When disabling all protocols without enabling any, the resulting
set of allowed protocols remained the default set. Clearing the
allowed set before inspecting the passed value from --proto make
the set empty even in the errorpath of no protocols enabled.
Co-authored-by: Dan Fandrich <dan@telarity.com> Reported-by: Dan Fandrich <dan@telarity.com> Reviewed-by: Daniel Stenberg <daniel@haxx.se> Closes: #13004
Backported by: Guilherme Puida Moreira <guilherme@puida.xyz>
* Small change in the Makefile to add a new test.
Daniel Stenberg [Thu, 14 Sep 2023 21:28:32 +0000 (23:28 +0200)]
[PATCH] cookie: remove unnecessary struct fields
Plus: reduce the hash table size from 256 to 63. It seems unlikely to
make much of a speed difference for most use cases but saves 1.5KB of
data per instance.
Closes #11862
Backported by: Samuel Henrique <samueloph@debian.org>
Jay Satiro [Sat, 30 Sep 2023 07:40:02 +0000 (03:40 -0400)]
[PATCH] socks: return error if hostname too long for remote resolve
Prior to this change the state machine attempted to change the remote
resolve to a local resolve if the hostname was longer than 255
characters. Unfortunately that did not work as intended and caused a
security issue.
Name resolvers cannot resolve hostnames longer than 255 characters.
Bug: https://curl.se/docs/CVE-2023-38545.html
Backported by: Samuel Henrique <samueloph@debian.org>
Daniel Stenberg [Wed, 2 Aug 2023 21:34:48 +0000 (23:34 +0200)]
[PATCH] http: return error when receiving too large header set
To avoid abuse. The limit is set to 300 KB for the accumulated size of
all received HTTP headers for a single response. Incomplete research
suggests that Chrome uses a 256-300 KB limit, while Firefox allows up to
1MB.
Closes #11582
Backport to Debian by Carlos Henrique Lima Melara <charlesmelara@riseup.net>
The non-OpenLDAP code paths are less tested, less featureful, less secure,
and omitted in the build system by accident. It has been discovered that this
also mitigates curl not being able to make LDIF output when attributes have
binary values.
Gbp-Pq: Name Use-OpenLDAP-specific-functionality.patch
Daniel Stenberg [Tue, 25 Apr 2023 06:28:01 +0000 (08:28 +0200)]
[PATCH] lib: unify the upload/method handling
By making sure we set state.upload based on the set.method value and not
independently as set.upload, we reduce confusion and mixup risks, both
internally and externally.
Dan Fandrich [Mon, 17 Apr 2023 23:57:17 +0000 (16:57 -0700)]
[PATCH] runtests: don't try to stop stunnel before trying again
Calling stopserver() before retrying stunnel due to an error would stop
the dependent server (such as HTTP) meaning stunnel would have nothing
to talk to when it came up. Don't try to force a stop when it didn't
actually start. Also, don't mark the server as bad for future use when
it starts up on a retry.
Reported-by: eaglegai at github Tested-by: eaglegai at github
Fixes #10976
Backported by: Aquila Macedo Costa <aquilamacedo@riseup.net>.
Changes:
- Apply the changes to `runtests.pl` instead of `servers.pm`, as
`servers.pm` does not exist in this version of bookworm.
When the user specified an IPv6 address to be used as an LDAP server,
curl will fail to properly enclose it in square brackets, which causes
the connection to fail because the host address cannot be
distinguished from the port:
$ curl -v ldap://[fd42:be5:e632:a6b3:216:3eff:feb1:5bc4]:389
...
* LDAP local: Cannot connect to ldap://fd42:be5:e632:a6b3:216:3eff:feb1:5bc4:389, Bad parameter to an ldap routine
...
Fix this by always enclosing the IPv6 address in square brackets.
Stefan Eissing [Tue, 28 Feb 2023 09:07:21 +0000 (10:07 +0100)]
[PATCH] Fixing unix domain socket use in https connects.
- refs #10633, when h2/h3 eyeballing was involved, unix domain socket
configurations were not honoured
- configuring --unix-socket will disable HTTP/3 as candidate for eyeballing
- combinatino of --unix-socket and --http3-only will fail during initialisation
- adding pytest test_11 to reproduce
Simon McVittie [Tue, 22 Nov 2022 21:20:51 +0000 (21:20 +0000)]
Remove curl's LDFLAGS from curl-config --static-libs
On current Debian bookworm, the LDFLAGS consist of
-L/usr/lib/${triplet}/mit-krb5 originating from
`pkg-config --libs-only-L mit-krb5-gssapi` from krb5-multidev, plus
some linker options that are intended for curl itself rather than for
dependent packages. None of these are really desirable, and they create
divergence between architectures that would prevent libcurl-*-dev from
being Multi-Arch: same.
The -L flag is not really needed, for the same reason that -L@libdir@
isn't. curl Build-Depends on libkrb5-dev, which doesn't need a special
-L flag to find libgssapi_krb5, and the various libcurl-*-dev packages
have Suggests on libkrb5-dev rather than on krb5-multidev for static
linking.
The other options (currently `-Wl,-z-relro -Wl,-z,now`) are intended
for libcurl itself, and if dependent packages want those options then
they should set them from their own packaging.
Bug-Debian: https://bugs.debian.org/1024668
Forwarded: not-needed Signed-off-by: Simon McVittie <smcv@collabora.com>
Gbp-Pq: Name Remove-curl-s-LDFLAGS-from-curl-config-static-libs.patch
mention of @includedir@ and @libdir@ from the script. On Debian, the actual
header and library directories are architecture-dependent, but will always be
in the C compiler's default search path, so -I and -L options are not
necessary (and may be harmful in multi-arch environments.)
Gbp-Pq: Name 11_omit-directories-from-config.patch
Simon McVittie [Tue, 22 Nov 2022 20:43:41 +0000 (20:43 +0000)]
build: Divide mit-krb5-gssapi link flags between LDFLAGS and LIBS
From the comments nearby about not having --libs-only-L, it looks as
though the intention was to apply a split like this to all dependency
libraries where possible, and the only reason it was not done for
Kerberos is that krb5-config doesn't have that feature and pkg-config
was originally not supported here. For example, zlib, libssh and librtmp
all have their flags from pkg-config split in this way.
Now that pkg-config is supported here, we can do the intended split.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Gbp-Pq: Name build-Divide-mit-krb5-gssapi-link-flags-between-LDFLAGS-a.patch
projects / curl.git / log