]> git.ipfire.org Git - thirdparty/curl.git/log
thirdparty/curl.git
10 months agoRELEASE: synced curl-8_11_1
Daniel Stenberg [Wed, 11 Dec 2024 07:05:13 +0000 (08:05 +0100)] 
RELEASE: synced

curl 8.11.1 release

10 months agoTHANKS: contributors from 8.11.1
Daniel Stenberg [Wed, 11 Dec 2024 07:05:13 +0000 (08:05 +0100)] 
THANKS: contributors from 8.11.1

10 months agobuild: fix tests when documentation/manual is disabled
Viktor Szakats [Mon, 9 Dec 2024 00:57:32 +0000 (01:57 +0100)] 
build: fix tests when documentation/manual is disabled

- build: fix to exclude 'documentation' tests when building
  the documentation is explicitly disabled. Both for cmake
  and `./configure`.

Reported-by: Daniel Engberg
  Fixes #15703

- test481, test482: fix for builds with no manual.

Reported-by: Daniel Engberg
  Fixes #15703

- configure: fix to always detect Perl. Running tests require
  it when run. Before this patch Perl wasn't detected when
  documentation/manual/embedded-CA were all disabled,
  making tests fail to start.

- test1177: add keyword `documentation`. It depends no
  `curl_version_info.3`.

- GHA/linux: test cmake and `./configure` with docs and
  manual disabled and tests run.

Closes #15704

10 months agoGHA: update four depencencies
renovate[bot] [Tue, 3 Dec 2024 14:02:51 +0000 (14:02 +0000)] 
GHA: update four depencencies

- github/codeql-action digest to aa57810
- cross-platform-actions/action action to v0.26.0
- actions/cache digest to 1bd1e32
- msys2/setup-msys2 digest to d44ca8e

Closes #15674
Closes #15686
Closes #15696
Closes #15702

10 months agodocs: bring back ALTSVC.md and HSTS.md
Daniel Stenberg [Mon, 9 Dec 2024 07:52:01 +0000 (08:52 +0100)] 
docs: bring back ALTSVC.md and HSTS.md

This partly reverts 0e06603b2318356ba78b2f

These file formats are not properly documented elsewhere, plus the
website uses these files to populate the documentation pages to which
users end up via the URLs that are mentioned within the alt-svc and hsts
files.

Fixes #15705
Reported-by: Jeffrey Bosboom
Closes #15706

10 months agotest2086: disable MSYS2's POSIX path conversion
Marcel Raad [Wed, 4 Dec 2024 00:12:50 +0000 (01:12 +0100)] 
test2086: disable MSYS2's POSIX path conversion

Older MSYS2 versions treat the URL as paths list and convert them from
UNIX to Windows format. There's no path here that needs to be
converted, so disable path conversion for this test as done for others.

Fixes https://github.com/curl/curl/pull/15644#issuecomment-2511313206
Closes https://github.com/curl/curl/pull/15677

11 months agomprintf: fix the integer overflow checks
Daniel Stenberg [Fri, 6 Dec 2024 15:01:50 +0000 (16:01 +0100)] 
mprintf: fix the integer overflow checks

When a floating point precision or string width are provided as a
base-10 number, the code could miss to detect integer overflows if the
provided value was exactly 2147483648 or 2147483649 (2147483647 being
the maxium value a signed integer can hold).

The chance that such values would actually ever be used is slim.

This change fixes the detection to also cover those edge cases.

Closes #15699

11 months agoRELEASE-NOTES: synced
Daniel Stenberg [Fri, 6 Dec 2024 08:24:45 +0000 (09:24 +0100)] 
RELEASE-NOTES: synced

11 months agotool_getparam: remove Redundant Condition
Daniel Stenberg [Fri, 6 Dec 2024 06:48:11 +0000 (07:48 +0100)] 
tool_getparam: remove Redundant Condition

Pointed out by CodeSonar

Closes #15698

11 months agohostip: don't use the resolver for FQDN localhost
Jay Satiro [Tue, 3 Dec 2024 20:56:07 +0000 (15:56 -0500)] 
hostip: don't use the resolver for FQDN localhost

- Treat `[<any>.]localhost.` (ie localhost with FQDN period terminator)
  as fixed value 127.0.0.1 and ::1 instead of querying the resolver.

Prior to this change, b5c0fe20 (precedes 7.85.0) did the same for
non-FQDN `<any>.localhost`.

Prior to this change, 1a0ebf66 (precedes 7.78.0) did the same for
non-FQDN `localhost`.

Ref: https://github.com/curl/curl/issues/15628#issuecomment-2515540315

Closes https://github.com/curl/curl/pull/15676

11 months agohttp_negotiate: allow for a one byte larger channel binding buffer
Daniel Stenberg [Thu, 5 Dec 2024 17:24:45 +0000 (18:24 +0100)] 
http_negotiate: allow for a one byte larger channel binding buffer

The channel binding data dynbuf was not set correctly making it fail with
CURLE_TOO_LARGE too easily.

Reported-by: galen11 on github
Fixes #15685
Closes #15694

11 months agocmake: set `CURL_STATICLIB` for static lib when `SHARE_LIB_OBJECT=OFF`
chemodax [Thu, 5 Dec 2024 16:52:12 +0000 (17:52 +0100)] 
cmake: set `CURL_STATICLIB` for static lib when `SHARE_LIB_OBJECT=OFF`

When compiled with BUILD_STATIC_LIBS=ON and SHARE_LIB_OBJECT=OFF compile
definition CURL_STATICLIB was not set for static library. It seems to be
copy-paste error in the lib/CMakeLists.txt.

This pull request fixes it.

Closes #15695

11 months agomime: fix reader stall on small read lengths
Stefan Eissing [Thu, 5 Dec 2024 11:37:38 +0000 (12:37 +0100)] 
mime: fix reader stall on small read lengths

The base64 mime encoder stalls when it cannot encode a full 3 byte input
set into the read buffer. The workaround for this limitation was
incomplete and could lead to stalled transfers when the last chunk to
upload was smaller than 4 bytes.

Use a tmp buffer on small reads to allow mime encoders more space to put
their things.

Add test case reproducing the issue and fix.

Reported-by: Alexis Savin
Fixes #15688
Closes #15691

11 months agodmaketgz: use --no-cache when building docker image
andrewkirillov-ibm [Thu, 5 Dec 2024 10:48:50 +0000 (10:48 +0000)] 
dmaketgz: use --no-cache when building docker image

Fixes #15689
Closes #15690

11 months agotool_getparam: parse --localport without using sscanf
Daniel Stenberg [Wed, 4 Dec 2024 10:53:21 +0000 (11:53 +0100)] 
tool_getparam: parse --localport without using sscanf

and switch to str2unummax() for the number parsings

Closes #15681

11 months agotool_formparse: remove use of sscanf()
Daniel Stenberg [Wed, 4 Dec 2024 12:59:52 +0000 (13:59 +0100)] 
tool_formparse: remove use of sscanf()

In the function for handling 'type=' in the -F command line arguments,
we make the code more lax to accept more strings and thereby also avoid
the use of sscanf().

Closes #15683

11 months agotool_urlglob: parse character globbing range without sscanf
Daniel Stenberg [Wed, 4 Dec 2024 12:45:21 +0000 (13:45 +0100)] 
tool_urlglob: parse character globbing range without sscanf

A step towards a future without sscanf() calls.

Closes #15682

11 months agodigest: produce a shorter cnonce in Digest headers
Daniel Stenberg [Tue, 3 Dec 2024 06:52:48 +0000 (07:52 +0100)] 
digest: produce a shorter cnonce in Digest headers

Other programs (Postman, Chrome, Python request) use a 16 byte cnonce
and there are instances of server-side implementations that don't
support the larger lengths curl used previously.

