Commit Graph

14972 Commits

Author SHA1 Message Date
Kai Pastor
ac7e2c3dc6
asyn-ares: remove obsolete reference to local_ip6
7bf576064c moved local_ip6 from the parameter list to the actual
implementation of Curl_async_ares_set_dns_local_ip6. The no-op code for
!( defined(HAVE_CARES_SET_LOCAL) && defined(USE_IPV6) ) still had an
reference which is removed by this change.

Closes #17450
2025-05-26 10:12:28 +02:00
Stefan Eissing
745c3519a5
ftp: fix race in upload handling
When TYPE was skipped for an immediate STORE command and the server
replied fast and the EPRT data connection was not ready, the transfer
was not initated, leading to no upload.

Fixes #17394
Closes #17428
Reported-by: JoelAtWisetech on github
2025-05-25 11:56:16 +02:00
Jacob Mealey
8ab73bb1ff
urlapi: move complex switch case to separate func
Move complex switch statement cases in curl_url_set
to their own functions and call them from switch.

Closes #17435
2025-05-24 13:39:34 +02:00
Daniel Stenberg
129719c29c
lib: change progress bitwise ops to bitfields
Since they are mostly independent, using them as bitfelds makes the code
easier.

- remove the unused struct field 'width'.

- convert 'speeder_c' to an unsigned char from int

Closes #17431
2025-05-23 23:13:03 +02:00
Stefan Eissing
37b25f7bb0
sasl: give help when unable to select AUTH
When SASL is unable to select an AUTH mechanism, give user help
in info message why no AUTH could be selected.

Fixes #17420
Closes #17427
Reported-by: Aditya Garg
2025-05-23 22:56:05 +02:00
Daniel Stenberg
b445031e94
urldata: remove the unused struct field 'hide_progress'
It was only set, never read.

Closes #17430
2025-05-23 17:15:32 +02:00
Daniel Stenberg
1fef013b81
setopt: create set_ssl_options()
Used for both CURLOPT_SSL_OPTIONS and CURLOPT_PROXY_SSL_OPTIONS

Also: make the DoH code use the full original argument value instead of
each individual flag. Makes it easier to keep all of these in synk.

Closes #17429
2025-05-23 17:15:00 +02:00
Daniel Stenberg
9eaaa0748d
http_aws_sigv4: simplify, avoid many gotos
Closes #17422
2025-05-23 09:09:26 +02:00
Daniel Stenberg
6ad9230c2d
http_aws_sigv4: return error on too many query components
Instead of just silently continuing.

Closes #17421
2025-05-23 09:08:36 +02:00
Daniel Stenberg
4a2bd8e458
mprintf: move outputs into separate functions
To make everything easier to read and follow.

Closes #17409
2025-05-21 22:56:02 +02:00
Daniel Stenberg
497d3c7b01
ftplistparser: protect more cases decrementing 'len'
So that they never wrap. More Coverity remarks.

Closes #17406
2025-05-21 22:55:04 +02:00
Stefan Eissing
35e1e7be22
url: reduce complexity of url_match_conn
Split off the function code into several static helpers according to
aspects checked.

closes #17408
2025-05-21 22:54:25 +02:00
Stefan Eissing
e1f65937a9
pytest: add pinnedpubkey test cases
Add positive/negative test cases in pytest for pinned public keys.

Closes #17412
2025-05-21 22:45:42 +02:00
Stefan Eissing
7836c3de5d
openssl: reduce Curl_ossl_ctx_init complexity
Reduce Curl_ossl_ctx_init() complexity by splitting it up into
sub functions.

While splitting if ECH, add pytest fixed for AWS-LC and enable
it in CI.

Closes #17404
2025-05-21 13:58:53 +02:00
Daniel Stenberg
196afaf75c
ftplistparser: protect two more len -1 uses
Pointed out by Coverity

Closes #17400
2025-05-21 09:23:53 +02:00
Daniel Stenberg
8c8186eadc
http_aws_sigv4: avoid risk of overflowed constant
- Simplify canon_query() a bit. Avoid unconditionally using length -1
  where length risks being zero at times. Pointed out by Coverity.
- Fix indent errors
- narrow some variable scopes
- fix keywords in tests

Closes #17402
2025-05-21 09:23:06 +02:00
Christian Schmitz
5b4bd55006
url: fix @param in create_conn header to new one
was async, but is now reusedp.

Closes #17401
2025-05-21 09:17:26 +02:00
Nigel Brittain
c19465ca55
http_aws_sigv4: improve sigv4 url encoding and canonicalization
Closes #17129
2025-05-21 08:07:18 +02:00
Daniel Stenberg
155af7ac77
ftplistparser: add two overflow preventions
These two conditions probably cannot actually happen, but these two
checks make that certain and should please the static code analyzers.

