1 _ _ ____ _ 2 ___| | | | _ \| | 3 / __| | | | |_) | | 4 | (__| |_| | _ <| |___ 5 \___|\___/|_| \_\_____| 6 7 Changelog 8 9Version 7.80.0 (10 Nov 2021) 10 11Daniel Stenberg (10 Nov 2021) 12- RELEASE-NOTES: synced 13 14 for curl 7.80.0 15 16- THANKS: add contributors from the 7.80.0 cycle 17 18- [Tatsuhiro Tsujikawa brought this change] 19 20 ngtcp2: advertise h3 as well as h3-29 21 22 Advertise h3 as well as h3-29 since some servers out there require h3 23 for QUIC v1. 24 25 Closes #7979 26 27- [Tatsuhiro Tsujikawa brought this change] 28 29 ngtcp2: use QUIC v1 consistently 30 31 Since we switched to v1 quic_transport_parameters codepoint in #7960 32 with quictls, lets use QUIC v1 consistently. 33 34 Closes #7979 35 36- [Tatsuhiro Tsujikawa brought this change] 37 38 ngtcp2: compile with the latest nghttp3 39 40 Closes #7978 41 42Marc Hoersken (9 Nov 2021) 43- tests: add Schannel-specific tests and disable unsupported ones 44 45 Adds Schannel variants of SSLpinning tests that include the option 46 --ssl-revoke-best-effort to ignore certificate revocation check 47 failures which is required due to our custom test CA certificate. 48 49 Disable the original variants if the Schannel backend is enabled. 50 51 Also skip all IDN tests which are broken while using an msys shell. 52 53 This is a step to simplify test exclusions for Windows and MinGW. 54 55 Reviewed-by: Jay Satiro 56 Reviewed-by: Marcel Raad 57 Reviewed-by: Daniel Stenberg 58 Closes #7968 59 60Daniel Stenberg (8 Nov 2021) 61- docs: NAME fixes in easy option man pages 62 63 Closes #7975 64 65- [Roger Young brought this change] 66 67 ftp: make the MKD retry to retry once per directory 68 69 Reported-by: Roger Young 70 Fixes #7967 71 Closes #7976 72 73- tool_operate: reorder code to avoid compiler warning 74 75 tool_operate.c(889) : warning C4701: potentially uninitialized local 76 variable 'per' use 77 78 Follow-up to cc71d352651a0d95 79 Reported-by: Marc Hörsken 80 Bug: https://github.com/curl/curl/pull/7922#issuecomment-963042676 81 Closes #7971 82 83- curl_easy_perform.3: add a para about recv and send data 84 85 Reported-by: Godwin Stewart 86 Fixes #7973 87 Closes #7974 88 89- tool_operate: fclose stream only if fopened 90 91 Fixes torture test failures 92 Follow-up to cc71d352651 93 94 Closes #7972 95 96- libcurl-easy.3: language polish 97 98- limit-rate.d: this is average over several seconds 99 100 Closes #7970 101 102- docs: reduce/avoid English contractions 103 104 You're => You are 105 Hasn't => Has not 106 Doesn't => Does not 107 Don't => Do not 108 You'll => You will 109 etc 110 111 Closes #7930 112 113- tool_operate: fix torture leaks with etags 114 115 Spotted by torture testing 343 344 345 347. 116 117 Follow-up from cc71d352651a0 118 Pointed-out-by: Dan Fandrich 119 120 Closes #7969 121 122- [Amaury Denoyelle brought this change] 123 124 ngtcp2: support latest QUIC TLS RFC9001 125 126 QUIC Transport Parameters Extension has been changed between draft-29 127 and latest RFC9001. Most notably, its identifier has been updated from 128 0xffa5 to 0x0039. The version is selected through the QUIC TLS library 129 via the legacy codepoint. 130 131 Disable the usage of legacy codepoint in curl to switch to latest 132 RFC9001. This is required to be able to keep up with latest QUIC 133 implementations. 134 135 Acked-by: Tatsuhiro Tsujikawa 136 Closes #7960 137 138- test1173: make manpage-syntax.pl spot \n errors in examples 139 140- man pages: fix backslash-n in examples 141 142 ... to be proper backslash-backslash-n sequences to render nicely in man 143 and on website. 144 145 Follow-up to 24155569d8a 146 Reported-by: Sergey Markelov 147 148 Fixes https://github.com/curl/curl-www/issues/163 149 Closes #7962 150 151- scripts/release-notes.pl: use out of repo links verbatim in refs 152 153- tool_operate: a failed etag save now only fails that transfer 154 155 When failing to create the output file for saving an etag, only fail 156 that particular single transfer and allow others to follow. 157 158 In a serial transfer setup, if no transfer at all is done due to them 159 all being skipped because of this error, curl will output an error 160 message and return exit code 26. 161 162 Added test 369 and 370 to verify. 163 164 Reported-by: Earnestly on github 165 Ref: #7942 166 Closes #7945 167 168- [Kevin Burke brought this change] 169 170 .github: retry macos "brew install" command on failure 171 172 Previously we saw errors attempting to run "brew install", see 173 https://github.com/curl/curl/runs/4095721123?check_suite_focus=true for 174 an example, since this command is idempotent, it is safe to run again. 175 176 Closes #7955 177 178- CURLOPT_ALTSVC_CTRL.3: mention conn reuse is preferred 179 180 Ref: https://github.com/curl/curl/discussions/7954 181 182 Closes #7957 183 184- RELEASE-NOTES: synced 185 186- zuul: pin the quiche build to use an older cmake-rs 187 188 The latest cmake-rs assumes cmake's --parallel works. That was added in 189 cmake 3.12, but a lot of our CI builds run on Ubuntu Bionic which only 190 has cmake 3.10. 191 192 Fixes #7927 193 Closes #7952 194 195- [Marc Hoersken brought this change] 196 197 Revert "src/tool_filetime: disable -Wformat on mingw for this file" 198 199 This reverts commit 7c88fe375b15c44d77bccc9ab733b8069d228e6f. 200 201 Follow up to #6535 as the pragma is obsolete with warnf 202 203 Closes #7941 204 205Jay Satiro (2 Nov 2021) 206- schannel: fix memory leak due to failed SSL connection 207 208 - Call schannel_shutdown if the SSL connection fails. 209 210 Prior to this change schannel_shutdown (which shuts down the SSL 211 connection as well as memory cleanup) was not called when the SSL 212 connection failed (eg due to failed handshake). 213 214 Co-authored-by: Gisle Vanem 215 216 Fixes https://github.com/curl/curl/issues/7877 217 Closes https://github.com/curl/curl/pull/7878 218 219Daniel Stenberg (2 Nov 2021) 220- Curl_updateconninfo: store addresses for QUIC connections too 221 222 So that CURLINFO_PRIMARY_IP etc work for HTTP/3 like for other HTTP 223 versions. 224 225 Reported-by: Jerome Mao 226 Fixes #7939 227 Closes #7944 228 229- [Sergio Durigan Junior brought this change] 230 231 curl.1: fix typos in the manpage 232 233 s/transfering/transferring/ 234 s/transfered/transferred/ 235 236 Signed-off-by: Sergio Durigan Junior <sergiodj@sergiodj.net> 237 Closes #7937 238 239Marc Hoersken (1 Nov 2021) 240- tests/smbserver.py: fix compatibility with impacket 0.9.23+ 241 242 impacket now performs sanity checks if the requested and to 243 be served file path actually is inside the real share path. 244 245 Ref: https://github.com/SecureAuthCorp/impacket/pull/1066 246 247 Fixes #7924 248 Closes #7935 249 250Daniel Stenberg (1 Nov 2021) 251- docs: reduce use of "very" 252 253 "Very" should be avoided in most texts. If intensifiers are needed, try 254 find better words instead. 255 256 Closes #7936 257 258- [Tatsuhiro Tsujikawa brought this change] 259 260 ngtcp2: specify the missing required callback functions 261 262 Closes #7929 263 264- CURLOPT_[PROXY]_SSL_CIPHER_LIST.3: bold instead of quote 265 266 Bold the example ciphers instead of using single quotes, which then also 267 avoids the problem of how to use single quotes when first in a line. 268 269 Also rephrased the pages a little. 270 271 Reported-by: Sergio Durigan Junior 272 Ref: #7928 273 Closes #7934 274 275- gen.pl: replace leading single quotes with \(aq 276 277 ... and allow single quotes to be used "normally" in the .d files. 278 279 Makes the output curl.1 use better nroff. 280 281 Reported-by: Sergio Durigan Junior 282 Ref: #7928 283 Closes #7933 284 285Marc Hoersken (1 Nov 2021) 286- tests: kill some test servers afterwards to avoid locked logfiles 287 288 Reviewed-by: Daniel Stenberg 289 Closes #7925 290 291Daniel Stenberg (1 Nov 2021) 292- smooth-gtk-thread.c: enhance the mutex lock use 293 294 Reported-by: ryancaicse on github 295 Fixes #7926 296 Closes #7931 297 298Marc Hoersken (31 Oct 2021) 299- CI/runtests.pl: restore -u flag, but remove it from CI runs 300 301 This makes it possible to use -u again for local testing, 302 but removes the flag from CI config files and make targets. 303 304 Reviewed-by: Daniel Stenberg 305 306 Partially reverts #7841 307 Closes #7921 308 309Daniel Stenberg (29 Oct 2021) 310- [Jonathan Cardoso Machado brought this change] 311 312 CURLOPT_HSTSWRITEFUNCTION.3: using CURLOPT_HSTS_CTRL is required 313 314 Closes #7923 315 316- [Axel Morawietz brought this change] 317 318 imap: display quota information 319 320 Show response to "GETQUOTAROOT INBOX" command. 321 322 Closes #6973 323 324- RELEASE-NOTES: synced 325 326- [Boris Rasin brought this change] 327 328 cmake: fix error getting LOCATION property on non-imported target 329 330 Closes #7885 331 332- [x2018 brought this change] 333 334 url: check the return value of curl_url() 335 336 Closes #7917 337 338- [Roy Li brought this change] 339 340 configure.ac: replace krb5-config with pkg-config 341 342 The rationale is that custom *-config tools don't work well when 343 cross-compiling or using sysroots (such as when using Yocto project) and 344 require custom fixing for each of them; pkg-config on the other hand 345 works similarly everywhere. 346 347 Signed-off-by: Roy Li <rongqing.li@windriver.com> 348 Signed-off-by: Alexander Kanavin <alex@linutronix.de> 349 350 Closes #7916 351 352- test1160: edited to work with hyper 353 354 Closes #7912 355 356- data/DISABLED: enable tests that now work with hyper 357 358 Closes #7911 359 360- test559: add 'HTTP' in keywords 361 362 Makes it run fine with hyper 363 364 Closes #7911 365 366- test552: updated to work with hyper 367 368 Closes #7911 369 370Marc Hoersken (27 Oct 2021) 371- github: fix incomplete permission to label PRs for Hacktoberfest 372 373 Unfortunately the GitHub API requires a token with write permission 374 for both issues and pull-requests to edit labels on even just PRs. 375 376 Follow up to #7897 377 378Daniel Stenberg (27 Oct 2021) 379- opt-manpages: use 'Added in' instead of 'Since' 380 381 Closes #7913 382 383Marc Hoersken (27 Oct 2021) 384- github: fix missing permission to label PRs for Hacktoberfest 385 386 Follow up to #7897 387 388 Test references to see if permissions are now sufficient: 389 390 Closes #7832 391 Closes #7897 392 393- CI: more use of test-ci make target and verbose output 394 395 Replace test-nonflaky with test-ci and enable verbose output 396 in all remaining CIs except Zuul which is customized a lot. 397 398 Reviewed-by: Daniel Stenberg 399 Reviewed-by: Jay Satiro 400 401 Follow up to #7785 402 Closes #7832 403 404- github: add support for Hacktoberfest using labels 405 406 Automatically add hacktoberfest-accepted label to PRs opened between 407 September 30th and November 1st once a commit with a close reference 408 to it is pushed onto the master branch. 409 410 With this workflow we can participate in Hacktoberfest while not 411 relying on GitHub to identify PRs as merged due to our rebasing. 412 413 Requires hacktoberfest-accepted labels to exist for PRs on the 414 participating repository. Also requires hacktoberfest topic on 415 the participating repository to avoid applying to forked repos. 416 417 Reviewed-by: Daniel Stenberg 418 419 Fixes #7865 420 Closes #7897 421 422Daniel Stenberg (27 Oct 2021) 423- http: reject HTTP response codes < 100 424 425 ... which then also includes negative ones as test 1430 uses. 426 427 This makes native + hyper backend act identically on this and therefore 428 test 1430 can now be enabled when building with hyper. Adjust test 1431 429 as well. 430 431 Closes #7909 432 433- [Kerem Kat brought this change] 434 435 docs: fix typo in CURLOPT_TRAILERFUNCTION example 436 437 Closes #7910 438 439- docs/HYPER: remove some remaining issues, add HTTP/0.9 limitation 440 441- configure: when hyper is selected, deselect nghttp2 442 443 Closes #7908 444 445- [Patrick Monnerat brought this change] 446 447 sendf: accept zero-length data in Curl_client_write() 448 449 Historically, Curl_client_write() used a length value of 0 as a marker 450 for a null-terminated data string. This feature has been removed in 451 commit f4b85d2. To detect leftover uses of the feature, a DEBUGASSERT 452 statement rejecting a length with value 0 was introduced, effectively 453 precluding use of this function with zero-length data. 454 455 The current commit removes the DEBUGASSERT and makes the function to 456 return immediately if length is 0. 457 458 A direct effect is to fix trying to output a zero-length distinguished 459 name in openldap. 460 461 Another DEBUGASSERT statement is also rephrased for better readability. 462 463 Closes #7898 464 465- hyper: disable test 1294 since hyper doesn't allow such crazy headers 466 467 Closes #7905 468 469- c-hyper: make CURLOPT_SUPPRESS_CONNECT_HEADERS work 470 471 Verified by the enabled test 1288 472 473 Closes #7905 474 475- test1287: make work on hyper 476 477 Closes #7905 478 479- test1266/1267: disabled on hyper: no HTTP/0.9 support 480 481 Closes #7905 482 483Viktor Szakats (25 Oct 2021) 484- Makefile.m32: fix to not require OpenSSL with -libssh2 or -rtmp options 485 486 Previously, -libssh2/-rtmp options assumed that OpenSSL is also enabled 487 (and then failed with an error when not finding expected OpenSSL headers), 488 but this isn't necessarly true, e.g. when building both libssh2 and curl 489 against Schannel. This patch makes sure to only enable the OpenSSL backend 490 with -libssh2/-rtmp, when there was no SSL option explicitly selected. 491 492 - Re-implement the logic as a single block of script. 493 - Also fix an indentation while there. 494 495 Assisted-by: Jay Satiro 496 497 Closes #7895 498 499Daniel Stenberg (25 Oct 2021) 500- docs: consistent use of "Added in" 501 502 Make them all say "Added in [version]" without using 'curl' or 'libcurl' 503 in that phrase. 504 505- man pages: require all to use the same section header order 506 507 This is the same order we already enforce among the options' man pages: 508 consistency is good. Add lots of previously missing examples. 509 510 Adjust the manpage-syntax script for this purpose, used in test 1173. 511 512 Closes #7904 513 514- [David Hu brought this change] 515 516 docs/HTTP3: improve build instructions 517 518 1. If writing to a system path if the command is not prefixed with 519 `sudo` it will cause a permission denied error 520 521 2. The patched OpenSSL branch has been updated to `openssl-3.0.0+quic` 522 to match upstream OpenSSL version. 523 524 3. We should not disable GnuTLS docs. 525 526 Updated some commands about `make install` 527 528 Closes #7842 529 530- [Ricardo Martins brought this change] 531 532 CMake: restore support for SecureTransport on iOS 533 534 Restore support for building curl for iOS with SecureTransport enabled. 535 536 Closes #7501 537 538- tests: enable more tests with hyper 539 540 Adjusted 1144, 1164 and 1176. 541 542 Closes #7900 543 544- docs: provide "RETURN VALUE" section for more func manpages 545 546 Three were missing, one used a non-standard name for the header. 547 548 Closes #7902 549 550Jay Satiro (25 Oct 2021) 551- curl_multi_socket_action.3: add a "RETURN VALUE" section 552 553 .. because it may not be immediately clear to the user what 554 curl_multi_socket_action returns. 555 556 Ref: https://curl.se/mail/lib-2021-10/0035.html 557 558 Closes https://github.com/curl/curl/pull/7901 559 560Daniel Stenberg (24 Oct 2021) 561- RELEASE-NOTES: synced 562 563- [Samuel Henrique brought this change] 564 565 tests: use python3 in test 1451 566 567 This is a continuation of commit ec91b5a69000bea0794bbb3 in which 568 changing this test was missed. There are no other python2 leftovers 569 now. 570 571 Based on a Debian patch originally written by Alessandro Ghedini 572 <ghedo@debian.org> 573 574 Closes #7899 575 576- [Eddie Lumpkin brought this change] 577 578 lib: fixing comment spelling typos in lib files 579 580 Closes #7894 581 Signed-off-by: ewlumpkin <ewlumpkin@gmail.com> 582 583- openssl: if verifypeer is not requested, skip the CA loading 584 585 It was previously done mostly to show a match/non-match in the verbose 586 output even when verification was not asked for. This change skips the 587 loading of the CA certs unless verifypeer is set to save memory and CPU. 588 589 Closes #7892 590 591- curl-confopts.m4: remove --enable/disable-hidden-symbols 592 593 These configure options have been saying "deprecated" since 9e24b9c7af 594 (April 2012). It was about time we remove them. 595 596 Closes #7891 597 598- c-hyper: don't abort CONNECT responses early when auth-in-progress 599 600 ... and make sure to stop ignoring the body once the CONNECT is done. 601 602 This should make test 206 work proper again and not be flaky. 603 604 Closes #7889 605 606- hyper: does not support disabling CURLOPT_HTTP_TRANSFER_DECODING 607 608 Simply because hyper doesn't have this ability. Mentioned in docs now. 609 610 Skip test 326 then 611 612 Closes #7889 613 614- test262: don't attempt with hyper 615 616 This test verifies that curl works with binary zeroes in HTTP response 617 headers and hyper refuses such. They're not kosher http. 618 619 Closes #7889 620 621- c-hyper: make test 217 run 622 623 Closes #7889 624 625- DISABLED: enable test 209+213 for hyper 626 627 Follow-up to 823d3ab855c 628 629 Closes #7889 630 631- test207: accept a different error code for hyper 632 633 It returns HYPERE_UNEXPECTED_EOF for this case which we convert to the 634 somewhat generic CURLE_RECV_ERROR. 635 636 Closes #7889 637 638- [Érico Nogueira brought this change] 639 640 INSTALL: update symbol hiding option 641 642 --enable-hidden-symbols was deprecated in 643 9e24b9c7afbcb81120af4cf3f6cdee49a06d8224. 644 645 Closes #7890 646 647- http_proxy: multiple CONNECT with hyper done better 648 649 Enabled test 206 650 651 Closes #7888 652 653- hyper: pass the CONNECT line to the debug callback 654 655 Closes #7887 656 657- mailmap: Malik Idrees Hasan Khan 658 659Jay Satiro (21 Oct 2021) 660- [Malik Idrees Hasan Khan brought this change] 661 662 build: fix typos 663 664 Closes https://github.com/curl/curl/pull/7886 665 666- URL-SYNTAX: add IMAP UID SEARCH example 667 668 - Explain the difference between IMAP search via URL (which returns 669 message sequence numbers) and IMAP search via custom request (which 670 can return UID numbers if prefixed with UID, eg "UID SEARCH ..."). 671 672 Bug: https://github.com/curl/curl/issues/7626 673 Reported-by: orycho@users.noreply.github.com 674 675 Ref: https://github.com/curl/curl/issues/2789 676 677 Closes https://github.com/curl/curl/pull/7881 678 679Daniel Stenberg (20 Oct 2021) 680- manpage: adjust the asterisk in some SYNOPSIS sections 681 682 Closes #7884 683 684- curl_multi_perform.3: polish wording 685 686 - simplify the example by using curl_multi_poll 687 688 - mention curl_multi_add_handle in the text 689 690 - cut out the description of pre-7.20.0 return code behavior - that version 691 is now more than eleven years old and is basically no longer out there 692 693 - adjust the "typical usage" to mention curl_multi_poll 694 695 Closes #7883 696 697- docs/THANKS: removed on request 698 699- FAQ: polish the explanation of libcurl 700 701- curl_easy_perform.3: minor wording tweak 702 703- [Erik Stenlund brought this change] 704 705 mime: mention CURL_DISABLE_MIME in comment 706 707 CURL_DISABLE_MIME is not mentioned in the comment describing the if else 708 preprocessor directive. 709 710 Closes #7882 711 712- tls: remove newline from three infof() calls 713 714 Follow-up to e7416cf 715 716 Reported-by: billionai on github 717 Fixes #7879 718 Closes #7880 719 720- RELEASE-NOTES: synced 721 722- curl_gssapi: fix build warnings by removing const 723 724 Follow-up to 20e980f85b0ea6 725 726 In #7875 these inits were modified but I get two warnings that these new 727 typecasts are necessary for. 728 729 Closes #7876 730 731- [Bo Anderson brought this change] 732 733 curl_gssapi: fix link error on macOS Monterey 734 735 Fixes #7657 736 Closes #7875 737 738- test1185: verify checksrc 739 740 Closes #7866 741 742- checksrc: improve the SPACESEMICOLON error message 743 744 and adjust the MULTISPACE one to use plural 745 746 Closes #7866 747 748- url: set "k->size" -1 at start of request 749 750 The size of the transfer is unknown at that point. 751 752 Fixes #7871 753 Closes #7872 754 755Daniel Gustafsson (18 Oct 2021) 756- doh: remove experimental code for DoH with GET 757 758 The code for sending DoH requests with GET was never enabled in a way 759 such that it could be used or tested. As there haven't been requests 760 for this feature, and since it at this is effectively dead, remove it 761 and favor reimplementing the feature in case anyone is interested. 762 763 Closes #7870 764 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 765 766Daniel Stenberg (18 Oct 2021) 767- cirrus: remove FreeBSD 11.4 from the matrix 768 769 It has reached End-Of-Life and causes some LDAP CI issues. 770 771 Closes #7869 772 773- cirrus: switch to openldap24-client 774 775 ... as it seems openldap-client doesn't exist anymore. 776 777 Reported-by: Jay Satiro 778 Fixes #7868 779 Closes #7869 780 781- checksrc: ignore preprocessor lines 782 783 In order to check the actual code better, checksrc now ignores 784 everything that look like preprocessor instructions. It also means 785 that code in macros are now longer checked. 786 787 Note that some rules then still don't need to be followed when code is 788 exactly below a cpp instruction. 789 790 Removes two checksrc exceptions we needed previously because of 791 preprocessor lines being checked. 792 793 Reported-by: Marcel Raad 794 Fixes #7863 795 Closes #7864 796 797- urlapi: skip a strlen(), pass in zero 798 799 ... to let curl_easy_escape() itself do the strlen. This avoids a (false 800 positive) Coverity warning and it avoids us having to store the strlen() 801 return value in an int variable. 802 803 Reviewed-by: Daniel Gustafsson 804 Closes #7862 805 806- misc: update copyright years 807 808- examples/htmltidy: correct wrong printf() use 809 810 ... and update the includes to match how current htmltidy wants them 811 used. 812 813 Reported-by: Stathis Kapnidis 814 Fixes #7860 815 Closes #7861 816 817Jay Satiro (15 Oct 2021) 818- http: set content length earlier 819 820 - Make content length (ie download size) accessible to the user in the 821 header callback, but only after all headers have been processed (ie 822 only in the final call to the header callback). 823 824 Background: 825 826 For a long time the content length could be retrieved in the header 827 callback via CURLINFO_CONTENT_LENGTH_DOWNLOAD_T as soon as it was parsed 828 by curl. 829 830 Changes were made in 8a16e54 (precedes 7.79.0) to ignore content length 831 if any transfer encoding is used. A side effect of that was that 832 content length was not set by libcurl until after the header callback 833 was called the final time, because until all headers are processed it 834 cannot be determined if content length is valid. 835 836 This change keeps the same intention --all headers must be processed-- 837 but now the content length is available before the final call to the 838 header function that indicates all headers have been processed (ie 839 a blank header). 840 841 Bug: https://github.com/curl/curl/commit/8a16e54#r57374914 842 Reported-by: sergio-nsk@users.noreply.github.com 843 844 Co-authored-by: Daniel Stenberg 845 846 Fixes https://github.com/curl/curl/issues/7804 847 Closes https://github.com/curl/curl/pull/7803 848 849Daniel Stenberg (15 Oct 2021) 850- [Abhinav Singh brought this change] 851 852 aws-sigv4: make signature work when post data is binary 853 854 User sets the post fields size for binary data. Hence, we should not be 855 using strlen on it. 856 857 Added test 1937 and 1938 to verify. 858 859 Closes #7844 860 861- [a1346054 brought this change] 862 863 MacOSX-Framework: remove redundant ';' 864 865 Closes #7859 866 867- RELEASE-NOTES: synced 868 869- openssl: with OpenSSL 1.1.0+ a failed RAND_status means goaway 870 871 One reason we know it can fail is if a provider is used that doesn't do 872 a proper job or is wrongly configured. 873 874 Reported-by: Michael Baentsch 875 Fixes #7840 876 Closes #7856 877 878Marcel Raad (14 Oct 2021) 879- [Ryan Mast brought this change] 880 881 cmake: add CURL_ENABLE_SSL option and make CMAKE_USE_* SSL backend options depend on it 882 883 Closes https://github.com/curl/curl/pull/7822 884 885Daniel Stenberg (14 Oct 2021) 886- http: remove assert that breaks hyper 887 888 Reported-by: Jay Satiro 889 Fixes #7852 890 Closes #7855 891 892- http_proxy: fix one more result assign for hyper 893 894 and remove the bad assert again, since it was run even with no error! 895 896 Closes #7854 897 898Jay Satiro (14 Oct 2021) 899- sws: fix memory leak on exit 900 901 - Free the allocated http request struct on cleanup. 902 903 Prior to this change if sws was built with leak sanitizer it would 904 report a memory leak error during testing. 905 906 Closes https://github.com/curl/curl/pull/7849 907 908Daniel Stenberg (14 Oct 2021) 909- c-hyper: make Curl_http propagate errors better 910 911 Pass on better return codes when errors occur within Curl_http instead 912 of insisting that CURLE_OUT_OF_MEMORY is the only possible one. 913 914 Pointed-out-by: Jay Satiro 915 Closes #7851 916 917- http_proxy: make hyper CONNECT() return the correct error code 918 919 For every 'goto error', make sure the result variable holds the error 920 code for what went wrong. 921 922 Reported-by: Rafał Mikrut 923 Fixes #7825 924 Closes #7846 925 926- docs/Makefile.am: repair 'make html' 927 928 by removing index.html which isn't around anymore 929 930 Closes #7853 931 932- [Борис Верховский brought this change] 933 934 curl: correct grammar in generated libcurl code 935 936 Closes #7802 937 938- tests: disable test 2043 939 940 It uses revoked.badssl.com which now is expired and therefor this now 941 permafails. We should not use external sites for tests, this test should 942 be converted to use our own infra. 943 944 Closes #7845 945 946- runtests: split out ignored tests 947 948 Report ignore tests separately from the actual fails. 949 950 Don't exit non-zero if test servers couldn't get killed. 951 952 Assisted-by: Jay Satiro 953 954 Fixes #7818 955 Closes #7841 956 957- http2: make getsock not wait for write if there's no remote window 958 959 While uploading, check for remote window availability in the getsock 960 function so that we don't wait for a writable socket if no data can be 961 sent. 962 963 Reported-by: Steini2000 on github 964 Fixes #7821 965 Closes #7839 966 967- test368: verify dash is appended for "-r [num]" 968 969 Follow-up to 8758a26f8878 970 971- [Борис Верховский brought this change] 972 973 curl: actually append "-" to --range without number only 974 975 Closes #7837 976 977- RELEASE-NOTES: synced 978 979- urlapi: URL decode percent-encoded host names 980 981 The host name is stored decoded and can be encoded when used to extract 982 the full URL. By default when extracting the URL, the host name will not 983 be URL encoded to work as similar as possible as before. When not URL 984 encoding the host name, the '%' character will however still be encoded. 985 986 Getting the URL with the CURLU_URLENCODE flag set will percent encode 987 the host name part. 988 989 As a bonus, setting the host name part with curl_url_set() no longer 990 accepts a name that contains space, CR or LF. 991 992 Test 1560 has been extended to verify percent encodings. 993 994 Reported-by: Noam Moshe 995 Reported-by: Sharon Brizinov 996 Reported-by: Raul Onitza-Klugman 997 Reported-by: Kirill Efimov 998 Fixes #7830 999 Closes #7834 1000 1001Marc Hoersken (8 Oct 2021) 1002- CI/makefiles: introduce dedicated test target 1003 1004 Make it easy to use the same set of test flags 1005 throughout all current and future CI builds. 1006 1007 Reviewed-by: Jay Satiro 1008 1009 Follow up to #7690 1010 Closes #7785 1011 1012Daniel Stenberg (8 Oct 2021) 1013- maketgz: redirect updatemanpages.pl output to /dev/null 1014 1015- CURLOPT_HTTPHEADER.3: add descripion for specific headers 1016 1017 Settting Host: or Transfer-Encoding: chunked actually have special 1018 meanings to libcurl. This change tries to document them 1019 1020 Closes #7829 1021 1022- c-hyper: use hyper_request_set_uri_parts to make h2 better 1023 1024 and make sure to not send Host: over h2. 1025 1026 Fixes #7679 1027 Reported-by: David Cook 1028 Closes #7827 1029 1030- [Michael Afanasiev brought this change] 1031 1032 curl-openssl.m4: modify library order for openssl linking 1033 1034 lcrypto may depend on lz, and configure corrently fails with when 1035 statically linking as the order is "-lz -lcrypto". This commit switches 1036 the order to "-lcrypto -lz". 1037 1038 Closes #7826 1039 1040Marcel Raad (7 Oct 2021) 1041- sha256: use high-level EVP interface for OpenSSL 1042 1043 Available since OpenSSL 0.9.7. The low-level SHA256 interface is 1044 deprecated in OpenSSL v3, and its usage was discouraged even before. 1045 1046 Closes https://github.com/curl/curl/pull/7808 1047 1048- curl_ntlm_core: use OpenSSL only if DES is available 1049 1050 This selects another SSL backend then if available, or otherwise at 1051 least gives a meaningful error message. 1052 1053 Closes https://github.com/curl/curl/pull/7808 1054 1055- md5: fix compilation with OpenSSL 3.0 API 1056 1057 Only use OpenSSL's MD5 code if it's available. 1058 1059 Also fix wolfSSL build with `NO_MD5`, in which case neither the 1060 wolfSSL/OpenSSL implementation nor the fallback implementation was 1061 used. 1062 1063 Closes https://github.com/curl/curl/pull/7808 1064 1065Daniel Stenberg (7 Oct 2021) 1066- print_category: printf %*s needs an int argument 1067 1068 ... not a size_t! 1069 1070 Detected by Coverity: CID 1492331. 1071 Closes #7823 1072 1073Jay Satiro (7 Oct 2021) 1074- version_win32: use actual version instead of manifested version 1075 1076 - Use RtlVerifyVersionInfo instead of VerifyVersionInfo, when possible. 1077 1078 Later versions of Windows have normal version functions that compare and 1079 return versions based on the way the application is manifested, instead 1080 of the actual version of Windows the application is running on. We 1081 prefer the actual version of Windows so we'll now call the Rtl variant 1082 of version functions (RtlVerifyVersionInfo) which does a proper 1083 comparison of the actual version. 1084 1085 Reported-by: Wyatt O'Day 1086 1087 Ref: https://github.com/curl/curl/pull/7727 1088 1089 Fixes https://github.com/curl/curl/issues/7742 1090 Closes https://github.com/curl/curl/pull/7810 1091 1092Daniel Stenberg (6 Oct 2021) 1093- RELEASE-NOTES: synced 1094 1095- http: fix Basic auth with empty name field in URL 1096 1097 Add test 367 to verify. 1098 1099 Reported-by: Rick Lane 1100 Fixes #7819 1101 Closes #7820 1102 1103- [Jeffrey Tolar brought this change] 1104 1105 CURLOPT_MAXLIFETIME_CONN: maximum allowed lifetime for conn reuse 1106 1107 ... and close connections that are too old instead of reusing them. 1108 1109 By default, this behavior is disabled. 