Commit graph

36738 commits

Author SHA1 Message Date
Viktor Szakats
9c36eace60
autotools: drop detection of ancient OpenSSL libs RSAglue and rsaref
Closes #19078
2025-10-16 16:19:05 +02:00
Stefan Eissing
c37ed9a11e
apple sectrust: add to features
It should be visible in the feature list that libcurl is build with
Apple SecTrust enabled.

Closes #19057
2025-10-16 10:58:45 +02:00
Daniel Stenberg
79553fb7c6
RELEASE-NOTES: synced 2025-10-16 09:01:17 +02:00
Daniel Stenberg
71d5525113
connect: remove redundant condition in shutdown start
Pointed out by CodeSonar

Closes #19079
2025-10-16 08:56:16 +02:00
Daniel Stenberg
f8cd64e3ab
urldata: make redirect counter 16 bit
Instead of long (up to 64-bit) as the maximum allowed value set since
b059f7deaf is 0x7fff. Saves 2 or 6 bytes.

Closes #19072
2025-10-15 12:34:33 +02:00
Daniel Stenberg
b7f2355b8b
urldata: make 'retrycount' a single byte
Since it only counts up to 5

Closes #19071
2025-10-15 12:33:03 +02:00
Daniel Stenberg
62961d6cc5
lib: stop NULL-checking conn->passwd and ->user
They always point to a string. The string might be zero length.

Closes #19059
2025-10-15 10:44:51 +02:00
Emre Çalışkan
5e46318414
transfer: reset retry count on each request
Reported-by: plv1313 on github
Fixes #18926
Closes #19066
2025-10-15 10:39:31 +02:00
Stefan Eissing
182a5a9aae
quic: remove data_idle handling
The transfer loop used to check the socket and if no poll events
were seen, triggered a "DATA_IDLE" event into the filters to let
them schedule times/do things anyway.

Since we no longer check the socket, the filters have been called
already and the DATA_IDLE event is unnecessary work. Remove it.

Closes #19060
2025-10-15 10:36:43 +02:00
Daniel Stenberg
be852e39b2
tftp: check for trailing ";mode=" in URL without strstr
RFC 3617 defines two specific modes, "netascii" and "octet". This code
now checks only for those trailing ones - and not in the hostname since
they can't be there anymore.

Assisted-by: Jay Satiro
Closes #19070
2025-10-15 09:59:57 +02:00
Daniel Stenberg
5ac3541cb4
ftp: replace strstr() in ;type= handling
Since it needs to be a trailing piece of the path avoiding strstr() is
faster and more reliable.

Also stopped checking the host name since it cannot actually be there
since quite a long while back. The URL parser doesn't allow such a
hostname.

Moved the check into its own subfunction too.

Closes #19069
2025-10-15 09:19:23 +02:00
Daniel Stenberg
ae5fb4188d
lib: reduce use of data->conn->
If there are more than two of them in a function, use a local 'conn'
variable instead.

Closes #19063
2025-10-15 08:03:29 +02:00
Daniel Stenberg
9441127394
http: look for trailing 'type=' in ftp:// without strstr
- it could find a wrong string
- this is faster

Closes #19065
2025-10-15 08:02:44 +02:00
Jay Satiro
97ae9ec8ef ws: fix type conversion check
- Fix logic that checks whether a size_t will fit in a curl_off_t.

Reported-by: Viktor Szakats

Fixes https://github.com/curl/curl/issues/19017
Closes https://github.com/curl/curl/pull/19036
2025-10-14 11:06:49 -04:00
Jay Satiro
fe06127ded tool_operate: retry on HTTP response codes 522 and 524
- Treat HTTP response codes 522 and 524 as a transient error since
  Cloudflare may use them instead of 504 to signal timeout.

For example here is a 522 error message from Cloudflare:

"The initial connection between Cloudflare's network and the origin web
server timed out. As a result, the web page can not be displayed."

Prior to this change the curl tool did not retry on HTTP response codes
522 and 524 when --retry was used.

Fixes https://github.com/curl/curl/discussions/16143
Closes https://github.com/curl/curl/pull/19011
2025-10-14 11:06:24 -04:00
Viktor Szakats
64ed2ea196
examples: check more errors, fix cleanups, scope variables
Inspired by Joshua's report on examples.

Closes #19055
2025-10-14 16:33:00 +02:00
Daniel Stenberg
61dcb56743
openldap: explain a const removing typecast
Closes #19056
2025-10-14 16:25:34 +02:00
Stefan Eissing
1ea99afdc7
scorecard: add perf support on linux
When calling scorecard with --flame to produce a flamegraph, use
"perf" on linux platforms to do the measurements. Update the scorecard
documentation about it.