Fixes #15653
Reported-by: Florian Eckert
Closes #15670

11 months agocurl: do more command line parsing in sub functions
Daniel Stenberg [Wed, 4 Dec 2024 09:23:47 +0000 (10:23 +0100)] 
curl: do more command line parsing in sub functions

This moves argument parsing logic for a number of options into sub
functions to reduce the overall complexity of the single getparameter()
function. pmccabe says it takes complexity down from 234 to 147.

The command line options that now has dedicated parser funtions are:

 --continue-at, --ech, --header, --localport, --output, --quote, --range
 --remote-name, --time-cond, --upload-file, --url, --verbose, --writeout

These parsers were selected for thise because they had more than 15
lines of logic in the main switch(). Detected like this:

 git grep -hn 'case C_' tool_getparam.c |
  cut -d: -f1 |
  awk '{if(($1 - prev) > 15) { printf "%d\n", prev;} prev = $1;}'

Closes #15680

11 months agoopenssl: remove three "Useless Assignments"
Daniel Stenberg [Wed, 4 Dec 2024 06:17:43 +0000 (07:17 +0100)] 
openssl: remove three "Useless Assignments"

Pointed out by CodeSonar

Closes #15679

11 months agoliub: fixes for wolfSSL OPENSSL_COEXIST
Daniel Pouzzner [Tue, 3 Dec 2024 14:57:58 +0000 (08:57 -0600)] 
liub: fixes for wolfSSL OPENSSL_COEXIST

For MD4, MD5, and DES

Assisted-by: Viktor Szakats
Closes #15650

11 months agoKNOWN_BUGS: setting a disabled option should return CURLE_NOT_BUILT_IN
Daniel Stenberg [Tue, 3 Dec 2024 16:15:06 +0000 (17:15 +0100)] 
KNOWN_BUGS: setting a disabled option should return CURLE_NOT_BUILT_IN

Reported-by: Jeroen Ooms
Closes #15472
Closes #15675

11 months agoRELEASE-NOTES: synced
Daniel Stenberg [Tue, 3 Dec 2024 16:21:42 +0000 (17:21 +0100)] 
RELEASE-NOTES: synced

11 months agohttp_proxy: move dynhds_add_custom here from http.c
Daniel Stenberg [Tue, 3 Dec 2024 12:24:38 +0000 (13:24 +0100)] 
http_proxy: move dynhds_add_custom here from http.c

... and make it static. As it is not used anywhere else.

Closes #15672

11 months agoopenssl: stop using SSL_CTX_ function prefix for our functions
Daniel Stenberg [Tue, 3 Dec 2024 12:42:36 +0000 (13:42 +0100)] 
openssl: stop using SSL_CTX_ function prefix for our functions

It is a prefix already taken and is used by OpenSSL

Closes #15673

11 months agoDockerfile: Update debian:bookworm-slim Docker digest to b73bf02
renovate[bot] [Tue, 3 Dec 2024 07:48:02 +0000 (07:48 +0000)] 
Dockerfile: Update debian:bookworm-slim Docker digest to b73bf02

Closes #15671

11 months agoCI: update dependencies
renovate[bot] [Mon, 25 Nov 2024 15:18:48 +0000 (15:18 +0000)] 
CI: update dependencies

- ngtcp2/ngtcp2 to v1.9.1
- github/codeql-action digest to f09c1c0
- rustls/rustls-ffi to v0.14.1
- awslabs/aws-lc to v1.40.0

Closes #15616
Closes #15619
Closes #15629
Closes #15651

11 months agolibssh: use libssh sftp_aio to upload file
xiaofeng [Fri, 22 Nov 2024 07:02:00 +0000 (15:02 +0800)] 
libssh: use libssh sftp_aio to upload file

Support async sftp upload for curl built with libssh.

Closes #15625

11 months agocurl: --continue-at is mutually exclusive with --remove-on-error
Daniel Stenberg [Mon, 2 Dec 2024 13:12:29 +0000 (14:12 +0100)] 
curl: --continue-at is mutually exclusive with --remove-on-error

Test 482 verifies

Fixes #15645
Reported-by: Harry Sintonen
Closes #15668

11 months agocurl: --continue-at is mutually exclusive with --no-clobber
Daniel Stenberg [Mon, 2 Dec 2024 13:07:45 +0000 (14:07 +0100)] 
curl: --continue-at is mutually exclusive with --no-clobber

Test 481 verifies

Fixes #15645
Reported-by: Harry Sintonen
Closes #15668

11 months agocurl: use realtime in trace timestamps
Stefan Eissing [Tue, 26 Nov 2024 10:18:06 +0000 (11:18 +0100)] 
curl: use realtime in trace timestamps

Timestamps in trace logs used a mix of realtime and monotonic time
sources, leading to fractional seconds carrying wrong values. Use
realtime only, so the correct nanoseconds are printed.

Fixes #15614
Reported-by: jethrogb on github
Closes #15641

11 months agoOpenSSL: improvde error message on expired certificate
Stefan Eissing [Tue, 19 Nov 2024 13:44:02 +0000 (14:44 +0100)] 
OpenSSL: improvde error message on expired certificate

Fix regression that no longer printed the error messages about expired
certificates in openssl. Add test case for openssl/gnutls/wolfssl.

Fixes #15612
Reported-by: hiimmat on github
Closes #15613

11 months agopytest: add test for use of CURLMOPT_MAX_HOST_CONNECTIONS
Stefan Eissing [Wed, 6 Nov 2024 11:42:34 +0000 (12:42 +0100)] 
pytest: add test for use of CURLMOPT_MAX_HOST_CONNECTIONS

Add test_02_33 to run with various values for the multi option
CURLMOPT_MAX_HOST_CONNECTIONS and CURLOPT_FRESH_CONNECT to trigger
connection pool limit handling code.

Closes #15494

11 months agocurl: --continue-at is mutually exclusive with --range
Daniel Stenberg [Mon, 2 Dec 2024 10:53:54 +0000 (11:53 +0100)] 
curl: --continue-at is mutually exclusive with --range

Allowing both just creates a transfer with behaviors no user can
properly anticipate so better just deny the combo.

Fixes #15646
Reported-by: Harry Sintonen
Closes #15666

11 months agodocs: suggest --ssl-reqd instead of --ftp-ssl
Daniel Stenberg [Thu, 28 Nov 2024 14:24:11 +0000 (21:24 +0700)] 
docs: suggest --ssl-reqd instead of --ftp-ssl

Reported-by: SuperStormer on github
Fixes #15658
Closes #15660

11 months agoRELEASE-NOTES: synced
Daniel Stenberg [Mon, 2 Dec 2024 08:05:37 +0000 (09:05 +0100)] 
RELEASE-NOTES: synced

11 months agosetopt: fix missing options for builds without HTTP & MQTT
Jay Satiro [Tue, 26 Nov 2024 08:50:39 +0000 (03:50 -0500)] 
setopt: fix missing options for builds without HTTP & MQTT

- Restore some necessary options for builds without HTTP and MQTT.

The logic to turn off a segment of options in builds without HTTP and
MQTT was too expansive. Those builds (such as FTP-only builds) could not
use options such as CURLOPT_URL or CURLOPT_USERNAME etc.

Prior to this change 30da1f59 (precedes 8.11.0) refactored the options
processing and caused this issue.

Reported-by: Yoshimasa Ohno
Fixes https://github.com/curl/curl/issues/15634
Closes https://github.com/curl/curl/pull/15640

11 months agoGHA/windows: extend PATH instead copying libcurl.dll
Viktor Szakats [Fri, 29 Nov 2024 09:25:20 +0000 (10:25 +0100)] 
GHA/windows: extend PATH instead copying libcurl.dll

It was already done in cmake jobs, but not in autotools ones.

Follow-up to 1a2d38c47c7825ad4d993d10664a45be3e3bbb58 #15437
Follow-up to 04184d45badeb45ce9166725a15f93742fb09770 #15662

Closes #15663

11 months agotests: add the ending time stamp in testcurl.pl
Dan Fandrich [Thu, 28 Nov 2024 21:22:53 +0000 (13:22 -0800)] 
tests: add the ending time stamp in testcurl.pl

This provides better information on the length of the job and when it
completed.

