Jay Satiro [Wed, 8 Jun 2022 07:02:51 +0000 (03:02 -0400)]
curl_global_init.3: Separate the Windows loader lock warning
This is a slight correction of the parent commit which implied the
loader lock warning only applied if not thread-safe. In fact the loader
lock warning applies either way.
- Document that user input to header options is not sanitized, which
could result in CRLF used to modify the request in a way other than
what was intended.
Jay Satiro [Tue, 7 Jun 2022 07:50:11 +0000 (03:50 -0400)]
CURLOPT_RANGE.3: remove ranged upload advice
The e-mail link in the advice contains instructions that are prone to
error. We need an example that works and can demonstrate how to properly
perform a ranged upload, and then we can refer to that example instead.
Bug: https://github.com/curl/curl/issues/8969 Reported-by: Simon Berger
Closes https://github.com/curl/curl/pull/8970
Daniel Stenberg [Tue, 24 May 2022 21:40:50 +0000 (23:40 +0200)]
docs/CONTRIBUTE.md: document the 'needs-votes' concept
A pull request sent to the project might get labeled `needs-votes` by a
project maintainer. This label means that in addition to meeting all
other checks and qualifications this pull request must also receive
proven support/thumbs-ups from more community members to be considered
for merging.
Evgeny Grin [Wed, 25 May 2022 07:20:18 +0000 (10:20 +0300)]
digest: unquote realm and nonce before processing
RFC 7616 (and 2617) requires values to be "unquoted" before used for
digest calculations. The only place where unquoting can be done
correctly is header parsing function (realm="DOMAIN\\host" and
realm=DOMAN\\host are different realms).
This commit adds unquoting (de-escaping) of all values during header
parsing and quoting of the values during header forming. This approach
should be most straightforward and easy to read/maintain as all values
are processed in the same way as required by RFC.
Enable Linux GSO in ngtcp2 QUIC. In order to recover from the
EAGAIN/EWOULDBLOCK by sendmsg with multiple packets in one GSO write,
packet buffer is now held by struct quicsocket. GSO write might fail in
runtime depending on NIC. Disable GSO if sendmsg returns EIO.
Daniel Stenberg [Tue, 31 May 2022 07:04:56 +0000 (09:04 +0200)]
netrc: support quoted strings
The .netrc parser now accepts strings within double-quotes in order to
deal with for example passwords containing white space - which
previously was not possible.
A password that starts with a double-quote also ends with one, and
double-quotes themselves are escaped with backslashes, like \". It also
supports \n, \r and \t for newline, carriage return and tabs
respectively.
If the password does not start with a double quote, it will end at first
white space and no escaping is performed.
WARNING: this change is not entirely backwards compatible. If anyone
previously used a double-quote as the first letter of their password,
the parser will now get it differently compared to before. This is
highly unfortunate but hard to avoid.
Reported-by: ImpatientHippo on GitHub
Fixes #8908
Closes #8937
tool_getparam: fix --parallel-max maximum value constraint
- Clamp --parallel-max to MAX_PARALLEL (300) instead of resetting to
default value.
Previously, --parallel-max 300 would use 300 concurrent transfers, but
--parallel-max 301 would unexpectedly use only 50. This change clamps
higher values to the maximum (ie --parallel-max 301 would use 300).
Viktor Szakats [Thu, 26 May 2022 15:54:20 +0000 (15:54 +0000)]
cmake: support adding a suffix to the OS value
CMake automatically uses the `CMAKE_SYSTEM_NAME` value to fill the OS
string appearing in the --version output after the curl version number,
for example:
'curl 7.83.1 (Windows)'
This patchs adds the ability to pass a suffix that is appended to this
value. It's useful to add CPU info or other platform details,
for example:
Viktor Szakats [Thu, 26 May 2022 15:53:19 +0000 (15:53 +0000)]
cmake: enable curl.rc for all Windows targets
Before this patch, it was only enabled for MSVC. This syncs this
configuration with libcurl.rc, which was already included with
every Windows compiler.
Viktor Szakats [Thu, 26 May 2022 15:52:57 +0000 (15:52 +0000)]
cmake: fix detecting libidn2
Without this patch, libidn2 detection doesn't even seem to be
attempted. With this patch, cmake can be configured to pick it
up and enable it. Necessary configuration remains manual and
differs from most other dependencies.
If you are aware of a better fix, we're glad hearing about it
in a new Issue.
