]> git.ipfire.org Git - thirdparty/curl.git/log
thirdparty/curl.git
7 months agoprogress: avoid integer overflow when gathering total transfer size
Daniel Stenberg [Mon, 28 Apr 2025 11:41:20 +0000 (13:41 +0200)] 
progress: avoid integer overflow when gathering total transfer size

Reported by OSS-fuzz

Closes #17207

7 months agosmb: avoid integer overflow on weird input date
Daniel Stenberg [Mon, 28 Apr 2025 11:35:02 +0000 (13:35 +0200)] 
smb: avoid integer overflow on weird input date

Found by OSS-fuzz

Closes #17206

7 months agopull_request_template.md: REUSE compliance
Daniel Stenberg [Mon, 28 Apr 2025 11:44:15 +0000 (13:44 +0200)] 
pull_request_template.md: REUSE compliance

Plus move it to .github

Closes #17208

7 months agopull_request_template.md: provide basic instructions
Daniel Stenberg [Mon, 28 Apr 2025 08:28:55 +0000 (10:28 +0200)] 
pull_request_template.md: provide basic instructions

This should appear on GitHub for pull-requests and asks users to submit
their PRs as draft to begin with, to help us know when PRs are ready.

Closes #17205

7 months agows: store protocol context as connection meta data
Stefan Eissing [Wed, 23 Apr 2025 08:34:12 +0000 (10:34 +0200)] 
ws: store protocol context as connection meta data

Eliminates union member on struct connectdata. Sample of how
other procotols can handle their connection related data.

This avoids potention mix-ups of the `proto` union of a
connection with other protocol instances.

Removed ws "disconnect" callback as meta data is automatically
destroyed when a connection is destroyed.

Closes #17146

7 months agoHTTPSRR.md: clarify somewhat
Daniel Stenberg [Mon, 28 Apr 2025 06:30:16 +0000 (08:30 +0200)] 
HTTPSRR.md: clarify somewhat

Closes #17204

7 months agotests: add basic ECH tests
sftcd [Fri, 25 Apr 2025 17:26:04 +0000 (18:26 +0100)] 
tests: add basic ECH tests

Test 4000 and 4001

Closes #17192

7 months agocmake: extend integration tests
Viktor Szakats [Sun, 27 Apr 2025 10:26:41 +0000 (12:26 +0200)] 
cmake: extend integration tests

- GHA: add cmake integration tests for Windows.
- make them run faster with prefill, unity, Ninja, omitting curl tool.
- also test static libcurl.
- add old-cmake support with auto-detection.
- auto-detect Ninja.
- run consumer test apps to see if they work.
- add support for Windows.
- make it more verbose.
- re-add `ExternalProject` cmake consumer test. It's broken.
- tidy up terminology.

Cherry-picked from #16973
Closes #17203

7 months agocurl_osslq: remove a leftover debug fprintf() call
Daniel Stenberg [Sat, 26 Apr 2025 21:18:43 +0000 (23:18 +0200)] 
curl_osslq: remove a leftover debug fprintf() call

Reported-by: xiadnoring on github
Fixes #17198
Closes #17202

7 months agoGHA: update actions/download-artifact digest to d3f86a1
renovate[bot] [Thu, 24 Apr 2025 17:47:17 +0000 (17:47 +0000)] 
GHA: update actions/download-artifact digest to d3f86a1

Closes #17174

7 months agoGHA: Update awslabs/aws-lc to v1.50.0
renovate[bot] [Fri, 25 Apr 2025 15:41:09 +0000 (15:41 +0000)] 
GHA: Update awslabs/aws-lc to v1.50.0

Closes #17191

7 months agoRELEASE-PROCEDURE.md: release candidate git tagging explained
Daniel Stenberg [Thu, 24 Apr 2025 20:57:51 +0000 (22:57 +0200)] 
RELEASE-PROCEDURE.md: release candidate git tagging explained

To help anyone wanting to build/reproduce release candidates, this is
the set git tag naming scheme to use. Similar to, but different, than
the "normal" release tags to not be possible to mixup.

Closes #17177

7 months agows: fix the header replace check
Daniel Stenberg [Fri, 25 Apr 2025 21:36:05 +0000 (23:36 +0200)] 
ws: fix the header replace check

It passed in the wrong header length to the check function, which made
it do duplicated headers in cases where the user provides its own set.

Reported-by: sbernatsky on github
Fixes #17170
Closes #17194
Closes #16178

7 months agoGHA/windows: add gcc-15 job
Viktor Szakats [Fri, 25 Apr 2025 14:32:27 +0000 (16:32 +0200)] 
GHA/windows: add gcc-15 job

It's taking 2.5 minutes and planned for removal when MSYS2 gcc-15 gets
deployed in CI.

15.0.1 builds significantly faster than 9.5.0. (But still slower than
7.3.0 and 6.4.0)

Ref: https://github.com/msys2/MINGW-packages/commit/f59921184b35858d4ceb91679578de0d62475cbf
Ref: https://github.com/msys2/MINGW-packages/pull/24037

Closes #17190

7 months agocmake: honor individual picky option overrides found in `CMAKE_C_FLAGS`
Viktor Szakats [Sat, 26 Apr 2025 07:34:55 +0000 (09:34 +0200)] 
cmake: honor individual picky option overrides found in `CMAKE_C_FLAGS`

Also to sync up with similar `./configure` feature via
`CURL_ADD_COMPILER_WARNINGS()`.

Example: `-DCMAKE_C_FLAGS=-Wno-xor-used-as-pow`

It may be useful as a workaround if a specific build combination hits
a picky warning within curl's source code. If such happens, we do
appreciate a report to fix it in curl itself.

