From: Tom G. Christensen <tgc@jupiterrise.com>
Date: Thu, 10 Aug 2017 23:36:09 GMT
Subject: Re: [PATCH 0/4] dropping support for older curl
Message-ID: <030356f8-0472-7400-c9f6-7492788dd2d0@jupiterrise.com>
In-Reply-To: <20170810232315.twkrj32er552bryg@sigill.intra.peff.net>

On 11/08/17 01:23, Jeff King wrote:
> On Fri, Aug 11, 2017 at 01:17:51AM +0200, Tom G. Christensen wrote:
> 
>>> OK, thanks for double-checking. I'm still puzzled why your build
>>> succeeds and mine does not.
>>
>> I know what's going on now and it's so simple.
>> Red Hats version of curl 7.15.5 includes a number of patches including one
>> that backports support for CURLPROTO_* (as part of a fix for CVE-2009-0037).
>> I haven't checked el6 but I would not be surprised if there where similar
>> things going on there.
> 
> el6 should have it already as part of 7.19.7, right?
> 

Yes of course.

>> So in conclusion version based #ifdefs are misleading when used with curl as
>> shipped with RHEL.
> 
> Yeah, that's certainly an interesting finding. In this case your builds
> are missing out on redirect protection that we _could_ be providing.
> 

Yes and I'm looking into that right now.

> If we do keep the compat ifdefs around this feature, it may be worth
> converting them to "#ifdef CURLPROTO_HTTP" to more directly check the
> feature.
> 

Yes, a feature test would be better.

-tgc