Pointed out by Coverity

Closes #17397
2025-05-20 16:08:29 +02:00
Stefan Eissing
be45e014c6
dns_entry: move from conn to data->state
The `struct Curl_dns_entry *` used to established a connection
do not have the connection's lifetime, but the transfer's lifetime
(of the transfer that initiates the connect).

`Curl_dns_entry *` is reference counted with the "dns cache". That
cache might be owned by the multi or the transfer's share. In the
share, the reference count needs updating under lock.

Therefore, the dns entry can only be kept *and* released using the
same transfer it was initially looked up from. But a connection is
often discarded using another transfer.

So far, the problem of this has been avoided in clearing the connection's
dns entries in the "multi_don()" handling. So, connections had NULL
dns entries after the initial transfers and its connect had been handled.

Keeping the dns entries in data->state seems therefore a better choice.

Also: remove the `struct Curl_dns_entry *` from the connect filters
contexts. Use `data->state.dns` every time instead and fail correctly
when not present and needed.

Closes #17383
2025-05-20 14:49:17 +02:00
Daniel Stenberg
3ec6aa5c07
formdata: fix memory leak in OOM situation
Fixes #17390
Follow-up to c26da713e7
Reported-by: Viktor Szakats
Closes #17393
2025-05-20 10:44:53 +02:00
Viktor Szakats
e785e898a6
checksrc: avoid extra runs in CI, enable more check locally, fix fallouts
To avoid redundant work in CI and to avoid a single checksrc issue make
all autotools jobs fail. After this patch checksrc issues make fail
the checksrc job, the `dist / verify-out-of-tree-autotools-debug`,
`dist / maketgz-and-verify-in-tree`  jobs and the fuzzer job (if run).
Of these, the `dist` jobs replicate local builds, also testing the build
logic.

Also add a script to check the complete local repository, optionally
with the build tree to verify generated C files.

Also:
- automatically run checksrc in subdirectories having a `checksrc`
  target. (examples, OS400, tests http/client, unit and tunit)
- tests/libtest: make sure to run `checksrc` on generated `lib1521.c`.
  (requires in-tree autotools build.)
- tests: run `checksrc` on targets also for non-`DEBUGBUILD`
  builds. It ensures to check `lib1521.c` in CI via job
  `dist / maketgz-and-verify-in-tree`.
- src: drop redundant `$(builddir)` in autotools builds.
- scripts: add `checksrc-all.sh` script to check all C sources and
  the build directory as an option.
- use the above from CI, also make it verify all generated sources.
- silence `checksrc` issues in generated C sources.
- checksrc: add `-v` option to enable verbose mode.
- checksrc: make verbose mode show checked filename and fix to only
  return error on failure.
- make sure that generated C files pass `checksrc`.

Assisted-by: Daniel Stenberg

Closes #17376
2025-05-19 18:59:50 +02:00
Daniel Stenberg
c0f724e887
urldata: move a struct field in ssl_primary_config
... which makes the struct eight bytes smaller with no gaps.

Closes #17386
2025-05-19 15:14:23 +02:00
Daniel Stenberg
e83e8c30a8
ftplistparser: split up into more functions
And some general cleanups

Closes #17384
2025-05-19 13:46:12 +02:00
Stefan Eissing
a85f1df480
pytest tls: extend coverage
Add possibility to reload QUIC test server with another certificate. Add
tests for more coverage of handshakes.

Closes #17382
2025-05-19 13:30:02 +02:00
Daniel Stenberg
c26da713e7
formdata: cleanups
- use memchr() instead of for() loop
- add and use free_formlist() instead of duplicate code
- shorten some variable names
- reduce flag struct field from 'long' to 'unsigned char'
- pass in struct pointer, not individual fields, to addhttppost()

Closes #17370
2025-05-19 13:26:02 +02:00
Christian Schmitz
6414cc6ae1
setopt: split setopt_long
Split off the biggest options RTSP_REQUEST, SSLVERSION and HTTP_VERSION
into sub functions to reduce complexity.

Closes #17372
2025-05-19 09:09:23 +02:00
Christian Schmitz
f5a4d3c916
formdata: split up FormAdd
To reduce complexity of FormAdd, split the checking part into a separate
function.

Closes #17366
2025-05-16 16:14:29 +02:00
Daniel Stenberg
74cfba6a67
libssh2: remove the 'actualcode' struct field
Return and use CURLcode to a larger extent to avoid the complicated
double return code setup previously used.

Closes #17369
2025-05-16 14:56:59 +02:00
Jacob Mealey
e0f05bcf69
urlapi: remove unneeded guards around PUNY2IDN
Add more IDN/punycode tests to 1560

Closes #17364
2025-05-16 14:44:30 +02:00
Stefan Eissing
73b8912580
asnyc-thrdd: explain how this is okay with a comment
Coverity assess correctly that a variable write under mutex lock could
overwrite values from another thread - if the function were ever called
from multiple thread for the same transfer - which it is not.

