]> git.ipfire.org Git - thirdparty/curl.git/log
thirdparty/curl.git
5 months agodoh: remove wrong but unreachable exit path from doh_decode_rdata_name
Daniel Stenberg [Thu, 13 Mar 2025 22:28:42 +0000 (23:28 +0100)] 
doh: remove wrong but unreachable exit path from doh_decode_rdata_name

The condition could not happen, as the function is only called from a
single place where the caller already made sure it can't happen. This
change still removes the flawed logic.

Reported-by: Ronald Crane
Closes #16710

5 months agotool_setopt: reduce use of "code hiding" macros
Daniel Stenberg [Thu, 13 Mar 2025 14:23:17 +0000 (15:23 +0100)] 
tool_setopt: reduce use of "code hiding" macros

CODEx, DATAx, CLEANx, DECLx, REM3, CHKRET are all removed now.

Closes #16709

5 months agotool_setopt: simplify tool_setopt
Daniel Stenberg [Thu, 13 Mar 2025 14:09:15 +0000 (15:09 +0100)] 
tool_setopt: simplify tool_setopt

Since this is only used for object and function pointers now.

Closes #16709

5 months agoGHA/windows: replace OpenSSH-Windows-Prelease job with standard openssh
Viktor Szakats [Thu, 13 Mar 2025 02:06:09 +0000 (03:06 +0100)] 
GHA/windows: replace OpenSSH-Windows-Prelease job with standard openssh

After restricting OpenSSH-Windows to a single job, and bumping it to
the pre-release version, that job started hanging then timing out with
reasonable consistency.

Since we saw similar hangs before with OpenSSH-Windows stable, in all
jobs, drop OpenSSH-Windows from CI, and replace it with MSYS openssh.

After this patch, all Windows jobs use MSYS2 or Cygwin openssh.

Follow-up to 0ec72c1ef8d87a29bf2eaa5e36ab173147a4d015 #16672
Closes #16704

5 months agoGHA: fix configure disable options
Viktor Szakats [Thu, 13 Mar 2025 02:37:57 +0000 (03:37 +0100)] 
GHA: fix configure disable options

Linux AM openssl https-only:
```
configure: WARNING: unrecognized options: --disable-rtmp, --disable-scp, --disable-sftp
```
Ref: https://github.com/curl/curl/actions/runs/13823209634/job/38673119106#step:31:34

macOS AM clang !ssl HTTP-only:
```
configure: WARNING: unrecognized options: --disable-rtmp, --disable-scp, --disable-sftp, --without-ntlm-auth
```
Ref: https://github.com/curl/curl/actions/runs/13823209638/job/38673115560#step:7:54

Closes #16701

5 months agoresolve: fix building without Unix sockets and `CURLDEBUG`
Viktor Szakats [Thu, 13 Mar 2025 02:15:46 +0000 (03:15 +0100)] 
resolve: fix building without Unix sockets and `CURLDEBUG`

```
In file included from server_bundle.c:7:
../../../tests/server/resolve.c:110:5: error: unknown type name 'curl_socket_t'; did you mean 'curl_socklen_t'?
    curl_socket_t s = socket(PF_INET6, SOCK_DGRAM, 0);
    ^~~~~~~~~~~~~
    curl_socklen_t
../../../include/curl/system.h:392:38: note: 'curl_socklen_t' declared here
  typedef CURL_TYPEOF_CURL_SOCKLEN_T curl_socklen_t;
                                     ^
In file included from server_bundle.c:7:
../../../tests/server/resolve.c:111:13: error: use of undeclared identifier 'CURL_SOCKET_BAD'
    if(s == CURL_SOCKET_BAD)
            ^
```
Ref: https://github.com/curl/curl/actions/runs/13825438937/job/38679418428?pr=15000#step:14:47

Cherry-picked from #15000
Closes #16700

5 months agotests/server: sync memory callbacks with `lib/easy.c`
Viktor Szakats [Wed, 12 Mar 2025 16:55:52 +0000 (17:55 +0100)] 
tests/server: sync memory callbacks with `lib/easy.c`

Cherry-picked from #15000
Closes #16699

5 months agotests/server: do not redefine standard functions in `sockfilt`
Viktor Szakats [Tue, 11 Mar 2025 18:29:14 +0000 (19:29 +0100)] 
tests/server: do not redefine standard functions in `sockfilt`

Use a namespaced macro instead. To avoid confusion when other headers
also redefine these functions. And to improve readability by making it
apparent that the code sometimes overrides these functions.

Cherry-picked from #15000
Closes #16698

5 months agotests/server: drop unused headers
Viktor Szakats [Tue, 11 Mar 2025 08:04:42 +0000 (09:04 +0100)] 
tests/server: drop unused headers

Cherry-picked from #15000
Closes #16697

5 months agomemdebug.h: avoid `-Wredundant-decls` with an extra guard
Viktor Szakats [Wed, 12 Mar 2025 21:59:53 +0000 (22:59 +0100)] 
memdebug.h: avoid `-Wredundant-decls` with an extra guard

Add an extra guard for the function and variable declarations to avoid
redundant redeclaration warnings when including this header multiple
times. This can happen in unity builds when including it again after
`curl_memory.h`.

Fixes:
```
bld/tests/server/CMakeFiles/servers.dir/Unity/unity_0_c.c
In file included from lib/mprintf.c:32,
                 from bld/tests/server/CMakeFiles/servers.dir/Unity/unity_0_c.c:7:
lib/memdebug.h:52:14: error: redundant redeclaration of ‘curl_dbg_logfile’ [-Werror=redundant-decls]
   52 | extern FILE *curl_dbg_logfile;
      |              ^~~~~~~~~~~~~~~~
In file included from tests/server/resolve.c:50,
                 from bld/tests/server/server_bundle.c:7,
                 from bld/tests/server/CMakeFiles/servers.dir/Unity/unity_0_c.c:4:
lib/memdebug.h:52:14: note: previous declaration of ‘curl_dbg_logfile’ with type ‘FILE *’
   52 | extern FILE *curl_dbg_logfile;
      |              ^~~~~~~~~~~~~~~~
[...]
lib/memdebug.h:110:17: error: redundant redeclaration of ‘curl_dbg_fclose’ [-Werror=redundant-decls]
  110 | CURL_EXTERN int curl_dbg_fclose(FILE *file, int line, const char *source);
      |                 ^~~~~~~~~~~~~~~
lib/memdebug.h:110:17: note: previous declaration of ‘curl_dbg_fclose’ with type ‘int(FILE *, int,  const char *)’
  110 | CURL_EXTERN int curl_dbg_fclose(FILE *file, int line, const char *source);
      |                 ^~~~~~~~~~~~~~~
```
Ref: https://github.com/curl/curl/actions/runs/13822010778/job/38669360980#step:39:55

Cherry-picked from #15000
Closes #16696

5 months agocmake: unity mode optimization for non-`CURLDEBUG` `testdeps` targets
Viktor Szakats [Thu, 13 Mar 2025 00:20:52 +0000 (01:20 +0100)] 
cmake: unity mode optimization for non-`CURLDEBUG` `testdeps` targets

Include more sources in unity mode to optimize libtest and tests/server
builds for non-debug-enabled builds, syncing this pattern with `lib` and
`src`.

It reduces build steps from 62 to 47 (-14, -24%) with test bundles.
Without test bundles, from 680 to 642 (-38, -6%).

