Commit Graph

37505 Commits

Author SHA1 Message Date
Daniel Stenberg
e83c82f05f COPYING: bump copyright year range to 1996 - 2026 2026-01-08 23:19:44 +01:00
Stefan Eissing
f2d008811d ngtcp2: stabilize recv
When receiving on a stream that already failed or has already been closed,
return the matching error code without touching the connection. In case
the connection shows errors, e.g. the server closed, those errors should
not have impact on an already failed/closed stream.

This might mitigate flakiness in pytest 07_13 where unexpected errors
occur after a successful upload.

Closes #20220
2026-01-08 22:36:38 +01:00
Daniel Stenberg
e3691612ea urldata: switch to uint* types more widely
In particular, it turns 'unsigned long' into 'uint32_t' since the code
needs to build and run just as fine on Windows which has 32 bit longs,
so we know the code works with 32 bit field versions.

This makes Curl_easy 56 bytes smaller on my 64 bit Linux (maximized
build).

Closes #20209
2026-01-08 22:35:06 +01:00
Daniel Stenberg
97a02fade6 curl: rename a struct OutStruct field to 'regular_file'
From 's_isreg'. It explains better in plain English what it is for.

Closes #20222
2026-01-08 22:34:05 +01:00
Daniel Stenberg
8a25cf3d7c tool_operate: remove 'else' for VMS
It seems malplaced as it then avoids the following logic when invoked
from a VMS shell and that seems unlikely to be desired.

Based on code review. I have no system to try this on.

Follow-up to f1261bcdd7
Closes #20221
2026-01-08 22:33:06 +01:00
Daniel Stenberg
2aba8f613c urldata.h: remove two forward-declared structs not used
Closes #20206
2026-01-08 22:31:07 +01:00
Daniel Stenberg
13c1a93414 lib: remove uses of PRIu32 by adding "hack" for DJGPP
Avoid using PRIu32 and PRId32 in product source code. We don't need it.
It reduces readability. It is also inconsistent since unsigned int has
the same size and does not require the define.

DJGPP warns about using %u for uint32_t by default because it seems to
typedef it to unsigned long instead of unsigned int. Which even that is
annoying since long and int are both 32 bit on this platform.

We use our own *printf() implementation and we know this is safe.

This work-around defines uint32_t for DJGPP into unsigned int to avoid
the warnings and thus the need to use PRIu32 and PRId32.

Closes #20215
2026-01-08 14:15:47 +01:00
JimFuller-RedHat
af18d8ea1b docs: explicitly call out Slowloris as not a security flaw
Closes #20219
2026-01-08 10:19:16 +01:00
Daniel Stenberg
7de35515d9 mprintf: drop old sprintf fallback
1. No modern systems lack snprintf()

2. If there actually exist any such systems, they get to manage without
   floating point output.

Closes #20218
2026-01-08 09:31:39 +01:00
Viktor Szakats
bb7f69f9a2 tool_dirhie: drop superfluous F_OK fallback (Windows)
Follow-up to cb5ba675a7

Closes #20214
2026-01-07 22:59:52 +01:00
Viktor Szakats
d8f6175edc GHA/macos: switch one H3 pytest job to cmake
To:
- see if build tool makes a difference for flaky 8x pytest slowdowns.
- to make this job finished faster.

`curl -V`, number of runtests (1793) and pytests (568/159) verified
to remain the same.

Closes #20211
2026-01-07 17:34:57 +01:00
Viktor Szakats
1b9f1c2086 GHA/non-native: restore MS-DOS jobs
In `!ssl` variant.

It's useful to catch `uint32_t` mismatches with `unsigned int` or its
printf mask.

Also add Renovate version bump rule.

It takes about 1m (autotools) + 30s (cmake) in CI.

Bug: https://github.com/curl/curl/pull/20199#discussion_r2666363334
Follow-up to 8881a52ab0 #20210
Follow-up to e70436a88a #20200
Follow-up to 0630e66cb4 #18338

Closes #20204
2026-01-07 17:07:40 +01:00
Viktor Szakats
8881a52ab0 tests: fix to use uint32_t where necessary
Fixes MS-DOS DJGPP buidls, possibly others.

