]> git.ipfire.org Git - thirdparty/curl.git/log
thirdparty/curl.git
3 years agoprojects: fix third-party SSL library build paths for Visual Studio
Steve Holme [Thu, 9 Jun 2022 00:18:14 +0000 (17:18 -0700)] 
projects: fix third-party SSL library build paths for Visual Studio

The paths used by the build batch files were inconsistent with those in
the Visual Studio project files.

Closes #8991

3 years agourlapi: make curl_url_set(url, CURLUPART_URL, NULL, 0) clear all parts
Pierrick Charron [Sun, 19 Jun 2022 14:54:04 +0000 (10:54 -0400)] 
urlapi: make curl_url_set(url, CURLUPART_URL, NULL, 0) clear all parts

As per the documentation :

> Setting a part to a NULL pointer will effectively remove that
> part's contents from the CURLU handle.

But currently clearing CURLUPART_URL does nothing and returns
CURLUE_OK. This change will clear all parts of the URL at once.

Closes #9028

3 years agoCI: bump FreeBSD 13.0 to 13.1
Philip H [Thu, 26 May 2022 15:34:02 +0000 (17:34 +0200)] 
CI: bump FreeBSD 13.0 to 13.1

Signed-off-by: Philip H <47042125+pheiduck@users.noreply.github.com>
Closes #8815

3 years agoRELEASE-NOTES: synced
Daniel Stenberg [Sat, 18 Jun 2022 10:21:48 +0000 (12:21 +0200)] 
RELEASE-NOTES: synced

and updated release date in RELEASE-PROCEDURE.md

3 years agoCURLOPT_HTTPHEADER.3: improve comment in example
divinity76 [Fri, 17 Jun 2022 13:07:36 +0000 (15:07 +0200)] 
CURLOPT_HTTPHEADER.3: improve comment in example

Closes #9025

3 years agoCI/azure: reduce flakiness by retrying install/prepare steps
Marc Hoersken [Tue, 14 Jun 2022 19:33:35 +0000 (21:33 +0200)] 
CI/azure: reduce flakiness by retrying install/prepare steps

Closes #9010

3 years agoCI/cirrus: align Windows timeout with Azure CI at 120 minutes
Marc Hoersken [Tue, 14 Jun 2022 19:14:12 +0000 (21:14 +0200)] 
CI/cirrus: align Windows timeout with Azure CI at 120 minutes

Closes #9009

3 years agovtls: make curl_global_sslset thread-safe
Jay Satiro [Wed, 15 Jun 2022 06:20:49 +0000 (02:20 -0400)] 
vtls: make curl_global_sslset thread-safe

.. and update some docs to explain curl_global_* is now thread-safe.

Follow-up to 23af112 which made curl_global_init/cleanup thread-safe.

Closes https://github.com/curl/curl/pull/9016

3 years agocurl_easy_pause.3: remove explanation of progress function
Jay Satiro [Wed, 15 Jun 2022 05:20:27 +0000 (01:20 -0400)] 
curl_easy_pause.3: remove explanation of progress function

- Remove misleading text that says progress function "gets called at
  least once per second, even if the connection is paused."

The progress function behavior is more nuanced and the user is better
served reading the progress function doc rather than attempt to explain
it in the curl_easy_pause doc.

The progress function can only be called at least once per second if an
appropriate multi transfer function is called (eg curl_multi_perform) in
that time. For a paused transfer there may not be such a call. Rather
than explain this in detail in the curl_easy_pause doc, rely on the user
reading the CURLOPT_PROGRESSFUNCTION doc.

Ref: https://github.com/curl/curl/issues/8983

Closes https://github.com/curl/curl/pull/9015

3 years agolibssh: skip the fake-close when libssh does the right thing
Daniel Stenberg [Wed, 15 Jun 2022 21:43:33 +0000 (23:43 +0200)] 
libssh: skip the fake-close when libssh does the right thing

Starting in libssh 0.10.0 ssh_disconnect() will no longer close our
socket. Instead it will be kept alive as we want it, and it is our
responsibility to close it later.

