Commit graph

1167 commits

Author SHA1 Message Date
Viktor Szakats
e78a466ebd
lib: drop unused protocol headers
- drop unused `http.h` includes.
- drop unused `http1.h` include.
- drop unused `http2.h` includes.
- vssh/ssh.h: drop unused `vssh.h` include.
- urldata.h: drop unused protocol includes.
- url: include `smtp.h` directly.
- rtsp.h: include directly where used.
- imap, smtp: drop redundant include, move another from .h to .c.

Verified with an all non-unity CI run.

Closes #20093
2025-12-25 12:00:22 +01:00
Daniel Stenberg
7e064d0756
cf-h1-proxy: support folded headers in CONNECT responses
Update test 1941 to verify this

Remove unused code from dynhds for handling folded headers, and the
associated unit tests of those functions in test 2602 and 2603.

Closes #20080
2025-12-23 17:12:14 +01:00
Viktor Szakats
e8415a8296
lib: drop, or replace sendf.h with curl_trc.h where possible
- replace `sendf.h` with `curl_trc.h` where it was included just for it.
- drop unused `curl_trc.h` includes.
- easy: delete obsolete comment about `send.h` include reason.

Also:
- move out `curl_trc.h` include from `sendf.h` and include it directly
  in users, where not done already. To flatten the include tree and
  to less rely on indirect includes.
- stop including `sendf.h` from other headers, replace it with forward
  declaration of `Curl_easy`, as done already elsewhere.

Verified with an all non-unity CI run.

Closes #20061
2025-12-21 12:39:25 +01:00
Viktor Szakats
884b5ea921
lib: include curlx/warnless.h from curl_setup.h
To make it available for all files. Drop includes from individual
sources. This header was already included from most sources and not
specific to any internal subsystem.

Also to ensure that two system symbol redefines on Windows (`read()` and
`write()`) get applied to all sources. Move them to `curl_setup.h`.

Closes #20056
2025-12-21 02:36:33 +01:00
Viktor Szakats
fdb5152091
lib: drop unused vtls/vtls.h includes
Closes #20057
2025-12-21 02:16:34 +01:00
Viktor Szakats
a354cc8664
lib: drop includes unused or duplicate
Closes #20051
2025-12-20 22:02:20 +01:00
Daniel Stenberg
c85994d53b
http: minor cleanup after the unfold rework
Closes #20037
2025-12-20 16:46:12 +01:00
Daniel Stenberg
3388afd2b6
http: more unfold fixing
Extended test 798 with some mini-sleeps to better trigger a problem that
was

Reported-by: Stefan Eissing

Closes #20036
2025-12-19 13:52:10 +01:00
Viktor Szakats
d11b8593a2
build: drop duplicate include curl/curl.h and others
- curl_range: replace `sendf.h` with direct header dependency
  `curl_trc.h`.
- drop `curl/curl.h` includes from internal sourcees in favor of the
  include made from `curl_setup.h`. Replace it with the latter where
  it's the only include.
- include `curl_setup.h` before using macros, where missing.
- drop redundant `stdlib.h`, `string.h` includes, in favor of
  `curl_setup_once.h` including them.
- drop redundant `limits.h` in favor of `curl_setup.h` including it.
- fake_addrinfo.h: fix typo in comment.
- curl_setup_once.h: drop `stdio.h` in favor of earlier include in
  `curl_setup.h`.
- drop stray, unused, `stddef.h` includes.
- memdebug.h: add missing `stddef.h` include. (relying on accidental
  includes via other headers before this patch.)
- stddef.h: document why it's included.
- strerr: drop `curl/mprintf.h` in favor of `curl/curl.h` including it
  via `curl_setup.h`.

Closes #20027
2025-12-19 10:58:11 +01:00
Daniel Stenberg
6c7bc9871f
http: fix for unfolding line starting with TAB
It should still insert a (single) space when unfolding

Follow-up to 9941e7c95b following up to 67ae101666.

Updated test 1274 and 1940 accordingly.

Closes #20029
2025-12-19 10:52:39 +01:00
Stefan Eissing
b4be1f271e
time-keeping: keep timestamp in multi, always update
Always use curlx_now() when calling Curl_pgrs_now(data). Tests with the
"manual" updates to now proved differ more then 100ms in parallel testing.

Add `curlx_nowp()` to set current time into a struct curltime.
Add `curlx_ptimediff_ms() and friends, passing pointers.

