Commit graph

37759 commits

Author SHA1 Message Date
Viktor Szakats
14144a4064
mk-ca-bundle.pl: drop support for obsolete/insecure fingerprint algos
MD5 and SHA1 fingerprints can no longer be included in the output when
using the `-t` option.

Closes #20527
2026-02-05 15:22:01 +01:00
Viktor Szakats
4b3af7fb67
lib: disable websockets early if no http
To prevent inconsistent `CURL_DISABLE_WEBSOCKETS` states between source
files.

Follow-up to 8edc0338f3 #20351

Closes #20526
2026-02-05 13:12:10 +01:00
Viktor Szakats
f659b82c2a
build: make HTTP_ONLY build options also disable websockets
Closes #20525
2026-02-05 13:12:10 +01:00
Viktor Szakats
4fb5c916fd
cmake: use list(APPEND ...) where missing
Cherry-picked from #20407

Closes #20522
2026-02-05 13:12:10 +01:00
Viktor Szakats
fa9318cabf
GHA/linux-old: use tilde where possible and consistent
Cherry-picked from #20407

Closes #20524
2026-02-05 13:12:10 +01:00
Viktor Szakats
86d8e2b94d
GHA/non-native: pin DJGPP toolchain to hash
This package is automatically bumped, but needs manual intervention
anyway, to update gcc version number in the filename.

Follow-up to 4ad0a022e1 #20517

Closes #20523
2026-02-05 13:12:10 +01:00
Viktor Szakats
4ad0a022e1
CI: log downloaded file hashes, pin manually bumped ones
To ensure downloaded binaries are the expected ones. Also to document
SHA-256 hashes of all binary packages and source tarballs.

Closes #20517
2026-02-05 03:20:46 +01:00
Viktor Szakats
462244447e
build: use native file open flags in Windows-specific code
To comply with official documentation. Also to make code compile with
`NO_OLDNAMES` (mingw-w64) or `_CRT_DECLARE_NONSTDC_NAMES=0` (MSVC) set.

Ref: #15652

Closes #20516
2026-02-04 15:59:35 +01:00
Daniel Stenberg
94349aa932
mqtt: verify Remaining Length for CONNACK and PUBACK
Verified in test 1132

Closes #20513
2026-02-04 15:43:13 +01:00
Daniel Stenberg
0ccaf6c835
VULN-DISCLOSURE-POLICY.md: push reports to the web form
Closes #20515
2026-02-04 12:45:51 +01:00
Viktor Szakats
0bfd2645ca
GHA/windows: set lookup-only in build-cache jobs
To save a few seconds by not actually restoring the cache, just checking
if there is cache hit.

Follow-up to fb44e44d92 #20456

Closes #20512
2026-02-04 03:07:29 +01:00
Viktor Szakats
443a539fcf
build: move curl stat struct type to the curlx namespace
To match surrounding curlx symbols and functions.

Follow-up to a84b041281 #20496

Closes #20508
2026-02-04 02:07:16 +01:00
Daniel Stenberg
fdca2e0fd3
imap: add a check for Curl_meta_get()
It should not return NULL, but if it does we need to bail out. Like we
do elsewhere.a

Found by CodeSonar.
Closes #20510
2026-02-03 23:24:06 +01:00
Stefan Eissing
2d4efbb9b3 multi: update timer unconditionally in multi_remove_handle
When removing an easy handle from a multi, there was an optimization
to update the timer only when the removed handle had any timers.

With the introduction of the "dirty" bitset, easy handles can now cause
a timeout of 0 to be set without having anything in their timer list.
Removing such a handle needs to update the timer now always, so that
it may get cleared when there is nothing more to wait for.

The previous "not clearing a 0 timer" should not have any effect on
application's logic. Without clearing, the timer will fire and then
adjust itself to the proper value. But it would cause one more timer
fire than necessary.

Reported-by: Jan Macku

Fixes https://github.com/curl/curl/issues/20498
Closes https://github.com/curl/curl/pull/20502
2026-02-03 16:24:39 -05:00
Viktor Szakats
0590753a3c
build: require POSIX strdup()
Stop detecting this function and drop the local fallback.

Let us know if this update is causing an issue.

Notes:
- on Windows `_strdup()` is required instead.
- `strdup()/_strdup()` were required before this patch to build one of
  the examples: `block_ip`.
- `strdup()/_strdup()` were required in 8.18.0 and earlier to build
  tests.

