ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

curl: upgrade to 8.19.0

Browse Source 
--with-secure-transport was dropped in curl 8.15,
so replace it with --with-openssl --with-apple-sectrust,
which was added in curl 8.17

Remove all patches fixed upstream

Downloaded from https://curl.se/download/curl-8.19.0.tar.xz

Change-Id: Ic93d8e3ef637d2adf84454c4e0375d1bf4620870
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201850
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Reviewed-by: Patrick Luby <guibomacdev@gmail.com>
This commit is contained in:
Xisco Fauli
2026-03-24 22:20:55 +01:00
parent 75d1ea1171
commit 8a9e4e8631
12 changed files with 15 additions and 639 deletions
Download Patch File Download Diff File Expand all files Collapse all files
download.lst
+2 -2
View File
@@ -80,8 +80,8 @@ CPPUNIT_TARBALL := cppunit-1.15.1.tar.gz
# three static lines
# so that git cherry-pick
# will not run into conflicts
CURL_SHA256SUM := f4619a1e2474c4bbfedc88a7c2191209c8334b48fa1f4e53fd584cc12e9120dd
CURL_TARBALL := curl-8.14.1.tar.xz
CURL_SHA256SUM := 4eb41489790d19e190d7ac7e18e82857cdd68af8f4e66b292ced562d333f11df
CURL_TARBALL := curl-8.19.0.tar.xz
# three static lines
# so that git cherry-pick
# will not run into conflicts
external/curl/0001-const-up-readonly-H2_NON_FIELD.patch.1
Vendored
-25
View File
@@ -1,25 +0,0 @@
From df1f9619ac00091b309a479a166fe861f935779c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
Date: Tue, 22 Jul 2025 14:48:26 +0100
Subject: [PATCH] const up readonly H2_NON_FIELD
---
lib/http.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/http.c b/lib/http.c
index e5a069627..9a844301f 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -4569,7 +4569,7 @@ struct name_const {
};
/* keep them sorted by length! */
-static struct name_const H2_NON_FIELD[] = {
+static const struct name_const H2_NON_FIELD[] = {
{ STRCONST("Host") },
{ STRCONST("Upgrade") },
{ STRCONST("Connection") },
--
2.49.0
external/curl/0001-cookie-don-t-treat-the-leading-slash-as-trailing.patch
Vendored
-54
View File
@@ -1,54 +0,0 @@
From c6ae07c6a541e0e96d0040afb62b45dd37711300 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 11 Aug 2025 20:23:05 +0200
Subject: [PATCH] cookie: don't treat the leading slash as trailing
If there is only a leading slash in the path, keep that. Also add an
assert to make sure the path is never blank.
Reported-by: Google Big Sleep
Closes #18266
---
lib/cookie.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/lib/cookie.c b/lib/cookie.c
index 914a4aca1..b72dd99bc 100644
--- a/lib/cookie.c
+++ b/lib/cookie.c
@@ -296,9 +296,9 @@ static char *sanitize_cookie_path(const char *cookie_path)
/* Let cookie-path be the default-path. */
return strdup("/");
- /* remove trailing slash */
+ /* remove trailing slash when path is non-empty */
/* convert /hoge/ to /hoge */
- if(len && cookie_path[len - 1] == '/')
+ if(len > 1 && cookie_path[len - 1] == '/')
len--;
return Curl_memdup0(cookie_path, len);
@@ -965,7 +965,7 @@ replace_existing(struct Curl_easy *data,
clist->spath && co->spath && /* both have paths */
clist->secure && !co->secure && !secure) {
size_t cllen;
- const char *sep;
+ const char *sep = NULL;
/*
* A non-secure cookie may not overlay an existing secure cookie.
@@ -974,8 +974,9 @@ replace_existing(struct Curl_easy *data,
* "/loginhelper" is ok.
