]> git.ipfire.org Git - thirdparty/curl.git/log
thirdparty/curl.git
7 months agomulti: fix curl_multi_waitfds reporting of fd_count 15155/head
Christopher Dannemiller [Fri, 4 Oct 2024 16:31:59 +0000 (09:31 -0700)] 
multi: fix curl_multi_waitfds reporting of fd_count

- Make curl_multi_waitfds consistent with the documentation.

Issue Addressed:

 - The documentation of curl_multi_waitfds indicates that users should
   be able to call curl_multi_waitfds with a NULL ufds. However, before
   this change, the function would return CURLM_BAD_FUNCTION_ARGUMENT.
 - Additionally, the documentation suggests that users can use this
   function to determine the number of file descriptors (fds) needed.
   However, the function would stop counting fds if the supplied fds
   were exhausted.

Changes Made:

 - NULL ufds Handling: curl_multi_waitfds can now accept a NULL ufds if
   size is also zero.
 - Counting File Descriptors: If curl_multi_waitfds is passed a NULL
   ufds, or the size of ufds is insufficient, the output parameter
   fd_count will return the number of fds needed. This value may be
   higher than actually needed but never lower.

Testing:

 - Test 2405 has been updated to cover the usage scenarios described
   above.

Fixes https://github.com/curl/curl/issues/15146
Closes https://github.com/curl/curl/pull/15155

7 months agoGHA/windows: shorten job timeouts
Viktor Szakats [Sat, 28 Dec 2024 22:23:04 +0000 (23:23 +0100)] 
GHA/windows: shorten job timeouts

To reduce the wait for re-running stuck jobs.

Sometimes jobs hang/get stuck while running tests, ignoring the step
timeout.

Closes #15851

7 months agocmake: optimize out 4 picky warning option detections with gcc
Viktor Szakats [Sat, 28 Dec 2024 19:20:38 +0000 (20:20 +0100)] 
cmake: optimize out 4 picky warning option detections with gcc

Follow-up to 9c543de0ecf14880c3324d3d24591fb695dd1917 #10973
Closes #15850

7 months agocmake: drop unused `HAVE_SYS_XATTR_H` detection
Viktor Szakats [Sat, 28 Dec 2024 11:06:53 +0000 (12:06 +0100)] 
cmake: drop unused `HAVE_SYS_XATTR_H` detection

Follow-up to 8e345057761a8f796403923a96f2c8fd3edca647 #15164
Follow-up to 1c877a0712b7851c7f286007193668058ed2e987 #1176

Closes #15845

7 months agocmake: tidy up local variable names
Viktor Szakats [Sun, 1 Jan 2023 00:11:51 +0000 (01:11 +0100)] 
cmake: tidy up local variable names

Closes #15843

7 months agocmake: drop duplicate Windows cache value
Viktor Szakats [Fri, 27 Dec 2024 22:54:37 +0000 (23:54 +0100)] 
cmake: drop duplicate Windows cache value

Closes #15840

7 months agotidy-up: rename `MHDX_INLINE` to `CURL_FORCEINLINE`
Viktor Szakats [Fri, 27 Dec 2024 22:35:48 +0000 (23:35 +0100)] 
tidy-up: rename `MHDX_INLINE` to `CURL_FORCEINLINE`

Closes #15839

7 months agoGHA/non-native: fix CM/AM in FreeBSD job names
Viktor Szakats [Fri, 27 Dec 2024 21:57:28 +0000 (22:57 +0100)] 
GHA/non-native: fix CM/AM in FreeBSD job names

Closes #15837

7 months agocookie: fix crash in netscape cookie parsing
Jay Satiro [Tue, 24 Dec 2024 07:18:37 +0000 (02:18 -0500)] 
cookie: fix crash in netscape cookie parsing

- Parse the input string without modifying it.

Prior to this change a segfault could occur if the input string was
const because the tokenizer modified the input string. For example if
the user set CURLOPT_COOKIELIST to a const string then libcurl would
likely cause a crash when modifying that string. Even if the string was
not const or a crash did not occur there was still the incorrect and
unexpected modification of the user's input string.

This issue was caused by 30da1f59 (precedes 8.11.0) which refactored
some options parsing and eliminated the copy of the input string. Also,
an earlier commit f88cc654 incorrectly cast the input pointer when
passing it to strtok.

Co-authored-by: Daniel Stenberg
Closes https://github.com/curl/curl/pull/15826

7 months agoclang-tidy: add to CI, add cmake support, fix fallouts
Viktor Szakats [Tue, 24 Dec 2024 01:43:02 +0000 (02:43 +0100)] 
clang-tidy: add to CI, add cmake support, fix fallouts

build:
- autotools: fix to build generated sources for the `tidy` target.
- autotools: allow passing custom clang-tidy options via
  `CURL_CLANG_TIDYFLAGS` env.
- cmake: add `CURL_CLANG_TIDY` option to configure for `clang-tidy`.
  Also add:
  - `CLANG_TIDY` variable to customize the `clang-tidy` tool.
  - `CURL_CLANG_TIDYFLAGS` to pass custom options to `clang-tidy`.
- apply `--enable-werror` and `-DCURL_WERROR=ON` to `clang-tidy`.

CI/GHA:
- add clang-tidy job for Linux, using autotools and clang-tidy v18.
  This one needs to disable `clang-analyzer-valist.Uninitialized`
  to avoid false positives:
  https://github.com/llvm/llvm-project/issues/40656
  Duration: 5.5 minutes
- add clang-tidy job for macOS, using cmake and clang-tidy v19.
  This one also covers tests and examples, and doesn't hit the false
  positives seen with llvm v18 and earlier.
  Duration: 4.5 minutes
- Linux/macOS: skip installing test dependencies when not building or
  running tests.

fix fallouts reported by `clang-tidy`:
- lib:
  - cf-h2-proxy: unused assignment in non-debug builds.
  - cf-socket: silence warning.
    FIXME: https://github.com/curl/curl/pull/15825#issuecomment-2561867769
  - ftp: NULL passed to `strncmp()`.
  - http2: NULL-ptr deref.
  - mprintf: silence warning.
- src/tool_writeout: NULL passed to `fputs()`.
- examples:
  - invalid file pointers.
  - missing `fclose()`.
- tests:
  - http/clients/hx-download: memory leaks on error.
  - http/clients/hx-download: memory leak on repeat `-r` option.
  - server: double `fclose()`.
    https://www.man7.org/linux/man-pages/man3/fclose.3.html
  - server: invalid file pointer/handle.
  - server/getpart: unused assignments.
  - server/mqttd: leak on failed `realloc()`.
  - server/tftpd: NULL passed to `strcmp()`.

Closes #15825

7 months agocmake: add `librtmp` Find module
Viktor Szakats [Thu, 26 Dec 2024 10:34:24 +0000 (11:34 +0100)] 
cmake: add `librtmp` Find module

The new detection method also allows to enable librtmp without using
OpenSSL as a curl TLS backend at the same time.

Also:
- implement manual version detection for librtmp.
  Version info is in hex. With CMake 3.13 and newer, extract it as a hex
  number. With earlier CMake version, just strip the leading zeroes.
  Doing more here seems overkill because librtmp has been standing
  at 2.3/2.4 for a decade now. Bumping into hex digits seems unlikely
  before deprecating CMake 3.13 support.
  librtmp advertises v2.4 via its `pkg-config` module, and v2.3 via
  its public header. The latter shows up in `curl -V` and either can
  be shown at configure-time depending on detection method.
  This isn't a curl bug.
- GHA/macos: enable rtmp in a job.
- apply the "half-detection" fix to the Find module.
  `librtmp` is also affected (in CI too), because it depends on libssl and
  libcrypto.

