Commit Graph

35552 Commits

Author SHA1 Message Date
tiymat
6758aa722d
IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
Set properties on the uploaded resource.

Test 3209 and 3210 verify.

Closes #15970
2025-03-04 15:21:16 +01:00
Samuel Dionne-Riel
0cd2670afb
libssh2: print user with verbose flag
This change:

 - Breaks out the existing print out of the LIBSSH2_DEBUG compile-time
   flag
 - Adds (single) quotation marks around the string to better expose the
   actual value
 - Adds a NULL print if not set, mirroring other verbose prints in
   libssh2

Why was this done?

I was trying out the `sftp` option in `curl`, and found myself hitting
an issue where I was not able to get curl to tell me which username it
was using to connect to a host.

With this change, the `User: ` line is printed with `-v`, just like
other SSH verbose prints.

Instead of using the pattern used with *SSH MD5 public key*, where a
ternary is used to print `NULL` on NULL values, it is using a different
branch to add quotes around the string value.

The quotes around the string value are used to better expose to the user
an empty string value, compared to "no-value".

Closes #16430
2025-03-04 14:47:52 +01:00
Daniel Stenberg
18c6d5512f
lib: fix two curlx_strtoofft invokes
- cf-h1-proxy: check return code and return error if the parser fails

- http: make the Retry-After parser check for a date string first then
  number to avoid mis-parsing the begining of a date as a number

Closes #16548
2025-03-04 14:40:38 +01:00
Viktor Szakats
9213e4e497
tests/server: round of tidy-ups
Dedupe, merge macros, globals, make symbols local where possible.
Drop unused macros and headers. Drop `DEFAULT_LOGFILE` macro in favour
of `--logfile` command-line option.

Ref: #15000
Closes #16525
2025-03-04 04:17:44 +01:00
Viktor Szakats
387311012c
tidy-up: alphasort lists, indentation/whitespace, pp
- cmake/win32-cache: alphasort items.
- configure.ac: alphasort `CURL_CHECK_FUNC_*` checks.
- configure.ac: alphasort `AC_CHECK_FUNCS` checks.
- prefer `#ifdef`/`#ifndef`.
- lib/asyn-thread: drop unused value of `USE_HTTPSRR_ARES`.
- lib/formdata: drop unused header `libgen.h`.
- indentation, whitespace.

Closes #16490
2025-03-04 01:46:53 +01:00
Viktor Szakats
3834f31b22
cmake: exclude -MP for clang-cl again
To avoid this warning/error (seen with Ninja generator):
```
clang-cl: warning: argument unused during compilation: '-MP' [-Wunused-command-line-argument]
```

Curious why CI missed it. Maybe due to using a Visual Studio generator.

Regression from e0fd5790d9 #16004
Closes #16550
2025-03-04 01:01:09 +01:00
Viktor Szakats
61407464bf
cmake: allow CURL_STATIC_CRT with UCRT VS2015+ builds
After this patch, we're back to 8.12.1, but disallowing
`CURL_STATIC_CRT=ON` with shared curl exe built with VS2013 or older.
Because those may crash. A stable reprducer is with `ENABLE_DEBUG=ON`
and calling `curl.exe -V`.

You can pass the necessary CMake and MSVC linker options manually,
to get around this condition.

Shared build with static UCRT may be crashing too, depending on
conditions. Consult the documentation about limitations of static CRT:
https://learn.microsoft.com/cpp/c-runtime-library/crt-library-features

Follow-up to 049352dd80 #16516
Follow-up to edfa537100 #16456
Ref: #16394
Closes #16522
2025-03-04 01:01:09 +01:00
Jay Satiro
9a0767017c ftp: fix comment
- Explain ftp_conn's newhost and newport in the struct definition.

Follow-up to 1485e892 which changed the order of some struct members to
reduce struct size.

Closes https://github.com/curl/curl/pull/16538
2025-03-03 18:21:33 -05:00
Daniel Stenberg
324b439634
http_chunks: replace a strofft call with curl_str_hex
Make it not skip leading blanks. There should not be any.

