Replace the `timeoutlist` and time nodes for expire timers with `struct
expire_timers` that keeps a time and next array.
There is only ever one timeout per timer id and a fully dynamic list is
not needed. Do the sorting by keeping an array of 'next' indiced and a
'first' starting point.
Added tracking of splay tree status.
Fixed missing splay removal when last timeout was removed via
Curl_expire_done().
Closes#22473
To prevent creating a curl-development (aka debug-enabled, aka
`-DENABLE_DEBUG=ON`, `--enable-debug` or `DEBUGBUILD`) build without
`assert()`s. Since it may break expectations by missing to catch error
cases. Also to make it less likely to build an inherently insecure
development build by accident.
- in CMake, for non-Multi-Config builds, show this error unless Debug
configuration is set at configure-time:
```
CMake Error at CMakeLists.txt:263 (message):
Debug-enabled (aka development mode) curl requires the Debug configuration
```
Ref: https://github.com/curl/curl/actions/runs/31159065911/job/92805128331?pr=22513#step:6:56
The other 3 predefined configs (`Release`, `RelWithDebInfo`,
`MinSizeRel`) set `NDEBUG` automatically.
- or this message in other cases, e.g. when using CMake Multi-Config
with non-Debug, e.g. `--config Release`, or passed `NDEBUG` manually
with either build tools:
```
curl_setup.h(1062): fatal error C1189: #error:
"Debug-enabled builds cannot be combined with NDEBUG"
```
Ref: https://github.com/curl/curl/actions/runs/31159628749/job/92807878479#step:9:28
Also:
- INSTALL-CMAKE.md: document.
- GHA/windows: adjust CI jobs to meet the above requirement, where
missing.
Reported-by Stefan Eissing
Bug: https://github.com/curl/curl/pull/22484#discussion_r3730045572
Ref: ea98445680#13592Fixes#22481Fixes#22484Closes#22513
- decode results when individual requests are done
- makes happy eyeballing start asap
- remove doh_resp structures as no longer needed
- remove CURL_DNS_TYPE_NS, CURL_DNS_TYPE_CNAME and
CURL_DNS_TYPE_DNAME from DoH
- DoH: do not set PIPEWAIT and SSL OPTS when url starts with http:
- mark Doh master handle as dirty after every sub-request, not only the last
- Doh: start probe on AAAA before A (was the other way).
cf-dns: set EXPIRE_HAPPY_EYEBALLS timer when waiting 50ms on AAAA
result or progress will not be triggered in time.
Add debug env var CURL_DBG_HE_AAAA_AWAIT_MS to override the
default 50ms on waiting for the AAAA result to arrive.
test2100: set CURL_DBG_HE_AAAA_AWAIT_MS to 60 seconds to
provide enough time for slow CI runs to sent all DoH requests.
closes#22514
- Use %hu for unsigned short instead of %u.
Prior to this change some compilers could warn of an argument type
mismatch. C argument promotion rules promote the unsigned short argument
to an int, which does not match %u (unsigned int) but does match %hu
(unsigned short).
Assisted-by: Viktor Szakats
Closes https://github.com/curl/curl/pull/22511
dnsd now opens UDP+TCP sockets and accepts http: DoH requests to obtain
the same, configured answers (records, delays, error codes) as over UDP.
DoH: use `async->queries_ongoing` like all other resolvers instead of
the internal `pending` counter. Fixes waiting for results.
Tests: in pytest, parameterize dnsd tests to use both DNS and DoH.
Closes#22506
- convert the method switch() to a simple table
- avoid converting the methods from external to internal numbers, they were
the same anyway so keep the external ones, just use the old defines.
- fix range check. It wrongly used the method numbers as bitmask, which made
the check not work previously. Also error on OOM.
- Dropped the session-id check. It too wrongly did a bitmask check which was
wrong and never worked. When fixed, it broke test cases so I dropped the
entire check.
- split out rtsp_setup_request() from rtsp_do()
- replace the httpversion variable with a define
Closes#22505
The necessary cryptography API is provided by nettle 3.1+, via its
'hogweed' library. The minimum GnuTLS version required by curl is 3.6.5,
which requires nettle 3.4.1+, so the API is always available.
Also:
- autotools: detect and use nettle's hogweed library.
- cmake/FindNettle: add support for the hogweed library.
- GHA/http3-linux: enable in the autotools/cmake GnuTLS jobs.
Ref: 4353ea025aCloses#22456
The expire timers
- DNS_PER_NAME
- DNS_PER_NAME2
- HAPPY_EYEBALLS_DNS
are unused since we changed our happy eyeballing and handling of partial
resolve results.
Closes#22468
Sync fallback logic with other crypto algos to:
- allow falling back to the next backend candidate when wolfSSL does not
have ed25519 built in.
- de-duplicate fallback code.
Follow-up to a55731050e#22386#21239Closes#22450
When sending with sendmsg_x(), fix handling of last gso chunk being
smaller. Handle partial results correctly. Ignore SOCKEMSGSIZE by
reporting success which drops PMTUD probes into the void.
Closes#22429
- schannel: drop redundant parentheses.
- os400sys: drop redundant includes.
Follow-up to ebc5212dac#22374
- pytest: replace `()` with `[]` to match rest of tests.
- libtests: constify some local pointers.
- libtests: drop redundant `(long)` casts.
- lib650: use `CURL_CSTRLEN()`.
