Commit Graph

550 Commits

Author SHA1 Message Date
Daniel Stenberg
6c31df453b
mqtt: initial support for MQTTS
Closes #19418
2026-01-17 22:43:36 +01:00
Viktor Szakats
ac6264366f
tidy-up: miscellaneous
- tool_bname: scope an include.
- `endif` comments.
- Markdown fixes.
- comment tidy-ups.
- whitespace, newlines, indent.

Closes #20309
2026-01-15 13:06:13 +01:00
Viktor Szakats
62ba3604dc
checksrc: do not apply BANNEDFUNC to struct member functions
Omit this warning, when `close()` is banned:
```
./lib/vtls/vtls.c:947:13: warning: use of close is banned (BANNEDFUNC)
   Curl_ssl->close(cf, data);
             ^
```
Ref: https://github.com/curl/curl/actions/runs/21012427938/job/60410334312?pr=20212#step:3:6

Ref: #20212

Closes #20323
2026-01-15 02:06:06 +01:00
Daniel Stenberg
f057ed05be
checksrc: warn for leading spaces before the preprocessor hash
Fix the 40+ fallouts

Closes #20282
2026-01-13 09:52:26 +01:00
Daniel Stenberg
4b566d8310
top-complexity: always show the top-25
Accept argument as a custom amount. Previously it showed all functions
with a complexity score above 57. This way it adapts better as we
gradually decrease complexity in functions.

Closes #20273
2026-01-13 07:32:53 +01:00
Viktor Szakats
3ee1d3b573
tidy-up: merge root packages directory into projects
To simplify the directory layout.

- OS400 and vms support move from `packages` to `projects`.

- Windows README and `generate.bat` files move from `projects`
  to `projects/Windows`.

Closes #20271
2026-01-12 23:49:35 +01:00
Viktor Szakats
e52e6dac8e
spacecheck: show line numbers of duplicate empty lines
Also:
- drop separate check for 3 or more consecutive empty lines.

Ref: https://github.com/curl/curl/pull/20266#issuecomment-3738955165

Closes #20269
2026-01-12 22:21:01 +01:00
Viktor Szakats
13f0ede730
build: add curl-lint/lint targets, CURL_LINT cmake option
To run checksrc and spacecheck on the source tree. Also for cmake
to sync up with autotools' `checksrc` target.

- cmake: `curl-lint`
  With `-DCURL_LINT=ON`, checks run automatically for all targets.
- autotools: `lint`

Closes #20175
2026-01-12 16:45:24 +01:00
Samuel Henrique
dce81d3c4e
wcurl: import v2026.01.05
Closes #20194
2026-01-06 10:12:31 +01:00
Daniel Stenberg
d6be42eafa
delta: fix grep patterns after white space edits
To make the command line option counter work again

Follow-up to 308c347c8b
2025-12-30 14:04:10 +01:00
Viktor Szakats
7032982896
tidy-up: miscellaneous
- asyn-thrdd.c: scope an include.
- apply more clang-format suggestions.
- tidy-up PP guard comments.
- delete empty line from the top of headers.
- add empty line after `curl_setup.h` include where missing.
- fix indent.
- CODE_STYLE.md: add `strcpy`.
  Follow-up to 8636ad55df #20088
- lib1901.c: drop unnecessary line.
  Follow-up to 436e67f65b #20076

Closes #20070
2025-12-26 22:06:09 +01:00
Daniel Stenberg
a585cc35e5
memdebug: stop tracking send and recv
- they rarely catch any problems
- we have other ways to test different send/recv problems
- the number of such calls vary much more per invoke than others, making
  memdebugging harder
- reducing the total number of fallible functions per test is good
- they were not used as intended anyway

Closes #20097
2025-12-26 10:27:27 +01:00
Viktor Szakats
8636ad55df
checksrc: ban strcpy
No longer used in the codebase. Replacement is `curlx_strcopy()`, possibly
`memcpy()` or dynbuf.

Also:
- OS400: allow three calls.

