af6d8a10ad
Add a timeout to scgi tasks.
...
A hundred connections sending a partial header held the whole task pool.
2026-08-18 12:25:58 +02:00
9066afc063
Guard the unit multiplication in value commands against overflow.
...
The kb variants multiply the argument by 1024 without checking the range.
2026-08-18 11:58:47 +02:00
a2fabb10de
Range check the socket allocation and size values.
...
int64 arguments were truncated into uint32 setters, so -1 became 4294967295.
2026-08-18 11:38:01 +02:00
13e073d9ff
Reject division overflow in math.div and math.mod.
...
Dividing the smallest integer by -1 traps and takes the process with it.
2026-08-18 11:12:33 +02:00
d73f245692
Add a depth limit to the command parser.
...
A million nested braces in one argument exhausted the main thread's stack.
2026-08-18 10:52:38 +02:00
7db356cae4
Add a depth limit to json_to_object.
...
Deeply nested params recursed until the main thread's stack was exhausted.
2026-08-18 10:34:07 +02:00
8378c0a83a
Fix review: mark ipv4/ipv6 local_port safe, dedup port validation
...
- mark network.local_port.ipv4/ipv6 safe for untrusted RPC connections (mark_safe matches exact command keys).
- Replace duplicated multi-line port validation with a shared checked_local_port_value helper and single-line lambdas.
2026-08-17 11:29:50 +02:00
4c6f7afdc7
Add network.local_port commands for tracker port reporting
...
Mirror the network.local_address.* command family for ports:
- network.local_port report the best-match local port
- network.local_port.set set both the ipv4 and ipv6 local ports
- network.local_port.ipv4(.set) get/set the ipv4 local port only
- network.local_port.ipv6(.set) get/set the ipv6 local port only
Values are restricted to 0-65535; 0 (default) means unset, and trackers
then report the listening port.
Why: behind multiple layers of NAT the port peers must connect to can
differ from the port rtorrent is listening on. These commands let the
user manually advertise the forwarded public port per address family,
e.g.:
network.local_port.ipv4.set = 6881
network.local_port.ipv6.set = 6882
network.local_port is marked safe for RPC use alongside
network.local_address.
2026-08-17 11:29:50 +02:00
385e149ccc
Let the download list own its downloads through a shared pointer.
...
A multicall could then dispatch commands on an erased download.
2026-08-17 10:40:41 +02:00
58e627f2be
Fixed '-i <ip>' command line argument.
2026-08-16 14:11:01 +02:00
9ff0cd28d5
Add schedule.if_absent for clients that re-register periodic tasks.
...
schedule restarts a re-registered task's countdown, if_absent keeps the existing entry.
2026-08-16 13:36:19 +02:00
5e7dd98c67
Update rtorrent.rc.lua-example to use new network.listen.port.x commands
...
See #1935
2026-08-14 16:35:20 +02:00
b24db0eaa5
Do not dereference missing text nodes in the tinyxml2 backend.
...
Empty elements and element children crashed the parser on a null.
2026-08-14 13:16:17 +02:00
6fa139f7bf
Reduce max_string_pad_size from 1<<20 to 1<<14
2026-08-14 12:46:37 +02:00
68904ba005
Limit the padding string.rpad and string.lpad will build.
...
An untrusted caller could exhaust memory or the response limit.
2026-08-14 12:46:37 +02:00
b401068246
Let the choke group list own its groups.
...
Each choke_group.insert leaked a group, and size reported a stale copy.
2026-08-14 12:15:36 +02:00
946a4b5c83
Check the focus iterator before dereferencing it on erase.
...
Erasing a download read past the end of the view.
2026-08-13 19:30:21 +02:00
a075001a73
Catch every json exception when processing a JSONRPC request.
...
A number overflow escaped the two handlers and killed the process.
2026-08-12 18:22:17 +02:00
781520fef8
Close the connection when an SCGI header does not fit the buffer.
...
A malformed header aborted the process from the SCGI thread.
2026-08-12 15:48:39 +02:00
224f06fdc2
Link against libatomic when 64-bit atomics require it.
2026-08-09 12:06:08 +02:00
324811d6f0
Do not fail startup on unreadable session files.
...
The download is flagged as hash failed with a message instead of throwing.
