xrootd 5.9.2__tar.gz → 5.9.4__tar.gz

{xrootd-5.9.2 → xrootd-5.9.4}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: xrootd
-Version: 5.9.2
+Version: 5.9.4
 Summary: eXtended ROOT daemon
 Home-page: https://xrootd.org
-Download-URL: https://github.com/xrootd/xrootd/archive/v5.9.2.tar.gz
+Download-URL: https://github.com/xrootd/xrootd/archive/v5.9.4.tar.gz
 Author: XRootD Developers
 Author-email: xrootd-dev@slac.stanford.edu
 License: LGPL-3.0-or-later

xrootd-5.9.4/VERSION

@@ -0,0 +1 @@
+v5.9.4

xrootd-5.9.4/bindings/python/VERSION

@@ -0,0 +1 @@
+v5.9.4

{xrootd-5.9.2 → xrootd-5.9.4}/docs/ReleaseNotes.txt

@@ -5,6 +5,64 @@ XRootD
 Release Notes
 =============
 
+-------------
+Version 5.9.4
+-------------
+
++ **Major bug fixes**
+  **[XrdHttp]** Construct digest according to OpenSSL's EVP_MAC documentation
+  **[XrdMacaroons]** Fix support for activity caveats
+
++ **Minor bug fixes**
+  **[DEB]** Add missing libcrypt-dev build dependency
+  **[Misc]** Fix some null pointer dereference bugs reported by clang-tidy
+  **[Python]** Use RPATH for macOS python wheels
+  **[Xrd]** Fix memory leak of Head member in XrdStats
+  **[XrdCks]** Fix clang-tidy warnings about uninitialized values
+  **[XrdHttp]** Send an error response back to the client when xrdhttptk is invalid
+  **[XrdHttpTpc]** Handle error determining IP when tpc.fixed_route is enabled
+  **[XrdMacaroons]** Improve handling of client errors
+  **[XrdMacaroons]** Fix leak of dynamic library handle on error
+  **[XrdMacaroons]** Fix leak of fd file descriptor during configuration
+  **[XrdMacaroons]** Fix memory leak of XrdSysError object
+  **[XrdSys]** Fix undefined behavior warning from clang-tidy
+  **[XrdSys]** Reset cmd.theSem before returning to avoid dangling reference
+  **[XrdXrootd]** Fix clang-tidy uninitialized variable warning in do_Read()
+
++ **Miscellaneous**
+  **[CI]** Replace Debian 11 and Ubuntu 22.04 with Debian 13 and Ubuntu 26.04
+  **[XrdMacaroons]** Remove obsolete macaroon-init script
+  **[XrdMacaroons]** Update README.md
+
+-------------
+Version 5.9.3
+-------------
+
++ **Major bug fixes**
+  **[XrdHttpTpc]** Filter source/destination URLs through allowed list of schemes
+  **[XrdHttpTpc]** Limit curl handle to http and https protocols only
+  **[XrdHttp]** Encode the key of the opaque query string
+  **[XrdMacaroons]** Reject user-provided caveats with reserved keys
+
++ **Minor bug fixes**
+  **[XrdOuc]** Ensure XList is initialized in XrdOucNSWalk constructor
+  **[XrdSciTokens]** Close token and ACL cleanup leaks
+  **[XrdSciTokens]** Fix ACL cache TTL computation from token expiry
+  **[XrdSciTokens]** Harden token input
+  **[XrdSciTokens]** Match rules based on path-component boundary
+  **[XrdSciTokens]** Serialize issuer reads and atomic reconfig state swap
+  **[XrdSciTokens]** Tighten group and subject-claim memory handling
+  **[XrdSecgsi]** Remove dead code
+  **[XrdSsi]** Fix GCC 16 -Wmaybe-uninitialized compiler warning
+
++ **Miscellaneous**
+  **[CI]** Check ABI against merge-base of HEAD and latest tag
+  **[CI]** Publish binary Python wheels for Linux/macOS on aarch64/x86_64
+  **[CMake]** Set install_name property on macOS for Python wheel builds
+  **[XrdHttpTpc]** Add option to allow/deny transfers to/from local/private addresses
+  **[XrdHttpTpc]** Convert s3(s):// scheme to https:// in tpc source/destination URLs
+  **[XrdHttpTpc]** Improve error handling in TPCHandler::DetermineXferSize
+
 -------------
 Version 5.9.2
 -------------

