Memduh Çelik [Tue, 30 Jun 2026 04:12:11 +0000 (07:12 +0300)]
tests: pin connection reuse rules for partial, host, and credentials
Add classic tests 3223-3226 and extend tests/http/test_12_reuse.py so that
connection reuse decisions are explicit:
- partial/aborted HTTP/1.1 responses must not reuse the connection
(premature multi_done closes non-multiplexed conns)
- different target hostnames must not share a connection even when they
resolve to the same address (url_match_destination)
- HTTP Basic credentials are per-request (PROTOPT_CREDSPERREQUEST), so
different -u values still reuse; assert that with num_connects
- same host positive control reuses (num_connects 1 then 0)
Patrick Monnerat [Mon, 29 Jun 2026 16:17:14 +0000 (18:17 +0200)]
sasl: fix zero-length response encoding
A sasl zero-length normal response is an empty string, unlike an initial
response. Since the encoding of a zero-length initial response is
protocol dependent, move its handling to the protocol-specific sendauth
procedure. Similarly, do not check for an '=' server message, as this
should normally never occur.
HwangRock [Thu, 25 Jun 2026 13:00:04 +0000 (22:00 +0900)]
content_encoding: give a clear error on multi-member gzip
A gzip Content-Encoding response holding more than one gzip member made
curl decode the first member and then fail the transfer with a bare
CURLE_WRITE_ERROR and no hint about the cause. Detect the trailing
member and fail with a message that explains what happened.
Viktor Szakats [Sun, 28 Jun 2026 10:19:11 +0000 (12:19 +0200)]
build: drop superfluous `STDC_HEADERS` macro
It is traditionally defined by autotools to detect the presence of set
of standard C89 headers. autoconf 2.70 (2020-12-08) reduced the headers
covered to `stdlib.h`, `string.h`. After 2.59d (2006-06-05) obsoleting
it earlier. CMake replicated this detection, and curl included
`curl/stdcheaders.h` if standard headers were missing. However, such
condition could never happen because curl sources already assume all
checked standard headers (`stdarg.h`, `stdlib.h`, `string.h`) and
include them unconditionally.
Since this is an unused feature detection and an impossible fallback
path, drop them from CMake and curl's source. autotools continues to do
the detection by default, but its result is unused after this patch.
This leaves public `curl/stdcheaders.h` unused from within the codebase.
Viktor Szakats [Fri, 26 Jun 2026 20:56:02 +0000 (22:56 +0200)]
cmake: minor improvements to `cmake_uninstall.in.cmake`
- reduce log noise by showing 'Uninstalling' message only if the file
exists. (and a different message otherwise)
- replace cmake `rm` command with `file(REMOVE)`. For efficiency.
Show manual message if the file could not be deleted.
Ref: https://cmake.org/cmake/help/v3.18/command/file.html#remove
Follow-up to 6d008352c667799beecb1ab1dfbc408c415d018c #22193
- reduce log noise by showing 'Uninstalled' only if the deletion was
successful. (and a different message otherwise)
- display `DESTDIR` env value if set.
- drop checking, setting and showing `CMAKE_INSTALL_PREFIX`.
The value was never predefined, also not used, besides showing it,
and showing it is misleading because `--prefix` may override the
configure-time value, and also superfluous because the filenames
are showing the actual prefix anyway.
Viktor Szakats [Fri, 26 Jun 2026 18:17:16 +0000 (20:17 +0200)]
cmake: minor tidy-ups
- INSTALL-CMAKE.md: document that `CMAKE_INSTALL_PREFIX`
may be set as environment (with CMake 3.29+)
Ref: https://cmake.org/cmake/help/v3.29/variable/CMAKE_INSTALL_PREFIX.html
- CurlTests: fix copy-paste typo in comment.
Spotted by GitHub Code Quality
- optimized out `_generated_dir` local variable.
- unfold a `@ONLY` to match rest of code.
