"In `ul_parallel`, `max_parallel` is computed using
`self._download_parallel` instead of `self._upload_parallel`. This
causes the upload parallelism to incorrectly follow the download
parallel setting. It should use `self._upload_parallel` to be consistent
with how `uploads()` computes `max_parallel`."
Reported by GitHub Code Quality
Follow-up to 30ef79ed93#17295Closes#22421
"The check `i > 256` permits `i == 256` to pass through. When `i` is
then cast to `uint8_t` in `blob_add(b, (uint8_t)i)`, the value wraps to
0, silently encoding a zero-length ALPN entry instead of rejecting it.
The condition should be `i > 255` (or equivalently `i >= 256`) to
correctly reject any length that does not fit in a single byte."
Reported by GitHub Code Quality
Follow-up to 86f1e5b3f6#21299Closes#22420
- update `GSS_C_DELEG_POLICY_FLAG` comment to include Apple GSS, add
date, and amend MIT Kerberos version to 1.7+ (was: 1.8+)
Ref: 45875a4d7b
Ref: 1635de38a8
- document `HAVE_GSS_SET_NEG_MECHS`/`gss_set_neg_mechs()`.
Ref: 079eed2cf7
It's also committed to Heimdal, but not present in a release
as of 7.8.0 (current latest).
Ref: 735039dbdc
Follow-up to a8881e5e1d#21315#22410
Follow-up to d169ad68fa#22052Closes#22419
This version is already two releases out of support, but is "only" 7
years old so is probably still being used in the real world. Document
this version along with some other testing dependencies. Remove code
support for earlier versions. Disable ruff checks that need a newer
version.
Mark Python mutable class variables with ClassVar, to denote that the
danger this can cause has been considered. Since any change made to
these in any object affects all other objects, this can cause locality
errors. However, as used in the test suite, they are are never modified
and so they are annotated as being intended.
Always set a timezone in datetime objects, as mixing naive and
timezone-aware object can cause errors.
These fix ruff rules DTZ005, RUF012.
* call super() without arguments
* mark an unused variable as such
* simplify by using dict getter for default values
* use writelines() when possible
* use dedent to simplify some text formatting
* avoid items() on dict in a loop when unnecessary
* replace most Python format() calls with f-strings
* use capture_output in subprocess.run
This fixes ruff rules FLY002, FURB122, PERF102, RUF059, SIM401, UP008,
UP022, UP030.
* combine separate if statements
* remove an unneeded encode() call
* remove unneeded returns
* simplify code when returning early
This fixes ruff rules SIM102, SIM114, UP012, PLR1711.
* remove an unneeded ruff warning disable
* remove coding: utf-8 from Python code; PEP 3120 makes UTF-8 the
default encoding
* remove unusable shebang lines from Python code
* remove empty print strings
* disable warnings when file objects are stored; these instances can't
be handled with context managers
* use more consistent whitespace in Python code, fixing flake8 warnings
* set the executable bit on scorecard.py, making it easier to run
These fix ruff rules EXE001, FURB105, UP009, SIM115.
* Explicitly set "check" in subprocess.run() to raise an exception
automatically, where it was done manually before
* Use contextlib.suppress to ignore exceptions
* Use custom exceptions for test errors for clarity and flexibility.
* Replace IOError with OSError
This fixes ruff rules BLE001, PLW1510, S110, TRY201, TRY203, TRY002,
UP024.
- make `const` data `static`, where missing and possible.
- replace `strlen()` on literal or const strings with `sizeof()`.
While the latter is optimized by popular C compiler, e.g. MSVC only
does it with `/O2`.
- replace magic numbers with `sizeof()`, where missing.
- introduce `CURL_CSTRLEN()` macro for `sizeof(char[]) - 1`.
- use `CURL_CSTRLEN()` macro.
- move `const` before integer types, where missing.
- replace `char *var` with `var[]`, where missing and possible.
- use double const, where missing.
`static const char *` -> `static const char * const`.
- lib1514: constify pointers.
- unit3205: drop redundant cast, avoid another one.
- unit1666: map `OID()` macro to identical `STRCONST()`.
Closes#22406
- add CURLUE_BACKSLASH that can be returned when a backslash was used
where a forward one probably was intended.
- make CURLUE_NO_HOST higher priority than port number errors for URLs
without hostname. Like in "http://::1"
- shortened some URL parser error strings
Extend test 1560 to verify.
Reported-by: kit-ty-kate on github
Fixes#22337Closes#22408
- Switch the Windows SSPI identity struct to SEC_WINNT_AUTH_IDENTITY_EX
to use !ntlm in PackageList to prevent NTLM from being offered.
- For GSS filter out NTLMSSP OID, and restrict via gss_set_neg_mechs()
to prevent NTLM from being offered.
- Extend the GSS-API debug stub layer to support the NTLM blocking logic
without a real Kerberos environment.
