]> git.ipfire.org Git - thirdparty/curl.git/log
thirdparty/curl.git
5 months agolib: silence LibreSSL collision warning on non-MSVC Windows
Viktor Szakats [Sun, 9 Feb 2025 01:35:07 +0000 (02:35 +0100)] 
lib: silence LibreSSL collision warning on non-MSVC Windows

LibreSSL headers emit this warning because we included `wincrypt.h`
before them. We have to include `wincrypt.h` before OpenSSL headers
to avoid symbol collisions when using other forks. LibreSSL 3.8.2+
offers a macro to silence its warnings to avoid this issue. This patch
sets it.

This allows to stop setting this macro in curl-for-win builds.

Warnings seen with MinGW with cmake non-unity (also unity batch=30):
```
[156/219] Building C object lib/CMakeFiles/libcurl_object.dir/vtls/openssl.c.obj
In file included from lib/vtls/openssl.h:35,
                 from lib/vtls/openssl.c:53:
dep/libressl-win-x64/include/openssl/ossl_typ.h:90:2: warning: #warning overriding WinCrypt defines [-Wcpp]
   90 | #warning overriding WinCrypt defines
      |  ^~~~~~~
In file included from dep/libressl-win-x64/include/openssl/pem.h:71,
                 from dep/libressl-win-x64/include/openssl/ssl.h:151,
                 from lib/vtls/openssl.h:36:
dep/libressl-win-x64/include/openssl/x509.h:108:2: warning: #warning overriding WinCrypt defines [-Wcpp]
  108 | #warning overriding WinCrypt defines
      |  ^~~~~~~
In file included from dep/libressl-win-x64/include/openssl/x509.h:319:
dep/libressl-win-x64/include/openssl/pkcs7.h:77:2: warning: #warning overriding WinCrypt defines [-Wcpp]
   77 | #warning overriding WinCrypt defines
      |  ^~~~~~~
```

Ref: https://github.com/libressl/portable/issues/910
Ref: https://github.com/libressl/portable/pull/924
Ref: https://github.com/libressl/portable/commit/e7fe6caab2869a043514c297ce04e6995a65d79f
Ref: https://github.com/curl/curl-for-win/commit/760ccfcc9114dbb6d79710a5582323be0f152c9e

Closes #16273

5 months agoasyn-thread: survive a c-ares channel set to NULL
Daniel Stenberg [Fri, 7 Feb 2025 15:40:53 +0000 (16:40 +0100)] 
asyn-thread: survive a c-ares channel set to NULL

When the c-ares setup fails and we get a NULL channel, the resolve still
continues and we just need to survive it and just not get any HTTPS RR.

Reported-by: nono303 on github
Fixes #16216
Closes #16244

5 months agoGHA/appveyor: tidy up quotes
Viktor Szakats [Sun, 9 Feb 2025 02:04:02 +0000 (03:04 +0100)] 
GHA/appveyor: tidy up quotes

5 months agoGHA/windows: bump dl-mingw tests to `-j8`
Viktor Szakats [Sat, 8 Feb 2025 23:01:32 +0000 (00:01 +0100)] 
GHA/windows: bump dl-mingw tests to `-j8`

To match the rest of Windows jobs.

dl-mingw, CM 9.5.0-x86_64 schannel: 4m24s -> 2m56s
dl-mingw, CM 7.3.0-x86_64 schannel U: 4m37s -> 3m10s
(based on a few runs.)

Closes #16271

5 months agodocs: use valid example domain names
Terence Eden [Sat, 8 Feb 2025 22:20:30 +0000 (22:20 +0000)] 
docs: use valid example domain names

Replace .site domains and domain.com with valid example domains.

Fixes #16269
Closes #16270

5 months agoGHA/windows: restore runtests perf with last known good Git for Windows
Viktor Szakats [Sat, 8 Feb 2025 12:51:59 +0000 (13:51 +0100)] 
GHA/windows: restore runtests perf with last known good Git for Windows

Use the last known good release of Git for Windows by installing it
manually. It restores `runtests.pl` performance to the levels before
the October 2024 and this week's fallouts which gradually deployed
MSYS2 runtimes with pipe/signal/concurrency issues.

Also:
- restore vcpkg job's test parallelism to `-j8` (from `-j4`).
- keep using the default shell for jobs not running tests.
  To avoid the unnecessary Git for Windows install overhead.

Upsides:
- good performance again.
- easy to experiment with any version.

Downsides:
- installing the Git for Windows package takes 15-30 seconds.
- we're pinned to an old package version.
- no canary to tell when the issue is fixed on the runner images.

Unknown:
- stability. (no MSYS2 runtimes were ever stable and it's difficult
  to quantify if a version improves or worsens stability/flakiness, and
  intermittent env failures.

Follow-up to 1bf774df57e873d08f0c6e525e6ec3a0f6e62bce #16217
Follow-up to 5f9411f953f35ca84645b5a6824fb9fef20887ed #15380

Closes #16265

5 months agolibssh2: comparison is always true because rc <= -1
Daniel Stenberg [Sat, 8 Feb 2025 21:47:50 +0000 (22:47 +0100)] 
libssh2: comparison is always true because rc <= -1

Pointed out by CodeQL

Closes #16268

5 months agoGHA/http3-linux: fix quictls cache key mismatch
Viktor Szakats [Sat, 8 Feb 2025 17:26:04 +0000 (18:26 +0100)] 
GHA/http3-linux: fix quictls cache key mismatch

Closes #16266

5 months agolib3208: add a final easy_perform as well
Daniel Stenberg [Sat, 8 Feb 2025 11:49:15 +0000 (12:49 +0100)] 
lib3208: add a final easy_perform as well

Make the test also verify using the handle in the other order.

Closes #16262

5 months agovtsl: eliminate 'data->state.ssl_scache'
Stefan Eissing [Sat, 8 Feb 2025 11:49:34 +0000 (12:49 +0100)] 
vtsl: eliminate 'data->state.ssl_scache'

Keeping the relevant 'ssl_scache' in 'data->state' leads to problems
when the owner of the cache is cleaned up and this reference is left
dangling.

Remove the ref entirely and always find the ssl_scache at the current
share or multi.

Folded in #16260 (test 3208) to verify this fixes the bug with a
dangling reference when an easy handle is used with easy_perform first
and in a multi_perform after.

Ref: #16236
Closes #16261

5 months agovtls: fix multissl-init
Daniel Stenberg [Sat, 8 Feb 2025 09:45:31 +0000 (10:45 +0100)] 
vtls: fix multissl-init

Regression since and follow-up to 2bf48b48b3e564bcbf3249.

Don't call init functions set to NULL.

Fixes #16253
Reported-by: thisisgk on github
Closes #16258

5 months agoRELEASE-NOTES: synced
Daniel Stenberg [Sat, 8 Feb 2025 09:53:00 +0000 (10:53 +0100)] 
RELEASE-NOTES: synced

5 months agorelease-notes.pl: manage more "closes" typos
Daniel Stenberg [Sat, 8 Feb 2025 09:51:27 +0000 (10:51 +0100)] 
release-notes.pl: manage more "closes" typos

5 months agoCURLSHOPT_SHARE.md: adjust for the new SSL session cache
Michael Kaufmann [Fri, 7 Feb 2025 16:20:44 +0000 (17:20 +0100)] 
CURLSHOPT_SHARE.md: adjust for the new SSL session cache

curl 8.12.0 introduced an improved SSL session cache. All easy handles
that are added to the same multi handle automatically use the multi
handle's SSL session cache.

Clsoes #16245

5 months agoopenssl: fix out of scope variables in goto
Daniel Stenberg [Fri, 7 Feb 2025 22:34:49 +0000 (23:34 +0100)] 
openssl: fix out of scope variables in goto

Some of the 'goto fail' situations could happen without having
initialized the local variables referenced in the error code flow.