Viktor Szakats [Wed, 25 May 2022 15:24:42 +0000 (15:24 +0000)]
version: allow stricmp() for sorting the feature list
In CMakeLists.txt there is an attempt to detect `stricmp()`, and in
certain cases, this attempt is the only successful one to detect a
case-insensitive comparison function. `HAVE_STRICMP` is defined as
a result, but this macro wasn't used anywhere in the source. This
patch makes use of it as an alternative when alpha-sorting the
`--version` feature list.
Marc Hoersken [Tue, 24 May 2022 10:25:39 +0000 (12:25 +0200)]
tests/data/test1501: kill ftp server after slow LIST response
This test is contributing to flakiness on the Windows CI runs.
Killing the ftp server after the test run like other slowness
tests already do may help resolve or reduce the flakiness.
- `-D_AMD64_` has not been necessary for mingw-w64 builds for a long time now.
- `-fno-strict-aliasing` is mentioned for Intel C compiler in autotools, and
I used this with VxWorks in another project, but otherwise this isn't
necessary anymore as a default. If a target still needs it, it can be
added with `CURL_CFLAG_EXTRAS=-fno-strict-aliasing`
- bump up default optimization level to `-O3` (from `-O2`), and also rearrange
option order so the default can now be overridden via
`CURL_CFLAG_EXTRAS`.
- delete `-g` (generate debug info) from `CFLAGS` and `-s` from `LDFLAGS`
(strip debug info). They were working against each other. Now, if someone
needs debug info, it can be enabled via `CURL_CFLAG_EXTRAS=-g`
Jay Satiro [Thu, 19 May 2022 07:40:52 +0000 (03:40 -0400)]
max-time.d: clarify max-time sets max transfer time
Prior to this change the doc said --max-time set the maximum time of the
'whole operation' which is not accurate. The option maps to
CURLOPT_TIMEOUT_MS which sets maximum transfer time.
For example, the maximum time on a transfer is reset if the transfer is
retried (--retry).
Commit 709ae2454f43 added a fake hostname to avoid leaking the local
hostname, but omitted copying it to the host buffer. Fix by copying
and adjust the test fallout.
Closes: #8895 Fixes: #8893 Reported-by: Patrick Monnerat <patrick@monnerat.net> Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Allow curl to send larger UDP datagram if Path MTU Discovery finds the
availability of larger path MTU. To make it work and not to send
fragmented packet, we need to set DF bit. That makes send(2) fail with
EMSGSIZE if UDP datagram is too large. In that case, just let it be
lost. This patch enables DF bit for Linux only.
Daniel Stenberg [Fri, 20 May 2022 14:23:21 +0000 (16:23 +0200)]
ntlm: provide a fixed fake host name
The NTLM protocol includes providing the local host name, but apparently
other implementations already provide a fixed fake name instead to avoid
leaking the real local name.
The exact name used is 'WORKSTATION', because Firefox uses that.
The change is written to allow someone to "back-pedal" fairly easy in
case of need.
Reported-by: Carlo Alberto
Fixes #8859
Closes #8889
yassl was added in commit 9d904ee41b880b but is no longer available
and is thus not a library to use for NTLM. This aligns the FEATURES
doc with the FAQ.
Closes: #8886 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
The empty left-behind footnote confused the website rendering into
creating a nested emoty list, making the resulting page look quite
odd. Remove and re-order the remaining ones to avoid a gap in the
sequence.
Closes: #8886 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
curl is a tool that support many different things, and it doesn't
really seem like our job to tell other what to use (as they might
not have much say in the matter even). Also tidy up wording.
Closes: #8886 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Viktor Szakats [Thu, 19 May 2022 16:47:00 +0000 (16:47 +0000)]
Makefile.m32: delete two obsolete OpenSSL options [ci skip]
- -DOPENSSL_NO_KRB5: No longer used by OpenSSL 1.1.x, 3.x, or
LibreSSL 3.5.x, yet it collides with the latter, which defines
it unconditionally, resulting in this warning:
../../libressl/include/openssl/opensslfeatures.h:14:9: warning: 'OPENSSL_NO_KRB5' macro redefined [-Wmacro-redefined]
It was originally added to curl in 2004.
- -DHAVE_OPENSSL_PKCS12_H: No longer used by OpenSSL 1.1.x, 3.x, or
LibreSSL back to at least 2.5.5. Originally added in the same
commit as the above, in 2004.
projects / thirdparty / curl.git / log
