Commit graph

36019 commits

Author SHA1 Message Date
Viktor Szakats
9863599d69
lib: introduce CURL_ACCEPT()
To avoid overriding the system symbol `accept`, which is a macro on some
systems (AIX), and thus can't be called via the `(function)` PP trick.

It's also problematic to reset such macro to its original value.

Follow-up to 3bb5e58c10 #17827
Reported-by: Andrew Kirillov
Fixes #18500
Closes #18501
Closes #18502
2025-09-09 15:17:34 +02:00
Daniel Stenberg
f8ff233cdf
_ENVIRONMENT.md: document NETRC
Follow-up to 378713deb2

Closes #18497
2025-09-08 22:45:30 +02:00
Daniel Stenberg
32909591d2
docs: put <> within backticks in titles
To render better markdown. Make managen warn if present "unticked" and
unescaped.

Closes #18498
2025-09-08 22:42:53 +02:00
Stefan Eissing
e3c06ccc66
vquic: replace assert
Replace the hard assert in case not all data is send on UDP
(which should never happen), with an error return.

Closes #18495
2025-09-08 16:05:27 +02:00
Daniel Stenberg
84db7a9eae
ws: get a new mask for each new outgoing frame
Reported-by: Calvin Ruocco
Closes #18496
2025-09-08 16:04:16 +02:00
Andrew
7c9878ff0c
curl_setup.h: include limits.h before testing for #ifndef SSIZE_MAX
Ref: 93f333c18f #18426 #18406
Fixes #18493
Closes #18494
2025-09-08 14:52:55 +02:00
Daniel Stenberg
07a688135d
KNOWN_BUGS: OpenSSL-QUIC problems on google.com
Closes #18336
Closes #18492
2025-09-08 11:45:33 +02:00
Daniel Stenberg
34fd7e8d2d
RELEASE-PROCEDURE.md: drop the _newslog edit mention
Because that file has now been removed from the website repository
2025-09-08 11:12:47 +02:00
Daniel Stenberg
455afa1de5
RELEASE-PROCEDURE.md: remove some old release dates, add some new 2025-09-08 10:14:12 +02:00
Daniel Stenberg
3b2cfa55a0
mailmap: unify on James 2025-09-08 09:26:22 +02:00
Viktor Szakats
93bc523541
GHA/linux: run on .md file changes
To execute runtests on Markdown files. E.g. test 1275.

Bug: https://github.com/curl/curl/pull/18486#issuecomment-3263681032

Closes #18487
2025-09-07 22:21:04 +02:00
Viktor Szakats
7f7db9e372
lib: fix broken link in comment 2025-09-07 19:19:05 +02:00
Viktor Szakats
10e9d512e5
BINDINGS: point a link to archive.org
The original website is hosting different content now.

Closes #18489
2025-09-07 18:59:11 +02:00
Viktor Szakats
ce62f0f9a1
VULN-DISCLOSURE-POLICY: make it pass test 1275
```
test 1275...[Verify capital letters after period in markdown files]
 ../../docs/VULN-DISCLOSURE-POLICY.md:426:55:error: lowercase daily after period
 * regular communication from communication leader (ex. daily update)
```
Ref: https://github.com/curl/curl/actions/runs/17527331816/job/49779555753?pr=18485

Also: add ending slashes to 2 URLs.

Follow-up to 6905370df5 #18483
Closes #18486
2025-09-07 12:39:44 +02:00
Viktor Szakats
b85cb8cb4e
openldap: fix -Wtentative-definition-compat
It's a `-Weverything` warning that appeared in llvm/clang 21.

```
lib/openldap.c:1297:19: warning: duplicate declaration of 'ldapsb_tls' is invalid in C++ [-Wtentative-definition-compat]
 1297 | static Sockbuf_IO ldapsb_tls =
      |                   ^
lib/openldap.c:499:19: note: previous declaration is here
  499 | static Sockbuf_IO ldapsb_tls;
      |                   ^
```

Reported-by: correctmost on github
Fixes #18470
Cherry-picked from #18477
Closes #18485
2025-09-07 12:36:44 +02:00
Jim Fuller
6905370df5
docs: add major incident section to vuln disclosure policy
Closes #18483
2025-09-06 12:20:45 +02:00
Daniel Stenberg
6420c52294
RELEASE-NOTES: synced 2025-09-06 12:12:55 +02:00
Stefan Eissing
0b09132877
websocket: handling of PONG frames
The auto PONG frames were inserted into the connection at the time
a PING had been decoded, irregardless if an upstream frame was just
in the middle of being assembled.

Add PONG frames only to the buffer if there is no frame currently
assemebled and, if it is, set the control frame aside. This control
frame is then added on the first opportunity of a "clean" send buffer.

There is only a single control frame set aside at a time. This means
a double PING will, when the PONG cannot be sent right away, only
send the last PONG.