Closes #17197

7 months agobuild: enable gcc-12/13+, clang-10+ picky warnings
Viktor Szakats [Sat, 26 Apr 2025 07:28:28 +0000 (09:28 +0200)] 
build: enable gcc-12/13+, clang-10+ picky warnings

Cherry-picked from #17190
Closes #17196

7 months agocmake: use `LIB_NAME` in `curl-config.cmake.in`
Viktor Szakats [Sat, 26 Apr 2025 07:17:32 +0000 (09:17 +0200)] 
cmake: use `LIB_NAME` in `curl-config.cmake.in`

Cherry-picked from #16973
Closes #17195

7 months agoGHA/linux: formatting nit [ci skip]
Viktor Szakats [Wed, 23 Apr 2025 18:12:42 +0000 (20:12 +0200)] 
GHA/linux: formatting nit [ci skip]

Cherry-picked from #16973

7 months agourlapi: redirecting to "" is considered fine
Daniel Stenberg [Fri, 25 Apr 2025 14:22:24 +0000 (16:22 +0200)] 
urlapi: redirecting to "" is considered fine

If the CURLU handle already holds a proper URL, otherwise it is an
error.

Verified by test 1560

Fixes #17188
Reported-by: zopsicle on github
Closes #17189

7 months agoGHA: update wolfSSL/wolfssl to v5.8.0
renovate[bot] [Fri, 25 Apr 2025 07:33:49 +0000 (07:33 +0000)] 
GHA: update wolfSSL/wolfssl to v5.8.0

Closes #17182

7 months agoGHA/macos: fix typo in comment [ci skip]
Viktor Szakats [Fri, 25 Apr 2025 19:08:59 +0000 (21:08 +0200)] 
GHA/macos: fix typo in comment [ci skip]

7 months agosectransp: fix building for macOS Sierra and older
Viktor Szakats [Fri, 25 Apr 2025 16:26:10 +0000 (18:26 +0200)] 
sectransp: fix building for macOS Sierra and older

Reported-by: Eric Knibbe
Bug: https://github.com/curl/curl/pull/16581#issuecomment-2830837500
Regression from 2d94439eaa8da4fe11f99872a8b44087f74f88b0 #16581

Closes #17193

7 months agotool_paramhlp: avoid integer overflow in secs2ms()
Daniel Stenberg [Fri, 25 Apr 2025 10:05:52 +0000 (12:05 +0200)] 
tool_paramhlp: avoid integer overflow in secs2ms()

The previous approach was wrong and could lead to wrong timeout values
getting used.

Reported-by: bsr13 on hackerone
Closes #17184

7 months agocf-socket: fix FTP accept connect
Andreas Westin [Thu, 17 Apr 2025 08:46:35 +0000 (10:46 +0200)] 
cf-socket: fix FTP accept connect

When cf_tcp_accept_connect() is called and it sets up a connection it
never indicates to the caller that the it's done.

Closes #17186

7 months agocmake: use `CMAKE_COMPILE_WARNING_AS_ERROR` if available
Viktor Szakats [Fri, 25 Apr 2025 08:52:39 +0000 (10:52 +0200)] 
cmake: use `CMAKE_COMPILE_WARNING_AS_ERROR` if available

It's available in CMake >= 3.24.

Ref: https://cmake.org/cmake/help/latest/variable/CMAKE_COMPILE_WARNING_AS_ERROR.html

Closes #17183

7 months agocmake: stop deleting `-W<n>` from `CMAKE_C_FLAGS` (MSVC)
Viktor Szakats [Thu, 24 Apr 2025 23:45:23 +0000 (01:45 +0200)] 
cmake: stop deleting `-W<n>` from `CMAKE_C_FLAGS` (MSVC)

1. `CMAKE_C_FLAGS` may apply to other projects, and deleting/altering it
   may be unexpected.

2. We pass `-W4`/`-Wall` internally now, which do override custom
   `-W<n>` options in all supported MSVC versions.
   (as tested with Visual Studio generators)
   Ref: https://ci.appveyor.com/project/curlorg/curl/builds/51945416

Follow-up to e86542038dda88dadf8959584e803895f979310c #17047
Ref: 866e02935deb28373130116dac578d84e057a03e #1711

Closes #17179

7 months agoGHA: skip updating man-db for faster installs (Ubuntu)
Viktor Szakats [Fri, 25 Apr 2025 07:19:31 +0000 (09:19 +0200)] 
GHA: skip updating man-db for faster installs (Ubuntu)

This step could take from 5 seconds to 5 minutes, sometimes making it
run out of its time slot. It affected 60 CI jobs.

Saving an estimated minimum of 5 minutes per CI run.

Also fixing:
```
Fri, 25 Apr 2025 06:19:14 GMT
Processing triggers for man-db (2.12.0-4build2) ...
Fri, 25 Apr 2025 06:23:40 GMT
Running kernel seems to be up-to-date.
[...]
Error: The action 'install packages' has timed out after 5 minutes.
```
Ref: https://github.com/curl/curl/actions/runs/14658212268/job/41136971525?pr=17180#step:2:169

Closes #17181

7 months agoRELEASE-NOTES: synced
Daniel Stenberg [Fri, 25 Apr 2025 07:49:59 +0000 (09:49 +0200)] 
RELEASE-NOTES: synced

7 months agotests/buildinfo: former "disabled" now provides more info
Daniel Stenberg [Fri, 25 Apr 2025 06:16:13 +0000 (08:16 +0200)] 
tests/buildinfo: former "disabled" now provides more info

This tool now contains ON/OFF information about features in the build.
This way, runtests gets both positive and negative feature presence with
this. Allows for more flexibility and avoids having to duplicate the
names.

Closes #17180

7 months agoaws-sigv4: allow a blank string
Daniel Stenberg [Thu, 24 Apr 2025 21:39:08 +0000 (23:39 +0200)] 
aws-sigv4: allow a blank string

make sure a zero length sigv4 gets the default value

Reported-by: Arian van Putten
Fixes #17176
Closes #17178

7 months agobuild: tidy up internal feature detection variables for wolfSSL
Viktor Szakats [Thu, 17 Apr 2025 21:47:37 +0000 (23:47 +0200)] 
build: tidy up internal feature detection variables for wolfSSL

Sync them with the function name they detect, and sync them between
cmake and autotools.

