-
Notifications
You must be signed in to change notification settings - Fork 1
/
CHANGES
10374 lines (6571 loc) · 292 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
_ _ ____ _
___| | | | _ \| |
/ __| | | | |_) | |
| (__| |_| | _ <| |___
\___|\___/|_| \_\_____|
Changelog
Version 8.5.0 (6 Dec 2023)
Daniel Stenberg (6 Dec 2023)
- RELEASE-NOTES: synced
The curl 8.5.0 release.
Dan Fandrich (5 Dec 2023)
- github/labeler: switch from the beta to labeler v5
Some keys were renamed and the dot option was made default.
Closes #12458
Daniel Stenberg (5 Dec 2023)
- DEPRECATE: remove NTLM_WB in June 2024
Ref: https://curl.se/mail/lib-2023-12/0010.html
Closes #12451
Jacob Hoffman-Andrews (4 Dec 2023)
- rustls: implement connect_blocking
Closes #11647
Daniel Stenberg (4 Dec 2023)
- examples/rtsp-options.c: add
Just a bare bones RTSP example using CURLOPT_RTSP_SESSION_ID and
CURLOPT_RTSP_REQUEST set to CURL_RTSPREQ_OPTIONS.
Closes #12452
Stefan Eissing (4 Dec 2023)
- ngtcp2: ignore errors on unknown streams
- expecially in is_alive checks on connections, we might
see incoming packets on streams already forgotten and closed,
leading to errors reported by nghttp3. Ignore those.
Closes #12449
Daniel Stenberg (4 Dec 2023)
- docs: make all examples in all libcurl man pages compile
Closes #12448
- checksrc.pl: support #line instructions
makes it identify the correct source file and line
- GHA/man-examples: verify libcurl man page examples
- verify-examples.pl: verify that all man page examples compile clean
- RELEASE-NOTES: synced
Graham Campbell (2 Dec 2023)
- http3: bump ngtcp2 and nghttp3 versions
nghttp3 v1.1.0
ngtcp2 v1.1.0
In docs and CI
Closes #12446
- CI/quiche: use `3.1.4+quic` consistently in CI workflows
Closes #12447
Viktor Szakats (2 Dec 2023)
- test1545: disable deprecation warnings
Fixes:
https://ci.appveyor.com/project/curlorg/curl/builds/48631551/job/bhx74e0i66yr
p6pk#L1205
Same with details:
https://ci.appveyor.com/project/curlorg/curl/builds/48662893/job/ol8a78q9gmil
b6wt#L1263
```
tests/libtest/lib1545.c:38:3: error: 'curl_formadd' is deprecated: since 7.56
.0. Use curl_mime_init() [-Werror=deprecated-declarations]
38 | curl_formadd(&m_formpost, &lastptr, CURLFORM_COPYNAME, "file",
| ^~~~~~~~~~~~
[...]
```
Follow-up to 07a3cd83e0456ca17dfd8c3104af7cf45b7a1ff5 #12421
Fixes #12445
Closes #12444
Daniel Stenberg (2 Dec 2023)
- INSTALL: update list of ports and CPU archs
- symbols-in-versions: the CLOSEPOLICY options are deprecated
The were used with the CURLOPT_CLOSEPOLICY option, which *never* worked.
z2_ (1 Dec 2023)
- build: fix builds that disable protocols but not digest auth
- Build base64 functions if digest auth is not disabled.
Prior to this change if some protocols were disabled but not digest auth
then a build error would occur due to missing base64 functions.
Fixes https://github.com/curl/curl/issues/12440
Closes https://github.com/curl/curl/pull/12442
Michał Antoniak (1 Dec 2023)
- connect: reduce number of transportation providers
Use only the ones necessary - the ones that are built-in. Saves a few
bytes in the resulting code.
