aboutsummaryrefslogtreecommitdiff
path: root/lib/libfetch
Commit message (Collapse)AuthorAgeFilesLines
* Fix libfetch out of bounds read.Gordon Tetlow2021-08-241-1/+4
| | | | | | | | Approved by: so Security: SA-21:15.libfetch Security: CVE-2021-36159 (cherry picked from commit 3be62d49ae2b6f9050f39fe74210c88f35901fa5)
* libfetch: Retry with proxy auth when server returns 407Renato Botelho2021-04-281-6/+49
| | | | | | | | | | | | PR: 220468 Submitted by: Egil Hasting <egil.hasting@higen.org> (based on) Reviewed by: kevans, kp Approved by: kp MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29533 (cherry picked from commit 345c30a94f6425954163f1e0b075a75f603d27cd)
* A few more cases where strcasecmp() is no longer required.Dag-Erling Smørgrav2021-04-281-4/+4
| | | | | | | | MFC after: 1 week Approved by: kp Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit ceedec4bce2161062ffcacf7f07e364c8cfe09bc)
* Improve URL parsing. In particular, convert scheme and host to lowercase.Dag-Erling Smørgrav2021-04-283-43/+56
| | | | | | | | MFC after: 1 week Approved by:▸ kp Sponsored by:▸ Rubicon Communications, LLC ("Netgate") (cherry picked from commit 8d9de5b10a24bd2d79ed99f139c0ac28c09b15ca)
* Support proxying FTP over HTTPS, not just HTTP.Dag-Erling Smørgrav2021-04-281-1/+2
| | | | | | | | | | | | There is probably a PR for this, but I can't find this, or remember who submitted it. The patch got lost in the noise of another that wasn't ready to commit. MFC after: 3 days Approved by: kp Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit b68815f0886031fcccb426b85484b18a282d1b8c)
* MFC r357579: libfetch: disallow invalid escape sequencesEd Maste2020-03-081-0/+3
| | | | | | | | | | | Per RFC1738 escape is "% hex hex"; other sequences do not form a valid URL. Suggested by: Matthew Dillon Reviewed by: Matthew Dillon Sponsored by: The FreeBSD Foundation Notes: svn path=/stable/12/; revision=358750
* MFC 357212.Gordon Tetlow2020-01-281-2/+8
| | | | | | | | | | | | Fix urldecode buffer overrun. Reported by: Duncan Overbruck Approved by: so Security: FreeBSD-SA-20:01.libfetch Security: CVE-2020-7450 Notes: svn path=/stable/12/; revision=357213
* Add Makefile.depend.optionsSimon J. Gerraty2019-12-192-3/+9
| | | | | | | | | | | | | | | | | | | | | | | Leaf directories that have dependencies impacted by options need a Makefile.depend.options file to avoid churn in Makefile.depend DIRDEPS for cases such as OPENSSL, TCP_WRAPPERS etc can be set in local.dirdeps-options.mk which can add to those set in Makefile.depend.options See share/mk/dirdeps-options.mk Also update affected Makefile.depend files. MFC of r355616 and r355617 Reviewed by: bdrewery Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org/D22469 Notes: svn path=/stable/12/; revision=355906
* MFC r351573:Mark Johnston2019-09-083-3/+23
| | | | | | | Document fetchReqHTTP(). Notes: svn path=/stable/12/; revision=352042
* Make libfetch buildable.Jung-uk Kim2018-09-191-0/+4
| | | | Notes: svn path=/projects/openssl111/; revision=338779
* Fix an inverted conditional in the netrc code, which would ignore theDag-Erling Smørgrav2018-05-293-14/+34
| | | | | | | | | | | | value of $HOME and always use the home directory from the passwd database, unless $HOME was unset, in which case it would use (null). While there, clean up handling of netrcfd and add debugging aids. MFC after: 3 weeks Notes: svn path=/head/; revision=334326
* Fix a few (but far from all) style issues.Dag-Erling Smørgrav2018-05-291-24/+29
| | | | | | | MFC after: 3 weeks Notes: svn path=/head/; revision=334319
* Use __VA_ARGS__ to simplify the DEBUG macro.Dag-Erling Smørgrav2018-05-295-51/+52
| | | | | | | MFC after: 3 weeks Notes: svn path=/head/; revision=334317