11 months agoDISTROS: update Alt Linux links
Dan Fandrich [Thu, 28 Nov 2024 21:21:54 +0000 (13:21 -0800)] 
DISTROS: update Alt Linux links

11 months agoGHA/windows: avoid libtool wrapper for test and server executables
Viktor Szakats [Thu, 28 Nov 2024 23:32:44 +0000 (00:32 +0100)] 
GHA/windows: avoid libtool wrapper for test and server executables

This makes `runtests.pl` run the final executables directly.
Before this patch it called the autotools/libtool wrapper tool, which
then called the final executables.

This solution was already used for `curl.exe`.

Applies to tests run in the `mingw, AM x86_64 c-ares U` job, which still
shows unexplained flakiness.

Also makes tests finish 45 seconds faster.

Ref: #14854
Follow-up to 1a2d38c47c7825ad4d993d10664a45be3e3bbb58 #15437
Closes #15662

11 months agocmake: remove legacy unused IMMEDIATE keyword
Peter Kokot [Thu, 28 Nov 2024 22:27:13 +0000 (23:27 +0100)] 
cmake: remove legacy unused IMMEDIATE keyword

This was once supported in CMake 2.x and in current 3.x versions is
ignored.

Closes #15661

11 months agobuild: fix MSVC UWP builds
Viktor Szakats [Wed, 27 Nov 2024 15:21:04 +0000 (16:21 +0100)] 
build: fix MSVC UWP builds

The MSVC UWP job in CI did not actually enable UWP. Fix this and
the fallouts discovered after enabling it.

- GHA/windows: make sure to enable UWP in MSVC vcpkg UWP job.
  Use the CMake options and C flags already used for mingw-w64, but use
  `WINAPI_FAMILY_PC_APP` instead of the deprecated `WINAPI_FAMILY_APP`.
  (The former is not supported by mingw-w64, so leave it there as-is.)
  Follow-up to cb22cfca69bded45bf7f9c72c8e6764990490f11 #14077

- GHA/windows: by default the MSVC UWP job became 2x-3x slower than
  others after actually enabling UWP. Most of it is caused by
  CMake/MSBuild automatically building full APPX containers for each
  `.exe` target. This includes 21 CMake feature detections. Each
  detection app is built into a 15MB APPX project, with code signing,
  logos, etc. Example:
    https://github.com/curl/curl/actions/runs/12056968170/job/33620610958
  Disable this overhead for curl build targets via custom
  `CMAKE_VS_GLOBALS` options. I've found no way to apply them to feature
  detection targets, so those remain slow.

- cmake: automatically enable Unicode for UWP builds. It's required.
  Also stop enabling it manually in the existing CI job.

- tests: fix `getpid()` use for Windows UWP:
  ```
  tests\server\util.c(281,21): warning C4013: 'getpid' undefined; assuming extern returning int
  ```
  Ref: https://github.com/curl/curl/actions/runs/12061215311/job/33632904249#step:11:38

- src/tool_doswin: disable `GetLoadedModulePaths()` for UWP.
  mingw-w64 UWP was okay with this, but MS SDK headers are not.
  This makes `--dump-module-paths` return empty for UWP builds.
  ```
  src\tool_doswin.c(620,3): error C2065: 'MODULEENTRY32': undeclared identifier
  src\tool_doswin.c(626,11): warning C4013: 'CreateToolhelp32Snapshot' undefined; assuming extern returning int
  src\tool_doswin.c(626,36): error C2065: 'TH32CS_SNAPMODULE': undeclared identifier
  src\tool_doswin.c(632,7): warning C4013: 'Module32First' undefined; assuming extern returning int
  ```
  Ref: https://github.com/curl/curl/actions/runs/12055081933/job/33614629930#step:9:35

- examples: fix `websocket.c` to include `winsock2.h` before `windows.h`
  to make it build with MSVC UWP:
  ```
  include\curl\curl.h(143,16): error C2061: syntax error: identifier 'curl_socket_t'
  include\curl\curl.h(143,16): error C2059: syntax error: ';'
  include\curl\curl.h(417,52): error C2146: syntax error: missing ')' before identifier 'curlfd'
  include\curl\curl.h(417,38): error C2081: 'curl_socket_t': name in formal parameter list illegal
  ```
  Ref: https://github.com/curl/curl/actions/runs/12055317910/job/33615644427#step:14:126

- GHA/windows: silence linker warning with MSVC UWP builds:
  ```
  LINK : warning LNK4075: ignoring '/INCREMENTAL' due to '/OPT:ICF' specification
  ```
  Ref: https://github.com/curl/curl/actions/runs/12055696808/job/33616629610#step:11:38

- GHA/windows: set `/INCREMENTAL:NO` for all MSVC jobs to improve
  performance a little.

- cmake: show `UWP` platform flag.

Ref: #15652
Closes #15657

11 months agobuild: fix ECH to always enable HTTPS RR
Viktor Szakats [Tue, 26 Nov 2024 17:03:54 +0000 (18:03 +0100)] 
build: fix ECH to always enable HTTPS RR

The ECH feature cannot be built without HTTPS RR.

ECH automatically implied HTTPS RR in `./configure` but not in CMake,
winbuild, documentation.

Also update documentation and CI configs.

Follow-up to a362962b7289ec02b412890c9515657cf0ed50ac #11922
Closes #15648

11 months agotests: re-enable 2086, and 472, 1299, 1613 for Windows
Viktor Szakats [Tue, 26 Nov 2024 14:08:56 +0000 (15:08 +0100)] 
tests: re-enable 2086, and 472, 1299, 1613 for Windows

- GHA/windows: un-ignore tests 472 1299 1613.
  They were ignored for the mingw-w64 c-ares U job.
  They do run fine now:
  https://github.com/curl/curl/actions/runs/12032875421/job/33547724780?pr=15644

- globally re-enable test 2086.
  Comment says it only affected Windows.
  Seems to be running fine now. Example:
  Windows:
  https://github.com/curl/curl/actions/runs/12032875421/job/33547718309?pr=15644#step:13:3856
  Linux:
  https://github.com/curl/curl/actions/runs/12032875397/job/33545739712#step:41:3650

- update comments for disabled tests 1184, 1801.
  They affect all operating systems, likely all CIs.

  FAIL 1801: 'HTTP/2 upgrade with lying server' HTTP, HTTP/2
  https://github.com/curl/curl/actions/runs/12032362497/job/33544053001#step:14:4265
  FAIL 1184: 'HTTP 1.1 CONNECT with redirect and set -H user-agent' HTTP, HTTP CONNECT, HTTP proxy, proxytunnel
  https://github.com/curl/curl/actions/runs/12032362497/job/33544051415#step:14:5252

Closes #15644

11 months agotool_getpass: replace `getch()` call with `_getch()` on Windows
Viktor Szakats [Tue, 26 Nov 2024 12:03:49 +0000 (13:03 +0100)] 
tool_getpass: replace `getch()` call with `_getch()` on Windows

`getch()` is deprecated according to MSDN:
https://learn.microsoft.com/cpp/c-runtime-library/reference/getch
"The Microsoft-specific function name `getch` is a deprecated alias
for the `_getch` function."

Ref: https://learn.microsoft.com/cpp/c-runtime-library/reference/getch-getwch

Follow-up to 72edb22b8a0e1e62216b59a045147d1a863ad59b #15638
Closes #15642

11 months agoGHA/windows: enable ECH in vcpkg wolfSSL job
Tal Regev [Tue, 26 Nov 2024 16:39:35 +0000 (18:39 +0200)] 
GHA/windows: enable ECH in vcpkg wolfSSL job

Enable ECH feature on wolfSSL

Closes #15649

11 months agoGHA/windows: merge cmake/autotools steps
Viktor Szakats [Tue, 26 Nov 2024 12:22:08 +0000 (13:22 +0100)] 
GHA/windows: merge cmake/autotools steps

Merge cmake and autotools build steps for cygwin, msys2 and
cross-linux jobs.

