6768 Commits

Author SHA1 Message Date
Dan Fandrich
c693cc02b0 docs: vulnerabilities in debug code are not eligible for a bounty
This is code that is off by default and is therefore treated as a
regular bug.

Ref: #16526
Closes #16527
2025-02-28 14:21:46 -08:00
Viktor Szakats
049352dd80
cmake: allow CURL_STATIC_CRT with shared libcurl and no curl exe
Follow-up to edfa537100d6b5d2ac1b829c66757880afe59407 #16456

Closes #16516
2025-02-28 13:11:41 +01:00
Viktor Szakats
08c7c937dc
tidy-up: prefer return over exit(), fix fallouts
To avoid breaking the control flow and align to majority of code
already using `return`.

`exit()` has the side-effect of suppressing leak detection in cases.
Fix fallouts detected after switching to `return`.

- configure:
  - fix `getaddrinfo` run test to call `freeaddrinfo()` to pacify ASAN,
    and call `WSACleanup()` to deinit winsock2.
  - fix `getifaddrs` run test to call `freeifaddrs()` to pacify ASAN.
- tests/server:
  - setup `atexit(win32_cleanup)` via `win32_init()`.
  - return 2 instead of 1 on winsock2 init failures.
  - sws: goto cleanup instead of `exit()` in `http_connect()`.
    Follow-up to 02dfe7193704817184b522888ffa926e6b73f648 #7235
- tests/client/http:
  - cleanup memory to pacify ASAN in `h2-upgrade-extreme`,
    `tls-session-reuse`.
- examples:
  - block_ip: fix memory leak reported by CI.
  - http2-upload: avoid handle leaks.

Untouched `exit()` calls, made from callbacks:
- docs/examples: ephiperfifo.c, ghiper.c, hiperfifo.c
- tests/libtest: lib582.c, lib655.c, lib670.c
- tests/server: tftpd.c

Closes #16507
2025-02-28 13:11:41 +01:00
Daniel Stenberg
a8ad9a5758
docs: minor edits to please the new spellchecker regime 2025-02-27 13:15:21 +01:00
Viktor Szakats
dbbbf717f3
curl.h: stop defining non-curl __has_declspec_attribute
Public curl headers are best not to define 3rd-party or system macros.
Introduce `CURL_HAS_DECLSPEC_ATTRIBUTE` to cover this system macro and
use it.

Detected by test1167 after dropping the indentation:
```
test 1167...[Verify curl prefix of public symbols in header files]

/usr/bin/perl -I. -I.  returned 1, when expecting 0
 1167: exit FAILED
== Contents of files in the log/10/ dir after test 1167
=== Start of file server.cmd
 Testnum 1167
=== End of file server.cmd
=== Start of file stdout1167
 Bad symbols in public header files:
   __has_declspec_attribute(x)
=== End of file stdout1167
```
Ref: https://github.com/curl/curl/actions/runs/13533200900/job/37819784405?pr=16490#step:42:2087

Ref: https://clang.llvm.org/docs/LanguageExtensions.html#has-declspec-attribute
Follow-up to 50482b8c0a2cf5315e66d182998c8fc4901ffb2d #3616
Ref: #16496 (fixing test1167)
Closes #16491
2025-02-26 13:10:31 +01:00
Daniel Stenberg
6c81f2a35c
CURLOPT_HTTPHEADER.md: add comments to the example
Ref: https://mastodon.social/@jpmens/114065709635360064
Closes #16488
2025-02-25 23:56:05 +01:00
Derek Huang
af0100fc17
INSTALL-CMAKE.md: CMake usage updates
This PR updates the CMake build/install docs in `docs/INSTALL-CMAKE.md`,
in particular focusing on the use of libcurl from CMake using
`find_package` as well as the newly added features/protocols support via
using `COMPONENTS` or `OPTIONAL_COMPONENTS` with `find_package`.
See #15854 for initial discussion and the corresponding PR #15858 that
was merged.

Some additional best-practices notes are added, for example:

* Encouraging building out-of-source
* Using `--config` with `cmake --build` for multi-config CMake
  generators, not `CMAKE_BUILD_TYPE`

We also add a CURL CMake-specific tip on using `CMAKE_INSTALL_PREFIX`
during configure time to set the install prefix, not using `--prefix`
when running `cmake --install` so `curl-config` output is consistent.