Follow-up to de0693f24943cd65f26a7b421a4304cbadb875a0 #16274
Follow-up to 3efba94f773db5d8ae19e33aa749ab7914cafeea #14765
Cherry-picked from #15000
Closes #16695

5 months agocookie: accept "high byte" cookie content
Daniel Stenberg [Thu, 13 Mar 2025 07:22:11 +0000 (08:22 +0100)] 
cookie: accept "high byte" cookie content

Regression from 597ee915c4c6da132dbd1735345 (not shipped in a release)
Reported-by: Carlos Henrique Lima Melara
Assisted-by: Scott Talbert
Added such a cookie to test 31.

Fixes #16692
Closes #16703

5 months agocore: stop redefining `E*` macros on Windows, map `EACCES`, related fixes
Viktor Szakats [Sat, 8 Mar 2025 01:18:35 +0000 (02:18 +0100)] 
core: stop redefining `E*` macros on Windows, map `EACCES`, related fixes

Before this patch, standard `E*` errno codes were redefined on Windows,
onto matching winsock2 `WSA*` error codes, which have different values.
This broke uses where using the `E*` value in non-socket context, or
other places expecting a POSIX `errno`, e.g. file I/O, threads, IDN or
interfacing with dependencies.

Fix it by introducing a curl-specific `SOCKE*` set of macros that map to
`WSA*` on Windows and standard POSIX codes on other platforms. Then
verify and update the code to use `SOCKE*` or `E*` macro depending on
context.

- Add `SOCKE*` macros that map to either winsock2 or POSIX error codes.
  And use them with `SOCKERRNO` or in contexts requiring
  platform-dependent socket error codes.

  This fixes `E*` uses which were supposed be POSIX values, not `WSA*`
  socket errors, on Windows:
  - lib/curl_multibyte.c
  - lib/curl_threads.c
  - lib/idn.c
  - lib/vtls/gtls.c
  - lib/vtls/rustls.c
  - src/tool_cb_wrt.c
  - src/tool_dirhie.c

- Ban `E*` codes having a `SOCKE*` mapping, via checksrc.
Authored-by: Daniel Stenberg
- Add exceptions for `E*` codes used in file I/O, or other contexts
  requiring POSIX error codes.

Also:
- ftp: fix missing `SOCKEACCES` mapping for Windows.
- add `SOCKENOMEM` for `Curl_getaddrinfo()` via `asyn-thread.c`.
- tests/server/sockfilt: fix to set `SOCKERRNO` in local `select()`
  override on Windows.
- lib/inet_ntop: fix to return `WSAEINVAL` on Windows, where `ENOSPC` is
  used on other platforms. To simulate Windows' built-in `inet_ntop()`,
  as tested on a Win10 machine.
  Note:
  - WINE returns `STATUS_INVALID_PARAMETER` = `0xC000000D`.
  - Microsoft documentation says it returns `WSA_INVALID_PARAMETER`
    (= `ERROR_INVALID_PARAMETER`) 87:
    https://learn.microsoft.com/windows/win32/api/ws2tcpip/nf-ws2tcpip-inet_ntop#return-value
- lib/inet_ntop: drop redundant `CURL_SETERRNO(ENOSPC)`.
  `inet_ntop4()` already sets it before returning `NULL`.
- replace stray `WSAEWOULDBLOCK` with `USE_WINSOCK` macro to detect
  winsock2.
- move existing `SOCKE*` mappings from `tests/server` to
  `curl_setup_once.h`.
- add missing `EINTR`, `EINVAL` constants for WinCE.

Follow-up to abf80aae384319ef9b19ffbd0d69a1fbe7421f1f #16612
Follow-up to d69425ed7d0918aceddd96048b146a9df85638ec #16615
Bug: https://github.com/curl/curl/pull/16553#issuecomment-2704679377

Closes #16621

5 months agobase64: drop `BUILDING_CURL` macro, always include in tests/server
Viktor Szakats [Wed, 12 Mar 2025 18:39:06 +0000 (19:39 +0100)] 
base64: drop `BUILDING_CURL` macro, always include in tests/server

Before this patch, building tests/server (or curl with winbuild) was
broken in rare builds when many features were explicitly disabled.

Fix it by enabling base64 functions unconditionally when building
for anything other than libcurl.

Closes #16691

5 months agontlm: merge ntlm.h into ntlm.c
Viktor Szakats [Wed, 12 Mar 2025 18:49:46 +0000 (19:49 +0100)] 
ntlm: merge ntlm.h into ntlm.c

It's the only user since dropping NTLM_WB support.

Follow-up to 50def7c881ba560ab6e0235990e8f07fa69f4bc8 #13249

Closes #16690

5 months agobuild: replace Curl_ prefix with curlx_ for functions used in servers
Viktor Szakats [Wed, 12 Mar 2025 14:36:47 +0000 (15:36 +0100)] 
build: replace Curl_ prefix with curlx_ for functions used in servers

Closes #16689

5 months agoruntests: enable the --libcurl feature by default
Daniel Stenberg [Wed, 12 Mar 2025 22:21:05 +0000 (23:21 +0100)] 
runtests: enable the --libcurl feature by default

Follow-up to a14eb26a585e67309066ac8a2
Reported-by: Viktor Szakats
Fixes #16693
Closes #16694

5 months agomulti: call protocol handler done() if PROTOCONNECT or later
Daniel Stenberg [Wed, 12 Mar 2025 10:22:49 +0000 (11:22 +0100)] 
multi: call protocol handler done() if PROTOCONNECT or later

The protocol handlers' done() function would previous get called
unconditionally in multi_done(), no matter how far the easy handle's
state machine has transitioned.

This caused problems in IMAP which in imap_connect() initializes things
that the imap_done() function assumes has occured. I think that seems
like a correct assumption and we should rather make sure that the done()
function is only called if we have reached the PROTOCONNECT state.

This problem was found using OSS-Fuzz.

Assisted-by: Catena cyber
Closes #16681

5 months agocurl: fix --cert parameter clearing
Stefan Eissing [Wed, 12 Mar 2025 13:42:19 +0000 (14:42 +0100)] 
curl: fix --cert parameter clearing

Blank the argument *after* it has been copied.

Reported-by: Jan Macku
Fixes #16686
Closes #16688

5 months agoGHA: do a build-only without the --libcurl option enabled
Daniel Stenberg [Wed, 12 Mar 2025 10:31:59 +0000 (11:31 +0100)] 
GHA: do a build-only without the --libcurl option enabled

Closes #16682

5 months agotests: make --libcurl tests require the --libcurl feature
Daniel Stenberg [Wed, 12 Mar 2025 13:58:41 +0000 (14:58 +0100)] 
tests: make --libcurl tests require the --libcurl feature

Closes #16682

5 months agosrc: remove final uses of Curl_ symbol prefixes in tool code
Daniel Stenberg [Wed, 12 Mar 2025 08:03:45 +0000 (09:03 +0100)] 
src: remove final uses of Curl_ symbol prefixes in tool code

Closes #16678

5 months agomanagen: accept more markdown-quote-markers
Daniel Stenberg [Wed, 12 Mar 2025 12:09:30 +0000 (13:09 +0100)] 
managen: accept more markdown-quote-markers

Lines starting with ``` or ~~~ indicate start and end of a quoted
section.

Closes #16685

5 months agosendf: client reader line conversion: do not change data->state.infilesize
Stefan Eissing [Wed, 12 Mar 2025 10:31:21 +0000 (11:31 +0100)] 
sendf: client reader line conversion: do not change data->state.infilesize

The line conversion reader, added in crfl and prefer_ascii mode was
incrementing data->state.infilesize for every line end converted. This
results in the wrong size to start a retry of an upload.

