Commit graph

39122 commits

Author SHA1 Message Date
Viktor Szakats
6d008352c6
cmake: replace deprecated remove command with rm and pass arg safely
All curl-supported CMake versions support the modern method, along with
the `--` marker.

Also:
- make sure to pass `-f` to not fail if the file is missing, as before
  this patch.
- drop now redundant `OUTPUT_QUIET`, `ERROR_QUIET` and error handling
  in `cmake_uninstall`.
- move filename to end of the error message for readability.
- GHA/linux: test these two 'clean' targets in the aws-lc job.

Refs:
https://cmake.org/cmake/help/v4.4/manual/cmake.1.html#cmdoption-cmake-E-arg-remove
https://cmake.org/cmake/help/v3.18/manual/cmake.1.html#run-a-command-line-tool

Closes #22193
2026-06-26 19:01:30 +02:00
Viktor Szakats
a7e8016fa2
cmake: flatten build tree, tidy up base dir variables
- drop `generated` subdir, move these files to build root.
  To move them next to CPack and other config files, and to avoid
  a subdirectory for only 2 files.
  Follow-up to 69328490fc #2849

- add 'Consumed variables' comment for `CMake/cmake_uninstall.in.cmake`.

- move generated `cmake_uninstall.cmake` to the build root directory
  (from `CMake/`). To:
  - avoid creating a `CMake` subdirectory within the build directory
    with this single file in it.
  - move it next to its `cmake_install.cmake` counterpart.
  - move it next to `install_manifest.txt` which it relies on.

  Follow-up to 27e2a4733c

- Use `PROJECT_SOURCE_DIR` for these files, replacing
  `CMAKE_CURRENT_SOURCE_DIR`, to make it consistent with rest of CMake
  sources, and to reduce ambiguity in `CMake/cmake_uninstall.in.cmake`
  template.

Follow-up to 8198e388d3 #22188
Follow-up to 4839029645 #22187
Follow-up to 9126eb5a8a #15331

Closes #22192
2026-06-26 18:39:09 +02:00
Viktor Szakats
8be2daae0f
GHA/windows: set VCPKG_APPLOCAL_DEPS=OFF for vcpkg jobs
Add the necessary directory to `PATH` instead.

To disable a vcpkg feature (auto-copying DLL dependencies next to the
build targets) that was causing CI flakiness in the libssh2 repository.
In curl it currently cannot cause flakiness because targets (with DLL
dependencies) reside in separate directories.

AFAIU this vcpkg feature has been present and enabled by default for
a long time, but only a recent update made it visible in the log and
flaky at the same time, due to switching implementation.

This patch removes log noise and potential issues, improves efficiency,
and saves disk space: 74MB -> 71 in UWP, and 69MB -> 65 in the arm64 job.
Time saving is negligible with current jobs.

Refs:
https://github.com/libssh2/libssh2/pull/2114
30a0484cb7
https://github.com/microsoft/vcpkg/pull/52315
https://learn.microsoft.com/vcpkg/reference/installation-tree-layout

Closes #22189
2026-06-26 15:45:24 +02:00
Viktor Szakats
8198e388d3
cmake: tidy-up base directory variable for include/*/CMake/* files
Use `PROJECT_SOURCE_DIR` for these files, replacing
`CMAKE_CURRENT_SOURCE_DIR`, to make it consistent with rest of CMake
sources and to reflect that the locations of these files are fixed and
do not depend on the CMake source location referencing them.

Exception: keep as-is before calling `project()`, which is where
`PROJECT_SOURCE_DIR` is initialized.

Ref: https://cmake.org/cmake/help/v3.18/command/project.html

Follow-up to #22187
Follow-up to 9126eb5a8a #15331

Closes #22188
2026-06-26 15:45:24 +02:00
Viktor Szakats
4839029645
cmake: robustify base path in local file reference
To make the macro find this file also when used elsewhere than the root
`CMakeLists.txt`. Current code only uses it from the root.

