Viktor Szakats [Sat, 25 Apr 2026 10:59:55 +0000 (12:59 +0200)]
tidy-up: git options, ECH, HTTP/3 documentation
- prefer `--branch` over `-b`, where missing.
- add `--depth 1` where missing.
- sync option order between docs and GHA.
- bump quiche and rustls-ffi versions in documentation.
- ECH.md: update for OpenSSL 4.
Viktor Szakats [Fri, 24 Apr 2026 11:31:53 +0000 (13:31 +0200)]
sshserver.pl: add option to enable KEX algorithms in sshd
Necessary when the libssh2/libssh client library does not support KEX
algos offered by default by the OpenSSH server. E.g. libssh2 with WinCNG
combined with OpenSSH 10+.
Daniel Stenberg [Fri, 24 Apr 2026 14:27:34 +0000 (16:27 +0200)]
mbedtls: cleanup more without care for 'initialized'
Several mbedTLS resources (entropy/CTR-DRBG, CA/client certs, keys, CRL)
are initialized and may allocate memory before initialized is set, and
must still be cleaned up.
Daniel Stenberg [Thu, 23 Apr 2026 19:49:50 +0000 (21:49 +0200)]
rustls: fix memory leak on repeated SSLKEYLOGFILE fails
Before this fix, Curl_tls_keylog_open() assigned the environment
variable result to a global keylog_file_name without freeing any prior
allocation. If the file cannot be opened (e.g., permission error)
keylog_file_fp stays NULL, so subsequent calls to Curl_tls_keylog_open
will overwrite keylog_file_name and leak the previous allocation.
Stefan Eissing [Thu, 23 Apr 2026 12:43:11 +0000 (14:43 +0200)]
doh: remove conn->bits.doh
Since we have a new struct instance for each async operation now and
async operation may happen in parallel, remove the connection bit
indicating doh is in progress.
Stefan Eissing [Wed, 22 Apr 2026 13:00:14 +0000 (15:00 +0200)]
multi: enhance pending handles fairness
When trying to connect a pending transfer, remember the `mid` that was
last reactivated and start looking for future pending handles from the
last one forward through the pending bitset.
Background: when many pending handles exist, iterating the bitset always
from the start may become unfair to transfers that were assigned higher
`mid` values.
Fixes #21396 Reported-by: Juan Belón
Closes #21412
Viktor Szakats [Wed, 22 Apr 2026 16:03:32 +0000 (18:03 +0200)]
GHA: delete all apt sources except `ubuntu.sources`
GitHub runners are getting new 3rd-party sources frequntly now, last
week `docker.list`, this week: `google-chrome.sources`. To avoid
playing catch up, allowlist the only one we use: `ubuntu.sources`. If
this is renamed, CI would break. Let's hope this happens much less
often than new sources.
Stefan Eissing [Tue, 21 Apr 2026 13:06:46 +0000 (15:06 +0200)]
async-ares: fix query counter handling
When starting an c-ares query, the provided callback may be invoked
right away, leading to a decrement of `queries_ongoing`. Increment
the counter *before* call c-ares. Otherwise, the `async->done` bit
is not properly set.
Daniel Stenberg [Tue, 21 Apr 2026 07:19:53 +0000 (09:19 +0200)]
parsedate: refactor
- introduce 'struct when' to hold the parser result
- initwhen() initializes a 'struct when'
- datestring() parses strings
- datenum() parses numbers
- datecheck() does some final checks
- tzadjust() adds the time zone offset
- convert math to 64 bit, squeeze into time_t only in the last step,
mktimet() does the time_t storing
Viktor Szakats [Tue, 21 Apr 2026 07:46:45 +0000 (09:46 +0200)]
wolfssl: fix `-Wmissing-prototypes`
Seen with unity, H3, wolfssl with `HAVE_EX_DATA`.
Fixing:
```
lib/vtls/wolfssl.c:412:10: error: no previous prototype for function 'Curl_wssl_cache_session' [-Wmissing-prototypes]
412 | CURLcode Curl_wssl_cache_session(struct Curl_cfilter *cf,
| ^
lib/vtls/wolfssl.c:412:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
412 | CURLcode Curl_wssl_cache_session(struct Curl_cfilter *cf,
| ^
| static
1 error generated.