{xrootd-5.9.2 → xrootd-5.9.4}/genversion.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/sh
 
 # This script no longer generates XrdVersion.hh, but just
 # prints the version using the same strategy as in the module
@@ -8,7 +8,7 @@
 # not expanded by git, git describe is used. If a bad version is
 # set for any reason, a fallback version is used based on a date.
 
-function usage()
+usage()
 {
 	cat 1>&2 <<-EOF
 		Usage:
@@ -24,9 +24,9 @@ function usage()
 SRC="$(dirname "$0")"
 VF="${SRC}/VERSION"
 
-if [[ -n "${XRDVERSION}" ]]; then
+if [ -n "${XRDVERSION}" ]; then
 	VERSION="${XRDVERSION}";
-elif [[ -r "${VF}" ]] && grep -vq "Format:" "${VF}"; then
+elif [ -r "${VF}" ] && grep -vq "Format:" "${VF}"; then
 	VERSION="$(sed -e 's/-g/+git/' "${VF}")"
 elif git -C "${SRC}" describe --match 'v*' >/dev/null 2>&1; then
 	VERSION="$(git -C "${SRC}" describe --match 'v*' | sed -e 's/-g/+git/')"
@@ -34,7 +34,7 @@ else
 	VERSION="v5.9-rc$(date +%Y%m%d)"
 fi
 
-while [[ $# -gt 0 ]]; do
+while [ $# -gt 0 ]; do
 	case $1 in
 	--help)
 		usage
@@ -52,7 +52,7 @@ while [[ $# -gt 0 ]]; do
 
 	--version)
 		shift
-		if [[ $# == 0 ]]; then
+		if [ $# -eq 0 ]; then
 			echo "error: --version parameter needs an argument" 1>&2
 		fi
 		VERSION=$1
@@ -66,8 +66,8 @@ while [[ $# -gt 0 ]]; do
 	esac
 done
 
-if [[ -v SANITIZE ]]; then
-	VERSION=$(sed -e 's/v//; s/-rc/~rc/; s/-g/+git/; s/-/.post/; s/-/./' <<< "${VERSION}")
+if [ -n "${SANITIZE}" ]; then
+	VERSION=$(printf "%s\n" "${VERSION}" | sed -e 's/v//; s/-rc/~rc/; s/-g/+git/; s/-/.post/; s/-/./')
 fi
 
 printf "%s" "${VERSION}"

{xrootd-5.9.2 → xrootd-5.9.4}/src/CMakeLists.txt

@@ -3,8 +3,13 @@
 # (this is especially important for plugins)
 #-------------------------------------------------------------------------------
 if( PYPI_BUILD )
-  set( CMAKE_INSTALL_RPATH "$ORIGIN" )
-  set( CMAKE_INSTALL_RPATH_USE_LINK_PATH true )
+  if( APPLE )
+    set(CMAKE_INSTALL_NAME_DIR "@rpath")
+    set(CMAKE_INSTALL_RPATH "@loader_path")
+  else()
+    set(CMAKE_INSTALL_RPATH "$ORIGIN")
+  endif()
+  set(CMAKE_INSTALL_RPATH_USE_LINK_PATH true)
 endif()
 
 #-------------------------------------------------------------------------------

{xrootd-5.9.2 → xrootd-5.9.4}/src/Xrd/XrdStats.hh

@@ -89,7 +89,7 @@ void  Stats(XrdStats::CallBack *InfoBack, int xOpts, int jOpts=0);
                const char *hn, int port, const char *in, const char *pn,
                const char *sn);
 
