c-hyper: fix NTLM on closed connection tested with test159

Closes #7154

data_pending: check only SECONDARY socket for FTP(S) transfers

Check the FIRST for all other protocols.

This fixes a timeout in an ftps download. The server sends a TLS
close_no

data_pending: check only SECONDARY socket for FTP(S) transfers

Check the FIRST for all other protocols.

This fixes a timeout in an ftps download. The server sends a TLS
close_notify message in the same packet as the file data. The
close_notify seems to not be handled in the schannel_recv function, so
libcurl is not aware that the server has closed the connection. Thus
libcurl ends up waiting for action on the socket until a timeout is
reached. With the secondary socket check added to the data_pending
function, the close_notify is properly handled, and the ftps transfer
terminates as expected.

Fixes #7068
Closes #7069

show more ...

http: fix the check for 'Authorization' with Bearer

The code would wrongly check for it using an additional colon.

Reported-by: Blake Burkhart
Closes #6988

lib: fix 0-length Curl_client_write calls

Closes #6954

transfer: clear 'referer' in declaration

To silence (false positive) compiler warnings about it.

Follow-up to 7214288898f5625

Reviewed-by: Marcel Raad
Closes #6810

transfer: strip credentials from the auto-referer header field

Added test 2081 to verify.

CVE-2021-22876

Bug: https://curl.se/docs/CVE-2021-22876.html

urldata: merge "struct DynamicStatic" into "struct UrlState"

Both were used for the same purposes and there was no logical separation
between them. Combined, this also saves 16 bytes in

urldata: merge "struct DynamicStatic" into "struct UrlState"

Both were used for the same purposes and there was no logical separation
between them. Combined, this also saves 16 bytes in less holes in my
test build.

Closes #6798

show more ...

http: use credentials from transfer, not connection

HTTP auth "accidentally" worked before this cleanup since the code would
always overwrite the connection credentials with the credenti

http: use credentials from transfer, not connection

HTTP auth "accidentally" worked before this cleanup since the code would
always overwrite the connection credentials with the credentials from
the most recent transfer and since HTTP auth is typically done first
thing, this has not been an issue. It was still wrong and subject to
possible race conditions or future breakage if the sequence of functions
would change.

The data.set.str[] strings MUST remain unmodified exactly as set by the
user, and the credentials to use internally are instead set/updated in
state.aptr.*

Added test 675 to verify different credentials used in two requests done
over a reused HTTP connection, which previously behaved wrongly.

Fixes #6542
Closes #6545

show more ...

urldata: don't touch data->set.httpversion at run-time

Rename it to 'httpwant' and make a cloned field in the state struct as
well for run-time updates.

Also: refuse non-support

urldata: don't touch data->set.httpversion at run-time

Rename it to 'httpwant' and make a cloned field in the state struct as
well for run-time updates.

Also: refuse non-supported HTTP versions. Verified with test 129.

Closes #6585

show more ...

ftp: add 'list_only' to the transfer state struct

and rename it from 'ftp_list_only' since it is also used for SSH and
POP3. The state is updated internally for 'type=D' FTP URLs.

ftp: add 'list_only' to the transfer state struct

and rename it from 'ftp_list_only' since it is also used for SSH and
POP3. The state is updated internally for 'type=D' FTP URLs.

Added test case 1570 to verify.

Closes #6578

show more ...

ftp: add 'prefer_ascii' to the transfer state struct

... and make sure the code never updates 'set.prefer_ascii' as it breaks
handle reuse which should use the setting as the user specif

ftp: add 'prefer_ascii' to the transfer state struct

... and make sure the code never updates 'set.prefer_ascii' as it breaks
handle reuse which should use the setting as the user specified it.

Added test 1569 to verify: it first makes an FTP transfer with ';type=A'
and then another without type on the same handle and the second should
then use binary. Previously, curl failed this.

Closes #6578

show more ...

urldata: move 'followlocation' to UrlState

As this is a state variable it does not belong in UserDefined which is
used to store values set by the user.

Closes #6582

transfer: fix GCC 10 warning with flag '-Wint-in-bool-context'

... and return the error code from the Curl_mime_rewind call.

Closes #6537

avoid warning: enum constant in boolean context

Curl_chunker: shrink the struct

... by removing a field, converting the hex index into a byte and
rearranging the order. Cuts it down from 48 bytes to 32 on x86_64.

Closes #6527

chunk/encoding: remove conn->data references

... by anchoring more functions on Curl_easy instead of connectdata

Closes #6498

transfer: fix ‘conn’ undeclared mistake for iconv build

Follow-up to 219d9f8620d

transfer: remove conn->data use

Closes #6486

quic: remove conn->data use

Closes #6485

lib: more conn->data cleanups

Closes #6479

lib: pass in 'struct Curl_easy *' to most functions

... in most cases instead of 'struct connectdata *' but in some cases in
addition to.

- We mostly operate on transfers and no

lib: pass in 'struct Curl_easy *' to most functions

... in most cases instead of 'struct connectdata *' but in some cases in
addition to.

- We mostly operate on transfers and not connections.

- We need the transfer handle to log, store data and more. Everything in
libcurl is driven by a transfer (the CURL * in the public API).

- This work clarifies and separates the transfers from the connections
better.

- We should avoid "conn->data". Since individual connections can be used
by many transfers when multiplexing, making sure that conn->data
points to the current and correct transfer at all times is difficult
and has been notoriously error-prone over the years. The goal is to
ultimately remove the conn->data pointer for this reason.

Closes #6425

show more ...

transfer: remove Curl_ prefix from static functions

pretransfer: setup the User-Agent header here

... and not in the connection setup, as for multiplexed transfers the
connection setup might be skipped and then the transfer would end up

pretransfer: setup the User-Agent header here

... and not in the connection setup, as for multiplexed transfers the
connection setup might be skipped and then the transfer would end up
without the set user-agent!

Reported-by: Flameborn on github
Assisted-by: Andrey Gursky
Assisted-by: Jay Satiro
Assisted-by: Mike Gelfand
Fixes #6312
Closes #6417

show more ...

httpauth: make multi-request auth work with custom port

When doing HTTP authentication and a port number set with CURLOPT_PORT,
the code would previously have the URL's port number overr

httpauth: make multi-request auth work with custom port

When doing HTTP authentication and a port number set with CURLOPT_PORT,
the code would previously have the URL's port number override as if it
had been a redirect to an absolute URL.

Added test 1568 to verify.

Reported-by: UrsusArctos on github
Fixes #6397
Closes #6400

show more ...

language: s/behaviour/behavior/g

We currently use both spellings the british "behaviour" and the american
"behavior". However "behavior" is more used in the project so I think
it's w

language: s/behaviour/behavior/g

We currently use both spellings the british "behaviour" and the american
"behavior". However "behavior" is more used in the project so I think
it's worth dropping the british name.

Closes #6395

show more ...