Stefan Eissing [Mon, 6 Jul 2026 10:59:45 +0000 (12:59 +0200)]
hardening: add API guards
Add call stacks to easy and multi instances. Record ongoing API calls
and callback invocations there to detect recursion and not allowed
invocations.
Define enums for easy, multi and callbacks in `api.h`. In `api.c` define
properties for these functions:
- can they recurse
- is the easy/multi handle destroyed during the call or should it be
good afterwards
- is the call allowed when a multi event callback is ongoing
- is the call allowed when a notification callback is ongoing
Entering a guard
- checks that passed CURL*/CURLM* are GOOD on entering
- checks that easy handle's `mid` is correct and it is known
for it in the multi.
- checks that call properties are obeyed (recursion, callback checks)
- checks that passed CURL*/CURLM* are GOOD on leaving, unless call is
known to kill it
Checks for ongoing callbacks inspect the whole call stack and catches
nested invocations (which our current flags can not).
Call stacks in easy/multi handle are fixed size and will deny recursion
when the limit is reached. The current limits are 7 for easy and 15 for
multi now.
Removes:
- multi->in_callback, check is done via call stack
- multi->in_ntfy_cb, check is done via call stack
The overhead in my tests seems minimal, if noticeable at all.
Stefan Eissing [Wed, 15 Jul 2026 15:21:04 +0000 (17:21 +0200)]
cf-dns: resolve on filter demand
Use separate dns cache entries for addresses (A+AAAA) and HTTPS-RR
results. That makes also "negative" results independent of each other.
Dns cache entries, once in use, can no longer be modified safely, as
concurrent use would require each access then to be done under lock. By
using separate entries, we can update a HTTPS entry without needing to
duplicate an existing address entry for the same host+port.
Connection filters can now ask for DNS resolves. This works at any time
during connection setup and while connect is going on.
`Curl_conn_dns_add_addr_resolve()` and
`Curl_conn_dns_add_https_resolve()` are used for that. They check if the
resolve is already ongoing, can be added to a resolve not started yet
or, as last resort, create a new filter instance and add it to the
connection (it's easier to add more filters than making the same filter
handle multiple resolves. Since DNS filters are removed once the
connection is established, there is no later penalty).
HTTPS-RR queries are added by the `HTTPS-CONNECT`, `SSL` and `QUIC`
filters. The latter will only do that when ECH is configured and
supported. That means we trigger HTTPS-RR queries only when the results
matter.
Add test_22_06 for ALPN influenced via HTTPS-RR when tunneling through a
proxy. This did not work before.
Adjust test2100 to use https: as the previous http: URL no longer
triggers HTTPS-RR resolves.
Stefan Eissing [Fri, 17 Jul 2026 12:10:03 +0000 (14:10 +0200)]
uint-spbset: reused empty chunks
Fix chunk allocations by reusing existing empty chunks when a new offset
is needed. Before this fix, spbsets would only ever grow with added
numbers outside the range of existing chunks.
Stefan Eissing [Thu, 16 Jul 2026 09:26:33 +0000 (11:26 +0200)]
lib: client writer tweaks
- keep pause state at request
- keep presense of content decoding writers at request
- only add cw-pause writer when content decoding happens
- define macro for passing data down the writer chain
Stefan Eissing [Wed, 8 Jul 2026 08:34:51 +0000 (10:34 +0200)]
lib: add multi_wakeup_internal
For threaded resolving, added an additional socket/eventfd pair to the
multi handle for notifications from threads. The original "double use"
of the standard wakeup pair did lead to regressions for apps.
The API definition of curl_multi_poll/wait/wakeup is pretty tight
regarding what effects what and adding notifications on top of that
broke what apps perceived to be the contract.
Fixes #22272 Reported-by: Sergei Zimmerman
Closes #22274
Keng-Yu Lin [Sun, 28 Jun 2026 20:43:01 +0000 (17:43 -0300)]
tests: fix type promotion on 32-bit arches in http test code
As reported in the bug:
> On a 32-bit architecture (i386):
> 1. `chunks * chunk_size` evaluates to `unsigned int` (32-bit
> unsigned).