-virtual ~XrdStats() {if (buff) free(buff);}
+virtual ~XrdStats() {if (buff) free(buff); if (Head) free(Head); }
 
 private:
 

{xrootd-5.9.2 → xrootd-5.9.4}/src/XrdApps/XrdCpConfig.cc

@@ -417,10 +417,13 @@ do{while(optind < Argc && Legacy(optind)) {}
 
 // Check if we have any sources or too many sources
 //
-   if (!numFiles) UMSG("Source not specified.");
+   srcFile = pBase.Next;
+
+   if (!numFiles || !srcFile)
+      UMSG("Source not specified.");
+
    if (Opts & opt1Src && numFiles > 1)
       FMSG("Only a single source is allowed.", 2);
-   srcFile = pBase.Next;
 
 // Check if we have an appropriate destination
 //

{xrootd-5.9.2 → xrootd-5.9.4}/src/XrdCks/XrdCksManager.cc

@@ -118,10 +118,10 @@ XrdCksManager::~XrdCksManager()
   
 int XrdCksManager::Calc(const char *Pfn, XrdCksData &Cks, int doSet)
 {
-   XrdCksCalc *csP;
+   XrdCksCalc *csP = nullptr;
    csInfo *csIP = &csTab[0];
-   time_t MTime;
-   int rc;
+   time_t MTime = 0;
+   int rc = 0;
 
 // Determine which checksum to get
 //
@@ -463,8 +463,8 @@ int XrdCksManager::Del(const char *Pfn, XrdCksData &Cks)
 int XrdCksManager::Get(const char *Pfn, XrdCksData &Cks)
 {
    XrdOucXAttr<XrdCksXAttr> xCS;
-   time_t MTime;
-   int rc, nFault;
+   time_t MTime = 0;
+   int rc = 0, nFault = 0;
 
 // Determine which checksum to get (we will accept unsupported ones as well)
 //
@@ -613,7 +613,7 @@ int XrdCksManager::Set(const char *Pfn, XrdCksData &Cks, int myTime)
 // Set correct times if need be
 //
    if (!myTime)
-      {time_t MTime;
+      {time_t MTime = 0;
        int rc = ModTime(Pfn, MTime);
        if (rc) return rc;
        xCS.Attr.Cks.fmTime = static_cast<long long>(MTime);
@@ -638,7 +638,7 @@ void XrdCksManager::SetOpts(int opt) {CksOpts = opt;}
 int XrdCksManager::Ver(const char *Pfn, XrdCksData &Cks)
 {
    XrdOucXAttr<XrdCksXAttr> xCS;
-   time_t MTime;
+   time_t MTime = 0;
    csInfo *csIP = &csTab[0];
    int rc;
 

{xrootd-5.9.2 → xrootd-5.9.4}/src/XrdCl/XrdClFileStateHandler.cc

@@ -339,6 +339,8 @@ namespace
                                     XrdCl::AnyObject    *rdresp,
                                     XrdCl::HostList     *hostList )
       {
+        using namespace XrdCl;
+
         if( !status->IsOK() )
         {
           userHandler->HandleResponseWithHosts( status, rdresp, hostList );
@@ -346,11 +348,17 @@ namespace
           return;
         }
 
-        using namespace XrdCl;
 
-        ChunkInfo *chunk = 0;
+        ChunkInfo *chunk = nullptr;
         rdresp->Get( chunk );
 
+        if( !chunk )
+        {
+          userHandler->HandleResponseWithHosts( status, rdresp, hostList );
+          delete this;
+          return;
+        }
+
         std::vector<uint32_t> cksums;
         if( stateHandler->pIsChannelEncrypted )
         {

