Commit graph

7000 commits

Author SHA1 Message Date
Viktor Szakats
bf7375ecc5
build: avoid overriding system symbols for socket functions
Before this patch `accept4()`, `socket()`, `socketpair()`, `send()` and
`recv()` system symbols were remapped via macros, using the same name,
to local curl debug wrappers. This patch replaces these overrides by
introducing curl-namespaced macros that map either to the system symbols
or to their curl debug wrappers in `CURLDEBUG` (TrackMemory) builds.

This follows a patch that implemented the same for `accept()`.

The old method required tricks to make these redefines work in unity
builds, and avoid them interfering with system headers. These tricks
did not work for system symbols implemented as macros.

The new method allows to setup these mappings once, without interfering
with system headers, upstream macros, or unity builds. It makes builds
more robust.

Also:
- checksrc: ban all mapped functions.
- docs/examples: tidy up checksrc rules.

Follow-up to 9863599d69 #18502
Follow-up to 3bb5e58c10 #17827

Closes #18503
2025-09-20 13:44:59 +02:00
Daniel Stenberg
7a26304a95
curl_slist_append.md: clarify that a NULL pointer is not acceptable
Closes #18627
2025-09-20 12:04:47 +02:00
Viktor Szakats
1429858bce
tidy-up: update MS links, allow long URLs via checksrc
- update Microsoft documentation links.
  (also drop language designator where present.)

- checksrc: allow longer than 78 character lines if they
  contain a https URL. To make these links easier to use and parse.

- merge links that were split into two lines.

Closes #18626
2025-09-20 11:49:23 +02:00
Viktor Szakats
ad26a6cb99
tidy-up: avoid using the reserved macro namespace
To avoid hitting `-Wreserved-macro-identifier` where possible.

- amigaos: introduce local macro instead of reusing `__request()`.
- easy_lock: avoid redefining `__has_builtin()`.
  Follow-up to 33fd57b8ff #9062
- rand: drop interim macro `_random()`.
- windows: rename local macro `_tcsdup()` to `Curl_tcsdup()`.
  To avoid using the reserved macro namespace and to avoid
  colliding with `_tcsdup()` as defined by Windows headers.
- checksrc: ban `_tcsdup()` in favor of `Curl_tcsdup()`.
- tool_doswin: avoid redefining `_use_lfn()` (MS-DOS).
- tool_findfile: limit `__NO_NET_API` hack to AmigaOS.
  Syncing this pattern with `lib/netrc.c`.
  Follow-up to 784a8ec2c1 #16279
- examples/http2-upload: avoid reserved namespace for local macro.

More cases will be removed when dropping WinCE support via #17927.

Cases remain when defining external macros out of curl's control.

Ref: #18477
Closes #18482
2025-09-20 02:27:06 +02:00
Viktor Szakats
91720b620e
cmake: add CURL_CODE_COVERAGE option
To sync up with the `--enable-code-coverage` `./configure` option.

Ref: https://gcc.gnu.org/onlinedocs/gcc/Invoking-Gcov.html
Ref: https://gcc.gnu.org/onlinedocs/gcc/Cross-profiling.html
Ref: https://clang.llvm.org/docs/SourceBasedCodeCoverage.html

Closes #18468
2025-09-20 01:28:35 +02:00
Viktor Szakats
8d004781a5
build: drop the winbuild build system
In favor of CMake.

Closes #18040
2025-09-20 01:20:25 +02:00
Viktor Szakats
f13250edf1
examples: fix two issues found by CodeQL
- http2-upload: use `fstat()` to query file length to fix TOCTOU.

- ftpuploadresume: fix checking `sscanf()` return value.

Follow-up to b4922b1295 #18564
Closes #18605
2025-09-18 20:14:21 +02:00
Christian Schmitz
0f067ba4aa
libcurl-multi.md: added curl_multi_get_offt mention
The multi interface page didn't mention the new curl_multi_get_offt
function.

Closes #18579
2025-09-17 23:11:38 +02:00
Daniel Stenberg
3053a3e90f
docs/libcurl: use lowercase must
To shout less. Use bold in some places.

Closes #18570
2025-09-16 17:12:26 +02:00
Daniel Stenberg
cdb56c6666
docs/libcurl: clarify some timeout option behavior
Closes #18569
2025-09-16 16:57:28 +02:00
Viktor Szakats
619307feb0
cmake: fix building docs when the base directory contains .3
Fixing:
```
ninja: error: '<...>/basedir.md/_bld/docs/libcurl/libcurl-symbols.md',
  needed by 'docs/libcurl/curl_easy_cleanup.3', missing and no known rule to make it
```

Reported-by: Nir Azkiel
Fixes #18560
Follow-up to 898b012a9b #1288
Closes #18563
2025-09-16 12:37:11 +02:00
Viktor Szakats
f6ddc1fc1e
Makefile.example: simplify and make it configurable
- build in a single step.

- allow overriding all variables:
  source, target, compiler, libpaths, libs, flags.