> 2. Due to Usual Arithmetic Conversions in C, the signed `-1` (int)
> operand of the ternary operator is promoted to `unsigned int`,
> yielding `4294967295` (0xFFFFFFFF).
> 3. The ternary operator returns `4294967295` as an `unsigned int`.
> 4. This unsigned value is then assigned to `r->clength` (apr_off_t,
> 64-bit signed). Since the source is unsigned, it is zero-extended,
> resulting in `r->clength` becoming `+4294967295`.
> 5. The subsequently executed check `if(r->clength >= 0)` evaluates to
> true.
> 6. Inside the block, `apr_ltoa(r->pool, (long)r->clength)` casts it to
> a 32-bit signed `long` (on 32-bit platforms), which truncates it
> back to `-1`, formatting it as "-1" and sending the
> "Content-Length: -1" header.
>
> On a 64-bit architecture (amd64), `size_t` is 64-bit, and `-1` (32-bit
> int) is promoted to `unsigned long` (64-bit), yielding
> `18446744073709551615`. When assigned to `r->clength` (64-bit signed),
> it wraps back to `-1`, which correctly skips the Content-Length
> generation.
>
> This type promotion mismatch can be safely fixed by avoiding the
> signed/unsigned mixture in the ternary operator.
Graham Campbell [Sun, 12 Jul 2026 16:52:16 +0000 (17:52 +0100)]
cfilters: fix event-based connection shutdown
- Adjust pollset during connection shutdown.
- Separate the FIRSTSOCKET and SECONDSOCKET check so that one being in
connect or shutdown no longer adds poll events for the other.
- Fix shutdown state evaluation (as detailed below).
- Add a unit test for Curl_conn_adjust_pollset.
- Add a client for event testing.
- Test that shutdown sockets stay with the socket callback until done.
The pollset predicate now reads the connection's own shutdown state
rather than going through data->conn, and the EXPIRE_SHUTDOWN arming in
cshutdn_perform() works again: next_expire_ms started at 0 and could
never be set, so a peer that never sends a close_notify would still park
its connection forever, timeout or not.
Graham Campbell [Tue, 14 Jul 2026 00:37:51 +0000 (01:37 +0100)]
test798: force IPv4 to avoid cross-runner port aliasing
`test798` is the only test fetching `http://localhost:%HTTPPORT` without
`-4`, since it needs the hostname for its folded `domain=localhost`
cookie. curl tries `::1` first, but the test HTTP server is IPv4-only.
On the BSDs, IPv4 and IPv6 have separate ephemeral port namespaces, so
with every test server binding port 0, another parallel runner's
IPv6-bound server can hold the same numeric port. curl then connects to
the wrong runner's server, which cannot open its own `log/N/test798` and
closes without a response, giving exit 52 and an empty `server.input`.
This PR fixes this flake by adding `-4` matches what tests 389 and 392
already do. Linux is immune because wildcard IPv6 binds occupy the IPv4
port too. Seen in
https://github.com/curl/curl/actions/runs/29229170329/job/86749470571.
Graham Campbell [Tue, 14 Jul 2026 00:37:41 +0000 (01:37 +0100)]
ngtcp2: let verify failures win over expiry processing errors
A flaky CI failure of `test_17_05_bad_ip_addr[h3]` (GnuTLS, event-based)
had curl detect the certificate name mismatch yet exit with
`CURLE_RECV_ERROR` (56) instead of `CURLE_PEER_FAILED_VERIFICATION`
(60). `Curl_cf_ngtcp2_cmn_connect` calls `Curl_cf_ngtcp2_cmn_set_expiry`
after its `ctx->tls_vrfy_result` override and returns the error
unfiltered, so when the server's final handshake flight happens to be
processed by the ingress inside set_expiry, the verify failure surfaces
as a generic receive error.
This PR makes set_expiry prefer `ctx->tls_vrfy_result` over generic
progress errors, as the recv and send paths already do after calling it,
and also covers the `cf-ngtcp2-proxy.c` call sites that lack the
override. Completes #21712. Seen in
https://github.com/curl/curl/actions/runs/29243256619/job/86794119412.