{xrootd-5.9.2 → xrootd-5.9.4}/src/XrdHttp/XrdHttpProtocol.cc

@@ -867,7 +867,8 @@ int XrdHttpProtocol::Process(XrdLink *lp) // We ignore the argument here
                 secretkey);
 
         if (compareHash(hash, tk)) {
-          TRACEI(REQ, " Invalid tk '" << tk << "' != '" << hash << "'(calculated). Authentication failed.");
+          TRACEI(REQ, "Invalid tk '" << tk << "' != '" << hash << "' (calculated). Authentication failed.");
+          SendSimpleResp(400, nullptr, nullptr, "Authentication failed: invalid token", 0, false);
           return -1;
         }
 

{xrootd-5.9.2 → xrootd-5.9.4}/src/XrdHttp/XrdHttpUtils.cc

@@ -258,16 +258,25 @@ void calcHashes(
 
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
 
-  mac = EVP_MAC_fetch(0, "sha256", 0);
-  ctx = EVP_MAC_CTX_new(mac);
-
-  if (!ctx) {
-     return;
+  if (!(mac = EVP_MAC_fetch(nullptr, "HMAC", nullptr))) {
+    return;
   }
 
+  if (!(ctx = EVP_MAC_CTX_new(mac))) {
+    EVP_MAC_free(mac);
+    return;
+  }
 
-  EVP_MAC_init(ctx, (const unsigned char *) key, strlen(key), 0);
+  OSSL_PARAM params[2] = {
+    OSSL_PARAM_construct_utf8_string("digest", (char*)"SHA256", 0),
+    OSSL_PARAM_construct_end()
+  };
 
+  if (!EVP_MAC_init(ctx, (const unsigned char *) key, strlen(key), params)) {
+    EVP_MAC_CTX_free(ctx);
+    EVP_MAC_free(mac);
+    return;
+  }
 
   if (fn)
     EVP_MAC_update(ctx, (const unsigned char *) fn,

{xrootd-5.9.2 → xrootd-5.9.4}/src/XrdHttp/XrdHttpUtils.hh

@@ -233,7 +233,7 @@ inline std::string encode_opaque(const std::string & opaque) {
       if(!first) {
         output << "&";
       }
-      output << key << "=" << encode_str(value);
+      output << encode_str(key) << "=" << encode_str(value);
       first = false;
     }
   }

{xrootd-5.9.2 → xrootd-5.9.4}/src/XrdHttpTpc/XrdHttpTpcConfigure.cc

@@ -52,6 +52,36 @@ bool TPCHandler::Configure(const char *configfn, XrdOucEnv *myEnv)
                 m_log.Emsg("Config", "https.desthttps value is invalid", val);
                 return false;
             }
+        } else if (!strcmp("tpc.allow", val)) {
+            if (!(val = Config.GetWord())) {
+                Config.Close();
+                m_log.Emsg("Config", "tpc.allow value not specified");
+                return false;
+            }
+            if (strcmp(val, "local") == 0) {
+              m_allow_local = true;
+            } else if (strcmp(val, "private") == 0) {
+              m_allow_private = true;
+            } else {
+                Config.Close();
+                m_log.Emsg("Config", "tpc.allow value is invalid", val);
+                return false;
+            }
+        } else if (!strcmp("tpc.deny", val)) {
+            if (!(val = Config.GetWord())) {
+                Config.Close();
+                m_log.Emsg("Config", "tpc.deny value not specified");
+                return false;
+            }
+            if (strcmp(val, "local") == 0) {
+              m_allow_local = false;
+            } else if (strcmp(val, "private") == 0) {
+              m_allow_private = false;
+            } else {
+                Config.Close();
+                m_log.Emsg("Config", "tpc.deny value is invalid", val);
+                return false;
+            }
         } else if (!strcmp("tpc.trace", val)) {
             if (!ConfigureLogger(Config)) {
                 Config.Close();

