* format `data->state.aptr.host` without crlf, so signatures do not need
to strip it again. Add the crlf when adding the header to the request
dynbuf
* check `connect-to` strings on normalized hostname and user supplied
hostname (when those differ)
* libssh: always use the peer for setting ssh option SSH_OPTIONS_HOST,
preserve ipv6 [] enclosure, use IDN converted hostname otherwise. This
is the libssh documented expectation.
Do NOT use strings from URL parsing.
Closes#22128
By exposing and reusing existing custom type via `vtls/openss.h`.
Also:
- GHA/curl-for-win: test in CI by enabling building tests.
Cost is 45s per job, so limit it to the gcc job.
Seen with Windows x64 gcc (not tested in CI prior to this patch):
```
tests/libtest/lib1587.c:50:7: error: conversion from 'opt1587' {aka 'long long unsigned int'} to 'long int' may change value [-Werror=conversion]
50 | SSL_CTX_set_options(info->internals, opts);
| ^~~~~~~~~~~~~~~~~~~
tests/libtest/lib1587.c:59:7: error: conversion from 'opt1587' {aka 'long long unsigned int'} to 'long int' may change value [-Werror=conversion]
59 | SSL_set_options(info->internals, opts);
| ^~~~~~~~~~~~~~~
```
Ref: https://github.com/curl/curl/actions/runs/28258372229/job/83727170184?pr=22195#step:3:4884
Ref: da2f05e6f6#22198
Ref: 6163566461#22197
Follow-up to 3e40ccb875#21290
Follow-up to 2db8ae480f#17809#17801Closes#22195
It fails as expected, with a list of errors:
```
In file included from _x64-win-ucrt-for-trurl-bld/tests/tunit/tunits.c:5:
tests/tunit/tool1394.c:76:11: error: call to undeclared function 'parse_cert_parameter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
76 | err = parse_cert_parameter(p->param, &certname, &passphrase);
| ^
[...]
tests/tunit/tool1622.c:68:5: error: call to undeclared function 'timebuf'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
68 | timebuf(buffer, sizeof(buffer), secs);
| ^
[...]
tests/tunit/tool1623.c:104:26: error: call to undeclared function 'GetSizeParameter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
104 | ParameterError err = GetSizeParameter(check[i].input, &output);
| ^
[...]
```
Ref: https://github.com/curl/curl/actions/runs/28256499057/job/83720797064?pr=22195
Ref: #22195
Ref: 640fed88b6Closes#22198
- drop `generated` subdir, move these files to build root.
To move them next to CPack and other config files, and to avoid
a subdirectory for only 2 files.
Follow-up to 69328490fc#2849
- add 'Consumed variables' comment for `CMake/cmake_uninstall.in.cmake`.
- move generated `cmake_uninstall.cmake` to the build root directory
(from `CMake/`). To:
- avoid creating a `CMake` subdirectory within the build directory
with this single file in it.
- move it next to its `cmake_install.cmake` counterpart.
- move it next to `install_manifest.txt` which it relies on.
Follow-up to 27e2a4733c
- Use `PROJECT_SOURCE_DIR` for these files, replacing
`CMAKE_CURRENT_SOURCE_DIR`, to make it consistent with rest of CMake
sources, and to reduce ambiguity in `CMake/cmake_uninstall.in.cmake`
template.
Follow-up to 8198e388d3#22188
Follow-up to 4839029645#22187
Follow-up to 9126eb5a8a#15331Closes#22192
Add the necessary directory to `PATH` instead.
To disable a vcpkg feature (auto-copying DLL dependencies next to the
build targets) that was causing CI flakiness in the libssh2 repository.
In curl it currently cannot cause flakiness because targets (with DLL
dependencies) reside in separate directories.
AFAIU this vcpkg feature has been present and enabled by default for
a long time, but only a recent update made it visible in the log and
flaky at the same time, due to switching implementation.
This patch removes log noise and potential issues, improves efficiency,
and saves disk space: 74MB -> 71 in UWP, and 69MB -> 65 in the arm64 job.
Time saving is negligible with current jobs.
Refs:
https://github.com/libssh2/libssh2/pull/211430a0484cb7https://github.com/microsoft/vcpkg/pull/52315https://learn.microsoft.com/vcpkg/reference/installation-tree-layoutCloses#22189
Use `PROJECT_SOURCE_DIR` for these files, replacing
`CMAKE_CURRENT_SOURCE_DIR`, to make it consistent with rest of CMake
sources and to reflect that the locations of these files are fixed and
do not depend on the CMake source location referencing them.