Closes #15832

7 months agocurl_ws_recv.md: fix typo
Jay Satiro [Fri, 27 Dec 2024 05:37:53 +0000 (00:37 -0500)] 
curl_ws_recv.md: fix typo

7 months agocmake: move `pkg-config` names to Find modules
Viktor Szakats [Sun, 22 Dec 2024 10:30:45 +0000 (11:30 +0100)] 
cmake: move `pkg-config` names to Find modules

Make the Find modules set and return their respective `pkg-config`
module name(s) to the CMake build process, which then adds those
to the `Requires:` list.

Before this patch, `pkg-config` module names were maintainted in two
separate places. After this patch, they are maintained in the Find
modules for dependencies that have one (most do).

Re-align existing modules with this change: msh3, mbedtls, rustls.
These modules return their `pkg-config` module name only when
detected via `pkg-config`.

Follow-up to d511ec8b0a56b2a99226fe556abe9f815153c648 #15573
Closes #15800

7 months agocmake: allow `CURL_LTO` regardless of `CURL_BUILD_TYPE`, enable in CI
Viktor Szakats [Tue, 24 Dec 2024 09:09:13 +0000 (10:09 +0100)] 
cmake: allow `CURL_LTO` regardless of `CURL_BUILD_TYPE`, enable in CI

Before this patch `CURL_LTO` only applied to builds explicitly
configured for `Release` or `RelWithDebInfo` via `CURL_BUILD_TYPE`.

After this patch it enables LTO regardess of build type.

Also:
- GHA/linux: enable LTO in an existing job.

Follow-up to 4ccf7622db04af58442c460b8091b952585de5c7 #4799
Closes #15829

7 months agocmake/FindLibpsl: protect against `pkg-config` "half-detection"
Viktor Szakats [Tue, 24 Dec 2024 09:12:31 +0000 (10:12 +0100)] 
cmake/FindLibpsl: protect against `pkg-config` "half-detection"

Same issue as seen before with libssh2: `libpsl`'s pkg-config module
depends on another module, but that's not found. CMake ends up reporting
`LIBPSL_FOUND=YES`, while leaving `LIBPSL_INCLUDE_DIRS` empty. Then
the build fails to find `psl.h`.

The missing dependency in this case is `icu4c`, which is "keg-only",
meaning it's not exposed in the default Homebrew header, pkg-config,
lib, etc locations. It must be added to the `PKG_CONFIG_PATH` env, as
suggested by the warnings messages of `pkgconf`.

To avoid this fallout, let's ensure that `LIBPSL_INCLUDE_DIRS` is
non-empty when detecting via `pkg-config` and fall back to the CMake
detection method otherwise.

This was an issue till Homebrew libpsl 0.21.5_1, fixed in 0.21.5_2, that
no longer depends on `icu4c`.

Example log:
```
-- Checking for module 'libpsl'
--   Found libpsl, version 0.21.5
Package icu-uc was not found in the pkg-config search path.
Perhaps you should add the directory containing `icu-uc.pc'
to the PKG_CONFIG_PATH environment variable
Package 'icu-uc', required by 'libpsl', not found
[...]
-- Found Libpsl (via pkg-config):  (found version "0.21.5")
[...]
In file included from curl/_bld/lib/CMakeFiles/libcurl_static.dir/Unity/unity_0_c.c:4:
In file included from curl/lib/altsvc.c:32:
In file included from curl/lib/urldata.h:145:
curl/lib/psl.h:28:10: fatal error: 'libpsl.h' file not found
         ^~~~~~~~~~
1 error generated.
```

Follow-up to 39c741b7b008b5959980b29ac721357ff75de3f5 #15408
Closes #15827

7 months agocmake/FindLDAP: avoid empty 'Requires' item when omitting `pkg-config` module
Viktor Szakats [Mon, 23 Dec 2024 20:36:23 +0000 (21:36 +0100)] 
cmake/FindLDAP: avoid empty 'Requires' item when omitting `pkg-config` module

`list(APPEND ...)` does this automatically, but we're _prepending_ LDAP
(to follow historical code and also autotools). `list(PREPEND ...)`
would likely do that the same, but it requires CMake 3.15 so we do this
manually and the manual method needs to skip the empty value manually.

Follow-up to 49f2a23d509645d534cbb2e2ffbd6347fac6e59e #15273
Closes #15828

7 months agotidy-up: misc
Viktor Szakats [Sat, 14 Dec 2024 22:52:38 +0000 (23:52 +0100)] 
tidy-up: misc

- lib1531: fix to use `curl_off_t`.
- src/tool_doswin: merge `_WIN32` guards.
- src/tool_doswin: limit `S_ISCHR()` to MS-DOS.
- src: dedupe `CURL_O_BINARY` macro into `tool_setup.h`.
- CMake/CurlTests.c: cleanup/formatting `HAVE_FILE_OFFSET_BITS` test.
- examples/httpput-postfields: delete unused include.
- spelling: MultiSSL.
- whitespace.

Ref: #15652
Closes #15799

7 months agocurl-config: tidy up, optimize
Viktor Szakats [Wed, 20 Nov 2024 21:01:32 +0000 (22:01 +0100)] 
curl-config: tidy up, optimize

- optimize out `cppflag_curl_staticlib` variable.
- optimize out `CPPFLAG_CURL_STATICLIB` variable and simplify logic.
- lowercase local variable name `CURLLIBDIR`.

Closes #15810

7 months agocmake: move GSS init before feature detections
Viktor Szakats [Mon, 23 Dec 2024 00:44:06 +0000 (01:44 +0100)] 
cmake: move GSS init before feature detections

To sync up with other dependency initializations.

Closes #15809

7 months agocurl_url_set.md: adjust the added-in to 7.62.0
Daniel Stenberg [Mon, 23 Dec 2024 22:56:25 +0000 (23:56 +0100)] 
curl_url_set.md: adjust the added-in to 7.62.0

Reported-by: Jeroen Ooms
Fixes #15822
Closes #15823

7 months agohttp: fix build with `CURL_DISABLE_COOKIES`
Marcel Raad [Mon, 23 Dec 2024 17:34:17 +0000 (18:34 +0100)] 
http: fix build with `CURL_DISABLE_COOKIES`

This fixes an oversight from commit fc3e1cbc508.

Closes https://github.com/curl/curl/pull/15820

7 months agoRELEASE-NOTES: synced
Daniel Stenberg [Mon, 23 Dec 2024 22:06:36 +0000 (23:06 +0100)] 
RELEASE-NOTES: synced

7 months agogetinfo: provide info which auth was used for HTTP and proxy
Daniel Stenberg [Tue, 29 Oct 2024 15:53:32 +0000 (16:53 +0100)] 
getinfo: provide info which auth was used for HTTP and proxy

CURLINFO_HTTPAUTH_USED and CURLINFO_PROXYAUTH_USED

Tested in 590 and 694

Ref: #12668
Idea-by: Ganesh Viswanathan
Closes #15450

7 months agobuild: fix the tidy targets for autotools
Daniel Stenberg [Sun, 22 Dec 2024 23:04:35 +0000 (00:04 +0100)] 
build: fix the tidy targets for autotools

To make them run clang-tidy correctly. clang-tidy occasionally finds
mistakes none of the other static code analyzers we use finds.

