Commit Graph

34814 Commits

Author SHA1 Message Date
Daniel Stenberg
ed15fce1fd
src: avoid strdup on platforms not doing UTF8 conversions
... and use more const strings.

Closes #16560
2025-03-05 09:19:09 +01:00
Orgad Shaneh
7298c4320b
docs: adapt to removed --with-random
Amends 269fdd4c6e.

Closes #16565
2025-03-05 08:19:15 +01:00
Daniel Stenberg
d121bc9884
tool_getparam: parse --trace-config without strdup()/free()
Closes #16559
2025-03-05 07:44:43 +01:00
Viktor Szakats
0825cf42f0
GHA/windows: drop running tests with dl-mingw 7.3.0 due to flakiness
This job was never stable. Bumping to -j8 (from -j4) possibly made it
flakier: 032447e624 #16271

Keep this job for build tests and drop running tests to improve the CI
experience and save CI time.

It's also a simple build with no dependencies. CI continues to build
a similar job with 9.5.0, which is more stable.

It remains a puzzle why builds with this toolchain (7.3.0 win32 threads
mingw-builds) is flakier and requires more test exceptions than the
indentical build with a slightly different build/version of
the toolchain (9.5.0 posix threads winlibs_mingw).

Ref: #14854
Closes #16564
2025-03-05 03:10:45 +01:00
Viktor Szakats
aa0d70fef7
build: tidy-ups around inet_pton
- cmake: make the `inet_pton`/`inet_ntop` detection codepath explicit
  for WinCE. To not rely on an empty `HAVE_WIN32_WINNT`.

- tests/server/mqttd: drop `inet_pton` header and lib source.

- tests/server: move `inet_pton` lib source to a variable.

Closes #16563
2025-03-05 03:10:45 +01:00
Daniel Stenberg
e4e8f1226f
tool_getparam: do parse_upload_flags without the alloc/free
Follow-up to 6758aa722d

Closes #16552
2025-03-04 23:44:12 +01:00
Viktor Szakats
0e0db0e385
GHA: brew --no-lock an invalid option now, drop
```
Error: invalid option: --no-lock
```
Ref: https://github.com/curl/curl/actions/runs/13659344413/job/38186577572#step:2:655

Closes #16561
2025-03-04 19:33:50 +01:00
Viktor Szakats
6f1031e9d5
tests/server: replace strerror with sstrerror in socksd
To follow the `errno` -> `SOCKERRNO` update.

Missed from the previous commit.

Follow-up to adcfd4fb3e #16553
2025-03-04 18:32:51 +01:00
Viktor Szakats
adcfd4fb3e
tests/server: replace errno with SOCKERRNO in sockfilt, socksd, sws
To correctly read the winsock2 result code on Windows.

Follow-up to de2126b182 #5241
Ref: 5e855bbd18 (r38507132)
Ref: #14854
Closes #16553
2025-03-04 18:23:40 +01:00
Daniel Stenberg
d251ecb5c8
RELEASE-NOTES: synced 2025-03-04 17:27:28 +01:00
Michał Antoniak
8e07429e43
cf-socket: remove empty switch
Closes #16555
2025-03-04 17:21:27 +01:00
Daniel Stenberg
57ac8aed3f
tests/data/Makefile.am: fix trailing slash issue
Follow-up from 6758aa722d

Fixes #16556
Closes #16558
2025-03-04 16:43:39 +01:00
tiymat
6758aa722d
IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
Set properties on the uploaded resource.

Test 3209 and 3210 verify.

Closes #15970
2025-03-04 15:21:16 +01:00
Samuel Dionne-Riel
0cd2670afb
libssh2: print user with verbose flag
This change:

 - Breaks out the existing print out of the LIBSSH2_DEBUG compile-time
   flag
 - Adds (single) quotation marks around the string to better expose the
   actual value
 - Adds a NULL print if not set, mirroring other verbose prints in
   libssh2

Why was this done?

