Commit graph

7044 commits

Author SHA1 Message Date
Viktor Szakats
4a6bdd5899
examples/usercertinmem: avoid stripping const
This API started accepting a const somewhere between OpenSSL 1.0.2b and
1.0.2t. It means this example, like the other similar one now works best
with those versions or newer:
```
docs/examples/usercertinmem.c💯33: error: cast from 'const char *' to 'char *' drops const qualifier [-Werror,-Wcast-qual]
  100 |   bio = BIO_new_mem_buf((char *)mypem, -1);
      |                                 ^
docs/examples/usercertinmem.c:121:34: error: cast from 'const char *' to 'char *' drops const qualifier [-Werror,-Wcast-qual]
  121 |   kbio = BIO_new_mem_buf((char *)mykey, -1);
      |                                  ^
```

Closes #18908
2025-10-07 13:12:24 +02:00
Stefan Eissing
357808f4ad
multi: add notifications API
Add infrastructure to colled and dispatch notifications for transfers
and the multi handle in general. Applications can register a callback
and en-/disable notification type the are interested in.

Without a callback installed, notifications are not collected. Same when
a notification type has not been enabled.

Memory allocation failures on adding notifications lead to a general
multi failure state and result in CURLM_OUT_OF_MEMORY returned from
curl_multi_perform() and curl_multi_socket*() invocations.

Closes #18432
2025-10-07 10:55:31 +02:00
Daniel Stenberg
752090b963
examples/synctime: make the sscanf not overflow the local buffer
If the incoming Date: header has a funky format.

Bonus: remove bad null terminator assumptions for header

Reported-by: Stanislav Fort

Closes #18890
2025-10-07 00:23:54 +02:00
Daniel Stenberg
3b18aeb8bd
managen: verify the options used in example lines
Also fix the --knownhosts typo

Follow-up to aae18c4bdc

Reported-by: Daniel Terhorst-North
URL: https://mas.to/@tastapod/115327102344617386
Closes #18884
2025-10-06 23:17:33 +02:00
Daniel Stenberg
66f4c5699e
test766: verify CURLOPT_SOCKOPTFUNCTION error on accept
This test does active FTP with a socketopt callback that returns error
for the CURLSOCKTYPE_ACCEPT "purpose" to make sure we test and exercise
this error path - without leaks.

Closes #18879
2025-10-06 23:16:04 +02:00
Viktor Szakats
6f0e212f6e
tidy-up: miscellaneous (cont.)
- examples: replace magic numbers with `sizeof()`.
- typos: drop rules no longer needed after excluding tests/data.
- typos: move an exception inline.
- alpha-sort lists.
- fix indentation, whitespace.

Closes #18898
2025-10-06 22:33:38 +02:00
Viktor Szakats
b12da22db1
lib: stop overriding system printf symbols
After this patch, the codebase no longer overrides system printf
functions. Instead it explicitly calls either the curl printf functions
`curl_m*printf()` or the system ones using their original names.

Also:
- drop unused `curl_printf.h` includes.
- checksrc: ban system printf functions, allow where necessary.

Follow-up to db98daab05 #18844
Follow-up to 4deea9396b #18814

Closes #18866
2025-10-06 20:57:59 +02:00
Daniel Stenberg
aae18c4bdc
tool_getparam: add --knownhosts
To allow users to specify a known hosts file that is not the default
one: ~/.ssh/known_hosts

URL: https://github.com/curl/curl/discussions/18784
Closes #18859
2025-10-06 13:41:22 +02:00
Viktor Szakats
34ad78da89
curlx: move Curl_strerror, use in src and tests, ban strerror globally
Also:
- tests/server: replace local `sstrerror()` with `curlx_strerror()`.
- tests/server: show the error code next to the string, where missing.
- curlx: use `curl_msnprintf()` when building for src and tests.
  (units was already using it.)
- lib: drop unused includes found along the way.
- curlx_strerror(): avoid compiler warning (and another similar one):
  ```
  In file included from servers.c:14:
  ../../lib/../../lib/curlx/strerr.c: In function ‘curlx_strerror’:
  ../../lib/../../lib/curlx/strerr.c:328:32: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
    328 |       SNPRINTF(buf, buflen, "%s", msg);
        |                                ^
  ../../lib/../../lib/curlx/strerr.c:47:18: note: ‘snprintf’ output 1 or more bytes (assuming 2) into a destination of size 1
     47 | #define SNPRINTF snprintf
        |                  ^
  ../../lib/../../lib/curlx/strerr.c:328:7: note: in expansion of macro ‘SNPRINTF’
    328 |       SNPRINTF(buf, buflen, "%s", msg);
        |       ^~~~~~~~
  ```