Also added the
-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling
flag, to make it not complain about memcpy()

"make tidy" in the build root works fine now. The previous clang-tidy CI
job was removed in e43c3b3e3e6c2d580. It is probably time to bring it
back.

Closes #15813

7 months agobuild: drop `-Winline` picky warning
Viktor Szakats [Mon, 23 Dec 2024 17:05:40 +0000 (18:05 +0100)] 
build: drop `-Winline` picky warning

To avoid this in certain debug build cases:
```
./lib/easy_lock.h:72:20: error: inlining failed in call to 'curl_simple_lock_lock': function not considered for inlining [-Werror=inline]
```

Ref: #13596
Reported-by: Rudi Heitbaum
Fixes #15815
Closes #15819

7 months agosrc: add `CURL_STRICMP()` macro, use `_stricmp()` on Windows
Viktor Szakats [Wed, 27 Nov 2024 11:34:38 +0000 (12:34 +0100)] 
src: add `CURL_STRICMP()` macro, use `_stricmp()` on Windows

Add `CURL_STRICMP()` macro that works on all platforms depending on
which lib C function is available.

Make sure to always use `_stricmp()` on Windows, which is the
non-deprecated, official API for this on this platform. Before this
patch it used a MinGW-specific call, or a deprecated compatibility
wrapper with MSVC.

Drop `stricmp` variant detections on Windows with autotools.

https://learn.microsoft.com/cpp/c-runtime-library/reference/stricmp-wcsicmp-mbsicmp-stricmp-l-wcsicmp-l-mbsicmp-l

Ref: #15652
Closes #15788

7 months agoQUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
Stefan Eissing [Mon, 2 Dec 2024 11:50:15 +0000 (12:50 +0100)] 
QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA

When a QUIC TLS session announced early data support and
'CURLSSLOPT_EARLYDATA' is set for the transfer, send initial request and
body (up to the 128k we buffer) as 0RTT when curl is built with
ngtcp2+gnutls.

QUIC 0RTT needs not only the TLS session but the QUIC transport
paramters as well. Store those and the earlydata max value together with
the session in the cache.

Add test case for h3 use of this. Enable quic early data in nghttpx for
testing.

Closes #15667

7 months agongtcp2: fix two cases of value stored never read
Daniel Stenberg [Mon, 23 Dec 2024 07:46:45 +0000 (08:46 +0100)] 
ngtcp2: fix two cases of value stored never read

Detected by clang-tidy

Closes #15812

7 months agoCURLOPT_PROXY.md: clarify the crendential support in proxy URLs
Daniel Stenberg [Sun, 22 Dec 2024 21:56:52 +0000 (22:56 +0100)] 
CURLOPT_PROXY.md: clarify the crendential support in proxy URLs

Ref: #15802
Closes #15805

7 months agoopenssl: fix ECH logic
Daniel Stenberg [Mon, 23 Dec 2024 08:59:33 +0000 (09:59 +0100)] 
openssl: fix ECH logic

- on error, bail out proper
- remove unused #define

Closes #15814

7 months agoGHA: drop codeql
Daniel Stenberg [Sat, 21 Dec 2024 13:58:24 +0000 (14:58 +0100)] 
GHA: drop codeql

We started using codeql for static code analysis in 7183f5acc3d7ca39,
June 2020.

Since then, not a single commit has been merged into the source code
repository citing codeql as source or reason. Yet, it keeps getting
updated and we get constant reminders to upgrade the pinning it to the
latest hash.

During 4.5 years with intense development and significant code churn.
While Coverity, scan-build and CodeSonar have belped us point out many
mistakes, codeql has remained silent (or had false positives).

For this little gain, I think we spend a disproportionate amount of work
on codeql maintanance.

We can try again in a future if we think it improves.

Assisted-by: Viktor Szakats
Closes #15798

7 months agovquic: make vquic_send_packets not return without setting psent
Daniel Stenberg [Sun, 22 Dec 2024 23:01:12 +0000 (00:01 +0100)] 
vquic: make vquic_send_packets not return without setting psent

This is debug code, but since the caller might use the value even when
this function returns error, it needs to be cleared properly here.

Spotted by Clang-tidy

Closes #15807

7 months agovquic: fix 4th function call argument is an uninitialized value
Daniel Stenberg [Sun, 22 Dec 2024 23:11:31 +0000 (00:11 +0100)] 
vquic: fix 4th function call argument is an uninitialized value

As recvmmsg_packets() could fail early and goto out before 'pkts' were
assigned.

Caught by clang-tidy

Closes #15808

7 months agohttp2: fix value stored to 'result' is never read
Daniel Stenberg [Sun, 22 Dec 2024 22:55:22 +0000 (23:55 +0100)] 
http2: fix value stored to 'result' is never read

Detected by clang-tidy

Closes #15806

7 months agocmake/FindLibssh: sync header comment with other modules
Viktor Szakats [Sun, 22 Dec 2024 10:16:24 +0000 (11:16 +0100)] 
cmake/FindLibssh: sync header comment with other modules

Follow-up to f66af623cfbf469ddef493dacca5bc760417021a #15388

7 months agocmake: delete accidental debug message [ci skip]
Viktor Szakats [Sun, 22 Dec 2024 10:45:45 +0000 (11:45 +0100)] 
cmake: delete accidental debug message [ci skip]

Follow-up to 39c741b7b008b5959980b29ac721357ff75de3f5 #15408

7 months agocf-socket: error if address can't be copied
Jay Satiro [Thu, 19 Dec 2024 22:12:02 +0000 (17:12 -0500)] 
cf-socket: error if address can't be copied

- When converting Curl_addrinfo to Curl_sockaddr_ex, if the address
  length is too large then return error CURLE_TOO_LARGE.

Prior to this change the address structure was truncated on copy, and
the length shortened which I think is incorrect.

AFAICS the only time it could conceivably happen is when a UNIX socket
path is too long, and even then curl should've accounted for that by
having a structure that is large enough to store it. This is why I added
a DEBUGASSERT for debug builds, because I don't think it should ever
happen.

Closes https://github.com/curl/curl/pull/15784

7 months agogitignore: ignore output files created by mk-ca-bundle.pl
Jay Satiro [Thu, 19 Dec 2024 22:52:11 +0000 (17:52 -0500)] 
gitignore: ignore output files created by mk-ca-bundle.pl

- Ignore mk-ca-bundle.pl's default output files
  ca-bundle.crt and certdata.txt.

Closes https://github.com/curl/curl/pull/15781

7 months agoexamples/block-ip: show how to block IP addresses
Jay Satiro [Sun, 15 Dec 2024 08:43:08 +0000 (03:43 -0500)] 
examples/block-ip: show how to block IP addresses

- Show how CURLOPT_OPENSOCKETFUNCTION can be used to block IP addresses.

This is a new example that demonstrates IP blocking.

Ref: https://github.com/curl/curl/discussions/15710#discussioncomment-11534877

Closes https://github.com/curl/curl/pull/15748

7 months agoprojects/Windows: remove wolfSSL from legacy projects
Jay Satiro [Fri, 1 Nov 2024 08:24:26 +0000 (04:24 -0400)] 
projects/Windows: remove wolfSSL from legacy projects

- Remove wolfSSL from the legacy projects for Visual Studio 2010 - 2013.

It's no longer possible to maintain the custom build configuration of
wolfSSL for these old versions of Visual Studio.

Note support for wolfSSL was recently added to the winbuild build system
in 4de627ab and the user could possibly make their own wolfSSL build and
attempt to link it using an old version of Visual Studio that way.

