Daniel Stenberg [Mon, 14 Jul 2025 06:59:04 +0000 (08:59 +0200)]
VULN-DISCLOSURE-POLICY.md: 7 days embargo is max
It was recently updated in this doc to seven, but there was *two*
numbers mentioned and only one of them were updated leaving the
paragraph quite confusing.
Viktor Szakats [Sun, 13 Jul 2025 01:28:19 +0000 (03:28 +0200)]
GHA: minor tidy-ups
- GHA/checksrc: make a step name more accurate.
- cmakelint.sh: make sure to run from project root.
To make it easier to run locally.
- cmakelint.sh: use `set -eu`.
Viktor Szakats [Sat, 12 Jul 2025 16:07:51 +0000 (18:07 +0200)]
GHA/checksrc: use Linux for CI checks, merge job into misc checks
CI check used macOS before this patch, but with the help of Linuxbrew,
latest zizmor and shellcheck are also available on Linux.
Also:
- migrate CI checks to the misc check workflow, to make both shellcheck
use the same, latest, shellcheck version, and to save the overhead of
an extra workflow.
Daniel McCarney [Fri, 11 Jul 2025 20:19:12 +0000 (16:19 -0400)]
lib/vts: fix a copy-pasted early data comment typo
In gtls.c there was a typo'd comment that I think was missing the word
"no" to indicate there's "no GnuTLS way to signal no EarlyData".
This commit fixes that typo, and also updates a copy-pasted instance
that made it into wolfssl.c where it should refer to the WolfSSL API
missing the capability, not GnuTLS.
Viktor Szakats [Wed, 9 Jul 2025 22:36:03 +0000 (00:36 +0200)]
test1175: fix to run, and fix documentation issues detected
Fix test 1175 by passing the source root directory (was: tests).
Before this patch this caused silent Perl warnings and returning success
without executing the tests, due to:
```
readline() on closed filehandle $f at ../../tests/test1175.pl line 55.
readline() on closed filehandle $f at ../../tests/test1175.pl line 39.
```
Running the test revealed these issues:
```
CURLE_FUNCTION_NOT_FOUND is not in libcurl-errors.md
CURLE_HTTP_POST_ERROR is not in libcurl-errors.md
CURLE_TELNET_OPTION_SYNTAX is not in libcurl-errors.md
CURLM_CALL_MULTI_SOCKET is not in libcurl-errors.md
```
Apply fixes:
- mark `CURLE_FUNCTION_NOT_FOUND` deprecated by 7.53.0
- mark `CURLE_HTTP_POST_ERROR` deprecated by 7.56.0
- mark `CURLE_TELNET_OPTION_SYNTAX` deprecated by 7.78.0
- document `CURLM_CALL_MULTI_SOCKET` as a synonym for
`CURLM_CALL_MULTI_PERFORM`
- test1477: exclude `CURLM_CALL_MULTI_SOCKET`.
But, these weren't officially deprecated. It may need more updates
to reflect that in other places, or fix the issues differently.
Viktor Szakats [Thu, 10 Jul 2025 07:55:02 +0000 (09:55 +0200)]
checksrc-all: rewrite in Perl, remove `checksrc.bat`
`checksrc.bat` was outdated and required Perl for `checksrc.pl` anyway.
Rewrite `checksrc-all.sh` in Perl, making it usable in envs without
a POSIX shell.
Viktor Szakats [Wed, 9 Jul 2025 14:33:17 +0000 (16:33 +0200)]
libtests: more header tidy-ups
- make `test*` sources include `first.h`, like all others.
- drop redundant `curlx/*` includes after the above.
- merge `test.h` into `first.h`, now that no other file uses it.
(and `first.h` had almost no content.)
To simplify and sync header structure with other tests.
Viktor Szakats [Wed, 9 Jul 2025 11:01:57 +0000 (13:01 +0200)]
test1499, 1599: use `%LOGDIR`
Fixing test 1599 also fixes these warnings in the test log:
```
Use of uninitialized value in join or string at /home/runner/work/curl/curl/tests/runner.pm line 774.
```
https://github.com/curl/curl/actions/runs/16157402085/job/45602590085?pr=17768#step:39:743
Assisted-by: Daniel Stenberg
Fixes #17871
Closes #17874
Viktor Szakats [Tue, 8 Jul 2025 22:43:44 +0000 (00:43 +0200)]
tests: move `curlcheck.h` to libtest as `unitcheck.h`
To simplify dependencies, and sync tunits and units builds further.
