Commit Graph

35764 Commits

Author SHA1 Message Date
Stefan Eissing
219302b4e6
openssl-quic: fix shutdown when stream not open
Check that h3 stream had been opened before telling nghttp3 to
shut it down.

Fixes #16998
Reported-by: Demi Marie Obenour
Closes #17003
2025-04-10 08:38:58 +02:00
Daniel Stenberg
4a9657a890
KNOWN_BUGS: fix link in sivg4 issue 16.3
Fixes #17007
Reported-by: Demi Marie Obenour
Closes #17009
2025-04-10 08:29:53 +02:00
Jake Yuesong Li
320eed00a4
HTTP3.md: fix incorrect variable placeholders
Closes #17008
2025-04-10 08:18:56 +02:00
Viktor Szakats
6af7ab3b39
cmake: quotes, whitespace, use VERSION_GREATER_EQUAL
- `NOT` + `VERSION_LESS` -> `VERSION_GREATER_EQUAL`
  Available since 3.7, which is the minimum required for curl:
  https://cmake.org/cmake/help/latest/command/if.html#version-greater-equal
- make `CMAKE_REQUIRED_*` argument quotes consistent.
- make `CMAKE_REQUIRED_*` space alignment consistent.
- drop quote from version value for consistency with other cases.
- formatting

Closes #17002
2025-04-10 01:42:59 +02:00
Viktor Szakats
2485a2d100
tests/ech_tests.sh: sync shebang with rest of bash scripts
Closes #17001
2025-04-10 01:42:59 +02:00
Viktor Szakats
3c868fbf7f
certs: drop unused default_bits from .prm files
Cert generation do not use these default values, some were also low,
and they were RSA-specific, and the generator recently switched to ECC.

Closes #16999
2025-04-10 01:42:59 +02:00
Daniel McCarney
2ade14b666
build: check required rustls-ffi version
Try to enforce that the Rustls vTLS backend is only used with
rustls-ffi 0.15 - the documentation already describes this as
the required version.

Follow-up from https://github.com/curl/curl/issues/16890

Closes #16922
2025-04-09 09:29:20 +02:00
Viktor Szakats
304b01b8cf
cmake: use INCLUDE_DIRECTORIES prop to specify local header dirs
To use more modern cmake, and make it somewhat more obvious where these
header directories should apply.

Also move setting the directory property _before_ defining targets,
to make them inherit this directory property.

Ref: https://cmake.org/cmake/help/latest/command/include_directories.html
Ref: https://cmake.org/cmake/help/latest/prop_dir/INCLUDE_DIRECTORIES.html

Follow-up to 45f7cb7695 #16238

Closes #16993
2025-04-08 19:09:58 +02:00
Daniel Stenberg
625f2c1644
lib: include files using known path
by including headers using "../[header]" when done from C files in
subdirectories, we do not need to specify the lib source dir as an
include path and we reduce the risk of header name collisions with
headers in the SDK using the same file names.

Idea-by: Kai Pastor

Ref: #16949
Closes #16991
2025-04-08 17:00:00 +02:00
dependabot[bot]
7e4d516bcb
GHA: bump rojopolis/spellcheck-github-actions to 0.48.0
Bumps [rojopolis/spellcheck-github-actions](https://github.com/rojopolis/spellcheck-github-actions) from 0.47.0 to 0.48.0.
- [Release notes](https://github.com/rojopolis/spellcheck-github-actions/releases)
- [Changelog](https://github.com/rojopolis/spellcheck-github-actions/blob/master/CHANGELOG.md)
- [Commits](ed0756273a...23dc186319)

---
updated-dependencies:
- dependency-name: rojopolis/spellcheck-github-actions
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Closes #16988
2025-04-08 16:58:10 +02:00
renovate[bot]
c8014fd978
GHA: update openssl/openssl to v3.5.0
Closes #16997
2025-04-08 16:57:08 +02:00
Johan Eliasson
23150149f6
docs: fix incorrect shell substitution in docker run example command
Corrected the volume mount path in the Docker run example by replacing
`(pwd)` with the shell substitution syntax `$(pwd)`. This ensures the
current working directory is properly mounted into the container.

