Daniel Stenberg [Thu, 16 Dec 2021 22:56:15 +0000 (23:56 +0100)]
BINDINGS.md: "markdown-link-check-disable"
It feels a bit unfortunate to litter an ugly tag for this functionality,
but if we get link scans of all markdown files, this might be worth the
price.
Jay Satiro [Wed, 15 Dec 2021 19:45:34 +0000 (14:45 -0500)]
openssl: define HAVE_OPENSSL_VERSION for OpenSSL 1.1.0+
Prior to this change OpenSSL_version was only detected in configure
builds. For other builds the old version parsing code was used which
would result in incorrect versioning for OpenSSL 3:
Dan Fandrich [Wed, 15 Dec 2021 08:11:53 +0000 (00:11 -0800)]
libcurl-security.3: mention address and URL mitigations
The new CURLOPT_PREREQFUNCTION callback is another way to sanitize
addresses.
Using the curl_url API is a way to mitigate against attacks relying on
URL parsing differences.
Patrick Monnerat [Tue, 14 Dec 2021 14:42:47 +0000 (15:42 +0100)]
openldap: several minor improvements
- Early check proper LDAP URL syntax. Reject URLs with a userinfo part.
- Use dynamic memory for ldap_init_fd() URL rather than a
stack-allocated buffer.
- Never chase referrals: supporting it would require additional parallel
connections and alternate authentication credentials.
- Do not wait 1 microsecond while polling/reading query response data.
- Store last received server code for retrieval with CURLINFO_RESPONSE_CODE.
Avoid CURL_FORMAT_CURL_OFF_T by using unsigned long instead.
Improve size_t to long conversion in imap-append.c example.
Ref: https://github.com/curl/curl/issues/6079
Ref: https://github.com/curl/curl/pull/6082 Assisted-by: Jay Satiro Reviewed-by: Daniel Stenberg
Preparation of #7922
Daniel Stenberg [Fri, 10 Dec 2021 11:46:16 +0000 (12:46 +0100)]
multi: cleanup the socket hash when destroying it
Since each socket hash entry may themselves have a hash table in them,
the destroying of the socket hash needs to make sure all the subhashes
are also correctly destroyed to avoid leaking memory.
Daniel Stenberg [Thu, 2 Dec 2021 12:57:38 +0000 (13:57 +0100)]
multi: handle errors returned from socket/timer callbacks
The callbacks were partially documented to support this. Now the
behavior is documented and returning error from either of these
callbacks will effectively kill all currently ongoing transfers.
Dan Fandrich [Wed, 1 Dec 2021 02:33:49 +0000 (18:33 -0800)]
docs: Update the Reducing Size section
Add many more options that can reduce the size of the binary that were
added since the last update. Update the sample minimal binary size for
version 7.80.0.
Daniel Stenberg [Fri, 19 Nov 2021 15:11:29 +0000 (16:11 +0100)]
tool_findfile: search for a file in the homedir
The homedir() function is now renamed into findfile() and iterates over
all the environment variables trying to access the file in question
until it finds it. Last resort is then getpwuid() if
available. Previously it would first try to find a home directory and if
that was set, insist on checking only that directory for the file. This
now returns the full file name it finds.
The Windows specific checks are now done differently too and in this
order:
1 - %USERPROFILE%
2 - %APPDATA%
3 - %USERPROFILE%\\Application Data
The windows order is modified to match how the Windows 10 ssh tool works
when it searches for .ssh/known_hosts.
Reported-by: jeffrson on github Co-authored-by: Jay Satiro
Fixes #8033
Closes #8035
Daniel Stenberg [Fri, 26 Nov 2021 13:20:18 +0000 (14:20 +0100)]
docs: consistent manpage SYNOPSIS
Make all libcurl related options use .nf (no fill) for the SYNOPSIS
section - for consistent look. roffit then renders that section using
<pre> (monospace font) in html for the website.
Extended manpage-syntax (test 1173) with a basic check for it.
Viktor Szakats [Thu, 25 Nov 2021 17:35:24 +0000 (17:35 +0000)]
Makefile.m32: rename -winssl option to -schannel and tidy up
- accept `-schannel` as an alternative to `CFG` option `-winssl`
(latter still accepted, but deprecated)
- rename internal variable `WINSSL` to `SCHANNEL`
- make the `CFG` option evaluation shorter, without repeating the option
name
Reviewed-by: Marcel Raad Reviewed-by: Daniel Stenberg
Closes #8053
Daniel Stenberg [Tue, 23 Nov 2021 16:07:31 +0000 (17:07 +0100)]
urlapi: provide more detailed return codes
Previously, the return code CURLUE_MALFORMED_INPUT was used for almost
30 different URL format violations. This made it hard for users to
understand why a particular URL was not acceptable. Since the API cannot
point out a specific position within the URL for the problem, this now
instead introduces a number of additional and more fine-grained error
codes to allow the API to return more exactly in what "part" or section
of the URL a problem was detected.
Also bug-fixes curl_url_get() with CURLUPART_ZONEID, which previously
returned CURLUE_OK even if no zoneid existed.
Test cases in 1560 have been adjusted and extended. Tests 1538 and 1559
have been updated.
Updated libcurl-errors.3 and curl_url_strerror() accordingly.
Daniel Stenberg [Tue, 23 Nov 2021 13:16:38 +0000 (14:16 +0100)]
urlapi: make Curl_is_absolute_url always use MAX_SCHEME_LEN
Instad of having all callers pass in the maximum length, always use
it. The passed in length is instead used only as the length of the
target buffer for to storing the scheme name in, if used.
Added the scheme max length restriction to the curl_url_set.3 man page.
Daniel Stenberg [Mon, 22 Nov 2021 17:09:43 +0000 (18:09 +0100)]
curl: improve error message for --head with -J
... it now focuses on the "output of headers" combined with the
--remote-header-name option, as that is actually the problem. Both
--head and --include can output headers.
Reported-by: nimaje on github
Fixes #7987
Closes #8045
The comment is incorrect in two ways:
- It says the check needs to be last, but the check is actually first.
- is_handshaking actually starts out true.
projects / thirdparty / curl.git / log
