src/lib/libfetch, branch stable/13

libfetch: Gracefully skip unsupported protocols

2026-02-26T04:03:52Z

If socket() fails because the address family or protocol is unsupported, just continue with the next address. MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D55407 (cherry picked from commit b5d570e711da1dad303312bebaf1bd2fb720f0dc)

libfetch: Fail hard if interrupted while connecting

2026-02-26T04:03:52Z

This fixes an issue where the first address that DNS returns is blocked by a packet filter, so we hang for a while, then the user hits Ctrl-C, interrupting connect(2), whereupon we move on to the next address, get a connection, request the file, and return to fetch(1), which sees that SIGINT was caught and bails. Note that we make no attempt to enforce fetchTimeout in the connection phase, and never have. It's feasible, but non-trivial, so we'll leave it as an exercise for future us. PR: 293312 MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D55406 (cherry picked from commit afbdcd402bb439bd3d487baaad63b68e95929265)

libfetch: Clean up fetch_info usage

2026-02-26T04:03:52Z

* Provide a wrapper for the common if (verbose) fetch_info(...) idiom. * Replace remaining instances of fprintf(stderr, ...) with fetch_info(). * Fix a few style nits. MFC after: 1 week Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D55405 (cherry picked from commit 1b7c4d29fdfc975facdc43f6da50947cf3bb8e4a)

libfetch: Restore timeout functionality

2026-02-18T18:41:17Z

PR: 293124 MFC after: 1 week Fixes: 792ef1ae7b94 ("Refactor fetch_connect() and fetch_bind() to improve readability and avoid repeating the same DNS lookups.") Reverts: 8f8a7f6fffd7 ("libfetch: apply timeout to SSL_read()") Reviewed by: eugen, imp Differential Revision: https://reviews.freebsd.org/D55293 (cherry picked from commit 73b82d1b0a2f09224e6d0f7a13dd73c66d740207) (insta-mfc requested by re@)

libfetch: Check for failure to create SSL context

2026-02-11T13:54:33Z

* Drop the ssl_meth member, there is no reason to hang on to it. * Replace deprecated SSLv23_client_method() with TLS_client_method(). * Check the return value from SSL_CTX_new(). MFC after: 1 week PR: 292903 Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D55098 (cherry picked from commit 4e160c6197f75fda3d5d5997ce893087058cf718)

libfetch: remove all old OpenSSL support

2026-02-11T13:53:30Z

This change removes pre-OpenSSL 1.1 supporting code and removes/adjusted preprocessor conditionals which were tautilogically true as FreeBSD main has shipped with OpenSSL 1.1+ for some time. Reviewed by: emaste Differential Revision: https://reviews.freebsd.org/D40711 (cherry picked from commit bc1027a7785166fde9c2a3b48e6e70d198377d4b)

libfetch: do not call deprecated OpenSSL functions

2026-02-11T13:53:17Z

As of OpenSSL 1.1 SSL_library_init() and SSL_load_error_strings() are deprecated. There are replacement initialization functions but they do not need to be called: "As of version 1.1.0 OpenSSL will automatically allocate all resources that it needs so no explicit initialisation is required." Wrap both calls in an OPENSSL_VERSION_NUMBER block. PR: 271615 Reviewed by: Pierre Pronchery Event: Kitchener-Waterloo Hackathon 202305 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D40265 (cherry picked from commit 01aee8c92d936470c44821736e0d9e11ed7ce812)

MFC: libfetch: allow disabling TLS v1.3 when negotiating the connection

2026-01-25T04:17:00Z

(cherry picked from commit 129aec72250266e60c07ff4643623188f7c27a9d)

MFC: libfetch: apply timeout to SSL_read()

2026-01-25T04:14:54Z

Currently, fetchTimeout works for non-SSL connections only, so does fetch -T. Fix it applying specified timeout to SSL_read(). (cherry picked from commit 8f8a7f6fffd7dca09013f7c4bfa075bc3825fb8e)

libfetch: parse scheme://domain:/ correctly

2024-04-03T19:12:38Z

This improves URL-parsing compability with cURL, and unbreaks parsing of similar kinds of URLs after commit 8d9de5b10a24. Sponsored by: Juniper Networks, Inc. Reviewed by: des MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D44493 (cherry picked from commit fb860ed0c52c2c1e7792ef86718620a439663c7f)