summaryrefslogtreecommitdiff
path: root/src/tool_getparam.c
Commit message (Collapse)AuthorAgeFilesLines
* libssh2: add SHA256 fingerprint supportMats Lindestam2021-09-261-0/+4
| | | | | | | Added support for SHA256 fingerprint in command line curl and in libcurl. Closes #7646
* misc: fix typos in docs and commentsa13460542021-09-231-1/+1
| | | | | | | No user facing output from curl/libcurl is changed by this, just comments. Closes #7747
* parse_args: redo the warnings for --remote-header-name combosDaniel Stenberg2021-09-101-11/+5
| | | | | | | | ... to avoid the memory leak risk pointed out by scan-build. Follow-up from 7a3e981781d6c18a Closes #7698
* curl: add warning for incompatible parameters usageCao ZhenXiang2021-09-061-10/+13
| | | | | | --continue-at - and --remote-header-name are known incompatible parameters Closes #7674
* getparameter: fix the --local-port number parserDaniel Stenberg2021-08-171-2/+3
| | | | | | | | It could previously get tricked into parsing the uninitialized stack based buffer. Reported-by: Brian Carpenter Closes #7582
* metalink: removeDaniel Stenberg2021-06-071-24/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Warning: this will make existing curl command lines that use metalink to stop working. Reasons for removal: 1. We've found several security problems and issues involving the metalink support in curl. The issues are not detailed here. When working on those, it become apparent to the team that several of the problems are due to the system design, metalink library API and what the metalink RFC says. They are very hard to fix on the curl side only. 2. The metalink usage with curl was only very briefly documented and was not following the "normal" curl usage pattern in several ways, making it surprising and non-intuitive which could lead to further security issues. 3. The metalink library was last updated 6 years ago and wasn't so active the years before that either. An unmaintained library means there's a security problem waiting to happen. This is probably reason enough. 4. Metalink requires an XML parsing library, which is complex code (even the smaller alternatives) and to this day often gets security updates. 5. Metalink is not a widely used curl feature. In the 2020 curl user survey, only 1.4% of the responders said that they'd are using it. In 2021 that number was 1.2%. Searching the web also show very few traces of it being used, even with other tools. 6. The torrent format and associated technology clearly won for downloading large files from multiple sources in parallel. Cloes #7176
* tool_getparam: fix comment typo in tool_getparam.cIkko Ashimine2021-05-151-1/+1
| | | | | | enfore -> enforce Closes #7074
* tool_getparam: handle failure of curlx_convert_tchar_to_UTF8()Kamil Dudka2021-05-061-0/+2
| | | | | | | | | | | | | | | | Reported by GCC analyzer: Error: GCC_ANALYZER_WARNING (CWE-476): src/tool_getparam.c: scope_hint: In function 'parse_args' src/tool_getparam.c:2318:38: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL 'orig_opt' lib/curlx.h:56: included_from: Included from here. src/tool_getparam.c:28: included_from: Included from here. lib/curl_multibyte.h:70:51: note: in definition of macro 'curlx_convert_tchar_to_UTF8' src/tool_getparam.c:2316:16: note: in expansion of macro 'curlx_convert_tchar_to_UTF8' Reviewed-by: Marcel Raad Reviewed-by: Daniel Stenberg Closes #7023