*/
- sep = strchr(clist->spath + 1, '/');
-
+ DEBUGASSERT(clist->spath[0]);
+ if(clist->spath[0])
+ sep = strchr(clist->spath + 1, '/');
if(sep)
cllen = sep - clist->spath;
else
--
2.39.5
external/curl/0001-http-only-send-bearer-if-auth-is-allowed.patch
Vendored
-147
View File
@@ -1,147 +0,0 @@
From e3d7401a32a46516c9e5ee877e613e62ed35bddc Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Fri, 6 Mar 2026 23:13:07 +0100
Subject: [PATCH] http: only send bearer if auth is allowed
Verify with test 2006
Closes #20843
---
lib/http.c | 1 +
tests/data/Makefile.am | 2 +-
tests/data/test2006 | 98 ++++++++++++++++++++++++++++++++++++++++++
3 files changed, 100 insertions(+), 1 deletion(-)
create mode 100644 tests/data/test2006
diff --git a/lib/http.c b/lib/http.c
index d2f85fc5bf..d61edbd0cd 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -705,6 +705,7 @@ static CURLcode output_auth_headers(struct Curl_easy *data,
if(authstatus->picked == CURLAUTH_BEARER) {
/* Bearer */
if((!proxy && data->set.str[STRING_BEARER] &&
+ Curl_auth_allowed_to_host(data) &&
!Curl_checkheaders(data, STRCONST("Authorization")))) {
auth = "Bearer";
result = http_output_bearer(data);
diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
index f39568d3b8..6c8be18b32 100644
--- a/tests/data/Makefile.am
+++ b/tests/data/Makefile.am
@@ -243,7 +243,7 @@ test1955 test1956 test1957 test1958 test1959 test1960 test1964 \
test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \
test1978 test1979 test1980 \
\
-test2000 test2001 test2002 test2003 test2004 test2005 \
+test2000 test2001 test2002 test2003 test2004 test2005 test2006 \
\
test2023 \
test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
diff --git a/tests/data/test2006 b/tests/data/test2006
new file mode 100644
index 0000000000..200d30a7ce
--- /dev/null
+++ b/tests/data/test2006
@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+netrc
+HTTP
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 301 Follow this you fool
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Location: http://b.com/%TESTNUMBER0002
+
+-foo-
+</data>
+
+<data2 crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 7
+Connection: close
+
+target
+</data2>
+
+<datacheck crlf="headers">
+HTTP/1.1 301 Follow this you fool
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Location: http://b.com/%TESTNUMBER0002
+
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 7
+Connection: close
+
+target
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+proxy
+</features>
+<name>
+.netrc default with redirect plus oauth2-bearer
+</name>
+<command>
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER --oauth2-bearer SECRET_TOKEN -L -x http://%HOSTIP:%HTTPPORT/ http://a.com/
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+default login testuser password testpass
+</file>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET http://a.com/ HTTP/1.1
+Host: a.com
+Authorization: Bearer SECRET_TOKEN
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://b.com/%TESTNUMBER0002 HTTP/1.1
+Host: b.com
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
--
2.53.0
external/curl/0001-proxy-auth-additional-tests.patch
Vendored
-162
View File
@@ -1,162 +0,0 @@
From 5f13a7645e565c5c1a06f3ef86e97afb856fb364 Mon Sep 17 00:00:00 2001
From: Stefan Eissing <stefan@eissing.org>
Date: Fri, 6 Mar 2026 14:54:09 +0100
Subject: [PATCH] proxy-auth: additional tests
Also eliminate the special handling for socks proxy match.