- rename `HAVE_WOLFSSL_BIO` to `HAVE_WOLFSSL_BIO_NEW`.
- rename `HAVE_WOLFSSL_FULL_BIO` to `HAVE_WOLFSSL_BIO_SET_SHUTDOWN`.
- autotools: rename `WOLFSSL_NTLM` to `HAVE_WOLFSSL_DES_ECB_ENCRYPT`
  (to sync with cmake).
- autotools: rename `WOLFSSL_BIO` to `HAVE_WOLFSSL_BIO_NEW`
  (to sync with cmake).
- autotools: simplify `HAVE_WOLFSSL_DES_ECB_ENCRYPT` detection.

Cherry-picked from #17082

Closes #17175

7 months agoGHA/windows: limit jobs to 15 minutes
Viktor Szakats [Thu, 24 Apr 2025 17:12:42 +0000 (19:12 +0200)] 
GHA/windows: limit jobs to 15 minutes

They typically finish (well) within 10 minutes.

A notable exception was vcpkg jobs when a rebuild was triggered.
With caching lost and reducing them to short builds, this is not
an issue at the moment.

The advantage of shorter timeouts is hung/crashed jobs giving back
control earlier for a manual retry.

Closes #17173

7 months agoautotools: detect `wolfSSL_set_quic_use_legacy_code` like cmake does
Viktor Szakats [Thu, 17 Apr 2025 14:27:53 +0000 (16:27 +0200)] 
autotools: detect `wolfSSL_set_quic_use_legacy_code` like cmake does

Cherry-picked from #17082

Closes #17172

7 months agocmake: tidy up and document feature detections in dependencies
Viktor Szakats [Thu, 17 Apr 2025 08:07:30 +0000 (10:07 +0200)] 
cmake: tidy up and document feature detections in dependencies

- update text on dependency feature detection variables, and move it
  to its own section in `docs/INSTALL-CMAKE.md`.
  Ref: #17032 (Discussion)

- tidy up descriptions/comments, alpha-sort.

- move comment to its own section in `docs/INSTALL-CMAKE.md`.

- split `HAVE_SSL_SET_QUIC_USE_LEGACY_CODEPOINT` to distinct names for
  each TLS backend API. To make the names more stable and to sync them
  with autotools.
  Follow-up to 07cc50f8ebc6ad4c2ad23642ca727d79dab8855e #17018
  Follow-up to 342a654ef32f6c4ff284d8680f85db6136534699 #15873

- drop redundant condition while detecting QUICTLS API.
  Follow-up to 07cc50f8ebc6ad4c2ad23642ca727d79dab8855e #17018

- add config-comparison exception for `HAVE_SSL_SET_QUIC_TLS_CBS`.
  Follow-up to 5eefdd71a394d135c0ffb56fb8ec117c87dbe4f0 #17027

- detect `wolfSSL_get_peer_certificate` like autotools does.

- detect `wolfSSL_UseALPN` like autotools does.

Closes #17082

7 months agoc-ares: really lazy init channel
Stefan Eissing [Thu, 24 Apr 2025 10:18:33 +0000 (12:18 +0200)] 
c-ares: really lazy init channel

Only initialize the c-ares channel when we start resolving and not
alreads when the application sets `CURLOPT_DNS_SERVERS` and friends.

Creating an ares channel takes considerable time and when we have the
DNS information for a transfer already cached, we do not need it.

Closes #17167

7 months agombedtls: TLS 1.3 is max when mbedtls has 1.3 support
Daniel Stenberg [Tue, 22 Apr 2025 14:05:42 +0000 (16:05 +0200)] 
mbedtls: TLS 1.3 is max when mbedtls has 1.3 support

Co-authored-by: Viktor Szakats
Reported-by: kkalganov on github
Fixes #17048
Closes #17137

7 months agotypecheck-gcc.h: fix the typechecks
Daniel Stenberg [Tue, 22 Apr 2025 20:20:27 +0000 (22:20 +0200)] 
typecheck-gcc.h: fix the typechecks

Refreshed, cleaned up, improved and now checks *all* options.

This must have stopped working at some point. gcc-14 least shows these
warnings with this change, not without.

Add test 745 to verify that all options listed in curl.h is also checked
by the typechecker.

This improved checker found almost 30 mistakes in the curl git
repository.

Closes #17143

7 months agocmake: fix option() and mark_as_advanced() mixed order
Sergey [Thu, 24 Apr 2025 01:45:17 +0000 (18:45 -0700)] 
cmake: fix option() and mark_as_advanced() mixed order

Closes #17163

7 months agocmake: install shell completions for cross-builds
Viktor Szakats [Wed, 23 Apr 2025 08:26:38 +0000 (10:26 +0200)] 
cmake: install shell completions for cross-builds

Also:
- omit auto-detecting `CURL_COMPLETION_FISH_DIR` via `pkg-config`
  for cross-builds and when `CMAKE_INSTALL_PREFIX` is set.
- flatten nested `if`s.

Note:
On macOS with Homebrew, `pkg-config --variable completionsdir fish`
returns the version-specific Cellar path instead of the permanent path
`/opt/homebrew/share/fish/vendor_completions.d/`. This mimics what
autotools does, but may need further fixing, possibly upstream.
https://github.com/Homebrew/homebrew-core/blob/9c13e62b009b8e814fda180e0fcc5096318daf31/Formula/f/fish.rb
https://github.com/fish-shell/fish-shell/blob/ce631fd2fb1f5b63f5f0f1b4041a30dfad823d22/cmake/Install.cmake#L15-L21

Ref: #17147
Ref: 51170b52d15256d4aaf74ed6eea9a9297f5d595c #17159
Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103938

Closes #17145

7 months agoopenssl-quic: Add missing include
Jochen Sprickerhof [Wed, 23 Apr 2025 13:54:21 +0000 (15:54 +0200)] 
openssl-quic: Add missing include

uint_hash, Curl_uint_hash_init and others are used in the file.

Regression from 657aae79c0

Closes #17156

7 months agomulti: init_do(): check result
Stefan Eissing [Wed, 23 Apr 2025 09:24:45 +0000 (11:24 +0200)] 
multi: init_do(): check result

Calls to `Curl_init_do()` did not check on result and missed failures to
properly and completely initialize a transfer request.

