Henrik Holst [Thu, 10 Feb 2022 17:47:08 +0000 (18:47 +0100)]
mprintf: remove strlen calls on empty strings in dprintf_formatf
Turns out that in dprintf_formatf we did a strlen on empty strings, a
bit strange is how common this actually is, 24 alone when doing a simple
GET from https://curl.se
Daniel Stenberg [Tue, 8 Feb 2022 13:47:17 +0000 (14:47 +0100)]
scripts/cijobs.pl: output data about all currect CI jobs
This script parses the config files for all the CI services currently in
use and output the information in a uniform way. The idea is that the
output from this script should be possible to massage into informational
tables or graphs to help us visualize what they are all testing and NOT
testing.
Daniel Stenberg [Mon, 7 Feb 2022 16:17:31 +0000 (17:17 +0100)]
configure: remove support for "embedded ares"
In March 2010 (commit 4259d2df7dd) we removed the embedded 'ares'
directory from the curl source tree but we have since supported
especially detecting and using that build directory. The time has come
to remove that kludge and ask users to specify the c-ares dir correctly
with --enable-ares.
Marcel Raad [Sun, 6 Feb 2022 11:26:29 +0000 (12:26 +0100)]
curl-openssl: fix SRP check for OpenSSL 3.0
When OpenSSL 3.0 is built with `--api=3.0` and `no-deprecated`, the SRP
functions exist in the library, but are disabled for user code. Check
if they are actually usable instead of only if they exist. Also, check
for the functions actually required for TLS-SRP.
TLS-SRP support is still enabled if OpenSSL is configured with just
`--api=3.0` or with `--api=1.1.1 no-deprecated`.
Daniel Stenberg [Sat, 5 Feb 2022 22:51:05 +0000 (23:51 +0100)]
http2: allow CURLOPT_HTTPHEADER change ":scheme"
The only h2 psuedo header that wasn't previously possible to change by a
user. This change also makes it impossible to send a HTTP/1 header that
starts with a colon, which I don't think anyone does anyway.
The other pseudo headers are possible to change indirectly by doing the
rightly crafted request.
Reported-by: siddharthchhabrap on github
Fixes #8381
Closes #8393
Daniel Stenberg [Fri, 4 Feb 2022 13:46:29 +0000 (14:46 +0100)]
tests/disable-scan.pl: properly detect multiple symbols per line
Test 1165 would fail on some systems because it didn't detect
CURL_DISABLE_* symbols that were used to the right of another one on the
same line! The script would only detect and extract the first one.
Jay Satiro [Thu, 3 Feb 2022 22:07:53 +0000 (17:07 -0500)]
config.d: Clarify _curlrc filename is still valid on Windows
Recent changes added support for filename .curlrc on Windows, and
when it's not found curl falls back on the original Windows filename
_curlrc. _curlrc was removed from the doc, however it is still valid.
Daniel Stenberg [Thu, 3 Feb 2022 09:42:02 +0000 (10:42 +0100)]
TPF: drop support
There has been no TPF related changes done since September 2010 (commit 7e1a45e224e57) and since this is a platform that is relatively different
than many others (== needs attention), I draw the conclusion that this
build is broken since a long time.
Leah Neukirchen [Mon, 31 Jan 2022 17:28:01 +0000 (18:28 +0100)]
scripts/completion.pl: improve zsh completion
- Detect all spellings of <file>, <file name> etc as well as <path>.
- Only complete directories for <dir>.
- Complete URLs for <URL>.
- Complete --request and --ftp-method.
Jay Satiro [Tue, 1 Feb 2022 22:44:26 +0000 (17:44 -0500)]
build: fix ngtcp2 crypto library detection
- Change library link check for ngtcp2_crypto_{gnutls,openssl} to
to use function ngtcp2_crypto_recv_client_initial_cb instead of
ngtcp2_crypto_ctx_initial.
The latter function is no longer external since two days ago in
ngtcp2/ngtcp2@533451f. curl HTTP/3 CI builds have been failing since
then because they would not link to the ngtcp2 crypto library.
multi: remember connection_id before returning connection to pool
Fix a bug that does not require a new CVE as discussed on hackerone.com.
Previously `connection_id` was accessed after returning connection to
the shared pool.
Daniel Stenberg [Fri, 28 Jan 2022 07:17:15 +0000 (08:17 +0100)]
nss: handshake callback during shutdown has no conn->bundle
The callback gets called because of the call to PR_Recv() done to
attempt to avoid RST on the TCP connection. The conn->bundle pointer is
already cleared at this point so avoid dereferencing it.
MAntoniak [Fri, 28 Jan 2022 12:45:30 +0000 (13:45 +0100)]
mbedtls: remove #include <mbedtls/certs.h>
mbedtls/certs.h file contains only certificates example (all definitions
is beginning by mbedtls_test_*). None of them is used so we can avoid
include the file.
Jay Satiro [Thu, 27 Jan 2022 08:32:37 +0000 (03:32 -0500)]
schannel: restore debug message in schannel_connect_step2
This is a follow-up to recent commit 2218c3a which removed the debug
message to avoid an unused variable warning. The message has been
reworked to avoid the warning.
Jay Satiro [Tue, 25 Jan 2022 03:53:29 +0000 (22:53 -0500)]
test3021: disable all msys2 path transformation
- Disable all MSYS2 path transformation in test3021 and test3022.
Prior to this change path transformation in those tests was disabled
only for arguments that start with forward slashes. However arguments
that are in base64 contain forward slashes at any position and caused
unwanted translations.
== Info: Denied establishing ssh session: mismatch sha256 fingerprint.
Remote +/EYG2YDzDGm6yiwepEMSuExgRRMoTi8Di1UN3kixZw= is not equal to
+C:/msys64/EYG2YDzDGm6yiwepEMSuExgRRMoTi8Di1UN3kixZw
In the above example an argument containing a base64 sha256 fingerprint
was passed to curl after MSYS2 translated +/ into +C:/msys64/, and then
the fingerprint didn't match what was expected.
Daniel Stenberg [Sat, 22 Jan 2022 15:56:00 +0000 (16:56 +0100)]
url: revert the removal of trailing dot from host name
Reverts 5de8d84098db1bd24e (May 2014, shipped in 7.37.0) and the
follow-up changes done afterward.
Keep the dot in names for everything except the SNI to make curl behave
more similar to current browsers. This means 'name' and 'name.' send the
same SNI for different 'Host:' headers.
Updated test 1322 accordingly
Fixes #8290 Reported-by: Charles Cazabon
Closes #8320
projects / thirdparty / curl.git / log