Follow-up to 88c17d5587

Closes #22187
2026-06-26 15:45:24 +02:00
Viktor Szakats
84c5dcdb05
tidy-up: syntax and code nits
- cmp-pkg-config.sh: replace `-r -f` with `-rf` to match rest of repo.
- configure.ac: add double quotes for robustness (not a bug).
- curl-openssl.m4: merge nested `if`s.
- CurlTests.c: drop `!= 0`, also to sync with m4.
- CurlTests.c: replace `example.com` with `localhost` in
  `gethostbyname()` feature test code. (compile-only, not a bug)
- GHA/http3-linux: drop literal `true` from bool expression.
- lib650: drop redundant `&`.
- move variable/call to left-hand side of equality checks, where
  missing.
- perl: detach `<`/`>` from filename in `open()`, where missing.
- schannel: apply two nit fixes lost in rebase.
- scripts/verify-release: drop redundant double quotes.
- scripts/verify-release: exit with error code on error.
- synctime: replace magic numbers with `sizeof()`.
- telnet: add missing parentheses to macro value.
- tests/Makefile.am: use single quotes.
- tool_operate: drop redundant `break` after `return` in VMS code.
- unit2413: drop unused NULL pointer + free call.
- unit2413: fix duplicate test case name.
- urlapi: drop redundant parentheses.
- urlapi: drop `CURL_UNCONST()` that became redundant.

Closes #22186
2026-06-26 15:45:24 +02:00
Alhuda Khan
a36384ab94
http: trim custom header name before the Authorization drop
A custom header name padded with blanks (`Authorization :`) missed the
exact-length compare and slipped past the cross-host Authorization and
Cookie drop, forwarding the header to the redirect target. Trim the
parsed name in both the request and proxy CONNECT header builders.

Closes #22178
2026-06-26 14:50:04 +02:00
Stefan Eissing
18475e662c
urlpieces: remove members that live in peers/creds
Remove members of `struct urlpieces` that now live in peers/creds.

Change all remaining uses of those urlpieces.

When comparing schemes, use the protocol constants.

Closes #22171
2026-06-26 14:39:40 +02:00
Stefan Eissing
cfc7922377
altsvc: use Curl_peer in processing
Use `data->state.origin` when processing alt-avc information.

Decomplexify parsing function.

Closes #22184
2026-06-26 14:12:53 +02:00
Stefan Eissing
2f1e94eaed
conncache: connection alive checks intervals
Do not check if a particular connection is alive or not more than once
every second. We did this on every connection reuse which is overkill
when sending many requests to the same host.

Closes #22169
2026-06-26 13:52:26 +02:00
Stefan Eissing
00d5562650
proxy: optimized env lookups
Optimize proxy env var lookups for the commen case of 'https' and 'http'
urls. We do this for every transfer.

Closes #22168
2026-06-26 13:50:20 +02:00
Daniel Stenberg
a6af50c484
multi: forbid curl_easy_pause from within multi socket callback
- there is a risk for a nasty recursive situation

- we avoid certain risks that the pause call changes things so that when
  returning from the callback, the state of some internals is undefined
  and we need to reload which is easy to miss

- we can't think of legitiate use cases for doing this. This is
  basically just the new favorite point for AI and security researchers
  to find hypothetical problems

Closes #22179
2026-06-26 13:43:48 +02:00
Daniel Stenberg
d8f9f0a912
tool_operate: remove call to abort()
Make an assert and return a plain error instead. No abort in release
code.

- also remove from two examples
- add as a banned function in checksrc
- document the banned state

Closes #22182
2026-06-26 13:41:55 +02:00
Viktor Szakats
397b8f0ec6
tidy-up: docs, comments, typos, whitespace
- GHA/windows: mention `IgnoreStandardErrorWarningFormat=true`
  in comment.
- cmake: fix MIT/GNU GSS order in messages.
- drop some exclamation marks from messages.
- drop redundant ending newlines from messages.
- fold/unfold where possible.
- fix indent, whitespace, typos and other nits.

