Commit graph

36518 commits

Author SHA1 Message Date
Daniel Stenberg
d6c39cd2cb
curl.h: remove incorrect comment about CURLOPT_PINNEDPUBLICKEY
Bug: https://curl.se/mail/lib-2025-10/0018.html
Reported-by: curl.stunt430
Closes #19105
2025-10-17 22:23:12 +02:00
Daniel Stenberg
480ff0cf58
INSTALL: update the list of known operating systems
curl has run on

Closes #19106
2025-10-17 22:19:38 +02:00
Viktor Szakats
87b72b8182
krb5: fix output_token allocators in the GSS debug stub (Windows)
Before this patch system `malloc()`/`free()` were used to allocate
the buffer returned in the `output_token` object from the debug stub
of `gss_init_sec_context()` when enabled via `CURL_STUB_GSS_CREDS` in
debug-enabled libcurl builds. This object is later released via stock
`gss_release_buffer()`, which, in the Windows builds of MIT Kerberos,
doesn't use the system `free()`, but the Win32 `HeapFree()`.

Fix it by using the GSS alloc/free macros: `gssalloc_malloc()` and
`gssalloc_free()` from `gssapi_alloc.h`.

To make this work without MIT Kerberos feature detection, use a canary
macro to detect a version which installs `gssapi_alloc.h` for Windows.
For <1.15 (2016-11-30) releases, that do not install it, disable the GSS
debug stub in libcurl.

Strictly speaking, non-Windows builds would also need to use GSS
allocators, but, detecting support for `gssapi_alloc.h` is impossible
without build-level logic. Built-level logic is complex and overkill,
and MIT Kerberos, as of 1.22.1, uses standard malloc/free on
non-Windows platforms anyway. (except in GSS debug builds.)

Follow-up to 73840836a5 #17752

Closes #19064
2025-10-17 17:47:22 +02:00
Daniel Stenberg
25eb34dd3e
KNOWN_BUGS: SOCKS-SSPI discards the security context
Also make the verbose log say it

Pointed out by ZeroPath

Closes #19103
2025-10-17 17:45:06 +02:00
Daniel Stenberg
e9455ea523
rustls: make read_file_into not reject good files
For files with sizes using an exact multiple of 256 bytes, the final
successful read(s) filled the buffer(s) and the subsequent fread
returned 0 for EOF, which caused read_file_into to fail.

Now, it needs to return 0 and not be EOF to be an error.

Follow-up to dd95a49d49

Pointed out by ZeroPath
Closes #19104
2025-10-17 17:44:14 +02:00
Viktor Szakats
373855a4da
GHA/curl-for-win: add minimal Linux build
A bit more minimal build than the one used for trurl. To stress test
a build with most features disabled.

Costs 40 seconds, of which 6 is the build, rest is installing tools.

Ref: 5b385001d5
Ref: 3ee10692c7

Follow-up to 5af2457848 #17818

Closes #17961
2025-10-17 17:27:12 +02:00
Stefan Eissing
5cefb455d4
quic: improve UDP GRO receives
Closes #19101
2025-10-17 17:23:46 +02:00
Stefan Eissing
1d01d4975f
socks_sspi: use the correct free function
When freeing buffers allocated by SSPI, use its own function, not free().

Reported-by: Joshua Rogers
Closes #19046
2025-10-17 16:59:11 +02:00
Viktor Szakats
14e4d9c3c7
setopt: fix unused variable warning in minimal build
Found via: #17961

Closes #19102
2025-10-17 16:19:42 +02:00
renovate[bot]
74147acd17
GHA: update dependency ruff to v0.14.1
Closes #19085
2025-10-17 16:19:42 +02:00
Daniel Stenberg
4fb12f2891
mime: fix use of fseek()
Avoid the possible 64-bit offset truncation when used on systems with
small 'long', like Windows.

bonus: make mime_open_file() return bool

Pointed out by ZeroPath
Closes #19100
2025-10-17 16:13:35 +02:00
Daniel Stenberg
c0564ceb3a
cf-socket: if FD_CLOEXEC fails on accepted socket, cleanup
Follow-up to 9d7b532404

Pointed out by ZeroPath

Closes #19098
2025-10-17 16:12:34 +02:00
Daniel Stenberg
fbff1d5b90
openssl: avoid overwriting 'result' after error
Follow-up to eefd03c572

Pointed out by ZeroPath https://zeropath.com/
Closes #19099
2025-10-17 15:48:47 +02:00
Daniel Stenberg
6296b9d383
tool_ipfs: simplify the ipfs gateway logic
- make sure memory allocated by libcurl is freed with curl_free()

- drop the ensure_trailing_slash complexity

Closes #19097
2025-10-17 15:47:36 +02:00
renovate[bot]
9568109f71
GHA: update ngtcp2/ngtcp2 to v1.17.0
Closes #19092
2025-10-17 14:25:09 +02:00
Daniel Stenberg
3df71e6dc2
openssl: fail if more than MAX_ALLOWED_CERT_AMOUNT certs
Detect and prevent abuse or mistakes. Limit set to 100.