Closes #20505
2026-02-03 17:50:18 +01:00
Viktor Szakats
710d5a28fb
fopen.h: simplify curl memory macro mappings
Closes #20506
2026-02-03 15:13:37 +01:00
Viktor Szakats
5bdbad87c5
curlx: drop unused curlx_saferealloc()
Unused since 67ae101666 #19949

Closes #20504
2026-02-03 15:13:37 +01:00
Viktor Szakats
31a4f415af
build: tidy up and dedupe strdup functions
- de-dupe lib/src strdup/memdup functions into curlx.
- introduce `CURLX_STRDUP_LOW()` for mapping `strdup()`, and to do it at
  one place within the code, in `curl_setup.h`.
- tests/server: use `curlx_strdup()`. (Also to fix building without
  a system `strdup()`.)
- curlx/curlx.h: shorten and tidy up.
- adjust Windows build path to not need `HAVE_STRDUP`.
- build: stop detecting `HAVE_STRDUP` on Windows.

Closes #20497
2026-02-03 14:02:30 +01:00
Viktor Szakats
e39650c984
curl_setup.h: simplify curl memory macro mappings
Full argument listing is redundant for `curl`-prefixed internal macros.

Closes #20499
2026-02-03 10:54:42 +01:00
Viktor Szakats
d442be2ce3
typos: silence false positives found in C code
Closes #20500
2026-02-03 00:59:41 +01:00
Daniel Stenberg
76c4c8d411
RELEASE-NOTES: synced 2026-02-02 23:44:30 +01:00
Stefan Eissing
ffdbc04c7b
hostip.c: fix leak of addrinfo
When creating a dns entry, the addrinfo is passed into the entry on
success and needed deallocation by the caller on failure.

Change the signature to have Curl_dnscache_mk_entry() *always* take
ownership of the addrinfo, even on failure. Change parameter to address
of pointer so that call always clears it.

This makes the handling of failures to Curl_dnscache_mk_entry() simpler.

Fixes #20465
Closes #20468
2026-02-02 23:29:45 +01:00
Viktor Szakats
a84b041281
build: tidy up curl-specific fstat calls and stat struct type
To avoid redefining the `fstat` system symbol, and to clarify
`struct_stat` is a curl symbol.

- introduce `curlx_fstat()` macro and use it.
- rename `struct_stat` to `curl_struct_stat`.

Also:
- tests: replace direct `curlx_win32_stat()` call with `curlx_stat()`.
- checksrc: disallow direct `_fstati64` and `fstat()` calls, except in
  examples.

Closes #20496
2026-02-02 18:57:13 +01:00
Viktor Szakats
9630593650
build: use more const
Mostly with `char *` types.

Also:
- mime, x509asn1, tool_operate, lib3207: drop redundant casts.
- examples/smooth-gtk-thread: add missing variable declaration.
- reduce variable scopes.
- tests/server: move `data_to_hex()` to its only user: `sws`.

Closes #20489
2026-02-02 12:32:49 +01:00
Viktor Szakats
66bb641331
ftp: drop single-caller local verbose function
Closes #20495
2026-02-02 12:28:13 +01:00
Viktor Szakats
4728efe082
ftp: replace a curlx_free() with curlx_dyn_free()
On an error path.

Follow-up to f4beef524a #12638

Closes #20494
2026-02-02 12:28:13 +01:00
Viktor Szakats
9d04582d8c
test1604: avoid dynamic allocations
Closes #20493
2026-02-02 12:28:13 +01:00
Viktor Szakats
d8e3376c18
test1304: drop CURL_UNCONST()
Closes #20492
2026-02-02 12:28:13 +01:00
Viktor Szakats
4f1646ef8a
cmake: skip binutils ld hack if zlib/openssl target is not IMPORTED
The binutils ld hack requires reading the targets' `LOCATION` property.
This property exists in `IMPORTED` targets. `ZLIB::ZLIB` and
`OpenSSL::Crypto` are normally `IMPORTED` targets defined by CMake's
built-in Find modules. However, in some cases (e.g. in "superbuilds"),
they may be regular targets, defined manually, without a `LOCATION`
property. To avoid a CMake warning in such case, verify if the target is
`IMPORTED` before reading this property.

