Commit graph

37491 commits

Author SHA1 Message Date
Viktor Szakats
4c9e4e99c1
build: detect and include inttypes.h again
For `PRI*` printf masks for fixed-size C99 types.

Also:
- add simple fallback for `PRIu32`, `PRIx32`, if `inttypes.h` is
  missing.

Cherry-picked from #20200
Ref: #20207
Follow-up to 4701a6d2ae #19695
Ref: 60359ad504 #12275
Closes #20208
2026-01-07 16:10:23 +01:00
Daniel Stenberg
5f612acaa1
urlapi: split parts of parseurl() into sub functions
- parse_file
- parse_scheme
- guess_scheme
- handle_fragment
- handle_query
- handle_path

Closes #20205
2026-01-07 14:31:08 +01:00
Stefan Eissing
f6e8531c03
http/3: add description for known server error codes
When a server resets a stream with an error code, list that code
and its known name in the failure message of the transfer.

Ref: #20195
Closes #20202
2026-01-07 14:30:21 +01:00
Viktor Szakats
c25fdaf081
GHA/macos: merge two autotools !ssl jobs into others, switch one to cmake
Number of jobs down to 34 (from 56 at end of last year.)
Out of them 7 autotools (was 24 at end of last year.)

Also:
- stop install brew packages preinstalled.
- make some dependency options explicit.

Closes #20203
2026-01-07 12:44:42 +01:00
Viktor Szakats
671df8d357
config-plan9: set HAVE_STDINT_H again
Follow-up to 1ecf2f1113 #16585 #15907
Follow-up to 60359ad504 #12275

Closes #20201
2026-01-07 10:43:34 +01:00
Daniel Stenberg
2eebc58c4b
RELEASE-NOTES: synced
curl 8.18.0 release
2026-01-07 07:56:22 +01:00
Daniel Stenberg
45802c9bdb
THANKS: add contributors from 8.18.0 2026-01-07 07:56:22 +01:00
Daniel Stenberg
4c9f868686
VERSIONS.md: add date for 8.18.0, mention 8.19.0 is pending 2026-01-07 07:56:22 +01:00
Viktor Szakats
40c1748af5
tool_urlglob: fix propagating OOM error from sanitize_file_name()
Make sure to convert a low-level OOM error code a libcurl one, to make
the curl tool to display an accurate error code and messages. On Windows
and MS-DOS.

Improving:
```
$ CURL_FN_SANITIZE_OOM=1 wine curl.exe https://curl.se/ --output out.txt
[...]
curl: (3) URL using bad/illegal format or missing URL
```
to:
```
[...]
curl: (27) Out of memory
```

Cherry-picked from #20116
Closes #20198
2026-01-06 20:02:55 +01:00
Viktor Szakats
e2d61a6b30
curlx_win32_fopen: use _fsopen()/_wfsopen() with _SH_DENYNO
Replacing `fopen_s()`/`_wfopen_s()`, to allow customizing share mode,
and keep the sharing mode as was with `fopen()`/`_wopen()` earlier and
as used in `_sopen_s()`/`_wsopen_s()`.

The replaced functions used `_SH_SECURE` internally. Otherwise they are
identical to the replacements.

Ref: https://learn.microsoft.com/cpp/c-runtime-library/reference/fsopen-wfsopen

Reported-by: Jay Satiro
Fixes #20155
Ref: #20156
Follow-up to 1e7d0bafc6 #19643
Closes #20186
2026-01-06 12:20:01 +01:00
Andrew
64350280d3
ldap: fix LDAP version display on IBMi
Fixes #20196
Closes #20197
2026-01-06 12:08:16 +01:00
Samuel Henrique
dce81d3c4e
wcurl: import v2026.01.05
Closes #20194
2026-01-06 10:12:31 +01:00
Viktor Szakats
5a4cd75863
GHA/macos: switch 5 jobs from autotools to cmake
To save 0.5 to 3 minutes per job.

There remain 7 main autotools jobs, plus 1 in combinations and 1 more
for iOS.

Also:
- fix to disable MQTT, WebSockets, IPFS in HTTP-only job.