* schannel: Disable auto credentials; add an option to enable itJay Satiro2021-04-221-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Disable auto credentials by default. This is a breaking change for clients that are using it, wittingly or not. - New libcurl ssl option value CURLSSLOPT_AUTO_CLIENT_CERT tells libcurl to automatically locate and use a client certificate for authentication, when requested by the server. - New curl tool options --ssl-auto-client-cert and --proxy-ssl-auto-client-cert map to CURLSSLOPT_AUTO_CLIENT_CERT. This option is only supported for Schannel (the native Windows SSL library). Prior to this change Schannel would, with no notification to the client, attempt to locate a client certificate and send it to the server, when requested by the server. Since the server can request any certificate that supports client authentication in the OS certificate store it could be a privacy violation and unexpected. Fixes https://github.com/curl/curl/issues/2262 Reported-by: Jeroen Ooms Assisted-by: Wes Hinsley Assisted-by: Rich FitzJohn Ref: https://curl.se/mail/lib-2021-02/0066.html Reported-by: Morten Minde Neergaard Closes https://github.com/curl/curl/pull/6673
* curl: ignore options asking for SSLv2 or SSLv3Daniel Stenberg2021-04-191-2/+2
| | | | | | | | | | | | | Instead output a warning about it and continue with the defaults. These SSL versions are typically not supported by the TLS libraries since a long time back already since they are inherently insecure and broken. Asking for them to be used will just cause an error to be returned slightly later. In the unlikely event that a user's TLS library actually still supports these protocol versions, this change might make the request a little less insecure. Closes #6772
* tool_getparam: replace (in-place) '%20' by '+' according to RFC1866Victor Vieux2021-04-151-1/+31
| | | | | | Signed-off-by: Victor Vieux <victorvieux@gmail.com> Closes #6895
* cookies: Support multiple -b parametersDaniel Gustafsson2021-02-251-2/+6
| | | | | | | | | | Previously only a single -b cookie parameter was supported with the last one winning. This adds support for supplying multiple -b params to have them serialized semicolon separated. Both cookiefiles and cookies can be entered multiple times. Closes #6649 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* http: do not add a referrer header with empty valueViktor Szakats2021-02-161-1/+2
| | | | | | | | | | Previously an empty 'Referer:' header was added to the HTTP request when passing `--referer ';auto'` or `--referer ''` on the command-line. This patch makes `--referer` work like `--header 'Referer:'` and will only add the header if it has a non-zero length value. Reviewed-by: Jay Satiro Closes #6610
* doh: add options to disable ssl verificationJay Satiro2021-02-141-1/+10
| | | | | | | | | | | | | | | | | | | | | | - New libcurl options CURLOPT_DOH_SSL_VERIFYHOST, CURLOPT_DOH_SSL_VERIFYPEER and CURLOPT_DOH_SSL_VERIFYSTATUS do the same as their respective counterparts. - New curl tool options --doh-insecure and --doh-cert-status do the same as their respective counterparts. Prior to this change DOH SSL certificate verification settings for verifyhost and verifypeer were supposed to be inherited respectively from CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER, but due to a bug were not. As a result DOH verification remained at the default, ie enabled, and it was not possible to disable. This commit changes behavior so that the DOH verification settings are independent and not inherited. Ref: https://github.com/curl/curl/pull/4579#issuecomment-554723676 Fixes https://github.com/curl/curl/issues/4578 Closes https://github.com/curl/curl/pull/6597
* curl: add --fail-with-bodyDaniel Stenberg2021-02-111-0/+10
| | | | | | | | Prevent both --fail and --fail-with-body on the same command line. Verify with test 349, 360 and 361. Closes #6449
* http: improve AWS HTTP v4 Signature authDmitry Wagin2021-01-301-2/+3
| | | | | | | | | | | | | | | | | | - Add support services without region and service prefixes in the URL endpoint (ex. Min.IO, GCP, Yandex Cloud, Mail.Ru Cloud Solutions, etc) by providing region and service parameters via aws-sigv4 option. - Add [:region[:service]] suffix to aws-sigv4 option; - Fix memory allocation errors. - Refactor memory management. - Use Curl_http_method instead() STRING_CUSTOMREQUEST. - Refactor canonical headers generating. - Remove repeated sha256_to_hex() usage. - Add some docs fixes. - Add some codestyle fixes. - Add overloaded strndup() for debug - curl_dbg_strndup(). - Update tests. Closes #6524