Closes #20088
2025-12-24 13:55:25 +01:00
Viktor Szakats
4ad87f2cb8
checksrc: ensure using ifdef/ifndef when possible, fix fallouts
Follow-up to 89771d19d5 #18018

Closes #20065
2025-12-21 21:12:31 +01:00
Daniel Stenberg
94a57b4e15
contrithanks.sh: adopt the stricter by: check from contributors.sh 2025-12-20 17:45:15 +01:00
Daniel Stenberg
50b29440a3
contributors.sh: even stricter requirements for the -by: line 2025-12-20 17:44:18 +01:00
Viktor Szakats
6d0ee7b17b
curlx: add curlx_rename(), fix to support long filenames on Windows
Move existing `Curl_rename()` `rename()` wrapper from lib to
curlx/fopen, and make it a curlx macro/function. To allow using
the local worker function to fixup long filenames on Windows.

Then fix the Windows-specific rename implementation to support long
filenames. This operation may happen when using a cookie jar, HSTS cache
or alt-svc cache, via libcurl or the curl tool.

Before this patch, when passing a long filename to the above options,
a `<random>.tmp` file was left on the disk without renaming it to the
filename passed to curl. There was also 1 second delay for each
attempted rename operation.

Also:
- checksrc: ban raw `rename()` and `MoveFileEx*()` functions.
- Note: `Curl_rename()` returned 1 on failure before this patch, while
  `curlx_rename()` returns -1 after, to match POSIX `rename()`.

Refs:
https://learn.microsoft.com/windows/win32/api/winbase/nf-winbase-movefileexa
https://learn.microsoft.com/windows/win32/fileio/maximum-file-path-limitation

Ref: #20040

Closes #20042
2025-12-20 16:03:11 +01:00
Viktor Szakats
969351bb1e
windows: fix CreateFile() calls to support long filenames
It makes them work in Schannel's CA bundle loader, and curl tool's
set/get file timestamp operations (e.g. in `-R`/`--remote-time`). Also
to match file open operations, that already support long filenames.

E.g. when using `--remote-time`, fixing:
```
Warning: Failed to set filetime 1741363917 on outfile: CreateFile failed:
Warning: GetLastError 0x00000003
```

The special long filename logic is necessary to support Windows releases
prior to Windows 10 v1607. With the latter, it's possible to opt-in to
this behavior via a manifest setting. Note that Windows itself also needs
to opt-in to support this. Finally note that curl itself needs passing
`--globoff` to let long filenames through, pending #20044 and #20046.

Refs:
https://learn.microsoft.com/windows/win32/api/fileapi/nf-fileapi-createfilea
https://learn.microsoft.com/windows/win32/fileio/maximum-file-path-limitation

Ref: #8361
Inspired by: #19286
Inspired-by: Mathesh V
Closes #19286
Closes #20040
2025-12-20 14:16:42 +01:00
Viktor Szakats
1892286086
cmake: match filename suffixes with file content
To:
- simplify recognizing CMake sources.
- ensure syntax highlighters use the correct file type.
- sync .h template filename with its autotools counterpart.

Also:
- cmakelint.sh: simplify, alpha sort the filelist.
- perlcheck.sh: simplify.

Closes #20039
2025-12-20 11:34:27 +01:00
Daniel Stenberg
828d2e8762
contributors.sh: only check -by: lines for names
Avoid catching lines that otherwise just says "by:" something.
2025-12-19 11:07:53 +01:00
Viktor Szakats
308c347c8b
tidy-up: miscellaneous
- apply more clang-format.
- lib/version: use `CURL_ARRAYSIZE()`.
- INSTALL-CMAKE.md: sync-up an option description with others.
- examples: delete unused main args.
- examples/ftpgetinfo: document `_CRT_SECURE_NO_WARNINGS` symbol.
- delete remaining stray duplicate lines.
- acinclude.m4: drop an unnecessary x-hack.
- vtls/mbedtls: join a URL split into two lines.
- src/tool_cb_see: add parentheses around macro expressions.
- src/tool_operate: move literals to the right side of comparisons.
- libtests: sync up fopen/fstat error messages between tests.
- curl_setup.h: replace `if ! defined __LP64` with `ifndef __LP64`.
  I assume it makes no difference on Tandem systems, as the latter form
  is already used in `include/curl/system.h`.