Graham Campbell [Wed, 15 Jul 2026 11:52:21 +0000 (12:52 +0100)]
quiche: set the max field section size
quiche 0.29.3 started enforcing a default
`SETTINGS_MAX_FIELD_SECTION_SIZE` of 32 KiB, so larger response headers
now shut down the whole connection with `CURLE_HTTP3`. curl accepts up
to 300 KiB of response headers with every other backend and HTTP
version. Tell quiche to allow what curl itself allows. This keeps
test_01_11 passing with quiche 0.29.3 and it also advertises our real
limit to servers, which the RFC encourages.
Viktor Szakats [Tue, 14 Jul 2026 17:06:37 +0000 (19:06 +0200)]
idn: restore `MultiByteToWideChar()` `MB_ERR_INVALID_CHARS` flag
Also:
- curlx: pass this flag to the actual conversion calls, for consistency
and robustness. (It's not stricly necessary because the initial call
to determine size, with this flag passed, fails already on bad input.)
- schannel: unfold `MultiByteToWideChar()` line (formatting).
unit3214: fix to pass on systems with >=128-bit pointers
E.g. on CHERI pointers are 128 bits [1]. This causes the unit3214 test
to fail, which was written with more traditional platforms in mind. Here
is the output of log/stderr3214:
```
URL: -
BAD: struct Curl_easy is 7984 bytes, allowed to be 5370: 2614 bytes too big
BAD: struct connectdata is 1408 bytes, allowed to be 1300: 108 bytes too big
BAD: struct Curl_multi is 1248 bytes, allowed to be 850: 398 bytes too big
BAD: struct curl_httppost is 224 bytes, allowed to be 112: 112 bytes too big
BAD: struct curl_slist is 32 bytes, allowed to be 16: 16 bytes too big
BAD: struct curl_khkey is 32 bytes, allowed to be 24: 8 bytes too big
BAD: struct curl_hstsentry is 48 bytes, allowed to be 40: 8 bytes too big
BAD: struct curl_mime is 144 bytes, allowed to be 96: 48 bytes too big
BAD: struct curl_mimepart is 592 bytes, allowed to be 440: 152 bytes too big
BAD: struct curl_certinfo is 32 bytes, allowed to be 16: 16 bytes too big
BAD: struct curl_tlssessioninfo is 32 bytes, allowed to be 16: 16 bytes too big
BAD: struct curl_blob is 32 bytes, allowed to be 24: 8 bytes too big
BAD: struct CURLMsg is 48 bytes, allowed to be 24: 24 bytes too big
BAD: struct curl_header is 80 bytes, allowed to be 48: 32 bytes too big
Test ended with result 14
```
Multiply the allowed size on systems with larger than 64-bit pointers.
Stefan Eissing [Fri, 10 Jul 2026 09:47:48 +0000 (11:47 +0200)]
lib: ratelimit timestamps
Remove the timestamp passed for ratelimit checks. Let the limit
calculation obtain a timestamp when it needs it. Most transfers run
without active ratelimits and getting a fresh timestamp is unnecessary.
ftp: reject control bytes in ACCT and alternative-to-user
A CR or LF in the CURLOPT_FTP_ACCOUNT or CURLOPT_FTP_ALTERNATIVE_TO_USER
string split the control-channel command line and smuggled a second FTP
command. Reject a byte below 0x20 in both values before the command is
built.
Graham Campbell [Sat, 4 Jul 2026 19:45:31 +0000 (20:45 +0100)]
conncache: apply multi limits to transfers using a shared pool
- Determine max host and total connection limits from the transfer's own
multi handle and test that it works for shared connections.
Prior to this change, since df67269 (precedes 8.13.0),
Curl_cpool_check_limits() took the limits from the multi handle that
owns the pool. A share-owned pool is not owned by any multi, so the
limit check always passed.
Prior to df67269 the limits came from the transfer's own multi handle.
Stefan Eissing [Thu, 9 Jul 2026 10:45:51 +0000 (12:45 +0200)]
ws: pause/unpause write handling
Websocket frames need to be written individualy, so that applications
can access the frame meta data correctly. This worked until the write
function triggered a pause. Remaining frames accumulated in the "out"
writer's buffer and on unpaused were written in one chunk.
ws decode writer will now stop writing frames when the client writer
is paused. To handle the writing of buffered raw data after an unpause,
client writers have gotten a new "flush" method.
