Jay Satiro [Sat, 12 Aug 2023 19:06:08 +0000 (15:06 -0400)]
http_aws_sigv4: handle no-value user header entries
- Handle user headers in format 'name:' and 'name;' with no value.
The former is used when the user wants to remove an internal libcurl
header and the latter is used when the user actually wants to send a
no-value header in the format 'name:' (note the semi-colon is converted
by libcurl to a colon).
Prior to this change the AWS header import code did not special case
either of those and the generated AWS SignedHeaders would be incorrect.
include.d: explain headers not printed with --fail before 7.75.0
Prior to 7.75.0 response headers were not printed if -f/--fail was used
and an error was reported by server. This was fixed in ab525c0
(precedes 7.75.0).
- Use CERT_CONTEXT's pbCertEncoded to determine chain order.
CERT_CONTEXT from SECPKG_ATTR_REMOTE_CERT_CONTEXT contains
end-entity/server certificate in pbCertEncoded. We can use this pointer
to determine the order of certificates when enumerating hCertStore using
CertEnumCertificatesInStore.
This change is to help ensure that the ordering of the certificate chain
requested by the user via CURLINFO_CERTINFO has the same ordering on all
versions of Windows.
Prior to this change Schannel certificate order was reversed in 8986df80
but that was later reverted in f540a39b when it was discovered that
Windows 11 22H2 does the reversal on its own.
Chris Talbot [Thu, 29 Jun 2023 16:27:48 +0000 (12:27 -0400)]
digest: Use hostname to generate spn instead of realm
In https://www.rfc-editor.org/rfc/rfc2831#section-2.1.2
digest-uri-value should be serv-type "/" host , where host is:
The DNS host name or IP address for the service requested. The
DNS host name must be the fully-qualified canonical name of the
host. The DNS host name is the preferred form; see notes on server
processing of the digest-uri.
Realm may not be the host, so we must specify the host explicitly.
Note this change only affects the non-SSPI digest code. The digest code
used by SSPI builds already uses the hostname to generate the spn.
Stefan Eissing [Thu, 7 Sep 2023 12:51:44 +0000 (14:51 +0200)]
ngtcp2: fix handling of large requests
- requests >64K are send in parts to the filter
- fix parsing of the request to assemble it correctly
from several sends
- open a QUIC stream only when the complete request has
been collected
Stefan Eissing [Wed, 6 Sep 2023 06:35:42 +0000 (08:35 +0200)]
openssl: when CURLOPT_SSL_CTX_FUNCTION is registered, init x509 store before
- we delay loading the x509 store to shorten the handshake time.
However an application callback installed via CURLOPT_SSL_CTX_FUNCTION
may need to have the store loaded and try to manipulate it.
- load the x509 store before invoking the app callback
Fixes #11800 Reported-by: guoxinvmware on github
Cloes #11805
Stefan Eissing [Wed, 6 Sep 2023 08:03:37 +0000 (10:03 +0200)]
pytest: improvements
- set CURL_CI for pytest runs in CI environments
- exclude timing sensitive tests from CI runs
- for failed results, list only the log and stat of
the failed transfer
Stefan Eissing [Tue, 5 Sep 2023 11:44:13 +0000 (13:44 +0200)]
http: fix sending of large requests
- refs #11342 where errors with git https interactions
were observed
- problem was caused by 1st sends of size larger than 64KB
which resulted in later retries of 64KB only
- limit sending of 1st block to 64KB
- adjust h2/h3 filters to cope with parsing the HTTP/1.1
formatted request in chunks
- introducing Curl_nwrite() as companion to Curl_write()
for the many cases where the sockindex is already known
Daniel Stenberg [Mon, 4 Sep 2023 12:14:32 +0000 (14:14 +0200)]
transfer: also stop the sending on closed connection
Previously this cleared the receiving bit only but in some cases it is
also still sending (like a request-body) when disconnected and neither
direction can continue then.
Stefan Eissing [Tue, 29 Aug 2023 11:08:35 +0000 (13:08 +0200)]
http2: polish things around POST
- added test cases for various code paths
- fixed handling of blocked write when stream had
been closed inbetween attempts
- re-enabled DEBUGASSERT on send with smaller data size
- in debug builds, environment variables can be set to simulate a slow
network when sending data. cf-socket.c and vquic.c support
* CURL_DBG_SOCK_WBLOCK: percentage of send() calls that should be
answered with a EAGAIN. TCP/UNIX sockets.
This is chosen randomly.
* CURL_DBG_SOCK_WPARTIAL: percentage of data that shall be written
to the network. TCP/UNIX sockets.
Example: 80 means a send with 1000 bytes would only send 800
This is applied to every send.
* CURL_DBG_QUIC_WBLOCK: percentage of send() calls that should be
answered with EAGAIN. QUIC only.
This is chosen randomly.
`Curl_hyper_stream` needs to distinguish between two kinds of
`HYPER_TASK_EMPTY` tasks: (a) the `foreach` tasks it creates itself, and
(b) background tasks that hyper produces. It does this by recording the
address of any `foreach` task in `hyptransfer->endtask` before pushing
it into the executor, and then comparing that against the address of
tasks later polled out of the executor.
