Commit graph

15930 commits

Author SHA1 Message Date
Stefan Eissing
0f7b182f2f
ngtcp2: retune window sizes
With 24b36fd stream flow control window sizes have been set too
restrictive, crippling transfer rates when no rate limit is in effect.

Disable ngtcp3 stream window auto-tuning and extend the stream window
from the small initial size to the effective rate limit. If no rate
limit is configured, extend stream window to maximum value right away.

This cannot shrink the stream window later, however. But growing the
limit or removing it, will work mid download.

Fixes #20030
Reported-by: koujaz on github
Closes #20033
2025-12-19 13:56:07 +01:00
Daniel Stenberg
3388afd2b6
http: more unfold fixing
Extended test 798 with some mini-sleeps to better trigger a problem that
was

Reported-by: Stefan Eissing

Closes #20036
2025-12-19 13:52:10 +01:00
Viktor Szakats
3233304224
socketpair: drop redundant _WIN32 branch and include
`io.h` already included via `curl_setup.h`, the other headers are
already guarded off for Windows. `INADDR_LOOPBACK` fallback remains
a no-op on Windows.

Closes #20032
2025-12-19 11:40:59 +01:00
Viktor Szakats
d11b8593a2
build: drop duplicate include curl/curl.h and others
- curl_range: replace `sendf.h` with direct header dependency
  `curl_trc.h`.
- drop `curl/curl.h` includes from internal sourcees in favor of the
  include made from `curl_setup.h`. Replace it with the latter where
  it's the only include.
- include `curl_setup.h` before using macros, where missing.
- drop redundant `stdlib.h`, `string.h` includes, in favor of
  `curl_setup_once.h` including them.
- drop redundant `limits.h` in favor of `curl_setup.h` including it.
- fake_addrinfo.h: fix typo in comment.
- curl_setup_once.h: drop `stdio.h` in favor of earlier include in
  `curl_setup.h`.
- drop stray, unused, `stddef.h` includes.
- memdebug.h: add missing `stddef.h` include. (relying on accidental
  includes via other headers before this patch.)
- stddef.h: document why it's included.
- strerr: drop `curl/mprintf.h` in favor of `curl/curl.h` including it
  via `curl_setup.h`.

Closes #20027
2025-12-19 10:58:11 +01:00
Daniel Stenberg
6c7bc9871f
http: fix for unfolding line starting with TAB
It should still insert a (single) space when unfolding

Follow-up to 9941e7c95b following up to 67ae101666.

Updated test 1274 and 1940 accordingly.

Closes #20029
2025-12-19 10:52:39 +01:00
Viktor Szakats
7db60495ad
build: drop unused includes
`curl_endian.h`, `easyif.h`, `llist.h`, `progress.h`, `slist.h`.

Also:
- multi_ev.h: delete unused include, add a missing direct one.

Closes #20025
2025-12-19 02:04:20 +01:00
Viktor Szakats
fb50214604
build: drop unused multiif.h includes
Closes #20023
2025-12-19 01:45:05 +01:00
Viktor Szakats
e59e512635
curl_trc: delete unused DoH remains
Closes #20026
2025-12-19 01:35:07 +01:00
Viktor Szakats
eb72ec4f12
build: drop unused curlx/inet_pton.h includes
Closes #20024
2025-12-19 01:34:56 +01:00
Viktor Szakats
951d778c33
build: drop unused curl_share.h includes
Closes #20022
2025-12-19 01:34:56 +01:00
Viktor Szakats
2c31dc45b4
timeval: scope a variable, merge two PP branches
Closes #20021
2025-12-18 23:31:50 +01:00
Stefan Eissing
b4be1f271e
time-keeping: keep timestamp in multi, always update
Always use curlx_now() when calling Curl_pgrs_now(data). Tests with the
"manual" updates to now proved differ more then 100ms in parallel testing.

Add `curlx_nowp()` to set current time into a struct curltime.
Add `curlx_ptimediff_ms() and friends, passing pointers.

Update documentation.

Closes #19998
2025-12-18 22:10:06 +01:00
Viktor Szakats
308c347c8b
tidy-up: miscellaneous
- apply more clang-format.
- lib/version: use `CURL_ARRAYSIZE()`.
- INSTALL-CMAKE.md: sync-up an option description with others.
- examples: delete unused main args.
- examples/ftpgetinfo: document `_CRT_SECURE_NO_WARNINGS` symbol.
- delete remaining stray duplicate lines.
- acinclude.m4: drop an unnecessary x-hack.
- vtls/mbedtls: join a URL split into two lines.
- src/tool_cb_see: add parentheses around macro expressions.
- src/tool_operate: move literals to the right side of comparisons.
- libtests: sync up fopen/fstat error messages between tests.
- curl_setup.h: replace `if ! defined __LP64` with `ifndef __LP64`.
  I assume it makes no difference on Tandem systems, as the latter form
  is already used in `include/curl/system.h`.