* curl: move fprintf outputs to warnfDaniel Stenberg2021-01-271-1/+1
| | | | | | | | | For setting and getting time of the download. To make the outputs respect --silent etc. Reported-by: Viktor Szakats Fixes #6533 Closes #6535
* language: s/behaviour/behavior/gEmil Engler2021-01-021-2/+2
| | | | | | | | We currently use both spellings the british "behaviour" and the american "behavior". However "behavior" is more used in the project so I think it's worth dropping the british name. Closes #6395
* tool: add AWS HTTP v4 Signature supportMatthias Gatto2020-12-211-0/+5
| | | | Signed-off-by: Matthias Gatto <matthias.gatto@outscale.com>
* curl: add --create-file-mode [mode]Daniel Stenberg2020-12-211-0/+7
| | | | | | | | This option sets the (octal) mode to use for the remote file when one is created, using the SFTP, SCP or FILE protocols. When not set, the default is 0644. Closes #6244
* curl.se: new homeDaniel Stenberg2020-11-041-1/+1
| | | | Closes #6172
* hsts: add support for Strict-Transport-SecurityDaniel Stenberg2020-11-031-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | - enable in the build (configure) - header parsing - host name lookup - unit tests for the above - CI build - CURL_VERSION_HSTS bit - curl_version_info support - curl -V output - curl-config --features - CURLOPT_HSTS_CTRL - man page for CURLOPT_HSTS_CTRL - curl --hsts (sets CURLOPT_HSTS_CTRL and works with --libcurl) - man page for --hsts - save cache to disk - load cache from disk - CURLOPT_HSTS - man page for CURLOPT_HSTS - added docs/HSTS.md - fixed --version docs - adjusted curl_easy_duphandle Closes #5896
* curl: make sure setopt CURLOPT_IPRESOLVE passes on a longDaniel Stenberg2020-10-051-2/+2
| | | | | | | | | | Previously, it would pass on a define (int) which could make libcurl read junk as a value - which prevented the CURLOPT_IPRESOLVE option to "take". This could then make test 2100 do two DoH requests instead of one! Fixes #6042 Closes #6043
* --help: strdup the categoryDaniel Stenberg2020-09-181-1/+5
| | | | | | | | | | ... since it is converted and the original pointer is freed on Windows unicode handling. Follow-up to aa8777f63febc Fixes #5977 Closes #5978 Reported-by: xwxbug on github
* tool: update --help with categoriesEmil Engler2020-09-041-0/+1
| | | | | | This commit is a part of "--help me if you can" Closes #5680
* tls: add CURLOPT_SSL_EC_CURVES and --curvesMichael Baentsch2020-08-301-0/+5
| | | | Closes #5892
* curl: add --output-dirDaniel Stenberg2020-08-241-0/+5
| | | | | | | | Works with --create-dirs and with -J Add test 3008, 3009, 3011, 3012 and 3013 to verify. Closes #5637
* content_encoding: add zstd decoding supportGilles Vollant2020-07-121-1/+2
| | | | | | | | | include zstd curl patch for Makefile.m32 from vszakats and include Add CMake support for zstd from Peter Wu Helped-by: Viktor Szakats Helped-by: Peter Wu Closes #5453
* tool_getparam: make --krb option work againKamil Dudka2020-07-031-1/+1
| | | | | | | It was disabled by mistake in commit curl-7_37_1-23-ge38ba4301. Bug: https://bugzilla.redhat.com/1833193 Closes #5640
* terminology: call them null-terminated stringsDaniel Stenberg2020-06-281-2/+2
| | | | | | | | | | | Updated terminology in docs, comments and phrases to refer to C strings as "null-terminated". Done to unify with how most other C oriented docs refer of them and what users in general seem to prefer (based on a single highly unscientific poll on twitter). Reported-by: coinhubs on github Fixes #5598 Closes #5608
* tool_getparam: -i is not OK if -J is usedDaniel Stenberg2020-06-221-0/+5
| | | | | Reported-by: sn on hackerone Bug: https://curl.haxx.se/docs/CVE-2020-8177.html
* tool_getparam: repair the error message for unknown flagDaniel Stenberg2020-06-181-1/+2
| | | | | | | Follow-up to 9e5669f3880674 Detected by Coverity CID 1464582 ("Logically dead code") Closes #5577
* tool_getparam: fix memory leak in parse_argsJay Satiro2020-06-091-0/+2