Advantages:
- makes it easier to keep the two build tracks in sync.
- uses the same steps across jobs.
- avoids scrolling through greyed out steps.
- syncs steps with other workflows already merged like this.
- less code.

Also:
- stop ignoring WebSockets tests results for msys2/mingw-w64 cmake jobs,
  except for 2301 2302 that were also ignored for autotools. Syncing the
  two build methods.
- drop 'cmake' from step names where cmake was the only build tool.
  This was redundant as "CM" already indicates it in the job name.

Closes #15643

11 months agotool_getpass: restore UWP `getpass_r()`, fixup CI builds, fix UWP `-Wnull-dereference`
Viktor Szakats [Tue, 26 Nov 2024 02:17:53 +0000 (03:17 +0100)] 
tool_getpass: restore UWP `getpass_r()`, fixup CI builds, fix UWP `-Wnull-dereference`

- GHA/windows: switch mingw-w64 UWP CI job to use UCRT.
  `msvcr120_app` was missing `getch()` for example.
  Follow-up to f988842d85a06d7ad03764433b6dfee9febf0118 #15637
  This job tests compiling for UWP correctly, but the the resulting
  `curl.exe` still doesn't look like a correct UWP app, now exiting
  on startup with: `curl: error initializing curl library`.

- tool_getpass: restore `getch()` for UWP builds.
  Follow-up to f988842d85a06d7ad03764433b6dfee9febf0118 #15637

- schannel: silence `-Werror=null-dereference` warning in mingw-w64 UWP:
  ```
  lib/vtls/schannel_verify.c: In function 'Curl_verify_host':
  lib/vtls/schannel_verify.c:558:33: error: null pointer dereference [-Werror=null-dereference]
    558 |     for(i = 0; i < alt_name_info->cAltEntry; ++i) {
        |                    ~~~~~~~~~~~~~^~~~~~~~~~~
  lib/vtls/schannel_verify.c:559:50: error: null pointer dereference [-Werror=null-dereference]
    559 |       PCERT_ALT_NAME_ENTRY entry = &alt_name_info->rgAltEntry[i];
        |                                     ~~~~~~~~~~~~~^~~~~~~~~~~~
  ```
  Ref: https://github.com/curl/curl/actions/runs/12022656065/job/33515255397?pr=15638#step:19:27
  Follow-up to 9640a8ef6f0db21da2ee7864423aa28cc3cecce2 #15421

- GHA/windows: fix `find` command in MSVC job step.
  Follow-up to 5f9411f953f35ca84645b5a6824fb9fef20887ed #15380

- GHA/windows: drop unnecessary `windowsappcompat` lib from mingw-w64
  UWP job. Also drop related MSYS2 package.

- GHA/windows: cmake 3.31.0 still invokes `windres` with wrong options
  with mingw-w64 UPW. Update curl version in comment accordingly.

- GHA/windows: tidy up mingw-w64 UWP spec logic, limit it to gcc.

- GHA/windows: update comments on `curl.exe` UWP startup errors.

Closes #15638

11 months agotool_getpass: make local `getpass_r()` a dummy for UWP
renovate[bot] [Sat, 16 Nov 2024 22:40:22 +0000 (22:40 +0000)] 
tool_getpass: make local `getpass_r()` a dummy for UWP

The CRT call `getch()` isn't supported on Windows UWP. This function is
used to implement `getpass_r()` for reading a password from the console,
for platforms not supporting it natively. This patch makes this function
a dummy, so password entry from the command-line is no longer supported
for UWP apps. Though it probably did not work before this patch, due to:

CRT headers do declare `getch()`, but it's missing from the CRT DLL.

MSDN documents it as unsupported for UWP:
https://learn.microsoft.com/cpp/c-runtime-library/reference/getch
https://learn.microsoft.com/cpp/c-runtime-library/reference/getch-getwch

Same is true for the non-deprecated `_getch()` function.

After mingw-w64 synced its implib with `msvcr120_app.dll`, the CI job
`mingw, CM x86_64 schannel R uwp` broke with:
```
[16/16] Linking C executable src\curl.exe
FAILED: src/curl.exe
[...]
D:/a/_temp/msys64/mingw64/bin/../lib/gcc/x86_64-w64-mingw32/14.2.0/../../../../x86_64-w64-mingw32/bin/ld.exe:
  src/CMakeFiles/curl.dir/Unity/unity_0_c.c.obj:unity_0_c.c:(.text+0x4d05): undefined reference to `getch'
```
Ref: https://github.com/curl/curl/actions/runs/11873795410/job/33089008727?pr=15597#step:19:25

Also:
- GHA/windows: bump `msys2/setup-msys2` action to
  https://github.com/msys2/setup-msys2/commit/c52d1fa
  This triggered the build failure above.
  Closes #15597

Ref: https://sourceforge.net/p/mingw-w64/mingw-w64/ci/d408f51e5a3e9a4eb3739efea1fb2daf50dbb058/tree/mingw-w64-crt/def-include/crt-aliases.def.in?diff=9e27bb062a46d20aa9a372559956451d4565c22b

Closes #15637

11 months agomulti: fix callback for `CURLMOPT_TIMERFUNCTION` not being called again when...
Vladislavs Sokurenko [Fri, 22 Nov 2024 15:00:14 +0000 (17:00 +0200)] 
multi: fix callback for `CURLMOPT_TIMERFUNCTION` not being called again when...

Issue is reproducible for me if I have made request with multi handle,
then I make request that will take very long and then I make request
that should be fast again, however what happens it is that it seems
to think that timeout was not changed and it makes it not call initial
`CURLMOPT_TIMERFUNCTION`.

Closes #15627

11 months agortsp: check EOS in the RTSP receive and return an error code
Deng Jianfeng [Fri, 22 Nov 2024 08:59:19 +0000 (16:59 +0800)] 
rtsp: check EOS in the RTSP receive and return an error code

This helps the caller detect disconnection events.

Fixes #15624
Closes #15626

11 months agoGHA: source mbedTLS from official tarball
Viktor Szakats [Sun, 24 Nov 2024 14:52:38 +0000 (15:52 +0100)] 
GHA: source mbedTLS from official tarball

Instead of the Git repo tag which requires downloading the tip of
a dependency repository at the time of bumping version:
https://github.com/Mbed-TLS/mbedtls-framework

The official source tarball ships with this dependency, making
the CI builds reproducible.

Also: fold long download commands for other dependencies.

Closes #15632

11 months agoGHA: speed up 3 openssl/quictls builds 3x
Viktor Szakats [Sun, 24 Nov 2024 01:46:41 +0000 (02:46 +0100)] 
GHA: speed up 3 openssl/quictls builds 3x

Build in parallel first, then install with `-j1`. This makes the build
part 3x quicker, while avoiding parallellism issues at the install
phase.

```
                       before   after  after
                              1da198d   this
aws-lc:                 1m55s    ~40s
libressl:               1m16s  ~1m20s
openssl-tsan:           5m47s   3m43s  1m48s (clang)
openssl:                6m38s   4m49s  2m13s (quic)
quictls-no-deprecated:  2m28s   1m51s
quictls:               ~6m08s   4m16s  1m55s
wolfssl-all:            1m36s     52s
wolfssl-master:         1m34s     53s
wolfssl-opensslextra:     50s     32s
```

Follow-up to 1da198d18e495c08adb5691459da0b5fcfc7f160 #15622

Closes #15630

11 months agoGHA: disable building tests, apps, docs in dependencies
Viktor Szakats [Thu, 21 Nov 2024 18:22:43 +0000 (19:22 +0100)] 
GHA: disable building tests, apps, docs in dependencies

Also:
- for LibreSSL download the official source tarball instead of
  using the tagged Git repo and running the build script which
  merged the OpenBSD libressl repo into it. The latter method
  was also broken at the time of this commit.