Closes #20018
2025-12-18 21:27:58 +01:00
Viktor Szakats
14d5b6c7a7
cmake: replace deprecated PERL_FOUND with Perl_FOUND
`Perl_FOUND` available since CMake v3.3.
`PERL_FOUND` deprecated since v4.2.

Ref: https://cmake.org/cmake/help/v4.2/module/FindPerl.html

Closes #20011
2025-12-17 17:56:32 +01:00
Viktor Szakats
fe8393d7db
tidy-up: miscellaneous
- drop stray duplicate empty lines in docs, scripts, test data, include,
  examples, tests.
- drop duplicate PP parenthesis.
- curl-functions.m4: move literals to the right side in if expressions,
  to match rest of the source code.
- FAQ.md: delete language designator from an URL.
- packages: apply clang-format (OS400, VMS).
- scripts/schemetable.c: apply clang-format.
- data320: delete duplicate empty line that doesn't change the outcome.
- spacecheck: extend to check for duplicate empty lines
  (with exceptions.)
- fix whitespace nits

Closes #19936
2025-12-12 04:18:48 +01:00
Daniel Stenberg
2e3687c60c
mdlinkcheck: only look for markdown links in markdown files
It finds debug outputs in source code otherwise.

Output the whitelist "warnings" to stderr to better allow us to count
URLs with `./mdlinkcheck --dry-run | wc -l`.

Closes #19938
2025-12-11 23:40:07 +01:00
Daniel Stenberg
26d766596e
mdlinkcheck: add --dry-run to only show all found URLs
- remove the debug tracing leftovers from d9d2e339ce that made exit
  unconditonally

Closes #19914
2025-12-10 10:51:10 +01:00
Viktor Szakats
d9d2e339ce
tidy-up: URLs (cont.) and mdlinkcheck
- add missing ending slashes.
  To avoid duplicates and to use canonical URLs.
- reapply lost updates.
  Follow-up to 2ae983bf4e #19879
- mdlinkcheck: include the `include` directory.
- mdlinkcheck: show unused whitelist items.
- mdlinkcheck: improve debug output.
- mdlinkcheck: delete redundant whitelist items.
- examples/simplessl: lowercase the protocol part.
- BINDINGS: replace one remaining HTTP URL with HTTPS.
  Issue: https://github.com/pycurl/pycurl/issues/892
- BINDINGS: fix a broken link.
- BINDINGS: follow a refresh content redirect.
- KNOWN_BUGS: whitespace.

Closes #19911
2025-12-10 01:21:07 +01:00
Viktor Szakats
3fb932d492
mdlinkcheck: do not pick up single quote and backslash after URLs
Closes #19910
2025-12-09 23:54:55 +01:00
Viktor Szakats
920319855d
mdlinkcheck: exclude self from URL search
To avoid picking up the whitelist.

Closes #19909
2025-12-09 23:54:54 +01:00
Daniel Stenberg
073b85cefe
GHA: make links get checked daily
Assisted-by: Viktor Szakats
Closes #19898
2025-12-09 16:28:23 +01:00
Daniel Stenberg
3dd1ffdeb0
FAQ/TODO/KNOWN_BUGS: convert to markdown
- convert to markdown
- auto-generate the TOCs on the website, remove them from the docs
- cleanups
- spellchecked
- updated links

Closes #19875
2025-12-09 10:52:56 +01:00
Viktor Szakats
d75716e4e5
tests/data: move --libcurl output to external data files
To make the test files XML-compliant, and the expected results
possibly easier to manage by keeping them in `.c` files.

Non-XML-compliant files are down to 36 after this patch.

Also:
- make all macro expansions apply to `%includetext` contents.

Closes #19799
2025-12-09 00:19:10 +01:00
Daniel Stenberg
a1c01b2015
mdlinkcheck: ignore IP numbers, allow '@' in raw URLs 2025-12-08 12:57:51 +01:00
Daniel Stenberg
51587f6f14
mdlinkcheck: detect and check "raw" links
- URLs specified outside of the markdown []() are now extracted and
  checked

- also check TODO, FAQ and KNOWN_BUGS

- more aggressive avoiding to check github.com/curl/curl, all uses of
  example domains and some more established URLs on the curl.se site

- list all errors in the end to make them easier to spot in CI logs

Closes #19848
2025-12-05 23:41:41 +01:00
Viktor Szakats
dfd781ff62
tidy-up: miscellaneous
- gnutls, mbedtls: fix casing in log messages.
- src/tool_cfgable.h: drop unused header.
- appveyor.sh: variable style.
- cmakelint.sh: sync with libssh2, catch `.cmake.in` explicitly.
- examples: drop obsolete comments, exclamation marks.
- fix comment typos, casing.