Ref: #8718
Ref: https://gitlab.com/libssh/libssh-mirror/-/merge_requests/240
Closes #9021

3 years agoconfigure: warn about rustls being experimental
Daniel Stenberg [Wed, 15 Jun 2022 21:33:00 +0000 (23:33 +0200)] 
configure: warn about rustls being experimental

Right now a dozen test cases are disabled because they don't work with
rustls.

Closes #9019

3 years agoruntests: skip starting the ssh server if user name is lacking
Daniel Stenberg [Tue, 14 Jun 2022 21:58:26 +0000 (23:58 +0200)] 
runtests: skip starting the ssh server if user name is lacking

Because the ssh server startup script *requires* a user name there's no
point in invoking it if no name was found.

Reported-by: Ricardo M. Correia
Ref: #9007
Closes #9013

3 years agocopyright.pl: parse and use .reuse/dep5 for skips
Daniel Stenberg [Tue, 14 Jun 2022 08:22:57 +0000 (10:22 +0200)] 
copyright.pl: parse and use .reuse/dep5 for skips

Also scan skipped files to be able to find superfluous ignores, shown with -v.

Closes #9006

3 years agoreuse/dep5: adjusted to parse better
Daniel Stenberg [Tue, 14 Jun 2022 08:22:56 +0000 (10:22 +0200)] 
reuse/dep5: adjusted to parse better

... adjusted a few files to contain copyright and license info.

Closes #9006

3 years agobuildconf.bat: update copyright year range
Daniel Stenberg [Tue, 14 Jun 2022 08:22:56 +0000 (10:22 +0200)] 
buildconf.bat: update copyright year range

Closes #9006

3 years agoREADME.md: use the common "Copyright" style formatting
Daniel Stenberg [Tue, 14 Jun 2022 08:22:56 +0000 (10:22 +0200)] 
README.md: use the common "Copyright" style formatting

Closes #9006

3 years agoreuse: move license info from .mailmap.license to .reuse/dep5
Daniel Stenberg [Tue, 14 Jun 2022 08:22:56 +0000 (10:22 +0200)] 
reuse: move license info from .mailmap.license to .reuse/dep5

Closes #9006

3 years agoREADME.md: add a REUSE badge
Daniel Stenberg [Tue, 14 Jun 2022 06:29:31 +0000 (08:29 +0200)] 
README.md: add a REUSE badge

Closes #9004

3 years ago.reuse/dep5: remove recursive docs ignore, only skip markdown files
Daniel Stenberg [Tue, 14 Jun 2022 06:58:20 +0000 (08:58 +0200)] 
.reuse/dep5: remove recursive docs ignore, only skip markdown files

... and some additional non-markdown individual files in docs/

Closes #9005

3 years agodocs/cmdline-opts: add copyright and license identifier to each file
Daniel Stenberg [Mon, 13 Jun 2022 22:12:03 +0000 (00:12 +0200)] 
docs/cmdline-opts: add copyright and license identifier to each file

gen.pl now insists on C: and SPDX-License-Identifier: fields to be
present in all files.

Closes #9002

3 years agocopyright: info for/ignore .github/ISSUE_TEMPLATE/bug_report.md
Daniel Stenberg [Mon, 13 Jun 2022 21:50:45 +0000 (23:50 +0200)] 
copyright: info for/ignore .github/ISSUE_TEMPLATE/bug_report.md

Follow-up from 448f7ef9ab2afb7. The adding of the copyright text in that
file broke site functionality.

Closes #9001

3 years agobug_report.md: revert the REUSE template to see if it works again
Daniel Stenberg [Mon, 13 Jun 2022 21:41:07 +0000 (23:41 +0200)] 
bug_report.md: revert the REUSE template to see if it works again

3 years agoversion: rename threadsafe-init to threadsafe
Viktor Szakats [Mon, 13 Jun 2022 18:59:45 +0000 (18:59 +0000)] 
version: rename threadsafe-init to threadsafe

Referring to Daniel's article [1], making the init function thread-safe
was the last bit to make libcurl thread-safe as a whole. So the name of
the feature may as well be the more concise 'threadsafe', also telling
the story that libcurl is now fully thread-safe, not just its init
function. Chances are high that libcurl wants to remain so in the
future, so there is little likelihood of ever needing any other distinct
`threadsafe-<name>` feature flags.

