The curl tool was creating a new transfer every time it checked if
it needed to add one to reach max parallelism. This led to eventually
all configured transfers to have easy handles created.
Limit the creation again to the ones needed for max parallelism.
scorecard.py: set --out-null only for curl versions that support it
Closes#22277
Homebrew is distributing v5.9.2 at the time of this commit, which
contains known regression failing to parse the server certificate.
The fix has been merged upstream. Till it makes it into a release
and Homebrew, ignore test results for 311.
Refs:
https://github.com/wolfSSL/wolfssl/pull/107937dd269fc52
Follow-up to 03f9751585#22204#22175#22160Closes#22269
Note: Renovate strips pre-existing quotes from the YAML version value.
This breaks the bump next time its version is ending with zero(s).
Ref: 78267398e5#22143#22142Closes#22267
The test provides an invalid username, but no ':' with password, so that
the curl tool tries to read the password from stdin. That makes the test
hang, also in CI.
The check for invalid characters is happening when the CURLOPT_USERPWD
is applied to the URL, so when the transfer is started. Maybe the check
should happen also in setopt already.
The test hangs because tool_paramhlp.c:548 `checkpasswd()` does not see
a ':' and tries to read the password from stdin.
Fix: add a ':' in the tests invalid user setting, so that the read does
not happen.
Follow-up to ecaa344a7aCloses#22264
Add support for the native GSS Framework on Apple targets, which is
Apple's fork of Heimdal. This option allows to drop Apple's deprecated
MIT Kerberos compatibility shim "mit-krb5/1.7-prerelease".
Source code uses different headers, other than that no source changes
are necessary.
You can enable by configuring with:
autotools: `--enable-gssapi-apple`
CMake: `-DCURL_USE_GSSAPI=ON -DCURL_GSS_FLAVOR=Apple`
These options are experimental, and may receive breaking updates till
the GSS backend selection logic settles, for Apple and also for the GNU
and MIT implementation.
Version string:
```
curl 8.21.0-DEV (aarch64-apple-darwin25.4.0) libcurl/8.21.0-DEV
OpenSSL/3.6.2 zlib/1.2.12 AppleIDN AppleGSS OpenLDAP/2.4.28/Apple
```
Also:
- drop in-source deprecation warning suppressions when using AppleGSS.
- GHA/macos: enable Apple GSS in CI jobs.
Supported by:
iOS 5.0+, iPadOS 5.0+, Mac Catalyst 13.0+, macOS 10.14+, visionOS 1.0+
Ref: https://developer.apple.com/documentation/gss
Ref: #19109Closes#22052
The nroff (man page) version of the markdown docs could get asterisks
mistreated as emphasis - seen in the CURLOPT_WRITEDATA manpage. The
regex now more stricter requires a word character to follow an italics
starting asterisk and there needs to be a word character or a closing
parenthesis before the italics ending asterisk.
Also: fix CURLINFO_CERTINFO.md which used wrong italics - it was not
rendered correctly on GitHub and with other generic markdown parsers.
Reported-by: Christian Ullrich
Fixes#22257Closes#22260
Syncing it with CMake/FindWolfSSL.
`-lm` is not needed on Windows. As of mingw-w64 14.0.0 it's offered as
a dummy library; in such case it wasn't causing an actual issue.
`-lcryp32` is necessary when linking wolfSSL statically.
Ref: #22249Closes#22251
FTP servers using SSL can be configured to check TLS session reuse on
the DATA connection. They hand out a new session on every CONTROL
connect and require to see the client using exactly that one when
up-/downloading on DATA.
This means:
1. We have to configure the SSL filter on the DATA connection with
exactly the same peers.
2. We have to remember the SSL session on the CONTROL connection -
separately from the session cache. The SSL filter on the DATA
connection then looks for a session at the CONTROL filter and, if
present, uses that.
Tests:
Enable `require_ssl_reuse` in our pytest setup for vsftpd. This
reproduces the problem reported in #22225 and verifies the fix.
Skip ftp+SSL pytests for rustls, as we have no possibility to reuse
sessions in that backend.
Schannel: we do not run these tests with the backend. I expect it has
similar problems but am not able to verify.
Reported-by: Laurent Sabourin
Fixes#22225Closes#22246
- make the libssh backend do the same fallback for private and public key
filename as libssh2 already did and is documented behavior. This now uses a
common function.
- set the file names already in setup_connection if public key auth is
requested, so that the connection reuse functions can use the
information when checking for existing connections to reuse
- rename the oddly named struct fields 'rsa' to 'priv_key' and 'rsa_pub'
to 'pub_key' to better reflect their purposes
Fixes#22243Closes#22244
To make it clear what they are and according to our styleguide.
- Curl_cf_ip_happy_insert_after
- Curl_ftp_conns_match
Found with:
$ nm lib/.libs/libcurl.a | grep ' T ' | grep -vi ' curl'
Closes#22245
When TLS is verified via Apple SecTrust, openssl internal state is a
verification faiure (that is how it works, we use sectrust when openssl
fails to verify and natice ca store is enabled).
OpenSSL stores this verification status inside its TLS session objects.
On reuse, we see an unverified session and do not reuse it for a
verified connect attempt. While this is a performance penalty for most
connections, it *fails* on ftps:// transfers where servers expect
session reuse on DATA connections.
Fix this by remembering that TLS and a session was verified by sectrust
and allow reuse of such sessions for new connect attempts that also use
sectrust.
Closes#22235
- updates `actions/cache` from 5.0.5 to 6.1.0
- updates `actions/checkout` from 6.0.2 to 7.0.0
- updates `github/codeql-action/analyze` from 4.36.0 to 4.36.2
- updates `github/codeql-action/init` from 4.36.0 to 4.36.2
- updates `msys2/setup-msys2` from 2.31.1 to 2.32.0
Closes#22239
These are generated for every PR and master pushes. Retain for 3 days.
Size is 1.8MB zipped per artifact. (Takes 1 second extra job time.)
Ref: #22162
Ref: 1b0e3569b3Closes#22234
Add classic tests 3223-3226 and extend tests/http/test_12_reuse.py so that
connection reuse decisions are explicit:
- partial/aborted HTTP/1.1 responses must not reuse the connection
(premature multi_done closes non-multiplexed conns)
- different target hostnames must not share a connection even when they
resolve to the same address (url_match_destination)
- HTTP Basic credentials are per-request (PROTOPT_CREDSPERREQUEST), so
different -u values still reuse; assert that with num_connects
- same host positive control reuses (num_connects 1 then 0)
Closes#22224
A sasl zero-length normal response is an empty string, unlike an initial
response. Since the encoding of a zero-length initial response is
protocol dependent, move its handling to the protocol-specific sendauth
procedure. Similarly, do not check for an '=' server message, as this
should normally never occur.
Update the erroneous tests accordingly.
Closes#22218
A gzip Content-Encoding response holding more than one gzip member made
curl decode the first member and then fail the transfer with a bare
CURLE_WRITE_ERROR and no hint about the cause. Detect the trailing
member and fail with a message that explains what happened.
Fixes#22156Closes#22172