Eliminate the increment and check upload size in FTP less precise when
conversions are done.

Bug: https://issues.oss-fuzz.com/issues/402476456

Closes #16683

5 months agotool_operate: fix build with --libcurl support disabled
Daniel Stenberg [Wed, 12 Mar 2025 10:35:35 +0000 (11:35 +0100)] 
tool_operate: fix build with --libcurl support disabled

A compiler warning for unused argument.

Reported-by: Marcel Raad
Closes #16684

5 months agoGHA/windows: change openssh server, non-debug-enabled MSVC job, other improvements
Viktor Szakats [Tue, 11 Mar 2025 13:13:07 +0000 (14:13 +0100)] 
GHA/windows: change openssh server, non-debug-enabled MSVC job, other improvements

MSVC:

- switch jobs to standard openssh server. Reduce exceptions.
- make the SCP/SFTP ignore list more specific and comment with details.
- keep using OpenSSH-Windows for the OpenSSL job, and bump to the
  prerelease version.
- disable `ENABLE_DEBUG` for BoringSSL to have such build tested. (This
  is the first Windows non-ENABLE_DEBUG build with test runs.)

Takeaways:

- test 612 broken on Windows.
- test 613 broken on Windows with the standard openssh server.
- test 614 broken with libssh and OpenSSH-Windows.
- test 3022 broken with libssh2 and OpenSSH-Windows.
- tests broken with OpenSSH-Windows:
  601 603 617 619 621 641 665 2004.
- vcpkg `libssh2[core,zlib]` broken due to:
  curl: (67) Authentication failure

MSVC prep steps:

- install base msys2 package to simplify configuration, align with other
  jobs and allow to use msys2 packages for tests.
- add support for msys2 openssh server. Keep OpenSSH-Windows as per-job
  option. Add support for OpenSSH prerelease versions.
  Prerelease does not make a difference in test results, but, stable was
  last updated in 2019 (v8.0.0.1) and it seems better to use maintained
  release track, with its latest from April 2024 (v9.5.0).
  https://community.chocolatey.org/packages/openssh/8.0.0.1
  https://community.chocolatey.org/packages/openssh
  https://github.com/PowerShell/Win32-OpenSSH
  https://github.com/PowerShell/openssh-portable
- add 'libssh' to its job name.
- make `ENABLE_DEBUG` a per-job option.

msys/mingw:

- install `openssh` later and only when necessary.
- downgrade msys2 runtime later. (to follow other jobs)
- disable `CheckSpace` earlier. Also to untie it from the runtime
  downgrade step, which we would hopefully drop.

Closes #16672

5 months agocurltime: use libcurl time functions in src and tests/server
Viktor Szakats [Sun, 9 Mar 2025 12:14:31 +0000 (13:14 +0100)] 
curltime: use libcurl time functions in src and tests/server

The curl tool and tests/server used 2 parallel implementations
of libcurl's `Curl_now()` and `Curl_timediff()` functions.

Make them use the libcurl one.

Closes #16653

5 months agomulti: kill off remaining internal handles in curl_multi_cleanup
Daniel Stenberg [Tue, 11 Mar 2025 16:40:21 +0000 (17:40 +0100)] 
multi: kill off remaining internal handles in curl_multi_cleanup

- if there are pending internal handles left in the list, they are
  leftovers (from for example Doh) and must be freed.

- unlink_all_msgsent_handles() did not properly move all msgsent
  handles over to the process list as intended

Fixes a DoH memory leak found by oss-fuzz.

Add test 2101 that can reproduce and verify.

Closes #16674

5 months agocurl_setup: drop `ERANGE` (for WinCE), no longer used
Viktor Szakats [Tue, 11 Mar 2025 15:10:18 +0000 (16:10 +0100)] 
curl_setup: drop `ERANGE` (for WinCE), no longer used

Follow-up to 29ed1f9834047887a232423e715b0f2b72d744e9 #16671

Closes #16673

5 months agotests/server: use `curlx_str_numblanks()` to avoid `errno`
Viktor Szakats [Tue, 11 Mar 2025 10:09:43 +0000 (11:09 +0100)] 
tests/server: use `curlx_str_numblanks()` to avoid `errno`

Replacing `strtoul()` calls and glue code.

Closes #16671

5 months agoRELEASE-NOTES: synced
Daniel Stenberg [Tue, 11 Mar 2025 15:02:18 +0000 (16:02 +0100)] 
RELEASE-NOTES: synced

5 months agocurl: add my_setopt_long() and _offt()
Daniel Stenberg [Tue, 11 Mar 2025 09:34:47 +0000 (10:34 +0100)] 
curl: add my_setopt_long() and _offt()

Two new dedicated functions for setting long and curl_off_t options with
curl_easy_setopt(). These make it easier to make sure we pass on the
right option (types) so that the --libcurl code also gets right.

Corrected a few errors.

Closes #16669

5 months agowolfssh: fix freeing of resources in disconnect
Stefan Eissing [Tue, 11 Mar 2025 09:04:50 +0000 (10:04 +0100)] 
wolfssh: fix freeing of resources in disconnect

ssh's disconnect assumed that the session to the server could be
shut down successfully during disconnect. When this failed, e.g.
timed out, memory was leaked.

Closes #16668

5 months agotest489: set output dir
Stefan Eissing [Tue, 11 Mar 2025 11:13:13 +0000 (12:13 +0100)] 
test489: set output dir

Set output dir to %LOGIDR so that generated files are ignored by git.

Closes #16670

5 months agotftpd: prefix TFTP protocol error `E*` constants with `TFTP_`
Viktor Szakats [Fri, 7 Mar 2025 17:24:43 +0000 (18:24 +0100)] 
tftpd: prefix TFTP protocol error `E*` constants with `TFTP_`

To avoid mistaking them for `errno` error codes.

Closes #16666

5 months agoGHA: enable OpenSSL QUIC in a macOS and MinGW job
Viktor Szakats [Tue, 11 Mar 2025 00:16:11 +0000 (01:16 +0100)] 
GHA: enable OpenSSL QUIC in a macOS and MinGW job

Closes #16665

5 months agotool_operate: fix a stray Curl_ symbol use
Daniel Stenberg [Mon, 10 Mar 2025 22:05:49 +0000 (23:05 +0100)] 
tool_operate: fix a stray Curl_ symbol use

5 months agosrc: s/Curl_safefree/curlx_safefree
Daniel Stenberg [Mon, 10 Mar 2025 22:03:09 +0000 (23:03 +0100)] 
src: s/Curl_safefree/curlx_safefree

Towards using curlx_ prefix for all libcurl code that is used in the
tool outside of the "real" API.

Closes #16664

5 months agocurl_memrchr: enable in all builds
Daniel Stenberg [Mon, 10 Mar 2025 21:41:15 +0000 (22:41 +0100)] 
curl_memrchr: enable in all builds

It is used in the URL parser since bc24c60512

Reported-by: Justin Steventon
Fixes #16661
Closes #16663

5 months agosrc: use curlx_dyn_ prefix, not Curl_dyn_
Daniel Stenberg [Mon, 10 Mar 2025 15:57:42 +0000 (16:57 +0100)] 
src: use curlx_dyn_ prefix, not Curl_dyn_

Closes #16658

5 months agosrc: remove Curl_ prefix from tool-specific function
Daniel Stenberg [Mon, 10 Mar 2025 15:54:16 +0000 (16:54 +0100)] 
src: remove Curl_ prefix from tool-specific function

Since that's a prefix we use for library-private functions

Curl_execpath is now tool_execpath

Closes #16657

5 months agolibssh: fix freeing of resources in disconnect
Stefan Eissing [Mon, 10 Mar 2025 16:08:57 +0000 (17:08 +0100)] 
libssh: fix freeing of resources in disconnect

ssh's disconnect assumed that the session to the server could be shut
down successfully during disconnect. When this failed, e.g. timed out,
memory was leaked.