Follow-up to e70436a88a #20200
Follow-up to 4701a6d2ae #19695

Closes #20210
2026-01-07 17:01:06 +01:00
Viktor Szakats
e70436a88a lib: sync printf masks with uint32_t types
Also adjust a printf mask for signedness.

Fixing with MS-DOS DJGPP gcc 12.2.0:
```
lib/conncache.c:612:22: error: format '%u' expects argument of type 'unsigned int', but argument 4 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi.c:394:22: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi.c:520:20: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi.c:520:20: error: format '%u' expects argument of type 'unsigned int', but argument 5 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi.c:611:20: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi.c:614:22: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi.c:887:20: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi.c:887:20: error: format '%u' expects argument of type 'unsigned int', but argument 5 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi.c:2719:26: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi.c:2725:30: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi.c:2729:28: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi.c:3126:34: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi.c:3348:34: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi.c:3991:28: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi_ev.c:343:24: error: format '%u' expects argument of type 'unsigned int', but argument 6 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi_ev.c:413:24: error: format '%u' expects argument of type 'unsigned int', but argument 4 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi_ev.c:584:36: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi_ntfy.c:113:34: error: format '%d' expects argument of type 'int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi_ntfy.c:113:34: error: format '%u' expects argument of type 'unsigned int', but argument 4 has type 'uint32_t' {aka 'long unsigned int'}
lib/multi_ntfy.c:171:22: error: format '%u' expects argument of type 'unsigned int', but argument 4 has type 'uint32_t' {aka 'long unsigned int'}
lib/url.c:883:22: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
lib/url.c:889:22: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'uint32_t' {aka 'long unsigned int'}
```

Bug: https://github.com/curl/curl/pull/20199#discussion_r2666363334
Follow-up to 4c9e4e99c1 #20208

Closes #20200
2026-01-07 16:28:30 +01:00
Viktor Szakats
4c9e4e99c1 build: detect and include inttypes.h again
For `PRI*` printf masks for fixed-size C99 types.

Also:
- add simple fallback for `PRIu32`, `PRIx32`, if `inttypes.h` is
  missing.

Cherry-picked from #20200
Ref: #20207
Follow-up to 4701a6d2ae #19695
Ref: 60359ad504 #12275
Closes #20208
2026-01-07 16:10:23 +01:00
Daniel Stenberg
5f612acaa1 urlapi: split parts of parseurl() into sub functions
- parse_file
- parse_scheme
- guess_scheme
- handle_fragment
- handle_query
- handle_path

Closes #20205
2026-01-07 14:31:08 +01:00
Stefan Eissing
f6e8531c03 http/3: add description for known server error codes
When a server resets a stream with an error code, list that code
and its known name in the failure message of the transfer.

Ref: #20195
Closes #20202
2026-01-07 14:30:21 +01:00
Viktor Szakats
c25fdaf081 GHA/macos: merge two autotools !ssl jobs into others, switch one to cmake
Number of jobs down to 34 (from 56 at end of last year.)
Out of them 7 autotools (was 24 at end of last year.)

Also:
- stop install brew packages preinstalled.
- make some dependency options explicit.

Closes #20203
2026-01-07 12:44:42 +01:00
Viktor Szakats
671df8d357 config-plan9: set HAVE_STDINT_H again
Follow-up to 1ecf2f1113 #16585 #15907
Follow-up to 60359ad504 #12275

Closes #20201
2026-01-07 10:43:34 +01:00
Daniel Stenberg
2eebc58c4b RELEASE-NOTES: synced
curl 8.18.0 release
curl-8_18_0
2026-01-07 07:56:22 +01:00
Daniel Stenberg
45802c9bdb THANKS: add contributors from 8.18.0 2026-01-07 07:56:22 +01:00
Daniel Stenberg
4c9f868686 VERSIONS.md: add date for 8.18.0, mention 8.19.0 is pending 2026-01-07 07:56:22 +01:00
Viktor Szakats
40c1748af5 tool_urlglob: fix propagating OOM error from sanitize_file_name()
Make sure to convert a low-level OOM error code a libcurl one, to make
the curl tool to display an accurate error code and messages. On Windows
and MS-DOS.