I was trying out the `sftp` option in `curl`, and found myself hitting
an issue where I was not able to get curl to tell me which username it
was using to connect to a host.

With this change, the `User: ` line is printed with `-v`, just like
other SSH verbose prints.

Instead of using the pattern used with *SSH MD5 public key*, where a
ternary is used to print `NULL` on NULL values, it is using a different
branch to add quotes around the string value.

The quotes around the string value are used to better expose to the user
an empty string value, compared to "no-value".

Closes #16430
2025-03-04 14:47:52 +01:00
Daniel Stenberg
18c6d5512f
lib: fix two curlx_strtoofft invokes
- cf-h1-proxy: check return code and return error if the parser fails

- http: make the Retry-After parser check for a date string first then
  number to avoid mis-parsing the begining of a date as a number

Closes #16548
2025-03-04 14:40:38 +01:00
Viktor Szakats
9213e4e497
tests/server: round of tidy-ups
Dedupe, merge macros, globals, make symbols local where possible.
Drop unused macros and headers. Drop `DEFAULT_LOGFILE` macro in favour
of `--logfile` command-line option.

Ref: #15000
Closes #16525
2025-03-04 04:17:44 +01:00
Viktor Szakats
387311012c
tidy-up: alphasort lists, indentation/whitespace, pp
- cmake/win32-cache: alphasort items.
- configure.ac: alphasort `CURL_CHECK_FUNC_*` checks.
- configure.ac: alphasort `AC_CHECK_FUNCS` checks.
- prefer `#ifdef`/`#ifndef`.
- lib/asyn-thread: drop unused value of `USE_HTTPSRR_ARES`.
- lib/formdata: drop unused header `libgen.h`.
- indentation, whitespace.

Closes #16490
2025-03-04 01:46:53 +01:00
Viktor Szakats
3834f31b22
cmake: exclude -MP for clang-cl again
To avoid this warning/error (seen with Ninja generator):
```
clang-cl: warning: argument unused during compilation: '-MP' [-Wunused-command-line-argument]
```

Curious why CI missed it. Maybe due to using a Visual Studio generator.

Regression from e0fd5790d9 #16004
Closes #16550
2025-03-04 01:01:09 +01:00
Viktor Szakats
61407464bf
cmake: allow CURL_STATIC_CRT with UCRT VS2015+ builds
After this patch, we're back to 8.12.1, but disallowing
`CURL_STATIC_CRT=ON` with shared curl exe built with VS2013 or older.
Because those may crash. A stable reprducer is with `ENABLE_DEBUG=ON`
and calling `curl.exe -V`.

You can pass the necessary CMake and MSVC linker options manually,
to get around this condition.

Shared build with static UCRT may be crashing too, depending on
conditions. Consult the documentation about limitations of static CRT:
https://learn.microsoft.com/cpp/c-runtime-library/crt-library-features

Follow-up to 049352dd80 #16516
Follow-up to edfa537100 #16456
Ref: #16394
Closes #16522
2025-03-04 01:01:09 +01:00
Jay Satiro
9a0767017c ftp: fix comment
- Explain ftp_conn's newhost and newport in the struct definition.

Follow-up to 1485e892 which changed the order of some struct members to
reduce struct size.

Closes https://github.com/curl/curl/pull/16538
2025-03-03 18:21:33 -05:00
Daniel Stenberg
324b439634
http_chunks: replace a strofft call with curl_str_hex
Make it not skip leading blanks. There should not be any.

