Commit Graph

6835 Commits

Author SHA1 Message Date
Viktor Szakats
2c27a67daa
tests: always make bundles, adapt build and tests
Make test bundles the default. Drop non-bundle build mode.
Also do all the optimizations and tidy-ups this allows, simpler builds,
less bundle exceptions, streamlined build mechanics.

Also rework the init/deinit macro magic for unit tests. The new method
allows using unique init/deinit function names, and calling them with
arguments. This is in turn makes it possible to reduce the use of global
variables.

Note this drop existing build options `-DCURL_TEST_BUNDLES=` from cmake
and `--enable-test-bundles` / `--disable-test-bundles` from autotools.

Also:
- rename test entry functions to have unique names: `test_<testname>`
  This removes the last exception that was handled in the generator.
- fix `make dist` to not miss test sources with test bundles enabled.
- sync and merge `tests/mk-bundle.pl` into `scripts/mk-unity.pl`.
- mk-unity.pl: add `--embed` option and use it when `CURL_CLANG_TIDY=ON`
  to ensure that `clang-tidy` does not miss external test C sources.
  (because `clang-tidy` ignores code that's #included.)
- tests/unit: drop no-op setup/stop functions.
- tests: reduce symbol scopes, global macros, other fixes and tidy-ups.
- tool1621: fix to run, also fix it to pass.
- sockfilt: fix Windows compiler warning in certain unity include order,
  by explicitly including `warnless.h`.

Follow-up to 6897aeb105 #17468

Closes #17590
2025-06-14 21:08:23 +02:00
Viktor Szakats
3934431421
tidy-up: drop BearSSL and Secure Transport reference remains
Follow-up to 08a3e8e19a #16677

Closes #17582
2025-06-11 11:14:29 +02:00
Daniel Stenberg
599bf4a271
RELEASE-PROCEDURE.md: update docs/VERSIONS
Add it as an item to fix in each release

Closes #17584
2025-06-11 09:21:44 +02:00
Orgad Shaneh
b244371bf4
VERSIONS.md: update
Closes #17583
2025-06-11 08:49:15 +02:00
Daniel Stenberg
08a3e8e19a
TLS: remove support for Secure Transport and BearSSL
These libraries do not support TLS 1.3 and have been marked for removal
for over a year. We want to help users select a TLS dependency that is
future-proof and reliable, and not supporting TLS 1.3 in 2025 does not
infer confidence. Users who build libcurl are likely to be served better
and get something more future-proof with a TLS library that supports
1.3.

Closes #16677
2025-06-11 07:54:19 +02:00
Viktor Szakats
b761eb5add
cmake: replace cmakelint with cmake-lint from cmakelang, fix issues
This linter detects formatting and naming issues with minimal amount of
noise. It seems to be an improvement over the existing linter which was
only detecting line width overruns.

Also: fix to exclude `CurlTests.c` from linter.

Ref: https://cmake-format.readthedocs.io/en/latest/cmake-lint.html
Ref: https://github.com/cheshirekow/cmake_format

Closes #17576
2025-06-11 07:07:49 +02:00
Viktor Szakats
a7e364df81
cmake: document OpenSSL and ngtcp2 crypto lib custom variables
Cherry-picked from #17561

Closes #17574
2025-06-10 16:31:07 +02:00
Dan Fandrich
5f805eec11 tool_getparam: fix --ftp-pasv
This boolean option was moved to the wrong handling function. Make it
an ARG_NONE and move it to the correct handler and add a test to
verify that the option works.

Follow-up to 698491f44

Reported-by: fjaell on github
Fixes #17545
Closes #17547
2025-06-06 14:40:14 -07:00
John Haugabook
3035b8e7a4
INSTALL.md: cygwin details and add source code link
Added more details to help with cygwin install, adding links to curl
source code where relevant to help save people a little time.