Closes #20837
---
lib/url.c | 28 +++++++---------------------
tests/http/test_13_proxy_auth.py | 20 ++++++++++++++++++++
tests/http/testenv/curl.py | 18 +++++++++++++++---
3 files changed, 42 insertions(+), 24 deletions(-)
diff --git a/lib/url.c b/lib/url.c
index eabeb776ab..bdc183b45b 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -590,30 +590,15 @@ static bool proxy_info_matches(const struct proxy_info *data,
{
if((data->proxytype == needle->proxytype) &&
(data->port == needle->port) &&
- strcasecompare(data->host.name, needle->host.name))
- return TRUE;
+ strcasecompare(data->host.name, needle->host.name)) {
+ if(Curl_timestrcmp(data->user, needle->user) ||
+ Curl_timestrcmp(data->passwd, needle->passwd))
+ return FALSE;
+ return TRUE;
+ }
return FALSE;
}
-
-static bool
-socks_proxy_info_matches(const struct proxy_info *data,
- const struct proxy_info *needle)
-{
- if(!proxy_info_matches(data, needle))
- return FALSE;
-
- /* the user information is case-sensitive
- or at least it is not defined as case-insensitive
- see https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.1 */
-
- /* curl_strequal does a case insensitive comparison,
- so do not use it here! */
- if(Curl_timestrcmp(data->user, needle->user) ||
- Curl_timestrcmp(data->passwd, needle->passwd))
- return FALSE;
- return TRUE;
-}
#else
/* disabled, will not get called */
#define proxy_info_matches(x,y) FALSE
@@ -923,8 +909,7 @@ static bool url_match_proxy_use(struct connectdata *conn,
return FALSE;
if(m->needle->bits.socksproxy &&
- !socks_proxy_info_matches(&m->needle->socks_proxy,
- &conn->socks_proxy))
+ !proxy_info_matches(&m->needle->socks_proxy, &conn->socks_proxy))
return FALSE;
if(m->needle->bits.httpproxy) {
diff --git a/tests/http/test_13_proxy_auth.py b/tests/http/test_13_proxy_auth.py
index 080adef187..33fb211e99 100644
--- a/tests/http/test_13_proxy_auth.py
+++ b/tests/http/test_13_proxy_auth.py
@@ -169,3 +169,23 @@ class TestProxyAuth:
'--negotiate', '--proxy-user', 'proxy:proxy'
])
r1.check_response(count=1, http_status=200)
+
+ def test_13_10_tunnels_mixed_auth(self, env: Env, httpd, configures_httpd):
+ self.httpd_configure(env, httpd)
+ curl = CurlClient(env=env)
+ url1 = f'http://localhost:{env.http_port}/data.json?1'
+ url2 = f'http://localhost:{env.http_port}/data.json?2'
+ url3 = f'http://localhost:{env.http_port}/data.json?3'
+ xargs1 = curl.get_proxy_args(proxys=False, tunnel=True)
+ xargs1.extend(['--proxy-user', 'proxy:proxy']) # good auth
+ xargs2 = curl.get_proxy_args(proxys=False, tunnel=True)
+ xargs2.extend(['--proxy-user', 'ungood:ungood']) # bad auth
+ xargs3 = curl.get_proxy_args(proxys=False, tunnel=True)
+ # no auth
+ r = curl.http_download(urls=[url1, url2, url3], alpn_proto='http/1.1', with_stats=True,
+ url_options={url1: xargs1, url2: xargs2, url3: xargs3})
+ # only url1 succeeds, others fail, no connection reuse
+ assert r.stats[0]['http_code'] == 200, f'{r.dump_logs()}'
+ assert r.stats[1]['http_code'] == 0, f'{r.dump_logs()}'
+ assert r.stats[2]['http_code'] == 0, f'{r.dump_logs()}'
+ assert r.total_connects == 3, f'{r.dump_logs()}'
diff --git a/tests/http/testenv/curl.py b/tests/http/testenv/curl.py
index 4fc11c7923..1f812a1c2e 100644
--- a/tests/http/testenv/curl.py