{xrootd-5.9.2 → xrootd-5.9.4}/src/XrdHttpTpc/XrdHttpTpcTPC.cc

@@ -120,24 +120,43 @@ int TPCHandler::opensocket_callback(void *clientp,
                                     curlsocktype purpose,
                                     struct curl_sockaddr *aInfo)
 {
-  //Return a socket file descriptor (note the clo_exec flag will be set).
+  /* CURLSOCKTYPE_IPCXN (for IP based connections) is the only type currently known by curl,
+   * so let's make sure to reject other types if they appear in the furure */
+  if (purpose != CURLSOCKTYPE_IPCXN)
+    return CURL_SOCKET_BAD;
+
+  if (!aInfo)
+    return CURL_SOCKET_BAD;
+
+  // Create the socket (note that O_CLOEXEC flag will be set)
   int fd = XrdSysFD_Socket(aInfo->family, aInfo->socktype, aInfo->protocol);
-  // See what kind of address will be used to connect
-  //
-  if(fd < 0) {
+
+  if (fd < 0) {
     return CURL_SOCKET_BAD;
   }
-  TPCLogRecord * rec = (TPCLogRecord *)clientp;
-  if (purpose == CURLSOCKTYPE_IPCXN && clientp)
-  {XrdNetAddr thePeer(&(aInfo->addr));
-    rec->isIPv6 =  (thePeer.isIPType(XrdNetAddrInfo::IPv6)
-                    && !thePeer.isMapped());
-    std::stringstream connectErrMsg;
-
-    if(!rec->pmarkManager.connect(fd, &(aInfo->addr), aInfo->addrlen, CONNECT_TIMEOUT, connectErrMsg)) {
-      rec->m_log->Emsg(rec->log_prefix.c_str(),"Unable to connect socket:", connectErrMsg.str().c_str());
-      return CURL_SOCKET_BAD;
-    }
+
+  if (!clientp)
+    return fd;
+
+  XrdNetAddr thePeer(&(aInfo->addr));
+  TPCLogRecord *rec = static_cast<TPCLogRecord*>(clientp);
+
+  /* Reject attempts to connect to local/private addresses unless allowed by configuration */
+  if ((!rec->allow_private && thePeer.isPrivate()) || (!rec->allow_local && thePeer.isLocal())) {
+    rec->tpc_status = 403; // Forbidden
+    rec->m_log->Emsg(rec->log_prefix.c_str(),
+      "Connection to local/private address is forbidden");
+    close(fd);
+    return CURL_SOCKET_BAD;
+  }
+
+  rec->isIPv6 = (thePeer.isIPType(XrdNetAddrInfo::IPv6) && !thePeer.isMapped());
+
+  std::stringstream connectErrMsg;
+  if(!rec->pmarkManager.connect(fd, &(aInfo->addr), aInfo->addrlen, CONNECT_TIMEOUT, connectErrMsg)) {
+    rec->m_log->Emsg(rec->log_prefix.c_str(), "Unable to connect socket: ", connectErrMsg.str().c_str());
+    close(fd);
+    return CURL_SOCKET_BAD;
   }
 
   return fd;
@@ -238,11 +257,26 @@ bool TPCHandler::MatchesPath(const char *verb, const char *path) {
 /*                            P r e p a r e U R L                             */
 /******************************************************************************/
   
-static std::string PrepareURL(const std::string &input) {
-    if (!strncmp(input.c_str(), "davs://", 7)) {
-        return "https://" + input.substr(7);
-    }
-    return input;
+static std::string PrepareURL(const std::string &url)
+{
+  const std::string replace_schemes[] = { "davs://", "s3://", "s3s://" };
+
+  for (const auto& s : replace_schemes)
+    if (url.compare(0, s.size(), s) == 0)
+      return "https://" + url.substr(s.size());
+
+  return url;
+}
+
+static bool IsAllowedScheme(const std::string& url)
+{
+  const std::string allowed_schemes[] = { "https://", "http://" };
+
+  for (const auto& s : allowed_schemes)
+    if (url.compare(0, s.size(), s) == 0)
+      return true;
+
+  return false;
 }
 
