Stefan Eissing [Thu, 12 Mar 2026 10:18:32 +0000 (11:18 +0100)]
lib: keepon improving
Improve the name, type and handling of `data->req.keepon`:
- Rename `keepon` to `io_flags`
- make `io_flags` and `uint8_t` and reposition in struct
- Rename `KEEP_*` defines to `REQ_IO_*`, move to request.h
- Replace all direct bit tests to `CURL_REQ_WANT_*` use
- Replace all direct bit manipulations with new macros
Stefan Eissing [Fri, 13 Mar 2026 12:34:46 +0000 (13:34 +0100)]
urldata: import port types and conn destination format
Convert more `int port` to `uint16_t` port types. Reshuffle ports in
connectdata to save some bytes. Change `conn->destination` format to
- make it more readable and thus usable in tracing
- add the IPv6 scope_id only when not default (global)
and make it resemble more the textual format for IPv6
(e.g. suffix '%<scope_id>')
Stefan Eissing [Fri, 13 Mar 2026 13:29:13 +0000 (14:29 +0100)]
urldata: connection bit ipv6_ip is wrong
Eliminate `conn->bits.ipv6_ip`
The bit was only correct for the first transfer using a connection. Use
`data->state.up.hostname` instead in places that need the URL hostname
in its original form.
Fix parseurlandfillconn() to not modify `data->state.up.hostname` before
copying the connection's hostname, but modify the copy instead, leaving
the URL hostname intact.
Daniel Stenberg [Fri, 13 Mar 2026 09:29:05 +0000 (10:29 +0100)]
GHA: make typos ignore RELEASE-NOTES
The file is almost entirely made up by first-lines of previous git
commits, and we usually push it without a PR cycle, making it annoying
to trigger on typos later as they then show in independent PRs by other
people.
Daniel Stenberg [Thu, 12 Mar 2026 13:39:59 +0000 (14:39 +0100)]
badwords: only check comments and strings in source code
- when scanning source code, this now only checks source code comments
and double-quote strings. No more finding bad words as part of code
- this allows the full scan to be done in a single invocation
- detects source code or markdown by file name extension
- moved the whitelist words config into the single `badwords.txt` file,
no more having them separately (see top of file for syntax)
- all whitelisted words are checked case insensitively now
- removed support for whitelisting words on a specific line number. We
did not use it and it is too fragile
Removing the actual code from getting scanned made the script take an
additional 0.5 seconds on my machine.
Scanning 1525 files now takes a little under 1.7 seconds for me.
- tool_writeout: add comment saying silencing is a no-op for llvm/clang.
For `strftime()` it is a GCC-specific, as of llvm/clang v22.1.0.
Follow-up to f07a98ae113b832a8748ba66e1554a7f14c6897e #20366
- unit1652: drop always-false `!defined(__clang__)` guard. Pointed-out-by: Orgad Shaneh
Ref: #20902
Follow-up to 7e814c8717939393d4436d75f5f0c3ffa98c8c53 #16062
- a logic error made it not loop and thus only match if the searched string
was first
- it no longer matches a substring
Adjusted test 1 to use multiple values in the Connection: response
header. Adjusted test 1542 to have a "Connection: close-not" which
should not match.
Viktor Szakats [Wed, 11 Mar 2026 09:17:10 +0000 (10:17 +0100)]
badwords: rework exceptions, fix many of them
Also:
- support per-directory and per-upper-directory whitelist entries.
- convert badlist input grep tweak into the above format.
(except for 'And' which had just a few hits.)
- fix many code exceptions, but do not enforce.
(there also remain about 350 'will' uses in lib)
- fix badwords in example code, drop exceptions.
- badwords-all: convert to Perl.
To make it usable from CMake.
- FAQ: reword to not use 'will'. Drop exception.
Stefan Eissing [Wed, 11 Mar 2026 13:43:14 +0000 (14:43 +0100)]
pingpong: cleanup timeleft handling
- Move `RESP_TIMEOUT` from urldata.h to pingpong.h as
`PINGPONG_TIMEOUT_MS`.
- Rename `Curl_pp_state_timeout()` to `Curl_pp_state_timeleft_ms()` as
the function returns the time left, not the timout..
- Update implementation comments and variable names
Stefan Eissing [Wed, 11 Mar 2026 14:25:45 +0000 (15:25 +0100)]
connection_check, simplified
The protocol handler method `connection_check` allowed to variable
operations to trigger with variable result bits. Only the `CONNCHECK_ISDEAD`
and `CONNRESULT_DEAD` were in use. Transform the function into
`connection_is_dead` without extra parameter and a bool result.
- Remove defines for `CONNCHECK_*` and `CONNRESULT_*`
- Rename protocol function in handler comments
- Change RTSP implementation (only protocol that uses this)
Vladimír Marek [Wed, 11 Mar 2026 09:46:51 +0000 (10:46 +0100)]
hostip: clear the sockaddr_in6 structure before use
On Solaris this was causing intermittent issues when the private
structure member __sin6_src_id had unexpectedly some value. connect(2)
would then fail with EADDRNOTAVAIL.
Felipe Mesquita [Thu, 5 Mar 2026 13:40:16 +0000 (10:40 -0300)]
badwords: avoid 'simply'
It's mostly a filler word. I've read through each use of it in the code
base and did minor rephrasings when "simply" carried some meaning. The
overwhelming majority of cases, removing it improved the text
significantly. Inspired by #20793.
