Commit Graph

35235 Commits

Author SHA1 Message Date
Jeremy Drake
7a30481760 dllmain: exclude from Cygwin builds
On Cygwin, it is unsafe to call POSIX functions from DllMain, which
OPENSSL_thread_stop does.  Additionally, it should be unnecessary as
OpenSSL uses pthread_key_create to register a thread destructor to do
thread cleanup in a POSIX way.

Reported-by: Yuyi Wang

Ref: https://cygwin.com/pipermail/cygwin/2025-June/258235.html

Fixes #17262
Closes https://github.com/curl/curl/pull/17528
2025-06-03 14:30:31 -04:00
Stefan Eissing
f1e1c8b98a
tls BIOs: handle BIO_CTRL_EOF correctly
Needs to return 1 if EOF from underlying filter has been seen.

Fixes #17471
Reported-by: Michael Kaufmann
Closes #17526
2025-06-03 16:52:01 +02:00
Daniel Stenberg
c7658f274c
curl: make -N handled correctly
Options marked ARG_NO should have their 'toggle' value reverted when the
short option is used as it implies using the --no- prefix.

-N happens be the only short option flag for a --no- long option.

Reported-by: Stefan Eissing
Closes #17527
2025-06-03 16:51:00 +02:00
Viktor Szakats
741748e341
autotools: recognize more Linux targets when setting -D_GNU_SOURCE
To set `-D_GNU_SOURCE`.

Required to declare `accept4` on uclibc targets. `host_os` can have
the value `uclinux-uclibcgnueabi` in this case.

Fixing:
```
cf-socket.c: In function 'cf_tcp_accept_connect':
cf-socket.c:2141:18: error: implicit declaration of function 'accept4'; did you mean 'accept'? [-Werror=implicit-function-declaration]
 2141 |     s_accepted = accept4(ctx->sock, (struct sockaddr *) &add, &size,
```

Follow-up to 3d02872be7 #16979

Reported-by: Kadambini Nema
Fixes #17512
Closes #17524
2025-06-03 09:51:41 +02:00
Daniel Stenberg
f6ab4c8b75
cmdline-docs: mention HTTP resumed uploads to be shaky
In the documentation for the --continue-at and --range options.

A future version could implement support for the new standard HTTP resumed
uploads mechanism.

Ref: #17510
Closes #17521
2025-06-02 23:23:50 +02:00
Stefan Eissing
a084ad543e
pytest: do not use reserved chars in url queries
Closes #17458
2025-06-02 23:17:35 +02:00
Stefan Eissing
dc60a82747
scorecard: rework format and add json print
Improve the JSON result format to be more descriptive and
easier to parse.

Add --print option to scorecard.py that prints a saved JSON file
Add date field to score card.

Closes #17465
2025-06-02 23:15:33 +02:00
Daniel Stenberg
700b5445b2
test1498: verify "-T ."
Closes #17519
2025-06-02 13:33:20 +02:00
Daniel Stenberg
ccdcf40c38
RELEASE-NOTES: synced 2025-06-02 13:02:12 +02:00
Stefan Eissing
78dd083788
curl: upload from '.' fix
CURLOPT_NOPROGRESS is being set twice, if a file is uploaded from '.'.

Fix order of options so that '.' can override the global setting. Without
this, the `tool_readbusy_cb()` is never inoked and cannot unpause a
transfer waiting for more input.

Fixes #17513
Reported-by: denandz on github
Closes #17517
2025-06-02 12:49:38 +02:00
Daniel Stenberg
d591bc1416
tool_getparam: make --no-anyauth not be accepted
It was previously just ignored, now it triggers an error. It was never
documented (nor intended) to work.

Fixes #17508
Reported-by: Dan Fandrich
Closes #17511
2025-06-02 11:19:04 +02:00
Ruocco, Calvin
d3594be653
ws: tests and fixes
This started out as regression tests for the `curl_ws_recv()` and
`curl_ws_send()` implementation and ended up with a bugfix, additional
protocol validation and minor logging improvements.

