Commit graph

38362 commits

Author SHA1 Message Date
Viktor Szakats
b81d30ade3
pytest: fix conditions for test_02_28
- allow 02_28 to run in HTTP/1.1 without H2 support again.
  Follow-up to 3752de465d #19412

- fix to skip 02_28 for all protocols for curl without compression
  support (either zlib, brotli or ztsd).

Closes #19458
2025-11-10 23:30:20 +01:00
Viktor Szakats
cdb7ac11b4
GHA/linux: disable test 776 in valgrind jobs to avoid delay
Saving ~30 seconds in jobs affected.

Closes #19456
2025-11-10 23:14:01 +01:00
Viktor Szakats
af5a1647af
OS400/makefile.sh: fix shellcheck warning SC2038
Also:
- OS400/makefile.sh: use end-of-options marker in xargs command.
- OS400/make-tests.sh: drop warning suppression.
  Seems to not trigger anymore as of shellcheck 0.11.0

Closes #19451
2025-11-10 18:52:29 +01:00
Viktor Szakats
6aab1dc263
scripts: use end-of-options marker in find -exec commands
Closes #19450
2025-11-10 18:52:29 +01:00
Viktor Szakats
a8e46c5ab1
verify-release: update to avoid shellcheck warning SC2034
```
SC2034: dl appears unused
```

Also to shorten the code.

Closes #19449
2025-11-10 16:06:48 +01:00
Viktor Szakats
77be4a7ab2
mdlinkcheck: pass curl arguments to open() as list
To prevent misinterpreting quotes or other special characters.

Requires Perl 5.22+ (2015-Jun-01) on Windows.

Ref: https://perldoc.perl.org/functions/open

Closes #19437
2025-11-10 14:21:35 +01:00
Viktor Szakats
b39c158e4a
scripts: fix shellcheck SC2046 warnings
Fix SC2046: "Quote this to prevent word splitting."
Ref: https://www.shellcheck.net/wiki/SC2046

Also:
- shellcheck.sh: add `set -eu`.
- shellcheck.sh, yamlcheck.sh: always run from repo root.
- pass `--` before passing the list of files, where missing.
- badwords.pl, cleancmd.pl: rework to accept `git ls-files` arguments.
  Requires Perl 5.22+ (2015-Jun-01) on Windows.
  Ref: https://perldoc.perl.org/functions/open
- INTERNALS.md: require Perl 5.22 on Windows.
- spacecheck.pl: formatting.
- GHA/http3-linux: rework command to avoid SC2046.
- stop suppressing SC2046 warnings.

The yamlcheck.sh issue reported-by: Stanislav Fort (Aisle Research)
Ref: 20251109163515_6eb31da3-deb2-4f4d-8327-935904f27da5

Closes #19432
2025-11-10 14:21:35 +01:00
Viktor Szakats
f477f3efc3
tests/data: support using native newlines on disk, drop .gitattributes
Data files no longer depend on mixed newline styles. Before this
patch the harness still assumed data files to use LF newlines,
ensured by `.gitattribute` and distributing sources with LF newlines.

To allow using platform native newlines (CRLF on Windows typically),
update the test harness to support data files with any newline style
on disk. And delete `.gitattributes`.

Fix to:
- load original data files (from test/data) so that their newline-style
  doesn't matter on the checked out source repo, meaning it works
  when its CRLF on Windows, just like any other file.
  (if a BOM slips in, it's caught by `spacecheck.pl` as binary content.)
- do the same in `util.py` used by `smbserver.py` (for test 1451).
- also fix `util.py` to use us-ascii encoding for data files, replacing utf-8.

Also:
- runtests: rework the stray CR checker to allow full CRLF data files,
  and keep warning for mixed newlines.

Follow-up to 904e7ecb66 #19347

Closes #19398
2025-11-10 14:21:34 +01:00
Daniel Stenberg
8e321a53df
examples/crawler: fix variable
A variable missed in the previous rename cleanup

Follow-up to 928363f28c
Reported-by: Gisle Vanem
Closes #19446
2025-11-10 13:40:13 +01:00
Daniel Stenberg
7e87255020
socks_sspi: use free() not FreeContextBuffer()
The memory is allocated with malloc().

This reverts commit 1d01d4975f.

Reported-by: Stanislav Fort (Aisle Research)
Closes #19445
2025-11-10 13:39:22 +01:00
Daniel Stenberg
37050a1462
OS400/ccsidcurl: fix curl_easy_setopt_ccsid for non-converted blobs
When a blob option is used and it does not convert, the code would
erroneously pass along an uninitialized stack struct.