1110 1111 Bug: https://curl.se/mail/lib-2021-09/0058.html 1112 Closes #7751 1113 1114Daniel Gustafsson (6 Oct 2021) 1115- docs/examples: add missing binaries to gitignore 1116 1117 Commit f65d7889b added getreferrer, and commit ae8e11ed5 multi-legacy, 1118 both of which missed adding .gitignore clauses for the built binaries. 1119 1120 Closes #7817 1121 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 1122 1123Daniel Stenberg (5 Oct 2021) 1124- [Josip Medved brought this change] 1125 1126 HTTP3: fix the HTTP/3 Explained book link 1127 1128 Closes #7813 1129 1130- [Lucas Holt brought this change] 1131 1132 misc: fix a few issues on MidnightBSD 1133 1134 Closes #7812 1135 1136Daniel Gustafsson (4 Oct 2021) 1137- [8U61ife brought this change] 1138 1139 tool_main: fix typo in comment 1140 1141 Closes: #7811 1142 Reviewed-by: Daniel Gustafsson <daniel@yesql.se> 1143 1144Daniel Stenberg (4 Oct 2021) 1145- [Ryan Mast brought this change] 1146 1147 BINDINGS: URL updates 1148 1149 For cpr, BBHTTP, Eiffel, Harbour, Haskell, Mono, and Rust 1150 1151 Closes #7809 1152 1153- scripts/delta: hide a git error message we don't care about 1154 1155 fatal: path 'src/tool_listhelp.c' exists on disk, but not in [tag] 1156 1157- [Patrick Monnerat brought this change] 1158 1159 sasl: binary messages 1160 1161 Capabilities of sasl module are extended to exchange messages in binary 1162 as an alternative to base64. 1163 1164 If http authentication flags have been set, those are used as sasl 1165 default preferred mechanisms. 1166 1167 Closes #6930 1168 1169- [Hayden Roche brought this change] 1170 1171 wolfssl: use for SHA256, MD4, MD5, and setting DES odd parity 1172 1173 Prior to this commit, OpenSSL could be used for all these functions, but 1174 not wolfSSL. This commit makes it so wolfSSL will be used if USE_WOLFSSL 1175 is defined. 1176 1177 Closes #7806 1178 1179- scripts/delta: count command line options in the new file 1180 1181 ... which makes the shown delta number wrong until next release. 1182 1183- RELEASE-NOTES: synced 1184 1185- print_category: print help descriptions aligned 1186 1187 Adjust the description position to make an aligned column when doing 1188 help listings, which is more pleasing to the eye. 1189 1190 Suggested-by: Gisle Vanem 1191 Closes #7792 1192 1193- lib/mk-ca-bundle.pl: skip certs passed Not Valid After date 1194 1195 With this change applied, the now expired 'DST Root CA X3' cert will no 1196 longer be included in the output. 1197 1198 Details: https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ 1199 1200 Closes #7801 1201 1202- tool_listhelp: easier to generate with gen.pl 1203 1204 tool_listhelp.c is now a separate file with only the command line --help 1205 output, exactly as generated by gen.pl. This makes it easier to generate 1206 updates according to what's in the docs/cmdline-opts docs. 1207 1208 cd $srcroot/docs/cmdline-opts 1209 ./gen.pl listhelp *.d > $srcroot/src/tool_listhelp.c 1210 1211 With a configure build, this also works: 1212 1213 make -C src listhelp 1214 1215 Closes #7787 1216 1217- [Anthony Hu brought this change] 1218 1219 wolfssl: allow setting of groups/curves 1220 1221 In particular, the quantum safe KEM and hybrid curves if wolfSSL is 1222 built to support them. 1223 1224 Closes #7728 1225 1226- [Jan Mazur brought this change] 1227 1228 connnect: use sysaddr_un fron sys/un.h or custom-defined for windows 1229 1230 Closes #7737 1231 1232Jay Satiro (30 Sep 2021) 1233- [Rikard Falkeborn brought this change] 1234 1235 hostip: Move allocation to clarify there is no memleak 1236 1237 By just glancing at the code, it looks like there is a memleak if the 1238 call to Curl_inet_pton() fails. Looking closer, it is clear that the 1239 call to Curl_inet_pton() can not fail, so the code will never leak 1240 memory. However, we can make this obvious by moving the allocation 1241 after the if-statement. 1242 1243 Closes https://github.com/curl/curl/pull/7796 1244 1245Daniel Stenberg (30 Sep 2021) 1246- gen.pl: make the output date format work better 1247 1248 Follow-up to 15910dfd143dd 1249 1250 The previous strftime format used didn't work correctly on Windows, so 1251 change to %B %d %Y which today looks like "September 29 2021". 1252 1253 Reported-by: Gisle Vanem 1254 Bug: #7782 1255 Closes #7793 1256 1257- typecheck-gcc.h: add CURLOPT_PREREQDATA awareness 1258 1259 Follow-up to a517378de58358a 1260 1261 To make test 1912 happy again 1262 1263 Closes #7799 1264 1265Marcel Raad (29 Sep 2021) 1266- configure: remove `HAVE_WINSOCK_H` definition 1267 1268 It's not used anymore. 1269 1270 Closes https://github.com/curl/curl/pull/7795 1271 1272- CMake: remove `HAVE_WINSOCK_H` definition 1273 1274 It's not used anymore. 1275 1276 Closes https://github.com/curl/curl/pull/7795 1277 1278- config: remove `HAVE_WINSOCK_H` definition 1279 1280 It's not used anymore. 1281 1282 Closes https://github.com/curl/curl/pull/7795 1283 1284- lib: remove `HAVE_WINSOCK_H` usage 1285 1286 WinSock v1 is not supported anymore. Exclusively use `HAVE_WINSOCK2_H` 1287 instead. 1288 1289 Closes https://github.com/curl/curl/pull/7795 1290 1291Daniel Stenberg (29 Sep 2021) 1292- easyoptions: add the two new PRE* options 1293 1294 Follow-up to a517378de58358a 1295 1296 Also fix optiontable.pl to do the correct remainder on the entry. 1297 1298 Reported-by: Gisle Vanem 1299 Bug: https://github.com/curl/curl/commit/a517378de58358a85b7cfe9efecb56051268f629#commitcomment-57224830 1300 Closes #7791 1301 1302- Revert "build: remove checks for WinSock 1" 1303 1304 Due to CI issues 1305 1306 This reverts commit c2ea04f92b00b6271627cb218647527b5a50f2fc. 1307 1308 Closes #7790 1309 1310Daniel Gustafsson (29 Sep 2021) 1311- lib: avoid fallthrough cases in switch statements 1312 1313 Commit b5a434f7f0ee4d64857f8592eced5b9007d83620 inhibits the warning 1314 on implicit fallthrough cases, since the current coding of indicating 1315 fallthrough with comments is falling out of fashion with new compilers. 1316 This attempts to make the issue smaller by rewriting fallthroughs to no 1317 longer fallthrough, via either breaking the cases or turning switch 1318 statements into if statements. 1319 1320 lib/content_encoding.c: the fallthrough codepath is simply copied 1321 into the case as it's a single line. 1322 lib/http_ntlm.c: the fallthrough case skips a state in the state- 1323 machine and fast-forwards to NTLMSTATE_LAST. Do this before the 1324 switch statement instead to set up the states that we actually 1325 want. 1326 lib/http_proxy.c: the fallthrough is just falling into exiting the 1327 switch statement which can be done easily enough in the case. 1328 lib/mime.c: switch statement rewritten as if statement. 1329 lib/pop3.c: the fallthrough case skips to the next state in the 1330 statemachine, do this explicitly instead. 1331 lib/urlapi.c: switch statement rewritten as if statement. 1332 lib/vssh/wolfssh.c: the fallthrough cases fast-forwards the state 1333 machine, do this by running another iteration of the switch 1334 statement instead. 1335 lib/vtls/gtls.c: switch statement rewritten as if statement. 1336 lib/vtls/nss.c: the fallthrough codepath is simply copied into the 1337 case as it's a single line. Also twiddle a comment to not be 1338 inside a non-brace if statement. 1339 1340 Closes: #7322 1341 See-also: #7295 1342 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 1343 1344Marcel Raad (28 Sep 2021) 1345- config-win32ce: enable WinSock 2 1346 1347 WinSock 2.2 is supported by Windows CE .NET 4.1 (from 2002, out of 1348 support since 2013). 1349 1350 Ref: https://docs.microsoft.com/en-us/previous-versions/windows/embedded/ms899586(v=msdn.10) 1351 1352 Closes https://github.com/curl/curl/pull/7778 1353 1354- externalsocket: use WinSock 2.2 1355 1356 That's the only version we support. 1357 1358 Closes https://github.com/curl/curl/pull/7778 1359 1360- build: remove checks for WinSock 1 1361 1362 It's not supported anymore. 1363 1364 Closes https://github.com/curl/curl/pull/7778 1365 1366Daniel Stenberg (28 Sep 2021) 1367- scripts/copyright: .muse is .lift now 1368 1369 And update 5 files with old copyright year range 1370 1371- cmdline-opts: made the 'Added:' field mandatory 1372 1373 Since "too old" versions are no longer included in the generated man 1374 page, this field is now mandatory so that it won't be forgotten and then 1375 not included in the documentation. 1376 1377 Closes #7786 1378 1379- curl.1: remove mentions of really old version changes 1380 1381 To make the man page more readable, this change removes all references 1382 to changes in support/versions etc that happened before 7.30.0 from the 1383 curl.1 output file. 7.30.0 was released on Apr 12 2013. This particular 1384 limit is a bit arbitrary but was fairly easy to grep for. 1385 1386 It is handled like this: the 'Added' keyword is only used in output if 1387 it refers to 7.30.0 or later. All occurances of "(Added in $VERSION)" in 1388 description will be stripped out if the mentioned $VERSION is from 1389 before 7.30.0. It is therefore important that the "Added in..." 1390 references are always written exactly like that - and on a single line, 1391 not split over two. 1392 1393 This change removes about 80 version number references from curl.1, down 1394 to 138 from 218. 1395 1396 Closes #7786 1397 1398- RELEASE-NOTES: synced 1399 1400- tool_cb_prg: make resumed upload progress bar show better 1401 1402 This is a regression that was *probably* injected in the larger progress 1403 bar overhaul in 2018. 1404 1405 Reported-by: beslick5 on github 1406 Fixes #7760 1407 Closes #7777 1408 1409- gen.pl: insert the current date and version in generated man page 1410 1411 Reported-by: Gisle Vanem 1412 Ref: #7780 1413 Closes #7782 1414 1415- NTLM: use DES_set_key_unchecked with OpenSSL 1416 1417 ... as the previously used function DES_set_key() will in some cases 1418 reject using a key that it deems "weak" which will cause curl to 1419 continue using the unitialized buffer content as key instead. 1420 1421 Assisted-by: Harry Sintonen 1422 Fixes #7779 1423 Closes #7781 1424 1425Marc Hoersken (27 Sep 2021) 1426- CI: align make and test flags in various config files 1427 1428 1. Use Makefile target to run tests in autotools builds on AppVeyor. 1429 2. Disable testing of SCP protocol on native Windows environments. 1430 3. Remove redundant parameters -a -p from target test-nonflaky. 1431 4. Don't use -vc parameter which is reserved for debugging. 1432 1433 Replaces #7591 1434 Closes #7690 1435 1436Daniel Stenberg (27 Sep 2021) 1437- mailmap: unify Max! 1438 1439- [Max Dymond brought this change] 1440 1441 CURLOPT_PREREQFUNCTION: add new callback 1442 1443 Triggered before a request is made but after a connection is set up 1444 1445 Changes: 1446 1447 - callback: Update docs and callback for pre-request callback 1448 - Add documentation for CURLOPT_PREREQDATA and CURLOPT_PREREQFUNCTION, 1449 - Add redirect test and callback failure test 1450 - Note that the function may be called multiple times on a redirection 1451 - Disable new 2086 test due to Windows weirdness 1452 1453 Closes #7477 1454 1455- KNOWN_BUGS: HTTP/2 connections through HTTPS proxy frequently stall 1456 1457 Closes #6936 1458 1459- TODO: make configure use --cache-file more and better 1460 1461 Closes #7753 1462 1463- [Sergey Markelov brought this change] 1464 1465 urlapi: support UNC paths in file: URLs on Windows 1466 1467 - file://host.name/path/file.txt is a valid UNC path 1468 \\host.name\path\files.txt to a non-local file transformed into URI 1469 (RFC 8089 Appendix E.3) 1470 1471 - UNC paths on other OSs must be smb: URLs 1472 1473 Closes #7366 1474 1475- [Gleb Ivanovsky brought this change] 1476 1477 urlapi: add curl_url_strerror() 1478 1479 Add curl_url_strerror() to convert CURLUcode into readable string and 1480 facilitate easier troubleshooting in programs using URL API. 1481 Extend CURLUcode with CURLU_LAST for iteration in unit tests. 1482 Update man pages with a mention of new function. 1483 Update example code and tests with new functionality where it fits. 1484 1485 Closes #7605 1486 1487- RELEASE-NOTES: synced 1488 1489- [Mats Lindestam brought this change] 1490 1491 libssh2: add SHA256 fingerprint support 1492 1493 Added support for SHA256 fingerprint in command line curl and in 1494 libcurl. 1495 1496 Closes #7646 1497 1498- libcurl.rc: switch out the copyright symbol for plain ASCII 1499 1500 Reported-by: Vitaly Varyvdin 1501 Assisted-by: Viktor Szakats 1502 Fixes #7765 1503 Closes #7776 1504 1505- [Jun-ya Kato brought this change] 1506 1507 ngtcp2: fix QUIC transport parameter version 1508 1509 fix inappropriate version setting for QUIC transport parameters. 1510 this patch keeps curl with ngtcp2 uses QUIC draft version (h3-29). 1511 1512 Closes #7771 1513 1514- examples/imap-append: fix end-of-data check 1515 1516 Reported-by: Alexander Chuykov 1517 Fixes #7774 1518 Closes #7775 1519 1520Michael Kaufmann (24 Sep 2021) 1521- vtls: Fix a memory leak if an SSL session cannot be added to the cache 1522 1523 On connection shutdown, a new TLS session ticket may arrive after the 1524 SSL session cache has already been destructed. In this case, the new 1525 SSL session cannot be added to the SSL session cache. 1526 1527 The callers of Curl_ssl_addsessionid() need to know whether the SSL 1528 session has been added to the cache. If it has not been added, the 1529 reference counter of the SSL session must not be incremented, or memory 1530 used by the SSL session must be freed. This is now possible with the new 1531 output parameter "added" of Curl_ssl_addsessionid(). 1532 1533 Fixes #7683 1534 Closes #7752 1535 1536Daniel Stenberg (24 Sep 2021) 1537- [Momoka Yamamoto brought this change] 1538 1539 HTTP3.md: use 'autoreconf -fi' instead of buildconf 1540 1541 buildconf is not used since #5853 1542 1543 Closes #7746 1544 1545- GIT-INFO: rephrase to adapt to s/buildconf/autoreconf 1546 1547- [h1zzz brought this change] 1548 1549 llist: remove redundant code, branch will not be executed 1550 1551 Closes #7770 1552 1553- [tlahn brought this change] 1554 1555 HTTP-COOKIES.md: remove duplicate 'each' 1556 1557 Closes #7772 1558 1559Jay Satiro (24 Sep 2021) 1560- [Joel Depooter brought this change] 1561 1562 libssh2: Get the version at runtime if possible 1563 1564 Previously this code used a compile time constant, meaning that libcurl 1565 always reported the libssh2 version that libcurl was built with. This 1566 could differ from the libssh2 version actually being used. The new code 1567 uses the CURL_LIBSSH2_VERSION macro, which is defined in ssh.h. The 1568 macro calls the libssh2_version function if it is available, otherwise 1569 it falls back to the compile time version. 1570 1571 Closes https://github.com/curl/curl/pull/7768 1572 1573- [Joel Depooter brought this change] 1574 1575 schannel: fix typo 1576 1577 Closes https://github.com/curl/curl/pull/7769 1578 1579Daniel Stenberg (23 Sep 2021) 1580- cmake: with OpenSSL, define OPENSSL_SUPPRESS_DEPRECATED 1581 1582 To avoid the "... is deprecated" warnings brought by OpenSSL v3. 1583 (We need to address the underlying code at some point of course.) 1584 1585 Assisted-by: Jakub Zakrzewski 1586 Closes #7767 1587 1588- curl-openssl: pass argument to sed single-quoted 1589 1590 ... instead of using an escaped double-quote. This is an attempt to make 1591 this work better with ksh that otherwise would insist on a double 1592 escape! 1593 1594 Reported-by: Randall S. Becker 1595 Fixes #7758 1596 Closes #7764 1597 1598- RELEASE-NOTES: synced 1599 1600 Bumped curlver to 7.80.0-dev 1601 1602- [a1346054 brought this change] 1603 1604 misc: fix typos in docs and comments 1605 1606 No user facing output from curl/libcurl is changed by this, just 1607 comments. 1608 1609 Closes #7747 1610 1611- [Thomas M. DuBuisson brought this change] 1612 1613 ci: update Lift config to match requirements of curl build 1614 1615 Also renamed Muse -> Lift, the new tool name. 1616 1617 Closes #7761 1618 1619- [Rikard Falkeborn brought this change] 1620 1621 cleanup: constify unmodified static structs 1622 1623 Constify a number of static structs that are never modified. Make them 1624 const to show this. 1625 1626 Closes #7759 1627 1628Version 7.79.1 (22 Sep 2021) 1629 1630Daniel Stenberg (22 Sep 2021) 1631- RELEASE-NOTES: synced 1632 1633 curl 7.79.1 release 1634 1635- THANKS: added names from the 7.79.1 release 1636 1637- test897: verify delivery of IMAP post-body header content 1638 1639 The "content" is delivered as "body" by curl, but the envelope continues 1640 after the body and the rest of it should be delivered as header. 1641 1642 The IMAP server can now get 'POSTFETCH' set to include more data to 1643 include after the body and test 897 is done to verify that such "extra" 1644 header data is in fact delivered by curl as header. 1645 1646 Ref: #7284 but fails to reproduce the issue 1647 1648 Closes #7748 1649 1650- KNOWN_BUGS: connection migration doesn't work 1651 1652 Closes #7695 1653 1654- RELEASE-NOTES: synced 1655 1656- http: fix the broken >3 digit response code detection 1657 1658 When the "reason phrase" in the HTTP status line starts with a digit, 1659 that was treated as the forth response code digit and curl would claim 1660 the response to be non-compliant. 1661 1662 Added test 1466 to verify this case. 1663 1664 Regression brought by 5dc594e44f73b17 1665 Reported-by: Glenn de boer 1666 Fixes #7738 1667 Closes #7739 1668 1669Jay Satiro (17 Sep 2021) 1670- strerror: use sys_errlist instead of strerror on Windows 1671 1672 - Change Curl_strerror to use sys_errlist[errnum] instead of strerror to 1673 retrieve the error message on Windows. 1674 1675 Windows' strerror writes to a static buffer and is not thread-safe. 1676 1677 Follow-up to 2f0bb86 which removed most instances of strerror in favor 1678 of calling Curl_strerror (which calls strerror_r for other platforms). 1679 1680 Ref: https://github.com/curl/curl/pull/7685 1681 Ref: https://github.com/curl/curl/commit/2f0bb86 1682 1683 Closes https://github.com/curl/curl/pull/7735 1684 1685Daniel Stenberg (16 Sep 2021) 1686- dist: provide lib/.checksrc in the tarball 1687 1688 So that debug builds work (checksrc really) 1689 1690 Reported-by: Marcel Raad 1691 Reported-by: tawmoto on github 1692 Fixes #7733 1693 Closes #7734 1694 1695- TODO: Improve documentation about fork safety 1696 1697 Closes #6968 1698 1699- hsts: CURLSTS_FAIL from hsts read callback should fail transfer 1700 1701 ... and have CURLE_ABORTED_BY_CALLBACK returned. 1702 1703 Extended test 1915 to verify. 1704 1705 Reported-by: Jonathan Cardoso 1706 Fixes #7726 1707 Closes #7729 1708 1709- test1184: disable 1710 1711 The test should be fine and it works for me repeated when run manually, 1712 but clearly it causes CI failures and it needs more research. 1713 1714 Reported-by: RiderALT on github 1715 Fixes #7725 1716 Closes #7732 1717 1718- Curl_http2_setup: don't change connection data on repeat invokes 1719 1720 Regression from 3cb8a748670ab88c (releasde in 7.79.0). That change moved 1721 transfer oriented inits to before the check but also erroneously moved a 1722 few connection oriented ones, which causes problems. 1723 1724 Reported-by: Evangelos Foutras 1725 Fixes #7730 1726 Closes #7731 1727 1728- RELEASE-NOTES: synced 1729 1730 and bump to 7.79.1 1731 1732Kamil Dudka (16 Sep 2021) 1733- tests/sshserver.pl: make it work with openssh-8.7p1 1734 1735 ... by not using options with no argument where an argument is required: 1736 1737 === Start of file tests/log/ssh_server.log 1738 curl_sshd_config line 6: no argument after keyword "DenyGroups" 1739 curl_sshd_config line 7: no argument after keyword "AllowGroups" 1740 curl_sshd_config line 10: Deprecated option AuthorizedKeysFile2 1741 curl_sshd_config line 29: Deprecated option KeyRegenerationInterval 1742 curl_sshd_config line 39: Deprecated option RhostsRSAAuthentication 1743 curl_sshd_config line 40: Deprecated option RSAAuthentication 1744 curl_sshd_config line 41: Deprecated option ServerKeyBits 1745 curl_sshd_config line 45: Deprecated option UseLogin 1746 curl_sshd_config line 56: no argument after keyword "AcceptEnv" 1747 curl_sshd_config: terminating, 3 bad configuration options 1748 === End of file tests/log/ssh_server.log 1749 1750 === Start of file log/sftp_server.log 1751 curl_sftp_config line 33: Unsupported option "rhostsrsaauthentication" 1752 curl_sftp_config line 34: Unsupported option "rsaauthentication" 1753 curl_sftp_config line 52: no argument after keyword "sendenv" 1754 curl_sftp_config: terminating, 1 bad configuration options 1755 Connection closed. 1756 Connection closed 1757 === End of file log/sftp_server.log 1758 1759 Closes #7724 1760 1761Daniel Stenberg (15 Sep 2021) 1762- hsts: handle unlimited expiry 1763 1764 When setting a blank expire string, meaning unlimited, curl would pass 1765 TIME_T_MAX to getime_r() when creating the output, while on 64 bit 1766 systems such a large value cannot be convetered to a tm struct making 1767 curl to exit the loop with an error instead. It can't be converted 1768 because the year it would represent doesn't fit in the 'int tm_year' 1769 field! 1770 1771 Starting now, unlimited expiry is instead handled differently by using a 1772 human readable expiry date spelled out as "unlimited" instead of trying 1773 to use a distant actual date. 1774 1775 Test 1660 and 1915 have been updated to help verify this change. 1776 1777 Reported-by: Jonathan Cardoso 1778 Fixes #7720 1779 Closes #7721 1780 1781- curl_multi_fdset: make FD_SET() not operate on sockets out of range 1782 1783 The VALID_SOCK() macro was made to only check for FD_SETSIZE if curl was 1784 built to use select(), even though the curl_multi_fdset() function 1785 always and unconditionally uses FD_SET and needs the check. 1786 1787 Reported-by: 0xee on github 1788 Fixes #7718 1789 Closes #7719 1790 1791- FAQ: add GOPHERS + curl works on data, not files 1792 1793Version 7.79.0 (14 Sep 2021) 1794 1795Daniel Stenberg (14 Sep 2021) 1796- RELEASE-NOTES: synced 1797 1798 For the 7.79.0 release 1799 1800- THANKS: add contributors from 7.79.0 release cycle 1801 1802- FAQ: add two dev related questions 1803 1804 8.1 Why does curl use C89? 1805 8.2 Will curl be rewritten? 1806 1807 Spell-checked-by: Paul Johnson 1808 Closes #7715 1809 1810- zuul.d/jobs: disable three tests for *-openssl-disable-proxy 1811 1812 ... as they mysteriously seem to permfail without being related to 1813 proxy. 1814 1815 Closes #7714 1816 1817- [Patrick Monnerat brought this change] 1818 1819 ftp,imap,pop3,smtp: reject STARTTLS server response pipelining 1820 1821 If a server pipelines future responses within the STARTTLS response, the 1822 former are preserved in the pingpong cache across TLS negotiation and 1823 used as responses to the encrypted commands. 1824 1825 This fix detects pipelined STARTTLS responses and rejects them with an 1826 error. 1827 1828 CVE-2021-22947 1829 1830 Bug: https://curl.se/docs/CVE-2021-22947.html 1831 1832- [Patrick Monnerat brought this change] 1833 1834 ftp,imap,pop3: do not ignore --ssl-reqd 1835 1836 In imap and pop3, check if TLS is required even when capabilities 1837 request has failed. 1838 1839 In ftp, ignore preauthentication (230 status of server greeting) if TLS 1840 is required. 1841 1842 Bug: https://curl.se/docs/CVE-2021-22946.html 1843 1844 CVE-2021-22946 1845 1846- [z2_ on hackerone brought this change] 1847 1848 mqtt: clear the leftovers pointer when sending succeeds 1849 1850 CVE-2021-22945 1851 1852 Bug: https://curl.se/docs/CVE-2021-22945.html 1853 1854- zuul: bump the rustls job to use v0.7.2 1855 1856 ... and add -lm when using a rust library. 1857 1858 Closes #7701 1859 1860- RELEASE-PROCEDURE: add release dates from now to 8.0.0 in 2023 1861 1862- SECURITY-PROCESS: tweak a little to match current practices 1863 1864 Closes #7713 1865 1866- http_proxy: fix the User-Agent inclusion in CONNECT 1867 1868 It should not refer to the uagent string that is allocated and created 1869 for the end server http request, as that pointer may be cleared on 1870 subsequent CONNECT requests. 1871 1872 Added test case 1184 to verify. 1873 1874 Reported-by: T200proX7 on github 1875 Fixes #7705 1876 Closes #7707 1877 1878- Curl_hsts_loadcb: don't attempt to load if hsts wasn't inited 1879 1880 Reported-by: Jonathan Cardoso 1881 Fixes #7710 1882 Closes #7711 1883 1884- [Tatsuhiro Tsujikawa brought this change] 1885 1886 ngtcp2: fix build with ngtcp2 and nghttp3 1887 1888 ngtcp2_conn_client_new and nghttp3_conn_client_new are now macros. 1889 Check the wrapped functions instead. 1890 1891 ngtcp2_stream_close callback now takes flags parameter. 1892 1893 Closes #7709 1894 1895- write-out.d: clarify size_download/upload 1896 1897 They show the number of "body" bytes transfered. 1898 Fixes #7702 1899 Closes #7706 1900 1901- http2: Curl_http2_setup needs to init stream data in all invokes 1902 1903 Thus function was written to avoid doing multiple connection data 1904 initializations, which is fine, but since it also initiates stream 1905 related data it is crucial that it doesn't skip those even if called 1906 again for the same connection. Solved by moving the stream 1907 initializations before the "doing-it-again" check. 1908 1909 Reported-by: Inho Oh 1910 Fixes #7630 1911 Closes #7692 1912 1913- url: fix compiler warning in no-verbose builds 1914 1915 Follow-up from 2f0bb864c12 1916 1917 Closes #7700 1918 1919- non-ascii: fix build errors from strerror fix 1920 1921 Follow-up to 2f0bb864c12 1922 1923 Closes #7697 1924 1925- parse_args: redo the warnings for --remote-header-name combos 1926 1927 ... to avoid the memory leak risk pointed out by scan-build. 1928 1929 Follow-up from 7a3e981781d6c18a 1930 1931 Closes #7698 1932 1933- ngtcp2: adapt to new size defintions upstream 1934 1935 Reviewed-by: Tatsuhiro Tsujikawa 1936 Closes #7699 1937 1938- rustls: add strerror.h include 1939 1940 Follow-up to 2f0bb864c12 1941 1942- docs: the security list is reached at security at curl.se now 1943 1944 Also update the FAQ section a bit to encourage users to rather submit 1945 security issues on hackerone than sending email. 1946 1947 Closes #7689 1948 1949Marc Hoersken (9 Sep 2021) 1950- runtests: add option -u to error on server unexpectedly alive 1951 1952 Let's try to actually handle the server unexpectedly alive 1953 case by first making them visible on CI builds as failures. 1954 1955 This is needed to detect issues with killing of the test 1956 servers completely including nested process chains with 1957 multiple PIDs per test server (including bash and perl). 1958 1959 On Windows/cygwin platforms this is especially helpful with 1960 debugging PID mixups due to cygwin using its own PID space. 1961 1962 Reviewed-by: Daniel Stenberg 1963 Closes #7180 1964 1965Daniel Stenberg (9 Sep 2021) 1966- opts docs: unify phrasing in NAME header 1967 1968 - avoid writing "set ..." or "enable/disable ..." or "specify ..." 1969 *All* options for curl_easy_setopt() are about setting or enabling 1970 things and most of the existing options didn't use that way of 1971 description. 1972 1973 - start with lowercase letter, unless abbreviation. For consistency. 1974 1975 - Some additional touch-ups 1976 1977 Closes #7688 1978 1979- strerror.h: remove the #include from files not using it 1980 1981- lib: don't use strerror() 1982 1983 We have and provide Curl_strerror() internally for a reason: strerror() 1984 is not necessarily thread-safe so we should always try to avoid it. 1985 1986 Extended checksrc to warn for this, but feature the check disabled by 1987 default and only enable it in lib/ 1988 1989 Closes #7685 1990 1991Daniel Gustafsson (8 Sep 2021) 1992- cirrus: Add FreeBSD 13.0 job and disable sanitizer build 1993 1994 As alluded to the in the now removed comment, a 13.0 image became 1995 available and is now ready to be used. 1996 1997 The sanitizer builds were running on the 12.1 image which since has 1998 been removed from the config, leaving the builds not running at all. 1999 When enabled it turns out that they don't actually work due to very 2000 long timeouts in executing the tests, so keep the disabled for now 2001 but a bit more controlled. 2002 2003 Closes #7592 2004 2005Daniel Stenberg (8 Sep 2021) 2006- copyrights: update copyright year ranges 2007 2008- RELEASE-NOTES: synced 2009 2010- INTERNALS: c-ares has a new home: c-ares.org 2011 2012- docs: remove experimental mentions from HSTS and MQTT 2013 2014 Reported-by: Jonathan Cardoso 2015 Bug: https://github.com/curl/curl/pull/6700#issuecomment-913792863 2016 Closes #7681 2017 2018- [Cao ZhenXiang brought this change] 2019 2020 curl: add warning for incompatible parameters usage 2021 2022 --continue-at - and --remote-header-name are known incompatible parameters 2023 2024 Closes #7674 2025 2026- [git-bruh brought this change] 2027 2028 examples/*hiperfifo.c: fix calloc arguments to match function proto 2029 2030 Closes #7678 2031 2032- INTERNALS: bump c-ares requirement to 1.16.0 2033 2034 Since ba904db0705c93 we use ares_getaddrinfo, added in c-ares 1.16.0 2035 2036- curl: stop retry if Retry-After: is longer than allowed 2037 2038 If Retry-After: specifies a period that is longer than what fits within 2039 --retry-max-time, then stop retrying immediately. 2040 2041 Added test 366 to verify. 2042 2043 Reported-by: Kari Pahula 2044 Fixes #7675 2045 Closes #7676 2046 2047- [Michał Antoniak brought this change] 2048 2049 mbedtls: avoid using a large buffer on the stack 2050 2051 Use dynamic memory allocation for the buffer used in checking "pinned 2052 public key". The PUB_DER_MAX_BYTES parameter with default settings is 2053 set to a value greater than 2kB. 2054 2055 Co-authored-by: Daniel Stenberg 2056 Closes #7586 2057 2058- configure: make --disable-hsts work 2059 2060 The AC_ARG_ENABLE() macro itself uses a variable called 2061 'enable_[option]', so when our script also used a variable with that 2062 name for the purpose of storing what the user wants, it also 2063 accidentally made it impossible to switch off the feature with 2064 --disable-hsts. Fix this by renaming our variable. 2065 2066 Reported-by: Michał Antoniak 2067 Fixes #7669 2068 Closes #7672 2069 2070Jay Satiro (5 Sep 2021) 2071- config.d: note that curlrc is used even when --config 2072 2073 Bug: https://github.com/curl/curl/pull/7666#issuecomment-912214751 2074 Reported-by: Viktor Szakats 2075 2076 Closes https://github.com/curl/curl/pull/7667 2077 2078Daniel Stenberg (4 Sep 2021) 2079- RELEASE-NOTES: synced 2080 2081- test1173: check references to libcurl options 2082 2083 ... that they refer to actual existing libcurl options. 2084 2085 Reviewed-by: Daniel Gustafsson 2086 Closes #7656 2087 2088- CURLOPT_UNIX_SOCKET_PATH.3: remove nginx reference, add see also 2089 2090 Closes #7656 2091 2092- opt-docs: verify man page sections + order 2093 2094 In every libcurl option man page there are now 8 mandatory sections that 2095 must use the right name in the correct order and test 1173 verifies 2096 this. Only 14 man pages needed adjustments. 