Closes #16990
2025-04-08 16:13:30 +02:00
renovate[bot]
cb9b4a2c97
Dockerfile: update debian:bookworm-slim Docker digest to 4b44499
Closes #16992
2025-04-08 16:11:11 +02:00
Daniel Stenberg
eeed87f056
mk-ca-bundle.pl: follow redirects
The Mozilla hosted files have started to redirect. Follow them to restore
script functionality.

Reported-by: Harry Sintonen
Closes #16995
2025-04-08 11:47:05 +02:00
Daniel Stenberg
461ebbd336
tests/tunit: make a separate directory for tool-based unit tests
Separated from library based unit tests to not confuse memory management
etc. Move 1394 and 1604 there.

Closes #16983
2025-04-08 08:08:05 +02:00
Viktor Szakats
04c78c897b
curl_multibyte: fixup low-level calls, include in unity builds
Also adjust `()` around low-level calls preventing macro overrides via
e.g. `memdebug.h`:
- add for `malloc` and `free`.
- drop for `_open`. (We do not override `_open` in curl.)

Tidy-up: also sync libcurlu custom macro order in cmake with autotools.

Follow-up to f42a279ee3 #11928

Closes #16742
2025-04-07 22:33:24 +02:00
Andy Pan
131a2fd5aa
socketpair: support pipe2 where available
By replacing pipe with pipe2, it would save us 4 extra system calls of
setting O_NONBLOCK and O_CLOEXEC. This system call is widely supported
across UNIX-like OS's: Linux, *BSD, and SunOS derivatives - Solaris,
illumos, etc.

Ref:
https://man7.org/linux/man-pages/man2/pipe.2.html
https://man.freebsd.org/cgi/man.cgi?query=pipe
https://man.dragonflybsd.org/?command=pipe2
https://man.netbsd.org/pipe.2
https://man.openbsd.org/pipe.2
https://docs.oracle.com/cd/E88353_01/html/E37841/pipe2-2.html
https://illumos.org/man/2/pipe2
https://www.gnu.org/software/gnulib/manual/html_node/pipe2.html

Closes #16987
2025-04-07 12:35:17 +02:00
Yedaya Katsman
8988f33f62
tests: Add https-mtls server to force client auth
- test2088 verifies that mutual tls works

This adds a new certificate to generate which has the clientAuth key
usage enabled, and uses it to connect to a https-mtls server.

Closes #16923
2025-04-07 08:46:56 +02:00
Yedaya Katsman
0f201d41d9
tests: removes CApath in stunnel
It wasn't used, and didn't do anything since the folder it got didn't
have files with names of the hash of the subjects. [1]

[1] https://www.stunnel.org/static/stunnel.html#CApath-CA_DIRECTORY

Closes #16923
2025-04-07 08:46:31 +02:00
Daniel Stenberg
fd39579241
KNOWN_BUGS: wolfssh: all tests fail
Closes #16794
2025-04-06 13:19:30 +02:00
Daniel Stenberg
d3761bb840
make: clean tests better
1. 'make clean' in the root dir now also invokes 'make clean' in the
tests subdir so that it cleans up better recursively. The Makefile.am
does not list 'tests' as a normal subdir to avoid building that
directory for a normal make invoke.

2. 'make clean' in the tests/libtest and tests/unit directories now
*explicitly* remove the unity build executables even if this is not a
unit build. This, because those files may be leftovers from previous
builds and such leftovers can otherwise linger around and since
'runtests.pl' dynamically acts differently based on the mere *presence*
of those files, they can keep you fooled for a while until you
realize...

Closes #16986
2025-04-06 13:12:55 +02:00
Daniel Stenberg
64ce880d71
RELEASE-NOTES: synced 2025-04-06 13:11:26 +02:00
Andy Pan
3d02872be7
socket: use accept4 when available
Linux, *BSD, and Solaris support accept4 system call that enables the
caller to assign additional flags and save some extra system calls. It
can come in handy when O_NONBLOCK or/and FD_CLOEXEC is/are required on a
socket after being accepted.

Ref:
https://man7.org/linux/man-pages/man2/accept.2.html
https://man.freebsd.org/cgi/man.cgi?query=accept4
https://man.dragonflybsd.org/?command=accept&section=2
https://man.openbsd.org/accept.2
https://man.netbsd.org/accept.2
https://docs.oracle.com/cd/E88353_01/html/E37843/accept4-3c.html
https://www.gnu.org/software/gnulib/manual/html_node/accept4.html

Closes #16979
2025-04-06 13:08:33 +02:00
Carlos Henrique Lima Melara
2f5e4e0db4
scripts: completion.pl: sort the completion file for all shells
The reproducible builds effort in Debian has caught a regression in curl
8.13.0-rc1 but we were a bit slow to realize it. The ordering of the
completion file for fish is not deterministic so it can differ between
builds. Since there is no restriction about the order of the completion
file for fish, let's just sort it too.