Reported-by: Marcel Raad
Fixes #16246
Closes #16251

5 months agogenerate.bat: remove curl_get_line.c from the curlx file list
Jay Satiro [Fri, 7 Feb 2025 18:08:45 +0000 (13:08 -0500)] 
generate.bat: remove curl_get_line.c from the curlx file list

Follow-up to d8618f4d which did the same for the other build systems.

Closes https://github.com/curl/curl/pull/16248

5 months agoscache: add magic checks
Stefan Eissing [Fri, 7 Feb 2025 13:57:50 +0000 (14:57 +0100)] 
scache: add magic checks

DEBUGASSERT for debug builds, otherwise log failure and return error
code where possible.

Closes #16240

5 months agocmake: save a line with `CMAKE_C_IMPLICIT_LINK_DIRECTORIES` exclusion
Viktor Szakats [Fri, 7 Feb 2025 11:04:16 +0000 (12:04 +0100)] 
cmake: save a line with `CMAKE_C_IMPLICIT_LINK_DIRECTORIES` exclusion

Also mind the quotes:
https://github.com/curl/curl/pull/16233#issuecomment-2642603412

Follow-up to f72b84809216657e4ad3c1a0184775c911080d63 #16233
Closes #16243

5 months agocmake: respect `GNUTLS_CFLAGS` when detected via `pkg-config`
Viktor Szakats [Fri, 7 Feb 2025 12:15:57 +0000 (13:15 +0100)] 
cmake: respect `GNUTLS_CFLAGS` when detected via `pkg-config`

Closes #16242

5 months agowakeup_write: make sure the eventfd write sends eight bytes
Daniel Stenberg [Fri, 7 Feb 2025 13:57:36 +0000 (14:57 +0100)] 
wakeup_write: make sure the eventfd write sends eight bytes

The eventfd manpage says:

  A write(2) fails with the error EINVAL if the size of the supplied
  buffer is less than 8 bytes

When doing x32 on a 64-bit system, pointers are still four bytes so this
code must not use the size of a pointer but the size of a 64-bit type.

Fixes #16237
Reported-by: Jan Engelhardt
Closes #16239

5 months agoasyn-thread: fix build with `CURL_DISABLE_SOCKETPAIR`
Marcel Raad [Wed, 5 Feb 2025 09:46:30 +0000 (10:46 +0100)] 
asyn-thread: fix build with `CURL_DISABLE_SOCKETPAIR`

With `CURL_DISABLE_SOCKETPAIR` defined and `USE_HTTPSRR_ARES`
undefined, the local variable `socketi` was unused.

This fixes a regression from commit 0d4fdbf15d8.

Closes https://github.com/curl/curl/pull/16179

5 months agotidy-up: make per-file `ARRAYSIZE` macros global as `CURL_ARRAYSIZE`
Viktor Szakats [Tue, 28 Jan 2025 11:09:55 +0000 (12:09 +0100)] 
tidy-up: make per-file `ARRAYSIZE` macros global as `CURL_ARRAYSIZE`

Closes #16111

5 months agoRELEASE-NOTES: synced
Daniel Stenberg [Fri, 7 Feb 2025 12:34:26 +0000 (13:34 +0100)] 
RELEASE-NOTES: synced

5 months agoopenssl-quic: ignore ciphers for h3
Stefan Eissing [Fri, 7 Feb 2025 10:03:18 +0000 (11:03 +0100)] 
openssl-quic: ignore ciphers for h3

OpenSSL QUIC method errors on setting TLSv1.2 ciphers, where other
methods do not.

Refrain setting --ciphers when min TLS version is 1.3 or higher.
Refrain setting --tls13-ciphers when max TLS version is less than 1.3.
Add 2 test cases.

Fixes #16232
Reported-by: zzq1015 on github
Closes #16235

5 months agocmake: avoid unnecessary `-L` for implicit link dirs
Kai Pastor [Fri, 7 Feb 2025 06:54:43 +0000 (07:54 +0100)] 
cmake: avoid unnecessary `-L` for implicit link dirs

The unnecessary `-L` may unexpectedly change the toolchain's chosen
search order in implicit link directories.

Causing this error noticed by a vcpkg user, and reproduced, in the
context of Android NDK r22b, API level 16, static library and CRT
linkage:
~~~
configure:23635: checking whether libcurl is usable
configure:23669: armv7a-linux-androideabi16-clang -o conftest
  --sysroot=/home/runner/work/boinc/boinc/3rdParty/android/android-ndk-r22b/toolchains/llvm/prebuilt/linux-x86_64/sysroot
  -DANDROID -DDECLARE_TIMEZONE -Wall
  -I/home/runner/work/boinc/boinc/3rdParty/buildCache/android/android-tc/arm/arm-linux-androideabi/include
  -O3 -fomit-frame-pointer -fPIE -march=armv7-a -mfloat-abi=softfp -mfpu=vfpv3-d16 -D__ANDROID_API__=16 -Wall
  -I/home/runner/work/boinc/boinc/3rdParty/android/vcpkg/installed/arm-android/include
  -I/home/runner/work/boinc/boinc/3rdParty/android/vcpkg/installed/arm-android/lib/pkgconfig/../../include -DCURL_STATICLIB
  -L/home/runner/work/boinc/boinc/3rdParty/android/vcpkg/installed/arm-android/lib -llog -fPIE -pie -latomic -static-libstdc++
  -march=armv7-a -Wl,--fix-cortex-a8 -L/home/runner/work/boinc/boinc/3rdParty/android/vcpkg/installed/arm-android/lib conftest.c
  -L/home/runner/work/boinc/boinc/3rdParty/android/vcpkg/installed/arm-android/lib/pkgconfig/../../lib -lcurl
  -L/home/runner/work/boinc/boinc/3rdParty/android/android-ndk-r22b/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/arm-linux-androideabi
  -lssl -lcrypto -ldl -pthread -lz  >&5
clang: warning: argument unused during compilation: '-static-libstdc++' [-Wunused-command-line-argument]
ld: error: undefined symbol: bsd_signal
>>> referenced by legacy_signal_inlines.h:116 (/home/runner/work/boinc/boinc/3rdParty/android/android-ndk-r22b/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/include/android/legacy_signal_inlines.h:116)
>>>               libcrypto-lib-ui_openssl.o:(read_string_inner) in archive /home/runner/work/boinc/boinc/3rdParty/android/vcpkg/installed/arm-android/lib/libcrypto.a
ld: error: undefined symbol: pthread_atfork
~~~
with the unnecessary option
~~~
-L/home/runner/work/boinc/boinc/3rdParty/android/android-ndk-r22b/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/arm-linux-androideabi
~~~
Reference: https://github.com/microsoft/vcpkg/pull/43463#issuecomment-2638611717

Closes #16233

5 months agoGHA/appveyor: add VS2019 job, merge two others, fix build fallout
Viktor Szakats [Fri, 7 Feb 2025 01:53:15 +0000 (02:53 +0100)] 
GHA/appveyor: add VS2019 job, merge two others, fix build fallout

- add VS2019 job, with Schannel + OpenSSL 1.0.2.
  First MultiSSL job here and add the last missing modern VS version.

- fix builds with mixed ALPN capabilities in MultiSSL unity builds.
  Caused by reusing `HAS_ALPN` between TLS modules without
  resetting it. Fix it by using unique names for each backend.

- merge a VS2010 job into a VS2012. With MultiSSL and x86 OpenSSL.

- make a job static.

- fix `Shared`/`Static` in a job name.

- add `Shared` to job names.

Closes #16231

5 months agowolfssl: silence compiler warning (MSVC 2019), simplify existing
Viktor Szakats [Fri, 7 Feb 2025 00:48:24 +0000 (01:48 +0100)] 
wolfssl: silence compiler warning (MSVC 2019), simplify existing

Seen with VS2019 and older versions:
```
lib\vtls\wolfssl.c(773): warning C4706: assignment within conditional expression
```
Ref: https://github.com/curl/curl/actions/runs/13190321645/job/36821938202?pr=16217#step:9:30

Also replace pragma suppression with this simpler method, and silence
`checksrc` where it complains about the extra ` != NULL` this needs.