Closes #12438
David Benjamin (1 Dec 2023)
- vtls: consistently use typedef names for OpenSSL structs
The foo_st names don't appear in OpenSSL public API documentation. The
FOO typedefs are more common. This header was already referencing
SSL_CTX via <openssl/ssl.h>. There is a comment about avoiding
<openssl/x509v3.h>, but OpenSSL actually declares all the typedefs in
<openssl/ossl_typ.h>, which is already included by <openssl/ssl.h> (and
every other OpenSSL header), so just use that. Though I've included it
just to be explicit.
(I'm also fairly sure including <openssl/ssl.h> already triggers the
Schannel conflicts anyway. The comment was probably just out of date.)
Closes #12439
Lau (1 Dec 2023)
- libcurl-security.3: fix typo
Fixed minimal typo.
Closes #12437
Stefan Eissing (1 Dec 2023)
- ngtcp2: fix races in stream handling
- fix cases where ngtcp2 invokes callbacks on streams that
nghttp3 has already forgotten. Ignore the NGHTTP3_ERR_STREAM_NOT_FOUND
in these cases as it is normal behaviour.
Closes #12435
Emanuele Torre (1 Dec 2023)
- tool_writeout_json: fix JSON encoding of non-ascii bytes
char variables if unspecified can be either signed or unsigned depending
on the platform according to the C standard; in most platforms, they are
signed.
This meant that the *i<32 waas always true for bytes with the top bit
set. So they were always getting encoded as \uXXXX, and then since they
were also signed negative, they were getting extended with 1s causing
'\xe2' to be expanded to \uffffffe2, for example:
$ curl --variable 'v=“' --expand-write-out '{{v:json}}\n' file:///dev/nul
l
\uffffffe2\uffffff80\uffffff9c
I fixed this bug by making the code use explicitly unsigned char*
variables instead of char* variables.
Test 268 verifies
Reported-by: iconoclasthero
Closes #12434
Stefan Eissing (1 Dec 2023)
- cf-socket: TCP trace output local address used in connect
Closes #12427
Jay Satiro (1 Dec 2023)
- CURLINFO_PRETRANSFER_TIME_T.3: fix time explanation
- Change CURLINFO_PRETRANSFER_TIME_T explanation to say that it
includes protocol-specific instructions that trigger a transfer.
Prior to this change it explicitly said that it did not include those
instructions in the time, but that is incorrect.
The change is a copy of the fixed explanation already in
CURLINFO_PRETRANSFER_TIME, fixed by ec8dcd7b.
Reported-by: eeverettrbx@users.noreply.github.com
Fixes https://github.com/curl/curl/issues/12431
Closes https://github.com/curl/curl/pull/12432
Daniel Stenberg (30 Nov 2023)
- multi: during ratelimit multi_getsock should return no sockets
... as there is nothing to wait for then, it just waits. Otherwise, this
causes much more CPU work and updates than necessary during ratelimit
periods.
Ref: https://curl.se/mail/lib-2023-11/0056.html
Closes #12430
Dmitry Karpov (30 Nov 2023)
- transfer: abort pause send when connection is marked for closing
This handles cases of some bi-directional "upgrade" scenarios
(i.e. WebSockets) where sending is paused until some "upgrade" handshake
is completed, but server rejects the handshake and closes the
connection.
Closes #12428
Daniel Stenberg (28 Nov 2023)
- RELEASE-NOTES: synced
- openssl: when a session-ID is reused, skip OCSP stapling
Fixes #12399
Reported-by: Alexey Larikov
Closes #12418
- test1545: test doing curl_formadd twice with missing file
Reproduces #12410
Verifies the fix
Closes #12421
- Curl_http_body: cleanup properly when Curl_getformdata errors
Reported-by: yushicheng7788 on github
Based-on-work-by: yushicheng7788 on github
Fixes #12410
Closes #12421
- test1477: verify that libcurl-errors.3 and public headers are synced
The script errorcodes.pl extracts all error codes from all headers and
checks that they are all documented, then checks that all documented
error codes are also specified in a header file.
Closes #12424
- libcurl-errors.3: sync with current public headers
Closes #12424
Stefan Eissing (28 Nov 2023)
- test459: fix for parallel runs
- change warniing message to work better with varying filename
length.