2097 2098 The sections and the order is as follows: 2099 2100 - NAME 2101 - SYNOPSIS 2102 - DESCRIPTION 2103 - PROTOCOLS 2104 - EXAMPLE 2105 - AVAILABILITY 2106 - RETURN VALUE 2107 - SEE ALSO 2108 2109 Reviewed-by: Daniel Gustafsson 2110 Closes #7656 2111 2112- opt-docs: make sure all man pages have examples 2113 2114 Extended manpage-syntax.pl (run by test 1173) to check that every man 2115 page for a libcurl option has an EXAMPLE section that is more than two 2116 lines. Then fixed all errors it found and added examples. 2117 2118 Reviewed-by: Daniel Gustafsson 2119 Closes #7656 2120 2121- get.d: provide more useful examples 2122 2123 Closes #7668 2124 2125- page-header: add GOPHERS, simplify wording in the 1st para 2126 2127 Closes #7665 2128 2129- connect: get local port + ip also when reusing connections 2130 2131 Regression. In d6a37c23a3c (7.75.0) we removed the duplicated storage 2132 (connection + easy handle), so this info needs be extracted again even 2133 for re-used connections. 2134 2135 Add test 435 to verify 2136 2137 Reported-by: Max Dymond 2138 Fixes #7660 2139 Closes #7662 2140 2141Marcel Raad (2 Sep 2021) 2142- multi: fix compiler warning with `CURL_DISABLE_WAKEUP` 2143 2144 `use_wakeup` is unused in this case. 2145 2146 Closes https://github.com/curl/curl/pull/7661 2147 2148Daniel Stenberg (1 Sep 2021) 2149- tests: adjust the tftpd output to work with hyper mode 2150 2151 By making them look less like http headers, the hyper mode "tweak" 2152 doesn't interfere. 2153 2154 Enable test 2002 and 2003 in hyper builds (and 1280 which is unrelated 2155 but should be enabled). 2156 2157 Closes #7658 2158 2159Daniel Gustafsson (1 Sep 2021) 2160- [Gisle Vanem brought this change] 2161 2162 openssl: annotate SSL3_MT_SUPPLEMENTAL_DATA 2163 2164 This adds support for the previously unhandled supplemental data which 2165 in -v output was printed like: 2166 2167 TLSv1.2 (IN), TLS header, Unknown (23): 2168 2169 These will now be printed with proper annotation: 2170 2171 TLSv1.2 (OUT), TLS header, Supplemental data (23): 2172 2173 Closes #7652 2174 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 2175 2176Daniel Stenberg (1 Sep 2021) 2177- curl.1: provide examples for each option 2178 2179 The file format for each option now features a "Example:" header that 2180 can provide one or more examples that get rendered appropriately in the 2181 output. All options MUST have at least one example or gen.pl complains 2182 at build-time. 2183 2184 This fix also does a few other minor format and consistency cleanups. 2185 2186 Closes #7654 2187 2188- progress: make trspeed avoid floats 2189 2190 and compiler warnings for data conversions. 2191 2192 Reported-by: Michał Antoniak 2193 Fixes #7645 2194 Closes #7653 2195 2196- test365: verify response with chunked AND Content-Length headers 2197 2198- http: ignore content-length if any transfer-encoding is used 2199 2200 Fixes #7643 2201 Closes #7649 2202 2203- RELEASE-NOTES: synced 2204 2205- Revert "http2: skip immediate parsing of payload following protocol switch" 2206 2207 This reverts commit 455a63c66f188598275e87d32de2c4e8e26b80cb. 2208 2209 Reported-by: Tk Xiong 2210 Fixes #7633 2211 Closes #7648 2212 2213- KNOWN_BUGS: HTTP/3 doesn't support client certs 2214 2215 Closes #7625 2216 2217- mailing lists: move from cool.haxx.se to lists.haxx.se 2218 2219- http_proxy: only wait for writable socket while sending request 2220 2221 Otherwise it would wait socket writability even after the entire CONNECT 2222 request has sent and make curl basically busy-loop while waiting for a 2223 response to come back. 2224 2225 The previous fix attempt in #7484 (c27a70a591a4) was inadequate. 2226 2227 Reported-by: zloi-user on github 2228 Reported-by: Oleguer Llopart 2229 Fixes #7589 2230 Closes #7647 2231 2232- http: disallow >3-digit response codes 2233 2234 Make the built-in HTTP parser behave similar to hyper and reject any 2235 HTTP response using more than 3 digits for the response code. 2236 2237 Updated test 1432 accordingly. 2238 Enabled test 1432 in the hyper builds. 2239 2240 Closes #7641 2241 2242- [Tatsuhiro Tsujikawa brought this change] 2243 2244 ngtcp2: stop buffering crypto data 2245 2246 Stop buffering crypto data because libngtcp2 now buffers submitted 2247 crypto data. 2248 2249 Closes #7637 2250 2251- test1280: CRLFify the response to please hyper 2252 2253 Closes #7639 2254 2255- tests: enable test 1129 for hyper builds 2256 2257 Closes #7638 2258 2259- curl: better error message when -O fails to get a good name 2260 2261 Due to how this currently works internally, it needs a working initial 2262 file name to store contents in, so it may still fail even with -J is 2263 used (and thus accepting a name from content-disposition:) if the file 2264 name part of the URL isn't "good enough". 2265 2266 Fixes #7628 2267 Closes #7635 2268 2269- curl_easy_setopt: tweak the string copy wording 2270 2271 Reported-by: Yaobin Wen 2272 Fixes #7632 2273 Closes #7634 2274 2275- RELEASE-NOTES: synced 2276 2277- [Don J Olmstead brought this change] 2278 2279 cmake: sync CURL_DISABLE options 2280 2281 Adds the full listing of CURL_DISABLE options to the CMake build. Moves 2282 all option code, except for CURL_DISABLE_OPENSSL_AUTO_LOA_CONFIG which 2283 resides near OpenSSL configuration, to the same block of code. Also 2284 sorts the options here and in the cmake config header. 2285 2286 Additionally sorted the CURL-DISABLE listing and fixed the 2287 CURL_DISABLE_POP3 option. 2288 2289 Closes #7624 2290 2291Jay Satiro (25 Aug 2021) 2292- KNOWN_BUGS: FTPS upload data loss with TLS 1.3 2293 2294 Bug: https://github.com/curl/curl/issues/6149 2295 Reported-by: Bylon2@users.noreply.github.com 2296 2297 Closes https://github.com/curl/curl/pull/7623 2298 2299Daniel Stenberg (24 Aug 2021) 2300- cmake: avoid poll() on macOS 2301 2302 ... like we do in configure builds. Since poll() on macOS is not 2303 reliable enough. 2304 2305 Reported-by: marc-groundctl 2306 Fixes #7595 2307 Closes #7619 2308 2309- c-hyper: handle HTTP/1.1 => HTTP/1.0 downgrade on reused connection 2310 2311 Enable test 1074 2312 2313 Closes #7617 2314 2315- c-hyper: deal with Expect: 100-continue combined with POSTFIELDS 2316 2317 Enable test 1130 and 1131 2318 2319 Closes #7616 2320 2321- [a1346054 brought this change] 2322 2323 tests: be explicit about using 'python3' instead of 'python' 2324 2325 This fixes running tests in virtualenvs (or on distros) that no longer 2326 have a symlink from python to python2 or python3. 2327 2328 Closes #7602 2329 2330- [a1346054 brought this change] 2331 2332 scripts: invoke interpreters through /usr/bin/env 2333 2334 Closes #7602 2335 2336- DISABLED: enable 11 more tests for hyper builds 2337 2338 Closes #7612 2339 2340- setopt: enable CURLOPT_IGNORE_CONTENT_LENGTH for hyper 2341 2342 Since this option is also used for FTP, it needs to work to set for 2343 applications even if hyper doesn't support it for HTTP. Verified by test 2344 1137. 2345 2346 Updated docs to specify that the option doesn't work for HTTP when using 2347 the hyper backend. 2348 2349 Closes #7614 2350 2351- test1138: remove trailing space to make work with hyper 2352 2353 Closes #7613 2354 2355- libcurl-errors.3: clarify two CURLUcode errors 2356 2357 CURLUE_BAD_HANDLE and CURLUE_BAD_PARTPOINTER should be for "bad" or 2358 wrong pointers in a generic sense, not just for NULL pointers. 2359 2360 Reviewed-by: Jay Satiro 2361 2362 Ref: #7605 2363 Closes #7611 2364 2365Jay Satiro (23 Aug 2021) 2366- symbols-in-versions: fix CURLSSLBACKEND_QSOSSL last used version 2367 2368 ... and also change the 'Removed' column name to 'Last' since that 2369 column is for the last version to contain the symbol. 2370 2371 Closes https://github.com/curl/curl/pull/7609 2372 2373Daniel Stenberg (23 Aug 2021) 2374- urlapi.c:seturl: assert URL instead of using if-check 2375 2376 There's no code flow possible where this can happen. The assert makes 2377 sure it also won't be introduced undetected in the future. 2378 2379 Closes #7610 2380 2381- curl-openssl.m4: show correct output for OpenSSL v3 2382 2383 Using 3.0.0 versions configure should now show this: 2384 2385 checking for OpenSSL headers version... 3.0.0 - 0x300 2386 checking for OpenSSL library version... 3.0.0 2387 checking for OpenSSL headers and library versions matching... yes 2388 2389 This output doesn't actually change what configure generates but is only 2390 "cosmetic". 2391 2392 Reported-by: Randall S. Becker 2393 Fixes #7606 2394 Closes #7608 2395 2396Jay Satiro (22 Aug 2021) 2397- mksymbolsmanpage.pl: Fix showing symbol's last used version 2398 2399 Prior to this change the symbol's deprecated version was erroneously 2400 shown as its last used version. 2401 2402 Bug: https://github.com/curl/curl/commit/4e53b94#commitcomment-55239509 2403 Reported-by: i-ky@users.noreply.github.com 2404 2405Daniel Stenberg (21 Aug 2021) 2406- mksymbolsmanpage.pl: match symbols case insenitively 2407 2408 Follow-up to 4e53b9430c750 which made this bug show. 2409 2410 Reported-by: i-ky 2411 Bug: https://github.com/curl/curl/commit/4e53b9430c7504de8984796e2a2091ec16f27136#commitcomment-55239253 2412 Closes #7607 2413 2414- asyn-ares: call ares_freeaddrinfo() to clean up addrinfo results 2415 2416 As this leaks memory otherwise 2417 2418 Follow-up to ba904db0705c931 2419 2420 Closes #7599 2421 2422- [Ehren Bendler brought this change] 2423 2424 wolfssl: clean up wolfcrypt error queue 2425 2426 If wolfSSL is built in certain ways (OPENSSL_EXTRA or Debug), the error 2427 queue gets added on to for each session and never freed. Fix it by 2428 calling ERR_clear_error() like in vtls/openssl when needed. This func is 2429 a no-op in wolfcrypt if the error queue is not enabled. 2430 2431 Closes #7594 2432 2433- man pages: remove trailing whitespaces 2434 2435 Extended test 1173 (via the manpage-syntax.pl script) to detect and warn 2436 for them. 2437 2438 Ref: #7602 2439 Reported-by: a1346054 on github 2440 Closes #7604 2441 2442- mailmap: add Gleb Ivanovsky 2443 2444- config.d: escape the backslash properly 2445 2446 Closes #7603 2447 2448- [Don J Olmstead brought this change] 2449 2450 curl_setup.h: sync values for HTTP_ONLY 2451 2452 The values for HTTP_ONLY differed between CMakeLists.txt and 2453 curl_setup.h. Sync them and sort the values in curl_setup.h to make it 2454 easier to spot differences. 2455 2456 Closes #7601 2457 2458Jay Satiro (21 Aug 2021) 2459- configure: set classic mingw minimum OS version to XP 2460 2461 - If the user has not specified a minimum OS version (via WINVER or 2462 _WIN32_WINNT macros) then set it to Windows XP. 2463 2464 Prior to this change classic MinGW defaulted the minimum OS version 2465 to Windows NT 4.0 which is way too old. At least Windows XP is needed 2466 for getaddrinfo (which resolves hostnames to IPv6 addresses). 2467 2468 Ref: https://github.com/curl/curl/issues/7483#issuecomment-891597034 2469 2470 Closes https://github.com/curl/curl/pull/7581 2471 2472- schannel: Work around typo in classic mingw macro 2473 2474 - Define ALG_CLASS_DHASH (the typo from the include) to ALG_CLASS_HASH. 2475 2476 Prior to this change there was an incomplete fix to ignore the 2477 CALG_TLS1PRF macro on those versions of MinGW where it uses the 2478 ALG_CLASS_DHASH typoed macro. 2479 2480 Ref: 48cf45c 2481 Ref: https://osdn.net/projects/mingw/ticket/38391 2482 Ref: https://github.com/curl/curl/issues/2924 2483 2484 Closes https://github.com/curl/curl/pull/7580 2485 2486Daniel Stenberg (20 Aug 2021) 2487- RELEASE-NOTES: synced 2488 2489- http_proxy: fix user-agent and custom headers for CONNECT with hyper 2490 2491 Enable test 287 2492 2493 Closes #7598 2494 2495- c-hyper: initial support for "dumping" 1xx HTTP responses 2496 2497 With the use hyper_request_on_informational() 2498 2499 Enable test 155 and 158 2500 2501 Closes #7597 2502 2503Marc Hoersken (18 Aug 2021) 2504- tests/*server.pl: flush output before executing subprocess 2505 2506 Also avoid shell processes staying around by using exec. 2507 This is necessary to avoid output data being buffering 2508 inside the process chain of Perl, Bash/Shell and our 2509 test server binaries. On non-Windows systems the exec 2510 will also make the subprocess replace the intermediate 2511 shell, but on Windows it will at least bind the processes 2512 together since there is no real fork or exec available. 2513 2514 See: https://cygwin.com/cygwin-ug-net/highlights.html 2515 and: https://docs.microsoft.com/cpp/c-runtime-library/exec-wexec-functions 2516 Ref: https://github.com/curl/curl/pull/7530#issuecomment-900949010 2517 2518 Reviewed-by: Daniel Stenberg 2519 Reviewed-by: Jay Satiro 2520 Closes #7530 2521 2522- CI: use GitHub Container Registry instead of Docker Hub 2523 2524 Avoid limits on Docker Hub and improve image pull/download speed. 2525 2526 Closes #7587 2527 2528Daniel Stenberg (18 Aug 2021) 2529- openssl: when creating a new context, there cannot be an old one 2530 2531 Remove the previous handling that would call SSL_CTX_free(), and instead 2532 add an assert that halts a debug build if there ever is a context 2533 already set at this point. 2534 2535 Closes #7585 2536 2537Jay Satiro (18 Aug 2021) 2538- KNOWN_BUGS: Renegotiate from server may cause hang for OpenSSL backend 2539 2540 Closes https://github.com/curl/curl/issues/6785 2541 2542Viktor Szakats (17 Aug 2021) 2543- docs/BINDINGS: URL update 2544 2545Marc Hoersken (17 Aug 2021) 2546- tests/server/*.c: align handling of portfile argument and file 2547 2548 1. Call the internal variable portname (like pidname) everywhere. 2549 2. Have a variable wroteportfile (like wrotepidfile) everywhere. 2550 3. Make sure the file is cleaned up on exit (like pidfile). 2551 4. Add parameter --portfile to usage outputs everywhere. 2552 2553 Reviewed-by: Daniel Stenberg 2554 2555 Replaces #7523 2556 Closes #7574 2557 2558Daniel Gustafsson (17 Aug 2021) 2559- KNOWN_BUGS: Fix a number of typos in KNOWN_BUGS 2560 2561 Fixes a set of typos found in section 11.3. 2562 2563Daniel Stenberg (17 Aug 2021) 2564- getparameter: fix the --local-port number parser 2565 2566 It could previously get tricked into parsing the uninitialized stack 2567 based buffer. 2568 2569 Reported-by: Brian Carpenter 2570 Closes #7582 2571 2572- KNOWN_BUGS: Can't use Secure Transport with Crypto Token Kit 2573 2574 Closes #7048 2575 2576- [Jan Verbeek brought this change] 2577 2578 curl: add warning for ignored data after quoted form parameter 2579 2580 In an argument like `-F 'x=@/etc/hostname;filename="foo"abc'` the `abc` 2581 is ignored. This adds a warning if the ignored data isn't all 2582 whitespace. 2583 2584 Closes #7394 2585 2586Jay Satiro (17 Aug 2021) 2587- codeql: fix error "Resource not accessible by integration" 2588 2589 - Enable codeql writing security-events. 2590 2591 GitHub set the default permissions to read, apparently since earlier 2592 this year. 2593 2594 Ref: https://github.com/github/codeql-action/issues/464 2595 Ref: https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ 2596 2597 Fixes https://github.com/curl/curl/issues/7575 2598 Closes https://github.com/curl/curl/pull/7576 2599 2600- tool_operate: Fix --fail-early with parallel transfers 2601 2602 - Abort via progress callback to fail early during parallel transfers. 2603 2604 When a critical error occurs during a transfer (eg --fail-early 2605 constraint) then other running transfers will be aborted via progress 2606 callback and finish with error CURLE_ABORTED_BY_CALLBACK (42). In this 2607 case, the callback error does not become the most recent error and a 2608 custom error message is used for those transfers: 2609 2610 curld --fail --fail-early --parallel 2611 https://httpbin.org/status/404 https://httpbin.org/delay/10 2612 2613 curl: (22) The requested URL returned error: 404 2614 curl: (42) Transfer aborted due to critical error in another transfer 2615 2616 > echo %ERRORLEVEL% 2617 22 2618 2619 Fixes https://github.com/curl/curl/issues/6939 2620 Closes https://github.com/curl/curl/pull/6984 2621 2622Daniel Stenberg (17 Aug 2021) 2623- [Sergey Markelov brought this change] 2624 2625 sectransp: support CURLINFO_CERTINFO 2626 2627 Fixes #4130 2628 Closes #7372 2629 2630- ngtcp2: remove the acked_crypto_offset struct field init 2631 2632 ... as it is gone from the API upstream. 2633 2634 Closes #7578 2635 2636- misc: update incorrect copyright year ranges 2637 2638 Closes #7577 2639 2640- KNOWN_BUGS: HTTP/3 quiche upload large file fails 2641 2642 Closes #7532 2643 2644- KNOWN_BUGS: CMake build with MIT Kerberos does not work 2645 2646 Closes #6904 2647 2648- TODO: add asynch getaddrinfo support 2649 2650 Closes #6746 2651 2652- RELEASE-NOTES: synced 2653 2654- [Artur Sinila brought this change] 2655 2656 http2: revert call the handle-closed function correctly on closed stream 2657 2658 Reverts 252790c5335a221 2659 2660 Assisted-by: Gergely Nagy 2661 Fixes #7400 2662 Closes #7525 2663 2664- [Patrick Monnerat brought this change] 2665 2666 auth: do not append zero-terminator to authorisation id in kerberos 2667 2668 RFC4752 Section 3.1 states "The authorization identity is not terminated 2669 with a zero-valued (%x00) octet". Although a comment in code said it may 2670 be needed anyway, nothing confirms it. In addition, servers may consider 2671 it as part of the identity, causing a failure. 2672 2673 Closes #7008 2674 2675- [Patrick Monnerat brought this change] 2676 2677 auth: use sasl authzid option in kerberos 2678 2679 ... instead of deriving it from active ticket. 2680 Closes #7008 2681 2682- [Patrick Monnerat brought this change] 2683 2684 auth: we do not support a security layer after kerberos authentication 2685 2686 Closes #7008 2687 2688- [Patrick Monnerat brought this change] 2689 2690 auth: properly handle byte order in kerberos security message 2691 2692 Closes #7008 2693 2694- [z2_ brought this change] 2695 2696 x509asn1: fix heap over-read when parsing x509 certificates 2697 2698 Assisted-by: Patrick Monnerat 2699 Closes #7536 2700 2701- KNOWN_BUGS: Disconnects don't do verbose 2702 2703 Closes #6995 2704 2705- mailmap: fixup Michał Antoniak 2706 2707- [Michał Antoniak brought this change] 2708 2709 build: fix compiler warnings 2710 2711 For when CURL_DISABLE_VERBOSE_STRINGS and DEBUGBUILD flags are both 2712 active. 2713 2714 - socks.c : warning C4100: 'lineno': unreferenced formal parameter 2715 (co-authored by Daniel Stenberg) 2716 2717 - mbedtls.c: warning C4189: 'port': local variable is initialized but 2718 not referenced 2719 2720 - schannel.c: warning C4189: 'hostname': local variable is initialized 2721 but not referenced 2722 2723 Cloes #7528 2724 2725- [Gleb Ivanovsky brought this change] 2726 2727 CODE_STYLE-md: fix bold font style 2728 2729 Markdown gets confused with abundance of asterisks, so use underscores 2730 instead. 2731 2732 Reviewed-by: Daniel Gustafsson 2733 Closes #7569 2734 2735- [Gleb Ivanovsky brought this change] 2736 2737 CODE_STYLE-md: add missing comma 2738 2739 Reviewed-by: Daniel Gustafsson 2740 Closes #7570 2741 2742- [Daniel Gustafsson brought this change] 2743 2744 examples/ephiperfifo.c: simplify signal handler 2745 2746 The signal handler registered for SIGINT is only handling SIGINT 2747 so there isn't much need for inspecting the signo. While there, 2748 rename the handler to be more specific. 2749 2750 g_should_exit should really be of sig_atomic_t type, but relying 2751 on autoconf in the examples seems like a bad idea so keep that 2752 for now. 2753 2754 Reviewed-by: Daniel Stenberg 2755 Closes #7310 2756 2757- c-hyper: initial step for 100-continue support 2758 2759 Enabled test 154 2760 2761 Closes #7568 2762 2763- [Ikko Ashimine brought this change] 2764 2765 vtls: fix typo in schannel_verify.c 2766 2767 occurence -> occurrence 2768 2769 Closes #7566 2770 2771- [Emil Engler brought this change] 2772 2773 curl_url_get.3: clarify about path and query 2774 2775 The current man-page lacks some details regarding the obtained path and 2776 query. 2777 2778 Closes #7563 2779 2780- c-hyper: fix header value passed to debug callback 2781 2782 Closes #7567 2783 2784Viktor Szakats (12 Aug 2021) 2785- cleanup: URL updates 2786 2787 - replace broken URL with the one it was most probably pointing to 2788 when added (lib/tftp.c) 2789 - replace broken URL with archive.org link (lib/curl_ntlm_wb.c) 2790 - delete unnecessary protocol designator from archive.org URL 2791 (docs/BINDINGS.md) 2792 2793 Closes #7562 2794 2795Daniel Stenberg (12 Aug 2021) 2796- [April King brought this change] 2797 2798 DEPRECATE.md: linkify curl-library mailing list 2799 2800 Closes #7561 2801 2802- [Barry Pollard brought this change] 2803 2804 output.d: add method to suppress response bodies 2805 2806 Closes #7560 2807 2808- TODO: remove 'c-ares deviates on http://1346569778' 2809 2810 Fixed since 56a037cc0ad1b2 (7.77.0) 2811 2812- [Colin O'Dell brought this change] 2813 2814 BINDINGS.md: update links to use https where available 2815 2816 Closes #7558 2817 2818- asyn-ares.c: move all version number checks to the top 2819 2820 ... and use #ifdef [feature] in the code as per our guidelines. 2821 2822- ares: use ares_getaddrinfo() 2823 2824 ares_getaddrinfo() is the getaddrinfo() cloned provided by c-ares, introduced 2825 in version 1.16.0. 2826 2827 With older c-ares versions, curl invokes ares_gethostbyname() twice - once for 2828 IPv4 and once for IPv6 to resolve both addresses, and then combines the 2829 returned results. 2830 2831 Reported-by: jjandesmet 2832 Fixes #7364 2833 Closes #7552 2834 2835- [Tatsuhiro Tsujikawa brought this change] 2836 2837 ngtcp2: utilize crypto API functions to simplify 2838 2839 Closes #7551 2840 2841- [megatronking brought this change] 2842 2843 ngtcp2: reset the oustanding send buffer again when drained 2844 2845 Closes #7538 2846 2847Michael Kaufmann (10 Aug 2021) 2848- progress: fix a compile warning on some systems 2849 2850 lib/progress.c:380:40: warning: conversion to 'long double' from 2851 'curl_off_t {aka long long int}' may alter its value [-Wconversion] 2852 2853 Closes #7549 2854 2855Daniel Stenberg (10 Aug 2021) 2856- RELEASE-NOTES: synced 2857 2858- http: consider cookies over localhost to be secure 2859 2860 Updated test31. 2861 Added test 392 to verify secure cookies used for http://localhost 2862 2863 Reviewed-by: Daniel Gustafsson 2864 Fixes #6733 2865 Closes #7263 2866 2867- TODO: erase secrets from heap/stack after use 2868 2869 Closes #7268 2870 2871Jay Satiro (10 Aug 2021) 2872- hostip: Make Curl_ipv6works function independent of getaddrinfo 2873 2874 - Do not assume IPv6 is not working when getaddrinfo is not present. 2875 2876 The check to see if IPv6 actually works is now independent of whether 2877 there is any resolver that can potentially resolve a hostname to IPv6. 2878 2879 Prior to this change if getaddrinfo() was not found at compile time then 2880 Curl_ipv6works() would be defined as a macro that returns FALSE. 2881 2882 When getaddrinfo is not found then libcurl is built with CURLRES_IPV4 2883 defined instead of CURLRES_IPV6, meaning that it cannot do IPv6 lookups 2884 in the traditional way. With this commit if libcurl is built with IPv6 2885 support (ENABLE_IPV6) but without getaddrinfo (CURLRES_IPV6), and the 2886 IPv6 stack is actually working, then it is possible for libcurl to 2887 resolve IPv6 addresses by using DoH. 2888 2889 Ref: https://github.com/curl/curl/issues/7483#issuecomment-890765378 2890 2891 Closes https://github.com/curl/curl/pull/7529 2892 2893- test1565: fix windows build errors 2894 2895 - Use our wait_ms() instead of sleep() since Windows doesn't have the 2896 latter. 2897 2898 - Use a separate variable to keep track of whether the pthread_t thread 2899 id is valid. 2900 2901 On Windows pthread_t is not an integer type. pthread offers no macro for 2902 invalid pthread_t thread id, so validity is kept track of separately. 2903 2904 Closes https://github.com/curl/curl/pull/7527 2905 2906- [Jeremy Falcon brought this change] 2907 2908 winbuild/README.md: clarify GEN_PDB option 2909 2910 - Document that GEN_PDB option creates an external database. 2911 2912 Ref: https://github.com/curl/curl/issues/7502 2913 2914Daniel Stenberg (9 Aug 2021) 2915- [Tatsuhiro Tsujikawa brought this change] 2916 2917 ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read 2918 2919 Closes #7546 2920 2921- [Tatsuhiro Tsujikawa brought this change] 2922 2923 ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream 2924 2925 Rework the return value handling of ngtcp2_conn_writev_stream and treat 2926 NGTCP2_ERR_STREAM_SHUT_WR separately. 2927 2928 Closes #7546 2929 2930- configure: error out if both ngtcp2 and quiche are specified 2931 2932 Reported-by: Vincent Grande 2933 See #7539 2934 Closes #7545 2935 2936- [Jeff Mears brought this change] 2937 2938 easy: use a custom implementation of wcsdup on Windows 2939 2940 ... so that malloc/free overrides from curl_global_init are used for 2941 wcsdup correctly. 2942 2943 Closes #7540 2944 2945- zuul: add an mbedtls3 CI job 2946 2947 Closes #7544 2948 2949- [Benau brought this change] 2950 2951 mbedTLS: initial 3.0.0 support 2952 2953 Closes #7428 2954 2955- RELEASE-NOTES: synced 2956 2957- configure.ac: revert bad nghttp2 library detection improvements 2958 2959 This reverts commit b4b34db65f9f8, 673753344c5f and 29c7cf79e8b. 2960 2961 The logic is now back to assuming that the nghttp2 lib is called nghttp2 and 2962 nothing else. 2963 2964 Reported-by: Rui Pinheiro 2965 Reported-by: Alex Crichton 2966 Fixes #7514 2967 Closes #7515 2968 2969- happy-eyeballs-timeout-ms.d: polish the wording 2970 2971 Reported-by: Josh Soref 2972 Fixes #7433 2973 Closes #7542 2974 2975- [modbw brought this change] 2976 2977 mbedtls_threadlock: fix unused variable warning 2978 2979 Closes #7393 2980 2981- [Tatsuhiro Tsujikawa brought this change] 2982 2983 ngtcp2: compile with the latest ngtcp2 and nghttp3 2984 2985 Closes #7541 2986 2987Marc Hoersken (31 Jul 2021) 2988- CI/cirrus: reduce compile time with increased parallism 2989 2990 Cirrus CI VMs have 2 CPUs, let's use them also for Windows builds. 2991 2992 Reviewed-by: Daniel Stenberg 2993 Closes #7505 2994 2995Daniel Stenberg (30 Jul 2021) 2996- [Bin Lan brought this change] 2997 2998 tool/tests: fix potential year 2038 issues 2999 3000 The length of 'long' in a 32-bit system is 32 bits, which cannot be used 3001 to save timestamps after 2038. Most operating systems have extended 3002 time_t to 64 bits. 3003 3004 Remove the castings to long. 3005 3006 Closes #7466 3007 3008- compressed.d: it's a request, not an order 3009 3010 Clarified 3011 3012 Reported-by: Dan Jacobson 3013 Reviewed-by: Daniel Gustafsson 3014 Fixes #7516 3015 Closes #7517 3016 3017- [Bernhard M. Wiedemann brought this change] 3018 3019 tests: make three tests pass until 2037 3020 3021 after 2038 something in test1915 fails on 32-bit OSes 3022 3023 Closes #7512 3024 3025Daniel Gustafsson (30 Jul 2021) 3026- connect: remove superfluous conditional 3027 3028 Commit dbd16c3e2 cleaned up the logic for traversing the addrinfos, 3029 but the move left a conditional on ai which no longer is needed as 3030 the while loop reevaluation will cover it. 3031 3032 Closes #7511 3033 Reviewed-by: Carlo Marcelo Arenas Belón 3034 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 3035 3036Daniel Stenberg (29 Jul 2021) 3037- RELEASE-NOTES: synced 3038 3039 and bump curlver to 7.79.0 for next release 3040 3041Marc Hoersken (29 Jul 2021) 3042- tests/*server.py: remove pidfile on server termination 3043 3044 Avoid pidfile leaking/laying around after server already exited. 3045 3046 Reviewed-by: Daniel Stenberg 3047 Closes #7506 3048 3049Daniel Gustafsson (27 Jul 2021) 3050- tool_main: fix typo in comment 3051 3052 The referred to library is NSPR, so fix the switched around characters. 3053 3054Daniel Stenberg (28 Jul 2021) 3055- [Aleksandr Krotov brought this change] 3056 3057 bearssl: support CURLOPT_CAINFO_BLOB 3058 3059 Closes #7468 3060 3061- curl.1: mention "global" flags 3062 3063 Mention options that are "global". A global command line option is one 3064 that doesn't get reset at --next uses and therefore don't need to be 3065 used again. 3066 3067 Reported-by: Josh Soref 3068 3069 Fixes #7457 3070 Closes #7510 3071 3072- CURLOPT_DOH_URL.3: CURLOPT_OPENSOCKETFUNCTION is not inherited 3073 3074 Reported-by: Daniel Woelfel 3075 Fixes #7441 3076 Closes #7509 3077 3078- KNOWN_BUGS: add more HTTP/3 problems 3079 3080 Closes #7351 3081 Closes #7339 3082 Closes #7125 3083 3084Marc Hoersken (27 Jul 2021) 3085- CI/azure: reduce compile time with increased parallism 3086 3087 Azure Pipelines CI VMs have 2 CPUs, let's use them. 3088 3089 Closes #7489 3090 3091Jay Satiro (27 Jul 2021) 3092- [Josh Soref brought this change] 3093 3094 docs: fix grammar 3095 3096 Fixes https://github.com/curl/curl/issues/7444 3097 Fixes https://github.com/curl/curl/issues/7451 3098 Fixes https://github.com/curl/curl/issues/7465 3099 Closes https://github.com/curl/curl/pull/7495 3100 3101- mail-rcpt.d: fix grammar 3102 3103 Remove confusing sentence that says to specify an e-mail address for 3104 mail transfer, since that's implied. 3105 3106 Reported-by: Josh Soref 3107 3108 Fixes https://github.com/curl/curl/issues/7452 3109 Closes https://github.com/curl/curl/pull/7495 3110 3111Daniel Stenberg (27 Jul 2021) 3112- c-hyper: remove the hyper_executor_poll() loop from Curl_http 3113 3114 1. it's superfluous 3115 2. it didn't work identically to the Curl_hyper_stream one which could 3116 cause problems like #7486 3117 3118 Pointed-out-by: David Cook 3119 Closes #7499 3120 3121- curl-openssl.m4: check lib64 for the pkg-config file 3122 3123 OpenSSL recently started putting the libs in $prefix/lib64 on 'make 3124 install', so we check that directory for pkg-config data if the 'lib' 3125 check fails. 3126 3127 Closes #7503 3128 3129- CURLOPT_SSL_CTX_*.3: tidy up the example 3130 3131 Use the proper code style. Don't store return codes that aren't read. 3132 Copy the same example into CURLOPT_SSL_CTX_FUNCTION.3 as well. 3133 3134 Closes #7500 3135 3136- example/cookie_interface: fix scan-build printf warning 3137 3138 Follow-up to 4b79c4fb565 3139 3140 Fixes #7497 3141 Closes #7498 3142 3143- [Josh Soref brought this change] 3144 3145 limit-rate.d: clarify base unit 3146 3147 Fixes #7439 3148 Closes #7494 3149 3150- [Carlo Marcelo Arenas Belón brought this change] 3151 3152 examples/cookie_interface: avoid printfing time_t directly 3153 3154 time_t representation is undefined and varies on bitsize and signedness, 3155 and as of C11 could be even non integer. 3156 3157 instead of casting to unsigned long (which would truncate in systems 3158 with a 32bit long after 2106) use difftime to get the elapsed time as a 3159 double and print that (without decimals) instead. 3160 3161 alternatively a cast to curl_off_t and its corresponding print 3162 formatting could have been used (at least in POSIX) but portability and 3163 curl agnostic code was prioritized. 3164 3165 Closes #7490 3166 3167Marc Hoersken (25 Jul 2021) 3168- tests/servers: remove obsolete pid variable 3169 3170 Variable is not used since pidfile handling moved to util.[ch] 3171 3172 Reviewed-by: Jay Satiro 3173 Closes #7482 3174 3175- tests/servers: use our platform-aware pid for server verification 3176 3177 The pid used for server verification is later stored as pid2 in 3178 the hash of running test servers and therefore used for shutdown. 