diff options
54 files changed, 484 insertions, 181 deletions
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 09afcb3716..7917803b79 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -530,6 +530,13 @@ t:intel2021.5.0-makefiles: CMAKE_CI_BUILD_NAME: intel2021.5.0_makefiles CMAKE_CI_INTELCOMPILER_IMAGE_TAG: 2022.0.2-el8 +t:intel2021.6.0-makefiles: + extends: + - .cmake_test_linux_intelclassic_makefiles + variables: + CMAKE_CI_BUILD_NAME: intel2021.6.0_makefiles + CMAKE_CI_INTELCOMPILER_IMAGE_TAG: 2022.1.0-el8 + t:oneapi2021.1.1-makefiles: extends: - .cmake_test_linux_inteloneapi_makefiles @@ -572,6 +579,13 @@ t:oneapi2022.0.2-makefiles: CMAKE_CI_BUILD_NAME: oneapi2022.0.2_makefiles CMAKE_CI_INTELCOMPILER_IMAGE_TAG: 2022.0.2-el8 +t:oneapi2022.1.0-makefiles: + extends: + - .cmake_test_linux_inteloneapi_makefiles + variables: + CMAKE_CI_BUILD_NAME: oneapi2022.1.0_makefiles + CMAKE_CI_INTELCOMPILER_IMAGE_TAG: 2022.1.0-el8 + b:linux-x86_64-package: extends: - .linux_package diff --git a/Help/command/try_compile.rst b/Help/command/try_compile.rst index 4b2a63169e..806a98d4b2 100644 --- a/Help/command/try_compile.rst +++ b/Help/command/try_compile.rst @@ -7,6 +7,8 @@ try_compile Try building some code. +.. _`Try Compiling Whole Projects`: + Try Compiling Whole Projects ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -25,6 +27,15 @@ will not be deleted after this command is run. Specify ``<targetName>`` to build a specific target instead of the ``all`` or ``ALL_BUILD`` target. See below for the meaning of other options. +.. versionchanged:: 3.24 + CMake variables describing platform settings, and those listed by the + :variable:`CMAKE_TRY_COMPILE_PLATFORM_VARIABLES` variable, are propagated + into the project's build configuration. See policy :policy:`CMP0137`. + Previously this was only done by the + :ref:`source file <Try Compiling Source Files>` signature. + +.. _`Try Compiling Source Files`: + Try Compiling Source Files ^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -205,3 +216,7 @@ a build configuration. .. versionchanged:: 3.14 For the :generator:`Green Hills MULTI` generator the GHS toolset and target system customization cache variables are also propagated into the test project. + +.. versionadded:: 3.24 + The :variable:`CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES` variable may be + set to disable passing platform variables into the test project. diff --git a/Help/manual/cmake-policies.7.rst b/Help/manual/cmake-policies.7.rst index 259cebbe64..788d086ce1 100644 --- a/Help/manual/cmake-policies.7.rst +++ b/Help/manual/cmake-policies.7.rst @@ -58,6 +58,7 @@ Policies Introduced by CMake 3.24 .. toctree:: :maxdepth: 1 + CMP0137: try_compile() passes platform variables in project mode. </policy/CMP0137> CMP0136: Watcom runtime library flags are selected by an abstraction. </policy/CMP0136> CMP0135: ExternalProject ignores timestamps in archives by default for the URL download method. </policy/CMP0135> CMP0134: Fallback to \"HOST\" Windows registry view when \"TARGET\" view is not usable. </policy/CMP0134> diff --git a/Help/manual/cmake-variables.7.rst b/Help/manual/cmake-variables.7.rst index 00ea0bcc54..ff431ad4aa 100644 --- a/Help/manual/cmake-variables.7.rst +++ b/Help/manual/cmake-variables.7.rst @@ -503,6 +503,7 @@ Variables that Control the Build /variable/CMAKE_STATIC_LINKER_FLAGS_CONFIG_INIT /variable/CMAKE_STATIC_LINKER_FLAGS_INIT /variable/CMAKE_TRY_COMPILE_CONFIGURATION + /variable/CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES /variable/CMAKE_TRY_COMPILE_PLATFORM_VARIABLES /variable/CMAKE_TRY_COMPILE_TARGET_TYPE /variable/CMAKE_UNITY_BUILD diff --git a/Help/policy/CMP0137.rst b/Help/policy/CMP0137.rst new file mode 100644 index 0000000000..ba3cb9c149 --- /dev/null +++ b/Help/policy/CMP0137.rst @@ -0,0 +1,33 @@ +CMP0137 +------- + +.. versionadded:: 3.24 + +:command:`try_compile` passes platform variables in project mode. + +The :command:`try_compile` command :ref:`source file <Try Compiling Source +Files>` signature propagates CMake variables containing platform settings, +and those specified by the :variable:`CMAKE_TRY_COMPILE_PLATFORM_VARIABLES` +variable, into the generated test project. This helps the test project drive +the toolchain the same way the calling project will. In CMake 3.23 and below, +the :ref:`whole-project <Try Compiling Whole Projects>` signature does not +propagate platform variables automatically. CMake 3.24 and above prefer to +propagate platform variables in the :ref:`whole-project <Try Compiling Whole +Projects>` signature. This policy provides compatibility with projects that +have not been updated to expect the behavior. + +The ``OLD`` behavior for this policy is to not pass any additional variables to +the :ref:`whole-project <Try Compiling Whole Projects>` signature. +The ``NEW`` behavior for this policy is to pass the same variables that the +:ref:`source file <Try Compiling Source Files>` signature does. + +Regardless of the policy setting, the +:variable:`CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES` variable may be set +to suppress passing the platform variables through either signature. + +This policy was introduced in CMake version 3.24. Use the +:command:`cmake_policy` command to set this policy to ``OLD`` or ``NEW`` +explicitly. Unlike many policies, CMake version |release| does *not* warn +by default when this policy is not set and simply uses ``OLD`` behavior. + +.. include:: DEPRECATED.txt diff --git a/Help/release/dev/try_compile-project-platform-vars.rst b/Help/release/dev/try_compile-project-platform-vars.rst new file mode 100644 index 0000000000..06596d4882 --- /dev/null +++ b/Help/release/dev/try_compile-project-platform-vars.rst @@ -0,0 +1,10 @@ +try_compile-project-platform-vars +--------------------------------- + +* The :command:`try_compile` command + :ref:`whole-project <Try Compiling Whole Projects>` signature + now propagates platform variables. See policy :policy:`CMP0137`. + +* The :variable:`CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES` variable + was added to tell the :command:`try_compile` command not to + pass any platform variables to the test project. diff --git a/Help/variable/CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES.rst b/Help/variable/CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES.rst new file mode 100644 index 0000000000..944caa584f --- /dev/null +++ b/Help/variable/CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES.rst @@ -0,0 +1,10 @@ +CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES +--------------------------------------- + +Set to a true value to tell the :command:`try_compile` command not +to propagate any platform variables into the test project. + +The :command:`try_compile` command normally passes some CMake variables +that configure the platform and toolchain behavior into test projects. +See policy :policy:`CMP0137`. This variable may be set to disable +that behavior. diff --git a/Help/variable/CMAKE_TRY_COMPILE_PLATFORM_VARIABLES.rst b/Help/variable/CMAKE_TRY_COMPILE_PLATFORM_VARIABLES.rst index d17851304b..6b26d14b3e 100644 --- a/Help/variable/CMAKE_TRY_COMPILE_PLATFORM_VARIABLES.rst +++ b/Help/variable/CMAKE_TRY_COMPILE_PLATFORM_VARIABLES.rst @@ -26,3 +26,12 @@ If a user passes ``-DMY_CUSTOM_VARIABLE=SomeValue`` to CMake then this setting will be made visible to the toolchain file both for the main project and for test projects generated by the :command:`try_compile` command source file signature. + +.. versionchanged:: 3.24 + Listed variables are propagated to the :command:`try_compile` + :ref:`whole-project <Try Compiling Whole Projects>` signature too. + See :policy:`CMP0137`. + +.. versionadded:: 3.24 + The :variable:`CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES` variable may be + set to disable passing platform variables into the test project. diff --git a/Modules/FetchContent.cmake b/Modules/FetchContent.cmake index b92c6793af..a342aa7023 100644 --- a/Modules/FetchContent.cmake +++ b/Modules/FetchContent.cmake @@ -1356,7 +1356,7 @@ ExternalProject_Add_Step(${contentName}-populate copyfile # and can always request a known configuration further below. get_property(is_multi_config GLOBAL PROPERTY GENERATOR_IS_MULTI_CONFIG) if(is_multi_config) - list(APPEND subCMakeOpts "-DCMAKE_CONFIGURATION_TYPES:STRING=Release") + list(APPEND subCMakeOpts "-DCMAKE_CONFIGURATION_TYPES:STRING=Debug") endif() else() @@ -1404,7 +1404,7 @@ set_property(GLOBAL PROPERTY _CMAKE_FindGit_GIT_EXECUTABLE_VERSION # anything