Improving:
```
$ CURL_FN_SANITIZE_OOM=1 wine curl.exe https://curl.se/ --output out.txt
[...]
curl: (3) URL using bad/illegal format or missing URL
```
to:
```
[...]
curl: (27) Out of memory
```

Cherry-picked from #20116
Closes #20198
2026-01-06 20:02:55 +01:00
Viktor Szakats
e2d61a6b30 curlx_win32_fopen: use _fsopen()/_wfsopen() with _SH_DENYNO
Replacing `fopen_s()`/`_wfopen_s()`, to allow customizing share mode,
and keep the sharing mode as was with `fopen()`/`_wopen()` earlier and
as used in `_sopen_s()`/`_wsopen_s()`.

The replaced functions used `_SH_SECURE` internally. Otherwise they are
identical to the replacements.

Ref: https://learn.microsoft.com/cpp/c-runtime-library/reference/fsopen-wfsopen

Reported-by: Jay Satiro
Fixes #20155
Ref: #20156
Follow-up to 1e7d0bafc6 #19643
Closes #20186
2026-01-06 12:20:01 +01:00
Andrew
64350280d3 ldap: fix LDAP version display on IBMi
Fixes #20196
Closes #20197
2026-01-06 12:08:16 +01:00
Samuel Henrique
dce81d3c4e wcurl: import v2026.01.05
Closes #20194
2026-01-06 10:12:31 +01:00
Viktor Szakats
5a4cd75863 GHA/macos: switch 5 jobs from autotools to cmake
To save 0.5 to 3 minutes per job.

There remain 7 main autotools jobs, plus 1 in combinations and 1 more
for iOS.

Also:
- fix to disable MQTT, WebSockets, IPFS in HTTP-only job.

Closes #20193
2026-01-06 04:15:22 +01:00
pojomi
dc739fee16 config2setopts: add space in cookie header with multiple -b
Closes #20184
2026-01-05 23:32:00 +01:00
Viktor Szakats
fecc987ebf GHA: reduce total timeouts for Linux and macOS jobs
- Linux: 25 -> 15 minutes.
- Linux H3: 45 -> 10 minutes.
- macOS: 25 -> 15 minutes.

On macOS this may catch flaky slowness seen sometimes in pytests:
https://github.com/curl/curl/pull/20187#issuecomment-3711753097

Closes #20192
2026-01-05 23:27:36 +01:00
Andrew
d3def68d3b multi: fix to build on IBMi
Sync function declaration with definition. Update related local vars.

Follow-up to 4701a6d2ae #19695
Fixes #20190
Closes #20191
2026-01-05 23:16:04 +01:00
Andrew
0343951cb5 ldap: fix Curl_ldap_version() for IBMi/OS400
- `LDAP_OPT_SUCCESS` (== 0) is missing from some LDAP implementations
  and documented to use `LDAP_SUCCESS` (== 0) instead. Use literal zero
  to avoid macro name differences.

- fix freeing `LDAP_OPT_API_INFO` buffers:
  - docs suggest `ldapai_vendor_name` on IBMi is `const char *`.
    Nothing in docs says it need to be freed.
  - `ldapai_extensions` need to be freed, according to docs.
    However, on IBMi there is `ldap_value_free()` function for it.
  Ref: https://www.ibm.com/docs/en/svd/10.0.3?topic=settings-ldap-opt-api-info

Fixing, on OS400 (V7R4M0):
```
CZM1003:  LDAP__819.c, 1028.56: CZM0045(30) Undeclared identifier LDAP_OPT_SUCCESS.
CZM1003:  LDAP__819.c, 1036.21: CZM0280(30) Function argument assignment between types "char*" and "const char*" is not allowed.
CZM1001:  LDAP__819.c, 1037.5: CZM0304(10) No function prototype given for "ber_memvfree".
...
CZS0601:  Module LDAP is not created because statement errors occurred.
```

Follow-up to 859ce48de1 #19832
Fixes #20188
Closes #20189
2026-01-05 23:10:47 +01:00
Viktor Szakats
0ec07e38f3 GHA/macos: drop compiler matrix for macos jobs
To reduce the number of jobs, and the time spent running macos runners.
The curl codebase has just a few Apple-specific parts, and they remain
well-covered after this patch.