Closes #16230

5 months agoimap: TLS upgrade fix
Stefan Eissing [Thu, 6 Feb 2025 12:45:01 +0000 (13:45 +0100)] 
imap: TLS upgrade fix

There were two places in the code that tried to connect the SSL filter,
e.g. do the TLS handshake, but only one changed imap state to CAPA
afterwards.

Depending on timing, the wrong path was taken and the connection was
hanging, waiting for a server reply to a command not sent.

Do the upgrade to tls in one place and update connection filter and
smtps protocol handler at the same time. Always transition to CAPA on
success.

Closes #16213

5 months agopop3: TLS upgrade fix
Stefan Eissing [Thu, 6 Feb 2025 12:31:10 +0000 (13:31 +0100)] 
pop3: TLS upgrade fix

There were two places in the code that tried to connect the SSL filter,
e.g. do the TLS handshake, but only one changed pop3 state to CAPA
afterwards.

Depending on timing, the wrong path was taken and the connection was
hanging, waiting for a server reply to a command not sent.

Do the upgrade to tls in one place and update connection filter and
smtps protocol handler at the same time. Always transition to CAPA on
success.

Ref: #16166
Closes #16208

5 months agosmtp: TLS upgrade fix
Stefan Eissing [Thu, 6 Feb 2025 11:08:44 +0000 (12:08 +0100)] 
smtp: TLS upgrade fix

There were two places in the code that tried to connect the SSL filter,
e.g. do the TLS handshake, but only one changed stmp state to EHLO
afterwards.

Depending on timing, the wrong path was taken and the connection was
hanging, waiting for a server reply to a command not sent.

Do the upgrade to tls in one place and update connection filter and
smtps protocol handler at the same time. Always transition to EHLO on
success.

Fixes #16189
Reported-by: Christian Schmitz
Closes #16206

5 months agotool_cfgable: sort struct fields by size, use bitfields for booleans
Daniel Stenberg [Thu, 6 Feb 2025 10:59:04 +0000 (11:59 +0100)] 
tool_cfgable: sort struct fields by size, use bitfields for booleans

Shrunk struct OperationConfig and struct GlobalConfig by several hundred
bytes combined. No loss of functionality.

Closes #16211

5 months agoasyn-thread: fix the returned bitmask from Curl_resolver_getsock
Daniel Stenberg [Thu, 6 Feb 2025 22:01:55 +0000 (23:01 +0100)] 
asyn-thread: fix the returned bitmask from Curl_resolver_getsock

It should use a bitwise OR, not an assignment so that it does not
override the c-ares bits.

Closes #16227

5 months agoconfigure/cmake: check for realpath
Daniel Stenberg [Thu, 6 Feb 2025 21:35:09 +0000 (22:35 +0100)] 
configure/cmake: check for realpath

And make vtls_scache use HAVE_REALPATH

Fixes #16209
Reported-by: Andrew Kirillov
Closes #16225

5 months agoGHA/windows: mitigate drastic runtests perf drop under MSYS2
Viktor Szakats [Thu, 6 Feb 2025 23:46:35 +0000 (00:46 +0100)] 
GHA/windows: mitigate drastic runtests perf drop under MSYS2

Today GHA Windows runner images (all versions) deployed an upgrade
(20250127.1.0 -> 20250203.1.0) that upgraded the default MSYS2, which
now seems to feature the October 2024 issue that caused curl runtests
run times increasing ~2.5x. It also causes test987 to fail, and vcpkg
jobs hitting their time limits and fail. Reliability also got a hit.

In October this issue came with a Git for Windows upgrade, and likely
the MSYS2 runtime update within it. It affected vcpkg jobs only, and
I mitigated it by switching them to use the default MSYS2 shell and
runtime (at `C:\msys64`):

5f9411f953f35ca84645b5a6824fb9fef20887ed #15380

After today's update this mitigation no longer works. The issue also
affects `dl-mingw` jobs now, though to a lesser extent than vcpkg ones.

Tried switching back to Git for Windows which received several updates
since October, but the performance issue is still present.

I managed to mitigate the slowdown in vcpkg by lowering test parallelism
to `-j4` (from `-j8`), after which the jobs are about *half the speed*
than before, and fit their time limits. `dl-mingw` builds run slower by
1-1.5 minutes per job, they were already using `-j4`.

Example jobs:

Before (ALL GOOD):
https://github.com/curl/curl/actions/runs/13167230443/job/36750175428 installed MSYS2, mingw (-j8): 3m50s (OK)
https://github.com/curl/curl/actions/runs/13167230443/job/36750158662 default MSYS2, dl-mingw (-j4): 4m22s (OK)
https://github.com/curl/curl/actions/runs/13167230443/job/36750163392 default MSYS2, vcpkg (-j8): 3m27s (OK)
runner: https://github.com/actions/runner-images/blob/win22/20250127.1/images/windows/Windows2022-Readme.md
C:\msys64:
System: MSYS_NT-10.0-20348 fv-az1115-916 3.5.4-0bc1222b.x86_64 2024-12-05 09:27 UTC x86_64 Msys
https://github.com/msys2/msys2-runtime/commit/0bc1222b

After:
https://github.com/curl/curl/actions/runs/13186498273/job/36809747078 installed MSYS2, mingw (-j8): 3m48s (OK)
https://github.com/curl/curl/actions/runs/13186498273/job/36809728481 default MSYS2, dl-mingw (-j4): 5m56s (SLOW)
https://github.com/curl/curl/actions/runs/13186498273/job/36809736429 default MSYS2, vcpkg (-j8): 9m1s (SLOW)
runner: https://github.com/actions/runner-images/blob/win22/20250203.1/images/windows/Windows2022-Readme.md
C:\msys64:
System: MSYS_NT-10.0-20348 fv-az1115-498 3.5.7-2644508f.x86_64 2025-01-30 09:08 UTC x86_64 Msys
https://github.com/msys2/msys2-runtime/commit/2644508f

windows-2025 image:
C:\msys64:
System: MSYS_NT-10.0-26100 fv-az2043-515 3.5.7-2644508f.x86_64 2025-01-30 09:08 UTC x86_64 Msys

windows-2019 image:
C:\msys64:
System: MSYS_NT-10.0-17763 fv-az1434-677 3.5.7-2644508f.x86_64 2025-01-30 09:08 UTC x86_64 Msys

This PR:
final: https://github.com/curl/curl/actions/runs/13186498273/job/36809736429 GfW, vcpkg (*-j4*): ~7m (SLOW)
test: https://github.com/curl/curl/actions/runs/13187992987/job/36814644852?pr=16217, GfW, vcpkg (-j8): ~11m (SLOWER)

Before and after (unused) Git for Windows (SLOW as tested in this PR):
C:\Program Files\Git
System: MINGW64_NT-10.0-20348 fv-az1760-186 3.5.4-395fda67.x86_64 2024-11-25 09:49 UTC x86_64 Msys
https://github.com/msys2/msys2-runtime/commit/395fda67 (fork)

Before and after (used) MSYS2 installed via msys2/setup-msys2 (OK):
D:\a\_temp\msys64
System: MINGW64_NT-10.0-20348 fv-az836-378 3.5.4-0bc1222b.x86_64 2024-12-05 09:27 UTC x86_64 Msys

Perl pipe issue report from October, still open:
https://github.com/msys2/msys2-runtime/issues/230
ARM deadlock fixed by GfW 2.47.1(1), but for x86_64, on a quick glance:
https://github.com/msys2/msys2-runtime/commit/290bea94d0d5c632c016f916a7b123a260fc02a8
Possibly interesting:
https://github.com/msys2/msys2-autobuild/issues/62

Closes #16217

5 months agocmake: add integration tests, run them in CI
Viktor Szakats [Wed, 29 Jan 2025 13:18:35 +0000 (14:18 +0100)] 
cmake: add integration tests, run them in CI

Add CMake test project consuming curl via these methods:
`FetchContent`, `add_subdirectory()`, `find_package()`.