Follow-up to 45438c8d6f #18823

Closes #18840
2025-10-06 09:44:23 +02:00
Viktor Szakats
4535532ed3
examples: fix two build issues surfaced with WinCE
Both may apply to rare non-WinCE Windows builds too.

- fix gcc 4.4.0 preprocessor error:
  ```
  docs/examples/http2-upload.c:43:8: error: "_MSC_VER" is not defined
  ```
  Ref: https://github.com/curl/curl/actions/runs/18238150607/job/51935502616

- fix wrong header order:
  Inlcude `windows.h` after `winsock2.h` via `curl/curl.h`.

Regressions from 45438c8d6f #18823

Closes #18843
2025-10-04 11:35:44 +02:00
Viktor Szakats
ed1e72143a
examples: drop unused curl/mprintf.h includes
Follow-up to 45438c8d6f #18823

Closes #18842
2025-10-04 11:34:46 +02:00
Viktor Szakats
45438c8d6f
checksrc: reduce directory-specific exceptions
By making them defaults, then fixing and/or reshuffling remaining
exceptions as necessary.

- checksrc: ban by default: `snprintf`, `vsnprintf`, `sscanf`, `strtol`.
- examples: replace `strtol` with `atoi` to avoid a checksrc exception.
- tests/libtest: replace `strtol` with `atol`.
- tests/server: replace most `strtol` with `atol`.
- tests/server: replace most `strtoul` with `atol`/`atoi`.
- tests/server: drop no longer used `util_ultous`.
- fix typo in checksrc rules: `vsnprint` -> `vsnprintf`.
- update local exceptions.

Also:
- examples: ban curl printf functions. They're discouraged in user code.
- examples: replace curl printf with system printf.
  Add `snprintf` workaround for <VS2015.
- examples/synctime: fix `-Wfloat-equal`.
- examples/synctime: exclude for non-Windows and non-UWP Windows.
- examples/synctime: build by default.

Closes #18823
2025-10-04 00:48:58 +02:00
Viktor Szakats
7468faffc1
Makefile.example: fix option order [ci skip]
The `ld` linker is sensitive to this, and did not find libcurl symbol
with the order before this patch. Seen with mingw-w64 gcc.

Follow-up to f6ddc1fc1e #18554

Closes #18835
2025-10-03 21:35:06 +02:00
Daniel Stenberg
3b583ab7d7
docs/cmdline-opts: drop double quotes from GLOBBING and URL examples
It looks easier on the eye without them

Closes #18829
2025-10-03 13:47:16 +02:00
Stefan Eissing
eefd03c572
ssl: support Apple SecTrust configurations
- configure/cmake support for enabling the option
- supported in OpenSSL and GnuTLS backends
- when configured, Apple SecTrust is the default trust store
  for peer verification. When one of the CURLOPT_* for adding
  certificates is used, that default does not apply.
- add documentation of build options and SSL use

Closes #18703
2025-10-03 12:02:23 +02:00
Daniel Stenberg
0a3459ca51
DEPRECATE.md: remove OpenSSL 1.1.1 support already in December 2025
No sponsors == remove it

Closes #18822
2025-10-03 08:14:23 +02:00
Daniel Stenberg
06c0f8c5cd
DEPRECATE.md: We remove the OpenSSL-QUIC backend in March 2026
URL: https://curl.se/mail/lib-2025-10/0000.html

Closes #18820
2025-10-03 08:13:43 +02:00
Daniel Stenberg
84c4b485f3
time-cond.md: refer to the singular curl_getdate man page
Closes #18816
2025-10-02 23:25:36 +02:00
Daniel Stenberg
18e4fbad4c
tcp-nodelay.md: expand the documentation
Instead of referring to another document.