- Fix reset of fragmented message decoder state when a PING/PONG is
  received in between message fragments.

- Fix undefined behavior (applying zero offset to null pointer) in
  curl_ws_send() when the given buffer is NULL.

- Detect invalid overlong PING/PONG/CLOSE frames.
- Detect invalid fragmented PING/PONG/CLOSE frames.
- Detect invalid sequences of fragmented frames.

  - a) A continuation frame (0x80...) is received without any ongoing
    fragmented message.
  - b) A new fragmented message is started (0x81/0x01/0x82/0x02...)
    before the ongoing fragmented message has terminated.

- Made logs for invalid opcodes easier to understand.
- Moved noisy logs to the `CURL_TRC_WS` log level.
- Unified the prefixes for WebSocket log messages: `[WS] ...`

- Add env var `CURL_WS_FORCE_ZERO_MASK` in debug builds.

  - If set, it forces the bit mask applied to outgoing payloads to
    0x00000000, which effectively means the payload is not masked at
    all. This drastically simplifies defining the expected `<protocol>`
    data in test cases.

- 2700: Frame types
- 2701: Invalid opcode 0x3
- 2702: Invalid opcode 0xB
- 2703: Invalid reserved bit RSV1 _(replaces 2310)_
- 2704: Invalid reserved bit RSV2
- 2705: Invalid reserved bit RSV3
- 2706: Invalid masked server message
- 2707: Peculiar frame sizes _(part. replaces 2311)_
- 2708: Automatic PONG
- 2709: No automatic PONG _(replaces 2312)_
- 2710: Unsolicited PONG
- 2711: Empty PING/PONG/CLOSE
- 2712: Max sized PING/PONG/CLOSE
- 2713: Invalid oversized PING _(replaces 2307)_
- 2714: Invalid oversized PONG
- 2715: Invalid oversized CLOSE
- 2716: Invalid fragmented PING
- 2717: Invalid fragmented PONG
- 2718: Invalid fragmented CLOSE
- 2719: Fragmented messages _(part. replaces 2311)_
- 2720: Fragmented messages with empty fragments
- 2721: Fragmented messages with interleaved pong
- 2722: Invalid fragmented message without initial frame
- 2723: Invalid fragmented message without final frame

- 2305: curl_ws_recv() loop reading three larger frames
  - This test involuntarily sent an invalid sequence of opcodes (0x01...,0x01...,0x81...) , but neither libcurl nor the test caught this! The correct sequence was tested in 2311 (0x01...,0x00...,0x80...). See below for 2311.
  - Validation of the opcode sequence was added to libcurl and is now tested in 2723.
  - Superseded by 2719 (fragmented message) and 2707 (large frames).
- 2307: overlong PING payload
  - The tested PING payload length check was actually missing, but the test didn't catch this since it involuntarily sent an invalid opcode (0x19... instead of 0x89...) so that the expected error occurred, but for the wrong reason.
  - Superseded by 2713.
- 2310: unknown reserved bit set in frame header
  - Superseded by 2703 and extended by 2704 and 2705.
- 2311: curl_ws_recv() read fragmented message
  - Superseded by 2719 (fragmented message) and 2707 (large frames).
- 2312: WebSockets no auto ping
  - Superseded by 2709.

- No tests for `CURLOPT_WRITEFUNCTION`.
- No tests for sending of invalid frames/fragments.

Closes #17136
2025-06-02 11:15:38 +02:00
Stefan Eissing
04c3895ceb
tests: improve server start reliability
Fix all lookups of the port a server is using by
- unlinking the portfile before the start
- waiting `timeout` seconds for the port file to exist
  and contain a positive number
- check results and fail server start when port could
  not be determined

Closes #17516
2025-06-02 11:03:10 +02:00
Stefan Eissing
e61c287e73
test1510: fix expectation
The test had `Closing connection 0` in its expectations, but a stripfile
expression that removes such lines. No recent changes, but started failing
this morning.