Closes #17365
2025-05-16 12:55:17 +02:00
Daniel Stenberg
96726af95a
libssh: add NULL check for Curl_meta_get()
It really cannot return NULL in a working condition, but ...

Pointed out by Coverity.

Closes #17359
2025-05-15 23:04:37 +02:00
Daniel Stenberg
f7ff1d1e5e
libssh: remove a condition that always equals false
Found by Coverity

Closes #17358
2025-05-15 23:03:35 +02:00
Daniel Stenberg
f0bf43e209
libssh2: split up ssh_statemachine
Into many sub functions.

Complexity taken down from 150 to 37.

Closes #17356
2025-05-15 19:50:15 +02:00
Stefan Eissing
d59d8530c6
ngtcp2: clarify ignoring of result
In shutdown, the result of a bufq_write() is intentionally ignored, but
it was not obvious why. Add a (void) cast to declare intent and a
comment explaining why.

Closes #17354
2025-05-15 11:10:02 +02:00
Daniel Stenberg
f5b7eb27f0
netrc: deal with null token better
If there is no length of the token, assign a blank string to avoid
risking it being NULL.

Pointed out by Coverity

Closes #17351
2025-05-15 00:48:10 +02:00
Daniel Stenberg
6f6ee601b9
libssh: split up the state machine function
This reduces the "complexity score" for myssh_statemach_act from 160 to
100, taking it down from the most complex function in libcurl to the
5th.

Also fixes a memory leak of the sftp session.

Closes #17346
2025-05-14 23:15:58 +02:00
Daniel Stenberg
0cce66b3b3
setopt: provide info for CURLE_BAD_FUNCTION_ARGUMENT
If CURLE_BAD_FUNCTION_ARGUMENT is returned and failf() has not provided
any details, this adds a generic error string that includes the option
number.

This helps debugging for example the curl tool which does a lot of
setopt calls and in reading post fact logs it is not always easy to tell
exactly which call that failed.

Closes #17337
2025-05-13 14:18:19 +02:00
Daniel Stenberg
a8b947e7f4
headers: set an error message on illegal response headers
Makes it report "Invalid response header" instead of the slightly odd "A
libcurl function was given a bad argument".

Add test 749 and 750 for more CONNECT response testing.

Reported-by: Int64x86 on github
Fixes #17330
Closes #17336
2025-05-13 14:15:05 +02:00
Daniel Stenberg
65444f1dc3
curlx: move the docs to docs/internals/
Closes #17333
2025-05-13 10:30:02 +02:00
Daniel Stenberg
47896d4b59
tests/server: stop using libcurl string comparisons
Further untangle the test server code from curl code. While the string
comparison functions are available in the libcurl API, the tests servers
don't link with libcurl. Use native functions instead.

Closes #17328
2025-05-13 10:28:19 +02:00
Stefan Eissing
2e1040fa5c
asny-thrdd: fix detach from running thread
When cancelling a threaded resolve and the thread is
still running, detach from it under the mutex lock.

Otherwise, the detach might happen after the thread finished
and access already freed memory.

Fixes #17256
Reported-by: Mathieu Garaud
Closes #17320
2025-05-12 17:17:19 +02:00
Daniel Stenberg
dc4272318f
imap: remove redundant condition
'imap' always evaluates to true. Spotted by CodeSonar.

Closes #17318
2025-05-12 11:04:33 +02:00
Daniel Stenberg
da06f01ab9
rtsp: remove redundant condition
'rtsp' always evaluates to true. Spotted by CodeSonar.

Closes #17317
2025-05-12 11:03:44 +02:00
Daniel Stenberg
c5398fa393
netrc: avoid strdup NULL
Coverity found a code path where this might happen. Avoid it.

Closes #17319
2025-05-12 11:02:51 +02:00
Daniel Stenberg
5f6c714d24
http_chunks: narrow variable scope for 'trlen'
CodeSonar found a case where it would be assigned but never used and
narrowing the scope makes sense anyway.

Closes #17316
2025-05-12 11:02:00 +02:00
Daniel Stenberg
f862f863bf
mprintf: provide hex digits for escape.c to use
Since they need the exact same set, use the same set. The mprintf string
was longer than it had to be.

Closes #17311
2025-05-12 07:44:35 +02:00
Daniel Stenberg
1eb3928db6
mprintf: remove outdated comment about SIZEOF_SIZE_T
It was now plain wrong

Closes #17312
2025-05-12 07:43:54 +02:00
Daniel Stenberg
c37f4b6ac3
inet_ntop: rename curlx_inet_ntop to Curl_inet_ntop
It is not part of the curlx club.

Closes #17313
2025-05-12 07:42:59 +02:00
Daniel Stenberg
3b3d6a46ba
timeval.c: #include fix 2025-05-11 12:24:10 +02:00