Closes #16329
2025-02-25 13:02:51 +01:00
Daniel Stenberg
6306476fc3
tool_getparam: make --url support a file with URLs
It implies -O used for each URL.

Mention in the --url documentation.

Test 488 and 489 verify.

Closes #16099
2025-02-25 09:16:54 +01:00
Yedaya Katsman
a55b5b7c62
rustls: add support for CERTINFO
This allows you to use the `certs` and `num_certs` writeout variables in
the curl tool, and getting information about the server certificates
using CURLINFO_CERTINFO.

Closes #16459
2025-02-25 07:59:39 +01:00
Daniel Stenberg
b930142d12
CURLOPT_HTTPHEADER.md: rephrases
An attempt to use better language

Closes #16461
2025-02-24 23:15:26 +01:00
Laurențiu Nicola
46f17ef010
docs: bump rustls to 0.14.1
Closes #16446
2025-02-24 22:41:30 +01:00
Viktor Szakats
5070b6ac45
INSTALL-CMAKE.md: mention ZLIB_USE_STATIC_LIBS
Cherry-picked from #16394
Closes #16457
2025-02-24 21:00:31 +01:00
Viktor Szakats
edfa537100
cmake: restrict static CRT builds to static curl exe, test in CI
Static CRT crashes MSVCR* MSVC builds (in VS2008, VS2010, VS2012,
VS2013) according to CI and local tests. The reproducible crash happens
in `curl_mfprintf() -> fputc(s, stderr)` when trying to display the
warning message in `curl -V`. `stderr` is non-NULL and resolves to `2`.
This reproducer needs a debug-enabled build, but it's unrelated to debug
features or curl's memory tracker. It happens regardless of unity build,
CPU architecture or `DllMain()` use. Example from VS2013:

```
+ _bld/src/Debug/curl.exe --disable --version
./appveyor.sh: line 124:   203 Segmentation fault      "${curl}" --disable --version
```
Ref: https://ci.appveyor.com/project/curlorg/curl/builds/51570451/job/ojpdqrsm1hmpmq6a#L210

Another crash happened in an UCRT build (VS2017) with a couple of
`printf()`s added to curl's `main()` function:

```
Microsoft Visual C++ Runtime Library
Debug Assertion Failed!
Program: C:/projects/curl/bld/src/Debug/curl.exe
File: minkernel/crts/ucrt/src/appcrt/heap/debug_heap.cpp
Line: 996
Expression: _act_first_block == header
```
(it hangs the job in CI due to the GUI popup)
Ref: https://github.com/curl/curl/pull/16394#issuecomment-2677181716

To avoid actual and potential issues, this patch issues a warning on
the shared-libcurl + static-CRT combination and falls back to the
default, shared CRT. IOW a static CRT build now requires a static curl
exe when using the `CURL_STATIC_CRT=ON` option.

Follow-up to 4fc6ebe18a607764194ee23e5aa898a027fe3c60 #1621
Cherry-picked from #16394 (with more details there)

Closes #16456
2025-02-24 21:00:31 +01:00
Stefan Eissing
edd573d980
wolfssl: tls early data support
Enable TLS Early Data for wolfSSL:

- merge WOLFSSL_CTX and WOLFSSL setup from ngtcp2 with the general
  implemenation in wolfssl.c
- enable for QUIC via ngtcp2
- give Curl_vquic_tls_init() a `struct alpn_spec` like used for the TCP
  case. Adapt gnutls and other users.
- enable pytest test cases for early data with wolfSSL

and while this messes up wolfssl.c anyway, do

- rename all struct/functions with prefix 'wolfssl_' to 'wssl_' to not
  pollute that name prefix
- rename `ctx/handle` to `ssl_ctx/ssl`, as used in openssl case

Closes #16167
2025-02-24 10:01:51 +01:00
Daniel Stenberg
efec626ebb
contributors.sh: lowercase 'github' for consistency
also fix contrithanks and THANKS-filter

Ref: #16438
Closes #16443
2025-02-24 08:05:06 +01:00
Stefan Eissing
51f8aa79a9
CURLMOPT_SOCKETFUNCTION.md: add advice for socket callback invocation times
Explain when a registered socket callback may get invoked to make user
better aware on how to handle it.