Build times:
```
                       before   after
aws-lc:                 1m55s    ~40s
libressl:               1m16s  ~1m20s
openssl-tsan:           5m47s   3m43s
openssl:                6m38s   4m49s
quictls-no-deprecated:  2m28s   1m51s
quictls:               ~6m08s   4m16s
wolfssl-all:            1m36s     52s
wolfssl-master:         1m34s     53s
wolfssl-opensslextra:     50s     32s
```

LibreSSL build options are unchanged, but by using the tarball now
instead of two repos and a generator script, it also should be faster,
and more stable.

Closes #15622

11 months agocmake: include `wolfssl/options.h` first
Viktor Szakats [Thu, 21 Nov 2024 19:07:21 +0000 (20:07 +0100)] 
cmake: include `wolfssl/options.h` first

It was missing while detecting `wolfSSL_DES_ecb_encrypt`,
`wolfSSL_BIO_new` and `wolfSSL_BIO_set_shutdown`.

We have not seen it causing issues in stable wolfSSL releases as of
v5.7.4, until a recent commit in wolfSSL master, which broke detections:
```
curl/CMakeFiles/CMakeScratch//CheckSymbolExists.c:8:19: error: â€˜wolfSSL_BIO_new’ undeclared (first use in this function); did you mean â€˜wolfSSL_CTX_new’?
curl/CMakeFiles/CMakeScratch//CheckSymbolExists.c:8:19: error: â€˜wolfSSL_BIO_set_shutdown’ undeclared (first use in this function); did you mean â€˜wolfSSL_set_shutdown’?
```
This in turn disabled `HTTPS-proxy` and failed related pytests:
https://github.com/curl/curl/actions/runs/11953800545/job/33324250039?pr=15620

wolfSSL source diff causing the regression:
https://github.com/wolfSSL/wolfSSL/compare/be70bea687526a51e3d751d425bbaaa412b451ee..c06f65a8ace311667d9b9d7fd320b6b25f8b1bf8

The wolfSSL build says:
```
Note: Make sure your application includes "wolfssl/options.h" before any other wolfSSL headers.
      You can define "WOLFSSL_USE_OPTIONS_H" in your application to include this automatically.
```

This patch makes sure to follow this rule across the curl codebase.

Also:
- include `wolfssl/options.h` first in `lib/vtls/wolfssl.c`.
  It was preceded by `wolfssl/version.h`, which did not cause issues.
  Background for the pre-existing include order:
  Ref: deb9462ff2de8e955c67ed441f5f48619a31198d #3903
  Ref: https://curl.se/mail/lib-2015-04/0069.html

Bug: https://github.com/curl/curl/pull/15620#issuecomment-2491872463
Follow-up to d68a121266671c806b5065c2fdce52d292bf7830 #14064

Closes #15623

11 months agoschannel: remove TLS 1.3 ciphersuite-list support
Wyatt O'Day [Thu, 21 Nov 2024 14:08:31 +0000 (09:08 -0500)] 
schannel: remove TLS 1.3 ciphersuite-list support

Drop TLS 1.3 ciphersuite-list support from SChannel because of the
number of bugs in SChannel itself (a closed-source TLS library). TLS 1.3
with SChannel still works, however the ciphersuite negotiation is left
entirely to SChannel.

Bug: https://hackerone.com/reports/2792484
Reported-by: newfunction on hackerone
Fixes https://github.com/curl/curl/issues/15482
Closes https://github.com/curl/curl/pull/15621

11 months agocmake: do not echo most inherited `LDFLAGS` to config files
Viktor Szakats [Thu, 14 Nov 2024 21:25:15 +0000 (22:25 +0100)] 
cmake: do not echo most inherited `LDFLAGS` to config files

Sync with autotools and filter out most linker flags inherited via
`CMAKE_SHARED_LINKER_FLAGS` (that includes `LDFLAGS` env) before
echoing them in `libcurl.pc` `Libs.private` and `curl-config`
`--static-libs`.

Keep inheriting `-l`, `-L`, `-F`, `--library-path=`, `-framework`
options.

Follow-up to e244d50064a56723c2ba4f0df8c847d6b70de0cb #15550
Follow-up to 9f56bb608ecfbb8978c6cb72a04d9e8b23162d82 #14681
Follow-up to 8ed66f98a954cfce92f770adeb2320deb1ea700e

Closes #15617

11 months agocurl_multi_socket_all.md: soften the deprecation warning
Jay Satiro [Wed, 13 Nov 2024 21:17:37 +0000 (16:17 -0500)] 
curl_multi_socket_all.md: soften the deprecation warning

- Instead of saying "do not use", explain that the function was
  deprecated for performance reasons.

Some users may have a legitimate use of this function even though we
deprecated it. Since there are no plans to remove it from the API get
rid of the "do not use" warning.

Bug: https://curl.se/mail/lib-2024-11/0029.html
Reported-by: Jacob Champion
Closes https://github.com/curl/curl/pull/15576

11 months agodocs: document default `User-Agent`
Brendon Smith [Sun, 17 Nov 2024 21:38:31 +0000 (16:38 -0500)] 
docs: document default `User-Agent`

curl offers a `--user-agent` option for modifying the `User-Agent`
header supplied in its requests.

The man page section for this option explains how to use the
`--user-agent` option, but does not explain which `User-Agent` curl uses
by default.

By default, curl uses curl/VERSION, such as `User-Agent: curl/8.11.0`.

Note that this appears to be different from the libcurl default (no
User-Agent header).

This commit documents the default `User-Agent` in the man page section
for the `--user-agent` option, as well as on the "Art of Scripting"
page.

The `%VERSION` placeholder will be used to insert the current version
as described in the man page generator docs.

Closes #15608

11 months agoshow-headers.md: clarify the headers are saved with the data
Daniel Stenberg [Sun, 17 Nov 2024 16:44:47 +0000 (17:44 +0100)] 
show-headers.md: clarify the headers are saved with the data

Fixes #15605
Reported-by: tkzv on github
Closes #15606

11 months agoGHA/macos: enable ECH in wolfSSL jobs
Viktor Szakats [Sun, 17 Nov 2024 19:02:56 +0000 (20:02 +0100)] 
GHA/macos: enable ECH in wolfSSL jobs

Homebrew wolfSSL builds recently enabled all features.
It allows to enable ECH in curl for these jobs.

https://github.com/Homebrew/homebrew-core/commit/97d1ed6e6db63071853f0d0c5b3b02cb22983be9
https://github.com/Homebrew/homebrew-core/pull/191561

Closes #15607

11 months agoRELEASE-NOTES: synced
Daniel Stenberg [Sun, 17 Nov 2024 16:13:33 +0000 (17:13 +0100)] 
RELEASE-NOTES: synced

11 months agomulti: add clarifying comment for wakeup_write()
Daniel Stenberg [Sun, 17 Nov 2024 10:48:07 +0000 (11:48 +0100)] 
multi: add clarifying comment for wakeup_write()

Coverity raised it as a "suspicious sizeof".

Closes #15600

11 months agonetrc: fix pointer to bool conversion
Viktor Szakats [Sun, 17 Nov 2024 11:46:25 +0000 (12:46 +0100)] 
netrc: fix pointer to bool conversion

with MSVC 2008 and 2010:
```
lib/netrc.c(107): error C2440: 'initializing' : cannot convert from 'char *' to 'bool'
```
Ref: https://ci.appveyor.com/project/curlorg/curl/builds/51002792/job/jtoxd4mk984oi6fd#L164
Ref: https://ci.appveyor.com/project/curlorg/curl/builds/51002792/job/0wxlw9a8g04e56vt#L177

Follow-up to e9b9bbac22c26cf67316fa8e6c6b9e831af31949 #15586
Closes #15601

11 months agosocket: handle binding to "host!<ip>"
Daniel Stenberg [Sat, 16 Nov 2024 17:53:56 +0000 (18:53 +0100)] 
socket: handle binding to "host!<ip>"

Regression since 3060557af702d (shipped in 8.9.0)

Fixes #15553
Reported-by: marcos-ng on github
Closes #15583

11 months agonetrc: address several netrc parser flaws
Daniel Stenberg [Fri, 15 Nov 2024 10:06:36 +0000 (11:06 +0100)] 
netrc: address several netrc parser flaws

- make sure that a match that returns a username also returns a
  password, that should be blank if no password is found

- fix handling of multiple logins for same host where the password/login
  order might be reversed.

