ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

curl: upgrade to 8.21 (squashed)

Browse Source 
This commit contains:

curl: no longer necessary to use --without-[TLS library name] options

See https://github.com/curl/curl/pull/6897

Change-Id: I99013a9b646dbd317a6840c61939f97b256c25a0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201447
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
(cherry picked from commit f946ee2587)

curl: hyper support was dropped in 8.12

See https://github.com/curl/curl/pull/15120

Change-Id: I78201cc07f5b74b039b78b7c168f2e2fe84766f4
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201459
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
(cherry picked from commit d881b750bb)

curl: migrate to CMake on Windows

it fails to build without WINBUILD_ACKNOWLEDGE_DEPRECATED with
WARNING:

The winbuild build system is deprecated and will be removed in
September 2025 in favor of the CMake build system.

curl dropped winbuild support in 8.17.
See https://curl.se/ch/8.17.0.html

Change-Id: I236414c670d1d62d82c5a430e2abdbf71a50a2ff
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201470
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
(cherry picked from commit 1ec1b40f17)

curl: drop leftover from 1ec1b40f17

Change-Id: I656a68ad489937baf37fe7d406861827bbff66f3
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201599
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
(cherry picked from commit 437f5e6eee)

use cmake from visual studio extensions in cygwin

Change-Id: Id3b895e8833dd65457f4c03791f2aa698c4a27ab
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201805
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
(cherry picked from commit fd9058c19f)

fix typo from fd9058c19f

Change-Id: I86e5826efb598e61b2ae1d27bd1ec104d9302aac
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201848
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
(cherry picked from commit 1f6847ae17)

use cmake from VS extensions in WSL too

See https://gerrit.libreoffice.org/c/core/+/201805/comment/bc56beb5_4fb2fc27/

Change-Id: I3203d620270035d21b57f1be497d851119c04b40
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201890
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Tested-by: Jenkins
(cherry picked from commit e403e84cb9)

curl: upgrade to 8.19.0

--with-secure-transport was dropped in curl 8.15,
so replace it with --with-openssl --with-apple-sectrust,
which was added in curl 8.17

Remove all patches fixed upstream

Downloaded from https://curl.se/download/curl-8.19.0.tar.xz

Change-Id: Ic93d8e3ef637d2adf84454c4e0375d1bf4620870
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201850
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Reviewed-by: Patrick Luby <guibomacdev@gmail.com>
(cherry picked from commit 8a9e4e8631)

curl: upgrade to 8.20.0

Downloaded from https://curl.se/download/curl-8.20.0.tar.xz

Change-Id: I3a1e5f316a1d20565bb5da369b280c10ed5c2869
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/204563
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
(cherry picked from commit efddae2da0)

