Marcel Raad [Mon, 17 Nov 2025 08:25:22 +0000 (09:25 +0100)]
build: exclude clang prereleases from compiler warning options
Starting with clang 18, stable clang releases start with minor version 1.
Exclude pre-releases with minor version 0 from the compiler warning
options for that major version.
This fixes the build with Android NDK r29, which uses a prerelease
version of clang 21 that doesn't know the new options yet.
Viktor Szakats [Mon, 17 Nov 2025 00:16:07 +0000 (01:16 +0100)]
cf-socket: limit use of `TCP_KEEP*` to Windows 10.0.16299+ at runtime
Before this patch `TCP_KEEP*` socket options were unconditionally used
if the build-time SDK supported them. This caused curl logging errors
(or trace messages since #19527) on Windows versions missing support
for them. After this patch, use them only when the runtime environment
supports it and fall back to the alternate method (`SIO_KEEPALIVE_VALS`)
dynamically.
Also:
- log a trace message when using the Win10 method.
- document which SDK versions offer `TCP_KEEP*` macros.
Stefan Eissing [Sat, 15 Nov 2025 11:45:54 +0000 (12:45 +0100)]
pytest fixes and improvements
- fix test_17_20 flakiness: the test case did not have `nghttpx` in
its parameters, causing it to no check if a reload was necessary.
When that test ran behind one that gave nghttpx another certificate,
eg. in parallel mode, it used the wrong pinned pubkey.
- Have `env` provide lists of HTTP protocol versions available for
testing. Replace parameterized tests on a fixed protocol list with
the dynamic one from env. This makes checks for protocol availability
in the test function bodies superfluous.
Viktor Szakats [Sun, 16 Nov 2025 18:56:39 +0000 (19:56 +0100)]
runtests: detect bad libssh differently for test 1459 (fixing CircleCI libssh job)
test 1459 "SFTP with corrupted known_hosts" was seen failing in the past.
To fix it, the test was automatically disabled when detecting libssh
0.9.3 or older, as in the curl CircleCI job, running on Ubuntu 20.04.
This work for a long time, until bumping the CircleCI runner to Ubuntu
22.04 (to have OpenSSL 3), where the test was running again, and failing
with the isssue seen in the past.
- Test skipped with Ubuntu 20.04 (libssh 0.9.3):
https://app.circleci.com/pipelines/github/curl/curl/16445/workflows/7f198763-e0b0-4037-9245-4c4b40ab8726/jobs/155164
- Failure seen with Ubuntu 22.04 (libssh 0.9.6):
https://app.circleci.com/pipelines/github/curl/curl/16452/workflows/b817a808-0fd4-40b0-8eb0-d064926efe12/jobs/155206?invite=true#step-107-211709_45
- Failure seen with Ubuntu 24.04 (libssh 0.10.6):
https://app.circleci.com/pipelines/github/curl/curl/16455/workflows/86c631f1-3c5f-4438-b398-3df2bdab5d20/jobs/155218
Turns out the issue issue isn't libssh 0.9.3 itself, but
a CircleCI-specific default configuration in `/etc/ssh/ssh_config`:
```
# BEGIN ANSIBLE MANAGED BLOCK
Host *
StrictHostKeyChecking no <------ this particular line
HashKnownHosts no
SendEnv LANG LC_*
# END ANSIBLE MANAGED BLOCK
```
libssh will consult configuration files on hard-coded default system
locations and alter its behavior based on settings found in them.
This libssh behavior is present in all supported versions:
https://gitlab.com/libssh/libssh-mirror/-/commit/5a2abd34ce9ad97c69906c5fb7b07e26e96fceaa
https://gitlab.com/libssh/libssh-mirror/-/tags/libssh-0.9.0
It means the existing disable logic based on libssh version worked by
coincidence, and what needs to be checked is these configurations
to decide if it's safe to run the test. Another, simpler option is
to also accept the result code 67, though in that case the test
wouldn't actually test what we want, but would pass anyway.
With the old `oldlibssh` workaround deleted, and the problematic setting
manually overridden (`StrictHostKeyChecking yes`):
- CircleCI Ubuntu 20.04 passes with 1459 enabled:
https://app.circleci.com/pipelines/github/curl/curl/16483/workflows/87a9f389-76a2-4a32-acde-c0b411a4c842/jobs/155302
- CircleCI Ubuntu 22.04 does too:
https://app.circleci.com/pipelines/github/curl/curl/16483/workflows/87a9f389-76a2-4a32-acde-c0b411a4c842/jobs/155303
To fix, replace the `runtests` `oldlibssh` detection logic to parse
libssh config files (instead of checking for libssh version) and disable
test 1459 based on that. Notice the detection is making a light attempt
to parse these files, and does not implement most config file features
(such as includes, quoted values and `=` operator.)