- reject credentials provided in the .netrc if they contain ASCII control
  codes - if the used protocol does not support such (like HTTP and WS do)

Reported-by: Harry Sintonen
Add test 478, 479 and 480 to verify. Updated unit 1304.

Closes #15586

11 months agoGHA/linux: enable ECH in wolfSSL jobs
Viktor Szakats [Sun, 17 Nov 2024 02:18:13 +0000 (03:18 +0100)] 
GHA/linux: enable ECH in wolfSSL jobs

wolfSSL `--enable-all` builds support ECH. Enable it for 3 jobs using
such builds.

Also:
- GHA/windows: drop ECH from the job name.

Closes #15598

11 months agocurl.h: mark two error codes as obsolete
Daniel Stenberg [Sun, 10 Nov 2024 15:11:02 +0000 (16:11 +0100)] 
curl.h: mark two error codes as obsolete

Not used by libcurl since many years

Closes #15538

11 months agoCI: update dependencies
renovate[bot] [Tue, 12 Nov 2024 07:35:29 +0000 (07:35 +0000)] 
CI: update dependencies

- debian:bookworm-slim Docker digest to c00d13c
- github/codeql-action digest to ea9e4e3
- fsfe/reuse-action action to v5
- awslabs/aws-lc to v1.39.0

Closes #15555
Closes #15556
Closes #15579
Closes #15594

11 months agoGHA/windows: enable GSS-API in an MSVC job
Tal Regev [Thu, 14 Nov 2024 22:27:18 +0000 (00:27 +0200)] 
GHA/windows: enable GSS-API in an MSVC job

Ref: #15545
Ref: #15564
Ref: #15585

Closes #15549

11 months agokrb5: fix socket/sockindex confusion, MSVC compiler warnings
Viktor Szakats [Fri, 15 Nov 2024 01:32:18 +0000 (02:32 +0100)] 
krb5: fix socket/sockindex confusion, MSVC compiler warnings

- fix socket/sockindex confusion on writes:

  The callstack used to end with `Curl_write_plain()` accepting a socket
  till 7.87.0. This call got swapped for `Curl_conn_send()`, expecting
  a sockindex. `socket_write()` was updated accordingly. Its callers
  missed it and continued operating on sockets: `do_sec_send()`,
  `sec_write()`, passing it down the stack and `Curl_conn_send()`
  resolving it as if it were a sockindex.
  It affected FTP Kerberos authentication.

  Discovered through MSVC warnings:
  ```
  curl\lib\krb5.c(652,28): warning C4244: 'function': conversion from 'curl_socket_t' to 'int', possible loss of data
  curl\lib\krb5.c(654,28): warning C4244: 'function': conversion from 'curl_socket_t' to 'int', possible loss of data
  curl\lib\krb5.c(656,26): warning C4244: 'function': conversion from 'curl_socket_t' to 'int', possible loss of data
  curl\lib\krb5.c(657,26): warning C4244: 'function': conversion from 'curl_socket_t' to 'int', possible loss of data
  curl\lib\krb5.c(665,24): warning C4244: 'function': conversion from 'curl_socket_t' to 'int', possible loss of data
  curl\lib\krb5.c(666,24): warning C4244: 'function': conversion from 'curl_socket_t' to 'int', possible loss of data
  ```
  Ref: https://github.com/curl/curl/actions/runs/11846599621/job/33014592805#step:9:32

  Follow-up to 5651a36d1ae46db61a31771a8d4d6dcf2a510856 #10280
  Bug: https://github.com/curl/curl/pull/15549#issuecomment-2474154067
  Fixes #15582

- fix uninitialized buffer:
  ```
  curl\lib\krb5.c(288,1): warning C4701: potentially uninitialized local variable '_gssresp' used
  ```
  Ref: https://github.com/curl/curl/actions/runs/11848626645/job/33020501026?pr=15585#step:9:31

- silence unreachable code compiler warning:
  ```
  curl\lib\krb5.c(370,1): warning C4702: unreachable code
  ```
  Ref: https://github.com/curl/curl/actions/runs/11848626645/job/33020501026?pr=15585#step:9:30

Closes #15585

11 months agoCURLOPT_PREREQFUNCTION.md: add result code on failure
Logan Buth [Fri, 8 Nov 2024 05:58:17 +0000 (23:58 -0600)] 
CURLOPT_PREREQFUNCTION.md: add result code on failure

Closes #15542

11 months agoRename struct var to fix AIX build
andrewkirillov-ibm [Thu, 14 Nov 2024 15:50:33 +0000 (15:50 +0000)] 
Rename struct var to fix AIX build

Fixing issue #15580 by renaming struct var to tool_var to avoid conflict
with the same structure name defined in AIX system headers.

Fixes #15580
Closes #15581

11 months agotidy-up: indentation [ci skip]
Viktor Szakats [Fri, 15 Nov 2024 01:51:30 +0000 (02:51 +0100)] 
tidy-up: indentation [ci skip]

11 months agoconfigure: replace `$#` shell syntax
Viktor Szakats [Thu, 14 Nov 2024 22:28:42 +0000 (23:28 +0100)] 
configure: replace `$#` shell syntax

With a more portable alternative.

Fixes (seen on macOS):
```
../configure: line 47131: 1: command not found
```
Ref: https://github.com/curl/curl/actions/runs/11846071276/job/33012894013#step:7:635

Follow-up to e244d50064a56723c2ba4f0df8c847d6b70de0cb #15550
Closes #15584

11 months agocmake: restore cmake args list in `buildinfo.txt`
Viktor Szakats [Wed, 13 Nov 2024 01:16:31 +0000 (02:16 +0100)] 
cmake: restore cmake args list in `buildinfo.txt`

This feature was recently dropped because of a bad side-effect of
silencing unused cmake command-line option warnings.

Fix this issue by retrieving variable values using `get_property()`,
instead of accessing the variables directly. It allows restoring
this feature without the bad side-effect.

Also limit the logic to CI runs.

Follow-up to 96edb5f611c9e54da1ae824d9dc0e219619c24c0 #15501
Closes #15563

11 months agoconfigure: add FIXMEs for disabled pkg-config references
Viktor Szakats [Thu, 14 Nov 2024 21:42:20 +0000 (22:42 +0100)] 
configure: add FIXMEs for disabled pkg-config references

Follow-up to d511ec8b0a56b2a99226fe556abe9f815153c648 #15573

11 months agobuild: omit certain deps from `libcurl.pc` unless found via `pkg-config`
Viktor Szakats [Wed, 13 Nov 2024 13:44:05 +0000 (14:44 +0100)] 
build: omit certain deps from `libcurl.pc` unless found via `pkg-config`

The idea of linking dependencies found to `libcurl.pc` turns out not
to work in practice in some cases.

Specifically: gss, ldap, mbedtls, libmsh3, rustls

A `.pc` may not work or be missing for a couple of reasons:
- not all build methods generate it: mbedTLS, Rustls
- generated file is broken: msh3
  Ref: https://github.com/nibanks/msh3/pull/225
- installed package flavour isn't shipping with one:
  FreeBSD GSS, OmniOS LDAP, macOS LDAP

The effect of such issues shall be subtle in theory, because
`libcurl.pc` normally lists these dependencies in the `Requires.private`
section meant for static linking. But, e.g. `pkg-config --exists`
requires these to be present, and builds sometimes use this check
regardless of build type. This bug is not present in `pkgconf`; it only
checks for them when `--static` is also passed.