curl: upgrade to 8.21.0

Downloaded from https://curl.se/download/curl-8.21.0.tar.xz

Change-Id: Idbf678a0e00e2c7a802dbaad8439ec24b253ef57
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207281
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
(cherry picked from commit 57d226bd21)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207673
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
This commit is contained in:
Xisco Fauli
2026-07-07 16:07:42 +02:00
committed by Christian Lohmaier
parent fcd9468192
commit 91d292dc7c
26 changed files with 57 additions and 2261 deletions
Download Patch File Download Diff File Expand all files Collapse all files
RepositoryExternal.mk
+1 -1
View File
@@ -2885,7 +2885,7 @@ $(call gb_LinkTarget_set_include,$(1),\
ifeq ($(COM),MSC)
$(call gb_LinkTarget_add_libs,$(1),\
$(gb_UnpackedTarball_workdir)/curl/builds/libcurl-vc12-$(gb_MSBUILD_PLATFORM)-$(gb_MSBUILD_CONFIG)-dll-zlib-static-ipv6-sspi-schannel/lib/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).lib \
$(gb_UnpackedTarball_workdir)/curl/lib/$(if $(MSVC_USE_DEBUG_RUNTIME),Debug,Release)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),-d)_imp.lib \
)
else
$(call gb_LinkTarget_add_libs,$(1),\
config_host.mk.in
+1
View File
@@ -77,6 +77,7 @@ export CLUCENE_CFLAGS=$(gb_SPACE)@CLUCENE_CFLAGS@
export CLUCENE_LIBS=$(gb_SPACE)@CLUCENE_LIBS@
export LIBCMIS_CFLAGS=$(gb_SPACE)@LIBCMIS_CFLAGS@
export LIBCMIS_LIBS=$(gb_SPACE)@LIBCMIS_LIBS@
CMAKE=@CMAKE@
export COM=@COM@
export COMPATH=@COMPATH@
export COMPILER_PLUGINS=@COMPILER_PLUGINS@
configure.ac
+6
View File
@@ -4589,6 +4589,7 @@ test_cl_exe()
SOLARINC=
MSBUILD_PATH=
DEVENV=
CMAKE=
if test "$_os" = "WINNT"; then
AC_MSG_CHECKING([Visual C++])
find_msvc "$with_visual_studio"
@@ -4667,6 +4668,10 @@ if test "$_os" = "WINNT"; then
AC_MSG_ERROR([MSBuild.exe location not found])
fi
# Find the cmake.exe in Visual Studio Extensions
PathFormat "$VC_PRODUCT_DIR/../Common7/IDE/CommonExtensions/Microsoft/CMake/CMake/bin/cmake.exe"
CMAKE="$formatted_path"
# Find the version of devenv.exe
PathFormat "$VC_PRODUCT_DIR/../Common7/IDE/devenv.exe"
DEVENV="$formatted_path"
@@ -4775,6 +4780,7 @@ if test "$_os" = "WINNT"; then
fi
AC_SUBST(VCVER)
AC_SUBST(VCTOOLSET)
AC_SUBST(CMAKE)
AC_SUBST(DEVENV)
AC_SUBST(MSVC_CXX)
download.lst
+2 -2
View File
@@ -80,8 +80,8 @@ CPPUNIT_TARBALL := cppunit-1.15.1.tar.gz
# three static lines
# so that git cherry-pick
# will not run into conflicts
CURL_SHA256SUM := f4619a1e2474c4bbfedc88a7c2191209c8334b48fa1f4e53fd584cc12e9120dd
CURL_TARBALL := curl-8.14.1.tar.xz
CURL_SHA256SUM := aa1b66a70eace83dc624508745646c08ae561de512ab403adffb93ac87fc72e6
CURL_TARBALL := curl-8.21.0.tar.xz
# three static lines
# so that git cherry-pick
# will not run into conflicts
external/curl/0001-const-up-readonly-H2_NON_FIELD.patch.1
Vendored
-25
View File
@@ -1,25 +0,0 @@
From df1f9619ac00091b309a479a166fe861f935779c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
Date: Tue, 22 Jul 2025 14:48:26 +0100
Subject: [PATCH] const up readonly H2_NON_FIELD
---
lib/http.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/http.c b/lib/http.c
index e5a069627..9a844301f 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -4569,7 +4569,7 @@ struct name_const {
};
/* keep them sorted by length! */
-static struct name_const H2_NON_FIELD[] = {
+static const struct name_const H2_NON_FIELD[] = {
{ STRCONST("Host") },
{ STRCONST("Upgrade") },
{ STRCONST("Connection") },
--
2.49.0
external/curl/0001-cookie-don-t-treat-the-leading-slash-as-trailing.patch
Vendored
-54
View File
@@ -1,54 +0,0 @@
From c6ae07c6a541e0e96d0040afb62b45dd37711300 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 11 Aug 2025 20:23:05 +0200
Subject: [PATCH] cookie: don't treat the leading slash as trailing
If there is only a leading slash in the path, keep that. Also add an
assert to make sure the path is never blank.
Reported-by: Google Big Sleep
Closes #18266
---
lib/cookie.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/lib/cookie.c b/lib/cookie.c
index 914a4aca1..b72dd99bc 100644
--- a/lib/cookie.c
+++ b/lib/cookie.c
@@ -296,9 +296,9 @@ static char *sanitize_cookie_path(const char *cookie_path)
/* Let cookie-path be the default-path. */
return strdup("/");
- /* remove trailing slash */
+ /* remove trailing slash when path is non-empty */
/* convert /hoge/ to /hoge */
- if(len && cookie_path[len - 1] == '/')
+ if(len > 1 && cookie_path[len - 1] == '/')
len--;
return Curl_memdup0(cookie_path, len);
@@ -965,7 +965,7 @@ replace_existing(struct Curl_easy *data,
clist->spath && co->spath && /* both have paths */
clist->secure && !co->secure && !secure) {
size_t cllen;
- const char *sep;
+ const char *sep = NULL;
/*
* A non-secure cookie may not overlay an existing secure cookie.
@@ -974,8 +974,9 @@ replace_existing(struct Curl_easy *data,
* "/loginhelper" is ok.
*/
- sep = strchr(clist->spath + 1, '/');
-
+ DEBUGASSERT(clist->spath[0]);
+ if(clist->spath[0])
+ sep = strchr(clist->spath + 1, '/');
if(sep)
cllen = sep - clist->spath;
else
--
2.39.5
external/curl/0001-digest-flush-state-on-origin-or-credential-change.patch
Vendored
-338
View File
@@ -1,338 +0,0 @@
From 595b3830680595c9d375896e8b92f5356f558a53 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 10 Jun 2026 10:27:50 +0200
Subject: [PATCH] digest: flush state on origin or credential change
Verified by test 1686
Closes #21944
(cherry picked from commit 5c6b4880357ab3e72967c1c45cae0f96ffabc535)
---
lib/http_digest.c | 34 +++++++++++++
lib/urldata.h | 7 +++
lib/vauth/digest.c | 3 ++
lib/vauth/digest_sspi.c | 5 ++
tests/data/Makefile.am | 2 +-
tests/data/test1686 | 83 ++++++++++++++++++++++++++++++
tests/libtest/Makefile.inc | 4 ++
tests/libtest/lib1686.c | 102 +++++++++++++++++++++++++++++++++++++
8 files changed, 239 insertions(+), 1 deletion(-)
create mode 100644 tests/data/test1686
create mode 100644 tests/libtest/lib1686.c
diff --git a/lib/http_digest.c b/lib/http_digest.c
index 651bb83403..40137f4391 100644
--- a/lib/http_digest.c
+++ b/lib/http_digest.c
@@ -104,6 +104,36 @@ CURLcode Curl_output_digest(struct Curl_easy *data,
#endif
}
else {
+ bool flush = FALSE;
+ const char *curorigin = data->conn ? data->conn->destination : NULL;
+ const char *curuser = data->state.aptr.user ?
+ data->state.aptr.user : "";
+ const char *curpasswd = data->state.aptr.passwd ?
+ data->state.aptr.passwd : "";
+
+ if(data->state.digest.origin && curorigin &&
+ strcmp(data->state.digest.origin, curorigin))
+ flush = TRUE;
+ else if(data->state.digest.creduser &&
+ (strcmp(data->state.digest.creduser, curuser) ||
+ strcmp(data->state.digest.credpasswd ?
+ data->state.digest.credpasswd : "", curpasswd)))
+ flush = TRUE;
+
+ if(flush)
+ /* flush host Digest state */
+ Curl_auth_digest_cleanup(&data->state.digest);
+
+ /* remember the origin and credentials this host Digest state is for */
+ if(curorigin) {
+ Curl_safefree(data->state.digest.origin);
+ data->state.digest.origin = strdup(curorigin);
+ }
+ Curl_safefree(data->state.digest.creduser);
+ data->state.digest.creduser = strdup(curuser);
+ Curl_safefree(data->state.digest.credpasswd);
+ data->state.digest.credpasswd = strdup(curpasswd);
+
digest = &data->state.digest;
allocuserpwd = &data->state.aptr.userpwd;
userp = data->state.aptr.user;
diff --git a/lib/urldata.h b/lib/urldata.h
index 45052e84b1..8655e8186a 100644
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -318,6 +318,9 @@ struct ssl_general_config {
#ifndef CURL_DISABLE_DIGEST_AUTH
/* Struct used for Digest challenge-response authentication */
struct digestdata {
+ char *origin;
+ char *creduser;
+ char *credpasswd;
#if defined(USE_WINDOWS_SSPI)
BYTE *input_token;
size_t input_token_len;
diff --git a/lib/vauth/digest.c b/lib/vauth/digest.c
index ec4e82256c..225e993e72 100644
--- a/lib/vauth/digest.c
+++ b/lib/vauth/digest.c
@@ -998,6 +998,9 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
*/
void Curl_auth_digest_cleanup(struct digestdata *digest)
{
+ Curl_safefree(digest->origin);
+ Curl_safefree(digest->creduser);
+ Curl_safefree(digest->credpasswd);
Curl_safefree(digest->nonce);
Curl_safefree(digest->cnonce);
Curl_safefree(digest->realm);
diff --git a/lib/vauth/digest_sspi.c b/lib/vauth/digest_sspi.c
index 2761c59965..428ffd6916 100644
--- a/lib/vauth/digest_sspi.c
+++ b/lib/vauth/digest_sspi.c
@@ -678,6 +678,11 @@ void Curl_auth_digest_cleanup(struct digestdata *digest)
/* Free the copy of user/passwd used to make the identity for http_context */
Curl_safefree(digest->user);
Curl_safefree(digest->passwd);
+
+ /* Free the origin/credentials tracked for host Digest state flushing */
+ Curl_safefree(digest->origin);
+ Curl_safefree(digest->creduser);
+ Curl_safefree(digest->credpasswd);
}
#endif /* USE_WINDOWS_SSPI && !CURL_DISABLE_DIGEST_AUTH */
diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
index 1ef85cd3a2..b6a212763f 100644
--- a/tests/data/Makefile.am
+++ b/tests/data/Makefile.am
@@ -225,7 +225,7 @@ test1660 test1661 test1662 test1663 test1664 \
\
test1670 test1671 \
\
-test1680 test1681 test1682 test1683 \
+test1680 test1681 test1682 test1683 test1686 \
\
test1700 test1701 test1702 test1703 test1704 test1705 test1706 test1707 \
test1708 test1709 test1710 \
diff --git a/tests/data/test1686 b/tests/data/test1686
new file mode 100644
index 0000000000..a9413a6c4f
--- /dev/null
+++ b/tests/data/test1686
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+Digest
+</keywords>
+</info>
+
+<reply>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 401 Authorization Required
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+WWW-Authenticate: Digest realm="my-backyard", nonce="314156295"
+Content-Length: 26
+
+This is not the real page
+</data>
+
+# This is supposed to be returned when the server gets a