The main cause of such an init failure is the need to rewind the
READFUNCTION without a SEEKFUNCTION registered. Check the failure to
"rewind" the upload data immediately make test cases 1576 and friends
fail.

Reported-by: Travis Lane
Fixes #17139
Closes #17150

7 months agoasyn-base: remove the HTTPSRR_WORKS define
Daniel Stenberg [Wed, 23 Apr 2025 21:43:38 +0000 (23:43 +0200)] 
asyn-base: remove the HTTPSRR_WORKS define

It is done in asyn-ares.c since 179aeeaf228e

Closes #17161

7 months agolib/src/docs/test: improve curl_easy_setopt() calls
Daniel Stenberg [Wed, 23 Apr 2025 21:13:29 +0000 (23:13 +0200)] 
lib/src/docs/test: improve curl_easy_setopt() calls

Fix invokes where the argument was not the correct type.

Closes #17160

7 months agoares: add definition for HTTPSRR_WORKS
Niall [Wed, 23 Apr 2025 13:57:37 +0000 (14:57 +0100)] 
ares: add definition for HTTPSRR_WORKS

Closes #17157

7 months agolibcurl-tutorial.md: fix read callback explanation
Daniel Stenberg [Wed, 23 Apr 2025 12:36:02 +0000 (14:36 +0200)] 
libcurl-tutorial.md: fix read callback explanation

Fixes #17138
Reported-by: Thomas Klausner
Closes #17154

7 months agoautotools: install shell completion files on cross build
Helmut Grohne [Wed, 23 Apr 2025 08:54:28 +0000 (09:54 +0100)] 
autotools: install shell completion files on cross build

 Before 8.13.0, it was not possible to generate them as it required
 calling the compiled binary, but this has been fixed.

Co-authored-by: Samuel Henrique <samueloph@debian.org>
Closes #17159

7 months agoGHA/windows: fixup MSYS2 downgrade step
Viktor Szakats [Wed, 23 Apr 2025 17:30:39 +0000 (19:30 +0200)] 
GHA/windows: fixup MSYS2 downgrade step

Fix step failing when 3.6 is detected.
Ref: https://github.com/curl/curl/actions/runs/14620854081/job/41020237740?pr=17157#step:14:8

Follow-up to 20d9d3bcce5efe47ab14e5c9233c2889515fada1 #17151
Follow-up to b06c12b7248592cf001e621d7cd8dc78a827212b #16574

Closes #17158

7 months agoGHA: use more Ninja
Viktor Szakats [Wed, 23 Apr 2025 12:13:55 +0000 (14:13 +0200)] 
GHA: use more Ninja

Use it for AmigaOS, Android, dl-mingw 7.3.0 and 6.4.0 Windows builds.

Also drop explicit ninja installs.

dl-mingw:
Before:
7.3.0: https://github.com/curl/curl/actions/runs/14617346216/job/41008536465
6.4.0: https://github.com/curl/curl/actions/runs/14617346216/job/41008540878
After:
7.3.0: https://github.com/curl/curl/actions/runs/14617983032/job/41010584040?pr=17153
6.4.0: https://github.com/curl/curl/actions/runs/14617983032/job/41010586490?pr=17153

Follow-up to a36655224356c10d70bcc566ce60f82af795ca90 #17115
Ref: https://github.com/actions/runner-images/issues/11391

Closes #17153

7 months agoGHA/windows: apply MSYS2 runtime downgrades to v3.5.x, leave v3.6.x as-is
Viktor Szakats [Wed, 23 Apr 2025 10:12:02 +0000 (12:12 +0200)] 
GHA/windows: apply MSYS2 runtime downgrades to v3.5.x, leave v3.6.x as-is

windows-runners 20250420.1.0 come with msys2-runtime 3.6.x. It has
the perf regression issue fixed, so stop downgrading it.

This makes CI jobs settle on this version when supplied by
the runner image or the msys2/setup-msys2 action:
MINGW64_NT-10.0-20348 fv-az980-636 3.6.1-0cfedd4f.x86_64 2025-04-12 01:44 UTC x86_64 Msys

With 3.6.1, we've seen issues launching `perl.exe` before this patch:
https://github.com/curl/curl/discussions/14854#discussioncomment-12908214
https://github.com/curl/curl/discussions/14854#discussioncomment-12921007

Follow-up to b06c12b7248592cf001e621d7cd8dc78a827212b #16574
Closes #17151

7 months agocmake: fix `fish` install directory detection via `pkg-config`
Viktor Szakats [Wed, 23 Apr 2025 08:52:06 +0000 (10:52 +0200)] 
cmake: fix `fish` install directory detection via `pkg-config`

Follow-up to c8b0f0c9ad78eafc6c8f0005113de346ee797c21 #16833

Closes #17147

7 months agodoh: make sure CURLOPT_PROTOCOLS is set a with a "long" arg
Daniel Stenberg [Wed, 23 Apr 2025 06:19:56 +0000 (08:19 +0200)] 
doh: make sure CURLOPT_PROTOCOLS is set a with a "long" arg

Closes #17142

7 months agoruntests: fix indentation [ci skip]
Viktor Szakats [Tue, 22 Apr 2025 19:10:39 +0000 (21:10 +0200)] 
runtests: fix indentation [ci skip]

Cherry-picked from #16840

7 months agocmake: avoid 'target is imported but not globally visible' when consuming libcurl...
Viktor Szakats [Tue, 22 Apr 2025 08:36:16 +0000 (10:36 +0200)] 
cmake: avoid 'target is imported but not globally visible' when consuming libcurl with old cmake

Fixes:
```
CMake Error at bld-curl/_pkg/lib/cmake/CURL/CURLConfig.cmake:62 (add_library):
  add_library cannot create ALIAS target "CURL::libcurl" because target
  "CURL::libcurl_shared" is imported but not globally visible.
Call Stack (most recent call first):
  CMakeLists.txt:39 (find_package)
```

tests/cmake reproducer (requires #16973):
```shell
export CMAKE_CONSUMER=/path/to/CMake-3.12.0/bin/cmake
./test.sh find_package
```

I don't understand what this error says, why it happens in certain CMake
versions, and why a workaround is necessary for what seems like
a standard export/consume configuration. This patch is based on internet
suggestions and other projects ending up with this workaround.