Closes #16441
2025-02-24 00:05:56 +01:00
Daniel Stenberg
4c5099868e
http: make the RTSP version check stricter
- make it only accept version 1.0, as that is the version curl supports
- convert the parser to use strparse
- the status code max is now 999, but it does allow != 3 digits

Closes #16435
2025-02-22 15:07:31 +01:00
Stefan Eissing
cfc657a48d
multi: event based rework
Rework the event based handling of transfers and connections to
be "localized" into a single source file with clearer dependencies.

- add multi_ev.c and multi_ev.h
- add docs/internal/MULTI-EV.md to explain the overall workings
- only do event handling book keeping when the socket callback
  is set
- add handling for "connection only" event tracking, when internal
  easy handles are used that are not really tied to a connection.
  Used in connection pool.
- remove transfer member "last_poll" and connections "shutdown_poll"
  and keep all that internal to multi_ev.c
- add CURL_TRC_M() for tracing of "multi" related things, including
  event handling and connection pool operations. Add new trace
  feature "multi" for trace config.
  multi traces will show exactly what is going on in regard to
  event handling.
- multi: trace transfers "mstate" in every CURL_TRC_M() call
- make internal trace buffer 2048 bytes and end the silliness
  with +n here -m there. Adjust test 1652 expectations of resulting
  length and input edge cases.
- add trace feature "lib-ids" to perfix libcurl traces with transfer
  and connection ids. Useful for debugging libcurl applications.

Closes #16308
2025-02-22 14:47:40 +01:00
Daniel Stenberg
a6e8ead533
var: add a '64dec' function that can base64 decode a string
Verified in test 455 and 487.

If the provided string cannot be base64-decoded, it will instead use
"[64dec-fail]" (without the quotes).

Documented

Ref: #16288
Closes #16330
2025-02-22 11:38:52 +01:00
Stefan Eissing
54c07fd6c5
curl: add write-out variable 'tls_earlydata'
Add the write-out variable 'tls_earlydata' to inspect the amount of
TLSv1.3 early data that had been sent.

Closes #15956
2025-02-22 10:02:39 +01:00
Viktor Szakats
2a292c3984
build: add Windows CE / CeGCC support, with CI jobs
Make it possible to build curl for Windows CE using the CeGCC toolchain.
With both CMake and autotools, including tests and examples, also in CI.
The build configuration is the default one with Schannel enabled. No
3rd-party dependencies have been tested.

Also revive old code to make Schannel build with Windows CE, including
certificate verification.

Builds have been throughougly tested. But, I've made no functional tests
for this PR. Some parts (esp. file operations, like truncate and seek)
are stubbed out and likely broken as a result. Test servers build, but
they do not work on Windows CE. This patch substitutes `fstat()` calls
with `stat()`, which operate on filenames, not file handles. This may or
may not work and/or may not be secure.

About CeGCC: I used the latest available macOS binary build v0.59.1
r1397 from 2009, in native `mingw32ce` build mode. CeGCC is in effect
MinGW + GCC 4.4.0 + old/classic-mingw Windows headers. It targets
Windows CE v3.0 according to its `_WIN32_WCE` value. It means this PR
restores portions of old/classic-mingw support. It makes the Windows CE
codepath compatible with GCC 4.4.0. It also adds workaround for CMake,
which cannot identify and configure this toolchain out of the box.