- adapt test output check to new formatting
Follow-up to 97ccc4479f77ba3191c6
Closes #12423
Daniel Stenberg (27 Nov 2023)
- tool_cb_prg: make the carriage return fit for wide progress bars
When the progress bar was made max width (256 columns), the fly()
function attempted to generate its output buffer too long so that the
trailing carriage return would not fit and then the output would show
wrongly. The fly function is called when the expected total transfer is
unknown, which could be one or more progress calls before the actual
progress meter get shown when the expected transfer size is provided.
This new take also replaces the msnprintf() call with a much simpler
memset() for speed.
Reported-by: Tim Hill
Fixes #12407
Closes #12415
- tool_parsecfg: make warning output propose double-quoting
When the config file parser detects a word that *probably* should be
quoted, mention double-quotes as a possible remedy.
Test 459 verifies.
Proposed-by: Jiehong on github
Fixes #12409
Closes #12412
Jay Satiro (26 Nov 2023)
- curl.rc: switch out the copyright symbol for plain ASCII
.. like we already do for libcurl.rc.
libcurl.rc copyright symbol used to cause a "non-ascii 8-bit codepoint"
warning so it was switched to ascii.
Ref: https://github.com/curl/curl/commit/1ca62bb5#commitcomment-133474972
Suggested-by: Robert Southee
Closes https://github.com/curl/curl/pull/12403
Daniel Stenberg (26 Nov 2023)
- conncache: use the closure handle when disconnecting surplus connections
Use the closure handle for disconnecting connection cache entries so
that anything that happens during the disconnect is not stored and
associated with the 'data' handle which already just finished a transfer
and it is important that details from the unrelated disconnect does not
taint meta-data in the data handle.
Like storing the response code.
This also adjust test 1506. Unfortunately it also removes a key part of
the test that verifies that a connection is closed since when this
output vanishes (because the closure handle is used), we don't know
exactly that the connection actually gets closed in this test...
Reported-by: ohyeaah on github
Fixes #12367
Closes #12405
- RELEASE-NOTES: synced
Stefan Eissing (24 Nov 2023)
- quic: make eyeballers connect retries stop at weird replies
- when a connect immediately goes into DRAINING state, do
not attempt retries in the QUIC connection filter. Instead,
return CURLE_WEIRD_SERVER_REPLY
- When eyeballing, interpret CURLE_WEIRD_SERVER_REPLY as an
inconclusive answer. When all addresses have been attempted,
rewind the address list once on an inconclusive answer.
- refs #11832 where connects were retried indefinitely until
the overall timeout fired
Closes #12400
Daniel Stenberg (24 Nov 2023)
- CI: verify libcurl function SYNPOSIS sections
With the .github/scripits/verify-synopsis.pl script
Closes #12402
- docs/libcurl: SYNSOPSIS cleanup
- use the correct include file
- make sure they are declared as in the header file
- fix minor nroff syntax mistakes (missing .fi)
These are verified by verify-synopsis.pl, which extracts the SYNPOSIS
code and runs it through gcc.
Closes #12402
- sendf: fix comment typo
- fopen: allocate the dir after fopen
Move the allocation of the directory name down to after the fopen() call
to allow that shortcut code path to avoid a superfluous malloc+free
cycle.
Follow-up to 73b65e94f35311
Closes #12398
Stefan Eissing (24 Nov 2023)
- transfer: cleanup done+excess handling
- add `SingleRequest->download_done` as indicator that
all download bytes have been received
- remove `stop_reading` bool from readwrite functions
- move excess body handling into client download writer
Closes #12371
Daniel Stenberg (23 Nov 2023)
- fopen: create new file using old file's mode
Because the function renames the temp file to the target name as a last
step, if the file was previously owned by a different user, not ORing
the old mode could otherwise end up creating a file that was no longer
readable by the original owner after save.
Reported-by: Loïc Yhuel
Fixes #12299
Closes #12395
- test1476: require proxy
Follow-up from 323df4261c3542
Closes #12394
- fopen: create short(er) temporary file name
Only using random letters in the name plus a ".tmp" extension. Not by
appending characters to the final file name.
