Commit graph

39503 commits

Author SHA1 Message Date
Viktor Szakats
133785b159
servers: drop re-registering the signal handler on modern systems
Before this patch modern systems used `sigaction()` and `SA_RESTART` to
install signal handlers, but the signal handler function itself still
made a call to the legacy `signal()` function to re-register itself
before returning.

Re-registering the handler is not necessary with `sigaction()`. It's
also undesired to use the legacy API when the modern one is available.

Fix by guarding off this call in builds that support the modern API.

Follow-up to 3fb6e5a010 #6529
Follow-up to 18cbb4d7d6

Closes #22497
2026-08-05 19:34:52 +02:00
Viktor Szakats
b11e0026f7
GHA/windows: re-enable taskkill in torture jobs
Torture jobs are arguably the most flaky nowadays. Make a blind try to
see if re-enabling taskkill makes an observable improvement for torture.

Follow-up to 208b87744e #21039
Follow-up to f450f3801b #19897
Follow-up to 2701ac6a4d #19421

Closes #22495
2026-08-05 18:29:59 +02:00
Viktor Szakats
947ae0e0cc
servers: drop redundant guards on Windows
These `SIG*` macro are provided by all supported Windows toolchains.

Cherry-picked from #22487

Closes #22493
2026-08-05 15:09:12 +02:00
Viktor Szakats
b260e9f841
servers: fix to avoid a non-signal-safe call in signal handler
`strlen()` is only guaranteed to be signal-safe since POSIX.1-2008.

Ref: https://pubs.opengroup.org/onlinepubs/009695399/functions/xsh_chap02_04.html#tag_02_04_03

Reported by Copilot
Bug: https://github.com/curl/curl/pull/22487#pullrequestreview-4863961494
Follow-up to e95f509c66 #16852

Closes #22491
2026-08-05 15:09:12 +02:00
Daniel Stenberg
518a4dadff
RELEASE-NOTES: synced 2026-08-05 13:19:30 +02:00
Viktor Szakats
7babac8690
servers: fix HANDLE leak in UWP builds
Also: shorten code.

Reported by Copilot
Bug: https://github.com/curl/curl/pull/22487#pullrequestreview-4863399903

Closes #22489
2026-08-05 13:07:49 +02:00
Daniel Stenberg
90325ff044
http2: make server push transfers inherit share from parent
Reported-by: Stephan Zeisberg
Closes #22488
2026-08-05 11:52:08 +02:00
Stefan Eissing
69a224d6b4
vdns: directory for all DNS related sources
Move all DNS related source files from lib to lib/vdns. Fix
include paths, no furher changes.

Closes #22482
2026-08-05 08:09:07 +02:00
renovate[bot]
e5b5846c10
Dockerfile: Update debian:bookworm-slim Docker digest to abd67ff
Closes #22486
2026-08-05 08:01:28 +02:00
Viktor Szakats
69e8278149
servers: fix to reverse SA_RESTART option for sigaction() on modern codepath
Historically servers used the deprecated `siginterrupt()` function to
configure restart behavior on specific signals. It accepts a flag, where
1 means to remove the `SA_RESTART` option, and 0 means to enable it.

In year 2021 3fb6e5a010 introduced the
modern alternative to the codebase, replacing `siginterrupt()` with
`sigaction()`. After this patch, supporting, modern, systems reacted on
the same flag, but, by accident, set the `SA_RESTART` bit when flag is
1, and did not set it when 0. This reversed the previous behavior, and
the one still used on the `siginterrupt()` legacy codepath.

Fix it by revesring the `SA_RESTART` logic for the `sigaction()`
codepath, syncing it with the pre-existing behavior.

I find it odd this did not cause any perceivable issue for 5 years, even
though it's the active one in most Unix envs.

Spotted by GitHub Code Quality, though suggesting to fix
`siginterrupt()` calls. But looking into the history, those were correct
all along.

Refs:
https://pubs.opengroup.org/onlinepubs/9699919799/functions/siginterrupt.html
https://pubs.opengroup.org/onlinepubs/9699919799/functions/sigaction.html
https://www.man7.org/linux/man-pages/man3/siginterrupt.3.html
https://www.man7.org/linux/man-pages/man2/sigaction.2.html

Follow-up to 3fb6e5a010 #6529

Closes #22037
2026-08-04 17:36:14 +02:00
Daniel Stenberg
2112f185c0
TODO: do not consider APPDATA for netrc
See #22462
Closes #22480
2026-08-04 11:48:01 +02:00
Stefan Eissing
73a05428d4
dnscache: use Curl_peer in resolve and dnscache operations
Removes unused/duplicate members in async/ares/doh structs.