Ref: https://gist.github.com/jay/5f6d8d5ba15c12c7457e3216a94da72d

Closes https://github.com/curl/curl/pull/15468

7 months agocurl_multibyte: support Windows paths longer than MAX_PATH 13522/head
Jay Satiro [Fri, 3 May 2024 07:40:50 +0000 (03:40 -0400)] 
curl_multibyte: support Windows paths longer than MAX_PATH

- Add a helper function for the Windows file wrapper functions that will
  normalize a long path (or a filename in a long path) and add the
  prefix `\\?\` so that Windows will access the file.

Prior to this change if a filename (when normalized internally by
Windows to its full path) or a path was longer than MAX_PATH (260) then
Windows would not open the path, unless it was already normalized by the
user and had the `\\?\` prefix prepended.

The `\\?\` prefix could not be passed to file:// so for example
something like file://c:/foo/bar/filename255chars could not be opened
prior to this change.

There's some code in tool_doswin that will need to be modified as well
to further remove MAX_PATH (aka PATH_MAX) limitation.

Ref: https://github.com/curl/curl/issues/8361
Ref: https://github.com/curl/curl/pull/13512
Ref: https://learn.microsoft.com/en-us/dotnet/standard/io/file-path-formats
Ref: https://learn.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation

Closes https://github.com/curl/curl/pull/13522

7 months agollist: survive cleared list better
Daniel Stenberg [Sat, 21 Dec 2024 10:16:09 +0000 (11:16 +0100)] 
llist: survive cleared list better

Make Curl_node_uremove() and Curl_node_take_elem() properly survive
run-time when the ->list field has been cleared previously. Like when
Curl_node_take_elem() is called twice.

We have asserts to catch those situations to make sure we avoid them if
we can, but if they still happen in a non-debug build we should make
sure the functions survive proper.

Pointed out by CodeSonar.

Closes #15791

7 months agoRELEASE-NOTES: synced
Daniel Stenberg [Sat, 21 Dec 2024 13:15:03 +0000 (14:15 +0100)] 
RELEASE-NOTES: synced

7 months agocurl: make --etag-save acknowledge --create-dirs
Daniel Stenberg [Sat, 21 Dec 2024 10:45:28 +0000 (11:45 +0100)] 
curl: make --etag-save acknowledge --create-dirs

Add test 693 to verify

Fixes #15730
Suggested-by: Tamir Duberstein
Closes #15732

7 months agotool_formparse.c: make curlx_uztoso a static in here
Daniel Stenberg [Sat, 21 Dec 2024 11:50:01 +0000 (12:50 +0100)] 
tool_formparse.c: make curlx_uztoso a static in here

And drop the prefix. This function was not use elsewhere and it should
certainly not be present in libcurl code when not used in the library.

Closes #15796

7 months agoscripts/mdlinkcheck: fix the ../ handling in file links
Daniel Stenberg [Sat, 21 Dec 2024 12:26:56 +0000 (13:26 +0100)] 
scripts/mdlinkcheck: fix the ../ handling in file links

Follow-up to 62515e8e9d750f

Closes #15797

7 months agobinmode: convert to macro and use it from tests
Viktor Szakats [Wed, 27 Nov 2024 12:52:30 +0000 (13:52 +0100)] 
binmode: convert to macro and use it from tests

And use it from src and tests.

Syncing this functionality between platforms and build targets.

Also: Stop redefining `O_BINARY` in src, and use a local macro with
the same effect. `O_BINARY` is used in `CURL_SET_BINMODE()` to decide
if this functionality is supported, and redefining it makes this check
pass always in unity builds. The check is required for Apple OS, because
it offers a `setmode()` function, successfully detected by both CMake
and autotools, but that function has a different functionality and
signature than that expected by `CURL_SET_BINMODE()`.

Also:
- drop MetaWare High C (MS-DOS) support for set binmode.
- tests/libtest/Makefile.inc: dedupe comments.
- lib/curl_setup_once.h: tidy up feature guards for `io.h`, `fcntl.h`.

Ref: #15652
Closes #15787

7 months agovtls_cache: bail out proper if Curl_hmacit() fails
Daniel Stenberg [Sat, 21 Dec 2024 09:54:28 +0000 (10:54 +0100)] 
vtls_cache: bail out proper if Curl_hmacit() fails

Pointed out by CodeSonar

Closes #15790

7 months agoopenssl: avoid "redundant condition"
Daniel Stenberg [Sat, 21 Dec 2024 10:25:29 +0000 (11:25 +0100)] 
openssl: avoid "redundant condition"

Pointed out by CodeSonar

Closes #15792

7 months agoTODO: sending only part of --data is now possible
Daniel Stenberg [Sat, 21 Dec 2024 10:47:33 +0000 (11:47 +0100)] 
TODO: sending only part of --data is now possible

Since 40c264db617d02

Closes #15794

7 months agogetinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
Stefan Eissing [Thu, 7 Nov 2024 13:43:23 +0000 (14:43 +0100)] 
getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var

Let CURLINFO_QUEUE_TIME_T count only the time a transfer spends queued,
including possible redirect requests.

Add var 'time_queue' for reporting the time in write outs.

Add test for verifying correct reporting.

Closes #15512

7 months agocurl: add byte range support to --variable reading from file
Daniel Stenberg [Sat, 21 Dec 2024 10:46:27 +0000 (11:46 +0100)] 
curl: add byte range support to --variable reading from file

Allowing --variable read a portion of provided files, makes curl work on
partial files for any options that accepts strings. Like --data and others.

The byte offset is provided within brackets, with a semicolon separator
like: --variable name@file;[100-200]"

Inspired by #14479
Assisted-by: Manuel Einfalt
Test 784 - 789. Documentation update provided.

Closes #15739

7 months agohyper: drop support
Daniel Stenberg [Sat, 21 Dec 2024 10:33:05 +0000 (11:33 +0100)] 
hyper: drop support

lib : remove all hyper code
configure: stop detecting hyper
docs: no more mention of hyper
tests: mo more special-handling of hyper builds
CI: no jobs using hyper

Closes #15120

7 months agoexamples: make them compile with compatibility functions disabled (Windows)
Viktor Szakats [Thu, 28 Nov 2024 13:59:35 +0000 (14:59 +0100)] 
examples: make them compile with compatibility functions disabled (Windows)

For MinGW this is `-DNO_OLDNAMES`, with MSVC it is
`-D_CRT_DECLARE_NONSTDC_NAMES=0`.

There have been some support for this before this patch.
After this patch this is extended to all examples.

(And also the standalone http/client programs, if here.)

Cherry-picked from #15652
Closes #15789

7 months agoexamples/complicated: fix warnings, bump deprecated callback, tidy up
Viktor Szakats [Fri, 20 Dec 2024 01:00:22 +0000 (02:00 +0100)] 
examples/complicated: fix warnings, bump deprecated callback, tidy up

Also: make them C89, add consts.