Notes:
- CMake doesn't recognize CeGCC/mingw32ce, necessitating tricks as seen
  with Amiga and MS-DOS.
- CMake doesn't set `MINGW` for mingw32ce. Set it and `MINGW32CE`
  manually as a helper variable, in addition to `WINCE` which CMake sets
  based on `CMAKE_SYSTEM_NAME`.
- CMake fails to create an implib for `libcurl.dll`, due to not
  recognizing the platform as a Windowsy one. This patch adds the
  necessary workaround to make it work.
- headers shipping with CeGCC miss some things curl needs for Schannel
  support. Fixed by restoring and renovating code previously deleted
  old-mingw code.
- it's sometime non-trivial to figure out if a fallout is WinCE,
  mingw32ce, old-mingw, or GCC version-specific.
- WinCE is always Unicode. With exceptions: no `wmain`,
  `GetProcAddress()`.
- `_fileno()` is said to convert from `FILE *` to `void *` which is
  a Win32 file `HANDLE`. (This patch doesn't use this, but with further
  effort it probably could be.)
  https://stackoverflow.com/questions/3989545/how-do-i-get-the-file-handle-from-the-fopen-file-structure
- WinCE has no signals, current directory, stdio/CRT file handles, no
  `_get_osfhandle()`, no `errno`, no `errno.h`. Some of this stuff is
  standard C89, yet missing from this platform. Microsoft expects
  Windows CE apps to use Win32 file API and `FILE *` exclusively.
- revived CeGCC here (not tested for this PR):
  https://building.enlyze.com/posts/a-new-windows-ce-x86-compiler-in-2024/

On `UNDER_CE` vs. `_WIN32_WCE`: (This patch settled on `UNDER_CE`)

- A custom VS2008 WinCE toolchain does not set any of these.
  The compiler binaries don't contain these strings, and has no compiler
  option for targeting WinCE, hinting that a vanilla toolchain isn't
  setting any of them either.
- `UNDER_CE` is automatically defined by the CeGCC compiler.
  https://cegcc.sourceforge.net/docs/details.html
- `UNDER_CE` is similar to `_WIN32`, except it's not set automatically
  by all compilers. It's not supposed to have any value, like a version.
  (Though e.g. OpenSSL sets it to a version)
- `_WIN32_WCE` is the CE counterpart of the non-CE `_WIN32_WINNT` macro.
  That does return the targeted Windows CE version.
- `_WIN32_WCE` is not defined by compilers, and relies on a header
  setting it to a default, or the build to set it to the desired target
  version. This is also how `_WIN32_WINNT` works.
- `_WIN32_WCE` default is set by `windef.h` in CeGCC.
- `_WIN32_WCE` isn't set to a default by MSVC Windows CE headers (the
  ones I checked at least).
- CMake sets `_WIN32_WCE=<ver>`, `UNDER_CE`, `WINCE` for MSVC WinCE.
- `_WIN32_WCE` seems more popular in other projects, including CeGCC
  itself. `zlib` is a notable exception amongst curl dependencies,
  which uses `UNDER_CE`.
- Since `_WIN32_WCE` needs "certain" headers to have it defined, it's
  undefined depending on headers included beforehand.
- `curl/curl.h` re-uses `_WIN32_WCE`'s as a self-guard, relying on
  its not-(necessarily)-defined-by-default property:
  25b445e479/include/curl/curl.h (L77)

Toolchain downloads:
- Windows:
  https://downloads.sourceforge.net/cegcc/cegcc/0.59.1/cegcc_mingw32ce_cygwin1.7_r1399.tar.bz2
- macOS Intel:
  https://downloads.sourceforge.net/cegcc/cegcc/0.59.1/cegcc_mingw32ce_snowleopard_r1397.tar.bz2

Closes #15975
2025-02-21 13:56:34 +01:00
Viktor Szakats
2cc90a679a
openssl: drop support for old OpenSSL/LibreSSL versions
Require OpenSSL 1.0.2a (2015-03-19) or LibreSSL 2.9.1 (2019-04-13).

Closes #16104
2025-02-21 12:02:35 +01:00
Daniel Stenberg
f0d7318193
strparse: provide access functions
To access the string and the length without having to directly use the
struct field names. Gives more freedom, flexbility and keeps
implementation specifics out of users' code.

Closes #16386
2025-02-19 12:17:32 +01:00
Jay Satiro
2335cbaa21 ca-native.md: sync with CURLSSLOPT_NATIVE_CA
- Add that the native CA store is used to verify certs in addition to
  the other certificate location settings.

Basically clarify that --ca-native does not override --cacert etc.

Prior to this change that behavior was only documented in
CURLSSLOPT_NATIVE_CA which is what --ca-native maps to.