Closes #19091
2025-10-17 13:36:57 +02:00
Stefan Eissing
f221cdeabe
ngtcp2: add a comment explaining write result handling
The choice to continue processing incoming data although the
writeout of the headers/data failed is not obvious. Add a comment
explaining why this is done.

Closes #19093
2025-10-17 13:36:21 +02:00
Stefan Eissing
2719aa36b5
test_16: adjust timing expectations
In MOST protocols and runs, the 'pretransfer' time is less than the
'starttransfer'. E.g. request being sent before response comes in.

However, when curl is starved of cpu a server response might start
streaming in before the multi-state transitioned to DID (and recorded
the 'pretransfer' time).

Do no longer check that 'pretransfer' is less or equal 'starttransfer'.
Check that is is less or equal to the total time instead.

Closes #19096
2025-10-17 13:35:35 +02:00
Daniel Stenberg
e2a4de8a60
openssl: better return code checks when logging cert data
Pointed out by ZeroPath

Closes #19094
2025-10-17 12:41:04 +02:00
Daniel Stenberg
c4db9eb491
rustls: limit snprintf proper in cr_keylog_log_cb()
It should limit the size to the size of the target array, not the
incoming data.

Pointed out by ZeroPath
Closes #19095
2025-10-17 12:38:36 +02:00
Viktor Szakats
3a305831d1
mbedtls: add support for 4.0.0
After this patch libcurl requires (as already documented)
the `curl_global_init()` call when using the `curl_formadd()` API with
mbedTLS.

Note: NTLM is not supported with mbedTLS 4+, because it lacks
the necessary crypto primitive: DES.

Also:
- lib: de-dupe mbedTLS minimum version checks into `curl_setup.h`.
- lib: initialize PSA Crypto as part of `curl_global_init()`.
  For MD5, SHA-256, `curl_formadd()`, and MultiSSL builds with mbedTLS
  but where mbedTLS isn't the default backend.
- lib1308: fix to call `curl_global_init()` (for the Form API).
- curl_ntlm_core: disable with mbedTLS 4+.
- md4: disable mbedTLS implementation when building against 4.x.
- md5: use mbedTLS PSA Crypto API when available, otherwise use
  the default local implementation.
- sha256: use mbedTLS PSA Crypto API when available, otherwise use
  the default local implementation.
- vtls/mbedtls: drop PSA Crypto initialization in favor of
  `curl_global_init()`.
- vtls/mbedtls: use PSA Crypto random API with all mbedTLS versions.
- vtls/mbedtls: do the same for the SHA-256 callback.
- autotools: detect mbedTLS 4+, and disable NTLM for 3.x.
- cmake: disable NTLM for mbedTLS 3.x.
- GHA/linux: keep building mbedTLS 3.x manually and use it in
  an existing job, while also enabling pytest in it.
- GHA/linux: bump to mbedTLS 4.0.0.
  Closes #19075
  Closes #19074

Refs:
https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-4.0.0
https://github.com/Mbed-TLS/mbedtls/blob/mbedtls-4.0.0/docs/4.0-migration-guide.md
https://github.com/Mbed-TLS/mbedtls/blob/mbedtls-4.0.0/tf-psa-crypto/docs/1.0-migration-guide.md [404]
https://github.com/Mbed-TLS/TF-PSA-Crypto/blob/tf-psa-crypto-1.0.0/docs/1.0-migration-guide.md
https://github.com/Mbed-TLS/TF-PSA-Crypto/blob/tf-psa-crypto-1.0.0/docs/psa-transition.md
627f727bbe/docs/4.0-migration-guide

Closes #19077
2025-10-17 11:50:48 +02:00
Daniel Stenberg
7e12139719
imap: treat capabilities case insensitively
Reported-by: Joshua Rogers
Fixes #19089
Closes #19090
2025-10-17 10:40:37 +02:00
Daniel Stenberg
f5f4710a26
examples/websocket: fix use of uninitialized rlen
Pointed out by ZeroPath

Closes #19088
2025-10-17 10:15:07 +02:00
Daniel Stenberg
f91be14bfb
openldap: limit max incoming size
Set the maximum allowed size of an incoming LDAP message, which to
OpenLDAP means that it allows malloc() up to this size. If not set,
there is no limit and we instead risk a malloc() failure.

