b6b195707f
Fix --server-response for HTTP/1.1 ( #705 )
...
* libwget/http.c (wget_http_get_response_cb): Clone header memory.
2025-12-30 17:07:31 +01:00
b966fa041a
* libwget/ssl_openssl.c (wget_ssl_set_config_int): Ignore WGET_SSL_DANE
2025-12-29 20:04:39 +01:00
684be47852
Fix file overwrite issue with metalink
...
Fix a remotely triggered arbitrary file write/overwrite abusing
metalink <file name="…"> path traversal.
Reported-by: Arkadi <arkadva8@gmail.com >
2025-12-26 19:17:42 +01:00
ba4d64e443
Fix WolfSSL build
...
* Makefile.am: Run tests of GnuTLS is available.
* configure.ac: Add conditional WITH_GNUTLS_IN_TESTSUITE,
add check for SSLv2_client_method().
* libwget/ssl_wolfssl.c (wget_ssl_init): Silently fall back to
SSLv3 if SSLv2 is requested but not available.
2025-12-26 17:42:16 +01:00
4626211f57
* libwget/ssl_wolfssl.c (ShowX509): Fix -Wzero-as-null-pointer-constant
2025-12-26 17:42:16 +01:00
c2a9108c4d
Fix checks for errno
...
* libwget/ssl_gnutls.c (ssl_writev): Only check errno on error.
* src/job.c (job_validate_file): Set errno explicitly to 0.
* src/utils.c (mkdir_path): Check a secure value of errno.
* src/wget.c (prepare_file): Likewise.
2025-12-14 18:56:19 +01:00
a479b1aeaf
* html_url (html_get_url): Remove dead code (Coverity #209327 )
2025-12-07 18:09:29 +01:00
18165409bb
Fix gcc 15 -Wunterminated-string-initialization
...
* libwget/base64.c (base64_encode): Drop explicit error length.
* libwget/buffer_printf.c (convert_pointer): Likewise.
Just cosmetics - allows to build with -Werror.
2025-11-09 19:43:29 +01:00
b02444a10a
Fix gcc 15 -Wzero-as-null-pointer-constant
...
* libwget/logger.c (wget_logger_is_active): Fix warning.
* libwget/ssl_gnutls.c (verify_certificate_callback): Likewise.
* src/host.c (_search_host_for_free_job): Likewise.
* src/wget.c (main, input_thread): Likewise.
Just cosmetics - allows to build with -Werror.
2025-11-09 19:31:19 +01:00
07d10bd090
Drop iri->uri_allocated
...
* include/wget/wget.h (struct wget_iri_st): Remove uri_allocated.
* libwget/iri.c (wget_iri_free_content): Do not free iri->uri,
(wget_iri_clone): Simplify code and do not heap-allocate iri->uri.
2025-02-02 19:19:47 +01:00
9949f9d48d
Fix buffer overflow in wget_iri_clone() after wget_iri_set_scheme()
...
* fuzz/libwget_iri_fuzzer.c: Call wget_iri_clone() after wget_iri_set_scheme().
* libwget/iri.c (wget_iri_parse): Increase value of iri->msize,
(wget_iri_clone): Use wget_memdup() instead of malloc+memcpy,
(wget_iri_set_scheme): Tiny code cleanup.
Fixes: https://gitlab.com/gnuwget/wget2/-/issues/687
Reported-by: https://gitlab.com/gleurent
2025-02-02 19:19:32 +01:00
4d4d9b3a4d
Fix sorting of metalink mirrors by priority
...
* libwget/metalink.c (compare_mirror): Fix implementation.
Reported-by: Aidan Harris (https://gitlab.com/aidanharris )
2024-12-08 19:27:22 +01:00
ff735fce14
* libwget/iri.c (wget_iri_parse): Check for port number validity
2024-11-01 18:22:41 +01:00
1d6632a31c
* libwget/ssl_wolfssl.c (ShowX509): Add semicolon to end of XFREE()
...
Fixes https://github.com/rockdaboot/wget2/issues/351
2024-11-01 10:12:59 +01:00
dc8966d906
Don't log URI userinfo to logs
...
* include/wget/wget.h (struct wget_iri_st): Add safe_uri member.
* libwget/iri.c: New function create_safe_uri(),
(wget_iri_unescape_url_inline): Check iri->userinfo,
(wget_iri_parse): Likewise,
(wget_iri_clone): Likewise,
(wget_iri_relative_to_abs): Remove debug logs,
(wget_iri_set_scheme): Check iri->userinfo.
* src/blacklist.c: Log safe_uri instead of uri.
* src/host.c: Likewise.
* src/options.c: Likewise.
* src/stats_site.c: Likewise.