Closes #18811
2025-10-02 23:24:42 +02:00
Daniel Stenberg
06625975af
cmdline-opts/_PROGRESS.md: explain the suffixes
Closes #18817
2025-10-02 23:23:40 +02:00
Viktor Szakats
03fe446789
INTERNALS: specify minimum version for Heimdal: 7.1.0
Released on 2016-Dec-19, it's the first "revamped" stable version, and
the earliest available as a source tarball at the official repository:
https://github.com/heimdal/heimdal/releases/tag/heimdal-7.1.0

It's also the first version hosted by Homebrew. It builds fine locally
with curl, and also builds in CI with old linux: 7.1.0+dfsg-13+deb9u4.

Closes #18809
2025-10-02 15:21:09 +02:00
Viktor Szakats
9ac3a9a670
INTERNALS: drop Winsock 2.2 from the dependency list
It's implied by the minimum requirement of Windows XP.
Also Windows CE is soon to be deleted via #17927.

Closes #18808
2025-10-02 14:58:06 +02:00
Daniel Stenberg
ea4ba6d9ef
lib: remove personal names from comments
- it's just too random who got mentioned
- we can't mention all, so better consistently mention none
- make sure they all are mentioned in THANKS
- also remove some unnecessary comment ramblings

Closes #18803
2025-10-02 14:22:57 +02:00
Daniel Stenberg
bc37765466
form.md: drop reference to MANUAL
Since it isn't linked and users might not understand what it refers to.

Ref: #18755
Closes #18790
2025-10-01 15:51:21 +02:00
Samuel Henrique
a5a17b8ddb
wcurl: import v2025.09.27
Closes #18754
2025-10-01 09:26:42 +02:00
Daniel Stenberg
f284222ffc
TODO: fix a typo
Closes #18788
2025-10-01 08:26:49 +02:00
Stefan Eissing
b022389757
ip-happy: do not set unnecessary timeout
When attempts on all addresses have been started, do no longer set any
EXPIRE_HAPPY_EYEBALLS timeouts.

Fixes #18767
Reported-by: Johannes Schindelin
Closes #18768
2025-10-01 08:01:47 +02:00
Viktor Szakats
9678ff5b1b
build: avoid overriding system open and stat symbols
Replace them by `curlx_open()` and `curlx_stat()`.

To make it obvious in the source code what is being executed.

Also:
- tests/server: stop overriding `open()` for test servers.
  This is critical for the call made from the signal handler.
  For other calls, it's an option to use `curlx_open()`, but
  doesn't look important enough to do it, following the path
  taken with `fopen()`.

Follow-up to 10bac43b87 #18774
Follow-up to 20142f5d06 #18634
Follow-up to bf7375ecc5 #18503

Closes #18776
2025-09-30 16:30:09 +02:00
Viktor Szakats
c478c7efdf
examples: fix two more cases of stat() TOCTOU
Also:
- ftpupload: bump an intermediate variable size.

Follow-up to f13250edf1 #18605

Closes #18778
2025-09-30 12:28:43 +02:00
Viktor Szakats
20142f5d06
build: avoid overriding system symbols for fopen functions
By introducing wrappers for them in the curlx namespace:
`curlx_fopen()`, `curlx_fdopen()`, `curlx_fclose()`.

The undefine/redefine/`(function)()` methods broke on systems
implementing these functions as macros. E.g. AIX 32-bit's `fopen()`.

Also:
- rename `lib/fopen.*` to `lib/curl_fopen.*` (for `Curl_fopen()`)
  to make room for the newly added `curlx/fopen.h`.
- curlx: move file-related functions from `multibyte.c` to `fopen.c`.
- tests/server: stop using the curl-specific `fopen()` implementation
  on Windows. Unicode isn't used by runtests, and it isn't critical to
  run tests on longs path. It can be re-enabled if this becomes
  necessary, or if the wrapper receives a feature that's critical for
  test servers.