Closes #16985
2025-04-06 11:35:38 +02:00
Daniel Stenberg
b676ae3b2a
CURLOPT_HTTP_TRANSFER_DECODING: fixed
The fix in b8bd019c6a (#16959) broke the
CURLOPT_HTTP_TRANSFER_DECODING handling, shown in test 319 and curl's
--raw option.

This is a follow-up that restores the functionality.

Enable test 319 again.

Fixes #16974
Closes #16984
2025-04-06 11:31:22 +02:00
Viktor Szakats
213115bd7e
GHA/configure-vs-cmake: dump generated configs to log
Sometimes it's useful to have a look at the generated `libcurl.pc` and
`curl-config` files.

`cmp-config.pl` normalizes them before diffing, thus doesn't show their
original content.

Closes #16981
2025-04-05 23:03:15 +02:00
Viktor Szakats
01e45f81bd
cmake/FindNGTCP2: simplify multi-pkg-config detection
Use a single `pkg_check_modules` call to detect the main & crypto libs.

Follow-up to 3b501976a9 #16479
Closes #16980
2025-04-05 23:03:14 +02:00
Daniel Stenberg
badfb951ec
test1658: add unit test for the HTTPS RR decoder
Made the HTTPS-RR parser a little stricter while at it.

Drop the ALPN escape handling, that was not needed.

Make the hode handle (and ignore) duplicate ALPN entries.

Closes #16972
2025-04-05 21:03:47 +02:00
Jay Satiro
023cc8d595 winbuild: add the deprecation warning to the README
- Mention in README.md and INSTALL-CMAKE.md that the winbuild build
  system is going to be removed in September 2025.

Closes https://github.com/curl/curl/pull/16957
2025-04-05 14:51:00 -04:00
Daniel Stenberg
72f9133311
tests/globalconfig.pm: remove the qw
Fixes the warning.

Fixes #16976
Closes #16977
2025-04-05 18:25:34 +02:00
Daniel Stenberg
b8bd019c6a
content_encoding: Transfer-Encoding parser improvements
- allow and ignore "identity" as an encoding

- fail if any other encoder than chunked follows after chunked

- fail on unsolicited encodings - when the server encodes but curl did
  not ask for it

Add test 1493 to 1496 to verify.

Disable test 319 as that is now broken: issue #16974

Reported-by: Jonathan Rosa
Fixes #16956
Closes #16959
2025-04-05 18:23:07 +02:00
Daniel Stenberg
3454844f36
libtest/first: stop defining MEMDEBUG_NODEFINES
It causes problems in unity builds, in particular when this file is used
for unit tests.

Bonus: switch to plain getenv() instead of curl_getenv() to avoid extra
malloc/free rounds.

Closes #16978
2025-04-05 18:20:22 +02:00
Daniel Stenberg
f3527ed443
randdisable: build randomizer
This script makes a "random" build using configure and verifies that it
builds curl correctly. It randomly adds a number of the available
--disable-* flags to configure. When it detects a problem the script
stops, otherwise it continues trying more combinations.

Closes #16962
2025-04-05 14:59:17 +02:00
Stefan Eissing
5fbd78eb2d
http2: fix stream window size after unpausing
When pausing a HTTP/2 transfer, the stream's local window size
is reduced to 0 to prevent the server from sending further data
which curl cannot write out to the application.

When unpausing again, the stream's window size was not correctly
increased again. The attempt to trigger a window update was
ignored by nghttp2, the server never received it and the transfer
stalled.

Add a debug feature to allow use of small window sizes which
reproduces this bug in test_02_21.

Fixes #16955
Closes #16960
2025-04-05 14:54:40 +02:00
Dan Fandrich
dac78ae638 tests: remove some unused test case sections 2025-04-04 13:23:31 -07:00
Dan Fandrich
cbb80f215e tests: unify test case keywords
Unify the case, punctuation and name of test case keywords so they can
be more easily selected or skipped when desired. Add a few keywords that
were missing. Fix a couple of typos in test names.
2025-04-04 13:23:15 -07:00
Yedaya Katsman
80f9f6e59b
rand: update comment on Curl_rand_bytes weak random
From what I understand both rustls and mbedTLS expose a strong random
function, so as long as you have a TLS library random will be strong.