* src/wget.c: Likewise,
(queue_url_from_remote): Move redirection check further down.
* unit-tests/test.c (test_iri_parse): Add checks for safe_uri,
(test_iri_parse): Add safe_uri to IRI comparison,
Print safe_uri and password.
Co-authored-by: Tim Rühsen <tim.ruehsen@gmx.de >
2024-10-03 17:25:38 +02:00
8877050c3f
Count 0 as an error for SSL_read and SSL_write, per documentation
...
* libwget/ssl_openssl.c (ssl_transfer): Take 0 as error,
slightly refactor code.
Fixes https://github.com/rockdaboot/wget2/issues/342
Reported-by: Tobias Brick (he/him) <tobiasb@microsoft.com >
Co-authored-by: Tobias Brick (he/him) <tobiasb@microsoft.com >
2024-09-22 12:12:46 +02:00
182a4c8c0d
Merge pull request #345 from tobiasb-ms/tobiasb-ms/ssl-binary-request-body-debug-output
...
set debug_skip_body for OCSP requests in openssl tls provider
2024-09-22 11:47:14 +02:00
ffa79a561f
Add empty line after header with --save-headers
...
* libwget/http.c (wget_http_get_response_cb): Remove adding empty line.
* src/wget.c (prepare_file): Add empty line to headers.
Fixes https://github.com/rockdaboot/wget2/issues/347
2024-09-21 20:20:25 +02:00
3359e3e182
set debug_skip_body for OCSP requests in openssl tls provider
2024-09-16 15:34:19 +00:00
ec27488fea
Fix downloading multiple files via HTTP/2
...
* include/wget/wget.h: New function declaration wget_http_connection_receive_only().
* libwget/http.c: New function definition wget_http_connection_receive_only().
* libwget/http.h (struct wget_http_connection_st): Add member goaway.
* libwget/http2.c (struct http2_stream_context): Add member conn,
(on_frame_recv_callback): Handle NGHTTP2_GOAWAY,
(wget_http2_send_request): Initialize conn member.
* src/host.c (_release_job): Don't release parts if in 'done' state.
* src/wget.c (process_response_header): Remove handling of LINK headers,
(process_response): Add handling of LINK headers,
(downloader_thread): Handle pending responses correctly.
This patch fixes two related issues:
1. With HTTP/2, servers sometimes limit the number of requests per connection.
Beforethis patch, the connection was closed too early after GOAWAY and pending
responses weren't received.
2. In _release_job(), already downloaded parts of a file were erroneous released.
This caused successful metalink and chunked downloads to fail in combination with
a GOAWAY or a remotely closed connection.
2024-09-11 17:45:09 +02:00
c4c43209d5
Update progress report line every second
...
* src/wget.c: Add new function progress_report(),
add new declaration progress_report().
* src/wget.c (main): Start thread progress_report().
* src/bar.c: Increase BAR_THREAD_SLEEP_DURATION from 125 to 1000 millseconds.
* libwget/bar.c (bar_update_slot): Limit ratio to 100%, add TODO.
2024-09-06 16:42:12 +02:00
f5344eb415
Support connecting with HTTP/1.0 proxies
...
* libwget/http.c (establish_proxy_connect): Allow HTTP/1.0 responses
Fixes https://gitlab.com/gnuwget/wget2/-/issues/666
2024-09-05 13:28:32 +02:00
fa638f597c
Ignore 1xx HTTP responses
...
* libwget/http.c (wget_http_get_response_cb): Ignore 1xx responses.
Fixes https://github.com/rockdaboot/wget2/issues/340
2024-09-04 20:30:59 +02:00
7aa492f822
Fix confusing error message on Win32 "No CAs were found in ..."
...
* libwget/ssl.c (wget_ssl_default_ca_bundle_path): Check if file exists
2024-08-16 23:16:16 +02:00
8a739f0a71
Fix buffer overflow in progress bar
...
* libwget/bar.c (bar_set_progress): Check for minimum bar size.
2024-07-21 18:46:52 +02:00
29b3fc9db6
Consider connect timeout only when set
...
* libwget/net.c (set_socket_options): Skip SO_SNDTIMEO if connect timeout is <= 0.
Copyright-paperwork-exempt: Yes
2024-07-14 13:41:02 +02:00
21f41932af
Fix ignoring connect timeout (regression)
...
* libwget/net.c (set_socket_options): Set SO_SNDTIMEO for socket
Reported-by: https://gitlab.com/plvalerio
Co-authored-by: https://gitlab.com/RogerMarcoHernandez
2024-07-07 20:12:17 +02:00
0e60ece89a
Connect using synchronous socket
...
* libwget/dns.c (getaddrinfo_merging, resolve): Code cleanup.