Cherry-picked from #16973
Closes #17140

7 months agoopenssl-quic: avoid potential `-Wnull-dereference`, add assert
Viktor Szakats [Sun, 20 Apr 2025 08:13:52 +0000 (10:13 +0200)] 
openssl-quic: avoid potential `-Wnull-dereference`, add assert

Seen with curl-for-win, OpenSSL QUIC, gcc 14.2.0, cmake unity mode.

Silences:
```
In file included from _x86-win-ucrt-bld/lib/CMakeFiles/libcurl_object.dir/Unity/unity_5_c.c:55:
In function 'cf_osslq_check_and_unblock',
    inlined from 'cf_progress_egress' at lib/vquic/curl_osslq.c:1730:12:
lib/vquic/curl_osslq.c:1581:11: error: potential null pointer dereference [-Werror=null-dereference]
 1581 |           nghttp3_conn_unblock_stream(ctx->h3.conn, stream->s.id);
      |           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/vquic/curl_osslq.c:1582:34: error: potential null pointer dereference [-Werror=null-dereference]
 1582 |           stream->s.send_blocked = FALSE;
      |                                  ^
```

Co-authored-by: Daniel Stenberg
Co-authored-by: Stefan Eissing
Closes #17107

7 months agoGHA: always use Ninja on macos runners
Viktor Szakats [Mon, 21 Apr 2025 02:00:36 +0000 (04:00 +0200)] 
GHA: always use Ninja on macos runners

It's installed by default on the macos runners now.

Closes #17115

7 months agoGHA/windows: bump cygwin/cygwin-install-action
dependabot[bot] [Mon, 21 Apr 2025 15:50:58 +0000 (15:50 +0000)] 
GHA/windows: bump cygwin/cygwin-install-action

to https://github.com/cygwin/cygwin-install-action/commit/f2009323764960f80959895c7bc3bb30210afe4d

Closes #17118

7 months agolib: add meta_hash to connection, eliminate hash_offt
Stefan Eissing [Fri, 18 Apr 2025 09:03:29 +0000 (11:03 +0200)] 
lib: add meta_hash to connection, eliminate hash_offt

With a meta_hash at each connection (similar to easy handle, let
multi_ev.c store its pollsets as meta data, no longer needing its own
hashes.

This eliminates the last use of Curl_hash_offt. Remove it.

Closes #17095

7 months agohttp: fix HTTP/2 handling of TE request header using "trailers"
Stefan Eissing [Tue, 22 Apr 2025 10:53:22 +0000 (12:53 +0200)] 
http: fix HTTP/2 handling of TE request header using "trailers"

A "TE" request header is allowed in HTTP/2 when it only carries the
"trailers" value. RFC 9113 ch. 8.2.2. Check client supplied TE values
for the "trailers" token and only pass that one in a HTTP/2 request.

Add test_01_17 to verify.

Fixes #17122
Reported-by: epicmkirzinger on github
Closes #17128

7 months agovquic: unblame netbsd
Stefan Eissing [Tue, 22 Apr 2025 12:23:31 +0000 (14:23 +0200)] 
vquic: unblame netbsd

it was innocent.

Follow-up to 4872dafd8075fab781b7a3ac

Closes #17133

7 months agoconnect: shutdown timer fix
Stefan Eissing [Tue, 22 Apr 2025 13:23:36 +0000 (15:23 +0200)] 
connect: shutdown timer fix

Fix a bug in timeout handling for connection shutdowns that led to
default timeout of 2 seconds not being in effect.

Only set the shutdown timeout expiry when operating on a non-admin
transfers. Admin handles are only temproarily tied to a connection.

Fixes #17130
Reported-by: Rasmus Melchior Jacobsen
Closes #17135

7 months agocares: fix missing lazy init for CURLOPT_DNS_SERVERS
Stefan Eissing [Tue, 22 Apr 2025 09:02:41 +0000 (11:02 +0200)] 
cares: fix missing lazy init for CURLOPT_DNS_SERVERS

When setting option CURLOPT_DNS_SERVERS, the ares channel was not
properly initialized and the setting failed.

Fixes #17119
Reported-by: calvin2021y on github
Closes #17127

7 months agovquic: init for every call to recvmsg
Stefan Eissing [Tue, 22 Apr 2025 11:12:24 +0000 (13:12 +0200)] 
vquic: init for every call to recvmsg

When calling recvmsg(), always set up the msg structures for
each call as there are OS implemenations that change members
of msg.

Fixes #17120
Reported-by: Harry Sintonen
Closes #17131

7 months agovquic: consistent name for the stream struct across backends
Daniel Stenberg [Sun, 20 Apr 2025 21:24:52 +0000 (23:24 +0200)] 
vquic: consistent name for the stream struct across backends

Now known as "struct h3_stream_ctx" in all four backends.

Also as a bonus: a single definition of the H3_STREAM_CTX macro

Closes #17113

7 months agocurl/curlver.h: next version is 8.14.0
Daniel Stenberg [Tue, 22 Apr 2025 07:44:34 +0000 (09:44 +0200)] 
curl/curlver.h: next version is 8.14.0

7 months agoRELEASE-NOTES: synced
Daniel Stenberg [Tue, 22 Apr 2025 07:43:55 +0000 (09:43 +0200)] 
RELEASE-NOTES: synced

7 months agohostip: fix build when no async resolvers are present
Daniel Stenberg [Tue, 22 Apr 2025 06:55:21 +0000 (08:55 +0200)] 
hostip: fix build when no async resolvers are present

Fixes #17124
Closes #17125

7 months agoasyn-base: fix build with disabled threaded resolver
Daniel Stenberg [Tue, 22 Apr 2025 05:54:32 +0000 (07:54 +0200)] 
asyn-base: fix build with disabled threaded resolver

... but *with* DoH.