* Preserve if-modified-since timestamps across redirects.Dag-Erling Smørgrav2018-05-121-0/+1
| | | | | | | | PR: 224426 MFC after: 1 week Notes: svn path=/head/; revision=333571
* SPDX: use the Beerware identifier.Pedro F. Giffuni2017-11-301-1/+1
| | | | Notes: svn path=/head/; revision=326408
* lib: further adoption of SPDX licensing ID tags.Pedro F. Giffuni2017-11-267-0/+14
| | | | | | | | | | | | | | | Mainly focus on files that use BSD 2-Clause license, however the tool I was using mis-identified many licenses so this was mostly a manual - error prone - task. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. Notes: svn path=/head/; revision=326219
* DIRDEPS_BUILD: Update dependencies.Bryan Drewery2017-10-311-1/+0
| | | | | | | Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=325188
* In fetch_resolve(), if the port number or service name is included inDag-Erling Smørgrav2017-08-181-1/+1
| | | | | | | | | | | | | | | | the host argument (e.g. "www.freebsd.org:443"), the service pointer, which is supposed to point to the port or service part, instead points to the separator, causing getaddrinfo() to fail. Note that I have not been able to trigger this bug with fetch(1), nor do I believe it is possible, as libfetch always parses the host:port specification itself. I discovered it when I copied fetch_resolve() into an unrelated project. MFC after: 3 days Notes: svn path=/head/; revision=322669
* r308996 broke IP literals by assuming that a colon could only occur asDag-Erling Smørgrav2017-03-173-42/+49
| | | | | | | | | | | | | | | | | | a separator between host and port, and using strchr() to search for it. Rewrite fetch_resolve() so it handles bracketed literals correctly, and remove similar code elsewhere to avoid passing unbracketed literals to fetch_resolve(). Remove #ifdef INET6 so we still parse IP literals correctly even if we do not have the ability to connect to them. While there, fix an off-by-one error which caused HTTP 400 errors to be misinterpreted as redirects. PR: 217723 MFC after: 1 week Reported by: bapt, bz, cem, ngie Notes: svn path=/head/; revision=315455
* Add a __printflike() that would have caught the bug fixed in r314396.Dag-Erling Smørgrav2017-03-121-1/+1
| | | | Notes: svn path=/head/; revision=315143
* libfetch: extra bounds checking through reallocarray(3).Pedro F. Giffuni2017-03-061-1/+1
| | | | | | | | Reviewed by: des MFC after: 1 week Notes: svn path=/head/; revision=314778
* Fix partial requests (used by fetch -r) when the requested file isDag-Erling Smørgrav2017-03-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | already complete. Since 416 is an error code, any Content-Range header in the response would refer to the error message, not the requested document, so relying on the value of size when we know we got a 416 is wrong. Instead, just verify that offset == 0 and assume that we've reached the end of the document (if offset > 0, we did not request a range, and the server is screwing with us). Note that we cannot distinguish between reaching the end and going past it, but that is a flaw in the protocol, not in the code, so we just have to assume that the caller knows what it's doing. A smart caller would request an offset slightly before what it believes is the end and compare the result to what is already in the file. PR: 212065 Reported by: mandree MFC after: 3 weeks Notes: svn path=/head/; revision=314701
* Properly initialize netrcfd in fetchParseURLBaptiste Daroussin2017-03-031-0/+1
| | | | | | | | | | | This fixes ftp with fetch(1) which was broken after r313974 Submitted by: dim Reported by: olivier Pointyhat to: bapt Notes: svn path=/head/; revision=314596
* Properly indent a default: label and avoid crashing when runningBjoern A. Zeeb2017-02-281-2/+2