The limit is arbitrarily set to 256K as I can't figure out what a
reasonable value should be.

OpenLDAP docs: https://openldap.org/software/man.cgi?query=lber-sockbuf&apropos=0&sektion=0&manpath=OpenLDAP+2.6-Release&arch=default&format=html

Bug: https://issues.oss-fuzz.com/issues/432441303
Closes #19087
2025-10-16 22:23:37 +02:00
Viktor Szakats
da06621d61
firefox-db2pem.sh: add macOS support, tidy-ups
Cherry-picked from #19076
Closes #19086
2025-10-16 20:53:28 +02:00
Viktor Szakats
c8aaa5d2f2
scripts: pass -- before passing xargs
Also:
- GHA/checkdocs: escape `.` in -E regex expression.

Closes #19076
2025-10-16 20:45:28 +02:00
Viktor Szakats
3c0604bba4
GHA: sync up curl -V step descriptions
Also to make it easier to recognize.

Also:
- GHA/linux-old: split steps to match other jobs.
- GHA: add `--disable` where missing.

Closes #19084
2025-10-16 20:18:25 +02:00
Viktor Szakats
c8d6643df2
GHA/windows: stop installing Perl Win32-Process* modules
It's complex and did not help stabilizing CI runs.

Hard to say, but I'm suspicious it's related to the CI errors
-1073741502, 0xC0000142, seen in the 'build examples' and
'disk space used' steps.

Ref: #18526
Reverts 52775a7fb4 #18296
Closes #19083
2025-10-16 18:53:44 +02:00
Viktor Szakats
800b0bec18
GHA: bump LibreSSL to 4.2.0
Also move back URLs to GitHub, sources are available there again.

Ref: https://github.com/libressl/portable/releases/tag/v4.2.0
Ref: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.2.0-relnotes.txt
Ref: #19050
Ref: #19081

Closes #19082
2025-10-16 16:51:08 +02:00
Viktor Szakats
1a81a8e478
version: add GSS backend name and version
MIT Kerberos version detection is implemented for autotools and cmake.

Examples:
```
curl 8.17.0-DEV (x86_64-pc-linux-gnu) ... mbedTLS/3.6.4 libidn2/2.3.7 nghttp2/1.59.0 libgss/1.0.4 OpenLDAP/2.6.7
curl 8.17.0-DEV (x86_64-pc-linux-gnu) ... LibreSSL/4.1.1 libidn2/2.3.7 nghttp2/1.59.0 mit-krb5/1.20.1 OpenLDAP/2.6.7
curl 8.17.0-DEV (x86_64-pc-linux-gnu) ... LibreSSL/4.1.1 libidn2/2.3.7 nghttp2/1.59.0 mit-krb5 OpenLDAP/2.6.7
curl 8.17.0-DEV (x86_64-pc-linux-gnu) ... LibreSSL/4.1.1 nghttp2/1.59.0 mit-krb5/1.20.1 OpenLDAP/2.6.7
curl 8.17.0-DEV (aarch64e-apple-darwin24.6.0) ... GnuTLS/3.8.10 libidn2/2.3.8 libssh2/1.11.1 nghttp2/1.67.1 mit-krb5/1.22.1
```

Also:
- cmake/FindGSS: strip project name ("Kerberos 5 release") from
  the version string when detected via `krb5-config`.

Closes #19073
2025-10-16 16:19:05 +02:00
Viktor Szakats
9c36eace60
autotools: drop detection of ancient OpenSSL libs RSAglue and rsaref
Closes #19078
2025-10-16 16:19:05 +02:00
Stefan Eissing
c37ed9a11e
apple sectrust: add to features
It should be visible in the feature list that libcurl is build with
Apple SecTrust enabled.

Closes #19057
2025-10-16 10:58:45 +02:00
Daniel Stenberg
79553fb7c6
RELEASE-NOTES: synced 2025-10-16 09:01:17 +02:00
Daniel Stenberg
71d5525113
connect: remove redundant condition in shutdown start
Pointed out by CodeSonar

Closes #19079
2025-10-16 08:56:16 +02:00
Daniel Stenberg
f8cd64e3ab
urldata: make redirect counter 16 bit
Instead of long (up to 64-bit) as the maximum allowed value set since
b059f7deaf is 0x7fff. Saves 2 or 6 bytes.

