The c-ares header directory was added to the header path within `lib`,
as opposed to every other dependency which added them in the root
`CMakeLists.txt`. Such exception is no longer necessary. This patch
aligns c-ares header setup with the rest of dependencies. And also with
autotools, which also makes no exception here.
Cherry-picked from #17705
Cherry-picked from #16973Closes#17707
Connection filters had a method `get_host()` which had not really been
documented. Since then, the cf had the `query()` method added. Replace
the separate get_host with query.
Add `CF_QUERY_HOST_PORT` as query to connection filters to retrieve
which remote hostname and port the filter (or its sub-filter) is talking
to. The query is implemented by HTTP and SOCKS filters, all others pass
it through.
Add `Curl_conn_get_current_host()` to retrieve the remote host and port
for a connection. During connect, this will return the host the
connection is talking to right now. Before/After connect, this will
return `conn->host.name`.
This is used by SASL authentication.
Closes#17419
Add a bitset `dirty` to the multi handle. The presence of a transfer int
he "dirty" set means: this transfer has something to do ASAP.
"dirty" is set by multiplexing protocols like HTTP/2 and 3 when
encountering response data for another transfer than the current one.
"dirty" is set by protocols that want to be called.
Implementation:
* just an additional `uint_bset` in the multi handle
* `Curl_multi_mark_dirty()` to add a transfer to the dirty set.
* `multi_runsingle()` clears the dirty bit of the transfer at
start. Without new dirty marks, this empties the set after
al dirty transfers have been run.
* `multi_timeout()` immediately gives the current time and
timeout_ms == 0 when dirty transfers are present.
* multi_event: marks all transfers tracked for a socket as dirty.
Then marks all expired transfers as dirty. Then it runs
all dirty transfers.
With this mechanism:
* Most uses of `EXPIRE_RUN_NOW` are replaced by `Curl_multi_mark_dirty()`
* `Curl_multi_mark_dirty()` is cheaper than querying if a transfer is
already dirty or set for timeout. There is no need to check, just do it.
* `data->state.select_bits` is eliminated. We need no longer to
simulate a poll event to make a transfer run.
Closes#17662
- cmake: use `CURL_RCFILES` instead of literal.
- cmake: use `LIB_RCFILES` instead of literal.
- cmake: fix comments.
- autotools: use `CURL_RCFILES` in `EXTRA_DIST`.
- autotools: use `LIB_RCFILES` in `EXTRA_DIST`.
- autotools: fix comments.
- autotools: fix indentation.
Closes#17694
In the unlikely case that no SSH auth methods are supported, the
previous code would return 0 from myssh_in_AUTH_PKEY_INIT. However,
following the code path, it seems like it should be returning SSH_ERROR,
as set in myssh_to_ERROR (through myssh_to_GSSAPI_AUTH,
myssh_to_KEY_AUTH and myssh_to_PASSWD_AUTH).
In actuality, this is unlikely to occur, as the similar code in
myssh_in_AUTHLIST would have already returned an error in this scenario.
However setting a return value and then ignoring it is a bit fishy and
should be documented if this is intended.
I believe this used to return an error, but was changed in the recent
re-factoring of this code.
Closes#17691
Allow prequotes to be sent after curl has changed the working directory,
just before the listing command if the URL is a directory.
FTP state machine is updated with the new FTP_LIST_PREQUOTE state and
FTP_RETR_LIST_TYPE type.
Test 754 verifies
Fixes#8602Closes#17616
Concentrate the handling of KEEP_RECV_PAUSE and KEEP_SEND_PAUSE into
common transfer functions. Setting or clearing these bits requires
subsequent actions involving connection events and client reader/writer
notifications. Have it in one place.
Closes#17650
Used to be a pointer set (and cleared) by the socket connection filters
to a struct in their contexts. Instead, add a filter query method to
obtain the pointer when needed.
Closes#17385
The `#undef` hack is no longer necessary after changing the redifitions
to not map back to the original symbols.