The new runtests workaround tests OK with the:
- default CircleCI configuration, disabling 1459 automatically.
- a sudoless configuration fix, with 1459 run successfully.
Also keep setting this option in CircleCI jobs.
- a sudo configuration fix, with 1459 run successfully.
Ref: https://app.circleci.com/pipelines/github/curl/curl/16492/workflows/56f39335-97ba-412c-9a9b-3d662694375a
GHA jobs are not affected and they work fine, with 1459 running successfully
before and after this patch.
It's possible the libssh API offers ways to control config file use
and/or set the strict host checking option programatically. Maybe
to enable in debug mode (albeit CircleCI job are not debug-enabled),
or offer an option for them. It may be something for a future patch.
Viktor Szakats [Sun, 16 Nov 2025 00:06:24 +0000 (01:06 +0100)]
CI: avoid restart prompt on libssh-dev install in CircleCI
By setting `DEBIAN_FRONTEND=noninteractive`.
Also:
- add `curl -V` step to CircleCI jobs.
- drop duplicate `libpsl` from `apt install`.
- replace sudo pip with venv, fixing a warning and syncing with GHA.
- Note that test 1459 was disabled on Ubuntu 20.04 due to past issues.
When running on newer CircleCI Ubuntu runners (22.04 or 24.04), the
test is not disabled, and also fails with the issue seen in the past.
I've identified the root cause and will fix it in a separate PR.
Viktor Szakats [Mon, 14 Jul 2025 22:36:08 +0000 (00:36 +0200)]
build: drop Windows CE / CeGCC support
Windows CE support was limited to successful builds with ming32ce
(a toolchain that hasn't seen an update since 2009, using an ancient gcc
version and "old mingw"-style SDK headers, that curl deprecated earlier).
Builds with MSVC were broken for a long time. mingw32ce builds were never
actually tested and runtime and unlikely to work due to missing stubs.
Windows CE toolchains also miss to comply with C89. Paired with lack of
demand and support for the platform, curl deprecated it earlier.
This patch removes support from the codebase to ease maintaining Windows
codepaths.
Viktor Szakats [Fri, 14 Nov 2025 16:55:33 +0000 (17:55 +0100)]
badwords: check indented lines in source code, fix fallouts
- badwords.pl: add `-a` option to check all lines in source code files.
Before this patch indented lines were skipped (to avoid Markdown code
fences.)
- GHA/checksrc: use `-a` when verifying the source code.
- GHA/checksrc: disable `So` and `But` rules for source code.
- GHA/checksrc: add docs/examples to the verified sources.
- badwords.txt: delete 4 duplicates.
- badwords.txt: group and sort contractions.
- badwords.txt: allow ` url = `, `DIR`, `<file name`.
Stefan Eissing [Fri, 14 Nov 2025 15:26:14 +0000 (16:26 +0100)]
test07_22: fix flakiness
The HTTP/3 tests did send 20 transfers against nghttpx with a backend
that failed the uploads with a 400 and an incomplete response body. This
causes stream resets.
Apache keeps the connection open, but newer nghttpx closes the front
connection after "too many" reset. When that bites, it depends on the
number of transfers ongoing how the test case fails. This led to flaky
outcomes.
Reduce the transfers to just a single one and check the result of
that one. Parallelism is not important here.
Daniel Stenberg [Fri, 14 Nov 2025 09:52:43 +0000 (10:52 +0100)]
connect: reshuffle Curl_timeleft_ms to avoid 'redundant condition'
Line 143: "if(duringconnect)" would always equal true. While this is
harmless, I believe this minor tweak makes the flow slightly more
obvious to the reader and avoids the redundant condition.
Daniel Stenberg [Thu, 13 Nov 2025 12:19:01 +0000 (13:19 +0100)]
wolfssl: simplify wssl_send_earlydata
Move out logic from a switch() expression and return error directly
instead of using goto. This also removes the odd-looking two subsequent
closing braces at the same indent level.
Stefan Eissing [Wed, 12 Nov 2025 14:58:49 +0000 (15:58 +0100)]
lib: eliminate size_t casts
Add new functions in `curlx/warnless.h` for controlled type
conversions:
* curlx_uitouz, convert unsigned into to size_t (should always work)
* curlx_uztoso, convert size_t to curl_off_t, capping at CURL_OFF_T_MAX
* curlx_sztouz, convert ssize_t to size_t, return TRUE when ok
* curlx_sotouz_range, convert curl_off_t to size_t interval, capping
values to interval bounds
Remove some unnecesary casts, convert some internal recv functions
to the "return result, have size_t* arg" pattern.