Viktor Szakats [Thu, 25 Jun 2026 10:48:26 +0000 (12:48 +0200)]
build: always use local `inet_pton()`/`inet_ntop()` implementations
Also repurpose existing build-time feature checks into unit test 1961,
to verify.
Prior to this patch these functions were auto-detected with both
autotools and cmake. In case of autotools there was an extra
verification phase ensuring the functions work as expected. This step
required running the function, thus was limited to non-cross-builds. For
cross-builds and CMake it always used the system implementation if
present. On Windows it always used the local implementation, because
availability/use is complicated there.
After this patch all platforms, always use the local implementation,
which is known to be accurate. This makes curl behave more consistently,
and simplifies the build process, a fixes cross-builds and CMake
auto-detection differences.
Also:
- test1960: enable unconditionally.
- checksrc: disallow globally, allowlist in `block_ip.c` example.
- dnsd: verify ntop result for NULL before passing to printf.
Stefan Eissing [Mon, 22 Jun 2026 08:45:42 +0000 (10:45 +0200)]
lib: hostname related cleanups
* format `data->state.aptr.host` without crlf, so signatures do not need
to strip it again. Add the crlf when adding the header to the request
dynbuf
* check `connect-to` strings on normalized hostname and user supplied
hostname (when those differ)
* libssh: always use the peer for setting ssh option SSH_OPTIONS_HOST,
preserve ipv6 [] enclosure, use IDN converted hostname otherwise. This
is the libssh documented expectation.
Do NOT use strings from URL parsing.
Viktor Szakats [Fri, 26 Jun 2026 17:48:17 +0000 (19:48 +0200)]
lib1587: fix gcc `-Wconversion` with LibreSSL on Windows, test in CI
By exposing and reusing existing custom type via `vtls/openss.h`.
Also:
- GHA/curl-for-win: test in CI by enabling building tests.
Cost is 45s per job, so limit it to the gcc job.
Seen with Windows x64 gcc (not tested in CI prior to this patch):
```
tests/libtest/lib1587.c:50:7: error: conversion from 'opt1587' {aka 'long long unsigned int'} to 'long int' may change value [-Werror=conversion]
50 | SSL_CTX_set_options(info->internals, opts);
| ^~~~~~~~~~~~~~~~~~~
tests/libtest/lib1587.c:59:7: error: conversion from 'opt1587' {aka 'long long unsigned int'} to 'long int' may change value [-Werror=conversion]
59 | SSL_set_options(info->internals, opts);
| ^~~~~~~~~~~~~~~
```
Ref: https://github.com/curl/curl/actions/runs/28258372229/job/83727170184?pr=22195#step:3:4884
Viktor Szakats [Fri, 26 Jun 2026 18:45:07 +0000 (20:45 +0200)]
cmake: fix not to build `tunits` when `BUILD_CURL_EXE=OFF`
It fails as expected, with a list of errors:
```
In file included from _x64-win-ucrt-for-trurl-bld/tests/tunit/tunits.c:5:
tests/tunit/tool1394.c:76:11: error: call to undeclared function 'parse_cert_parameter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
76 | err = parse_cert_parameter(p->param, &certname, &passphrase);
| ^
[...]
tests/tunit/tool1622.c:68:5: error: call to undeclared function 'timebuf'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
68 | timebuf(buffer, sizeof(buffer), secs);
| ^
[...]
tests/tunit/tool1623.c:104:26: error: call to undeclared function 'GetSizeParameter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
104 | ParameterError err = GetSizeParameter(check[i].input, &output);
| ^
[...]
```
Ref: https://github.com/curl/curl/actions/runs/28256499057/job/83720797064?pr=22195
Viktor Szakats [Fri, 26 Jun 2026 15:25:16 +0000 (17:25 +0200)]
cmake: replace deprecated `remove` command with `rm` and pass arg safely
All curl-supported CMake versions support the modern method, along with
the `--` marker.