Closes #16546
2025-03-03 23:10:31 +01:00
Daniel Stenberg
aa18891dda
docs/cmdline-opts: unify HTTP version style in --help output
$ curl -h all | grep -- --http

Now:

     --http0.9                      Allow HTTP/0.9 responses
 -0, --http1.0                      Use HTTP/1.0
     --http1.1                      Use HTTP/1.1
     --http2                        Use HTTP/2
     --http2-prior-knowledge        Use HTTP/2 without HTTP/1.1 Upgrade
     --http3                        Use HTTP/3
     --http3-only                   Use HTTP/3 only

Before:

     --http0.9                      Allow HTTP 0.9 responses
 -0, --http1.0                      Use HTTP 1.0
     --http1.1                      Use HTTP 1.1
     --http2                        Use HTTP/2
     --http2-prior-knowledge        Use HTTP 2 without HTTP/1.1 Upgrade
     --http3                        Use HTTP v3
     --http3-only                   Use HTTP v3 only

Closes #16542
2025-03-03 23:09:19 +01:00
Daniel Stenberg
48ba23070a
tool_operate: remove unnecessary (long) typecasts
Closes #16540
2025-03-03 23:08:12 +01:00
Stefan Eissing
35cfb081d2
pytest: check overlarge response headers
Add test_01 11, 12 and 13 to check various very long response
headers (accumulated and single) with http/1.1 and h2.

Closes #16541
2025-03-03 15:46:55 +01:00
Stefan Eissing
cee9cefa76
multi_ev: use mid instead of id for transfer hashes
`data->id` is unique in the same connection pool, but a multi may
involved more than one pool. `data->mid` is unique inside the multi and
since multi_ev lives inside one multi, the `mid` is the right thing to
use.

Closes #16545
2025-03-03 15:44:19 +01:00
Daniel Stenberg
7b0240c077
curl.h: convert CURLUSESSL* names to defines
So that we can use L suffix.

Follow-up to 2ec00372a1

Closes #16539
2025-03-03 12:03:02 +01:00
Daniel Stenberg
fb13923dd6
lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
With this change, the argument passed to the CURLOPT_FOLLOWLOCATION
option is now instead a "mode" instead of just a boolean. Documentation
is extended to describe the two new modes.

Test 1571 to 1581 verify.

Closes #16473
2025-03-03 11:35:48 +01:00
Daniel Stenberg
294136b754
lib: replace while(ISBLANK()) loops with Curl_str_passblanks()
- replace several ISSPACE() with ISBLANK(), since the former also skips
  CR and LF which in most cases should not occur where this macro is
  used

- after this commit, there is no ISSPACE() user left in libcurl code, but
  unfortunately tool and test code use the macro so it cannot be removed.

Closes #16520
2025-03-03 10:56:09 +01:00
Peng-Yu Chen
f61b218e7d
http2: enhance error messages on Curl_dyn* upon receiving headers
This is a partial fix of #16535. The error message format is borrowed
from the existing code[1].

Sample message before:
    curl: (56) process_pending_input: nghttp2_session_mem_recv() returned -902:The user callback function failed

Sample message after:
    curl: (56) Error receiving HTTP2 header: 100(A value or data field grew larger than allowed)

[1]: df672695e5/lib/http2.c (L1999-L2000)

Closes #16536
2025-03-03 10:30:54 +01:00
Stefan Eissing
0d3b5937b3
OpenSSL/quictls: add support for TLSv1.3 early data
based on #16450

Adds support for TLSv1.3 early data for TCP and QUIC via ngtcp2.

Closes #16477
2025-03-03 09:27:04 +01:00
renovate[bot]
b5d99a5474
GHA: update dependency nghttp2/nghttp2 to v1.65.0
Tweaked-by: Viktor Szakats

Closes #16534
2025-03-03 09:03:14 +01:00
renovate[bot]
aa51da563a
GHA: update actions/cache digest to d4323d4
Closes #16510
2025-03-03 09:01:15 +01:00
renovate[bot]
1fe62d9bae
GHA: update actions/download-artifact digest to cc20338
Closes #16500
2025-03-03 08:59:40 +01:00
renovate[bot]
0ec77026bc
docker: update debian:bookworm-slim Docker digest to ceac69a
Closes #16471
2025-03-03 08:58:32 +01:00
renovate[bot]
ce6d34860c
GHA: update actions/upload-artifact digest to 4cec3d8
Closes #16431
2025-03-03 08:56:40 +01:00
Stefan Eissing
df672695e5
shutdowns: split shutdown handling from connection pool
Further testing with timeouts in event based processing revealed that
our current shutdown handling in the connection pool was not clear
enough. Graceful shutdowns can only happen inside a multi handle and it
was confusing to track in the code which situation actually applies. It
seems better to split the shutdown handling off and have that code
always be part of a multi handle.