3179 3180 The pid used for shutdown must be the platform-aware (Win32) pid 3181 to avoid leaking test servers while running them using Cygwin/msys. 3182 3183 Reviewed-by: Jay Satiro 3184 Closes #7481 3185 3186- tests/runtests.pl: cleanup copy&paste mistakes and unused code 3187 3188 Reviewed-by: Jay Satiro 3189 Part of #7481 3190 3191Daniel Stenberg (25 Jul 2021) 3192- RELEASE-NOTES: synced 3193 3194 bumped to 7.78.1 for next release 3195 3196- http_proxy: clear 'sending' when the outgoing request is sent 3197 3198 ... so that Curl_connect_getsock() will know how to wait for the socket 3199 to become readable and not writable after the entire CONNECT request has 3200 been issued. 3201 3202 Regression added in 7.77.0 3203 3204 Reported-by: zloi-user on github 3205 Assisted-by: Jay Satiro 3206 Fixes #7155 3207 Closes #7484 3208 3209Jay Satiro (25 Jul 2021) 3210- [Josh Soref brought this change] 3211 3212 openssl: fix grammar 3213 3214 Closes https://github.com/curl/curl/pull/7480 3215 3216- configure.ac: tweak nghttp2 library name fix again 3217 3218 - Change extraction to handle multiple library names returned by 3219 pkg-config (eg a possible scenario with pkg-config --static). 3220 3221 Ref: https://github.com/curl/curl/pull/7472 3222 3223 Closes https://github.com/curl/curl/pull/7485 3224 3225Dan Fandrich (23 Jul 2021) 3226- Get rid of the unused HAVE_SIG_ATOMIC_T et. al. 3227 3228 It was added in 2006 but I see no evidence it was ever used. 3229 3230Jay Satiro (23 Jul 2021) 3231- docs: change max-filesize caveat again 3232 3233 - Add protocols field to max-filesize.d. 3234 3235 - Revert wording on unknown file size caveat and do not discuss specific 3236 protocols in that section. 3237 3238 Partial revert of ecf0225. All max-filesize options now have the list of 3239 protocols and it's clearer just to have that list without discussing 3240 specific protocols in the caveat. 3241 3242 Reported-by: Josh Soref 3243 3244 Ref: https://github.com/curl/curl/issues/7453#issuecomment-884128762 3245 3246Daniel Stenberg (22 Jul 2021) 3247- [Christian Weisgerber brought this change] 3248 3249 configure: tweak nghttp2 library name fix 3250 3251 commit 29c7cf79e8b44cf (shipped in 7.78.0) introduced a problem by 3252 assuming that LIB_H2 does not have any leading whitespace. At least 3253 OpenBSD's native pkg-config can produce such whitespace, though: 3254 3255 $ pkg-config --libs-only-l libnghttp2 3256 -lnghttp2 3257 3258 As a result, the configure check for libnghttp2 will erroneously fail. 3259 3260 Bug: https://curl.se/mail/lib-2021-07/0050.html 3261 Closes #7472 3262 3263- [Bastian Krause brought this change] 3264 3265 docs/MQTT: update state of username/password support 3266 3267 PR #7243 implemented username/password support for MQTT, so let's drop 3268 these items from the caveats. 3269 3270 Signed-off-by: Bastian Krause <bst@pengutronix.de> 3271 3272 Closes #7474 3273 3274- [Oleg Pudeyev brought this change] 3275 3276 CURLMOPT_TIMERFUNCTION.3: remove misplaced "time" 3277 3278 Closes #7470 3279 3280Version 7.78.0 (21 Jul 2021) 3281 3282Daniel Stenberg (21 Jul 2021) 3283- RELEASE-NOTES: synced 3284 3285 curl 7.78.0 release 3286 3287- winbuild/MakefileBuild.vc: bump copyright year 3288 3289Jay Satiro (21 Jul 2021) 3290- docs: mention max-filesize options also apply to MQTT transfers 3291 3292 Also make it clearer that the caveat 'if the file size is unknown it 3293 the option will have no effect' may apply to protocols other than FTP 3294 and HTTP. 3295 3296 Reported-by: Josh Soref 3297 3298 Fixes https://github.com/curl/curl/issues/7453 3299 3300- [Josh Soref brought this change] 3301 3302 docs/cmdline: fix grammar and typos 3303 3304- [Josh Soref brought this change] 3305 3306 dump-header.d: Drop suggestion to use for cookie storage 3307 3308 Since --cookie-jar is the preferred way to store cookies, no longer 3309 suggest using --dump-header to do so. 3310 3311 Co-authored-by: Daniel Stenberg 3312 3313 Closes https://github.com/curl/curl/issues/7414 3314 3315- [Josh Soref brought this change] 3316 3317 doc/cmdline: fix grammar and typos 3318 3319 Closes https://github.com/curl/curl/pull/7454 3320 Closes https://github.com/curl/curl/pull/7455 3321 Closes https://github.com/curl/curl/pull/7456 3322 Closes https://github.com/curl/curl/pull/7459 3323 Closes https://github.com/curl/curl/pull/7460 3324 Closes https://github.com/curl/curl/pull/7461 3325 Closes https://github.com/curl/curl/pull/7462 3326 Closes https://github.com/curl/curl/pull/7463 3327 3328Daniel Stenberg (20 Jul 2021) 3329- vtls: fix connection reuse checks for issuer cert and case sensitivity 3330 3331 CVE-2021-22924 3332 3333 Reported-by: Harry Sintonen 3334 Bug: https://curl.se/docs/CVE-2021-22924.html 3335 3336- sectransp: check for client certs by name first, then file 3337 3338 CVE-2021-22926 3339 3340 Bug: https://curl.se/docs/CVE-2021-22926.html 3341 3342 Assisted-by: Daniel Gustafsson 3343 Reported-by: Harry Sintonen 3344 3345- telnet: fix option parser to not send uninitialized contents 3346 3347 CVS-2021-22925 3348 3349 Reported-by: Red Hat Product Security 3350 Bug: https://curl.se/docs/CVE-2021-22925.html 3351 3352Jay Satiro (20 Jul 2021) 3353- connect: fix wrong format specifier in connect error string 3354 3355 0842175 (not in any release) used the wrong format specifier (long int) 3356 for timediff_t. On an OS such as Windows libcurl's timediff_t (usually 3357 64-bit) is bigger than long int (32-bit). In 32-bit Windows builds the 3358 upper 32-bits of the timediff_t were erroneously then used by the next 3359 format specifier. Usually since the timeout isn't larger than 32-bits 3360 this would result in null as a pointer to the string with the reason for 3361 the connection failing. On other OSes or maybe other compilers it could 3362 probably result in garbage values (ie crash on deref). 3363 3364 Before: 3365 Failed to connect to localhost port 12345 after 1201 ms: (nil) 3366 3367 After: 3368 Failed to connect to localhost port 12345 after 1203 ms: Connection refused 3369 3370 Closes https://github.com/curl/curl/pull/7449 3371 3372- winbuild: support alternate nghttp2 static lib name 3373 3374 - Support both nghttp2.lib and nghttp2_static.lib for static nghttp2. 3375 3376 nghttp2 briefly changed its static lib name to nghttp2_static, but then 3377 made the _static suffix optional. 3378 3379 Ref: https://github.com/nghttp2/nghttp2/pull/1394 3380 Ref: https://github.com/nghttp2/nghttp2/pull/1418 3381 Ref: https://github.com/nghttp2/nghttp2/issues/1466 3382 3383 Reported-by: Pierre Yager 3384 3385 Fixes https://github.com/curl/curl/issues/7446 3386 Closes https://github.com/curl/curl/pull/7447 3387 3388- [Josh Soref brought this change] 3389 3390 docs/cmdline: fix grammar and typos 3391 3392 Closes https://github.com/curl/curl/pull/7432 3393 Closes https://github.com/curl/curl/pull/7436 3394 Closes https://github.com/curl/curl/pull/7438 3395 Closes https://github.com/curl/curl/pull/7440 3396 Closes https://github.com/curl/curl/pull/7445 3397 3398- [Josh Soref brought this change] 3399 3400 delegation.d: mention what happens when used multiple times 3401 3402 Closes https://github.com/curl/curl/pull/7408 3403 3404- [Josh Soref brought this change] 3405 3406 create-file-mode.d: mention what happens when used multiple times 3407 3408 Closes https://github.com/curl/curl/pull/7407 3409 3410- [Josh Soref brought this change] 3411 3412 config.d: split comments and option-per line 3413 3414 Closes https://github.com/curl/curl/pull/7405 3415 3416Daniel Stenberg (19 Jul 2021) 3417- misc: copyright year range updates 3418 3419- mailmap: add Tobias and Timur 3420 3421Daniel Gustafsson (18 Jul 2021) 3422- [Josh Soref brought this change] 3423 3424 docs: spell out directories instead of dirs in create-dirs 3425 3426 Write out directories rather than using the dirs abbrevation. Also 3427 use plural form consistently, even if the code in the end might just 3428 create a single directory. 3429 3430 Closes #7406 3431 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 3432 Reviewed-by: Daniel Gustafsson <daniel@yesql.se> 3433 3434- [Tobias Nyholm brought this change] 3435 3436 docs: correct spelling errors and a broken link 3437 3438 Update grammar and spelling in docs and source code comments. 3439 3440 Closes: #7427 3441 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 3442 3443Marc Hoersken (18 Jul 2021) 3444- CI/cirrus: install impacket from PyPI instead of FreeBSD packages 3445 3446 Availability of impacket as FreeBSD package is too flaky. 3447 3448 Stick to legacy version of cryptography which still 3449 supports OpenSSL version 1.0.2 due to FreeBSD 11. 3450 3451 Reviewed-by: Daniel Stenberg 3452 3453 Closes #7418 3454 3455Daniel Stenberg (18 Jul 2021) 3456- [Josh Soref brought this change] 3457 3458 docs/cmdline: mention what happens when used multiple times 3459 3460 For --dns-ipv4-addr, --dns-ipv6-addr and --dns-servers 3461 3462 Closes #7410 3463 Closes #7411 3464 Closes #7412 3465 3466- [Michał Antoniak brought this change] 3467 3468 lib: fix compiler warnings with CURL_DISABLE_NETRC 3469 3470 warning C4189: 'netrc_user_changed': local variable is initialized but 3471 not referenced 3472 3473 warning C4189: 'netrc_passwd_changed': local variable is initialized but 3474 not referenced 3475 3476 Closes #7423 3477 3478- disable-epsv.d: remove duplicate "(FTP)" 3479 3480 ... since the tooling adds that to the output based on the "Protocols:" 3481 tag. 3482 3483- [Max Zettlmeißl brought this change] 3484 3485 docs: make the documentation for --etag-save match the program behaviour 3486 3487 When using curl with the option `--etag-save` I expected it to save the 3488 ETag without its surrounding quotes, as stated by the documentation in 3489 the repository and by the generated man pages. 3490 3491 My first endeavour was to fix the program, but while investigating the 3492 history of the relevant parts, I discovered that curl once saved the 3493 ETag without the quotes. This was undone by Daniel Stenberg in commit 3494 `98c94596f5928840177b6bd3c7b0f0dd03a431af`, therefore I decided that in 3495 this case the documentation should be adjusted to match the behaviour of 3496 curl. 3497 3498 The changed save behaviour also made parts of the `--etag-compare` 3499 documentation wrong or superfluous, so I adjusted those accordingly. 3500 3501 Closes #7429 3502 3503- [Josh Soref brought this change] 3504 3505 write-out.d: add missing periods 3506 3507 Closes #7404 3508 3509- [Josie Huddleston brought this change] 3510 3511 easy: during upkeep, attach Curl_easy to connections in the cache 3512 3513 During the protocol-specific parts of connection upkeep, some code 3514 assumes that the data->conn pointer already is set correctly. However, 3515 there's currently no guarantee of that in the code. 3516 3517 This fix temporarily attaches each connection to the Curl_easy object 3518 before performing the protocol-specific connection check on it, in a 3519 similar manner to the connection checking in extract_if_dead(). 3520 3521 Fixes #7386 3522 Closes #7387 3523 Reported-by: Josie Huddleston 3524 3525- [Josh Soref brought this change] 3526 3527 cleanup: spell DoH with a lowercase o 3528 3529 Signed-off-by: Josh Soref <jsoref@users.noreply.github.com> 3530 3531 Closes #7413 3532 3533- [Josh Soref brought this change] 3534 3535 TheArtOfHttpScripting: polish 3536 3537 - add missing backticks and comma 3538 3539 - fix proxy description: 3540 3541 * example proxy isn't local 3542 * locally doesn't really make sense 3543 3544 Closes #7416 3545 3546- [Josh Soref brought this change] 3547 3548 form.d: add examples of `,`/`;` for file[name] 3549 3550 Fixes #7415 3551 Closes #7417 3552 3553- [Michał Antoniak brought this change] 3554 3555 mbedtls: Remove unnecessary include 3556 3557 - curl_setup.h: all references to mbedtls_md4* functions and structures 3558 are in the md4.c. This file already includes the <mbedtls/md4.h> file 3559 along with the file existence control (defined (MBEDTLS_MD4_C)) 3560 3561 - curl_ntlm_core.c: unnecessary include - repeated below 3562 3563 Closes #7419 3564 3565- RELEASE-NOTES: synced 3566 3567Jay Satiro (16 Jul 2021) 3568- [User Sg brought this change] 3569 3570 multi: fix crash in curl_multi_wait / curl_multi_poll 3571 3572 Appears to have been caused by 51c0ebc (precedes 7.77.0) which added a 3573 VALID_SOCK check to one of the loops through the sockets but not the 3574 other. 3575 3576 Reported-by: sylgal@users.noreply.github.com 3577 Authored-by: sylgal@users.noreply.github.com 3578 3579 Fixes https://github.com/curl/curl/issues/7379 3580 Closes https://github.com/curl/curl/pull/7389 3581 3582- [Daniel Gustafsson brought this change] 3583 3584 tool_help: remove unused define 3585 3586 The PRINT_LINES_PAUSE macro is no longer used, and has been mostly 3587 cleaned out but one occurrence remained. 3588 3589 Closes https://github.com/curl/curl/pull/7380 3590 3591- [Sergey Markelov brought this change] 3592 3593 build: fix compiler warnings when CURL_DISABLE_VERBOSE_STRINGS 3594 3595 fix compiler warnings about unused variables and parameters when 3596 built with --disable-verbose. 3597 3598 Closes https://github.com/curl/curl/pull/7377 3599 3600- [Andrea Pappacoda brought this change] 3601 3602 build: fix IoctlSocket FIONBIO check 3603 3604 Prior to this change HAVE_IOCTLSOCKET_CAMEL_FIONBIO mistakenly checked 3605 for (lowercase) ioctlsocket when it should have checked for IoctlSocket. 3606 3607 Closes https://github.com/curl/curl/pull/7375 3608 3609- [Timur Artikov brought this change] 3610 3611 configure: fix nghttp2 library name for static builds 3612 3613 Don't hardcode the nghttp2 library name, 3614 because it can vary, be "nghttp2_static" for example. 3615 3616 Fixes https://github.com/curl/curl/issues/7367 3617 Closes https://github.com/curl/curl/pull/7368 3618 3619Gisle Vanem (16 Jul 2021) 3620- [PellesC] fix _lseeki64() macro 3621 3622- [SChannel] Use '_tcsncmp()' instead 3623 3624 Revert previous change for PellesC. 3625 3626 Instead replace all use of `_tcsnccmp()` with `_tcsncmp()`. 3627 3628- [PellesC] missing '_tcsnccmp' 3629 3630 PellesC compiler does not have this macro in it's `<tchar.h>` 3631 3632Daniel Gustafsson (14 Jul 2021) 3633- TODO: add mention of mbedTLS 3 incompatibilities 3634 3635 Wyatt OʼDay reported in #7385 that mbedTLS isn't backwards compatible 3636 and curl no longer builds with it. Document the need to fix our support 3637 until so has been done. 3638 3639 Closes #7390 3640 Fixes #7385 3641 Reported-by: Wyatt OʼDay 3642 Reviewed-by: Jay Satiro <raysatiro@yahoo.com> 3643 3644- docs: fix inconsistencies in EGDSOCKET documentation 3645 3646 Only the OpenSSL backend actually use the EGDSOCKET, and also use 3647 TLS consistently rather than mixing SSL and TLS. While there, also 3648 fix a minor spelling nit. 3649 3650 Closes: #7391 3651 Reviewed-by: Jay Satiro <raysatiro@yahoo.com> 3652 3653- [Борис Верховский brought this change] 3654 3655 docs: document missing arguments to commands 3656 3657 This is a followup to commit f410b9e538129e77607fef1 fixing a few 3658 more commands which takes arguments. 3659 3660 Closes #7382 3661 Reviewed-by: Daniel Gustafsson <daniel@yesql.se> 3662 3663- [Randolf J brought this change] 3664 3665 docs: fix incorrect argument name reference 3666 3667 The documentation for the read callback was erroneously referencing 3668 the nitems argument by nmemb. The error was introduced in commit 3669 ce0881edee3c7. 3670 3671 Closes #7383 3672 Reviewed-by: Daniel Gustafsson <daniel@yesql.se> 3673 3674- [Борис Верховский brought this change] 3675 3676 tool_help: Document that --tlspassword takes a password 3677 3678 Closes #7378 3679 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 3680 3681- scripts: Fix typo in release-notes instructions 3682 3683 The command to run had a typo in the pathname which prevented copy 3684 pasting it to work, which has annoyed me enough to fix this now. 3685 3686- RELEASE-NOTES: synced 3687 3688Jay Satiro (10 Jul 2021) 3689- write-out.d: Clarify urlnum is not unique for de-globbed URLs 3690 3691 Reported-by: Коваленко Анатолий Викторович 3692 3693 Fixes https://github.com/curl/curl/issues/7342 3694 Closes https://github.com/curl/curl/pull/7369 3695 3696Daniel Gustafsson (3 Jul 2021) 3697- [William Desportes brought this change] 3698 3699 docs: Fix typos 3700 3701 Closes: #7370 3702 Reviewed-by: Daniel Gustafsson <daniel@yesql.se> 3703 3704Daniel Stenberg (8 Jul 2021) 3705- [Jonathan Wernberg brought this change] 3706 3707 Revert "ftp: Expression 'ftpc->wait_data_conn' is always false" 3708 3709 The reverted commit introduced a logic error in code that was 3710 correct. 3711 3712 The client using libcurl would notice the error since FTP file 3713 uploads in active transfer mode would somtimes complete with 3714 success despite no transfer having been performed and the 3715 "uploaded" file thus not being on the remote server afterwards. 3716 3717 The FTP server would notice the error because it receives a 3718 RST on the data connection it has established with the client 3719 before any data was transferred at all. 3720 3721 The logic error happens if the STOR response from the server have 3722 arrived by the time ftp_multi_statemach() in the affected code path 3723 is called, but the incoming data connection have not arrived yet. 3724 In that case, the processing of the STOR response will cause 3725 'ftpc->wait_data_conn' to be set to TRUE, contradicting the comment 3726 in the code. Since 'complete' will also be set, later logic would 3727 believe the transfer was done. 3728 3729 In most cases, the STOR response will not have arrived yet when 3730 the affected code path is executed, or the incoming connection will 3731 also have arrived, and thus the error would not express itself. 3732 But if the speed difference of the device using libcurl and the 3733 FTP server is exactly right, the error may happen as often as in 3734 one out of hundred file transfers. 3735 3736 This reverts commit 49f3117a238b6eac0e22a32f50699a9eddcb66ab. 3737 3738 Bug: https://curl.se/mail/lib-2021-07/0025.html 3739 Closes #7362 3740 3741- msnprintf: return number of printed characters excluding null byte 3742 3743 ... even when the output is "capped" by the maximum length argument. 3744 3745 Clarified in the docs. 3746 3747 Closes #7361 3748 3749- infof: remove newline from format strings, always append it 3750 3751 - the data needs to be "line-based" anyway since it's also passed to the 3752 debug callback/application 3753 3754 - it makes infof() work like failf() and consistency is good 3755 3756 - there's an assert that triggers on newlines in the format string 3757 3758 - Also removes a few instances of "..." 3759 3760 - Removes the code that would append "..." to the end of the data *iff* 3761 it was truncated in infof() 3762 3763 Closes #7357 3764 3765- examples/multi-single: fix scan-build warning 3766 3767 warning: Value stored to 'mc' during its initialization is never read 3768 3769 Follow-up to ae8e11ed5fd2ce 3770 3771 Closes #7360 3772 3773- wolfssl: failing to set a session id is not reason to error out 3774 3775 ... as it is *probably* just timed out. 3776 3777 Reported-by: Francisco Munoz 3778 3779 Closes #7358 3780 3781- docs/examples: use curl_multi_poll() in multi examples 3782 3783 The API is soon two years old and deserves being shown as the primary 3784 way to drive multi code as it makes it much easier to write code. 3785 3786 multi-poll: removed 3787 3788 multi-legacy: add to show how we did multi API use before 3789 curl_multi_wait/poll. 3790 3791 Closes #7352 3792 3793- KNOWN_BUGS: flaky Windows CI builds 3794 3795 Closes #6972 3796 3797- RELEASE-NOTES: synced 3798 3799- test1147: hyper doesn't allow "crazy" request headers like built-in 3800 3801 ... so strip that from the test. 3802 3803 Closes #7349 3804 3805- c-hyper: bail on too long response headers 3806 3807 To match with built-in behaviors. Makes test 1154 work. 3808 3809 Closes #7350 3810 3811- test1151: added missing CRLF to work with hyper 3812 3813 Closes #7350 3814 3815- c-hyper: add support for transfer-encoding in the request 3816 3817 Closes #7348 3818 3819- [Andrea Pappacoda brought this change] 3820 3821 cmake: remove libssh2 feature checks 3822 3823 libssh2 features are detected based on version since commit 3824 9dbbba997608f7c3c5de1c627c77c8cd2aa85b73 3825 3826 Closes #7343 3827 3828- test1116: hyper doesn't pass through "surprise-trailers" 3829 3830 Closes #7344 3831 3832- socks4: scan for the IPv4 address in resolve results 3833 3834 Follow-up to 84d2839740 which changed the resolving to always resolve 3835 both address families, but since SOCKS4 only supports IPv4 it should 3836 scan for and use the first available IPv4 address. 3837 3838 Reported-by: shithappens2016 on github 3839 Fixes #7345 3840 Closes #7346 3841 3842Jay Satiro (5 Jul 2021) 3843- proto.d: fix formatting for paragraphs after margin changes 3844 3845 Closes https://github.com/curl/curl/pull/7341 3846 3847- pinnedpubkey.d: fix formatting for version support lists 3848 3849 Closes https://github.com/curl/curl/pull/7340 3850 3851Daniel Stenberg (2 Jul 2021) 3852- TODO: "Support in-memory certs/ca certs/keys" done 3853 3854 Has been suppored for a while now with the *BLOB options. 3855 3856- examples: safer and more proper read callback logic 3857 3858 The same callback code is used in: 3859 3860 imap-append.c 3861 smtp-authzid.c 3862 smtp-mail.c 3863 smtp-multi.c 3864 smtp-ssl.c 3865 smtp-tls.c 3866 3867 It should not assume that it can copy full lines into the buffer as it 3868 will encourage sloppy coding practices. Instead use byte-wise logic and 3869 check/acknowledge the buffer size appropriately. 3870 3871 Reported-by: Harry Sintonen 3872 Fixes #7330 3873 Closes #7331 3874 3875- test1519: adjusted to work with hyper 3876 3877 Closes #7333 3878 3879- test1518: adjusted to work with hyper 3880 3881 ... by making sure the stdout output doesn't look like HTTP headers. 3882 3883 Closes #7333 3884 3885- test1514: add a CRLF to the response to make it correct 3886 3887 Makes hyper accept it fine instead returning HYPERE_UNEXPECTED_EOF on 3888 us. 3889 3890 Closes #7334 3891 3892- formdata: avoid "Argument cannot be negative" warning 3893 3894 ... when converting a curl_off_t to size_t, by using 3895 CURL_ZERO_TERMINATED before passing the argument to the function. 3896 3897 Detected by Coverity CID 1486590. 3898 3899 Closes #7328 3900 Assisted-by: Daniel Gustafsson 3901 3902- lib: more %u for port and int for %*s fixes 3903 3904 Detected by Coverity 3905 3906 Closes #7329 3907 3908- doh: (void)-prefix call to curl_easy_setopt 3909 3910- lib: fix type of len passed to *printf's %*s 3911 3912 ... it needs to be 'int'. Detected by Coverity CID 1486611 (etc) 3913 3914 Closes #7326 3915 3916- lib: use %u instead of %ld for port number printf 3917 3918 Follow-up to 764c6bd3bf which changed the type of some port number 3919 fields. Detected by Coverity (CID 1486624) etc. 3920 3921 Closes #7325 3922 3923- version: turn version number functions into returning void 3924 3925 ... as we never use the return codes from them. 3926 3927 Reviewed-by: Daniel Gustafsson 3928 Closes #7319 3929 3930- mqtt: extend the error message for no topic 3931 3932 ... and mention that it needs URL encoding. 3933 3934 Reported-by: Peter Körner 3935 Fixes #7316 3936 Closes #7317 3937 3938- formdata: correct typecast in curl_mime_data call 3939 3940 Coverity pointed out it the mismatch. CID 1486590 3941 3942 Closes #7327 3943 3944- url: (void)-prefix a curl_url_get() call 3945 3946 Coverity (CID 1486645) pointed out a use of curl_url_get() in the 3947 parse_proxy function where the return code wasn't checked. A 3948 (void)-prefix makes the intention obvious. 3949 3950 Closes #7320 3951 3952- glob: pass an 'int' as len when using printf's %*s 3953 3954 Detected by Coverity CID 1486629. 3955 3956 Closes #7324 3957 3958- vtls: use free() not curl_free() 3959 3960 curl_free() is provided for users of the API to free returned data, 3961 there's no need to use it internally. 3962 3963 Closes #7318 3964 3965- zuul: use the new rustls directory name 3966 3967 Follow-up to 6d972c8b1cbb3 which missed updating this directory name. 3968 3969 Also no longer call it crustls in the docs and bump to rusttls-ffi 0.7.1 3970 3971 Closes #7311 3972 3973Jay Satiro (29 Jun 2021) 3974- http: fix crash in rate-limited upload 3975 3976 - Don't set the size of the piece of data to send to the rate limit if 3977 that limit is larger than the buffer size that will hold the piece. 3978 3979 Prior to this change if CURLOPT_MAX_SEND_SPEED_LARGE 3980 (curl tool: --limit-rate) was set then it was possible that a temporary 3981 buffer used for uploading could be written to out of bounds. A likely 3982 scenario for this would be a non-trivial amount of post data combined 3983 with a rate limit larger than CURLOPT_UPLOAD_BUFFERSIZE (default 64k). 3984 3985 The bug was introduced in 24e469f which is in releases since 7.76.0. 3986 3987 perl -e "print '0' x 200000" > tmp 3988 curl --limit-rate 128k -d @tmp httpbin.org/post 3989 3990 Reported-by: Richard Marion 3991 3992 Fixes https://github.com/curl/curl/issues/7308 3993 Closes https://github.com/curl/curl/pull/7315 3994 3995Daniel Stenberg (29 Jun 2021) 3996- copyright: add boiler-plate headers to CI config files 3997 3998 And whitelist .zuul.ignore 3999 4000 Closes #7314 4001 4002- CI: remove travis details 4003 4004 Rename still used leftovers to "zuul" as that's now the CI using them. 4005 4006 Closes #7313 4007 4008- RELEASE-NOTES: synced 4009 4010- openssl: avoid static variable for seed flag 4011 4012 Avoid the race condition risk by instead storing the "seeded" flag in 4013 the multi handle. Modern OpenSSL versions handle the seeding itself so 4014 doing the seeding once per multi-handle instead of once per process is 4015 less of an issue. 4016 4017 Reported-by: Gerrit Renker 4018 Fixes #7296 4019 Closes #7306 4020 4021- configure: inhibit the implicit-fallthrough warning on gcc-12 4022 4023 ... since it no longer acknowledges the comment markup we use for that 4024 purpose. 4025 4026 Reported-by: Younes El-karama 4027 Fixes #7295 4028 Closes #7307 4029 4030Daniel Gustafsson (28 Jun 2021) 4031- [Andrei Rybak brought this change] 4032 4033 misc: fix typos in comments which repeat a word 4034 4035 Fix typos in code comments which repeat various words. In trivial 4036 cases, just delete the repeated word. Reword the affected sentence in 4037 "lib/url.c" for it to make sense. 4038 4039 Closes #7303 4040 Reviewed-by: Daniel Gustafsson <daniel@yesql.se> 4041 4042Daniel Stenberg (27 Jun 2021) 4043- lib677: make it survive torture testing 4044 4045 Follow-up to a5ab72d5edd7 4046 4047 Closes #7300 4048 4049- [Tommy Chiang brought this change] 4050 4051 docs/BINDINGS: fix outdated links 4052 4053 * luacurl page is now not accessible, fix it with wayback machine page 4054 * Scheme one seems not providing https now, change it back to http one 4055 4056 Closes #7301 4057 4058- [Jacob Hoffman-Andrews brought this change] 4059 4060 curstls: bump crustls version and use new URL 4061 4062 crustls moved to https://github.com/rustls/rustls-ffi. This also bumps 4063 the expected version to 0.7.0. 4064 4065 Closes #7297 4066 4067- RELEASE-NOTES: synced 4068 4069- examples: length-limit two sscanf() uses of %s 4070 4071 Reported-by: Jishan Shaikh 4072 Fixes #7293 4073 Closes #7294 4074 4075- [Richard Whitehouse brought this change] 4076 4077 multi: alter transfer timeout ordering 4078 4079 - Check whether a connection has succeded before checking whether it's 4080 timed out. 4081 4082 This means if we've connected quickly, but subsequently been 4083 descheduled, we allow the connection to succeed. Note, if we timeout, 4084 but between checking the timeout, and connecting to the server the 4085 connection succeeds, we will allow it to go ahead. This is viewed as 4086 an acceptable trade off. 4087 4088 - Add additional failf logging around failed connection attempts to 4089 propogate the cause up to the caller. 4090 4091 Co-Authored-by: Martin Howarth 4092 Closes #7178 4093 4094- test677: IMAP CONNECT_ONLY, custom command and then exit 4095 4096 Adjusted ftpserver.pl to add support for the IMAP IDLE command 4097 4098 Adjusted test 660 to sync with the fix 4099 4100- multi: do not switch off connect_only flag when closing 4101 4102 ... as it made protocol specific disconnect commands wrongly get used. 4103 4104 Bug: https://curl.se/mail/lib-2021-06/0024.html 4105 Reported-by: Aleksander Mazur 4106 Closes #7288 4107 4108- http: make the haproxy support work with unix domain sockets 4109 4110 ... it should then pass on "PROXY UNKNOWN" since it doesn't know the 4111 involved IP addresses. 4112 4113 Reported-by: Valentín Gutiérrez 4114 Fixes #7290 4115 Closes #7291 4116 4117- [Xiang Xiao brought this change] 4118 4119 curl.h: include sys/select.h for NuttX RTOS 4120 4121 Closes #7287 4122 4123- [Bin Meng brought this change] 4124 4125 curl.h: remove the execution bit 4126 4127 The execution bit of curl.h file was wrongly added: 4128 4129 commit 2621025d6f96 ("curl.h: <sys/select.h> is supported by VxWorks7") 4130 4131 and should be removed. 4132 4133 Follow-up to 2621025d6f96 ("curl.h: <sys/select.h> is supported by VxWorks7") 4134 Signed-off-by: Bin Meng <bmeng.cn@gmail.com> 4135 Closes #7286 4136 4137- [Bin Lan brought this change] 4138 4139 curl.h: <sys/select.h> is supported by VxWorks7 4140 4141 Closes #7285 4142 4143- [Bachue Zhou brought this change] 4144 4145 quiche: use send() instead of sendto() to avoid macOS issue 4146 4147 sendto() always returns "Socket is already connected" error on macos 4148 4149 Closes #7260 4150 4151- [Li Xinwei brought this change] 4152 4153 cmake: fix support for UnixSockets feature on Win32 4154 4155 Move the definition of sockaddr_un struct from config-win32.h to 4156 curl_setup.h, so that it could be shared by all build systems. 4157 4158 Add ADDRESS_FAMILY typedef for old mingw, now old mingw can also use 4159 unix sockets. 4160 4161 Also fix the build of tests/server/sws.c on Win32 when USE_UNIX_SOCKETS 4162 is defined. 4163 4164 Closes #7034 4165 4166- [Gregory Muchka brought this change] 4167 4168 hostip: (macOS) free returned memory of SCDynamicStoreCopyProxies 4169 4170 From Apples documentation on SCDynamicStoreCopyProxies, "Return Value: A 4171 dictionary of key-value pairs that represent the current internet proxy 4172 settings, or NULL if no proxy settings have been defined or if an error 4173 occurred. You must release the returned value." 4174 4175 Failure to release the returned value of SCDynamicStoreCopyProxies can 4176 result in a memory leak. 4177 4178 Source: https://developer.apple.com/documentation/systemconfiguration/1517088-scdynamicstorecopyproxies 4179 4180 Closes #7265 4181 4182- RELEASE-NOTES: synced 4183 4184Jay Satiro (21 Jun 2021) 4185- vtls: fix warning due to function prototype mismatch 4186 4187 b09c8ee changed the function prototype. Caught by Visual Studio. 4188 4189- curl_multibyte: Remove local encoding fallbacks 4190 4191 - If the UTF-8 to UTF-16 conversion fails in Windows Unicode builds then 4192 no longer fall back to assuming the string is in a local encoding. 