Reported-by: Stanislav Fort (Aisle Research)
Closes #19444
2025-11-10 13:38:36 +01:00
Daniel Stenberg
2f29a8f19e
RELEASE-NOTES: spellcheck 2025-11-10 10:41:38 +01:00
Daniel Stenberg
2f768b8c62
RELEASE-NOTES: synced 2025-11-10 10:09:03 +01:00
Daniel Stenberg
4efe88ee7e
renovate.json: drop parentheses from group names
They make git branch names using those parentheses, that need to be
quoted when used with git command lines. Avoid parentheses for easier to
use branch names.

Follow-up to f77c574445

Closes #19441
2025-11-10 09:48:05 +01:00
renovate[bot]
24774bbb5e
GHA: update awslabs/aws-lc to v1.63.0
Closes #19435
2025-11-10 09:21:25 +01:00
x2018
323b33d51f
digest_sspi: properly free sspi identity
Closes #19426
2025-11-10 09:20:26 +01:00
Daniel Stenberg
660f244640
urlapi: fix mem-leaks in curl_url_get error paths
Reported-by: Stanislav Fort (Aisle Research)
Closes #19440
2025-11-10 09:16:20 +01:00
x2018
baafa5ff76
schannel: fix potental memory leak of cert_store_path on four error paths
Closes #19423
2025-11-10 09:14:56 +01:00
x2018
87149c8383
mqtt: properly handle the message which exceeds maxsize
We should goto fail as topic is allocated.

Follow-up to 92fd791

Closes #19417
2025-11-10 09:07:27 +01:00
Stanislav Fort
b0aba1005b
cshutdn: acknowledge FD_SETSIZE for shutdown descriptors
In the logic called for curl_multi_fdset().

File descriptors larger than FD_SETSIZE size are simply ignored, which
of course will make things break but at least it does not trash memory.

Reported-by: Stanislav Fort (Aisle Research)
Closes #19439
2025-11-10 08:54:43 +01:00
Daniel Stenberg
00872d5c98
rtmp: fix double-free on URL parse errors
Reported-by: Stanislav Fort (Aisle Research)
Closes #19438
2025-11-10 08:53:30 +01:00
Samuel Henrique
79d3e1d7d4
wcurl: import v2025.11.09
Closes #19430
2025-11-10 08:52:55 +01:00
Daniel Stenberg
c791223743
setopt: disable CURLOPT_HAPROXY_CLIENT_IP on NULL
As documented.

Reported-by: Stanislav Fort (Aisle Research)
Closes #19434
2025-11-10 07:49:00 +01:00
Viktor Szakats
2701ac6a4d
processhelp.pm: log taskkill pid info, add debug envs, enable in CI
To debug the Windows CI fails further. Acting on the suspicions that
`taskkill` may sometimes be applied to the wrong process.

- log task info, and task child info before calling `taskkill` on a PID.
  (on native Windows.)
  One of the calls needs PowerShell.

- add env `CURL_TEST_NO_TASKKILL` to disable using `taskkill`.

- add env `CURL_TEST_NO_TASKKILL_TREE` to use `taskkill` without
  `-t`, meaning to kill the process, but not child processes.

- GHA/windows: disable `taskkill` calls, to see what happens.
  I'll revert or tweak this in a future commit depending on results.

Ref: https://github.com/curl/curl/discussions/14854#discussioncomment-13062859
Ref: https://github.com/curl/curl/discussions/14854#discussioncomment-14913014

Closes #19421
2025-11-10 02:00:17 +01:00
Viktor Szakats
c6f1b0ff49
tests/server: do not fall back to original data file in test2fopen()
Before this patch servers were loading the original data source file
(from `tests/data/test*`) if they failed to open the preprocessed data
file.

It was causing issues in many (most?) tests, because original data files
are not preprocessed, thus may be incomplete and/or come with wrong
newline characters. It's also causing difficult to diagnose issues when
a test accidentally references another test's data, which by chance
makes the test pass initially, until either that or the executed test
data gets an update, and breaking it, as seen in #19329.

Historically, the fallback existed first, then the preprocessed copy.
The fallback is no longer used by tests (except by stray accidents).

Fix it by dropping the fallback logic and relying on the preprocessed
data file saved there by the runtests framework.