Closes #22446
2026-08-04 10:49:11 +02:00
Daniel Stenberg
7acf124614
url: rename Curl_init_do => Curl_init_transfer
And correct some comments

Closes #22474
2026-08-04 09:08:53 +02:00
Viktor Szakats
a368fbe968
curl_ed25519: add GnuTLS support (via nettle, hogweed)
The necessary cryptography API is provided by nettle 3.1+, via its
'hogweed' library. The minimum GnuTLS version required by curl is 3.6.5,
which requires nettle 3.4.1+, so the API is always available.

Also:
- autotools: detect and use nettle's hogweed library.
- cmake/FindNettle: add support for the hogweed library.
- GHA/http3-linux: enable in the autotools/cmake GnuTLS jobs.

Ref: 4353ea025a

Closes #22456
2026-08-03 16:48:08 +02:00
Daniel Stenberg
56457f838c
test557: test curl_mv*printf() functions
These functions were previously untested in the test suite. This is just
a set of basic invokes to make sure they work. The core of these
functions is identical and is tested already.

  - curl_mvfprintf
  - curl_mvprintf
  - curl_mvsnprintf
  - curl_mvsprintf
  - curl_mvaprintf

Closes #22472
2026-08-03 16:24:06 +02:00
Daniel Stenberg
1f860394e6
lib1560: add CURLU_NO_GUESS_SCHEME tests
Closes #22469
2026-08-03 14:00:11 +02:00
Daniel Stenberg
a2b178d378
tests: convert unit test 1396 and 1398 into libtests
They were previously unit tests but used only public library functions.

Closes #22471
2026-08-03 13:55:53 +02:00
Stefan Eissing
b3cd319655
curl_trc: remove unused expire timers
The expire timers
-  DNS_PER_NAME
-  DNS_PER_NAME2
-  HAPPY_EYEBALLS_DNS

are unused since we changed our happy eyeballing and handling of partial
resolve results.

Closes #22468
2026-08-03 13:10:16 +02:00
Daniel Stenberg
08679d89f5
multi: remove #if 0'ed code that uses old struct
Closes #22467
2026-08-03 10:55:44 +02:00
renovate[bot]
a946d40822
GHA: Update pizlonator/fil-c to v0.682
Closes #22464
2026-08-03 09:38:18 +02:00
Daniel Stenberg
54371bca75
lib: update mentions of the legacy "sessionhandle"
It is now "Curl_easy"

Follow-up to 434f8d0389 (June 2016)

Closes #22463
2026-08-03 08:57:36 +02:00
Viktor Szakats
c59b06c99c
sshserver.pl: bump an sshd config to use its modern name
Ref: ee9c0da803

Closes #22460
2026-08-02 11:47:46 +02:00
Viktor Szakats
0043b3fb8c
DEPENDENCIES.md: document minimum nettle version: 3.4.1 (2018-12-04)
It comes as a transitive requirement by the minimum GnuTLS version.
Because libcurl uses nettle directly (in GnuTLS builds), I figure it is
useful to document explicitly.

Refs:
4353ea025a
https://github.com/curl/curl/pull/22456#discussion_r3695417678
https://github.com/gnutls/nettle/releases/tag/nettle_3.4.1_release_20181204

Closes #22457
2026-08-02 10:30:59 +02:00
dependabot[bot]
d2ea63b17c
GHA: bump GitHub Actions and pips
- update `actions/checkout` from 7.0.0 to 7.0.1
- update `actions/labeler` from 6.1.0 to 7.0.0
- update `github/codeql-action/analyze` from 4.36.2 to 4.37.3
- update `github/codeql-action/init` from 4.36.2 to 4.37.3

- update `cryptography` from 48.0.1 to 49.0.0
- update `filelock` from 3.29.0 to 3.32.0
- update `impacket` from 0.13.0 to 0.13.1
- update `pytest` from 9.0.3 to 9.1.1
- update `websockets` from 16.0 to 16.1.1

Closes #22458
Closes #22459
2026-08-02 00:02:10 +02:00
Viktor Szakats
527573490e
GHA/http3-linux: enable HTTPSIG in jobs running tests
To test HTTPSIG with all supported OpenSSL forks.