Add `cshutdn.[ch]` with its own struct to maintain connections being
shut down. A `cshutdn` always belongs to a multi handle and uses that
for socket/timeout monitoring.

The `cpool`, which can be part of a multi or share, either passes
connections to a `cshutdn` or terminates them with a one-time, best
effort.

Add an `admin` easy handle to each multi and share. This is used to
perform all maintenance operations where no "real" easy handle is
available. This solves the problem that the multi admin handle requires
some additional initialisation (e.g. timeout list).

The share needs its admin handle as it is often cleaned up when no other
transfer or multi handle exists any more. But we need a `data` in almost
every call.

Fix file:// handling of errors when adding a new connection to the pool.

Changes in `curl` itself:

- for parallel transfers, do not set a connection pool in the share,
  rely on the multi's connection pool instead. While not a requirement
  for the new `cshutdn` to work, this is

  a) helpful in testing to trigger graceful shutdowns
  b) a broader code coverage of libcurl via the curl tool

- on test_event with uv, cleanup the multi handle before returning from
  parallel_event(). The uv struct is on the stack, cleanup of the multi
  later will crash when it tries to register sockets. This is a "eat
  your own dogfood" related fix.

Closes #16508
2025-03-02 11:13:34 +01:00
renovate[bot]
3afa47b627
GHA: update dependency awslabs/aws-lc to v1.47.0
Closes #16530
2025-03-02 10:52:08 +01:00
Daniel Stenberg
2633961d56
asyn: bring back port to the Curl_async struct
To make sure we store and use the correct port used for this particular
lookup.

Partial revert of 8ded8e5f3f

Fixes #16531
Reported-by: Jay Satiro
Closes #16532
2025-03-02 10:51:00 +01:00
Daniel Stenberg
5f72a69076
RELEASE-NOTES: synced 2025-03-01 18:44:56 +01:00
Stefan Eissing
1aa69221be
hash_offt: standalone hash for curl_off_t
Add a standalong hash table for curl_offt_t as key. This allows a
smaller memory footprint and faster lookups as we do not need to deal
with variable key lengths.

Use in all places we had the standard hash for this purpose.

Closes #16442
2025-03-01 18:42:10 +01:00
Stefan Eissing
2809723ddf
pytest: test negotiate with http proxy
Fixes #14973
Reported-by: stevenpackardblp on github

When curl negotiated with a http: proxy for a https: request, it
wrongly believed there must be an SSL filter present, which during
CONNECT, there is not.

25b445e fixed this. This PR adds a pytest case for the setup.

Closes #16136
2025-03-01 18:40:40 +01:00
Viktor Szakats
b4834a7d6d
examples: prefer return over exit() (cont.)
Some of these calls were not in callbacks. These examples may leak
handles.

Also fix some whitespace.

Follow-up to 08c7c937dc #16507
Closes #16524
2025-03-01 02:09:02 +01:00
Viktor Szakats
5693342ec2
winbuild: reduce command-line length by dropping whitespace
Keep the `@for %%i in [...]` lines within limits by stripping whitespace
from the input `.c` source lists read from `Makefile.inc`. To avoid this
error after adding a new `.c` source:
```
configuration name: libcurl-vc14-x64-release-dll-ssl-dll-ipv6-sspi
NMAKE : fatal error U1095: expanded command line 'for %i in (altsvc.obj            amigaos.obj
           asyn-ares.obj         asyn-thread.obj       base64.obj            bufq.obj
              bufref.obj            cf-h1-proxy.obj       cf-h2-proxy.obj       cf-haproxy.obj [...]
  vssh/wolfssh.obj) do @echo ..\builds\libcurl-vc14-x64-release-dll-ssl-dll-ipv6-sspi-obj-lib/%i \
                   ' too long
Stop.
Command exited with code 2
```
Ref: https://ci.appveyor.com/project/curlorg/curl/builds/51605338/job/dqg6qtebtscb279g#L44

Reported-by: Stefan Eissing
Bug: https://github.com/curl/curl/pull/16508#issuecomment-2690443409
Fixes #16521
Closes #16528
2025-03-01 02:04:42 +01:00
Dan Fandrich
c693cc02b0 docs: vulnerabilities in debug code are not eligible for a bounty
This is code that is off by default and is therefore treated as a
regular bug.