* libwget/net.c (wget_tcp_connect): Connect first, then set socket to async.
Connecting asynchronously prevented wget2 to fallback to the next IP address
of a host when a connect error occurred.
Reported at https://github.com/rockdaboot/wget2/issues/325
2024-06-30 18:55:38 +02:00
4b2692120b
* libwget/bar.c: Add new function wget_bar_write_line_ext()
2024-06-01 18:11:50 +02:00
b9accafecb
* libwget/io.c (getline_internal): Clear memory to not trigger valgrind
2024-05-21 13:55:38 +02:00
de294c8ddf
* libwget/ssl_gnutls.c (verify_certificate_callback): Fix gcc warning -Wjump-misses-init
2024-05-19 20:02:31 +02:00
81cf05e1da
Move Win32 console save/restore from libwget into wget.c.
...
* libwget/init.c: Remove Win32 console code.
* src/wget.c: Add Win32 console code.
2024-05-19 19:58:29 +02:00
f4e7c46073
* libwget/ssl_gnutls.c (verify_certificate_callback): Fix 'do not translate debug strings'
2024-05-19 19:36:59 +02:00
543e1f2708
* libwget/ssl_gnutls.c (verify_certificate_callback): Warn about OCSP privacy leak
2024-05-19 19:29:32 +02:00
2b6bd2e190
Windows: handle ctrl+break to restore console modes
...
* libwget/init.c: Add HandleCtrlEvent(),
(global_exit): Restore console modes,
(global_init): Save console modes.
Copyright-paperwork-exempt: Yes
2024-05-19 13:34:30 +02:00
c556a3226a
* libwget/ssl_openssl.c (verify_ocsp): Fix segfault when OCSP response is missing
2024-05-19 13:05:11 +02:00
c341fcd1df
Disable explicit OCSP requests by default for TLS library functions
...
* libwget/ssl_openssl: Disable explicit OCSP requests by default.
* libwget/ssl_gnutls: Likewise.
* libwget/ssl_wolfssl.c: Likewise.
2024-05-19 12:46:40 +02:00
0895f92308
* libwget/ssl_gnutls.c: Improve messages for OCSP stapling
2024-05-18 14:46:07 +02:00
a96f88a054
-* libwget/ssl_gnutls.c (cert_verify_ocsp): Fix segfault when OCSP response is missing
2024-05-12 19:51:03 +02:00
53a8a88e84
Fix OCSP verification of first intermediate certificate.
...
* libwget/ssl_gnutls.c (verify_certificate_callback): Fix off-by-one check.
See https://gitlab.com/gnuwget/wget2/-/issues/664#note_1901610438
2024-05-12 15:14:36 +02:00
7929bf887c
Allow option --no-tcp-fastopen to work on Linux kernels >= 4.11.
...
* libwget/net.c (set_socket_options): Add check for tcp->tcp_fastopen.
Copyright-paperwork-exempt: Yes
2024-05-11 18:55:49 +02:00
761ae5082d
* libwget/cookie.c (cookie_db_load): Fix return value
2024-04-28 17:37:14 +02:00
235df6545e
* libwget/io.c (wget_update_load_fn): Fix parameter name
2024-04-28 17:36:29 +02:00
62ba66116c
Fix progress bar for multiple downloads
...
* libwget/bar.c (wget_bar_slot_begin): Remove numfiles handling,
(struct bar_slot): Remove member 'numfiles'.
Report: https://github.com/rockdaboot/wget2/issues/307
2024-04-01 18:10:58 +02:00
fbfa096506
* libwget/net.c (wget_tcp_connect): Fix return code on resolve failure
2024-04-01 15:43:45 +02:00
25b28e2c1a
* libwget/xml.c (xml_context): Add docs to member fields
2024-03-29 12:01:32 +01:00
9aeab55d09
Fix --no-parent for denormalized paths
...
* libwget/iri.c (wget_iri_parse): Normalize path part of URL.
* unit-tests/test.c (test_iri_parse): Add test with denormalized path.
2024-03-28 18:17:26 +01:00
d55ecc7113
Update gnulib link libraries
...
* fuzz/Makefile.am: Update gnulib link libraries.
* libwget/Makefile.am: Likewise.
* src/Makefile.am: Likewise.
* tests/Makefile.am: Likewise.
* unit-tests/Makefile.am: Likewise.
2024-03-24 15:58:27 +01:00
07b15e71f4
* libwget/robots.c: Fix robots.txt parser
...
Co-authored-by: Tim Rühsen <tim.ruehsen@gmx.de >
2024-03-15 19:33:13 +01:00
a033e97ac0
* libwget/cookie.c (cookie_db_load): Fix EOL removal
2024-01-07 12:47:24 +01:00