Follow-up to 59dc2bbe07#22424Closes#22444
That may hold credentials or other sensitive data, or where we want to
ensure the zeroing is not optimized out by the compiler.
Credits-to: Daniel Gustafsson
Ref: #13589 (original attempt)
Ref: #21588
Follow-up to #21645
Follow-up to 066478f634#21598Closes#21637
- delete zero-and-free wrapper macros. (not yet used)
To keep it simple.
- do NULL-check in `curlx_memzero()`.
To avoid noise at call sites.
- add `curlx_strzero()` for null-terminated strings, also with
NULL-check.
Ref: #21637
Follow-upt o 066478f634#21598Closes#21645
When writing a decoded chunk of websocket data, always flush the writer
chain so that buffered data gets delivered before the ws meta data gets
updated.
Add client writer flags CURL_CW_FLAG_BLOWUP for writer types that may
significantly enlarge write sizes. This flag causes the pause writer to
be added and shrinks the write chunk sizes. We do not want that for
content decoders like WS that do not change the size.
Add test_20_13 to check that large frames are paused/unpaused correctly
with the matching meta data.
Fixes#22413
Reported-by: Hendrik Hübner
Closes#22416
Update the `lastchecked` timestamp on connection health checks when
successful to prevent repeated recalcs for a second.
Rename `seems_dead` to `seems_healthy` because the world is already
depressing enough.
Consider pending input on connection only unhealthy when the connection
has no transfers and is not multiplexed.
Closes#22412
- update `GSS_C_DELEG_POLICY_FLAG` comment to include Apple GSS, add
date, and amend MIT Kerberos version to 1.7+ (was: 1.8+)
Ref: 45875a4d7b
Ref: 1635de38a8
- document `HAVE_GSS_SET_NEG_MECHS`/`gss_set_neg_mechs()`.
Ref: 079eed2cf7
It's also committed to Heimdal, but not present in a release
as of 7.8.0 (current latest).
Ref: 735039dbdc
Follow-up to a8881e5e1d#21315#22410
Follow-up to d169ad68fa#22052Closes#22419
- make `const` data `static`, where missing and possible.
- replace `strlen()` on literal or const strings with `sizeof()`.
While the latter is optimized by popular C compiler, e.g. MSVC only
does it with `/O2`.
- replace magic numbers with `sizeof()`, where missing.
- introduce `CURL_CSTRLEN()` macro for `sizeof(char[]) - 1`.
- use `CURL_CSTRLEN()` macro.
- move `const` before integer types, where missing.
- replace `char *var` with `var[]`, where missing and possible.
- use double const, where missing.
`static const char *` -> `static const char * const`.
- lib1514: constify pointers.
- unit3205: drop redundant cast, avoid another one.
- unit1666: map `OID()` macro to identical `STRCONST()`.
Closes#22406
- add CURLUE_BACKSLASH that can be returned when a backslash was used
where a forward one probably was intended.
- make CURLUE_NO_HOST higher priority than port number errors for URLs
without hostname. Like in "http://::1"
- shortened some URL parser error strings
Extend test 1560 to verify.
Reported-by: kit-ty-kate on github
Fixes#22337Closes#22408
- Switch the Windows SSPI identity struct to SEC_WINNT_AUTH_IDENTITY_EX
to use !ntlm in PackageList to prevent NTLM from being offered.
- For GSS filter out NTLMSSP OID, and restrict via gss_set_neg_mechs()
to prevent NTLM from being offered.
- Extend the GSS-API debug stub layer to support the NTLM blocking logic
without a real Kerberos environment.
- Update test 2057 to check that negotiate auth is silently skipped with
no Authorization header when only NTLM stub credentials are available.
- Add SPNEGO NTLM blocking test 2093 which verifies that Kerberos
credentials still succeed when NTLM is blocked within SPNEGO.
- Suppress tests valgrind leak for MIT krb5 gss_display_status, since
the leak is in the library and not in curl.
To suppress the tests valgrind leak, the wildcard '...' bridges over an
anonymous frame inside libgssapi_krb5.so that valgrind reports as '???'.
Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Aided-by: Johannes Schindelin
Closes https://github.com/curl/curl/pull/21315
Closes https://github.com/curl/curl/pull/22410
- move `Curl_conn_seems_dead()` into conncache.c
- move `Curl_conn_upkeep()` into conncache.c
- when upkeep gives an error on a connection not in use,
terminate it
Closes#21806
Forward only the app error code from the receiving side to the h3 layer.
This only takes effect when building against ngtcp2 v1.25.0 or higher.
Fixes#22270Closes#22356
To avoid a breakage in CI and curl-for-win builds on upstream updates
extending the callback lists. Each such breakage needed patching curl,
rolling these patches into curl-for-win, and doing it in near real-time,
to keep CI and builds working (and still causing some red CI jobs).
Bring calmness here by suppressing the warnings and allowing time to
extend the callback tables as/if needed and at a convenient moment.
Closes#22400
Do not let unrelated credentials from a redirected URL bypass the
cross-host auth boundary
Verified by test 5023 to 5025
Follow-up to a55731050eCloses#22395
Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.
New libcurl options:
- CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
- CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
- CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
- CURLOPT_HTTPSIG_HEADERS: space-separated components to sign
New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers
The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.
Verified by test 5000 to 5021
Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes#22386Closes#21239