+# Authorization: Digest line passed-in from the client
+<data1000 crlf="headers">
+HTTP/1.1 200 OK
+Server: Apache/1.3.27 (Darwin) PHP/4.1.2
+Content-Type: text/html; charset=iso-8859-1
+Content-Length: 23
+
+This IS the real page!
+</data1000>
+
+</reply>
+
+<client>
+<features>
+!SSPI
+crypto
+</features>
+<server>
+http
+</server>
+<name>
+HTTP Digest to different origins and switching credentials
+</name>
+<tool>
+lib%TESTNUMBER
+</tool>
+<command>
+%HOSTIP %HTTPPORT
+</command>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET /api HTTP/1.1
+Host: first.test:%HTTPPORT
+Accept: */*
+
+GET /api HTTP/1.1
+Host: first.test:%HTTPPORT
+Authorization: Digest username="alice", realm="my-backyard", nonce="314156295", uri="/api", response="4ecc00e567c37a9d537727890c2e5b32"
+Accept: */*
+
+GET /hook HTTP/1.1
+Host: second.test:%HTTPPORT
+Accept: */*
+
+GET /hook HTTP/1.1
+Host: second.test:%HTTPPORT
+Authorization: Digest username="alice", realm="my-backyard", nonce="314156295", uri="/hook", response="d3a7738fb6a23f5543fb8dacc0f0f253"
+Accept: */*
+
+GET /hook HTTP/1.1
+Host: second.test:%HTTPPORT
+Accept: */*
+
+GET /hook HTTP/1.1
+Host: second.test:%HTTPPORT
+Authorization: Digest username="bob", realm="my-backyard", nonce="314156295", uri="/hook", response="777e68eddb77294d9cbd6134973cbbab"
+Accept: */*
+
+</protocol>
+</verify>
+</testcase>
diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
index d130d5158d..1dcd51434f 100644
--- a/tests/libtest/Makefile.inc
+++ b/tests/libtest/Makefile.inc
@@ -68,6 +68,7 @@ LIBTESTPROGS = libauthretry libntlmconnect libprereq \
\
lib1647 \
lib1662 \
+ lib1686 \
\
lib1900 lib1901 \
lib1903 lib1905 lib1906 lib1907 lib1908 lib1910 lib1911 lib1912 lib1913 \
@@ -566,6 +568,8 @@ lib1598_LDADD = $(TESTUTIL_LIBS)
lib1662_SOURCES = lib1662.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
lib1662_LDADD = $(TESTUTIL_LIBS)
+lib1686_SOURCES = lib1686.c $(SUPPORTFILES)
+
lib1900_SOURCES = lib1900.c $(SUPPORTFILES)
lib1901_SOURCES = lib1901.c $(SUPPORTFILES)
diff --git a/tests/libtest/lib1686.c b/tests/libtest/lib1686.c
new file mode 100644
index 0000000000..fd1ed4ed9c
--- /dev/null
+++ b/tests/libtest/lib1686.c
@@ -0,0 +1,98 @@
+/***************************************************************************
+ * _ _ ____ _
+ * Project ___| | | | _ \| |
+ * / __| | | | |_) | |
+ * | (__| |_| | _ <| |___
+ * \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "test.h"
+
+#include "memdebug.h"
+
+static size_t devnull_1686(char *p, size_t s, size_t n, void *u)
+{
+ (void)p;
+ (void)u;
+ return s * n;
+}
+
+#define FIRSTHOST "first.test"
+#define SECONDHOST "second.test"
+
+CURLcode test(const char *hostip)
+{
+ CURL *curl = NULL;
+ CURLcode result = CURLE_OK;
+ const char *httpport = libtest_arg2;
+ char firsturl[100];
+ char secondurl[100];
+ char firstres[100];
+ char secondres[100];
+ struct curl_slist *host = NULL;
+ struct curl_slist *host2 = NULL;
+
+ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+ curl_mfprintf(stderr, "curl_global_init() failed\n");
+ return TEST_ERR_MAJOR_BAD;
+ }
+
+ /* create strings for CURLOPT_RESOLVE */
+ curl_msnprintf(firstres, sizeof(firstres), "%s:%s:%s",
+ FIRSTHOST, httpport, hostip);
+ curl_msnprintf(secondres, sizeof(secondres), "%s:%s:%s",
+ SECONDHOST, httpport, hostip);
+
+ /* create URLs */
+ curl_msnprintf(firsturl, sizeof(firsturl), "http://%s:%s/api",
+ FIRSTHOST, httpport);
+ curl_msnprintf(secondurl, sizeof(secondurl), "http://%s:%s/hook",
+ SECONDHOST, httpport);
+
+ host = curl_slist_append(NULL, firstres);
+ if(!host)
+ goto test_cleanup;
+ host2 = curl_slist_append(host, secondres);
+ if(!host2)
+ goto test_cleanup;
+ host = host2;
+
+ curl = curl_easy_init();
+ if(curl) {
+ easy_setopt(curl, CURLOPT_RESOLVE, host);
+ easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_DIGEST);
+ easy_setopt(curl, CURLOPT_USERPWD, "alice:bond");
+ easy_setopt(curl, CURLOPT_WRITEFUNCTION, devnull_1686);
+
+ easy_setopt(curl, CURLOPT_URL, firsturl);
+ result = curl_easy_perform(curl);
+
+ easy_setopt(curl, CURLOPT_URL, secondurl);
+ result = curl_easy_perform(curl);
+
+ easy_setopt(curl, CURLOPT_USERPWD, "bob:secret");
+ easy_setopt(curl, CURLOPT_URL, secondurl);
+ result = curl_easy_perform(curl);
+ }
+
+test_cleanup:
+ curl_easy_cleanup(curl);
+ curl_global_cleanup();
+ curl_slist_free_all(host);
+ return result;
+}
--
2.54.0
external/curl/0001-http-clear-the-proxy-credentials-as-well-on-port-or-.patch
Vendored
-382
View File
@@ -1,382 +0,0 @@
From 188c2f166a20fa97c2325b2da7d0e5cecc13725f Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 13 Apr 2026 17:17:23 +0200
Subject: [PATCH] http: clear the proxy credentials as well on port or scheme
change
Add tests 2009-2011 to verify switching between proxies with credentials
when the switch is driven by a redirect
Reported-by: Dwij Mehta
Closes #21304
---
lib/http.c | 12 +++++++
lib/transfer.c | 51 +++++++++++++++++++++---------
lib/transfer.h | 2 ++
tests/data/Makefile.am | 2 +-
tests/data/test2009 | 70 +++++++++++++++++++++++++++++++++++++++++
tests/data/test2010 | 71 ++++++++++++++++++++++++++++++++++++++++++
tests/data/test2011 | 70 +++++++++++++++++++++++++++++++++++++++++
7 files changed, 262 insertions(+), 16 deletions(-)
create mode 100644 tests/data/test2009
create mode 100644 tests/data/test2010
create mode 100644 tests/data/test2011
diff --git a/lib/http.c b/lib/http.c
index a1e58e886c..f976987111 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -1278,12 +1278,24 @@ CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl,
free(scheme);
}
if(clear) {
+ CURLcode result = Curl_reset_userpwd(data);
+ if(result) {
+ free(follow_url);
+ return result;
+ }
Curl_safefree(data->state.aptr.user);
Curl_safefree(data->state.aptr.passwd);
}
}
}
DEBUGASSERT(follow_url);
+ {
+ CURLcode result = Curl_reset_proxypwd(data);
+ if(result) {
+ free(follow_url);
+ return result;
+ }
+ }
if(type == FOLLOW_FAKE) {
/* we are only figuring out the new URL if we would have followed locations
diff --git a/lib/transfer.c b/lib/transfer.c
index dd4e16b7f5..a2fce9331b 100644
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -438,6 +438,40 @@ void Curl_init_CONNECT(struct Curl_easy *data)
data->state.upload = (data->state.httpreq == HTTPREQ_PUT);
}
+/*
+ * Restore the user credentials to those set in options.
+ */
+CURLcode Curl_reset_userpwd(struct Curl_easy *data)
+{
+ CURLcode result;
+ if(data->set.str[STRING_USERNAME] || data->set.str[STRING_PASSWORD])
+ data->state.creds_from = CREDS_OPTION;
+ result = Curl_setstropt(&data->state.aptr.user,
+ data->set.str[STRING_USERNAME]);
+ if(!result)
+ result = Curl_setstropt(&data->state.aptr.passwd,
+ data->set.str[STRING_PASSWORD]);
+ return result;
+}
+
+/*
+ * Restore the proxy credentials to those set in options.
+ */
+CURLcode Curl_reset_proxypwd(struct Curl_easy *data)
+{
+#ifndef CURL_DISABLE_PROXY
+ CURLcode result = Curl_setstropt(&data->state.aptr.proxyuser,
+ data->set.str[STRING_PROXYUSERNAME]);
+ if(!result)
+ result = Curl_setstropt(&data->state.aptr.proxypasswd,
+ data->set.str[STRING_PROXYPASSWORD]);
+ return result;
+#else
+ (void)data;
+ return CURLE_OK;
+#endif
+}
+
/*
* Curl_pretransfer() is called immediately before a transfer starts, and only
* once for one transfer no matter if it has redirects or do multi-pass
@@ -586,23 +620,10 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
return CURLE_OUT_OF_MEMORY;
}
- if(data->set.str[STRING_USERNAME] ||
- data->set.str[STRING_PASSWORD])
- data->state.creds_from = CREDS_OPTION;
if(!result)
- result = Curl_setstropt(&data->state.aptr.user,
- data->set.str[STRING_USERNAME]);
+ result = Curl_reset_userpwd(data);
if(!result)
- result = Curl_setstropt(&data->state.aptr.passwd,
- data->set.str[STRING_PASSWORD]);
-#ifndef CURL_DISABLE_PROXY
- if(!result)
- result = Curl_setstropt(&data->state.aptr.proxyuser,
- data->set.str[STRING_PROXYUSERNAME]);
- if(!result)
- result = Curl_setstropt(&data->state.aptr.proxypasswd,
- data->set.str[STRING_PROXYPASSWORD]);
-#endif
+ result = Curl_reset_proxypwd(data);
data->req.headerbytecount = 0;
Curl_headers_cleanup(data);
diff --git a/lib/transfer.h b/lib/transfer.h
index 41ec0357f6..b29e70b9ec 100644
--- a/lib/transfer.h
+++ b/lib/transfer.h
@@ -31,6 +31,8 @@ char *Curl_checkheaders(const struct Curl_easy *data,
void Curl_init_CONNECT(struct Curl_easy *data);
+CURLcode Curl_reset_userpwd(struct Curl_easy *data);
+CURLcode Curl_reset_proxypwd(struct Curl_easy *data);
CURLcode Curl_pretransfer(struct Curl_easy *data);
CURLcode Curl_sendrecv(struct Curl_easy *data, struct curltime *nowp);
diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
index 44ff75668f..3003dce03b 100644
--- a/tests/data/Makefile.am
+++ b/tests/data/Makefile.am
@@ -244,6 +244,7 @@ test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \
test1978 test1979 test1980 \
\
test2000 test2001 test2002 test2003 test2004 test2005 test2006 \
+test2009 test2010 test2011 \
\
test2023 \
test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
diff --git a/tests/data/test2009 b/tests/data/test2009
new file mode 100644
index 0000000000..d2fd79e0d6
--- /dev/null
+++ b/tests/data/test2009
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+http_proxy
+</keywords>
+</info>
+# Server-side
+<reply>
+<connect>
+HTTP/1.1 407 Denied
+
+</connect>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 301 redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 4
+Content-Type: text/html
+Location: https://another.example/%TESTNUMBER0002
+
+boo
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+https
+</server>
+<name>
+proxy credentials via env variables, redirect from http to https
+</name>
+
+<setenv>
+http_proxy=http://user:secret@%HOSTIP:%HTTPPORT
+https_proxy=https://%HOSTIP:%HTTPSPORT/
+</setenv>
+<command>