Fix these by adding affected `.pc` references to `libcurl.pc` only when
we detected the dependency via `pkg-config`.

There are a few side-effects of this solution:
- references are never added for dependencies where curl doesn't
  implement `pkg-config` detection. These are:
  - autotools: ldap, mbedtls, msh3
  - cmake: ldap (pending #15273)
- generated `libcurl.pc` depends on the build-time environment.
- generated `libcurl.pc` depends on curl build tool (cmake, autotools).
- generated `libcurl.pc` depends on curl build implementation details.

Make an exception for GNU GSS, where I blindly guess that `gss.pc` is
always available, as no issues were reported.

Other, not mentioned, dependencies continue to be added regardless
of the detection method.

Reported-by: Harmen Stoppels, Thomas, Daniel Engberg, Andy Fiddaman
Fixes #15469
Fixes #15507
Fixes #15535
Fixes https://github.com/curl/curl/pull/15163#issuecomment-2473358444
Closes #15573

11 months agocmake: sync GSS config code with other deps
Viktor Szakats [Mon, 11 Nov 2024 10:03:08 +0000 (11:03 +0100)] 
cmake: sync GSS config code with other deps

- stop passing explicit libpaths via `CMAKE_SHARED_LINKER_FLAGS` and
  `CMAKE_EXE_LINKER_FLAGS`. `link_directories()` is doing that already.
- use `curl_required_libpaths()` to pass libpaths to the feature test.
Reported-by: Daniel Engberg
  Fixes #15536
  Also fixes GSS feature detection with non-gcc/clang compilers,
  such as MSVC.
- add libpaths to `CURL_LIBPATHS`.
- move `GSS_CFLAGS`, `GSS_LDFLAGS` stringifications to FindGSS.
  To match the `CFLAGS` format returned by the rest of Find modules.
- reorder calls to match other dependencies.
- don't extend system `LDFLAGS` when FindGSS did not return any.
- ignore `LDFLAGS` when detecting GSS via `pkg-config`. `LDFLAGS` holds
  a copy of libpaths and libs in this case. Ignore those to avoid these
  duplicates making into `libcurl.pc` and `curl-config`. Also syncing
  behavior with other Find modules which also ignore raw `LDFLAGS`.
- ignore raw `LDFLAGS` coming from `krb5-config --libs`. FindGSS
  no longer returns dependency-specific `LDFLAGS` after this. Syncing
  behavior with other Find modules.
- reduce scope of checker state push/pop/set.

Closes #15545

11 months agostrtok: use namespaced `strtok_r` macro instead of redefining it
Viktor Szakats [Tue, 12 Nov 2024 12:37:33 +0000 (13:37 +0100)] 
strtok: use namespaced `strtok_r` macro instead of redefining it

krb5 defines `strtok_r` for Windows unconditionally in its public
header:
https://github.com/krb5/krb5/blob/dc5554394e5a4363b3e109623edbeb9ad6c18a62/src/include/win-mac.h#L214-L215
resulting in this warning:
```
lib\strtok.h(31,9): warning C4005: 'strtok_r': macro redefinition
      C:\vcpkg\installed\x64-windows\include\win-mac.h(215,9):
      see previous definition of 'strtok_r'
```

The krb5 macro collides with curl's internal definition, in case
the `strtok_r` function is undetected and falling back to a local
replacement.

Reported-by: Tal Regev
Bug: https://github.com/curl/curl/pull/15549#issuecomment-2468251761
Closes #15564

11 months agosocketpair: fix enabling `USE_EVENTFD`
Viktor Szakats [Tue, 12 Nov 2024 17:04:35 +0000 (18:04 +0100)] 
socketpair: fix enabling `USE_EVENTFD`

Follow-up to 23fe1a52dc8a2ffd74e19b956927bbccdc07f15f #13874
Closes #15561

11 months agoconfigure: do not echo most inherited `LDFLAGS` to config files
Viktor Szakats [Mon, 11 Nov 2024 12:21:58 +0000 (13:21 +0100)] 
configure: do not echo most inherited `LDFLAGS` to config files

`libcurl.pc` `Libs.private` (since 8.11.0, and in `Libs` before 7.20.0)
and `curl-config` `--static-libs` (since 7.17.1, and in `Libs` between
7.7.2-7.25.0). This included all flags inherited from the environment,
in addition to those coming from dependency detections.

To avoid spilling all linker flags inherited from the environment to
the libcurl config files, this patch omits them all, except `-L`, `-F`,
`--library-path=` and `-framework` options, which are still passed.
The rationale for the exceptions is that `LIBS` is passed as-is, and
`LDFLAGS`, `LIBS` are the canonical way to pass custom libs options
to a build. `LIBS` may not work without a matching custom libpath.

This brings autotools behaviour closer to cmake, and `curl-config`
closer to `libcurl.pc`.

Follow-up to 9f56bb608ecfbb8978c6cb72a04d9e8b23162d82 #14681
Follow-up to 4c8adc8fee5e55754da3d8f8d982733a7bf3dece
Reported-by: Peter Marko
Fixes #15533
Closes #15550

11 months agoGHA/linux: fix `pip3 install impacket` breakage
Viktor Szakats [Wed, 13 Nov 2024 22:43:49 +0000 (23:43 +0100)] 
GHA/linux: fix `pip3 install impacket` breakage

An upstream update `impacket` pip package started requiring `blinker`.
An older version is shipping with Ubuntu, causing this on install:
```
  Attempting uninstall: blinker
    Found existing installation: blinker 1.7.0
ERROR: Cannot uninstall blinker 1.7.0, RECORD file not found. Hint: The package was installed by debian.
```

Fix it by switching to venv and install everything separate from the
system.

The overhead is the same as using `pip --ignore-installed`, which also
installs everything from scratch.

The 3rd option is to uninstall the system `python3-blinker` package, but
it was the slowest.

Closes #15578

11 months agoos400: Fix IBMi builds
andrewkirillov-ibm [Wed, 13 Nov 2024 14:07:47 +0000 (14:07 +0000)] 
os400: Fix IBMi builds

- Use a separate variable for CURL type dereference.

Prior to this change, eed3c8f4 (precedes 8.11.0), changed CURL type from
Curl_easy to void which broke dereferences to the former.

Reported-by: Andrew Kirillov
Fixes https://github.com/curl/curl/issues/15566
Closes https://github.com/curl/curl/pull/15572

11 months agoos400: Fix IBMi EBCDIC conversion of arguments
andrewkirillov-ibm [Wed, 13 Nov 2024 14:40:44 +0000 (14:40 +0000)] 
os400: Fix IBMi EBCDIC conversion of arguments

- Fix the length of strings passed to iconv_open.

IBM's iconv_open expects parameters to be a pointer to a 32 byte
character array with the unused fields set to 0.

Prior to this change, since 8c62479a (precedes 8.11.0), it was
incorrectly passed pointers to smaller length const strings and curl
would fail with error "blank argument where content is expected".

Reported-by: Andrew Kirillov
Ref: https://www.ibm.com/docs/en/i/7.5?topic=ssw_ibm_i_75/apis/iconvopn.html

Fixes https://github.com/curl/curl/issues/15570
Closes https://github.com/curl/curl/pull/15574

11 months agocmake: typo in comment [ci skip]
Viktor Szakats [Wed, 13 Nov 2024 18:07:00 +0000 (19:07 +0100)] 
cmake: typo in comment [ci skip]

Follow-up to 93e6e4b823d4b62119e5d464ae733b68245772e6 #15559

11 months agoGHA/macos: follow Homebrew and switch to `pkgconf`
Viktor Szakats [Wed, 13 Nov 2024 17:00:34 +0000 (18:00 +0100)] 
GHA/macos: follow Homebrew and switch to `pkgconf`

Homebrew switched to `pkgconf`, and now pkg-config installs an extra
package. Update package list to avoid that.

