Before this patch modern systems used `sigaction()` and `SA_RESTART` to
install signal handlers, but the signal handler function itself still
made a call to the legacy `signal()` function to re-register itself
before returning.
Re-registering the handler is not necessary with `sigaction()`. It's
also undesired to use the legacy API when the modern one is available.
Fix by guarding off this call in builds that support the modern API.
Follow-up to 3fb6e5a010#6529
Follow-up to 18cbb4d7d6Closes#22497
Torture jobs are arguably the most flaky nowadays. Make a blind try to
see if re-enabling taskkill makes an observable improvement for torture.
Follow-up to 208b87744e#21039
Follow-up to f450f3801b#19897
Follow-up to 2701ac6a4d#19421Closes#22495
Historically servers used the deprecated `siginterrupt()` function to
configure restart behavior on specific signals. It accepts a flag, where
1 means to remove the `SA_RESTART` option, and 0 means to enable it.
In year 2021 3fb6e5a010 introduced the
modern alternative to the codebase, replacing `siginterrupt()` with
`sigaction()`. After this patch, supporting, modern, systems reacted on
the same flag, but, by accident, set the `SA_RESTART` bit when flag is
1, and did not set it when 0. This reversed the previous behavior, and
the one still used on the `siginterrupt()` legacy codepath.
Fix it by revesring the `SA_RESTART` logic for the `sigaction()`
codepath, syncing it with the pre-existing behavior.
I find it odd this did not cause any perceivable issue for 5 years, even
though it's the active one in most Unix envs.
Spotted by GitHub Code Quality, though suggesting to fix
`siginterrupt()` calls. But looking into the history, those were correct
all along.
Refs:
https://pubs.opengroup.org/onlinepubs/9699919799/functions/siginterrupt.htmlhttps://pubs.opengroup.org/onlinepubs/9699919799/functions/sigaction.htmlhttps://www.man7.org/linux/man-pages/man3/siginterrupt.3.htmlhttps://www.man7.org/linux/man-pages/man2/sigaction.2.html
Follow-up to 3fb6e5a010#6529Closes#22037
The necessary cryptography API is provided by nettle 3.1+, via its
'hogweed' library. The minimum GnuTLS version required by curl is 3.6.5,
which requires nettle 3.4.1+, so the API is always available.
Also:
- autotools: detect and use nettle's hogweed library.
- cmake/FindNettle: add support for the hogweed library.
- GHA/http3-linux: enable in the autotools/cmake GnuTLS jobs.
Ref: 4353ea025aCloses#22456
These functions were previously untested in the test suite. This is just
a set of basic invokes to make sure they work. The core of these
functions is identical and is tested already.
- curl_mvfprintf
- curl_mvprintf
- curl_mvsnprintf
- curl_mvsprintf
- curl_mvaprintf
Closes#22472
The expire timers
- DNS_PER_NAME
- DNS_PER_NAME2
- HAPPY_EYEBALLS_DNS
are unused since we changed our happy eyeballing and handling of partial
resolve results.
Closes#22468
- update `actions/checkout` from 7.0.0 to 7.0.1
- update `actions/labeler` from 6.1.0 to 7.0.0
- update `github/codeql-action/analyze` from 4.36.2 to 4.37.3
- update `github/codeql-action/init` from 4.36.2 to 4.37.3
- update `cryptography` from 48.0.1 to 49.0.0
- update `filelock` from 3.29.0 to 3.32.0
- update `impacket` from 0.13.0 to 0.13.1
- update `pytest` from 9.0.3 to 9.1.1
- update `websockets` from 16.0 to 16.1.1
Closes#22458Closes#22459
Sync fallback logic with other crypto algos to:
- allow falling back to the next backend candidate when wolfSSL does not
have ed25519 built in.
- de-duplicate fallback code.
Follow-up to a55731050e#22386#21239Closes#22450
When sending with sendmsg_x(), fix handling of last gso chunk being
smaller. Handle partial results correctly. Ignore SOCKEMSGSIZE by
reporting success which drops PMTUD probes into the void.
Closes#22429
- docs/cmdline-opts/.gitignore: also ignore `manpage.tmp.*`.
Follow-up to a55731050e#22386#21239
- ./.gitignore: drop obsolete entries.
Follow-up to 4f38db1d28#1923Closes#22445
- schannel: drop redundant parentheses.
- os400sys: drop redundant includes.
Follow-up to ebc5212dac#22374
- pytest: replace `()` with `[]` to match rest of tests.
- libtests: constify some local pointers.
- libtests: drop redundant `(long)` casts.
- lib650: use `CURL_CSTRLEN()`.
Follow-up to 59dc2bbe07#22424Closes#22444
Detected by torture tests:
```
test 5004...[HTTP RFC 9421 B.2.6: Ed25519 POST with headers (RFC test vector)]
105 functions found, but only fail 25 (23.81%)
** MEMORY FAILURE
Leak detected: memory still allocated: 99 bytes
At 6000022c9408, there is 36 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:87
At 6000039c8e78, there is 31 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:87
At 6000037dd688, there is 16 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:62
At 6000037dd628, there is 16 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:62
LIMIT /Users/runner/work/curl/curl/lib/slist.c:62 malloc reached memlimit
5004: torture FAILED: function number 10 in test.
```
Ref: https://github.com/curl/curl/actions/runs/30497660391/job/90730128599?pr=22437#step:16:2331
Also:
- enable HTTPSIG in torture tests.
- NULL check all `curl_slist_append()` results.
- apply a NULL check to sibling test 5000 also.
Co-authored-by: Daniel Stenberg
Follow-up to a55731050e#22386#21239Closes#22437
Show a warning and force-disable HTTPSIG when the TLS backend is not
OpenSSL or wolfSSL. Before this patch this resulted in a mismatched
feature list in configure and `curl -V`.
Also enable HTTPSIG in more CI jobs to cover unsupported ones, Windows
compilers, clang-tidy, cmake.
Follow-up to a55731050e#22386#21239
Cherry-picked from #22437Closes#22439
The fallback path for cryptography < 42 was broken by commit e13362c2
that caused a comparison between offset-naive and offset-aware
datetimes. Use the positional form of tz in datetime.now() everywhere.
Ref: #22396
Pointed out by Codex Security
Closes#22426
That may hold credentials or other sensitive data, or where we want to
ensure the zeroing is not optimized out by the compiler.
Credits-to: Daniel Gustafsson
Ref: #13589 (original attempt)
Ref: #21588
Follow-up to #21645
Follow-up to 066478f634#21598Closes#21637
- delete zero-and-free wrapper macros. (not yet used)
To keep it simple.
- do NULL-check in `curlx_memzero()`.
To avoid noise at call sites.
- add `curlx_strzero()` for null-terminated strings, also with
NULL-check.
Ref: #21637
Follow-upt o 066478f634#21598Closes#21645