Closes #16546
2025-03-03 23:10:31 +01:00
Daniel Stenberg
aa18891dda
docs/cmdline-opts: unify HTTP version style in --help output
$ curl -h all | grep -- --http

Now:

     --http0.9                      Allow HTTP/0.9 responses
 -0, --http1.0                      Use HTTP/1.0
     --http1.1                      Use HTTP/1.1
     --http2                        Use HTTP/2
     --http2-prior-knowledge        Use HTTP/2 without HTTP/1.1 Upgrade
     --http3                        Use HTTP/3
     --http3-only                   Use HTTP/3 only

Before:

     --http0.9                      Allow HTTP 0.9 responses
 -0, --http1.0                      Use HTTP 1.0
     --http1.1                      Use HTTP 1.1
     --http2                        Use HTTP/2
     --http2-prior-knowledge        Use HTTP 2 without HTTP/1.1 Upgrade
     --http3                        Use HTTP v3
     --http3-only                   Use HTTP v3 only

Closes #16542
2025-03-03 23:09:19 +01:00
Daniel Stenberg
48ba23070a
tool_operate: remove unnecessary (long) typecasts
Closes #16540
2025-03-03 23:08:12 +01:00
Stefan Eissing
35cfb081d2
pytest: check overlarge response headers
Add test_01 11, 12 and 13 to check various very long response
headers (accumulated and single) with http/1.1 and h2.

Closes #16541
2025-03-03 15:46:55 +01:00
Stefan Eissing
cee9cefa76
multi_ev: use mid instead of id for transfer hashes
`data->id` is unique in the same connection pool, but a multi may
involved more than one pool. `data->mid` is unique inside the multi and
since multi_ev lives inside one multi, the `mid` is the right thing to
use.

Closes #16545
2025-03-03 15:44:19 +01:00
Daniel Stenberg
7b0240c077
curl.h: convert CURLUSESSL* names to defines
So that we can use L suffix.

Follow-up to 2ec00372a1

Closes #16539
2025-03-03 12:03:02 +01:00
Daniel Stenberg
fb13923dd6
lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
With this change, the argument passed to the CURLOPT_FOLLOWLOCATION
option is now instead a "mode" instead of just a boolean. Documentation
is extended to describe the two new modes.

Test 1571 to 1581 verify.

Closes #16473
2025-03-03 11:35:48 +01:00
Daniel Stenberg
294136b754
lib: replace while(ISBLANK()) loops with Curl_str_passblanks()
- replace several ISSPACE() with ISBLANK(), since the former also skips
  CR and LF which in most cases should not occur where this macro is
  used

- after this commit, there is no ISSPACE() user left in libcurl code, but
  unfortunately tool and test code use the macro so it cannot be removed.

Closes #16520
2025-03-03 10:56:09 +01:00
Peng-Yu Chen
f61b218e7d
http2: enhance error messages on Curl_dyn* upon receiving headers
This is a partial fix of #16535. The error message format is borrowed
from the existing code[1].

Sample message before:
    curl: (56) process_pending_input: nghttp2_session_mem_recv() returned -902:The user callback function failed

Sample message after:
    curl: (56) Error receiving HTTP2 header: 100(A value or data field grew larger than allowed)

[1]: df672695e5/lib/http2.c (L1999-L2000)

Closes #16536
2025-03-03 10:30:54 +01:00
Stefan Eissing
0d3b5937b3
OpenSSL/quictls: add support for TLSv1.3 early data
based on #16450

Adds support for TLSv1.3 early data for TCP and QUIC via ngtcp2.

Closes #16477
2025-03-03 09:27:04 +01:00
renovate[bot]
b5d99a5474
GHA: update dependency nghttp2/nghttp2 to v1.65.0
Tweaked-by: Viktor Szakats

Closes #16534
2025-03-03 09:03:14 +01:00
renovate[bot]
aa51da563a
GHA: update actions/cache digest to d4323d4
Closes #16510
2025-03-03 09:01:15 +01:00
renovate[bot]
1fe62d9bae
GHA: update actions/download-artifact digest to cc20338
Closes #16500
2025-03-03 08:59:40 +01:00
renovate[bot]
0ec77026bc
docker: update debian:bookworm-slim Docker digest to ceac69a
Closes #16471
2025-03-03 08:58:32 +01:00
renovate[bot]
ce6d34860c
GHA: update actions/upload-artifact digest to 4cec3d8
Closes #16431
2025-03-03 08:56:40 +01:00
Stefan Eissing
df672695e5
shutdowns: split shutdown handling from connection pool
Further testing with timeouts in event based processing revealed that
our current shutdown handling in the connection pool was not clear
enough. Graceful shutdowns can only happen inside a multi handle and it
was confusing to track in the code which situation actually applies. It
seems better to split the shutdown handling off and have that code
always be part of a multi handle.