I imagine this is fine. We want to prevent the endless buffering of
PONG frames on a connection where the server sends but does no receives.

Reported-by: Calvin Ruocco
Fixes #16706
Closes #18479
2025-09-05 13:17:39 +02:00
renovate[bot]
4c0da28231 gha: Update actions/labeler action to v6 2025-09-04 13:03:47 -07:00
Viktor Szakats
ec9cb618a0
spacecheck: warn for 3+ empty lines in a row, fix fallouts
Closes #18478
2025-09-04 20:37:51 +02:00
Stefan Eissing
5fa4fb0c13
websocket: reset upload_done when sending data
Sending websocket data did not clear the "upload_done" flag of
the initial HTTP Upgrade request, leading to KEEP_SEND never be
cleared. This caused the socket to be polled for INOUT after all
the websocket data had been sent. A busy loop.

Closes #18476
2025-09-04 14:47:15 +02:00
Daniel Stenberg
f333a73892
top-complexity: set threshold to 70
Closes #18475
2025-09-04 10:06:13 +02:00
Daniel Stenberg
1edead4360
rtsp: split out a subfunction from rtsp_do
Takes complexity down from 71 to 52.

Closes #18471
2025-09-04 08:31:27 +02:00
Daniel Stenberg
31659b4a7a
http_add_connection_hd: respect previous error
Pointed out by CodeSonar

Closes #18472
2025-09-04 08:26:17 +02:00
Viktor Szakats
5ef4451f7b
cmake: fix setting LTO properties on the wrong targets
Follow-up to ae1a861bd6 #17043

Closes #18469
2025-09-03 18:35:31 +02:00
Viktor Szakats
0b0f3d937c
lib: drop UNUSED_PARAM macro
Added in 2011, but has seen little use in the code. The necessary
compiler feature is missing in some compilers (e.g. MSVC), thus in most
places the portable `(void)` cast is used in addition.

Also:
- vtls/rustls: silence unused argument warning with `(void)`.
  Necessary for MSVC, for example.

Ref: ee4ed46128

Closes #18455
2025-09-03 16:33:05 +02:00
Viktor Szakats
49145249be
tidy-up: drop stray "unused" comments
Closes #18453
2025-09-03 16:31:16 +02:00
Stefan Eissing
24badd29f5
multi: limit-rate revisited
Tweaks around handling of --limit-rate:

* tracing: trace outstanding timeouts by name
* multi: do not mark transfer as dirty that have
  an EXPIRE_TOOFAST set
* multi: have one static function to asses speed limits
* multi: when setting EXPIRE_TOOFAST remove the transfers
  from the dirty set
* progress: rename vars and comment on how speed limit
  timeouts are calculated, for clarity
* transfer: when speed limiting, exit the receive loop
  after a quarter of the limit has been received, not
  on the first chunk received.
* cf-ip-happy.c: clear EXPIRE_HAPPY_EYEBALLS on connect
* scorecard: add --limit-rate parameter to test with
  speed limits in effect

Closes #18454
2025-09-03 15:53:41 +02:00
renovate[bot]
2ebb966e08
GHA: update nghttp2/nghttp2 to v1.67.0
Closes #18456
2025-09-03 15:51:43 +02:00
Daniel Stenberg
de86c2483f
test763: verify IDN hostname with zero width characters only
Bonus: fix memory leak in exit path from 967a626af4

Closes #18465
2025-09-03 15:49:54 +02:00
Daniel Stenberg
71c9706959
tests: remove the 'none' server
Only actually needed servers should be listed and none is then implied
if no servers are listed.

Outputs a warning if "none" is still set as a server.

Closes #18466
2025-09-03 14:30:10 +02:00
David Zhuang
c278c508e2
http: do the cookie list access under lock
A previous refactor of cookie logic changed Curl_cookie_getlist to no
longer return a list of copied cookies, but instead return a linked list
pointing to existing cookies. The returned linked list is accessed
outside of the scope of the cookie share lock in http_cookies, which
leads to issues if the shared cookie list is modified at the same time.
This is the relevant commit: be39ed1

Closes #18457
2025-09-03 12:54:31 +02:00
renovate[bot]
5e6bc73570
GHA: Update cloudflare/quiche to v0.24.6
Closes #18464
2025-09-03 12:52:04 +02:00
Stefan Eissing
9f1102cf74
pytest: add tests for getting a non-existing ftp file
Check that return code is 78.

Closes #18463
2025-09-03 12:51:00 +02:00
Daniel Stenberg
967a626af4
idn: reject conversions that end up as a zero length hostname
Reported-by: RepoRascal on hackerone
Closes #18462
2025-09-03 11:55:23 +02:00
renovate[bot]
8603d5262b
GHA: update awslabs/aws-lc to v1.60.0
Closes #18458
2025-09-03 11:37:42 +02:00
Daniel Stenberg
765b5ab0cd
tool_getparam: warn on more unicode prefixes
If a string argument is expected and the first two bytes are 0xe2 ex80
and the third has the 7th bit set, that's enough for curl to warn.