Closes #19839
2025-12-04 20:14:11 +01:00
Viktor Szakats
f553bff6ee
cmakelint: also lint CMake .in files, fix a long line
```
CMakeConfigurableFile.in
cmake_uninstall.cmake.in
curl-config.cmake.in
```

Follow-up to 16f073ef49 #16973
Closes #19773
2025-12-01 00:03:07 +01:00
Viktor Szakats
193cb00ce9
build: stop overriding standard memory allocation functions
Before this patch curl used the C preprocessor to override standard
memory allocation symbols: malloc, calloc, strdup, realloc, free.
The goal of these is to replace them with curl's debug wrappers in
`CURLDEBUG` builds, another was to replace them with the wrappers
calling user-defined allocators in libcurl. This solution needed a bunch
of workarounds to avoid breaking external headers: it relied on include
order to do the overriding last. For "unity" builds it needed to reset
overrides before external includes. Also in test apps, which are always
built as single source files. It also needed the `(symbol)` trick
to avoid overrides in some places. This would still not fix cases where
the standard symbols were macros. It was also fragile and difficult
to figure out which was the actual function behind an alloc or free call
in a specific piece of code. This in turn caused bugs where the wrong
allocator was accidentally called.

To avoid these problems, this patch replaces this solution with
`curlx_`-prefixed allocator macros, and mapping them _once_ to either
the libcurl wrappers, the debug wrappers or the standard ones, matching
the rest of the code in libtests.

This concludes the long journey to avoid redefining standard functions
in the curl codebase.

Note: I did not update `packages/OS400/*.c` sources. They did not
`#include` `curl_setup.h`, `curl_memory.h` or `memdebug.h`, meaning
the overrides were never applied to them. This may or may not have been
correct. For now I suppressed the direct use of standard allocators
via a local `.checksrc`. Probably they (except for `curlcl.c`) should be
updated to include `curl_setup.h` and use the `curlx_` macros.

This patch changes mappings in two places:
- `lib/curl_threads.c` in libtests: Before this patch it mapped to
  libcurl allocators. After, it maps to standard allocators, like
  the rest of libtests code.
- `units`: before this patch it mapped to standard allocators. After, it
  maps to libcurl allocators.

Also:
- drop all position-dependent `curl_memory.h` and `memdebug.h` includes,
  and delete the now unnecessary headers.
- rename `Curl_tcsdup` macro to `curlx_tcsdup` and define like the other
  allocators.
- map `curlx_strdup()` to `_strdup()` on Windows (was: `strdup()`).
  To fix warnings silenced via `_CRT_NONSTDC_NO_DEPRECATE`.
- multibyte: map `curlx_convert_*()` to `_strdup()` on Windows
  (was: `strdup()`).
- src: do not reuse the `strdup` name for the local replacement.
- lib509: call `_strdup()` on Windows (was: `strdup()`).
- test1132: delete test obsoleted by this patch.
- CHECKSRC.md: update text for `SNPRINTF`.
- checksrc: ban standard allocator symbols.

Follow-up to b12da22db1 #18866
Follow-up to db98daab05 #18844
Follow-up to 4deea9396b #18814
Follow-up to 9678ff5b1b #18776
Follow-up to 10bac43b87 #18774
Follow-up to 20142f5d06 #18634
Follow-up to bf7375ecc5 #18503
Follow-up to 9863599d69 #18502
Follow-up to 3bb5e58c10 #17827

Closes #19626
2025-11-28 10:44:26 +01:00
Viktor Szakats
986e6d4eae
CODE_STYLE.md: sync banned function list with checksrc.pl
Also alpha sort the list in checksrc.pl.

Closes #19733
2025-11-27 18:53:35 +01:00
Daniel Stenberg
ea7df8d076
docs: spell it Rustls with a capital R
I believe this is how the project itself uses it.