Exception: keep as-is before calling `project()`, which is where
`PROJECT_SOURCE_DIR` is initialized.
Ref: https://cmake.org/cmake/help/v3.18/command/project.html
Follow-up to #22187
Follow-up to 9126eb5a8a#15331Closes#22188
To make the macro find this file also when used elsewhere than the root
`CMakeLists.txt`. Current code only uses it from the root.
Follow-up to 88c17d5587Closes#22187
- cmp-pkg-config.sh: replace `-r -f` with `-rf` to match rest of repo.
- configure.ac: add double quotes for robustness (not a bug).
- curl-openssl.m4: merge nested `if`s.
- CurlTests.c: drop `!= 0`, also to sync with m4.
- CurlTests.c: replace `example.com` with `localhost` in
`gethostbyname()` feature test code. (compile-only, not a bug)
- GHA/http3-linux: drop literal `true` from bool expression.
- lib650: drop redundant `&`.
- move variable/call to left-hand side of equality checks, where
missing.
- perl: detach `<`/`>` from filename in `open()`, where missing.
- schannel: apply two nit fixes lost in rebase.
- scripts/verify-release: drop redundant double quotes.
- scripts/verify-release: exit with error code on error.
- synctime: replace magic numbers with `sizeof()`.
- telnet: add missing parentheses to macro value.
- tests/Makefile.am: use single quotes.
- tool_operate: drop redundant `break` after `return` in VMS code.
- unit2413: drop unused NULL pointer + free call.
- unit2413: fix duplicate test case name.
- urlapi: drop redundant parentheses.
- urlapi: drop `CURL_UNCONST()` that became redundant.
Closes#22186
A custom header name padded with blanks (`Authorization :`) missed the
exact-length compare and slipped past the cross-host Authorization and
Cookie drop, forwarding the header to the redirect target. Trim the
parsed name in both the request and proxy CONNECT header builders.
Closes#22178
Remove members of `struct urlpieces` that now live in peers/creds.
Change all remaining uses of those urlpieces.
When comparing schemes, use the protocol constants.
Closes#22171
Do not check if a particular connection is alive or not more than once
every second. We did this on every connection reuse which is overkill
when sending many requests to the same host.
Closes#22169
- there is a risk for a nasty recursive situation
- we avoid certain risks that the pause call changes things so that when
returning from the callback, the state of some internals is undefined
and we need to reload which is easy to miss
- we can't think of legitiate use cases for doing this. This is
basically just the new favorite point for AI and security researchers
to find hypothetical problems
Closes#22179
Make an assert and return a plain error instead. No abort in release
code.
- also remove from two examples
- add as a banned function in checksrc
- document the banned state
Closes#22182
- GHA/windows: mention `IgnoreStandardErrorWarningFormat=true`
in comment.
- cmake: fix MIT/GNU GSS order in messages.
- drop some exclamation marks from messages.
- drop redundant ending newlines from messages.
- fold/unfold where possible.
- fix indent, whitespace, typos and other nits.
Closes#22185
In jobs that may benefit from newer tool versions (pyspelling, possibly
CodeQL, CM integration, configure-vs-cmake). Also curl-for-win to match
the curl/curl-for-win repo that also bumped. Bump some Linux jobs to add
variation. Also the rest of `check*` jobs for no particular reason other
than using the latest.
Follow-up to 8f5e4f020e#22097
Follow-up to 139ce4d37c#22096
Follow-up to e44f1a1446#22094Closes#22092
Do not allocated an internal port string, just keep and number and a bit
if it is present. Format the port string in a local buffer when someone
asks for it and copy that.
This avoid the format/alloc penalty when parsing URLs and no one ever
asking for the port string.
(And there will be a method to get the uint16_t value directly in
another PR)
Closes#22167
- Makefile.am: add root `test-quiet` target that maps to
`tests/quiet-test`, for completeness.
Ref: #22098
- tests/Makefile.am: drop unused remains of `MANFILES`.
Follow-up to fa3f889752#17463
Also replace the `distclean` target to delete `CLEANFILES`, otherwise
the CI dist job fails. (I'm not grokking why)
- tests/Makefile.am: sync up `tests` target with CMake, to pass `TFLAGS`
`-a`.