The side-effect of `pkgconf` is that this former log message:
```
--   Package 'libcrypto', required by 'libssh2', not found
```
https://github.com/curl/curl/actions/runs/11779568834/job/32808325442#step:7:84

is replaced by this, and repeated 10 times:
```
Package libcrypto was not found in the pkg-config search path.
Perhaps you should add the directory containing `libcrypto.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libcrypto', required by 'libssh2', not found
```
https://github.com/curl/curl/actions/runs/11792711391/job/32846858320#step:7:85

Closes #15575

11 months agocmakelint: fix to check root `CMakeLists.txt`
Viktor Szakats [Wed, 13 Nov 2024 09:44:32 +0000 (10:44 +0100)] 
cmakelint: fix to check root `CMakeLists.txt`

Closes #15565

11 months agocmake: work around `ios.toolchain.cmake` breaking feature-detections
Viktor Szakats [Tue, 12 Nov 2024 14:22:50 +0000 (15:22 +0100)] 
cmake: work around `ios.toolchain.cmake` breaking feature-detections

Fix builds with CMake configured to falsely return successful detection
when using `check_function_exists()` (and `check_library_exists()`, and
anything based on `try_compile()` that's relying on the linker). After
such mis-detection the build fails when trying to use the feature that
doesn't in fact exist.

The mis-detection is caused by this CMake setting:
```
set(CMAKE_TRY_COMPILE_TARGET_TYPE STATIC_LIBRARY)
```
It is set by default (or on conditions) when using 3rd-party toolchain:
https://github.com/leetal/ios-cmake/blob/master/ios.toolchain.cmake

After this patch the curl build overrides this setting for the duration
of feature tests, and logs a message about it.

Also preset and skip feature tests for known mis-detections:
- `connect()` in `libsocket`
- `getpass_r()`
- `eventfd()` (did not cause an issue due to a separate bug)
- `sendmmsg()` (did not cause an issue because it's Linux-only)

If mis-detections are still seen, the workaround is to force-set the
specific feature by passing `-DHAVE_*=OFF` to cmake.
Also consider passing `-DENABLE_STRICT_TRY_COMPILE=ON` for
`ios.toolchain.cmake` to fix the root cause.

Interestingly curl itself uses this setting to speed up compile-only
detections: be17f298ff508d62d493d4a8d43e56a1e2861a50 #3744

Also:
- OtherTests.cmake: restore original value of
  `CMAKE_TRY_COMPILE_TARGET_TYPE`. Before this patch it reset it
  to empty.
- OtherTests.cmake: unset a local variable after use, quote a string.

Follow-up to 8e345057761a8f796403923a96f2c8fd3edca647 #15164
Follow-up to 8b76a8aeb21c8ae2261147af1bddd0d4637c252c #15525
Ref: https://github.com/leetal/ios-cmake/issues/47
Ref: https://gitlab.kitware.com/cmake/cmake/-/issues/18121
Ref: https://cmake.org/cmake/help/latest/variable/CMAKE_TRY_COMPILE_TARGET_TYPE.html
Reported-by: Dan Rosser
Fixes #15557
Closes #15559

11 months agotests: use the standard format of an IGNORED line
Dan Fandrich [Wed, 13 Nov 2024 06:01:54 +0000 (22:01 -0800)] 
tests: use the standard format of an IGNORED line

This is more consistent and allows Test Clutch to parse it properly.
Also, add --test-duphandle and --test-event to the runtests.pl help
text.

11 months agoGHA/non-native: streamline installed packages on FreeBSD
Daniel Engberg [Sun, 10 Nov 2024 21:23:26 +0000 (22:23 +0100)] 
GHA/non-native: streamline installed packages on FreeBSD

Instead of installing the cmake package which is a meta-port (includes
documentation and manpages etc) install cmake-core which is cmake itself
to save a few cpu cycles.

Also drop nghttp2 in favour of the slimmer libnghttp2.

Closes #15540

11 months agomk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions
Daniel Stenberg [Tue, 12 Nov 2024 07:33:53 +0000 (08:33 +0100)] 
mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions

The script's previous treatment of this meta-data was a
misunderstanding. (Added in 1ebc53df25181908) The mistrust is not for
the root cert at this date (it would simply be removed from the bundle
then instead) but for created server certificates:

    If a builtin certificate has a CKA_NSS_SERVER_DISTRUST_AFTER
    timestamp before the SCT or NotBefore date of a certificate that
    builtin issued, then clients can elect not to trust it.

That is however information that cannot be provided in the generated PEM
output.

Fixes #15547
Reported-by: Andrew Ayer
Closes #15552

11 months agocurl-rustls.m4: keep existing `CPPFLAGS`/`LDFLAGS` when detected
Viktor Szakats [Mon, 11 Nov 2024 12:59:08 +0000 (13:59 +0100)] 
curl-rustls.m4: keep existing `CPPFLAGS`/`LDFLAGS` when detected

Different variable names were used in flag save and restore operations,
which could cause existing `CPPFLAGS` and `LDFLAGS` be accidentally lost
when detecting Rustls.

Follow-up to 647e86a3efe1eea7a2a456c009cfe1eb55fe48eb #13179
Closes #15546

11 months agobuild: use `_fseeki64()` on Windows, drop detections
Viktor Szakats [Fri, 8 Nov 2024 17:51:45 +0000 (18:51 +0100)] 
build: use `_fseeki64()` on Windows, drop detections

A recent update caused CMake builds to mis-detect this symbol on iOS.
Auto-detection also seems redundant given that it's a Windows-only
function and most Windows builds were already opted-in.

Drop detections and use it in all Windows builds with large file support
enabled.

Feature history:
- pririotizing for Windows: aaacd02466f77d03b8fdc19e91a0a3ec72f4c38a #14678
- Windows opt-in cmake: 8e74c0729d0cace00a202fc6c33c1b35703e220a #11950
- Windows opt-in: aa6c94c5bf4f5caa31c0213d9cd7058c29a9b30b #11944
- use in libcurl: 9c7165e96a3a9a2d0b7059c87c699b5ca8cdae93 #11918
- use in example: 817d1c01064ac81e9609819b15738ee540ef056c

Regression from 8e345057761a8f796403923a96f2c8fd3edca647 #15164

Reported-by: Maarten Billemont
Fixes #15525
Closes #15526

11 months agoGHA: update four dependencies
renovate[bot] [Tue, 5 Nov 2024 12:40:24 +0000 (12:40 +0000)] 
GHA: update four dependencies

- gnutls/gnutls to v3.8.8
- rojopolis/spellcheck-github-actions digest to 403efe0
- awslabs/aws-lc to v1.38.0
- github/codeql-action digest to 4f3212b

Closes #15487
Closes #15490
Closes #15516
Closes #15528

11 months agolibssh: when using IPv6 numerical address, add brackets
Daniel Stenberg [Fri, 8 Nov 2024 15:31:41 +0000 (16:31 +0100)] 
libssh: when using IPv6 numerical address, add brackets

Reported-by: henrikjehgmti on github
Fixes #15522
Closes #15524

11 months agoGHA/non-native: enable nghttp2 in OmniOS job
Viktor Szakats [Fri, 8 Nov 2024 23:57:07 +0000 (00:57 +0100)] 
GHA/non-native: enable nghttp2 in OmniOS job

Closes #15530

11 months agoci: Update vmactions/omnios-vm digest to 16b5996
renovate[bot] [Fri, 8 Nov 2024 22:21:36 +0000 (22:21 +0000)] 
ci: Update vmactions/omnios-vm digest to 16b5996

Closes #15529

11 months agoRELEASE-NOTES: synced
Daniel Stenberg [Fri, 8 Nov 2024 22:24:50 +0000 (23:24 +0100)] 
RELEASE-NOTES: synced