4193 4194 Background: 4195 4196 Some functions in Windows Unicode builds must convert UTF-8 to UTF-16 to 4197 pass to the Windows CRT API wide-character functions since in Windows 4198 UTF-8 is not a valid locale (or at least 99% of the time right now). 4199 4200 Prior to this change if the Unicode encoding conversion failed then 4201 libcurl would assume, for backwards compatibility with applications that 4202 may have written their code for non-Unicode builds, attempt to convert 4203 the string from local encoding to UTF-16. 4204 4205 That type of "best effort" could theoretically cause some type of 4206 security or other problem if a string that was locally encoded was also 4207 valid UTF-8, and therefore an unexpected UTF-8 to UTF-16 conversion 4208 could occur. 4209 4210 Ref: https://github.com/curl/curl/pull/7246 4211 4212 Closes https://github.com/curl/curl/pull/7257 4213 4214Daniel Stenberg (20 Jun 2021) 4215- curl_endian: remove the unused Curl_write64_le function 4216 4217 The last usage was removed in cca455a36 4218 4219 Closes #7280 4220 4221- vtls: only store TIMER_APPCONNECT for non-proxy connect 4222 4223 Introducing a 'isproxy' argument to the connect function so that it 4224 knows wether to store the time stamp or not. 4225 4226 Reported-by: Yongkang Huang 4227 Fixes #7274 4228 Closes #7274 4229 4230- gnutls: set the preferred TLS versions in correct order 4231 4232 Regression since 781864bedbc57 (curl 7.77.0) 4233 4234 Reported-by: civodul on github 4235 Assisted-by: Nikos Mavrogiannopoulos 4236 Fixes #7277 4237 Closes #7278 4238 4239- [Gergely Nagy brought this change] 4240 4241 configure/cmake: remove checks for unused gethostbyaddr and gethostbyaddr_r 4242 4243 Closes #7276 4244 4245- [Gergely Nagy brought this change] 4246 4247 configure/cmake: remove checks for unused inet_ntoa and inet_ntoa_r 4248 4249 Closes #7276 4250 4251- [Gergely Nagy brought this change] 4252 4253 configure/cmake: remove unused define HAVE_PERROR 4254 4255 Closes #7276 4256 4257- [Gergely Nagy brought this change] 4258 4259 configure: remove unused check for gai_strerror 4260 4261 Closes #7276 4262 4263- [Gergely Nagy brought this change] 4264 4265 configure/cmake: remove unused define HAVE_FREEIFADDRS 4266 4267 Closes #7276 4268 4269- [Gergely Nagy brought this change] 4270 4271 configure/cmake: remove unused define HAVE_FORK 4272 4273 Closes #7276 4274 4275- [Gergely Nagy brought this change] 4276 4277 configure/cmake: remove unused define HAVE_FDOPEN 4278 4279 Closes #7276 4280 4281- [Gergely Nagy brought this change] 4282 4283 configure/cmake: remove checks for unused sgtty.h 4284 4285 Closes #7276 4286 4287- [Gergely Nagy brought this change] 4288 4289 configure/cmake: remove remaining checks for rsa.h 4290 4291 Closes #7276 4292 4293- [Gergely Nagy brought this change] 4294 4295 configure/cmake: remove remaining checks for err.h 4296 4297 Closes #7276 4298 4299- [Gergely Nagy brought this change] 4300 4301 configure/cmake: remove remaining checks for crypto.h 4302 4303 Closes #7276 4304 4305- [Gergely Nagy brought this change] 4306 4307 configure/cmake: remove checks for unused getservbyport_r 4308 4309 Closes #7276 4310 4311- --socks4[a]: clarify where the host name is resolved 4312 4313 Closes #7273 4314 4315- libcurl-security.3: mention file descriptors and forks 4316 4317 ... and move the security report section last. 4318 4319 Reported-by: Harry Sintonen 4320 Closes #7270 4321 4322- [Alex Xu (Hello71) brought this change] 4323 4324 configure.ac: make non-executable 4325 4326 it needs to be processed by autoconf or autoreconf, and doesn't have a 4327 suitable shebang to be directly executed. other projects normally set 4328 configure.ac -x. 4329 4330 Closes #7272 4331 4332- configure: do not strip out debug flags 4333 4334 To allow users to set them when invoking configure without using 4335 --with-debug. 4336 4337 Reported-by: Alex Xu 4338 Fixes #7216 4339 Closes #7267 4340 4341- libssh2: limit time a disconnect can take to 1 second 4342 4343 Closes #7271 4344 4345- TLS: prevent shutdown loops to get stuck 4346 4347 ... by making sure the loops are only allowed to read the shutdown 4348 traffic a limited number of times. 4349 4350 Reported-by: Harry Sintonen 4351 Closes #7271 4352 4353- hyper: propagate errors back up from read callbacks 4354 4355 Makes test 513 work with hyper 4356 4357 Closes #7266 4358 4359- KNOWN_BUGS: Negotiate on Windows fails 4360 4361 Closes #5881 4362 4363- KNOWN_BUGS: renames instead of locking for atomic operations 4364 4365 Closes #6882 4366 Closes #6884 4367 4368- zuul: add two missing CI jobs 4369 4370 ... that were configured, just not run 4371 4372 Closes #7261 4373 4374Viktor Szakats (15 Jun 2021) 4375- idn: fix libidn2 with windows unicode builds 4376 4377 Unicode Windows builds use UTF-8 strings internally in libcurl, 4378 so make sure to call the UTF-8 flavour of the libidn2 API. Also 4379 document that Windows builds with libidn2 and UNICODE do expect 4380 CURLOPT_URL as an UTF-8 string. 4381 4382 Reported-by: dEajL3kA on github 4383 Assisted-by: Jay Satiro 4384 Reviewed-by: Marcel Raad 4385 Closes #7246 4386 Fixes #7228 4387 4388Daniel Stenberg (15 Jun 2021) 4389- curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE 4390 4391 They were never officially allowed and slipped in only due to sloppy 4392 parsing. Spaces (ascii 32) should be correctly encoded (to %20) before 4393 being part of a URL. 4394 4395 The new flag bit CURLU_ALLOW_SPACE when a full URL is set, makes libcurl 4396 allow spaces. 4397 4398 Updated test 1560 to verify. 4399 4400 Closes #7073 4401 4402- RELEASE-NOTES: synced 4403 4404 ... and bump to version 7.78.0 for the next planned release. 4405 4406Jay Satiro (15 Jun 2021) 4407- docs: Remove outdated curl tool limitation 4408 4409 - Document that HTTP/2 multiplexing is supported by the curl tool when 4410 parallel transfers are used. 4411 4412 Supported since 7.66.0 via --parallel, but the doc wasn't updated. 4413 4414 Closes https://github.com/curl/curl/pull/7259 4415 4416- http2: Clarify 'Using HTTP2' verbose message 4417 4418 - Change phrasing from multi-use to multiplexing since the former may 4419 not be as well understood. 4420 4421 Before: * Using HTTP2, server supports multi-use 4422 4423 After: * Using HTTP2, server supports multiplexing 4424 4425 Bug: https://github.com/curl/curl/discussions/7255 4426 Reported-by: David Hu 4427 4428 Closes https://github.com/curl/curl/pull/7258 4429 4430Daniel Stenberg (14 Jun 2021) 4431- winbuild/README: VC should be set to 6 'or larger' 4432 4433 Previously it listed all versions up to 15 (missing 16) but this new 4434 phrasing is more open ended. 4435 4436 Reported-by: Hugh Macdonald 4437 Fixes #7253 4438 Closes #7254 4439 4440- [Jacob Hoffman-Andrews brought this change] 4441 4442 rustls: remove native_roots fallback 4443 4444 For the commandline tool, we expect to be passed 4445 SSL_CONN_CONFIG(CAfile); for library use, the use should pass a set of 4446 trusted roots (like in other TLS backends). 4447 4448 This also removes a dependency on Security.framework when building on 4449 macOS. 4450 4451 Closes #7250 4452 4453- [Albin Vass brought this change] 4454 4455 travis: remove jobs that have migrated to zuul 4456 4457 Closes #7245 4458 4459- [Mohammed Naser brought this change] 4460 4461 CI: add jobs using Zuul 4462 4463 It also includes a few changes to get the builds going: 4464 - Added autoconf to common dependencies 4465 - Added automake to common dependencies 4466 - Added libtool to common dependencies 4467 - Added libssl-dev to common dependencies 4468 4469 Co-authored-by: Albin Vass 4470 4471 Closes #7245 4472 4473- netrc: skip 'macdef' definitions 4474 4475 Add test 494 to verify 4476 4477 Reported-by: Harry Sintonen 4478 Fixes #7238 4479 Closes #7244 4480 4481- multi: add scan-build-6 work-around in curl_multi_fdset 4482 4483 scan-build-6 otherwise warns, saying: warning: The left operand of '>=' 4484 is a garbage value otherwise, which is false. 4485 4486 Later scan-builds don't claim this on the same code. 4487 4488 Closes #7248 4489 4490- asyn-ares: remove check for 'data' in Curl_resolver_cancel 4491 4492 It implied it would survive a NULL in there which it won't. Instead do 4493 an assert. 4494 4495 Pointed out by scan-build. 4496 4497 Closes #7248 4498 4499- url.c: remove two variable assigns that are never read 4500 4501 Pointed out by scan-build 4502 4503 Closes #7248 4504 4505- [Gealber Morales brought this change] 4506 4507 mqtt: add support for username and password 4508 4509 Minor-edits-by: Daniel Stenberg 4510 Added test 2200 to 2205 4511 4512 Closes #7243 4513 4514- travis: remove the arm job 4515 4516 We do it on circle CI instead 4517 4518- CI: add .circleci/config.yml 4519 4520 Assisted-by: Gabriel Simmer 4521 4522 Closes #7239 4523 4524- RELEASE-NOTES: synced 4525 4526- runtests: init $VERSION to avoid warnings when using -l 4527 4528- openssl: don't remove session id entry in disassociate 4529 4530 When a connection is disassociated from a transfer, the Session ID entry 4531 should remain. 4532 4533 Regression since 7f4a9a9 (shipped in libcurl 7.77.0) 4534 Reported-by: Gergely Nagy 4535 Reported-by: Paul Groke 4536 4537 Fixes #7222 4538 Closes #7230 4539 4540- single_transfer: ignore blank --output-dir 4541 4542 ... as otherwise it creates a rather unexpected target directory with a 4543 leading slash. 4544 4545 Reported-by: Harry Sintonen 4546 Fixes #7218 4547 Closes #7233 4548 4549- tests: update README about servers and port numbers 4550 4551 Closes #7242 4552 4553- conn_shutdown: if closed during CONNECT cleanup properly 4554 4555 Reported-by: Alex Xu 4556 Reported-by: Phil E. Taylor 4557 4558 Fixes #7236 4559 Closes #7237 4560 4561- [Christian Weisgerber brought this change] 4562 4563 sws: malloc request struct instead of using stack 4564 4565 ... 2MB requests is otherwise just too big for some systems. 4566 4567 (The allocations are not freed properly.) 4568 4569 Bug: https://curl.se/mail/lib-2021-06/0018.html 4570 4571 Closes #7235 4572 4573- [Mark Swaanenburg brought this change] 4574 4575 lib: don't compare fd to FD_SETSIZE when using poll 4576 4577 FD_SETSIZE is irrelevant when using poll. So ensuring that the file 4578 descriptor is smaller than FD_SETSIZE in VALID_SOCK, can cause 4579 multi_wait to ignore perfectly valid file descriptors and simply wait 4580 for 1s to avoid hammering the CPU in a busy loop. 4581 4582 Fixes #7240 4583 Closes #7241 4584 4585- [zhangxiuhua brought this change] 4586 4587 doh: fix wrong DEBUGASSERT for doh private_data 4588 4589 Closes #7227 4590 4591- [yb999 brought this change] 4592 4593 tests: update README.md with a missing single quote 4594 4595 Closes #7231 4596 4597- GHA: run all tests for hyper too 4598 4599 As it lists disabled ones in DISABLED now 4600 4601 Closes #7209 4602 4603- tests/data/DISABLED: add tests not working with hyper 4604 4605 The goal is to remove them all from here over time. 4606 4607 Closes #7209 4608 4609- runtests: also find the last test in Makefile.inc 4610 4611 Closes #7209 4612 4613- test3010: work with hyper mode 4614 4615 Closes #7209 4616 4617- configure: disable RTSP when hyper is selected 4618 4619 Makes test 1013 work 4620 4621 Closes #7209 4622 4623- test1594/1595/1596: fix to work in hyper mode 4624 4625 Closes #7209 4626 4627- test1438/1457: add HTTP keyword to make hyper mode work 4628 4629 Closes #7209 4630 4631- test1340/1341: adjusted for hyper mode 4632 4633 Closes #7209 4634 4635- test1218: adjusted for hyper mode 4636 4637 Closes #7209 4638 4639- test1216: adjusted for hyper mode 4640 4641 Closes #7209 4642 4643- test1230: adjust to work in hyper mode 4644 4645 Closes #7209 4646 4647- c-hyper: abort CONNECT response reading early on non 2xx responses 4648 4649 Fixes test 493 4650 4651 Closes #7209 4652 4653- test434: add HTTP keyword 4654 4655 Closes #7209 4656 4657- test599: adjusted to work in hyper mode 4658 4659 Closes #7209 4660 4661- c-hyper: fix the uploaded field in progress callbacks 4662 4663 Makes test 578 work 4664 4665 Closes #7209 4666 4667- test566: adjust to work with hyper mode 4668 4669 Closes #7209 4670 4671- [Fawad Mirza brought this change] 4672 4673 CURLOPT_WRITEFUNCTION.3: minor update of the example 4674 4675 Safely avoid chunk.size garbage value if declared non globally. 4676 4677 Closes #7219 4678 4679- [Bastian Krause brought this change] 4680 4681 configure: rename get-easy-option configure option to get-easy-options 4682 4683 "get-easy-options" is the configure option advertised by the help text 4684 anyway, so use that. 4685 4686 Fixes #7211 4687 Closes #7213 4688 4689 Follow-up to ad691b191 ("configure: added --disable-get-easy-options") 4690 Suggested-by: Daniel Stenberg <daniel@haxx.se> 4691 Signed-off-by: Bastian Krause <bst@pengutronix.de> 4692 4693- runtests: skip disabled tests unless -f is used 4694 4695 To make it easier to write ranges like '115 to 229' without that 4696 explicitly enabling tests that are listed in DISABLED, this makes 4697 runtests always skip disabled tests unless the -f command line option is 4698 used. 4699 4700 Previously the code attempted to not run such tests, but didn't do it 4701 correctly. 4702 4703 Closes #7212 4704 4705- [Jun-ya Kato brought this change] 4706 4707 ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS 4708 4709 The latest GnuTLS-3.7.2 implements disable switch for TLSv1.3 compatible 4710 mode for middle box but it is enabled by default, which is unnecessary 4711 for QUIC. 4712 4713 Fixes #6896 4714 Closes #7202 4715 4716- test644: remove as duplicate of test 587 4717 4718 Closes #7208 4719 4720Daniel Gustafsson (8 Jun 2021) 4721- RELEASE-NOTES: synced 4722 4723- cookies: track expiration in jar to optimize removals 4724 4725 Removing expired cookies needs to be a fast operation since we want to 4726 be able to perform it often and speculatively. By tracking the timestamp 4727 of the next known expiration we can exit early in case the timestamp is 4728 in the future. 4729 4730 Closes: #7172 4731 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 4732 4733Daniel Stenberg (7 Jun 2021) 4734- GHA: add several libcurl tests to the hyper job 4735 4736 500 to 512 4737 4738- test500: adjust to work with hyper mode 4739 4740- c-hyper: support CURLINFO_STARTTRANSFER_TIME 4741 4742 Closes #7204 4743 4744- c-hyper: support CURLOPT_HEADER 4745 4746 When enabled, the headers are passed to the body write callback as well. 4747 4748 Like in test 500 4749 4750 Closes #7204 4751 4752- GHA: run the newly fixed tests with hyper 4753 4754 Closes #7205 4755 4756- test433: adjust for hyper mode 4757 4758 Closes #7205 4759 4760- test395: hyper cannot work around > 64 bit content-lengths like built-in 4761 4762 Closes #7205 4763 4764- test394: hyper returns a different error 4765 4766 Closes #7205 4767 4768- test393: make Content-Length fit within 64 bit for hyper 4769 4770 Closes #7205 4771 4772- test347: CRLFify to work in hyper mode 4773 4774 Closes #7205 4775 4776- test339: CRLFify better to work in hyper mode 4777 4778 Closes #7205 4779 4780- travis: remove the hyper build 4781 4782- GHA: add a linux-hyper job 4783 4784 Closes #7206 4785 4786- test328: avoid a header-looking body to make hyper mode work 4787 4788 The test still works the same, just modified two bytes in the content. 4789 4790 Closes #7203 4791 4792- release-notes.pl: also spot common 'closes' typo 4793 4794- metalink: remove 4795 4796 Warning: this will make existing curl command lines that use metalink to 4797 stop working. 4798 4799 Reasons for removal: 4800 4801 1. We've found several security problems and issues involving the 4802 metalink support in curl. The issues are not detailed here. When 4803 working on those, it become apparent to the team that several of the 4804 problems are due to the system design, metalink library API and what 4805 the metalink RFC says. They are very hard to fix on the curl side 4806 only. 4807 4808 2. The metalink usage with curl was only very briefly documented and was 4809 not following the "normal" curl usage pattern in several ways, making 4810 it surprising and non-intuitive which could lead to further security 4811 issues. 4812 4813 3. The metalink library was last updated 6 years ago and wasn't so 4814 active the years before that either. An unmaintained library means 4815 there's a security problem waiting to happen. This is probably reason 4816 enough. 4817 4818 4. Metalink requires an XML parsing library, which is complex code (even 4819 the smaller alternatives) and to this day often gets security 4820 updates. 4821 4822 5. Metalink is not a widely used curl feature. In the 2020 curl user 4823 survey, only 1.4% of the responders said that they'd are using it. In 4824 2021 that number was 1.2%. Searching the web also show very few 4825 traces of it being used, even with other tools. 4826 4827 6. The torrent format and associated technology clearly won for 4828 downloading large files from multiple sources in parallel. 4829 4830 Cloes #7176 4831 4832- docs/INSTALL: remove mentions of configure --with-darwin-ssl 4833 4834 ... as it isn't supported since a while back. 4835 4836 Make configure fail with a warning if used. 4837 4838 Reported-by: Vadim Grinshpun 4839 Bug: https://curl.se/mail/lib-2021-06/0008.html 4840 Closes #7200 4841 4842- RELEASE-NOTES: synced 4843 4844- [Gregor Jasny brought this change] 4845 4846 cmake: Avoid leaking absolute paths into exported config 4847 4848 The `find_libarary` command resolves the library or framework 4849 into an absolute path. In case of system frameworks which are 4850 located within an Xcode-provided SDK this results in the Xcode 4851 path and SDK version being part of the library path. 4852 4853 Because those library paths end up in the exported CMake config 4854 importing curl will fail once the Xcode location or SDK version 4855 changes: 4856 4857 ```cmake 4858 set_target_properties(CURL::libcurl PROPERTIES 4859 INTERFACE_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include" 4860 INTERFACE_LINK_LIBRARIES "lber;ldap;/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/SystemConfiguration.framework;OpenSSL::SSL;OpenSSL::Crypto;ZLIB::ZLIB" 4861 ) 4862 ``` 4863 4864 A work-around is to link against system-level frameworks with 4865 `-framework XYZ`. In case of `SystemConfiguration` we might be able 4866 to omit the lookup-check because we could assume the framework is 4867 always present. 4868 4869 Closes #7152 4870 4871- [Shikha Sharma brought this change] 4872 4873 http2_connisdead: handle trailing GOAWAY better 4874 4875 When checking the connection the input processing returns error 4876 immediately, we now consider that a dead connnection. 4877 4878 Bug: https://curl.se/mail/lib-2021-06/0001.html 4879 Closes #7192 4880 4881- [Dmitry Karpov brought this change] 4882 4883 ares: always store IPv6 addresses first 4884 4885 Trying dual-stack on some embedded platform, I noticed that quite 4886 frequently (20%) libCurl starts from IPv4 regardless the Happy Eyeballs 4887 timeout value. After debugging this issue, I noticed that this happens 4888 if c-ares resolver response for IPv6 family comes before IPv4 (which was 4889 randomly happening in my tests). 4890 4891 In such cases, because libCurl puts the last resolver response on top of 4892 the address list, when IPv4 resolver response comes after IPv6 one - the 4893 IPv4 family starts the connection phase instead of IPv6 family. 4894 4895 The solution for this issue is to always put IPv6 addresses on top of 4896 the address list, regardless the order of resolver responses. 4897 4898 Bug: https://curl.se/mail/lib-2021-06/0003.html 4899 4900 Closes #7188 4901 4902- Revert "Revert "socketpair: fix potential hangs"" 4903 4904 This reverts commit 3e70c3430a370a31eff2c1d8fea29edaca8f1127. 4905 4906 Thus brings back the change from #7144 as was originally landed in 4907 c769d1eab4de8b 4908 4909 Closes #7144 (again) 4910 4911- [Ebe Janchivdorj brought this change] 4912 4913 schannel: move code out of SChannel_connect_step1 4914 4915 Reviewed-by: Marc Hoersken 4916 Closes #7168 4917 4918- tests/data/Makefile.inc: error: trailing backslash on last line 4919 4920 Follow-up to d8dcb399b8009d 4921 4922- TODO: Support rate-limiting for MQTT 4923 4924- [Dmitry Kostjuchenko brought this change] 4925 4926 warnless: simplify type size handling 4927 4928 By using sizeof(T), existing defines and relying on the compiler to 4929 define the required signed/unsigned mask. 4930 4931 Closes #7181 4932 4933Gisle Vanem (4 Jun 2021) 4934- [Win32] Fix for USE_WATT32 4935 4936 My Watt-32 tcp/ip stack works on Windows but it does not have `WSAIoctl()` 4937 4938Daniel Stenberg (4 Jun 2021) 4939- [Alexis Vachette brought this change] 4940 4941 url: bad CURLOPT_CONNECT_TO syntax now returns error 4942 4943 Added test 3020 to verify 4944 4945 Closes #7183 4946 4947- github: remove the cmake macOS gcc-8 jobs 4948 4949 They're too similar to the gcc-9 ones to be useful (and seems to not 4950 work anymore). 4951 4952 Closes #7187 4953 4954- test269: disable for hyper 4955 4956 --ignore-content-length / CURLOPT_IGNORE_CONTENT_LENGTH doesn't work 4957 with hyper. 4958 4959 Closes #7184 4960 4961- runtests: enable 'hyper mode' only for HTTP tests 4962 4963 The 'hyper mode' makes line-ending checks work in the test suite for 4964 when hyper is used. Now it also requires that HTTP or HTTPS are 4965 mentioned as keywords to be enabled so that it doesn't wrongly adjusts 4966 tests for other protocols. 4967 4968 This makes test 271 (TFTP) work again in hyper enabled builds. 4969 4970 Closes #7185 4971 4972- [Alexis Vachette brought this change] 4973 4974 hostip: bad CURLOPT_RESOLVE syntax now returns error 4975 4976 Added test 3019 4977 Fixes #7170 4978 Closes #7174 4979 4980Daniel Gustafsson (3 Jun 2021) 4981- cookies: fix typo and expand comment 4982 4983 Fix a typo in the sorting comment, and while in there elaborate slightly 4984 on why creationtime can be used as a tiebreaker. 4985 4986- cookies: remove unused header 4987 4988 Commit 1c1d9f1affbd3367bcb24062e261d0ea5d185e3a removed the last use 4989 for the inet_pton.h headerfile, this removes the inclusion of the 4990 header. 4991 4992 Closes: #7182 4993 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 4994 4995Daniel Stenberg (3 Jun 2021) 4996- Revert "socketpair: fix potential hangs" 4997 4998 This reverts commit c769d1eab4de8b9f1bd84d992c63692fdc43c5be. 4999 5000 See #7144 for details 5001 5002- [Paul Groke brought this change] 5003 5004 socketpair: fix potential hangs 5005 5006 Fixes potential hang in accept by using select + non-blocking accept. 5007 5008 Fixes potential hang in peer check by replacing the send/recv check with 5009 a getsockname/getpeername check. 5010 5011 Adds length check for returned sockaddr data. 5012 5013 Closes #7144 5014 5015- runtests: parse data/Makefile.inc instead of using make 5016 5017 The warning about missing entries in that file then doesn't require that 5018 the Makefile has been regenerated which was confusing. 5019 5020 The scan for the test num is a little more error prone than before 5021 (since now it doesn't actually verify that it is legitimate Makefile 5022 syntax), but I think it is good enough. 5023 5024 Closes #7177 5025 5026- [Harry Sintonen brought this change] 5027 5028 filecheck: quietly remove test-place/*~ 5029 5030 Closes #7179 5031 5032- CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax 5033 5034 For options that pass in lists or strings that are subsequently parsed 5035 and must be correct. This broadens the scope for the option previously 5036 known as CURLE_TELNET_OPTION_SYNTAX but the old name is of course still 5037 provided as a #define for existing applications. 5038 5039 Closes #7175 5040 5041- tests: fix Accept-Encoding strips to work with Hyper builds 5042 5043 The previous strip also removed the CR which turned problematic. 5044 5045 valgrind.supp: add zstd suppression using hyper 5046 5047 Reported-and-analyzed-by: Kevin Burke 5048 Fixes #7169 5049 Closes #7171 5050 5051- github: timeout jobs on macOS after 90 minutes 5052 5053 Assisted-by: Marc Hoersken 5054 Closes #7173 5055 5056- [Harry Sintonen brought this change] 5057 5058 mqtt: detect illegal and too large file size 5059 5060 Add test 3017 and 3018 to verify. 5061 Closes #7166 5062 5063- [Abhinav Singh brought this change] 5064 5065 cmake: add CURL_DISABLE_NTLM option 5066 5067 Closes #7028 5068 5069- [Abhinav Singh brought this change] 5070 5071 configure: add --disable-ntlm option 5072 5073 Closes #7028 5074 5075- [Abhinav Singh brought this change] 5076 5077 define: re-add CURL_DISABLE_NTLM and corresponding ifdefs 5078 5079 This flag will be further exposed by adding build options. 5080 5081 Reverts #6809 5082 Closes #7028 5083 5084- RELEASE-NOTES: synced 5085 5086Viktor Szakats (1 Jun 2021) 5087- travis: delete --enable-hsts option (it is the default now) [ci skip] 5088 5089 Reviewed-by: Daniel Stenberg 5090 Closes #7167 5091 5092Daniel Stenberg (1 Jun 2021) 5093- hostip: fix 3 coverity complaints 5094 5095 Follow-up to 1a0ebf6632f889eed 5096 5097 - Check the return code to Curl_inet_pton() in two instances, even 5098 though we know the input is valid so the functions won't fail. 5099 5100 - Clear the 'struct sockaddr_in' struct before use so that the 5101 'sin_zero' field isn't left uninitialized. 5102 5103 Detected by Coverity. 5104 Assisted-by: Harry Sintonen 5105 Closes #7163 5106 5107- c-hyper: fix NTLM on closed connection tested with test159 5108 5109 Closes #7154 5110 5111- conncache: lowercase the hash key for better match 5112 5113 As host names are case insensitive, the use of case sensitive hashing 5114 caused unnecesary cache misses and therefore lost performance. This 5115 lowercases the hash key. 5116 5117 Reported-by: Harry Sintonen 5118 Fixes #7159 5119 Closes #7161 5120 5121- mbedtls: make mbedtls_strerror always work 5122 5123 If the function doesn't exist, provide a macro that just clears the 5124 error message. Removes #ifdef uses from the code. 5125 5126 Closes #7162 5127 5128- vtls: exit addsessionid if no cache is inited 5129 5130 Follow-up to b249592d29ae0 5131 5132 Avoids NULL pointer derefs. 5133 5134 Closes #7165 5135 5136- [Harry Sintonen brought this change] 5137 5138 Curl_ntlm_core_mk_nt_hash: fix OOM in error path 5139 5140 Closes #7164 5141 5142Michael Kaufmann (1 Jun 2021) 5143- ssl: read pending close notify alert before closing the connection 5144 5145 This avoids a TCP reset (RST) if the server initiates a connection 5146 shutdown by sending an SSL close notify alert and then closes the TCP 5147 connection. 5148 5149 For SSL connections, usually the server announces that it will close the 5150 connection with an SSL close notify alert. curl should read this alert. 5151 If curl does not read this alert and just closes the connection, some 5152 operating systems close the TCP connection with an RST flag. 5153 5154 See RFC 1122, section 4.2.2.13 5155 5156 If curl reads the close notify alert, the TCP connection is closed 5157 normally with a FIN flag. 5158 5159 The new code is similar to existing code in the "SSL shutdown" function: 5160 try to read an alert (non-blocking), and ignore any read errors. 5161 5162 Closes #7095 5163 5164Daniel Stenberg (1 Jun 2021) 5165- [Laurent Dufresne brought this change] 5166 5167 setopt: fix incorrect comments 5168 5169 Closes #7157 5170 5171- [Laurent Dufresne brought this change] 5172 5173 mbedtls: add support for cert and key blob options 5174 5175 CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB weren't usable with 5176 mbedtls backend, so the support was added. 5177 5178 Closes #7157 5179 5180- [Gregor Jasny brought this change] 5181 5182 cmake: try well-known send/recv signature for Apple 5183 5184 The CMake `try_compile` command is especially slow for 5185 the Xcode generator. With this patch applied it first tests 5186 for the currently used (and Open Group specified) send/recv 5187 signature. In case this fails testing falls-back to the 5188 permutations. 5189 5190 speed-up: 5191 5192 ``` 5193 time cmake .. -GNinja -DCMAKE_USE_SECTRANSP=ON -DHTTP_ONLY=ON -DCMAKE_USE_LIBSSH2=OFF 5194 before: 11.64s user 11.09s system 55% cpu 40.754 total 5195 after: 7.84s user 6.57s system 51% cpu 28.074 total 5196 ``` 5197 5198 ``` 5199 time cmake .. -GXcode -DCMAKE_USE_SECTRANSP=ON -DHTTP_ONLY=ON -DCMAKE_USE_LIBSSH2=OFF 5200 before: 217.07s user 104.15s system 60% cpu 8:51.79 total 5201 after: 108.76s user 51.80s system 58% cpu 4:32.58 total 5202 ``` 5203 5204 Closes #7158 5205 5206- http2: init recvbuf struct for pushed streams 5207 5208 Debug builds would warn that these structs were not initialized properly 5209 for pushed streams. 5210 5211 Ref: #7148 5212 Closes #7153 5213 5214- Curl_ssl_getsessionid: fail if no session cache exists 5215 5216 This function might get called for an easy handle for which the session 5217 cache hasn't been setup. It now just returns a "miss" in that case. 5218 5219 Reported-by: Christoph M. Becker 5220 Fixes #7148 5221 Closes #7153 5222 5223- GOVERNANCE: add 'user', 'committer' and 'contributor' 5224 5225 As those are commonly used terms in the project. 5226 5227 Closes #7151 5228 5229- URL-SYNTAX.md: document the new 'localhost' treatment 5230 5231- hostip: make 'localhost' return fixed values 5232 5233 Resolving the case insensitive host name 'localhost' now returns the 5234 addresses 127.0.0.1 and (if IPv6 is enabled) ::1 without using any 5235 resolver. 5236 5237 This removes the risk that users accidentally resolves 'localhost' to 5238 something else. By making sure 'localhost' is always local, we can 5239 assume a "secure context" for such transfers (for cookies etc). 5240 5241 Closes #7039 5242 5243Daniel Gustafsson (31 May 2021) 5244- docs: fix typos 5245 5246Daniel Stenberg (30 May 2021) 5247- hsts: ignore numberical IP address hosts 5248 5249 Also, use a single function library-wide for detecting if a given hostname is 5250 a numerical IP address. 5251 5252 Reported-by: Harry Sintonen 5253 Fixes #7146 5254 Closes #7149 5255 5256- test178: adjust for hyper 5257 5258 Hyper returns the same error for wrong HTTP version as for negative 5259 content-length. Test 178 verifies that negative content-length is 5260 rejected but the hyper backend will return a different error for it (and 5261 without any helpful message telling why the message was bad). It will 5262 also not return any headers at all for the response, not even the ones 5263 that arrived before the error. 5264 5265 Closes #7147 5266 5267- HYPER: remove mentions of deprecated development branch 5268 5269- c-hyper: handle NULL from hyper_buf_copy() 5270 5271 Closes #7143 5272 5273- HSTS: not experimental anymore 5274 5275- [Douglas R. Reno brought this change] 5276 5277 INSTALL: use correct extension for CURL-DISABLE.md 5278 5279 In INSTALL.MD, it's currently set to CURL-DISABLE-md instead of 5280 CURL-DISABLE.md. This generates a 404 on the cURL website as well as 5281 when viewing the docs through Github. 5282 5283 Closes #7142 5284 5285- travis: run tests 1 - 153 with hyper 5286 5287- c-hyper: convert HYPERE_INVALID_PEER_MESSAGE to CURLE_UNSUPPORTED_PROTOCOL 5288 5289 Makes test 129 work (HTTP/1.2 response). 