Closes #20018
2025-12-18 21:27:58 +01:00
Daniel Stenberg
9941e7c95b
http: when unfolding, leave single-space for new header line
Restore the unfolding behavior from before 67ae101666. This change
(leaving more whitespace in the delivered headers) turned out causing
some friction in the git project so presumably others might also find it
a little surprising.

Reported-by: Jeff King
Ref: https://marc.info/?l=git&m=176606332701171&w=2
Closes #20016
2025-12-18 17:41:46 +01:00
Viktor Szakats
d7bde803ee
cmake: add curl-optiontable, curl-listhelp, curl-listcats targets
To match autotools `optiontable`, `listhelp`, `listcats` targets.

Closes #20014
2025-12-18 12:22:35 +01:00
Daniel Stenberg
cd046f6c93
openssl: toggling CURLSSLOPT_NO_PARTIALCHAIN makes a different CA cache
Reported-by: Stanislav Fort

Closes #20009
2025-12-17 15:29:37 +01:00
Stefan Eissing
be3c226bb0
wolfssl: proof use of wolfSSL_i2d_SSL_SESSION
While wolfSSL_i2d_SSL_SESSION() does not change the passed pointer, like
OpenSSL does, it may one day decide to do so. Pass a copy instead to be
future-proof to such a change in wolfSSL's implementation.

Closes #20008
2025-12-17 13:52:59 +01:00
Daniel Stenberg
de8470c6e5
multi: remove useless assignment
Pointed out by CodeSonar

Closes #20006
2025-12-17 08:57:44 +01:00
Daniel Stenberg
0a26e3a660
lib: name the main CURLMcode variable 'mresult'
To make it distinctly different from 'result' and keep consistency
betwen functions.

Closes #19997
2025-12-17 08:55:07 +01:00
Viktor Szakats
61273f5812
badwords: catch and fix threading-related words
Also:
- sync newlines between the two threaded examples.

Closes #20001
2025-12-16 21:26:58 +01:00
Viktor Szakats
8dadff9434
schannel: use Win8 CERT_NAME_SEARCH_ALL_NAMES_FLAG with old SDKs
Define `CERT_NAME_SEARCH_ALL_NAMES_FLAG` macro if missing.
To allow using a runtime branch regardless of build-time SDK version,
when running on Windows 8+.

In practice it enables this branch for builds using mingw-w64 v3, and
MSVC with Windows SDK <8.

Also reducing build variations.

Follow-up to 29e40a6d8a #4761 #3711
Follow-up to 8996300211 #1325
Follow-up to 172b2beba6 #264 (comment)

Closes #20000
2025-12-16 20:41:11 +01:00
Dan Fandrich
5196abad73 lib: create unitprotos.h in the builddir, not srcdir
The make rule confused automake by changing directories before creating
the file, causing unitprotos.h to be created in the srcdir instead of
the builddir. This results in a stale file and confusing compile errors
in out-of-tree builds.

Fixes #19966
Closes #19993
2025-12-16 09:51:06 -08:00
Viktor Szakats
627e32fa12
cf-socket: enable Win10 TCP_KEEP* options with old SDKs
Define `TCP_KEEP*` macros if they are missing in Windows builds.
To allow using these runtime `setsockopt()` options regardless of
build-time SDK version, when running on Windows 10.0.16299+.

In practice in enables them for builds using mingw-w64 <12, and
MSVC with Windows SDK <10.

Before this patch these runtime options required building curl with
a recent toolchain.

Follow-up to f0de14168a #19559

Closes #19999
2025-12-16 17:22:50 +01:00
Viktor Szakats
be76b32aed
idn: clarify null-termination on Windows
Add comments to clarify that a terminating null is always present in
the buffers returned to the caller.

The curl APIs `win32_idn_to_ascii()` or `win32_ascii_to_idn()` receive
a null-terminated UTF-8 string as input. They first convert it to wide
chars by first asking `MultiByteToWideChar()` to calculate the length,
by passing -1. This API returns the length with the null char included
(= `strlen() + 1`), does the conversion, with the output also
null-terminated. `IdnTo*()` preserve this null character as documented.
Then we pass this null-terminated, fixed-length buffer ito
`WideCharToMultiByte()`, which keeps preserving the null, ending up in
the buffer returned to the caller.