Closes #20193
2026-01-06 04:15:22 +01:00
pojomi
dc739fee16
config2setopts: add space in cookie header with multiple -b
Closes #20184
2026-01-05 23:32:00 +01:00
Viktor Szakats
fecc987ebf
GHA: reduce total timeouts for Linux and macOS jobs
- Linux: 25 -> 15 minutes.
- Linux H3: 45 -> 10 minutes.
- macOS: 25 -> 15 minutes.

On macOS this may catch flaky slowness seen sometimes in pytests:
https://github.com/curl/curl/pull/20187#issuecomment-3711753097

Closes #20192
2026-01-05 23:27:36 +01:00
Andrew
d3def68d3b
multi: fix to build on IBMi
Sync function declaration with definition. Update related local vars.

Follow-up to 4701a6d2ae #19695
Fixes #20190
Closes #20191
2026-01-05 23:16:04 +01:00
Andrew
0343951cb5
ldap: fix Curl_ldap_version() for IBMi/OS400
- `LDAP_OPT_SUCCESS` (== 0) is missing from some LDAP implementations
  and documented to use `LDAP_SUCCESS` (== 0) instead. Use literal zero
  to avoid macro name differences.

- fix freeing `LDAP_OPT_API_INFO` buffers:
  - docs suggest `ldapai_vendor_name` on IBMi is `const char *`.
    Nothing in docs says it need to be freed.
  - `ldapai_extensions` need to be freed, according to docs.
    However, on IBMi there is `ldap_value_free()` function for it.
  Ref: https://www.ibm.com/docs/en/svd/10.0.3?topic=settings-ldap-opt-api-info

Fixing, on OS400 (V7R4M0):
```
CZM1003:  LDAP__819.c, 1028.56: CZM0045(30) Undeclared identifier LDAP_OPT_SUCCESS.
CZM1003:  LDAP__819.c, 1036.21: CZM0280(30) Function argument assignment between types "char*" and "const char*" is not allowed.
CZM1001:  LDAP__819.c, 1037.5: CZM0304(10) No function prototype given for "ber_memvfree".
...
CZS0601:  Module LDAP is not created because statement errors occurred.
```

Follow-up to 859ce48de1 #19832
Fixes #20188
Closes #20189
2026-01-05 23:10:47 +01:00
Viktor Szakats
0ec07e38f3
GHA/macos: drop compiler matrix for macos jobs
To reduce the number of jobs, and the time spent running macos runners.
The curl codebase has just a few Apple-specific parts, and they remain
well-covered after this patch.

Makes the number of jobs 24, down from 32.

Perhaps more jobs could be merged or dropped, and CPU use reduced by
moving some to cmake. Unique, but not Apple-specific jobs may also be
moved to Linux.

Follow-up to b869932392 #20178

Closes #20187
2026-01-05 19:43:23 +01:00
Viktor Szakats
9f1838e965
GHA/macos: enable Apple IDN and SecTrust for combination jobs
Closes #20185
2026-01-05 11:00:19 +01:00
Daniel Stenberg
20ac5531cd
mk-lib1521: make the test set each string option again
In an attempt to make sure that setting it again does not leak memory.

The second string is set to `""`, which is done so that this now finds
the problem reported in #20179.

Ref: #20179
Closes #20181
2026-01-04 14:48:13 +01:00
Daniel Stenberg
193397bf4e
progress: narrower time display, multiple fixes
- Each time field is now 7 characters wide, so that the total width
  never exceeds 79 columns so that it works correctly also in Windows
  terminals. The title lines are adjusted accordingly.

  This is accomplished by using h:mm:ss style up to 10 hours, and for
  longer periods switch to "nnX nnY" style output. For hours, days,
  months and years.

  For less than one hour, the hour field is now dropped.

  When no time info is provided, the field is now space-only. No more
  `-:--:--`.

  Also fixed the output for really long times which previously was
  completely broken. The largest time now shows as ">99999y". (Becase
  I can't figure out a better way).