Reported-by: Maksymilian Arciemowicz
Closes #12388
Stefan Eissing (23 Nov 2023)
- tests: git ignore generated second-hsts.txt file
File is generated in test lib1900
Follow-up to 7cb03229d9e9c5
Closes #12393
Viktor Szakats (23 Nov 2023)
- openssl: enable `infof_certstack` for 1.1 and LibreSSL 3.6
Lower the barrier to enable `infof_certstack()` from OpenSSL 3 to
OpenSSL 1.1.x, and LibreSSL 3.6 or upper.
With the caveat, that "group name" and "type name" are missing from
the log output with these TLS backends.
Follow-up to b6e6d4ff8f253c8b8055bab9d4d6a10f9be109f3 #12030
Reviewed-by: Daniel Stenberg
Closes #12385
Daniel Stenberg (23 Nov 2023)
- urldata: fix typo in comment
- CI: codespell
The list of words to ignore is in the file
.github/scripts/codespell-ignore.txt
Closes #12390
- lib: fix comment typos
Five separate ones, found by codespell
Closes #12390
- test1476: verify cookie PSL mixed case
- cookie: lowercase the domain names before PSL checks
Reported-by: Harry Sintonen
Closes #12387
Viktor Szakats (23 Nov 2023)
- openssl: fix building with v3 `no-deprecated` + add CI test
- build quictls with `no-deprecated` in CI to have test coverage for
this OpenSSL 3 configuration.
- don't call `OpenSSL_add_all_algorithms()`, `OpenSSL_add_all_digests()`.
The caller code is meant for OpenSSL 3, while these two functions were
only necessary before OpenSSL 1.1.0. They are missing from OpenSSL 3
if built with option `no-deprecated`, causing build errors:
```
vtls/openssl.c:4097:3: error: call to undeclared function 'OpenSSL_add_all_
algorithms'; ISO C99 and later do not support implicit function declaration
s [-Wimplicit-function-declaration]
vtls/openssl.c:4098:3: error: call to undeclared function 'OpenSSL_add_all_
digests'; ISO C99 and later do not support implicit function declarations [
-Wimplicit-function-declaration]
```
Ref: https://ci.appveyor.com/project/curlorg/curl-for-win/builds/48587418?f
ullLog=true#L7667
Regression from b6e6d4ff8f253c8b8055bab9d4d6a10f9be109f3 #12030
Bug: https://github.com/curl/curl/issues/12380#issuecomment-1822944669
Reviewed-by: Alex Bozarth
- vquic/curl_ngtcp2: fix using `SSL_get_peer_certificate` with
`no-deprecated` quictls 3 builds.
Do it by moving an existing solution for this from `vtls/openssl.c`
to `vtls/openssl.h` and adjusting caller code.
```
vquic/curl_ngtcp2.c:1950:19: error: implicit declaration of function 'SSL_g
et_peer_certificate'; did you mean 'SSL_get1_peer_certificate'? [-Wimplicit
-function-declaration]
```
Ref: https://github.com/curl/curl/actions/runs/6960723097/job/18940818625#s
tep:24:1178
- curl_ntlm_core: fix `-Wunused-parameter`, `-Wunused-variable` and
`-Wunused-function` when trying to build curl with NTLM enabled but
without the necessary TLS backend (with DES) support.
Closes #12384
- curl.h: delete Symbian OS references
curl deprecated Symbian OS in 3d64031fa7a80ac4ae3fd09a5939196268b92f81
via #5989. Delete references to it from public headers, because there
is no fresh release to use those headers with.
Reviewed-by: Dan Fandrich
Reviewed-by: Jay Satiro
Closes #12378
- windows: use built-in `_WIN32` macro to detect Windows
Windows compilers define `_WIN32` automatically. Windows SDK headers
or build env defines `WIN32`, or we have to take care of it. The
agreement seems to be that `_WIN32` is the preferred practice here.