This makes it unnecessary to repeat the redefinitions after compiling
`warnless.c` itself (in unity mode).
Which in turns makes it unnecessary to include `warnless.h` again, to
trigger such redefinition.
This also means that `read`/`write` are now redefined on Windows from
the first inclusion of `warnless.h`.
Also:
- tests/server: drop a repeat `warnless.h` include, that is unnecessary
after this patch.
- tests/unit: drop repeat `warnless.h` include.
- tests/libtest: drop repeat `warnless.h` includes.
- tests/libtest: formatting.
Follow-up to 2f312a14da#17619
Follow-up to 84338c4de2#12331
Follow-up to 6239146e93Closes#17673
Use it from libtests' `first.c` and thus also from units, and tunits.
Also:
- cmake: drop stray `curltool` lib dependency for units.
- units: stop depending on `src` headers.
- tests/server: drop depending on `src` headers.
(the remaining one listed in the comments, `tool_xattr.h`, was not
actually used from servers.)
- tests/server: drop duplicate curlx headers.
(Except `warnless.h`, which is tricky on Windows.)
Closes#17672
To pass `-municode` to the linker. Before this patch we passed this via
`target_link_libraries()` which is designed to pass libraries. Keep
using it for old CMake versions, where no better alternative existed.
https://cmake.org/cmake/help/latest/command/target_link_options.html
Also:
- also pass `-municode` as `PRIVATE` for old cmake versions.
(it should not make a difference because no target depends on the curl
tool, but this seem to be the modern, non-ambiguous syntax.)
- unfold a bunch of split lines for greppability of `add_library()` and
`add_executable()` commands.
- quote a string.
Closes#17670
When checking to expire a transfer with input data pending, also assess
the blocked status and do not EXPIRE_RUN_NOW a transfer that is blocked
on READ/WRITE.
Follow-up to 62349e45a8#17636Closes#17639
When a transfer is done prematurely, a RST is generated to the server,
but was not send right away due to send buffering.
Flush the send buffer in a best effort when transfer is done.
Reported-by: Michael Kaufmann
Fixes#17611Closes#17638
When multi creates the pollset of a transfer, it checks now if
a connection (FIRST/SECONDARY) socket waits on POLLIN and has input data
pending in filters (relevant to OpenSSL's new read ahead). If so, it
triggers a timeout on the transfer via EXPIRE_RUN_NOW.
This fixes sporadic stalls in test 988 when running event based.
Closes#17636
Introduce an immutable `CURL_FOPEN()` macro to store the `fopen()`
mapping on Windows. Then use that instead `(fopen)` from `memdebug.c`.
It makes CURLDEBUG builds use the correct `fopen` wrapper on Windows.
This macro is only defined on Windows, as of this patch.
This is necessary after cde81e4398,
which no longer applies the default `fopen()` override to `memdebug.c`.
Also:
- curl_setup.h: de-dupe, simplify Windows file I/O function overrides.
- curl_memory.h: fix to reset `fopen` to `curlx_win32_fopen()` on
Windows. Before this patch it reset it to stock `fopen()`.
Follow-up to cde81e4398#17631Closes#16747
Before this patch `memdebug.c` was compiled as a separate source in
unity builds. This was necessary because `memdebug.c` failed to compile
if `memdebug.h` was included before it, in `CURLDEBUG` mode. This patch
fixes this issue and allows to compile `memdebug.c` as part of the unity
source batch. This removes an exception and makes builds perform a notch
better.
- introduce `CURL_SCLOSE()` macro as an immutable synonym of `sclose()`.
- memdebug: replace `sclose()` reference with `CURL_SCLOSE()` to compile
as expected when `sclose()` is overridden by `memdebug.h`.
- memdebug: make it not break when including `memdebug.h` before it in
`CURLDEBUG` mode. Do this by calling low-level functions as
`(function)`.