Closes #19058
2025-10-14 16:24:35 +02:00
Viktor Szakats
4c7507daf9
examples: improve global init, error checks and returning errors
- add `curl_global_init()` and `curl_global_cleanup()` where missing.
- check the result of `curl_global_init()` where missing.
- return the last curl error from `main()`.
- drop Win32-specific socket initialization in favor of `curl_global_init()`.
- rename some outliers to `res` for curl result code.
- fix cleanup in some error cases.

Inspired by Joshua's report on examples.

Closes #19053
2025-10-13 23:02:05 +02:00
Viktor Szakats
3049c8e0a0
examples: return curl_easy_perform() results
Where missing. Or explicitly `(void)` it where we ignore it on purpose.

Reported-by: Joshua Rogers (for `sepheaders.c`)

Closes #19052
2025-10-13 17:58:30 +02:00
Viktor Szakats
5cf0a6789d
examples: call curl_global_cleanup() where missing
Reported-by: Joshua Rogers (for `sepheaders.c`)

Closes #19051
2025-10-13 17:52:06 +02:00
Viktor Szakats
497b3f022e
checksrc: allow disabling warnings on FIXME/TODO comments
Follow-up to 71ace9f3c1

Closes #19048
2025-10-13 16:11:10 +02:00
Daniel Stenberg
6deea19eb4
RELEASE-NOTES: synced 2025-10-13 16:03:46 +02:00
Daniel Stenberg
f1828b5404
libssh2: avoid risking using an uninitialized local struct field
Reported-by: Joshua Rogers
Closes #19043
2025-10-13 12:29:13 +02:00
Daniel Stenberg
6d0fcdf2ed
libssh: catch a resume point larger than the size
As it would otherwise trigger broken math

Reported-by: Joshua Rogers
Closes #19044
2025-10-13 12:27:39 +02:00
Viktor Szakats
5e74b2df34
REUSE: move copyright headers to .checksrc
To make it simpler to move them around, create and delete them without
syncing with `REUSE.toml`.

Also:
- checksrc: allow empty lines in `.checksrc`.
- comment on why curl printfs are disallowed in examples.

Closes #19024
2025-10-13 11:54:22 +02:00
Daniel Stenberg
dee72fe31e
libssh2: fix EAGAIN return in ssh_state_auth_agent
Reported-by: Joshua Rogers
Closes #19042
2025-10-13 10:46:42 +02:00
Daniel Stenberg
e003c0b259
socks_sspi: remove the enforced mode clearing
Reported-by: Joshua Rogers
Closes #19040
2025-10-13 10:41:42 +02:00
Daniel Stenberg
67c4256f7e
pop3: function could get the ->transfer field wrong
In pop3_perform(), pop3->transfer was derived from the old
data->req.no_body. Then, pop3_perform_command() re-computed
data->req.no_body.

Now we instead call pop3_perform_command() first.

Reported-by: Joshua Rogers
Closes #19039
2025-10-13 10:40:48 +02:00
Daniel Stenberg
27375ca364
tool_getparam: make --fail and --fail-with-body override each other
This allows users to put one of them in their .curlrc and still easily
use the other one at will in command lines.

The --no-* versions disable both of them.

Reported-by: Mitchell Blank Jr
Fixes #19029
Closes #19034
2025-10-13 10:38:10 +02:00
Daniel Stenberg
56450ce26f
tool_msgs: make errorf() show if --show-error
Assisted-by: Mitchell Blank Jr
Ref: #19029
Closes #19035
2025-10-13 08:56:14 +02:00
Daniel Stenberg
cde85412d0
KNOWN_BUGS: We do not support auth-int for Digest using PUT or POST
Closes #19038
2025-10-13 08:55:32 +02:00
Daniel Stenberg
e90b2aaa7e
tftp: error requests for blank filenames
Reported-by: Joshua Rogers
Closes #19033
2025-10-12 15:37:07 +02:00
Daniel Stenberg
1feeda422e
examples/synctime: fix null termination assumptions
bonus: dont parse argv[0] for options

Reported-by: Joshua Rogers
Closes #19032
2025-10-12 15:35:57 +02:00
Daniel Stenberg
1e90a63a49
sws: pass in socket reference to allow function to close it
The function service_connection() now passes in a reference to the
socket instead of by value since the sub function http_connect() might
close it and set *infdp = CURL_SOCKET_BAD. This would previously not be
detected when service_connection() returned and potentially cause a
double close of the socket.