to be updated, so extra rebuilds of the project won't occur. # Make sure to pass through CMAKE_MAKE_PROGRAM in case the main project # has this set to something not findable on the PATH. We also ensured above - # that the Release config will be defined for multi-config generators. + # that the Debug config will be defined for multi-config generators. configure_file("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/FetchContent/CMakeLists.cmake.in" "${ARG_SUBBUILD_DIR}/CMakeLists.txt") execute_process( @@ -1420,7 +1420,7 @@ set_property(GLOBAL PROPERTY _CMAKE_FindGit_GIT_EXECUTABLE_VERSION message(FATAL_ERROR "CMake step for ${contentName} failed: ${result}") endif() execute_process( - COMMAND ${CMAKE_COMMAND} --build . --config Release + COMMAND ${CMAKE_COMMAND} --build . --config Debug RESULT_VARIABLE result ${outputOptions} WORKING_DIRECTORY "${ARG_SUBBUILD_DIR}" diff --git a/Modules/FindZLIB.cmake b/Modules/FindZLIB.cmake index 4af842ac4e..f50116fc4d 100644 --- a/Modules/FindZLIB.cmake +++ b/Modules/FindZLIB.cmake @@ -77,8 +77,13 @@ set(_ZLIB_SEARCH_NORMAL unset(_ZLIB_x86) list(APPEND _ZLIB_SEARCHES _ZLIB_SEARCH_NORMAL) -set(ZLIB_NAMES z zlib zdll zlib1 zlibstatic zlibstat zlibvc) -set(ZLIB_NAMES_DEBUG zd zlibd zdlld zlibd1 zlib1d zlibstaticd zlibstatd zlibvcd) +if(ZLIB_USE_STATIC_LIBS) + set(ZLIB_NAMES zlibstatic zlibstat zlib z) + set(ZLIB_NAMES_DEBUG zlibstaticd zlibstatd zlibd zd) +else() + set(ZLIB_NAMES z zlib zdll zlib1 zlibstatic zlibwapi zlibvc zlibstat) + set(ZLIB_NAMES_DEBUG zd zlibd zdlld zlibd1 zlib1d zlibstaticd zlibwapid zlibvcd zlibstatd) +endif() # Try each search configuration. foreach(search ${_ZLIB_SEARCHES}) @@ -87,9 +92,15 @@ endforeach() # Allow ZLIB_LIBRARY to be set manually, as the location of the zlib library if(NOT ZLIB_LIBRARY) + set(_zlib_ORIG_CMAKE_FIND_LIBRARY_PREFIXES ${CMAKE_FIND_LIBRARY_PREFIXES}) + set(_zlib_ORIG_CMAKE_FIND_LIBRARY_SUFFIXES ${CMAKE_FIND_LIBRARY_SUFFIXES}) + # Prefix/suffix of the win32/Makefile.gcc build + if(WIN32) + list(APPEND CMAKE_FIND_LIBRARY_PREFIXES "" "lib") + list(APPEND CMAKE_FIND_LIBRARY_SUFFIXES ".dll.a") + endif() # Support preference of static libs by adjusting CMAKE_FIND_LIBRARY_SUFFIXES if(ZLIB_USE_STATIC_LIBS) - set(_zlib_ORIG_CMAKE_FIND_LIBRARY_SUFFIXES ${CMAKE_FIND_LIBRARY_SUFFIXES}) if(WIN32) set(CMAKE_FIND_LIBRARY_SUFFIXES .lib .a ${CMAKE_FIND_LIBRARY_SUFFIXES}) else() @@ -103,9 +114,8 @@ if(NOT ZLIB_LIBRARY) endforeach() # Restore the original find library ordering - if(ZLIB_USE_STATIC_LIBS) - set(CMAKE_FIND_LIBRARY_SUFFIXES ${_zlib_ORIG_CMAKE_FIND_LIBRARY_SUFFIXES}) - endif() + set(CMAKE_FIND_LIBRARY_SUFFIXES ${_zlib_ORIG_CMAKE_FIND_LIBRARY_SUFFIXES}) + set(CMAKE_FIND_LIBRARY_PREFIXES ${_zlib_ORIG_CMAKE_FIND_LIBRARY_PREFIXES}) include(${CMAKE_CURRENT_LIST_DIR}/SelectLibraryConfigurations.cmake) select_library_configurations(ZLIB) diff --git a/Modules/FortranCInterface/CMakeLists.txt b/Modules/FortranCInterface/CMakeLists.txt index ce0bc10c8e..fb35ff0a6d 100644 --- a/Modules/FortranCInterface/CMakeLists.txt +++ b/Modules/FortranCInterface/CMakeLists.txt @@ -112,6 +112,9 @@ if(CMAKE_Fortran_COMPILER_ID STREQUAL "GNU" AND CMAKE_Fortran_COMPILER_VERSION VERSION_GREATER_EQUAL 12) target_compile_options(FortranCInterface PRIVATE "-fno-lto") target_compile_options(myfort PRIVATE "-flto=auto" "-ffat-lto-objects") +endif() +if(CMAKE_C_COMPILER_ID STREQUAL "GNU" AND + CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 12) target_compile_options(symbols PRIVATE "-flto=auto" "-ffat-lto-objects") endif() diff --git a/Source/CMakeVersion.cmake b/Source/CMakeVersion.cmake index 66590af8ea..e650f7f268 100644 --- a/Source/CMakeVersion.cmake +++ b/Source/CMakeVersion.cmake @@ -1,7 +1,7 @@ # CMake version number components. set(CMake_VERSION_MAJOR 3) set(CMake_VERSION_MINOR 23) -set(CMake_VERSION_PATCH 20220517) +set(CMake_VERSION_PATCH 20220518) #set(CMake_VERSION_RC 0) set(CMake_VERSION_IS_DIRTY 0) diff --git a/Source/cmCoreTryCompile.cxx b/Source/cmCoreTryCompile.cxx index 4909948c2b..caa413b9e5 100644 --- a/Source/cmCoreTryCompile.cxx +++ b/Source/cmCoreTryCompile.cxx @@ -872,7 +872,10 @@ int cmCoreTryCompile::TryCompileCode(std::vector<std::string> const& argv, } // Forward a set of variables to the inner project cache. - if (this->SrcFileSignature) { + if ((this->SrcFileSignature || + this->Makefile->GetPolicyStatus(cmPolicies::CMP0137) == + cmPolicies::NEW) && + !this->Makefile->IsOn("CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES")) { std::set<std::string> vars; vars.insert(&c_properties[lang_property_start], &c_properties[lang_property_start + lang_property_size]); diff --git a/Source/cmInstallGenerator.cxx b/Source/cmInstallGenerator.cxx index 87110a9c4f..93abd45693 100644 --- a/Source/cmInstallGenerator.cxx +++ b/Source/cmInstallGenerator.cxx @@ -165,14 +165,22 @@ void cmInstallGenerator::AddInstallRule( } std::string cmInstallGenerator::CreateComponentTest( - const std::string& component, bool exclude_from_all) + const std::string& component, bool exclude_from_all, bool all_components) { + if (all_components) { + if (exclude_from_all) { + return "CMAKE_INSTALL_COMPONENT"; + } + return {}; + } + std::string result = "CMAKE_INSTALL_COMPONENT STREQUAL \""; result += component; result += "\""; if (!exclude_from_all) { result += " OR NOT CMAKE_INSTALL_COMPONENT"; } + return result; } @@ -181,10 +189,11 @@ void cmInstallGenerator::GenerateScript(std::ostream& os) // Track indentation. Indent indent; + std::string component_test = this->CreateComponentTest( + this->Component, this->ExcludeFromAll, this->AllComponents); + // Begin this block of installation. - if (!this->AllComponents) { - std::string component_test = - this->CreateComponentTest(this->Component, this->ExcludeFromAll); + if (!component_test.empty()) { os << indent << "if(" << component_test << ")\n"; } @@ -193,7 +202,7 @@ void cmInstallGenerator::GenerateScript(std::ostream& os) this->AllComponents ? indent : indent.Next()); // End this block of installation. - if (!this->AllComponents) { + if (!component_test.empty()) { os << indent << "endif()\n\n"; } } diff --git a/Source/cmInstallGenerator.h b/Source/cmInstallGenerator.h index d342c99261..9fcd284a91 100644 --- a/Source/cmInstallGenerator.h +++ b/Source/cmInstallGenerator.h @@ -78,7 +78,8 @@ protected: void GenerateScript(std::ostream& os) override; std::string CreateComponentTest(const std::string& component, - bool exclude_from_all); + bool exclude_from_all, + bool all_components = false); using TweakMethod = std::function<void(std::ostream& os, Indent indent, diff --git a/Source/cmPolicies.h b/Source/cmPolicies.h index 49770833bf..c8b037ee3c 100644 --- a/Source/cmPolicies.h +++ b/Source/cmPolicies.h @@ -411,7 +411,10 @@ class cmMakefile; 3, 24, 0, cmPolicies::WARN) \ SELECT(POLICY, CMP0136, \ "Watcom runtime library flags are selected by an abstraction.", 3, \ - 24, 0, cmPolicies::WARN) + 24, 0, cmPolicies::WARN) \ + SELECT(POLICY, CMP0137, \ + "try_compile() passes platform variables in project mode", 3, 24, 0, \ + cmPolicies::WARN) #define CM_SELECT_ID(F, A1, A2, A3, A4, A5, A6) F(A1) #define CM_FOR_EACH_POLICY_ID(POLICY) \ diff --git a/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS-all-check.cmake b/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS-all-check.cmake index 48d8e1aec6..0b5fb8debf 100644 --- a/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS-all-check.cmake +++ b/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS-all-check.cmake @@ -1 +1 @@ -check_installed([[^empty1.txt;empty2.txt$]]) +check_installed([[^empty1.txt;empty3.txt$]]) diff --git a/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS-dev-check.cmake b/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS-dev-check.cmake index 48d8e1aec6..88e57e3cbf 100644 --- a/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS-dev-check.cmake +++ b/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS-dev-check.cmake @@ -1 +1 @@ -check_installed([[^empty1.txt;empty2.txt$]]) +check_installed([[^empty1.txt;empty2.txt;empty3.txt$]]) diff --git a/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS-uns-check.cmake b/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS-uns-check.cmake index 48d8e1aec6..88e57e3cbf 100644 --- a/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS-uns-check.cmake +++ b/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS-uns-check.cmake @@ -1 +1 @@ -check_installed([[^empty1.txt;empty2.txt$]]) +check_installed([[^empty1.txt;empty2.txt;empty3.txt$]]) diff --git