Commit Graph

35949 Commits

Author SHA1 Message Date
Viktor Szakats
283ad5c432
GHA/windows: set persist-credentials: false where missing
Found by zizmor.

Closes #17277
2025-05-07 19:14:46 +02:00
Daniel Stenberg
613436dbbb
netrc: avoid NULL deref on weird input
A dynbuf that never gets populated might return a NULL, and Coverity
could find a way through like that.

Closes #17275
2025-05-07 17:15:39 +02:00
Stefan Eissing
412d3c3dc9
ldap: move easy handle protocol struct into meta hash
Removing the member of data->req.p

Closes #17269
2025-05-07 17:13:03 +02:00
Daniel Stenberg
3a2689712a
vtls: avoid NULL deref on bad PEM input
Spotted by Coverity

Closes #17274
2025-05-07 17:08:06 +02:00
Stefan Eissing
7b92844639
smtp: use easy handle/connectin meta for proto structs
Move `struct smtp_conn` and `struct STMP` into the meta data at easy
handle/connection. Remove it from the unions at connectdata and request.

Closes #17257
2025-05-07 16:01:05 +02:00
Daniel Stenberg
bc46ff2d2b
RELEASE-PROCEDURE: update the coming release dates 2025-05-07 14:39:18 +02:00
Daniel Stenberg
cf38e0067c
metahash: add asserts to help analyzers
Where NULL pointers are not acceptable input.

Closes #17268
2025-05-07 11:25:14 +02:00
Daniel Stenberg
255aac56f9
curlx: move into to curlx/
Move curlx_ functions into its own subdir.

The idea is to use the curlx_ prefix proper on these functions, and use
these same function names both in tool, lib and test suite source code.
Stop the previous special #define setup for curlx_ names.

The printf defines are now done for the library alone. Tests no longer
use the printf defines. The tool code sets its own defines. The printf
functions are not curlx, they are publicly available.

The strcase defines are not curlx_ functions and should not be used by
tool or server code.

dynbuf, warnless, base64, strparse, timeval, timediff are now proper
curlx functions.

When libcurl is built statically, the functions from the library can be
used as-is. The key is then that the functions must work as-is, without
having to be recompiled for use in tool/tests. This avoids symbol
collisions - when libcurl is built statically, we use those functions
directly when building the tool/tests. When libcurl is shared, we
build/link them separately for the tool/tests.

Assisted-by: Jay Satiro

Closes #17253
2025-05-07 11:01:15 +02:00
Stefan Eissing
17e13cba62
imap: use easy handle/connection meta for proto structs
Remove the imap protocol structs from connectdata->proto union
and data->req.p and use the easy handle/connection meta hash
for keeping them.

Closes #17261
2025-05-07 10:25:18 +02:00
Viktor Szakats
c6d0524265
cmake: set BUILDING_LIBCURL directly for unit test targets
To avoid adding this macro to the global `CURL_DEBUG_MACROS` variable,
which may be used for targets defined after unit tests, and where this
macro may not be necessary.

As of this commit unit tests are defined last, so extending the global
variable did not cause any issue.

Follow-up to 220eda34cd #17259

Closes #17264
2025-05-07 10:10:28 +02:00
Jay Satiro
e3802ab489 generate.bat: exclude curlinfo.c from legacy VS projects
- Do not include curlinfo.c as a ClCompile unit when compiling the curl
  tool.

Prior to this change generate.bat would add curlinfo.c to the source
files for the curl tool because it is located in the src directory. That
caused ambiguous behavior in legacy versions of Visual Studio which had
to guess between two main entry points (one in curlinfo and one in
tool_main, the latter being correct).

Closes https://github.com/curl/curl/pull/17263
2025-05-07 02:49:47 -04:00
Daniel Stenberg
220eda34cd
tests: separate tunit tests from unit tests more
- unit tests need no tool code as they are libcurl unit tests
- unit test 1621 is now tunit test 1621 instead, as it tests tool code
- build unit tests with BUILDING_LIBCURL as they pretent to be libcurl

Closes #17259
2025-05-06 17:25:22 +02:00
Stefan Eissing
2e49965126
rtsp: move easy handle/connection protoocol structs into meta data
Remove the connectdata proto and data->req.p member for rtsp and manage
the structs as meta data at easy handle/connection.

Closes #17254
2025-05-06 17:13:24 +02:00
Daniel Stenberg
f7c544d867
pop3: add null pointer check
Pointed out by Coverity. A precaution to catch internal errors.

Follow-up to 76d13c721b

Closes #17255
2025-05-06 17:11:25 +02:00
Stefan Eissing
a30830db78
ftp: fix bug in failed init
torture tests revealed that memory was not released correctly when FTP's
connection setup failed an allocation.