Closes #17485
2025-06-05 12:37:07 +02:00
Daniel Stenberg
fae5784346
docs/examples: add ftp-delete.c
To show how to delete a single file after a transfer

Closes #17540
2025-06-05 12:17:21 +02:00
Daniel Stenberg
614313f12f
system.h: remove some macros
Since curl_off_t is always 64 bit these days, we can simplify and avoid
using some macros.

Closes #17498
2025-06-05 10:56:31 +02:00
Daniel Stenberg
cda3bb3741
THANKS: add names from 8.14.1 release 2025-06-04 07:40:18 +02:00
Daniel Stenberg
f6ab4c8b75
cmdline-docs: mention HTTP resumed uploads to be shaky
In the documentation for the --continue-at and --range options.

A future version could implement support for the new standard HTTP resumed
uploads mechanism.

Ref: #17510
Closes #17521
2025-06-02 23:23:50 +02:00
Ruocco, Calvin
d3594be653
ws: tests and fixes
This started out as regression tests for the `curl_ws_recv()` and
`curl_ws_send()` implementation and ended up with a bugfix, additional
protocol validation and minor logging improvements.

- Fix reset of fragmented message decoder state when a PING/PONG is
  received in between message fragments.

- Fix undefined behavior (applying zero offset to null pointer) in
  curl_ws_send() when the given buffer is NULL.

- Detect invalid overlong PING/PONG/CLOSE frames.
- Detect invalid fragmented PING/PONG/CLOSE frames.
- Detect invalid sequences of fragmented frames.

  - a) A continuation frame (0x80...) is received without any ongoing
    fragmented message.
  - b) A new fragmented message is started (0x81/0x01/0x82/0x02...)
    before the ongoing fragmented message has terminated.

- Made logs for invalid opcodes easier to understand.
- Moved noisy logs to the `CURL_TRC_WS` log level.
- Unified the prefixes for WebSocket log messages: `[WS] ...`

- Add env var `CURL_WS_FORCE_ZERO_MASK` in debug builds.

  - If set, it forces the bit mask applied to outgoing payloads to
    0x00000000, which effectively means the payload is not masked at
    all. This drastically simplifies defining the expected `<protocol>`
    data in test cases.

- 2700: Frame types
- 2701: Invalid opcode 0x3
- 2702: Invalid opcode 0xB
- 2703: Invalid reserved bit RSV1 _(replaces 2310)_
- 2704: Invalid reserved bit RSV2
- 2705: Invalid reserved bit RSV3
- 2706: Invalid masked server message
- 2707: Peculiar frame sizes _(part. replaces 2311)_
- 2708: Automatic PONG
- 2709: No automatic PONG _(replaces 2312)_
- 2710: Unsolicited PONG
- 2711: Empty PING/PONG/CLOSE
- 2712: Max sized PING/PONG/CLOSE
- 2713: Invalid oversized PING _(replaces 2307)_
- 2714: Invalid oversized PONG
- 2715: Invalid oversized CLOSE
- 2716: Invalid fragmented PING
- 2717: Invalid fragmented PONG
- 2718: Invalid fragmented CLOSE
- 2719: Fragmented messages _(part. replaces 2311)_
- 2720: Fragmented messages with empty fragments
- 2721: Fragmented messages with interleaved pong
- 2722: Invalid fragmented message without initial frame
- 2723: Invalid fragmented message without final frame

- 2305: curl_ws_recv() loop reading three larger frames
  - This test involuntarily sent an invalid sequence of opcodes (0x01...,0x01...,0x81...) , but neither libcurl nor the test caught this! The correct sequence was tested in 2311 (0x01...,0x00...,0x80...). See below for 2311.
  - Validation of the opcode sequence was added to libcurl and is now tested in 2723.
  - Superseded by 2719 (fragmented message) and 2707 (large frames).
- 2307: overlong PING payload
  - The tested PING payload length check was actually missing, but the test didn't catch this since it involuntarily sent an invalid opcode (0x19... instead of 0x89...) so that the expected error occurred, but for the wrong reason.
  - Superseded by 2713.
- 2310: unknown reserved bit set in frame header
  - Superseded by 2703 and extended by 2704 and 2705.
- 2311: curl_ws_recv() read fragmented message
  - Superseded by 2719 (fragmented message) and 2707 (large frames).
- 2312: WebSockets no auto ping
  - Superseded by 2709.