Also fix two remaining test data cross-references:
- test1565: reference own server input data instead of test1's.
- test3014: reference own server input data instead of test1439's.
  Ref: #19398

Follow-up to aaf9522a2c #19329

Closes #19429
2025-11-09 21:14:41 +01:00
Viktor Szakats
28ff2b260e
tests/data: replace hard-coded test numbers with %TESTNUMBER
Closes #19427
2025-11-09 19:27:19 +01:00
Viktor Szakats
67236f7edd
tests/data: delete stray space indentation from xml tags
Closes #19428
2025-11-09 19:27:19 +01:00
Viktor Szakats
49ef2f8d1e
cmake: adjust defaults for target platforms not supporting shared libs
If CMake reports the target platform not supporting shared libs, turn
`BUILD_SHARED_LIBS` off by default. CMake 3.30+ fails with an error
when trying to create a `SHARED` target for such platforms. Earlier
versions used a workaround that may or may not have worked in practice.

Ref: https://cmake.org/cmake/help/v3.30/policy/CMP0164.html

Seen this with a build setting `-DCMAKE_SYSTEM_NAME=Generic`, e.g.
AmigaOS.

Note this may introduce incompatibility for "Generic" targets, which
support shared libs. If that's the case, set `BUILD_SHARED_LIBS=ON`
manually.

Also drop AmigaOS-specific logic handled automatically after this patch.

Ref: https://cmake.org/cmake/help/v3.7/command/get_property.html
Ref: https://cmake.org/cmake/help/v3.7/prop_gbl/TARGET_SUPPORTS_SHARED_LIBS.html

Closes #19420
2025-11-09 17:56:20 +01:00
Viktor Szakats
f760a5cef7
tests/data: replace %CR with crlf=headers where possible
Missed them in previous rounds of updates:
test 433, 1375, 1376, 1377, 1429

Closes #19424
2025-11-09 16:39:34 +01:00
Viktor Szakats
d35c880a75
INSTALL-CMAKE.md: document static option defaults more
Closes #19419
2025-11-09 13:16:02 +01:00
Daniel Stenberg
7aa50124c2
TODO: improve code for large MQTT payloads
Closes #19416
2025-11-09 11:53:39 +01:00
Daniel Stenberg
92fd791f31
mqtt: reject overly big messages
Reported-by: Jiyong Yang
Closes #19415
2025-11-09 11:40:28 +01:00
x2018
a002c50510
ftp: refactor a piece of code by merging the repeated part
Closes #19411
2025-11-09 11:39:56 +01:00
x2018
1bddfe02d5
asyn-thrdd: release rrname if ares_init_options fails
Closes #19410
2025-11-09 11:35:04 +01:00
x2018
59584399a5
tftp: release filename if conn_get_remote_addr fails
Closes #19409
2025-11-09 11:32:57 +01:00
x2018
239c389836
openssl: release ssl_session if sess_reuse_cb fails
Closes #19405
2025-11-09 11:31:20 +01:00
Viktor Szakats
019874f197
GHA/linux: stop disabling TLS-SRP tests in event-based & duphandle jobs
They were disabled since these jobs ran in Zuul. The tests are 320, 321,
322, 323, 324. Of which, 323 runs in CI, the rest needs `gnutls-serv`
with SRP enabled, which is not available in current jobs and no longer
offered by Ubuntu's `gnutls-bin` package. 324 doesn't appear as
a skipped test, 323 seems to be running fine, the rest are logged as
skipped. This suggests it's safe to drop the exceptions.

Closes #19413
2025-11-09 00:53:22 +01:00
Viktor Szakats
c262481873
GHA/linux: build and test LibreSSL with Fil-C curl, enable pytests
Build and cache LibreSSL locally with Fil-C and enable it in the Fil-C
job.

Also:
- disable test 776 in the Fil-C job. It fails consistently, and due to
  flakiness seen earlier its result is disabled. In this job it seems to
  be adding 1 to 9 minues to the test run step and fails consistently.
- include Fil-C version in the LibreSSL cache key to prepare for Fil-C
  ABI changes.
- GHA/linux: fully quote `tflags` values to avoid breaking YAML.

Tested and confirmed working with OpenSSL too, but ended up with
LibreSSL for faster, smaller builds.

Closes #19407
2025-11-08 22:51:33 +01:00
Viktor Szakats
3752de465d
pytest: skip H2 tests if feature missing from curl
To allow running pytests on more curl configurations.

Also delete a redundant H3 feature check from test_17_14_expired_cert.

Cherry-picked from #19407
Closes #19412
2025-11-08 22:40:24 +01:00
Daniel Stenberg
7e0d4dd4a8
CURLOPT_SSH_KEYFUNCTION.md: fix minor indent mistake in example 2025-11-08 17:49:30 +01:00
Daniel Stenberg
64489bc3be
CURLOPT_READFUNCTION.md: clarify the size of the buffer
No need to multiply with size as size is always 1 - and documented so.