For consistency we also shorten `CURL_VERSION_THREADSAFE_INIT` to
`CURL_VERSION_THREADSAFE`, update its description and reference libcurl's
thread safety documentation.

[1]: https://daniel.haxx.se/blog/2022/06/08/making-libcurl-init-more-thread-safe/

Reviewed-by: Daniel Stenberg
Reviewed-by: Jay Satiro
Closes #8989

3 years agotest3026: disable on win32
Daniel Stenberg [Mon, 13 Jun 2022 06:04:18 +0000 (08:04 +0200)] 
test3026: disable on win32

... as it's not likely to have working pthreads

Closes #8996

3 years agoGHA: shorten the reuse CI job name
Daniel Stenberg [Mon, 13 Jun 2022 08:03:04 +0000 (10:03 +0200)] 
GHA: shorten the reuse CI job name

"REUSE compliance / check" should be good enough

Closes #9000

3 years agomisc: add missing SPDX-License-Identifier info
Daniel Stenberg [Mon, 13 Jun 2022 07:51:49 +0000 (09:51 +0200)] 
misc: add missing SPDX-License-Identifier info

For some reason the REUSE CI job did not find these.

Closes #8999

3 years agocopyright: verify SPDX-License-Identifier presence as well
Daniel Stenberg [Mon, 13 Jun 2022 07:51:32 +0000 (09:51 +0200)] 
copyright: verify SPDX-License-Identifier presence as well

3 years agoeasy_lock: add SPDX license identifier
Daniel Stenberg [Mon, 13 Jun 2022 07:33:44 +0000 (09:33 +0200)] 
easy_lock: add SPDX license identifier

Closes #8998

3 years agomailmap: Max Mehl
Daniel Stenberg [Mon, 13 Jun 2022 07:12:41 +0000 (09:12 +0200)] 
mailmap: Max Mehl

3 years agogit: ignore large commit making the curl REUSE compliant
max.mehl [Thu, 2 Jun 2022 14:05:04 +0000 (16:05 +0200)] 
git: ignore large commit making the curl REUSE compliant

3 years agocopyright: make repository REUSE compliant
max.mehl [Tue, 17 May 2022 09:16:50 +0000 (11:16 +0200)] 
copyright: make repository REUSE compliant

Add licensing and copyright information for all files in this repository. This
either happens in the file itself as a comment header or in the file
`.reuse/dep5`.

This commit also adds a Github workflow to check pull requests and adapts
copyright.pl to the changes.

Closes #8869

3 years agocurl_url_set.3: clarify by default using known schemes only
Daniel Stenberg [Sun, 12 Jun 2022 10:53:54 +0000 (12:53 +0200)] 
curl_url_set.3: clarify by default using known schemes only

Closes #8994

3 years agoscripts/copyright.pl: ignore leading spaces
Daniel Stenberg [Sun, 12 Jun 2022 10:37:03 +0000 (12:37 +0200)] 
scripts/copyright.pl: ignore leading spaces

3 years agongtcp2: fix typo in preprocessor condition
Viktor Szakats [Fri, 10 Jun 2022 23:07:15 +0000 (23:07 +0000)] 
ngtcp2: fix typo in preprocessor condition

Ref: 927ede7edcb7b05b8e8bbf9ced6aed523ae594a7

Bug: https://github.com/curl/curl/pull/8981#discussion_r894312185
Reported-by: Emil Engler
Closes #8987

3 years agoRELEASE-NOTES: synced
Daniel Stenberg [Fri, 10 Jun 2022 07:18:39 +0000 (09:18 +0200)] 
RELEASE-NOTES: synced

3 years agongtcp2: build without sendmsg
Tatsuhiro Tsujikawa [Fri, 10 Jun 2022 07:09:39 +0000 (09:09 +0200)] 
ngtcp2: build without sendmsg

Closes #8981

3 years agongtcp2: use handshake helper funcs to simplify TLS handshake integration
Tatsuhiro Tsujikawa [Sun, 5 Jun 2022 01:10:51 +0000 (10:10 +0900)] 
ngtcp2: use handshake helper funcs to simplify TLS handshake integration