Too little coffee for me? Or what triggered this?

Closes #17515
2025-06-02 11:02:14 +02:00
Daniel Stenberg
f738093896
asyn-thrdd: fix cleanup when RR fails due to OOM
Fixes #17507
Closes #17514
2025-06-02 09:08:04 +02:00
Viktor Szakats
516e9ccab3
GHA/non-native: un-ignore tests on OpenBSD, bump to -j8 for NetBSD/FreeBSD
- un-ignore tests (3017, FTP, TFTP) on OpenBSD
  Patch-by: Jacob Mealey
  Ref: https://github.com/curl/curl/issues/13623#issuecomment-2925129037
  Fixes: #13623

- KNOWN_BUGS: drop TFTP failures issue on OpenBSD.
  Fixes: #13623

- bump test parallelism to `-j8` (from `-j4`) for NetBSD, FreeBSD,
  to match OpenBSD.
  Before: https://github.com/curl/curl/actions/runs/15371760479
  After: https://github.com/curl/curl/actions/runs/15371937205

- FreeBSD: sync cmake `TFLAGS` with autotools. (This branch is not
  currently hit in CI.)
  Follow-up to 7f3d598276 #15040

Closes #17505
2025-06-02 00:21:52 +02:00
Viktor Szakats
7020ba7979
tests: re-enable 1510, unignore 2027 2051 in GHA/macos, document heimdal memleak
- test1510: it was marked flaky, then disabled. Keep the flaky flag
  and allow it to run again.
  Ref: ef02da3156
  Ref: 0110cced2a

- GHA/linux: extend information about the heimdal valgrind failures.

- GHA/macos: unignore 2037 2041 in torture tests. They no longer
  appear flaky.
  Follow-up to 4b791dca37 #14667

Closes #17462
2025-06-02 00:21:51 +02:00
Yedaya Katsman
4ac7087306
docs/tests: remove mention of hyper
Closes #17500
2025-06-01 13:45:52 +02:00
Yedaya Katsman
8645e4f6ee
license: update some copyright links to curl.se
Instead of curl.haxx.se

Also widen the .gitignore for libtest, since it missed libtest751,
so ignore three digit tests that start with 5-9 instead of just 5-6.

Closes #17502
2025-06-01 13:44:15 +02:00
Daniel Stenberg
70115763c3
memanalyze.pl: fix getaddrinfo/freeaddrinfo checks
It did not parse them correctly. Problem never shows before we don't run
torture tests with these functions - yet.

Seen when enabling torture tests with the threaded resolver.

Closes #17503
2025-06-01 10:24:31 +02:00
Daniel Stenberg
83c90e5047
VULN-DISCLOSURE-POLICY.md: the distros list wants <= 7 days embargo
Closes #17497
2025-05-31 18:00:58 +02:00
z2_
d1145df24d
ws: handle blocked sends better
Closes #17496
2025-05-31 17:04:18 +02:00
Yedaya Katsman
2cf19c245e
tests: test mtls also w/ clientAuth EKU only
The google chrome root program will stop allowing roots that have both
clientAuth and ServerAuth [1].

In one of the mtls tests, use a certificate with only the clientAuth
EKU.

[1] https://googlechrome.github.io/chromerootprogram/#322-pki-hierarchies-included-in-the-chrome-root-store

Closes #17493
2025-05-31 15:20:25 +02:00
Yedaya Katsman
b53848738c
tests: test mtls with --insecure
Closes #17493
2025-05-31 15:20:25 +02:00
Yedaya Katsman
215b5f389a
tests: fix checks for https-mtls proto
If there were two tests using the "https-mtls" server there was a perl
unbound variable error, since certfile wan't set. Additionally, once the
responsiveserver function was actually called, it failed finding a
responsiveness function. For now I made it use the `verifypid` function,
since the curl execution in `verifyhttp` doesn't know about client
certificates.