Refs:
https://learn.microsoft.com/windows/win32/api/stringapiset/nf-stringapiset-multibytetowidechar
https://learn.microsoft.com/windows/win32/api/stringapiset/nf-stringapiset-widechartomultibyte
https://learn.microsoft.com/windows/win32/api/winnls/nf-winnls-idntoascii
https://learn.microsoft.com/windows/win32/api/winnls/nf-winnls-idntounicode

WINE source code:
https://gitlab.winehq.org/wine/wine/-/blob/wine-10.20/dlls/kernelbase/locale.c
https://gitlab.winehq.org/wine/wine/-/blob/wine-10.20/dlls/ntdll/locale.c
https://gitlab.winehq.org/wine/wine/-/blob/wine-10.20/dlls/ntdll/locale_private.h

Ref: https://github.com/curl/curl/pull/19976#issuecomment-3656005765
Follow-up to 6694a42aa0 #19798

Closes #19980
2025-12-16 16:30:43 +01:00
Viktor Szakats
32454b954a
localtime: detect thread-safe alternatives and use them
- add local API `toolx_localtime()` to wrap the banned function
  `localtime()`. Used from libcurl, libtests and test servers.
- auto-detect and use `localtime_r()` where available (e.g. Linux).
  Also to support multi-threading.
- use `localtime_s()` on Windows. It requires MSVC or mingw-w64 v4+.
  Also to support multi-threading.
  Use local workaround to also support mingw-w64 v3.
- add `src/toolx` to keep internal APIs used by the curl tool and tests,
  but not by libcurl. `toolx_localtime()` is the first API in it.
- replace `localtime()` calls with `toolx_localtime()`.
  Except in examples.
- note Windows XP's default `msvcrt.dll` doesn't offer secure CRT APIs.
  XP likely needs a newer version of this DLL, or may not run.
- note that `localtime()` mirrors `gmtime()`, with the difference that
  `gmtime()`'s internal wrapper lives in curlx.

Also:
- drop redundant `int` casts.

Refs:
https://learn.microsoft.com/cpp/c-runtime-library/reference/localtime-localtime32-localtime64
https://learn.microsoft.com/cpp/c-runtime-library/reference/localtime-s-localtime32-s-localtime64-s
https://pubs.opengroup.org/onlinepubs/9799919799/functions/localtime.html
https://linux.die.net/man/3/localtime_r

Ref: #19955 (for `gmtime_r()`)
Follow-up to 54d9f060b4
Closes #19957
2025-12-16 14:30:06 +01:00
Viktor Szakats
c6988f9131
curlx: move Curl_gmtime(), use gmtime_s() on Windows
Move `Curl_gmtime()` to curlx and rename to `curlx_gmtime()`. Then call
the internal wrapper also from the curl tool, to avoid using the banned
`gmtime()` directly, and using better, thread-safe alternatives when
available.

Windows `gmtime_s()` requires mingw-w64 v4+ or MSVC. Use local
workaround to also support mingw-w64 v3. `gmtime_s()` also makes
defining `_CRT_SECURE_NO_WARNINGS` unnecessary.

Also:
- lib: drop unused `parsedate.h` includes.
- drop redundant cast from `gmtime_r()` result.
- autotools: reverse condition in the proto detection to avoid
  misleading readers. (the condition plays no role in detection.)
- note Windows XP's default `msvcrt.dll` doesn't offer secure CRT APIs.
  XP likely needs a newer version of this DLL, or may not run.

Refs:
https://learn.microsoft.com/cpp/c-runtime-library/reference/gmtime-gmtime32-gmtime64
https://learn.microsoft.com/cpp/c-runtime-library/reference/gmtime-s-gmtime32-s-gmtime64-s
https://pubs.opengroup.org/onlinepubs/9799919799/functions/gmtime.html
https://linux.die.net/man/3/gmtime_r

Ref: #19957 (for `localtime_r()`)
Follow-up to 54d9f060b4
Closes #19955
2025-12-16 14:30:05 +01:00
Viktor Szakats
5431b3dd6b
build: unix socket tidy-ups
- lib: delete two unused `<sys/un.h>` includes.

- lib: drop interim macro `WIN32_SOCKADDR_UN`.
  Follow-up to 0fe9018e1a #7737
  Also fixing a potential issue of leaving unix socket support disabled
  if any header would include Windows' `afunix.h`, and define
  `UNIX_PATH_MAX` on its own.

