To avoid generator expressions. Generator expresson do not work with
curl_clang_tidy_tests() macro, resulting in an empty `-D` option and
breaking clang-tidy:
```
error: macro name must be an identifier [clang-diagnostic-error]
```
https://github.com/curl/curl/actions/runs/15938223758/job/44962176793?pr=17768#step:14:337
But, curl/curl.h behaves the same on non-Windows with tests/server with
and without CURL_STATICLIB, making it safe to pass for all platforms.
Before this patch we explicitly linked the full list of libcurl
dependency libs to tests and examples via `CURL_LIBS`. This was
redundant, because test and example code do not directly use these
dependency libs and for indirect use they are implicitly passed
via libcurl as needed. After this patch, tests and examples only link
explicitly to system libs (e.g. socket).
Also bringing it closer to how `./configure` does this.
Borrow the variable name `CURL_NETWORK_AND_TIME_LIBS` from
`./configure`. However, its content is not exactly the same. With cmake
it also holds `pthread`, but doesn't hold AmiSSL.
Closes#17696
Fix compile error when building with `--disable-verbose`.
Adjust pytest to skip when curl is not a debug build but needs
traces.
Follow-up to b453a447ceCloses#18053
Now that multi keeps the "dirty" bitset, the detection of possibly
stalling transfers needs to adapt. Before dirty, transfers needed
to expose a socket to poll or a timer to wait for.
Dirty transfer might no longer have a timer, but will run, so do
not need to report a socket. Adjust the assert condition.
Fixes#18046
Reported-by: Viktor Szakats
Closes#18051
This patch bumps the size of these constants from `int` to `long`, while
keeping their actual values the same. It may cause incompatibilities in
user code, requiring the bump of holder variables and/or adding casts:
- CURLFTP_CREATE_DIR
- CURLFTP_CREATE_DIR_NONE
- CURLFTP_CREATE_DIR_RETRY
- CURLFTPAUTH_DEFAULT
- CURLFTPAUTH_SSL
- CURLFTPAUTH_TLS
- CURLFTPMETHOD_DEFAULT
- CURLFTPMETHOD_MULTICWD
- CURLFTPMETHOD_NOCWD
- CURLFTPMETHOD_SINGLECWD
- CURLFTPSSL_CCC_ACTIVE
- CURLFTPSSL_CCC_NONE
- CURLFTPSSL_CCC_PASSIVE
Also:
- keep existing casts within the documentation to make sure it applies
to older curl versions as well.
Closes#17797
Also:
- CURLOPT_HSTS_CTRL.md: sync macro definitions with `curl/curl.h`.
Perhaps it'd be better to delete copies like this?
- keep existing casts within the documentation to make sure it applies
to older curl versions as well.
- CURLOPT_IPRESOLVE.md: re-add a long cast to man page, for consistency
with the above.
Closes#17791
These introduced *hundreds* of lines of output in a single test run.
I think this also shows strict+warnigns in perl in their most annoying
way.
Follow-up to 2ec54556d4Closes#18048
Syncing winbuild and VS Project File builds with the same fix applied
to cmake and autotools builds earlier.
Also fixes these warnings seen in the VisualStudioSolution (VS2013) job
on AppVeyor CI:
```
lib\hostip.c(148): warning C4090: 'function' : different 'const' qualifiers
lib\hostip.c(155): warning C4090: 'function' : different 'const' qualifiers
```
Ref: https://ci.appveyor.com/project/curlorg/curl/builds/52470650/job/gslnjrdxnd8b9mtv#L180
Went unnoticed because warnings are not promoted to error in these builds.
winbuild CI jobs did not hit this warning for some reason.
Follow-up to 8537a5b0bc#16577Closes#18045
Do not declare local inet_pton/inet_ntop implementations when they are
not used. In this case the same symbol is defined as a macro and mapped
to the system implementation.
Syncing this with their definitions.
Closes#18043
```
Use of uninitialized value $errors in exit at .github/scripts/badwords.pl line 87.
Use of uninitialized value $o in concatenation (.) or string at ../.github/scripts/randcurl.pl line 99.
```
Follow-up to 2ec54556d4#17877
Cherry-picked from #18042Closes#18047
Some GNU C version guards implicitly include the clang compiler, because
clang reports itself as GCC 4.2.1.
This implicit inclusion doesn't happen if the guard requires a GCC
version above 4.2.1.
Fix two such guards to explicitly include clang where it does support
the guarded feature:
- curl/curl.h: use `typecheck-gcc.h` with clang.
llvm clang v14+ supports this. The corresponding Apple clang version
is also v14.