Fixes #17121
Closes #17123

7 months agoCURLOPT_ERRORBUFFER.md: the buffer is read only after curl takes ownership
Max Eliaser [Sat, 19 Apr 2025 21:08:06 +0000 (14:08 -0700)] 
CURLOPT_ERRORBUFFER.md: the buffer is read only after curl takes ownership

Clarifies #17100
Closes #17105

7 months agolib: use BIT() instead of bool in structs more
Daniel Stenberg [Sun, 20 Apr 2025 22:08:22 +0000 (00:08 +0200)] 
lib: use BIT() instead of bool in structs more

Since it makes use of bitfields on supported platforms, it saves a few
bytes memory. Might as well use it consistently.

Closes #17114

7 months agowcurl: import v2025.04.20 script + docs
Daniel Stenberg [Fri, 11 Apr 2025 21:17:03 +0000 (23:17 +0200)] 
wcurl: import v2025.04.20 script + docs

Build/install the man page. Install the script.

This an "import" rather than just adding the script into the release tarball
with maketgz to make sure the tarball build is completely reproducible.

wcurl development, issues etc is still to be done at
https://github.com/curl/wcurl

Assisted-by: Viktor Szakats
Assisted-by: Samuel Henrique
Closes #17035

7 months agotool_getparam: clear argument only when needed
Daniel Stenberg [Tue, 15 Apr 2025 15:27:47 +0000 (17:27 +0200)] 
tool_getparam: clear argument only when needed

Test 699 verifies

Reported-by: bsr13 on hackerone
Closes #17112

7 months agoopenssl-quic: fix printf mask
Viktor Szakats [Sun, 20 Apr 2025 08:08:00 +0000 (10:08 +0200)] 
openssl-quic: fix printf mask

Fixes:
```
lib/vquic/curl_osslq.c:835:25: error: format '%zd' expects argument of type 'signed size_t', but argument 6 has type 'curl_off_t' {aka 'long long int'} [-Werror=format=]
  835 |   CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] DATA len=%zu, total=%zd",
      |                         ^~~~
  836 |               stream->s.id, buflen, stream->download_recvd);
      |                                     ~~~~~~~~~~~~~~~~~~~~~~
      |                                           |
      |                                           curl_off_t {aka long long int}
```

Closes #17106

7 months agoGHA/linux: tidy up around wolfSSH
Viktor Szakats [Sun, 20 Apr 2025 09:59:06 +0000 (11:59 +0200)] 
GHA/linux: tidy up around wolfSSH

- fix filter expression for cache step.
  It did not cause an issue because `wolfssh` is always paired with
  a `wolfssl*`.

- build `wolfssh` against `wolfssl-opensslextra` (was: `wolfssl-all`).
  It makes `wolfssh` builds `OPENSSL_COEXIST`-compatible, and clarifies
  its use in the clang-tidy job. The earlier mixup didn't cause issues
  because the clang-tidy job is compile-only (using their headers only.)
  Useful side-effect is making the wolfssh build valgrind-tested.

Reported-by: bo0tzz on github
Ref: https://github.com/curl/curl/discussions/16970#discussioncomment-12752019

Closes #17109

7 months agoGHA/windows: enable MSYS2 `diffutils` on ARM64
Viktor Szakats [Sat, 19 Apr 2025 08:31:51 +0000 (10:31 +0200)] 
GHA/windows: enable MSYS2 `diffutils` on ARM64

https://packages.msys2.org/packages/mingw-w64-clang-aarch64-diffutils

Thanks-to: Christoph Reiter
Ref: https://github.com/curl/curl/pull/17067#issuecomment-2816599349

Closes #17103

7 months agocmake: link `crypt32` for OpenSSL feature detection
Viktor Szakats [Sat, 19 Apr 2025 07:34:35 +0000 (09:34 +0200)] 
cmake: link `crypt32` for OpenSSL feature detection

Also fix to link the winsock library for WinCE there.

Reported-by: Jixinqi
Fixes #17101
Closes #17102

7 months agoruntests: add retry option to reduce flakiness
Viktor Szakats [Thu, 17 Apr 2025 14:25:37 +0000 (16:25 +0200)] 
runtests: add retry option to reduce flakiness

Add `--retry=<num>` option to tell runtests to retry the first `<num>`
tests that failed. Retries aren't run right away, but added to the end
of the test queue. Once all retry slots are used, test fail as normal.

In CI, typically a single test fails for flakiness, and rarely over 5.

Make the `ci-test` targets default to `--retry=5`.

Closes #17091

7 months agoRELEASE-NOTES: synced
Daniel Stenberg [Fri, 18 Apr 2025 22:05:37 +0000 (00:05 +0200)] 
RELEASE-NOTES: synced

7 months agowebsocket: add option to disable auto-pong reply
Brian Chrzanowski [Wed, 24 Jul 2024 02:15:23 +0000 (22:15 -0400)] 
websocket: add option to disable auto-pong reply

This adds another bitflag on CURLOPT_WS_OPTIONS (CURLWS_NOAUTOPONG) that
disables the default and automatic PONG reply in the WebSocket layer.

Assisted-by: Calvin Ruocco
Closes #16744

7 months agoquic: no local idle connection timeout, ngtcp2 keep-alive
Stefan Eissing [Tue, 15 Apr 2025 08:55:59 +0000 (10:55 +0200)] 
quic: no local idle connection timeout, ngtcp2 keep-alive

Do not set a transport parameter idle timeout, meaning we have no such
thing from our side. The remote setting then applies.

In ngtcp2, set its "keep-alive" timer to prevent a possible remote idle
timeout to tear down the connection while we have active transfers on
that connection.

Closes #17057

7 months agocf-https-connect: use the passed in dns struct pointer
Daniel Stenberg [Thu, 17 Apr 2025 20:49:29 +0000 (22:49 +0200)] 
cf-https-connect: use the passed in dns struct pointer

... instead of digging it out from the connection struct.

Plus: simplify struct referencing in the condition.

Closes #17092

7 months agodoh: reduce the DNS request buffer size
Daniel Stenberg [Thu, 17 Apr 2025 15:54:59 +0000 (17:54 +0200)] 
doh: reduce the DNS request buffer size

No point in having it larger than the largest allowed request size.