Follow-up to a55731050e #22386 #21239

Closes #22453
2026-07-31 13:02:10 +02:00
Viktor Szakats
e9f6619694
curl_ed25519: drop unused wolfSSL random generator
Follow-up to a55731050e #22386 #21239

Closes #22451
2026-07-31 12:38:52 +02:00
Viktor Szakats
ca48bd076d
curl_ed25519: tidy-up backend fallback
Sync fallback logic with other crypto algos to:

- allow falling back to the next backend candidate when wolfSSL does not
  have ed25519 built in.

- de-duplicate fallback code.

Follow-up to a55731050e #22386 #21239

Closes #22450
2026-07-31 12:38:52 +02:00
Viktor Szakats
cb21a37a68
build: assume POSIX select() is available
This change effectively replaces an explicit compile-time #error with
a missing prototype error in environments not offering `select()`, and
saves curl-compatible systems from performing an explicit feature check.

Refs:
https://pubs.opengroup.org/onlinepubs/009695399/functions/pselect.html
https://linux.die.net/man/2/select

Closes #22448
2026-07-31 12:38:52 +02:00
Ramesh Adhikari
decc609085
h3-proxy: fix NULL deref when non-:status header arrives before :status
Closes #22449
2026-07-31 09:30:21 +02:00
Stefan Eissing
6e130eb484
apple-fast-udp: fix sendmsg_x partial results
When sending with sendmsg_x(), fix handling of last gso chunk being
smaller. Handle partial results correctly. Ignore SOCKEMSGSIZE by
reporting success which drops PMTUD probes into the void.

Closes #22429
2026-07-30 22:55:04 +02:00
Daniel Stenberg
5eb2f0757e
curl: help category cleanups
- add 'mqtt' as a category
- add more protocol categories to several options
- make --data worded better to also cover MQTT

Closes #22447
2026-07-30 16:17:55 +02:00
Viktor Szakats
1d7b8e6c29
gitignore: maintenance updates
- docs/cmdline-opts/.gitignore: also ignore `manpage.tmp.*`.
  Follow-up to a55731050e #22386 #21239

- ./.gitignore: drop obsolete entries.
  Follow-up to 4f38db1d28 #1923

Closes #22445
2026-07-30 12:00:22 +02:00
Viktor Szakats
b84838073c
tidy-up: minor code fixes and improvements
- schannel: drop redundant parentheses.
- os400sys: drop redundant includes.
  Follow-up to ebc5212dac #22374
- pytest: replace `()` with `[]` to match rest of tests.
- libtests: constify some local pointers.
- libtests: drop redundant `(long)` casts.
- lib650: use `CURL_CSTRLEN()`.
  Follow-up to 59dc2bbe07 #22424

Closes #22444
2026-07-30 12:00:22 +02:00
Viktor Szakats
c4013cdb85
tidy-up: comments, messages, formatting
- 'null-terminate', sync casing.
- add an `#endif` comment.
- avoid a few instances of 'will'.
- configure: 'aws' -> 'aws-sigv4', where missing.
- unfold/fold lines.
- update memzero/strzero comments.
- uppercase 'CRLF'.

Closes #22443
2026-07-30 11:26:22 +02:00
renovate[bot]
83216878e4
GHA: update dependency google/boringssl to v0.20260730.0
Closes #22442
2026-07-30 11:26:22 +02:00
Viktor Szakats
ddb22d12c2
lib5004: fix memleak on OOM, check all slist append results (httpsig)
Detected by torture tests:
```
test 5004...[HTTP RFC 9421 B.2.6: Ed25519 POST with headers (RFC test vector)]
 105 functions found, but only fail 25 (23.81%)
** MEMORY FAILURE
Leak detected: memory still allocated: 99 bytes
At 6000022c9408, there is 36 bytes.
 allocated by /Users/runner/work/curl/curl/lib/slist.c:87
At 6000039c8e78, there is 31 bytes.
 allocated by /Users/runner/work/curl/curl/lib/slist.c:87
At 6000037dd688, there is 16 bytes.
 allocated by /Users/runner/work/curl/curl/lib/slist.c:62
At 6000037dd628, there is 16 bytes.
 allocated by /Users/runner/work/curl/curl/lib/slist.c:62
LIMIT /Users/runner/work/curl/curl/lib/slist.c:62 malloc reached memlimit
 5004: torture FAILED: function number 10 in test.
```
Ref: https://github.com/curl/curl/actions/runs/30497660391/job/90730128599?pr=22437#step:16:2331

Also:
- enable HTTPSIG in torture tests.
- NULL check all `curl_slist_append()` results.
- apply a NULL check to sibling test 5000 also.