+++ b/tests/http/testenv/curl.py
@@ -543,7 +543,8 @@ class CurlClient:
with_profile: bool = False,
with_tcpdump: bool = False,
no_save: bool = False,
- extra_args: Optional[List[str]] = None):
+ extra_args: Optional[List[str]] = None,
+ url_options: Optional[Dict[str,List[str]]] = None):
if extra_args is None:
extra_args = []
if no_save:
@@ -563,6 +564,7 @@ class CurlClient:
])
return self._raw(urls, alpn_proto=alpn_proto, options=extra_args,
with_stats=with_stats,
+ url_options=url_options,
with_headers=with_headers,
with_profile=with_profile,
with_tcpdump=with_tcpdump)
@@ -1083,6 +1085,7 @@ class CurlClient:
def _raw(self, urls, intext='', timeout=None, options=None, insecure=False,
alpn_proto: Optional[str] = None,
+ url_options=None,
force_resolve=True,
with_stats=False,
with_headers=True,
@@ -1092,7 +1095,8 @@ class CurlClient:
args = self._complete_args(
urls=urls, timeout=timeout, options=options, insecure=insecure,
alpn_proto=alpn_proto, force_resolve=force_resolve,
- with_headers=with_headers, def_tracing=def_tracing)
+ with_headers=with_headers, def_tracing=def_tracing,
+ url_options=url_options)
r = self._run(args, intext=intext, with_stats=with_stats,
with_profile=with_profile, with_tcpdump=with_tcpdump)
if r.exit_code == 0 and with_headers:
@@ -1102,8 +1106,10 @@ class CurlClient:
def _complete_args(self, urls, timeout=None, options=None,
insecure=False, force_resolve=True,
alpn_proto: Optional[str] = None,
+ url_options=None,
with_headers: bool = True,
def_tracing: bool = True):
+ url_sep = []
if not isinstance(urls, list):
urls = [urls]
@@ -1129,7 +1135,13 @@ class CurlClient:
active_options = options[options.index('--next') + 1:]
for url in urls:
- u = urlparse(urls[0])
+ args.extend(url_sep)
+ if url_options is not None:
+ url_sep = ['--next']
+
+ u = urlparse(url)
+ if url_options is not None and url in url_options:
+ args.extend(url_options[url])
if options:
args.extend(options)
if alpn_proto is not None:
--
2.53.0
external/curl/0001-url-fix-copy-and-paste-url_match_auth_nego-mistake.patch
Vendored
-28
View File
@@ -1,28 +0,0 @@
From f1a39f221d57354990e3eeeddc3404aede2aff70 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Sat, 21 Feb 2026 18:11:41 +0100
Subject: [PATCH] url: fix copy and paste url_match_auth_nego mistake
Follow-up to 34fa034
Reported-by: dahmono on github
Closes #20662
---
lib/url.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/url.c b/lib/url.c
index c879a85e92..8b42aebade 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -1217,7 +1217,7 @@ static bool url_match_auth_nego(struct connectdata *conn,
return FALSE;
}
#endif
- if(m->want_ntlm_http || m->want_proxy_ntlm_http) {
+ if(m->want_nego_http || m->want_proxy_nego_http) {
/* Credentials are already checked, we may use this connection. We MUST
* use a connection where it has already been fully negotiated. If it has
* not, we keep on looking for a better one. */
--
2.53.0
external/curl/0001-url-fix-reuse-of-connections-using-HTTP-Negotiate.patch
Vendored
-137
View File
@@ -1,137 +0,0 @@
From 34fa034d9a390c4bd65e2d05262755ec8646ac12 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Thu, 5 Feb 2026 08:34:21 +0100
Subject: [PATCH] url: fix reuse of connections using HTTP Negotiate