Make the source code rely on that to detect we're building for Windows.
Public `curl.h` was using `WIN32`, `__WIN32__` and `CURL_WIN32` for
Windows detection, next to the official `_WIN32`. After this patch it
only uses `_WIN32` for this. Also, make it stop defining `CURL_WIN32`.
There is a slight chance these break compatibility with Windows
compilers that fail to define `_WIN32`. I'm not aware of any obsolete
or modern compiler affected, but in case there is one, one possible
solution is to define this macro manually.
grepping for `WIN32` remains useful to discover Windows-specific code.
Also:
- extend `checksrc` to ensure we're not using `WIN32` anymore.
- apply minor formatting here and there.
- delete unnecessary checks for `!MSDOS` when `_WIN32` is present.
Co-authored-by: Jay Satiro
Reviewed-by: Daniel Stenberg
Closes #12376
Stefan Eissing (22 Nov 2023)
- url: ConnectionExists revisited
- have common pattern of `if not match, continue`
- revert pages long if()s to return early
- move dead connection check to later since it may
be relatively expensive
- check multiuse also when NOT building with NGHTTP2
- for MULTIUSE bundles, verify that the inspected
connection indeed supports multiplexing when in use
(bundles may contain a mix of connection, afaict)
Closes #12373
Daniel Stenberg (22 Nov 2023)
- CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range
... or use the default value.
Also clarify the documentation language somewhat.
Closes #12382
- urldata: make maxconnects a 32 bit value
"2^32 idle connections ought to be enough for anybody"
Closes #12375
- FEATURES: update the URL phrasing
The URL is length limited since a while back so "no limit" simply is not
true anymore. Mention the URL RFC standard used instead.
Closes #12383
- wolfssh: remove redundant static prototypes
vssh/wolfssh.c:346:18: error: redundant redeclaration of ‘wscp_recv’ [-We
rror=redundant-decls]
Closes #12381
- setopt: remove superfluous use of ternary expressions
Closes #12374
- mime: store "form escape" as a single bit
Closes #12374
- setopt: check CURLOPT_TFTP_BLKSIZE range on set
... instead of later when the transfer is about to happen.
Closes #12374
Viktor Szakats (21 Nov 2023)
- build: add more picky warnings and fix them
Enable more picky compiler warnings. I've found these options in the
nghttp3 project when implementing the CMake quick picky warning
functionality for it [1].
`-Wunused-macros` was too noisy to keep around, but fixed a few issues
it revealed while testing.
- autotools: reflect the more precisely-versioned clang warnings.
Follow-up to 033f8e2a08eb1d3102f08c4d8c8e85470f8b460e #12324
- autotools: sync between clang and gcc the way we set `no-multichar`.
- autotools: avoid setting `-Wstrict-aliasing=3` twice.
- autotools: disable `-Wmissing-noreturn` for MSYS gcc targets [2].
It triggers in libtool-generated stub code.
- lib/timeval: delete a redundant `!MSDOS` guard from a `WIN32` branch.
- lib/curl_setup.h: delete duplicate declaration for `fileno`.
Added in initial commit ae1912cb0d494b48d514d937826c9fe83ec96c4d
(1999-12-29). This suggests this may not be needed anymore, but if
it does, we may restore this for those specific (non-Windows) systems.
- lib: delete unused macro `FTP_BUFFER_ALLOCSIZE` since
c1d6fe2aaa5a26e49a69a4f2495b3cc7a24d9394.
- lib: delete unused macro `isxdigit_ascii` since
f65f750742068f579f4ee6d8539ed9d5f0afcb85.
- lib/mqtt: delete unused macro `MQTT_HEADER_LEN`.
- lib/multi: delete unused macro `SH_READ`/`SH_WRITE`.
- lib/hostip: add `noreturn` function attribute via new `CURL_NORETURN`
macro.
- lib/mprintf: delete duplicate declaration for `Curl_dyn_vprintf`.
- lib/rand: fix `-Wunreachable-code` and related fallouts [3].
- lib/setopt: fix `-Wunreachable-code-break`.