Closes #15785

7 months agolib: TLS session ticket caching reworked
Stefan Eissing [Wed, 18 Dec 2024 12:22:35 +0000 (13:22 +0100)] 
lib: TLS session ticket caching reworked

Described in detail in internal doc TLS-SESSIONS.md

Main points:
- use a new `ssl_peer_key` for cache lookups by connection filters
- recognize differences between TLSv1.3 and other tickets
  * TLSv1.3 tickets are single-use, cache can hold several of them for a peer
  * TLSv1.2 are reused, keep only a single one per peer
- differentiate between ticket BLOB to store (that could be persisted) and object instances
- use put/take/return pattern for cache access
- remember TLS version, ALPN protocol, time received and lifetime of ticket
- auto-expire tickets after their lifetime

Closes #15774

7 months agoGHA: update ngtcp2 and nghttp3
renovate[bot] [Thu, 19 Dec 2024 20:43:21 +0000 (20:43 +0000)] 
GHA: update ngtcp2 and nghttp3

- ngtcp2 to v1.10.0
- nghttp3 to v1.7.0

Closes #15783
Closes #15782

7 months agoexamples/synctime.c: remove references to dead URLs and functionality
Daniel Stenberg [Fri, 20 Dec 2024 07:42:20 +0000 (08:42 +0100)] 
examples/synctime.c: remove references to dead URLs and functionality

This example can use the Date: header of any server so there is no point
in linking to ancient URLs describeing a setup at NIST that no longer
exists.

Closes #15786

7 months agoconfig-mac: drop `MACOS_SSL_SUPPORT` macro
Viktor Szakats [Wed, 18 Dec 2024 14:43:39 +0000 (15:43 +0100)] 
config-mac: drop `MACOS_SSL_SUPPORT` macro

It has been a synonym for `USE_OPENSSL` since
709cf76f6bb7dbaca14e3e8df160ccfac04dcecb (2015).

The few uses of this on GitHub also set `USE_OPENSSL` and
should be fine. Those which don't, please replace
`-DMACOS_SSL_SUPPORT` with `-DUSE_OPENSSL`.

Closes #15777

7 months agocmake: drop redundant opening/closing `.*` from `MATCH` expressions
Viktor Szakats [Wed, 18 Dec 2024 11:47:33 +0000 (12:47 +0100)] 
cmake: drop redundant opening/closing `.*` from `MATCH` expressions

Also from a corresponding `REPLACE` expression.

CMake matches expressions anywhere within the value without an explicit
`.*`.

https://cmake.org/cmake/help/latest/command/if.html#matches
https://cmake.org/cmake/help/latest/command/string.html#regex-match

Closes #15773

7 months agoRELEASE-NOTES: synced
Daniel Stenberg [Fri, 20 Dec 2024 09:08:08 +0000 (10:08 +0100)] 
RELEASE-NOTES: synced

7 months agoVULN-DISCLOSURE-POLICY.md: mention the not setting CVSS
Daniel Stenberg [Thu, 19 Dec 2024 13:25:32 +0000 (14:25 +0100)] 
VULN-DISCLOSURE-POLICY.md: mention the not setting CVSS

Closes #15779

7 months agohttp_aws_sigv4: Fix invalid compare function handling zero-length pairs
Kuan-Wei Chiu [Wed, 18 Dec 2024 18:09:57 +0000 (02:09 +0800)] 
http_aws_sigv4: Fix invalid compare function handling zero-length pairs

The compare_func() can violate the antisymmetric property required by
qsort. Specifically, when both aa->len == 0 and bb->len == 0, the
function returns conflicting results (-1 for compare_func(a, b) and -1
for compare_func(b, a)).

This violates the rules of qsort and may lead to undefined behavior,
including incorrect sorting or memory corruption in glibc [1].

Add a check to return 0 when both lengths are zero, ensuring proper
behavior and preventing undefined behavior in the sorting process.

Ref: https://www.qualys.com/2024/01/30/qsort.txt [1]

Closes #15778

7 months agovtls: remove 'detach/attach' functions from TLS handler struct
Daniel Stenberg [Wed, 18 Dec 2024 13:43:43 +0000 (14:43 +0100)] 
vtls: remove 'detach/attach' functions from TLS handler struct

Unused since 7c8bae0d9c9b2dfeeb

Closes #15776

7 months agovtls: remove unusued 'check_cxn' from TLS handler struct
Daniel Stenberg [Wed, 18 Dec 2024 12:54:42 +0000 (13:54 +0100)] 
vtls: remove unusued 'check_cxn' from TLS handler struct

The last use was removed in 7c5637b8b4

Closes #15775

7 months agovtls: replace "none"-functions with NULL pointers
Daniel Stenberg [Wed, 18 Dec 2024 10:46:37 +0000 (11:46 +0100)] 
vtls: replace "none"-functions with NULL pointers

For TLS backends that don't need these functions, they now use plain
NULL pointers instead of setting a function that does nothing.

Helps making it clearer that a specific TLS handler does not provide
anything specific for that action.

Closes #15772

7 months agonetrc: fix password-only entries
Daniel Stenberg [Tue, 17 Dec 2024 22:56:42 +0000 (23:56 +0100)] 
netrc: fix password-only entries

When a specific hostname matched, and only a password is set before
another machine is specified in the netrc file, the parser would not be
happy and stop there and return the password-only state. It instead
continued and did not return a match.

Add test 2005 to verify this case

Regression from e9b9bba, shipped in 8.11.1.

Reported-by: Ben Zanin
Fixes #15767
Closes #15768

7 months agocd2nroff: support "none" as a TLS backend
Daniel Stenberg [Tue, 17 Dec 2024 23:18:06 +0000 (00:18 +0100)] 
cd2nroff: support "none" as a TLS backend

When we remove support for a specific TLS backend, it might be the only
one that supports a specific feature and then we need to be able to go
"none".

Closes #15769

7 months agoCURLOPT_RESOLVE.md: fix wording
dwickr [Tue, 17 Dec 2024 23:22:54 +0000 (17:22 -0600)] 
CURLOPT_RESOLVE.md: fix wording

(`*`) It's an asterisk, not an ampersand.

Closes https://github.com/curl/curl/pull/15770

7 months agoGHA/macos: drop custom `macos-version-min` options
Viktor Szakats [Tue, 17 Dec 2024 14:54:53 +0000 (15:54 +0100)] 
GHA/macos: drop custom `macos-version-min` options

Drop them, except for Secure Transport jobs where they may trigger
different code paths.

Also drop unused `matrix.build.cflags` variable.

Follow-up to ef90ee39e129eb463cf866898a8581250c824761 #15763
Closes #15766

7 months agolib: supress deprecation warnings in apple builds
Stefan Eissing [Tue, 17 Dec 2024 08:45:10 +0000 (09:45 +0100)] 
lib: supress deprecation warnings in apple builds

On apple builds, the gssapi/ldap/securetransport headers deprecate
almost everything which leads to a wall of compiler warnings on use in
code.

Suppress those warning that may hide other warnings/errors.

Closes #15763

7 months agotool_formparse: accept digits in --form type= strings
Daniel Stenberg [Tue, 17 Dec 2024 06:52:06 +0000 (07:52 +0100)] 
tool_formparse: accept digits in --form type= strings

Adjusted test 186 to verify.

Regression in 9664d5a5475fdc66, shipped in 8.11.1

Reported-by: IcedCoffeee on github
Assisted-by: Jay Satiro
Fixes #15761
Closes #15762

7 months agomultissl: make openssl + wolfssl builds work
Viktor Szakats [Sat, 16 Nov 2024 20:24:17 +0000 (21:24 +0100)] 
multissl: make openssl + wolfssl builds work

- make colliding vtls static function names unique.
- wolfssl: stop including an unused compatibility header.
- cmake: adapt detection logic for openssl+wolfssl coexist.
- wolfssl: fix to use native wolfSSL API in ECH codepath.
- openssl+wolfssl: fix ECH code to coexist.

Requires a post wolfSSL v5.7.4, recent master for `OPENSSL_COEXIST`
feature, and `CPPFLAGS=-DOPENSSL_COEXIST`.