Closes #22185
2026-06-26 11:36:09 +02:00
Viktor Szakats
15bd6c5d4c
cmake: document upstream variable ZLIB_ROOT
Closes #22177
2026-06-26 10:17:00 +02:00
Viktor Szakats
231445df2a
cmake: drop logic for GNU/kFreeBSD systems
Adopting change made in CMake, with description: "kFreeBSD is no longer
maintained or supported and was never an officially-supported release
architecture for Debian."

This system name was also dropped by CMake 4.1+:
https://cmake.org/cmake/help/v4.2/variable/CMAKE_SYSTEM_NAME.html

Credits-to: Roger Leigh
Ref: 99c8abed55
Ref: https://gitlab.kitware.com/cmake/cmake/-/work_items/26742
Ref: https://gitlab.kitware.com/cmake/cmake/-/work_items/26722

Follow-up to 5de6848f10 #10023 #5935

Closes #22176
2026-06-26 10:17:00 +02:00
Daniel Stenberg
fdbc5beed3
urlapi: make two #defines instead of magic values/strings in code
Closes #22181
2026-06-26 09:57:21 +02:00
Daniel Stenberg
cff59ddf4a
docs/INSTALL: minor polish
Closes #22183
2026-06-26 09:56:20 +02:00
Viktor Szakats
2c1e625a6f
INSTALL.md: add building-from-source overview section
Ref: #22098

Closes #22113
2026-06-25 17:43:36 +02:00
Viktor Szakats
27370e9fc7
GHA: bump some jobs to ubuntu-26.04
In jobs that may benefit from newer tool versions (pyspelling, possibly
CodeQL, CM integration, configure-vs-cmake). Also curl-for-win to match
the curl/curl-for-win repo that also bumped. Bump some Linux jobs to add
variation. Also the rest of `check*` jobs for no particular reason other
than using the latest.

Follow-up to 8f5e4f020e #22097
Follow-up to 139ce4d37c #22096
Follow-up to e44f1a1446 #22094

Closes #22092
2026-06-25 17:10:56 +02:00
Stefan Eissing
26c6a4d898
urlapi: do not keep an internal port string
Do not allocated an internal port string, just keep and number and a bit
if it is present. Format the port string in a local buffer when someone
asks for it and copy that.

This avoid the format/alloc penalty when parsing URLs and no one ever
asking for the port string.

(And there will be a method to get the uint16_t value directly in
 another PR)

Closes #22167
2026-06-25 14:07:40 +02:00
Viktor Szakats
d2fe26cfe2
runtests: exit with error on -k option
Ref: https://github.com/curl/curl/pull/22157#discussion_r3473254887
Follow-up to 481e10160f #22157
2026-06-25 11:35:06 +02:00
Viktor Szakats
481e10160f
runtests: restore -k option and actively process as no-op
Restore processing this option to avoid falling it through and
misinterpreted as something else, which in turn disables tests.

Exit with an error instead. We delete completely in December 2026.

Reported-by: Sam James
Bug: https://github.com/curl/curl/pull/22100#issuecomment-4789828929
Follow-up to 04305a3e40 #22100
Follow-up to 6617db6a7e #4035

Closes #22157
2026-06-25 11:32:36 +02:00
Viktor Szakats
2f4d3221aa
autotools: minor fixes and improvements
- Makefile.am: add root `test-quiet` target that maps to
  `tests/quiet-test`, for completeness.
  Ref: #22098

- tests/Makefile.am: drop unused remains of `MANFILES`.
  Follow-up to fa3f889752 #17463
  Also replace the `distclean` target to delete `CLEANFILES`, otherwise
  the CI dist job fails. (I'm not grokking why)