Reported-by: Andrew Kirillov
Bug: https://github.com/curl/curl/issues/18510#issuecomment-3274393640

Follow-up to bf7375ecc5 #18503
Follow-up to 9863599d69 #18502
Follow-up to 3bb5e58c10 #17827

Closes #18634
2025-09-30 01:10:36 +02:00
Viktor Szakats
95e50ad694
tidy-up: miscellaneous
- GHA/checkdocs: rename `spellcheck` job to `pyspelling` to say
  the exact tool used.
- GHA/checkdocs: restore a comment.
- GHA/linux: add `-B .` to a cmake configure to avoid warning, and
  future breakage.
- autotools: use correct casing for `Schannel`.
- doh: update RFC URL.
- drop redundant parenthesis.
- fix indentation, whitespace.

Closes #18756
2025-09-27 12:59:07 +02:00
Stefan Eissing
061e265502
http: handle user-defined connection headers
When there is more than one user-supplied 'Connection: ' header, add
values that curl needs internally to the first one and emit all
subsequent ones thereafter.

Fixes #18662
Reported-by: Evgeny Grin (Karlson2k)
Closes #18686
2025-09-26 09:27:50 +02:00
Daniel Stenberg
882293cc81
KNOWN_BUGS: telnet code does not handle partial writes properly
Reported in Joshua's sarif data

Closes #18735
2025-09-25 14:42:04 +02:00
Daniel Stenberg
97e5a471e0
KNOWN_BUGS: Access violation sending client cert with SChannel
It seems we can select between crashing or leaking sensitive files
because Schannel is buggy.

Closes #17626
Closes #18679
2025-09-25 09:06:24 +02:00
Daniel Stenberg
b011e3fcfb
vssh: drop support for wolfSSH
The implementation was incomplete and lesser than the other backends. No
one ever reported a bug or requested enhancements for this, indicating
that this backend was never used.

Closes #18700
2025-09-24 22:59:33 +02:00
Viktor Szakats
acd0aa2c9d
docs: fix/tidy code fences
- INSTALL.md: fence code to avoid wrong rendering.
  Reported-by: rinsuki on github
  Fixes: https://github.com/curl/curl-www/issues/480

- use `sh` instead of `bash` as fence language, for less visual noise.

- INSTALL.md: drop stray shebang.

- ECH.md: drop indent from fenced code.

- minor tidy-ups.

Ref: https://curl.se/docs/install.html

Closes #18707
2025-09-24 15:16:09 +02:00
Viktor Szakats
051839eb8f
tidy-up: URLs
Closes #18689
2025-09-23 00:34:46 +02:00
Daniel Stenberg
1f0f0bdb19
managen: strict protocol check
- protocols MUST match one in the accept-list
- protocols are typically all uppercase
- drop All
- use SCP and SFTP instead of SSH
- add Protocols: to some options previously missing one

Closes #18675
2025-09-22 09:06:00 +02:00
Viktor Szakats
e5d9c871f0
tidy-up: assortment of small fixes
- examples/headerapi: fix wrong cast.
- curl_ngtcp2: delete stray character from error message.
- rustls: fix inline variable declaration.
- sendf: drop redundant `int` cast.
- libtest/cli_ws_data: drop cast with mismatched signedness.

Cherry-picked from #18343

Closes #18664
2025-09-21 16:50:14 +02:00
Viktor Szakats
06d00e3879
cmake: clang detection tidy-ups
Follow-up to 0513f9f878 #18645
Follow-up to fe5225b5ea #18209

Closes #18659
2025-09-21 15:26:49 +02:00
Daniel Stenberg
3dad0cfd77
write-out: make %header{} able to output *all* occurances of a header
By appending `:all:[separator]` to the header name. The `[separator]` string
is output between each header value if there are more than one to output.

Test 764 and 765 verify

Idea-by: kapsiR on github
Ref: #18449
Closes #18491
2025-09-21 00:00:29 +02:00
Daniel Stenberg
5ab120bc4e
krb5: drop support for Kerberos FTP
It was accidentally broken in commit 0f4c439fc7, shipped since
8.8.0 (May 2024) and yet not a single person has noticed or reported,
indicating that we might as well drop support for FTP Kerberos.