 /******************************************************************************/
@@ -263,10 +297,21 @@ int TPCHandler::ProcessReq(XrdHttpExtReq &req) {
     header = XrdOucTUtils::caseInsensitiveFind(req.headers,"source");
     if (header != req.headers.end()) {
         std::string src = PrepareURL(header->second);
+        if (!IsAllowedScheme(src)) {
+            const char *error_src = "COPY rejected: disallowed scheme in source URL";
+            m_log.Emsg("ProcessReq", error_src, src.c_str());
+            return req.SendSimpleResp(400, NULL, NULL, error_src, 0);
+        }
         return ProcessPullReq(src, req);
     }
     header = XrdOucTUtils::caseInsensitiveFind(req.headers,"destination");
     if (header != req.headers.end()) {
+        const std::string& dst = header->second;
+        if (!IsAllowedScheme(dst)) {
+            const char *error_dst = "COPY rejected: disallowed scheme in destination URL";
+            m_log.Emsg("ProcessReq", error_dst, dst.c_str());
+            return req.SendSimpleResp(400, NULL, NULL, error_dst, 0);
+        }
         return ProcessPushReq(header->second, req);
     }
     m_log.Emsg("ProcessReq", "COPY verb requested but no source or destination specified.");
@@ -286,6 +331,8 @@ TPCHandler::~TPCHandler() {
 /******************************************************************************/
   
 TPCHandler::TPCHandler(XrdSysError *log, const char *config, XrdOucEnv *myEnv) :
+        m_allow_local(false),
+        m_allow_private(true),
         m_desthttps(false),
         m_fixed_route(false),
         m_timeout(60),
@@ -430,34 +477,45 @@ int TPCHandler::DetermineXferSize(CURL *curl, XrdHttpExtReq &req, State &state,
     curl_easy_setopt(curl, CURLOPT_NOBODY, 0);
     // Reset the CURLOPT_TIMEOUT to no timeout (default)
     curl_easy_setopt(curl, CURLOPT_TIMEOUT, 0L);
-    if (res == CURLE_HTTP_RETURNED_ERROR) {
-        std::stringstream ss;
-        ss << "Remote server failed request while fetching remote size";
-        std::stringstream ss2;
-        ss2 << ss.str() << ": " << curl_easy_strerror(res);
-        rec.status = 500;
-        logTransferEvent(LogMask::Error, rec, "SIZE_FAIL", ss2.str());
-        return shouldReturnErrorToClient ? req.SendSimpleResp(rec.status, NULL, NULL, generateClientErr(ss, rec, res).c_str(), 0) : -1;
-    } else if (state.GetStatusCode() >= 400) {
-        std::stringstream ss;
-        ss << "Remote side " << req.clienthost << " failed with status code " << state.GetStatusCode() << " while fetching remote size";
-        rec.status = 500;
-        logTransferEvent(LogMask::Error, rec, "SIZE_FAIL", ss.str());
-        return shouldReturnErrorToClient ? req.SendSimpleResp(rec.status, NULL, NULL, generateClientErr(ss, rec).c_str(), 0) : -1;
-    } else if (res) {
-        std::stringstream ss;
-        ss << "Internal transfer failure while fetching remote size";
-        std::stringstream ss2;
-        ss2 << ss.str() << " - HTTP library failed: " << curl_easy_strerror(res);
-        rec.status = 500;
-        logTransferEvent(LogMask::Error, rec, "SIZE_FAIL", ss2.str());
-        return shouldReturnErrorToClient ? req.SendSimpleResp(rec.status, NULL, NULL, generateClientErr(ss, rec, res).c_str(), 0) : -1;
-    }
+    curl_easy_setopt(curl, CURLOPT_FAILONERROR, true);
+
     std::stringstream ss;
-    ss << "Successfully determined remote size for pull request: "
-       << state.GetContentLength();
-    logTransferEvent(LogMask::Debug, rec, "SIZE_SUCCESS", ss.str());
+
+    if (state.GetStatusCode() >= 400)
+      res = CURLE_HTTP_RETURNED_ERROR;
+
+    if (res != CURLE_OK) { /* curl failed */
+      ss << curl_easy_strerror(res);
+      switch (res) {
+      case CURLE_HTTP_RETURNED_ERROR: /* remote side may have returned an error */
+        rec.tpc_status = state.GetStatusCode(); /* relay status received from remote side to the client */
+        ss << ": remote host returned '" << rec.tpc_status << " "
+           << httpStatusToString(rec.tpc_status) << "' while fetching file size";
+        break;
+      case CURLE_COULDNT_CONNECT: /* socket callback may have failed */
+        switch (rec.tpc_status) {
+        case 403:
+          ss << ": connection to local/private addresses is forbidden";
+          break;
+        default:
+          ss << ": internal server failure";
+          rec.tpc_status = 500;
+        }
+        break;
+      default:
+        rec.tpc_status = 500;
+        state.SetErrorCode(500);
+      }
+    }
+
+    if (rec.tpc_status >= 400) {
+      logTransferEvent(LogMask::Error, rec, "SIZE_FAIL", ss.str());
+      return shouldReturnErrorToClient ? req.SendSimpleResp(rec.tpc_status, NULL, NULL, generateClientErr(ss, rec, res).c_str(), 0) : -1;
+    }
+
     success = true;
+    ss << "Successfully determined remote size for pull request: " << state.GetContentLength();
+    logTransferEvent(LogMask::Debug, rec, "SIZE_SUCCESS", ss.str());
     return 0;
 }
 
