- a logic error made it not loop and thus only match if the searched string
was first
- it no longer matches a substring
Adjusted test 1 to use multiple values in the Connection: response
header. Adjusted test 1542 to have a "Connection: close-not" which
should not match.
Viktor Szakats [Wed, 11 Mar 2026 09:17:10 +0000 (10:17 +0100)]
badwords: rework exceptions, fix many of them
Also:
- support per-directory and per-upper-directory whitelist entries.
- convert badlist input grep tweak into the above format.
(except for 'And' which had just a few hits.)
- fix many code exceptions, but do not enforce.
(there also remain about 350 'will' uses in lib)
- fix badwords in example code, drop exceptions.
- badwords-all: convert to Perl.
To make it usable from CMake.
- FAQ: reword to not use 'will'. Drop exception.
Stefan Eissing [Wed, 11 Mar 2026 13:43:14 +0000 (14:43 +0100)]
pingpong: cleanup timeleft handling
- Move `RESP_TIMEOUT` from urldata.h to pingpong.h as
`PINGPONG_TIMEOUT_MS`.
- Rename `Curl_pp_state_timeout()` to `Curl_pp_state_timeleft_ms()` as
the function returns the time left, not the timout..
- Update implementation comments and variable names
Stefan Eissing [Wed, 11 Mar 2026 14:25:45 +0000 (15:25 +0100)]
connection_check, simplified
The protocol handler method `connection_check` allowed to variable
operations to trigger with variable result bits. Only the `CONNCHECK_ISDEAD`
and `CONNRESULT_DEAD` were in use. Transform the function into
`connection_is_dead` without extra parameter and a bool result.
- Remove defines for `CONNCHECK_*` and `CONNRESULT_*`
- Rename protocol function in handler comments
- Change RTSP implementation (only protocol that uses this)
Vladimír Marek [Wed, 11 Mar 2026 09:46:51 +0000 (10:46 +0100)]
hostip: clear the sockaddr_in6 structure before use
On Solaris this was causing intermittent issues when the private
structure member __sin6_src_id had unexpectedly some value. connect(2)
would then fail with EADDRNOTAVAIL.
Felipe Mesquita [Thu, 5 Mar 2026 13:40:16 +0000 (10:40 -0300)]
badwords: avoid 'simply'
It's mostly a filler word. I've read through each use of it in the code
base and did minor rephrasings when "simply" carried some meaning. The
overwhelming majority of cases, removing it improved the text
significantly. Inspired by #20793.
Daniel Stenberg [Mon, 9 Mar 2026 12:32:14 +0000 (13:32 +0100)]
badwords: move into ./scripts, speed up
- 'badwords' is now a target in Makefile.am
- change badwords.txt to specify plain "words" instead of regexes so the
script can build single regexes when scanning, which makes the script
perform much faster (~6 times faster)
Daniel Stenberg [Sat, 7 Mar 2026 10:24:18 +0000 (11:24 +0100)]
cf-socket: ignore SOCK_CLOEXEC etc for socktype equality checks
As the SOCK_CLOEXEC and SOCK_NONBLOCK get ORed to the socktype, this
introduces the cf_socktype() function to use when checking for the
specific socket type: DGRAM or STREAM. The function filters off the
non-type related bits to enable the comparison.
Andrei Rybak [Wed, 4 Mar 2026 09:11:58 +0000 (10:11 +0100)]
FAQ: syntax improvements
During conversion of `docs/FAQ` into Markdown, 'man ld' has incorrectly
kept one of its quotes when it was surrounded by backticks for inline
code formatting. A space on the left of it was lost as well.
Stefan Eissing [Thu, 5 Mar 2026 12:56:49 +0000 (13:56 +0100)]
openssl+ech: workaround for insecure handshakes
OpenSSL 4.0.0-dev supports ECH with one flaw. If peer verification
is not enabled, it will report SSL_ECH_STATUS_BAD_NAME on the ECH
status.
Provide a workaround in libcurl that checks the inner name used in
ECH was the peer's hostname, both verify peer and host are disabled
and then accept the BAD_NAME without failing the connect.
Perform the actual timeout calculation in the blocking resolv
loop each time in the same way, keeping the logic simpler.
The previous version calculated the timeout once, and then
reduced it by the elapsed time spent in polling/processing.
This is unnecessarily complicated.
Viktor Szakats [Fri, 6 Mar 2026 00:51:30 +0000 (01:51 +0100)]
cmake: improve clang-tidy test command-line reproduction
- also query `INTERFACE_COMPILE_DEFINITIONS` and
`INTERFACE_COMPILE_OPTIONS`.
To further sync clang-tidy manual command-lines with the C compiler
command-lines generated by CMake. In practice this adds `-I` options
(via `INTERFACE_COMPILE_OPTIONS`) to the end of the command-line for
dependency header directories. It does not change the outcome of
clang-tidy runs.
- limit querying `COMPILE_DEFINITIONS` and `COMPILE_OPTIONS` to the top
target, the test itself. To not include options such as
`-DCURL_HIDDEN_SYMBOLS` and `-fvisibility=hidden` (when set) via
the libcurl shared lib.
To sync with the actual C compiler command-line.