| | | | | | | | | | under -v but cannot connect due to trying to print an int as %s [1]. Reported by: andrew [1] MFC after: 3 days Notes: svn path=/head/; revision=314396
* Add a file descriptor in struct url for netrcBaptiste Daroussin2017-02-203-9/+23
| | | | | | | | | | | | | | | | When using libfetch in an application that drops privileges when fetching like pkg(8) then user complain because the application does not read anymore ${HOME}/.netrc. Now a caller can prepare a fd to the said file and manually assign it to the structure. It is also a first step to allow to capsicumize libfetch applications Reviewed by: allanjude, des Approved by: des Differential Revision: https://reviews.freebsd.org/D9678 Notes: svn path=/head/; revision=313974
* Fix inverted loop condition which broke multi-line responses to CONNECT.Dag-Erling Smørgrav2016-12-301-1/+1
| | | | | | | | | PR: 194483 Submitted by: Miłosz Kaniewski <milosz.kaniewski@gmail.com> MFC after: 1 week Notes: svn path=/head/; revision=310823
* More debugging code I missed in r309051.Dag-Erling Smørgrav2016-12-091-1/+0
| | | | | | | Reported by: jbeich, jkim Notes: svn path=/head/; revision=309738
* Remove debugging code.Dag-Erling Smørgrav2016-11-231-4/+0
| | | | Notes: svn path=/head/; revision=309051
* Refactor fetch_connect() and fetch_bind() to improve readability and avoidDag-Erling Smørgrav2016-11-223-54/+129
| | | | | | | | | repeating the same DNS lookups. MFC after: 3 weeks Notes: svn path=/head/; revision=308996
* r169386 (PR 112515) was incomplete: it treated 307 as an error exceptDag-Erling Smørgrav2016-05-311-0/+3
| | | | | | | | | | | | | | | | in verbose mode, and did not handle 308 at all. r241840 (PR 172451) added support for 308, but with the same bug. Correctly handle both by recognizing them as redirects in all places where we check the HTTP result code. PR: 112515 173451 209546 Submitted by: novel@ MFC after: 1 week Notes: svn path=/head/; revision=301027
* Call closedir() before returning from fetchListFile() to avoid a leak.Don Lewis2016-05-251-0/+1
| | | | | | | | | Reported by: Coverity CID: 1016697 MFC after: 1 week Notes: svn path=/head/; revision=300666
* Don't leak addrinfo in fetch_bind()Don Lewis2016-05-251-1/+4
| | | | | | | | | Reported by: Coverity CID: 1225038 MFC after: 1 week Notes: svn path=/head/; revision=300665
* Use strlcpy() instead of strncpy() to copy the string returned byDon Lewis2016-05-121-1/+1
| | | | | | | | | | | | | | | setlocale() so that static analyzers know that the string is NUL terminated. This was causing a false positive in Coverity even though the longest string returned by setlocale() is ENCODING_LEN (31) and we are copying into a 64 byte buffer. This change is also a bit of an optimization since we don't need the strncpy() feature of padding the rest of the destination buffer with NUL characters. Reported by: Coverity CID: 974654 Notes: svn path=/head/; revision=299520
* lib: minor spelling fixes in comments.Pedro F. Giffuni2016-05-011-2/+2
| | | | | | | No functional change. Notes: svn path=/head/; revision=298896
* MFHGlen Barber2016-04-111-1/+1
|\ | | | | | | | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/release-pkg/; revision=297824
| * libfetch: replace 0 with NULL for pointers.Pedro F. Giffuni2016-04-091-1/+1
| | | | | | | | | | | | | | | | | | Found with devel/coccinelle. Reviewed by: des Notes: svn path=/head/; revision=297754
* | MFHGlen Barber2016-04-041-11/+17
|\| | | | | | | | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/release-pkg/; revision=297567
| * Fix bunch of .Xrs.Edward Tomasz Napierala2016-03-281-1/+0
| | | | | | | | | | | | | | | | MFC after: 1 month Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=297355
| * Update fetch.1 and fetch.3 to reflect libfetch's actual use of CA bundlesMichael Gmelin2016-03-191-10/+17