Also:
- make sure to pass `-f` to not fail if the file is missing, as before
this patch.
- drop now redundant `OUTPUT_QUIET`, `ERROR_QUIET` and error handling
in `cmake_uninstall`.
- move filename to end of the error message for readability.
- GHA/linux: test these two 'clean' targets in the aws-lc job.
Viktor Szakats [Fri, 26 Jun 2026 13:54:30 +0000 (15:54 +0200)]
cmake: flatten build tree, tidy up base dir variables
- drop `generated` subdir, move these files to build root.
To move them next to CPack and other config files, and to avoid
a subdirectory for only 2 files.
Follow-up to 69328490fc91bfa00a6a90da84239524b01f5527 #2849
- add 'Consumed variables' comment for `CMake/cmake_uninstall.in.cmake`.
- move generated `cmake_uninstall.cmake` to the build root directory
(from `CMake/`). To:
- avoid creating a `CMake` subdirectory within the build directory
with this single file in it.
- move it next to its `cmake_install.cmake` counterpart.
- move it next to `install_manifest.txt` which it relies on.
- Use `PROJECT_SOURCE_DIR` for these files, replacing
`CMAKE_CURRENT_SOURCE_DIR`, to make it consistent with rest of CMake
sources, and to reduce ambiguity in `CMake/cmake_uninstall.in.cmake`
template.
Viktor Szakats [Mon, 22 Jun 2026 02:03:45 +0000 (04:03 +0200)]
GHA/windows: set `VCPKG_APPLOCAL_DEPS=OFF` for vcpkg jobs
Add the necessary directory to `PATH` instead.
To disable a vcpkg feature (auto-copying DLL dependencies next to the
build targets) that was causing CI flakiness in the libssh2 repository.
In curl it currently cannot cause flakiness because targets (with DLL
dependencies) reside in separate directories.
AFAIU this vcpkg feature has been present and enabled by default for
a long time, but only a recent update made it visible in the log and
flaky at the same time, due to switching implementation.
This patch removes log noise and potential issues, improves efficiency,
and saves disk space: 74MB -> 71 in UWP, and 69MB -> 65 in the arm64 job.
Time saving is negligible with current jobs.
Viktor Szakats [Fri, 26 Jun 2026 10:22:05 +0000 (12:22 +0200)]
cmake: tidy-up base directory variable for `include/*`/`CMake/*` files
Use `PROJECT_SOURCE_DIR` for these files, replacing
`CMAKE_CURRENT_SOURCE_DIR`, to make it consistent with rest of CMake
sources and to reflect that the locations of these files are fixed and
do not depend on the CMake source location referencing them.
Exception: keep as-is before calling `project()`, which is where
`PROJECT_SOURCE_DIR` is initialized.
Viktor Szakats [Mon, 15 Jun 2026 12:36:05 +0000 (14:36 +0200)]
tidy-up: syntax and code nits
- cmp-pkg-config.sh: replace `-r -f` with `-rf` to match rest of repo.
- configure.ac: add double quotes for robustness (not a bug).
- curl-openssl.m4: merge nested `if`s.
- CurlTests.c: drop `!= 0`, also to sync with m4.
- CurlTests.c: replace `example.com` with `localhost` in
`gethostbyname()` feature test code. (compile-only, not a bug)
- GHA/http3-linux: drop literal `true` from bool expression.
- lib650: drop redundant `&`.
- move variable/call to left-hand side of equality checks, where
missing.
- perl: detach `<`/`>` from filename in `open()`, where missing.
- schannel: apply two nit fixes lost in rebase.
- scripts/verify-release: drop redundant double quotes.
- scripts/verify-release: exit with error code on error.
- synctime: replace magic numbers with `sizeof()`.
- telnet: add missing parentheses to macro value.
- tests/Makefile.am: use single quotes.
- tool_operate: drop redundant `break` after `return` in VMS code.