Ref: https://github.com/wolfSSL/wolfssl/issues/8194

Closes #15596

7 months agochecksrc: fix the return() checker
Daniel Stenberg [Tue, 17 Dec 2024 10:08:13 +0000 (11:08 +0100)] 
checksrc: fix the return() checker

It would previously wrongly also catch function calls to function names
ending with 'return'

Amended test1185.

Reported-by: Stefan Eissing
Closes #15764

7 months agocmake: extend zlib's `AUTO` option to brotli, zstd and enable if found
Viktor Szakats [Mon, 28 Oct 2024 13:27:00 +0000 (14:27 +0100)] 
cmake: extend zlib's `AUTO` option to brotli, zstd and enable if found

- make `curl_dependency_option()` more generic.

- extend `CURL_BROTLI` and `CURL_ZSTD` options to accept
  `AUTO` in addition to existing `ON` and `OFF`.

- change `CURL_BROTLI` and `CURL_ZSTD` option default
  to `AUTO`. Was: `OFF`.
  It brings cmake behavior closer to `./configure`.
  Still different:
  - `./configure` defaults to `off` which means to check default
    locations. cmake checks more locations by default.
    (Also tried `NO_CMAKE_PATH`, but then it checked less locations.)
  - cmake returns both `brotlicommon` and `brotlidec` libs,
    while `./configure` only returns the latter.

- ci: drop explicit cmake options, that are now unnecessary.

- GHA/configure-vs-cmake: make adjustments to make tests pass.

Closes #15431

7 months agoRevert: cmake: enable `CURL_USE_PKGCONFIG` for cross-`MINGW`
Viktor Szakats [Tue, 17 Dec 2024 02:20:30 +0000 (03:20 +0100)] 
Revert: cmake: enable `CURL_USE_PKGCONFIG` for cross-`MINGW`

This reverts commit 39c06f7883f448c222082c0dbb3d9a4c5eae2826 #15005.

Combined with most Find modules now supporting `pkg-config`
(39c741b7b008b5959980b29ac721357ff75de3f5 #15408) this change made
mingw-cross builds fragile by picking up OS-native components. Also
adding `/usr/include` to the header path, confusing feature detection.

7 months agocmake: add native `pkg-config` detection for remaining Find modules
Viktor Szakats [Fri, 25 Oct 2024 00:26:33 +0000 (02:26 +0200)] 
cmake: add native `pkg-config` detection for remaining Find modules

brotli, c-ares, libpsl, libssh2, nghttp2, nghttp3, ntgcp2, zstd.

Also:

Add workaround for CMake reporting successful libssh2 detection, but
leaving the header directory empty, and causing `libssh2.h` not found
while compiling. It happens when `pkgconf` is not detecting libssh2
dependency libcrypto in Homebrew after `brew unlink openssl` (as in
GHA/macos). The workaround is to require a non-empty header directory
to consider the detection successful. This workaround may need to be
tweaked and/or applied to other Find modules.

Follow-up to 7bab201abe3915a0167c002f9308950cb8a06e4b #15193

Closes #15408

7 months agoMakefile.mk: drop in favour of autotools and cmake (MS-DOS, AmigaOS3)
Viktor Szakats [Sat, 16 Nov 2024 18:04:36 +0000 (19:04 +0100)] 
Makefile.mk: drop in favour of autotools and cmake (MS-DOS, AmigaOS3)

`Makefile.mk` supported MS-DOS and Amiga, but `./configure` also
supported them in a better tested and more flexible way.

This patch also adds CMake support for MS-DOS/DJGPP and Amiga OS 3.

`Makefile.mk` was not maintained. Delete it in favour of first-tier
build methods.

Also include some non-MS-DOS/AmigaOS-specific tidy-up, see details at
the end of this message.

Details:

- fix/silence all MS-DOS/DJGPP build warnings and issues.
- add MS-DOS support to cmake.
  - default to `ENABLE_THREADED_RESOLVER=OFF` for MS-DOS.
  - add support for `WATT_ROOT`.
  - use static libcurl with MS-DOS.
  - fixup default CMake suffixes/prefixes for DJGPP.
  - disable hidden symbols for MS-DOS. Not supported on MS-DOS.
  - opt-in MS-DOS into `USE_UNIX_SOCKETS`.
- improve MS-DOS support in autotools.
  - default to `--disable-threaded-resolver` for MS-DOS.
- make sure to use `close_s()` (from Watt-32) with autotools and cmake.
  `Makefile.mk` used it before this patch.
- GHA: add DJGPP cmake (~30s) and autotools (~60s) build jobs.
  Also build tests and examples with cmake.
- improve AmigaOS support in autotools:
  - configure: detect `CloseSocket()` when it's a macro.
  - configure: fix `IoctlSocket` detection on AmigaOS.
  - curl-amissl.m4: pass AmiSSL libs to tests/servers.
- add AmigaOS3 support to cmake:
  - cmake: fix `HAVE_IOCTLSOCKET_CAMEL` and
    `HAVE_IOCTLSOCKET_CAMEL_FIONBIO` detections.
  - set necessary system libs.
  - add AmiSSL support.
  - inet_ntop, inet_pton: fix using it for AmigaOS. cmake detects them,
    and they did not compile with AmigaOS.
  - cmake: better sync `gethostname` detection with autotools.
    Fixes detection for AmigaOS, where `gethostname` is a macro.
  - cmake: fix `sys/utime.h` detection on AmigaOS.
  - cmake: force-disable `getaddrinfo` for AmigaOS.
  - cmake: tweak threading and static/shared default for AmigaOS.
  - cmake: rely on manual variable `AMIGA` to enable the platform.
- GHA: add AmigaOS cmake and autotools (~45s) jobs.
  Also build tests and examples with cmake.
- INSTALL: update MS-DOS and AmigaOS build instructions.
- amigaos: fix `-Wpointer-sign` and
  `zero or negative size array '_args'` in `Printf()`.
- amigaos: fix `-Wpointer-sign`
- amigaos: fix `-Wredundant-decls` `errno` and `h_errno`.
- amigaos: brute-force silence `lseek()` size warnings.
- amigaos: server/resolve: silence `-Wdiscarded-qualifiers`.
- amigaos: server/resolve: fix `-Wpointer-sign`.
- amigaos: fix `CURL_SA_FAMILY_T` type.
- nonblock: prefer `HAVE_IOCTLSOCKET_CAMEL_FIONBIO` for AmigaOS.
  `ioctl` is also detected, but fails when used. Make the above override
  it for a successful build.
Authored-by: Darren Banfi
  Fixes #15537
  Closes #15603
- tftpd: prefer `HAVE_IOCTLSOCKET_CAMEL_FIONBIO` for AmigaOS.
- tftpd: tidy-up conditional code.
- curl: set stack size to 16384 for AmigaOS3/4
  Overriding the default 4096.
Suggested-by: Darren Banfi
  Ref: https://github.com/curl/curl/pull/15543#issuecomment-2498783123
  Ref: https://wiki.amigaos.net/wiki/Controlling_Application_Stack
- functypes.h: fix `SEND_QUAL_ARG2` for AmigaOS.
- tftp: add missing cast in sendto() call for AmigaOS.
- getinfo: fix warning with AmigaOS.
- tool_operate: silence warning with AmigaOS
- amigaos: fix building libtests due to missing `RLIMIT_NOFILE`.
- curl_gethostname: silence warning for AmigaOS.
- ftp: silence `-Wtype-limits` for AmigaOS.
- libtest: fix timeval initialization for AmigaOS.
- examples: fix `timeval` initialization for AmigaOS.
- examples: silence warning for AmigaOS.
- configure: fix IPv6 detection for cross-builds.
- netrc: fix to build with AmigaOS cleanly.
- buildinfo: detect and add `DOS` tag for MS-DOS builds.
- buildinfo: add `AMIGA` to buildinfo.txt in auttools.
- build: move `USE_WATT32` macro definition to cmake/configure.