Update documentation.

Closes #19998
2025-12-18 22:10:06 +01:00
Daniel Stenberg
9941e7c95b
http: when unfolding, leave single-space for new header line
Restore the unfolding behavior from before 67ae101666. This change
(leaving more whitespace in the delivered headers) turned out causing
some friction in the git project so presumably others might also find it
a little surprising.

Reported-by: Jeff King
Ref: https://marc.info/?l=git&m=176606332701171&w=2
Closes #20016
2025-12-18 17:41:46 +01:00
Viktor Szakats
c6988f9131
curlx: move Curl_gmtime(), use gmtime_s() on Windows
Move `Curl_gmtime()` to curlx and rename to `curlx_gmtime()`. Then call
the internal wrapper also from the curl tool, to avoid using the banned
`gmtime()` directly, and using better, thread-safe alternatives when
available.

Windows `gmtime_s()` requires mingw-w64 v4+ or MSVC. Use local
workaround to also support mingw-w64 v3. `gmtime_s()` also makes
defining `_CRT_SECURE_NO_WARNINGS` unnecessary.

Also:
- lib: drop unused `parsedate.h` includes.
- drop redundant cast from `gmtime_r()` result.
- autotools: reverse condition in the proto detection to avoid
  misleading readers. (the condition plays no role in detection.)
- note Windows XP's default `msvcrt.dll` doesn't offer secure CRT APIs.
  XP likely needs a newer version of this DLL, or may not run.

Refs:
https://learn.microsoft.com/cpp/c-runtime-library/reference/gmtime-gmtime32-gmtime64
https://learn.microsoft.com/cpp/c-runtime-library/reference/gmtime-s-gmtime32-s-gmtime64-s
https://pubs.opengroup.org/onlinepubs/9799919799/functions/gmtime.html
https://linux.die.net/man/3/gmtime_r

Ref: #19957 (for `localtime_r()`)
Follow-up to 54d9f060b4
Closes #19955
2025-12-16 14:30:05 +01:00
Stefan Eissing
2de22a00c7
lib: keep timestamp in easy handle
Use `data->progress.now` as the timestamp of proecssing a transfer.
Update it on significant events and refrain from calling `curlx_now()`
in many places.

The problem this addresses is
a) calling curlx_now() has costs, depending on platform. Calling it
   every time results in 25% increase `./runtest` duration on macOS.
b) we used to pass a `struct curltime *` around to save on calls, but
   when some method directly use `curx_now()` and some use the passed
   pointer, the transfer experienes non-linear time. This results in
   timeline checks to report events in the wrong order.

By keeping a timestamp in the easy handle and updating it there, no
longer invoking `curlx_now()` in the "lower" methods, the transfer
can observer a steady clock progression.

Add documentation in docs/internals/TIME-KEEPING.md

Reported-by: Viktor Szakats
Fixes #19935
Closes #19961
2025-12-16 08:48:44 +01:00
Daniel Stenberg
67ae101666
http: unfold response headers earlier
Make the low-level HTTP header "builder" unfold headers so that
everything else can keep pretending folding does not exist.

This code no longer tries to reduce repeated leading whitespace (in the
continued folded header) to a single one. To avoid having to have a
special state for that.

Adjusted two test cases accordingly

Closes #19949
2025-12-13 23:02:18 +01:00
Stefan Eissing
9711c986ba
multi: remove MSTATE_TUNNELING
MSTATE_TUNNELING is no longer in use now that we have proxy connection
filters. Remove the state.

Remove the http handler `connect_it` method as it was merely a NOP.

Closes #19894
2025-12-09 16:01:51 +01:00
Daniel Stenberg
a3f4fd25d3
http: return OOM errors from hsts properly
When Curl_hsts_parse() fails with out of memory, return it to parent.

Closes #19862
2025-12-07 12:54:45 +01:00
Daniel Stenberg
d517efe5bd
bufref: add Curl_bufref_dup that returns a strdup()ed version
Cleans up a common pattern somewhat. Implemented as a macro.