- lib/system_win32 and lib/timeval: fix double declarations for
`Curl_freq` and `Curl_isVistaOrGreater` in CMake UNITY mode [4].
- lib/warnless: fix double declarations in CMake UNITY mode [5].
This was due to force-disabling the header guard of `warnless.h` to
to reapply it to source code coming after `warnless.c` in UNITY
builds. This reapplied declarations too, causing the warnings.
Solved by adding a header guard for the lines that actually need
to be reapplied.
- lib/vauth/digest: fix `-Wunreachable-code-break` [6].
- lib/vssh/libssh2: fix `-Wunreachable-code-break` and delete redundant
block.
- lib/vtls/sectransp: fix `-Wunreachable-code-break` [7].
- lib/vtls/sectransp: suppress `-Wunreachable-code`.
Detected in `else` branches of dynamic feature checks, with results
known at compile-time, e.g.
```c
if(SecCertificateCopySubjectSummary) /* -> true */
```
Likely fixable as a separate micro-project, but given SecureTransport
is deprecated anyway, let's just silence these locally.
- src/tool_help: delete duplicate declaration for `helptext`.
- src/tool_xattr: fix `-Wunreachable-code`.
- tests: delete duplicate declaration for `unitfail` [8].
- tests: delete duplicate declaration for `strncasecompare`.
- tests/libtest: delete duplicate declaration for `gethostname`.
Originally added in 687df5c8c39c370a59999b9afc0917d808d978b7
(2010-08-02).
Got complicated later: c49e9683b85ba9d12cbb6eebc4ab2c8dba68fbdc
If there are still systems around with warnings, we may restore the
prototype, but limited for those systems.
- tests/lib2305: delete duplicate declaration for
`libtest_debug_config`.
- tests/h2-download: fix `-Wunreachable-code-break`.
[1] https://github.com/ngtcp2/nghttp3/blob/a70edb08e954d690e8fb2c1df999b5a056
f8bf9f/cmake/PickyWarningsC.cmake
[2] https://ci.appveyor.com/project/curlorg/curl/builds/48553586/job/3qkgjaui
qla5fj45?fullLog=true#L1675
[3] https://github.com/curl/curl/actions/runs/6880886309/job/18716044703?pr=1
2331#step:7:72
https://github.com/curl/curl/actions/runs/6883016087/job/18722707368?pr=1
2331#step:7:109
[4] https://ci.appveyor.com/project/curlorg/curl/builds/48555101/job/9g15qkrr
iklpf1ut#L204
[5] https://ci.appveyor.com/project/curlorg/curl/builds/48555101/job/9g15qkrr
iklpf1ut#L218
[6] https://github.com/curl/curl/actions/runs/6880886309/job/18716042927?pr=1
2331#step:7:290
[7] https://github.com/curl/curl/actions/runs/6891484996/job/18746659406?pr=1
2331#step:9:1193
[8] https://github.com/curl/curl/actions/runs/6882803986/job/18722082562?pr=1
2331#step:33:1870
Closes #12331
Daniel Stenberg (21 Nov 2023)
- transfer: avoid unreachable expression
If curl_off_t and size_t have the same size (which is common on modern
64 bit systems), a condition cannot occur which Coverity pointed
out. Avoid the warning by having the code conditionally only used if
curl_off_t actually is larger.
Follow-up to 1cd2f0072fa482e25baa2
Closes #12370
Stefan Eissing (21 Nov 2023)
- transfer: readwrite improvements
- changed header/chunk/handler->readwrite prototypes to accept `buf`,
`blen` and a `pconsumed` pointer. They now get the buffer to work on
and report back how many bytes they consumed
- eliminated `k->str` in SingleRequest
- improved excess data handling to properly calculate with any body data
left in the headerb buffer
- eliminated `k->badheader` enum to only be a bool
Closes #12283
Daniel Stenberg (21 Nov 2023)
- RELEASE-NOTES: synced
Jiřà Hruška (21 Nov 2023)
- transfer: avoid calling the read callback again after EOF
Regression since 7f43f3dc5994d01b12 (7.84.0)
Bug: https://curl.se/mail/lib-2023-11/0017.html
Closes #12363
Daniel Stenberg (21 Nov 2023)
- doh: provide better return code for responses w/o addresses
Previously it was wrongly returning CURLE_OUT_OF_MEMORY when the
response did not contain any addresses. Now it more accurately returns
CURLE_COULDNT_RESOLVE_HOST.