Add pytest test_20_12 with a new client to check handling of pauses
and websocket frames.
Reported-by: Hendrik Hübner
Fixes #22273
Closes #22283
Stefan Eissing [Fri, 10 Jul 2026 07:58:08 +0000 (09:58 +0200)]
tests: remove test1701
Test 1701 did a HTTP/2 Upgrade in a HTTP/1.1 POST request. This will no
longer be supported in the upcoming nghttp2 release for security reasons
(Upgrade requests with body a re messy, error prone and can easily lead
to connection confusion).
As no other server we have supports this, remove the test.
Reported-by: firexinghe on github
Fixes #22280
Closes #22291
Stefan Eissing [Wed, 8 Jul 2026 12:15:10 +0000 (14:15 +0200)]
tool: fix memory use in parallel mode
The curl tool was creating a new transfer every time it checked if
it needed to add one to reach max parallelism. This led to eventually
all configured transfers to have easy handles created.
Limit the creation again to the ones needed for max parallelism.
scorecard.py: set --out-null only for curl versions that support it
Stefan Eissing [Mon, 6 Jul 2026 09:24:31 +0000 (11:24 +0200)]
GHA/macos: ignore test 311 results for Homebrew wolfSSL
Homebrew is distributing v5.9.2 at the time of this commit, which
contains known regression failing to parse the server certificate.
The fix has been merged upstream. Till it makes it into a release
and Homebrew, ignore test results for 311.
Note: Renovate strips pre-existing quotes from the YAML version value.
This breaks the bump next time its version is ending with zero(s).
Ref: 78267398e5a2ce347a6729926c68272b2b6fbed5 #22143 #22142
Stefan Eissing [Sat, 4 Jul 2026 15:20:13 +0000 (17:20 +0200)]
test2114: fix reading from stdin
The test provides an invalid username, but no ':' with password, so that
the curl tool tries to read the password from stdin. That makes the test
hang, also in CI.
The check for invalid characters is happening when the CURLOPT_USERPWD
is applied to the URL, so when the transfer is started. Maybe the check
should happen also in setopt already.
The test hangs because tool_paramhlp.c:548 `checkpasswd()` does not see
a ':' and tries to read the password from stdin.
Fix: add a ':' in the tests invalid user setting, so that the read does
not happen.
Viktor Szakats [Fri, 24 Oct 2025 23:40:44 +0000 (01:40 +0200)]
gssapi: add support for Apple GSS Framework
Add support for the native GSS Framework on Apple targets, which is
Apple's fork of Heimdal. This option allows to drop Apple's deprecated
MIT Kerberos compatibility shim "mit-krb5/1.7-prerelease".
Source code uses different headers, other than that no source changes
are necessary.
You can enable by configuring with:
autotools: `--enable-gssapi-apple`
CMake: `-DCURL_USE_GSSAPI=ON -DCURL_GSS_FLAVOR=Apple`
These options are experimental, and may receive breaking updates till
the GSS backend selection logic settles, for Apple and also for the GNU
and MIT implementation.
Daniel Stenberg [Fri, 3 Jul 2026 21:32:08 +0000 (23:32 +0200)]
cd2nroff: stricter checks for asterisks for italics
The nroff (man page) version of the markdown docs could get asterisks
mistreated as emphasis - seen in the CURLOPT_WRITEDATA manpage. The
regex now more stricter requires a word character to follow an italics
starting asterisk and there needs to be a word character or a closing
parenthesis before the italics ending asterisk.
Also: fix CURLINFO_CERTINFO.md which used wrong italics - it was not
rendered correctly on GitHub and with other generic markdown parsers.
Reported-by: Christian Ullrich
Fixes #22257
Closes #22260
Viktor Szakats [Thu, 2 Jul 2026 22:51:12 +0000 (00:51 +0200)]
GHA/windows: fix MSYS2 UWP job name
Also:
- whitespace tidy-up.
- tried building with MSYS2 wolfSSL, but still not compatible with curl.