This also mean that in such case the binutils/ld/gcc hack is not
enabled, and libcurl may fail linking in static mode.

https://cmake.org/cmake/help/v4.2/prop_tgt/IMPORTED.html
https://cmake.org/cmake/help/v4.2/prop_tgt/LOCATION.html

Reported-by: Tomáš Malý
Fixes #20419
Follow-up to 3e841630ec #20427
Follow-up to 16f073ef49 #16973

Closes #20486
2026-02-02 12:28:12 +01:00
Viktor Szakats
96fa42c7c0
build: tidy up local lseek() mappings
- stop redefining system symbol `lseek`, by introducing `curl_lseek()`.
- handle AmigaOS quirk within the macro mapping.
- add missing parenthesis to `LSEEK_ERROR` values.
- tool_util: use curl `lseek` macros in `tool_ftruncate64()`.
- move `LSEEK_ERROR` to right-hand side of if expressions.
- checksrc: disallow direct uses of `_lseeki64`, `llseek`, `lseek`.

Closes #20488
2026-02-01 17:29:39 +01:00
dependabot[bot]
47734f3244
GHA: bump GHA and pip dependencies
- update `actions/checkout` from 6.0.1 to 6.0.2
- update `ruff` from 0.14.11 to 0.14.14
- update `cryptography` from 46.0.3 to 46.0.4
- update `psutil` from 7.2.1 to 7.2.2
- update `websockets` from 15.0.1 to 16.0

Closes #20490
Closes #20491
2026-02-01 16:40:37 +01:00
Viktor Szakats
3003c32cb2
tidy-up: miscellaneous
- INSTALL-CMAKE.md: add missing periods, text fixes.
- md4, md5: sync variables names.
- curl_trc: sync an argument type.
- docs/examples: sync debug/trace function copies, constify, tidy-ups.
- replace commented code with `#if 0`.
- drop redundant parenthesis (macro values, `return`, around single
  variables, function calls).
- fix indentation, apply clang-format in places.

Closes #20481
2026-02-01 00:54:23 +01:00
Jay Satiro
ca5efd02b6 CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.md: fix available protocols
Bug: https://curl.se/mail/lib-2026-01/0033.html
Reported-by: Tenant HellTower (Negar)
2026-01-31 14:37:29 -05:00
Viktor Szakats
9c3fcb8a32
vtls: dedupe common on-session-reuse logic
Closes #20475
2026-01-30 13:27:03 +01:00
Viktor Szakats
97a294688f
ssh: dedupe state change function
Closes #20473
2026-01-30 13:27:03 +01:00
Viktor Szakats
1acf0c45f4
cmake: improve setting up runtests in Windows cross-builds
Closes #20479
2026-01-30 00:34:25 +01:00
Viktor Szakats
b619952b82
GHA/windows: fix typo in test number [ci skip]
Follow-up to 3ae234b2a3 #20462
2026-01-30 00:24:21 +01:00
Viktor Szakats
154dff6acc
tests/server/sockfilt: avoid possible endless loop on Windows
Seen to happen when run under WINE v10.0 on macOS.
```
$ CURL_TEST_EXE_EXT_SRV=.exe CURL_TEST_EXE_EXT_TOOL=.exe \
CURL_TEST_EXE_RUNNER=wine TFLAGS='951 -t' ninja tests
[...]
16:02:18.607002 [select_ws_wait_thread] PeekNamedPipe error: (0x00000032) - Request not supported.
[...endless repeat...]
```

Closes #20478
2026-01-29 23:25:36 +01:00
Viktor Szakats
373e89a021
tests/server: tidy-up error messages (Windows)
- show error description on `PeekNamedPipe()` error.
- show `GetLastError()` instead of socket error on non-socket failures
  in the window handler.
- include full hex `GetLastError()` numbers in error messages, syncing
  with Schannel code.
- drop internal `win32_perror()` function, in favor of direct
  `curlx_*strerror()` calls.

Closes #20477
2026-01-29 22:53:23 +01:00
Viktor Szakats
4d0c3b690e
tool_help.h: drop redundant U suffix from literals
Also:
- update the generator script accordingly.
- convert lowercase `u` suffix to uppercase to match rest of code.