Non-MS-DOS/AmigeOS-specific tidy-ups:

- configure: sync `sa_family_t` detection with cmake.
- configure: sync `ADDRESS_FAMILY` detection signals with cmake.
- doh: use `CURL_SA_FAMILY_T`.
- lib: drop mingw-specific `CURL_SA_FAMILY_T` workaround.
- cmake: extend instead of override check-specific
  configurations/requirements.
  This allows to honor global requirements added earlier.
  Necessary for AmigaOS for example.
- cmake: omit warning on disabled IPv6 for MS-DOS and AmigaOS.
  No IPv6 support on these platforms. Also sync with autotools.
- lib1960: use libcurl `inet_pton()` wrapper.
- cmake: detect LibreSSL (to match autotools).
- cmake: say the specific OpenSSL flavour detected.
- hostip: add missing `HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID` guard.
- lib: simplify classic mac feature guards.

Follow-up to a8861b6ccdd7ca35b6115588a578e36d765c9e38 #9764

Closes #15543

7 months agoINSTALL.md: sync with my brag slide "104 operating systems"
Daniel Stenberg [Mon, 16 Dec 2024 12:01:15 +0000 (13:01 +0100)] 
INSTALL.md: sync with my brag slide "104 operating systems"

Minoca, Nintendo 3DS and Maemo were missing.

Rename OS/400 to IBM I

Closes #15755

7 months agocmake: enable `CURL_USE_PKGCONFIG` for cross-`MINGW`
Viktor Szakats [Sun, 22 Sep 2024 17:58:48 +0000 (19:58 +0200)] 
cmake: enable `CURL_USE_PKGCONFIG` for cross-`MINGW`

Enable `CURL_USE_PKGCONFIG` by default for MinGW cross-builds.

Note: This may cause fallouts in certain envs where `pkg-config` picks
up native packages.

Follow-up to e1ab01d1bd13f0ec79c97ac7e19e4b8108dce270 #14658
Follow-up to c555ab469d74756b0e3a21f797237d53f9334ce3 #14575

Closes #15005

7 months agocmake: namespace functions and macros
Viktor Szakats [Wed, 6 Nov 2024 13:00:04 +0000 (14:00 +0100)] 
cmake: namespace functions and macros

Prefix (or suffix) curl-defined macro and function names with `curl`.
To avoid collisions with non-curl CMake and to make them recognizable
as curl-specific calls.

Closes #15498

7 months agocmake: clang-cl improvements
Viktor Szakats [Sat, 2 Nov 2024 20:11:28 +0000 (21:11 +0100)] 
cmake: clang-cl improvements

- drop `/clang:` prefix for `-W` options for clang-cl.
  Except for `-Wall` which gets interpreted as MSVC `/Wall`
  and translated to `-Weverything`, which is undesired.
  Related: https://github.com/llvm/llvm-project/issues/102982

- include `MSVC_VERSION` in target flags.
  Useful for clang-cl builds where this information doesn't appear
  elsewhere in the cmake configure log.

- suppress `-Wlanguage-extension-token` more for clang-cl.
  This fixes clang-cl builds with default `CURL_WERROR=OFF` and
  `PICKY_COMPILER=ON`.
  This warning is enabled by `-pedantic` as a warning and by
  `-pedantic-errors` as an error. Verifiable using llvm's
  `diagtool show-enabled -pedantic test.c`.
  Follow-up to fb711b50981e86c9dcdd6c2ba468b5d32edbcfce #15449

Closes #15478

7 months agocmake: replace `unset(VAR)` with `set(VAR "")` for init
Viktor Szakats [Wed, 6 Nov 2024 12:53:12 +0000 (13:53 +0100)] 
cmake: replace `unset(VAR)` with `set(VAR "")` for init

Also add cleanup `unset()`s where missing.

Reported-by: Kai Pastor
Bug: https://github.com/curl/curl/pull/15255#issuecomment-2458659626
Follow-up to 8b09138083640039ce35657a68eeb10b903ed0a5 #14610

Closes #15497

7 months agoGHA/codeql-analysis: install libpsl
Viktor Szakats [Mon, 16 Dec 2024 19:58:31 +0000 (20:58 +0100)] 
GHA/codeql-analysis: install libpsl

Stay with the default CMake build. It requires libpsl now, but
the latest Ubuntu runner no longer seems to provide it. Install it
manually.

Bug: https://github.com/curl/curl/pull/15464#issuecomment-2546602052
Follow-up to 7afbc39173f1dc00b99ebe3b08837d6d051672d6 #15464

Closes #15760

7 months agocmake: make libpsl required by default
Viktor Szakats [Thu, 31 Oct 2024 11:12:49 +0000 (12:12 +0100)] 
cmake: make libpsl required by default

As done earlier in `./configure`:

To force users to explictily disable it if they really don't want it
used and make it harder to accidentally miss it.

`-DCURL_USE_LIBPSL=OFF` is the option to use if PSL is not wanted.

Follow-up to 2998874bb61ac6ef3b72d6a61467cd2aaf6e53ea #12661

Closes #15464

7 months agocmake: add LDAP Find module
Viktor Szakats [Fri, 11 Oct 2024 21:40:37 +0000 (23:40 +0200)] 
cmake: add LDAP Find module

Move LDAP detection to its own Find module.

It supports `pkg-config` and the standard detection method used for
other dependencies, with version detection.

In curl CI it fixes LDAP detection in the OpenBSD job.

Closes #15273

7 months agolib: replace `inline` redefine with `CURL_INLINE` macro
Viktor Szakats [Fri, 8 Nov 2024 14:47:19 +0000 (15:47 +0100)] 
lib: replace `inline` redefine with `CURL_INLINE` macro

Instead of redefining the `inline` keyword, introduce curl's own
`CURL_INLINE` macro and set it depending on the compiler's capabilities,
or use its value set via custom C flags.

Also keep honoring a custom `inline` macro, if set.

Closes #15523

7 months agocmake: use `CMAKE_REQUIRED_LINK_DIRECTORIES`
Viktor Szakats [Sat, 12 Oct 2024 22:34:23 +0000 (00:34 +0200)] 
cmake: use `CMAKE_REQUIRED_LINK_DIRECTORIES`

Use `CMAKE_REQUIRED_LINK_DIRECTORIES` with CMake 3.31.0 and upper,
in local macro `curl_required_libpaths()`.

https://github.com/Kitware/CMake/commit/9e95bd49f278cd2a05caf21fd624a41e4bfaba60
https://gitlab.kitware.com/cmake/cmake/-/commit/9e95bd49f278cd2a05caf21fd624a41e4bfaba60
https://gitlab.kitware.com/cmake/cmake/-/merge_requests/9795
https://cmake.org/cmake/help/v3.31/module/CheckSymbolExists.html

Tested OK with cmake 3.31.0-rc1.