Closes #19834
2025-12-04 19:04:19 +01:00
Patrick Monnerat
2cb868242d
lib: turn state.referer into a struct bufref
Closes #19827
2025-12-04 16:17:33 +01:00
Patrick Monnerat
36542b7349
lib: turn state.url into a struct bufref
Closes #19827
2025-12-04 16:17:31 +01:00
Viktor Szakats
c3b030b860
lib: fix formatting nits (part 3)
From `lib/h` to `lib/w`.

part 1: 47a1ab2ebe #19764
part 2: 86b346443b #19800

Closes #19811
2025-12-03 14:50:16 +01:00
Daniel Stenberg
c6c4a99300
http: acknowledge OOM errors from Curl_input_ntlm
Closes #19781
2025-12-01 12:47:57 +01:00
Daniel Stenberg
729316a9e4
http: handle oom error from Curl_input_digest()
Closes #19780
2025-12-01 10:47:33 +01:00
Viktor Szakats
193cb00ce9
build: stop overriding standard memory allocation functions
Before this patch curl used the C preprocessor to override standard
memory allocation symbols: malloc, calloc, strdup, realloc, free.
The goal of these is to replace them with curl's debug wrappers in
`CURLDEBUG` builds, another was to replace them with the wrappers
calling user-defined allocators in libcurl. This solution needed a bunch
of workarounds to avoid breaking external headers: it relied on include
order to do the overriding last. For "unity" builds it needed to reset
overrides before external includes. Also in test apps, which are always
built as single source files. It also needed the `(symbol)` trick
to avoid overrides in some places. This would still not fix cases where
the standard symbols were macros. It was also fragile and difficult
to figure out which was the actual function behind an alloc or free call
in a specific piece of code. This in turn caused bugs where the wrong
allocator was accidentally called.

To avoid these problems, this patch replaces this solution with
`curlx_`-prefixed allocator macros, and mapping them _once_ to either
the libcurl wrappers, the debug wrappers or the standard ones, matching
the rest of the code in libtests.

This concludes the long journey to avoid redefining standard functions
in the curl codebase.

Note: I did not update `packages/OS400/*.c` sources. They did not
`#include` `curl_setup.h`, `curl_memory.h` or `memdebug.h`, meaning
the overrides were never applied to them. This may or may not have been
correct. For now I suppressed the direct use of standard allocators
via a local `.checksrc`. Probably they (except for `curlcl.c`) should be
updated to include `curl_setup.h` and use the `curlx_` macros.

This patch changes mappings in two places:
- `lib/curl_threads.c` in libtests: Before this patch it mapped to
  libcurl allocators. After, it maps to standard allocators, like
  the rest of libtests code.
- `units`: before this patch it mapped to standard allocators. After, it
  maps to libcurl allocators.

Also:
- drop all position-dependent `curl_memory.h` and `memdebug.h` includes,
  and delete the now unnecessary headers.
- rename `Curl_tcsdup` macro to `curlx_tcsdup` and define like the other
  allocators.
- map `curlx_strdup()` to `_strdup()` on Windows (was: `strdup()`).
  To fix warnings silenced via `_CRT_NONSTDC_NO_DEPRECATE`.
- multibyte: map `curlx_convert_*()` to `_strdup()` on Windows
  (was: `strdup()`).
- src: do not reuse the `strdup` name for the local replacement.
- lib509: call `_strdup()` on Windows (was: `strdup()`).
- test1132: delete test obsoleted by this patch.
- CHECKSRC.md: update text for `SNPRINTF`.
- checksrc: ban standard allocator symbols.

Follow-up to b12da22db1 #18866
Follow-up to db98daab05 #18844
Follow-up to 4deea9396b #18814
Follow-up to 9678ff5b1b #18776
Follow-up to 10bac43b87 #18774
Follow-up to 20142f5d06 #18634
Follow-up to bf7375ecc5 #18503
Follow-up to 9863599d69 #18502
Follow-up to 3bb5e58c10 #17827

Closes #19626
2025-11-28 10:44:26 +01:00
Daniel Stenberg
bfc3d131b6
http: add asserts for null terminator for input strings
http_rw_hd() assumes the null terminator is present. These asserts make
sure this remains true.

Closes #19741
2025-11-28 10:06:09 +01:00
Stefan Eissing
bbb929112b
curlx_base64_encode: use uint8_t* for input
Change `inputbuff` parameter from `const char *` to `const uint8_t *` to
reflect the binary nature of the input bytes. Half the code was casting
unsigned char to signed already in calling.

Closes #19722
2025-11-27 14:35:01 +01:00
Stefan Eissing
feea968512
conncontrol: reuse handling
Add protocol handler flag `PROTOPT_CONN_REUSE` to indicate that the
protocol allows reusing connections for other tranfers. Add that
to all handlers that support it.