Viktor Szakats [Fri, 6 Mar 2026 02:42:41 +0000 (03:42 +0100)]
cmake: fix `LOCATION` property read errors in target debug function
Exclude reading certain props for certain target types to avoid these errors:
```
CMake Error at CMake/Utilities.cmake:71 (get_property):
The LOCATION property may not be read from target "...". Use the target
name directly with add_custom_command, or use the generator expression
$<TARGET_FILE>, as appropriate.
```
(and the same in line 78.)
Viktor Szakats [Tue, 3 Mar 2026 17:44:29 +0000 (18:44 +0100)]
examples: improve OpenSSL certificate examples
- add/fix/synchronize error messages and comments.
- consistently return error from the callback on failure.
- fix potential leaks on OpenSSL API failures.
- fix to not pass the nul-terminator to BIO read.
- scope a variable.
- sync code/formatting between the two examples.
Daniel Stenberg [Tue, 3 Mar 2026 16:55:37 +0000 (17:55 +0100)]
curl.h: remove CURLPROTO_MQTTS from the public header
- the value collided with the internal one used for WebSocket
- we add all new ones as internal bits
- bump to 64-bit internal type
- introduce new define for setting all protocols (CURLPROTO_64ALL)
Viktor Szakats [Sun, 1 Mar 2026 15:19:33 +0000 (16:19 +0100)]
cmake: fix building with `CMAKE_FIND_PACKAGE_PREFER_CONFIG=ON`
This CMake global custom option tells it to find dependencies as cmake
Configs first, and only then look for `Find*` modules. This may result
in `find_package()` succeeding, but without actually creating `CURL::*`
imported targets the curl build scripts are expecting.
For dependencies with curl-specific, local, `Find*` modules, we always
want to use them, via the module detection method, and never a
Config-based detection. Ensure this by passing the `MODULE` option to
`find_package()` and `find_dependency()` to make them use `Find*`
modules unconditionally, making them work as expected with the
`CMAKE_FIND_PACKAGE_PREFER_CONFIG=ON` option set.
curl uses local Find modules for all dependencies except OpenSSL and
ZLIB. The latter two keep using either CMake's built-in Find modules or
Config method as before this patch.
Also:
- apply the same change to `curl-config.cmake`. To fix consuming curl
with this option set. Authored-by: Valerie Snyder
Ref: #20764
Follow-up to 16f073ef49f94412000218c9f6ad04e3fd7e4d01 #16973
- GHA/distcheck: add a job testing both building and consuming curl with
this option set. (takes 15 seconds)
Use custom NGHTTP2 configuration for an extra twist (not required
to trigger this issue.)
Follow-up to fcde8d7e3745df3b4d83c86d0a1f0caef398511b #20773
Daniel Stenberg [Sat, 28 Feb 2026 09:48:59 +0000 (10:48 +0100)]
urlapi: use U_CURLU_URLDECODE when toggling it off unsigned
In this use case 'unsigned value &= ~DEFINE;
As otherwise the right side is treated as signed, which annoyingly
triggers UBSan. The U_* defines are local versions of the public define,
only typecast to unsigned.
Reported-by: xmoezzz on github
Fixes #20753
Closes #20769
Viktor Szakats [Mon, 2 Mar 2026 21:47:06 +0000 (22:47 +0100)]
cmake: stop disabling C4774 after replacing `snprintf()`, update comment (MSVC)
- update comment for `-wd4710` option.
Ref: https://ci.appveyor.com/project/curlorg/curl/builds/53627545
- stop suppressing C4774. Not triggered by the replacement call
`vsnprintf()`, as also confirmed by local tests.
Follow-up to https://github.com/curl/curl/commit/192b9214a7cf9082665ce460617308cb4836850b
Ref: https://devblogs.microsoft.com/cppblog/format-specifiers-checking/
Ref: https://learn.microsoft.com/cpp/error-messages/compiler-warnings/compiler-warnings-c4600-through-c4799
If TLS 1.3 is not supported, the call to
`mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets()` fails
during compilation:
```
curl-8.18.0/lib/vtls/mbedtls.c: In function 'mbed_connect_step1':
curl-8.18.0/lib/vtls/mbedtls.c:809:3: error: implicit declaration of function 'mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets' [-Werror=implicit-function-declaration]
mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(&backend->config,
^
curl-8.18.0/lib/vtls/mbedtls.c:809:3: warning: nested extern declaration of 'mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets' [-Wnested-externs]
```
Protect this call inside the `#ifdef` block by making sure that support
for TLS 1.3 is defined.
Viktor Szakats [Fri, 27 Feb 2026 15:43:16 +0000 (16:43 +0100)]
curlx: add local `snprintf()` helper that always nul-terminates (Windows)
Make the helper use `vsnprintf()` internally on all supported Windows
toolchains (dropping `_snprintf()` and `snprintf()`), ensure to
nul-terminate. Omit the return value to avoid complexity.
Use the helper from `mprintf.c` / `out_double()`, from tests/server code
and the tests/server-specific build of `curlx_inet_ntop()`,
`curlx_strerror()` functions. In the single call (in tests) where the
returned length was used previously, determine it with `strlen()`.
Viktor Szakats [Sat, 28 Feb 2026 18:28:42 +0000 (19:28 +0100)]
cmake: minor improvements to integration test framework
- add support for separate provider / consumer cmake options in
`find_package` tests. To help test more integration scenarios.
Refs: #20784 #20729 #20764
projects / thirdparty / curl.git / log