Closes #16659

5 months agolibssh2: fix freeing of resources in disconnect
Stefan Eissing [Mon, 10 Mar 2025 15:34:10 +0000 (16:34 +0100)] 
libssh2: fix freeing of resources in disconnect

ssh's disconnect assumed that the session to the server could be shut
down successfully during disconnect. When this failed, e.g. timed out,
memory was leaked.

Closes #16656

5 months agobuild: enable `-Wcast-qual`, fix or silence compiler warnings
Viktor Szakats [Fri, 31 Jan 2025 22:20:46 +0000 (23:20 +0100)] 
build: enable `-Wcast-qual`, fix or silence compiler warnings

The issues found fell into these categories, with the applied fixes:

- const was accidentally stripped.
  Adjust code to not cast or cast with const.

- const/volatile missing from arguments, local variables.
  Constify arguments or variables, adjust/delete casts. Small code
  changes in a few places.

- const must be stripped because an API dependency requires it.
  Strip `const` with `CURL_UNCONST()` macro to silence the warning out
  of our control. These happen at API boundaries. Sometimes they depend
  on dependency version, which this patch handles as necessary. Also
  enable const support for the zlib API, using `ZLIB_CONST`. Supported
  by zlib 1.2.5.2 and newer.

- const must be stripped because a curl API requires it.
  Strip `const` with `CURL_UNCONST()` macro to silence the warning out
  of our immediate control. For example we promise to send a non-const
  argument to a callback, though the data is const internally.

- other cases where we may avoid const stripping by code changes.
  Also silenced with `CURL_UNCONST()`.

- there are 3 places where `CURL_UNCONST()` is cast again to const.
  To silence this type of warning:
  ```
  lib/vquic/curl_osslq.c:1015:29: error: to be safe all intermediate
    pointers in cast from 'unsigned char **' to 'const unsigned char **'
    must be 'const' qualified [-Werror=cast-qual]
  lib/cf-socket.c:734:32: error: to be safe all intermediate pointers in
    cast from 'char **' to 'const char **' must be 'const' qualified
    [-Werror=cast-qual]
  ```
  There may be a better solution, but I couldn't find it.

These cases are handled in separate subcommits, but without further
markup.

If you see a `-Wcast-qual` warning in curl, we appreciate your report
about it.

Closes #16142

5 months agoDISABLED: add 313 for sectransp (move from GHA/macos)
Viktor Szakats [Mon, 10 Mar 2025 18:26:40 +0000 (19:26 +0100)] 
DISABLED: add 313 for sectransp (move from GHA/macos)

Closes #16660

5 months agotidy-up: replace `Curl_safefree` with `free` before re-assignment
Viktor Szakats [Sun, 9 Mar 2025 23:31:20 +0000 (00:31 +0100)] 
tidy-up: replace `Curl_safefree` with `free` before re-assignment

Also drop `NULL` assignments after `Curl_safefree()`.

Closes #16640

5 months agolibssh: fix scp large file upload for 32-bit size_t systems
Jay Satiro [Mon, 10 Mar 2025 02:20:01 +0000 (22:20 -0400)] 
libssh: fix scp large file upload for 32-bit size_t systems

- Use ssh_scp_push_file64 instead of ssh_scp_push_file.

The former uses uint64_t for file size and the latter uses size_t which
may be 32-bit.

Ref: https://github.com/curl/curl/pull/16194

Closes https://github.com/curl/curl/pull/16641

5 months agourlapi: treat 0 alone as decimal number in IPv4 address
Daniel Stenberg [Mon, 10 Mar 2025 12:42:42 +0000 (13:42 +0100)] 
urlapi: treat 0 alone as decimal number in IPv4 address

Not as a broken octcal. Regression from b4538ec522

Extended test 1560 to verify this behavior.

Reported-by: Carlos Henrique Lima Melara
Closes #16652

5 months agotidy-up: whitespace, tests/server Makefile.inc, timeval in VS project
Viktor Szakats [Sat, 8 Mar 2025 22:32:10 +0000 (23:32 +0100)] 
tidy-up: whitespace, tests/server Makefile.inc, timeval in VS project

- VS projects: drop unused `timediff`.
  (used by curltool library, but this build method doesn't build that.)
- tests/server/sws: reflow an `if` for greppability.
- tests/server/Makefile.inc: indent, format
- tests/server/Makefile.inc: merge `USEFUL` and `UTIL` lists.

Closes #16651

5 months agohostip: don't use alarm() for DoH resolves
Daniel Stenberg [Mon, 10 Mar 2025 11:02:58 +0000 (12:02 +0100)] 
hostip: don't use alarm() for DoH resolves

When built to use the synch resolver and DoH is used for a transfer, do
not use alarm() for timeout since DoH resolving is not blocking.

Closes #16649

5 months agolib: clear up CURLRES_ASYNCH vs USE_CURL_ASYNC use
Daniel Stenberg [Mon, 10 Mar 2025 10:55:01 +0000 (11:55 +0100)] 
lib: clear up CURLRES_ASYNCH vs USE_CURL_ASYNC use

CURLRES_ASYNCH - is for when built to use an async name resolver; threaded or
c-ares

USE_CURL_ASYNC - is for when built to use either an async name resolver OR DoH

Reported-by: Lars Karlitski
Fixes #16645
Closes #16648

5 months agosocks: remove bad assert from do_SOCKS5()
Daniel Stenberg [Mon, 10 Mar 2025 11:09:00 +0000 (12:09 +0100)] 
socks: remove bad assert from do_SOCKS5()

It verified the auth bits wrongly. We don't need this assert anymore
since the input is verified in *setopt().

Bug: https://issues.oss-fuzz.com/issues/401869346

Closes #16650

5 months agoSTRPARSE: amend with recently added functions
Daniel Stenberg [Mon, 10 Mar 2025 08:54:37 +0000 (09:54 +0100)] 
STRPARSE: amend with recently added functions

Closes #16647

5 months agolib: rename curlx_strtoofft to Curl_str_numblanks()
Daniel Stenberg [Mon, 10 Mar 2025 07:12:05 +0000 (08:12 +0100)] 
lib: rename curlx_strtoofft to Curl_str_numblanks()

The function is no longer used via the curlx shortcut.

Remove the strtoofft.[ch] files.

Closes #16642

5 months agoeasy: fix warning about possible comma misuse
Christian Schmitz [Mon, 10 Mar 2025 08:22:22 +0000 (09:22 +0100)] 
easy: fix warning about possible comma misuse

Closes #16644

5 months agoconfigure: call the blocking resolver "blocking", not "default"
Daniel Stenberg [Mon, 10 Mar 2025 09:15:11 +0000 (10:15 +0100)] 
configure: call the blocking resolver "blocking", not "default"

On most systems the default is actually the threaded resolver.

Closes #16646

5 months agomprintf: switch three number parsers to use strparse
Daniel Stenberg [Sat, 8 Mar 2025 21:51:09 +0000 (22:51 +0100)] 
mprintf: switch three number parsers to use strparse

Also add more const char pointers and reduced the scope for some
variables.