Closes #20476
2026-01-29 22:53:22 +01:00
Viktor Szakats
c2d7bfa992
http2: dedupe nghttp2 verbose frame print function
Closes #20472
2026-01-29 19:22:00 +01:00
Viktor Szakats
0f5006f50d
md4, md5: replace custom types with uint32_t
Closes #20469
2026-01-29 15:01:16 +01:00
Viktor Szakats
ea044c5e65
setup-os400.h: drop no longer used custom type u_int32_t
Unused since bb55293313.

Closes #20470
2026-01-29 14:58:03 +01:00
Viktor Szakats
f95c79a988
send: drop CURL_UNCONST() from buffer argument on most platforms
Keep it on platforms requiring a non-const buffer. These are AmigaOS and
OS400.

Also:
- replace `SEND_QUAL_ARG2` with boolean macro `SEND_NONCONST_ARG2`.

Closes #20463
2026-01-29 03:42:09 +01:00
Viktor Szakats
d60f1006b0
GHA/macos: merge an autotools job into a cmake one, drop an iOS job
Merging the two macOS jobs saves 4-5 minutes. The dropped iOS Ninja job
saves 0.5-1 minute. (Keep the two slow iOS jobs to maintain variation.)

Number of Apple jobs is 32 after this patch.

Also:
- skip building tests and example in iOS autotools to save 30-40s.

Closes #20467
2026-01-29 03:10:21 +01:00
Dan Fandrich
3509a41494 docs: document the need for a 64-bit type and stdint.h
These are requirements above and above C89.

Ref: #20406

Closes #20384
2026-01-28 08:45:56 -08:00
Viktor Szakats
3ae234b2a3
GHA/windows: mark test 3001 flaky in native Windows jobs
It has been happening for a long time.

Example:
```
test 3001...[HTTPS localhost, last subject alt name matches, CN does not match]

 3001: protocol FAILED!
 There was no content at all in the file log/7/server.input.
 Server glitch? Total curl failure? Returned: 56
== Contents of files in the log/7/ directory after test 3001
=== Start of file commands.log
 ../src/curl.exe -q --output log/7/curl3001.out  --include --trace-ascii log/7/trace3001 --trace-time -4 --cacert ./certs/test-ca.crt https://localhost:64259/3001 > log/7/stdout3001 2> log/7/stderr3001
=== End of file commands.log
=== Start of file http_server.log
 13:57:47.951283 Running HTTP IPv4 version on port 64256
=== End of file http_server.log
=== Start of file https_stunnel.log
 2026.01.28 13:57:48 LOG5[ui]: stunnel 5.76 on x64-pc-mingw32-gnu platform
 2026.01.28 13:57:48 LOG5[ui]: Compiled/running with OpenSSL 3.5.4 30 Sep 2025
 [...]
 2026.01.28 13:57:49 LOG5[0]: Service [curltest] accepted connection from 127.0.0.1:64281
 2026.01.28 13:57:51 LOG3[0]: s_connect: connect 127.0.0.1:64256: Connection refused (WSAECONNREFUSED) (10061)
 2026.01.28 13:57:51 LOG3[0]: No more addresses to connect
 2026.01.28 13:57:51 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
=== End of file https_stunnel.log
=== Start of file server.cmd
 Testnum 3001
=== End of file server.cmd
=== Start of file stderr3001
 curl: (56) Recv failure: Connection was reset
=== End of file stderr3001
[...]
RUN: Unknown server on our https port: 64259 (56)
```

Ref: https://github.com/curl/curl/actions/runs/21440845836/job/61743268798?pr=20461

Closes #20462
2026-01-28 15:47:36 +01:00
Viktor Szakats
41880875ad
tests/server: drop stray casts from swrite/sread arguments
Closes #20461
2026-01-28 15:09:52 +01:00
Viktor Szakats
2e5cc08d25
tests/server: replace 4 remaining send() calls with swrite()
They were masked by `()`, which was also not necessary anymore.

Follow-up to 483f4291fb #20459
Follow-up to a585cc35e5 #20097
Follow-up to bf7375ecc5 #18503

Closes #20460
2026-01-28 15:09:51 +01:00
Viktor Szakats
483f4291fb
build: replace send/recv with swrite/sread where missing
Also:
- checksrc: ban `send` and `recv`, as documented in `CODE_STYLE.md`.

Follow-up to 9a2663322c #17572
Ref: a585cc35e5 #20097
Ref: #20441

Closes #20459
2026-01-28 14:39:22 +01:00