Also removed a no longer used struct.

Closes #17087

7 months agodoh: httpsrr fix
sftcd [Fri, 18 Apr 2025 16:12:23 +0000 (17:12 +0100)] 
doh: httpsrr fix

Closes #17099

7 months agocmake: fix shell completion install when just one flavor is enabled
Viktor Szakats [Fri, 18 Apr 2025 07:46:59 +0000 (09:46 +0200)] 
cmake: fix shell completion install when just one flavor is enabled

Also:
- tidy up the `if` tree.
- drop `include(GNUInstallDirs)` in favor of the upper-level one.

Reported-by: Daniel Engberg
Bug: https://github.com/curl/curl/issues/16946#issuecomment-2814663246
Follow-up to c8b0f0c9ad78eafc6c8f0005113de346ee797c21 #16833

Closes #17094

7 months agoGHA/windows: add 2 basic MSVC jobs to restore some CI coverage
Viktor Szakats [Thu, 17 Apr 2025 17:21:38 +0000 (19:21 +0200)] 
GHA/windows: add 2 basic MSVC jobs to restore some CI coverage

To keep testing these with MSVC:
- UWP !ssl
- arm64 build on the `windows-11-arm` runner
- examples
- OpenSSH-Windows (fix install on `windows-11-arm`)
- `windows-2025` runner
- cmake pre-fill checker

Surprise: UWP doesn't support SSPI, which is required by curl's Schannel
backend. Thus, no TLS support for this UWP build. It also suggests
the Schannel UWP mingw-w64 binaries may be broken and just a happy build
accident thanks to mingw-w64 headers being inaccurate.

Building zlib + libssh2 might actually take up to 2+ minutes with vcpkg,
instead of the previously estimated <1.5 minutes.

Follow-up to e3912f0f9fac06d37cd1ab93cef4f01f33809f0b #17086
Follow-up to 15fb1dc7f86ad1832e0386ec7d92542f44ee9c44 #17069

Closes #17089

7 months agoruntests: recognize lowercase `windows` in `curl -V`
Viktor Szakats [Thu, 17 Apr 2025 14:52:52 +0000 (16:52 +0200)] 
runtests: recognize lowercase `windows` in `curl -V`

As in vcpkg triplets. Test it in CI.

Closes #17088

7 months agoGHA/windows: restore a simple vcpkg job (zlib + libssh2)
Viktor Szakats [Thu, 17 Apr 2025 14:59:04 +0000 (16:59 +0200)] 
GHA/windows: restore a simple vcpkg job (zlib + libssh2)

To keep the basics tested. Building zlib and libssh2 takes <1.5 minutes.

So far it seems the "lost" vcpkg binary cache is not a vcpkg-tool
regression, but a GitHub server-side deprecation combined with lack of
replacement service or lack of vcpkg support for such service.

Ref: https://github.blog/changelog/2025-03-20-notification-of-upcoming-breaking-changes-in-github-actions/
Ref: https://github.com/microsoft/vcpkg/issues/45073

Follow-up to 15fb1dc7f86ad1832e0386ec7d92542f44ee9c44 #17069

Closes #17086

7 months agopytest: make test_07_22 more lenient to exit codes
Stefan Eissing [Thu, 17 Apr 2025 09:05:28 +0000 (11:05 +0200)] 
pytest: make test_07_22 more lenient to exit codes

Depending on timing when the server aborting the connection is detected,
the reported curl exit code may vary. Check for the possible set of
expected codes instead of a single one.

Closes #17083

7 months agomulti: do transfer book keeping using mid
Stefan Eissing [Tue, 25 Mar 2025 08:47:40 +0000 (09:47 +0100)] 
multi: do transfer book keeping using mid

Change multi's book keeping of transfers to no longer use lists, but a
special table and bitsets for unsigned int values.

`multi-xfers` is the `uint_tbl` where `multi_add_handle()` inserts a new
transfer which assigns it a unique identifier `mid`. Use bitsets to keep
track of transfers that are in state "process" or "pending" or
"msgsent".

Use sparse bitsets to replace `conn->easyq` and event handlings tracking
of transfers per socket. Instead of pointers, keep the mids involved.

Provide base data structures and document them in docs/internal:
* `uint_tbl`: a table of transfers with `mid` as lookup key,
   handing out a mid for adds between 0 - capacity.
* `uint_bset`: a bitset keeping unsigned ints from 0 - capacity.
* `uint_spbset`: a sparse bitset for keeping a small number of
  unsigned int values
* `uint_hash`: for associating `mid`s with a pointer.

This makes the `mid` the recommended way to refer to transfers inside
the same multi without risk of running into a UAF.

Modifying table and bitsets is safe while iterating over them. Overall
memory requirements are lower as with the double linked list apprach.

Closes #16761

7 months agotests/server/dnsd: basic DNS server for test suite
Daniel Stenberg [Wed, 9 Apr 2025 07:47:43 +0000 (09:47 +0200)] 
tests/server/dnsd: basic DNS server for test suite

Currently the DNS server only responds to A and AAAA queries. It always
responds with a fixed response: the localhost address. Three times.

It should work fine over either IPv4 or IPv6, but I don't think it
matters much for curl testing.

The idea is to allow curl tests to use "normal" DNS hostnames (using the
normal name resolving code paths) and still use the local test servers.

This setup currently only works if curl is built with c-ares because
redirecting DNS requests to our test server when using getaddrinfo() is
not easy.

This should be extended to respond to HTTPS queries as well to allow
more testing there, as c-ares is always used for that.

Test 2102 is the first test using this.

