Commit graph

36498 commits

Author SHA1 Message Date
Viktor Szakats
3a305831d1
mbedtls: add support for 4.0.0
After this patch libcurl requires (as already documented)
the `curl_global_init()` call when using the `curl_formadd()` API with
mbedTLS.

Note: NTLM is not supported with mbedTLS 4+, because it lacks
the necessary crypto primitive: DES.

Also:
- lib: de-dupe mbedTLS minimum version checks into `curl_setup.h`.
- lib: initialize PSA Crypto as part of `curl_global_init()`.
  For MD5, SHA-256, `curl_formadd()`, and MultiSSL builds with mbedTLS
  but where mbedTLS isn't the default backend.
- lib1308: fix to call `curl_global_init()` (for the Form API).
- curl_ntlm_core: disable with mbedTLS 4+.
- md4: disable mbedTLS implementation when building against 4.x.
- md5: use mbedTLS PSA Crypto API when available, otherwise use
  the default local implementation.
- sha256: use mbedTLS PSA Crypto API when available, otherwise use
  the default local implementation.
- vtls/mbedtls: drop PSA Crypto initialization in favor of
  `curl_global_init()`.
- vtls/mbedtls: use PSA Crypto random API with all mbedTLS versions.
- vtls/mbedtls: do the same for the SHA-256 callback.
- autotools: detect mbedTLS 4+, and disable NTLM for 3.x.
- cmake: disable NTLM for mbedTLS 3.x.
- GHA/linux: keep building mbedTLS 3.x manually and use it in
  an existing job, while also enabling pytest in it.
- GHA/linux: bump to mbedTLS 4.0.0.
  Closes #19075
  Closes #19074

Refs:
https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-4.0.0
https://github.com/Mbed-TLS/mbedtls/blob/mbedtls-4.0.0/docs/4.0-migration-guide.md
https://github.com/Mbed-TLS/mbedtls/blob/mbedtls-4.0.0/tf-psa-crypto/docs/1.0-migration-guide.md [404]
https://github.com/Mbed-TLS/TF-PSA-Crypto/blob/tf-psa-crypto-1.0.0/docs/1.0-migration-guide.md
https://github.com/Mbed-TLS/TF-PSA-Crypto/blob/tf-psa-crypto-1.0.0/docs/psa-transition.md
627f727bbe/docs/4.0-migration-guide

Closes #19077
2025-10-17 11:50:48 +02:00
Daniel Stenberg
7e12139719
imap: treat capabilities case insensitively
Reported-by: Joshua Rogers
Fixes #19089
Closes #19090
2025-10-17 10:40:37 +02:00
Daniel Stenberg
f5f4710a26
examples/websocket: fix use of uninitialized rlen
Pointed out by ZeroPath

Closes #19088
2025-10-17 10:15:07 +02:00
Daniel Stenberg
f91be14bfb
openldap: limit max incoming size
Set the maximum allowed size of an incoming LDAP message, which to
OpenLDAP means that it allows malloc() up to this size. If not set,
there is no limit and we instead risk a malloc() failure.

The limit is arbitrarily set to 256K as I can't figure out what a
reasonable value should be.

OpenLDAP docs: https://openldap.org/software/man.cgi?query=lber-sockbuf&apropos=0&sektion=0&manpath=OpenLDAP+2.6-Release&arch=default&format=html

Bug: https://issues.oss-fuzz.com/issues/432441303
Closes #19087
2025-10-16 22:23:37 +02:00
Viktor Szakats
da06621d61
firefox-db2pem.sh: add macOS support, tidy-ups
Cherry-picked from #19076
Closes #19086
2025-10-16 20:53:28 +02:00
Viktor Szakats
c8aaa5d2f2
scripts: pass -- before passing xargs
Also:
- GHA/checkdocs: escape `.` in -E regex expression.

Closes #19076
2025-10-16 20:45:28 +02:00
Viktor Szakats
3c0604bba4
GHA: sync up curl -V step descriptions
Also to make it easier to recognize.

Also:
- GHA/linux-old: split steps to match other jobs.
- GHA: add `--disable` where missing.

Closes #19084
2025-10-16 20:18:25 +02:00
Viktor Szakats
c8d6643df2
GHA/windows: stop installing Perl Win32-Process* modules
It's complex and did not help stabilizing CI runs.