Ref: https://en.wikipedia.org/wiki/Xcode#Toolchain_versions
Apple clang v14 tested OK in CI:
https://github.com/curl/curl/actions/runs/16353901480/job/46207437204
- tool_urlglib: use `__builtin_mul_overflow()` with clang v8+.
llvm clang v3.8+ supports this, but to accommodate for Apple clang,
start with v8, the Apple version having the mainline v3.8 feature set.
Also fix compile warnings triggered by the above:
- lib1912: fix duplicate `;`:
```
tests/libtest/lib1912.c:44:57: error: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Werror,-Wextra-semi-stmt]
44 | print_err(o->name, "CURLOT_LONG or CURLOT_VALUES");
| ^
[...]
```
Ref: https://github.com/curl/curl/actions/runs/16351302841/job/46198524880?pr=17955#step:12:61
- lib2032: silence typcheck warning with a cast:
```
tests/libtest/lib2032.c:145:29: error: sizeof on pointer operation will return size of 'CURL **' (aka 'void **') instead of 'CURL *[3]' (aka 'void *[3]') [-Werror,-Wsizeof-array-decay]
145 | ntlm_easy + num_handles);
| ~~~~~~~~~ ^
```
Ref: https://github.com/curl/curl/actions/runs/16351302841/job/46198524880?pr=17955#step:12:86Closes#17955
When a multiplex connection (h2/h3) is shutdown by the server, the
reported number of parallel transfers allowed drops to 0.
Determine that when the last transfer is done and terminate the
connection instead of keeping it in the cache.
We detect the drop to 0 also when we try to reuse such a connection, but
if we know this at the time the last transfer is done, we better
terminate it right away.
Have a consistent trace logging to this with the connections current
hostname and port. Adjust test expectations to carry port numbers.
Closes#17884
- add 'use warnings' and 'use strict' where missing from Perl scripts.
- fix 'Use of uninitialized value'.
- fix missing declarations.
- test1140.pl: fix 'Possible precedence issue with control flow operator'.
- fix other misc issues.
Most actual errors found during this PR were fixed and merged via
separate PRs.
Likely there are remaining warnings not found and fixed in this PR.
Closes#17877
Collision happens when building with mingw-w64 v3 or v2 while targeting
Vista or newer. `iphlpapi.h` includes `windns.h` in this case, which
defines macros named `DNS_TYPE_*`, colliding with curl doh enums.
The issue was fixed in mingw-w64 v4:
ea95d55e33
Fixes:
```
lib/doh.h:54:3: error: expected identifier before numeric constant
DNS_TYPE_A = 1,
^
```
Ref: https://github.com/curl/curl/actions/runs/16551209676/job/46806303365?pr=18009#step:10:17
This workaround seems harmless and generally good practice, but
another option is to require mingw-w64 v4.
Ref: #18009Closes#18041
If the long option name ends with an equals sign (`=`), the argument is
the text following on its right side.
This makes the command line parser accept this common style in addition
to the existing way to accept option arguments more similar to how other
command line tools do.
Example: `curl --user-agent=curl-2000 https://example.com/`
Change a few existing tests to use this syntax: 206, 1333, 1335, 1442
Closes#17789
This still allows users to explictily ask for 1.0 or 1.1 as the minimum
version. If the TLS library allows it.
Starting with this change, the CURL_SSLVERSION_DEFAULT value is no
longer used as minimum version when the TLS backend are called.
This also makes curl set the minimum version to 1.2 independently of
libcurl for the rare case where a newer curl tool would use an older
libcurl.
URL: https://curl.se/mail/lib-2025-07/0007.html
Assisted-by: Stefan Eissing
Closes#17894
- GHA/windows: disable building certs in the MSVC job that's not running
tests. Saves 4-5 seconds for MSVC, makes logs shorter for the rests.
- GHA/linux: build tests in two more jobs (LTO, CM Rustls), 5s each.
- GHA/linux: skip 'install test prereqs' for `skiprun` jobs.
(there were no such jobs before this patch.)
Closes#18034
This became an issue after promoting curl compiler warnings to errors in
curl-for-win. The code is correct. It over-allocates a struct to store
variable sized data past its length. Similar code is present in
`lib/smb.c`, silenced earlier.