Create connections with `conn->bits.close = FALSE` and remove all
the `connkeep()` calls in protocol handlers setup/connect implementations.
`PROTOPT_CONN_REUSE` assures that the default behaviour applies
at the end of a transfer without need to juggle the close bit.

`conn->bits.close` now serves as an additional indication that a
connection cannot be reused. Only protocol handles that allow
reuse need to set it to override the default behaviour.

Remove all `connclose()` and `connkeep()` calls from connection
filters. Filters should not modify connection flags. They are
supposed to run in eyeballing situations where a filter is just
one of many determining the outcome.

Fix http response header handling to only honour `Connection: close`
for HTTP/1.x versions.

Closes #19333
2025-11-27 14:30:14 +01:00
Daniel Stenberg
0d2bb9c7c6
http: fix OOM exit in Curl_http_follow
Spotted by "strict torture" tests.

Closes #19705
2025-11-26 11:57:09 +01:00
Viktor Szakats
3887069c66
lib: rename internal header share.h to curl_share.h to avoid collision
Windows CRTs have a `share.h`. Before this patch when trying to
`#include <share.h>` it, the compiler picked up curl's internal
`lib/share.h` instead. Rename it to avoid this issue.

CRT `share.h` has constants necessary for using safe open CRT functions.

Also rename `lib/share.c` to keep matching the header.

Ref: https://learn.microsoft.com/cpp/c-runtime-library/sharing-constants
Ref: 625f2c1644 #16949 #16991
Cherry-picked from #19643
Closes #19676
2025-11-25 00:26:50 +01:00
Stefan Eissing
24b36fdd15
ratelimit: redesign
Description of how this works in `docs/internal/RATELIMITS.ms`.

Notable implementation changes:
- KEEP_SEND_PAUSE/KEEP_SEND_HOLD and KEEP_RECV_PAUSE/KEEP_RECV_HOLD
  no longer exist. Pausing is down via blocked the new rlimits.
- KEEP_SEND_TIMED no longer exists. Pausing "100-continue" transfers
  is done in the new `Curl_http_perform_pollset()` method.
- HTTP/2 rate limiting implemented via window updates. When
  transfer initiaiting connection has a ratelimit, adjust the
  initial window size
- HTTP/3 ngtcp2 rate limitin implemnented via ack updates
- HTTP/3 quiche does not seem to support this via its API
- the default progress-meter has been improved for accuracy
  in "current speed" results.

pytest speed tests have been improved.

Closes #19384
2025-11-24 23:34:05 +01:00
Daniel Stenberg
01623e26d0
http: error on OOM when creating range header
Closes #19630
2025-11-20 22:11:03 +01:00
Daniel Stenberg
b360fc62fb
http: avoid two strdup()s and do minor simplifications
Closes #19571
2025-11-17 16:43:01 +01:00
Daniel Stenberg
2459dc7a22
http: the :authority header should never contain user+password
Pointed-out-by: Stanislav Fort
Closes #19568
2025-11-17 15:19:39 +01:00
Viktor Szakats
2dc71ba8bf
badwords: check indented lines in source code, fix fallouts
- badwords.pl: add `-a` option to check all lines in source code files.
  Before this patch indented lines were skipped (to avoid Markdown code
  fences.)
- GHA/checksrc: use `-a` when verifying the source code.
- GHA/checksrc: disable `So` and `But` rules for source code.
- GHA/checksrc: add docs/examples to the verified sources.
- badwords.txt: delete 4 duplicates.
- badwords.txt: group and sort contractions.
- badwords.txt: allow ` url = `, `DIR`, `<file name`.

Closes #19536
2025-11-15 13:25:02 +01:00
Stefan Eissing
cb2bcb681f
lib: eliminate size_t casts
Add new functions in `curlx/warnless.h` for controlled type
conversions:

* curlx_uitouz, convert unsigned into to size_t (should always work)
* curlx_uztoso, convert size_t to curl_off_t, capping at CURL_OFF_T_MAX
* curlx_sztouz, convert ssize_t to size_t, return TRUE when ok
* curlx_sotouz_range, convert curl_off_t to size_t interval, capping
  values to interval bounds

Remove some unnecesary casts, convert some internal recv functions
to the "return result, have size_t* arg" pattern.