- Update test 2057 to check that negotiate auth is silently skipped with
no Authorization header when only NTLM stub credentials are available.
- Add SPNEGO NTLM blocking test 2093 which verifies that Kerberos
credentials still succeed when NTLM is blocked within SPNEGO.
- Suppress tests valgrind leak for MIT krb5 gss_display_status, since
the leak is in the library and not in curl.
To suppress the tests valgrind leak, the wildcard '...' bridges over an
anonymous frame inside libgssapi_krb5.so that valgrind reports as '???'.
Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Aided-by: Johannes Schindelin
Closes https://github.com/curl/curl/pull/21315
Closes https://github.com/curl/curl/pull/22410
- move `Curl_conn_seems_dead()` into conncache.c
- move `Curl_conn_upkeep()` into conncache.c
- when upkeep gives an error on a connection not in use,
terminate it
Closes#21806
Forward only the app error code from the receiving side to the h3 layer.
This only takes effect when building against ngtcp2 v1.25.0 or higher.
Fixes#22270Closes#22356
To avoid a breakage in CI and curl-for-win builds on upstream updates
extending the callback lists. Each such breakage needed patching curl,
rolling these patches into curl-for-win, and doing it in near real-time,
to keep CI and builds working (and still causing some red CI jobs).
Bring calmness here by suppressing the warnings and allowing time to
extend the callback tables as/if needed and at a convenient moment.
Closes#22400
Fix test 1712 to pass curl C by setting `COLUMNS` to the highest
accepted value, and adjust expected results. To avoid envs with varying
lengths of `LOGDIR` affect the outcome.
Apply the same fix to test 459, though it wasn't affected in curl CI.
Also sync up test 433 `COLUMNS` value with these two tests for
consistency.
Ref: #22381
Follow-up to 8e3a2a64d1#20666Closes#22388
Do not let unrelated credentials from a redirected URL bypass the
cross-host auth boundary
Verified by test 5023 to 5025
Follow-up to a55731050eCloses#22395
Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.
New libcurl options:
- CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
- CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
- CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
- CURLOPT_HTTPSIG_HEADERS: space-separated components to sign
New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers
The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.
Verified by test 5000 to 5021
Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes#22386Closes#21239
`sys/types.h` and `sys/socket.h` (non-Win32). They are included via
`curl/curl.h` and `curl_setup.h`.
This drops `HAVE_SYS_TYPES_H` guards from the codebase. It's safe
because `sys/types.h` (POSIX) is already required unconditionally by
`curl/curl.h`. It remains used in feature checks by both autotools and
cmake; to be reviewed in a future step.
Closes#22374
To prevent merging large text files by accident.
Set the cap at 10k lines. The current line number top list is:
```
5577 configure.ac
5561 lib/vtls/openssl.c
5077 lib/http.c
4517 lib/ftp.c
4284 lib/multi.c
```
Closes#22387
- connclose/streamclose/connkeep() remove description string that was
never used anywhere. Add trace statements where reasons for closing
were not already traced and maybe not obvious.
- multi_remove_handle: only lookup former connection in pool when
transfer is set to connect only
- test1554: adapt expectations now that pool is less often locked
Closes#22379
Fix handling of DoH response that only asks for HTTPS records.
Add test 2117 for checking that a HTTPS-RR resolve is processed,
even though the actual answer is invalid.
Closes#22372
Add a property to easy/multi API calls that prohibit calling
the function when the involved SSL session cache is under lock
by the current thread.
Checks are only in effect when pthreads/Windows threads are
available.
Closes#22367
Make sure hostname used in URL to proxy is IDN decoded form, but keep
the original hostname in case it was ipv6.
Fixes#22382
Reported-by: RMMoreton on github
Closes#22385
- In vsftpd ignore unrelated RST by matching tcpdump RSTs to the data
connection port pair.
Prior to this change an unrelated RST on a recycled ephemeral port
could cause test failure.
Closes https://github.com/curl/curl/pull/22305
When the threaded resolver gets AAAA results that carry a link-local
address without scope-id, it now re-queues a query with AF_UNSPEC and
strips ipv4 addresses from that result. Whatever the resulting addresses
and scope-ids are, this becomes the result of the resolve.
Fixes#22330
Reported-by: Bartel Sielski
Closes#22368
Only look for gethostbyname in libwatt in $WATT_ROOT/lib if WATT_ROOT
has actually been set. This avoids configure trying to search in /lib,
which won't every succeed and can cause problems in cross builds which
check that host paths are not being searched.
Closes#22380
- CMake/CurlTests.c: sync indent with rest of file and most of code.
- cmake: sync term in `_CURL_PREFILL` description with rest of code.
- curl_setup.h: document function relying on `_CRT_SECURE_NO_WARNINGS`.
- tests/http/scorecard.py: typo in message.
- 'Quiche' -> 'quiche'.
- fix comment and formatting nits.
Closes#22378