- connect: honor unix socket disable option.

- connect: simplify unix socket PP condition.
  `USE_UNIX_SOCKETS` already means the necessary header/type are
  available, guaranteed by configure. `AF_UNIX` is already used
  elsewhere in the code without explicit checks.

- curl_setup.h: document availability of `afunix.h` on Windows more.
  It requires mingw-w64 10+ or MS SDK 10.17763.0 VS2017 15.8+.

- curl_setup.h: use `afunix.h` with mingw-w64 v10+ to start avoiding
  the local workaround if possible.

- GHA/windows: test disable unix socket option on Windows.

Ref: https://devblogs.microsoft.com/commandline/af_unix-comes-to-windows/

Closes #19989
2025-12-16 13:41:25 +01:00
Daniel Stenberg
222fce0a50
cookie. return proper error on OOM
Follow-up to a78a07d3a9

Closes #19992
2025-12-16 09:45:41 +01:00
Stefan Eissing
2de22a00c7
lib: keep timestamp in easy handle
Use `data->progress.now` as the timestamp of proecssing a transfer.
Update it on significant events and refrain from calling `curlx_now()`
in many places.

The problem this addresses is
a) calling curlx_now() has costs, depending on platform. Calling it
   every time results in 25% increase `./runtest` duration on macOS.
b) we used to pass a `struct curltime *` around to save on calls, but
   when some method directly use `curx_now()` and some use the passed
   pointer, the transfer experienes non-linear time. This results in
   timeline checks to report events in the wrong order.

By keeping a timestamp in the easy handle and updating it there, no
longer invoking `curlx_now()` in the "lower" methods, the transfer
can observer a steady clock progression.

Add documentation in docs/internals/TIME-KEEPING.md

Reported-by: Viktor Szakats
Fixes #19935
Closes #19961
2025-12-16 08:48:44 +01:00
Daniel Stenberg
425a2aa1af
curl_sasl: username cleanups
Remove 'user' from the sasl_ctx struct and instead refer to conn->user.

conn->user is always non-NULL, so remove the checks for that.

Closes #19981
2025-12-16 08:19:35 +01:00
Viktor Szakats
c36416eb29
getenv: drop internal 1-to-1 wrapper
Closes #19984
2025-12-16 00:21:38 +01:00
Stefan Eissing
6a3d0b6d63
vquic: ignore 0-length UDP packets
When someone gives us 0-length UDP packets, ignore
them as they cannot be valid QUIC packets. This also
prevents us from messing up any GSO calculations.

Reported-by: Stanislav Fort
Closes #19978
2025-12-15 14:20:38 +01:00
Gabriel Marin
15de32f09d easy: fix debug ev poll builds
Prior to this change the wrong variable name was used for one of the
debug messages.

Closes https://github.com/curl/curl/pull/19963
2025-12-14 19:03:54 -05:00
Daniel Stenberg
1c8c34c88e
schannel: cap the maximum allowed size for loading cert
To avoid problems with mistakes or abuse, cap the largest allowed
certificate size to load to CURL_MAX_INPUT_LENGTH bytes (8MB).

Closes #19964
2025-12-14 00:47:33 +01:00
Daniel Stenberg
67ae101666
http: unfold response headers earlier
Make the low-level HTTP header "builder" unfold headers so that
everything else can keep pretending folding does not exist.

This code no longer tries to reduce repeated leading whitespace (in the
continued folded header) to a single one. To avoid having to have a
special state for that.

Adjusted two test cases accordingly

Closes #19949
2025-12-13 23:02:18 +01:00
Viktor Szakats
fe8393d7db
tidy-up: miscellaneous
- drop stray duplicate empty lines in docs, scripts, test data, include,
  examples, tests.
- drop duplicate PP parenthesis.
- curl-functions.m4: move literals to the right side in if expressions,
  to match rest of the source code.
- FAQ.md: delete language designator from an URL.
- packages: apply clang-format (OS400, VMS).
- scripts/schemetable.c: apply clang-format.
- data320: delete duplicate empty line that doesn't change the outcome.
- spacecheck: extend to check for duplicate empty lines
  (with exceptions.)
- fix whitespace nits

Closes #19936
2025-12-12 04:18:48 +01:00
Christian Schmitz
624d98e79c
transfer: remove @param for err for xfer_recv_resp function.
The err parameter in xfer_recv_resp doesn't exist anymore. Removed in
cb2bcb681f.