- unit2413: drop unused NULL pointer + free call.
- unit2413: fix duplicate test case name.
- urlapi: drop redundant parentheses.
- urlapi: drop `CURL_UNCONST()` that became redundant.
Alhuda Khan [Thu, 25 Jun 2026 20:48:07 +0000 (02:18 +0530)]
http: trim custom header name before the Authorization drop
A custom header name padded with blanks (`Authorization :`) missed the
exact-length compare and slipped past the cross-host Authorization and
Cookie drop, forwarding the header to the redirect target. Trim the
parsed name in both the request and proxy CONNECT header builders.
Stefan Eissing [Thu, 25 Jun 2026 11:25:35 +0000 (13:25 +0200)]
conncache: connection alive checks intervals
Do not check if a particular connection is alive or not more than once
every second. We did this on every connection reuse which is overkill
when sending many requests to the same host.
Daniel Stenberg [Thu, 25 Jun 2026 20:52:07 +0000 (22:52 +0200)]
multi: forbid curl_easy_pause from within multi socket callback
- there is a risk for a nasty recursive situation
- we avoid certain risks that the pause call changes things so that when
returning from the callback, the state of some internals is undefined
and we need to reload which is easy to miss
- we can't think of legitiate use cases for doing this. This is
basically just the new favorite point for AI and security researchers
to find hypothetical problems
Viktor Szakats [Mon, 15 Jun 2026 12:33:20 +0000 (14:33 +0200)]
tidy-up: docs, comments, typos, whitespace
- GHA/windows: mention `IgnoreStandardErrorWarningFormat=true`
in comment.
- cmake: fix MIT/GNU GSS order in messages.
- drop some exclamation marks from messages.
- drop redundant ending newlines from messages.
- fold/unfold where possible.
- fix indent, whitespace, typos and other nits.
Viktor Szakats [Thu, 25 Jun 2026 18:42:16 +0000 (20:42 +0200)]
cmake: drop logic for `GNU/kFreeBSD` systems
Adopting change made in CMake, with description: "kFreeBSD is no longer
maintained or supported and was never an officially-supported release
architecture for Debian."
This system name was also dropped by CMake 4.1+:
https://cmake.org/cmake/help/v4.2/variable/CMAKE_SYSTEM_NAME.html
Credits-to: Roger Leigh
Ref: https://gitlab.kitware.com/cmake/cmake/-/commit/99c8abed55c354f5674e52b25bb65391d4afca52
Ref: https://gitlab.kitware.com/cmake/cmake/-/work_items/26742
Ref: https://gitlab.kitware.com/cmake/cmake/-/work_items/26722
Viktor Szakats [Thu, 18 Jun 2026 17:39:33 +0000 (19:39 +0200)]
GHA: bump some jobs to ubuntu-26.04
In jobs that may benefit from newer tool versions (pyspelling, possibly
CodeQL, CM integration, configure-vs-cmake). Also curl-for-win to match
the curl/curl-for-win repo that also bumped. Bump some Linux jobs to add
variation. Also the rest of `check*` jobs for no particular reason other
than using the latest.
Stefan Eissing [Thu, 25 Jun 2026 09:18:27 +0000 (11:18 +0200)]
urlapi: do not keep an internal port string
Do not allocated an internal port string, just keep and number and a bit
if it is present. Format the port string in a local buffer when someone
asks for it and copy that.
This avoid the format/alloc penalty when parsing URLs and no one ever
asking for the port string.
(And there will be a method to get the uint16_t value directly in
another PR)
Viktor Szakats [Wed, 24 Jun 2026 11:43:28 +0000 (13:43 +0200)]
autotools: minor fixes and improvements
- Makefile.am: add root `test-quiet` target that maps to
`tests/quiet-test`, for completeness.
Ref: #22098
- tests/Makefile.am: drop unused remains of `MANFILES`.