Krb5 support was added in 54967d2a3a (July 2007), and we have
been carrying the extra license information around since then for this
code. This commit removes the last traces of that code and thus we can
remove the extra copyright notices along with it.

Reported-by: Joshua Rogers
Closes #18577
2025-09-20 23:58:28 +02:00
Daniel Stenberg
cf3b9657bc
libssh2: up the minimum requirement to 1.9.0
Released on June 20 2019
2025-09-20 22:39:07 +02:00
Daniel Stenberg
82eeda1041
CURLOPT_HEADER/WRITEFUNCTION.md: drop '* size' since size is always 1
Closes #18640
2025-09-20 17:27:17 +02:00
Viktor Szakats
bf7375ecc5
build: avoid overriding system symbols for socket functions
Before this patch `accept4()`, `socket()`, `socketpair()`, `send()` and
`recv()` system symbols were remapped via macros, using the same name,
to local curl debug wrappers. This patch replaces these overrides by
introducing curl-namespaced macros that map either to the system symbols
or to their curl debug wrappers in `CURLDEBUG` (TrackMemory) builds.

This follows a patch that implemented the same for `accept()`.

The old method required tricks to make these redefines work in unity
builds, and avoid them interfering with system headers. These tricks
did not work for system symbols implemented as macros.

The new method allows to setup these mappings once, without interfering
with system headers, upstream macros, or unity builds. It makes builds
more robust.

Also:
- checksrc: ban all mapped functions.
- docs/examples: tidy up checksrc rules.

Follow-up to 9863599d69 #18502
Follow-up to 3bb5e58c10 #17827

Closes #18503
2025-09-20 13:44:59 +02:00
Daniel Stenberg
7a26304a95
curl_slist_append.md: clarify that a NULL pointer is not acceptable
Closes #18627
2025-09-20 12:04:47 +02:00
Viktor Szakats
1429858bce
tidy-up: update MS links, allow long URLs via checksrc
- update Microsoft documentation links.
  (also drop language designator where present.)

- checksrc: allow longer than 78 character lines if they
  contain a https URL. To make these links easier to use and parse.

- merge links that were split into two lines.

Closes #18626
2025-09-20 11:49:23 +02:00
Viktor Szakats
ad26a6cb99
tidy-up: avoid using the reserved macro namespace
To avoid hitting `-Wreserved-macro-identifier` where possible.

- amigaos: introduce local macro instead of reusing `__request()`.
- easy_lock: avoid redefining `__has_builtin()`.
  Follow-up to 33fd57b8ff #9062
- rand: drop interim macro `_random()`.
- windows: rename local macro `_tcsdup()` to `Curl_tcsdup()`.
  To avoid using the reserved macro namespace and to avoid
  colliding with `_tcsdup()` as defined by Windows headers.
- checksrc: ban `_tcsdup()` in favor of `Curl_tcsdup()`.
- tool_doswin: avoid redefining `_use_lfn()` (MS-DOS).
- tool_findfile: limit `__NO_NET_API` hack to AmigaOS.
  Syncing this pattern with `lib/netrc.c`.
  Follow-up to 784a8ec2c1 #16279
- examples/http2-upload: avoid reserved namespace for local macro.

More cases will be removed when dropping WinCE support via #17927.

Cases remain when defining external macros out of curl's control.

Ref: #18477
Closes #18482
2025-09-20 02:27:06 +02:00
Viktor Szakats
91720b620e
cmake: add CURL_CODE_COVERAGE option
To sync up with the `--enable-code-coverage` `./configure` option.

Ref: https://gcc.gnu.org/onlinedocs/gcc/Invoking-Gcov.html
Ref: https://gcc.gnu.org/onlinedocs/gcc/Cross-profiling.html
Ref: https://clang.llvm.org/docs/SourceBasedCodeCoverage.html

Closes #18468
2025-09-20 01:28:35 +02:00
Viktor Szakats
8d004781a5
build: drop the winbuild build system
In favor of CMake.

Closes #18040
2025-09-20 01:20:25 +02:00