Commit Graph

55 Commits

Author SHA1 Message Date
emaste
1adde9351c libfetch: disallow invalid escape sequences
Per RFC1738 escape is "% hex hex"; other sequences do not form a valid URL.

Suggested by:	Matthew Dillon
Reviewed by:	Matthew Dillon
MFC after:	1 week
2020-02-05 16:55:00 +00:00
gordon
17d91d18a8 Fix urldecode buffer overrun.
Reported by:	Duncan Overbruck
Security:	CVE-2020-7450
2020-01-28 18:37:18 +00:00
des
76f1068313 Improve URL parsing. In particular, convert scheme and host to lowercase.
MFC after:	1 week
2018-11-27 10:45:14 +00:00
des
34a324be57 Fix an inverted conditional in the netrc code, which would ignore the
value of $HOME and always use the home directory from the passwd
database, unless $HOME was unset, in which case it would use (null).

While there, clean up handling of netrcfd and add debugging aids.

MFC after:	3 weeks
2018-05-29 13:07:36 +00:00
des
c3d70f46d2 Use __VA_ARGS__ to simplify the DEBUG macro.
MFC after:	3 weeks
2018-05-29 10:28:20 +00:00
pfg
260ba0bff1 lib: further adoption of SPDX licensing ID tags.
Mainly focus on files that use BSD 2-Clause license, however the tool I
was using mis-identified many licenses so this was mostly a manual - error
prone - task.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.
2017-11-26 02:00:33 +00:00
des
95071c34d6 r308996 broke IP literals by assuming that a colon could only occur as
a separator between host and port, and using strchr() to search for it.
Rewrite fetch_resolve() so it handles bracketed literals correctly, and
remove similar code elsewhere to avoid passing unbracketed literals to
fetch_resolve().  Remove #ifdef INET6 so we still parse IP literals
correctly even if we do not have the ability to connect to them.

While there, fix an off-by-one error which caused HTTP 400 errors to be
misinterpreted as redirects.

PR:		217723
MFC after:	1 week
Reported by:	bapt, bz, cem, ngie
2017-03-17 14:18:52 +00:00
bapt
bca61d04be Properly initialize netrcfd in fetchParseURL
This fixes ftp with fetch(1) which was broken after r313974

Submitted by:	dim
Reported by:	olivier
Pointyhat to:	bapt
2017-03-03 12:51:16 +00:00
bapt
44a7c65850 Add a file descriptor in struct url for netrc
When using libfetch in an application that drops privileges when fetching
like pkg(8) then user complain because the application does not read anymore
${HOME}/.netrc. Now a caller can prepare a fd to the said file and manually
assign it to the structure.

It is also a first step to allow to capsicumize libfetch applications

Reviewed by:	allanjude, des
Approved by:	des
Differential Revision:	https://reviews.freebsd.org/D9678
2017-02-20 00:14:31 +00:00
kientzle
7a1b8ef999 Fix -Wunsequenced warning.
Submitted by:	dt71@gmx.com
2013-06-29 15:51:27 +00:00
emaste
b6c463eabc Support percent-encoded user and password
RFC 1738 specifies that any ":", "@", or "/" within a user name or
password in a URL is percent-encoded, to avoid ambiguity with the use
of those characters as URL component separators.

Reviewed by:    rstone@
MFC after:	1 month
2012-04-11 15:42:02 +00:00
des
5d19d6ad80 latin1 -> utf8 2011-10-19 11:43:51 +00:00
des
b99d90c0bb Update copyright dates and strip my middle name. 2011-09-27 18:57:26 +00:00
murray
a12379d1b7 1. Update fetch to consistently return 1 on error, as the man page states,
rather than usually returning 1 but in a few instances using a sysexits(3)
   return value.

2. Remove a few unused variables from libfetch.

PR:		docs/122470  (1, only)
Reviewed by:	des
> Description of fields to fill in above:                     76 columns --|
> PR:            If a GNATS PR is affected by the change.
> Submitted by:  If someone else sent in the change.
> Reviewed by:   If someone else reviewed your modification.
> Approved by:   If you needed approval for this commit.
> Obtained from: If the change is from a third party.
> MFC after:     N [day[s]|week[s]|month[s]].  Request a reminder email.
> Security:      Vulnerability reference (one per line) or description.
> Empty fields above will be automatically removed.