Also:
- GHA/distcheck: run these tests in CI.
- cmakelint: exclude a warning for calling "wonky-cased" built-in
  CMake functions, such as `FetchContent_Declare()`.

Closes #16126

5 months agocmake/Find: set `<Modulename>_FOUND` for compatibility when found via `pkg-config`
Viktor Szakats [Sun, 2 Feb 2025 13:45:21 +0000 (14:45 +0100)] 
cmake/Find: set `<Modulename>_FOUND` for compatibility when found via `pkg-config`

For Find modules where `<Modulename>` is not fully uppercase.

`<Modulename>` is case-exact name used in the Find modules filename:
`CMake/Find<Moduleame>.cmake`.

`find_package_handle_standard_args()` sets both `<MODULENAME>_FOUND` and
`<Modulename>_FOUND` when detecting the dependency. Some CMake code
relies on this and 3rd-party code may rely on it too. Make sure to set
the latter variant when detecting the dependency via `pkg-config`, where
we don't call `find_package_handle_standard_args()`.

CMake sets these variable to `TRUE` (not `ON` or `1`). Replicate this
for compatibility.

Closes #16153

5 months agocmake: drop `LDAP_DEPRECATED=1` macro, to sync with autotools
Viktor Szakats [Sat, 1 Feb 2025 11:55:47 +0000 (12:55 +0100)] 
cmake: drop `LDAP_DEPRECATED=1` macro, to sync with autotools

We set this macro to silence a warning inside `openldap.h`. With this
warning now silenced by using `-isystem`, we can drop it. Also it never
had to be set to `1`.

Also enable OpenLDAP in a CMake GHA/macos job.

Follow-up to 445fb81237342ff1ec177a61241a53778570526f #14763
Follow-up to 751e168d93b4a58f3fbbe2908c0041ae2f934329 #12024

Closes #16146

5 months agocmake: always reference OpenSSL and ZLIB via imported targets
Viktor Szakats [Thu, 6 Feb 2025 01:50:09 +0000 (02:50 +0100)] 
cmake: always reference OpenSSL and ZLIB via imported targets

Some places where still referencing them via global variables.

Closes #16207

5 months agoldap: drop support for legacy Novell LDAP SDK
Viktor Szakats [Wed, 5 Feb 2025 00:29:08 +0000 (01:29 +0100)] 
ldap: drop support for legacy Novell LDAP SDK

The latest copy I could find at:
https://beta.novell.com/developer/ndk/ldap_libraries_for_c.html
is from 2016-Feb-03, available for Linux and Windows.

I built curl against the Windows package with CMake:
https://sdk.suse.com/ndk/cldap/builds/2016/openldapsdk-devel-windows64-2016-01-28.zip
(It comes with OpenSSL 1.0.1q-fips (2015-Dec-03) binaries.)
CMake identified it as OpenLDAP and built with it as expected:
```
curl 8.12.0-DEV (x86_64-w64-mingw32) libcurl/8.12.0-DEV Schannel OpenLDAP/2.4.37
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IPv6 Kerberos Largefile NTLM SPNEGO SSL SSPI threadsafe UnixSockets
```

Since it identified it as OpenLDAP (`lib/openldap.c`), the branch
deleted in this PR (`lib/ldap.c`) wasn't reached. Thus, defining
the `CURL_HAS_NOVELL_LDAPSDK` also made no difference in the build.
This suggests the code guarded by it is now orphan and unnecessary.

Novell NetWare builds were another user, but we dropped support for them
in 2022: 3b16575ae938dec2a29454631a12aa52b6ab9c67 #8358

Closes #16176

5 months agoGHA/curl-for-win: drop `nolibgroup` option, upstream default now
Viktor Szakats [Thu, 6 Feb 2025 22:42:51 +0000 (23:42 +0100)] 
GHA/curl-for-win: drop `nolibgroup` option, upstream default now

Ref: https://github.com/curl/curl-for-win/commit/2ed700e687fec09cd02241af3f1068849480fc16

5 months agocmake: lib order fixes for picky linkers (e.g. binutils `ld`)
Viktor Szakats [Wed, 5 Feb 2025 12:17:52 +0000 (13:17 +0100)] 
cmake: lib order fixes for picky linkers (e.g. binutils `ld`)

This issue was not addressed with CMake builds so far. curl-for-win
worked thanks to its `-Wl,--start-group` workaround. It affects
binutils `ld` linking statically. Shared linking and llvm's `lld`
doesn't need strict lib order, and are not affected.

The solution is to pass libs in dependency order, with least dependent
(e.g. system) libs last. In case of cyclic dependency, may pass libs
twice.

Fix most issues by moving Windows system libs `ws2_32` and `bcrypt`
last, and move SSH libs first due to their dependence on crypto
backends and zlib compression.

Also:
- modify an existing Linux curl-for-win job to use gcc.
- add a specific Windows gcc job to test this. Make it use different
  options than the default to extend build coverage too: `libssh`,
  `zlib-ng`, 32-bit.
- prefer CMake imported targets for OpenSSL and ZLIB.

Examples of issues fixed:

Windows LibreSSL, libpsl vs. ws2_32:
```
x86_64-w64-mingw32-ld: curl/libressl/lib/libcrypto.a(bss_sock.c.obj):bss_sock.c:(.text$sock_ctrl[sock_ctrl]+0x59): undefined reference to `__imp_shutdown'
x86_64-w64-mingw32-ld: curl/libressl/lib/libcrypto.a(gcm128.c.obj):gcm128.c:(.text$CRYPTO_gcm128_init[CRYPTO_gcm128_init]+0x65): undefined reference to `__imp_ntohl'
x86_64-w64-mingw32-ld: curl/libpsl/_x64-win-ucrt/usr/lib/libpsl.a(psl.o):(.text$psl_is_cookie_domain_acceptable+0xef): undefined reference to `__imp_WSAStringToAddressW'
```
Ref: https://github.com/curl/curl/actions/runs/13157579253/job/36718144881?pr=16182#step:3:5354

Linux libssh2 vs. zlib:
```
/usr/lib/gcc-cross/aarch64-linux-gnu/12/../../../../aarch64-linux-gnu/bin/ld: curl/libssh2/_a64-linux-gnu-libressl/usr/lib/libssh2.a(unity_0_c.c.o): in function `comp_method_zlib_dtor':
(.text.comp_method_zlib_dtor+0x8c): undefined reference to `deflateEnd'
/usr/lib/gcc-cross/aarch64-linux-gnu/12/../../../../aarch64-linux-gnu/bin/ld: curl/libssh2/_a64-linux-gnu-libressl/usr/lib/libssh2.a(unity_0_c.c.o): in function `comp_method_zlib_comp':
(.text.comp_method_zlib_comp+0x50): undefined reference to `deflate'
/usr/lib/gcc-cross/aarch64-linux-gnu/12/../../../../aarch64-linux-gnu/bin/ld: curl/libssh2/_a64-linux-gnu-libressl/usr/lib/libssh2.a(unity_0_c.c.o): in function `comp_method_zlib_init':
(.text.comp_method_zlib_init+0x8c): undefined reference to `deflateInit_'
```
Ref: https://github.com/curl/curl/actions/runs/13157270420/job/36717189086?pr=16182#step:3:5285

Windows libssh vs. ws2_32 and LibreSSL:
```
/usr/bin/i686-w64-mingw32-ld: curl/libssh/_x86-win-ucrt-libressl/usr/lib/libssh.a(connect.c.obj):(.text$ssh_connect_host_nonblocking+0x92): undefined reference to `WspiapiGetAddrInfo@16'
/usr/bin/i686-w64-mingw32-ld: curl/libssh/_x86-win-ucrt-libressl/usr/lib/libssh.a(connect.c.obj):(.text$ssh_connect_host_nonblocking+0x3d9): undefined reference to `gai_strerrorA'
/usr/bin/i686-w64-mingw32-ld: curl/libssh/_x86-win-ucrt-libressl/usr/lib/libssh.a(kex.c.obj):(.text$ssh_client_select_hostkeys+0xd2): undefined reference to `FIPS_mode'
/usr/bin/i686-w64-mingw32-ld: curl/libssh/_x86-win-ucrt-libressl/usr/lib/libssh.a(options.c.obj):(.text$ssh_options_set+0x942): undefined reference to `FIPS_mode'
```
Ref: https://github.com/curl/curl/actions/runs/13163986294/job/36739557888?pr=16182#step:3:5127
Ref: https://github.com/curl/curl/actions/runs/13163986294/job/36739557888?pr=16182#step:3:5121

Closes #16182

5 months agocmake: initialize variables where missing
Viktor Szakats [Thu, 6 Feb 2025 00:22:22 +0000 (01:22 +0100)] 
cmake: initialize variables where missing

As detected using `cmake --warn-uninitialized`.