+http://somewhere.example/ --follow --proxy-insecure
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://somewhere.example/ HTTP/1.1
+Host: somewhere.example
+Proxy-Authorization: Basic %b64[user:secret]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+CONNECT another.example:443 HTTP/1.1
+Host: another.example:443
+User-Agent: curl/%VERSION
+Proxy-Connection: Keep-Alive
+
+</protocol>
+<errorcode>
+7
+</errorcode>
+</verify>
+</testcase>
diff --git a/tests/data/test2010 b/tests/data/test2010
new file mode 100644
index 0000000000..443ae9d2f9
--- /dev/null
+++ b/tests/data/test2010
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+http_proxy
+</keywords>
+</info>
+# Server-side
+<reply>
+<connect>
+HTTP/1.1 407 Denied
+
+</connect>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 301 redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 4
+Content-Type: text/html
+Location: https://another.example/%TESTNUMBER0002
+
+boo
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+https
+</server>
+<name>
+proxy credentials via options for two proxies, redirect from http to https
+</name>
+
+<setenv>
+http_proxy=http://%HOSTIP:%HTTPPORT
+https_proxy=https://%HOSTIP:%HTTPSPORT/
+</setenv>
+<command>
+--proxy-user batman:robin http://somewhere.example/ --follow --proxy-insecure
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://somewhere.example/ HTTP/1.1
+Host: somewhere.example
+Proxy-Authorization: Basic %b64[batman:robin]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+CONNECT another.example:443 HTTP/1.1
+Host: another.example:443
+Proxy-Authorization: Basic %b64[batman:robin]b64%
+User-Agent: curl/%VERSION
+Proxy-Connection: Keep-Alive
+
+</protocol>
+<errorcode>
+7
+</errorcode>
+</verify>
+</testcase>
diff --git a/tests/data/test2011 b/tests/data/test2011
new file mode 100644
index 0000000000..dd4e534248
--- /dev/null
+++ b/tests/data/test2011
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP proxy
+http_proxy
+</keywords>
+</info>
+# Server-side
+<reply>
+<connect>
+HTTP/1.1 407 Denied
+
+</connect>
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 301 redirect
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 4
+Content-Type: text/html
+Location: https://another.example/%TESTNUMBER0002
+
+boo
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+https
+</server>
+<name>
+proxy creds via env, cross-scheme redirect, --location-trusted
+</name>
+
+<setenv>
+http_proxy=http://user:secret@%HOSTIP:%HTTPPORT
+https_proxy=https://%HOSTIP:%HTTPSPORT/
+</setenv>
+<command>
+http://somewhere.example/ --location-trusted --proxy-insecure
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://somewhere.example/ HTTP/1.1
+Host: somewhere.example
+Proxy-Authorization: Basic %b64[user:secret]b64%
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+CONNECT another.example:443 HTTP/1.1
+Host: another.example:443
+User-Agent: curl/%VERSION
+Proxy-Connection: Keep-Alive
+
+</protocol>
+<errorcode>
+7
+</errorcode>
+</verify>
+</testcase>
--
2.54.0
external/curl/0001-http-only-send-bearer-if-auth-is-allowed.patch
Vendored
-147
View File
@@ -1,147 +0,0 @@
From e3d7401a32a46516c9e5ee877e613e62ed35bddc Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Fri, 6 Mar 2026 23:13:07 +0100
Subject: [PATCH] http: only send bearer if auth is allowed
Verify with test 2006
Closes #20843
---
lib/http.c | 1 +
tests/data/Makefile.am | 2 +-
tests/data/test2006 | 98 ++++++++++++++++++++++++++++++++++++++++++
3 files changed, 100 insertions(+), 1 deletion(-)
create mode 100644 tests/data/test2006
diff --git a/lib/http.c b/lib/http.c
index d2f85fc5bf..d61edbd0cd 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -705,6 +705,7 @@ static CURLcode output_auth_headers(struct Curl_easy *data,
if(authstatus->picked == CURLAUTH_BEARER) {
/* Bearer */
if((!proxy && data->set.str[STRING_BEARER] &&
+ Curl_auth_allowed_to_host(data) &&
!Curl_checkheaders(data, STRCONST("Authorization")))) {
auth = "Bearer";
result = http_output_bearer(data);
diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
index f39568d3b8..6c8be18b32 100644
--- a/tests/data/Makefile.am
+++ b/tests/data/Makefile.am
@@ -243,7 +243,7 @@ test1955 test1956 test1957 test1958 test1959 test1960 test1964 \
test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \
test1978 test1979 test1980 \
\
-test2000 test2001 test2002 test2003 test2004 test2005 \
+test2000 test2001 test2002 test2003 test2004 test2005 test2006 \
\
test2023 \
test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
diff --git a/tests/data/test2006 b/tests/data/test2006
new file mode 100644
index 0000000000..200d30a7ce
--- /dev/null
+++ b/tests/data/test2006
@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+netrc
+HTTP
+</keywords>
+</info>
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 301 Follow this you fool
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Location: http://b.com/%TESTNUMBER0002
+
+-foo-
+</data>
+
+<data2 crlf="headers">
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 7
+Connection: close
+
+target
+</data2>
+
+<datacheck crlf="headers">
+HTTP/1.1 301 Follow this you fool
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 6
+Connection: close
+Location: http://b.com/%TESTNUMBER0002
+
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
+ETag: "21025-dc7-39462498"
+Accept-Ranges: bytes
+Content-Length: 7
+Connection: close
+
+target
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<features>
+proxy
+</features>
+<name>
+.netrc default with redirect plus oauth2-bearer
+</name>
+<command>
+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER --oauth2-bearer SECRET_TOKEN -L -x http://%HOSTIP:%HTTPPORT/ http://a.com/
+</command>
+<file name="%LOGDIR/netrc%TESTNUMBER" >
+default login testuser password testpass
+</file>
+</client>
+
+<verify>
+<protocol crlf="headers">
+GET http://a.com/ HTTP/1.1
+Host: a.com
+Authorization: Bearer SECRET_TOKEN
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://b.com/%TESTNUMBER0002 HTTP/1.1
+Host: b.com
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
--
2.53.0
external/curl/0001-proxy-auth-additional-tests.patch
Vendored
-162
View File
@@ -1,162 +0,0 @@
From 5f13a7645e565c5c1a06f3ef86e97afb856fb364 Mon Sep 17 00:00:00 2001
From: Stefan Eissing <stefan@eissing.org>
Date: Fri, 6 Mar 2026 14:54:09 +0100
Subject: [PATCH] proxy-auth: additional tests
Also eliminate the special handling for socks proxy match.
Closes #20837
---
lib/url.c | 28 +++++++---------------------
tests/http/test_13_proxy_auth.py | 20 ++++++++++++++++++++
tests/http/testenv/curl.py | 18 +++++++++++++++---
3 files changed, 42 insertions(+), 24 deletions(-)
diff --git a/lib/url.c b/lib/url.c
index eabeb776ab..bdc183b45b 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -590,30 +590,15 @@ static bool proxy_info_matches(const struct proxy_info *data,
{
if((data->proxytype == needle->proxytype) &&
(data->port == needle->port) &&
- strcasecompare(data->host.name, needle->host.name))
- return TRUE;
+ strcasecompare(data->host.name, needle->host.name)) {
+ if(Curl_timestrcmp(data->user, needle->user) ||
+ Curl_timestrcmp(data->passwd, needle->passwd))
+ return FALSE;
+ return TRUE;
+ }
return FALSE;
}
-
-static bool
-socks_proxy_info_matches(const struct proxy_info *data,
- const struct proxy_info *needle)
-{
- if(!proxy_info_matches(data, needle))
- return FALSE;
-
- /* the user information is case-sensitive
- or at least it is not defined as case-insensitive
- see https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.1 */
-
- /* curl_strequal does a case insensitive comparison,
- so do not use it here! */
- if(Curl_timestrcmp(data->user, needle->user) ||
- Curl_timestrcmp(data->passwd, needle->passwd))
- return FALSE;
- return TRUE;
-}
#else
/* disabled, will not get called */
#define proxy_info_matches(x,y) FALSE
@@ -923,8 +909,7 @@ static bool url_match_proxy_use(struct connectdata *conn,
return FALSE;
if(m->needle->bits.socksproxy &&
- !socks_proxy_info_matches(&m->needle->socks_proxy,
- &conn->socks_proxy))
+ !proxy_info_matches(&m->needle->socks_proxy, &conn->socks_proxy))
return FALSE;
if(m->needle->bits.httpproxy) {
diff --git a/tests/http/test_13_proxy_auth.py b/tests/http/test_13_proxy_auth.py
index 080adef187..33fb211e99 100644
--- a/tests/http/test_13_proxy_auth.py
+++ b/tests/http/test_13_proxy_auth.py
@@ -169,3 +169,23 @@ class TestProxyAuth:
'--negotiate', '--proxy-user', 'proxy:proxy'
])
r1.check_response(count=1, http_status=200)
+
+ def test_13_10_tunnels_mixed_auth(self, env: Env, httpd, configures_httpd):
+ self.httpd_configure(env, httpd)
+ curl = CurlClient(env=env)
+ url1 = f'http://localhost:{env.http_port}/data.json?1'
+ url2 = f'http://localhost:{env.http_port}/data.json?2'
+ url3 = f'http://localhost:{env.http_port}/data.json?3'
+ xargs1 = curl.get_proxy_args(proxys=False, tunnel=True)
+ xargs1.extend(['--proxy-user', 'proxy:proxy']) # good auth
+ xargs2 = curl.get_proxy_args(proxys=False, tunnel=True)
+ xargs2.extend(['--proxy-user', 'ungood:ungood']) # bad auth
+ xargs3 = curl.get_proxy_args(proxys=False, tunnel=True)
+ # no auth
+ r = curl.http_download(urls=[url1, url2, url3], alpn_proto='http/1.1', with_stats=True,
+ url_options={url1: xargs1, url2: xargs2, url3: xargs3})
+ # only url1 succeeds, others fail, no connection reuse
+ assert r.stats[0]['http_code'] == 200, f'{r.dump_logs()}'
+ assert r.stats[1]['http_code'] == 0, f'{r.dump_logs()}'
+ assert r.stats[2]['http_code'] == 0, f'{r.dump_logs()}'
+ assert r.total_connects == 3, f'{r.dump_logs()}'
diff --git a/tests/http/testenv/curl.py b/tests/http/testenv/curl.py
index 4fc11c7923..1f812a1c2e 100644
--- a/tests/http/testenv/curl.py
+++ b/tests/http/testenv/curl.py
@@ -543,7 +543,8 @@ class CurlClient:
with_profile: bool = False,
with_tcpdump: bool = False,