Closes #8968

3 years agotest390: verify --parallel
Daniel Stenberg [Fri, 10 Jun 2022 07:05:24 +0000 (09:05 +0200)] 
test390: verify --parallel

Closes #8985

3 years agotest1543: verify CURLINFO_EFFECTIVE_URL with CURLOPT_CURLU set
Daniel Stenberg [Wed, 8 Jun 2022 14:32:46 +0000 (16:32 +0200)] 
test1543: verify CURLINFO_EFFECTIVE_URL with CURLOPT_CURLU set

Triggered by a bug report from Adam Light:
https://curl.se/mail/lib-2022-06/0013.html - which ended up being mostly
a misunderstanding of how CURLINFO_EFFECTIVE_URL works.

Closes #8971

3 years agourl: URL encode the path when extracted, if spaces were set
Daniel Stenberg [Wed, 8 Jun 2022 14:32:46 +0000 (16:32 +0200)] 
url: URL encode the path when extracted, if spaces were set

3 years agourlapi: support CURLU_URLENCODE for curl_url_get()
Daniel Stenberg [Wed, 8 Jun 2022 14:32:46 +0000 (16:32 +0200)] 
urlapi: support CURLU_URLENCODE for curl_url_get()

3 years agoserver/sws: support spaces in the HTTP request path
Daniel Stenberg [Wed, 8 Jun 2022 14:32:46 +0000 (16:32 +0200)] 
server/sws: support spaces in the HTTP request path

3 years agotests/getpart: fix getpartattr to work with "data" and "data2"
Daniel Stenberg [Wed, 8 Jun 2022 14:32:46 +0000 (16:32 +0200)] 
tests/getpart: fix getpartattr to work with "data" and "data2"

3 years agoselect: return error from "lethal" poll/select errors
Daniel Stenberg [Wed, 8 Jun 2022 09:03:07 +0000 (11:03 +0200)] 
select: return error from "lethal" poll/select errors

Adds two new error codes: CURLE_UNRECOVERABLE_POLL and
CURLM_UNRECOVERABLE_POLL one each for the easy and the multi interfaces.

Reported-by: Harry Sintonen
Fixes #8921
Closes #8961

3 years agotest3026: add missing control file
Daniel Stenberg [Wed, 8 Jun 2022 08:59:11 +0000 (10:59 +0200)] 
test3026: add missing control file

Follow-up from 2ed101256414ea5

Makes the test run, makes 'make dist' work

This single test takes 24-25 seconds on my machine (with valgrind). For
this reason I tag it with a "slow" keyword.

Closes #8976

3 years agoruntests: fix skipping tests not done event-based
Daniel Stenberg [Wed, 8 Jun 2022 08:24:35 +0000 (10:24 +0200)] 
runtests: fix skipping tests not done event-based

... and call timestampskippedevents() to avoid the flood of
uninitialized variable warnings.

Closes #8977

3 years agotransfer: maintain --path-as-is after redirects
Daniel Stenberg [Tue, 7 Jun 2022 21:28:07 +0000 (23:28 +0200)] 
transfer: maintain --path-as-is after redirects

Reported-by: Marcus T
Fixes #8974
Closes #8975

3 years agotest391: verify --path-as-is with redirect
Daniel Stenberg [Tue, 7 Jun 2022 21:26:59 +0000 (23:26 +0200)] 
test391: verify --path-as-is with redirect

3 years agocurl_global_init.3: Separate the Windows loader lock warning
Jay Satiro [Wed, 8 Jun 2022 07:02:51 +0000 (03:02 -0400)] 
curl_global_init.3: Separate the Windows loader lock warning

This is a slight correction of the parent commit which implied the
loader lock warning only applied if not thread-safe. In fact the loader
lock warning applies either way.