Previously we tried to detect and warn only for the unicode double
quote, but users might use single quotes, other quotes or even lead the
argument with one of the "zero widths" characters. This is an attempt to
detect many of those. Without triggering for "normal" IDN hostnames.

Closes #18459
2025-09-03 11:35:10 +02:00
Daniel Stenberg
4c70b71ba4
RELEASE-NOTES: synced 2025-09-03 08:36:55 +02:00
Jay Satiro
c72bb7aec4 projects: fix Windows project 'clean' function
- Fix generate.bat "-clean" option.

- Change version template substitutes to match old files, eg go back to
  using format version "11.00" instead of "11.0".

- Limit the vcxproj filters file types that are filtered to c, h, rc.

- Get rid of the tmpl extension from template files and add a README
  to the tmpl directory explaining the purpose of the files.

- gitignore VCxx directories entirely rather than individual file types.

- Do not remove the VC directories during clean, instead remove just the
  generated project files.

Removing the VC directories has the unwanted behavior of removing files
other than those generated. Visual Studio will generate its own
preference files (like if you have some debug arguments in your .suo)
and those files sit in the VC directories. We ignore those files since
they are the user's files and should not be deleted. Also the user may
have their own untracked files that we shouldn't be deleting.

Follow-up to 57d349fe which consolidated the project templates.

Assisted-by: Viktor Szakats

Closes https://github.com/curl/curl/pull/18412
2025-09-02 10:34:48 -04:00
Florian Friedrich
ad42850b23
docs: fix typo (staring -> starting)
Closes #18450
2025-09-02 10:11:51 +02:00
Michał Petryka
37c6744997
.editorconfig: add
This allows IDEs that support this standard to automatically use the
correct formatting options.

Closes #18409
2025-09-02 08:36:40 +02:00
Daniel Stenberg
f8e6e11725
parsedate: make Curl_getdate_capped able to return epoch
By returning error separately on parse errors and avoiding magic
numbers, this function can now return 0 or -1 as proper dates when such
a date string is provided.

Closes #18445
2025-09-02 07:55:34 +02:00
Stefan Eissing
4d040c71d7
Curl_http(), decomplexify
Split out adding of individual request headers into a switch. Check
the connection http version only on fresh connections, use separate
methods.

Add TE: header directly without allocation. Add bit for indicating
Connection: header has been added and custom headers should not do
that again.

Closes #18444
2025-09-02 07:54:46 +02:00
Daniel Stenberg
e00cb001c6
CURLINFO_FILETIME*.md: correct the examples
Only -1 means bad value, all others are acceptable.

Ref: #18424
Closes #18447
2025-09-02 07:51:14 +02:00
Daniel Stenberg
9598ccee59
tool_filetime: correct the conditions
The libcurl API for CURLINFO_FILETIME_T clearly says it contains -1 if
not set. Everything else is a valid time stamp so use that.

Follow-up to 54f1ef05d6
Closes #18446
2025-09-02 07:50:11 +02:00
Stefan Eissing
e65dc7fa23
aws-lc: do not use large buffer
test_10_08, uploading larger files for a h2 proxy, sporadically fails
with a decrpytion error on received data in AWS-LC. The frequency can
be increased by simulated network receive blocks.

Not setting a 4 * TLS record sized buffer, leaving AWS-LC at its
default buffer size seems to mitigate this problem.

Closes #18434
2025-09-01 23:27:11 +02:00
Yedaya Katsman
63b7d8b8f4
autotools: make curl-config executable
This was already done when building using CMake:
fa9151b41a/CMakeLists.txt (L2391-L2394)

Closes #18433
2025-09-01 09:41:30 +02:00
Daniel Stenberg
5256ce229e
cw-out: add assert for data->conn
Instead of checking it runtime. CodeSonar pointed out that if it
actually CAN legitimately be NULL here, then we need to do more checks
for it...

Closes #18440
2025-09-01 08:53:39 +02:00
Daniel Stenberg
84c92f7113
tool: move the error buffer to the per transfer struct
To avoid having to alloc or manage it separately.

Closes #18442
2025-09-01 08:52:57 +02:00
Daniel Stenberg
54f1ef05d6
tool_filetime: accept setting negative filetime
This allows --remote-time to set dates before 1970.

Due to a minor omission in the API, it will still avoid setting the time
if it is indeed exactly epoch 0 (jan 1 1970).

Verified by test 762

Fixes #18424
Reported-by: Terence Eden
Closes #18443
2025-09-01 08:51:36 +02:00