
* alt-svc: enable by defaultDaniel Stenberg2020-10-251-1/+1
| | | | | | | | Remove CURLALTSVC_IMMEDIATELY, which was never implemented/supported. alt-svc support in curl is no longer considered experimental Closes #5868
* Curl_handler: add 'family' to each protocolDaniel Stenberg2020-09-211-113/+21
| | | | | | | Makes get_protocol_family() faster and it moves the knowledge about the "families" to each protocol handler, where it belongs. Closes #5986
* vtls: deduplicate client certificates in ssl_config_dataGergely Nagy2020-09-141-4/+0
| | | | Closes #5629
* url: use blank credentials when using proxy w/o username and passwordDiven Qi2020-09-081-2/+4
| | | | | | | Fixes proxy regression brought in commit ad829b21ae (7.71.0) Fixed #5911 Closes #5914
* altsvc: clone setting in curl_easy_duphandlebagder/altsvc-duphandleDaniel Stenberg2020-09-061-4/+1
| | | | | | | | | | | | The cache content is not duplicated, like other caches, but the setting and specified file name are. Test 1908 is extended to verify this somewhat. Since the duplicated handle gets the same file name, the test unfortunately overwrites the same file twice (with different contents) which makes it hard to check automatically. Closes #5923
* http_proxy: do not crash with HTTPS_PROXY and NO_PROXY setMartin Bašti2020-09-031-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ... in case NO_PROXY takes an effect Without this patch, the following command crashes: $ GIT_CURL_VERBOSE=1 NO_PROXY=github.com HTTPS_PROXY=https://example.com \ git clone https://github.com/curl/curl.git Minimal libcurl-based reproducer: #include <curl/curl.h> int main() { CURL *curl = curl_easy_init(); if(curl) { CURLcode ret; curl_easy_setopt(curl, CURLOPT_URL, "https://github.com/"); curl_easy_setopt(curl, CURLOPT_PROXY, "example.com"); /* set the proxy type */ curl_easy_setopt(curl, CURLOPT_PROXYTYPE, CURLPROXY_HTTPS); curl_easy_setopt(curl, CURLOPT_NOPROXY, "github.com"); curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); ret = curl_easy_perform(curl); curl_easy_cleanup(curl); return ret; } return -1; } Assisted-by: Kamil Dudka Bug: https://bugzilla.redhat.com/1873327 Closes #5902
* llist: make it "struct Curl_llist"Daniel Stenberg2020-09-021-1/+1
| | | | | | As internal global names should use captical C. Closes #5906
* mqtt: enable by defaultDaniel Stenberg2020-08-311-1/+1
| | | | | | No longer considered experimental. Closes #5858
* tls: add CURLOPT_SSL_EC_CURVES and --curvesMichael Baentsch2020-08-301-0/+1
| | | | Closes #5892
* url: remove funny embedded comments in Curl_disonnect callsDaniel Stenberg2020-08-301-6/+4
|
* conn: check for connection being dead before reuseChris Paulson-Ellis2020-08-301-0/+6
| | | | | | | | | | Prevents incorrect reuse of an HTTP connection that has been prematurely shutdown() by the server. Partial revert of 755083d00deb16 Fixes #5884 Closes #5893
* ntlm: fix condition for curl_ntlm_core usageMarcel Raad2020-08-291-3/+2
| | | | | | | | | | | | `USE_WINDOWS_SSPI` without `USE_WIN32_CRYPTO` but with any other DES backend is fine, but was excluded before. This also fixes test 1013 as the condition for SMB support in configure.ac didn't match the condition in the source code. Now it does. Fixes https://github.com/curl/curl/issues/1262 Closes https://github.com/curl/curl/pull/5771
* Curl_easy: remember last connection by id, not by pointerDaniel Stenberg2020-08-171-1/+1
| | | | | | | | | CVE-2020-8231 Bug: https://curl.haxx.se/docs/CVE-2020-8231.html Reported-by: Marc Aldorasi Closes #5824
* url: fix CURLU and location followingJay Satiro2020-07-301-2/+3
| | | | | | | | | | | Prior to this change if the user set a URL handle (CURLOPT_CURLU) it was incorrectly used for the location follow, resulting in infinite requests to the original location. Reported-by: sspiri@users.noreply.github.com Fixes https://github.com/curl/curl/issues/5709 Closes https://github.com/curl/curl/pull/5713
* url: silence MSVC warningMarcel Raad2020-07-021-1/+1
| | | | | | | | | | | | | | Since commit f3d501dc678, if proxy support is disabled, MSVC warns: url.c : warning C4701: potentially uninitialized local variable 'hostaddr' used url.c : error C4703: potentially uninitialized local pointer variable 'hostaddr' used That could actually only happen if both `conn->bits.proxy` and `CURL_DISABLE_PROXY` were enabled. Initialize it to NULL to silence the warning. Closes https://github.com/curl/curl/pull/5638
* vtls: compare cert blob when finding a connection to reuseDaniel Stenberg2020-06-291-1/+3
| | | | | | Reported-by: Gergely Nagy Fixes #5617 Closes #5619
* url: allow user + password to contain "control codes" for HTTP(S)Daniel Stenberg2020-06-251-10/+19
| | | | | | Reported-by: Jon Johnson Jr Fixes #5582 Closes #5592
* escape: make the URL decode able to reject only %00 bytesDaniel Stenberg2020-06-251-2/+2
| | | | | | ... or all "control codes" or nothing. Assisted-by: Nicolas Sterchele
* url: make sure pushed streams get an allocated download bufferDaniel Stenberg2020-06-231-0/+5
| | | | | | | | | Follow-up to c4e6968127e876b0 When a new transfer is created, as a resuly of an acknowledged push, that transfer needs a download buffer allocated. Closes #5590
View Lorry Controller Status