- autotools, cmake: drop memdebug exception, include it like any other
source file. This is now possible because `memdebug.c` doesn't break
if `memdebug.h` was included before it, in `CURLDEBUG` builds.
- mk-unity: drop `--exclude` option. No longer used after this patch.
- drop `MEMDEBUG_NODEFINES` macro hack. No longer necessary.
Ref: #16747Closes#16746Closes#16738Closes#17631
Instead of relying on CMake's built-in unity feature, use `mk-unity.pl`,
as already done with autotools. It simplified the build, shortens logs
and makes debugging easier because of the fewer build variations.
It also allows testing / fixing with cmake and those automatically apply
to autotools builds too. cmake builds can be much-much faster, esp.
when working the builds themselves.
It also enables "unity" in old cmake versions. Basically every test
target is a single generated .c source.
Also:
- drop a `lib` unity workaround for libtests with autotools after fixing
the issue in libtests itself. It drops a few exceptions and makes
libcurl build faster (in autotools unity).
- fix another `lib` autotools unity issue and drop the workaround for it
from `mk-unity.pl`. `srcdir` was missing from the header path.
- simplify `mk-unity.pl` command-lines, drop exclusions.
Follow-up to 2c27a67daa#17590Closes#17628
Both are available with well-known conditions, under non-Windows, and
`curl/curl.h` already uses them. `sys/time.h` is also necessary for
mingw-w64 for `gettimeofday()`.
Follow-up to 56d5982312#17522Closes#17581
Fix building with `--disable-digest-auth`. Make test cases run in such
a build. Add such a build to our CI jobs.
Reported-by: Tristan Perrault
Fixes#17612Closes#17614
When `curl_easy_cleanup()` is invoked while still being part
of a multi handle, the code will auto-remove it. But since the
connection was detached first, the code in
`curl_multi_remove_handle()` that invalidates dirty connections
did not bite.
Attach the connection *after* the possible remove from a multi
handle, so that connection reuse can be prevented.
Add test753 to reproduce and verify the fix. This required adding
the new debug env var CURL_FTP_PWD_STOP, to have a transfer return
from multi_perform() early with a connection that does not show
and pending input.
Reported-by: Brian Harris
Fixes https://github.com/curl/curl/issues/17578
Closes https://github.com/curl/curl/pull/17607
- Return CURLE_OK if the engine successfully loaded.
Prior to this change:
When loading an openssl engine, the result code is initialized to
CURLE_SSL_ENGINE_NOTFOUND, but is never set to CURLE_OK when the engine
was successfully loaded. This causes curl to error out, falsely stating
engine not found when it actually was.
Broken since f2ce6c46 (precedes 8.14.0) which added support for using
engines and providers at the same time.
Fixes https://github.com/curl/curl/issues/17617
Closes https://github.com/curl/curl/pull/17618
- Align --cacert behaviour with OpenSSL and LibreSSL.
This changes the default behavior of Schannel manual certificate
verification, which is used when the user provides their own CA
certificates for verification, to accept partial chains. In other words,
the user may provide an intermediate certificate without having to
provide the root CA.
Win8/Server2012 widened the PKIX chain traversal API to allow
certificate traversal to terminate at an intermediate.
This behaviour (terminate at the fist matching intermediate) is the
default for LibreSSL and OpenSSL (with OpenSSL allowing control via
CURLSSLOPT_NO_PARTIALCHAIN).
This change uses the new API if it is available, and also allows the
behaviour to revert legacy if CURLSSLOPT_NO_PARTIALCHAIN is present.
Closes https://github.com/curl/curl/pull/17418
Make test bundles the default. Drop non-bundle build mode.
Also do all the optimizations and tidy-ups this allows, simpler builds,
less bundle exceptions, streamlined build mechanics.
Also rework the init/deinit macro magic for unit tests. The new method
allows using unique init/deinit function names, and calling them with
arguments. This is in turn makes it possible to reduce the use of global
variables.