Closes #17493
2025-05-31 15:20:21 +02:00
Stefan Eissing
4977747f0d
ftp: fix teardown of DATA connection in done
When ftp_done() is called to terminate the transfer, it needs to tear
down any open SECONDARY filter chain. The condition on when to do that
was relying on there to be a valid socket. This is not sufficient as the
socket is only set *after* happy eyeballing has decided on one.

Instead of checking for a valid conn->sock, check if any connection
filter is installed.

Fixes #17482
Reported-by: Rasmus Melchior Jacobsen
Closes #17491
2025-05-31 15:15:05 +02:00
Daniel Stenberg
4b76a821f8
RELEASE-NOTES: synced 2025-05-31 15:12:43 +02:00
Stefan Eissing
759d33a25c
tests: await portfile to be complete
When running under load, a started server may not produce a valid portfile
before the runner starts reading it. If the read is not successful, wait
for 100ms and try again, timing out after 15 seconds.

Fixes #17492
Closes #17495
2025-05-31 13:58:18 +02:00
Daniel Stenberg
fe81a80ae7
spelling: call it null-terminate consistently
With a dash, using two Ls. Also for different forms of the word.

Use NULL in all uppercase if it means a zero pointer.

Follow-up to 307b7543ea

Closes #17489
2025-05-30 17:29:45 +02:00
Stefan Eissing
54834b4ad3
wolfssl: fix sending of early data
Early data was reported as being sent, but was not. While everything was
aligned with the Gods and early data was reported as accepted, the
actual sending required another call to wolfSSL.

Fixes #17481
Reported-by: Ethan Everett
Closes #17488
2025-05-30 11:44:20 +02:00
Daniel Stenberg
bdb7d8b004
spelling: 'a' vs 'an'
Closes #17487
2025-05-30 11:38:35 +02:00
Viktor Szakats
7a14898264
GHA/non-native: drop AmigaOS jobs, toolchain no longer available
Fixing:
```
[...] https://github.com/bebbo/amiga-gcc/releases/download/Mechen/amiga-gcc.tgz
curl: (22) The requested URL returned error: 404
```
Ref: https://github.com/curl/curl/actions/runs/15342088546/job/43170188027#step:2:17

Reason:
"As a sign of protest against the refusal to restore 2FA accounts,
this account is now empty."
Ref: https://github.com/bebbo/

If someone happens to have a local copy of the toolchain, we may use it
to restore the AmigaOS jobs.

Closes #17486
2025-05-30 10:42:53 +02:00
Viktor Szakats
94d2ae6205
libssh: adjust indentation
Follow-up to 54d04e2536 #17478
2025-05-30 09:58:19 +02:00
Daniel Stenberg
b13a7a3ec4
misc: we write *an* IPv6 address
Add it as a "bad word"

Closes #17484
2025-05-30 07:53:31 +02:00
Daniel Stenberg
12d13b84fa
tool_getparam: remove two nextarg NULL checks
Because by checking for NULL when the argument can never be NULL, they
mislead the static analyzers into thinking it *can* be NULL and then the
analyzers tend to warn about other places in the code *without* the
check!

Closes #17483
2025-05-29 11:54:49 +02:00
Samuel Henrique
620401f193
docs: fix typos
After Gmail called out the typo I fixed on
532d89a866, I've decided to paste the
whole man page into Google docs and check what other issues it would
spot.

I know, it sounds silly, but I've just spent the last hour and a half
going over each one of them and fixing everything which was a true
finding and non-controversial.

Closes #17480
2025-05-29 10:21:52 +02:00
John Bampton
217fd5b424
misc: fix spelling
Closes #17479
2025-05-29 10:21:05 +02:00
Viktor Szakats
4c6b74e1e8
cmake: fix missed version number for multi-pkg-config detections
It broke cmake builds with OpenSSL 3.5.0 and ngtcp2 1.12.0 or newer,
when detected via `pkg-config`.