Ref: https://github.com/curl/curl/pull/8972#discussion_r891987030

3 years agocurl_global_init.3: this is now (usually) thread-safe
Daniel Stenberg [Tue, 7 Jun 2022 15:12:52 +0000 (17:12 +0200)] 
curl_global_init.3: this is now (usually) thread-safe

Follow-up to 23af112f5556

Closes #8972

3 years agolibcurl-security.3: Document CRLF header injection
Haxatron [Mon, 6 Jun 2022 04:22:09 +0000 (12:22 +0800)] 
libcurl-security.3: Document CRLF header injection

- Document that user input to header options is not sanitized, which
  could result in CRLF used to modify the request in a way other than
  what was intended.

Ref: https://hackerone.com/reports/1589877
Ref: https://medium.com/@tomnomnom/crlf-injection-into-phps-curl-options-e2e0d7cfe545

Closes https://github.com/curl/curl/pull/8964

3 years agoCURLOPT_RANGE.3: remove ranged upload advice
Jay Satiro [Tue, 7 Jun 2022 07:50:11 +0000 (03:50 -0400)] 
CURLOPT_RANGE.3: remove ranged upload advice

The e-mail link in the advice contains instructions that are prone to
error. We need an example that works and can demonstrate how to properly
perform a ranged upload, and then we can refer to that example instead.

Bug: https://github.com/curl/curl/issues/8969
Reported-by: Simon Berger
Closes https://github.com/curl/curl/pull/8970

3 years agocurl_version_info: add CURL_VERSION_THREADSAFE_INIT
Thomas Guillem [Tue, 5 Apr 2022 14:00:37 +0000 (16:00 +0200)] 
curl_version_info: add CURL_VERSION_THREADSAFE_INIT

This flag can be used to make sure that curl_global_init() is
thread-safe.

This can be useful for libraries that can't control what other
dependencies are doing with Curl.

Closes #8680

3 years agolib: make curl_global_init() threadsafe when possible
Thomas Guillem [Tue, 5 Apr 2022 13:46:03 +0000 (15:46 +0200)] 
lib: make curl_global_init() threadsafe when possible

Use a posix pthread or a Windows SRWLOCK to lock curl_global_init*() and
curl_global_cleanup().

Closes #8680

3 years agoRELEASE-NOTES: synced
Daniel Stenberg [Mon, 6 Jun 2022 10:29:51 +0000 (12:29 +0200)] 
RELEASE-NOTES: synced

3 years agotest414: add the '--resolve' keyword
Fabian Keil [Sat, 21 May 2022 12:42:42 +0000 (14:42 +0200)] 
test414: add the '--resolve' keyword

... so the test can be automatically skipped when
using an external proxy like Privoxy.

Closes #8959

3 years agotest{440,441,493,977}: add "HTTP proxy" keywords
Fabian Keil [Mon, 13 Dec 2021 11:39:51 +0000 (12:39 +0100)] 
test{440,441,493,977}: add "HTTP proxy" keywords

... so the tests can be automatically skipped when
using an external proxy like Privoxy.

Closes #8959

3 years agoruntests.pl: add the --repeat parameter to the --help output
Fabian Keil [Wed, 31 Mar 2021 10:03:00 +0000 (12:03 +0200)] 
runtests.pl: add the --repeat parameter to the --help output

Closes #8959

3 years agotest 2081: add a valid reply for the second request
Fabian Keil [Tue, 30 Mar 2021 12:22:11 +0000 (14:22 +0200)] 
test 2081: add a valid reply for the second request

... so the test works when using a HTTP proxy like
Privoxy that sends an error message if the server
doesn't send data.

Closes #8959

3 years agotest 675: add missing CR so the test passes when run through Privoxy
Fabian Keil [Mon, 22 Feb 2021 09:25:44 +0000 (10:25 +0100)] 
test 675: add missing CR so the test passes when run through Privoxy

Closes #8959

3 years agoftp: when failing to do a secure GSSAPI login, fail hard
Daniel Stenberg [Sun, 5 Jun 2022 20:23:46 +0000 (22:23 +0200)] 
ftp: when failing to do a secure GSSAPI login, fail hard

... instead of switching to cleartext. For the sake of security.

Reported-by: Harry Sintonen
Bug: https://hackerone.com/reports/1590102
Closes #8963

3 years agohttp2: reject overly many push-promise headers
Daniel Stenberg [Sun, 5 Jun 2022 09:41:49 +0000 (11:41 +0200)] 
http2: reject overly many push-promise headers

Getting more than a thousand of them is rather a sign of some kind of
attack.