Co-authored-by: Daniel Stenberg
Follow-up to a55731050e #22386 #21239

Closes #22437
2026-07-30 10:39:01 +02:00
Viktor Szakats
d3e74f1278
GHA: set HOMEBREW_NO_INSTALL_CLEANUP=1 where brew is used
To save work unnecessary in CI context, and to reduce log noise.

Cherry-picked from #22437

Closes #22440
2026-07-30 10:36:51 +02:00
Daniel Stenberg
33a967318c
RELEASE-NOTES: synced 2026-07-30 09:12:28 +02:00
Viktor Szakats
7d5398f764
build: fix HTTPSIG option for unsupported TLS backends
Show a warning and force-disable HTTPSIG when the TLS backend is not
OpenSSL or wolfSSL. Before this patch this resulted in a mismatched
feature list in configure and `curl -V`.

Also enable HTTPSIG in more CI jobs to cover unsupported ones, Windows
compilers, clang-tidy, cmake.

Follow-up to a55731050e #22386 #21239
Cherry-picked from #22437

Closes #22439
2026-07-30 02:59:30 +02:00
Viktor Szakats
c155cbc638
GHA: work around Homebrew ca-certificates install error
Working around:
```
==> Installing libngtcp2 dependency: ca-certificates
==> Pouring ca-certificates--2026-07-16.all.bottle.1.tar.gz
Warning: The post-install step did not complete successfully
[...]
Error: Process completed with exit code 1.
```

Refs:
https://github.com/Homebrew/homebrew-core/pull/295934
https://github.com/Homebrew/brew/pull/23357

Bug: https://github.com/curl/curl/pull/22437#issuecomment-5124151490

Closes #22438
2026-07-30 02:21:09 +02:00
Daniel Stenberg
57cae40ae5
sws: log the exact closing reason better, to help debugging tests
Closes #22431
2026-07-29 23:59:00 +02:00
Stefan Eissing
9951a2247e
tool: remove duplicate setopts
CURLOPT_RESOLVE and CURLOPT_CONNECT_TO were set twice.
A happy little accident?

Closes #22433
2026-07-29 23:48:54 +02:00
Dan Fandrich
9743720ab9 tests: fix cert comparison with old cryptography
The fallback path for cryptography < 42 was broken by commit e13362c2
that caused a comparison between offset-naive and offset-aware
datetimes. Use the positional form of tz in datetime.now() everywhere.

Ref: #22396

Pointed out by Codex Security
Closes #22426
2026-07-29 13:56:49 -07:00
Jay Satiro
c4fe0c7b9f ldap: support empty username and password
Prior to this change an empty username or password was passed to the
LDAP bind function as NULL instead of an empty string.

Regression since 8f71d0fd.

Reported-by: Yoshiro Yoneya

Fixes https://github.com/curl/curl/issues/22162
Closes https://github.com/curl/curl/pull/22196
2026-07-29 13:54:18 -04:00
renovate[bot]
a7f82509e4
GHA: update dependency nghttp2/nghttp2 to v1.70.0
Closes #22434
2026-07-29 19:26:19 +02:00
Viktor Szakats
64f746ee1e
urlapi: clear password buffer on error path
Reported by Copilot
Bug: https://github.com/curl/curl/pull/21637#pullrequestreview-4809702512
Follow-up to 112a8b5adf #21637
Follow-up to 7c34365cce #21879

Closes #22432
2026-07-29 19:12:55 +02:00
Viktor Szakats
112a8b5adf
src: safely clear certain buffers
That may hold credentials or other sensitive data, or where we want to
ensure the zeroing is not optimized out by the compiler.

Credits-to: Daniel Gustafsson
Ref: #13589 (original attempt)
Ref: #21588

Follow-up to #21645
Follow-up to 066478f634 #21598

Closes #21637
2026-07-29 14:38:48 +02:00
Daniel Stenberg
172c16b58c
docs/INTERNALS.md -> docs/DEPENDENCIES.md
With some minor cleanups

Closes #22430
2026-07-29 14:20:36 +02:00
Viktor Szakats
2a3804936d
src: improve curlx_memzero() internal APIs
- delete zero-and-free wrapper macros. (not yet used)
  To keep it simple.
- do NULL-check in `curlx_memzero()`.
  To avoid noise at call sites.
- add `curlx_strzero()` for null-terminated strings, also with
  NULL-check.

Ref: #21637
Follow-upt o 066478f634 #21598

Closes #21645
2026-07-29 13:54:07 +02:00
CatboxParadox
c7b1e10dc1
h2: bootstrap max streams from multi handle if in use
Closes #22418
2026-07-29 13:51:55 +02:00