Closes #19937
2025-12-11 15:32:16 +01:00
Daniel Stenberg
1a822275d3
curl_sasl: if redirected, require permission to use bearer
Closes #19933
2025-12-11 09:42:49 +01:00
Viktor Szakats
edbbcbb127
config-win32.h: drop unused/obsolete CURL_HAS_OPENLDAP_LDAPSDK
Meant for use from `Makefile.mk`. The suggested replacement is CMake or
autotools.

Follow-up to ba8752e556 #12224

Closes #19920
2025-12-10 16:02:56 +01:00
Viktor Szakats
0295c9401d
ldap: drop PP logic for old, unsupported, Windows SDKs
`LDAP_VENDOR_NAME` and `winber.h` are available in all supported
MS SDK and mingw-w64 versions. Stop checking for them.

Also drop redundant parenthesis in PP expression.

Closes #19918
2025-12-10 16:02:55 +01:00
Viktor Szakats
d9d2e339ce
tidy-up: URLs (cont.) and mdlinkcheck
- add missing ending slashes.
  To avoid duplicates and to use canonical URLs.
- reapply lost updates.
  Follow-up to 2ae983bf4e #19879
- mdlinkcheck: include the `include` directory.
- mdlinkcheck: show unused whitelist items.
- mdlinkcheck: improve debug output.
- mdlinkcheck: delete redundant whitelist items.
- examples/simplessl: lowercase the protocol part.
- BINDINGS: replace one remaining HTTP URL with HTTPS.
  Issue: https://github.com/pycurl/pycurl/issues/892
- BINDINGS: fix a broken link.
- BINDINGS: follow a refresh content redirect.
- KNOWN_BUGS: whitespace.

Closes #19911
2025-12-10 01:21:07 +01:00
Stefan Eissing
00f06127ce
memdebug: fix realloc logging
Do the whole realloc and the subsequent logging under mutex lock. This
fixed log entries that state allocation a memory location before realloc
logs it as being freed.

Closes #19900
2025-12-10 00:24:42 +01:00
Viktor Szakats
163705db75
windows: assume USE_WIN32_LARGE_FILES
All Windows platforms support it. It was permanently enabled with most
build methods. The exception is autotools where it is enabled by
default, with an option to disable it. It changed the build in a few
places for rarely tested code paths, but not bringing other advantages
(and used some 64-bit APIs anyway). This patch makes autotools'
`--disable-largefile` option a no-op for Windows.

Closes #19888
2025-12-09 19:34:13 +01:00
Viktor Szakats
197904d4b1
config-win32.h: delete obsolete, non-Windows comments
Closes #19899
2025-12-09 16:23:58 +01:00
Stefan Eissing
9711c986ba
multi: remove MSTATE_TUNNELING
MSTATE_TUNNELING is no longer in use now that we have proxy connection
filters. Remove the state.

Remove the http handler `connect_it` method as it was merely a NOP.

Closes #19894
2025-12-09 16:01:51 +01:00
Stefan Eissing
5ed7b5b01b
alt-svc: more flexibility on same destination
When the Alt-Svc points to the same host and port, add the destination
ALPN to the `wanted` versions and set it also as the `preferred` version
in negotiations.

This allows Alt-Svc for h3 to point to h2 and have it tried first. Also,
this allows Alt-Svc to say http/1.1 is preferred and changes the ALPN
protocol ordering for the TLS handshake.

Add tests in various combination to verify this works.

Reported-by: yushicheng7788 on github
Fixes #19740
Closes #19874
2025-12-09 15:59:09 +01:00
Yedaya Katsman
8e847fa536
gtls: Call keylog_close in cleanup 2025-12-09 14:14:50 +01:00
Daniel Stenberg
43c781a116
imap: check buffer length before accessing it
Pointed out by ZeroPath

Closes #19887
2025-12-09 10:50:29 +01:00
Daniel Stenberg
4c3614304f
headers: add length argument to Curl_headers_push()
- the length is already known by parent functions
- avoids strlen() calls
- avoids strchr() calls for trimming off newline characters

Closes #19886
2025-12-09 10:49:28 +01:00
Viktor Szakats
86f5bd3c6e
curl_setup.h: fix FMT_SOCKET_T to be unsigned on Windows
To match the Windows socket type.

Ref: https://learn.microsoft.com/windows/win32/winsock/socket-data-type-2

Cherry-picked from #18343
Closes #19881
2025-12-09 09:20:10 +01:00