Follow-up to fa3f889752e6b5034966de61a372a60773a69ca8 #17463
Also replace the `distclean` target to delete `CLEANFILES`, otherwise
the CI dist job fails. (I'm not grokking why)
- tests/certs/Makefile.am: fix to clean generated certs via `CLEANFILES`
to comply with autotools documentation, which says the previously used
variable `DISTCLEANFILES` is meant for files created by `./configure`.
Ref: https://www.gnu.org/software/automake/manual/html_node/Clean.html
Follow-up to 44341e736a3e2f7a2b25a774be3a9796e81abab9 #16824
- tests/http/Makefile.am: add `./` prefix to glob passed to `rm -rf` on
clean, to avoid deleting unintented files, or pass unintended options.
Follow-up to 671158242db32032a41e8da89da33d773b481ef8 #10349
Cherry-picked from #22102
Cherry-picked from #22150
Viktor Szakats [Tue, 23 Jun 2026 21:14:24 +0000 (23:14 +0200)]
scripts: use end-of-options marker in `cd`, `mkdir`, `mv`, `sha256sum` commands
Where missing. To avoid passing an option by accident.
End-of-option marker (`--`) is not POSIX, but most of these scripts are
internal and/or CI-focused, where this is fine. `maketgz` and
`verify-release` are meant for public use, and I asses this is fine too,
but let us know if this causes issues in real world envs.
Also:
- maketgz: pass args with `:?` to `rm -rf`, where missing.
Cannot cause an actual issue with current code.
- verified `cp`, `rm` instances too, but none were affected.
- tests/cmake/test.sh: replace `$PWD` with `$(pwd)` for sturdiness.
- appveyor.sh: replace `$PWD` with `$(pwd)` for sturdiness.
- autotools: fix to enable for Darwin 9+ / macOS 10.5+ (2007-10-26).
Prior to this patch it was Darwin 6 / macOS 10.2.
Source: https://github.com/python/cpython/issues/70112
Ref: https://en.wikipedia.org/wiki/MacOS_version_history
10.5 was the first one UNIX '03 certified, which requires this
feature. iOS and others were forked from this codebase, so they also
have support.
- cmake: add version numbers as comments.
Sadly the OS versions are not verified. This and the autotools logic
could possibly be implemented in `curl-setup.h` more accurately, for
all build systems, without duplicating logic.
Also:
- cmake: `BSD` variable requires CMake 3.25+, add fallback code where
missing.
Ref: https://cmake.org/cmake/help/v3.25/variable/BSD.html
- unix-cache.cmake: stop listing all BSDs for `HAVE_PIPE2`,
and fix generic BSD filter for CMake <3.25.
- unix-cache.cmake: stop listing all BSDs, since it's prefilled anyway
for those via `OtherTests.cmake`.
Samuel Dainard [Wed, 24 Jun 2026 19:53:52 +0000 (19:53 +0000)]
sws: allow connection-monitor to log all disconnects
Remove the suppression of connmon after the first disconnect event. The
connmon flag is set per-test via the 'connection-monitor' server command
and should remain active for the lifetime of that test's connections to
properly detect connection reuse failures.
The suppression was introduced in 510fdad to work around a connection
reuse regression that has since been resolved by the credentials
refactoring in 8f71d0f. With the underlying issue fixed, restoring full
disconnect logging strengthens tests like 338 to catch future
regressions in connection reuse logic.
Jay Satiro [Wed, 24 Jun 2026 05:59:05 +0000 (01:59 -0400)]
ldap: support insecure mode for Windows native LDAP
- Bypass cert verification if verifypeer is disabled.
Prior to this change libcurl lacked the ability to bypass certificate
verification for Windows native LDAP (USE_WIN32_LDAP). A comment said
"Win32 LDAP SDK does not support insecure mode without CA!" but I found
that we can bypass the check by setting a verify callback to override
Windows' internal verify check.