Followup 8972845123 "vtls/rustls: support strong CSRNG data"
Followup a90a5bccd4 "mbedtls: implement CTR-DRBG and HAVEGE random generators"

Closes #16965
2025-04-04 21:32:07 +02:00
Stefan Eissing
4f3c22d77d
https-connect, fix httpsrr target check
The HTTPSRR check on the record's target was not working as it used the
wrong index on the NUL byte if the target was not NULL.

Fixes #16966
Reported-by: Pavel Kropachev
Closes #16968
2025-04-04 21:31:02 +02:00
Dan Fandrich
0e9f2c41b6 tests: fix some test tag mismatches 2025-04-04 09:17:08 -07:00
Dan Fandrich
b117d2cacf tests: move a boolean variable out of the path section 2025-04-04 08:42:43 -07:00
Daniel Stenberg
db3e7a24b5
hostip: show the correct name on proxy resolve error
Regression, probably from 8ded8e5f3f (#16451)

Fixes #16958
Reported-by: Jean-Christophe Amiel
Closes #16961
2025-04-04 14:23:01 +02:00
Jay Satiro
997e55d5a7 tests: use a more portable null device path
- Use File::Spec->devnull() to get the null device path.

Prior to this change we used NUL for Windows native perl and /dev/null
otherwise.

Bug: https://github.com/curl/curl/pull/16929#discussion_r2025718160
Reported-by: Viktor Szakats

Closes https://github.com/curl/curl/pull/16930
2025-04-04 03:40:47 -04:00
Nigel Brittain
c871dcb612
http_aws_sigv4: add additional verbose log statements
To use curl as a tool for troubleshooting SigV4 signing, it is useful to
have the 'Canonical Request', 'String To Sign' and 'Signature'
calculations output.

Closes #16952
2025-04-04 08:54:09 +02:00
Viktor Szakats
b809629f8c
cmake: use absolute paths for completion targets
Fixing potential:
```
CMake Error at scripts/CMakeLists.txt:72 (install):
  install FILES given directory "/usr/ports/ftp/curl/work/.build/scripts/" to
  install.
```

Reported-by: Daniel Engberg
Fixes #16946
Follow-up to c8b0f0c9ad #16833
Closes #16954
2025-04-04 02:34:52 +02:00
Dan Fandrich
eb0c622a5b scripts: fix --opts-dir help in completion.pl
The help text gave the wrong option name.

Reported-by: Daniel Engberg
Ref: #16946
2025-04-03 16:14:34 -07:00
Yedaya Katsman
fe1ba25c87
rustls: make max size of cert and key reasonable
SIZE_MAX is an very overkill size for certificates or keys, lower it to
100KiB for both certificate and keys. The default max size of openssl is
100KiB for the entire chain [1], and it seems firefox fails at ~60kb
[2].

Found by https://github.com/curl/curl/pull/16923

[0] https://docs.openssl.org/3.2/man3/SSL_CTX_set_max_cert_list/#notes
[2] https://0x00.cl/blog/2024/exploring-tls-certs/

Closes #16951
2025-04-03 23:30:36 +02:00
Viktor Szakats
bdc42ba23e
GHA/curl-for-win: switch to podman (from docker)
Closes #16727
2025-04-03 23:23:37 +02:00
Viktor Szakats
c6bd2e6a9a
tests: prefer --insecure over -k
To make it uniform in all tests, and greppability.

Also:
- replace `-k` flag with `-q` in test 1268. (the actual flag doesn't
  matter in this test)
- keep `-k` in test 300 to test its short form.
  (also verified to fail without a working `-k`)

Closes #16878
2025-04-03 23:18:55 +02:00
Dan Fandrich
9ba597bed7 lib: make Curl_easyopts const
Also, make the optiontable rule work in an out-of-tree build.

Closes #16950
2025-04-03 13:43:26 -07:00
Dan Fandrich
9f4f61ddcb lib: add const to clientwriter tables
Unlike the connection filter tables that hold a writable log level, the
client writer tables can be const.
2025-04-03 12:45:54 -07:00