diff --git a/0044-curl-7.61.1-retry-http11.patch b/0044-curl-7.61.1-retry-http11.patch new file mode 100644 index 0000000000000000000000000000000000000000..6c9dd4982b6e5789f0c1270f512905cb3495bb48 --- /dev/null +++ b/0044-curl-7.61.1-retry-http11.patch @@ -0,0 +1,112 @@ +From 78b62ef1206621e8f4f1628ad4eb0a7be877c96f Mon Sep 17 00:00:00 2001 +From: Johannes Schindelin +Date: Fri, 7 Dec 2018 17:04:39 +0100 +Subject: [PATCH] Upon HTTP_1_1_REQUIRED, retry the request with HTTP/1.1 + +This is a companion patch to cbea2fd2c (NTLM: force the connection to +HTTP/1.1, 2018-12-06): with NTLM, we can switch to HTTP/1.1 +preemptively. However, with other (Negotiate) authentication it is not +clear to this developer whether there is a way to make it work with +HTTP/2, so let's try HTTP/2 first and fall back in case we encounter the +error HTTP_1_1_REQUIRED. + +Note: we will still keep the NTLM workaround, as it avoids an extra +round trip. + +Daniel Stenberg helped a lot with this patch, in particular by +suggesting to introduce the Curl_h2_http_1_1_error() function. + +Closes #3349 + +Signed-off-by: Johannes Schindelin + +Upstream-commit: d997aa0e963c5be5de100dccdc5208d39bd3d62b +Signed-off-by: Kamil Dudka +--- + lib/http2.c | 8 ++++++++ + lib/http2.h | 4 ++++ + lib/multi.c | 20 ++++++++++++++++++++ + 3 files changed, 32 insertions(+) + +diff --git a/lib/http2.c b/lib/http2.c +index d769193..3071097 100644 +--- a/lib/http2.c ++++ b/lib/http2.c +@@ -2300,6 +2300,14 @@ void Curl_http2_cleanup_dependencies(struct Curl_easy *data) + Curl_http2_remove_child(data->set.stream_depends_on, data); + } + ++/* Only call this function for a transfer that already got a HTTP/2 ++ CURLE_HTTP2_STREAM error! */ ++bool Curl_h2_http_1_1_error(struct connectdata *conn) ++{ ++ struct http_conn *httpc = &conn->proto.httpc; ++ return (httpc->error_code == NGHTTP2_HTTP_1_1_REQUIRED); ++} ++ + #else /* !USE_NGHTTP2 */ + + /* Satisfy external references even if http2 is not compiled in. */ +diff --git a/lib/http2.h b/lib/http2.h +index 21cd9b8..91e504c 100644 +--- a/lib/http2.h ++++ b/lib/http2.h +@@ -59,6 +59,9 @@ CURLcode Curl_http2_add_child(struct Curl_easy *parent, + void Curl_http2_remove_child(struct Curl_easy *parent, + struct Curl_easy *child); + void Curl_http2_cleanup_dependencies(struct Curl_easy *data); ++ ++/* returns true if the HTTP/2 stream error was HTTP_1_1_REQUIRED */ ++bool Curl_h2_http_1_1_error(struct connectdata *conn); + #else /* USE_NGHTTP2 */ + #define Curl_http2_init(x) CURLE_UNSUPPORTED_PROTOCOL + #define Curl_http2_send_request(x) CURLE_UNSUPPORTED_PROTOCOL +@@ -74,6 +77,7 @@ void Curl_http2_cleanup_dependencies(struct Curl_easy *data); + #define Curl_http2_add_child(x, y, z) + #define Curl_http2_remove_child(x, y) + #define Curl_http2_cleanup_dependencies(x) ++#define Curl_h2_http_1_1_error(x) 0 + #endif + + #endif /* HEADER_CURL_HTTP2_H */ +diff --git a/lib/multi.c b/lib/multi.c +index 0f57fd5..d64ba94 100644 +--- a/lib/multi.c ++++ b/lib/multi.c +@@ -46,6 +46,7 @@ + #include "vtls/vtls.h" + #include "connect.h" + #include "http_proxy.h" ++#include "http2.h" + /* The last 3 #include files should be in this order */ + #include "curl_printf.h" + #include "curl_memory.h" +@@ -1943,6 +1944,25 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi, + done = TRUE; + } + } ++ else if((CURLE_HTTP2_STREAM == result) && ++ Curl_h2_http_1_1_error(data->easy_conn)) { ++ CURLcode ret = Curl_retry_request(data->easy_conn, &newurl); ++ ++ infof(data, "Forcing HTTP/1.1 for NTLM"); ++ data->set.httpversion = CURL_HTTP_VERSION_1_1; ++ ++ if(!ret) ++ retry = (newurl)?TRUE:FALSE; ++ else ++ result = ret; ++ ++ if(retry) { ++ /* if we are to retry, set the result to OK and consider the ++ request as done */ ++ result = CURLE_OK; ++ done = TRUE; ++ } ++ } + + if(result) { + /* +-- +2.37.3 + diff --git a/curl.spec b/curl.spec index 64d504a0bddcbd3300632854dab8f490fa441c53..06bb183c37ce8702b1f62e2a04156e51341d661e 100644 --- a/curl.spec +++ b/curl.spec @@ -1,8 +1,8 @@ -%define anolis_release .0.1 +%define anolis_release .0.2 Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Name: curl Version: 7.61.1 -Release: 25%{anolis_release}%{?dist} +Release: 25%{anolis_release}%{?dist}.1 License: MIT Source: https://curl.haxx.se/download/%{name}-%{version}.tar.xz @@ -122,6 +122,9 @@ Patch41: 0041-curl-7.61.1-CVE-2022-32206.patch # setopt: enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION (#2063703) Patch42: 0042-curl-7.61.1-ssh-known-hosts.patch +# upon HTTP_1_1_REQUIRED, retry the request with HTTP/1.1 (#2139337) +Patch44: 0044-curl-7.61.1-retry-http11.patch + # patch making libcurl multilib ready Patch101: 0101-curl-7.32.0-multilib.patch @@ -347,6 +350,7 @@ sed -e 's|:8992/|:%{?__isa_bits}92/|g' -i tests/data/test97{3..6} %patch40 -p1 %patch41 -p1 %patch42 -p1 +%patch44 -p1 # make tests/*.py use Python 3 sed -e '1 s|^#!/.*python|#!%{__python3}|' -i tests/*.py @@ -510,9 +514,12 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %doc docs/TheArtOfHttpScripting docs/TODO %changelog -* Tue Jan 03 2023 Weisson - 7.61.1-25.0.1 +* Mon Jan 30 2023 Weisson - 7.61.1-25.0.2.1 - Add doc sub package +* Fri Nov 18 2022 Kamil Dudka - 7.61.1-25.el8_7.1 +- upon HTTP_1_1_REQUIRED, retry the request with HTTP/1.1 (#2139337) + * Wed Jun 29 2022 Kamil Dudka - 7.61.1-25 - setopt: enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION (#2063703) - fix HTTP compression denial of service (CVE-2022-32206) diff --git a/dist b/dist index 9c0e36ec42a2d9bfefacb21ac6354c9ddd910533..535c6900412d365bb0ff6de8d1f27110833b3ae3 100644 --- a/dist +++ b/dist @@ -1 +1 @@ -an8 +an8_7