2026-08-09 10:39:55 +02:00
e51fad5bd2
Clean up comments in root.h
...
Removed comments regarding input history size limitations.
2026-08-09 10:19:35 +02:00
44bb2d691f
ui: bound the input history size.
...
Only the lower end was checked, so a large value threw bad_alloc and exited.
2026-08-09 10:19:35 +02:00
161a36dedd
Add system.sockets.<category>.min_alloc.limit.
...
A category can have a lower bound too, and a client needs to read it.
2026-08-08 19:39:59 +02:00
a69e44a096
Add system.sockets.<category>.max_alloc.limit.
...
A category can have a ceiling below the shared budget, and a client needs to read it.
2026-08-08 11:28:26 +02:00
4dd8b1fd7e
Update rtorrent.rc-example with newer network.listen
2026-08-08 10:44:41 +02:00
b5f6bb5652
Update rtorrent.rc with newer network.listen
2026-08-08 10:44:41 +02:00
3ae6bbc394
Fix garbage throttle values in the status bar on 32-bit archs.
...
Closes #1683 .
2026-08-07 15:45:47 +02:00
fdfca98f1c
Add documentation for resolving paths.
2026-08-07 11:58:14 +02:00
31196ff5f0
Add realpath variants of the commands that return paths.
...
Closes #1670 .
2026-08-07 11:58:14 +02:00
cfb9e083d2
Add documentation for the string.* commands.
2026-08-07 11:35:35 +02:00
5b4b607c98
Add string.* commands for text manipulation.
...
Closes #1366 .
2026-08-07 11:35:35 +02:00
87db1cf0f0
rpc: do not dereference a null result from the xmlrpc-c registry.
...
A failed call returns null, which was passed straight to xmlrpc_mem_block_contents.
2026-08-07 10:56:19 +02:00
dd3ddf7c39
Tagged release 0.16.20.
2026-08-06 10:12:49 +02:00
e56bffff4d
Fixed socket category unit test.
2026-08-05 11:18:31 +02:00
d20c3234da
Add system.sockets allocation budget commands.
...
They report the budget the socket manager enforces, so a client can show the limit.
2026-08-05 11:18:31 +02:00
dda5e4fa04
Fix deprecated command redirects (rtorrent -D)
2026-08-05 10:14:35 +02:00
9ab73352e1
Minor fixes to WaitpidQueue.
2026-08-05 00:59:33 +09:00
f90a96d57a
Added WaitpidQueue to handle background process reaping.
2026-08-04 19:03:26 +09:00
247ae7621a
Tagged release 0.16.19.
2026-08-02 10:44:30 +02:00
05831942a7
commands: don't register min_alloc/max_alloc for the generic socket category
...
SocketManager throws internal_error for category_generic, aborting rtorrent over RPC.
2026-07-30 12:42:24 +02:00
ee18a1f3fc
Added commit message linter.
2026-07-28 10:04:51 +02:00
f52f20f1b6
Cleaned up system headers.
2026-07-26 19:53:18 +09:00
41eef969ea
commands: fix group.<name>.ratio.disable calling a removed command
...
group_insert() builds the disable method as "schedule_remove=...", but that
command no longer exists: the current name is schedule.remove, and the only
old-style aliases registered are schedule2 and schedule_remove2 (and those only
when deprecated commands are enabled at registration time). Every
group.<name>.ratio.disable therefore faults with
Command "schedule_remove" does not exist.
including the built-in group.seeding.ratio.disable, so a ratio group can be
enabled but never disabled. The enable half already uses the current name.
2026-07-25 10:18:49 +02:00
1def5e8b36
Add log.print and enum.log_group methods
2026-07-22 11:08:32 +02:00
8355870586
Mark 'd.timestamp.started' as safe in command download initialization
2026-07-20 08:21:32 +02:00
ba2bc7e64d
Various release bug fixes.
2026-07-19 18:53:57 +09:00
0c11deac50
Tagged release 0.16.18.
2026-07-17 10:15:28 +02:00
f6b3ad0efd
Minor cleanup of pex and other commands.
2026-07-15 19:40:13 +09:00
5d350f0bcc
Use new encryption modes.
2026-07-14 17:34:14 +09:00
xirvik