Closes #16628

5 months agosrc: replace strto[u][ld] with curlx_str_ parsers
Daniel Stenberg [Sun, 9 Mar 2025 11:49:24 +0000 (12:49 +0100)] 
src: replace strto[u][ld] with curlx_str_ parsers

- Better error handling (no errno mess), better limit checks.

- Also removed all uses of curlx_strtoofft()

Closes #16634

5 months agoGHA/windows: enable H3 in GnuTLS MinGW job
Viktor Szakats [Sun, 9 Mar 2025 16:35:33 +0000 (17:35 +0100)] 
GHA/windows: enable H3 in GnuTLS MinGW job

Closes #16635

5 months agolibssh2: fix memory leak in `SSH_SFTP_REALPATH` state
Viktor Szakats [Sun, 9 Mar 2025 22:12:10 +0000 (23:12 +0100)] 
libssh2: fix memory leak in `SSH_SFTP_REALPATH` state

Seen in MSVC libssh2 CI job:
```
test 0615...[SFTP put remote failure]
test 0616...[SFTP retrieval of empty file]
test 0618...[SFTP retrieval of two files]
test 0620...[SFTP retrieval of missing file followed by good file]
test 0622...[SFTP put failure]
test 0637...[SFTP retrieval with invalid X- range]
test 0640...[SFTP --head retrieval]
  ** MEMORY FAILURE
  Leak detected: memory still allocated: 22 bytes
  At 2ae5b8a7ab8, there's 22 bytes.
   allocated by D:/a/curl/curl/lib/vssh/libssh2.c:2006
```
https://github.com/curl/curl/actions/runs/13752652590/job/38455575042?pr=16636#step:14:3907
https://github.com/curl/curl/actions/runs/13752879003/job/38456075461
https://github.com/curl/curl/actions/runs/13753706458/job/38457888479

Bug: https://github.com/curl/curl/pull/16636#issuecomment-2709086838
Co-authored-by: Daniel Stenberg
Closes #16639

5 months agoruntests: fix SSH server not starting in cases, re-ignore failing vcpkg CI jobs
Viktor Szakats [Sun, 9 Mar 2025 12:14:31 +0000 (13:14 +0100)] 
runtests: fix SSH server not starting in cases, re-ignore failing vcpkg CI jobs

Replace `Cwd::abs_path()` with `File::Spec->rel2abs()`. The former
requires the file to exist, but in some cases, it's missing.

Seen in MSVC vcpkg jobs using Chocolatey OpenSSH v8.0.0.1 ending up with
`$path=/d/a/curl/curl/bld/tests/log/3/server/ssh_server.pid`, which does
not exist while converting to an absolute path (the path is already
absolute, but the conversion is done unconditionally):
```
Use of uninitialized value in subroutine entry at D:/a/curl/curl/tests/pathhelp.pm line 128.
can't convert empty path at D:/a/curl/curl/tests/pathhelp.pm line 128.
```
Ref: https://github.com/curl/curl/actions/runs/13747741797/job/38444844173#step:14:1233 (master)
Ref: https://github.com/curl/curl/actions/runs/13751862952/job/38453816737#step:14:3185 (trace)

Also ignore 3 new libssh2 jobs failing due to memleak.

Partial revert of 1bd5ac998bbc943dbf812b2824ad0f532201734c #16570

Closes #16636

5 months agotests/server: sync `wait_ms()` with the libcurl implementation
Viktor Szakats [Sat, 8 Mar 2025 21:15:07 +0000 (22:15 +0100)] 
tests/server: sync `wait_ms()` with the libcurl implementation

It contains a series of bugfixes and updates applied to libcurl's
`Curl_wait_ms()` over the years, but missed from the copy in
`tests/server/util.c`:
d65321f93916e60f65b89d9bcb502341ea5c5939,
  52e822173aa3cd4f610531d32fbf943f026cdca6,
  5912da253b64de3cb2a1a229558077219b2c8a35
4a8f459837e2b7dc146825fc9a864045f7d1ae4a
1ad49feb71418f26aa6114c7a20ce1463beb3ea9

It fixes `wait_ms()` to check for, and return `SOCKERRNO`. Fixing error
handling on Windows.

Also:
- tests/server: change callers to check `SOCKERRNO`.
- `wait_ms()`: fix to check for the correct error code on Windows.
  Pending for `Curl_wait_ms()`: #16621.
- `Curl_wait_ms()`: tidy-up `Sleep()` argument cast (nit).
- lib/curl_trc: drop an unused header.

Closes #16627

5 months agotests/servers.pm: remove unused variable 'portrange'
Samuel Henrique [Sun, 9 Mar 2025 10:19:48 +0000 (10:19 +0000)] 
tests/servers.pm: remove unused variable 'portrange'

Its usage was dropped at 4efa0b5749bb7c366e1c3bda90650ef864d3978e
(https://github.com/curl/curl/pull/11220)

Grepping the tests folder for "portrange" returns only this as a result.

Closes #16632

5 months agolib2302: fix crash due to stack overflow on MSVC and clang Windows
Viktor Szakats [Sat, 8 Mar 2025 23:32:22 +0000 (00:32 +0100)] 
lib2302: fix crash due to stack overflow on MSVC and clang Windows

It fixes test 2302, 2303, 2307 with MSVC and clang on Windows.
GCC Windows builds were not affected.

Failure was caused by stack overflow due to a 1MB+ sized test struct on
stack. Replace it with dynamic allocation.

Also unignore affected tests in GHA/windows.

As seen under WINE with llvm-mingw:
```
$ wine64 libtests.exe lib2302 ws://127.0.0.1:59964/2302 > stdout2302 2> stderr2302
Test: lib2302
URL: ws://127.0.0.1:59964/2302
wine: Unhandled stack overflow at address 000000014007486A (thread 0024), starting debugger...
Unhandled exception: stack overflow in 64-bit code (0x000000014007486a).
```

Ref: #16629 (discovery)
Ref: 1bd5ac998bbc943dbf812b2824ad0f532201734c #16570

Closes #16630

5 months agoGHA/windows: add GnuTLS job, drop default OpenSSL for Cygwin/MSYS2 jobs
Viktor Szakats [Sat, 8 Mar 2025 23:01:17 +0000 (00:01 +0100)] 
GHA/windows: add GnuTLS job, drop default OpenSSL for Cygwin/MSYS2 jobs

To allow selecting the TLS backend(s) for each individual job.

Closes #16629

5 months agoGHA/windows: re-add GnuTLS for vcpkg, improve perf by building examples less
Viktor Szakats [Sat, 8 Mar 2025 02:31:45 +0000 (03:31 +0100)] 
GHA/windows: re-add GnuTLS for vcpkg, improve perf by building examples less

The GnuTLS MSVC/vcpkg build doesn't actually work on Windows. Let's
restore the build itself, to keep it fit for more testing. With disabled
tests (and examples) to keep it fast and not add to flakiness.

Also:
- enable GnuTLS in the MultiSSL job.
- limit building examples to one normal and one UWP job. It saves
  6 x 1-1.5 minutes. Coverage remains the same, because example builds
  only depend on the toolchain / target, not on the actual features
  (except IPv6, but that's enabled for all.)