`curlcheck.h` already depended on logic implemented within libtests:
it referenced a global variable (`unitfail`) defined in `first.c` and
declared in `test.h`.
Also:
- rename to `unitcheck.h` to indicate it's meant for unit tests.
- make `unitcheck.h` include `first.h` instead of `test.h`.
This brings header use closer to libtests. It also includes
`curlx/curlx.h` for all unit tests by default now.
- move `unitfail` declaration from `test.h` to `first.h`.
To match its definition in `first.c`.
- drop now redundant per-test curlx header includes.
Viktor Szakats [Tue, 8 Jul 2025 20:38:02 +0000 (22:38 +0200)]
tests: fix 1301, 1308 to fail on error
They were using a macro designed for unit tests. It does not fail when
used in libtests. Make similar macros for these tests, and make them
return a failure.
Also:
- makes these two tests align with the rest of libtests, by including
`first.h` instead of `curlcheck.h`.
- since libtests no longer need to depend on tests/unit, drop this
dependency from build scripts.
Viktor Szakats [Mon, 7 Jul 2025 09:46:26 +0000 (11:46 +0200)]
windows: drop redundant `curl_wcsdup_callback` callback
This callback was permanently mapped to libcurl's internal
`Curl_wcsdup()`, which always uses the customizable malloc for
allocation, thus making a custom mapping redundant anyway.
To simplify, drop the callback and map `_tcsdup()` in Unicode mode
directly to `Curl_wcsdup()`.
Also fixes:
- `curl_global_init()` which, before this patch, (re)initialized its
mapping to `_wcsdup()`, returning buffers potentially incompatible
with a custom allocator.
Bug: https://github.com/curl/curl/pull/17840#issuecomment-3044361245
Bug: https://github.com/curl/curl/pull/7540#issuecomment-2380995349 Co-reported-by: Luca Kellermann
Follow-up to 76e047fc27b3a0b9e6d6d00cacf536e7b7c1b532 #7540 Assisted-by: Jay Satiro
Closes #17843
Daniel Stenberg [Fri, 4 Jul 2025 21:57:03 +0000 (23:57 +0200)]
runtests: support memory-limits per test
The idea here is to set limits per test how many allocations and maximum
amount of memory it is allowed to use. This is a means to make sure the
number and total size of allocations are kept in check and don't
mistakenly "blow up".
If runtests.pl detects that the given limits have been exceeded it fails
the test case with an error.
The `<verify>` part now supports `<limits>`, and in this section two
limits can be set for each test (verified in debug builds only):
Allocations: [number of allocation calls]
Maximum allocated: [maximum concurrent memory allocated]
Default limits (used if nothing is set in the test file):
Viktor Szakats [Mon, 7 Jul 2025 14:19:24 +0000 (16:19 +0200)]
CI: sync curl download command-line options
- circleci: pipe to tar.
- use long options uniformly.
- sync option order.
- set timeout where missing.
- set retry where missing.
- set `--retry-connrefused` where missing.
- set `--disable` where missing.
- lower 999s timeouts to 120s.
Stefan Eissing [Thu, 3 Jul 2025 10:06:41 +0000 (12:06 +0200)]
quic: implement CURLINFO_TLS_SSL_PTR
Replace the old Curl_ssl_get_internals() with a new connection filter
query to retrieve the information. Implement that filter query for TCP
and QUIC TLS filter types.
Add tests in client tls_session_reuse to use the info option and check
that pointers are returned.
Reported-by: Larry Campbell
Fixes #17801
Closes #17809
Viktor Szakats [Sun, 6 Jul 2025 10:35:00 +0000 (12:35 +0200)]
rustls: apply memory function overrides, fixing an ECH buffer free
Fixing:
- a raw `free()` in ECH code that's malloced in lib code, causing
an invalid free, also reported by valgrind (in non-unity builds).
And in unity builds adjusted to behave like non-unity via #17827:
Ref: https://github.com/curl/curl/actions/runs/16093372427/job/45421778472?pr=17827#step:39:3321
- a local pair of `malloc()`/`free()` to use curl's memory allocators,
and participate in memory tracking when enabled.
Viktor Szakats [Fri, 4 Jul 2025 04:15:54 +0000 (06:15 +0200)]
cmake: `curl_add_clang_tidy_test_target` tidy-ups
- simplify gathering header directories and compiler definitions
recursively.