Assume Negotiate means connection-based
Reported-by: Zhicheng Chen
Closes #20534
---
lib/url.c | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++----
1 file changed, 82 insertions(+), 5 deletions(-)
diff --git a/lib/url.c b/lib/url.c
index fac8cea732..cfe398de8b 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -764,6 +764,8 @@ struct url_conn_match {
BIT(may_multiplex);
BIT(want_ntlm_http);
BIT(want_proxy_ntlm_http);
+ BIT(want_nego_http);
+ BIT(want_proxy_nego_http);
BIT(wait_pipe);
BIT(force_reuse);
@@ -1185,6 +1187,63 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
#define url_match_auth_ntlm(c,m) ((void)c, (void)m, TRUE)
#endif
+#ifdef USE_SPNEGO
+static bool url_match_auth_nego(struct connectdata *conn,
+ struct url_conn_match *m)
+{
+ /* If we are looking for an HTTP+Negotiate connection, check if this is
+ already authenticating with the right credentials. If not, keep looking
+ so that we can reuse Negotiate connections if possible. */
+ if(m->want_nego_http) {
+ if(Curl_timestrcmp(m->needle->user, conn->user) ||
+ Curl_timestrcmp(m->needle->passwd, conn->passwd))
+ return FALSE;
+ }
+ else if(conn->http_negotiate_state != GSS_AUTHNONE) {
+ /* Connection is using Negotiate auth but we do not want Negotiate */
+ return FALSE;
+ }
+
+#ifndef CURL_DISABLE_PROXY
+ /* Same for Proxy Negotiate authentication */
+ if(m->want_proxy_nego_http) {
+ /* Both conn->http_proxy.user and conn->http_proxy.passwd can be
+ * NULL */
+ if(!conn->http_proxy.user || !conn->http_proxy.passwd)
+ return FALSE;
+
+ if(Curl_timestrcmp(m->needle->http_proxy.user,
+ conn->http_proxy.user) ||
+ Curl_timestrcmp(m->needle->http_proxy.passwd,
+ conn->http_proxy.passwd))
+ return FALSE;
+ }
+ else if(conn->proxy_negotiate_state != GSS_AUTHNONE) {
+ /* Proxy connection is using Negotiate auth but we do not want Negotiate */
+ return FALSE;
+ }
+#endif
+ if(m->want_ntlm_http || m->want_proxy_ntlm_http) {
+ /* Credentials are already checked, we may use this connection. We MUST
+ * use a connection where it has already been fully negotiated. If it has
+ * not, we keep on looking for a better one. */
+ m->found = conn;
+ if((m->want_nego_http &&
+ (conn->http_negotiate_state != GSS_AUTHNONE)) ||
+ (m->want_proxy_nego_http &&
+ (conn->proxy_negotiate_state != GSS_AUTHNONE))) {
+ /* We must use this connection, no other */
+ m->force_reuse = TRUE;
+ return TRUE;
+ }
+ return FALSE; /* get another */
+ }
+ return TRUE;
+}
+#else
+#define url_match_auth_nego(c, m) ((void)c, (void)m, TRUE)
+#endif
+
static bool url_match_conn(struct connectdata *conn, void *userdata)
{
struct url_conn_match *m = userdata;
@@ -1228,6 +1287,11 @@ static bool url_match_conn(struct connectdata *conn, void *userdata)
else if(m->force_reuse)
return TRUE;
+ if(!url_match_auth_nego(conn, m))
+ return FALSE;
+ else if(m->force_reuse)
+ return TRUE;
+
if(!url_match_multiplex_limits(conn, m))
return FALSE;
@@ -1290,13 +1354,26 @@ static bool url_attach_existing(struct Curl_easy *data,
match.may_multiplex = xfer_may_multiplex(data, needle);
#ifdef USE_NTLM
- match.want_ntlm_http = ((data->state.authhost.want & CURLAUTH_NTLM) &&
- (needle->handler->protocol & PROTO_FAMILY_HTTP));
+ match.want_ntlm_http =
+ (data->state.authhost.want & CURLAUTH_NTLM) &&