Reported-by: Harry Sintonen
Bug: https://hackerone.com/reports/1589847
Closes #8962

3 years agomisc: spelling improvements
Fabian Keil [Sat, 27 Mar 2021 04:03:00 +0000 (05:03 +0100)] 
misc: spelling improvements

Closes #8956

3 years agongtcp2: fix assertion failure on EMSGSIZE
Tatsuhiro Tsujikawa [Sun, 5 Jun 2022 01:12:36 +0000 (10:12 +0900)] 
ngtcp2: fix assertion failure on EMSGSIZE

Closes #8958

3 years agoeasy/transfer: fix cookie-disabled build
Daniel Stenberg [Thu, 2 Jun 2022 13:45:27 +0000 (15:45 +0200)] 
easy/transfer: fix cookie-disabled build

Follow-up from 45de940cebf6a
Reported-by: Marcel Raad
Fixes #8953
Closes #8954

3 years agoexamples/crawler.c: use the curl license
Daniel Stenberg [Thu, 2 Jun 2022 12:09:30 +0000 (14:09 +0200)] 
examples/crawler.c: use the curl license

With permission from Jeroen Ooms

URL: https://github.com/curl/curl/pull/8869#issuecomment-1144742731
Closes #8950

3 years agospeed-limit/time.d: mention these affect transfers in either direction
Daniel Stenberg [Thu, 2 Jun 2022 12:14:42 +0000 (14:14 +0200)] 
speed-limit/time.d: mention these affect transfers in either direction

Reported-by: Ladar Levison
Fixes #8948
Closes #8951

3 years agoscripts/copyright.pl: fix the exclusion to not ignore man pages
Daniel Stenberg [Thu, 2 Jun 2022 12:20:53 +0000 (14:20 +0200)] 
scripts/copyright.pl: fix the exclusion to not ignore man pages

Ref: #8869
Closes #8952

3 years agoexamples: remove fopen.c and rtsp.c
Daniel Stenberg [Thu, 2 Jun 2022 08:46:07 +0000 (10:46 +0200)] 
examples: remove fopen.c and rtsp.c

To simplify the license situation, as they were the only files in the
source tree using these specific BSD-3 clause licenses.

For an fopen style API, we recommend instead going
https://github.com/curl/fcurl

Ref: #8869
Closes #8949

3 years agonetrc: check %USERPROFILE% as well on Windows
Wolf Vollprecht [Thu, 2 Jun 2022 07:30:52 +0000 (09:30 +0200)] 
netrc: check %USERPROFILE% as well on Windows

Closes #8855

3 years agoCURLOPT_SSH_HOSTKEYDATA/FUNCTION.3: minor polish
Daniel Stenberg [Thu, 2 Jun 2022 07:30:52 +0000 (09:30 +0200)] 
CURLOPT_SSH_HOSTKEYDATA/FUNCTION.3: minor polish

3 years agolibssh2: add CURLOPT_SSH_HOSTKEYFUNCTION
michael musset [Thu, 4 Nov 2021 14:55:47 +0000 (15:55 +0100)] 
libssh2: add CURLOPT_SSH_HOSTKEYFUNCTION

The callback set by CURLOPT_SSH_HOSTKEYFUNCTION is called to check
wether or not the connection should continue.

The host key is passed in argument with a custom handle for the
application.

It overrides CURLOPT_SSH_KNOWNHOSTS

Closes #7959

3 years agodocs/CONTRIBUTE.md: document the 'needs-votes' concept
Daniel Stenberg [Tue, 24 May 2022 21:40:50 +0000 (23:40 +0200)] 
docs/CONTRIBUTE.md: document the 'needs-votes' concept

A pull request sent to the project might get labeled `needs-votes` by a
project maintainer. This label means that in addition to meeting all
other checks and qualifications this pull request must also receive
proven support/thumbs-ups from more community members to be considered
for merging.

Closes #8910

3 years agodigest: tolerate missing "realm"
Evgeny Grin [Wed, 25 May 2022 15:51:19 +0000 (18:51 +0300)] 
digest: tolerate missing "realm"

Server headers may not define "realm", avoid NULL pointer dereference
in such cases.