For brotli, mbedtls, LDAP, ngtcp2 builds, it caused their version
numbers missing from the configure log when detected via `pkg-config`.

Regression from 01e45f81bd #16980
Regression from 3b501976a9 #16479

Bug: https://github.com/curl/curl/pull/16980#issuecomment-2916811388
Reported-by: x-xiang on github

Closes #17476
2025-05-29 06:59:02 +02:00
John Bampton
54d04e2536
misc: fix spelling
Closes #17478
2025-05-28 22:47:12 +02:00
Daniel Stenberg
fa3f889752
tests: move test docs into /docs
In an attempt to make them easier to find.

The man pages runtests.md and testcurl.md are in /docs

The rest of the test documentation is in /docs/tests

Closes #17463
2025-05-28 15:00:03 +02:00
Daniel Stenberg
46733c585b
RELEASE-NOTES: synced
Bumped to 8.14.1
2025-05-28 14:55:59 +02:00
Stefan Eissing
71bb004c29
http: fail early when rewind of input failed when following redirects
When inspecting a possible follow HTTP request, the result of a rewind
of the upload data was ignored as it was not clear at that point in time
if the request would become a GET.

This initiated the followup, rewound again, which failed again and
terminated the follow up.

This was confusing to users as it was not clear of the follow up was
done or not.

Fix: fail the early rewind when the request is not converted to GET.

Fixes #17472
Closes #17474
Reported-by: Jeroen Ooms
2025-05-28 14:53:02 +02:00
Stefan Eissing
d16ccbd55d
multi: fix add_handle resizing
Due to someone being stupid, the resizing of the multi's transfer
table was actually shrinking it. Oh my.

Add test751 to reproduce, add code assertion.

Fixes #17473
Reported-by: Jeroen Ooms
Closes #17475
2025-05-28 14:48:44 +02:00
Daniel Stenberg
698491f444
tool_getparam: refactored, simplified
- add dedicated option functions for bools/none/strings
- simplify clearing (some) arguments, use '*' instead of ' '
- scripts/top-complexity: remove getparameter from whitelist
- handle --help separately
- getstr and getstrn do not allow a NULL input
- improve the ;auto check, it needs to be trailing
- add toggle bit helper function
- unify an error message for bad --no- use
- introduce generic handling of deprecated options: ARG_DEPR
- handle --no- prefix on more booleans:

    --cert-status
    --doh-cert-status
    --false-start
    --mptcp
    --ssl-no-revoke
    --ssl-revoke-best-effort
    --tcp-fastopen

Closes #17448
2025-05-28 14:25:32 +02:00
Daniel Stenberg
6eea7219a5
BUG-BOUNTY.md. mention the medium bounty amount in 2025
Closes #17470
2025-05-28 08:47:26 +02:00
Daniel Stenberg
4dacb79fcd
RELEASE-NOTES: synced
8.14.0 release
2025-05-28 07:40:54 +02:00
Daniel Stenberg
950ef272fa
docs/THANKS: updated from the 8.14.0 release 2025-05-28 07:40:54 +02:00
renovate[bot]
a71ea39a33
GHA: Update ngtcp2/nghttp3 to v1.10.1
Closes #17466
2025-05-27 17:10:53 +02:00
Samuel Henrique
d3a3d7afb6
wcurl: update to v2025.05.26
This release fixes a small issue with the retry strategy:

 * Increase number of retries to 5 (32 sec total time), fixing the
   problem with misleading output. Previously, it was showing a higher
   number of retries than what would be done and it always did only 3.

Closes #17461
2025-05-27 09:29:43 +02:00
Daniel Stenberg
c0d777c319
curl_url_get.md: don't call it normalized
Because that's not what it does.

Reported-by: Alberto Leiva Popper
Fixes #16829
Closes #17464
2025-05-27 09:25:32 +02:00