Reported-by: lRoccoon on github
Fixes #12365
Closes #12366
Stefan Eissing (21 Nov 2023)
- HTTP/2, HTTP/3: handle detach of onoing transfers
- refs #12356 where a UAF is reported when closing a connection
with a stream whose easy handle was cleaned up already
- handle DETACH events same as DONE events in h2/h3 filters
Fixes #12356
Reported-by: Paweł Wegner
Closes #12364
Viktor Szakats (20 Nov 2023)
- autotools: stop setting `-std=gnu89` with `--enable-warnings`
Do not alter the C standard when building with `--enable-warnings` when
building with gcc.
On one hand this alters warning results compared to a default build.
On the other, it may produce different binaries, which is unexpected.
Also fix new warnings that appeared after removing `-std=gnu89`:
- include: fix public curl headers to use the correct printf mask for
`CURL_FORMAT_CURL_OFF_T` and `CURL_FORMAT_CURL_OFF_TU` with mingw-w64
and Visual Studio 2013 and newer. This fixes the printf mask warnings
in examples and tests. E.g. [1]
- conncache: fix printf format string [2].
- http2: fix potential null pointer dereference [3].
(seen on Slackware with gcc 11.)
- libssh: fix printf format string in SFTP code [4].
Also make MSVC builds compatible with old CRT versions.
- libssh2: fix printf format string in SFTP code for MSVC.
Applying the same fix as for libssh above.
- unit1395: fix `argument is null` and related issues [5]:
- stop calling `strcmp()` with NULL to avoid undefined behaviour.
- fix checking results if some of them were NULL.
- do not pass NULL to printf `%s`.
- ci: keep a build job with `-std=gnu89` to continue testing for
C89-compliance. We can apply this to other gcc jobs as needed.
Ref: b23ce2cee7329bbf425f18b49973b7a5f23dfcb4 (2022-09-23) #9542
[1] https://dev.azure.com/daniel0244/curl/_build/results?buildId=18581&view=l
ogs&jobId=ccf9cc6d-2ef1-5cf2-2c09-30f0c14f923b
[2] https://github.com/curl/curl/actions/runs/6896854263/job/18763831142?pr=1
2346#step:6:67
[3] https://github.com/curl/curl/actions/runs/6896854253/job/18763839238?pr=1
2346#step:30:214
[4] https://github.com/curl/curl/actions/runs/6896854253/job/18763838007?pr=1
2346#step:29:895
[5] https://github.com/curl/curl/actions/runs/6896854253/job/18763836775?pr=1
2346#step:33:1689
Closes #12346
- autotools: fix/improve gcc and Apple clang version detection
- Before this patch we expected `n.n` `-dumpversion` output, but Ubuntu
may return `n-win32` (also with `-dumpfullversion`). Causing these
errors and failing to enable picky warnings:
```
../configure: line 23845: test: : integer expression expected
```
Ref: https://github.com/libssh2/libssh2/actions/runs/6263453828/job/1700789
3718#step:5:143
Fix that by stripping any dash-suffix and handling a dotless (major-only)
version number by assuming `.0` in that case.
`9.3-posix`, `9.3-win32`, `6`, `9.3.0`, `11`, `11.2`, `11.2.0`
Ref: https://github.com/mamedev/mame/pull/9767
- fix Apple clang version detection for releases between
'Apple LLVM version 7.3.0' and 'Apple LLVM version 10.0.1' where the
version was under-detected as 3.7 llvm/clang equivalent.
- fix Apple clang version detection for 'Apple clang version 11.0.0'
and newer where the Apple clang version was detected, instead of its
llvm/clang equivalent.