It also lists:
- variables inherited from `Makefile.inc`, which this PR does not fix.

- a documented CMake global variable, which is unexpected:
  `CMAKE_MODULE_PATH`.
  I'd expect CMake to initialize its namespace.

- envs: `CI`, `CURL_CI` and `CURL_BUILDINFO`. Unexpected, as the manual
  mentions variables only. As of August 2024, there is no solution to
  silence them:
  https://discourse.cmake.org/t/how-to-test-for-set-env-variables-without-getting-warnings/11401

https://cmake.org/cmake/help/latest/manual/cmake.1.html#cmdoption-cmake-warn-uninitialized

Closes #16198

5 months agocmake: tidy up string append and list prepend syntax
Viktor Szakats [Sat, 1 Feb 2025 11:31:13 +0000 (12:31 +0100)] 
cmake: tidy up string append and list prepend syntax

- `set(VAR "${VAR}<value>")` ->
  `string(APPEND VAR "<value>")`
  Available since CMake 3.4:
  https://cmake.org/cmake/help/latest/command/string.html#append

- `set(VAR "${VAR2}-or-<value>;${VAR}")` ->
  `set(VAR "${VAR2}-or-<value>" ${VAR})`

Closes #16144

5 months agoruntests: fix the disabling of the memory tracking
Daniel Stenberg [Thu, 6 Feb 2025 21:51:56 +0000 (22:51 +0100)] 
runtests: fix the disabling of the memory tracking

It should be done if "threaded-resolver" is enabled, but the detection
was slightly broken for builds that add c-ares for the asyn-rr feature.

Closes #16226

5 months agocmake: normalize before matching paths with syspaths
Viktor Szakats [Wed, 5 Feb 2025 17:32:18 +0000 (18:32 +0100)] 
cmake: normalize before matching paths with syspaths

Requires CMake 3.20:
https://cmake.org/cmake/help/latest/command/cmake_path.html

Co-authored-by: Kai Pastor
Ref: https://github.com/microsoft/vcpkg/pull/43463/commits/307e1f98786540b919536e1e6a301e2d6c60516e
Closes #16191

5 months agoCI: update dependency awslabs/aws-lc to v1.45.0
renovate[bot] [Thu, 6 Feb 2025 03:57:48 +0000 (03:57 +0000)] 
CI: update dependency awslabs/aws-lc to v1.45.0

Closes #16151

5 months agoGHA/linux: drop `sudo sysctl vm.mmap_rnd_bits=28`
Philip H. [Thu, 6 Feb 2025 20:13:35 +0000 (21:13 +0100)] 
GHA/linux: drop `sudo sysctl vm.mmap_rnd_bits=28`

useless on ubuntu-24.04 (ubuntu-latest)
as it uses read-only fs

Closes #16224

5 months agolibssh: drop support for libssh older than 0.9.0
Daniel Stenberg [Thu, 6 Feb 2025 07:16:35 +0000 (08:16 +0100)] 
libssh: drop support for libssh older than 0.9.0

libssh 0.9.0 was shipped on June 28 2019 and is the first version
featuring the knownhosts API

Drop libssh from the GHA/linux-old CI job since it gets a libssh 0.7.3
version, too old for us now.

Closes #16200

5 months agotest2080: simplify, avoid the null byte
Daniel Stenberg [Thu, 6 Feb 2025 13:09:41 +0000 (14:09 +0100)] 
test2080: simplify, avoid the null byte

The null byte was not necessary for the test

5 months agotool_ssls: switch to tool-specific get_line function
Daniel Stenberg [Thu, 6 Feb 2025 09:51:01 +0000 (10:51 +0100)] 
tool_ssls: switch to tool-specific get_line function

Instead of picky-backing on the libcurl one using the curlx shortcut,
which is fragile since the libcurl one is not present in all builds.

Reported-by: mschroeder-fzj on github
Fixes #16201
Closes #16203

5 months agoruntests: quote commands to support paths with spaces
Viktor Szakats [Thu, 6 Feb 2025 15:33:31 +0000 (16:33 +0100)] 
runtests: quote commands to support paths with spaces

In certain Windows configurations, Perl resides under `C:/Program Files`
causing tests to fail when executing Perl. Fix by quoting the command.

Seen in `dl-mingw` jobs when switching to the default `bash` shell
offered by the `windows-latest` runner on GHA.

Also:
- apply the same fix for `valgrind` for consistency.
- make more use of `shell_quote()` when passing the `srcdir` directory
  over the command-line. This doesn't come up in CI, but seems like
  good practice. There are lots more unquoted arguments and possibly
  also commands.

```
-------e--- OK (940 out of 1537, remaining: 00:32, took 0.217s, duration: 00:50)
test 1167...[Verify curl prefix of public symbols in header files]
/C/Program Files/Git/usr/bin/perl -I. -ID:/a/curl/curl/tests  returned 127, when expecting 0
 1167: exit FAILED
[...]
=== Start of file stderr1167
 sh: line 1: /C/Program: No such file or directory
```
Ref: https://github.com/curl/curl/actions/runs/13181757313/job/36794072190?pr=16217#step:13:2107

Closes #16220

5 months agotest1516: avoid failure due to spaces in path
Viktor Szakats [Thu, 6 Feb 2025 18:17:53 +0000 (19:17 +0100)] 
test1516: avoid failure due to spaces in path

Sync the test path with test1515. If fixes the test when the perl tool
resides on a path with spaces in it. E.g. when using the perl from Git
for Windows. This is a workaround, there may be a better fix this
type of issue.

Similar fix for test1515: 38b055446ae46e4568328fa90e96a87fe71c56a7

Failure:
```
test 1516...[caching of manual libcurl DNS entries after dead connection]
lib1515.exe returned 3, when expecting 0
 1516: exit FAILED
=== Start of file stderr1516
 Test: lib1515
[...]
 17:59:32.390000 == Info: Expire cleared
 request http://testserver.example.com:63621/C:/Program Files/Git/path/15160001 failed with 3
 Test ended with result 3
=== End of file stderr1516
```
Ref: https://github.com/curl/curl/actions/runs/13184790755/job/36804217128?pr=16217#step:13:2805

Closes #16223

5 months agoINTERNALS: fix c-ares, as we actually support 1.6.0 or later
Daniel Stenberg [Thu, 6 Feb 2025 16:00:17 +0000 (17:00 +0100)] 
INTERNALS: fix c-ares, as we actually support 1.6.0 or later

It was wrongly bumped to 1.16.0 in db50fc6e95816ec. While we strongly
recommend using 1.16.0 or later, we still allow builds using older
versions.

It would make sense to raise the requirement to at least 1.11.0 (Feb 19
2016) but that's not done right now.