Reported-by: Joshua Rogers

Closes #19031
2025-10-12 15:35:14 +02:00
Daniel Stenberg
578706adde
libssh/libssh2: reject quote command lines with too much data
If there is lingering letters left on the right side after the paths
have been parsed, they are syntactically incorrect so returning error is
the safe thing to do.

Reported-by: Harry Sintonen
Closes #19030
2025-10-12 15:34:27 +02:00
Daniel Stenberg
2b49d17cba
docs: expand on quoting rules for file names in SFTP quote
Reported-by: Harry Sintonen
Closes #19025
2025-10-12 15:33:21 +02:00
Stefan Eissing
6e35eb4879
lib: SSL connection reuse
Protocol handlers not flagging PROTOPT_SSL that allow reuse of existing
SSL connections now need to carry the flag PROTOPT_SSL_REUSE.

Add PROTOPT_SSL_REUSE to imap, ldap, pop3, smtp and ftp.

Add tests the http: urls do not reuse https: connections and vice versa.

Reported-by: Sakthi SK
Fixes #19006
Closes #19007
2025-10-12 15:30:12 +02:00
Stefan Eissing
dd7762c309
libssh2: use sockindex consistently
Although the protocol should only run on index 0, there was a mix of
looked up sockindex and using constant 0 in tls send/recv.

Reported-by: Joshua Rogers
Closes #19004
2025-10-12 15:28:04 +02:00
Stefan Eissing
44429da2e1
smb: transfer debugassert to real check
That also works for non-debug builds.

Reported-by: Joshua Rogers
Cloes #19003
2025-10-12 15:27:05 +02:00
Daniel Stenberg
d03a6b79b4
lib1514: fix return code mixup
Reported-by: Joshua Rogers
Closes #19027
2025-10-12 10:36:18 +02:00
Daniel Stenberg
1648f23ed3
socksd: remove --bindonly mention, there is no such option
Reported-by: Joshua Rogers
Closes #19026
2025-10-12 10:33:38 +02:00
Daniel Stenberg
b3f9c837d3
asyn-ares: remove wrong comment about the callback argument
Both the c-ares documentation and the c-ares source code contradict the
previous comment (and mentions/contains no such restriction).

Ref: #19001
Closes #19014
2025-10-12 10:30:54 +02:00
Daniel Stenberg
142d61a0ee
doswin: CloseHandle the thread on shutdown
As this is in the tool shutdown the impact of it was nothing.

Also, move two global variables to local.

Follow-up to 9a2663322c

Reported-by: Joshua Rogers
Closes #18996
2025-10-12 10:29:22 +02:00
Daniel Stenberg
66753bc120
RELEASE-NOTES: synced 2025-10-11 15:44:10 +02:00
Viktor Szakats
b419f1fd87
examples/log_failed_transfers: make it build for WinCE
- include `windows.h` after `winsock2.h` via `curl/curl.h`.
- avoid `errno` for WinCE.
- avoid `_vscprintf` for WinCE.

Ref: 4535532ed3 #18843
Follow-up to 0780de2625 #18668
Closes #19016
2025-10-11 01:04:24 +02:00
Viktor Szakats
16f0d4ae3a
curl_threads: delete WinCE fallback branch
Both WinCE and Windows use `CreateThread()` now, so the use of
`GetLastError()` works for both.

Follow-up to 03448f477a #18998
Follow-up to 1c49f2f26d #18451
Follow-up to af0216251b #1589

Closes #19015
2025-10-11 01:04:24 +02:00
Viktor Szakats
f04e7a7efa
cmake: pre-fill three more type sizes on Windows
Use `CMAKE_SIZEOF_VOID_P` to fill the size of three types that differ
on 32 and 64-bit Windows: `curl_socket_t`, `size_t`, and on mingw-w64:
`ssize_t`.

`time_t` remains the only type needing detection at configuration time,
with MSVC or mingw-w64.

Ref: https://cmake.org/cmake/help/v4.1/variable/CMAKE_SIZEOF_VOID_P.html

Closes #19013
2025-10-11 01:04:24 +02:00
Viktor Szakats
6e9246aeb3
cmake/FindGSS: simplify/de-dupe lib setup
- lib name is always `gss` with GNU GSS.
- move lib name assigments to the detection blocks.

Closes #19012
2025-10-11 01:04:23 +02:00
Patrick Monnerat
67c75b6712
os400: document threads handling in code.
This is to clarify threads unavaibility check and handling for security
bug busters unaware of OS400 specificities.

Fixes #18967
Closes #19009
2025-10-10 23:58:48 +02:00