Hard to say, but I'm suspicious it's related to the CI errors
-1073741502, 0xC0000142, seen in the 'build examples' and
'disk space used' steps.

Ref: #18526
Reverts 52775a7fb4 #18296
Closes #19083
2025-10-16 18:53:44 +02:00
Viktor Szakats
800b0bec18
GHA: bump LibreSSL to 4.2.0
Also move back URLs to GitHub, sources are available there again.

Ref: https://github.com/libressl/portable/releases/tag/v4.2.0
Ref: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.2.0-relnotes.txt
Ref: #19050
Ref: #19081

Closes #19082
2025-10-16 16:51:08 +02:00
Viktor Szakats
1a81a8e478
version: add GSS backend name and version
MIT Kerberos version detection is implemented for autotools and cmake.

Examples:
```
curl 8.17.0-DEV (x86_64-pc-linux-gnu) ... mbedTLS/3.6.4 libidn2/2.3.7 nghttp2/1.59.0 libgss/1.0.4 OpenLDAP/2.6.7
curl 8.17.0-DEV (x86_64-pc-linux-gnu) ... LibreSSL/4.1.1 libidn2/2.3.7 nghttp2/1.59.0 mit-krb5/1.20.1 OpenLDAP/2.6.7
curl 8.17.0-DEV (x86_64-pc-linux-gnu) ... LibreSSL/4.1.1 libidn2/2.3.7 nghttp2/1.59.0 mit-krb5 OpenLDAP/2.6.7
curl 8.17.0-DEV (x86_64-pc-linux-gnu) ... LibreSSL/4.1.1 nghttp2/1.59.0 mit-krb5/1.20.1 OpenLDAP/2.6.7
curl 8.17.0-DEV (aarch64e-apple-darwin24.6.0) ... GnuTLS/3.8.10 libidn2/2.3.8 libssh2/1.11.1 nghttp2/1.67.1 mit-krb5/1.22.1
```

Also:
- cmake/FindGSS: strip project name ("Kerberos 5 release") from
  the version string when detected via `krb5-config`.

Closes #19073
2025-10-16 16:19:05 +02:00
Viktor Szakats
9c36eace60
autotools: drop detection of ancient OpenSSL libs RSAglue and rsaref
Closes #19078
2025-10-16 16:19:05 +02:00
Stefan Eissing
c37ed9a11e
apple sectrust: add to features
It should be visible in the feature list that libcurl is build with
Apple SecTrust enabled.

Closes #19057
2025-10-16 10:58:45 +02:00
Daniel Stenberg
79553fb7c6
RELEASE-NOTES: synced 2025-10-16 09:01:17 +02:00
Daniel Stenberg
71d5525113
connect: remove redundant condition in shutdown start
Pointed out by CodeSonar

Closes #19079
2025-10-16 08:56:16 +02:00
Daniel Stenberg
f8cd64e3ab
urldata: make redirect counter 16 bit
Instead of long (up to 64-bit) as the maximum allowed value set since
b059f7deaf is 0x7fff. Saves 2 or 6 bytes.

Closes #19072
2025-10-15 12:34:33 +02:00
Daniel Stenberg
b7f2355b8b
urldata: make 'retrycount' a single byte
Since it only counts up to 5

Closes #19071
2025-10-15 12:33:03 +02:00
Daniel Stenberg
62961d6cc5
lib: stop NULL-checking conn->passwd and ->user
They always point to a string. The string might be zero length.

Closes #19059
2025-10-15 10:44:51 +02:00
Emre Çalışkan
5e46318414
transfer: reset retry count on each request
Reported-by: plv1313 on github
Fixes #18926
Closes #19066
2025-10-15 10:39:31 +02:00
Stefan Eissing
182a5a9aae
quic: remove data_idle handling
The transfer loop used to check the socket and if no poll events
were seen, triggered a "DATA_IDLE" event into the filters to let
them schedule times/do things anyway.

Since we no longer check the socket, the filters have been called
already and the DATA_IDLE event is unnecessary work. Remove it.

Closes #19060
2025-10-15 10:36:43 +02:00
Daniel Stenberg
be852e39b2
tftp: check for trailing ";mode=" in URL without strstr
RFC 3617 defines two specific modes, "netascii" and "octet". This code
now checks only for those trailing ones - and not in the hostname since
they can't be there anymore.