Example:
```shell
LIBS= LDFLAGS= SRC=altsvc.c make -f Makefile.example
```

Closes #18554
2025-09-16 11:25:55 +02:00
Viktor Szakats
a4196e2249
tidy-up: whitespace
Closes #18553
2025-09-15 15:00:11 +02:00
Daniel Stenberg
61b79dee79
CURLOPT_TIMECONDITION.md: works for FILE and FTP as well
Closes #18551
2025-09-15 13:58:11 +02:00
Daniel Stenberg
8de37b8cda
cmdline-docs: extended, clarified, refreshed
Closes #18550
2025-09-15 11:56:36 +02:00
Viktor Szakats
e09f45fea4
dist: do not distribute CI.md
`CI.md` slipped into the 8.15.0, 8.16.0 tarballs by accident.
Remove it again and update the checker exception.

Follow-up to fa3f889752 #17463

Closes #18549
2025-09-15 11:15:31 +02:00
Stefan Eissing
de3fc1d7ad
asyn-thrdd: drop pthread_cancel
Remove use of pthread_cancel in asnyc threaded resolving. While there
are system where this works, others might leak to resource leakage
(memory, files, etc.). The popular nsswitch is one example where resolve
code can be dragged in that is not prepared.

The overall promise and mechanism of pthread_cancel() is just too
brittle and the historcal design of getaddrinfo() continues to haunt us.

Fixes #18532
Reported-by: Javier Blazquez
Closes #18540
2025-09-15 09:25:43 +02:00
Daniel Stenberg
58bdfb4e1d
CURLOPT_SSL_VERIFYHOST.md: add see-also to two other VERIFYHOST options
Closes #18548
2025-09-14 23:53:40 +02:00
Daniel Stenberg
6bb53f29ef
TODO: remove already implemented or bad items
- remove "connect to multiple IPs in parallel"
- remove "CURLOPT_RESOLVE for any port number", It can already be
  accomplished with CURLOPT_CONNECT_TO
- remove "dynamically load modules", we don't believe in this
- remove "netrc caching and sharing", we already cache it
- remove "Offer API to flush the connection pool", this is effectively
  what CURLMOPT_NETWORK_CHANGED now allows
- remove "WebSocket read callback", introduced in 8.16.0

Closes #18542
2025-09-14 13:46:59 +02:00
Viktor Szakats
cc50f05370
GHA/codeql: re-enable for C with the default query pack
Earlier we used `security-extended` and tried `security-and-quality`.
Try the default to see how it works.

CodeQL no longer uses the project's Actions cache, also fixing
the previously seen repeat cache entry issue.

- switch to `manual` build. It's 3x faster than the default `autobuild`.
- enable more dependencies to increase coverage.
- docs/tests/CI.md: re-add CodeQL.

Ref: https://docs.github.com/en/code-security/code-scanning/managing-your-code-scanning-configuration/codeql-query-suites
Ref: https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
Ref: #16263
Ref: 173805b2e7 #15798

Closes #18528
2025-09-12 11:03:44 +02:00
Dan Fandrich
bbdb869ec7 libcurl-security.md: mention long-running connections
Some applications may want to periodically recheck the remote server
certificate, which doesn't happen on a long-running connection.

Ref: #18527
Closes #18533
2025-09-12 00:20:19 -07:00
Daniel Stenberg
d7d32ad9b9
docs/libcurl: remove ancient version references
To make the texts easier on the eye.

- Remove most free text references to curl versions before 7.60.0 (May
  2018)
- Leave those present in a HISTORY section

Most of them are already documented in symbols-in-versions anyway.

Closes #18530
2025-09-12 08:27:38 +02:00
Daniel Stenberg
57b195bf51
CURLINFO_FTP_ENTRY_PATH.md: this is for SFTP as well
Closes #18531
2025-09-12 08:26:45 +02:00
Daniel Stenberg
c184f464f7
CURLOPT_MAXLIFETIME_CONN: make default 24 hours
Set a default value to only reuse existing connections if less than 24
hours old. This makes the TLS certificate check get redone for the new
connection. An application can still set it to zero.

Closes #18527
2025-09-11 19:46:41 +02:00
Daniel Stenberg
839b22863e
ssl-sessions.md: mark option experimental
Also make managen output the experimental text with the correct
prefix/margin for the ascii version.

Closes #18523
2025-09-11 17:01:07 +02:00
Daniel Stenberg
bee4ee6141
VERSIONS: update past versions 2025-09-10 07:43:09 +02:00
Daniel Stenberg
85ba1b8067
THANKS: names from the 8.16.0 cycle 2025-09-10 07:41:00 +02:00
Daniel Stenberg
f8ff233cdf
_ENVIRONMENT.md: document NETRC
Follow-up to 378713deb2

Closes #18497
2025-09-08 22:45:30 +02:00
Daniel Stenberg
32909591d2
docs: put <> within backticks in titles
To render better markdown. Make managen warn if present "unticked" and
unescaped.