- tests/Makefile.am: sync up `tests` target with CMake, to pass `TFLAGS`
  `-a`.
  Follow-up to 904e7ecb66 #19347

- tests/certs/Makefile.am: fix to clean generated certs via `CLEANFILES`
  to comply with autotools documentation, which says the previously used
  variable `DISTCLEANFILES` is meant for files created by `./configure`.
  Ref: https://www.gnu.org/software/automake/manual/html_node/Clean.html
  Follow-up to 44341e736a #16824

- tests/http/Makefile.am: add `./` prefix to glob passed to `rm -rf` on
  clean, to avoid deleting unintented files, or pass unintended options.
  Follow-up to 671158242d #10349

Cherry-picked from #22102
Cherry-picked from #22150

Closes #22154
2026-06-25 11:32:36 +02:00
Viktor Szakats
ccf19d59e7
scripts: use end-of-options marker in cd, mkdir, mv, sha256sum commands
Where missing. To avoid passing an option by accident.

End-of-option marker (`--`) is not POSIX, but most of these scripts are
internal and/or CI-focused, where this is fine. `maketgz` and
`verify-release` are meant for public use, and I asses this is fine too,
but let us know if this causes issues in real world envs.

Also:
- maketgz: pass args with `:?` to `rm -rf`, where missing.
  Cannot cause an actual issue with current code.
- verified `cp`, `rm` instances too, but none were affected.
- tests/cmake/test.sh: replace `$PWD` with `$(pwd)` for sturdiness.
- appveyor.sh: replace `$PWD` with `$(pwd)` for sturdiness.

Assisted-by: Dan Fandrich
Follow-up to 6aab1dc263 #19450

Closes #22150
2026-06-25 11:32:36 +02:00
Viktor Szakats
fbcce4da85
build: enable thread-safe getaddrinfo() for OpenBSD, and other tidy-ups
Aka `HAVE_GETADDRINFO_THREADSAFE`.

- enable it for OpenBSD 5.4+ (2013-11-01).
  Also adjust cmake pre-fill.

- explicitly opt-in DragonFly BSD, for 2.2.0+ (2009-02-17).
  Assuming this commit implemented this feature:
  21fcee4d6e (diff-498ff649e8770eb9a94e99a399a4b473fcea41ef58b033a2a2dae3809e17bb04)
  Prior to this patch it was enabled in autotools by accident, because
  its host ID misses `bsd` so the global BSD disable was not applied.

- autotools: fix to enable for Darwin 9+ / macOS 10.5+ (2007-10-26).
  Prior to this patch it was Darwin 6 / macOS 10.2.
  Source: https://github.com/python/cpython/issues/70112
  Ref: https://en.wikipedia.org/wiki/MacOS_version_history
  10.5 was the first one UNIX '03 certified, which requires this
  feature. iOS and others were forked from this codebase, so they also
  have support.

- cmake: add version numbers as comments.
  Sadly the OS versions are not verified. This and the autotools logic
  could possibly be implemented in `curl-setup.h` more accurately, for
  all build systems, without duplicating logic.

Also:
- cmake: `BSD` variable requires CMake 3.25+, add fallback code where
  missing.
  Ref: https://cmake.org/cmake/help/v3.25/variable/BSD.html
- unix-cache.cmake: stop listing all BSDs for `HAVE_PIPE2`,
  and fix generic BSD filter for CMake <3.25.
- unix-cache.cmake: stop listing all BSDs, since it's prefilled anyway
  for those via `OtherTests.cmake`.

Ref: https://github.com/curl/curl/pull/22138#issuecomment-4773617195

Closes #22148
2026-06-25 11:32:36 +02:00
Viktor Szakats
62e095cee0
ssh: dedupe ssh_pollset() functions
Closes #22115
2026-06-25 11:32:36 +02:00
Stefan Eissing
44ed43efe7
tool: optimize setopt use
- tool_setopt_long: lookup default value on for --libcurl where it is
  used
- tool_setoot_str: use `const char *` arg instead of var args.