Makes the number of jobs 24, down from 32.

Perhaps more jobs could be merged or dropped, and CPU use reduced by
moving some to cmake. Unique, but not Apple-specific jobs may also be
moved to Linux.

Follow-up to b869932392 #20178

Closes #20187
2026-01-05 19:43:23 +01:00
Viktor Szakats
9f1838e965 GHA/macos: enable Apple IDN and SecTrust for combination jobs
Closes #20185
2026-01-05 11:00:19 +01:00
Daniel Stenberg
20ac5531cd mk-lib1521: make the test set each string option again
In an attempt to make sure that setting it again does not leak memory.

The second string is set to `""`, which is done so that this now finds
the problem reported in #20179.

Ref: #20179
Closes #20181
2026-01-04 14:48:13 +01:00
Daniel Stenberg
193397bf4e progress: narrower time display, multiple fixes
- Each time field is now 7 characters wide, so that the total width
  never exceeds 79 columns so that it works correctly also in Windows
  terminals. The title lines are adjusted accordingly.

  This is accomplished by using h:mm:ss style up to 10 hours, and for
  longer periods switch to "nnX nnY" style output. For hours, days,
  months and years.

  For less than one hour, the hour field is now dropped.

  When no time info is provided, the field is now space-only. No more
  `-:--:--`.

  Also fixed the output for really long times which previously was
  completely broken. The largest time now shows as ">99999y". (Becase
  I can't figure out a better way).

- For sizes, the widths are now properly fixed to 6 characters. When
  displaying a unit with less than 3 digits, it shows two decimal
  precision like "16777215 => 15.99M" and one decmal otherwise: "262143
  => 255.9k"

  Also fixes the decimal math. 131071 is 127.9k, which it previously did
  not show.

- The time and size field outputs are now properly verified in test
  1636.

Fixes #20122
Closes #20173

fixup use only space when no time exists

Drop the hour from the display when zero
2026-01-04 14:42:08 +01:00
Daniel Stenberg
3c8f9c9247 setopt: free the previous STRING_ENCODING before storing the new
Follow-up to 6b9c75e219

Fixes #20179
Reported-by: correctmost on github
Closes #20180
2026-01-04 14:32:28 +01:00
Daniel Stenberg
eb7f5b71e5 tool_doswin: remove the max length check
A too long name is likely to cause a problem later anyway and get
reported there. We don't enforce file name lengths for any other
systems.

Assisted-by: Jay Satiro
Assisted-by: Viktor Szakats

Closes #20143
2026-01-04 11:22:43 +01:00
Viktor Szakats
b869932392 GHA/macos: reduce number of combination jobs
- drop autotools (except one) from combination jobs.
  They seem to add little value over cmake ones, yet take a lot of time
  even after restricting them to shared libs.

  20-25s to install autotools via Homebrew, for each 11 jobs. autoreconf
  taking 10s, configure 25s, build 30-35s. A total of 1m30s to 1m45s per
  job. Sometimes jumping up to 2-4 minutes.

  Compare this to 20-25s total job times with cmake.

  Keep one job with an indentical cmake pair to help detecting
  build-tool-specific fallouts.

- drop more combination jobs.
  To avoid overlap with main build jobs.

Reducing number of jobs to 9, from 22 (-13),
total job time to 5.5 minutes, from 25 (-20m).