Note this drop existing build options `-DCURL_TEST_BUNDLES=` from cmake
and `--enable-test-bundles` / `--disable-test-bundles` from autotools.
Also:
- rename test entry functions to have unique names: `test_<testname>`
This removes the last exception that was handled in the generator.
- fix `make dist` to not miss test sources with test bundles enabled.
- sync and merge `tests/mk-bundle.pl` into `scripts/mk-unity.pl`.
- mk-unity.pl: add `--embed` option and use it when `CURL_CLANG_TIDY=ON`
to ensure that `clang-tidy` does not miss external test C sources.
(because `clang-tidy` ignores code that's #included.)
- tests/unit: drop no-op setup/stop functions.
- tests: reduce symbol scopes, global macros, other fixes and tidy-ups.
- tool1621: fix to run, also fix it to pass.
- sockfilt: fix Windows compiler warning in certain unity include order,
by explicitly including `warnless.h`.
Follow-up to 6897aeb105#17468Closes#17590
`SSL_pending()` only checks if the *current* TLS packet has more data.
There might be more data in SSL's buffers.
`SSL_has_pending()` only checks if there is data in buffers, but does
*not* check if there is a complete TLS packet that can be decoded.
If we only check the first, we will poll on socket events without having
processed all data and may stall. If we only check the second, we would
busy loop without SSL_read() ever giving something.
Add the flag `connssl->input_pending` that is set on incoming data in
the BIO receive. Clear the flag when encountering a CURLE_AGAIN on
the filters receive (via SSL_read()) or see an EOF.
Ref: #17596Closes#17601
The secure transport vTLS backend was the only Curl_ssl struct instance
that populated the false_start field. Since its removed, we can now
remove that field entirely. This was a protocol feature specific to TLS
1.2 that has been replaced by the more widely adopted TLS 1.3 early data
mechanisms.
--false-start is now deprecated
Closes#17595
Since the code now checks for NULL and returns before this point, 'ntlm'
cannot be NULL at this point in the code. Pointed out by Coverity.
Follow-up to 5586520745Closes#17587
cfilter/conn: change send/recv function signatures. Unify the
calling/return conventions in our send/receive handling.
Curl_conn_recv(), adjust pnread type
Parameter `pnread` was a `ssize_t *`, but `size_t *` is better since the
function returns any error in its `CURLcode` return value.
Closes#17546
Convert the debug-only handling of SSL_ERROR_SYSCALL so that it is
enabled in all builds with openssl. This should not make a difference in
supported OpenSSL versions, but if whatever version or fork we link
against *does* return SSL_ERROR_SYSCALL, handle this as a fatal error.
Fixes#17471
Reported-by: Michael Kaufmann
Closes#17531
The checks for a connection being "too long idle" or "too old" where
rounding down the elapsed time to seconds before comparing to the
configured max values. This caused connections to be reused for up to
999ms longer than intended.
Change the compares to scale the configured seconds up to ms, so
connection will properly be "too old" 1 ms after the coonfigured values.
Fixes sporadic failures of test1542 on platforms where "sleep(2)"
returnes before 2 full seconds on the internal clock where passed.
Reported-by: Christian Weisgerber
URL: https://curl.se/mail/lib-2025-06/0004.htmlCloses#17571
These libraries do not support TLS 1.3 and have been marked for removal
for over a year. We want to help users select a TLS dependency that is
future-proof and reliable, and not supporting TLS 1.3 in 2025 does not
infer confidence. Users who build libcurl are likely to be served better
and get something more future-proof with a TLS library that supports
1.3.
Closes#16677
Delete macros from `curl_config.h.cmake` that were never set by
the CMake script: `_LARGE_FILES`, `_THREAD_SAFE`, `const`, `size_t`.
Also:
- lib/config-riscos.h: drop `#undef _LARGE_FILES`. This is an
IBM-specific macro, no need to unset it on other platforms.
Cherry-picked from #17576Closes#17580
