Remove the suppression of connmon after the first disconnect event. The
connmon flag is set per-test via the 'connection-monitor' server command
and should remain active for the lifetime of that test's connections to
properly detect connection reuse failures.
The suppression was introduced in 510fdad to work around a connection
reuse regression that has since been resolved by the credentials
refactoring in 8f71d0f. With the underlying issue fixed, restoring full
disconnect logging strengthens tests like 338 to catch future
regressions in connection reuse logic.
Fixes#22158Closes#22159
- Bypass cert verification if verifypeer is disabled.
Prior to this change libcurl lacked the ability to bypass certificate
verification for Windows native LDAP (USE_WIN32_LDAP). A comment said
"Win32 LDAP SDK does not support insecure mode without CA!" but I found
that we can bypass the check by setting a verify callback to override
Windows' internal verify check.
Closes https://github.com/curl/curl/pull/22152
py3-impacket, py3-asn1, py3-six and py3-pycryptodomex.
Number of tests run remain 1848 / 1847 for the two jobs respectively.
Number of installed packages go from 158 to 117, and from 177 to 142
(for the two jobs respectively; using different Alpine versions).
Closes#22153
- add autotools jobs for MidnightBSD, NetBSD, OpenBSD.
Takes under 3 minutes per new job, under +6m in total.
- comment out MidnightBSD to save CI time.
- to make them as fast as possible, skip building tests and examples,
and omit libidn2, openldap dependencies.
- add DragonFly BSD cmake job, which finally works.
(keep it commented out since the package server fails frequently.)
- do `mport index/upgrade` to make MidnightBSD autotools builds work.
- rework filtering MidnightBSD package manager's excessive log output.
- fixup OpenBSD autotools job to uninstall system curl to avoid linking
against it (and breaking debug builds).
- make OpenBSD package manager commands non-interactive.
- specify install packages for each matrix entry.
- make autotools build step verbose (to ease debugging).
- add link to DragonFly BSD package repo.
- bump cross-platform-actions from 1.1.0 to 1.3.0.
- bump FreeBSD 15.0 to 15.1.
- bump OpenBSD to 7.7 to 7.9.
This did not go well last time with 7.8, let's see with 7.9.
Ref: 8d00e28136#19372
Ref: c3b890b2c0#19368
- sync test-skipper keywords with rest of workflows.
- drop installing impacket. It was unused.
(also a slow install with many dependencies)
The original motivation was to prepare fixing OpenBSD's (and possibly
other platforms) `getaddrinfo()` thread-safety check.
Ref: https://github.com/curl/curl/pull/22138#issuecomment-4773617195Closes#22145
Also put the version number in quotes to avoid GHA altering the number
into `0.68` (without rightmost zero) and ending up storing that in the
`FIL_C_VERSION` env.
Hopefully Renovate will honor this on future bumps.
Do the same for the rest of `x.y` format version numbers.
Fixing:
```
env:
[...]
FIL_C_VERSION: 0.68
```
Ref: https://github.com/curl/curl/actions/runs/28006009260/job/82920767558?pr=22142#step:5:16Fixes#22142Closes#22143
The buffer is freed on the next instruction via `Curl_meta_remove()`'s
destructor.
Reported-by: netspacer.research
Follow-up to 1ebd92d0fd#16384Closes#22133
If any sublabel is longer than 63 octets, abort. This then also catches
compression attempts.
Verified in test 1658
Reported-by: netspacer.research
Closes#22124
To avoid mistakes or abuse to cause problems. Many public DNS providers
cap their cache times to this.
Verify in test 1650
Reported-by: netspacer.research
Closes#22122
When the HTTP Upgrade to websockets already carries ws frame data,
buffer that data at connection level and not in the ws decoder.
Adding new cfilter `cf_recvbuf` to buffer a fixed amont of data
to be received later. When the data is received, the filter
passes further recv call through to its subfilter.
Fixes#22107
Reported-by: sideshowbarker on github
Closes#22111
Fix a regression in curl 8.21.0-rc3: Check whether the host and the "connect
to host" are equal before initializing the proxy. If they are equal, switching
to tunnel mode is not necessary.
Follow-up to 73daec6Closes#22110
This option is used for both TLS and SSH so it needs to be handled
even in TLS-disabled builds
Mention this in the man page as well.
Follow-up to 52fa8d9
Pointed out by Codex Security
Closes#22121
- "cmake outputs: no version information available"
Ref: #11158
Seems to be about missing support for autotools `--enable-versioned-symbols`.
This was implemented for CMake in:
14d4712db7#170397100c5bc9b#148187b14449790#14378
- "generated `.pc` file contains strange entries"
Ref: #6167
Fixed in:
9f56bb608e#14681
- "CMake build with MIT Kerberos does not work"
Ref: #6904
The FindGSS module responsible for MIT Kerberos detection has seen 50
updates since this report. In the last years I made many local tests
with it, and it's also extensively CI-tested since (including Windows
for a 1-year period), with no known issues.
If you see problems remaining, let us know in a new issue.
Closes#22108
And the corresponding internal variable.
This option became the always-enabled default earlier, via #4035.
Reported-by: Zartaj Majeed
Ref: #22098
Follow-up to 6617db6a7e#4035Closes#22100
Before this patch it broke clang 20/21 cmake builds on ubuntu-26.04-arm
runner, failing at the beginning of the configure stage while probing
the compiler.
Seen in the 'CM openssl clang krb5 LTO' job:
```
: && /usr/bin/clang --target=aarch64-pc-linux-gnu CMakeFiles/cmTC_3d9ae.dir/testCCompiler.c.o -o cmTC_3d9ae && :
/usr/bin/aarch64-linux-gnu-ld.bfd: cannot find crtbeginS.o: No such file or directory
/usr/bin/aarch64-linux-gnu-ld.bfd: cannot find -lgcc: No such file or directory
/usr/bin/aarch64-linux-gnu-ld.bfd: cannot find -lgcc_s: No such file or directory
```
Ref: https://github.com/curl/curl/actions/runs/27778098314/job/82195462687#step:38:66
Follow-up to 36bd807475#15242
Follow-up to 232302f88a#14382
Cherry-picked from #22092Closes#22097
pytype is discontinued, does not receive further updates, and it
requires older python, offered by Ubuntu 24.04 or older.
Move it to its own GHA job to allow bumping the rest of checkers to.
newer runner images. Also move it out from the shared `requirements.txt`
and install directly from its separate GHA job, to avoid installing it
unnecessarily from others. Since it does not receive update, it's fine
to move out from Dependabot's view.
Ref: https://pypi.org/project/pytype/
Cherry-picked from #22092Closes#22096
The header path matches these prefixes case sensitively, as 5af0165562
made it for cookie spec reasons, but the Netscape cookie-file path still
used a case-insensitive match. Align the file path so a differently
cased name like __secure-x is treated as an ordinary cookie instead of
being put through the prefix integrity checks.
Extended test 2311 to cover it.
Closes#22085
Seen with clang-22:
```
lib/vtls/openssl.c:3538:14: error: implicit conversion from 'int' to enumeration type 'CURLcode' is invalid in C++ [-Werror,-Wimplicit-int-enum-cast]
3538 | result = SSL_ech_set1_server_names(octx->ssl,
| ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3539 | peer->origin->hostname, outername,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3540 | 0 /* do send outer */);
| ~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
```
Ref: https://github.com/curl/curl/actions/runs/27769068896/job/82163712258#step:42:43
Cherry-picked from #22086Closes#22087