5290 5291 Closes #7141 5292 5293- http_proxy: deal with non-200 CONNECT response with Hyper 5294 5295 Makes test 94 and 95 work 5296 5297 Closes #7141 5298 5299- c-hyper: clear NTLM auth buffer when request is issued 5300 5301 To prevent previous ones to get reused on subsequent requests. Matches 5302 how the built-in HTTP code works. Makes test 90 to 93 work. 5303 5304 Add test 90 to 93 in travis. 5305 5306 Closes #7139 5307 5308- [Joel Depooter brought this change] 5309 5310 schannel: set ALPN length correctly for HTTP/2 5311 5312 In a3268eca792f1 this code was changed to use the ALPN_H2 constant 5313 instead of the NGHTTP2_PROTO_ALPN constant. However, these constants are 5314 not the same. The nghttp2 constant included the length of the string, 5315 like this: "\x2h2". The ALPN_H2 constant is just "h2". Therefore we need 5316 to re-add the length of the string to the ALPN buffer. 5317 5318 Closes #7138 5319 5320- travis: run tests 1-89 in the hyper build 5321 5322 Closes #7137 5323 5324- Revert "c-hyper: handle body on HYPER_TASK_EMPTY" 5325 5326 This reverts commit c3eefa95c31f55657f0af422e8268d738f689066. 5327 5328 Reported-by: Kevin Burke 5329 Fixes #7122 5330 Closes #7136 5331 5332- [Jon Rumsey brought this change] 5333 5334 ccsidcurl: fix the compile errors 5335 5336 Looks like the declaration of cpp shoule be const char ** and return 5337 null if convert_version_info_string fails. 5338 5339 Fixes #7134 5340 Closes #7135 5341 5342- [Viktor Szakats brought this change] 5343 5344 docs: use --max-redirs instead of --max-redir 5345 5346 For consistency. 5347 5348 Closes #7130 5349 5350- RELEASE-NOTES: synced 5351 5352 ... and bump to 7.77.1 5353 5354- [Michael Forney brought this change] 5355 5356 travis: add bearssl build 5357 5358 Closes #7133 5359 5360- [Michael Forney brought this change] 5361 5362 bearssl: explicitly initialize all fields of Curl_ssl 5363 5364 Also, add comments like the other vtls backends. 5365 5366 Closes #7133 5367 5368- [Michael Forney brought this change] 5369 5370 bearssl: remove incorrect const on variable that is modified 5371 5372 hostname may be set to NULL later on in this function if it is an 5373 IP address. 5374 5375 Closes #7133 5376 5377Version 7.77.0 (26 May 2021) 5378 5379Daniel Stenberg (26 May 2021) 5380- RELEASE-NOTES: synced 5381 5382- THANKS: added contributors from 7.77.0 cycle 5383 5384- copyright: update copyright year ranges to 2021 5385 5386- [Radek Zajic brought this change] 5387 5388 hostip: fix broken macOS/CMake/GCC builds 5389 5390 Follow-up to 31f631a142d855f06 5391 5392 Fixes #7128 5393 Closes #7129 5394 5395- TODO: netrc caching and sharing 5396 5397 URL: https://curl.se/mail/archive-2021-05/0018.html 5398 5399- [Orgad Shaneh brought this change] 5400 5401 setopt: streamline ssl option code 5402 5403 Make it use the same style as the code next to it 5404 5405 Closes #7123 5406 5407- [Radek Zajic brought this change] 5408 5409 lib/hostip6.c: make NAT64 address synthesis on macOS work 5410 5411 Closes #7121 5412 5413- [ejanchivdorj brought this change] 5414 5415 sectransp: fix EXC_BAD_ACCESS caused by uninitialized buffer 5416 5417 When the SecCertificateCopyCommonName function fails, it leaves 5418 common_name in a invalid state so CFStringCompare uses the invalid 5419 result, causing EXC_BAD_ACCESS. 5420 5421 The fix is to check the return value of the function before using the 5422 name. 5423 5424 Closes #7126 5425 5426- [Paweł Wegner brought this change] 5427 5428 CMake: add CURL_ENABLE_EXPORT_TARGET option 5429 5430 install(EXPORT ...) causes trouble when embedding curl dependencies 5431 which don't provide install(EXPORT ...) targets (e.g libressl and 5432 nghttp2) with cmake's add_subdirectory. 5433 5434 Reviewed-by: Jakub Zakrzewski 5435 Closes #7060 5436 5437- [Alessandro Ghedini brought this change] 5438 5439 quiche: update for network path aware API 5440 5441 Latest version of quiche requires the application to pass the peer 5442 address of received packets, and it provides the address for outgoing 5443 packets back. 5444 5445 Closes #7120 5446 5447- [Jacob Hoffman-Andrews brought this change] 5448 5449 rustls: switch read_tls and write_tls to callbacks 5450 5451 And update to 0.6.0, including a rename from session to connection for 5452 many fields. 5453 5454 Closes #7071 5455 5456- [Koichi Shiraishi brought this change] 5457 5458 sectransp: fix 7f4a9a9b2a49 commit about missing comma 5459 5460 Follow-up to 7f4a9a9b2a495 5461 5462 Closes #7119 5463 5464- [Harry Sintonen brought this change] 5465 5466 openssl: associate/detach the transfer from connection 5467 5468 CVE-2021-22901 5469 5470 Bug: https://curl.se/docs/CVE-2021-22901.html 5471 5472- [Harry Sintonen brought this change] 5473 5474 telnet: check sscanf() for correct number of matches 5475 5476 CVE-2021-22898 5477 5478 Bug: https://curl.se/docs/CVE-2021-22898.html 5479 5480- schannel: don't use static to store selected ciphers 5481 5482 CVE-2021-22897 5483 5484 Bug: https://curl.se/docs/CVE-2021-22897.html 5485 5486- docs/tests: remove freenode references 5487 5488- RELEASE-NOTES: synced 5489 5490- [Sergey Markelov brought this change] 5491 5492 NSS: make colons, commas and spaces valid separators in cipher list 5493 5494 Fixes #7110 5495 Closes #7115 5496 5497- curl: include libmetalink version in --version output 5498 5499 Closes #7112 5500 5501Jay Satiro (21 May 2021) 5502- [Matias N. Goldberg brought this change] 5503 5504 cmake: Use multithreaded compilation on VS 2008+ 5505 5506 Multithreaded compilation has been supported since at least VS 2005 and 5507 been robustly stable since at least VS 2008 5508 5509 Closes https://github.com/curl/curl/pull/7109 5510 5511Daniel Stenberg (21 May 2021) 5512- [Matias N. Goldberg brought this change] 5513 5514 cmake: fix two invokes result in different curl_config.h 5515 5516 Fixes #7100 5517 Closes #7101 5518 5519 Reviewed-by: Jakub Zakrzewski 5520 Signed-off-by: Matias N. Goldberg <dark_sylinc@yahoo.com.ar> 5521 5522- [Peng-Yu Chen brought this change] 5523 5524 cmake: detect CURL_SA_FAMILY_T 5525 5526 Fixes #7049 5527 Closes #7065 5528 5529- [Lucas Clemente Vella brought this change] 5530 5531 CURLOPT_IPRESOLVE: preventing wrong IP version from being used 5532 5533 In some situations, it was possible that a transfer was setup to 5534 use an specific IP version, but due do DNS caching or connection 5535 reuse, it ended up using a different IP version from requested. 5536 5537 This commit changes the effect of CURLOPT_IPRESOLVE from simply 5538 restricting address resolution to preventing the wrong connection 5539 type being used, when choosing a connection from the pool, and 5540 to restricting what addresses could be used when establishing 5541 a new connection. 5542 5543 It is important that all addresses versions are resolved, even if 5544 not used in that transfer in particular, because the result is 5545 cached, and could be useful for a different transfer with a 5546 different CURLOPT_IPRESOLVE setting. 5547 5548 Closes #6853 5549 5550- [Oliver Urbann brought this change] 5551 5552 AmigaOS: add functions definitions for SHA256 5553 5554 AmiSSL replaces many functions with macros. Curl requires pointer 5555 to some of these functions. Thus, we have to encapsulate these macros: 5556 SHA256_Init, SHA256_Update, SHA256_Final, X509_INFO_free. 5557 5558 Bug: https://github.com/jens-maus/amissl/issues/15 5559 Co-authored-by: Daniel Stenberg <daniel@haxx.se> 5560 5561 Closes #7099 5562 5563- test2100: make it run with and require IPv6 5564 5565 Closes #7083 5566 5567- tests/getpart: generate output URL encoded for better diffs 5568 5569 Closes #7083 5570 5571- [Ryan Beck-Buysse brought this change] 5572 5573 docs/TheArtOfHttpScripting: fix markdown links 5574 5575 extra parens cause the links to be incorrectly formatted 5576 and inconsistent with the rest of the document. 5577 5578 Signed-off-by: Ryan Beck-Buysse <rbuysse@gmail.com> 5579 Closes #7097 5580 5581- RELEASE-NOTES: synced 5582 5583- [Emil Engler brought this change] 5584 5585 docs: replace dots with dashes in markdown enums 5586 5587 We use dashes instead of dots nearly everywhere except for those few 5588 cases. This commit addresses this issues and brings more coherency into 5589 it. 5590 5591 Closes #7093 5592 5593- [Emil Engler brought this change] 5594 5595 docs: improve INTERNALS.md regarding getsock cb 5596 5597 This adds the I/O prefix to indicate that those "actions" are kind-of 5598 related to those found in select(2) or poll(2) (reading/writing). 5599 5600 It also adds a note where the prototypes of those functions can be found 5601 in the source code. 5602 5603 Closes #7092 5604 5605- [Emil Engler brought this change] 5606 5607 docs: document attach in INTERNALS.md 5608 5609 The new field in the Curl_handler struct still lacks documentation. This 5610 adds it it from the information extracted from lib/urldata.h:797 5611 5612 Closes #7091 5613 5614- [Marc Aldorasi brought this change] 5615 5616 config: remove now-unused macros 5617 5618 Closes #7094 5619 5620- [Marc Aldorasi brought this change] 5621 5622 hostip.h: remove declaration of unimplemented function 5623 5624 Closes #7094 5625 5626- h3: add 'attach' callback to protocol handlers 5627 5628 Follow-up to 0c55fbab45be 5629 5630 Reviewed-by: Emil Engler 5631 Closes #7090 5632 5633- wolfssl: remove SSLv3 support leftovers 5634 5635 Closes #7088 5636 5637- curl-wolfssl.m4: without custom include path, assume /usr/include 5638 5639 ... so that we can point out the root of the OpenSSL emulation headers. 5640 Previously this used the '$includedir' variable which is wrong since 5641 that defaults to the dir where the current configure invoke will install 5642 the built libcurl headers: /usr/local by default. 5643 5644 Fixes #7085 5645 Reported-by: Joel Jakobsson 5646 Closes #7087 5647 5648- [Joel Depooter brought this change] 5649 5650 data_pending: check only SECONDARY socket for FTP(S) transfers 5651 5652 Check the FIRST for all other protocols. 5653 5654 This fixes a timeout in an ftps download. The server sends a TLS 5655 close_notify message in the same packet as the file data. The 5656 close_notify seems to not be handled in the schannel_recv function, so 5657 libcurl is not aware that the server has closed the connection. Thus 5658 libcurl ends up waiting for action on the socket until a timeout is 5659 reached. With the secondary socket check added to the data_pending 5660 function, the close_notify is properly handled, and the ftps transfer 5661 terminates as expected. 5662 5663 Fixes #7068 5664 Closes #7069 5665 5666- github: inhibit deprecated declarations for clang on macOS 5667 5668 ... as they otherwise cause ldap build errors in the CI. 5669 5670 Fixes #7081 5671 Closes #7082 5672 5673- conn: add 'attach' to protocol handler, make libssh2 use it 5674 5675 The libssh2 backend has SSH session associated with the connection but 5676 the callback context is the easy handle, so when a connection gets 5677 attached to a transfer, the protocol handler now allows for a custom 5678 function to get used to set things up correctly. 5679 5680 Reported-by: Michael O'Farrell 5681 Fixes #6898 5682 Closes #7078 5683 5684- http2: make sure pause is done on HTTP 5685 5686 Since the function is called for any protocol, we can't assume that the 5687 HTTP struct is there without first making sure it is HTTP. 5688 5689 Reported-by: Denis Goleshchikhin 5690 Fixes #7079 5691 Closes #7080 5692 5693- docs: cookies from HTTP headers need domain set 5694 5695 ... or the cookies won't get sent. Push users to using the "Netscape" 5696 format instead, which curl uses when saving a cookie "jar". 5697 5698 Reported-by: Martin Dorey 5699 Reviewed-by: Daniel Gustafsson 5700 Fixes #6723 5701 Closes #7077 5702 5703- RELEASE-NOTES: synced 5704 5705- github: add a workflow with libssh2 on macOS using cmake 5706 5707 Closes #7047 5708 5709- sws: allow HTTP requests up to 2MB in size 5710 5711 To allow tests with slightly larger payloads. Like #7071 ... 5712 5713 Closes #7075 5714 5715Marc Hoersken (16 May 2021) 5716- CI/azure: increase verbosity and fix outdated task names 5717 5718 Closes #7063 5719 5720- CI/cirrus: add shared and static Windows release builds 5721 5722 Azure Pipelines is currently being used for debug builds, 5723 let's also run some non-debug (release) Windows builds and 5724 make use of previously underutilized Cirrus CI for that. 5725 5726 Reviewed-by: Marcel Raad 5727 5728 Closes #6991 5729 5730Daniel Stenberg (16 May 2021) 5731- CURLOPT_CAPATH.3: defaults to a path, not NULL 5732 5733 Reported-by: Andrew Barnert 5734 5735 Closes #7062 5736 5737- [Jacob Hoffman-Andrews brought this change] 5738 5739 c-hyper: handle body on HYPER_TASK_EMPTY 5740 5741 Some of the time, we get a HYPER_TASK_EMPTY response before the status 5742 line, headers, and body have been read. Previously, that would cause us 5743 to poll again, leading to a 1 second timeout. 5744 5745 The HYPER_TASK_EMPTY docs say: 5746 5747 The value of this task is null (does not imply an error). 5748 5749 So, if we receive a HYPER_TASK_EMPTY, continue on with processing the 5750 response. 5751 5752 Reported-by: Kevin Burke 5753 Fixes #7064 5754 Closes #7070 5755 5756- [Ikko Ashimine brought this change] 5757 5758 tool_getparam: fix comment typo in tool_getparam.c 5759 5760 enfore -> enforce 5761 5762 Closes #7074 5763 5764- mem-include-scan.pl: require a non-word letter before memory funcs 5765 5766 ... so that ldap_memfree() for example doesn't match the scan for free. 5767 5768 Closes #7061 5769 5770- version: free the openldap info correctly 5771 5772 ... to avoid memory leaks. 5773 5774 Follow-up to: bf0feae7768d9 5775 Closes #7061 5776 5777- dupset: remove totally off comment 5778 5779 Closes #7067 5780 5781- configure: if asked for, fail if ldap is not found 5782 5783 Reported-by: Jakub Zakrzewski 5784 Fixes #7053 5785 Closes #7055 5786 5787- version: add OpenLDAP version in the output 5788 5789 Assisted-by: Howard Chu 5790 Closes #7054 5791 5792Jay Satiro (13 May 2021) 5793- [Joel Depooter brought this change] 5794 5795 schannel: Ensure the security context request flags are always set 5796 5797 As of commit 54e7475, these flags would only be set when using a new 5798 credential handle. When re-using an existing credential handle, the 5799 flags would not be set. 5800 5801 Closes https://github.com/curl/curl/pull/7051 5802 5803Dan Fandrich (12 May 2021) 5804- tests: Fix some tag matching issues in a number of tests 5805 5806Daniel Stenberg (12 May 2021) 5807- sasl: use 'unsigned short' to store mechanism 5808 5809 ... saves a few bytes of struct size in memory and it only uses 5810 10 bits anyway. 5811 5812 Closes #7045 5813 5814- hostip: remove the debug code for LocalHost 5815 5816 The Curl_resolv() had special code (when built in debug mode) for when 5817 resolving the host name "LocalHost" (using that exact casing). It would 5818 then get the host name from the --interface option instead. 5819 5820 This development-only feature was not used by anything (anymore) and we 5821 have the --resolve feature if we want to play similar tricks properly 5822 going forward. 5823 5824 Closes #7044 5825 5826- progress: reset limit_size variables at transfer start 5827 5828 Otherwise the old value would linger from a previous use and would mess 5829 up the network speed cap logic. 5830 5831 Reported-by: Ymir1711 on github 5832 5833 Fixes #7042 5834 Closes #7043 5835 5836- RELEASE-NOTES: synced 5837 5838- [Daniel Gustafsson brought this change] 5839 5840 cookies: use CURLcode for cookie_output reporting 5841 5842 Writing the cookie file has multiple error conditions, and was using an 5843 int with magic numbers to report the different error (which in turn were 5844 disregarded anyways). This moves reporting to use a CURLcode value. 5845 5846 Lightly-touched-by: Daniel Stenberg 5847 5848 Closes #7037 5849 Closes #6749 5850 5851- [Daniel Gustafsson brought this change] 5852 5853 cookies: make use of string duplication function 5854 5855 strstore() is defined as a strdup which ensures to free the target 5856 pointer before duping the source char * into it. Make use of it in 5857 two more cases where it can simplify the code. 5858 5859- [Daniel Gustafsson brought this change] 5860 5861 cookies: refactor comments 5862 5863 Comments in the cookie code were a bit all over the place in terms of 5864 style and wording. This takes a stab at cleaning them up by keeping to 5865 a single style and overall shape. Some comments are moved a little and 5866 some removed alltogether due to being redundant. No functional changes 5867 have been made, 5868 5869- [Peng-Yu Chen brought this change] 5870 5871 http2: skip immediate parsing of payload following protocol switch 5872 5873 This is considered not harmful as a following http2_recv shall be 5874 called very soon. 5875 5876 This is considered helpful in the specific situation where some 5877 servers (e.g. nghttpx v1.43.0) may fulfill stream 1 immediately 5878 following the return of HTTP status 101, other than waiting for 5879 the client-side connection preface to arrive. 5880 5881 Fixes #7036 5882 Closes #7040 5883 5884- [Peng-Yu Chen brought this change] 5885 5886 http2: use nghttp2_session_upgrade2 instead of nghttp2_session_upgrade 5887 5888 Following the upstream deprecation of nghttp2_session_upgrade. 5889 5890 Also provides further checks for requests with the HEAD method. 5891 5892 Closes #7041 5893 5894- progress/trspeed: use a local convenient pointer to beautify code 5895 5896 The function becomes easier to read and understand with less repetition. 5897 5898- trspeed: use long double for transfer speed calculation 5899 5900- progress: move transfer speed calc into function 5901 5902 This silences two scan-build-11 warnings: "The result of the '/' 5903 expression is undefined" 5904 5905 Bug: https://curl.se/mail/lib-2021-05/0022.html 5906 Closes #7035 5907 5908- [Cameron Cawley brought this change] 5909 5910 openssl: remove unneeded cast for CertOpenSystemStore() 5911 5912 Closes #7025 5913 5914- travis: disable the libssh build 5915 5916 It can't run on focal and causes warnings on bionic. Since the focal 5917 failure started rather suddenly a while ago, we can suspect it might be 5918 temporary. 5919 5920 Added "bring back the build" to the TODO document. 5921 5922 Fixes #7011 5923 Closes #7012 5924 5925- [Peng-Yu Chen brought this change] 5926 5927 http: use calculated offsets inst of integer literals for header parsing 5928 5929 Assumed to be a minor coding style improvement with no behavior change. 5930 5931 A modern compiler is expected to have the calculation optimized during 5932 compilation. It may be deemed okay even if that's not the case, since 5933 the added overhead is considered very low. 5934 5935 Closes #7032 5936 5937- [Peng-Yu Chen brought this change] 5938 5939 GIT-INFO: suggest using autoreconf instead of buildconf 5940 5941 Follow-up to 85868537d 5942 5943 Closes #7033 5944 5945- http: deal with partial CONNECT sends 5946 5947 Also added 'CURL_SMALLSENDS' to make Curl_write() send short packets, 5948 which helped verifying this even more. 5949 5950 Add test 363 to verify. 5951 5952 Reported-by: ustcqidi on github 5953 Fixes #6950 5954 Closes #7024 5955 5956- HTTP3: make the ngtcp2 build use the quictls fork 5957 5958 ... as ngtcp2 itself documents the build this way. 5959 5960 Closes #7031 5961 5962- http: limit the initial send amount to used upload buffer size 5963 5964 Previously this logic would cap the send to CURL_MAX_WRITE_SIZE bytes, 5965 but for the situations where a larger upload buffer has been set, this 5966 function can benefit from sending more bytes. With default size used, 5967 this does the same as before. 5968 5969 Also changed the storage of the size to an 'unsigned int' as it is not 5970 allowed to be set larger than 2M. 5971 5972 Also added cautions to the man pages about changing buffer sizes in 5973 run-time. 5974 5975 Closes #7022 5976 5977- RELEASE-NOTES: synced 5978 5979- ngtcp2: fix the cb_acked_stream_data_offset proto 5980 5981 The 'datalen' value should be 64 bit, not size_t! 5982 5983 Reported-by: Dmitry Karpov 5984 Bug: https://curl.se/mail/lib-2021-05/0019.html 5985 Closes #7027 5986 5987- progress: when possible, calculate transfer speeds with microseconds 5988 5989 ... this improves precision, especially for transfers in the few or even 5990 sub millisecond range. 5991 5992 Reported-by: J. Bromley 5993 Fixes #7017 5994 Closes #7020 5995 5996- http: reset the header buffer when sending the request 5997 5998 A reused transfer handle could otherwise reuse the previous leftover 5999 buffer and havoc would ensue. 6000 6001 Reported-by: sergio-nsk on github 6002 Fixes #7018 6003 Closes #7021 6004 6005- curl_mprintf.3: add description 6006 6007 These functions have existed in the API since the dawn of time. It is 6008 about time we describe how they work, even if we discourage users from 6009 using them. 6010 6011 Closes #7010 6012 6013- [Timothy Gu brought this change] 6014 6015 URL-SYNTAX: update IDNA section for WHATWG spec changes 6016 6017 WHATWG URL has dictated the use of Nontransitional Processing (IDNA 6018 2008) for several years now. Chrome (and derivatives) still use 6019 Transitional Processing, but Firefox and Safari have both switched. 6020 6021 Also document the fact that winidn functions differently from libidn2 6022 here. 6023 6024 Closes #7026 6025 6026- [Calvin Buckley brought this change] 6027 6028 INSTALL: add IBM i specific quirks 6029 6030 Fixes #6830 6031 Closes #7013 6032 6033- libcurl.3: mention the URL API 6034 6035 To make it easier to find. Also a minor polish of libcurl-url.3 6036 6037 Closes #7009 6038 6039- GnuTLS: don't allow TLS 1.3 for versions that don't support it 6040 6041 Follow-up to 781864bedbc5 6042 6043 ... as they don't understand it and will return error at us! 6044 6045 Closes #7014 6046 6047Kamil Dudka (6 May 2021) 6048- tool_getparam: handle failure of curlx_convert_tchar_to_UTF8() 6049 6050 Reported by GCC analyzer: 6051 6052 Error: GCC_ANALYZER_WARNING (CWE-476): 6053 src/tool_getparam.c: scope_hint: In function 'parse_args' 6054 src/tool_getparam.c:2318:38: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL 'orig_opt' 6055 lib/curlx.h:56: included_from: Included from here. 6056 src/tool_getparam.c:28: included_from: Included from here. 6057 lib/curl_multibyte.h:70:51: note: in definition of macro 'curlx_convert_tchar_to_UTF8' 6058 src/tool_getparam.c:2316:16: note: in expansion of macro 'curlx_convert_tchar_to_UTF8' 6059 6060 Reviewed-by: Marcel Raad 6061 Reviewed-by: Daniel Stenberg 6062 Closes #7023 6063 6064Daniel Stenberg (6 May 2021) 6065- scripts/delta: also show total number of days 6066 6067Marc Hoersken (5 May 2021) 6068- sockfilt: fix invalid increment of handles index variable nfd 6069 6070 Only increment the array index if we actually stored a handle. 6071 6072 Follow up to e917492048f4b85a0fd58a033d10072fc7666c3b 6073 Closes #6992 6074 6075- sockfilt: avoid getting stuck waiting for writable socket 6076 6077 Reset FD_WRITE event using the same approach as in multi.c 6078 6079 Follow up to b36442b24305f3cda7c13cc64b46838995a4985b 6080 Closes #6992 6081 6082Jay Satiro (5 May 2021) 6083- test678: Fix for Windows multibyte builds 6084 6085 Follow-up to 77fc385 from yesterday. 6086 6087 Bug: https://github.com/curl/curl/pull/6662#issuecomment-832966557 6088 Reported-by: Marc Hörsken 6089 6090- [Dmitry Kostjuchenko brought this change] 6091 6092 build: fix compilation for Windows UWP platform 6093 6094 - Include afunix.h which is necessary for sockaddr_un when 6095 USE_UNIX_SOCKETS is defined on Windows. 6096 6097 Closes https://github.com/curl/curl/pull/7006 6098 6099Daniel Stenberg (5 May 2021) 6100- gnutls: make setting only the MAX TLS allowed version work 6101 6102 Previously, settting only the max allowed TLS version, leaving the 6103 minimum one at default, didn't actually set it and left it to default 6104 (TLS 1.3) too! 6105 6106 As a bonus, this change also removes the dead code handling of SSLv3 6107 since that version can't be set anymore (since eff614fb0242cb). 6108 6109 Reported-by: Daniel Carpenter 6110 Fixes #6998 6111 Closes #7000 6112 6113- openldap: replace ldap_ prefix on private functions 6114 6115 Since openldap itself uses that prefix and with OpenĹDAP 2.5.4 (at 6116 least) there's a symbol collision because of that. 6117 6118 The private functions now use the 'oldap_' prefix where it previously 6119 used 'ldap_'. 6120 6121 Reported-by: 3eka on github 6122 Fixes #7004 6123 Closes #7005 6124 6125Jay Satiro (5 May 2021) 6126- http2: fix potentially uninitialized variable 6127 6128 introduced several days ago in 3193170. caught by visual studio linker. 6129 6130- [Gilles Vollant brought this change] 6131 6132 SSL: support in-memory CA certs for some backends 6133 6134 - New options CURLOPT_CAINFO_BLOB and CURLOPT_PROXY_CAINFO_BLOB to 6135 specify in-memory PEM certificates for OpenSSL, Schannel (Windows) 6136 and Secure Transport (Apple) SSL backends. 6137 6138 Prior to this change PEM certificates could only be imported from a file 6139 and not from memory. 6140 6141 Co-authored-by: moparisthebest@users.noreply.github.com 6142 6143 Ref: https://github.com/curl/curl/pull/4679 6144 Ref: https://github.com/curl/curl/pull/5677 6145 Ref: https://github.com/curl/curl/pull/6109 6146 6147 Closes https://github.com/curl/curl/pull/6662 6148 6149Daniel Stenberg (4 May 2021) 6150- [David Cook brought this change] 6151 6152 tests: ignore case of chunked hex numbers in tests 6153 6154 When hyper is used, it emits uppercase hexadecimal numbers for chunked 6155 encoding lengths. Without hyper, lowercase hexadecimal numbers are used. 6156 This change adds preprocessor statements to tests where this is an 6157 issue, and adapts the fixtures to match. 6158 6159 Closes #6987 6160 6161- cmake: check for getppid and utimes 6162 6163 ... as they're checked for in the configure script and are used by 6164 source code. 6165 6166 Removed checks for perror, setvbuf and strlcat since those defines are 6167 not checked for in source code. 6168 6169 Bonus: removed HAVE_STRLCPY from a few config-*.h files since that 6170 symbol is not used in source code. 6171 6172 Closes #6997 6173 6174- libtest: remove lib530.c 6175 6176 Follow up from e50a877df when test 530 was removed. Since then this 6177 source file has not been used/needed. 6178 6179 Closes #6999 6180 6181- FILEFORMAT: mention sectransp as a feature 6182 6183 Been supported since at least 40259ca65 6184 6185 Closes #7001 6186 6187- RELEASE-NOTES: synced 6188 6189- libssh2: ignore timeout during disconnect 6190 6191 ... to avoid memory leaks! 6192 6193 libssh2 is tricky as we have to deal with the non-blockiness even in 6194 close and shutdown cases. In the cases when we shutdown after a timeout 6195 already expired, it is crucial that curl doen't let the timeout abort 6196 the shutdown process as that then leaks memory! 6197 6198 Reported-by: Benjamin Riefenstahl 6199 Fixes #6990 6200 6201- KNOWN_BUGS: add two HTTP/2 bugs 6202 6203- KNOWN_BUGS: add three HTTP/3 issues 6204 6205 ... and moved the HTTP/2 issues to its own section 6206 6207 Closes #6606 6208 Closes #6510 6209 Closes #6494 6210 6211- [ejanchivdorj brought this change] 6212 6213 CURLcode: add CURLE_SSL_CLIENTCERT 6214 6215 When a TLS server requests a client certificate during handshake and 6216 none can be provided, libcurl now returns this new error code 6217 CURLE_SSL_CLIENTCERT 6218 6219 Only supported by Secure Transport and OpenSSL for TLS 1.3 so far. 6220 6221 Closes #6721 6222 6223- [Tobias Gabriel brought this change] 6224 6225 .github/FUNDING: add link to GitHub sponsors 6226 6227 Closes #6985 6228 6229- [Harry Sintonen brought this change] 6230 6231 krb5/name_to_level: replace checkprefix with curl_strequal 6232 6233 Closes #6993 6234 6235- [Harry Sintonen brought this change] 6236 6237 Curl_input_digest: require space after Digest 6238 6239 Closes #6993 6240 6241- [Harry Sintonen brought this change] 6242 6243 Curl_http_header: check for colon when matching Persistent-Auth 6244 6245 Closes #6993 6246 6247- [Harry Sintonen brought this change] 6248 6249 Curl_http_input_auth: require valid separator after negotiation type 6250 6251 Closes #6993 6252 6253- http: fix the check for 'Authorization' with Bearer 6254 6255 The code would wrongly check for it using an additional colon. 6256 6257 Reported-by: Blake Burkhart 6258 Closes #6988 6259 6260- [Kamil Dudka brought this change] 6261 6262 http2: fix a resource leak in push_promise() 6263 6264 ... detected by Coverity: 6265 6266 Error: RESOURCE_LEAK (CWE-772): 6267 lib/http2.c:532: alloc_fn: Storage is returned from allocation function "duphandle". 6268 lib/http2.c:532: var_assign: Assigning: "newhandle" = storage returned from "duphandle(data)". 6269 lib/http2.c:552: noescape: Resource "newhandle" is not freed or pointed-to in "set_transfer_url". 6270 lib/http2.c:555: leaked_storage: Variable "newhandle" going out of scope leaks the storage it points to. 6271 6272 Closes #6986 6273 6274- [Kamil Dudka brought this change] 6275 6276 http2: fix resource leaks in set_transfer_url() 6277 6278 ... detected by Coverity: 6279 6280 Error: RESOURCE_LEAK (CWE-772): 6281 lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.] 6282 lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()". 6283 lib/http2.c:486: noescape: Resource "u" is not freed or pointed-to in "curl_url_set". [Note: The source code implementation of the function has been overridden by a builtin model.] 6284 lib/http2.c:488: leaked_storage: Variable "u" going out of scope leaks the storage it points to. 6285 6286 Error: RESOURCE_LEAK (CWE-772): 6287 lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.] 6288 lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()". 6289 lib/http2.c:493: noescape: Resource "u" is not freed or pointed-to in "curl_url_set". [Note: The source code implementation of the function has been overridden by a builtin model.] 6290 lib/http2.c:495: leaked_storage: Variable "u" going out of scope leaks the storage it points to. 6291 6292 Error: RESOURCE_LEAK (CWE-772): 6293 lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.] 6294 lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()". 6295 lib/http2.c:500: noescape: Resource "u" is not freed or pointed-to in "curl_url_set". [Note: The source code implementation of the function has been overridden by a builtin model.] 6296 lib/http2.c:502: leaked_storage: Variable "u" going out of scope leaks the storage it points to. 6297 6298 Error: RESOURCE_LEAK (CWE-772): 6299 lib/http2.c:480: alloc_fn: Storage is returned from allocation function "curl_url". [Note: The source code implementation of the function has been overridden by a builtin model.] 6300 lib/http2.c:480: var_assign: Assigning: "u" = storage returned from "curl_url()". 6301 lib/http2.c:505: noescape: Resource "u" is not freed or pointed-to in "curl_url_get". [Note: The source code implementation of the function has been overridden by a builtin model.] 