Before: https://github.com/curl/curl/actions/runs/20637652089
After: https://github.com/curl/curl/actions/runs/20686390641?pr=20178

Considering the small amount of Apple-specific code in curl since
dropping Secure Transport, and that most combination issue were in
the toolchains, not curl, there is likely more room to avoid wasting
cycles (at 41 macOS + 3 iOS jobs after this patch).

Follow-up to d057b705fd #20167

Closes #20178
2026-01-04 04:01:37 +01:00
Daniel Stenberg
b32e66a8ee tool_progress: fix large time outputs and decimal size display
Time output:

- was broken for really large times

- now uses spaces instead of --:--:--

- >99999y is now the largest shown time

- show HH:MM:SS as long as hours are fewer than 100

Size:

- made the decimal output always only use a single decimal

Test:

- Add test 1622 to verify these functions

Closes #20177
2026-01-04 00:16:59 +01:00
Tobias Zimmermann
09374f6e75 docs: add a note about --compressed to note about binary output
Closes #20168
2026-01-04 00:10:40 +01:00
Daniel Stenberg
5ef7fa39d5 tool_getparam: use UNITTEST not, ifdef
Closes #20174
2026-01-04 00:09:12 +01:00
Viktor Szakats
b374a8f07f servers.pm: say the protocol when http server failed to start
To serve as possibly more signal to see when/why the http server fails
to start in some random cases (on Windows).

Seen it happen in the 'mingw, CM clang-x86_64 gnutls libss' CI job:
https://github.com/curl/curl/pull/20163#issuecomment-3705572750
https://github.com/curl/curl/pull/20163#issuecomment-3707231458

Closes #20176
2026-01-03 20:39:27 +01:00
Stefan Eissing
68b94daeb8 pytest: test 16_01 stabilize
When checking the reported times of a transfer, do not exptect
the 'queue' time to be in any relation to others. 'queue' uses its own
start timestamp and the reported duration is thereofore independant.

Ref: #20112
Closes #20163
2026-01-03 13:04:21 +01:00
Viktor Szakats
d07024cf93 GHA: restore --shallow value for some torture tests
It also means that now all torture test-pairs use the same shallowness,
while earlier FTP used 20.

Also:
- This made macOS torture jobs slow enough to split them into 3 jobs.

Follow-up to 2cbcde90e7 #20153

Closes #20172
2026-01-03 01:02:41 +01:00
Stefan Eissing
a348f19bd1 pytest: test 07_22 stabilize
Do not generate a 400 response code, but use a 200 one. The upload needs
to fail on sending, not on seeing a 400 response. Seeing a 400 before
the sending fails (when CI timings shift) will expose the wrong error
code.

Ref: #20112
Closes #20164
2026-01-03 00:48:54 +01:00
Stefan Eissing
2c32ab12a0 pytest: test 07_70 stabilize (curl_ngtcp2)
We recently allowed a larger send buffer in ngtcp2 streams. This allowed
curl to send more early data then previously when the server was slow in
performing the handshake. This led to flaky test failures when the
amount of early data was larger than expected.

Change test expectations to allow for varying amount of early data.

Ref: #20112
Closes #20161
2026-01-03 00:48:54 +01:00
Stefan Eissing
ac06643f71 pytest: test 03_02 stabilize (curl_ngtcp2)
The special handling for draining server connections during a connect
attempt was only done on CURLE_RECV_ERROR. But it may also happen when
ngtcp2 errors on writing data. Check for CURLE_SEND_ERROR also.

Ref: #20112
Closes #20162
2026-01-03 00:48:54 +01:00
Daniel Stenberg
46bda31702 RELEASE-NOTES: synced 2026-01-02 23:53:33 +01:00
Daniel Stenberg
03c9215e62 altsvc: accept ma/persist per alternative entry
The 'ma' and 'persist' keywords should be considered per list entry, not
once per header.

Expand test 1654 to verify such headers

Reported-by: Hunt Darlener
Closes #20160
2026-01-02 23:50:21 +01:00
Viktor Szakats
003dddae2b GHA/non-native: reduce workflow timeouts
Closes #20171
2026-01-02 23:43:23 +01:00