Ref: #16526
Closes #16527
2025-02-28 14:21:46 -08:00
Viktor Szakats
e7751571eb
GHA/macos: use quictls in some jobs, other small improvements
- enable quictls in autotools and cmake jobs. autotools requires
  a workaround due to wrong libpath in the quictls pkg-config.
  nghttp3 is offered by Homebrew, but not ngtcp2, to enable H3.

- install `libnghttp2` rather than `nghttp2`.
  `libnghttp2` is preinstalled and smaller. It also avoids detecting
  `nghttpx`, which confuses `pytest`.

- limit `brew unlink openssl` to libressl/quictls jobs.

Closes #16517
2025-02-28 16:58:12 +01:00
Zhaoming Luo
7211576442
tests: fix comment in lib533
Closes #16523
2025-02-28 16:12:20 +01:00
Stefan Eissing
794dfe7fc4
gnutls: fix use of pkcs11 urls for keys/certs
Fixes #16249
Forwarded-to-us-by: Carlos Henrique Lima Melara

Always use `gnutls_certificate_set_x509_key_file2()` for loading keys
and certificates, even without a password, since this function support
pkcs11 urls.

Thanks to @tatsuhiro-t for finding this out.
Help-by: Tatsuhiro Tsujikawa

Closes #16472
2025-02-28 16:08:10 +01:00
Viktor Szakats
049352dd80
cmake: allow CURL_STATIC_CRT with shared libcurl and no curl exe
Follow-up to edfa537100 #16456

Closes #16516
2025-02-28 13:11:41 +01:00
Viktor Szakats
08c7c937dc
tidy-up: prefer return over exit(), fix fallouts
To avoid breaking the control flow and align to majority of code
already using `return`.

`exit()` has the side-effect of suppressing leak detection in cases.
Fix fallouts detected after switching to `return`.

- configure:
  - fix `getaddrinfo` run test to call `freeaddrinfo()` to pacify ASAN,
    and call `WSACleanup()` to deinit winsock2.
  - fix `getifaddrs` run test to call `freeifaddrs()` to pacify ASAN.
- tests/server:
  - setup `atexit(win32_cleanup)` via `win32_init()`.
  - return 2 instead of 1 on winsock2 init failures.
  - sws: goto cleanup instead of `exit()` in `http_connect()`.
    Follow-up to 02dfe71937 #7235
- tests/client/http:
  - cleanup memory to pacify ASAN in `h2-upgrade-extreme`,
    `tls-session-reuse`.
- examples:
  - block_ip: fix memory leak reported by CI.
  - http2-upload: avoid handle leaks.

Untouched `exit()` calls, made from callbacks:
- docs/examples: ephiperfifo.c, ghiper.c, hiperfifo.c
- tests/libtest: lib582.c, lib655.c, lib670.c
- tests/server: tftpd.c

Closes #16507
2025-02-28 13:11:41 +01:00
Stefan Eissing
2e585f5640
test488: set --output-dir
Otherwise the downloaded files land in the `tests` directory and
show up in git status.

Closes #16519
2025-02-28 12:47:31 +01:00
Viktor Szakats
399cb7130a
cmake: drop HAVE_C_FLAG_Wno_long_double logic for ancient Apple gcc
The initial curl CMake commit introduced it in 2009-04-02 via
4c5307b456. Suppressing a stray
`-Wlong-double` warning in `mprintf.c`. This was before Apple switched
to clang, and likely affected the Apple distributed GCC, version 4.2.1
at the time. It applied the workaround to CMake builds only, though
the issue seems build-tool agnostic. Yet, it was not suppressed or
reported for autotools builds.

For these reasons this logic seems obsolete and this patch drops it with
no replacement. It saves a feature detection for GCC builds for macOS.

In PR sub-commits I added (and reverted) in-source suppression. In case
it becomes necessary, that should fix it for all build tools.

Closes #16513
2025-02-28 03:40:40 +01:00
Viktor Szakats
5a021aba41
cmake: improve httpd detection for pytest
Look for `httpd` in addition to `apache2`, like `./configure` does.
It fixes detection with macOS Homebrew for example.