Closes #17015

7 months agohostip: remove duplicate assignment
Daniel Stenberg [Thu, 17 Apr 2025 05:58:14 +0000 (07:58 +0200)] 
hostip: remove duplicate assignment

Follow-up from 56e40ae6a532850b503

Pointed out by CodeSonar

Closes #17080

7 months agoGHA: update ngtcp2/nghttp3 to v1.9.0
renovate[bot] [Wed, 16 Apr 2025 12:22:33 +0000 (12:22 +0000)] 
GHA: update ngtcp2/nghttp3 to v1.9.0

Closes #17073

7 months agoscripts: drop unused import, formatting
Viktor Szakats [Wed, 16 Apr 2025 19:47:46 +0000 (21:47 +0200)] 
scripts: drop unused import, formatting

Ref: #16840
Closes #17077

7 months agovquic: ngtcp2 + openssl support
Stefan Eissing [Wed, 16 Apr 2025 14:16:26 +0000 (16:16 +0200)] 
vquic: ngtcp2 + openssl support

With the new addition of OpenSSL QUIC API support and the support in
ngtcp2 main branch, make the necessary adjustments in curl to support
this combination.

- add support in configure.ac to detect the feature OPENSSL_QUIC_API2 in
  openssl
- initialise ngtcp2 properly in this combination
- add a Curl_vquic_init() for global initialisation that ngtcp2 likes
  for performance reasons
- add documentation on how to build in docs/HTTP3.md
- add CI testing in http3-linux.yml

Assisted-by: Viktor Szakats
Closes #17027

7 months agocmake: add openssl 3.5.0 + ngtcp2 support
Viktor Szakats [Fri, 11 Apr 2025 00:02:52 +0000 (02:02 +0200)] 
cmake: add openssl 3.5.0 + ngtcp2 support

```
curl 8.13.1-DEV (Darwin) libcurl/8.13.1-DEV OpenSSL/3.5.0 [...] ngtcp2/1.12.90 nghttp3/1.9.0
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Largefile libz NTLM PSL SSL threadsafe TLS-SRP UnixSockets zstd
```

Ref: #17027
Closes #17018

7 months agoasyn-ares: fix build with old c-ares
Daniel Stenberg [Wed, 16 Apr 2025 14:18:10 +0000 (16:18 +0200)] 
asyn-ares: fix build with old c-ares

See https://app.circleci.com/pipelines/github/curl/curl/13081/workflows/7d80b69e-9886-4f4c-b467-0fa321a0f8c2/jobs/130479

Closes #17075

7 months agoasync: DoH improvements
Stefan Eissing [Wed, 16 Apr 2025 11:45:53 +0000 (13:45 +0200)] 
async: DoH improvements

Adds a "meta_hash" to each easy handle for keeping special data during
operations. All meta data set needs to add its destructor callback, so
that meta data gets destroyed properly when the easy handle is cleaned
up or reset.

Add data->master_mid for "sub" transfers that belong to a "master" easy
handle. When a "sub" transfer is done, the corresponding "master" can
add a callback to be invoked. Used in DoH name resolution.

DoH: use easy meta hash to add internal structs for DoH name resolution.
One in each in each probe easy handle. When probes are done, response
data is copied from the probe to the initiating easy.

This allows DoH using transfers and their probes to be cleaned up in any
sequence correctly.

Fold DoH cleanup into the Curl_async_shutdown() and Curl_async_destroy()
functions.

Closes #16384

7 months agocmake: enable `-Wall` for MSVC when `PICKY_COMPILER=ON`
Viktor Szakats [Mon, 14 Apr 2025 10:56:30 +0000 (12:56 +0200)] 
cmake: enable `-Wall` for MSVC when `PICKY_COMPILER=ON`

Enable it for `_MSC_VER <= 1943`.

Omit it for not yet CI-tested MSVC versions, to avoid hitting unfixed
warnings emitted by future toolchain releases. It means we need
to explicitly opt-in to newer MSVC versions while fixing any new issues.

The newly enabled warnings did not reveal new issues. It hints that we
catch those with clang/gcc. Yet, these warnings may be useful for local
development done with MSVC.

Also:
- disable and document warnings that don't seem useful, unactionable,
  or unfixable.
- disable and document warnings found in Windows SDK headers.
- tidy up a few comments, also to avoid
  `-Wdocumentation-unknown-command`, part of llvm/clang `-Wall`.
  ```
  lib\dynhds.h(159,29): error : unknown command tag name [-Werror,-Wdocumentation-unknown-command]
  lib\ftp.c(337,15): error : unknown command tag name [-Werror,-Wdocumentation-unknown-command]
  ```
  (This patch did not end up enabling `-Wall` for clang-cl.)

Closes #17050

7 months agocmake: do not install `mk-ca-bundle` script and manpage
Viktor Szakats [Tue, 15 Apr 2025 23:26:53 +0000 (01:26 +0200)] 
cmake: do not install `mk-ca-bundle` script and manpage

To sync with autotools builds.

Reported-by: Daniel Stenberg
Bug: https://github.com/curl/curl/pull/17035#pullrequestreview-2769964979
Follow-up to 5023ffad2c27d4b916ddb91800f99ecc5d3aad07 #13197

Closes #17068

7 months agoGHA: automatic vcpkg binary cache is broken, temporarily disable vcpkg jobs
Viktor Szakats [Wed, 16 Apr 2025 02:18:33 +0000 (04:18 +0200)] 
GHA: automatic vcpkg binary cache is broken, temporarily disable vcpkg jobs

In the last 1-2 days, curl's vcpkg binary cache entries stored by GHA
apparently disappeared, and each vcpkg job is now rebuilding everything
on every run. This takes up to 40 minutes per job. New cache entries
fail on upload with messages like:
```
Completed submission of nghttp2:arm64-android@1.65.0 to 0 binary cache(s) in 172 ms
```
(note the zero.)

This coincided with my adding support for windows-11-arm and touching
some jobs affected. Yet, unrelated. It also affects Android jobs. The root
cause is a runner image update bumping the vcpkg tool.

The latest vcpkg tool also has this issue.

As a temporary workaround, stop using vcpkg in CI.

Last good run: https://github.com/curl/curl/actions/runs/14473789417/job/40594304523
First bad run: https://github.com/curl/curl/actions/runs/14474616982/job/40597095025

Assisted-by: Tal Regev
Ref: #17070

Closes #17069

7 months agoRELEASE-NOTES: synced
Daniel Stenberg [Wed, 16 Apr 2025 07:49:54 +0000 (09:49 +0200)] 
RELEASE-NOTES: synced