no_save: bool = False,
- extra_args: Optional[List[str]] = None):
+ extra_args: Optional[List[str]] = None,
+ url_options: Optional[Dict[str,List[str]]] = None):
if extra_args is None:
extra_args = []
if no_save:
@@ -563,6 +564,7 @@ class CurlClient:
])
return self._raw(urls, alpn_proto=alpn_proto, options=extra_args,
with_stats=with_stats,
+ url_options=url_options,
with_headers=with_headers,
with_profile=with_profile,
with_tcpdump=with_tcpdump)
@@ -1083,6 +1085,7 @@ class CurlClient:
def _raw(self, urls, intext='', timeout=None, options=None, insecure=False,
alpn_proto: Optional[str] = None,
+ url_options=None,
force_resolve=True,
with_stats=False,
with_headers=True,
@@ -1092,7 +1095,8 @@ class CurlClient:
args = self._complete_args(
urls=urls, timeout=timeout, options=options, insecure=insecure,
alpn_proto=alpn_proto, force_resolve=force_resolve,
- with_headers=with_headers, def_tracing=def_tracing)
+ with_headers=with_headers, def_tracing=def_tracing,
+ url_options=url_options)
r = self._run(args, intext=intext, with_stats=with_stats,
with_profile=with_profile, with_tcpdump=with_tcpdump)
if r.exit_code == 0 and with_headers:
@@ -1102,8 +1106,10 @@ class CurlClient:
def _complete_args(self, urls, timeout=None, options=None,
insecure=False, force_resolve=True,
alpn_proto: Optional[str] = None,
+ url_options=None,
with_headers: bool = True,
def_tracing: bool = True):
+ url_sep = []
if not isinstance(urls, list):
urls = [urls]
@@ -1129,7 +1135,13 @@ class CurlClient:
active_options = options[options.index('--next') + 1:]
for url in urls:
- u = urlparse(urls[0])
+ args.extend(url_sep)
+ if url_options is not None:
+ url_sep = ['--next']
+
+ u = urlparse(url)
+ if url_options is not None and url in url_options:
+ args.extend(url_options[url])
if options:
args.extend(options)
if alpn_proto is not None:
--
2.53.0
external/curl/0001-setopt-clear-proxy-auth-properties-when-switching.patch
Vendored
-373
View File
@@ -1,373 +0,0 @@
From c1cfdf59acbaf9504c4578d4cf56cdd7c8594507 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 27 Apr 2026 09:14:51 +0200
Subject: [PATCH] setopt: clear proxy auth properties when switching
Verify with test 1588
Closes #21453
---
lib/setopt.c | 17 ++++-
lib/vauth/vauth.h | 1 +
tests/data/Makefile.am | 1 +
tests/data/test1588 | 106 ++++++++++++++++++++++++++
tests/libtest/Makefile.inc | 2 +-
tests/libtest/lib1588.c | 150 +++++++++++++++++++++++++++++++++++++
6 files changed, 275 insertions(+), 2 deletions(-)
create mode 100644 tests/data/test1588
create mode 100644 tests/libtest/lib1588.c
diff --git a/lib/setopt.c b/lib/setopt.c
index e832ef1afd..22d32b64a4 100644
--- a/lib/setopt.c
+++ b/lib/setopt.c
@@ -49,6 +49,8 @@
#include "tftp.h"
#include "strdup.h"
#include "escape.h"
+
+#include "vauth/vauth.h"
/* The last 3 #include files should be in this order */
#include "curl_printf.h"
@@ -1622,6 +1623,22 @@ static CURLcode cookiefile(struct Curl_easy *data, const char *ptr)
return result;
}
+#ifndef CURL_DISABLE_PROXY
+
+static CURLcode setproxy(struct Curl_easy *data, const char *proxy)
+{
+ if((data->set.str[STRING_PROXY] && proxy) &&
+ /* there was one set, is this a new one? */
+ !strcmp(data->set.str[STRING_PROXY], proxy))
+ return CURLE_OK; /* same one as before */
+
+ Curl_auth_digest_cleanup(&data->state.proxydigest);
+ memset(&data->state.authproxy, 0, sizeof(data->state.authproxy));
+ return Curl_setstropt(&data->set.str[STRING_PROXY], proxy);
+}
+
+#endif /* CURL_DISABLE_PROXY */
+
static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
char *ptr)
{
@@ -1717,7 +1732,7 @@ static CURLcode setopt_cptr_proxy(struct Curl_easy *data, CURLoption option,
* Setting it to NULL, means no proxy but allows the environment variables
* to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL).
*/
- return Curl_setstropt(&data->set.str[STRING_PROXY], ptr);
+ return setproxy(data, ptr);
case CURLOPT_PRE_PROXY:
/*
diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h
index b5ff31414f..279da60be2 100644
--- a/lib/vauth/vauth.h
+++ b/lib/vauth/vauth.h
@@ -117,6 +117,8 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
/* This is used to clean up the digest specific data */
void Curl_auth_digest_cleanup(struct digestdata *digest);
+#else
+#define Curl_auth_digest_cleanup(x)
#endif /* !CURL_DISABLE_DIGEST_AUTH */
#ifdef USE_GSASL
diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
index dc0d8311ec..00d3e4166e 100644
--- a/tests/data/Makefile.am
+++ b/tests/data/Makefile.am
@@ -209,6 +209,7 @@ test1556 test1557 test1558 test1559 test1560 test1561 test1562 test1563 \
test1566 test1567 test1568 test1569 test1570 test1571 test1572 test1573 \
test1574 test1575 test1576 test1577 test1578 test1579 test1580 test1581 \
\
+test1588 \
test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \
test1598 \
test1600 test1601 test1602 test1603 test1604 test1605 test1606 test1607 \
diff --git a/tests/data/test1588 b/tests/data/test1588
new file mode 100644
index 0000000000..753e98cd6b
--- /dev/null
+++ b/tests/data/test1588
@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP proxy
+HTTP proxy Digest auth
+multi
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+# this is returned first since we get no proxy-auth
+<data crlf="headers">
+HTTP/1.1 407 Authorization Required to proxy me my dear
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
+Content-Length: 33
+
+And you should ignore this data.
+</data>
+
+# then this is returned when we get proxy-auth
+<data1000 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 21
+Server: no
+
+Nice proxy auth sir!
+</data1000>
+
+<datacheck crlf="headers">
+HTTP/1.1 407 Authorization Required to proxy me my dear
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
+Content-Length: 33
+
+HTTP/1.1 200 OK
+Content-Length: 21
+Server: no
+
+Nice proxy auth sir!
+HTTP/1.1 407 Authorization Required to proxy me my dear
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
+Content-Length: 33
+
+HTTP/1.1 200 OK
+Content-Length: 21
+Server: no
+
+Nice proxy auth sir!
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+# tool is what to use instead of 'curl'
+<tool>
+lib%TESTNUMBER
+</tool>
+<features>
+!SSPI
+crypto
+proxy
+digest
+</features>
+<name>
+HTTP proxy auth Digest, then change proxy and do it again
+</name>
+<command>
+http://test.remote.example.com/path/%TESTNUMBER %HOSTIP %HTTPPORT silly:person custom.set.host.name
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://test.remote.example.com/path/1588 HTTP/1.1
+Host: test.remote.example.com
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://test.remote.example.com/path/1588 HTTP/1.1
+Host: test.remote.example.com
+Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://test.remote.example.com/path/1588 HTTP/1.1
+Host: test.remote.example.com
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://test.remote.example.com/path/1588 HTTP/1.1
+Host: test.remote.example.com
+Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
index 10be282c17..724636464a 100644
--- a/tests/libtest/Makefile.inc
+++ b/tests/libtest/Makefile.inc
@@ -96,7 +96,7 @@ TESTS_C = \
lib1540 lib1541 lib1542 lib1543 lib1545 \
lib1550 lib1551 lib1552 lib1553 lib1554 lib1555 lib1556 lib1557 \
lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 lib1571 \
- lib1576 lib1578 \
+ lib1576 lib1578 lib1588 \
lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \
\
lib1662 \
diff --git a/tests/libtest/lib1588.c b/tests/libtest/lib1588.c
new file mode 100644
index 0000000000..9b12f36bfe
--- /dev/null
+++ b/tests/libtest/lib1588.c
@@ -0,0 +1,150 @@
+/***************************************************************************
+ * _ _ ____ _
+ * Project ___| | | | _ \| |
+ * / __| | | | |_) | |
+ * | (__| |_| | _ <| |___
+ * \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/*
+ * argv1 = URL
+ * argv2 = proxy host
+ * argv3 = proxy port
+ * argv4 = proxyuser:password
+ */
+
+#include "first.h"
+
+static CURLcode init1588(CURL *curl, const char *url,
+ const char *userpwd, const char *proxy)
+{
+ CURLcode result = CURLE_OK;
+
+ res_easy_setopt(curl, CURLOPT_URL, url);
+ if(result)
+ goto init_failed;
+
+ res_easy_setopt(curl, CURLOPT_PROXY, proxy);
+ if(result)
+ goto init_failed;
+
+ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
+ if(result)
+ goto init_failed;
+
+ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
+ if(result)
+ goto init_failed;
+
+ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+ if(result)
+ goto init_failed;
+#if 0
+ res_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
+ if(result)
+ goto init_failed;
+#endif
+
+ res_easy_setopt(curl, CURLOPT_HEADER, 1L);
+ if(result)
+ goto init_failed;
+
+ return CURLE_OK; /* success */
+
+init_failed:
+ return result; /* failure */
+}
+
+static CURLcode run1588(CURL *curl, const char *url, const char *userpwd,
+ const char *proxy)
+{
+ CURLcode result = CURLE_OK;
+
+ result = init1588(curl, url, userpwd, proxy);
+ if(result)
+ return result;
+
+ return curl_easy_perform(curl);
+}
+
+static CURLcode test_lib1588(const char *URL)
+{
+ CURLcode result = CURLE_OK;
+ CURL *curl = NULL;
+ const char *proxyuserpws = libtest_arg4;
+ struct curl_slist *host = NULL;
+ struct curl_slist *host2 = NULL;
+ char proxy1_resolve[128];
+ char proxy2_resolve[128];
+ char proxy1_connect[128];
+ char proxy2_connect[128];
+
+ if(test_argc < 3)
+ return TEST_ERR_MAJOR_BAD;
+
+ curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve),
+ "firstproxy:%s:%s", libtest_arg3, libtest_arg2);
+ curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve),
+ "secondproxy:%s:%s", libtest_arg3, libtest_arg2);
+
+ /* we connect to the fake host name but the right port number */
+ curl_msnprintf(proxy1_connect, sizeof(proxy1_connect),
+ "firstproxy:%s", libtest_arg3);