| | | | | | | | | | | | | | | | | | | | Reviewed by: wblock Approved by: wblock MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D5558 Notes: svn path=/head/; revision=297052
* | MFHGlen Barber2016-03-021-6/+0
|\| | | | | | | | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/release-pkg/; revision=296318
| * DIRDEPS_BUILD: Regenerate without local dependencies.Bryan Drewery2016-02-241-6/+0
| | | | | | | | | | | | | | | | | | | | | | These are no longer needed after the recent 'beforebuild: depend' changes and hooking DIRDEPS_BUILD into a subset of FAST_DEPEND which supports skipping 'make depend'. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=295989
* | MFHGlen Barber2016-02-151-1/+0
|\| | | | | | | | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/release-pkg/; revision=295639
| * Fix double-free error: r289419 moved all error handling in http_connect()Dag-Erling Smørgrav2016-02-111-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | to the end of the function, but did not remove a fetch_close() call which was made redundant by the one in the shared error-handling code. PR: 206774 Submitted by: Christian Heckendorf <heckendorfc@gmail.com> MFC after: 3 days Notes: svn path=/head/; revision=295536
* | First pass through library packaging.Glen Barber2016-02-041-0/+1
|/ | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/release-pkg/; revision=295278
* Test for /etc/ssl/cert.pem existence to avoid masking SSL_CA_CERT_PATHBaptiste Daroussin2016-01-191-3/+10
| | | | | | | | | | | | | | | | | | | | Prior to this patch, unless SSL_CA_CERT_FILE is set in the environment, libfetch will set the CA file to "/usr/local/etc/cert.pem" if it exists, and to "/etc/ssl/cert.pem" otherwise. This has the consequence of masking SSL_CA_CERT_PATH, because OpenSSL will ignore the CA path if a CA file is set but fails to load (see X509_STORE_load_locations()). While here, fall back to OpenSSL defaults if neither SSL_CA_CERT_FILE nor SSL_CA_CERT_PATH are set in the environment, and if neither of the libfetch default CA files exists. PR: 193871 Submitted by: John W. O'Brien <john@saltant.com> Approved by: des MFC after: 1 week Notes: svn path=/head/; revision=294326
* As a followup to r292330, standardize on size_t and add a few comments.Dag-Erling Smørgrav2015-12-161-2/+5
| | | | Notes: svn path=/head/; revision=292332
* Reset bufpos to 0 immediately after refilling the buffer. Otherwise, weDag-Erling Smørgrav2015-12-161-3/+2
| | | | | | | | | | | | | risk leaving the connection in an indeterminate state if the server fails to send a chunk delimiter. Depending on the application and on the sizes of the preceding chunks, the result can be anything from missing data to a segfault. With this patch, it will be reported as a protocol error. PR: 204771 MFC after: 1 week Notes: svn path=/head/; revision=292330
* Fix buildworld after r291453, similar to r284346: url->user and url->pwdDimitry Andric2015-11-291-4/+2
| | | | | | | | | | are arrays, so they can never be NULL. Reported by: many Pointy hat to: des Notes: svn path=/head/; revision=291461
* Use .netrc for HTTP sites and proxies, not just FTP.Dag-Erling Smørgrav2015-11-292-3/+11
| | | | | | | | | PR: 193740 Submitted by: TEUBEL György <tgyurci@gmail.com> MFC after: 1 week Notes: svn path=/head/; revision=291453
* META MODE: Prefer INSTALL=tools/install.sh to lessen the need for xinstall.host.Bryan Drewery2015-11-251-1/+0
| | | | | | | | | | | This both avoids some dependencies on xinstall.host and allows bootstrapping on older releases to work due to lack of at least 'install -l' support. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=291307
generated by cgit v1.3 (git 2.53.0) at 2026-08-01 13:07:20 +0000