Ref: https://github.com/curl/curl/pull/16181#issuecomment-2663998865

Closes https://github.com/curl/curl/pull/16373
2025-02-19 03:39:52 -05:00
John Bampton
8633b10a41
KNOWN_BUGS: fix typo
Closes #16383
2025-02-19 07:54:03 +01:00
Stefan Eissing
1b710381ca
https-rr: implementation improvements
- fold DoH and async HTTPS-RR handling into common code.
  have common cleanups, etc. Have a CURLcode result in async
  handling to allow HTTPS RR parsing to fail.
- keep target, ipv4hints, ipv6hints, port and echconfig also
  when resolving via cares. We need to know `target` and `port`
  when evaluating possible ALPN candidates to not go astray.
- add CURL_TRC_DNS for tracing DNS operations
- replace DoH specific tracing with DNS, use doh as alias
  for dns in curl_global_tracea()

Closes #16132
2025-02-18 16:12:26 +01:00
Viktor Szakats
f7fcbb8127
cmake: SHARE_LIB_OBJECT=ON requires CMake 3.12 or newer
This feature requires Object Libraries which is supported by CMake 3.12
or newer: https://cmake.org/cmake/help/latest/release/3.12.html

Keep it permanently disabled for older CMake versions.
Also document it in `docs/INSTALL-CMAKE.md`.

Ref: https://cmake.org/cmake/help/latest/manual/cmake-buildsystem.7.html#object-libraries

Follow-up to fc9bfb14520712672b4784e8b48256fb29204011 #11627
Follow-up to 2ebc74c36a19a1700af394c16855ce144d9878e3 #11546

Reported-by: Mark Phillips
Fixes #16375
Closes #16376
2025-02-18 15:05:39 +01:00
Daniel Stenberg
2f4dc6525c
hostip: make CURLOPT_RESOLVE support replacing IPv6 addresses
This also applies to --resolve of course.

Applied strparse functions on the function.

Fixes #16357
Reported-by: rmg-x on github
Closes #16358
Assisted-by: Jay Satiro
2025-02-18 08:55:56 +01:00
Daniel Stenberg
bd15d8beb3
STRPARSE.md: sync with recent changes
New functions and Curl_str_number() changed number return type.

Closes #16365
2025-02-17 14:40:52 +01:00
Jay Satiro
4a74135737 variable.md: clarify 'trim' example
- Use the variable name 'var' instead of 'url' since the latter is also
  a function name and that may confuse the user.

Closes https://github.com/curl/curl/pull/16346
2025-02-16 18:52:48 -05:00
Daniel Stenberg
37128035e5
CODE_STYLE: readability and banned functions
Closes #16349
2025-02-16 16:11:13 +01:00
Viktor Szakats
45f7cb7695
cmake: misc tidy-ups
- replace `add_compile_options()`,  `add_definitions()` with directory
  properties. To harmonize this across all scripts. The new commands are
  verbose, but describe better how they work. The syntax is also closer
  to setting target properties, helps grepping.

- prefer `CMAKE_INSTALL_PREFIX` over `--prefix` (in tests, CI).

- tidy up cmake invocations.

- formatting.

Closes #16238
2025-02-16 03:37:22 +01:00
Viktor Szakats
1b87357967
cmake: allow empty custom IMPORT_LIB_SUFFIX, add suffix collision detection
Allow overriding the `IMPORT_LIB_SUFFIX` default with an empty value.

Also:
- add a fatal error if the implib and static lib filename are identical.
- clarify `IMPORT_LIB_SUFFIX` default value in the documentation.

Reported-by: RubisetCie on Github
Fixes #16324
Ref: 1199308dbc902c52be67fc805c72dd2582520d30 #11505

Closes #16332
2025-02-16 02:03:16 +01:00
kriztalz
2ec1ce92ff
docs: correct argument names & URL redirection
Closes #16334
2025-02-15 22:29:35 +01:00
Viktor Szakats
784a8ec2c1
tidy-up: delete, comment or scope C macros reported unused
To reduce the number `-Wunused-macro` compiler warnings:
- delete unused macros.
- comment out unused macro that are part of a set.
- move macros into the scope they are used.