a/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS.cmake b/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS.cmake index aa3f9d1b7a..73c4e35181 100644 --- a/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS.cmake +++ b/Tests/RunCMake/install/SCRIPT-ALL_COMPONENTS.cmake @@ -1,5 +1,16 @@ + install( SCRIPT "${CMAKE_CURRENT_SOURCE_DIR}/install_script.cmake" + ALL_COMPONENTS +) + +install( CODE "write_empty_file(empty2.txt)" ALL_COMPONENTS - ) + EXCLUDE_FROM_ALL +) + +install( + CODE "write_empty_file(empty3.txt)" + ALL_COMPONENTS +) diff --git a/Tests/RunCMake/try_compile/CMP0137-Common.cmake b/Tests/RunCMake/try_compile/CMP0137-Common.cmake new file mode 100644 index 0000000000..2c1bc0d60d --- /dev/null +++ b/Tests/RunCMake/try_compile/CMP0137-Common.cmake @@ -0,0 +1,16 @@ +set(CMAKE_ENABLE_EXPORTS 1) +set(FOO 2) +set(CMAKE_TRY_COMPILE_PLATFORM_VARIABLES FOO) +try_compile(RESULT_VAR + ${CMAKE_CURRENT_BINARY_DIR}/CMP0137-build + ${CMAKE_CURRENT_SOURCE_DIR}/CMP0137 + TestCMP0137) +include(${CMAKE_CURRENT_BINARY_DIR}/CMP0137-build/info.cmake OPTIONAL) + +message(STATUS "Enabling CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES") +set(CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES 1) +try_compile(RESULT_VAR + ${CMAKE_CURRENT_BINARY_DIR}/CMP0137-build2 + ${CMAKE_CURRENT_SOURCE_DIR}/CMP0137 + TestCMP0137) +include(${CMAKE_CURRENT_BINARY_DIR}/CMP0137-build2/info.cmake OPTIONAL) diff --git a/Tests/RunCMake/try_compile/CMP0137-NEW-stdout.txt b/Tests/RunCMake/try_compile/CMP0137-NEW-stdout.txt new file mode 100644 index 0000000000..abc61dcc55 --- /dev/null +++ b/Tests/RunCMake/try_compile/CMP0137-NEW-stdout.txt @@ -0,0 +1,5 @@ +-- CMAKE_ENABLE_EXPORTS='1' +-- FOO='2' +-- Enabling CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES +-- CMAKE_ENABLE_EXPORTS='' +-- FOO='' diff --git a/Tests/RunCMake/try_compile/CMP0137-NEW.cmake b/Tests/RunCMake/try_compile/CMP0137-NEW.cmake new file mode 100644 index 0000000000..f7caa505b2 --- /dev/null +++ b/Tests/RunCMake/try_compile/CMP0137-NEW.cmake @@ -0,0 +1,2 @@ +cmake_policy(SET CMP0137 NEW) +include(CMP0137-Common.cmake) diff --git a/Tests/RunCMake/try_compile/CMP0137-WARN-stdout.txt b/Tests/RunCMake/try_compile/CMP0137-WARN-stdout.txt new file mode 100644 index 0000000000..2e4bebe09e --- /dev/null +++ b/Tests/RunCMake/try_compile/CMP0137-WARN-stdout.txt @@ -0,0 +1,5 @@ +-- CMAKE_ENABLE_EXPORTS='' +-- FOO='' +-- Enabling CMAKE_TRY_COMPILE_NO_PLATFORM_VARIABLES +-- CMAKE_ENABLE_EXPORTS='' +-- FOO='' diff --git a/Tests/RunCMake/try_compile/CMP0137-WARN.cmake b/Tests/RunCMake/try_compile/CMP0137-WARN.cmake new file mode 100644 index 0000000000..61b56416e9 --- /dev/null +++ b/Tests/RunCMake/try_compile/CMP0137-WARN.cmake @@ -0,0 +1,2 @@ +# policy CMP0137 not set +include(CMP0137-Common.cmake) diff --git a/Tests/RunCMake/try_compile/CMP0137/CMakeLists.txt b/Tests/RunCMake/try_compile/CMP0137/CMakeLists.txt new file mode 100644 index 0000000000..a3b9fda838 --- /dev/null +++ b/Tests/RunCMake/try_compile/CMP0137/CMakeLists.txt @@ -0,0 +1,6 @@ +cmake_minimum_required(VERSION 3.23) +project(TestCMP0137 NONE) +file(WRITE "${CMAKE_CURRENT_BINARY_DIR}/info.cmake" " +message(STATUS \"CMAKE_ENABLE_EXPORTS='${CMAKE_ENABLE_EXPORTS}'\") +message(STATUS \"FOO='${FOO}'\") +") diff --git a/Tests/RunCMake/try_compile/RunCMakeTest.cmake b/Tests/RunCMake/try_compile/RunCMakeTest.cmake index dcd37996e5..eca7bf485d 100644 --- a/Tests/RunCMake/try_compile/RunCMakeTest.cmake +++ b/Tests/RunCMake/try_compile/RunCMakeTest.cmake @@ -72,6 +72,8 @@ endif() run_cmake(CMP0056) run_cmake(CMP0066) run_cmake(CMP0067) +run_cmake(CMP0137-WARN) +run_cmake(CMP0137-NEW) if(RunCMake_GENERATOR MATCHES "Make|Ninja") # Use a single build tree for a few tests without cleaning. diff --git a/Utilities/Scripts/update-curl.bash b/Utilities/Scripts/update-curl.bash index 64cb659279..9715e07a03 100755 --- a/Utilities/Scripts/update-curl.bash +++ b/Utilities/Scripts/update-curl.bash @@ -8,7 +8,7 @@ readonly name="curl" readonly ownership="Curl Upstream <curl-library@lists.haxx.se>" readonly subtree="Utilities/cmcurl" readonly repo="https://github.com/curl/curl.git" -readonly tag="curl-7_83_0" +readonly tag="curl-7_83_1" readonly shortlog=false readonly paths=" CMake/* diff --git a/Utilities/cmcurl/include/curl/curlver.h b/Utilities/cmcurl/include/curl/curlver.h index 3081115f57..718d58c085 100644 --- a/Utilities/cmcurl/include/curl/curlver.h +++ b/Utilities/cmcurl/include/curl/curlver.h @@ -30,13 +30,13 @@ /* This is the version number of the libcurl package from which this header file origins: */ -#define LIBCURL_VERSION "7.83.0" +#define LIBCURL_VERSION "7.83.1" /* The numeric version number is also available "in parts" by using these defines: */ #define LIBCURL_VERSION_MAJOR 7 #define LIBCURL_VERSION_MINOR 83 -#define LIBCURL_VERSION_PATCH 0 +#define LIBCURL_VERSION_PATCH 1 /* This is the numeric version of the libcurl version number, meant for easier parsing and comparisons by programs. The LIBCURL_VERSION_NUM define will @@ -57,7 +57,7 @@ CURL_VERSION_BITS() macro since curl's own configure script greps for it and needs it to contain the full number. */ -#define LIBCURL_VERSION_NUM 0x075300 +#define LIBCURL_VERSION_NUM 0x075301 /* * This is the date and time when the full source package was created. The diff --git a/Utilities/cmcurl/lib/altsvc.c b/Utilities/cmcurl/lib/altsvc.c index 45929a5df7..dd2d0ebed6 100644 --- a/Utilities/cmcurl/lib/altsvc.c +++ b/Utilities/cmcurl/lib/altsvc.c @@ -102,12 +102,17 @@ static struct altsvc *altsvc_createid(const char *srchost, unsigned int dstport) { struct altsvc *as = calloc(sizeof(struct altsvc), 1); + size_t hlen; if(!as) return NULL; - + hlen = strlen(srchost); + DEBUGASSERT(hlen); as->src.host = strdup(srchost); if(!as->src.host) goto error; + if(hlen && (srchost[hlen - 1] == '.')) + /* strip off trailing any dot */ + as->src.host[--hlen] = 0; as->dst.host = strdup(dsthost); if(!as->dst.host) goto error; @@ -398,6 +403,22 @@ static CURLcode getalnum(const char **ptr, char *alpnbuf, size_t buflen) return CURLE_OK; } +/* hostcompare() returns true if 'host' matches 'check'. The first host + * argument may have a trailing dot present that will be ignored. + */ +static bool hostcompare(const char *host, const char *check) +{ + size_t hlen = strlen(host); + size_t clen = strlen(check); + + if(hlen && (host[hlen - 1] == '.')) + hlen--; + if(hlen != clen) + /* they can't match if they have different lengths */ + return FALSE; + return strncasecompare(host, check, hlen); +} + /* altsvc_flush() removes all alternatives for this source origin from the list */ static void altsvc_flush(struct altsvcinfo *asi, enum alpnid srcalpnid, @@ -410,7 +431,7 @@ static void altsvc_flush(struct altsvcinfo *asi, enum alpnid srcalpnid, n = e->next; if((srcalpnid == as->src.alpnid) && (srcport == as->src.port) && - strcasecompare(srchost, as->src.host)) { + hostcompare(srchost, as->src.host)) { Curl_llist_remove(&asi->list, e, NULL); altsvc_free(as); } @@ -635,7 +656,7 @@ bool Curl_altsvc_lookup(struct altsvcinfo *asi, continue; } if((as->src.alpnid == srcalpnid) && - strcasecompare(as->src.host, srchost) && + hostcompare(srchost, as->src.host) && (as->src.port == srcport) && (versions & as->dst.alpnid)) { /* match */ diff --git a/Utilities/cmcurl/lib/c-hyper.c b/Utilities/cmcurl/lib/c-hyper.c index de09568741..69082982cf 100644 --- a/Utilities/cmcurl/lib/c-hyper.c +++ b/Utilities/cmcurl/lib/c-hyper.c @@ -439,6 +439,13 @@ CURLcode Curl_hyper_stream(struct Curl_easy *data, reasonp = hyper_response_reason_phrase(resp); reason_len = hyper_response_reason_phrase_len(resp); + if(http_status == 417 && data->state.expect100header) { + infof(data, "Got 417 while waiting for a 100"); + data->state.disableexpect = TRUE; + data->req.newurl = strdup(data->state.url); + Curl_done_sending(data, k); + } + result = status_line(data, conn, http_status, http_version, reasonp, reason_len); if(result) @@ -951,6 +958,11 @@ CURLcode Curl_http(struct Curl_easy *data, bool *done) goto error; } } + else { + if(!h2 && !data->state.disableexpect) { + data->state.expect100header = TRUE; + } + } if(hyper_request_set_method(req, (uint8_t *)method, strlen(method))) { failf(data, "error setting method"); diff --git a/Utilities/cmcurl/lib/cookie.c b/Utilities/cmcurl/lib/cookie.c index 451881f578..0c2d49b478 100644 --- a/Utilities/cmcurl/lib/cookie.c +++ b/Utilities/cmcurl/lib/cookie.c @@ -427,7 +427,15 @@ static void remove_expired(struct CookieInfo *cookies) /* Make sure domain contains a dot or is localhost. */ static bool bad_domain(const char *domain) { - return !strchr(domain, '.') && !strcasecompare(domain, "localhost"); + if(strcasecompare(domain, "localhost")) + return FALSE; + else { + /* there must be a dot present, but that dot must not be a trailing dot */ + char *dot = strchr(domain, '.'); + if(dot) + return dot[1] ? FALSE : TRUE; + } + return TRUE; } /* diff --git a/Utilities/cmcurl/lib/easy.c b/Utilities/cmcurl/lib/easy.c index 65d74646ae..bd9d695bb5 100644 --- a/Utilities/cmcurl/lib/easy.c +++ b/Utilities/cmcurl/lib/easy.c @@ -1139,7 +1139,7 @@ CURLcode curl_easy_recv(struct Curl_easy *data, void *buffer, size_t buflen, if(!data->conn) /* on first invoke, the transfer has been detached from the connection and needs to be reattached */ - Curl_attach_connnection(data, c); + Curl_attach_connection(data, c); *n = 0; result = Curl_read(data, sfd, buffer, buflen, &n1); @@ -1175,7 +1175,7 @@ CURLcode curl_easy_send(struct Curl_easy *data, const void *buffer, if(!data->conn) /* on first invoke, the transfer has been detached from the connection and needs to be reattached */ - Curl_attach_connnection(data, c); + Curl_attach_connection(data, c); *n = 0; sigpipe_ignore(data, &pipe_st); @@ -1209,12 +1209,12 @@ static int conn_upkeep(struct Curl_easy *data, if(conn->handler->connection_check) { /* briefly attach the connection to this transfer for the purpose of checking it */ - Curl_attach_connnection(data, conn); + Curl_attach_connection(data, conn); /* Do a protocol-specific keepalive check on the connection. */ conn->handler->connection_check(data, conn, CONNCHECK_KEEPALIVE); /* detach the connection again */ - Curl_detach_connnection(data); + Curl_detach_connection(data); } return 0; /* continue iteration */ diff --git a/Utilities/cmcurl/lib/hostip.c b/Utilities/cmcurl/lib/hostip.c index 7f6bbac62d..7000b85501 100644 --- a/Utilities/cmcurl/lib/hostip.c +++ b/Utilities/cmcurl/lib/hostip.c @@ -1268,7 +1268,7 @@ CURLcode Curl_once_resolved(struct Curl_easy *data, bool *protocol_done) result = Curl_setup_conn(data, protocol_done); if(result) { - Curl_detach_connnection(data); + Curl_detach_connection(data); Curl_conncache_remove_conn(data, conn, TRUE); Curl_disconnect(data, conn, TRUE); } diff --git a/Utilities/cmcurl/lib/hsts.c b/Utilities/cmcurl/lib/hsts.c index 03fcc9e425..b9fa6f7af5 100644 --- a/Utilities/cmcurl/lib/hsts.c +++ b/Utilities/cmcurl/lib/hsts.c @@ -114,16 +114,25 @@ static CURLcode hsts_create(struct hsts *h, curl_off_t expires) { struct stsentry *sts = hsts_entry(); + char *duphost; + size_t hlen; if(!sts) return CURLE_OUT_OF_MEMORY; - sts->expires = expires; - sts->includeSubDomains = subdomains; - sts->host = strdup(hostname); - if(!sts->host) { + duphost = strdup(hostname); + if(!duphost) { free(sts); return CURLE_OUT_OF_MEMORY; } + + hlen = strlen(duphost); + if(duphost[hlen - 1] == '.') + /* strip off trailing any dot */ + duphost[--hlen] = 0; + + sts->host = duphost; + sts->expires = expires; + sts->includeSubDomains = subdomains; Curl_llist_insert_next(&h->list, h->list.tail, sts, &sts->node); return CURLE_OK; } @@ -238,10 +247,21 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname, bool subdomain) { if(h) { + char buffer[MAX_HSTS_HOSTLEN + 1]; time_t now = time(NULL); size_t hlen = strlen(hostname); struct Curl_llist_element *e; struct Curl_llist_element *n; + + if((hlen > MAX_HSTS_HOSTLEN) || !hlen) + return NULL; + memcpy(buffer, hostname, hlen); + if(hostname[hlen-1] == '.') + /* remove the trailing dot */ + --hlen; + buffer[hlen] = 0; + hostname = buffer; + for(e = h->list.head; e; e = n) { struct stsentry *sts = e->ptr; n = e->next; @@ -440,7 +460,7 @@ static CURLcode hsts_pull(struct Curl_easy *data, struct hsts *h) CURLSTScode sc; DEBUGASSERT(h); do { - char buffer[257]; + char buffer[MAX_HSTS_HOSTLEN + 1]; struct curl_hstsentry e; e.name = buffer; e.namelen = sizeof(buffer)-1; diff --git a/Utilities/cmcurl/lib/http.c b/Utilities/cmcurl/lib/http.c index 0d5c449bc7..b215307dca 100644 --- a/Utilities/cmcurl/lib/http.c +++ b/Utilities/cmcurl/lib/http.c @@ -651,6 +651,21 @@ CURLcode Curl_http_auth_act(struct Curl_easy *data) return result; } +/* + * Curl_allow_auth_to_host() tells if authentication, cookies or other + * "sensitive data" can (still) be sent to this host. + */ +bool Curl_allow_auth_to_host(struct Curl_easy *data) +{ + struct connectdata *conn = data->conn; + return (!data->state.this_is_a_follow || + data->set.allow_auth_to_other_hosts || + (data->state.first_host && + strcasecompare(data->state.first_host, conn->host.name) && + (data->state.first_remote_port == conn->remote_port) && + (data->state.first_remote_protocol == conn->handler->protocol))); +} + #ifndef CURL_DISABLE_HTTP_AUTH /* * Output the correct authentication header depending on the auth type @@ -775,21 +790,6 @@ output_auth_headers(struct Curl_easy *data, return CURLE_OK; } -/* - * Curl_allow_auth_to_host() tells if authentication, cookies or other - * "sensitive data" can (still) be sent to this host. - */ -bool Curl_allow_auth_to_host(struct Curl_easy *data) -{ - struct connectdata *conn = data->conn; - return (!data->state.this_is_a_follow || - data->set.allow_auth_to_other_hosts || - (data->state.first_host && - strcasecompare(data->state.first_host, conn->host.name) && - (data->state.first_remote_port == conn->remote_port) && - (data->state.first_remote_protocol == conn->handler->protocol))); -} - /** * Curl_http_output_auth() setups the authentication headers for the * host/proxy and the correct authentication diff --git a/Utilities/cmcurl/lib/http_proxy.c b/Utilities/cmcurl/lib/http_proxy.c index 863cbbbdce..ed08193e1e 100644 --- a/Utilities/cmcurl/lib/http_proxy.c +++ b/Utilities/cmcurl/lib/http_proxy.c @@ -967,6 +967,13 @@ static CURLcode CONNECT(struct Curl_easy *data, break; } + if(conn->bits.close && data->req.newurl) { + /* Connection closed by server. Don't use it anymore */ + Curl_closesocket(data, conn, conn->sock[sockindex]); + conn->sock[sockindex] = CURL_SOCKET_BAD; + break; + } + /* If we are supposed to continue and request a new URL, which basically * means the HTTP authentication is still going on so if the tunnel * is complete we start over in INIT state */ diff --git a/Utilities/cmcurl/lib/multi.c b/Utilities/cmcurl/lib/multi.c index 466425d58e..8e58d785a9 100644 --- a/Utilities/cmcurl/lib/multi.c +++ b/Utilities/cmcurl/lib/multi.c @@ -118,7 +118,7 @@ static void init_completed(struct Curl_easy *data) /* Important: reset the conn pointer so that we don't point to memory that could be freed anytime */ - Curl_detach_connnection(data); + Curl_detach_connection(data); Curl_expire_clear(data); /* stop all timers */ } @@ -635,7 +635,7 @@ static CURLcode multi_done(struct Curl_easy *data, process_pending_handles(data->multi); /* connection / multiplex */ CONNCACHE_LOCK(data); - Curl_detach_connnection(data); + Curl_detach_connection(data); if(CONN_INUSE(conn)) { /* Stop if still used. */ CONNCACHE_UNLOCK(data); @@ -824,7 +824,7 @@ CURLMcode curl_multi_remove_handle(struct Curl_multi *multi, that vanish with this handle */ /* Remove the association between the connection and the handle */ - Curl_detach_connnection(data); + Curl_detach_connection(data); if(data->state.lastconnect_id != -1) { /* Mark any connect-only connection for closure */ @@ -899,12 +899,12 @@ bool Curl_multiplex_wanted(const struct Curl_multi *multi) } /* - * Curl_detach_connnection() removes the given transfer from the connection. + * Curl_detach_connection() removes the given transfer from the connection. * * This is the only function that should clear data->conn. This will * occasionally be called with the data->conn pointer already cleared. */ -void Curl_detach_connnection(struct Curl_easy *data) +void Curl_detach_connection(struct Curl_easy *data) { struct connectdata *conn = data->conn; if(conn) { @@ -916,11 +916,11 @@ void Curl_detach_connnection(struct Curl_easy *data) } /* - * Curl_attach_connnection() attaches this transfer to this connection. + * Curl_attach_connection() attaches this transfer to this connection. * * This is the only function that should assign data->conn */ -void Curl_attach_connnection(struct Curl_easy *data, +void Curl_attach_connection(struct Curl_easy *data, struct connectdata *conn) { DEBUGASSERT(!data->conn); @@ -1540,7 +1540,7 @@ CURLMcode Curl_multi_add_perform(struct Curl_multi *multi, /* take this handle to the perform state right away */ multistate(data, MSTATE_PERFORMING); - Curl_attach_connnection(data, conn); + Curl_attach_connection(data, conn); k->keepon |= KEEP_RECV; /* setup to receive! */ } return rc; @@ -2558,7 +2558,7 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi, /* This is where we make sure that the conn pointer is reset. We don't have to do this in every case block above where a failure is detected */ - Curl_detach_connnection(data); + Curl_detach_connection(data); /* remove connection from cache */ Curl_conncache_remove_conn(data, conn, TRUE); diff --git a/Utilities/cmcurl/lib/multiif.h b/Utilities/cmcurl/lib/multiif.h index f4d0ada8e8..5a8c358bc4 100644 --- a/Utilities/cmcurl/lib/multiif.h +++ b/Utilities/cmcurl/lib/multiif.h @@ -7,7 +7,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al. + * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -31,9 +31,9 @@ void Curl_expire(struct Curl_easy *data, timediff_t milli, expire_id); void Curl_expire_clear(struct Curl_easy *data); void Curl_expire_done(struct Curl_easy *data, expire_id id); CURLMcode Curl_update_timer(struct Curl_multi *multi) WARN_UNUSED_RESULT; -void Curl_attach_connnection(struct Curl_easy *data, +void Curl_attach_connection(struct Curl_easy *data, struct connectdata *conn); -void Curl_detach_connnection(struct Curl_easy *data); +void Curl_detach_connection(struct Curl_easy *data); bool Curl_multiplex_wanted(const struct Curl_multi *multi); void Curl_set_in_callback(struct Curl_easy *data, bool value); bool Curl_is_in_callback(struct Curl_easy *easy); diff --git a/Utilities/cmcurl/lib/setopt.c b/Utilities/cmcurl/lib/setopt.c index 0df1afa614..05e1a544df 100644 --- a/Utilities/cmcurl/lib/setopt.c +++ b/Utilities/cmcurl/lib/setopt.c @@ -2294,6 +2294,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param) case CURLOPT_SSL_OPTIONS: arg = va_arg(param, long); + data->set.ssl.primary.ssl_options = (unsigned char)(arg & 0xff); data->set.ssl.enable_beast = !!(arg & CURLSSLOPT_ALLOW_BEAST); data->set.ssl.no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE); data->set.ssl.no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN); @@ -2307,6 +2308,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param) #ifndef CURL_DISABLE_PROXY case CURLOPT_PROXY_SSL_OPTIONS: arg = va_arg(param, long); + data->set.proxy_ssl.primary.ssl_options = (unsigned char)(arg & 0xff); data->set.proxy_ssl.enable_beast = !!(arg & CURLSSLOPT_ALLOW_BEAST); data->set.proxy_ssl.no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE); data->set.proxy_ssl.no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN); @@ -2745,49 +2747,52 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param) case CURLOPT_TLSAUTH_USERNAME: result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_USERNAME], va_arg(param, char *)); - if(data->set.str[STRING_TLSAUTH_USERNAME] && !data->set.ssl.authtype) - data->set.ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */ + if(data->set.str[STRING_TLSAUTH_USERNAME] && + !data->set.ssl.primary.authtype) + data->set.ssl.primary.authtype = CURL_TLSAUTH_SRP; /* default to SRP */ break; #ifndef CURL_DISABLE_PROXY case CURLOPT_PROXY_TLSAUTH_USERNAME: result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_USERNAME_PROXY], va_arg(param, char *)); if(data->set.str[STRING_TLSAUTH_USERNAME_PROXY] && - !data->set.proxy_ssl.authtype) - data->set.proxy_ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */ + !data->set.proxy_ssl.primary.authtype) + data->set.proxy_ssl.primary.authtype = CURL_TLSAUTH_SRP; /* default to + SRP */ break; #endif case CURLOPT_TLSAUTH_PASSWORD: result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD], va_arg(param, char *)); - if(data->set.str[STRING_TLSAUTH_USERNAME] && !data->set.ssl.authtype) - data->set.ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */ + if(data->set.str[STRING_TLSAUTH_USERNAME] && + !data->set.ssl.primary.authtype) + data->set.ssl.primary.authtype = CURL_TLSAUTH_SRP; /* default */ break; #ifndef CURL_DISABLE_PROXY case CURLOPT_PROXY_TLSAUTH_PASSWORD: result = Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD_PROXY], va_arg(param, char *)); if(data->set.str[STRING_TLSAUTH_USERNAME_PROXY] && - !data->set.proxy_ssl.authtype) - data->set.proxy_ssl.authtype = CURL_TLSAUTH_SRP; /* default to SRP */ + !data->set.proxy_ssl.primary.authtype) + data->set.proxy_ssl.primary.authtype = CURL_TLSAUTH_SRP; /* default */ break; #endif case CURLOPT_TLSAUTH_TYPE: argptr = va_arg(param, char *); if(!argptr || strncasecompare(argptr, "SRP", strlen("SRP"))) - data->set.ssl.authtype = CURL_TLSAUTH_SRP; + data->set.ssl.primary.authtype = CURL_TLSAUTH_SRP; else - data->set.ssl.authtype = CURL_TLSAUTH_NONE; + data->set.ssl.primary.authtype = CURL_TLSAUTH_NONE; break; #ifndef CURL_DISABLE_PROXY case CURLOPT_PROXY_TLSAUTH_TYPE: argptr = va_arg(param, char *); if(!argptr || strncasecompare(argptr, "SRP", strlen("SRP"))) - data->set.proxy_ssl.authtype = CURL_TLSAUTH_SRP; + data->set.proxy_ssl.primary.authtype = CURL_TLSAUTH_SRP; else - data->set.proxy_ssl.authtype = CURL_TLSAUTH_NONE; + data->set.proxy_ssl.primary.authtype = CURL_TLSAUTH_NONE; break; #endif #endif diff --git a/Utilities/cmcurl/lib/url.c b/Utilities/cmcurl/lib/url.c index ef48ed612c..6b31d4b131 100644 --- a/Utilities/cmcurl/lib/url.c +++ b/Utilities/cmcurl/lib/url.c @@ -372,7 +372,7 @@ CURLcode Curl_close(struct Curl_easy **datap) /* Detach connection if any is left. This should not be normal, but can be the case for example with CONNECT_ONLY + recv/send (test 556) */ - Curl_detach_connnection(data); + Curl_detach_connection(data); m = data->multi; if(m) /* This handle is still part of a multi handle, take care of this first @@ -542,7 +542,7 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data) set->ssl.primary.verifypeer = TRUE; set->ssl.primary.verifyhost = TRUE; #ifdef USE_TLS_SRP - set->ssl.authtype = CURL_TLSAUTH_NONE; + set->ssl.primary.authtype = CURL_TLSAUTH_NONE; #endif set->ssh_auth_types = CURLSSH_AUTH_DEFAULT; /* defaults to any auth type */ @@ -859,7 +859,7 @@ void Curl_disconnect(struct Curl_easy *data, /* temporarily attach the connection to this transfer handle for the disconnect and shutdown */ - Curl_attach_connnection(data, conn); + Curl_attach_connection(data, conn); if(conn->handler->disconnect) /* This is set if protocol-specific cleanups should be made */ @@ -868,7 +868,7 @@ void Curl_disconnect(struct Curl_easy *data, conn_shutdown(data, conn); /* detach it again */ - Curl_detach_connnection(data); + Curl_detach_connection(data); conn_free(conn); } @@ -1020,12 +1020,12 @@ static bool extract_if_dead(struct connectdata *conn, /* briefly attach the connection to this transfer for the purpose of checking it */ - Curl_attach_connnection(data, conn); + Curl_attach_connection(data, conn); state = conn->handler->connection_check(data, conn, CONNCHECK_ISDEAD); dead = (state & CONNRESULT_DEAD); /* detach the connection again */ - Curl_detach_connnection(data); + Curl_detach_connection(data); } else { @@ -1100,6 +1100,12 @@ static void prune_dead_connections(struct Curl_easy *data) } } +static bool ssh_config_matches(struct connectdata *one, + struct connectdata *two) +{ + return (Curl_safecmp(one->proto.sshc.rsa, two->proto.sshc.rsa) && + Curl_safecmp(one->proto.sshc.rsa_pub, two->proto.sshc.rsa_pub)); +} /* * Given one filled in connection struct (named needle), this function should * detect if there already is one that has all the significant details @@ -1356,6 +1362,11 @@ ConnectionExists(struct Curl_easy *data, (data->state.httpwant < CURL_HTTP_VERSION_2_0)) continue; + if(get_protocol_family(needle->handler) == PROTO_FAMILY_SSH) { + if(!ssh_config_matches(needle, check)) + continue; + } + if((needle->handler->flags&PROTOPT_SSL) #ifndef CURL_DISABLE_PROXY || !needle->bits.httpproxy || needle->bits.tunnel_proxy @@ -1508,7 +1519,7 @@ ConnectionExists(struct Curl_easy *data, if(chosen) { /* mark it as used before releasing the lock */ - Curl_attach_connnection(data, chosen); + Curl_attach_connection(data, chosen); CONNCACHE_UNLOCK(data); *usethis = chosen; return TRUE; /* yes, we found one to use! */ @@ -1758,11 +1769,17 @@ static struct connectdata *allocate_conn(struct Curl_easy *data) conn->ssl_config.verifystatus = data->set.ssl.primary.verifystatus; conn->ssl_config.verifypeer = data->set.ssl.primary.verifypeer; conn->ssl_config.verifyhost = data->set.ssl.primary.verifyhost; + conn->ssl_config.ssl_options = data->set.ssl.primary.ssl_options; +#ifdef USE_TLS_SRP +#endif #ifndef CURL_DISABLE_PROXY conn->proxy_ssl_config.verifystatus = data->set.proxy_ssl.primary.verifystatus; conn->proxy_ssl_config.verifypeer = data->set.proxy_ssl.primary.verifypeer; conn->proxy_ssl_config.verifyhost = data->set.proxy_ssl.primary.verifyhost; + conn->proxy_ssl_config.ssl_options = data->set.proxy_ssl.primary.ssl_options; +#ifdef USE_TLS_SRP +#endif #endif conn->ip_version = data->set.ipver; conn->bits.connect_only = data->set.connect_only; @@ -3779,7 +3796,7 @@ static CURLcode create_conn(struct Curl_easy *data, if(!result) { conn->bits.tcpconnect[FIRSTSOCKET] = TRUE; /* we are "connected */ - Curl_attach_connnection(data, conn); + Curl_attach_connection(data, conn); result = Curl_conncache_add_conn(data); if(result) goto out; @@ -3848,7 +3865,8 @@ static CURLcode create_conn(struct Curl_easy *data, data->set.str[STRING_SSL_ISSUERCERT_PROXY]; data->set.proxy_ssl.primary.issuercert_blob = data->set.blobs[BLOB_SSL_ISSUERCERT_PROXY]; - data->set.proxy_ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE_PROXY]; + data->set.proxy_ssl.primary.CRLfile = + data->set.str[STRING_SSL_CRLFILE_PROXY]; data->set.proxy_ssl.cert_type = data->set.str[STRING_CERT_TYPE_PROXY]; data->set.proxy_ssl.key = data->set.str[STRING_KEY_PROXY]; data->set.proxy_ssl.key_type = data->set.str[STRING_KEY_TYPE_PROXY]; @@ -3856,18 +3874,20 @@ static CURLcode create_conn(struct Curl_easy *data, data->set.proxy_ssl.primary.clientcert = data->set.str[STRING_CERT_PROXY]; data->set.proxy_ssl.key_blob = data->set.blobs[BLOB_KEY_PROXY]; #endif - data->set.ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE]; + data->set.ssl.primary.CRLfile = data->set.str[STRING_SSL_CRLFILE]; data->set.ssl.cert_type = data->set.str[STRING_CERT_TYPE]; data->set.ssl.key = data->set.str[STRING_KEY]; data->set.ssl.key_type = data->set.str[STRING_KEY_TYPE]; data->set.ssl.key_passwd = data->set.str[STRING_KEY_PASSWD]; data->set.ssl.primary.clientcert = data->set.str[STRING_CERT]; #ifdef USE_TLS_SRP - data->set.ssl.username = data->set.str[STRING_TLSAUTH_USERNAME]; - data->set.ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD]; + data->set.ssl.primary.username = data->set.str[STRING_TLSAUTH_USERNAME]; + data->set.ssl.primary.password = data->set.str[STRING_TLSAUTH_PASSWORD]; #ifndef CURL_DISABLE_PROXY - data->set.proxy_ssl.username = data->set.str[STRING_TLSAUTH_USERNAME_PROXY]; - data->set.proxy_ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD_PROXY]; + data->set.proxy_ssl.primary.username = + data->set.str[STRING_TLSAUTH_USERNAME_PROXY]; + data->set.proxy_ssl.primary.password = + data->set.str[STRING_TLSAUTH_PASSWORD_PROXY]; #endif #endif data->set.ssl.key_blob = data->set.blobs[BLOB_KEY]; @@ -4006,7 +4026,7 @@ static CURLcode create_conn(struct Curl_easy *data, * This is a brand new connection, so let's store it in the connection * cache of ours! */ - Curl_attach_connnection(data, conn); + Curl_attach_connection(data, conn); result = Curl_conncache_add_conn(data); if(result) goto out; @@ -4153,7 +4173,7 @@ CURLcode Curl_connect(struct Curl_easy *data, else if(result && conn) { /* We're not allowed to return failure with memory left allocated in the connectdata struct, free those here */ - Curl_detach_connnection(data); + Curl_detach_connection(data); Curl_conncache_remove_conn(data, conn, TRUE); Curl_disconnect(data, conn, TRUE); } diff --git a/Utilities/cmcurl/lib/urlapi.c b/Utilities/cmcurl/lib/urlapi.c index 99a0f69282..2a36de6a58 100644 --- a/Utilities/cmcurl/lib/urlapi.c +++ b/Utilities/cmcurl/lib/urlapi.c @@ -228,7 +228,7 @@ static void strcpy_url(char *output, const char *url, bool relative) */ bool Curl_is_absolute_url(const char *url, char *buf, size_t buflen) { - size_t i; + int i; DEBUGASSERT(!buf || (buflen > MAX_SCHEME_LEN)); (void)buflen; /* only used in debug-builds */ if(buf) @@ -678,8 +678,8 @@ static CURLUcode hostname_check(struct Curl_URL *u, char *hostname) #endif } else { - /* letters from the second string is not ok */ - len = strcspn(hostname, " \r\n"); + /* letters from the second string are not ok */ + len = strcspn(hostname, " \r\n\t/:#?!@"); if(hlen != len) /* hostname with bad content */ return CURLUE_BAD_HOSTNAME; diff --git a/Utilities/cmcurl/lib/urldata.h b/Utilities/cmcurl/lib/urldata.h index 9c34ec444c..584434d774 100644 --- a/Utilities/cmcurl/lib/urldata.h +++ b/Utilities/cmcurl/lib/urldata.h @@ -253,10 +253,17 @@ struct ssl_primary_config { char *cipher_list; /* list of ciphers to use */ char *cipher_list13; /* list of TLS 1.3 cipher suites to use */ char *pinned_key; + char *CRLfile; /* CRL to check certificate revocation */ struct curl_blob *cert_blob; struct curl_blob *ca_info_blob; struct curl_blob *issuercert_blob; +#ifdef USE_TLS_SRP + char *username; /* TLS username (for, e.g., SRP) */ + char *password; /* TLS password (for, e.g., SRP) */ + enum CURL_TLSAUTH authtype; /* TLS authentication type (default SRP) */ +#endif char *curves; /* list of curves to use */ + unsigned char ssl_options; /* the CURLOPT_SSL_OPTIONS bitmask */ BIT(verifypeer); /* set TRUE if this is desired */ BIT(verifyhost); /* set TRUE if CN/SAN must match hostname */ BIT(verifystatus); /* set TRUE if certificate status must be checked */ @@ -266,7 +273,6 @@ struct ssl_primary_config { struct ssl_config_data { struct ssl_primary_config primary; long certverifyresult; /* result from the certificate verification */ - char *CRLfile; /* CRL to check certificate revocation */ curl_ssl_ctx_callback fsslctx; /* function to initialize ssl ctx */ void *fsslctxp; /* parameter for call back */ char *cert_type; /* format for certificate (default: PEM)*/ @@ -274,11 +280,6 @@ struct ssl_config_data { struct curl_blob *key_blob; char *key_type; /* format for private key (default: PEM) */ char *key_passwd; /* plain text private key password */ -#ifdef USE_TLS_SRP - char *username; /* TLS username (for, e.g., SRP) */ - char *password; /* TLS password (for, e.g., SRP) */ - enum CURL_TLSAUTH authtype; /* TLS authentication type (default SRP) */ -#endif BIT(certinfo); /* gather lots of certificate info */ BIT(falsestart); BIT(enable_beast); /* allow this flaw for interoperability's sake*/ diff --git a/Utilities/cmcurl/lib/vquic/msh3.c b/Utilities/cmcurl/lib/vquic/msh3.c index be18e6e83c..f7bd315be1 100644 --- a/Utilities/cmcurl/lib/vquic/msh3.c +++ b/Utilities/cmcurl/lib/vquic/msh3.c @@ -95,7 +95,9 @@ static const MSH3_REQUEST_IF msh3_request_if = { void Curl_quic_ver(char *p, size_t len) { - (void)msnprintf(p, len, "msh3/%s", "0.0.1"); + uint32_t v[4]; + MsH3Version(v); + (void)msnprintf(p, len, "msh3/%d.%d.%d.%d", v[0], v[1], v[2], v[3]); } CURLcode Curl_quic_connect(struct Curl_easy *data, @@ -121,7 +123,10 @@ CURLcode Curl_quic_connect(struct Curl_easy *data, return CURLE_FAILED_INIT; } - qs->conn = MsH3ConnectionOpen(qs->api, conn->host.name, unsecure); + qs->conn = MsH3ConnectionOpen(qs->api, + conn->host.name, + (uint16_t)conn->remote_port, + unsecure); if(!qs->conn) { failf(data, "can't create msh3 connection"); if(qs->api) { @@ -357,7 +362,7 @@ static void MSH3_CALL msh3_complete(MSH3_REQUEST *Request, void *IfContext, struct HTTP *stream = IfContext; (void)Request; (void)AbortError; - H3BUGF(printf("* msh3_complete, aborted=%hhu\n", Aborted)); + H3BUGF(printf("* msh3_complete, aborted=%s\n", Aborted ? "true" : "false")); msh3_lock_acquire(&stream->recv_lock); if(Aborted) { stream->recv_error = CURLE_HTTP3; /* TODO - how do we pass AbortError? */ diff --git a/Utilities/cmcurl/lib/vquic/ngtcp2.c b/Utilities/cmcurl/lib/vquic/ngtcp2.c index abce631337..f1a64eea85 100644 --- a/Utilities/cmcurl/lib/vquic/ngtcp2.c +++ b/Utilities/cmcurl/lib/vquic/ngtcp2.c @@ -264,6 +264,7 @@ static SSL_QUIC_METHOD quic_method = {quic_set_encryption_secrets, static SSL_CTX *quic_ssl_ctx(struct Curl_easy *data) { + struct connectdata *conn = data->conn; SSL_CTX *ssl_ctx = SSL_CTX_new(TLS_method()); SSL_CTX_set_min_proto_version(ssl_ctx, TLS1_3_VERSION); @@ -291,12 +292,11 @@ static SSL_CTX *quic_ssl_ctx(struct Curl_easy *data) SSL_CTX_set_keylog_callback(ssl_ctx, keylog_callback); } - { - struct connectdata *conn = data->conn; + if(conn->ssl_config.verifypeer) { const char * const ssl_cafile = conn->ssl_config.CAfile; const char * const ssl_capath = conn->ssl_config.CApath; - if(conn->ssl_config.verifypeer) { + if(ssl_cafile || ssl_capath) { SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL); /* tell OpenSSL where to find CA certificates that are used to verify the server's certificate. */ @@ -311,6 +311,13 @@ static SSL_CTX *quic_ssl_ctx(struct Curl_easy *data) infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none"); infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none"); } +#ifdef CURL_CA_FALLBACK + else { + /* verifying the peer without any CA certificates won't work so + use openssl's built-in default as fallback */ + SSL_CTX_set_default_verify_paths(ssl_ctx); + } +#endif } return ssl_ctx; } diff --git a/Utilities/cmcurl/lib/vssh/ssh.h b/Utilities/cmcurl/lib/vssh/ssh.h index 7972081ec6..30d82e5764 100644 --- a/Utilities/cmcurl/lib/vssh/ssh.h +++ b/Utilities/cmcurl/lib/vssh/ssh.h @@ -7,7 +7,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al. + * Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -131,8 +131,8 @@ struct ssh_conn { /* common */ const char *passphrase; /* pass-phrase to use */ - char *rsa_pub; /* path name */ - char *rsa; /* path name */ + char *rsa_pub; /* strdup'ed public key file */ + char *rsa; /* strdup'ed private key file */ bool authed; /* the connection has been authenticated fine */ bool acceptfail; /* used by the SFTP_QUOTE (continue if quote command fails) */ diff --git a/Utilities/cmcurl/lib/vtls/gskit.c b/Utilities/cmcurl/lib/vtls/gskit.c index 9b5fbe4dd6..7a65f92f20 100644 --- a/Utilities/cmcurl/lib/vtls/gskit.c +++ b/Utilities/cmcurl/lib/vtls/gskit.c @@ -293,27 +293,6 @@ static CURLcode set_numeric(struct Curl_easy *data, } -static CURLcode set_callback(struct Curl_easy *data, - gsk_handle h, GSK_CALLBACK_ID id, void *info) -{ - char buffer[STRERROR_LEN]; - int rc = gsk_attribute_set_callback(h, id, info); - - switch(rc) { - case GSK_OK: - return CURLE_OK; - case GSK_ERROR_IO: - failf(data, "gsk_attribute_set_callback() I/O error: %s", - Curl_strerror(errno, buffer, sizeof(buffer))); - break; - default: - failf(data, "gsk_attribute_set_callback(): %s", gsk_strerror(rc)); - break; - } - return CURLE_SSL_CONNECT_ERROR; -} - - static CURLcode set_ciphers(struct Curl_easy *data, gsk_handle h, unsigned int *protoflags) { @@ -796,13 +775,13 @@ static CURLcode gskit_connect_step1(struct Curl_easy *data, BACKEND->localfd = sockpair[0]; BACKEND->remotefd = sockpair[1]; setsockopt(BACKEND->localfd, SOL_SOCKET, SO_RCVBUF, - (void *) sobufsize, sizeof(sobufsize)); + (void *) &sobufsize, sizeof(sobufsize)); setsockopt(BACKEND->remotefd, SOL_SOCKET, SO_RCVBUF, - (void *) sobufsize, sizeof(sobufsize)); + (void *) &sobufsize, sizeof(sobufsize)); setsockopt(BACKEND->localfd, SOL_SOCKET, SO_SNDBUF, - (void *) sobufsize, sizeof(sobufsize)); + (void *) &sobufsize, sizeof(sobufsize)); setsockopt(BACKEND->remotefd, SOL_SOCKET, SO_SNDBUF, - (void *) sobufsize, sizeof(sobufsize)); + (void *) &sobufsize, sizeof(sobufsize)); curlx_nonblock(BACKEND->localfd, TRUE); curlx_nonblock(BACKEND->remotefd, TRUE); } diff --git a/Utilities/cmcurl/lib/vtls/gtls.c b/Utilities/cmcurl/lib/vtls/gtls.c index 0535011911..dd82755852 100644 --- a/Utilities/cmcurl/lib/vtls/gtls.c +++ b/Utilities/cmcurl/lib/vtls/gtls.c @@ -445,9 +445,10 @@ gtls_connect_step1(struct Curl_easy *data, } #ifdef USE_GNUTLS_SRP - if((SSL_SET_OPTION(authtype) == CURL_TLSAUTH_SRP) && + if((SSL_SET_OPTION(primary.authtype) == CURL_TLSAUTH_SRP) && Curl_allow_auth_to_host(data)) { - infof(data, "Using TLS-SRP username: %s", SSL_SET_OPTION(username)); + infof(data, "Using TLS-SRP username: %s", + SSL_SET_OPTION(primary.username)); rc = gnutls_srp_allocate_client_credentials(&backend->srp_client_cred); if(rc != GNUTLS_E_SUCCESS) { @@ -457,8 +458,8 @@ gtls_connect_step1(struct Curl_easy *data, } rc = gnutls_srp_set_client_credentials(backend->srp_client_cred, - SSL_SET_OPTION(username), - SSL_SET_OPTION(password)); + SSL_SET_OPTION(primary.username), + SSL_SET_OPTION(primary.password)); if(rc != GNUTLS_E_SUCCESS) { failf(data, "gnutls_srp_set_client_cred() failed: %s", gnutls_strerror(rc)); @@ -515,19 +516,19 @@ gtls_connect_step1(struct Curl_easy *data, } #endif - if(SSL_SET_OPTION(CRLfile)) { + if(SSL_SET_OPTION(primary.CRLfile)) { /* set the CRL list file */ rc = gnutls_certificate_set_x509_crl_file(backend->cred, - SSL_SET_OPTION(CRLfile), + SSL_SET_OPTION(primary.CRLfile), GNUTLS_X509_FMT_PEM); if(rc < 0) { failf(data, "error reading crl file %s (%s)", - SSL_SET_OPTION(CRLfile), gnutls_strerror(rc)); + SSL_SET_OPTION(primary.CRLfile), gnutls_strerror(rc)); return CURLE_SSL_CRL_BADFILE; } else infof(data, "found %d CRL in %s", - rc, SSL_SET_OPTION(CRLfile)); + rc, SSL_SET_OPTION(primary.CRLfile)); } /* Initialize TLS session as a client */ @@ -598,7 +599,7 @@ gtls_connect_step1(struct Curl_easy *data, #ifdef USE_GNUTLS_SRP /* Only add SRP to the cipher list if SRP is requested. Otherwise * GnuTLS will disable TLS 1.3 support. */ - if(SSL_SET_OPTION(authtype) == CURL_TLSAUTH_SRP) { + if(SSL_SET_OPTION(primary.authtype) == CURL_TLSAUTH_SRP) { size_t len = strlen(prioritylist); char *prioritysrp = malloc(len + sizeof(GNUTLS_SRP) + 1); @@ -693,7 +694,7 @@ gtls_connect_step1(struct Curl_easy *data, #ifdef USE_GNUTLS_SRP /* put the credentials to the current session */ - if(SSL_SET_OPTION(authtype) == CURL_TLSAUTH_SRP) { + if(SSL_SET_OPTION(primary.authtype) == CURL_TLSAUTH_SRP) { rc = gnutls_credentials_set(session, GNUTLS_CRD_SRP, backend->srp_client_cred); if(rc != GNUTLS_E_SUCCESS) { @@ -875,8 +876,8 @@ Curl_gtls_verifyserver(struct Curl_easy *data, SSL_CONN_CONFIG(verifyhost) || SSL_CONN_CONFIG(issuercert)) { #ifdef USE_GNUTLS_SRP - if(SSL_SET_OPTION(authtype) == CURL_TLSAUTH_SRP - && SSL_SET_OPTION(username) != NULL + if(SSL_SET_OPTION(primary.authtype) == CURL_TLSAUTH_SRP + && SSL_SET_OPTION(primary.username) && !SSL_CONN_CONFIG(verifypeer) && gnutls_cipher_get(session)) { /* no peer cert, but auth is ok if we have SRP user and cipher and no @@ -934,7 +935,8 @@ Curl_gtls_verifyserver(struct Curl_easy *data, failf(data, "server certificate verification failed. CAfile: %s " "CRLfile: %s", SSL_CONN_CONFIG(CAfile) ? SSL_CONN_CONFIG(CAfile): "none", - SSL_SET_OPTION(CRLfile)?SSL_SET_OPTION(CRLfile):"none"); + SSL_SET_OPTION(primary.CRLfile) ? + SSL_SET_OPTION(primary.CRLfile) : "none"); return CURLE_PEER_FAILED_VERIFICATION; } else @@ -1564,8 +1566,8 @@ static int gtls_shutdown(struct Curl_easy *data, struct connectdata *conn, gnutls_certificate_free_credentials(backend->cred); #ifdef USE_GNUTLS_SRP - if(SSL_SET_OPTION(authtype) == CURL_TLSAUTH_SRP - && SSL_SET_OPTION(username) != NULL) + if(SSL_SET_OPTION(primary.authtype) == CURL_TLSAUTH_SRP + && SSL_SET_OPTION(primary.username) != NULL) gnutls_srp_free_client_credentials(backend->srp_client_cred); #endif diff --git a/Utilities/cmcurl/lib/vtls/mbedtls.c b/Utilities/cmcurl/lib/vtls/mbedtls.c index 64f57c5d83..b60b9cac50 100644 --- a/Utilities/cmcurl/lib/vtls/mbedtls.c +++ b/Utilities/cmcurl/lib/vtls/mbedtls.c @@ -279,7 +279,7 @@ mbed_connect_step1(struct Curl_easy *data, struct connectdata *conn, const char * const ssl_capath = SSL_CONN_CONFIG(CApath); char * const ssl_cert = SSL_SET_OPTION(primary.clientcert); const struct curl_blob *ssl_cert_blob = SSL_SET_OPTION(primary.cert_blob); - const char * const ssl_crlfile = SSL_SET_OPTION(CRLfile); + const char * const ssl_crlfile = SSL_SET_OPTION(primary.CRLfile); const char * const hostname = SSL_HOST_NAME(); #ifndef CURL_DISABLE_VERBOSE_STRINGS const long int port = SSL_HOST_PORT(); @@ -303,8 +303,9 @@ mbed_connect_step1(struct Curl_easy *data, struct connectdata *conn, &ts_entropy, NULL, 0); if(ret) { mbedtls_strerror(ret, errorbuf, sizeof(errorbuf)); - failf(data, "Failed - mbedTLS: ctr_drbg_init returned (-0x%04X) %s", + failf(data, "mbedtls_ctr_drbg_seed returned (-0x%04X) %s", -ret, errorbuf); + return CURLE_FAILED_INIT; } #else mbedtls_entropy_init(&backend->entropy); @@ -314,8 +315,9 @@ mbed_connect_step1(struct Curl_easy *data, struct connectdata *conn, &backend->entropy, NULL, 0); if(ret) { mbedtls_strerror(ret, errorbuf, sizeof(errorbuf)); - failf(data, "Failed - mbedTLS: ctr_drbg_init returned (-0x%04X) %s", + failf(data, "mbedtls_ctr_drbg_seed returned (-0x%04X) %s", -ret, errorbuf); + return CURLE_FAILED_INIT; } #endif /* THREADING_SUPPORT */ @@ -815,8 +817,8 @@ mbed_connect_step2(struct Curl_easy *data, struct connectdata *conn, if(next_protocol) { infof(data, VTLS_INFOF_ALPN_ACCEPTED_1STR, next_protocol); #ifdef USE_HTTP2 - if(!strncmp(next_protocol, ALPN_H2, ALPN_H2_LEN) && - !next_protocol[ALPN_H2_LEN]) { + if(!strncmp(next_protocol, ALPN_H2, ALPN_H2_LENGTH) && + !next_protocol[ALPN_H2_LENGTH]) { conn->negnpn = CURL_HTTP_VERSION_2; } else @@ -1015,7 +1017,7 @@ static CURLcode mbedtls_random(struct Curl_easy *data, if(ret) { mbedtls_strerror(ret, errorbuf, sizeof(errorbuf)); - failf(data, "Failed - mbedTLS: ctr_drbg_seed returned (-0x%04X) %s", + failf(data, "mbedtls_ctr_drbg_seed returned (-0x%04X) %s", -ret, errorbuf); } else { @@ -1023,7 +1025,7 @@ static CURLcode mbedtls_random(struct Curl_easy *data, if(ret) { mbedtls_strerror(ret, errorbuf, sizeof(errorbuf)); - failf(data, "mbedTLS: ctr_drbg_init returned (-0x%04X) %s", + failf(data, "mbedtls_ctr_drbg_random returned (-0x%04X) %s", -ret, errorbuf); } } diff --git a/Utilities/cmcurl/lib/vtls/nss.c b/Utilities/cmcurl/lib/vtls/nss.c index 5b7de9f818..cb0509ff5b 100644 --- a/Utilities/cmcurl/lib/vtls/nss.c +++ b/Utilities/cmcurl/lib/vtls/nss.c @@ -983,6 +983,9 @@ static void display_cert_info(struct Curl_easy *data, PR_Free(common_name); } +/* A number of certs that will never occur in a real server handshake */ +#define TOO_MANY_CERTS 300 + static CURLcode display_conn_info(struct Curl_easy *data, PRFileDesc *sock) { CURLcode result = CURLE_OK; @@ -1018,6 +1021,11 @@ static CURLcode display_conn_info(struct Curl_easy *data, PRFileDesc *sock) cert2 = CERT_FindCertIssuer(cert, now, certUsageSSLCA); while(cert2) { i++; + if(i >= TOO_MANY_CERTS) { + CERT_DestroyCertificate(cert2); + failf(data, "certificate loop"); + return CURLE_SSL_CERTPROBLEM; + } if(cert2->isRoot) { CERT_DestroyCertificate(cert2); break; @@ -2027,13 +2035,13 @@ static CURLcode nss_setup_connect(struct Curl_easy *data, } } - if(SSL_SET_OPTION(CRLfile)) { - const CURLcode rv = nss_load_crl(SSL_SET_OPTION(CRLfile)); + if(SSL_SET_OPTION(primary.CRLfile)) { + const CURLcode rv = nss_load_crl(SSL_SET_OPTION(primary.CRLfile)); if(rv) { result = rv; goto error; } - infof(data, " CRLfile: %s", SSL_SET_OPTION(CRLfile)); + infof(data, " CRLfile: %s", SSL_SET_OPTION(primary.CRLfile)); } if(SSL_SET_OPTION(primary.clientcert)) { diff --git a/Utilities/cmcurl/lib/vtls/openssl.c b/Utilities/cmcurl/lib/vtls/openssl.c index 3722005d44..635e9c15e7 100644 --- a/Utilities/cmcurl/lib/vtls/openssl.c +++ b/Utilities/cmcurl/lib/vtls/openssl.c @@ -215,11 +215,10 @@ * OpenSSL: supported since 1.0.2, see * https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set1_groups.html * BoringSSL: supported since 5fd1807d95f7 (committed 2016-09-30) - * LibreSSL: not tested. + * LibreSSL: since 2.5.3 (April 12, 2017) */ -#if ((OPENSSL_VERSION_NUMBER >= 0x10002000L) && \ - !defined(LIBRESSL_VERSION_NUMBER)) || \ - defined(OPENSSL_IS_BORINGSSL) +#if (OPENSSL_VERSION_NUMBER >= 0x10002000L) || \ + defined(OPENSSL_IS_BORINGSSL) #define HAVE_SSL_CTX_SET_EC_CURVES #endif @@ -2663,7 +2662,7 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data, #endif const long int ssl_version = SSL_CONN_CONFIG(version); #ifdef USE_OPENSSL_SRP - const enum CURL_TLSAUTH ssl_authtype = SSL_SET_OPTION(authtype); + const enum CURL_TLSAUTH ssl_authtype = SSL_SET_OPTION(primary.authtype); #endif char * const ssl_cert = SSL_SET_OPTION(primary.clientcert); const struct curl_blob *ssl_cert_blob = SSL_SET_OPTION(primary.cert_blob); @@ -2674,7 +2673,7 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data, (ca_info_blob ? NULL : SSL_CONN_CONFIG(CAfile)); const char * const ssl_capath = SSL_CONN_CONFIG(CApath); const bool verifypeer = SSL_CONN_CONFIG(verifypeer); - const char * const ssl_crlfile = SSL_SET_OPTION(CRLfile); + const char * const ssl_crlfile = SSL_SET_OPTION(primary.CRLfile); char error_buffer[256]; struct ssl_backend_data *backend = connssl->backend; bool imported_native_ca = false; @@ -2926,15 +2925,15 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data, #ifdef USE_OPENSSL_SRP if((ssl_authtype == CURL_TLSAUTH_SRP) && Curl_allow_auth_to_host(data)) { - char * const ssl_username = SSL_SET_OPTION(username); - + char * const ssl_username = SSL_SET_OPTION(primary.username); + char * const ssl_password = SSL_SET_OPTION(primary.password); infof(data, "Using TLS-SRP username: %s", ssl_username); if(!SSL_CTX_set_srp_username(backend->ctx, ssl_username)) { failf(data, "Unable to set SRP user name"); return CURLE_BAD_FUNCTION_ARGUMENT; } - if(!SSL_CTX_set_srp_password(backend->ctx, SSL_SET_OPTION(password))) { + if(!SSL_CTX_set_srp_password(backend->ctx, ssl_password)) { failf(data, "failed setting SRP password"); return CURLE_BAD_FUNCTION_ARGUMENT; } diff --git a/Utilities/cmcurl/lib/vtls/sectransp.c b/Utilities/cmcurl/lib/vtls/sectransp.c index 8ee8fe997f..2e57d83785 100644 --- a/Utilities/cmcurl/lib/vtls/sectransp.c +++ b/Utilities/cmcurl/lib/vtls/sectransp.c @@ -2045,8 +2045,9 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data, err = SSLSetPeerDomainName(backend->ssl_ctx, snihost, snilen); if(err != noErr) { - infof(data, "WARNING: SSL: SSLSetPeerDomainName() failed: OSStatus %d", + failf(data, "SSL: SSLSetPeerDomainName() failed: OSStatus %d", err); + return CURLE_SSL_CONNECT_ERROR; } if((Curl_inet_pton(AF_INET, hostname, &addr)) diff --git a/Utilities/cmcurl/lib/vtls/vtls.c b/Utilities/cmcurl/lib/vtls/vtls.c index a40ac06f68..e2d34388cc 100644 --- a/Utilities/cmcurl/lib/vtls/vtls.c +++ b/Utilities/cmcurl/lib/vtls/vtls.c @@ -132,6 +132,7 @@ Curl_ssl_config_matches(struct ssl_primary_config *data, { if((data->version == needle->version) && (data->version_max == needle->version_max) && + (data->ssl_options == needle->ssl_options) && (data->verifypeer == needle->verifypeer) && (data->verifyhost == needle->verifyhost) && (data->verifystatus == needle->verifystatus) && @@ -144,9 +145,15 @@ Curl_ssl_config_matches(struct ssl_primary_config *data, Curl_safecmp(data->clientcert, needle->clientcert) && Curl_safecmp(data->random_file, needle->random_file) && Curl_safecmp(data->egdsocket, needle->egdsocket) && +#ifdef USE_TLS_SRP + Curl_safecmp(data->username, needle->username) && + Curl_safecmp(data->password, needle->password) && + (data->authtype == needle->authtype) && +#endif Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list) && Curl_safe_strcasecompare(data->cipher_list13, needle->cipher_list13) && Curl_safe_strcasecompare(data->curves, needle->curves) && + Curl_safe_strcasecompare(data->CRLfile, needle->CRLfile) && Curl_safe_strcasecompare(data->pinned_key, needle->pinned_key)) return TRUE; @@ -163,6 +170,10 @@ Curl_clone_primary_ssl_config(struct ssl_primary_config *source, dest->verifyhost = source->verifyhost; dest->verifystatus = source->verifystatus; dest->sessionid = source->sessionid; + dest->ssl_options = source->ssl_options; +#ifdef USE_TLS_SRP + dest->authtype = source->authtype; +#endif CLONE_BLOB(cert_blob); CLONE_BLOB(ca_info_blob); @@ -177,6 +188,11 @@ Curl_clone_primary_ssl_config(struct ssl_primary_config *source, CLONE_STRING(cipher_list13); CLONE_STRING(pinned_key); CLONE_STRING(curves); + CLONE_STRING(CRLfile); +#ifdef USE_TLS_SRP + CLONE_STRING(username); + CLONE_STRING(password); +#endif return TRUE; } @@ -196,6 +212,11 @@ void Curl_free_primary_ssl_config(struct ssl_primary_config *sslc) Curl_safefree(sslc->ca_info_blob); Curl_safefree(sslc->issuercert_blob); Curl_safefree(sslc->curves); + Curl_safefree(sslc->CRLfile); +#ifdef USE_TLS_SRP + Curl_safefree(sslc->username); + Curl_safefree(sslc->password); +#endif } #ifdef USE_SSL diff --git a/Utilities/cmcurl/lib/vtls/x509asn1.c b/Utilities/cmcurl/lib/vtls/x509asn1.c index f64acb83c9..dfb938621c 100644 --- a/Utilities/cmcurl/lib/vtls/x509asn1.c +++ b/Utilities/cmcurl/lib/vtls/x509asn1.c @@ -945,6 +945,24 @@ static int do_pubkey(struct Curl_easy *data, int certnum, /* Generate all information records for the public key. */ + if(strcasecompare(algo, "ecPublicKey")) { + /* + * ECC public key is all the data, a value of type BIT STRING mapped to + * OCTET STRING and should not be parsed as an ASN.1 value. + */ + const unsigned long len = + (unsigned long)((pubkey->end - pubkey->beg - 2) * 4); + if(!certnum) + infof(data, " ECC Public Key (%lu bits)", len); + if(data->set.ssl.certinfo) { + char q[sizeof(len) * 8 / 3 + 1]; + msnprintf(q, sizeof(q), "%lu", len); + if(Curl_ssl_push_certinfo(data, certnum, "ECC Public Key", q)) + return 1; + } + return do_pubkey_field(data, certnum, "ecPublicKey", pubkey); + } + /* Get the public key (single element). */ if(!getASN1Element(&pk, pubkey->beg + 1, pubkey->end)) return 1; @@ -971,14 +989,10 @@ static int do_pubkey(struct Curl_easy *data, int certnum, if(!certnum) infof(data, " RSA Public Key (%lu bits)", len); if(data->set.ssl.certinfo) { - q = curl_maprintf("%lu", len); - if(q) { - CURLcode result = - Curl_ssl_push_certinfo(data, certnum, "RSA Public Key", q); - free((char *) q); - if(result) - return 1; - } + char r[sizeof(len) * 8 / 3 + 1]; + msnprintf(r, sizeof(r), "%lu", len); + if(Curl_ssl_push_certinfo(data, certnum, "RSA Public Key", r)) + return 1; } /* Generate coefficients. */ if(do_pubkey_field(data, certnum, "rsa(n)", &elem)) |