+ curl_msnprintf(proxy2_connect, sizeof(proxy2_connect),
+ "secondproxy:%s", libtest_arg3);
+
+ res_global_init(CURL_GLOBAL_ALL);
+ if(result)
+ return result;
+
+ curl = curl_easy_init();
+ if(!curl) {
+ curl_mfprintf(stderr, "curl_easy_init() failed\n");
+ curl_global_cleanup();
+ return TEST_ERR_MAJOR_BAD;
+ }
+
+ host = curl_slist_append(NULL, proxy1_resolve);
+ if(!host)
+ goto test_cleanup;
+ host2 = curl_slist_append(host, proxy2_resolve);
+ if(!host2)
+ goto test_cleanup;
+ host = host2;
+
+ start_test_timing();
+
+ easy_setopt(curl, CURLOPT_RESOLVE, host);
+
+ result = run1588(curl, URL, proxyuserpws, proxy1_connect);
+ if(result)
+ goto test_cleanup;
+
+ curl_mfprintf(stderr, "lib1588: now we do the request again\n");
+
+ result = run1588(curl, URL, proxyuserpws, proxy2_connect);
+
+test_cleanup:
+
+ /* proper cleanup sequence - type PB */
+
+ curl_easy_cleanup(curl);
+ curl_global_cleanup();
+ curl_slist_free_all(host);
+ return result;
+}
--
2.54.0
external/curl/0001-url-detect-proxy-changes-read-from-environment.patch
Vendored
-334
View File
@@ -1,334 +0,0 @@
From 5c225384b8d52c67ce8259c6e4203bc57aacb567 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 18 May 2026 23:47:11 +0200
Subject: [PATCH] url: detect proxy changes read from environment
When a proxy is set from an environment variable, detect if that proxy
is not the same as previously and flush state.
Verified by test1647: verify changing proxy with env variables and make
sure Digest state is flushed in the second use
Closes #21666
---
lib/url.c | 11 ++++
lib/urldata.h | 1 +
tests/data/Makefile.am | 8 +--
tests/data/test1647 | 103 +++++++++++++++++++++++++++++++
tests/libtest/Makefile.inc | 1 +
tests/libtest/lib1647.c | 120 +++++++++++++++++++++++++++++++++++++
6 files changed, 239 insertions(+), 5 deletions(-)
create mode 100644 tests/data/test1647
create mode 100644 tests/libtest/lib1647.c
diff --git a/lib/url.c b/lib/url.c
index a569c3e4bc..31f5d948d8 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -93,6 +93,7 @@
#include "cfilters.h"
#include "curl_krb5.h"
#include "idn.h"
+#include "vauth/vauth.h"
/* And now for the protocols */
#include "ftp.h"
@@ -305,6 +305,9 @@ CURLcode Curl_close(struct Curl_easy **datap)
Curl_freeset(data);
Curl_headers_cleanup(data);
Curl_netrc_cleanup(&data->state.netrc);
+#ifndef CURL_DISABLE_DIGEST_AUTH
+ Curl_safefree(data->state.envproxy);
+#endif
free(data);
return CURLE_OK;
}
@@ -2007,6 +2010,14 @@ static CURLcode url_set_conn_proxies(struct Curl_easy *data,
result = CURLE_UNSUPPORTED_PROTOCOL;
goto out;
#else
+#ifndef CURL_DISABLE_DIGEST_AUTH
+ if(!Curl_safecmp(data->state.envproxy, proxy)) {
+ /* proxy changed */
+ Curl_auth_digest_cleanup(&data->state.proxydigest);
+ Curl_safefree(data->state.envproxy);
+ data->state.envproxy = strdup(proxy);
+ }
+#endif
/* force this connection's protocol to become HTTP if compatible */
if(!(conn->handler->protocol & PROTO_FAMILY_HTTP)) {
if((conn->handler->flags & PROTOPT_PROXY_AS_HTTP) &&
diff --git a/lib/urldata.h b/lib/urldata.h
index 8b85c674a9..85630b05b7 100644
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -671,6 +671,7 @@ struct UrlState {
void (*prev_signal)(int sig);
#endif
#ifndef CURL_DISABLE_DIGEST_AUTH
+ char *envproxy; /* last proxy string used for proxy-related state */
struct digestdata digest; /* state data for host Digest auth */
struct digestdata proxydigest; /* state data for proxy Digest auth */
#endif
diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
index b330af3b90..a3778bdad1 100644
--- a/tests/data/Makefile.am
+++ b/tests/data/Makefile.am
@@ -214,6 +214,7 @@ test1596 test1597 test1598 test1599 test1600 test1601 test1602 test1603 \
test1620 test1621 \
\
test1630 test1631 test1632 test1633 test1634 test1635 \
+test1647 \
\
test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \
test1658 \
diff --git a/tests/data/test1647 b/tests/data/test1647
new file mode 100644
index 0000000000..a87487fa9f
--- /dev/null
+++ b/tests/data/test1647
@@ -0,0 +1,103 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP proxy
+HTTP proxy Digest auth
+multi
+</keywords>
+</info>
+
+# Server-side
+<reply>
+
+# this is returned first since we get no proxy-auth
+<data crlf="headers" nocheck="yes">
+HTTP/1.1 407 Authorization Required to proxy me my dear
+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
+Content-Length: 33
+
+And you should ignore this data.
+</data>
+
+# then this is returned when we get proxy-auth
+<data1000 crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 21
+Server: no
+
+Nice proxy auth sir!
+</data1000>
+
+<connect crlf="headers">
+HTTP/1.1 401 OK
+Content-Length: 21
+Server: no
+
+Denied access. Leave
+</connect>
+
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+https-proxy
+https
+</server>
+# tool is what to use instead of 'curl'
+<tool>
+lib%TESTNUMBER
+</tool>
+<features>
+!SSPI
+crypto
+proxy
+digest
+Debug
+</features>
+<setenv>
+http_proxy=%HOSTIP:%HTTPPORT
+https_proxy=https://%HOSTIP:%HTTPSPROXYPORT
+CURL_ENTROPY=99376
+</setenv>
+<name>
+HTTP proxy auth Digest, then change proxy with env var and do it again
+</name>
+<command>
+http://test.remote.example.com/path/%TESTNUMBER https://another.example.com:%HTTPSPORT/ daniel:monkey123 another:bump456
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
+Host: test.remote.example.com
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
+Host: test.remote.example.com
+Proxy-Authorization: Digest username="daniel", realm="weirdorealm", nonce="12345", uri="/path/%TESTNUMBER", response="7a1672891aff03248887b1a6674b8096"
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+
+<proxy crlf="headers">
+CONNECT another.example.com:%HTTPSPORT HTTP/1.1
+Host: another.example.com:%HTTPSPORT
+Proxy-Connection: Keep-Alive
+
+</proxy>
+
+# CONNECT fails
+<errorcode>
+7
+</errorcode>
+</verify>
+</testcase>
diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
index 734e7f30e9..586db5a2c9 100644
--- a/tests/libtest/Makefile.inc
+++ b/tests/libtest/Makefile.inc
@@ -99,6 +99,7 @@ TESTS_C = \
lib1576 lib1578 lib1588 \
lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \
\
+ lib1647 \
lib1662 \
\
lib1900 lib1901 \
diff --git a/tests/libtest/lib1647.c b/tests/libtest/lib1647.c
new file mode 100644
index 0000000000..8060e1bfe9
--- /dev/null
+++ b/tests/libtest/lib1647.c
@@ -0,0 +1,120 @@
+/***************************************************************************
+ * _ _ ____ _
+ * Project ___| | | | _ \| |
+ * / __| | | | |_) | |
+ * | (__| |_| | _ <| |___
+ * \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+/*
+ * argv1 = the first URL
+ * argv2 = URL2
+ * argv3 = credentials 1
+ * argv4 = credentials 2
+ */
+
+#include "first.h"
+
+/* this is meant to pick up the proxy from the environment variable */
+static CURLcode init1647(CURL *curl, const char *url, const char *userpwd)
+{
+ CURLcode result = CURLE_OK;
+
+ res_easy_setopt(curl, CURLOPT_URL, url);
+ if(result)
+ goto init_failed;
+
+ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
+ if(result)
+ goto init_failed;
+
+ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
+ if(result)
+ goto init_failed;
+
+ res_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+ if(result)
+ goto init_failed;
+
+ res_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
+ if(result)
+ goto init_failed;
+
+ res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 0L);
+ if(result)
+ goto init_failed;
+
+ res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 0L);
+ if(result)
+ goto init_failed;
+
+ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+ if(result)
+ goto init_failed;
+
+ return CURLE_OK; /* success */
+
+init_failed:
+ return result; /* failure */
+}
+
+static CURLcode run1647(CURL *curl, const char *url, const char *userpwd)
+{
+ CURLcode result = CURLE_OK;
+
+ result = init1647(curl, url, userpwd);
+ if(result)
+ return result;
+
+ return curl_easy_perform(curl);
+}
+
+static CURLcode test_lib1647(const char *URL)
+{
+ CURLcode result = CURLE_OK;
+ CURL *curl = NULL;
+
+ res_global_init(CURL_GLOBAL_ALL);
+ if(result)
+ return result;
+
+ curl = curl_easy_init();
+ if(!curl) {
+ curl_mfprintf(stderr, "curl_easy_init() failed\n");
+ curl_global_cleanup();
+ return TEST_ERR_MAJOR_BAD;
+ }
+
+ start_test_timing();
+
+ curl_mprintf("--- First get '%s'\n", URL);
+ result = run1647(curl, URL, libtest_arg3);
+ if(result)
+ goto test_cleanup;
+
+ curl_mprintf("--- Then get '%s'\n", libtest_arg2);
+ result = run1647(curl, libtest_arg2, libtest_arg4);
+
+test_cleanup:
+
+ /* proper cleanup sequence - type PB */
+
+ curl_easy_cleanup(curl);
+ curl_global_cleanup();
+ return result;
+}
--
2.54.0
external/curl/0001-url-fix-copy-and-paste-url_match_auth_nego-mistake.patch
Vendored
-28
View File
@@ -1,28 +0,0 @@
From f1a39f221d57354990e3eeeddc3404aede2aff70 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Sat, 21 Feb 2026 18:11:41 +0100
Subject: [PATCH] url: fix copy and paste url_match_auth_nego mistake
Follow-up to 34fa034
Reported-by: dahmono on github
Closes #20662
---
lib/url.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/url.c b/lib/url.c
index c879a85e92..8b42aebade 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -1217,7 +1217,7 @@ static bool url_match_auth_nego(struct connectdata *conn,
return FALSE;
}
#endif
- if(m->want_ntlm_http || m->want_proxy_ntlm_http) {
+ if(m->want_nego_http || m->want_proxy_nego_http) {
/* Credentials are already checked, we may use this connection. We MUST
* use a connection where it has already been fully negotiated. If it has
* not, we keep on looking for a better one. */
--
2.53.0
external/curl/0001-url-fix-reuse-of-connections-using-HTTP-Negotiate.patch
Vendored
-137
View File
@@ -1,137 +0,0 @@
From 34fa034d9a390c4bd65e2d05262755ec8646ac12 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Thu, 5 Feb 2026 08:34:21 +0100