Viktor Szakats [Wed, 24 Jun 2026 09:03:18 +0000 (11:03 +0200)]
GHA/linux: drop unused pip packages from Alpine job
py3-impacket, py3-asn1, py3-six and py3-pycryptodomex.
Number of tests run remain 1848 / 1847 for the two jobs respectively.
Number of installed packages go from 158 to 117, and from 177 to 142
(for the two jobs respectively; using different Alpine versions).
Viktor Szakats [Tue, 23 Jun 2026 10:08:25 +0000 (12:08 +0200)]
GHA/non-native: BSD overhaul, test more autotools, bump versions
- add autotools jobs for MidnightBSD, NetBSD, OpenBSD.
Takes under 3 minutes per new job, under +6m in total.
- comment out MidnightBSD to save CI time.
- to make them as fast as possible, skip building tests and examples,
and omit libidn2, openldap dependencies.
- add DragonFly BSD cmake job, which finally works.
(keep it commented out since the package server fails frequently.)
- do `mport index/upgrade` to make MidnightBSD autotools builds work.
- rework filtering MidnightBSD package manager's excessive log output.
- fixup OpenBSD autotools job to uninstall system curl to avoid linking
against it (and breaking debug builds).
- make OpenBSD package manager commands non-interactive.
- specify install packages for each matrix entry.
- make autotools build step verbose (to ease debugging).
- add link to DragonFly BSD package repo.
- bump cross-platform-actions from 1.1.0 to 1.3.0.
- bump FreeBSD 15.0 to 15.1.
- bump OpenBSD to 7.7 to 7.9.
This did not go well last time with 7.8, let's see with 7.9.
Ref: 8d00e28136baf661455f1fe5980a0d18c4d872e3 #19372
Ref: c3b890b2c005401e18b54dacf9e63d33412e2b4f #19368
- sync test-skipper keywords with rest of workflows.
- drop installing impacket. It was unused.
(also a slow install with many dependencies)
The original motivation was to prepare fixing OpenBSD's (and possibly
other platforms) `getaddrinfo()` thread-safety check.
Ref: https://github.com/curl/curl/pull/22138#issuecomment-4773617195
Viktor Szakats [Tue, 23 Jun 2026 09:28:15 +0000 (11:28 +0200)]
GHA/linux: bump pizlonator/fil-c to v0.680, fixup quoting
Also put the version number in quotes to avoid GHA altering the number
into `0.68` (without rightmost zero) and ending up storing that in the
`FIL_C_VERSION` env.
Hopefully Renovate will honor this on future bumps.
Do the same for the rest of `x.y` format version numbers.
Viktor Szakats [Mon, 22 Jun 2026 19:17:24 +0000 (21:17 +0200)]
cmake: add pre-fills for DragonFly BSD and MidnightBSD
Based on CI runs:
DragonFlyBSD: https://github.com/curl/curl/actions/runs/27978506617/job/82802332910 (autotools)
MidnightBSD: https://github.com/curl/curl/actions/runs/27977103321/job/82797523470 (cmake)
Also readd DragonFly BSD to GHA/non-native, but keep it commented.
Stefan Eissing [Fri, 19 Jun 2026 15:01:00 +0000 (17:01 +0200)]
websockets: buffer ugprade data at connection level
When the HTTP Upgrade to websockets already carries ws frame data,
buffer that data at connection level and not in the ws decoder.
Adding new cfilter `cf_recvbuf` to buffer a fixed amont of data
to be received later. When the data is received, the filter
passes further recv call through to its subfilter.
Fixes #22107 Reported-by: sideshowbarker on github
Closes #22111
Michael Kaufmann [Fri, 19 Jun 2026 14:16:55 +0000 (16:16 +0200)]
proxy: fix automatic tunnel mode with "connect to host"
Fix a regression in curl 8.21.0-rc3: Check whether the host and the "connect
to host" are equal before initializing the proxy. If they are equal, switching
to tunnel mode is not necessary.
projects / thirdparty / curl.git / log