- For sizes, the widths are now properly fixed to 6 characters. When
  displaying a unit with less than 3 digits, it shows two decimal
  precision like "16777215 => 15.99M" and one decmal otherwise: "262143
  => 255.9k"

  Also fixes the decimal math. 131071 is 127.9k, which it previously did
  not show.

- The time and size field outputs are now properly verified in test
  1636.

Fixes #20122
Closes #20173

fixup use only space when no time exists

Drop the hour from the display when zero
2026-01-04 14:42:08 +01:00
Daniel Stenberg
3c8f9c9247
setopt: free the previous STRING_ENCODING before storing the new
Follow-up to 6b9c75e219

Fixes #20179
Reported-by: correctmost on github
Closes #20180
2026-01-04 14:32:28 +01:00
Daniel Stenberg
eb7f5b71e5
tool_doswin: remove the max length check
A too long name is likely to cause a problem later anyway and get
reported there. We don't enforce file name lengths for any other
systems.

Assisted-by: Jay Satiro
Assisted-by: Viktor Szakats

Closes #20143
2026-01-04 11:22:43 +01:00
Viktor Szakats
b869932392
GHA/macos: reduce number of combination jobs
- drop autotools (except one) from combination jobs.
  They seem to add little value over cmake ones, yet take a lot of time
  even after restricting them to shared libs.

  20-25s to install autotools via Homebrew, for each 11 jobs. autoreconf
  taking 10s, configure 25s, build 30-35s. A total of 1m30s to 1m45s per
  job. Sometimes jumping up to 2-4 minutes.

  Compare this to 20-25s total job times with cmake.

  Keep one job with an indentical cmake pair to help detecting
  build-tool-specific fallouts.

- drop more combination jobs.
  To avoid overlap with main build jobs.

Reducing number of jobs to 9, from 22 (-13),
total job time to 5.5 minutes, from 25 (-20m).

Before: https://github.com/curl/curl/actions/runs/20637652089
After: https://github.com/curl/curl/actions/runs/20686390641?pr=20178

Considering the small amount of Apple-specific code in curl since
dropping Secure Transport, and that most combination issue were in
the toolchains, not curl, there is likely more room to avoid wasting
cycles (at 41 macOS + 3 iOS jobs after this patch).

Follow-up to d057b705fd #20167

Closes #20178
2026-01-04 04:01:37 +01:00
Daniel Stenberg
b32e66a8ee
tool_progress: fix large time outputs and decimal size display
Time output:

- was broken for really large times

- now uses spaces instead of --:--:--

- >99999y is now the largest shown time

- show HH:MM:SS as long as hours are fewer than 100

Size:

- made the decimal output always only use a single decimal

Test:

- Add test 1622 to verify these functions

Closes #20177
2026-01-04 00:16:59 +01:00
Tobias Zimmermann
09374f6e75
docs: add a note about --compressed to note about binary output
Closes #20168
2026-01-04 00:10:40 +01:00
Daniel Stenberg
5ef7fa39d5
tool_getparam: use UNITTEST not, ifdef
Closes #20174
2026-01-04 00:09:12 +01:00
Viktor Szakats
b374a8f07f
servers.pm: say the protocol when http server failed to start
To serve as possibly more signal to see when/why the http server fails
to start in some random cases (on Windows).

Seen it happen in the 'mingw, CM clang-x86_64 gnutls libss' CI job:
https://github.com/curl/curl/pull/20163#issuecomment-3705572750
https://github.com/curl/curl/pull/20163#issuecomment-3707231458

Closes #20176
2026-01-03 20:39:27 +01:00
Stefan Eissing
68b94daeb8
pytest: test 16_01 stabilize
When checking the reported times of a transfer, do not exptect
the 'queue' time to be in any relation to others. 'queue' uses its own
start timestamp and the reported duration is thereofore independant.

Ref: #20112
Closes #20163
2026-01-03 13:04:21 +01:00
Viktor Szakats
d07024cf93
GHA: restore --shallow value for some torture tests
It also means that now all torture test-pairs use the same shallowness,
while earlier FTP used 20.

Also:
- This made macOS torture jobs slow enough to split them into 3 jobs.