Follow-up to 01a81579977b3872935d508e306a735f0568d113 #15271
Follow-up to 7bab201abe3915a0167c002f9308950cb8a06e4b #15193

Closes #15280

7 months agocmake: drop redundant FOUND checks (libgsasl, libssh, libuv)
Viktor Szakats [Thu, 31 Oct 2024 11:26:37 +0000 (12:26 +0100)] 
cmake: drop redundant FOUND checks (libgsasl, libssh, libuv)

With `find_package(... REQUIRED)` the configuration fails and exits
if the package is not found. The `..._FOUND` check afterwards always
evaluates true and safe to delete.

Also true for brotli and zstd, but those are addressed differently
via #15431.

Closes #15465

7 months agocmake: improve `curl_dumpvars()` and move to `Utilities.cmake`
Viktor Szakats [Tue, 12 Nov 2024 20:37:07 +0000 (21:37 +0100)] 
cmake: improve `curl_dumpvars()` and move to `Utilities.cmake`

Also:
- dump variable types.
- show which variables are marked as advanced.
- use `IN ITEMS`.

Closes #15562

7 months agobuild: drop unused feature macros, update exception list
Viktor Szakats [Wed, 13 Nov 2024 21:38:58 +0000 (22:38 +0100)] 
build: drop unused feature macros, update exception list

- cmp-config.pl: add remaining exceptions. Sort list.

- drop unused `HAVE_SYS_WAIT_H`.
  Follow-up to 50def7c881ba560ab6e0235990e8f07fa69f4bc8 #13249

- drop unused `HAVE_FCHMOD`.
  Follow-up to 03cb1ff4d629d6110dab787c75c187626d58323d #12395

- autotools: stop promoting variables to macros:
  `USE_NGTCP2_CRYPTO_*`, `USE_NGTCP2_H3`, `USE_OPENSSL_H3`,
  `HAVE_LIBRESSL`.
  They are not used in the source.

- cmake: drop unused `HAVE_O_NONBLOCK`,
  `HAVE_DISABLED_NONBLOCKING`.

- lib: drop `NEED_MALLOC_H`.
  It was used in manual-build cases for Amiga/MS-DOS/Windows/WinCE, but
  never by autotools/cmake, thus apparently unnecessary.

- lib: drop unused `NEED_MEMORY_H`.

- lib: simplify classic mac feature guards,
  drop `HAVE_EXTRA_STRICMP_H` and `HAVE_EXTRA_STRDUP_H`.

- autotools: drop unused `HAVE_GETHOSTBYNAME` detection.

- autotools: drop unused OpenSSL feature tests:
  `HAVE_ERR_H`, `HAVE_PEM_H`, `HAVE_RSA_H`

- autotools: drop unused OpenSSL feature tests:
  `HAVE_X509_H`, `HAVE_CRYPTO_H`, `HAVE_SSL_H`.

  They performed a fallback check when the primary check missed
  `openssl/x509.h`. Though if any other prefixed headers were found,
  OpenSSL is already assumed detected.

  The fallback check was looking for 3 unprefixed OpenSSL headers, and
  if all found, marked OpenSSL found internally, but did not promote
  it to `curl_config.h` via `USE_OPENSSL`. Meaning it either didn't do
  anything or may have continued with an inconsistent state.
  Added in d99c20f62876457ca6880d706825e68f695bda18 (2008)

  At the time, there was an extra `AC_DEFINE(USE_SSLEAY, 1 ...` logic
  after this code, which kicked in in the fallback case, but that code
  was deleted in 709cf76f6bb7dbaca14e3e8df160ccfac04dcecb (2015)

  Follow-up to 709cf76f6bb7dbaca14e3e8df160ccfac04dcecb

- autotools: drop `AC_SUBST()` where the value is explicitly set anyway
  and the macro is unused.

- autotools: replace `AC_SUBST(VAR, 1)` with local variable assigments,
  where the `@VAR@` macro is unused. Also dedupe the local variable if
  there was a parallel one used for the same purpose.

- autotools: drop local feature variables that were never used.

- autotools: drop unused `CURL_CHECK_OPTION_NTLM_WB`,
  `CURL_CHECK_NTLM_WB`.
  Also stop setting unused `NTLM_WB_ENABLED` macro for VMS.
  Follow-up to 50def7c881ba560ab6e0235990e8f07fa69f4bc8 #13249

- autotools: drop unused `PKGADD_*`.
  Follow-up to bae0d473f5912d38fc8da1f9850a70b015b53c9e #3331

- autotools: drop unused `CURL_NETWORK_LIBS`.
  Follow-up to 3af75e18d691af24c4a11ee6cb1441de44b3a836 #14697

Closes #15577

7 months agoGHA: set `persist-credentials: false`
Viktor Szakats [Sat, 14 Dec 2024 23:45:04 +0000 (00:45 +0100)] 
GHA: set `persist-credentials: false`

Suggested by zizmor GHA analysis tool.

Also:
- Move GH variables within single-quotes.
- Prefer single-quotes in shell code. (tidy-up)

Ref: https://github.com/actions/checkout/issues/485
Ref: https://github.com/actions/checkout/pull/1687
Ref: https://woodruffw.github.io/zizmor/

Closes #15746

7 months agoRELEASE-NOTES: synced
Daniel Stenberg [Mon, 16 Dec 2024 09:09:22 +0000 (10:09 +0100)] 
RELEASE-NOTES: synced

7 months agovariable.md: mention --expand-variable for variables to variables
Daniel Stenberg [Sun, 15 Dec 2024 22:07:57 +0000 (23:07 +0100)] 
variable.md: mention --expand-variable for variables to variables

To assign a variable using contents from another variable.

Closes #15752

7 months agotool_getparam: fix memory leak on error in parse_ech
Hermes Zhang [Mon, 16 Dec 2024 04:55:57 +0000 (12:55 +0800)] 
tool_getparam: fix memory leak on error in parse_ech

- Free tmpcfg memory before returning an error code if aprintf failed.

Closes https://github.com/curl/curl/pull/15753

7 months agows-docs: remove the outdated texts saying ws support is experimental
Daniel Stenberg [Sun, 15 Dec 2024 14:57:13 +0000 (15:57 +0100)] 
ws-docs: remove the outdated texts saying ws support is experimental

It stopped being experimental in 8.10.0

Fixes #15749
Reported-by: Mohammed Sadiq
Closes #15751

7 months agoaltsvc: avoid integer overflow in expire calculation
Daniel Stenberg [Sat, 14 Dec 2024 22:09:16 +0000 (23:09 +0100)] 
altsvc: avoid integer overflow in expire calculation

A bad value here just makes for a bad alt-svc experience, not a security
problem.

Detected by OSS-Fuzz

Bug: https://issues.oss-fuzz.com/issues/383911309

Closes #15745

7 months agocmake/FindMbedTLS: drop lib duplicates early
Viktor Szakats [Wed, 6 Nov 2024 11:40:56 +0000 (12:40 +0100)] 
cmake/FindMbedTLS: drop lib duplicates early

When de-duplicating the list of raw libs, make sure to drop duplicates
from the beginning of the list.

Reported-by: Kai Pastor
Ref: https://github.com/curl/curl/pull/15273#pullrequestreview-2417191841
Closes #15495

7 months agovariable.md: show function use with examples
Daniel Stenberg [Sat, 14 Dec 2024 13:32:18 +0000 (14:32 +0100)] 
variable.md: show function use with examples

Closes #15743

7 months agodocs/BUGS.md: remove leading space from a link
Daniel Stenberg [Sat, 14 Dec 2024 12:31:52 +0000 (13:31 +0100)] 
docs/BUGS.md: remove leading space from a link