| | | | | | | | | Prior to this change in Windows Unicode builds most parsed options would not be freed. Found using _CrtDumpMemoryLeaks(). Ref: https://github.com/curl/curl/issues/5545
* tool: support UTF-16 command line on WindowsMarcel Raad2020-05-141-7/+10
| | | | | | | | | | | | | | | | | | - use `wmain` instead of `main` when `_UNICODE` is defined [0] - define `argv_item_t` as `wchar_t *` in this case - use the curl_multibyte gear to convert the command-line arguments to UTF-8 This makes it possible to pass parameters with characters outside of the current locale on Windows, which is required for some tests, e.g. the IDN tests. Out of the box, this currently only works with the Visual Studio project files, which default to Unicode, and winbuild with the `ENABLE_UNICODE` option. [0] https://devblogs.microsoft.com/oldnewthing/?p=40643 Ref: https://github.com/curl/curl/issues/3747 Closes https://github.com/curl/curl/pull/3784
* tool: Add option --retry-all-errors to retry on any errorJay Satiro2020-05-121-0/+4
| | | | | | The "sledgehammer" of retrying. Closes https://github.com/curl/curl/pull/5185
* cmdline: fix handling of OperationConfig linked list (--next)Rici Lake2020-03-201-0/+1
| | | | | | | | | | Ensures that -K/--config inserts new items at the end of the list instead of overwriting the second item, and that after a -K/--config option has been parsed, the option parser's view of the current config is update. Fixes #5120 Closes #5123
* schannel: add "best effort" revocation check optionJohannes Schindelin2020-03-181-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Implement new option CURLSSLOPT_REVOKE_BEST_EFFORT and --ssl-revoke-best-effort to allow a "best effort" revocation check. A best effort revocation check ignores errors that the revocation check was unable to take place. The reasoning is described in detail below and discussed further in the PR. --- When running e.g. with Fiddler, the schannel backend fails with an unhelpful error message: Unknown error (0x80092012) - The revocation function was unable to check revocation for the certificate. Sadly, many enterprise users who are stuck behind MITM proxies suffer the very same problem. This has been discussed in plenty of issues: https://github.com/curl/curl/issues/3727, https://github.com/curl/curl/issues/264, for example. In the latter, a Microsoft Edge developer even made the case that the common behavior is to ignore issues when a certificate has no recorded distribution point for revocation lists, or when the server is offline. This is also known as "best effort" strategy and addresses the Fiddler issue. Unfortunately, this strategy was not chosen as the default for schannel (and is therefore a backend-specific behavior: OpenSSL seems to happily ignore the offline servers and missing distribution points). To maintain backward-compatibility, we therefore add a new flag (`CURLSSLOPT_REVOKE_BEST_EFFORT`) and a new option (`--ssl-revoke-best-effort`) to select the new behavior. Due to the many related issues Git for Windows and GitHub Desktop, the plan is to make this behavior the default in these software packages. The test 2070 was added to verify this behavior, adapted from 310. Based-on-work-by: georgeok <giorgos.n.oikonomou@gmail.com> Co-authored-by: Markus Olsson <j.markus.olsson@gmail.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Closes https://github.com/curl/curl/pull/4981
* curl: error on --alt-svc use w/o supportDaniel Stenberg2020-02-051-1/+4
| | | | | | | | Make the tool check for alt-svc support at run-time and return error accordingly if not present when the option is used. Reported-by: Harry Sintonen Closes #4878
* curl: avoid using strlen for testing if a string is emptyOrgad Shaneh2020-02-041-1/+1
| | | | Closes #4873
* smtp: Allow RCPT TO command to fail for some recipientsPavel Volgarev2020-01-211-0/+4
| | | | | | | | Introduces CURLOPT_MAIL_RCPT_ALLLOWFAILS. Verified with the new tests 3002-3007 Closes #4816