- handle the case when the cmake directory object doesn't define header
directories or compiler definitions.
- honor more corners cases:
- `INTERFACE_INCLUDE_DIRECTORIES` of the initial target.
- handle no header directory for initial target.
- de-duplicate header directories and compiler redefinitions to mimic
CMake.
- drop unnecessary `unset()`s.
Note that the order of header directories remains different compared to
how CMake passes them to the compiler when building tests. The order is
already different in the test target `INCLUDE_DIRECTORIES` property,
preventing to reproduce the exact CMake order. The distinction between
`-I` and `-isystem` is also missing from target properties.
- hostip: fix unused variable with `CURL_DISABLE_SHUFFLE_DNS`
```
lib/hostip.c: In function 'Curl_dnscache_mk_entry':
lib/hostip.c:490:42: warning: unused parameter 'data' [-Wunused-parameter]
490 | Curl_dnscache_mk_entry(struct Curl_easy *data,
| ~~~~~~~~~~~~~~~~~~^~~~
```
- setopt: fix unused function with `CURL_DISABLE_HTTP`
```
lib/setopt.c:214:17: warning: 'httpauth' defined but not used [-Wunused-function]
214 | static CURLcode httpauth(struct Curl_easy *data, bool proxy,
| ^~~~~~~~
```
- url: fix unused function with `CURL_DISABLE_NETRC`
```
lib/url.c:2760:13: warning: 'str_has_ctrl' defined but not used [-Wunused-function]
2760 | static bool str_has_ctrl(const char *input)
| ^~~~~~~~~~~~
```
Seen with a minimal curl-for-win build:
```
CW_CONFIG=dev-x64-zero-osnotls-osnoidn-nohttp-nocurltool-linux-unity
```
Stefan Eissing [Fri, 4 Jul 2025 07:08:39 +0000 (09:08 +0200)]
docs: warn about lifetime in CURLOPT_CLOSESOCKET*
Callback and data set via CURLOPT_CLOSESOCKETFUNCTION and
CURLOPT_CLOSESOCKETDATA may get used after the easy handle has been
cleaned up. Inform about that.
Commit f2ce6c46 among other things added the use of own library context
instead of the default context. Default context has access to OpenSSL
configuration file, own context doesn't have it.
Therefore if a pkcs11 provider is loaded via config file, the function
OSSL_PROVIDER_available() incorrectly detects the provider as
unavailable.
Fix this by loading the OpenSSL config to the library context according
to OpenSSL documentation:
"OSSL_LIB_CTX_load_config() loads a configuration file using the given
ctx. This can be used to associate a library context with providers that
are loaded from a configuration."
Moreover use the provider_loaded flag instead of provider pointer to
determine if a provider is available, as the latter is not set when the
provider is loaded from a configuration.
Viktor Szakats [Sat, 28 Jun 2025 01:38:35 +0000 (03:38 +0200)]
cmake: fix `curl_add_clang_tidy_test_target` when no `-D` option
Fix `curl_add_clang_tidy_test_target` generating an invalid option for
`clang-tidy` if the tested target has no custom macro definition.
Current build doesn't hit this case, but a pending PR does.
Fixing:
```
[...] -Ilib -Itests/client -DCURL_HIDDEN_SYMBOLS -DHAVE_CONFIG_H -D_definitions_t-NOTFOUND
```
error: ISO C99 requires whitespace after the macro name [clang-diagnostic-c99-extensions,-warnings-as-errors]
Viktor Szakats [Thu, 3 Jul 2025 00:16:11 +0000 (02:16 +0200)]
cmake/FindGSS: fix processing C header path options
When processing `--cflags` received from `krb5-config` for `gssapi`:
- fix to not break on multiple `-I` options. Before this patch only
the first `-I` option was processed as a header directory, subsequent
ones ended up in C flags as a raw directory, without the `-I` arg.
Follow-up to 558814e16d84aa202c5ccc0c8108a9d728e77a58
Daniel Stenberg [Mon, 30 Jun 2025 22:09:37 +0000 (00:09 +0200)]
curlinfo: provide the 'digest' feature
... since the tests check for the feature using this name, we
accidentally had lots tests not run because this provided the
`digest-auth` feature that was not checked for.
projects / thirdparty / curl.git / log