6302 lib/http2.c:507: leaked_storage: Variable "u" going out of scope leaks the storage it points to. 6303 6304 Closes #6986 6305 6306- [Jacob Hoffman-Andrews brought this change] 6307 6308 rustls: use ALPN 6309 6310 Update required rustls to 0.5.0 6311 6312 Closes #6960 6313 6314- [Michał Antoniak brought this change] 6315 6316 gskit: fix CURL_DISABLE_PROXY build 6317 6318 Removed localfd and remotefd from ssl_backend_data (ued only with proxy 6319 connection). Function pipe_ssloverssl return always 0, when proxy is not 6320 used. 6321 6322 Closes #6981 6323 6324- [Michał Antoniak brought this change] 6325 6326 gskit: fix undefined reference to 'conn' 6327 6328 Closes #6980 6329 6330- [Jacob Hoffman-Andrews brought this change] 6331 6332 tls: add USE_HTTP2 define 6333 6334 This abstracts across the two HTTP/2 backends: nghttp2 and Hyper. 6335 6336 Add our own define for the "h2" ALPN protocol, so TLS backends can use 6337 it without depending on a specific HTTP backend. 6338 6339 Closes #6959 6340 6341- [Jacob Hoffman-Andrews brought this change] 6342 6343 lib: fix 0-length Curl_client_write calls 6344 6345 Closes #6954 6346 6347- [Jacob Hoffman-Andrews brought this change] 6348 6349 lib: remove strlen call from Curl_client_write 6350 6351 At all call sites with an explicit 0 len, pass an appropriate nonzero 6352 len. 6353 6354 Closes #6954 6355 6356- [Ayushman Singh Chauhan brought this change] 6357 6358 docs: camelcase it like GitHub everywhere 6359 6360 Closes #6979 6361 6362Jay Satiro (27 Apr 2021) 6363- [Lucas Servén Marín brought this change] 6364 6365 docs: fix typo in fail-with-body doc 6366 6367 This commit fixes a small typo in the documentation for the 6368 --fail-with-body flag. 6369 6370 Closes https://github.com/curl/curl/pull/6977 6371 6372- lib: fix some misuse of curlx_convert_UTF8_to_tchar 6373 6374 curlx_convert_UTF8_to_tchar must be freed by curlx_unicodefree, but 6375 prior to this change some uses mistakenly called free. 6376 6377 I've reviewed all other uses of curlx_convert_UTF8_to_tchar and 6378 curlx_convert_tchar_to_UTF8. 6379 6380 Bug: https://github.com/curl/curl/pull/6602#issuecomment-825236763 6381 Reported-by: sergio-nsk@users.noreply.github.com 6382 6383 Closes https://github.com/curl/curl/pull/6938 6384 6385Daniel Stenberg (27 Apr 2021) 6386- ntlm: precaution against super huge type2 offsets 6387 6388 ... which otherwise caused an integer overflow and circumvented the if() 6389 conditional size check. 6390 6391 Detected by OSS-Fuzz 6392 Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33720 6393 Assisted-by: Max Dymond 6394 Closes #6975 6395 6396- c-hyper: fix unused variable ‘wrote’ 6397 6398- libcurl-security.3: be careful of setuid 6399 6400 Reported-by: Harry Sintonen 6401 Closes #6970 6402 6403- [Kevin Burke brought this change] 6404 6405 c-hyper: don't write to set.writeheader if null 6406 6407 Previously if a caller set CURLOPT_WRITEFUNCTION but did not set a 6408 CURLOPT_HEADERDATA buffer, Hyper would still attempt to write headers to 6409 the data->set.writeheader header buffer, even though it is null. This 6410 led to NPE segfaults attempting to use libcurl+Hyper with Git, for 6411 example. 6412 6413 Instead, process the client write for the status line using the same 6414 logic we use to process the client write for the later HTTP headers, 6415 which contains the appropriate guard logic. As a side benefit, 6416 data->set.writeheader is now only read in one file instead of two. 6417 6418 Fixes #6619 6419 Fixes abetterinternet/crustls#49 6420 Fixes hyperium/hyper#2438 6421 Closes #6971 6422 6423- wolfssl: handle SSL_write() returns 0 for error 6424 6425 Reported-by: Timo Lange 6426 6427 Closes #6967 6428 6429- easy: ignore sigpipe in curl_easy_send 6430 6431 Closes #6965 6432 6433- sigpipe: ignore SIGPIPE when using wolfSSL as well 6434 6435 Closes #6966 6436 6437- libcurl-security.3: don't try to filter IPv4 hosts based on the URL 6438 6439 Closes #6942 6440 6441- [Harry Sintonen brought this change] 6442 6443 nss_set_blocking: avoid static for sock_opt 6444 6445 Reviewed-by: Kamil Dudka 6446 Closes #6945 6447 6448- RELEASE-NOTES: synced 6449 6450- [Yusuke Nakamura brought this change] 6451 6452 docs/HTTP3.md: fix nghttp2's HTTP/3 server port 6453 6454 Port 8443 does not work now. 6455 Correct origin is in the quicwg's wiki. 6456 https://github.com/quicwg/base-drafts/wiki/Implementations#ngtcp2 6457 6458 Closes #6964 6459 6460- krb5: don't use 'static' to store PBSZ size response 6461 6462 ... because it makes the knowledge and usage cross-transfer in funny and 6463 unexpected ways. 6464 6465 Reported-by: Harry Sintonen 6466 Closes #6963 6467 6468- [Kevin Burke brought this change] 6469 6470 m4: add security frameworks on Mac when compiling rustls 6471 6472 Previously compiling rustls on Mac would only complete if you also 6473 compiled the SecureTransport TLS backend, which curl would prefer to 6474 the Rust backend. 6475 6476 Appending these flags to LDFLAGS makes it possible to compile the 6477 Rustls backend on Mac without the SecureTransport backend, which means 6478 this patch will make it possible for Mac users to use the Rustls 6479 backend for TLS. 6480 6481 Reviewed-by: Jacob Hoffman-Andrews 6482 6483 Fixes #6955 6484 Cloes #6956 6485 6486- krb5: remove the unused 'overhead' function 6487 6488 Closes #6947 6489 6490- [Johann150 brought this change] 6491 6492 curl_url_set.3: add memory management information 6493 6494 wording taken from man page for CURLOPT_URL.3 6495 6496 As far as I can see, the URL part is either malloc'ed before due to 6497 encoding or it is strdup'ed. 6498 6499 Closes #6953 6500 6501- [Jacob Hoffman-Andrews brought this change] 6502 6503 c-hpyer: fix handling of zero-byte chunk from hyper 6504 6505 Closes #6951 6506 6507- CURLOPT_POSTFIELDS.3: clarify how it gets the size of the data 6508 6509 Ref: https://curl.se/mail/lib-2021-04/0085.html 6510 Closes #6943 6511 6512- [Ralph Langendam brought this change] 6513 6514 cmake: make libcurl output filename configurable 6515 6516 Reviewed-by: Jakub Zakrzewski 6517 Closes #6933 6518 6519- [Patrick Monnerat brought this change] 6520 6521 vtls: reset ssl use flag upon negotiation failure 6522 6523 Fixes the segfault in ldaps disconnect. 6524 6525 Reported-by: Illarion Taev 6526 Fixes #6934 6527 Closes #6937 6528 6529- configure: fix typo in TLS error message 6530 6531 Reported-by: Pontus Lundkvist 6532 6533- README: link to the commercial support option 6534 6535Jay Satiro (22 Apr 2021) 6536- [Martin Halle brought this change] 6537 6538 version: add gsasl_version to curl_version_info_data 6539 6540 - Add gsasl_version string and bump to CURLVERSION_TENTH. 6541 6542 Ref: https://curl.se/mail/lib-2021-04/0003.html 6543 6544 Closes https://github.com/curl/curl/pull/6843 6545 6546- [Morten Minde Neergaard brought this change] 6547 6548 schannel: Support strong crypto option 6549 6550 - Support enabling strong crypto via optional user cipher list when 6551 USE_STRONG_CRYPTO or SCH_USE_STRONG_CRYPTO is in the list. 6552 6553 MSDN says SCH_USE_STRONG_CRYPTO "Instructs Schannel to disable known 6554 weak cryptographic algorithms, cipher suites, and SSL/TLS protocol 6555 versions that may be otherwise enabled for better interoperability." 6556 6557 Ref: https://curl.se/mail/lib-2021-02/0066.html 6558 Ref: https://curl.se/docs/manpage.html#--ciphers 6559 Ref: https://curl.se/libcurl/c/CURLOPT_SSL_CIPHER_LIST.html 6560 Ref: https://docs.microsoft.com/en-us/windows/win32/api/schannel/ns-schannel-schannel_cred 6561 6562 Closes https://github.com/curl/curl/pull/6734 6563 6564Daniel Stenberg (22 Apr 2021) 6565- RELEASE-NOTES: synced 6566 6567- ci: adapt to configure requiring an explicit TLS choice 6568 6569- configure: split out each TLS library detector into its own function 6570 6571 ... and put those functions in separate m4 files per TLS library. 6572 6573- configure: make the TLS library choice(s) explicit 6574 6575 configure no longer tries to find a TLS library by default, but all 6576 libraries are now equal: the user needs to explicitly ask what TLS 6577 library or libraries to use. 6578 6579 If no TLS library is selected, configure will error out unless 6580 --without-ssl is explicitly used to request a built without TLS (as that 6581 is very rare these days). 6582 6583 Removes: --with-winssl, --with-darwinssl and all --without-* options for 6584 TLS libraries. 6585 6586 Closes #6897 6587 6588- tests/disable-scan.pl: also scan all m4 files 6589 6590 Fixes test 1165 when functions are moved from configure.ac to files in 6591 m4/ 6592 6593Jay Satiro (22 Apr 2021) 6594- schannel: Disable auto credentials; add an option to enable it 6595 6596 - Disable auto credentials by default. This is a breaking change 6597 for clients that are using it, wittingly or not. 6598 6599 - New libcurl ssl option value CURLSSLOPT_AUTO_CLIENT_CERT tells libcurl 6600 to automatically locate and use a client certificate for 6601 authentication, when requested by the server. 6602 6603 - New curl tool options --ssl-auto-client-cert and 6604 --proxy-ssl-auto-client-cert map to CURLSSLOPT_AUTO_CLIENT_CERT. 6605 6606 This option is only supported for Schannel (the native Windows SSL 6607 library). Prior to this change Schannel would, with no notification to 6608 the client, attempt to locate a client certificate and send it to the 6609 server, when requested by the server. Since the server can request any 6610 certificate that supports client authentication in the OS certificate 6611 store it could be a privacy violation and unexpected. 6612 6613 Fixes https://github.com/curl/curl/issues/2262 6614 Reported-by: Jeroen Ooms 6615 Assisted-by: Wes Hinsley 6616 Assisted-by: Rich FitzJohn 6617 6618 Ref: https://curl.se/mail/lib-2021-02/0066.html 6619 Reported-by: Morten Minde Neergaard 6620 6621 Closes https://github.com/curl/curl/pull/6673 6622 6623Daniel Stenberg (22 Apr 2021) 6624- [Michał Antoniak brought this change] 6625 6626 vtls: deduplicate some DISABLE_PROXY ifdefs 6627 6628 continue from #5735 6629 6630 - using SSL_HOST_NAME, SSL_HOST_DISPNAME, SSL_PINNED_PUB_KEY for other 6631 tls backend 6632 6633 - create SSL_HOST_PORT 6634 6635 Closes #6660 6636 6637Jay Satiro (22 Apr 2021) 6638- OS400: fix typo 6639 6640 CURLVERSION_HEIGHTH -> CURLVERSION_EIGHTH 6641 6642Daniel Stenberg (22 Apr 2021) 6643- checksrc: complain on == NULL or != 0 checks in conditions 6644 6645 ... to make them all consistenly use if(!var) and if(var) 6646 6647 Also added a few missing warnings to the documentation. 6648 6649 Closes #6912 6650 6651- tidy-up: make conditional checks more consistent 6652 6653 ... remove '== NULL' and '!= 0' 6654 6655 Closes #6912 6656 6657- [Patrick Monnerat brought this change] 6658 6659 vauth: factor base64 conversions out of authentication procedures 6660 6661 Input challenges and returned messages are now in binary. 6662 Conversions from/to base64 are performed by callers (currently curl_sasl.c 6663 and http_ntlm.c). 6664 6665 Closes #6654 6666 6667- [Patrick Monnerat brought this change] 6668 6669 bufref: buffer reference support 6670 6671 A struct bufref holds a buffer pointer, a data size and a destructor. 6672 When freed or its contents are changed, the previous buffer is implicitly 6673 released by the associated destructor. The data size, although not used 6674 internally, allows binary data support. 6675 6676 A unit test checks its handling methods: test 1661 6677 6678 Closes #6654 6679 6680- [Patrick Monnerat brought this change] 6681 6682 os400: additional support for options metadata 6683 6684 New functions curl_easy_option_by_name_ccsid() and 6685 curl_easy_option_get_name_ccsid() allows accessing metadata in alternate 6686 character encoding. 6687 6688 This commit also updates curl_version_info_ccsid() to handle info version 9 6689 and adds recent definitions to the ILE/RPG include file. 6690 6691 Documentation updated accordingly. 6692 6693 Reviewed-by: Jon Rumsey 6694 Closes #6574 6695 6696- [Patrick Monnerat brought this change] 6697 6698 test server: take care of siginterrupt() deprecation 6699 6700 Closes #6529 6701 6702Marc Hoersken (21 Apr 2021) 6703- lib1564.c: enable last wakeup test part on Windows 6704 6705 Suggested-by: Gergely Nagy 6706 Reviewed-by: Jay Satiro 6707 Reviewed-by: Marcel Raad 6708 6709 Closes #6245 6710 6711- multi: fix slow write/upload performance on Windows 6712 6713 Reset FD_WRITE by sending zero bytes which is permissible 6714 and will be treated by implementations as successful send. 6715 6716 Without this we won't be notified in case a socket is still 6717 writable if we already received such a notification and did 6718 not send any data afterwards on the socket. This would lead 6719 to waiting forever on a writable socket being writable again. 6720 6721 Assisted-by: Tommy Odom 6722 Reviewed-by: Jay Satiro 6723 Reviewed-by: Marcel Raad 6724 Tested-by: tmkk on github 6725 6726 Bug: #6146 6727 Closes #6245 6728 6729- multi: reduce Win32 API calls to improve performance 6730 6731 1. Consolidate pre-checks into a single Curl_poll call: 6732 6733 This is an attempt to restructure the code in Curl_multi_wait 6734 in such a way that less syscalls are made by removing individual 6735 calls to Curl_socket_check via SOCKET_READABLE/SOCKET_WRITABLE. 6736 6737 2. Avoid resetting the WinSock event multiple times: 6738 6739 We finally call WSAResetEvent anyway, so specifying it as 6740 an optional parameter to WSAEnumNetworkEvents is redundant. 6741 6742 3. Wakeup directly in case no sockets are being monitoring: 6743 6744 Fix the WinSock based implementation to skip extra waiting by 6745 not sleeping in case no sockets are to be waited on and just 6746 the WinSock event is being monitored for wakeup functionality. 6747 6748 Assisted-by: Tommy Odom 6749 Reviewed-by: Jay Satiro 6750 Reviewed-by: Marcel Raad 6751 6752 Bug: #6146 6753 Closes #6245 6754 6755- Revert "Revert 'multi: implement wait using winsock events'" 6756 6757 This reverts commit 2260e0ebe6d45529495231b3e37a0c58fb92a6a2, 6758 also restoring previous follow up changes which were reverted. 6759 6760 Authored-by: rcombs on github 6761 Authored-by: Marc Hörsken 6762 Reviewed-by: Jay Satiro 6763 Reviewed-by: Marcel Raad 6764 6765 Restores #5634 6766 Reverts #6281 6767 Part of #6245 6768 6769Daniel Stenberg (21 Apr 2021) 6770- Revert "cmake: make libcurl library output name configurable" 6771 6772 This reverts commit 1cba36d2166c396f987eea587cf92671b27acb92. 6773 6774 CMake provides properties that can be set on a target to rename the 6775 output artifact without changing the name of a target. 6776 6777 Ref: #6899 6778 6779- [Michael Kolechkin brought this change] 6780 6781 sectransp: allow cipher name to be specified 6782 6783 Add parser for CURLOPT_SSL_CIPHER_LIST option for Secure Transport (ST) 6784 back-end. Similar to NSS and GSKit back-ends, new code parses string 6785 value and configures ST library to use those ciphers for communication. 6786 Create cipher spec data structure and initialize the array of specs with 6787 cipher number, name, alias, and 'weak' flag. 6788 6789 Mark triple-DES ciphers as 'weak', and exclude them from the default 6790 ciphers list. 6791 6792 Closes #6464 6793 6794- [Michael Kolechkin brought this change] 6795 6796 NSS: add ciphers to map 6797 6798 Add cipher names to the `cipherlist` map, based on the list of ciphers 6799 implemented by the NSS in the source code file 6800 https://github.com/nss-dev/nss/blob/master/lib/ssl/sslenum.c 6801 6802 Closes #6670 6803 6804- http2: remove DEBUG_HTTP2 6805 6806 Accidentally committed in 605e84235 6807 6808- [Ralph Langendam brought this change] 6809 6810 cmake: make libcurl library output name configurable 6811 6812 Closes #6899 6813 6814- sws: #ifdef S_IFSOCK use 6815 6816 SCO OpenServer 5.0.7 does not define S_IFSOCK. 6817 6818 Reported-by: Kevin R. Bulgrien 6819 Bug: https://curl.se/mail/lib-2021-04/0074.html 6820 Closes #6926 6821 6822- curl_setup: provide the shutdown flags wider 6823 6824 By using #ifdef on the symbol names to work on anything that don't 6825 provide them. SCO OpenServer 5.0.7, sys/socket.h does not define either 6826 SHUT_RDWR, SHUT_RD, and SHUT_WR. 6827 6828 Reported-by: Kevin R. Bulgrien 6829 Bug: https://curl.se/mail/lib-2021-04/0073.html 6830 Closes #6925 6831 6832- connect: use CURL_SA_FAMILY_T for portability 6833 6834 Reported-by: Kevin R. Bulgrien 6835 Bug: https://curl.se/mail/lib-2021-04/0071.html 6836 6837 Closes #6918 6838 6839- urlapi: make sure no +/- signs are accepted in IPv4 numericals 6840 6841 Follow-up to 56a037cc0ad1b2. Extends test 1560 to verify. 6842 6843 Reported-by: Tuomas Siipola 6844 Fixes #6916 6845 Closes #6917 6846 6847- ConnectionExists: respect requests for h1 connections better 6848 6849 ... for situations when multiplexing isn't enabled on the h2 connection 6850 and h1 is explicitly requested for the transfer. 6851 6852 Assisted-by: Gergely Nagy 6853 6854- multi: don't close connection HTTP_1_1_REQUIRED 6855 6856 The ConnectionExists() function will note that the new transfer wants 6857 less then h2 and that it can't multiplex it and therefor opt to open a 6858 new connection instead. 6859 6860- http2: move the stream error field to the per-transfer storage 6861 6862 Storing a stream error in the per-connection struct was an error that lead to 6863 race conditions as subsequent stream handling could overwrite the error code 6864 before it was used for the stream with the actual problem. 6865 6866 Closes #6910 6867 6868- http2: call the handle-closed function correctly on closed stream 6869 6870 This was this one condition where the stream could be closed due to an 6871 error and the function would still wrongly just return 0 for it. 6872 6873 Reported-by: Gergely Nagy 6874 Fixes #6862 6875 Closes #6910 6876 6877- test1660: check the created HSTS file as text mode 6878 6879 Closes #6922 6880 6881- RELEASE-NOTES: synced 6882 6883- test 493: require https in curl to run 6884 6885 Closes #6927 6886 6887Jay Satiro (20 Apr 2021) 6888- tool_operate: don't discard failed parallel transfer result 6889 6890 - Save a parallel transfer's result code only when it fails and the 6891 transfer is not being retried. 6892 6893 Prior to this change the result code was always set which meant that a 6894 failed result could be erroneously discarded if a different transfer 6895 later had a successful result (CURLE_OK). 6896 6897 Before: 6898 6899 > curl --fail -Z https://httpbin.org/status/404 https://httpbin.org/delay/10 6900 > echo %ERRORLEVEL% 6901 0 6902 6903 After: 6904 6905 > curl --fail -Z https://httpbin.org/status/404 https://httpbin.org/delay/10 6906 > echo %ERRORLEVEL% 6907 22 6908 6909 Closes #xxxx 6910 6911- [Georeth Zhou brought this change] 6912 6913 openssl: fix build error with OpenSSL < 1.0.2 6914 6915 Closes https://github.com/curl/curl/pull/6920 6916 6917Viktor Szakats (19 Apr 2021) 6918- README.md: delete Codacy UTM parameters & follow permanent redirect [ci skip] 6919 6920 UTM parameters leak referrer and various marketing/tracking information 6921 even if these would normally be stripped by website or client policy. 6922 This link also works fine without them. Also took the opportunity to 6923 update the URL to the one pointed to by the previous one via permanent 6924 redirect. 6925 6926 Reviewed-by: Daniel Stenberg 6927 Closes #6919 6928 6929Daniel Stenberg (19 Apr 2021) 6930- urlapi: "normalize" numerical IPv4 host names 6931 6932 When the host name in a URL is given as an IPv4 numerical address, the 6933 address can be specified with dotted numericals in four different ways: 6934 a32, a.b24, a.b.c16 or a.b.c.d and each part can be specified in 6935 decimal, octal (0-prefixed) or hexadecimal (0x-prefixed). 6936 6937 Instead of passing on the name as-is and leaving the handling to the 6938 underlying name functions, which made them not work with c-ares but work 6939 with getaddrinfo, this change now makes the curl URL API itself detect 6940 and "normalize" host names specified as IPv4 numericals. 6941 6942 The WHATWG URL Spec says this is an okay way to specify a host name in a 6943 URL. RFC 3896 does not allow them, but curl didn't prevent them before 6944 and it seems other RFC 3896-using tools have not either. Host names used 6945 like this are widely supported by other tools as well due to the 6946 handling being done by getaddrinfo and friends. 6947 6948 I decided to add the functionality into the URL API itself so that all 6949 users of these functions get the benefits, when for example wanting to 6950 compare two URLs. Also, it makes curl built to use c-ares now support 6951 them as well and make curl builds more consistent. 6952 6953 The normalization makes HTTPS and virtual hosted HTTP work fine even 6954 when curl gets the address specified using one of the "obscure" formats. 6955 6956 Test 1560 is extended to verify. 6957 6958 Fixes #6863 6959 Closes #6871 6960 6961- libssh: fix "empty expression statement has no effect" warnings 6962 6963 ... by fixing macros to do-while constructs and moving out the calls to 6964 "break" outside of the actual macro. It also fixes the problem where the 6965 macro was used witin a loop and the break didn't do right. 6966 6967 Reported-by: Emil Engler 6968 Fixes #6847 6969 Closes #6909 6970 6971- hsts: enable by default 6972 6973 No longer considered experimental. 6974 6975 Closes #6700 6976 6977- vtls: refuse setting any SSL version 6978 6979 ... previously they were supported if a TLS library would (unexpectedly) 6980 still support them, but from this change they will be refused already in 6981 curl_easy_setopt(). SSLv2 and SSLv3 have been known to be insecure for 6982 many years now. 6983 6984 Closes #6773 6985 6986- curl: ignore options asking for SSLv2 or SSLv3 6987 6988 Instead output a warning about it and continue with the defaults. 6989 6990 These SSL versions are typically not supported by the TLS libraries since a 6991 long time back already since they are inherently insecure and broken. Asking 6992 for them to be used will just cause an error to be returned slightly later. 6993 6994 In the unlikely event that a user's TLS library actually still supports these 6995 protocol versions, this change might make the request a little less insecure. 6996 6997 Closes #6772 6998 6999- test972: verify the json output with jsonlint 7000 7001 Make sure one of the azure jobs has jsonlint installed so that the test 7002 runs there. 7003 7004 Ref: #6905 7005 7006- [Jay Satiro brought this change] 7007 7008 tool_writeout: fix the HTTP_CODE json output 7009 7010 Update test 970 accordingly. 7011 7012 Reported-by: Michal Rus 7013 Fixes #6905 7014 Closes #6906 7015 7016- openldap: protect SSL-specific code with proper #ifdef 7017 7018 Closes #6901 7019 7020- libssh2: fix Value stored to 'sshp' is never read 7021 7022 Pointed out by scan-build 7023 7024 Closes #6900 7025 7026- [Victor Vieux brought this change] 7027 7028 tool_getparam: replace (in-place) '%20' by '+' according to RFC1866 7029 7030 Signed-off-by: Victor Vieux <victorvieux@gmail.com> 7031 7032 Closes #6895 7033 7034- configure: provide --with-openssl, deprecate --with-ssl 7035 7036 Makes the option more explicit. 7037 7038 Closes #6887 7039 7040- RELEASE-NOTES: synced 7041 7042 and bumped curlver to 7.77.0 7043 7044- [Javier Blazquez brought this change] 7045 7046 rustls: only return CURLE_AGAIN when TLS session is fully drained 7047 7048 The code in cr_recv was returning prematurely as soon as the socket 7049 reported no more data to read. However, this could be leaving some 7050 unread plaintext data in the rustls session from a previous call, 7051 causing causing the transfer to hang if the socket never receives 7052 further data. 7053 7054 We need to ensure that the session is fully drained of plaintext data 7055 before returning CURLE_AGAIN to the caller. 7056 7057 Reviewed-by: Jacob Hoffman-Andrews 7058 Closes #6894 7059 7060- cookie: CURLOPT_COOKIEFILE set to NULL switches off cookies 7061 7062 Add test 676 to verify that setting CURLOPT_COOKIEFILE to NULL again clears 7063 the cookiejar from memory. 7064 7065 Reported-by: Stefan Karpinski 7066 Fixes #6889 7067 Closes #6891 7068 7069Version 7.76.1 (14 Apr 2021) 7070 7071Daniel Stenberg (14 Apr 2021) 7072- RELEASE-NOTES: synced 7073 7074 curl 7.76.1 release 7075 7076- THANKS: add names from 7.76.1 7077 7078- misc: update copyright year ranges to match latest updates 7079 7080- [Tatsuhiro Tsujikawa brought this change] 7081 7082 ngtcp2: Use ALPN h3-29 for now 7083 7084 Fixes #6864 7085 Cloes #6886 7086 7087Jay Satiro (11 Apr 2021) 7088- TODO: remove 18.22 --fail-with-body 7089 7090 --fail-with-body was added in 8a964cb (precedes curl-7_76_0). 7091 7092Daniel Stenberg (10 Apr 2021) 7093- [Jürgen Gmach brought this change] 7094 7095 src/tool_vms.c: remove duplicated word in comment 7096 7097 Closes #6881 7098 7099- configure: fix CURL_DARWIN_CFLAGS use 7100 7101 The macro name change was not completely done. 7102 7103 Follow-up to 5d2c384452543c 7104 Bug: https://github.com/curl/curl/commit/5d2c384452543c7b6c9fb02eaa0afc84fd5ab941#commitcomment-49315187 7105 Reported-by: Marcel Raad 7106 Closes #6878 7107 7108- [Anthony Shaw brought this change] 7109 7110 github/workflow: add "security-extended" to codeql-analysis.yml 7111 7112 Extends the CodeQL code scan. 7113 7114 Closes #6815 7115 7116- [Jochem Broekhoff brought this change] 7117 7118 examples/hiperfifo.c: check event_initialized before delete 7119 7120 If event_del is called with the event struct (still) zeroed out, a 7121 segmentation fault may occur. event_initialized checks whether the 7122 event struct is nonzero. 7123 7124 Closes #6876 7125 7126- [Patrick Monnerat brought this change] 7127 7128 ntlm: fix negotiated flags usage 7129 7130 According to Microsoft document MS-NLMP, current flags usage is not 7131 accurate: flag NTLMFLAG_NEGOTIATE_NTLM2_KEY controls the use of 7132 extended security in an NTLM authentication message and NTLM version 2 7133 cannot be negotiated within the protocol. 7134 7135 The solution implemented here is: if the extended security flag is set, 7136 prefer using NTLM version 2 (as a server featuring extended security 7137 should also support version 2). If version 2 has been disabled at 7138 compile time, use extended security. 7139 7140 Tests involving NTLM are adjusted to this new behavior. 7141 7142 Fixes #6813 7143 Closes #6849 7144 7145- [Patrick Monnerat brought this change] 7146 7147 ntlm: support version 2 on 32-bit platforms 7148 7149 Closes #6849 7150 7151- [Patrick Monnerat brought this change] 7152 7153 curl_ntlm_core.h: simplify conditionals for USE_NTLM2SESSION 7154 7155 ... as !defined(CURL_DISABLE_CRYPTO_AUTH) is a prerequisite for the 7156 whole NTLM. 7157 7158 Closes #6849 7159 7160- lib: remove unused HAVE_INET_NTOA_R* defines 7161 7162 Closes #6867 7163 7164- [Michael Forney brought this change] 7165 7166 configure: include <time.h> unconditionally 7167 7168 In 2682e5f5, several instances of AC_HEADER_TIME were removed since 7169 it is a deprecated autoconf macro. However, this was the macro that 7170 defined TIME_WITH_SYS_TIME, which was used to indicate that <time.h> 7171 can be included alongside <sys/time.h>. TIME_WITH_SYS_TIME is still 7172 used in the configure test body and since it is no longer defined, 7173 <time.h> is *not* included on systems that have <sys/time.h>. 7174 7175 In particular, at least on musl libc and glibc, <sys/time.h> does 7176 not implicitly include <time.h> and does not declare clock_gettime, 7177 gmtime_r, or localtime_r. This causes configure to fail to detect 7178 those functions. 7179 7180 The AC_HEADER_TIME macro deprecation text says 7181 7182 > All current systems provide time.h; it need not be checked for. 7183 > Not all systems provide sys/time.h, but those that do, all allow 7184 > you to include it and time.h simultaneously. 7185 7186 So, to fix this issue, simply include <time.h> unconditionally when 7187 testing for time-related functions and in libcurl, and don't bother 7188 checking for it. 7189 7190 Closes #6859 7191 7192- [Michael Forney brought this change] 7193 7194 configure: remove use of RETSIGTYPE 7195 7196 This was previously defined by the obsolete AC_TYPE_SIGNAL macro, 7197 which was removed in 2682e5f5. The deprecation text says 7198 7199 > Your code may safely assume C89 semantics that RETSIGTYPE is void. 7200 7201 So, remove it and just use void instead. 7202 7203 Closes #6861 7204 7205- [Muhammed Yavuz Nuzumlalı brought this change] 7206 7207 install: add instructions for Apple Darwin platforms 7208 7209 Closes #6860 7210 7211- [Muhammed Yavuz Nuzumlalı brought this change] 7212 7213 configure: disable min version set for Darwin 7214 7215 Fixes #6838 7216 Closes #6860 7217 7218- [David Hu brought this change] 7219 7220 docs/HTTP3.md: update the build instruction using gnutls 7221 7222 In ngtcp2 the `with-gnutls` option is disabled by default, which will 7223 cause `curl` unable to be `make` because of lacking the libraries 7224 needed. 7225 7226 Closes #6857 7227 7228- RELEASE-NOTES: synced 7229 7230- typecheck-gcc: make the ssl-ctx-cb check use SSL_CTX pointers 7231 7232 ... and not values. 7233 7234 Reported-by: locpyl-tidnyd on github 7235 Fixes #6818 7236 Closes #6819 7237 7238- ngtcp2+gnutls: clear credentials when freed 7239 7240 ... to avoid double-free. 7241 7242 Reported-by: Kenneth Davidson 7243 Fixes #6824 7244 Closes #6856 7245 7246Jay Satiro (5 Apr 2021) 7247- [Cherish98 brought this change] 7248 7249 tool_progress: Fix progress meter in parallel mode 7250 7251 Make sure the total amount of DL/UL bytes are counted before the 7252 transfer finalizes. Otherwise if a transfer finishes too quick, its 7253 total numbers are not added, and results in a DL%/UL% that goes above 7254 100%. 7255 7256 Detail: 7257 7258 progress_meter() is called periodically, and it may not catch a 7259 transfer's total bytes if the value was unknown during the last call, 7260 and the transfer is finished and deleted (i.e., lost) during the next 7261 call. 7262 7263 Closes https://github.com/curl/curl/pull/6840 7264 7265- [Emil Engler brought this change] 7266 7267 libssh: get rid of PATH_MAX 7268 7269 This removes the last occurrence of PATH_MAX inside our libssh 7270 implementation by calculating the path length from the string length of 7271 the two components. 7272 7273 Closes #6829 7274 7275Daniel Stenberg (5 Apr 2021) 7276- http_proxy: only loop on 407 + close if we have credentials 7277 7278 ... to fix the retry-loop. 7279 7280 Add test 718 to verify. 7281 7282 Reported-by: Daniel Kurečka 7283 Fixes #6828 7284 Closes #6850 7285 7286- h2: allow 100 streams by default 7287 7288 instead of 13, before the server has told how many streams it 7289 accepts. The server can always reject new streams anyway if we go above 7290 what it accepts. 7291 7292 Ref: #6826 7293 Closes #6852 7294 7295- [Luke Granger-Brown brought this change] 7296 7297 file: support GETing directories again 7298 7299 After 957bc1881e686f9714c4e6a01bf33535091f0e21, we no longer compute an 7300 expected_size for directories. This has the upshot that when we compare 7301 even an empty Range with the available size, we fail. 7302 7303 This brings back the previous behaviour, which was to succeed, but with 7304 empty content. This also removes the "Accept-ranges: bytes" header, 7305 which is nonsensical on directories. 