Closes #18498
2025-09-08 22:42:53 +02:00
Daniel Stenberg
07a688135d
KNOWN_BUGS: OpenSSL-QUIC problems on google.com
Closes #18336
Closes #18492
2025-09-08 11:45:33 +02:00
Daniel Stenberg
34fd7e8d2d
RELEASE-PROCEDURE.md: drop the _newslog edit mention
Because that file has now been removed from the website repository
2025-09-08 11:12:47 +02:00
Daniel Stenberg
455afa1de5
RELEASE-PROCEDURE.md: remove some old release dates, add some new 2025-09-08 10:14:12 +02:00
Daniel Stenberg
3b2cfa55a0
mailmap: unify on James 2025-09-08 09:26:22 +02:00
Viktor Szakats
10e9d512e5
BINDINGS: point a link to archive.org
The original website is hosting different content now.

Closes #18489
2025-09-07 18:59:11 +02:00
Viktor Szakats
ce62f0f9a1
VULN-DISCLOSURE-POLICY: make it pass test 1275
```
test 1275...[Verify capital letters after period in markdown files]
 ../../docs/VULN-DISCLOSURE-POLICY.md:426:55:error: lowercase daily after period
 * regular communication from communication leader (ex. daily update)
```
Ref: https://github.com/curl/curl/actions/runs/17527331816/job/49779555753?pr=18485

Also: add ending slashes to 2 URLs.

Follow-up to 6905370df5 #18483
Closes #18486
2025-09-07 12:39:44 +02:00
Jim Fuller
6905370df5
docs: add major incident section to vuln disclosure policy
Closes #18483
2025-09-06 12:20:45 +02:00
Viktor Szakats
ec9cb618a0
spacecheck: warn for 3+ empty lines in a row, fix fallouts
Closes #18478
2025-09-04 20:37:51 +02:00
Viktor Szakats
49145249be
tidy-up: drop stray "unused" comments
Closes #18453
2025-09-03 16:31:16 +02:00
Daniel Stenberg
71c9706959
tests: remove the 'none' server
Only actually needed servers should be listed and none is then implied
if no servers are listed.

Outputs a warning if "none" is still set as a server.

Closes #18466
2025-09-03 14:30:10 +02:00
Florian Friedrich
ad42850b23
docs: fix typo (staring -> starting)
Closes #18450
2025-09-02 10:11:51 +02:00
Daniel Stenberg
e00cb001c6
CURLINFO_FILETIME*.md: correct the examples
Only -1 means bad value, all others are acceptable.

Ref: #18424
Closes #18447
2025-09-02 07:51:14 +02:00
Daniel Stenberg
c3bbd41eef
DEPRECATE.md: drop old OpenSSL versions
Closes #18413
2025-08-28 17:52:40 +02:00
Stefan Eissing
fa3baabbd8
websocket: improve handling of 0-len frames
Write out 9-length frames to client's WRITEFUNCTION
Read 0-length frames from READFUNCTION *if* the function
started a new frame via `curl_ws_start_frame()`.

Fixes #18286
Closes #18332
Reported-by: Andriy Druk
2025-08-28 11:00:02 +02:00
Viktor Szakats
3c64ffaff4
HTTP3.md: avoid configure issue for ngtcp2 1.14.0+ compatibility
Applied the same workaround to the build examples as used earlier in CI.
That is, drop `<path> from `--with-ngtcp2=<path>` and configure env
`PKG_CONFIG_PATH` instead.

Till the root cause is fixed.

Ref: 99500660af #18028

Reported-by: Pavel Kropachev
Fixes #18188
Closes #18415
2025-08-27 16:38:16 +02:00
Daniel Stenberg
0718ae7c61
DEPRECATE.md: drop support for c-ares versions before 1.16.0
in March 2026

That month, c-ares 1.16.0 celebrates its sixth birthday.

Closes #18408
2025-08-27 10:45:23 +02:00
Daniel Stenberg
022f9a428a
write-out.md: header_json is not included the json object
Fixes #18390
Reported-by: Sebastian Carlos
Closes #18399
2025-08-26 10:10:33 +02:00
Viktor Szakats
1611e87d66
docs: point two broken links to archive.org
Closes #18393
2025-08-25 19:43:03 +02:00
Viktor Szakats
31e6798544
build: support LibreSSL native crypto lib with ngtcp2 1.15.0+
In ngtcp2 1.15.0 the LibreSSL crypto interface library got its own name:
`libngtcp2_crypto_libressl`. In previous versions it used
`libngtcp2_crypto_quictls`, shared with quictls itself (but not
compatible with).

Adapt autotools and cmake scripts to look for the new name first, and
fall back to the old one if not found.

Fallback to quictls tested OK in CI with both autotools and cmake:
https://github.com/curl/curl/actions/runs/17174994908?pr=18377

Ref: https://github.com/ngtcp2/ngtcp2/releases/tag/v1.15.0
Ref: https://github.com/ngtcp2/ngtcp2/pull/1716

Closes #18377
2025-08-23 15:45:36 +02:00
Viktor Szakats
4f0e530c77
tidy-up: formatting
Closes #18373
2025-08-23 01:12:27 +02:00
Viktor Szakats
d6c51a8fda
cmake: CURL_CA_FALLBACK only works with OpenSSL
Ref: 2f6524ce3c #18364
Ref: #18362

Closes #18365
2025-08-23 00:02:33 +02:00