@@ -776,6 +834,8 @@ int TPCHandler::RunCurlWithUpdates(CURL *curl, XrdHttpExtReq &req, State &state,
   
 int TPCHandler::ProcessPushReq(const std::string & resource, XrdHttpExtReq &req) {
     TPCLogRecord rec(req, TpcType::Push);
+    rec.allow_local = m_allow_local;
+    rec.allow_private = m_allow_private;
     rec.log_prefix = "PushRequest";
     rec.local = req.resource;
     rec.remote = resource;
@@ -796,14 +856,21 @@ int TPCHandler::ProcessPushReq(const std::string & resource, XrdHttpExtReq &req)
     }
     curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1);
     curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, (long) CURL_HTTP_VERSION_1_1);
-//  curl_easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_setcloexec_callback);
-
+#if CURL_AT_LEAST_VERSION(7, 85, 0)
+    curl_easy_setopt(curl, CURLOPT_PROTOCOLS_STR,       "https,http");
+    curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS_STR, "https,http");
+#else
+    long protocols = CURLPROTO_HTTP | CURLPROTO_HTTPS;
+    curl_easy_setopt(curl, CURLOPT_PROTOCOLS, protocols);
+    curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS, protocols);
+#endif
     curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket_callback);
     curl_easy_setopt(curl, CURLOPT_OPENSOCKETDATA, &rec);
     curl_easy_setopt(curl, CURLOPT_CLOSESOCKETFUNCTION, closesocket_callback);
     curl_easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);
     curl_easy_setopt(curl, CURLOPT_CLOSESOCKETDATA, &rec);
     curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, CONNECT_TIMEOUT);
+
     auto query_header = XrdOucTUtils::caseInsensitiveFind(req.headers,"xrd-http-fullresource");
     std::string redirect_resource = req.resource;
     if (query_header != req.headers.end()) {
@@ -859,6 +926,8 @@ int TPCHandler::ProcessPushReq(const std::string & resource, XrdHttpExtReq &req)
   