* curl:getparameter return error for --http3 if libcurl doesn't supportDaniel Stenberg2020-01-051-2/+5
| | | | Closes #4785
* tool: make a few char pointers point to const char insteadMarcel Raad2019-12-311-2/+1
| | | | | | These are read-only. Closes https://github.com/curl/curl/pull/4771
* build: Disable Visual Studio warning "conditional expression is constant"Jay Satiro2019-12-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Disable warning C4127 "conditional expression is constant" globally in curl_setup.h for when building with Microsoft's compiler. This mainly affects building with the Visual Studio project files found in the projects dir. Prior to this change the cmake and winbuild build systems already disabled 4127 globally for when building with Microsoft's compiler. Also, 4127 was already disabled for all build systems in the limited circumstance of the WHILE_FALSE macro which disabled the warning specifically for while(0). This commit removes the WHILE_FALSE macro and all other cruft in favor of disabling globally in curl_setup. Background: We have various macros that cause 0 or 1 to be evaluated, which would cause warning C4127 in Visual Studio. For example this causes it: #define Curl_resolver_asynch() 1 Full behavior is not clearly defined and inconsistent across versions. However it is documented that since VS 2015 Update 3 Microsoft has addressed this somewhat but not entirely, not warning on while(true) for example. Prior to this change some C4127 warnings occurred when I built with Visual Studio using the generated projects in the projects dir. Closes https://github.com/curl/curl/pull/4658
* curl: two new command line options for etagsMaros Priputen2019-11-281-0/+10
| | | | | | | | --etag-compare and --etag-save Suggested-by: Paul Hoffman Fixes #4277 Closes #4543
* curl: add --parallel-immediateDaniel Stenberg2019-11-211-0/+4
| | | | | | | | | | | | | | | Starting with this change when doing parallel transfers, without this option set, curl will prefer to create new transfers multiplexed on an existing connection rather than creating a brand new one. --parallel-immediate can be set to tell curl to prefer to use new connections rather than to wait and try to multiplex. libcurl-wise, this means that curl will set CURLOPT_PIPEWAIT by default on parallel transfers. Suggested-by: Tom van der Woerdt Closes #4500
* curl: --no-progress-meterDaniel Stenberg2019-10-081-5/+11
| | | | | | | | | New option that allows a user to ONLY switch off curl's progress meter and leave everything else in "talkative" mode. Reported-by: Piotr Komborski Fixes #4422 Closes #4470
* tool_getparam: remove duplicate switch caseDaniel Stenberg2019-09-201-5/+1
| | | | | Fixes warning detected by PVS-Studio Fixes #4374
* CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directlyDaniel Stenberg2019-08-081-4/+4
| | | | | | | | | | | | Even though it cannot fall-back to a lower HTTP version automatically. The safer way to upgrade remains via CURLOPT_ALTSVC. CURLOPT_H3 no longer has any bits that do anything and might be removed before we remove the experimental label. Updated the curl tool accordingly to use "--http3". Closes #4197
* curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the toolSteve Holme2019-08-061-1/+5
| | | | | | | | | | | | Ref: https://github.com/curl/curl/issues/3653 Ref: https://github.com/curl/curl/pull/3790 NOTE: This commit was cherry-picked and is part of a series of commits that added the authzid feature for upcoming 7.66.0. The series was temporarily reverted in db8ec1f so that it would not ship in a 7.65.x patch release. Closes https://github.com/curl/curl/pull/4186
* curl: cap the maximum allowed values for retry time argumentsDaniel Stenberg2019-07-301-2/+2
| | | | | | | | | | ... to avoid integer overflows later when multiplying with 1000 to convert seconds to milliseconds. Added test 1269 to verify. Reported-by: Jason Lee Closes #4166
View Lorry Controller Status