This may be useful to enable by default, but there are tricky cases that
I didn't manage to fix and paused the effort. E.g. internal features
checks in `openssl.c`. There is more, once those are fixed.

Closes #16279
2025-02-14 10:37:14 +01:00
Stefan Eissing
915f3981c9
HTTP3.md: only speak about minimal versions
Closes #16320
2025-02-14 10:21:48 +01:00
Harry Sintonen
f138177b92
docs: add FD_ZERO to curl_multi_fdset example
While the examples are not intended to complete applications this is
quite relevant for the correct function of the code.

Closes #16325
2025-02-14 08:21:42 +01:00
Daniel Stenberg
c561c94ec3
managen: correct the warning for un-escaped '<' and '>'
1. make sure the check is done before the backticks are replaced

2. ignore less-than and greater-than used within backticks

(adjust proxy.md that now showed a two-space warning)

Closes #16315
2025-02-13 11:17:40 +01:00
Daniel Stenberg
e93514e9b3
THANKS: add contributors from 8.12.1 2025-02-13 08:14:17 +01:00
Jay Satiro
42960ebec0 write-out.md: add 'header' and 'output' to the variable list
Prior to this change %header{} and %output{} were explained in remarks
but not listed in the --write-out variable list.

Closes https://github.com/curl/curl/pull/16299
2025-02-12 17:49:37 -05:00
Daniel Stenberg
383c030d52
KNOWN_BUGS: --interface with link-scoped IPv6 address
Reported-by: Aaron Deadman
Closes #14782
Closes #16295
2025-02-11 09:37:47 +01:00
Daniel Stenberg
81d253365c
verbose.md: mention how carriage-return might occur in headers
Fixes #16285
Reported-by: Andrei Korshikov
Closes #16286
2025-02-11 07:44:36 +01:00
jethrogb
cc6b630f13
KNOWN_BUGS: remove 2.5 client cert handling differs between backends
This was resolved in #4958

Closes #16175
2025-02-10 08:52:54 +01:00
Jay Satiro
973ffaa83f curl_global_sslset.md: Add SSL backend names
- Add the names that can be used to select an SSL backend by name.

This change syncs the names in 3 places: curl_global_sslset
documentation, the curl tool environment variable documentation for
CURL_SSL_BACKEND and the libcurl environment variable documentation for
CURL_SSL_BACKEND.

Closes https://github.com/curl/curl/pull/16256
2025-02-09 14:56:06 -05:00
Terence Eden
a042c67df3
docs: use valid example domain names
Replace .site domains and domain.com with valid example domains.

Fixes #16269
Closes #16270
2025-02-09 00:17:05 +01:00
Michael Kaufmann
9f3427b315
CURLSHOPT_SHARE.md: adjust for the new SSL session cache
curl 8.12.0 introduced an improved SSL session cache. All easy handles
that are added to the same multi handle automatically use the multi
handle's SSL session cache.

Clsoes #16245
2025-02-08 10:48:48 +01:00
Daniel Stenberg
ba92296279
libssh: drop support for libssh older than 0.9.0
libssh 0.9.0 was shipped on June 28 2019 and is the first version
featuring the knownhosts API

Drop libssh from the GHA/linux-old CI job since it gets a libssh 0.7.3
version, too old for us now.

Closes #16200
2025-02-06 22:27:13 +01:00
Daniel Stenberg
aa378570f5
INTERNALS: fix c-ares, as we actually support 1.6.0 or later
It was wrongly bumped to 1.16.0 in db50fc6e95816ec. While we strongly
recommend using 1.16.0 or later, we still allow builds using older
versions.

It would make sense to raise the requirement to at least 1.11.0 (Feb 19
2016) but that's not done right now.

Closes #16221
2025-02-06 17:13:53 +01:00
Daniel Stenberg
3f7f180901
CURLOPT_SSH_KNOWNHOSTS.md: strongly recommend using this
Make setopt fail for SSH backends not supporting knownhosts or pub md5

Closes #16204
2025-02-06 13:51:50 +01:00
Daniel Stenberg
448e71d1b7
header.md: mention Authorization: and Cookie: special treatment
Fixes #16160
Reported-by: deliciouslytyped on github
Closes #16164
2025-02-06 11:40:56 +01:00