Assisted-by: Jay Satiro
Closes #19070
2025-10-15 09:59:57 +02:00
Daniel Stenberg
5ac3541cb4
ftp: replace strstr() in ;type= handling
Since it needs to be a trailing piece of the path avoiding strstr() is
faster and more reliable.

Also stopped checking the host name since it cannot actually be there
since quite a long while back. The URL parser doesn't allow such a
hostname.

Moved the check into its own subfunction too.

Closes #19069
2025-10-15 09:19:23 +02:00
Daniel Stenberg
ae5fb4188d
lib: reduce use of data->conn->
If there are more than two of them in a function, use a local 'conn'
variable instead.

Closes #19063
2025-10-15 08:03:29 +02:00
Daniel Stenberg
9441127394
http: look for trailing 'type=' in ftp:// without strstr
- it could find a wrong string
- this is faster

Closes #19065
2025-10-15 08:02:44 +02:00
Jay Satiro
97ae9ec8ef ws: fix type conversion check
- Fix logic that checks whether a size_t will fit in a curl_off_t.

Reported-by: Viktor Szakats

Fixes https://github.com/curl/curl/issues/19017
Closes https://github.com/curl/curl/pull/19036
2025-10-14 11:06:49 -04:00
Jay Satiro
fe06127ded tool_operate: retry on HTTP response codes 522 and 524
- Treat HTTP response codes 522 and 524 as a transient error since
  Cloudflare may use them instead of 504 to signal timeout.

For example here is a 522 error message from Cloudflare:

"The initial connection between Cloudflare's network and the origin web
server timed out. As a result, the web page can not be displayed."

Prior to this change the curl tool did not retry on HTTP response codes
522 and 524 when --retry was used.

Fixes https://github.com/curl/curl/discussions/16143
Closes https://github.com/curl/curl/pull/19011
2025-10-14 11:06:24 -04:00
Viktor Szakats
64ed2ea196
examples: check more errors, fix cleanups, scope variables
Inspired by Joshua's report on examples.

Closes #19055
2025-10-14 16:33:00 +02:00
Daniel Stenberg
61dcb56743
openldap: explain a const removing typecast
Closes #19056
2025-10-14 16:25:34 +02:00
Stefan Eissing
1ea99afdc7
scorecard: add perf support on linux
When calling scorecard with --flame to produce a flamegraph, use
"perf" on linux platforms to do the measurements. Update the scorecard
documentation about it.

Closes #19058
2025-10-14 16:24:35 +02:00
Viktor Szakats
4c7507daf9
examples: improve global init, error checks and returning errors
- add `curl_global_init()` and `curl_global_cleanup()` where missing.
- check the result of `curl_global_init()` where missing.
- return the last curl error from `main()`.
- drop Win32-specific socket initialization in favor of `curl_global_init()`.
- rename some outliers to `res` for curl result code.
- fix cleanup in some error cases.

Inspired by Joshua's report on examples.

Closes #19053
2025-10-13 23:02:05 +02:00
Viktor Szakats
3049c8e0a0
examples: return curl_easy_perform() results
Where missing. Or explicitly `(void)` it where we ignore it on purpose.

Reported-by: Joshua Rogers (for `sepheaders.c`)

Closes #19052
2025-10-13 17:58:30 +02:00
Viktor Szakats
5cf0a6789d
examples: call curl_global_cleanup() where missing
Reported-by: Joshua Rogers (for `sepheaders.c`)

Closes #19051
2025-10-13 17:52:06 +02:00
Viktor Szakats
497b3f022e
checksrc: allow disabling warnings on FIXME/TODO comments
Follow-up to 71ace9f3c1

Closes #19048
2025-10-13 16:11:10 +02:00
Daniel Stenberg
6deea19eb4
RELEASE-NOTES: synced 2025-10-13 16:03:46 +02:00
Daniel Stenberg
f1828b5404
libssh2: avoid risking using an uninitialized local struct field
Reported-by: Joshua Rogers
Closes #19043
2025-10-13 12:29:13 +02:00
Daniel Stenberg
6d0fcdf2ed
libssh: catch a resume point larger than the size
As it would otherwise trigger broken math

Reported-by: Joshua Rogers
Closes #19044
2025-10-13 12:27:39 +02:00
Viktor Szakats
5e74b2df34
REUSE: move copyright headers to .checksrc
To make it simpler to move them around, create and delete them without
syncing with `REUSE.toml`.