- No tests for `CURLOPT_WRITEFUNCTION`.
- No tests for sending of invalid frames/fragments.

Closes #17136
2025-06-02 11:15:38 +02:00
Viktor Szakats
516e9ccab3
GHA/non-native: un-ignore tests on OpenBSD, bump to -j8 for NetBSD/FreeBSD
- un-ignore tests (3017, FTP, TFTP) on OpenBSD
  Patch-by: Jacob Mealey
  Ref: https://github.com/curl/curl/issues/13623#issuecomment-2925129037
  Fixes: #13623

- KNOWN_BUGS: drop TFTP failures issue on OpenBSD.
  Fixes: #13623

- bump test parallelism to `-j8` (from `-j4`) for NetBSD, FreeBSD,
  to match OpenBSD.
  Before: https://github.com/curl/curl/actions/runs/15371760479
  After: https://github.com/curl/curl/actions/runs/15371937205

- FreeBSD: sync cmake `TFLAGS` with autotools. (This branch is not
  currently hit in CI.)
  Follow-up to 7f3d598276 #15040

Closes #17505
2025-06-02 00:21:52 +02:00
Yedaya Katsman
4ac7087306
docs/tests: remove mention of hyper
Closes #17500
2025-06-01 13:45:52 +02:00
Daniel Stenberg
83c90e5047
VULN-DISCLOSURE-POLICY.md: the distros list wants <= 7 days embargo
Closes #17497
2025-05-31 18:00:58 +02:00
Daniel Stenberg
fe81a80ae7
spelling: call it null-terminate consistently
With a dash, using two Ls. Also for different forms of the word.

Use NULL in all uppercase if it means a zero pointer.

Follow-up to 307b7543ea

Closes #17489
2025-05-30 17:29:45 +02:00
Daniel Stenberg
bdb7d8b004
spelling: 'a' vs 'an'
Closes #17487
2025-05-30 11:38:35 +02:00
Daniel Stenberg
b13a7a3ec4
misc: we write *an* IPv6 address
Add it as a "bad word"

Closes #17484
2025-05-30 07:53:31 +02:00
Samuel Henrique
620401f193
docs: fix typos
After Gmail called out the typo I fixed on
532d89a866, I've decided to paste the
whole man page into Google docs and check what other issues it would
spot.

I know, it sounds silly, but I've just spent the last hour and a half
going over each one of them and fixing everything which was a true
finding and non-controversial.

Closes #17480
2025-05-29 10:21:52 +02:00
Daniel Stenberg
fa3f889752
tests: move test docs into /docs
In an attempt to make them easier to find.

The man pages runtests.md and testcurl.md are in /docs

The rest of the test documentation is in /docs/tests

Closes #17463
2025-05-28 15:00:03 +02:00
Daniel Stenberg
6eea7219a5
BUG-BOUNTY.md. mention the medium bounty amount in 2025
Closes #17470
2025-05-28 08:47:26 +02:00
Daniel Stenberg
950ef272fa
docs/THANKS: updated from the 8.14.0 release 2025-05-28 07:40:54 +02:00
Daniel Stenberg
c0d777c319
curl_url_get.md: don't call it normalized
Because that's not what it does.

Reported-by: Alberto Leiva Popper
Fixes #16829
Closes #17464
2025-05-27 09:25:32 +02:00
Samuel Henrique
532d89a866
docs: fix typo in retry.md
Closes #17443
2025-05-26 13:03:02 +02:00
Daniel Stenberg
783586b8fd
CURLOPT_FOLLOWLOCATION.md: switch to GET => no body
Clarify

URL: https://curl.se/mail/lib-2025-05/0026.html
Closes #17454
2025-05-26 13:00:38 +02:00
Daniel Stenberg
217c22f315
CURLOPT_READFUNCTION.md: mention the seek callback
Brought-up-by: Jeroen Ooms
URL: https://curl.se/mail/lib-2025-05/0030.html
Closes #17455
2025-05-26 12:59:43 +02:00
Daniel Stenberg
2b18866cd9
DEPRECATE.md: add version numbers to old deprecated items
For better tracking

Closes #17424
2025-05-23 11:01:13 +02:00
Viktor Szakats
4331e7087b
windows: fix builds targeting WinXP, test it in CI
- appveyor: make a job target Windows XP.

