bagder

scoring h2
TLS Handshake
  localhost...ok.
  curl.se...ipv4...ipv6...ok.
  nghttp2.org...ipv4...ipv6...ok.
httpd downloads
  https://one.http.curl.se:47541/score1.data: single...serial...parallel...ok.
  https://one.http.curl.se:47541/score10.data: single...serial...parallel...ok.
  https://one.http.curl.se:47541/score100.data: single...serial...parallel...ok.
httpd requests

bagder

#!/usr/bin/perl

# [scheme][divider][userinfo][hostname][port number][path][query][fragment]

my $num = $ARGV[0];

sub get_part
{
    my ($part, $g) = @_;
    my @a;

bagder

/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which

bagder

/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which

bagder

HTTP/3 options

• "HTTP/3 please". Attempt to use HTTP/3 but fallback to h1/h2 if h3 does not work. This option makes curl try h3 first and if that has not succeeded after N milliseconds, a second attempt using TLS+TCP is initiated and then the first to connect wins and is used. This might then also make h3 not get used if it is too slow. In a future, if a significant portion of servers run HTTP/3, we could consider enabling this option by default.

• "HTTP/3 only". Only try HTTP/3 against the given server and fail if h3 was

bagder

diff --git a/lib/http2.c b/lib/http2.c
index 3c8674cbf..ead356307 100644
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -391,12 +391,14 @@ static bool http2_connisdead(struct Curl_cfilter *cf, struct Curl_easy *data)
        not in use by any other transfer, there shouldn't be any data here,
        only "protocol frames" */
     CURLcode result;
     ssize_t nread = -1;
 

bagder

cd tests/httpd
$ pytest
===================================== test session starts =====================================
platform linux -- Python 3.10.9, pytest-7.2.0, pluggy-1.0.0+repack
httpd: [/usr/sbin/apache2]
rootdir: /home/daniel/src/curl/tests/httpd
collected 0 items / 1 error                                                                   

=========================================== ERRORS ============================================
______________________________ ERROR collecting test_01_basic.py ______________________________

bagder

$ cd tests/httpd/
$ pytest
===================================== test session starts =====================================
platform linux -- Python 3.10.9, pytest-7.2.0, pluggy-1.0.0+repack
httpd: [/usr/sbin/apache2]
rootdir: /home/daniel/src/curl/tests/httpd
collected 0 items / 1 error                                                                   

=========================================== ERRORS ============================================
______________________________ ERROR collecting test_01_basic.py ______________________________

bagder

HackerOne feedback

The site is slow

Going to the page and render it can take many seconds, even on a powerful machine with fast Internet.

Sometimes it seems that clicking on a notification does nothing and you have to reload the page.

bagder

Proxy credentials are cached without encryption (TOB-CURLTM-1)

The subject was brought up for discussion on the mailing list: https://curl.se/mail/lib-2022-09/0149.html - no actual changes for this have been made.

Lack of support for MQTT over TLS (TOB-CURLTM-2)

This remains an outstanding TODO. MQTT is a little used protocol in curl and this (MQTT over TLS) has not appeared much as a wanted feature.

No warnings when TLS connection attempts fail with the --ssl flag (TOB-CURLTM-3)