Stefan Eissing [Wed, 12 Nov 2025 11:15:42 +0000 (12:15 +0100)]
lib: rename curlx_timediff to curlx_timeleft_ms
Rename `Curl_timeleft()` to `Curl_timeleft_ms()` to make the units in
the returned `timediff_t` clear. (We used to always have ms there, but
with QUIC started to sometimes calc ns as well).
Rename some assigned vars without `_ms` suffix for clarity as well.
Daniel Stenberg [Wed, 12 Nov 2025 12:16:33 +0000 (13:16 +0100)]
cookie: propagate errors better, cleanup the internal API
Overhaul of the internal cookie APIs and an attempt to better return
errors for OOM and similar critical problems, separate from ordinary and
benign parsing problems.
Viktor Szakats [Wed, 12 Nov 2025 16:26:27 +0000 (17:26 +0100)]
runtests: allow `client/command` to span multiple lines, and use it
Some curl command-lines are long, often repetitive, and difficult
to read or write:
Before this patch (1 test == 1 line):
- <=78 characters: 1099 tests
- 79-132 characters: 500 tests
- 133+ characters: 217 tests: patch meant to help with some of these.
After this patch:
- <=78 characters: 1288 lines
- 79-132 characters: 526 lines
- 133+ characters: 190 lines
After this patch it's possible to fold long lines into multiple ones.
Folding can reduce greppability, thus this is primarily useful for cases
when the options are repetitive, e.g. a list of form options, headers,
mail parameters and the like.
Viktor Szakats [Wed, 12 Nov 2025 09:27:36 +0000 (10:27 +0100)]
test2405: split off H2 tests to new test 2407, fix callback prototype
To untangle the different curl/server requirements of these tests.
Also to make this test run for non-H2 builds. Searching the cause of
the flakiness documented in #19481.
Also:
- fix the callback function prototype. Detected by ASAN with this patch,
though the issue was pre-existing.
```
lib/cw-out.c:211:14: runtime error: call to function emptyWriteFunc
through pointer to incorrect function type
'unsigned long (*)(char *, unsigned long, unsigned long, void *)'
tests/libtest/lib2405.c:72: note: emptyWriteFunc defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior lib/cw-out.c:211:14
```
Ref: https://github.com/curl/curl/actions/runs/19296686908/job/55180334364?pr=19487#step:44:3768
Viktor Szakats [Wed, 12 Nov 2025 09:17:48 +0000 (10:17 +0100)]
test2405: report `fd_count*` variables on failure
This test is frequently failing in macOS !ssl jobs:
"curl_multi_waitfds() should return at least the number of fds needed":
https://github.com/curl/curl/actions/runs/19290229745/job/55159015942 AM clang !ssl !debug brotli zstd
https://github.com/curl/curl/actions/runs/19289578332/job/55157058146 AM clang !ssl !debug brotli zstd
https://github.com/curl/curl/actions/runs/19188515879/job/54859474947 AM clang !ssl
https://github.com/curl/curl/actions/runs/19165077858/job/54783776869 AM clang !ssl libssh2 AppleIDN
https://github.com/curl/curl/actions/runs/19046554157/job/54396096298 AM gcc-12 !ssl !debug
"curl_multi_waitfds() should return the amount of fds needed if enough isn't passed in":
https://github.com/curl/curl/actions/runs/19184546172/job/54848549080 AM gcc-13 !ssl !debug
Also high on the test clutch list:
2405 FAIL times: 165
Ref: https://testclutch.curl.se/static/reports/results-count.html
Viktor Szakats [Tue, 11 Nov 2025 16:43:06 +0000 (17:43 +0100)]
badwords: re-sync with curl-www, fix issues found
Also:
- replace `manpage` with `man page`, add to `badwords.txt`.
- badwords.pl: import `-w` feature from curl-www, syncing the two
scripts fully.
- badwords.txt: import missing items from curl-www, syncing the two
files fully.
- pyspelling.words: drop `cURL` allowed word.
Daniel Stenberg [Tue, 11 Nov 2025 13:39:20 +0000 (14:39 +0100)]
ftp: remove #ifdef for define that is always defined
The CURL_FTP_HTTPSTYLE_HEAD logic was added back in 2007 with the
intention to remove that logic one day, but since we never bump the
SONAME it is not likely to happen anytime soon. Remove again for
readability.
projects / thirdparty / curl.git / log