Closes #16623

5 months agoRELEASE-NOTES: synced
Daniel Stenberg [Sat, 8 Mar 2025 21:32:44 +0000 (22:32 +0100)] 
RELEASE-NOTES: synced

5 months agotest1022: add support for rc releases
Samuel Henrique [Sat, 8 Mar 2025 12:47:21 +0000 (12:47 +0000)] 
test1022: add support for rc releases

 Fix the following test failure:
 curl-config: illegal value

Closes #16626

5 months agogtls: fix uninitialized variable
Viktor Szakats [Sat, 8 Mar 2025 03:25:03 +0000 (04:25 +0100)] 
gtls: fix uninitialized variable

Fix uninitialized variable (warning by MSVC):
```
lib\vtls\gtls.c(1207,1): error C2220: the following warning is treated as an error
lib\vtls\gtls.c(1207,1): warning C4701: potentially uninitialized local variable 'result' used
```
Ref: https://github.com/curl/curl/actions/runs/13733139148/job/38413553053#step:9:31

Closes #16625

5 months agoGHA: update dependency cloudflare/quiche to v0.23.4
renovate[bot] [Fri, 7 Mar 2025 22:33:20 +0000 (22:33 +0000)] 
GHA: update dependency cloudflare/quiche to v0.23.4

Closes #16618

5 months agoRELEASE-PROCEDURE.md: explain release candidates
Daniel Stenberg [Sat, 8 Mar 2025 09:38:49 +0000 (10:38 +0100)] 
RELEASE-PROCEDURE.md: explain release candidates

Closes #16622

5 months agocurl_setup_once: stop redefining `ENAMETOOLONG` to winsock2 error code
Viktor Szakats [Sat, 8 Mar 2025 01:02:22 +0000 (02:02 +0100)] 
curl_setup_once: stop redefining `ENAMETOOLONG` to winsock2 error code

The only user is error display code following an `mkdir()` call. In this
case the redefinition didn't cause an issue, but was unnecessary.

Follow-up to d69425ed7d0918aceddd96048b146a9df85638ec #16615
Closes #16620

5 months agocurl_setup_once: drop `E*` macro redefines unused (with winsock2)
Viktor Szakats [Fri, 7 Mar 2025 16:07:35 +0000 (17:07 +0100)] 
curl_setup_once: drop `E*` macro redefines unused (with winsock2)

These were not used in curl sources at all.

Except `EDQUOT` which was used after `mkdir()` in `src/tool_dirhie.c`
for error display. It should not be redefined to a winsock2 error.
This makes the "exceeded your quota" error correctly appear on Windows,
if detected, after operations that create directories.

After this patch there remain 14 `E*` macro redefines on Windows,
down from 40 before this patch.

Bug: https://github.com/curl/curl/pull/16553#issuecomment-2704679377
Ref: #16612
Ref: #16605
Closes #16615

5 months agotests/server: fix to check against winsock2 error codes on Windows
Viktor Szakats [Thu, 6 Mar 2025 21:13:39 +0000 (22:13 +0100)] 
tests/server: fix to check against winsock2 error codes on Windows

Windows's winsock2 returns socket errors via `WSAGetLastError()` and
not via `errno` like most systems out there. This was covered by
switching to the `SOCKERRNO` curl macro earlier. But, on Windows the
returned socket error codes have different values than the standard
POSIX errno values. Existing code was using the POSIX values for all
these checks. Meaning they never actually matched on Windows.

This patch defines a set of `SOCKERRNO` constants that map to the
correct socket error values for Windows and other platforms.

The reverse issue exists in core curl code, which redefines POSIX errno
values to winsock2 ones, breaking non-socket uses on Windows.

Cherry-picked from #15000
Follow-up to adcfd4fb3e9be1de0e506728066bea2aaa53c394 #16553
Bug: https://github.com/curl/curl/pull/16553#issuecomment-2704679377

Closes #16612

5 months agozlib: bump minimum to 1.2.5.2 (was: 1.2.0.4)
Viktor Szakats [Fri, 7 Mar 2025 19:35:59 +0000 (20:35 +0100)] 
zlib: bump minimum to 1.2.5.2 (was: 1.2.0.4)

1.2.5.2 was released on 2011-12-18. (vs. 1.2.0.4 on 2003-08-10)

It allows to:
- use `Z_BLOCK` unconditionally.
- use `inflateReset2()` to replace `inflateEnd()` + `inflateInit2()`
  and save a memory allocation.
- use `Z_CONST` and `z_const` (in a future commit).

Suggested-by: Dan Fandrich
Ref: https://github.com/curl/curl/pull/16142#discussion_r1985449743

Closes #16616

5 months agoquiche: do not iterate over multi handles
Stefan Eissing [Fri, 7 Mar 2025 10:34:40 +0000 (11:34 +0100)] 
quiche: do not iterate over multi handles

Quiche needs to find easy handles to events. Do this by iterating
over the filters stream hash and lookup the easy handle on a match.

This O(+streams-in-filter) vs O(all easy handles), at least once
we fix the multi lookup to use a hash.

Closes #16607

5 months agotool_parsecfg: make my_get_line() skip empty and blanks-only lines
Daniel Stenberg [Fri, 7 Mar 2025 11:11:31 +0000 (12:11 +0100)] 
tool_parsecfg: make my_get_line() skip empty and blanks-only lines

Closes #16613

5 months agosetopt: illegal CURLOPT_SOCKS5_AUTH should return error
Daniel Stenberg [Fri, 7 Mar 2025 22:01:33 +0000 (23:01 +0100)] 
setopt: illegal CURLOPT_SOCKS5_AUTH should return error

The check was just wrong before.

Regression introduced in 30da1f5974d34841b30c4fac3

Bug: https://issues.oss-fuzz.com/issues/401430844
Closes #16617

5 months agoGHA/windows: msys/mingw improvements
Viktor Szakats [Fri, 7 Mar 2025 02:21:18 +0000 (03:21 +0100)] 
GHA/windows: msys/mingw improvements

- enable zstd in Cygwin and MSYS jobs.
- dl-mingw: use Ninja in the 9.5.0 (winlibs-mingw) job.
  The download package is shipping with it. Saves 15s build time.
  Keep testing GNU Makefiles with the two mingw-builds jobs.
- dl-mingw: split `env` prop to `env` and `ver` to aid integrating with
  MSYS2.
- dl-mingw: install MSYS2 with options to make it quick (<20s).
  It allows to use MSYS2 dependency packages with the downloaded
  toolchains. It also makes configuration cleaner. Install libpsl.
- dl-mingw: enable mbedTLS in the 7.3.0 job.
  (OpenSSL took a long time to install, wolfSSL misses features.)

Assisted-by: Jeremy Drake
Closes #16429

5 months agovtls: fix compiler warnings seen with gcc 7.3.0 and mbedTLS
Viktor Szakats [Fri, 7 Mar 2025 13:58:22 +0000 (14:58 +0100)] 
vtls: fix compiler warnings seen with gcc 7.3.0 and mbedTLS

Seen with downloaded mingw 7.3.0 when built against MSYS2 mbedTLS 3.6.2:
```
lib/vtls/cipher_suite.c: In function 'cs_zip_to_str':
lib/vtls/cipher_suite.c:789:16: error: conversion to 'uint8_t {aka unsigned char}' from 'int' may alter its value [-Werror=conversion]
   indexes[1] = ((zip[0] << 4) & 0x3F) | zip[1] >> 4;
                ^
lib/vtls/cipher_suite.c:790:16: error: conversion to 'uint8_t {aka unsigned char}' from 'int' may alter its value [-Werror=conversion]
   indexes[2] = ((zip[1] << 2) & 0x3F) | zip[2] >> 6;
                ^
lib/vtls/cipher_suite.c:793:16: error: conversion to 'uint8_t {aka unsigned char}' from 'int' may alter its value [-Werror=conversion]
   indexes[5] = ((zip[3] << 4) & 0x3F) | zip[4] >> 4;
                ^
lib/vtls/cipher_suite.c:794:16: error: conversion to 'uint8_t {aka unsigned char}' from 'int' may alter its value [-Werror=conversion]
   indexes[6] = ((zip[4] << 2) & 0x3F) | zip[5] >> 6;
                ^
```
Ref: https://github.com/curl/curl/actions/runs/13719756989/job/38372409927?pr=16429#step:10:21

Cherry-picked from #16429
Closes #16614

5 months agoopenssl-quic: do not iterate over multi handles
Stefan Eissing [Fri, 7 Mar 2025 12:09:16 +0000 (13:09 +0100)] 
openssl-quic: do not iterate over multi handles

Iterate over the filters stream hash instead, lookup easy handles
at the multi when needed.