Ref: https://packages.msys2.org/base/mingw-w64-wolfssl
Ref: #22251
Viktor Szakats [Thu, 2 Jul 2026 22:18:35 +0000 (00:18 +0200)]
configure: link `-lcrypt32` instead of `-lm` for wolfSSL on Windows
Syncing it with CMake/FindWolfSSL.
`-lm` is not needed on Windows. As of mingw-w64 14.0.0 it's offered as
a dummy library; in such case it wasn't causing an actual issue.
`-lcryp32` is necessary when linking wolfSSL statically.
Stefan Eissing [Thu, 2 Jul 2026 10:04:18 +0000 (12:04 +0200)]
FTP: fix TLS session reuse on the data connection
FTP servers using SSL can be configured to check TLS session reuse on
the DATA connection. They hand out a new session on every CONTROL
connect and require to see the client using exactly that one when
up-/downloading on DATA.
This means:
1. We have to configure the SSL filter on the DATA connection with
exactly the same peers.
2. We have to remember the SSL session on the CONTROL connection -
separately from the session cache. The SSL filter on the DATA
connection then looks for a session at the CONTROL filter and, if
present, uses that.
Tests:
Enable `require_ssl_reuse` in our pytest setup for vsftpd. This
reproduces the problem reported in #22225 and verifies the fix.
Skip ftp+SSL pytests for rustls, as we have no possibility to reuse
sessions in that backend.
Schannel: we do not run these tests with the backend. I expect it has
similar problems but am not able to verify.
Daniel Stenberg [Thu, 2 Jul 2026 07:07:05 +0000 (09:07 +0200)]
vssh: keyfile use cleanups
- make the libssh backend do the same fallback for private and public key
filename as libssh2 already did and is documented behavior. This now uses a
common function.
- set the file names already in setup_connection if public key auth is
requested, so that the connection reuse functions can use the
information when checking for existing connections to reuse
- rename the oddly named struct fields 'rsa' to 'priv_key' and 'rsa_pub'
to 'pub_key' to better reflect their purposes
Stefan Eissing [Wed, 1 Jul 2026 08:54:21 +0000 (10:54 +0200)]
openssl+sectrust: fix session reuse
When TLS is verified via Apple SecTrust, openssl internal state is a
verification faiure (that is how it works, we use sectrust when openssl
fails to verify and natice ca store is enabled).
OpenSSL stores this verification status inside its TLS session objects.
On reuse, we see an unverified session and do not reuse it for a
verified connect attempt. While this is a performance penalty for most
connections, it *fails* on ftps:// transfers where servers expect
session reuse on DATA connections.
Fix this by remembering that TLS and a session was verified by sectrust
and allow reuse of such sessions for new connect attempts that also use
sectrust.
- updates `actions/cache` from 5.0.5 to 6.1.0
- updates `actions/checkout` from 6.0.2 to 7.0.0
- updates `github/codeql-action/analyze` from 4.36.0 to 4.36.2
- updates `github/codeql-action/init` from 4.36.0 to 4.36.2
- updates `msys2/setup-msys2` from 2.31.1 to 2.32.0
Memduh Çelik [Tue, 30 Jun 2026 04:12:11 +0000 (07:12 +0300)]
tests: pin connection reuse rules for partial, host, and credentials
Add classic tests 3223-3226 and extend tests/http/test_12_reuse.py so that
connection reuse decisions are explicit:
- partial/aborted HTTP/1.1 responses must not reuse the connection
(premature multi_done closes non-multiplexed conns)
- different target hostnames must not share a connection even when they
resolve to the same address (url_match_destination)
- HTTP Basic credentials are per-request (PROTOPT_CREDSPERREQUEST), so
different -u values still reuse; assert that with num_connects
- same host positive control reuses (num_connects 1 then 0)
Patrick Monnerat [Mon, 29 Jun 2026 16:17:14 +0000 (18:17 +0200)]
sasl: fix zero-length response encoding
A sasl zero-length normal response is an empty string, unlike an initial
response. Since the encoding of a zero-length initial response is
protocol dependent, move its handling to the protocol-specific sendauth
procedure. Similarly, do not check for an '=' server message, as this
should normally never occur.
projects / thirdparty / curl.git / log