Closes #16221

5 months agoGHA/windows: always pass `-A <arch>` to cmake in vcpkg jobs
Viktor Szakats [Thu, 6 Feb 2025 13:09:58 +0000 (14:09 +0100)] 
GHA/windows: always pass `-A <arch>` to cmake in vcpkg jobs

Instead of relying on the default `-A x64` on `windows-latest` runners,
tell cmake the arch explicitly, to be in sync with `matrix.arch`. Also
add support for arm64 and x86.

`-DVCPKG_TARGET_TRIPLET=` isn't enough to select the platform, ref:
https://github.com/curl/curl/actions/runs/13179082565/job/36785363766?pr=16210

Closes #16210

5 months agocmake: respect `GNUTLS_LIBRARY_DIRS` in `libcurl.pc` and `curl-config`
Viktor Szakats [Wed, 5 Feb 2025 17:22:48 +0000 (18:22 +0100)] 
cmake: respect `GNUTLS_LIBRARY_DIRS` in `libcurl.pc` and `curl-config`

Authored-by: Kai Pastor
Ref: https://github.com/microsoft/vcpkg/commit/0ed3bfe969b2f95ad45f431c5ea482a69f132a67
Closes #16190

5 months agobuild: add tool_hugehelp.c into IBMi build
andrewkirillov-ibm [Thu, 6 Feb 2025 12:58:52 +0000 (12:58 +0000)] 
build: add tool_hugehelp.c into IBMi build

As `tool_hugehelp.c` is no longer included into `Makefile.inc`,
I did add it explicitly to list of source files built on IBMi.

Follow-up to 96843f4ef74e02452972fd97fe15d8ff656f46ec #16068
Fixes #16214
Closes #16215

5 months agoCURLOPT_SSH_KNOWNHOSTS.md: strongly recommend using this
Daniel Stenberg [Thu, 6 Feb 2025 10:09:06 +0000 (11:09 +0100)] 
CURLOPT_SSH_KNOWNHOSTS.md: strongly recommend using this

Make setopt fail for SSH backends not supporting knownhosts or pub md5

Closes #16204

5 months agoconfigure/cmake: set asyn-rr a feature only if httpsrr is enabled
Daniel Stenberg [Wed, 5 Feb 2025 12:52:46 +0000 (13:52 +0100)] 
configure/cmake: set asyn-rr a feature only if httpsrr is enabled

Closes #16183

5 months agoheader.md: mention `Authorization:` and `Cookie:` special treatment
Daniel Stenberg [Tue, 4 Feb 2025 09:25:12 +0000 (10:25 +0100)] 
header.md: mention `Authorization:` and `Cookie:` special treatment

Fixes #16160
Reported-by: deliciouslytyped on github
Closes #16164

5 months agotool_getparam: add "TLS required" flag for each such option
Daniel Stenberg [Mon, 3 Feb 2025 21:43:36 +0000 (22:43 +0100)] 
tool_getparam: add "TLS required" flag for each such option

... and check it early, once.

Closes #16159

5 months agonetrc: return code cleanup, fix missing file error
Daniel Stenberg [Tue, 4 Feb 2025 10:25:18 +0000 (11:25 +0100)] 
netrc: return code cleanup, fix missing file error

Made the netrc parser return a more consistent set of error codes and
error messages, and also return error properly if the .netrc file is
missing.

Add test 697 to verify error on missing netrc file.

Fixes #16163
Reported-by: arlt on github
Closes #16165

5 months agoRELEASE-NOTES: synced
Daniel Stenberg [Thu, 6 Feb 2025 09:30:07 +0000 (10:30 +0100)] 
RELEASE-NOTES: synced

and bump curlver to 8.12.1 while "cooling off"

5 months agocontent_encoding: #error on too old zlib
Daniel Stenberg [Thu, 6 Feb 2025 08:28:42 +0000 (09:28 +0100)] 
content_encoding: #error on too old zlib

The previous runtime check using strcmp() risks failing when zlib
reaches 1.10. While this instead changes the logic to a cruder
build-time instead of runtime, it avoids the 1.10 risk.

I verified that ZLIB_VERNUM has been provided since at least the 1.2.0.3
release.

1.2.0.4 was released on 10 August 2003.

Reported-by: Fay Stegerman
Closes #16202

5 months agolibssh2: raise lowest supported version to 1.2.8
Daniel Stenberg [Thu, 6 Feb 2025 06:54:54 +0000 (07:54 +0100)] 
libssh2: raise lowest supported version to 1.2.8

Shipped on April 5 2011

Closes #16199

5 months agodocs: better explain multi-part byte range behavior
Jay Satiro [Sat, 1 Feb 2025 23:12:18 +0000 (18:12 -0500)] 
docs: better explain multi-part byte range behavior

- Better explain that if the requested range (--range or CURLOPT_RANGE)
  contains multiple ranges then the response contains meta information
  in addition to the requested bytes.

Prior to this change it was noted that a multiple part response was
returned as-is but not what that meant. In particular, meta information
is returned in addition to the requested bytes and that may have been
unexpected.

Reported-by: Ralf A. Timmermann
Fixes https://github.com/curl/curl/issues/16139
Closes https://github.com/curl/curl/pull/16150

5 months agoSPONSORS.md: clarify that we don't promise goods or services
Daniel Stenberg [Wed, 5 Feb 2025 22:24:23 +0000 (23:24 +0100)] 
SPONSORS.md: clarify that we don't promise goods or services

Due to past events

Closes #16196

5 months agoGHA/non-native: skip examples in non-unity job
Viktor Szakats [Wed, 5 Feb 2025 20:35:58 +0000 (21:35 +0100)] 
GHA/non-native: skip examples in non-unity job

To save time. They are built the same way in the other jobs.

Follow-up to 6fc703904b2ed5e320abd66c9ef1efc894578fe9 #16188
Closes #16195

5 months agolibssh: silence `-Wconversion` with a cast (Windows 32-bit)
Viktor Szakats [Wed, 5 Feb 2025 18:19:04 +0000 (19:19 +0100)] 
libssh: silence `-Wconversion` with a cast (Windows 32-bit)

Seen with GCC 13 with Windows x86:
```
lib/vssh/libssh.c: In function 'myssh_statemach_act':
lib/vssh/libssh.c:1851:41: error: conversion from 'curl_off_t' {aka 'long long int'} to 'size_t' {aka 'unsigned int'} may change value [-Werror=conversion]
 1851 |                              data->state.infilesize,
      |                              ~~~~~~~~~~~^~~~~~~~~~~
```
Ref: https://github.com/curl/curl/actions/runs/13161422041/job/36737994642?pr=16182#step:3:5111

Closes #16194

5 months agolib: include necessary headers for `inet_ntop`/`inet_pton`
Viktor Szakats [Wed, 5 Feb 2025 14:32:11 +0000 (15:32 +0100)] 
lib: include necessary headers for `inet_ntop`/`inet_pton`

Include `netinet/in.h` for FreeBSD/OpenBSD. Also include `sys/socket.h`
just in case, based on earlier code in `tests/libtest/lib1960.c`.

Also:
- document these in `CMakeLists.txt`.
- add a CI job testing FreeBSD with no unity and no test bundles.
  (without running tests to keep it fast)

FreeBSD (autotools):
```
../../../tests/libtest/lib1960.c:66:22: error: variable has incomplete type 'struct sockaddr_in'
   66 |   struct sockaddr_in serv_addr;
      |                      ^
../../../tests/libtest/lib1960.c:66:10: note: forward declaration of 'struct sockaddr_in'
   66 |   struct sockaddr_in serv_addr;
      |          ^
```
Ref: https://github.com/curl/curl/actions/runs/13159721509/job/36725114118?pr=16188#step:3:5289

OpenBSD (cmake):
```
/home/runner/work/curl/curl/tests/libtest/lib1960.c:66:22: error: variable has incomplete type 'struct sockaddr_in'
  struct sockaddr_in serv_addr;
                     ^
/home/runner/work/curl/curl/tests/libtest/lib1960.c:66:10: note: forward declaration of 'struct sockaddr_in'
  struct sockaddr_in serv_addr;
         ^
1 error generated.
```
Ref: https://github.com/curl/curl/actions/runs/13159721509/job/36725102004?pr=16188#step:3:2166

Reported-by: CueXXIII on Github
Fixes #16184
Follow-up to a3585c9576abccddbd27200058912cef900c3c0f #15543
Closes #16188

5 months agosmb: silence `-Warray-bounds` with gcc 13+
Viktor Szakats [Wed, 5 Feb 2025 12:52:06 +0000 (13:52 +0100)] 
smb: silence `-Warray-bounds` with gcc 13+

The code look correct. The compiler gets confused by the `byte[1]`
struct member mapped into a memory buffer with a variable-sized
payload starting at this member. Perhaps there is a cleaner way
to silence this by changing the code.

