curl/lib/vssh
Stefan Eissing dfc01ea2a3
hardening: add API guards
Add call stacks to easy and multi instances. Record ongoing API calls
and callback invocations there to detect recursion and not allowed
invocations.

Define enums for easy, multi and callbacks in `api.h`. In `api.c` define
properties for these functions:

- can they recurse
- is the easy/multi handle destroyed during the call or should it be
  good afterwards
- is the call allowed when a multi event callback is ongoing
- is the call allowed when a notification callback is ongoing

Entering a guard
- checks that passed CURL*/CURLM* are GOOD on entering
- checks that easy handle's `mid` is correct and it is known
  for it in the multi.
- checks that call properties are obeyed (recursion, callback checks)
- checks that passed CURL*/CURLM* are GOOD on leaving, unless call is
  known to kill it

Checks for ongoing callbacks inspect the whole call stack and catches
nested invocations (which our current flags can not).

Call stacks in easy/multi handle are fixed size and will deny recursion
when the limit is reached. The current limits are 7 for easy and 15 for
multi now.

Removes:
- multi->in_callback, check is done via call stack
- multi->in_ntfy_cb, check is done via call stack

The overhead in my tests seems minimal, if noticeable at all.

Closes #22237
2026-07-21 23:22:24 +02:00
..
libssh.c hardening: add API guards 2026-07-21 23:22:24 +02:00
libssh2.c hardening: add API guards 2026-07-21 23:22:24 +02:00
ssh.h vssh: keyfile use cleanups 2026-07-02 12:37:20 +02:00
vssh.c vssh: keyfile use cleanups 2026-07-02 12:37:20 +02:00
vssh.h vssh: keyfile use cleanups 2026-07-02 12:37:20 +02:00