Also:
- checksrc: allow empty lines in `.checksrc`.
- comment on why curl printfs are disallowed in examples.

Closes #19024
2025-10-13 11:54:22 +02:00
Daniel Stenberg
dee72fe31e
libssh2: fix EAGAIN return in ssh_state_auth_agent
Reported-by: Joshua Rogers
Closes #19042
2025-10-13 10:46:42 +02:00
Daniel Stenberg
e003c0b259
socks_sspi: remove the enforced mode clearing
Reported-by: Joshua Rogers
Closes #19040
2025-10-13 10:41:42 +02:00
Daniel Stenberg
67c4256f7e
pop3: function could get the ->transfer field wrong
In pop3_perform(), pop3->transfer was derived from the old
data->req.no_body. Then, pop3_perform_command() re-computed
data->req.no_body.

Now we instead call pop3_perform_command() first.

Reported-by: Joshua Rogers
Closes #19039
2025-10-13 10:40:48 +02:00
Daniel Stenberg
27375ca364
tool_getparam: make --fail and --fail-with-body override each other
This allows users to put one of them in their .curlrc and still easily
use the other one at will in command lines.

The --no-* versions disable both of them.

Reported-by: Mitchell Blank Jr
Fixes #19029
Closes #19034
2025-10-13 10:38:10 +02:00
Daniel Stenberg
56450ce26f
tool_msgs: make errorf() show if --show-error
Assisted-by: Mitchell Blank Jr
Ref: #19029
Closes #19035
2025-10-13 08:56:14 +02:00
Daniel Stenberg
cde85412d0
KNOWN_BUGS: We do not support auth-int for Digest using PUT or POST
Closes #19038
2025-10-13 08:55:32 +02:00
Daniel Stenberg
e90b2aaa7e
tftp: error requests for blank filenames
Reported-by: Joshua Rogers
Closes #19033
2025-10-12 15:37:07 +02:00
Daniel Stenberg
1feeda422e
examples/synctime: fix null termination assumptions
bonus: dont parse argv[0] for options

Reported-by: Joshua Rogers
Closes #19032
2025-10-12 15:35:57 +02:00
Daniel Stenberg
1e90a63a49
sws: pass in socket reference to allow function to close it
The function service_connection() now passes in a reference to the
socket instead of by value since the sub function http_connect() might
close it and set *infdp = CURL_SOCKET_BAD. This would previously not be
detected when service_connection() returned and potentially cause a
double close of the socket.

Reported-by: Joshua Rogers

Closes #19031
2025-10-12 15:35:14 +02:00
Daniel Stenberg
578706adde
libssh/libssh2: reject quote command lines with too much data
If there is lingering letters left on the right side after the paths
have been parsed, they are syntactically incorrect so returning error is
the safe thing to do.

Reported-by: Harry Sintonen
Closes #19030
2025-10-12 15:34:27 +02:00
Daniel Stenberg
2b49d17cba
docs: expand on quoting rules for file names in SFTP quote
Reported-by: Harry Sintonen
Closes #19025
2025-10-12 15:33:21 +02:00
Stefan Eissing
6e35eb4879
lib: SSL connection reuse
Protocol handlers not flagging PROTOPT_SSL that allow reuse of existing
SSL connections now need to carry the flag PROTOPT_SSL_REUSE.

Add PROTOPT_SSL_REUSE to imap, ldap, pop3, smtp and ftp.

Add tests the http: urls do not reuse https: connections and vice versa.

Reported-by: Sakthi SK
Fixes #19006
Closes #19007
2025-10-12 15:30:12 +02:00
Stefan Eissing
dd7762c309
libssh2: use sockindex consistently
Although the protocol should only run on index 0, there was a mix of
looked up sockindex and using constant 0 in tls send/recv.

Reported-by: Joshua Rogers
Closes #19004
2025-10-12 15:28:04 +02:00
Stefan Eissing
44429da2e1
smb: transfer debugassert to real check
That also works for non-debug builds.

Reported-by: Joshua Rogers
Cloes #19003
2025-10-12 15:27:05 +02:00