M    usr.bin/fetch/fetch.c
M    lib/libfetch/fetch.c
2008-12-17 18:00:18 +00:00
des
d198b4b8bb As several people pointed out, I did all the ctype casts the wrong
way (not for the first time...)

Noticed by:	bde, ru ++
MFC after:	1 week
2007-12-19 00:26:36 +00:00
des
ddf13e4c29 Old patch I had lying around: correctly cast the argument to is*().
IWBNI gcc could warn about this the way it warns about printf() abuse.

MFC after:	1 week
2007-12-18 10:41:12 +00:00
des
a1830118ba Clean up namespace violations.
MFC after:	1 week
2007-12-14 10:26:58 +00:00
des
d59f3ddc7e Update copyright years. 2004-09-21 18:35:21 +00:00
des
7a494517a4 style(9): add parentheses to sizeof even when not strictly required.
MFC after:	3 days
2003-01-28 08:04:40 +00:00
des
cead81021c Initialization paranoia. 2003-01-22 17:53:15 +00:00
des
ce6d4c4a6e Add SSL support + slight cleanup.
Submitted by:	Henry Whincup <henry@techiebod.com> (in principle)
2002-06-05 12:46:36 +00:00
des
ec29926e4d Reindent, and add parentheses to return statements. Some functions in
ftp.c and http.c now have exceedingly long lines due to deep nesting;
this will be corrected by reorganizing the code in a later revision.
2002-02-05 22:13:51 +00:00
des
95a4ae2830 Eliminate a redundant loop. 2002-02-05 21:32:16 +00:00
des
e37508b70c Remove VT100 escapes from debugging messages now that they're enabled by
default.

PR:		32988
MFC after:	3 days
2002-01-01 14:48:09 +00:00
des
a9520ca9d7 Introduce a fetchDebug global. Change the DEBUG macro so it only runs the
debugging code if fetchDebug is set.

PR:		bin/32615
MFC after:	1 week
2001-12-09 15:05:19 +00:00
dillon
9e8adf09a9 Add __FBSDID()s to libfetch 2001-09-30 21:36:09 +00:00
se
742d7aada7 The fix for schemeless and hostless URLs (rev. 1.27) broke the schemeless
proxy specification, which seems to be valid according to the man page.

Change the logic to consider "hostname:port" a hostname and port instead
of a file URL.

Approved by:	des
2001-07-28 21:28:14 +00:00
des
35acbfe0b3 Unbreak parsing URLs that have a host part but no document part.
While we're here, fix a snprintf() usage warning.
2001-07-17 20:22:33 +00:00
des
0ca9dbc9d1 Handle shemeless, hostless URLs correctly. 2001-07-08 15:59:15 +00:00
des
4f0b341263 Add rudimentary support for an authentication callback function. 2001-05-26 19:37:15 +00:00
archie
21cf7b313e Apply 'const' liberally.
Fix some other minor glitches.
2001-04-24 00:06:21 +00:00
des
ae0af0d011 Avoid a segfault (due to an unitialized pointer) when parsing URLs that have
no scheme or host part.
2000-12-13 11:21:09 +00:00
des
1d928c8e6e Clean up the whitespace encoding code. 2000-12-01 11:04:57 +00:00
des
9c7c34c6a0 Use CHECK_FLAG 2000-10-29 15:56:10 +00:00
des
cbb8cbedb3 If the scheme is HTTP or HTTPS, percent-escape whitespace in the document
part.