Daniel Stenberg [Mon, 9 Mar 2026 12:32:14 +0000 (13:32 +0100)]
badwords: move into ./scripts, speed up
- 'badwords' is now a target in Makefile.am
- change badwords.txt to specify plain "words" instead of regexes so the
script can build single regexes when scanning, which makes the script
perform much faster (~6 times faster)
Daniel Stenberg [Sat, 7 Mar 2026 10:24:18 +0000 (11:24 +0100)]
cf-socket: ignore SOCK_CLOEXEC etc for socktype equality checks
As the SOCK_CLOEXEC and SOCK_NONBLOCK get ORed to the socktype, this
introduces the cf_socktype() function to use when checking for the
specific socket type: DGRAM or STREAM. The function filters off the
non-type related bits to enable the comparison.
Andrei Rybak [Wed, 4 Mar 2026 09:11:58 +0000 (10:11 +0100)]
FAQ: syntax improvements
During conversion of `docs/FAQ` into Markdown, 'man ld' has incorrectly
kept one of its quotes when it was surrounded by backticks for inline
code formatting. A space on the left of it was lost as well.
Stefan Eissing [Thu, 5 Mar 2026 12:56:49 +0000 (13:56 +0100)]
openssl+ech: workaround for insecure handshakes
OpenSSL 4.0.0-dev supports ECH with one flaw. If peer verification
is not enabled, it will report SSL_ECH_STATUS_BAD_NAME on the ECH
status.
Provide a workaround in libcurl that checks the inner name used in
ECH was the peer's hostname, both verify peer and host are disabled
and then accept the BAD_NAME without failing the connect.
Perform the actual timeout calculation in the blocking resolv
loop each time in the same way, keeping the logic simpler.
The previous version calculated the timeout once, and then
reduced it by the elapsed time spent in polling/processing.
This is unnecessarily complicated.
Viktor Szakats [Fri, 6 Mar 2026 00:51:30 +0000 (01:51 +0100)]
cmake: improve clang-tidy test command-line reproduction
- also query `INTERFACE_COMPILE_DEFINITIONS` and
`INTERFACE_COMPILE_OPTIONS`.
To further sync clang-tidy manual command-lines with the C compiler
command-lines generated by CMake. In practice this adds `-I` options
(via `INTERFACE_COMPILE_OPTIONS`) to the end of the command-line for
dependency header directories. It does not change the outcome of
clang-tidy runs.
- limit querying `COMPILE_DEFINITIONS` and `COMPILE_OPTIONS` to the top
target, the test itself. To not include options such as
`-DCURL_HIDDEN_SYMBOLS` and `-fvisibility=hidden` (when set) via
the libcurl shared lib.
To sync with the actual C compiler command-line.
Viktor Szakats [Fri, 6 Mar 2026 02:42:41 +0000 (03:42 +0100)]
cmake: fix `LOCATION` property read errors in target debug function
Exclude reading certain props for certain target types to avoid these errors:
```
CMake Error at CMake/Utilities.cmake:71 (get_property):
The LOCATION property may not be read from target "...". Use the target
name directly with add_custom_command, or use the generator expression
$<TARGET_FILE>, as appropriate.
```
(and the same in line 78.)
Viktor Szakats [Tue, 3 Mar 2026 17:44:29 +0000 (18:44 +0100)]
examples: improve OpenSSL certificate examples
- add/fix/synchronize error messages and comments.
- consistently return error from the callback on failure.
- fix potential leaks on OpenSSL API failures.
- fix to not pass the nul-terminator to BIO read.
- scope a variable.
- sync code/formatting between the two examples.
Daniel Stenberg [Tue, 3 Mar 2026 16:55:37 +0000 (17:55 +0100)]
curl.h: remove CURLPROTO_MQTTS from the public header
- the value collided with the internal one used for WebSocket
- we add all new ones as internal bits
- bump to 64-bit internal type
- introduce new define for setting all protocols (CURLPROTO_64ALL)
Viktor Szakats [Sun, 1 Mar 2026 15:19:33 +0000 (16:19 +0100)]
cmake: fix building with `CMAKE_FIND_PACKAGE_PREFER_CONFIG=ON`
This CMake global custom option tells it to find dependencies as cmake
Configs first, and only then look for `Find*` modules. This may result
in `find_package()` succeeding, but without actually creating `CURL::*`
imported targets the curl build scripts are expecting.
For dependencies with curl-specific, local, `Find*` modules, we always
want to use them, via the module detection method, and never a
Config-based detection. Ensure this by passing the `MODULE` option to
`find_package()` and `find_dependency()` to make them use `Find*`
modules unconditionally, making them work as expected with the
`CMAKE_FIND_PACKAGE_PREFER_CONFIG=ON` option set.
curl uses local Find modules for all dependencies except OpenSSL and
ZLIB. The latter two keep using either CMake's built-in Find modules or
Config method as before this patch.
Also:
- apply the same change to `curl-config.cmake`. To fix consuming curl
with this option set. Authored-by: Valerie Snyder
Ref: #20764
Follow-up to 16f073ef49f94412000218c9f6ad04e3fd7e4d01 #16973
- GHA/distcheck: add a job testing both building and consuming curl with
this option set. (takes 15 seconds)
Use custom NGHTTP2 configuration for an extra twist (not required
to trigger this issue.)
Follow-up to fcde8d7e3745df3b4d83c86d0a1f0caef398511b #20773
Daniel Stenberg [Sat, 28 Feb 2026 09:48:59 +0000 (10:48 +0100)]
urlapi: use U_CURLU_URLDECODE when toggling it off unsigned
In this use case 'unsigned value &= ~DEFINE;
As otherwise the right side is treated as signed, which annoyingly
triggers UBSan. The U_* defines are local versions of the public define,
only typecast to unsigned.
Reported-by: xmoezzz on github
Fixes #20753
Closes #20769
projects / thirdparty / curl.git / log