This works right now, but there is no guarantee from hyper that the
addresses are stable. `hyper_executor_push` says "The executor takes
ownership of the task, which should not be accessed again unless
returned back to the user with `hyper_executor_poll`". That wording is a
bit ambiguous but with my Rust programmer's hat on I read it as meaning
the task returned with `hyper_executor_poll` may be conceptually the
same as a task that was pushed, but that there are no other guarantees
and comparing addresses is a bad idea.
This commit instead uses `hyper_task_set_userdata` to mark the `foreach`
task with a `USERDATA_RESP_BODY` value which can then be checked for,
removing the need for `hyptransfer->endtask`. This makes the code look
more like that hyper C API examples, which use userdata for every task
and never look at task addresses.
Dan Fandrich [Fri, 1 Sep 2023 21:51:32 +0000 (14:51 -0700)]
build: fix portability of mancheck and checksrc targets
At least FreeBSD preserves cwd across makefile lines, so rules
consisting of more than one "cd X; do_something" must be explicitly run
in a subshell to avoid this. This problem caused the Cirrus FreeBSD
build to fail when parallel make jobs were enabled.
Dan Fandrich [Thu, 31 Aug 2023 23:06:02 +0000 (16:06 -0700)]
configure: trust pkg-config when it's used for zlib
The library flags retrieved from pkg-config were later thrown out and
harded-coded, which negates the whole reason to use pkg-config.
Also, previously, the assumption was made that --libs-only-l and
--libs-only-L are the full decomposition of --libs, which is untrue and
would not allow linking against a static zlib. The new approach is
better in that it uses --libs, although only if --libs-only-l returns
nothing.
`Curl_pgrsSetUploadCounter` should be a passed a total count, not an
increment.
This changes the failing diff for test 579 with hyper from this:
```
Progress callback called with UL 0 out of 0[LF]
-Progress callback called with UL 8 out of 0[LF]
-Progress callback called with UL 16 out of 0[LF]
-Progress callback called with UL 26 out of 0[LF]
-Progress callback called with UL 61 out of 0[LF]
-Progress callback called with UL 66 out of 0[LF]
+Progress callback called with UL 29 out of 0[LF]
```
to this:
```
Progress callback called with UL 0 out of 0[LF]
-Progress callback called with UL 8 out of 0[LF]
-Progress callback called with UL 16 out of 0[LF]
-Progress callback called with UL 26 out of 0[LF]
-Progress callback called with UL 61 out of 0[LF]
-Progress callback called with UL 66 out of 0[LF]
+Progress callback called with UL 40 out of 0[LF]
```
Presumably a step in the right direction.
Viktor Szakats [Thu, 31 Aug 2023 13:28:49 +0000 (13:28 +0000)]
tidy-up: mostly whitespace nits
- delete completed TODO from `./CMakeLists.txt`.
- convert a C++ comment to C89 in `./CMake/CurlTests.c`.
- delete duplicate EOLs from EOF.
- add missing EOL at EOF.
- delete whitespace at EOL (except from expected test results).
- convert tabs to spaces.
- convert CRLF EOLs to LF in GHA yaml.
- text casing fixes in `./CMakeLists.txt`.
- fix a codespell typo in `packages/OS400/initscript.sh`.
Dan Fandrich [Thu, 31 Aug 2023 06:47:30 +0000 (23:47 -0700)]
CI: remove Windows builds from Cirrus, without replacement
If we don't do this, all coverage on Cirrus will cease in a few days. By
removing the Windows builds, the FreeBSD one should still continue
as before. The Windows builds will need be moved to another service to
maintain test coverage.
Dan Fandrich [Thu, 31 Aug 2023 00:58:27 +0000 (17:58 -0700)]
CI: switch macOS ARM build from Cirrus to Circle CI
Cirrus is drastically reducing their free tier on Sept. 1, so they will
no longer perform all these builds for us. All but one build has been
moved, with the LibreSSL one being dropped because of linking problems
on Circle.
One important note about this change is that Circle CI is currently
directing all these builds to x86_64 hardware, despite them requesting
ARM. This is because ARM nodes are scheduled to be available on the
free tier only in December. This reduces our architectural diversity
until then but it should automatically come back once those machines are
enabled.
Dan Fandrich [Wed, 30 Aug 2023 20:47:11 +0000 (13:47 -0700)]
CI: drop the FreeBSD 12.X build
Cirrus' new free tier won't let us have many builds, so drop the
nonessential ones. The FreeBSD 13.X build will still give us the most
relevant FreeBSD coverage.
Stefan Eissing [Wed, 30 Aug 2023 09:18:17 +0000 (11:18 +0200)]
test_07_upload.py: fix test_07_34 curl args
- Pass correct filename to --data-binary.
Prior to this change --data-binary was passed an incorrect filename due
to a missing separator in the arguments list. Since aacbeae7 curl will
error on incorrect filenames for POST.