Submitted by:	green
2000-10-21 14:58:18 +00:00
des
238c26fcae Relax URL syntax so that schemeless URLs are supported. 2000-10-12 22:07:49 +00:00
des
c99122fbde The decision to use an HTTP proxy for FTP documents belongs in the FTP code 2000-07-21 10:46:22 +00:00
des
3033318809 Introduce fetchXGet*(), which combine the functionalities of fetchGet*() and
fetchStat*().  In most cases, either fetchGet*() or fetchXGet*() is a wrapper
around the other; in all cases, calling fetchGet*() is identical to calling
fetchXGet*() with the second argument set to NULL.
2000-07-17 21:25:00 +00:00
des
c1df3803c6 Introduce the (undocumented) variable fetchRestartCalls, which controls whether
or not interrupted system calls will be restarted. This fixes a bug where
fetch(1) would hang (potentially forever) if a server stopped responding,
because the signal handler would absorb the user's efforts to interrupt the
transfer.
2000-07-17 20:49:39 +00:00
des
59892af9b1 Add (and document) fetchMakeURL() 2000-05-25 16:46:09 +00:00
des
e5d7688f99 Dump com_err, it's a stinking crock of shit. 2000-05-25 16:24:31 +00:00
ume
1db238984d IPv6 support. 2000-05-20 18:23:51 +00:00
ume
3194168ffc Make HTTP_PROXY work for FTP.
Reported by:	Ben Smithurst <ben@scientia.demon.co.uk>
Reviewed by:	des
2000-05-15 09:05:36 +00:00
des
a9ed660f51 Reorganize some of the http code and split it into more functions.
Implement fetchStatHTTP().
Unbungle struct url, and add fetchFreeURL().
Document it.
2000-05-11 13:31:02 +00:00
des
0ee0a9878b Use sizeof more consistently. 2000-05-07 20:02:52 +00:00
des
c701cfdd7c More old uncommitted patches: implement timeouts at the protocol level.
Currently only supported for ftp connections.
2000-01-07 12:58:40 +00:00
peter
76f0c923fe $Id$ -> $FreeBSD$ 1999-08-28 00:22:10 +00:00
des
9eb6071298 Implement and document file list retrieval. 1998-12-21 19:41:50 +00:00
des
37f6ae6efa Add verbose flag, and support functions.
Brucify the Makefile.
Differentiate atime and mtime in fetch*Stat().
Fix a few pointer bugs.
Tweak some error messages.
Don't #include sys/param.h and stdio.h in fetch.h.
Document that sys/param.h and stdio.h must be #included before fetch.h.
1998-12-16 10:24:55 +00:00
des
93ce759c73 Second of a series of cleanups to libfetch.
This commit introduces the following features:

 a) the fetchStat*() functions, which return meta-information for a
    document, such as size, modification time, etc.

 b) the use of the com_err(3) facilities to report errors.

It also fixes a bunch of style bugs and a few logic bugs and somewhat
improves the man page.

Changed files, in alphabetical order:

 Makefile:
  Don't generate macros in {ftp,http}err.c.

  Generate category fields for the error message lists.

  Compile the error table.

  Install fetch_err.h along with fetch.h.

 common.c:
  Remove the _netdb_errstring() macro, and add FETCH_ERR_NETDB to the
  error code in the _netdb_seterr() macro.

  Add categories to the _netdb_errlist table.

  Report errors through the Common Error library.

 common.h:
  Add the DEBUG macros.

  Add prototype for fetchConnect().

  Remove the prototype for _fetch_errstring(), which is local to common.c

  Add a categroy field to struct fetcherr, and define constants for
  error categories.

  Define macros for _{url,netdb,ftp,http}_seterr().

 errors.et: (new file)
  List error categories.

 fetch.3:
  Document the fetchStat*() functions.

  Move the "unimplemented functionality" comments from NOTES to BUGS.

  Document that applications which use libfetch must also use
  libcom_err, and list existing error codes.

  Undocument fetchLastErr{Code,String}.

  Remove the (empty) DIAGNOSTICS section.

  Mention Eugene Skepner in the AUTHORS section.

 fetch.c:
  Move the DEBUG macros to common.c

  Add fetchStat() and fetchStatURL().

  Generate error messages for URL parser errors, and fix a minor bug
  in the parser.

  Use 'struct url' instead of 'url_t'.

  Remove fetchLastErr{Code,String}.

 fetch.h:
  Use 'struct url' instead of 'url_t', and remove the typedef.

  Define struct url_stat (used by fetchStat()).

  Add prototypes for fetchStat*().

  Remove the declarations for fetchLastErr{Code,String}.

  Include fetch_err.h.

 fetch_err.et: (new file)
  Error table for libfetch.

 file.c:
  Add fetchStatFile().

  Use 'struct url' instead of 'url_t'.

 ftp.c:
  Add fetchStatFTP().

  Use 'struct url' instead of 'url_t'.

  Don't use fetchLastErrCode.

 ftp.errors:
  Add categories to all error messages.

 http.c:
  Add fetchStatHTTP().

  Use 'struct url' instead of 'url_t'.

  Don't use fetchLastErr{Code,Text}.

 http.errors:
  Add categories to all error messages.

Prompted by: jkh and Eugene Skepner
Numerous sugestions from: Garett Wollman and Eugene Skepner
1998-11-06 22:14:08 +00:00