Follow-up to 904e7ecb66#19347
- tests/certs/Makefile.am: fix to clean generated certs via `CLEANFILES`
to comply with autotools documentation, which says the previously used
variable `DISTCLEANFILES` is meant for files created by `./configure`.
Ref: https://www.gnu.org/software/automake/manual/html_node/Clean.html
Follow-up to 44341e736a#16824
- tests/http/Makefile.am: add `./` prefix to glob passed to `rm -rf` on
clean, to avoid deleting unintented files, or pass unintended options.
Follow-up to 671158242d#10349
Cherry-picked from #22102
Cherry-picked from #22150Closes#22154
Where missing. To avoid passing an option by accident.
End-of-option marker (`--`) is not POSIX, but most of these scripts are
internal and/or CI-focused, where this is fine. `maketgz` and
`verify-release` are meant for public use, and I asses this is fine too,
but let us know if this causes issues in real world envs.
Also:
- maketgz: pass args with `:?` to `rm -rf`, where missing.
Cannot cause an actual issue with current code.
- verified `cp`, `rm` instances too, but none were affected.
- tests/cmake/test.sh: replace `$PWD` with `$(pwd)` for sturdiness.
- appveyor.sh: replace `$PWD` with `$(pwd)` for sturdiness.
Assisted-by: Dan Fandrich
Follow-up to 6aab1dc263#19450Closes#22150
Aka `HAVE_GETADDRINFO_THREADSAFE`.
- enable it for OpenBSD 5.4+ (2013-11-01).
Also adjust cmake pre-fill.
- explicitly opt-in DragonFly BSD, for 2.2.0+ (2009-02-17).
Assuming this commit implemented this feature:
21fcee4d6e (diff-498ff649e8770eb9a94e99a399a4b473fcea41ef58b033a2a2dae3809e17bb04)
Prior to this patch it was enabled in autotools by accident, because
its host ID misses `bsd` so the global BSD disable was not applied.
- autotools: fix to enable for Darwin 9+ / macOS 10.5+ (2007-10-26).
Prior to this patch it was Darwin 6 / macOS 10.2.
Source: https://github.com/python/cpython/issues/70112
Ref: https://en.wikipedia.org/wiki/MacOS_version_history
10.5 was the first one UNIX '03 certified, which requires this
feature. iOS and others were forked from this codebase, so they also
have support.
- cmake: add version numbers as comments.
Sadly the OS versions are not verified. This and the autotools logic
could possibly be implemented in `curl-setup.h` more accurately, for
all build systems, without duplicating logic.
Also:
- cmake: `BSD` variable requires CMake 3.25+, add fallback code where
missing.
Ref: https://cmake.org/cmake/help/v3.25/variable/BSD.html
- unix-cache.cmake: stop listing all BSDs for `HAVE_PIPE2`,
and fix generic BSD filter for CMake <3.25.
- unix-cache.cmake: stop listing all BSDs, since it's prefilled anyway
for those via `OtherTests.cmake`.
Ref: https://github.com/curl/curl/pull/22138#issuecomment-4773617195Closes#22148
Remove the suppression of connmon after the first disconnect event. The
connmon flag is set per-test via the 'connection-monitor' server command
and should remain active for the lifetime of that test's connections to
properly detect connection reuse failures.
The suppression was introduced in 510fdad to work around a connection
reuse regression that has since been resolved by the credentials
refactoring in 8f71d0f. With the underlying issue fixed, restoring full
disconnect logging strengthens tests like 338 to catch future
regressions in connection reuse logic.
Fixes#22158Closes#22159
- Bypass cert verification if verifypeer is disabled.
Prior to this change libcurl lacked the ability to bypass certificate
verification for Windows native LDAP (USE_WIN32_LDAP). A comment said
"Win32 LDAP SDK does not support insecure mode without CA!" but I found
that we can bypass the check by setting a verify callback to override
Windows' internal verify check.
Closes https://github.com/curl/curl/pull/22152
py3-impacket, py3-asn1, py3-six and py3-pycryptodomex.
Number of tests run remain 1848 / 1847 for the two jobs respectively.
Number of installed packages go from 158 to 117, and from 177 to 142
(for the two jobs respectively; using different Alpine versions).
Closes#22153