Closes #8912

3 years agodigest: added detection of more syntax error in server headers
Evgeny Grin [Wed, 25 May 2022 07:35:19 +0000 (10:35 +0300)] 
digest: added detection of more syntax error in server headers

Invalid headers should not be processed otherwise they may create
a security risk.

Closes #8912

3 years agodigest: unquote realm and nonce before processing
Evgeny Grin [Wed, 25 May 2022 07:20:18 +0000 (10:20 +0300)] 
digest: unquote realm and nonce before processing

RFC 7616 (and 2617) requires values to be "unquoted" before used for
digest calculations. The only place where unquoting can be done
correctly is header parsing function (realm="DOMAIN\\host" and
realm=DOMAN\\host are different realms).

This commit adds unquoting (de-escaping) of all values during header
parsing and quoting of the values during header forming. This approach
should be most straightforward and easy to read/maintain as all values
are processed in the same way as required by RFC.

Closes #8912

3 years agoheaders: handle unfold of space-cleansed headers
Daniel Stenberg [Wed, 1 Jun 2022 12:04:17 +0000 (14:04 +0200)] 
headers: handle unfold of space-cleansed headers

Detected by OSS-fuzz

Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47767

Updated test 1274

Closes #8947

3 years agolib: make more protocol specific struct fields #ifdefed
Daniel Stenberg [Wed, 1 Jun 2022 12:30:55 +0000 (14:30 +0200)] 
lib: make more protocol specific struct fields #ifdefed

... so that they don't take up space if the protocols are disabled in
the build.

Closes #8944

3 years agoDISABLED: disable 1021 for hyper again
Daniel Stenberg [Wed, 1 Jun 2022 07:43:48 +0000 (09:43 +0200)] 
DISABLED: disable 1021 for hyper again

due to flakiness in the CI builds

3 years agourldata: store tcp_keepidle and tcp_keepintvl as ints
Daniel Stenberg [Tue, 31 May 2022 11:42:35 +0000 (13:42 +0200)] 
urldata: store tcp_keepidle and tcp_keepintvl as ints

They can't be set larger than INT_MAX in the setsocket API calls.

Also document the max values in their respective man pages.

Closes #8940

3 years agourldata: reduce size of a few struct fields
Daniel Stenberg [Tue, 31 May 2022 11:42:31 +0000 (13:42 +0200)] 
urldata: reduce size of a few struct fields

When the values are never larger than 32 bit, ints are better than longs.

Closes #8940

3 years agourldata: remove three unused booleans from struct UserDefined
Daniel Stenberg [Tue, 31 May 2022 11:42:23 +0000 (13:42 +0200)] 
urldata: remove three unused booleans from struct UserDefined

- is_fwrite_set
- free_referer
- strip_path_slash

Closes #8940

3 years agoremote-name.d: mention --output-dir
Daniel Stenberg [Tue, 31 May 2022 22:33:17 +0000 (00:33 +0200)] 
remote-name.d: mention --output-dir

plus add two see-alsos

Closes #8945

3 years agoconfigure: skip libidn2 detection when winidn is used
Jay Satiro [Sun, 29 May 2022 07:20:39 +0000 (03:20 -0400)] 
configure: skip libidn2 detection when winidn is used

Prior to this change --with-winidn could be overridden by libidn2
detection.

Closes https://github.com/curl/curl/pull/8934

3 years agoCURLOPT_FILETIME.3: fix the protocols this works with
Daniel Stenberg [Tue, 31 May 2022 15:40:47 +0000 (17:40 +0200)] 
CURLOPT_FILETIME.3: fix the protocols this works with

3 years agotest681: verify --no-remote-name
Daniel Stenberg [Tue, 31 May 2022 11:24:02 +0000 (13:24 +0200)] 
test681: verify --no-remote-name

Follow-up to 83ee5c428d960 (from #8931)

Closes #8942

3 years agongtcp2: enable Linux GSO
Tatsuhiro Tsujikawa [Mon, 23 May 2022 11:03:05 +0000 (20:03 +0900)] 
ngtcp2: enable Linux GSO

Enable Linux GSO in ngtcp2 QUIC.  In order to recover from the
EAGAIN/EWOULDBLOCK by sendmsg with multiple packets in one GSO write,
packet buffer is now held by struct quicsocket.  GSO write might fail in
runtime depending on NIC.  Disable GSO if sendmsg returns EIO.