Closes #19402
2025-11-08 17:11:28 +01:00
Daniel Stenberg
d083f529e8
CURLINFO_SCHEME/PROTOCOL: they return the "scheme" for a "transfer"
Not protocol. Not for connection.

Closes #19403
2025-11-08 17:09:50 +01:00
Daniel Stenberg
a5c0dfc19f
CURLINFO_TLS_SSL_PTR.md: remove CURLINFO_TLS_SESSION text
That option is properly documented in its own page.

Closes #19404
2025-11-08 17:07:23 +01:00
Daniel Stenberg
8442c24c9a
CURLINFO: remove 'get' and 'get the' from each short desc
The short descriptions describe the data each info retrieves. The info
itself does not 'get' the data.

This simplifies and shortens the descriptions and make them more
consistent.

Closes #19406
2025-11-08 17:05:55 +01:00
Stefan Eissing
f55974c139
vtls: fix CURLOPT_CAPATH use
A regression in curl 8.17.0 led to a customer CAPATH set by the
application (or the curl command) to be ignored unless licurl was built
with a default CAPATH.

Add test cases using `--capath` on the custom pytest CA, generated with
the help of the openssl command when available.

Fixes #19401
Reported-by: Brad King
Closes #19308
2025-11-08 17:02:54 +01:00
Viktor Szakats
16c6ea36cc
GHA/linux: add minimal Fil-C build with tests
Requirements for Fil-C:
- not to accidentally pick up system headers. E.g. from `/usr/include`
  on Linux. It can happen when any dependency is auto-detected on this
  header path. This makes Fil-C find the wrong system headers, which
  in turn breaks the configuration step in subtle ways (with CMake) and
  less subtle ways (autotools). Then CMake ends up running into an error
  while compiling.
- build all dependencies with Fil-C too.
  (this patch doesn't build any dependencies yet.)
- "unity" mode disabled. It should work, but needs a lot of memory and
  slower than a standard compiler, or a Fil-C non-unity build.
- x86_64 Linux host platform when using the pre-built toolchain.

Observations on a minimal, static build made with no dependencies and
Fil-C 0.674 (based on clang 20.1.8).
- curl tool sizes:
  - cmake, default, w/o -O: 30 MB (gcc 14.2.0: 1.7 MB)
  - cmake, default, w/o -O, stripped: 29.6 MB (gcc: 1.4 MB)
  - cmake, Release, -O3: 7.2 MB (gcc: 1 MB)
  - cmake, Release, -O3, stripped: 6.8 MB (gcc: 0.93 MB)
  - autotools, default, -O2: 7 MB
- libcurl.a size is 32 MB (cmake, default, w/o -O) (gcc: 2.7 MB)
- build times 3-3.5x longer (compared to system gcc 14.2.0):
- all runtests available pass OK.
- all pytests skipped due to missing features/dependencies.
- shared libcurl builds also work (cmake, default: 25 MB libcurl.so and
  5.75 MB (5.6 stripped) curl tool)
- autotools works fine too, with dependencies disabled or set to avoid
  `/usr/include`.

Closes #19391
2025-11-08 13:42:03 +01:00
x2018
9c0ccd2739
vtls: handle possible malicious certs_num from peer
For GnuTLS, mbedTLS, Rustls, Schannel and wolfSSL

This check was previously added for OpenSSL in 3df71e6dc2

Closes #19397
2025-11-08 10:33:06 +01:00
x2018
a6fcaf2958
rtmp: precaution for a potential integer truncation
On some platforms, socket descriptors may use types larger than int.
When these values exceed INT_MAX, conversion to int can truncate to
negative values causing RTMP connection failures, and even accidentally
affect other socket when high-value descriptors map to existing
lower-value sockets after integer conversion. This check ensures socket
values are within the safe range before passing them to the RTMP
library.

Closes #19399
2025-11-08 10:28:43 +01:00
Andrew
2d99cf0761
lib: fix gssapi.h include on IBMi
Fixes #19336
Closes #19337
2025-11-08 10:25:12 +01:00
Daniel Stenberg
9d1acd048c
gtls: skip session resumption when verifystatus is set
Resumed TLS sessions skip OCSP stapled-response verification. Force a
full handshake so verifystatus() runs.

Follow-up to 4bfd7a9615

Pointed out by ZeroPath
2025-11-07 14:14:54 +01:00