Follow-up from a2d90d4ba5

Closes #17258
2025-05-06 13:22:12 +02:00
Stefan Eissing
777c5209df
smb: use easy handle/connection meta hash to keep structs
Keep easy/connection related protoocl structs in the meta hash instead
of the unions at request and connectdata.

Closes #17238
2025-05-06 09:10:07 +02:00
Stefan Eissing
cd3be116b6
rtmp: use connection meta for RTMP* instance
Keep RTMP* instance at connection meta hash.

Closes #17237
2025-05-06 09:09:21 +02:00
Stefan Eissing
76d13c721b
pop3: use meta hashes at easy handle and connection
Keep the pop3 related protocol information in the meta hashes at easy
handle and connection.

Move the struct definitions inside pop3.c

Closes #17236
2025-05-06 09:08:47 +02:00
Stefan Eissing
a2d90d4ba5
ftp: use easy handle and connectin meta data for protocol structs
- remove data->req.p.ftp and store `struct FTP` as easy meta data
- place `struct ftp_conn` instance in connection meta data

Closes #17249
2025-05-06 09:07:43 +02:00
Stefan Eissing
378aa011e6
tftp: use connections meta hash
Use connection meta hash for state struct instead of union pointer at
connectdata.

Closes #17235
2025-05-06 09:05:27 +02:00
Stefan Eissing
d57bdbf830
openldap: use connection meta for context struct
Remove member of conn->proto union.

Closes #17224
2025-05-06 09:04:01 +02:00
sftcd
de881a92eb
ECH: reference the OpenSSL ECH feature branch
rather than the defo-project fork.

Closes #17251
2025-05-06 09:02:24 +02:00
Viktor Szakats
838dc53bb7
spacecheck.pl: check for non-ASCII chars, fix fallouts
Reported-by: James Fuller
Assisted-by: Dan Fandrich

Closes #17247
2025-05-04 17:26:11 +02:00
Daniel Stenberg
e1f87a093b
RELEASE-NOTES: synced 2025-05-01 22:27:18 +02:00
renovate[bot]
c27ba7aa93
GHA: Update libressl-portable/portable to v4.1.0
Closes #17234
2025-05-01 12:13:19 +02:00
Viktor Szakats
68369a3198
mkhelp: fix to not generate a line-ending space in some cases
Fixing gcc-15:
```
bld/src/tool_hugehelp.c:11739:1: error: trailing whitespace [-Werror=trailing-whitespace=]
```
Ref: https://github.com/curl/curl/actions/runs/14758743743/job/41433794102?pr=17239#step:10:32

Closes #17240
2025-04-30 22:14:25 +02:00
Andrei Florea
a638828c88
TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs
Fixes #12982
Closes #16964
2025-04-30 17:47:22 +02:00
NeimadTL
f9daa75a3b
TODO: remove "nicer lacking perl message"
The document has been updated by removing point 20.2 as it was done
some time ago.

Closes #17233
2025-04-30 08:25:14 +02:00
Daniel Stenberg
b1eebdf46a
docs/libcurl: fix type and prototype problems in examples
Found by enabling the typechecks when compiling them with
verify-examples.pl

Closes #17231
2025-04-29 22:44:05 +02:00
Daniel Stenberg
d33b449271
CURLOPT_XFERINFOFUNCTION.md: fix the callback return type in example
Fixes #17228
Reported-by: gkarracer on github
Closes #17229
2025-04-29 22:16:40 +02:00
Viktor Szakats
3fcddc835c
scripts: fix perl indentation, whitespace, semicolons
Ref: #17116

Closes #17209
2025-04-29 19:35:55 +02:00
Viktor Szakats
fd4c342d88
GHA: drop vcpkg cache and most vcpkg logic with it
The unplanned dropping of the granular vcpkg binary cache indeed fell
into the cracks between Microsoft's various departments. The old method
is now official dropped, without replacement either on the vcpkg side or
the GitHub cache provider side.

Without a granular cache, vcpkg is impractical for builds larger than
a small dependency tree in CI, for performance reasons.

A granular cache is critical for CI use. Building dependencies is not
a goal of this CI, so a more desirable option would be pre-built binary
downloads. This would also allow keeping job timeouts low, which is
important for quick iteration in GHA when a flaky job requiring a manual
retry needs all other jobs to finish first. (GHA often disregards
step timeouts, which is another contributing factor here.)

Windows remains tested extensively with MSYS2, curl-for-win, and via
AppVeyor CI with MSVC + OpenSSL, and also in GHA via scaled back vcpkg
jobs that perform well without caching. What's lost is the recently
added Android OpenSSL build tests.

We may consider building/cachine important dependencies manually as in
GHA/linux-http3, and/or try integrating MSVC jobs with MSYS2 UCRT DLLs.