```
Stefan Eissing [Fri, 17 Apr 2026 08:26:25 +0000 (10:26 +0200)]
Happy Eyeballs: add resolution time delay
HEv3 describes conditions on when first connect attempts shall be
started.
https://www.ietf.org/archive/id/draft-ietf-happy-happyeyeballs-v3-01.html
Chapter 4.2
libcurl now waits 50ms for AAAA and HTTPS results (when requested) to
return before continuing with the connect.
Added HTTPS-RR to the "was resolved" information info message. Changed
logging of HTTPS-RR to a one-liner with RFC 9460 like formatting. This
way the user can see if/what was resolved and used in connecting.
Viktor Szakats [Sun, 19 Apr 2026 23:12:34 +0000 (01:12 +0200)]
openssl: fix unused variable warnings in !verbose builds
Also fix clang-tidy `readability-redundant-control-flow`.
```
lib/vtls/openssl.c:4055:46: error: unused parameter 'reason' [-Wunused-parameter]
4055 | int reason)
| ^
lib/vtls/openssl.c:4279:19: error: variable 'status' set but not used [-Wunused-but-set-variable]
4279 | const char *status = NULL;
| ^
```
Ref: https://github.com/curl/curl/actions/runs/24641388439/job/72045859306?pr=21379
```
lib/vtls/openssl.c:4092:7: error: Value stored to 'rv' is never read [clang-analyzer-deadcode.DeadStores]
4092 | rv = SSL_ech_get1_status(ssl, &inner, &outer);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/vtls/openssl.c:4092:7: note: Value stored to 'rv' is never read
4092 | rv = SSL_ech_get1_status(ssl, &inner, &outer);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/vtls/openssl.c:4112:3: error: redundant return statement at the end of a function with a void return type [readability-redundant-control-flow]
4111 | #endif
| ~~~~~~
4112 | return;
| ^~~~~~~
4113 | }
```
Ref: https://github.com/curl/curl/actions/runs/24642154148/job/72047919525?pr=21379#step:42:186
The combination of a misspelled directory name and failing to check the
result of cd leads to infinite recursion as `make check` simply invokes
itself over and over.
Stefan Eissing [Fri, 17 Apr 2026 13:21:12 +0000 (15:21 +0200)]
pytest: check 429 handling
Add a "limit" handler to httpd that responds 429 after 5 requests and
then 429s all requests for 2 seconds. After which another 4 requests are
served before 429 strikes again.
Stefan Eissing [Thu, 16 Apr 2026 11:44:13 +0000 (13:44 +0200)]
haproxy: use correct ip version on client supplied address
When a user supplies an IP address to use for the HAPROXY protocol,
the IP version reported must be deduced from the address and has
no relation to the IP version used for the upstream connection.
Stefan Eissing [Thu, 16 Apr 2026 07:14:58 +0000 (09:14 +0200)]
pytest_05_09: increase reliability
Test has been flaky due to not waiting for the test server to be
listening. On slow CI systems, the started thread is late and the curl
command gets a refused connection.
Viktor Szakats [Thu, 16 Apr 2026 13:13:25 +0000 (15:13 +0200)]
GHA: drop 3rd-party apt source `docker.list`
Seen on `ubuntu-slim` runners.
Also:
- extend to two jobs to `ls -l` package sources on both ubuntu-latest,
ubuntu-24.04-arm, and ubuntu-slim.
- drop former stray apt source `ondrej-ubuntu-php-noble.sources`.
It's no longer present on the image.
Stefan Eissing [Wed, 15 Apr 2026 08:43:12 +0000 (10:43 +0200)]
urlapi: same origin tests
Add new internal `curl_url_same_origin()` to check if a href has the
same origin as a base URL. Add test cases in test1675 and use this in
http2 push handling.
Daniel Stenberg [Thu, 16 Apr 2026 08:09:59 +0000 (10:09 +0200)]
libssh2: allocate libssh2-friendly memory in kbd_callback
The function libssh2_userauth_keyboard_interactive_ex() calls the
callback and is documented to call free() on the memory returned to
libssh2 from the callback. libcurl can therefore not use the regular
curlx_strdup() for this, as that is not compatible in debug builds or
when curl_global_init_mem() is used.
projects / thirdparty / curl.git / log