This also limits to pollset array sizes to the number of streams
on the connection and not the total number of transfers in the multi.

Closes #16611

5 months agoGHA/windows: ignore flaky 2310 with MSVC again
Viktor Szakats [Fri, 7 Mar 2025 13:28:04 +0000 (14:28 +0100)] 
GHA/windows: ignore flaky 2310 with MSVC again

Follow-up to 1bd5ac998bbc943dbf812b2824ad0f532201734c #16570

5 months agotests/server: round of tidy-ups (part 2)
Viktor Szakats [Sun, 22 Sep 2024 15:48:17 +0000 (17:48 +0200)] 
tests/server: round of tidy-ups (part 2)

General tidy-ups, to identify and reduce duplications and potential
issues, while also making the server modules compile as a single binary.

- ensure unique symbols and no shadowing across server sources, by
  renaming variables.
- move globals common to multiple servers into shared `util` module.
- drop constants with a single use.
- undef macro before re-using them across server sources.
- move common functions into shared `util` module.
- drop redundant static declarations.
- disable IPv6 code when built without IPv6.
- start syncing the 3 almost identical copies of `sockdaemon` function.
- drop unused `timeval.h` header.
- drop `poll()` from `wait_ms()`, for macOS, following an earlier core
  update.
  Follow-up to c72cefea0fadaf4114a0036c86005ee5739ec30a #15096

Follow-up to 9213e4e497d575d2bc2c9265d40da6c5549f526d #16525
Cherry-picked from #15000
Closes #16609

5 months agowolfssl: fix unused variable warning
Viktor Szakats [Fri, 7 Mar 2025 03:40:08 +0000 (04:40 +0100)] 
wolfssl: fix unused variable warning

E.g. when building against msys2-mingw wolfssl:
https://packages.msys2.org/base/mingw-w64-wolfssl

```
lib/vtls/wolfssl.c: In function 'wssl_verify_pinned':
lib/vtls/wolfssl.c:1534:20: error: unused variable 'wssl' [-Werror=unused-variable]
   struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
                    ^~~~
```
Ref: https://github.com/curl/curl/actions/runs/13713131802/job/38353245932#step:10:78

Building with the MSYS2 wolfssl is broken due to further issues.

Closes #16608

5 months agocmake: `CURL_LIBDIRS` improvements (upstreamed from vcpkg)
Viktor Szakats [Tue, 25 Feb 2025 15:27:15 +0000 (16:27 +0100)] 
cmake: `CURL_LIBDIRS` improvements (upstreamed from vcpkg)

Apply downstream patches from the vcpkg project:

- cmake: remove duplicates from `CURL_LIBDIRS`.

- cmake: set `CURL_LIBDIRS` as `INTERFACE_LINK_DIRECTORIES` for static
  libcurl.
  To support CMake <3.13, change downstream patch from:
  ```cmake
  target_link_directories(${LIB_STATIC} INTERFACE ${CURL_LIBDIRS})
  ```
  to:
  ```cmake
  set_target_properties(${LIB_STATIC} PROPERTIES [...] INTERFACE_LINK_DIRECTORIES "${CURL_LIBDIRS}")
  ```

Co-authored-by: Kai Pastor
Ref: https://github.com/microsoft/vcpkg/pull/43819

Closes #16610

5 months agobuild: cmake multi-pkg-config detection improvements (brotli, ldap, mbedtls)
Viktor Szakats [Tue, 25 Feb 2025 15:36:21 +0000 (16:36 +0100)] 
build: cmake multi-pkg-config detection improvements (brotli, ldap, mbedtls)

Apply downstream patch from the vcpkg project:

- cmake/FindBrotli: streamline detecting multiple pkg-config modules.
  Add `libbrotlicommon` to `Requires.private` in `libcurl.pc`.

Apply the above idea to the rest of multi-module dependencies:

- cmake/FindMbedTLS: streamline detecting multiple pkg-config modules
  Add `mbedx509`, `mbedcrypto` to `Requires.private` in `libcurl.pc`.

- cmake/FindLDAP: streamline detecting multiple pkg-config modules

And sync these changes with autotools, and add `libbrotlicommon`,
`mbedx509`, `mbedcrypto` to `Requires.private`.

Co-authored-by: Kai Pastor
Ref: https://github.com/microsoft/vcpkg/pull/43819

Closes #16479

5 months agourl: call protocol handler's disconnect in Curl_conn_free
Daniel Stenberg [Fri, 7 Mar 2025 08:32:57 +0000 (09:32 +0100)] 
url: call protocol handler's disconnect in Curl_conn_free

For the case when the connection struct is all setup, the protocol
handler allocates data in its setup_connection function, but the
connection struct is discarded again before used further because a
connection reuse is prefered. Then the handler's disconnect function was
not previously called, which then would lead to a memory leak.

I added test case 698 that reproduces the leak and the fix.

Reported-by: Philippe Antoine
Closes #16604

5 months agongtcp2: do not iterate over multi handles
Stefan Eissing [Fri, 7 Mar 2025 09:17:25 +0000 (10:17 +0100)] 
ngtcp2: do not iterate over multi handles

There was on place left iterating over `multi->process` list which was
unnecessary. Remove that.

Closes #16606

5 months agosrc: cleanup ISBLANK vs ISSPACE
Daniel Stenberg [Thu, 6 Mar 2025 10:01:55 +0000 (11:01 +0100)] 
src: cleanup ISBLANK vs ISSPACE

- use ISBLANK() where only spaces and tabs should match
- change while(x && ISBLANK(X)) => while(ISBLANK(x))

Closes #16589

5 months agoGHA/macos: add initial pytest support
Viktor Szakats [Thu, 27 Feb 2025 16:06:58 +0000 (17:06 +0100)] 
GHA/macos: add initial pytest support

Add support for running pytest in GHA/macos jobs.

Experimental, with caveats:
- slow.
- `httpd` often fails to start.
- 10-15 tests (depending on C compiler) fail consistently:
  02_20, 02_33, 02_34, 03_01, 03_03, 05_04, 07_42.
- Homebrew build of vsftpd misses TLS support.
- `nghttpx` temporarily disabled for pytest.

You can test pytest by adding `install_steps: pytest` to a job.

Closes #16518

5 months agosetopt: setting PROXYUSERPWD after PROXYUSERNAME/PASSWORD is fine 16601/head
Daniel Stenberg [Thu, 6 Mar 2025 22:40:17 +0000 (23:40 +0100)] 
setopt: setting PROXYUSERPWD after PROXYUSERNAME/PASSWORD is fine

Prevent the previous memory leak. Adjusted test 590 to reproduce the
problem then verify the fix.