Patrick Monnerat [Sun, 30 Jul 2023 17:10:31 +0000 (19:10 +0200)]
tests: fix compilation error for os400
OS400 uses BSD 4.3 setsockopt() prototype by default: this does not
define parameter as const, resulting in an error if actual parameter is
const. Remove the const keyword from the actual parameter cast: this
works in all conditions, even if the formal parameter uses it.
Jay Satiro [Mon, 28 Aug 2023 07:09:18 +0000 (03:09 -0400)]
ftp: fix temp write of ipv6 address
- During the check to differentiate between a port and IPv6 address
without brackets, write the binary IPv6 address to an in6_addr.
Prior to this change the binary IPv6 address was erroneously written to
a sockaddr_in6 'sa6' when it should have been written to its in6_addr
member 'sin6_addr'. There's no fallout because no members of 'sa6' are
accessed before it is later overwritten.
Jay Satiro [Sun, 20 Aug 2023 07:08:15 +0000 (03:08 -0400)]
tool: change some fopen failures from warnings to errors
- Error on missing input file for --data, --data-binary,
--data-urlencode, --header, --variable, --write-out.
Prior to this change if a user of the curl tool specified an input file
for one of the above options and that file could not be opened then it
would be treated as zero length data instead of an error. For example, a
POST using `--data @filenametypo` would cause a zero length POST which
is probably not what the user intended.
Daniel Stenberg [Fri, 18 Aug 2023 11:41:16 +0000 (13:41 +0200)]
connect: stop halving the remaining timeout when less than 600 ms left
When curl wants to connect to a host, it always has a TIMEOUT. The
maximum time it is allowed to spend until a connect is confirmed.
curl will try to connect to each of the IP adresses returned for the
host. Two loops, one for each IP family.
During the connect loop, while curl has more than one IP address left to
try within a single address family, curl has traditionally allowed (time
left/2) for *this* connect attempt. This, to not get stuck on the
initial addresses in case the timeout but still allow later addresses to
get attempted.
This has the downside that when users set a very short timeout and the
host has a large number of IP addresses, the effective result might be
that every attempt gets a little too short time.
This change stop doing the divided-by-two if the total time left is
below a threshold. This threshold is 600 milliseconds.
Jay Satiro [Wed, 23 Aug 2023 06:49:47 +0000 (02:49 -0400)]
secureserver.pl: fix stunnel version parsing
- Allow the stunnel minor-version version part to be zero.
Prior to this change with the stunnel version scheme of <major>.<minor>
if either part was 0 then version parsing would fail, causing
secureserver.pl to fail with error "No stunnel", causing tests that use
the SSL protocol to be skipped. As a practical matter this bug can only
be caused by a minor-version part of 0, since the major-version part is
always greater than 0.
Jay Satiro [Wed, 23 Aug 2023 07:37:43 +0000 (03:37 -0400)]
secureserver.pl: fix stunnel path quoting
- Store the stunnel path in the private variable $stunnel unquoted and
instead quote it in the command strings.
Prior to this change the quoted stunnel path was passed to perl's file
operators which cannot handle quoted paths. For example:
$stunnel = "\"/C/Program Files (x86)/stunnel/bin/tstunnel\"";
if(-x $stunnel or -x "$stunnel")
# false even if path exists and is executable
Our other test scripts written in perl, unlike this one, use servers.pm
which has a global $stunnel variable with the path stored unquoted and
therefore those scripts don't have this problem.
Daniel Stenberg [Mon, 28 Aug 2023 06:29:15 +0000 (08:29 +0200)]
libtest: use curl_free() to free libcurl allocated data
In several test programs. These mistakes are not detected or a problem
as long as memdebug.h is included, as that provides the debug wrappers
for all memory functions in the same style libcurl internals do it,
which makes curl_free and free effectively the same call.
Jay Satiro [Tue, 22 Aug 2023 18:48:45 +0000 (14:48 -0400)]
disable.d: explain --disable not implemented prior to 7.50.0
Option -q/--disable was added in 5.0 but only -q was actually
implemented. Later --disable was implemented in e200034 (precedes
7.49.0), but incorrectly, and fixed in 6dbc23c (precedes 7.50.0).
Some of these changes come from comparing `Curl_http` and
`start_CONNECT`, which are similar, and adding things to them that are
present in one and missing in another.
The most important changes:
- In `start_CONNECT`, add a missing `hyper_clientconn_free` call on the
happy path.
- In `start_CONNECT`, add a missing `hyper_request_free` on the error
path.
- In `bodysend`, add a missing `hyper_body_free` on an early-exit path.
- In `bodysend`, remove an unnecessary `hyper_body_free` on a different
error path that would cause a double-free.
https://docs.rs/hyper/latest/hyper/ffi/fn.hyper_request_set_body.html
says of `hyper_request_set_body`: "This takes ownership of the
hyper_body *, you must not use it or free it after setting it on the
request." This is true even if `hyper_request_set_body` returns an
error; I confirmed this by looking at the hyper source code.
Other changes are minor but make things slightly nicer.