- examples/block_ip: force this specific example to target Vista to make
  it compile when building curl for Windows XP. Fixing:
  ```
  docs\examples\block_ip.c(157): warning C4013: 'inet_pton' undefined; assuming extern returning int
  docs\examples\block_ip.c(272): warning C4013: 'inet_ntop' undefined; assuming extern returning int
  ```
  Ref: https://ci.appveyor.com/project/curlorg/curl/builds/52102142/job/2ajdluhc20r4gmmw#L530

Cherry-picked from #17413
Closes #17415
2025-05-22 13:04:28 +02:00
Nigel Brittain
c19465ca55
http_aws_sigv4: improve sigv4 url encoding and canonicalization
Closes #17129
2025-05-21 08:07:18 +02:00
Daniel Stenberg
6422005a3b
DEPRECATE: restore the Windows CE text
Accidentally wiped out with 63e513b106
2025-05-20 23:11:23 +02:00
Viktor Szakats
1e4a59f8fd
DEPRECATE.md: fix typo
Bug: https://github.com/curl/curl/actions/runs/15112183952/job/42473983311

Closes #17391
2025-05-20 00:40:31 +02:00
Viktor Szakats
e785e898a6
checksrc: avoid extra runs in CI, enable more check locally, fix fallouts
To avoid redundant work in CI and to avoid a single checksrc issue make
all autotools jobs fail. After this patch checksrc issues make fail
the checksrc job, the `dist / verify-out-of-tree-autotools-debug`,
`dist / maketgz-and-verify-in-tree`  jobs and the fuzzer job (if run).
Of these, the `dist` jobs replicate local builds, also testing the build
logic.

Also add a script to check the complete local repository, optionally
with the build tree to verify generated C files.

Also:
- automatically run checksrc in subdirectories having a `checksrc`
  target. (examples, OS400, tests http/client, unit and tunit)
- tests/libtest: make sure to run `checksrc` on generated `lib1521.c`.
  (requires in-tree autotools build.)
- tests: run `checksrc` on targets also for non-`DEBUGBUILD`
  builds. It ensures to check `lib1521.c` in CI via job
  `dist / maketgz-and-verify-in-tree`.
- src: drop redundant `$(builddir)` in autotools builds.
- scripts: add `checksrc-all.sh` script to check all C sources and
  the build directory as an option.
- use the above from CI, also make it verify all generated sources.
- silence `checksrc` issues in generated C sources.
- checksrc: add `-v` option to enable verbose mode.
- checksrc: make verbose mode show checked filename and fix to only
  return error on failure.
- make sure that generated C files pass `checksrc`.

Assisted-by: Daniel Stenberg

Closes #17376
2025-05-19 18:59:50 +02:00
Daniel Stenberg
63e513b106
DEPRECATE.md: drop support for VS2008
Closes #17380
2025-05-19 13:48:41 +02:00
Daniel Stenberg
8491e6574c
DEPRECATE.md: drop Windows CE support
Closes #17379
2025-05-19 13:32:26 +02:00
Daniel Stenberg
b4310c0fb9
docs/libcurl: mention sensitive data/headers
In the CURLOPT_DEBUGFUNCTION and CURLOPT_VERBOSE documentation.