Add `cshutdn.[ch]` with its own struct to maintain connections being
shut down. A `cshutdn` always belongs to a multi handle and uses that
for socket/timeout monitoring.

The `cpool`, which can be part of a multi or share, either passes
connections to a `cshutdn` or terminates them with a one-time, best
effort.

Add an `admin` easy handle to each multi and share. This is used to
perform all maintenance operations where no "real" easy handle is
available. This solves the problem that the multi admin handle requires
some additional initialisation (e.g. timeout list).

The share needs its admin handle as it is often cleaned up when no other
transfer or multi handle exists any more. But we need a `data` in almost
every call.

Fix file:// handling of errors when adding a new connection to the pool.

Changes in `curl` itself:

- for parallel transfers, do not set a connection pool in the share,
  rely on the multi's connection pool instead. While not a requirement
  for the new `cshutdn` to work, this is

  a) helpful in testing to trigger graceful shutdowns
  b) a broader code coverage of libcurl via the curl tool

- on test_event with uv, cleanup the multi handle before returning from
  parallel_event(). The uv struct is on the stack, cleanup of the multi
  later will crash when it tries to register sockets. This is a "eat
  your own dogfood" related fix.

Closes #16508
2025-03-02 11:13:34 +01:00
renovate[bot]
3afa47b627
GHA: update dependency awslabs/aws-lc to v1.47.0
Closes #16530
2025-03-02 10:52:08 +01:00
Daniel Stenberg
2633961d56
asyn: bring back port to the Curl_async struct
To make sure we store and use the correct port used for this particular
lookup.

Partial revert of 8ded8e5f3f

Fixes #16531
Reported-by: Jay Satiro
Closes #16532
2025-03-02 10:51:00 +01:00
Daniel Stenberg
5f72a69076
RELEASE-NOTES: synced 2025-03-01 18:44:56 +01:00
Stefan Eissing
1aa69221be
hash_offt: standalone hash for curl_off_t
Add a standalong hash table for curl_offt_t as key. This allows a
smaller memory footprint and faster lookups as we do not need to deal
with variable key lengths.

Use in all places we had the standard hash for this purpose.

Closes #16442
2025-03-01 18:42:10 +01:00
Stefan Eissing
2809723ddf
pytest: test negotiate with http proxy
Fixes #14973
Reported-by: stevenpackardblp on github

When curl negotiated with a http: proxy for a https: request, it
wrongly believed there must be an SSL filter present, which during
CONNECT, there is not.

25b445e fixed this. This PR adds a pytest case for the setup.

Closes #16136
2025-03-01 18:40:40 +01:00
Viktor Szakats
b4834a7d6d
examples: prefer return over exit() (cont.)
Some of these calls were not in callbacks. These examples may leak
handles.

Also fix some whitespace.

Follow-up to 08c7c937dc #16507
Closes #16524
2025-03-01 02:09:02 +01:00
Viktor Szakats
5693342ec2
winbuild: reduce command-line length by dropping whitespace
Keep the `@for %%i in [...]` lines within limits by stripping whitespace
from the input `.c` source lists read from `Makefile.inc`. To avoid this
error after adding a new `.c` source:
```
configuration name: libcurl-vc14-x64-release-dll-ssl-dll-ipv6-sspi
NMAKE : fatal error U1095: expanded command line 'for %i in (altsvc.obj            amigaos.obj
           asyn-ares.obj         asyn-thread.obj       base64.obj            bufq.obj
              bufref.obj            cf-h1-proxy.obj       cf-h2-proxy.obj       cf-haproxy.obj [...]
  vssh/wolfssh.obj) do @echo ..\builds\libcurl-vc14-x64-release-dll-ssl-dll-ipv6-sspi-obj-lib/%i \
                   ' too long
Stop.
Command exited with code 2
```
Ref: https://ci.appveyor.com/project/curlorg/curl/builds/51605338/job/dqg6qtebtscb279g#L44