First seen with gcc 13.2.0 in curl-for-win builds. Then with 13.2.1 and
the latest 14.2.0.

```
curl/lib/smb.c: In function 'smb_connection_state':
curl/lib/smb.c:895:5: warning: 'memcpy' offset [74, 80] from the object at 'buf' is out of the bounds of referenced subobject 'bytes' with type 'char[1]' at offset 73 [-Warray-bounds=]
  895 |     memcpy(smbc->challenge, nrsp->bytes, sizeof(smbc->challenge));
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
curl/lib/smb.c:130:8: note: subobject 'bytes' declared here
  130 |   char bytes[1];
      |        ^~~~~
```

gcc 14.2.0 debian:testing musl riscv64: https://github.com/curl/curl/actions/runs/13157579253/job/36718140035?pr=16182#step:3:5576
gcc 13.2.1 alpine amd64: https://github.com/curl/curl-for-win/actions/runs/9370491111/job/25797582549#step:3:4869
gcc 13.2.0 debian:testing glibc aarch64: https://github.com/curl/curl-for-win/actions/runs/9370491111/job/25797581315#step:3:6054
gcc 13.2.0 debian:testing glibc amd64: https://github.com/curl/curl-for-win/actions/runs/9370491111/job/25797581315#step:3:10959
gcc 13.2.0 debian:sid glibc riscv64: https://github.com/curl/curl-for-win/actions/runs/9370491111/job/25797580697#step:3:6122
gcc 13.2.0 debian:sid musl riscv64: https://github.com/curl/curl-for-win/actions/runs/9370491111/job/25797583450#step:3:6227

Closes #16187

5 months agoasyn-thread: fix HTTPS RR crash
Daniel Stenberg [Tue, 4 Feb 2025 16:51:57 +0000 (17:51 +0100)] 
asyn-thread: fix HTTPS RR crash

By removing 'data' from the thread struct and passing it in as an
argument we avoid the case it could be dereferenced before stored when
shutting down HTTPS RR.

Also reordered the struct fields a little to remove holes.

Closes #16169

5 months agoRELEASE-NOTES: synced curl-8_12_0
Daniel Stenberg [Wed, 5 Feb 2025 06:42:54 +0000 (07:42 +0100)] 
RELEASE-NOTES: synced

curl 8.12.0 release

Also THANKS

5 months agotransfer: replace `false` with `FALSE`
Viktor Szakats [Wed, 5 Feb 2025 01:26:01 +0000 (02:26 +0100)] 
transfer: replace `false` with `FALSE`

Follow-up to c9afcecee94284e754d82354c79e4e37f09bff61 #16170

Closes #16177

5 months agocfilters: silence compiler warning
Viktor Szakats [Tue, 4 Feb 2025 17:29:24 +0000 (18:29 +0100)] 
cfilters: silence compiler warning

seen with gcc 4.4.0:
```
../../lib/cfilters.c: In function 'Curl_conn_http_version':
../../lib/cfilters.c:523: error: conversion to 'unsigned char' from 'int' may alter its value
```
Ref: https://github.com/curl/curl/actions/runs/13124120573/job/36616761121?pr=15975#step:9:20

Follow-up to e83818cae1da495939aee5def1172ca1d20cc1e4 #16073

Closes #16171

5 months agotransfer: fix returning init failures from `xfer_recv_shutdown_started()`
Viktor Szakats [Tue, 4 Feb 2025 17:15:22 +0000 (18:15 +0100)] 
transfer: fix returning init failures from `xfer_recv_shutdown_started()`

Before this patch it returned `CURLE_FAILED_INIT` on init failures, with
the value of 2. Fix it to return `false`.

Seen with clang 18.1.8:
```
../lib/transfer.c(181,12): warning: integer constant not in range of enumerated type 'bool' [-Wassign-enum]
  181 |     return CURLE_FAILED_INIT;
      |            ^
../lib/transfer.c(181,12): warning: implicit conversion from enumeration type 'CURLcode' to different enumeration type 'bool' [-Wenum-conversion]
  181 |     return CURLE_FAILED_INIT;
      |     ~~~~~~ ^~~~~~~~~~~~~~~~~
../lib/transfer.c(183,12): warning: integer constant not in range of enumerated type 'bool' [-Wassign-enum]
  183 |     return CURLE_FAILED_INIT;
      |            ^
../lib/transfer.c(183,12): warning: implicit conversion from enumeration type 'CURLcode' to different enumeration type 'bool' [-Wenum-conversion]
  183 |     return CURLE_FAILED_INIT;
      |     ~~~~~~ ^~~~~~~~~~~~~~~~~
```

Follow-up to 35bf766280a77cde3055e0f4e249ab02a0dcd275 #14253

Closes #16170

5 months agodocs/HTTPSRR.md: Typo fix AAA -> AAAA
MacKenzie [Tue, 4 Feb 2025 21:39:22 +0000 (17:39 -0400)] 
docs/HTTPSRR.md: Typo fix AAA -> AAAA

Closes #16173

5 months agopop3: revert connection ssl check
Stefan Eissing [Tue, 4 Feb 2025 20:53:55 +0000 (21:53 +0100)] 
pop3: revert connection ssl check

As reported in #16166, the STLS hangs with the check for SSL connection
filters, but is working with the old protocol handler way. Revert the
change, although it is unclear why it was no good here.

Fixes #16166
Reported-by: ralfjunker on github
Closes #16172

5 months agoHTTPSRR.md: implement what seems to be deployed
Daniel Stenberg [Mon, 3 Feb 2025 21:15:35 +0000 (22:15 +0100)] 
HTTPSRR.md: implement what seems to be deployed

Closes #16158

5 months agobuild: drop macro used to enable `-Wsign-conversion` warnings in CI
Viktor Szakats [Mon, 3 Feb 2025 18:31:10 +0000 (19:31 +0100)] 
build: drop macro used to enable `-Wsign-conversion` warnings in CI

We don't pursue this, and the necessary `#pragma` got in the way of
compiling curl with gcc 4.2 and older. Drop the logic completely.

Follow-up to 8a266ac4883958c339fe16796081a296cd66acb3 #15939

Reported-by: prpr19xx on Github
Fixes #16152
Closes #16157

5 months agoRELEASE-NOTES: synced
Daniel Stenberg [Mon, 3 Feb 2025 21:02:16 +0000 (22:02 +0100)] 
RELEASE-NOTES: synced

5 months agosymbols-in-versions: update version for LIBCURL_VERSION and LIBCURL_VERSION_NUM
Edoardo Lolletti [Fri, 31 Jan 2025 22:18:07 +0000 (23:18 +0100)] 
symbols-in-versions: update version for LIBCURL_VERSION and LIBCURL_VERSION_NUM

Those 2 symbols were available since the first 7.1.1 release

Closes #16141

5 months agox509asn1: add parse recursion limit
Stefan Eissing [Fri, 31 Jan 2025 12:13:34 +0000 (13:13 +0100)] 
x509asn1: add parse recursion limit

For ASN.1 tags with indefinite length, curl's own parser for TLS
backends that do not support certificate inspection calls itself
recursively. A malicious server certificate can then lead to high
recursion level exhausting the stack space.