Seen in linux-musl-debian-testing-gcc curl-for-win builds, gcc 14.2.0,
RISC-V (but not amd64/aarch64), unity, debian:testing (trixie):
musl:
```
In file included from /curl/_r64-linux-musl-bld/lib/CMakeFiles/libcurl_object.dir/Unity/unity_0_c.c:184:
In function 'Curl_http_req_make',
inlined from 'Curl_http_proxy_create_CONNECT' at /curl/lib/http_proxy.c:252:12:
/curl/lib/http.c:4373:3: error: 'memcpy' offset [137, 142] from the object at 'req' is out of the bounds of
referenced subobject 'method' with type 'char[1]' at offset 136 [-Werror=array-bounds=]
4373 | memcpy(req->method, method, m_len);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /curl/lib/urldata.h:182,
from /curl/lib/altsvc.c:32,
from /curl/_r64-linux-musl-bld/lib/CMakeFiles/libcurl_object.dir/Unity/unity_0_c.c:4:
/curl/lib/http.h: In function 'Curl_http_proxy_create_CONNECT':
/curl/lib/http.h:230:8: note: subobject 'method' declared here
230 | char method[1];
| ^~~~~~
```
Ref: https://github.com/curl/curl/actions/runs/16527769182/job/46745369844?pr=18025#step:3:5798
Ref: https://github.com/curl/curl-for-win/actions/runs/16525969694/job/46739239206#step:3:5958
glibc (with unity batch):
```
In file included from /usr/riscv64-linux-gnu/include/string.h:548,
from /curl/lib/curl_setup_once.h:33,
from /curl/lib/curl_setup.h:823,
from /curl/lib/http.c:25,
from /curl/_r64-linux-gnu-bld/lib/CMakeFiles/libcurl_object.dir/Unity/unity_2_c.c:4:
In function 'memcpy',
inlined from 'Curl_http_req_make' at /curl/lib/http.c:4373:3,
inlined from 'Curl_http_proxy_create_CONNECT' at /curl/lib/http_proxy.c:252:12:
/usr/riscv64-linux-gnu/include/bits/string_fortified.h:29:10: error: '__builtin_memcpy' offset [137, 142]
from the object at 'req' is out of the bounds of
referenced subobject 'method' with type 'char[1]' at offset 136 [-Werror=array-bounds=]
29 | return __builtin___memcpy_chk (__dest, __src, __len,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
30 | __glibc_objsize0 (__dest));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /curl/lib/urldata.h:182,
from /curl/lib/http.c:50:
/curl/lib/http.h: In function 'Curl_http_proxy_create_CONNECT':
/curl/lib/http.h:230:8: note: subobject 'method' declared here
230 | char method[1];
| ^~~~~~
```
Ref: https://github.com/curl/curl-for-win/actions/runs/16538174468/job/46775731055#step:3:5936
Ref: f45df099f3
Follow-up to 14f26f5ee7#16187
Cherry-picked from #18025Closes#18030
ngtcp2 1.14.0 added crypto dependencies to the ngtcp2 crypto `.pc`
files. It broke GHA builds, because how curl's `configure` is setting up
the per-dependency custom prefixes for pkg-config.
`configure` uses `PKG_CONFIG_LIBDIR` to set per-dependency custom
prefixes, as specified via `--with-ngtcp2=<custom-dir>`. In classic
`pkg-config` this overrides any previously configured `PKG_CONFIG_DIR`.
This in turn break detecting transitive pkg-config modules unless they
are found at locations `pkg-config` is searching by default. This
doesn't affect `pkgconf` because it appends `PKG_CONFIG_LIBDIR` to
the custom `PKG_CONFIG_DIR`, according to its man page.
It may make sense to fix this in`acinclude.m4`, to make sure to honor
global custom pkg-config paths while detecting components at custom
locations, regardless of pkg-config implementation. But this PR doesn't
do this.
Instead it drops the ngtcp2 custom path and lets detection rely on
`PKG_CONFIG_DIR` that's already set up for all custom-built dependencies
anyway.
Also:
- fix `openssl-quic` job to use the custom-built nghttp2 (like other
jobs do) instead of the system default.
- configure nghttp3 via `PKG_CONFIG_DIR` in the `openssl-quic` job,
to sync with other jobs. And drop `--with-nghttp3` option.
cb9b1a4c4e/acinclude.m4 (L1376-L1381)https://manpages.debian.org/unstable/pkg-config/pkg-config.1.en.htmlhttps://man.archlinux.org/man/pkgconf.1.en
Ref: https://github.com/ngtcp2/ngtcp2/pull/1689#issuecomment-3121576712Closes#18022Closes#18028
```
../../lib/vquic/curl_osslq.c:1091:1: error: missing initializer for field 'recv_origin' of 'nghttp3_callbacks' [-Werror=missing-field-initializers]
1091 | };
| ^
In file included from ../../lib/vquic/curl_osslq.c:33:
/home/runner/nghttp3/build/include/nghttp3/nghttp3.h:2082:23: note: 'recv_origin' declared here
2082 | nghttp3_recv_origin recv_origin;
| ^~~~~~~~~~~
```
Ref: https://github.com/curl/curl/actions/runs/16527325587/job/46743893924?pr=18021#step:18:35
Follow-up to 1055144063#18019Closes#18026