+ (needle->handler->protocol & PROTO_FAMILY_HTTP);
#ifndef CURL_DISABLE_PROXY
match.want_proxy_ntlm_http =
- (needle->bits.proxy_user_passwd &&
- (data->state.authproxy.want & CURLAUTH_NTLM) &&
- (needle->handler->protocol & PROTO_FAMILY_HTTP));
+ needle->bits.proxy_user_passwd &&
+ (data->state.authproxy.want & CURLAUTH_NTLM) &&
+ (needle->handler->protocol & PROTO_FAMILY_HTTP);
+#endif
+#endif
+
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO)
+ match.want_nego_http =
+ (data->state.authhost.want & CURLAUTH_NEGOTIATE) &&
+ (needle->handler->protocol & PROTO_FAMILY_HTTP);
+#ifndef CURL_DISABLE_PROXY
+ match.want_proxy_nego_http =
+ needle->bits.proxy_user_passwd &&
+ (data->state.authproxy.want & CURLAUTH_NEGOTIATE) &&
+ (needle->handler->protocol & PROTO_FAMILY_HTTP);
#endif
#endif
--
2.53.0
external/curl/0001-ws-get-a-new-mask-for-each-new-outgoing-frame.patch
Vendored
-61
View File
@@ -1,61 +0,0 @@
From 84db7a9eae8468c0445b15aa806fa7fa806fa0f2 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 8 Sep 2025 14:14:15 +0200
Subject: [PATCH] ws: get a new mask for each new outgoing frame
Reported-by: Calvin Ruocco
Closes #18496
---
lib/ws.c | 28 +++++++++++++---------------
1 file changed, 13 insertions(+), 15 deletions(-)
diff --git a/lib/ws.c b/lib/ws.c
index e973409b6..3b6542816 100644
--- a/lib/ws.c
+++ b/lib/ws.c
@@ -875,6 +875,19 @@ static CURLcode ws_enc_add_frame(struct Curl_easy *data,
enc->payload_remain = enc->payload_len = payload_len;
ws_enc_info(enc, data, "sending");
+ /* 4 bytes random */
+
+ CURLcode result =
+ Curl_rand(data, (unsigned char *)&enc->mask, sizeof(enc->mask));
+ if(result)
+ return result;
+
+#ifdef DEBUGBUILD
+ if(getenv("CURL_WS_FORCE_ZERO_MASK"))
+ /* force the bit mask to 0x00000000, effectively disabling masking */
+ memset(&enc->mask, 0, sizeof(enc->mask));
+#endif
+
/* add 4 bytes mask */
memcpy(&head[hlen], &enc->mask, 4);
hlen += 4;
@@ -1335,21 +1347,7 @@ CURLcode Curl_ws_accept(struct Curl_easy *data,
subprotocol not requested by the client), the client MUST Fail
the WebSocket Connection. */
- /* 4 bytes random */
-
- result = Curl_rand(data, (unsigned char *)&ws->enc.mask,
- sizeof(ws->enc.mask));
- if(result)
- return result;
-
-#ifdef DEBUGBUILD
- if(getenv("CURL_WS_FORCE_ZERO_MASK"))
- /* force the bit mask to 0x00000000, effectively disabling masking */
- memset(ws->enc.mask, 0, sizeof(ws->enc.mask));
-#endif
-
- infof(data, "[WS] Received 101, switch to WebSocket; mask %02x%02x%02x%02x",
- ws->enc.mask[0], ws->enc.mask[1], ws->enc.mask[2], ws->enc.mask[3]);
+ infof(data, "[WS] Received 101, switch to WebSocket");
/* Install our client writer that decodes WS frames payload */
result = Curl_cwriter_create(&ws_dec_writer, data, &ws_cw_decode,
--
2.39.5
external/curl/ExternalProject_curl.mk
Vendored
+3 -5
View File
@@ -34,8 +34,7 @@ curl_LDFLAGS += -L$(SYSBASE)/usr/lib
endif
endif
# use --with-secure-transport on macOS >10.5 and iOS to get a native UI for SSL certs for CMIS usage
# use --with-openssl only on platforms other than macOS and iOS
# use --with-openssl on all platforms
$(call gb_ExternalProject_get_state_target,curl,build):
$(call gb_Trace_StartRange,curl,EXTERNAL)
$(call gb_ExternalProject_run,build,\