Closes #19495
2025-11-13 13:32:19 +01:00
Stefan Eissing
78a610cb83
lib: rename curlx_timediff to curlx_timeleft_ms
Rename `Curl_timeleft()` to `Curl_timeleft_ms()` to make the units in
the returned `timediff_t` clear. (We used to always have ms there, but
with QUIC started to sometimes calc ns as well).

Rename some assigned vars without `_ms` suffix for clarity as well.

Closes #19486
2025-11-13 13:12:58 +01:00
Daniel Stenberg
3f0629ca44
cookie: propagate errors better, cleanup the internal API
Overhaul of the internal cookie APIs and an attempt to better return
errors for OOM and similar critical problems, separate from ordinary and
benign parsing problems.

Closes #19493
2025-11-13 10:07:24 +01:00
Daniel Stenberg
7aaf9a3152
http: replace atoi use in Curl_http_follow with curlx_str_number
In an attempt to weed out atoi() use all over.

Closes #19478
2025-11-12 10:44:49 +01:00
x2018
dd71f61ea2
lib: cleanup for some typos about spaces and code style
Closes #19370
2025-11-05 14:07:28 +01:00
x2018
231f0a2eec
http: check the return value of strdup
Closes #19343
2025-11-03 20:17:41 +01:00
Viktor Szakats
25aee8648a
http: fix -Wunused-variable in !alt-svc !proxy !ws builds
```
lib/http.c:2783:23: error: unused variable 'conn' [-Werror,-Wunused-variable]
 2783 |   struct connectdata *conn = data->conn;
      |                       ^~~~
1 error generated.
```

Closes #19276
2025-10-29 16:17:35 +01:00
Viktor Szakats
7973cb0b3e
http: fix -Wunreachable-code in !websockets !unity builds
Also requires non-unity build. Possibly more non-default options are
necessary to reproduce. Seen with llvm/clang.

```
lib/http.c:1856:15: error: code will never be executed [-Werror,-Wunreachable-code]
 1856 |     httpreq = HTTPREQ_GET;
      |               ^~~~~~~~~~~
1 error generated.
```

Closes #19275
2025-10-29 16:17:34 +01:00
Daniel Stenberg
0d1d35fa34
http: only accept ';' as a separator for custom headers
When parsing incoming headers, they need to have a plain normal colon.

Previously out of convenience we used the same parser function for both
cases (incoming + custom set headers via the API) which made the
function too liberal for incoming HTTP traffic.

Closes #19200
2025-10-23 14:18:11 +02:00
x2018
7d5d0645e5
http: unify error handling in Curl_http()
Closes #19182
2025-10-21 23:19:39 +02:00
Stefan Eissing
4be9db7bc8
http: accept duplicate location with same value
When a server sends a Location: header repeat with the same location,
ignore the repeats silently.

Follow-up to 9596c4a258
Closes #19159
2025-10-20 14:48:20 +02:00
Daniel Stenberg
9596c4a258
http: return error for a second Location: header
Unless it is identical to the previous one.

Follow-up to dbcaa00657

Adjusted test 580, added test 772 and 773

Fixes #19130
Reported-by: Jakub Stasiak
Closes #19134
2025-10-20 09:35:23 +02:00
Daniel Stenberg
ae5fb4188d
lib: reduce use of data->conn->
If there are more than two of them in a function, use a local 'conn'
variable instead.

Closes #19063
2025-10-15 08:03:29 +02:00
Daniel Stenberg
9441127394
http: look for trailing 'type=' in ftp:// without strstr
- it could find a wrong string
- this is faster

Closes #19065
2025-10-15 08:02:44 +02:00
Daniel Stenberg
008078fc38
http: make Content-Length parser more WHATWG
Return error if there is something after the number other than
whitespace and newline.

Allow comma separated numbers and repeated headers as long as the new value is
the same as was set before.

Add test 767 to 771 to verify.

Reported-by: Ignat Loskutov
Fixes #18921
Closes #18925
2025-10-08 23:18:38 +02:00
Viktor Szakats
b12da22db1
lib: stop overriding system printf symbols
After this patch, the codebase no longer overrides system printf
functions. Instead it explicitly calls either the curl printf functions
`curl_m*printf()` or the system ones using their original names.

Also:
- drop unused `curl_printf.h` includes.
- checksrc: ban system printf functions, allow where necessary.

Follow-up to db98daab05 #18844
Follow-up to 4deea9396b #18814

Closes #18866
2025-10-06 20:57:59 +02:00