Closes #22166
2026-06-25 11:11:41 +02:00
Stefan Eissing
7b3316984f
tool: do not flush on out-null
Do not flush output when --out-null is set.

Closes #22165
2026-06-25 11:10:09 +02:00
Stefan Eissing
46e19c8744
tool: init progress bar on demand
Determine the terminal size on first invocation, not for all
transfers.

Closes #22164
2026-06-25 11:09:19 +02:00
Daniel Stenberg
c6c4c6a16d
test 1560: test RFC4291 style IPv6 IPv4-mapped addresses
Closes #22136
2026-06-25 11:03:18 +02:00
Daniel Stenberg
bf5cc6ab8b
curl-functions.m4: verify working RFC 4291 zero prefixed IPv4 - mapped format
Detect incompatible inet_ntop() call for IPv6 output.

Closes #22136
2026-06-25 11:02:50 +02:00
Stefan Eissing
e9a2b0dc72
multi_ev: refresh sock entry after remove callback
This was missed in the fix for CVE-2026-9080.

Reported-by: stze on hackerone
URL: https://hackerone.com/reports/3823985
Closes #22163
2026-06-25 10:43:41 +02:00
alhudz
f746780a1e
mqtt: reject control bytes in the topic
Closes #22112
2026-06-25 09:35:01 +02:00
Daniel Stenberg
c10a7aa259
RELEASE-NOTES: synced
and bump curlver.h
2026-06-25 08:42:02 +02:00
Samuel Dainard
5232c16208
sws: allow connection-monitor to log all disconnects
Remove the suppression of connmon after the first disconnect event. The
connmon flag is set per-test via the 'connection-monitor' server command
and should remain active for the lifetime of that test's connections to
properly detect connection reuse failures.

The suppression was introduced in 510fdad to work around a connection
reuse regression that has since been resolved by the credentials
refactoring in 8f71d0f. With the underlying issue fixed, restoring full
disconnect logging strengthens tests like 338 to catch future
regressions in connection reuse logic.

Fixes #22158
Closes #22159
2026-06-25 08:37:19 +02:00
Jay Satiro
4ce309d968 ldap: support insecure mode for Windows native LDAP
- Bypass cert verification if verifypeer is disabled.

Prior to this change libcurl lacked the ability to bypass certificate
verification for Windows native LDAP (USE_WIN32_LDAP). A comment said
"Win32 LDAP SDK does not support insecure mode without CA!" but I found
that we can bypass the check by setting a verify callback to override
Windows' internal verify check.

Closes https://github.com/curl/curl/pull/22152
2026-06-24 14:36:16 -04:00
renovate[bot]
a1af38be09
GHA: update debian:bookworm-slim Docker digest to 60eac75
Closes #22151
2026-06-24 11:42:21 +02:00
Viktor Szakats
93235c1b52
GHA/linux: drop unused pip packages from Alpine job
py3-impacket, py3-asn1, py3-six and py3-pycryptodomex.

Number of tests run remain 1848 / 1847 for the two jobs respectively.
Number of installed packages go from 158 to 117, and from 177 to 142
(for the two jobs respectively; using different Alpine versions).