 int TPCHandler::ProcessPullReq(const std::string &resource, XrdHttpExtReq &req) {
     TPCLogRecord rec(req,TpcType::Pull);
+    rec.allow_local = m_allow_local;
+    rec.allow_private = m_allow_private;
     rec.log_prefix = "PullRequest";
     rec.local = req.resource;
     rec.remote = resource;
@@ -877,6 +946,7 @@ int TPCHandler::ProcessPullReq(const std::string &resource, XrdHttpExtReq &req)
         logTransferEvent(LogMask::Error, rec, "PULL_FAIL", ss.str());
         return req.SendSimpleResp(rec.status, NULL, NULL, generateClientErr(ss, rec).c_str(), 0);
     }
+
     // ddavila 2023-01-05:
     // The following change was required by the Rucio/SENSE project where
     // multiple IP addresses, each from a different subnet, are assigned to a
@@ -884,34 +954,42 @@ int TPCHandler::ProcessPullReq(const std::string &resource, XrdHttpExtReq &req)
     // The above requires the server to utilize the same IP, that was used to
     // start the TPC, for the resolution of the given TPC instead of
     // using any of the IPs available.
-    if (m_fixed_route){
-        XrdNetAddr *nP;
-        int numIP = 0;
-        char buff[1024];
-        char * ip;
-
+    if (m_fixed_route) {
         // Get the hostname used to contact the server from the http header
-        auto host_header = XrdOucTUtils::caseInsensitiveFind(req.headers,"host");
-        std::string host_used;
+        std::string host;
+        auto host_header = XrdOucTUtils::caseInsensitiveFind(req.headers, "host");
+
         if (host_header != req.headers.end()) {
-            host_used = host_header->second;
+            host = host_header->second;
         }
 
-        // Get the IP addresses associated with the above hostname
-        XrdNetUtils::GetAddrs(host_used.c_str(), &nP, numIP, XrdNetUtils::prefAuto, 0);
-        int ip_size = nP[0].Format(buff, 1024, XrdNetAddrInfo::fmtAddr,XrdNetAddrInfo::noPort);
-        ip = (char *)malloc(ip_size-1);
+        // Get the IP addresses associated with the hostname
+        char ip[64]; // IPv6 addresses are up to 45 characters long
+        std::vector<XrdNetAddr> addresses;
+        const char *eText = XrdNetUtils::GetAddrs(host, addresses, nullptr, XrdNetUtils::prefAuto, 0);
+
+        if (eText || addresses.empty() ||
+          addresses.front().Format(ip, sizeof(ip), XrdNetAddrInfo::fmtAddr,XrdNetAddrInfo::noPortRaw) <= 0) {
+            std::stringstream ss;
+            ss << "Failed to determine host address of incoming request";
+            rec.status = 500;
+            logTransferEvent(LogMask::Error, rec, "PULL_FAIL", ss.str());
+            return req.SendSimpleResp(rec.status, NULL, NULL, generateClientErr(ss, rec).c_str(), 0);
+        }
 
-	// Substring to get only the address, remove brackets and garbage
-        memcpy(ip, buff+1, ip_size-2);
-        ip[ip_size-2]='\0';
         logTransferEvent(LogMask::Info, rec, "LOCAL IP", ip);
-
         curl_easy_setopt(curl, CURLOPT_INTERFACE, ip);
     }
     curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1);
     curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, (long) CURL_HTTP_VERSION_1_1);
-//  curl_easy_setopt(curl,CURLOPT_SOCKOPTFUNCTION,sockopt_setcloexec_callback);
+#if CURL_AT_LEAST_VERSION(7, 85, 0)
+    curl_easy_setopt(curl, CURLOPT_PROTOCOLS_STR,       "https,http");
+    curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS_STR, "https,http");
+#else
+    long protocols = CURLPROTO_HTTP | CURLPROTO_HTTPS;
+    curl_easy_setopt(curl, CURLOPT_PROTOCOLS, protocols);
+    curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS, protocols);
+#endif
     curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, opensocket_callback);
     curl_easy_setopt(curl, CURLOPT_OPENSOCKETDATA, &rec);
     curl_easy_setopt(curl, CURLOPT_SOCKOPTFUNCTION, sockopt_callback);