Fixes #16599
Reported-by: Catena cyber
Closes #16601

5 months agodoh: improve HTTPS RR svcparams parsing
Harry Sintonen [Thu, 6 Mar 2025 19:42:43 +0000 (21:42 +0200)] 
doh: improve HTTPS RR svcparams parsing

Fixed a heap read overflow when parsing the HTTP RR svcparams. Also the
code failed to enforce the requirements of SvcParamKey order specified
in section 2.2 of the RFC 9460.

Closes #16598

5 months agoGHA/windows: drop `handle64.exe`
Viktor Szakats [Tue, 25 Feb 2025 17:09:02 +0000 (18:09 +0100)] 
GHA/windows: drop `handle64.exe`

To test its effect on stability/flakiness of Windows jobs.

Ref: https://github.com/curl/curl/pull/16484#issuecomment-2705016375
Cherry-picked from #16484
Closes #16600

5 months agosectransp: add support for HTTP/2 in gcc builds
Viktor Szakats [Wed, 5 Mar 2025 23:17:08 +0000 (00:17 +0100)] 
sectransp: add support for HTTP/2 in gcc builds

Before this patch `--http2` did not work in gcc builds with Secure
Transport, because ALPN relied on a compiler supporting the
`HAVE_BUILTIN_AVAILABLE` aka `__builtin_available()` feature. This
is clang-specific and missing from gcc (as of gcc v14).

Add support for ALPN and HTTP/2 when this compiler feature is missing.

Also drop test exceptions from GHA/macos in CI.

Follow-up to 092f6815c808489f1cea3df8449e16dff2c35e6b
Ref: c349bd668c91f2484ae21c0f361ddf497143093c #14097 (issue 15.)
Ref: #4314

Closes #16581

5 months agotests: reformat error messages to avoid tripping MSBuild
Viktor Szakats [Thu, 6 Mar 2025 03:13:23 +0000 (04:13 +0100)] 
tests: reformat error messages to avoid tripping MSBuild

Change the format of error messages sent to stderr from tests and test
servers. As a workaround to avoid triggering Visual Studio's MSBuild
tool's built-in regexp matcher, and making it mark builds failed for
reasons we don't want them to hard fail.

Roughly, the pattern to avoid is the word "error" (case-insensitive)
in the same line with a colon `:`.

It affected GHA/windows MSVC CI jobs, causing flakiness:
```
CUSTOMBUILD : fopen() failed with error : 13 Permission denied [D:\a\curl\curl\bld\tests\test-ci.vcxproj]
  Error opening file: log/4/smtp_sockfilt.log
[...]
CUSTOMBUILD : fopen() failed with error : 13 Permission denied [D:\a\curl\curl\bld\tests\test-ci.vcxproj]
  Error opening file: log/8/imap_sockfilt.log
  Msg not logged: 00:18:10.656000 > 178 bytes data, server => client
[...]
  TESTDONE: 1629 tests out of 1634 reported OK: 99%
  Building Custom Rule D:/a/curl/curl/tests/CMakeLists.txt
C:\Program Files\Microsoft Visual Studio\2022\Enterprise\MSBuild\Microsoft\VC\v170\Microsoft.CppCommon.targets(254,5): error MSB8066: Custom build for 'D:\a\curl\curl\bld\CMakeFiles\621f80ddbb0fa48179f056ca77842ff0\test-ci.rule;D:\a\curl\curl\tests\CMakeLists.txt' exited with code -1. [D:\a\curl\curl\bld\tests\test-ci.vcxproj]
Error: Process completed with exit code 1.
```
Ref: https://github.com/curl/curl/actions/runs/13643149623/job/38137076210?pr=16490#step:14:3125
Ref: https://github.com/curl/curl/actions/runs/13688765792/job/38277961720?pr=16582#step:14:1717

The `IgnoreStandardErrorWarningFormat="true"` MSBuild Exec option
controls this behavior:
https://learn.microsoft.com/visualstudio/msbuild/exec-task#parameters
I couldn't figure out a way to apply it to CMake builds.

MSBuid pattern matching rules:
https://github.com/dotnet/msbuild/blob/353c0f3d37957cc98bfa6a76b568d70d12193fc3/src/Shared/CanonicalError.cs
https://learn.microsoft.com/visualstudio/msbuild/msbuild-diagnostic-format-for-tasks

Note: There may be further error messages output from runtests scripts,
that use this format, which are not explicitly fatal. They may need
future fixes.

Thanks-to: Dion Williams
Ref: https://github.com/curl/curl/discussions/14854#discussioncomment-12382190
Ref: https://github.com/curl/curl/discussions/14854#discussioncomment-12395224

Closes #16583

5 months agowindows: do not use winsock2 `inet_ntop()`/`inet_pton()`
Viktor Szakats [Wed, 5 Mar 2025 17:06:37 +0000 (18:06 +0100)] 
windows: do not use winsock2 `inet_ntop()`/`inet_pton()`

Disable these winsock2 functions on Windows to use the curl wrappers
and preserve `WSAGetLastError()` aka `SOCKERRNO` error codes.

curl sources uses `inet_pton()` and `inet_ntop()` via its own `Curl_`
prefixed wrappers. These wrappers promise to not overwrite
`WSAGetLastError()` aka `SOCKERRNO` error codes when calling them.
But, for Windows builds with these built-in winsock2 functions detected
(meaning all supported Windows versions, except Windows CE),
the wrappers were 1-to-1 mapped to the winsock2 functions, which broke
this promise.

https://github.com/curl/curl/blob/b06c12b7248592cf001e621d7cd8dc78a827212b/lib/inet_ntop.c#L188-L190
https://github.com/curl/curl/blob/b06c12b7248592cf001e621d7cd8dc78a827212b/lib/inet_pton.c#L66-L70

These promises are old (a1d598399146984c99baa46db148e87c75261033) and
may not be valid anymore. In this case, the callers would have to be
updated to use `SOCKERRNO` to retrieve any error, instead of using
`errno` as they do now.

https://learn.microsoft.com/windows/win32/api/ws2tcpip/nf-ws2tcpip-inet_ntop
https://learn.microsoft.com/windows/win32/api/ws2tcpip/nf-ws2tcpip-inet_pton

Closes #16577

5 months agoRELEASE-NOTES: synced
Daniel Stenberg [Thu, 6 Mar 2025 15:48:46 +0000 (16:48 +0100)] 
RELEASE-NOTES: synced

5 months agows: corrected curlws_cont to reflect its documented purpose
Ethan Wilkes [Thu, 27 Feb 2025 22:21:28 +0000 (16:21 -0600)] 
ws: corrected curlws_cont to reflect its documented purpose

Verified in test 2311

Closes #16512

5 months agomulti: start the loop over when handles are removed
Daniel Stenberg [Tue, 4 Mar 2025 13:00:03 +0000 (14:00 +0100)] 
multi: start the loop over when handles are removed

Since more than one handle can be removed in a single call to
multi_runsingle(), we cannot easily continue on the next node when a
node has been removed since that node migth ALSO have been removed.

Reported-by: Philippe Antoine
Closes #16588

5 months agotool_parsecfg: make my_get_line skip comments and newlines
Daniel Stenberg [Thu, 6 Mar 2025 10:38:23 +0000 (11:38 +0100)] 
tool_parsecfg: make my_get_line skip comments and newlines

- brings this functionality to all users of this function automatically
  and consistently

- consistently returns every line without trailing \n

Closes #16590