Reported-by: Stefan Eissing
Bug: https://github.com/curl/curl/pull/16508#issuecomment-2690443409
Fixes #16521
Closes #16528
2025-03-01 02:04:42 +01:00
Dan Fandrich
c693cc02b0 docs: vulnerabilities in debug code are not eligible for a bounty
This is code that is off by default and is therefore treated as a
regular bug.

Ref: #16526
Closes #16527
2025-02-28 14:21:46 -08:00
Viktor Szakats
e7751571eb
GHA/macos: use quictls in some jobs, other small improvements
- enable quictls in autotools and cmake jobs. autotools requires
  a workaround due to wrong libpath in the quictls pkg-config.
  nghttp3 is offered by Homebrew, but not ngtcp2, to enable H3.

- install `libnghttp2` rather than `nghttp2`.
  `libnghttp2` is preinstalled and smaller. It also avoids detecting
  `nghttpx`, which confuses `pytest`.

- limit `brew unlink openssl` to libressl/quictls jobs.

Closes #16517
2025-02-28 16:58:12 +01:00
Zhaoming Luo
7211576442
tests: fix comment in lib533
Closes #16523
2025-02-28 16:12:20 +01:00
Stefan Eissing
794dfe7fc4
gnutls: fix use of pkcs11 urls for keys/certs
Fixes #16249
Forwarded-to-us-by: Carlos Henrique Lima Melara

Always use `gnutls_certificate_set_x509_key_file2()` for loading keys
and certificates, even without a password, since this function support
pkcs11 urls.

Thanks to @tatsuhiro-t for finding this out.
Help-by: Tatsuhiro Tsujikawa

Closes #16472
2025-02-28 16:08:10 +01:00
Viktor Szakats
049352dd80
cmake: allow CURL_STATIC_CRT with shared libcurl and no curl exe
Follow-up to edfa537100 #16456

Closes #16516
2025-02-28 13:11:41 +01:00
Viktor Szakats
08c7c937dc
tidy-up: prefer return over exit(), fix fallouts
To avoid breaking the control flow and align to majority of code
already using `return`.

`exit()` has the side-effect of suppressing leak detection in cases.
Fix fallouts detected after switching to `return`.

- configure:
  - fix `getaddrinfo` run test to call `freeaddrinfo()` to pacify ASAN,
    and call `WSACleanup()` to deinit winsock2.
  - fix `getifaddrs` run test to call `freeifaddrs()` to pacify ASAN.
- tests/server:
  - setup `atexit(win32_cleanup)` via `win32_init()`.
  - return 2 instead of 1 on winsock2 init failures.
  - sws: goto cleanup instead of `exit()` in `http_connect()`.
    Follow-up to 02dfe71937 #7235
- tests/client/http:
  - cleanup memory to pacify ASAN in `h2-upgrade-extreme`,
    `tls-session-reuse`.
- examples:
  - block_ip: fix memory leak reported by CI.
  - http2-upload: avoid handle leaks.

Untouched `exit()` calls, made from callbacks:
- docs/examples: ephiperfifo.c, ghiper.c, hiperfifo.c
- tests/libtest: lib582.c, lib655.c, lib670.c
- tests/server: tftpd.c

Closes #16507
2025-02-28 13:11:41 +01:00
Stefan Eissing
2e585f5640
test488: set --output-dir
Otherwise the downloaded files land in the `tests` directory and
show up in git status.

Closes #16519
2025-02-28 12:47:31 +01:00