Follow-up to 2cbcde90e7 #20153

Closes #20172
2026-01-03 01:02:41 +01:00
Stefan Eissing
a348f19bd1
pytest: test 07_22 stabilize
Do not generate a 400 response code, but use a 200 one. The upload needs
to fail on sending, not on seeing a 400 response. Seeing a 400 before
the sending fails (when CI timings shift) will expose the wrong error
code.

Ref: #20112
Closes #20164
2026-01-03 00:48:54 +01:00
Stefan Eissing
2c32ab12a0
pytest: test 07_70 stabilize (curl_ngtcp2)
We recently allowed a larger send buffer in ngtcp2 streams. This allowed
curl to send more early data then previously when the server was slow in
performing the handshake. This led to flaky test failures when the
amount of early data was larger than expected.

Change test expectations to allow for varying amount of early data.

Ref: #20112
Closes #20161
2026-01-03 00:48:54 +01:00
Stefan Eissing
ac06643f71
pytest: test 03_02 stabilize (curl_ngtcp2)
The special handling for draining server connections during a connect
attempt was only done on CURLE_RECV_ERROR. But it may also happen when
ngtcp2 errors on writing data. Check for CURLE_SEND_ERROR also.

Ref: #20112
Closes #20162
2026-01-03 00:48:54 +01:00
Daniel Stenberg
46bda31702
RELEASE-NOTES: synced 2026-01-02 23:53:33 +01:00
Daniel Stenberg
03c9215e62
altsvc: accept ma/persist per alternative entry
The 'ma' and 'persist' keywords should be considered per list entry, not
once per header.

Expand test 1654 to verify such headers

Reported-by: Hunt Darlener
Closes #20160
2026-01-02 23:50:21 +01:00
Viktor Szakats
003dddae2b
GHA/non-native: reduce workflow timeouts
Closes #20171
2026-01-02 23:43:23 +01:00
Viktor Szakats
9de7001b5e
GHA/windows: reduce workflow timeouts
From 15 to 10 minutes.

To reduce the idle wait for hung jobs from 20 to 15 minutes (hopefully),
so that the failed just can be restarted manually eariler. It appears
that GitHub Actions notices a hung job 5 minutes past the workflow
timeout (reason undiscovered).

Also: Leave extra time for torture and arm64 jobs.

Closes #20170
2026-01-02 23:43:23 +01:00
Viktor Szakats
d057b705fd
GHA: disable autotools static libcurl in many jobs
To avoid building libcurl in both static and shared flavor by default.
It results in 1.5-2.x speed-up for the curl build step in most jobs.
Saving a total of 6-7 minutes. In the Cygwin job alone it saves 1-1.5m.

Also:
- enable static + shared in a Windows job to keep testing this combo.

Follow-up to ff958fc4b2 #20159

Closes #20167
2026-01-02 22:39:28 +01:00
Viktor Szakats
7e08d56c23
GHA/linux: simplify configuring mbedTLS in two jobs
Closes #20165
2026-01-02 16:34:40 +01:00
Viktor Szakats
2cbcde90e7
GHA/linux: split valgrind jobs to job-pairs for parallelism, to finish in 10m
To make CI turnaround time shorter, by cutting the longest running jobs.
After this patch all jobs should finish around 10-11 minutes. Down from
15-16 minutes before this patch.

Suggested-by: Stefan Eissing

The fuzzing workflow is now the slowest (with a 7-minute startup time
needed to build deps from source on each run), followed by macOS
and Windows torture tests (both split in two now). Without fuzzing, it's
under 10 minutes.

Notes:
- an extra cost with job-pairs is installing prereqs,
  configuring/building curl and tests twice. GitHub doesn't support
  making a matrix job a prereq for another workflow that may fix this:
    https://github.com/orgs/community/discussions/42335
  This overhead is significant on Windows: 11m20 -> 9m20 + 8m40
- job-pairs are annoying to maintain and keep in sync.
- splitting tests into halves is a manual process and needs to be
  revisited from time to time. Possibly something to automate with
  a runtests option, e.g. with `1 of 50%` and `2 of 50%`?

Also:
- split torture tests in two equal pieces, replacing the `FTP` + `!FTP`
  split used earlier.