Subject: [PATCH] url: fix reuse of connections using HTTP Negotiate
Assume Negotiate means connection-based
Reported-by: Zhicheng Chen
Closes #20534
---
lib/url.c | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++----
1 file changed, 82 insertions(+), 5 deletions(-)
diff --git a/lib/url.c b/lib/url.c
index fac8cea732..cfe398de8b 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -764,6 +764,8 @@ struct url_conn_match {
BIT(may_multiplex);
BIT(want_ntlm_http);
BIT(want_proxy_ntlm_http);
+ BIT(want_nego_http);
+ BIT(want_proxy_nego_http);
BIT(wait_pipe);
BIT(force_reuse);
@@ -1185,6 +1187,63 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
#define url_match_auth_ntlm(c,m) ((void)c, (void)m, TRUE)
#endif
+#ifdef USE_SPNEGO
+static bool url_match_auth_nego(struct connectdata *conn,
+ struct url_conn_match *m)
+{
+ /* If we are looking for an HTTP+Negotiate connection, check if this is
+ already authenticating with the right credentials. If not, keep looking
+ so that we can reuse Negotiate connections if possible. */
+ if(m->want_nego_http) {
+ if(Curl_timestrcmp(m->needle->user, conn->user) ||
+ Curl_timestrcmp(m->needle->passwd, conn->passwd))
+ return FALSE;
+ }
+ else if(conn->http_negotiate_state != GSS_AUTHNONE) {
+ /* Connection is using Negotiate auth but we do not want Negotiate */
+ return FALSE;
+ }
+
+#ifndef CURL_DISABLE_PROXY
+ /* Same for Proxy Negotiate authentication */
+ if(m->want_proxy_nego_http) {
+ /* Both conn->http_proxy.user and conn->http_proxy.passwd can be
+ * NULL */
+ if(!conn->http_proxy.user || !conn->http_proxy.passwd)
+ return FALSE;
+
+ if(Curl_timestrcmp(m->needle->http_proxy.user,
+ conn->http_proxy.user) ||
+ Curl_timestrcmp(m->needle->http_proxy.passwd,
+ conn->http_proxy.passwd))
+ return FALSE;
+ }
+ else if(conn->proxy_negotiate_state != GSS_AUTHNONE) {
+ /* Proxy connection is using Negotiate auth but we do not want Negotiate */
+ return FALSE;
+ }
+#endif
+ if(m->want_ntlm_http || m->want_proxy_ntlm_http) {
+ /* Credentials are already checked, we may use this connection. We MUST
+ * use a connection where it has already been fully negotiated. If it has
+ * not, we keep on looking for a better one. */
+ m->found = conn;
+ if((m->want_nego_http &&
+ (conn->http_negotiate_state != GSS_AUTHNONE)) ||
+ (m->want_proxy_nego_http &&
+ (conn->proxy_negotiate_state != GSS_AUTHNONE))) {
+ /* We must use this connection, no other */
+ m->force_reuse = TRUE;
+ return TRUE;
+ }
+ return FALSE; /* get another */
+ }
+ return TRUE;
+}
+#else
+#define url_match_auth_nego(c, m) ((void)c, (void)m, TRUE)
+#endif
+
static bool url_match_conn(struct connectdata *conn, void *userdata)
{
struct url_conn_match *m = userdata;
@@ -1228,6 +1287,11 @@ static bool url_match_conn(struct connectdata *conn, void *userdata)
else if(m->force_reuse)
return TRUE;
+ if(!url_match_auth_nego(conn, m))
+ return FALSE;
+ else if(m->force_reuse)
+ return TRUE;
+
if(!url_match_multiplex_limits(conn, m))
return FALSE;
@@ -1290,13 +1354,26 @@ static bool url_attach_existing(struct Curl_easy *data,
match.may_multiplex = xfer_may_multiplex(data, needle);
#ifdef USE_NTLM
- match.want_ntlm_http = ((data->state.authhost.want & CURLAUTH_NTLM) &&
- (needle->handler->protocol & PROTO_FAMILY_HTTP));
+ match.want_ntlm_http =
+ (data->state.authhost.want & CURLAUTH_NTLM) &&
+ (needle->handler->protocol & PROTO_FAMILY_HTTP);
#ifndef CURL_DISABLE_PROXY
match.want_proxy_ntlm_http =
- (needle->bits.proxy_user_passwd &&
- (data->state.authproxy.want & CURLAUTH_NTLM) &&
- (needle->handler->protocol & PROTO_FAMILY_HTTP));
+ needle->bits.proxy_user_passwd &&
+ (data->state.authproxy.want & CURLAUTH_NTLM) &&
+ (needle->handler->protocol & PROTO_FAMILY_HTTP);
+#endif
+#endif
+
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO)
+ match.want_nego_http =
+ (data->state.authhost.want & CURLAUTH_NEGOTIATE) &&
+ (needle->handler->protocol & PROTO_FAMILY_HTTP);
+#ifndef CURL_DISABLE_PROXY
+ match.want_proxy_nego_http =
+ needle->bits.proxy_user_passwd &&
+ (data->state.authproxy.want & CURLAUTH_NEGOTIATE) &&
+ (needle->handler->protocol & PROTO_FAMILY_HTTP);
#endif
#endif
--
2.53.0
external/curl/0001-url-improve-connection-reuse-on-negotiate.patch
Vendored
-40
View File
@@ -1,40 +0,0 @@
From 33e43985b8f3b9e66691d06e70be0395849856cd Mon Sep 17 00:00:00 2001
From: Stefan Eissing <stefan@eissing.org>
Date: Thu, 2 Apr 2026 11:33:39 +0200
Subject: [PATCH] url: improve connection reuse on negotiate
Check state of negotiate to allow proper connection reuse.
Closes #21203
---
lib/url.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/lib/url.c b/lib/url.c
index c377f0733b..c61c89c39d 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -1085,11 +1085,17 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
if(m->want_ntlm_http) {
if(Curl_timestrcmp(m->needle->user, conn->user) ||
Curl_timestrcmp(m->needle->passwd, conn->passwd)) {
-
/* we prefer a credential match, but this is at least a connection
- that can be reused and "upgraded" to NTLM */
- if(conn->http_ntlm_state == NTLMSTATE_NONE)
+ that can be reused and "upgraded" to NTLM if it does
+ not have any auth ongoing. */
+#ifdef USE_SPNEGO
+ if((conn->http_ntlm_state == NTLMSTATE_NONE)
+ && (conn->http_negotiate_state == GSS_AUTHNONE)) {
+#else
+ if(conn->http_ntlm_state == NTLMSTATE_NONE) {
+#endif
m->found = conn;
+ }
return FALSE;
}
}
--
2.54.0
external/curl/0001-ws-get-a-new-mask-for-each-new-outgoing-frame.patch
Vendored
-61
View File
@@ -1,61 +0,0 @@
From 84db7a9eae8468c0445b15aa806fa7fa806fa0f2 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 8 Sep 2025 14:14:15 +0200
Subject: [PATCH] ws: get a new mask for each new outgoing frame
Reported-by: Calvin Ruocco
Closes #18496
---
lib/ws.c | 28 +++++++++++++---------------
1 file changed, 13 insertions(+), 15 deletions(-)
diff --git a/lib/ws.c b/lib/ws.c
index e973409b6..3b6542816 100644
--- a/lib/ws.c
+++ b/lib/ws.c
@@ -875,6 +875,19 @@ static CURLcode ws_enc_add_frame(struct Curl_easy *data,
enc->payload_remain = enc->payload_len = payload_len;
ws_enc_info(enc, data, "sending");
+ /* 4 bytes random */
+
+ CURLcode result =
+ Curl_rand(data, (unsigned char *)&enc->mask, sizeof(enc->mask));
+ if(result)
+ return result;
+
+#ifdef DEBUGBUILD
+ if(getenv("CURL_WS_FORCE_ZERO_MASK"))
+ /* force the bit mask to 0x00000000, effectively disabling masking */
+ memset(&enc->mask, 0, sizeof(enc->mask));
+#endif
+
/* add 4 bytes mask */
memcpy(&head[hlen], &enc->mask, 4);
hlen += 4;
@@ -1335,21 +1347,7 @@ CURLcode Curl_ws_accept(struct Curl_easy *data,
subprotocol not requested by the client), the client MUST Fail
the WebSocket Connection. */
- /* 4 bytes random */
-
- result = Curl_rand(data, (unsigned char *)&ws->enc.mask,
- sizeof(ws->enc.mask));
- if(result)
- return result;
-
-#ifdef DEBUGBUILD
- if(getenv("CURL_WS_FORCE_ZERO_MASK"))
- /* force the bit mask to 0x00000000, effectively disabling masking */
- memset(ws->enc.mask, 0, sizeof(ws->enc.mask));
-#endif
-
- infof(data, "[WS] Received 101, switch to WebSocket; mask %02x%02x%02x%02x",
- ws->enc.mask[0], ws->enc.mask[1], ws->enc.mask[2], ws->enc.mask[3]);
+ infof(data, "[WS] Received 101, switch to WebSocket");
/* Install our client writer that decodes WS frames payload */
result = Curl_cwriter_create(&ws_dec_writer, data, &ws_cw_decode,
--
2.39.5
external/curl/ExternalPackage_curl.mk
Vendored
+1 -1
View File
@@ -14,7 +14,7 @@ $(eval $(call gb_ExternalPackage_use_external_project,curl,curl))
ifneq ($(DISABLE_DYNLOADING),TRUE)
ifeq ($(COM),MSC)
$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll,builds/libcurl-vc12-$(gb_MSBUILD_PLATFORM)-$(gb_MSBUILD_CONFIG)-dll-zlib-static-ipv6-sspi-schannel/bin/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll))
$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),-d).dll,lib/$(if $(MSVC_USE_DEBUG_RUNTIME),Debug,Release)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),-d).dll))
else ifeq ($(OS),MACOSX)
$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.4.dylib,lib/.libs/libcurl.4.dylib))
else
external/curl/ExternalProject_curl.mk
Vendored
+33 -23
View File
@@ -34,29 +34,25 @@ curl_LDFLAGS += -L$(SYSBASE)/usr/lib
endif
endif
# use --with-secure-transport on macOS >10.5 and iOS to get a native UI for SSL certs for CMIS usage
# use --with-openssl only on platforms other than macOS and iOS
# use --with-openssl on all platforms
$(call gb_ExternalProject_get_state_target,curl,build):
$(call gb_Trace_StartRange,curl,EXTERNAL)
$(call gb_ExternalProject_run,build,\
$(gb_RUN_CONFIGURE) ./configure \
--without-amissl --without-bearssl --without-gnutls \
--without-mbedtls --without-rustls --without-wolfssl \
--disable-ftp --enable-http --enable-ipv6 \
--without-libidn2 --without-libpsl --without-librtmp \
--without-libssh2 --without-nghttp2 \
--without-libssh --without-brotli \
--without-ngtcp2 --without-quiche \
--without-zstd --without-hyper --without-libgsasl \
--without-zstd --without-libgsasl \
$(if $(WITH_GSSAPI),--with-gssapi,--without-gssapi) \
--disable-ipfs --disable-mqtt --disable-ares \
--disable-dict --disable-file --disable-gopher --disable-imap \
--disable-ldap --disable-ldaps --disable-manual --disable-pop3 \
--disable-rtsp --disable-smb --disable-smtp --disable-telnet \
--disable-tftp \
$(if $(filter iOS MACOSX,$(OS)),\
--with-secure-transport,\
$(if $(ENABLE_OPENSSL),--with-openssl$(if $(SYSTEM_OPENSSL),,="$(gb_UnpackedTarball_workdir)/openssl"))) \
$(if $(ENABLE_OPENSSL),--with-openssl$(if $(SYSTEM_OPENSSL),,="$(gb_UnpackedTarball_workdir)/openssl")) \
$(if $(filter iOS MACOSX,$(OS)),--with-apple-sectrust) \
$(if $(filter LINUX,$(OS)),--without-ca-bundle --without-ca-path) \
$(gb_CONFIGURE_PLATFORMS) \
$(if $(filter TRUE,$(DISABLE_DYNLOADING)),--disable-shared,--disable-static) \