Closes #22153
2026-06-24 11:38:59 +02:00
Daniel Stenberg
68720b4837
RELEASE-NOTES: synced 2026-06-24 07:52:50 +02:00
Daniel Stenberg
9187ef7ec8
VERSIONS: 8.21.0 release 2026-06-24 07:52:50 +02:00
Daniel Stenberg
ec37b024d8
THANKS: added names from 8.21.0 release 2026-06-24 07:52:50 +02:00
Viktor Szakats
bf29c3e175
GHA/non-native: BSD overhaul, test more autotools, bump versions
- add autotools jobs for MidnightBSD, NetBSD, OpenBSD.
  Takes under 3 minutes per new job, under +6m in total.
  - comment out MidnightBSD to save CI time.
  - to make them as fast as possible, skip building tests and examples,
    and omit libidn2, openldap dependencies.
- add DragonFly BSD cmake job, which finally works.
  (keep it commented out since the package server fails frequently.)
- do `mport index/upgrade` to make MidnightBSD autotools builds work.
- rework filtering MidnightBSD package manager's excessive log output.
- fixup OpenBSD autotools job to uninstall system curl to avoid linking
  against it (and breaking debug builds).
- make OpenBSD package manager commands non-interactive.
- specify install packages for each matrix entry.
- make autotools build step verbose (to ease debugging).
- add link to DragonFly BSD package repo.
- bump cross-platform-actions from 1.1.0 to 1.3.0.
- bump FreeBSD 15.0 to 15.1.
- bump OpenBSD to 7.7 to 7.9.
  This did not go well last time with 7.8, let's see with 7.9.
  Ref: 8d00e28136 #19372
  Ref: c3b890b2c0 #19368
- sync test-skipper keywords with rest of workflows.
- drop installing impacket. It was unused.
  (also a slow install with many dependencies)

The original motivation was to prepare fixing OpenBSD's (and possibly
other platforms) `getaddrinfo()` thread-safety check.
Ref: https://github.com/curl/curl/pull/22138#issuecomment-4773617195

Closes #22145
2026-06-23 18:09:49 +02:00
Daniel Stenberg
9adc32a6e2
test 679: add a quoted string name in a netrc test
By using quotes a user name can have a space in netrc

Closes #22147
2026-06-23 17:23:11 +02:00
Viktor Szakats
78267398e5
GHA/linux: bump pizlonator/fil-c to v0.680, fixup quoting
Also put the version number in quotes to avoid GHA altering the number
into `0.68` (without rightmost zero) and ending up storing that in the
`FIL_C_VERSION` env.

Hopefully Renovate will honor this on future bumps.

Do the same for the rest of `x.y` format version numbers.

Fixing:
```
env:
[...]
    FIL_C_VERSION: 0.68
```
Ref: https://github.com/curl/curl/actions/runs/28006009260/job/82920767558?pr=22142#step:5:16

Fixes #22142

Closes #22143
2026-06-23 11:45:08 +02:00
Daniel Stenberg
7e37510c93
RELEASE-PROCEDURE.md: typo 2026-06-23 10:06:14 +02:00
Viktor Szakats
621176cbd5
GHA/windows: settle on windows-2025 image name
It's the final/stable image name and it's shipping with VS2026 now.

Ref: https://github.com/actions/runner-images/issues/14017
Follow-up to b0239417b3 #21713

Closes #22139
2026-06-23 01:14:57 +02:00
Viktor Szakats
364d6c18f7
cmake: add pre-fills for DragonFly BSD and MidnightBSD
Based on CI runs:
DragonFlyBSD: https://github.com/curl/curl/actions/runs/27978506617/job/82802332910 (autotools)
MidnightBSD: https://github.com/curl/curl/actions/runs/27977103321/job/82797523470 (cmake)

Also readd DragonFly BSD to GHA/non-native, but keep it commented.

Closes #22138
2026-06-22 22:57:07 +02:00
Viktor Szakats
560dc2985a
doh: drop redundant curlx_dyn_free() call in doh_probe_done()
The buffer is freed on the next instruction via `Curl_meta_remove()`'s
destructor.

Reported-by: netspacer.research

Follow-up to 1ebd92d0fd #16384

Closes #22133
2026-06-22 21:04:45 +02:00
Viktor Szakats
b0d0f16d20
tidy-up: make 'CA' uppercase, where missing
```sh
git grep -w ca | grep -v -E -i 'ca[;"=/()%_.-]' | grep -v -E -i '[*$"=/()%_.-]ca'
```

Closes #22135
2026-06-22 21:04:45 +02:00