Ref: https://github.com/microsoft/vcpkg-tool/pull/1662
Ref: https://github.com/microsoft/vcpkg/issues/45073

Follow-up to cd0ec4784c #17089
Follow-up to e3912f0f9f #17086
Follow-up to 15fb1dc7f8 #17069

Closes #17200
2025-04-29 19:35:55 +02:00
Viktor Szakats
9daca35b13
build: enable gcc-15 picky warnings
Closes #17199
2025-04-29 19:35:55 +02:00
Corinna Brandt
ea897fddfc
openssl: set the cipher string before doing private cert
... as this allows a set string to affect how OpenSSL deals with the
private keys/certs.

Closes #17227
2025-04-29 16:17:48 +02:00
Stefan Eissing
47b2300192
mqtt: use conn/easy meta hash
Remove mqtt structs from the unions at connectdata and
easy handle requests. Use meta hash at easy/connnection.

Make mqtt structs private to mqtt.c

Closes #17221
2025-04-29 14:25:25 +02:00
Daniel Stenberg
e383ba53eb
multi_ev: remove redundant check for data
Pointed out by CodeSonar

Closes #17226
2025-04-29 14:22:31 +02:00
Daniel Stenberg
1fc5226ce5
RELEASE-NOTES: synced 2025-04-29 14:07:59 +02:00
Stefan Eissing
f0824d1ed7
meta data handling for easy/conn fixes
- return error when adding to hash fails
- do not free passed in data, as ownership is taken by call

Closes #17219
2025-04-29 13:57:16 +02:00
Daniel Stenberg
9f57c2ea95
VULN-DISCLOSURE-POLICY: use of weak algos
Not necessarily security problems.

Closes #17220
2025-04-29 13:11:07 +02:00
Daniel Stenberg
2fa3d528ae
openssl: first unload the provider, then free the context
Doing it in the reversed order causes bad problems inside OpenSSL.

Closes #17223
2025-04-29 12:45:23 +02:00
Daniel Stenberg
cf1b709dff
etag-save.md: mention how using both options is a good idea
Ref: https://curl.se/mail/archive-2025-04/0011.html

Closes #17217
2025-04-29 10:58:19 +02:00
Stefan Eissing
89f5d45a33
ngtcp2+openssl: enable test 17_10
TLS session reuse in QUIC is also implemented for ngtcp2+openssl. Enable
the test.

Closes #17218
2025-04-29 10:46:25 +02:00
Daniel Stenberg
f2ce6c46b9
openssl: enable builds for *both* engines and providers
OpenSSL3 can in fact have both enabled at once. Load the provider and
key/cert appropriately. When loading a provider, the user can now also
set an associated "property string".

Work on this was sponsored by Valantic.

Closes #17165
2025-04-29 10:44:21 +02:00
Daniel Stenberg
e0ebc3ff13
lib: provide a getaddrinfo wrapper
This uses c-ares under the hood and supports the CURL_DNS_SERVER
environment variable - for debug builds only. The getaddrinfo()
replacement function is only used if CURL_DNS_SERVER is set to make a
debug build work more like a release version without the variable set.

'override-dns' is a new feature for the test suite when curl can be told
to use a dedicated DNS server, and test 2102 is the first to require
this.

Requires c-ares 1.26.0 or later.

Closes #17134
2025-04-28 23:48:02 +02:00
Daniel Stenberg
da33c1e349
cfilters: remove assert
The OSS-fuzz probe reaches this, so it can apparently in run-time. There
is already a run-time handling of the situation.

Closes #17211
2025-04-28 22:45:41 +02:00
Daniel Stenberg
7a1211d474
buildinfo: move from tests/server/ to src/, rename to curlinfo
Since a16485a42e, the test servers build with a different set of
options than the tool/lib - for example a different CURLDEBUG. To make
buildinfo better reflect the curl build, move it to src/ and build it
here using the local CURLDEBUG. Renamed to curlinfo to not get confused
with buildinfo.txt

I chose src/ and not lib/ because the file also uses tool-specific headers.

Assisted-by: Viktor Szakats
Closes #17187
2025-04-28 22:40:10 +02:00
Jay Satiro
4a70b9823b progress: fix integer overflow check
- Fix logic typo.

Prior to this change the overflow check was reversed, meaning it did
not stop an overflow condition and also if there wasn't an overflow it
erroneously set the total expected transfer size to the maximum value.

Follow-up to 69ce9a7f from earlier today.

Closes https://github.com/curl/curl/pull/17213
2025-04-28 14:07:32 -04:00
Daniel Stenberg
b4c8d19c6a
pull_request_template.md: remove again
It was just super annoying and bad

Closes #17212
2025-04-28 17:15:51 +02:00
Daniel Stenberg
69ce9a7feb
progress: avoid integer overflow when gathering total transfer size
Reported by OSS-fuzz

Closes #17207
2025-04-28 15:31:30 +02:00
Daniel Stenberg
771c15b603
smb: avoid integer overflow on weird input date
Found by OSS-fuzz

Closes #17206
2025-04-28 15:29:59 +02:00