Mentioned-by: Gordon Parke
Fixes #17353
Closes #17355
2025-05-15 19:42:32 +02:00
Daniel Stenberg
a9aafbea95
CONTRIBUTE: add project guidelines for AI use
Feedback-by: Daniel Fosco
Feedback-by: Jimmy Sjölund
Feedback-by: Christoph Jabs
Feedback-by: Manuel Strehl
Feedback-by: Dan Fandrich
Feedback-by: Sarah Gooding

Closes #17325
2025-05-15 14:07:39 +02:00
Daniel Stenberg
f0f6c610a9
_SEEALSO.md: remove spaces around command and man page section
Follows traditions better

Closes #17348
2025-05-14 23:34:28 +02:00
Viktor Szakats
828f998493
spacecheck.pl: drop more exceptions
- replace ß (scharfes S) with links.
- replace § (section sign) with links.
- replace 🙏 emoji with `🙏`.
 Supported by GitHub, Forgejo/Gitea and most likely GitLab.
- docs/libcurl/curl_mprintf.md: replace Unicode ± with `{+|-}`.
- docs/CIPHERS.md: URL encode Unicode in URLs.
- lib1560: use hex encoding in `räksmörgås.se`.
- unit1307: use hex encoding in `Lindmätarv`.
- drop LATIN SMALL LETTER A WITH ACUTE exception.
  No longer appears in tests.

This leaves the single character exception: `ö`
And file exceptions holding contributor names.

Follow-up to 9243ed59b3 #17329
Follow-up to 838dc53bb7 #17247

Closes #17335
2025-05-13 16:01:07 +02:00
Daniel Stenberg
65444f1dc3
curlx: move the docs to docs/internals/
Closes #17333
2025-05-13 10:30:02 +02:00
Dan Fandrich
fca1fdc988 docs: update distros links 2025-05-12 13:51:38 -07:00
Daniel Stenberg
cf511e7726
TODO: Retry SOCKS handshake
Closes #17222
Closes #17326
2025-05-12 16:34:28 +02:00
Jay Satiro
b794264408 curl_version_info.md: clarify ssl_version for MultiSSL
- Clarify that the ssl_version in MultiSSL builds contains all SSL
  backend names with the inactive backend names in parentheses.

Closes https://github.com/curl/curl/pull/17308
2025-05-11 12:23:36 -04:00
Daniel Stenberg
cd7904f5a9
CURLMOPT_TIMERFUNCTION.md: correct the example
Fixes #17301
Reported-by: Dirk Feytons
Closes #17303
2025-05-09 17:04:40 +02:00
Daniel Stenberg
bc46ff2d2b
RELEASE-PROCEDURE: update the coming release dates 2025-05-07 14:39:18 +02:00
Daniel Stenberg
255aac56f9
curlx: move into to curlx/
Move curlx_ functions into its own subdir.

The idea is to use the curlx_ prefix proper on these functions, and use
these same function names both in tool, lib and test suite source code.
Stop the previous special #define setup for curlx_ names.

The printf defines are now done for the library alone. Tests no longer
use the printf defines. The tool code sets its own defines. The printf
functions are not curlx, they are publicly available.

The strcase defines are not curlx_ functions and should not be used by
tool or server code.

dynbuf, warnless, base64, strparse, timeval, timediff are now proper
curlx functions.

When libcurl is built statically, the functions from the library can be
used as-is. The key is then that the functions must work as-is, without
having to be recompiled for use in tool/tests. This avoids symbol
collisions - when libcurl is built statically, we use those functions
directly when building the tool/tests. When libcurl is shared, we
build/link them separately for the tool/tests.

Assisted-by: Jay Satiro

Closes #17253
2025-05-07 11:01:15 +02:00
sftcd
de881a92eb
ECH: reference the OpenSSL ECH feature branch
rather than the defo-project fork.

Closes #17251
2025-05-06 09:02:24 +02:00
Andrei Florea
a638828c88
TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs
Fixes #12982
Closes #16964
2025-04-30 17:47:22 +02:00
NeimadTL
f9daa75a3b
TODO: remove "nicer lacking perl message"
The document has been updated by removing point 20.2 as it was done
some time ago.

Closes #17233
2025-04-30 08:25:14 +02:00