Closes #8909

3 years agoCURLOPT_PORT.3: We discourage using this option
Daniel Stenberg [Tue, 31 May 2022 08:56:35 +0000 (10:56 +0200)] 
CURLOPT_PORT.3: We discourage using this option

Closes #8941

3 years agoRELEASE-NOTES: synced
Daniel Stenberg [Tue, 31 May 2022 12:59:23 +0000 (14:59 +0200)] 
RELEASE-NOTES: synced

3 years agoheaders_push: error out if a folded header has no previous header
Daniel Stenberg [Tue, 31 May 2022 12:03:09 +0000 (14:03 +0200)] 
headers_push: error out if a folded header has no previous header

As that would indicate an illegal header. The fuzzer reached the assert
in unfold_value() proving that this case can happen.

Follow-up to c9b60f005358a364

Closes #8939

3 years agocurl: re-enable --no-remote-name
Boris Verkhovskiy [Tue, 31 May 2022 11:22:38 +0000 (13:22 +0200)] 
curl: re-enable --no-remote-name

Closes #8931

3 years agotest680: require 'http' since it uses such a URL
Daniel Stenberg [Tue, 31 May 2022 11:14:02 +0000 (13:14 +0200)] 
test680: require 'http' since it uses such a URL

Follow-up to d1b376c03524

3 years agoCURLOPT_NETRC.3: document the .netrc file format
Daniel Stenberg [Tue, 31 May 2022 07:05:01 +0000 (09:05 +0200)] 
CURLOPT_NETRC.3: document the .netrc file format

3 years agotest680: verify rejection of malformatted .netrc quoted password
Daniel Stenberg [Tue, 31 May 2022 07:05:01 +0000 (09:05 +0200)] 
test680: verify rejection of malformatted .netrc quoted password

3 years agotest679: verify netrc quoted string
Daniel Stenberg [Tue, 31 May 2022 07:05:01 +0000 (09:05 +0200)] 
test679: verify netrc quoted string

3 years agonetrc: support quoted strings
Daniel Stenberg [Tue, 31 May 2022 07:04:56 +0000 (09:04 +0200)] 
netrc: support quoted strings

The .netrc parser now accepts strings within double-quotes in order to
deal with for example passwords containing white space - which
previously was not possible.

A password that starts with a double-quote also ends with one, and
double-quotes themselves are escaped with backslashes, like \". It also
supports \n, \r and \t for newline, carriage return and tabs
respectively.

If the password does not start with a double quote, it will end at first
white space and no escaping is performed.

WARNING: this change is not entirely backwards compatible. If anyone
previously used a double-quote as the first letter of their password,
the parser will now get it differently compared to before. This is
highly unfortunate but hard to avoid.

Reported-by: ImpatientHippo on GitHub
Fixes #8908
Closes #8937

3 years agocurl_getdate.3: document that some illegal dates pass through
Daniel Stenberg [Mon, 30 May 2022 22:29:17 +0000 (00:29 +0200)] 
curl_getdate.3: document that some illegal dates pass through

Closes #8938

3 years agoCI: remove configure --enable-headers-api flags
Daniel Stenberg [Mon, 30 May 2022 12:13:48 +0000 (14:13 +0200)] 
CI: remove configure --enable-headers-api flags

3 years agoheaders api: remove EXPERIMENTAL tag
Daniel Stenberg [Mon, 30 May 2022 12:13:48 +0000 (14:13 +0200)] 
headers api: remove EXPERIMENTAL tag

Closes #8900

3 years agocookies: fix documentation comment
Daniel Gustafsson [Mon, 30 May 2022 11:46:25 +0000 (13:46 +0200)] 
cookies: fix documentation comment

Commit 4073cd83b2 added the noexpire parameter to Curl_cookie_add but
missed updating the documentation comment at the head of the file.