@@ -52,9 +51,8 @@ $(call gb_ExternalProject_get_state_target,curl,build):
--disable-ldap --disable-ldaps --disable-manual --disable-pop3 \
--disable-rtsp --disable-smb --disable-smtp --disable-telnet \
--disable-tftp \
$(if $(filter iOS MACOSX,$(OS)),\
--with-secure-transport,\
$(if $(ENABLE_OPENSSL),--with-openssl$(if $(SYSTEM_OPENSSL),,="$(gb_UnpackedTarball_workdir)/openssl"))) \
$(if $(ENABLE_OPENSSL),--with-openssl$(if $(SYSTEM_OPENSSL),,="$(gb_UnpackedTarball_workdir)/openssl")) \
$(if $(filter iOS MACOSX,$(OS)),--with-apple-sectrust) \
$(if $(filter LINUX,$(OS)),--without-ca-bundle --without-ca-path) \
$(gb_CONFIGURE_PLATFORMS) \
$(if $(filter TRUE,$(DISABLE_DYNLOADING)),--disable-shared,--disable-static) \
external/curl/UnpackedTarball_curl.mk
Vendored
-7
View File
@@ -19,13 +19,6 @@ $(eval $(call gb_UnpackedTarball_update_autoconf_configs,curl))
$(eval $(call gb_UnpackedTarball_add_patches,curl,\
external/curl/zlib.patch.0 \
external/curl/0001-const-up-readonly-H2_NON_FIELD.patch.1 \
external/curl/0001-cookie-don-t-treat-the-leading-slash-as-trailing.patch \
external/curl/0001-ws-get-a-new-mask-for-each-new-outgoing-frame.patch \
external/curl/0001-url-fix-reuse-of-connections-using-HTTP-Negotiate.patch \
external/curl/0001-url-fix-copy-and-paste-url_match_auth_nego-mistake.patch \
external/curl/0001-http-only-send-bearer-if-auth-is-allowed.patch \
external/curl/0001-proxy-auth-additional-tests.patch \
))
ifeq ($(ENABLE_EMSCRIPTEN_PROXY_POSIX_SOCKETS),TRUE)
external/curl/zlib.patch.0
Vendored
+9 -10
View File
@@ -8,15 +8,15 @@
# Check whether --with-zlib was given.
if test ${with_zlib+y}
@@ -23609,12 +23609,28 @@
@@ -23922,12 +23922,28 @@
if test "$OPT_ZLIB" = "no"; then
if test "x$OPT_ZLIB" = "xno"; then
+ ZLIB_LIBS=""
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: zlib disabled" >&5
printf "%s\n" "$as_me: WARNING: zlib disabled" >&2;}
else
if test "$OPT_ZLIB" = "yes"; then
if test "x$OPT_ZLIB" = "xyes"; then
OPT_ZLIB=""
fi
+
@@ -36,33 +36,32 @@
+ ZLIB_LIBS=""
if test -z "$OPT_ZLIB"; then
@@ -23903,6 +23903,7 @@
@@ -24232,6 +24248,7 @@
LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE zlib"
curl_zlib_msg="enabled"
fi
+ fi
fi
if test x"$AMFIXLIB" = x1; then
if test "$AMFIXLIB" = "1"; then
--- configure.ac
+++ configure.ac
@@ -1302,19 +1302,31 @@
@@ -1392,19 +1392,30 @@
clean_CPPFLAGS=$CPPFLAGS
clean_LDFLAGS=$LDFLAGS
clean_LIBS=$LIBS
-ZLIB_LIBS=""
+
AC_ARG_WITH(zlib,
AS_HELP_STRING([--with-zlib=PATH],[search for zlib in PATH])
AS_HELP_STRING([--without-zlib],[disable use of zlib]),
[OPT_ZLIB="$withval"])
if test "$OPT_ZLIB" = "no"; then
if test "x$OPT_ZLIB" = "xno"; then
+ ZLIB_LIBS=""
AC_MSG_WARN([zlib disabled])
else
if test "$OPT_ZLIB" = "yes"; then
if test "x$OPT_ZLIB" = "xyes"; then
OPT_ZLIB=""
fi
include/systools/curlinit.hxx
+1 -1
View File
@@ -13,7 +13,7 @@
#include <officecfg/Office/Security.hxx>
// curl is built with --with-secure-transport on macOS and iOS so doesn't need these
// curl is built with --with-apple-sectrust on macOS and iOS so doesn't need these
// certs. Windows doesn't need them either, but let's assume everything else does
#if !defined(SYSTEM_OPENSSL) && !defined(_WIN32) && !defined(MACOSX) && !defined(IOS)
#include <com/sun/star/uno/RuntimeException.hpp>