- display detected clang/gcc/icc compiler version.
Via libssh2:
- https://github.com/libssh2/libssh2/commit/00a3b88c51cdb407fbbb347a2e38c5c7d
89875ad
https://github.com/libssh2/libssh2/pull/1187
- https://github.com/libssh2/libssh2/commit/89ccc83c7da73e7ca3a112e3500081319
42b592e
https://github.com/libssh2/libssh2/pull/1232
Closes #12362
- autotools: delete LCC compiler support bits
Follow-up to fd7ef00f4305a2919e6950def1cf83d0110a4acd #12222
Closes #12357
- cmake: add test for `DISABLE` options, add `CURL_DISABLE_HEADERS_API`
- tests: verify CMake `DISABLE` options.
Make an exception for 2 CMake-only ones, and one more that's
using a different naming scheme, also in autotools and source.
- cmake: add support for `CURL_DISABLE_HEADERS_API`.
Suggested-by: Daniel Stenberg
Ref: https://github.com/curl/curl/pull/12345#pullrequestreview-1736238641
Closes #12353
Jacob Hoffman-Andrews (20 Nov 2023)
- hyper: temporarily remove HTTP/2 support
The current design of the Hyper integration requires rebuilding the
Hyper clientconn for each request. However, building the clientconn
requires resending the HTTP/2 connection preface, which is incorrect
from a protocol perspective. That in turn causes servers to send GOAWAY
frames, effectively degrading performance to "no connection reuse" in
the best case. It may also be triggering some bugs where requests get
dropped entirely and reconnects take too long.
This doesn't rule out HTTP/2 support with Hyper, but it may take a
redesign of the Hyper integration in order to make things work.
Closes #12191
Jay Satiro (20 Nov 2023)
- schannel: fix unused variable warning
Bug: https://github.com/curl/curl/pull/12349#issuecomment-1818000846
Reported-by: Viktor Szakats
Closes https://github.com/curl/curl/pull/12361
Daniel Stenberg (19 Nov 2023)
- url: find scheme with a "perfect hash"
Instead of a loop to scan over the potentially 30+ scheme names, this
uses a "perfect hash" table. This works fine because the set of schemes
is known and cannot change in a build. The hash algorithm and table size
is made to only make a single scheme index per table entry.
The perfect hash is generated by a separate tool (scripts/schemetable.c)
Closes #12347
- scripts: add schemetable.c
This tool generates a scheme-matching table.
It iterates over a number of different initial and shift values in order
to find the hash algorithm that needs the smallest possible table.
The generated hash function, table and table size then needs to be used
by the url.c:Curl_getn_scheme_handler() function.
Stefan Eissing (19 Nov 2023)
- vtls/vquic, keep peer name information together
- add `struct ssl_peer` to keep hostname, dispname and sni
for a filter
- allocate `sni` for use in VTLS backend
- eliminate `Curl_ssl_snihost()` and its use of the download buffer
- use ssl_peer in SSL and QUIC filters
Closes #12349
Viktor Szakats (18 Nov 2023)
- build: always revert `#pragma GCC diagnostic` after use
Before this patch some source files were overriding gcc warning options,
but without restoring them at the end of the file. In CMake UNITY builds
these options spilled over to the remainder of the source code,
effecitvely disabling them for a larger portion of the codebase than
intended.
`#pragma clang diagnostic` didn't have such issue in the codebase.
Reviewed-by: Marcel Raad
Closes #12352
- tidy-up: casing typos, delete unused Windows version aliases
- cmake: fix casing of `UnixSockets` to match the rest of the codebase.
- curl-compilers.m4: fix casing in a comment.
- setup-win32: delete unused Windows version constant aliases.
Reviewed-by: Marcel Raad
Closes #12351
- keylog: disable if unused
Fully disable keylog code if there is no TLS or QUIC subsystem using it.
Closes #12350
- cmake: add `CURL_DISABLE_BINDLOCAL` option
To match similar autotools option.
Default is `ON`.