Closes #16515
2025-02-28 03:40:40 +01:00
Viktor Szakats
6913c9b6ab
GHA/linux: improve 'test configs' step, don't set TFLAGS for pytest
- omit comments from th config dump, show filenames for each line.
- `TFLAGS` is not used by pytest, don't set it.

Closes #16514
2025-02-28 03:40:40 +01:00
Daniel Stenberg
953cd694dc
asyn-ares: use the correct port number
Only triggers with old c-ares versions.

Follow-up to 8ded8e5f3f

Closes #16511
2025-02-27 22:18:43 +01:00
Viktor Szakats
af6172c8f2
GHA/linux: merge two package install steps
Merge pytest prereq package install step into the main package install
step, to save install time.

Closes #16509
2025-02-27 20:32:50 +01:00
Daniel Stenberg
8ded8e5f3f
urldata: remove 'hostname' from struct Curl_async
It is unnecessary duplicated information, as the host name being
resolved is already present in conn->host.

Closes #16451
2025-02-27 17:18:43 +01:00
Daniel Stenberg
7007f59caa
GHA: spellcheck curl symbols better
This now makes sure to trim off exact matches for curl symbols and long
curl commanad line options instead of using pattern matching as before.
This should catch typoed names (that still follow the pattern) better.

The cleanspell.pl script is no longer used. cleancmd.pl is used for all
markdown files.

Closes #16504
2025-02-27 13:15:21 +01:00
Daniel Stenberg
a8ad9a5758
docs: minor edits to please the new spellchecker regime 2025-02-27 13:15:21 +01:00
Viktor Szakats
cba83bfb10
runtests: accept CURL_DIRSUFFIX without ending slash
Follow-up to 3585796049 #16452
Closes #16506
2025-02-27 12:11:23 +01:00
Viktor Szakats
59f4727480
appveyor: run VS2008 job with old CMake 3.12.2
Switch VS2008 job the oldest runner machine. It adds the oldest CMake to
the Windows mix, from 2018-11-30. Not a beauty, missing support for `-B`
and Unity, but it's a version curl supports. It's newer than Old Linux.
The previous oldest was 3.16.2. It remains used with VS2010-VS2017.

Also:
- fix VS2008 job to actually build examples.
- switch VS2019 job to OpenSSL 1.1.0 that wasn't tested before.
  Migrate OpenSSL 1.0.2 to the VS2008 job.
- measure run time of individual build steps.

Follow-up to 01c25e3b00 #16458
Closes #16505
2025-02-27 12:11:08 +01:00
Viktor Szakats
08a29e7f18
GHA: tidy up parallel options, improve performance for some jobs
- replace `--parallel <n>` and `-j<n>` for individual commands with
  `MAKEFLAGS`, for jobs not yet doing it.
  This enables parallel builds in distcheck / maketgz-and-verify-in-tree,
  where `-j` option was missing.
- add `--parallel` for iOS Xcode job for improved performance.
- drop redundant `-j5` for Android jobs.
- drop stray `cmake --config` options from single-target jobs (cygwin,
  msys/mingw, dl-mingw, non-native). Drop redundant
  `CMAKE_RUNTIME_OUTPUT_DIRECTORY_*` settings too.
- GHA/windows: add timeout for package install steps where missing.
- GHA/non-native: specify target type explicitly for iOS cmake jobs.
  Xcode default was already Debug, single-target default was generic,
  now it's Release, with unity batch to keep it fast.

`MAKEFLAGS` is necessary for autotools jobs and CMake jobs using
the default (GNU Make) generator. It's ignored by Ninja and other tools.
`cmake --parallel` is still necessary for jobs with Visual Studio or
Xcode generators. Parallelism is 5 for GHA Linux and Windows runners,
4 for macOS, 3 for VMs, 2 for AppVeyor.

Closes #16502
2025-02-27 12:11:07 +01:00
Daniel Stenberg
bc24c60512
urlapi: fix redirect from file:// with query, and simplify
- fix redirect from file:// URL with query part
- find_host_sep() simplify
- urlencode_str() simplify
- redirect_url() simplify
- made more const char *
- add more redirect URL test cases to test 1560

Closes #16498
2025-02-27 11:51:19 +01:00