The necessary cryptography API is provided by nettle 3.1+, via its
'hogweed' library. The minimum GnuTLS version required by curl is 3.6.5,
which requires nettle 3.4.1+, so the API is always available.
Also:
- autotools: detect and use nettle's hogweed library.
- cmake/FindNettle: add support for the hogweed library.
- GHA/http3-linux: enable in the autotools/cmake GnuTLS jobs.
Ref: 4353ea025aCloses#22456
These functions were previously untested in the test suite. This is just
a set of basic invokes to make sure they work. The core of these
functions is identical and is tested already.
- curl_mvfprintf
- curl_mvprintf
- curl_mvsnprintf
- curl_mvsprintf
- curl_mvaprintf
Closes#22472
The expire timers
- DNS_PER_NAME
- DNS_PER_NAME2
- HAPPY_EYEBALLS_DNS
are unused since we changed our happy eyeballing and handling of partial
resolve results.
Closes#22468
- update `actions/checkout` from 7.0.0 to 7.0.1
- update `actions/labeler` from 6.1.0 to 7.0.0
- update `github/codeql-action/analyze` from 4.36.2 to 4.37.3
- update `github/codeql-action/init` from 4.36.2 to 4.37.3
- update `cryptography` from 48.0.1 to 49.0.0
- update `filelock` from 3.29.0 to 3.32.0
- update `impacket` from 0.13.0 to 0.13.1
- update `pytest` from 9.0.3 to 9.1.1
- update `websockets` from 16.0 to 16.1.1
Closes#22458Closes#22459
Sync fallback logic with other crypto algos to:
- allow falling back to the next backend candidate when wolfSSL does not
have ed25519 built in.
- de-duplicate fallback code.
Follow-up to a55731050e#22386#21239Closes#22450
When sending with sendmsg_x(), fix handling of last gso chunk being
smaller. Handle partial results correctly. Ignore SOCKEMSGSIZE by
reporting success which drops PMTUD probes into the void.
Closes#22429
- docs/cmdline-opts/.gitignore: also ignore `manpage.tmp.*`.
Follow-up to a55731050e#22386#21239
- ./.gitignore: drop obsolete entries.
Follow-up to 4f38db1d28#1923Closes#22445
- schannel: drop redundant parentheses.
- os400sys: drop redundant includes.
Follow-up to ebc5212dac#22374
- pytest: replace `()` with `[]` to match rest of tests.
- libtests: constify some local pointers.
- libtests: drop redundant `(long)` casts.
- lib650: use `CURL_CSTRLEN()`.
Follow-up to 59dc2bbe07#22424Closes#22444
Detected by torture tests:
```
test 5004...[HTTP RFC 9421 B.2.6: Ed25519 POST with headers (RFC test vector)]
105 functions found, but only fail 25 (23.81%)
** MEMORY FAILURE
Leak detected: memory still allocated: 99 bytes
At 6000022c9408, there is 36 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:87
At 6000039c8e78, there is 31 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:87
At 6000037dd688, there is 16 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:62
At 6000037dd628, there is 16 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:62
LIMIT /Users/runner/work/curl/curl/lib/slist.c:62 malloc reached memlimit
5004: torture FAILED: function number 10 in test.
```
Ref: https://github.com/curl/curl/actions/runs/30497660391/job/90730128599?pr=22437#step:16:2331
Also:
- enable HTTPSIG in torture tests.
- NULL check all `curl_slist_append()` results.
- apply a NULL check to sibling test 5000 also.
Co-authored-by: Daniel Stenberg
Follow-up to a55731050e#22386#21239Closes#22437
Show a warning and force-disable HTTPSIG when the TLS backend is not
OpenSSL or wolfSSL. Before this patch this resulted in a mismatched
feature list in configure and `curl -V`.
Also enable HTTPSIG in more CI jobs to cover unsupported ones, Windows
compilers, clang-tidy, cmake.
Follow-up to a55731050e#22386#21239
Cherry-picked from #22437Closes#22439
The fallback path for cryptography < 42 was broken by commit e13362c2
that caused a comparison between offset-naive and offset-aware
datetimes. Use the positional form of tz in datetime.now() everywhere.
Ref: #22396
Pointed out by Codex Security
Closes#22426
That may hold credentials or other sensitive data, or where we want to
ensure the zeroing is not optimized out by the compiler.
Credits-to: Daniel Gustafsson
Ref: #13589 (original attempt)
Ref: #21588
Follow-up to #21645
Follow-up to 066478f634#21598Closes#21637
- delete zero-and-free wrapper macros. (not yet used)
To keep it simple.
- do NULL-check in `curlx_memzero()`.
To avoid noise at call sites.
- add `curlx_strzero()` for null-terminated strings, also with
NULL-check.
Ref: #21637
Follow-upt o 066478f634#21598Closes#21645
When writing a decoded chunk of websocket data, always flush the writer
chain so that buffered data gets delivered before the ws meta data gets
updated.
Add client writer flags CURL_CW_FLAG_BLOWUP for writer types that may
significantly enlarge write sizes. This flag causes the pause writer to
be added and shrinks the write chunk sizes. We do not want that for
content decoders like WS that do not change the size.
Add test_20_13 to check that large frames are paused/unpaused correctly
with the matching meta data.
Fixes#22413
Reported-by: Hendrik Hübner
Closes#22416
Update the `lastchecked` timestamp on connection health checks when
successful to prevent repeated recalcs for a second.
Rename `seems_dead` to `seems_healthy` because the world is already
depressing enough.
Consider pending input on connection only unhealthy when the connection
has no transfers and is not multiplexed.
Closes#22412