Closes #19072
2025-10-15 12:34:33 +02:00
Daniel Stenberg
b7f2355b8b
urldata: make 'retrycount' a single byte
Since it only counts up to 5

Closes #19071
2025-10-15 12:33:03 +02:00
Daniel Stenberg
62961d6cc5
lib: stop NULL-checking conn->passwd and ->user
They always point to a string. The string might be zero length.

Closes #19059
2025-10-15 10:44:51 +02:00
Emre Çalışkan
5e46318414
transfer: reset retry count on each request
Reported-by: plv1313 on github
Fixes #18926
Closes #19066
2025-10-15 10:39:31 +02:00
Stefan Eissing
182a5a9aae
quic: remove data_idle handling
The transfer loop used to check the socket and if no poll events
were seen, triggered a "DATA_IDLE" event into the filters to let
them schedule times/do things anyway.

Since we no longer check the socket, the filters have been called
already and the DATA_IDLE event is unnecessary work. Remove it.

Closes #19060
2025-10-15 10:36:43 +02:00
Daniel Stenberg
be852e39b2
tftp: check for trailing ";mode=" in URL without strstr
RFC 3617 defines two specific modes, "netascii" and "octet". This code
now checks only for those trailing ones - and not in the hostname since
they can't be there anymore.

Assisted-by: Jay Satiro
Closes #19070
2025-10-15 09:59:57 +02:00
Daniel Stenberg
5ac3541cb4
ftp: replace strstr() in ;type= handling
Since it needs to be a trailing piece of the path avoiding strstr() is
faster and more reliable.

Also stopped checking the host name since it cannot actually be there
since quite a long while back. The URL parser doesn't allow such a
hostname.

Moved the check into its own subfunction too.

Closes #19069
2025-10-15 09:19:23 +02:00
Daniel Stenberg
ae5fb4188d
lib: reduce use of data->conn->
If there are more than two of them in a function, use a local 'conn'
variable instead.

Closes #19063
2025-10-15 08:03:29 +02:00
Daniel Stenberg
9441127394
http: look for trailing 'type=' in ftp:// without strstr
- it could find a wrong string
- this is faster

Closes #19065
2025-10-15 08:02:44 +02:00
Jay Satiro
97ae9ec8ef ws: fix type conversion check
- Fix logic that checks whether a size_t will fit in a curl_off_t.

Reported-by: Viktor Szakats

Fixes https://github.com/curl/curl/issues/19017
Closes https://github.com/curl/curl/pull/19036
2025-10-14 11:06:49 -04:00
Jay Satiro
fe06127ded tool_operate: retry on HTTP response codes 522 and 524
- Treat HTTP response codes 522 and 524 as a transient error since
  Cloudflare may use them instead of 504 to signal timeout.

For example here is a 522 error message from Cloudflare:

"The initial connection between Cloudflare's network and the origin web
server timed out. As a result, the web page can not be displayed."

Prior to this change the curl tool did not retry on HTTP response codes
522 and 524 when --retry was used.

Fixes https://github.com/curl/curl/discussions/16143
Closes https://github.com/curl/curl/pull/19011
2025-10-14 11:06:24 -04:00
Viktor Szakats
64ed2ea196
examples: check more errors, fix cleanups, scope variables
Inspired by Joshua's report on examples.

Closes #19055
2025-10-14 16:33:00 +02:00
Daniel Stenberg
61dcb56743
openldap: explain a const removing typecast
Closes #19056
2025-10-14 16:25:34 +02:00
Stefan Eissing
1ea99afdc7
scorecard: add perf support on linux
When calling scorecard with --flame to produce a flamegraph, use
"perf" on linux platforms to do the measurements. Update the scorecard
documentation about it.

Closes #19058
2025-10-14 16:24:35 +02:00
Viktor Szakats
4c7507daf9
examples: improve global init, error checks and returning errors
- add `curl_global_init()` and `curl_global_cleanup()` where missing.
- check the result of `curl_global_init()` where missing.
- return the last curl error from `main()`.
- drop Win32-specific socket initialization in favor of `curl_global_init()`.
- rename some outliers to `res` for curl result code.
- fix cleanup in some error cases.

Inspired by Joshua's report on examples.

Closes #19053
2025-10-13 23:02:05 +02:00
Viktor Szakats
3049c8e0a0
examples: return curl_easy_perform() results
Where missing. Or explicitly `(void)` it where we ignore it on purpose.

Reported-by: Joshua Rogers (for `sepheaders.c`)

Closes #19052
2025-10-13 17:58:30 +02:00