7306 7307 Adds test 3016 7308 Fixes #6845 7309 Closes #6846 7310 7311- RELEASE-NOTES: synced 7312 7313 and bumped to 7.76.1 7314 7315- TLS: fix HTTP/2 selection 7316 7317 for GnuTLS, BearSSL, mbedTLS, NSS, SChannnel, Secure Transport and 7318 wolfSSL... 7319 7320 Regression since 88dd1a8a115b1f5ece (shipped in 7.76.0) 7321 Reported-by: Kenneth Davidson 7322 Reported-by: romamik om github 7323 Fixes #6825 7324 Closes #6827 7325 7326Jay Satiro (2 Apr 2021) 7327- hostip: Fix for builds that disable all asynchronous DNS 7328 7329 - Define Curl_resolver_error function only when USE_CURL_ASYNC. 7330 7331 Prior to this change building curl without an asynchronous resolver 7332 backend (c-ares or threaded) and without DoH (DNS-over-HTTPS, which is 7333 also asynchronous but independent of resolver backend) would cause a 7334 build error since Curl_resolver_error is called by and evaluates 7335 variables only available in asynchronous builds. 7336 7337 Reported-by: Benbuck Nason 7338 7339 Fixes https://github.com/curl/curl/issues/6831 7340 Closes https://github.com/curl/curl/pull/6832 7341 7342Daniel Stenberg (31 Mar 2021) 7343- [Gilles Vollant brought this change] 7344 7345 openssl: Fix CURLOPT_SSLCERT_BLOB without CURLOPT_SSLCERT_KEY 7346 7347 Reported-by: Christian Schmitz 7348 Fixes #6816 7349 Closes #6820 7350 7351Version 7.76.0 (31 Mar 2021) 7352 7353Daniel Stenberg (31 Mar 2021) 7354- RELEASE-NOTES: synced 7355 7356 curl 7.76.0 release 7357 7358- THANKS: added names from 7.76.0 7359 7360- CURLOPT_AUTOREFERER.3: clarify that it sets the full URL 7361 7362 ... some users may not want that! 7363 7364- define: remove CURL_DISABLE_NTLM ifdefs 7365 7366 It was never defined anywhere. Fixed disable-scan (test 1165) to also 7367 scan headers, which found this issue. 7368 7369 Closes #6809 7370 7371- vtls: fix addsessionid for non-proxy builds 7372 7373 Follow-up to b09c8ee15771c61 7374 Fixes #6812 7375 Closes #6811 7376 7377- [Li Xinwei brought this change] 7378 7379 cmake: support WinIDN 7380 7381 Closes #6807 7382 7383- transfer: clear 'referer' in declaration 7384 7385 To silence (false positive) compiler warnings about it. 7386 7387 Follow-up to 7214288898f5625 7388 7389 Reviewed-by: Marcel Raad 7390 Closes #6810 7391 7392- [Marc Hoersken brought this change] 7393 7394 config: fix SSPI enabling NTLM if crypto auth is disabled 7395 7396 Avoid enabling NTLM feature based upon Windows SSPI 7397 being enabled in case that crypto auth is disabled. 7398 7399 Reported-by: Marcel Raad 7400 7401 Follow-up to #6277 7402 Fixes #6803 7403 Closes #6808 7404 7405- HISTORY: add two 2021 events 7406 7407- vtls: add 'isproxy' argument to Curl_ssl_get/addsessionid() 7408 7409 To make sure we set and extract the correct session. 7410 7411 Reported-by: Mingtao Yang 7412 Bug: https://curl.se/docs/CVE-2021-22890.html 7413 7414 CVE-2021-22890 7415 7416- [Viktor Szakats brought this change] 7417 7418 transfer: strip credentials from the auto-referer header field 7419 7420 Added test 2081 to verify. 7421 7422 CVE-2021-22876 7423 7424 Bug: https://curl.se/docs/CVE-2021-22876.html 7425 7426- curl_sasl: fix compiler error with --disable-crypto-auth 7427 7428 ... if libgsasl was found. 7429 7430 Closes #6806 7431 7432- [Patrick Monnerat brought this change] 7433 7434 ldap: only set the callback ptr for TLS context when TLS is used 7435 7436 Follow-up to a5eee22e594c2460f 7437 Fixes #6804 7438 Closes #6805 7439 7440- copyright: update copyright year ranges to 2021 7441 7442 Reviewed-by: Emil Engler 7443 Closes #6802 7444 7445- send_speed: simplify the checks for if a speed limit is set 7446 7447 ... as we know the value cannot be set to negative: enforced by 7448 setopt() 7449 7450- http: cap body data amount during send speed limiting 7451 7452 By making sure never to send off more than the allowed number of bytes 7453 per second the speed limit logic is given more room to actually work. 7454 7455 Reported-by: Fabian Keil 7456 Bug: https://curl.se/mail/lib-2021-03/0042.html 7457 Closes #6797 7458 7459- urldata: merge "struct DynamicStatic" into "struct UrlState" 7460 7461 Both were used for the same purposes and there was no logical separation 7462 between them. Combined, this also saves 16 bytes in less holes in my 7463 test build. 7464 7465 Closes #6798 7466 7467- tests/README.md: mentioned that en_US.UTF-8 is required 7468 7469 Reported-by: Oumph on github 7470 Fixes #6768 7471 7472- HISTORY: fixed the Mac OS X 10.1 release date 7473 7474 Based on what Wikipedia says 7475 7476Jay Satiro (26 Mar 2021) 7477- examples: Remove threaded-shared-conn.c due to bug 7478 7479 Known bug 11.11 is the shared object's connection cache is not thread 7480 safe, so we should not have an example for it. 7481 7482 Ref: https://github.com/curl/curl/issues/4915 7483 Ref: https://curl.se/docs/knownbugs.html#A_shared_connection_cache_is_not 7484 7485 Closes https://github.com/curl/curl/pull/6795 7486 7487- KNOWN_BUGS: Update 11.9 - DoH option inheritance 7488 7489 - Add description: Explain that some options aren't inherited because 7490 they are not relevant for the DoH SSL connections or may result in 7491 unexpected behavior. 7492 7493 - Remove the reference to #4578 (SSL verify options not inherited) since 7494 that was fixed by #6597 (separate DoH-specific options for verify). 7495 7496 - Explain that DoH-specific options (those created by #6597) are 7497 available: CURLOPT_DOH_SSL_VERIFYHOST, CURLOPT_DOH_SSL_VERIFYPEER and 7498 CURLOPT_DOH_SSL_VERIFYSTATUS. 7499 7500 - Add a reference to #6605 and explain that the user's debug function is 7501 not inherited because it would be unexpected to pass internal handles 7502 (ie DoH handles) to the user's callback. 7503 7504 Closes https://github.com/curl/curl/issues/6605 7505 7506Daniel Stenberg (26 Mar 2021) 7507- curl_easy_setopt.3: add curl_easy_option* functions to SEE ALSO 7508 7509- [Jean-Philippe Menil brought this change] 7510 7511 openssl: ensure to check SSL_CTX_set_alpn_protos return values 7512 7513 SSL_CTX_set_alpn_protos() return 0 on success, and non-0 on failure 7514 7515 Signed-off-by: Jean-Philippe Menil <jpmenil@gmail.com> 7516 7517 Closes #6794 7518 7519- multi: close the connection when h2=>h1 downgrading 7520 7521 Otherwise libcurl is likely to reuse the connection again in the next 7522 attempt since the connection reuse logic doesn't take downgrades into 7523 account. 7524 7525 Reported-by: Anthony Ramine 7526 Fixes #6788 7527 Closes #6793 7528 7529- openssl: set the transfer pointer for logging early 7530 7531 Otherwise, the transfer will be NULL in the trace function when the 7532 early handshake details arrive and then curl won't show them. 7533 7534 Regresssion in 7.75.0 7535 7536 Reported-by: David Hu 7537 Fixes #6783 7538 Closes #6792 7539 7540- RELEASE-NOTES: synced 7541 7542- TODO: Custom progress meter update interval 7543 7544 Ref: https://stackoverflow.com/q/66789977/93747 7545 7546- docs/ABI: tighten up the language 7547 7548 Make the promises more firm 7549 7550 Closes #6786 7551 7552- openldap: disconnect better 7553 7554 Instead of clearing the callback argument in disconnect, set it to the 7555 (new) transfer to make sure the correct data is passed to the callbacks. 7556 7557 Follow-up to e467ea3bd937f38 7558 Assisted-by: Patrick Monnerat 7559 Closes #6787 7560 7561- libssh2: kdb_callback: get the right struct pointer 7562 7563 After the recent conn/data refactor in this source file, this function 7564 was mistakenly still getting the old struct pointer which would lead to 7565 crash on servers with keyboard-interactive auth enabled. 7566 7567 Follow-up to a304051620b92e12b (shipped in 7.75.0) 7568 7569 Reported-by: Christian Schmitz 7570 Fixes #6691 7571 Closes #6782 7572 7573- tftp: remove unused struct fields 7574 7575 Follow-up to d3d90ad9c00530d 7576 7577 Closes #6781 7578 7579- openldap: avoid NULL pointer dereferences 7580 7581 Follow-up to a59c33ceffb8f78 7582 Reported-by: Patrick Monnerat 7583 Fixes #6676 7584 Closes #6780 7585 7586- http: strip default port from URL sent to proxy 7587 7588 To make sure the Host: header and the URL provide the same authority 7589 portion when sent to the proxy, strip the default port number from the 7590 URL if one was provided. 7591 7592 Reported-by: Michael Brown 7593 Fixes #6769 7594 Closes #6778 7595 7596- azure: disable test 433 on azure-ubuntu 7597 7598 Something in that environment sets XDG_CONFIG_HOME for us in a way that 7599 breaks the test. 7600 7601 Reported-by: Marc Hörsken 7602 Fixes #6739 7603 Closes #6777 7604 7605- tftp: remove the 3600 second default timeout 7606 7607 ... it was never meant to be there. 7608 7609 Reported-by: Tomas Berger 7610 Fixes #6774 7611 Closes #6776 7612 7613- docs: make gen.pl support *italic* and **bold** 7614 7615 Remove some nroffisms from the cmdline doc files to simplify editing, 7616 and instead support this markdown style. 7617 7618 Closes #6771 7619 7620- ngtcp2: sync with recent API updates 7621 7622 Closes #6770 7623 7624- RELEASE-NOTES: synced 7625 7626- libssh2:ssh_connect: clear session pointer after free 7627 7628 If libssh2_knownhost_init() returns NULL, like in an OOM situation, the 7629 ssh session was freed but the pointer wasn't cleared which made libcurl 7630 later call libssh2 to cleanup using the stale pointer. 7631 7632 Fixes #6764 7633 Closes #6766 7634 7635- [Jacob Hoffman-Andrews brought this change] 7636 7637 docs: document version of crustls dependency 7638 7639 This also pins a specific release in the Travis test so future 7640 API-breaking changins in crustls won't break curl builds. 7641 7642 Add RUSTLS documentation to release tarball. 7643 7644 Enable running tests for rustls, minus FTP tests (require 7645 connect_blocking, which rustls doesn't implement) and 313 (requires CRL 7646 handling). 7647 7648 Closes #6763 7649 7650- [Jacob Hoffman-Andrews brought this change] 7651 7652 rustls: Handle close_notify. 7653 7654 If we get a close_notify, treat that as EOF. If we get an EOF from the 7655 TCP stream, treat that as an error (because we should have ended the 7656 connection earlier, when we got a close_notify). 7657 7658 Closes #6763 7659 7660- docs: clarify timeouts for queued transfers in multi API 7661 7662 Closes #6758 7663 7664- ftpserver: only load the preprocessed test file 7665 7666 We always preprocess and tests are no longer sensible to load "raw" 7667 7668 Closes #6738 7669 7670- tests: use %TESTNUMBER instead of fixed number 7671 7672 This makes the tests easier to copy and relocate to other test numbers 7673 without having to update content. 7674 7675 Closes #6738 7676 7677- KNOWN_BUGS: CURLOPT_OPENSOCKETPAIRFUNCTION is missing 7678 7679 Closes #5747 7680 7681- TODO: provide timing info for each redirect 7682 7683 Closes #6743 7684 7685Jay Satiro (17 Mar 2021) 7686- docs: Add SSL backend names to CURL_SSL_BACKEND 7687 7688 - Document the names that can be used with CURL_SSL_BACKEND: 7689 bearssl, gnutls, gskit, mbedtls, mesalink, nss, openssl, rustls, 7690 schannel, secure-transport, wolfssl 7691 7692 Ref: https://github.com/curl/curl/issues/2209#issuecomment-360623286 7693 Ref: https://github.com/curl/curl/issues/6717#issuecomment-800745201 7694 7695 Closes https://github.com/curl/curl/pull/6755 7696 7697- docs: Explain DOH transfers inherit some SSL settings 7698 7699 - Document in DOH that some SSL settings are inherited but DOH hostname 7700 and peer verification are not and are controlled separately. 7701 7702 - Document that CURLOPT_SSL_CTX_FUNCTION is inherited by DOH handles but 7703 we're considering changing behavior to no longer inherit it. Request 7704 feedback. 7705 7706 Closes https://github.com/curl/curl/pull/6688 7707 7708Daniel Stenberg (17 Mar 2021) 7709- http: make 416 not fail with resume + CURLOPT_FAILONERRROR 7710 7711 When asked to resume a download, libcurl will convert that to HTTP logic 7712 and if then the entire file is already transferred it will result in a 7713 416 response from the HTTP server. With CURLOPT_FAILONERRROR set in that 7714 scenario, it should *not* lead to an error return. 7715 7716 Updated test 1156, added test 1273 7717 7718 Reported-by: Jonathan Watt 7719 Fixes #6740 7720 Closes #6753 7721 7722- Curl_timeleft: check both timeouts during connect 7723 7724 The duration of a connect and the total transfer are calculated from two 7725 different time-stamps. It can end up with the total timeout triggering 7726 before the connect timeout expires and we should make sure to 7727 acknowledge whichever timeout that is reached first. 7728 7729 This is especially notable when a transfer first sits in PENDING, as 7730 that time is counted in the total time but the connect timeout is based 7731 on the time since the handle changed to the CONNECT state. 7732 7733 The CONNECTTIMEOUT is per connect attempt. The TIMEOUT is for the entire 7734 operation. 7735 7736 Fixes #6744 7737 Closes #6745 7738 Reported-by: Andrei Bica 7739 Assisted-by: Jay Satiro 7740 7741- configure: remove use of deprecated macros 7742 7743 AC_HEADER_TIME, AC_HEADER_STDC and AC_TYPE_SIGNAL 7744 7745- configure: make AC_TRY_* into AC_*_IFELSE 7746 7747 ... as the former versions are deprecated. 7748 7749- configure: s/AC_HELP_STRING/AS_HELP_STRING 7750 7751 AC_HELP_STRING is deprecated in 2.70+ and I believe AS_HELP_STRING works 7752 already since 2.59 so bump the minimum required version to that. 7753 7754 Reported-by: Emil Engler 7755 Fixes #6647 7756 Closes #6748 7757 7758- RELEASE-NOTES: synced 7759 7760- travis: use ubuntu nghttp2 package instead of build our own 7761 7762 Closes #6751 7763 7764- travis: bump wolfssl to 4.7.0 7765 7766- travis: only build wolfssl when needed 7767 7768 Closes #6751 7769 7770- [Jacob Hoffman-Andrews brought this change] 7771 7772 rustls: allocate a buffer for TLS data. 7773 7774 Previously, rustls was using an on-stack array for TLS data. However, 7775 crustls has an (unusual) requirement that buffers it deals with are 7776 initialized before writing to them. By using calloc, we can ensure the 7777 buffer is initialized once and then reuse it across calls. 7778 7779 Closes #6742 7780 7781- travis: add a rustls build 7782 7783 ... that doesn't run any tests (yet) 7784 7785 Closes #6750 7786 7787- HTTP2: remove the outdated remark about multiplexing for the tool 7788 7789- [Robert Ronto brought this change] 7790 7791 http2: don't set KEEP_SEND when there's no more data to be sent 7792 7793 this should fix an issue where curl sometimes doesn't send out a request 7794 with authorization info after a 401 is received over http2 7795 7796 Closes #6747 7797 7798Marc Hoersken (15 Mar 2021) 7799- config: fix building SMB with configure using Win32 Crypto 7800 7801 Align conditions for NTLM features between CMake and configure 7802 builds by differentiating between USE_NTLM and USE_CURL_NTLM_CORE, 7803 just like curl_setup.h does internally to detect support of: 7804 7805 - USE_NTLM: required for NTLM crypto authentication feature 7806 - USE_CURL_NTLM_CORE: required for SMB protocol 7807 7808 Implement USE_WIN32_CRYPTO detection by checking for Crypt functions 7809 in wincrypt.h which are not available in the Windows App environment. 7810 7811 Link advapi32 and crypt32 for Crypto API and Schannel SSL backend. 7812 Fix condition of Schannel SSL backend in CMake build accordingly. 7813 7814 Reviewed-by: Marcel Raad 7815 7816 Closes #6277 7817 7818- config: fix detection of restricted Windows App environment 7819 7820 Move the detection of the restricted Windows App environment 7821 in curl_setup.h before the definition of USE_WIN32_CRYPTO 7822 via included config-win32.h in case no build system is used. 7823 7824 Reviewed-by: Marcel Raad 7825 7826 Part of #6277 7827 7828Daniel Stenberg (15 Mar 2021) 7829- HISTORY: curl 7.7.2 was the first version used in Mac OS X 10.1 7830 7831- gen.pl: quote "bare" minuses in the nroff curl.1 7832 7833 Reported-by: Alejandro Colomar 7834 Fixes #6698 7835 Closes #6722 7836 7837Daniel Gustafsson (14 Mar 2021) 7838- hsts: remove unused defines 7839 7840 MAX_HSTS_SUBLEN and MAX_HSTS_SUBLENSTR were unused from the initial commit, 7841 and mostly likely leftovers from early development. Remove as they're not 7842 used for anything. 7843 7844 Closes #6741 7845 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 7846 7847Daniel Stenberg (12 Mar 2021) 7848- github: add torture-ftp for FTP-only torture testing 7849 7850 and at 20% to try to keep the run-time reasonable 7851 7852 Closes #6728 7853 7854- travis: split "torture" into a separate "events" build as well 7855 7856 Run torture without FTP and reducing coverage to 20% 7857 7858 For some reason the torture tests now run a lot slower on travis and run 7859 into the 50 minute limit all the time. 7860 7861 Closes #6728 7862 7863- ftp: fix memory leak in ftp_done 7864 7865 If after a transfer is complete Curl_GetFTPResponse() returns an error, 7866 curl would not free the ftp->pathalloc block. 7867 7868 Found by torture-testing test 576 7869 7870 Closes #6737 7871 7872- [oxalica brought this change] 7873 7874 http2: fail if connection terminated without END_STREAM 7875 7876 Closes #6736 7877 7878- RELEASE-NOTES: synced 7879 7880- [Jacob Hoffman-Andrews brought this change] 7881 7882 rustls: support CURLOPT_SSL_VERIFYPEER 7883 7884 This requires the latest main branch of crustls, which provides 7885 rustls_client_config_builder_dangerous_set_certificate_verifier and 7886 rustls_client_config_builder_set_enable_sni. 7887 7888 This refactors the session setup into its own function, and adds a new 7889 function cr_hostname_is_ip. Because crustls doesn't support verification 7890 of IP addresses, special handling is needed: We disable SNI and set a 7891 placeholder hostname (which never actually gets sent on the wire). 7892 7893 Closes #6719 7894 7895Daniel Gustafsson (12 Mar 2021) 7896- cookies: Fix potential NULL pointer deref with PSL 7897 7898 Curl_cookie_init can be called with data being NULL, and this can in turn 7899 be passed to Curl_cookie_add, meaning that both functions must be careful 7900 to only use data where it's checked for being a NULL pointer. The libpsl 7901 support code does however dereference data without checking, so if we are 7902 indeed having an unset data pointer we cannot PSL check the cookiedomain. 7903 7904 This is currently not a reachable dereference, as the only caller with a 7905 NULL data isn't passing a file to initialize cookies from, but since the 7906 API has this contract let's ensure we hold it. 7907 7908 Closes #6731 7909 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 7910 7911Daniel Stenberg (12 Mar 2021) 7912- [Michael Hordijk brought this change] 7913 7914 configure: only add OpenSSL paths if they are defined 7915 7916 Add paths for OpenSSL compiling and linking only if they have been 7917 defined. If they haven't been defined, we'll assume that the paths are 7918 already available to the toolchain. 7919 7920 Closes #6730 7921 7922Jay Satiro (12 Mar 2021) 7923- retry.d: Clarify transient 5xx HTTP response codes 7924 7925 - Clarify the only 5xx response codes that are treated as transient are 7926 500, 502, 503 and 504. 7927 7928 Prior to this change it said it treated all 5xx as transient, but the 7929 code says otherwise. 7930 7931 Ref: https://github.com/curl/curl/blob/curl-7_75_0/src/tool_operate.c#L462-L495 7932 7933 Closes https://github.com/curl/curl/pull/6724 7934 7935- retry-all-errors.d: Explain curl errors versus HTTP response errors 7936 7937 - Add a paragraph explaining that curl does not consider HTTP response 7938 errors as curl errors, and how that behavior can be modified by using 7939 --retry and --fail. 7940 7941 The --retry-all-errors doc says "Retry on any error" which some users 7942 may find misleading without the added explanation. 7943 7944 Ref: https://curl.se/docs/faq.html#Why_do_I_get_downloaded_data_eve 7945 Ref: https://curl.se/docs/faq.html#curl_doesn_t_return_error_for_HT 7946 7947 Reported-by: Lawrence Gripper 7948 7949 Fixes https://github.com/curl/curl/issues/6712 7950 Closes https://github.com/curl/curl/pull/6720 7951 7952Daniel Stenberg (11 Mar 2021) 7953- travis: switch ngtcp2 build over to quictls 7954 7955 The ngtcp2 project switched over to using the quictls OpenSSL fork 7956 instead of their own patched OpenSSL. We follow suit. 7957 7958 Closes #6729 7959 7960- test220/314: adjust to run with Hyper 7961 7962- c-hyper: support automatic content-encoding 7963 7964 Closes #6727 7965 7966- http: remove superfluous NULL assign 7967 7968 Closes #6727 7969 7970- tool_operate: bail if set CURLOPT_HTTP09_ALLOWED returns error 7971 7972 Closes #6727 7973 7974- setopt: error on CURLOPT_HTTP09_ALLOWED set true with Hyper 7975 7976 Not supported. 7977 7978 Closes #6727 7979 7980- test306: make it not run with Hyper 7981 7982 ... as it tests HTTP/0.9 which Hyper doesn't support. 7983 7984- test304: header CRLF cleanup to work with Hyper 7985 7986- FTP: allow SIZE to fail when doing (resumed) upload 7987 7988 Added test 362 to verify. 7989 7990 Reported-by: Jordan Brown 7991 Regression since 7ea2e1d0c5a7f (7.73.0) 7992 Fixes #6715 7993 Closes #6725 7994 7995- configure: provide Largefile feature for curl-config 7996 7997 ... as cmake now does it correctly, and make test1014 check for it 7998 7999 Closes #6702 8000 8001- config: remove CURL_SIZEOF_CURL_OFF_T use only SIZEOF_CURL_OFF_T 8002 8003 Make the code consistently use a single name for the size of the 8004 "curl_off_t" type. 8005 8006 Closes #6702 8007 8008Jay Satiro (10 Mar 2021) 8009- [Jun-ya Kato brought this change] 8010 8011 ngtcp2: Fix build error due to change in ngtcp2_addr_init 8012 8013 ngtcp2/ngtcp2@b8d90a9 changed the function prototype. 8014 8015 Closes https://github.com/curl/curl/pull/6716 8016 8017Daniel Stenberg (10 Mar 2021) 8018- [ejanchivdorj brought this change] 8019 8020 multi: update pending list when removing handle 8021 8022 when removing a handle, most of the lists are updated but pending list 8023 is not updated. Updating now. 8024 8025 Closes #6713 8026 8027- [kokke brought this change] 8028 8029 lib1536: check ptr against NULL before dereferencing it 8030 8031 Closes #6710 8032 8033- [kokke brought this change] 8034 8035 lib1537: check ptr against NULL before dereferencing it 8036 8037 Fixes #6707 8038 Closes #6708 8039 8040- travis: make torture tests skip TLS-SRP tests 8041 8042 ... as it seems to often hang. 8043 8044 Also: skip the "normal" tests as they're already run by many other 8045 builds. 8046 8047 Closes #6705 8048 8049- openssl: adapt to v3's new const for a few API calls 8050 8051 Closes #6703 8052 8053- quiche: fix crash when failing to connect 8054 8055 Reported-by: ウさん 8056 Fixes #6664 8057 Closes #6701 8058 8059- RELEASE-NOTES: synced 8060 8061 Fixed the release counter and added a missing contributor 8062 8063- RELEASE-NOTES: synced 8064 8065- dynbuf: bump the max HTTP request to 1MB 8066 8067 Raised from 128KB to allow longer request headers. 8068 8069 Reported-by: Carl Zogheib 8070 Fixes #6681 8071 Closes #6685 8072 8073Jay Satiro (6 Mar 2021) 8074- schannel: Evaluate CURLOPT_SSL_OPTIONS via SSL_SET_OPTION macro 8075 8076 - Change use of those options from CURLOPT_SSL_OPTIONS that are not 8077 already evaluated via SSL_SET_OPTION in schannel and secure transport 8078 to use that instead of data->set.ssl.optname. 8079 8080 Example: 8081 8082 Evaluate SSL_SET_OPTION(no_revoke) instead of data->set.ssl.no_revoke. 8083 8084 This change is because options set via CURLOPT_SSL_OPTIONS 8085 (data->set.ssl.optname) are separate from those set for HTTPS proxy via 8086 CURLOPT_PROXY_SSL_OPTIONS (data->set.proxy_ssl.optname). The 8087 SSL_SET_OPTION macro determines whether the connection is for HTTPS 8088 proxy and based on that which option to evaluate. 8089 8090 Since neither Schannel nor Secure Transport backends currently support 8091 HTTPS proxy in libcurl, this change is for posterity and has no other 8092 effect. 8093 8094 Closes https://github.com/curl/curl/pull/6690 8095 8096- [kokke brought this change] 8097 8098 c-hyper: Remove superfluous pointer check 8099 8100 `n` pointer is never NULL once set. Found by static analysis. 8101 8102 Ref: https://github.com/curl/curl/issues/6696 8103 8104 Closes https://github.com/curl/curl/pull/6697 8105 8106- version.d: Add missing features to the features list 8107 8108 - Add missing entries for gsasl, Kerberos, NTLM_WB, TrackMemory, 8109 Unicode and zstd. 8110 8111 - Remove krb4 since it's no longer a feature. 8112 8113 Reported-by: Ádler Jonas Gross 8114 8115 Fixes https://github.com/curl/curl/issues/6677 8116 Closes https://github.com/curl/curl/pull/6687 8117 8118- [Vladimir Varlamov brought this change] 8119 8120 docs: add missing Arg tag to --stderr 8121 8122 Prior to this change the required argument was not shown. 8123 8124 curl.1 before: --stderr 8125 curl.1 after: --stderr <file> 8126 8127 curl --help before: 8128 --stderr Where to redirect stderr 8129 8130 curl --help after: 8131 --stderr <file> Where to redirect stderr 8132 8133 Closes https://github.com/curl/curl/pull/6692 8134 8135- projects: Update VS projects for OpenSSL 1.1.x 8136 8137 - Update VS project templates to use the OpenSSL lib names and include 8138 directories for OpenSSL 1.1.x. 8139 8140 This change means the VS project files will now build only with OpenSSL 8141 1.1.x when an OpenSSL configuration is chosen. Prior to this change the 8142 project files built only with OpenSSL 1.0.x (end-of-life) when an 8143 OpenSSL configuration was chosen. 8144 8145 The template changes in this commit were made by script: 8146 8147 libeay32.lib => libcrypto.lib 8148 ssleay32.lib => libssl.lib 8149 ..\..\..\..\..\openssl\inc32 => ..\..\..\..\..\openssl\include 8150 8151 And since the output directory now contains the includes it's prepended: 8152 ..\..\..\..\..\openssl\build\Win{32,64}\VC{6..15}\{DLL,LIB} 8153 {Debug,Release}\include 8154 8155 - Change build-openssl.bat to copy the build's include directory to the 8156 output directory (as seen above). 8157 8158 Each build has its own opensslconf.h which is different so we can't just 8159 include the source include directory any longer. 8160 8161 Note the include directory in the output directory is a full copy from 8162 the build so technically we don't need to include the OpenSSL source 8163 include directory in the template. However, I left it last in case the 8164 user made a custom OpenSSL build using the old method which would put 8165 opensslconf in the OpenSSL source include directory. 8166 8167 - Change build-openssl.bat to use a temporary install directory that is 8168 different from the temporary build directory. 8169 8170 For OpenSSL 1.1.x the temporary paths must be separate not a descendant 8171 of the other, otherwise pdb files will be lost between builds. 8172 8173 Ref: https://curl.se/mail/lib-2018-10/0049.html 8174 Ref: https://gist.github.com/jay/125191c35bbeb894444eff827651f755 8175 Ref; https://github.com/openssl/openssl/issues/10005 8176 8177 Fixes https://github.com/curl/curl/issues/984 8178 Closes https://github.com/curl/curl/pull/6675 8179 8180- doh: Inherit CURLOPT_STDERR from user's easy handle 8181 8182 Prior to this change if the user set their easy handle's error stream 8183 to something other than stderr it was not inherited by the doh handles, 8184 which meant that they would still write to the default standard error 8185 stream (stderr) for verbose output. 8186 8187 Bug: https://github.com/curl/curl/issues/6605 8188 Reported-by: arvids-kokins-bidstack@users.noreply.github.com 8189 8190 Closes https://github.com/curl/curl/pull/6661 8191 8192Marc Hoersken (1 Mar 2021) 8193- CI/azure: replace python-impacket with python3-impacket 8194 8195 As of this month Azure DevOps uses Ubuntu 20.04 LTS which 8196 no longer supports Python 2 and instead ships Python 3. 8197 8198 Closes #6678 8199 8200- runtests.pl: kill processes locking test log files 8201 8202 Introduce a new runtests.pl command option: -rm 8203 8204 For now only required and implemented for Windows. 8205 Ignore stunnel logs due to long running processes. 8206 8207 Requires Sysinternals handle[64].exe to be on PATH. 8208 8209 Reviewed-by: Jay Satiro 8210 8211 Ref: #6058 8212 Closes #6179 8213 8214- pathhelp.pm: fix use of pwd -L in Msys environment 8215 8216 While Msys2 has a pwd binary which supports -L, 8217 Msys1 only has a shell built-in with that feature. 8218 8219 Reviewed-by: Jay Satiro 8220 8221 Part of #6179 8222 8223Daniel Gustafsson (1 Mar 2021) 8224- ldap: use correct memory free function 8225 8226 unescaped is coming from Curl_urldecode and not a unicode conversion 8227 function, so reclaiming its memory should be performed with a normal 8228 call to free rather than curlx_unicodefree. In reality, this is the 8229 same thing as curlx_unicodefree is implemented as a call to free but 8230 that's not guaranteed to always hold. Using the curlx macro present 8231 issues with memory debugging as well. 8232 8233 Closes #6671 8234 Reviewed-by: Jay Satiro <raysatiro@yahoo.com> 8235 Reviewed-by: Daniel Stenberg <daniel@haxx.se> 8236 8237- url: fix typo in comment 8238 8239 Correct a small typo which snuck in with a304051620. 8240 8241Jay Satiro (28 Feb 2021) 8242- tool_help: Increase space between option and description 8243 8244 - Increase the minimum number of spaces between the option and the 8245 description from 1 to 2. 8246 8247 Before: 8248 ~~~ 8249 -u, --user <user:password> Server user and password 8250 -A, --user-agent <name> Send User-Agent <name> to server 8251 -v, --verbose Make the operation more talkative 8252 -V, --version Show version number and quit 8253 -w, --write-out <format> Use output FORMAT after completion 8254 --xattr Store metadata in extended file attributes 8255 ~~~ 8256 8257 After: 8258 ~~~ 8259 -u, --user <user:password> Server user and password 8260 -A, --user-agent <name> Send User-Agent <name> to server 8261 -v, --verbose Make the operation more talkative 8262 -V, --version Show version number and quit 8263 -w, --write-out <format> Use output FORMAT after completion 8264 --xattr Store metadata in extended file attributes 8265 ~~~ 8266 8267 Closes https://github.com/curl/curl/pull/6674 8268 8269Daniel Stenberg (27 Feb 2021) 8270- curl: set CURLOPT_NEW_FILE_PERMS if requested 8271 8272 The --create-file-mode code logic accepted the value but never actually 8273 passed it on to libcurl! 8274 8275 Follow-up to a7696c73436f (shipped in 7.75.0) 8276 Reported-by: Johannes Lesr 8277 Fixes #6657 8278 Closes #6666 8279 8280- tool_operate: check argc before accessing argv[1] 8281 8282 Follow-up to 09363500b 8283 Reported-by: Emil Engler 8284 Reviewed-by: Daniel Gustafsson 8285 Closes #6668 8286 8287Daniel Gustafsson (26 Feb 2021) 8288- [Jean-Philippe Menil brought this change] 8289 8290 openssl: remove get_ssl_version_txt in favor of SSL_get_version 8291 8292 openssl: use SSL_get_version to get connection protocol 8293 8294 Replace our bespoke get_ssl_version_txt in favor of SSL_get_version. 8295 We can get rid of few lines of code, since SSL_get_version achieve 8296 the exact same thing 8297 8298 Closes #6665 8299 Reviewed-by: Daniel Gustafsson <daniel@yesql.se> 8300 Signed-off-by: Jean-Philippe Menil <jpmenil@gmail.com> 8301