Related perf improvements from today:
- make scan-build 2x fast:
  ff958fc4b2 #20159
- drop build-only Testi386 fuzz workflow (from curl), saving 9m per run:
  0106023c1f
  https://github.com/curl/curl-fuzzer/pull/236

Closes #20153
2026-01-02 15:51:00 +01:00
Viktor Szakats
ff958fc4b2
GHA/linux: switch scan-build jobs to cmake (for 2x perf)
Somewhat unexpectedly, switching autotools jobs to identical (non-unity,
non-debug, same options) cmake ones, makes them complete 2x faster.
Most of it comes from cmake building shared libcurl only, while autotools
was using defaults and building both, in two separate passes. Thers is
about a minute (per job) of gain due to other reasons.

Before:
MultiSSL: 10m30: https://github.com/curl/curl/actions/runs/20656775456/job/59311070197
H3: 9m14s: https://github.com/curl/curl/actions/runs/20656775456/job/59311070204

After:
MultiSSL: 4m52s: https://github.com/curl/curl/actions/runs/20658343323/job/59315501903
H3: 4m7s: https://github.com/curl/curl/actions/runs/20658343323/job/59315501918
H3: 5m4s: https://github.com/curl/curl/actions/runs/20659294959/job/59318215987 (autotools shared only, for comparison, not merged)

Also:
- drop building examples with scan-build in the second (shorter) job.
  This offers no extra coverage over the long job that has both GnuTLS
  and OpenSSL. Saving an extra ~30s.

Closes #20159
2026-01-02 15:13:53 +01:00
Daniel Stenberg
ae1597c312
VULN-DISCLOSURE-POLICY.md: CRLF in data
we reject the idea of *CRLF injection* by the user itself as a general
security problem

Closes #20157
2026-01-02 12:19:11 +01:00
Daniel Stenberg
ce423079dc
progress: make it one column narrower
To make it fit 80 columns appropriately

Reported-by: Jay Satiro
Fixes #20122
Closes #20124
2026-01-02 11:44:33 +01:00
Daniel Stenberg
7e48a34bf8
badwords.pl: don't mention the whitelisted finds
They obscure the real finds

Closes #20158
2026-01-02 11:21:31 +01:00
Viktor Szakats
438ba94461
vtls: drop unused use_alpn from ssl_connect_data struct
Closes #20154
2026-01-02 10:45:12 +01:00
Viktor Szakats
d3bf8d391f
src: drop redundant definition of BIT()
It's defined in `lib/curl_setup_once.h` which is always included before
the duplicate definition in `src/tool_cfgable.h`. Delete the latter.

Follow-up to 06bb158737 #16211

Closes #20152
2026-01-02 10:45:12 +01:00
Viktor Szakats
74c4bdc244
ws: replace a cast by matching the format string
Closes #20151
2026-01-02 10:45:12 +01:00
Joshua Vandaële
27ffb81a58
cmake: set found status to OFF when not found (for compression deps)
This fixes curl using libraries if `CURL_{BROTLI|ZLIB|ZSTD}` is set to
`OFF` but the library was found in a parent project that includes curl.

Closes #20147
2026-01-02 01:29:47 +01:00
Viktor Szakats
8292820b73
pytest: replace allowlist with feature check to enable OCSP test 17_08
Add a `cert-status` feature flag to `curlinfo`, based on the conditions
used in `lib/vtls` sources.

To:
- fix disabling this test when using OpenSSL (or fork) built with
  the `no-ocsp` option.
- enable this test for AWS-LC in CI.

Note:
- BoringSSL (and quiche) has OSCP disabled by default.
- MultiSSL dynamic selection continues to confuse this test.
  (To fix it, support would need to be detected by querying libcurl
  via curl. Probably overkill given that OCSP is on its way out.)

Follow-up to f2c765028f #20149

Closes #20133
2026-01-02 01:23:27 +01:00
Viktor Szakats
f2c765028f
pytest: enable OCSP test 17_08 for LibreSSL
Before: 735 passed, 115 skipped
After: 738 passed, 112 skipped

Closes #20149
2026-01-01 23:46:05 +01:00