Re: [PATCH 0/4] dropping support for older curl

From: Jeff King <peff@peff.net>
Date: Aug 10, 2017, 23:23 UTC
Message-ID: <20170810232315.twkrj32er552bryg@sigill.intra.peff.net>
In-Reply-To: <c8a2716d-76ac-735c-57f9-175ca3acbcb0@jupiterrise.com>

On Fri, Aug 11, 2017 at 01:17:51AM +0200, Tom G. Christensen wrote:

Show 8 quoted lines

> > OK, thanks for double-checking. I'm still puzzled why your build
> > succeeds and mine does not.
> 
> I know what's going on now and it's so simple.
> Red Hats version of curl 7.15.5 includes a number of patches including one
> that backports support for CURLPROTO_* (as part of a fix for CVE-2009-0037).
> I haven't checked el6 but I would not be surprised if there where similar
> things going on there.

el6 should have it already as part of 7.19.7, right?

> So in conclusion version based #ifdefs are misleading when used with curl as
> shipped with RHEL.

Yeah, that's certainly an interesting finding. In this case your builds are missing out on redirect protection that we _could_ be providing.

If we do keep the compat ifdefs around this feature, it may be worth converting them to "#ifdef CURLPROTO_HTTP" to more directly check the feature.

-Peff