@@ -78,24 +74,38 @@ $(call gb_ExternalProject_get_state_target,curl,build):
else ifeq ($(COM),MSC)
$(eval $(call gb_ExternalProject_use_nmake,curl,build))
$(call gb_ExternalProject_get_state_target,curl,build):
$(call gb_Trace_StartRange,curl,EXTERNAL)
$(call gb_ExternalProject_run,build,\
nmake -f Makefile.vc \
mode=dll \
VC=12 \
MACHINE=$(gb_MSBUILD_PLATFORM) \
GEN_PDB=$(if $(call gb_Module__symbols_enabled,curl),yes,no) \
$(if $(call gb_Module__symbols_enabled,curl),CFLAGS_PDB_VALUE="$(gb_DEBUGINFO_FLAGS)") \
DEBUG=$(if $(MSVC_USE_DEBUG_RUNTIME),yes,no) \
ENABLE_IPV6=yes \
ENABLE_SSPI=yes \
ENABLE_WINSSL=yes \
WINBUILD_ACKNOWLEDGE_DEPRECATED=yes \
WITH_ZLIB=static \
,winbuild)
$(CMAKE) . \
$(if $(filter 17.%,$(VCVER)),-G "Visual Studio 17 2022") \
$(if $(filter 18.%,$(VCVER)),-G "Visual Studio 18 2026") \
-A $(gb_MSBUILD_PLATFORM) \
-DBUILD_SHARED_LIBS=ON \
-DENABLE_IPV6=ON \
-DCURL_WINDOWS_SSPI=ON \
-DCURL_USE_SCHANNEL=ON \
-DCURL_USE_LIBPSL=OFF \
-DCURL_ZLIB=ON \
-DZLIB_INCLUDE_DIR=$(gb_UnpackedTarball_workdir)/zlib/ \
-DZLIB_LIBRARY=$(gb_StaticLibrary_WORKDIR)/zlib.lib \
-DCURL_DISABLE_DICT=ON \
-DCURL_DISABLE_FILE=ON \
-DCURL_DISABLE_FTP=ON \
-DCURL_DISABLE_GOPHER=ON \
-DCURL_DISABLE_IMAP=ON \
-DCURL_DISABLE_IPFS=ON \
-DCURL_DISABLE_LDAP=ON \
-DCURL_DISABLE_LDAPS=ON \
-DCURL_DISABLE_MQTT=ON \
-DCURL_DISABLE_POP3=ON \
-DCURL_DISABLE_RTSP=ON \
-DCURL_DISABLE_SMB=ON \
-DCURL_DISABLE_SMTP=ON \
-DCURL_DISABLE_TELNET=ON \
-DCURL_DISABLE_TFTP=ON \
&& $(CMAKE) --build . --config $(if $(MSVC_USE_DEBUG_RUNTIME),Debug,Release) \
)
$(call gb_Trace_EndRange,curl,EXTERNAL)
endif
external/curl/UnpackedTarball_curl.mk
Vendored
-26
View File
@@ -13,40 +13,14 @@ $(eval $(call gb_UnpackedTarball_set_tarball,curl,$(CURL_TARBALL),,curl))
$(eval $(call gb_UnpackedTarball_update_autoconf_configs,curl))
$(eval $(call gb_UnpackedTarball_fix_end_of_line,curl,\
winbuild/MakefileBuild.vc \
))
# 0001-const-up-readonly-H2_NON_FIELD.patch
# upstream effort as:
# https://github.com/curl/curl/pull/17996
$(eval $(call gb_UnpackedTarball_add_patches,curl,\
external/curl/curl-msvc.patch.1 \
external/curl/curl-msvc-zlib.patch.1 \
external/curl/curl-msvc-disable-protocols.patch.1 \
external/curl/zlib.patch.0 \
external/curl/configurable-z-option.patch.0 \
external/curl/0001-const-up-readonly-H2_NON_FIELD.patch.1 \
external/curl/0001-cookie-don-t-treat-the-leading-slash-as-trailing.patch \
external/curl/0001-ws-get-a-new-mask-for-each-new-outgoing-frame.patch \
external/curl/0001-url-fix-reuse-of-connections-using-HTTP-Negotiate.patch \
external/curl/0001-url-fix-copy-and-paste-url_match_auth_nego-mistake.patch \
external/curl/0001-http-only-send-bearer-if-auth-is-allowed.patch \
external/curl/0001-proxy-auth-additional-tests.patch \
external/curl/0001-url-improve-connection-reuse-on-negotiate.patch \
external/curl/0001-setopt-clear-proxy-auth-properties-when-switching.patch \
external/curl/0001-http-clear-the-proxy-credentials-as-well-on-port-or-.patch \
external/curl/0001-url-detect-proxy-changes-read-from-environment.patch \
external/curl/0001-digest-flush-state-on-origin-or-credential-change.patch \
))
ifeq ($(OS)-$(COM_IS_CLANG),WNT-TRUE)
$(eval $(call gb_UnpackedTarball_add_patches,curl, \
external/curl/clang-cl.patch.0 \
))
endif
ifeq ($(ENABLE_EMSCRIPTEN_PROXY_POSIX_SOCKETS),TRUE)
$(eval $(call gb_UnpackedTarball_add_patches,curl, \
external/curl/emscripten-proxy-poll.patch.0 \
external/curl/clang-cl.patch.0
Vendored
-11
View File
@@ -1,11 +0,0 @@
--- winbuild/MakefileBuild.vc
+++ winbuild/MakefileBuild.vc
@@ -52,7 +52,7 @@
!ELSE
CC_NODEBUG = $(CC) /O2 /DNDEBUG
CC_DEBUG = $(CC) /Od /D_DEBUG /RTC1 /Z7 /LDd
-CFLAGS = /I. /I ../lib /I../include /nologo /W4 /EHsc /DWIN32 /FD /c /DBUILDING_LIBCURL $(SOLARINC)
+CFLAGS = /I. /I ../lib /I../include /nologo /W4 /EHsc /DWIN32 /c /DBUILDING_LIBCURL $(SOLARINC)
!ENDIF
LFLAGS = /nologo /machine:$(MACHINE)
external/curl/configurable-z-option.patch.0
Vendored
-20
View File
@@ -1,20 +0,0 @@
--- winbuild/MakefileBuild.vc.sav 2021-11-13 11:43:40.756226600 +0000
+++ winbuild/MakefileBuild.vc 2021-11-13 11:52:08.921692300 +0000
@@ -47,7 +47,7 @@
!IF "$(VC)"=="6"
CC_NODEBUG = $(CC) /O2 /DNDEBUG
-CC_DEBUG = $(CC) /Od /Gm /Zi /D_DEBUG /GZ
+CC_DEBUG = $(CC) /Od /Gm $(DEBUG_FLAGS_VALUE) /D_DEBUG /GZ
CFLAGS = /I. /I../lib /I../include /nologo /W4 /GX /YX /FD /c /DBUILDING_LIBCURL
!ELSE
CC_NODEBUG = $(CC) /O2 /DNDEBUG
@@ -64,7 +64,7 @@
# Instead of id: just create an archive, that contains all objects
LNKLIB = lib.exe
-CFLAGS_PDB = /Zi
+CFLAGS_PDB = $(DEBUG_FLAGS_VALUE)
LFLAGS_PDB = /incremental:no /opt:ref,icf /DEBUG
CFLAGS_LIBCURL_STATIC = /DCURL_STATICLIB
external/curl/curl-msvc-disable-protocols.patch.1
Vendored
-39
View File
@@ -1,39 +0,0 @@
disable protocols nobody needs in MSVC build
--- curl/lib/config-win32.h.orig 2017-08-09 16:43:29.464000000 +0200
+++ curl/lib/config-win32.h 2017-08-09 16:47:38.549200000 +0200
@@ -500,6 +500,23 @@
# endif /* UNDER_CE */
#endif /* !CURL_OS */
+#define CURL_DISABLE_DICT 1
+#define CURL_DISABLE_FILE 1
+#define CURL_DISABLE_FTP 1
+#define CURL_DISABLE_GOPHER 1
+#undef CURL_DISABLE_HTTP
+#define CURL_DISABLE_IMAP 1
+#define CURL_DISABLE_IPFS 1
+#define CURL_DISABLE_LDAP 1
+#define CURL_DISABLE_LDAPS 1
+#define CURL_DISABLE_MQTT 1
+#define CURL_DISABLE_POP3 1
+#define CURL_DISABLE_RTSP 1
+#define CURL_DISABLE_SMB 1
+#define CURL_DISABLE_SMTP 1
+#define CURL_DISABLE_TELNET 1
+#define CURL_DISABLE_TFTP 1
+
/* ---------------------------------------------------------------- */
/* Windows CE */
/* ---------------------------------------------------------------- */
--- curl/winbuild/MakefileBuild.vc.orig 2017-10-23 23:41:21.393200000 +0200
+++ curl/winbuild/MakefileBuild.vc 2017-10-23 23:34:16.028000000 +0200
@@ -562,7 +562,7 @@
EXE_OBJS = $(CURL_OBJS) $(CURL_DIROBJ)\curl.res
-all : $(TARGET) $(PROGRAM_NAME)
+all : $(TARGET)
package: $(TARGET)
@cd $(DIRDIST)
external/curl/curl-msvc-zlib.patch.1
Vendored
-16
View File
@@ -1,16 +0,0 @@
find internal zlib in nmake buildsystem
--- curl/winbuild/MakefileBuild.vc.orig2 2021-10-27 20:44:48.685237000 +0200
+++ curl/winbuild/MakefileBuild.vc 2021-10-27 20:47:23.792407400 +0200
@@ -244,8 +244,9 @@
ZLIB_LIB_DIR = $(ZLIB_PATH)\lib
ZLIB_LFLAGS = $(ZLIB_LFLAGS) "/LIBPATH:$(ZLIB_LIB_DIR)"
!ELSE
-ZLIB_INC_DIR = $(DEVEL_INCLUDE)
-ZLIB_LIB_DIR = $(DEVEL_LIB)
+ZLIB_INC_DIR = $(WORKDIR)/UnpackedTarball/zlib
+ZLIB_LIB_DIR = $(WORKDIR)/LinkTarget/StaticLibrary
+ZLIB_LFLAGS = $(ZLIB_LFLAGS) "/LIBPATH:$(ZLIB_LIB_DIR)"
!ENDIF
# Depending on how zlib is built the libraries have different names, we
external/curl/curl-msvc.patch.1
Vendored
-27
View File
@@ -1,27 +0,0 @@
MSVC: using SOLARINC
--- curl/winbuild/MakefileBuild.vc.orig 2017-10-23 16:36:07.713550851 +0200
+++ curl/winbuild/MakefileBuild.vc 2017-10-23 16:38:19.301547594 +0200
@@ -52,7 +52,7 @@
!ELSE
CC_NODEBUG = $(CC) /O2 /DNDEBUG
CC_DEBUG = $(CC) /Od /D_DEBUG /RTC1 /Z7 /LDd
-CFLAGS = /I. /I ../lib /I../include /nologo /W4 /EHsc /FD /c /DBUILDING_LIBCURL
+CFLAGS = /I. /I ../lib /I../include /nologo /W4 /EHsc /FD /c /DBUILDING_LIBCURL $(SOLARINC)
!ENDIF
LFLAGS = /nologo /machine:$(MACHINE)
@@ -428,11 +428,11 @@
# CURL_XX macros are for the curl.exe command
!IF "$(DEBUG)"=="yes"
-RC_FLAGS = /d_DEBUG /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc
+RC_FLAGS = $(SOLARINC) /d_DEBUG /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc
CURL_CC = $(CC_DEBUG) $(RTLIB_DEBUG)
CURL_RC_FLAGS = $(CURL_RC_FLAGS) /i../include /d_DEBUG /Fo $@ $(CURL_SRC_DIR)\curl.rc
!ELSE
-RC_FLAGS = /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc
+RC_FLAGS = $(SOLARINC) /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc
CURL_CC = $(CC_NODEBUG) $(RTLIB)
CURL_RC_FLAGS = $(CURL_RC_FLAGS) /i../include /Fo $@ $(CURL_SRC_DIR)\curl.rc
!ENDIF
external/curl/zlib.patch.0
Vendored
+12 -13
View File
@@ -8,15 +8,15 @@
# Check whether --with-zlib was given.
if test ${with_zlib+y}
@@ -23609,12 +23609,28 @@
@@ -23922,12 +23922,28 @@
if test "$OPT_ZLIB" = "no"; then
if test "x$OPT_ZLIB" = "xno"; then
+ ZLIB_LIBS=""
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: zlib disabled" >&5
printf "%s\n" "$as_me: WARNING: zlib disabled" >&2;}
else
if test "$OPT_ZLIB" = "yes"; then
if test "x$OPT_ZLIB" = "xyes"; then
OPT_ZLIB=""
fi
+
@@ -36,33 +36,32 @@
+ ZLIB_LIBS=""
if test -z "$OPT_ZLIB"; then
@@ -23903,6 +23903,7 @@
LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE zlib"
@@ -24777,6 +24777,7 @@
fi
curl_zlib_msg="enabled"
fi
+ fi
fi
if test x"$AMFIXLIB" = x1; then
if test "$AMFIXLIB" = "1"; then
--- configure.ac
+++ configure.ac
@@ -1302,19 +1302,31 @@
@@ -1392,19 +1392,30 @@
clean_CPPFLAGS=$CPPFLAGS
clean_LDFLAGS=$LDFLAGS
clean_LIBS=$LIBS
-ZLIB_LIBS=""
+
AC_ARG_WITH(zlib,
AS_HELP_STRING([--with-zlib=PATH],[search for zlib in PATH])
AS_HELP_STRING([--without-zlib],[disable use of zlib]),
[OPT_ZLIB="$withval"])
if test "$OPT_ZLIB" = "no"; then
if test "x$OPT_ZLIB" = "xno"; then
+ ZLIB_LIBS=""
AC_MSG_WARN([zlib disabled])
else
if test "$OPT_ZLIB" = "yes"; then
if test "x$OPT_ZLIB" = "xyes"; then
OPT_ZLIB=""
fi
@@ -80,8 +79,8 @@
if test -z "$OPT_ZLIB"; then
CURL_CHECK_PKGCONFIG(zlib)
@@ -1395,6 +1395,7 @@
LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE zlib"
@@ -1571,6 +1571,7 @@
fi
curl_zlib_msg="enabled"
fi
+ fi
include/systools/curlinit.hxx
+1 -1
View File
@@ -13,7 +13,7 @@
#include <officecfg/Office/Security.hxx>
// curl is built with --with-secure-transport on macOS and iOS so doesn't need these
// curl is built with --with-apple-sectrust on macOS and iOS so doesn't need these
// certs. Windows doesn't need them either, but let's assume everything else does
#if !defined(SYSTEM_OPENSSL) && !defined(_WIN32) && !defined(MACOSX) && !defined(IOS)
#include <com/sun/star/uno/RuntimeException.hpp>