This PR limits the recursion level to 16 which should be safe on all
architectures.

Added unit test 1657 to verify behaviour.

Fixes #16135
Reported-by: z2_
Closes #16137

5 months agows-docs: extend WebSocket documentation
Calvin Ruocco [Thu, 12 Dec 2024 14:36:08 +0000 (15:36 +0100)] 
ws-docs: extend WebSocket documentation

Closes #16118

5 months agoruntests.pl: fix precedence issue
mauke [Thu, 30 Jan 2025 05:28:50 +0000 (06:28 +0100)] 
runtests.pl: fix precedence issue

The condition `!$cmdtype eq "perl"` (introduced in a4765b0551) is always
false. It checks whether a logical negation (giving true/false) is equal
to the string `"perl"`. This is impossible, so the logging never worked.

The intent was probably to negate the result of the string
comparison:`!($cmdtype eq "perl")` or simply `$cmdtype ne "perl"`.

Fixes #16128
Reported-by: Igor Todorovski
Closes #16129

5 months agotests: stop promoting perl warnings to fatal errors
Dan Fandrich [Mon, 3 Feb 2025 18:19:20 +0000 (10:19 -0800)] 
tests: stop promoting perl warnings to fatal errors

While this is useful on CI to highlight issues in the scripts, it's a
recipe for pain when enabled on users' builds.

Suggested-by: Leon Timmermans
Ref: #16128

5 months agoc-ares: fix/tidy-up macro initializations, avoid a deprecated function
Viktor Szakats [Thu, 30 Jan 2025 11:42:52 +0000 (12:42 +0100)] 
c-ares: fix/tidy-up macro initializations, avoid a deprecated function

- replace deprecated `ares_init()` call with `ares_init_options()`.
  Follow-up to 0d4fdbf15d8eec908b3e63b606f112b18a63015e #16054

- dedupe `CARES_STATICLIB` initalizations into `curl_setup.h`, to
  ensure it's defined before the first (and every) `ares.h` include and
  avoid a potential confusion.

- move `CARES_NO_DEPRECATED` from build level to `curl_setup.h`.
  To work regardless of build system.
  It is necessary because curl calls `ares_getsock()` from two places,
  of which one feeds a chain of wrappers: `Curl_ares_getsock()`,
  `Curl_resolver_getsock()`, `Curl_resolv_getsock()`.

Closes #16131

6 months agoINSTALL-CMAKE.md: fix punctuation
Viktor Szakats [Thu, 30 Jan 2025 14:24:57 +0000 (15:24 +0100)] 
INSTALL-CMAKE.md: fix punctuation

6 months agoGHA: tidy up `apt` commands
Viktor Szakats [Wed, 29 Jan 2025 18:46:25 +0000 (19:46 +0100)] 
GHA: tidy up `apt` commands

- drop `--quiet 2` option where used, to have uniform output.
- replace `apt` with `apt-get` in one job. sync options with rest.
- replace deprecated `apt-key` command with the alternative recommended
  by `apt-key(8)`.
- drop stray `cd /tmp`, no longer needed after migrating to GHA.
- shorten `--option Dpkg::Use-Pty=0` to `-o Dpkg::Use-Pty=0`.
- add `-o Dpkg::Use-Pty=0` to hide `apt-get` progress bars taking
  vertical log space, where missing.
- drop `-y --no-install-suggests --no-install-recommends` `apt-get`
  options. They are the default in the ubuntu-24.04 image.
- GHA/distcheck: move `name:` to top in steps where not there.
- scripts/cijobs.pl: catch `apt-get` lines with the `-o` option.

Closes #16127

6 months agombedtls: PSA can be used independently of TLS 1.3 (avoid runtime errors)
Michael Schuster [Sat, 18 Jan 2025 04:38:41 +0000 (05:38 +0100)] 
mbedtls: PSA can be used independently of TLS 1.3 (avoid runtime errors)

Closes #16044

6 months agotest1960: don't close the socket too early 16123/head
Dan Fandrich [Fri, 24 Jan 2025 01:48:21 +0000 (17:48 -0800)] 
test1960: don't close the socket too early

The socket was closed while the handle was still in use, so
curl_easy_cleanup ended up setting nonblocking mode on a closed handle.

Closes #16123

6 months agocmake: warn for OpenSSL versions missing TLS 1.3 support
Viktor Szakats [Tue, 28 Jan 2025 15:51:18 +0000 (16:51 +0100)] 
cmake: warn for OpenSSL versions missing TLS 1.3 support

To match existing warnings for Secure Transport and BearSSL.

OpenSSL 1.1.1 or upper are offering TLS 1.3 support.

Ref: https://wiki.openssl.org/index.php/TLS1.3

Closes #16120

6 months agocd2nroff: do not insist on quoted <> within backticks
Daniel Stenberg [Tue, 28 Jan 2025 15:51:33 +0000 (16:51 +0100)] 
cd2nroff: do not insist on quoted <> within backticks

Ref: #16118
Closes #16121

6 months agogitignore: add `lib/Makefile.soname.cmake`
Viktor Szakats [Tue, 28 Jan 2025 15:04:29 +0000 (16:04 +0100)] 
gitignore: add `lib/Makefile.soname.cmake`

6 months agohttps-connect: start next immediately on failure
Stefan Eissing [Tue, 28 Jan 2025 12:38:43 +0000 (13:38 +0100)] 
https-connect: start next immediately on failure

When parallel connects are attempted, the second one is started on a
delay. Start it right away when the first one failed.

Closes #16114

6 months agogitignore: restore explicit lists and fix them
Viktor Szakats [Tue, 28 Jan 2025 13:15:46 +0000 (14:15 +0100)] 
gitignore: restore explicit lists and fix them

Range matches are not supported with `+`: https://git-scm.com/docs/gitignore

Also sync `.gitignore` file lists with source files and alphasort them.

Follow-up to 5c31c2e6709979db4c949b7cd6a3cf88dec4e1aa #16093
Reported-by: Stefan Eissing
Fixes #16112
Fixes #16115
Closes #16116

6 months agongtcp2: fix memory leak on connect failure
Stefan Eissing [Tue, 28 Jan 2025 12:23:31 +0000 (13:23 +0100)] 
ngtcp2: fix memory leak on connect failure

When a QUIC connection using ngtcp2 failed immediately, the TLS
instances were not always released.

Closes #16113

6 months agodocs/cmdline-opts/location.md: fix typos for location flag
Martin Harrigan [Tue, 28 Jan 2025 10:28:25 +0000 (10:28 +0000)] 
docs/cmdline-opts/location.md: fix typos for location flag

Closes #16110

6 months agoINTERNALS.md: sync wolfSSL version requirement with source code
Viktor Szakats [Mon, 27 Jan 2025 20:36:46 +0000 (21:36 +0100)] 
INTERNALS.md: sync wolfSSL version requirement with source code

`lib/vtls/wolfssl.c` enforces it via a hard #error.

Cherry-picked from #16104

6 months agoopenssl: define `HAVE_KEYLOG_CALLBACK` before use
Viktor Szakats [Mon, 27 Jan 2025 22:04:02 +0000 (23:04 +0100)] 
openssl: define `HAVE_KEYLOG_CALLBACK` before use

Before this patch this macro was used in `vtls/openssl.h` without
setting it first, causing the `keylog_done` member be present in
struct `ossl_ctx` while the code did not use it.

Follow-up to 3210101088dfa3d6a125d213226b092f2f866722 #13172
Closes #16105

6 months agoopenssl: drop unused `HAVE_SSL_GET_SHUTDOWN` macro
Viktor Szakats [Mon, 27 Jan 2025 20:07:55 +0000 (21:07 +0100)] 
openssl: drop unused `HAVE_SSL_GET_SHUTDOWN` macro

Follow-up to c31041b17e5ee60e7ecc2309daa8ababf7c7ad2d #13904
Closes #16103