Closes #19702
2025-11-26 09:41:09 +01:00
Viktor Szakats
1e7d0bafc6
curlx/fopen: replace open CRT functions their with _s counterparts (Windows)
- `_wopen`        -> `_wsopen_s`
- `_open`, `open` -> `_sopen_s`
- `_wfopen`       -> `_wfopen_s`
- `fopen`         -> `fopen_s`
- `_wfreopen`     -> `_wfreopen_s`
- `freopen`       -> `freopen_s`

For better error handling and for using the CRT functions recommended
via warnings suppressed by `_CRT_SECURE_NO_WARNINGS`.

Also:
- add missing `freopen_s()` prototype when building with mingw-w64 <5.
  a5d824654c/
- tests/server: replace `open()` in the signal handler with `_sopen_s()`
  on Windows.
- tests/server: reduce scope of a checksrc exception to a single line.
- checksrc: ban replaced functions.

Refs:
https://learn.microsoft.com/cpp/c-runtime-library/reference/open-wopen
https://learn.microsoft.com/cpp/c-runtime-library/reference/sopen-s-wsopen-s
https://learn.microsoft.com/cpp/c-runtime-library/reference/freopen-wfreopen
https://learn.microsoft.com/cpp/c-runtime-library/reference/fopen-wfopen
https://learn.microsoft.com/cpp/c-runtime-library/reference/fopen-s-wfopen-s
https://learn.microsoft.com/cpp/c-runtime-library/reference/freopen-s-wfreopen-s

Closes #19643
2025-11-25 03:44:22 +01:00
Daniel Stenberg
56f2479c14
manage: expand the 'libcurl support required' message
Example of old text:

 --dns-ipv4-addr requires that libcurl is built to support c-ares.

New version:

 For --dns-ipv4-addr to work, it requires that the underlying libcurl is
 built to support c-ares.

Closes #19665
2025-11-24 23:35:00 +01:00
Viktor Szakats
18b9429313
curlx: replace mbstowcs/wcstombs with _s counterparts (Windows)
They are used in Windows-specific `fopen()`, `freopen`, `open()` and
`curlx_get_winapi_error()` calls, and in `fix_excessive_path()` in
Unicode builds.

Refs:
https://learn.microsoft.com/cpp/c-runtime-library/reference/mbstowcs-mbstowcs-l
https://learn.microsoft.com/cpp/c-runtime-library/reference/mbstowcs-s-mbstowcs-s-l
https://learn.microsoft.com/cpp/c-runtime-library/reference/wcstombs-wcstombs-l
https://learn.microsoft.com/cpp/c-runtime-library/reference/wcstombs-s-wcstombs-s-l

Also ban these functions via checksrc.

Co-authored-by: Jay Satiro

Closes #19581
2025-11-21 16:45:42 +01:00
Viktor Szakats
acfcc2b288
checksrc: ban _tcsncpy, wcscpy, wcsncpy
Follow-up to eaa7651374 #19589

Closes #19641
2025-11-21 16:42:45 +01:00
Viktor Szakats
3d80d37cf0
curlx: add and use curlx_freopen()
To complement the existing `curlx_fopen()` internal API.
It's used by the curl's `--stderr` option.

`curlx_freopen()` adds two features to the bare `freopen()`:
- tracing for debug-enabled builds.
- Unicode and long-filename support for Windows builds.

In effect this adds long-filename and enables Unicode support for
the `--stderr <filename>` curl command-line option on Windows.

Also add to checksrc.

Follow-up to 2f17a9b654 #10673

Closes #19598
2025-11-19 22:04:53 +01:00
Viktor Szakats
1e1ec7f6c2
badwords: add more contractions, fix fallouts
Also fix hits in autotools scripts (not to enforce).

Closes #19576
2025-11-17 19:29:15 +01:00
Viktor Szakats
ad35ecba97
badwords: fix issues found in scripts and other files
Single pass, not enforced.

Also:
- pyspelling.words: drop `web page`

Closes #19572
2025-11-17 17:18:07 +01:00
Viktor Szakats
1b48c6148a
tidy-up: miscellaneous
- schannel: delete superfluous parenthesis.
- tftp: delete stray space from log output.
- ws: update guard comment.
- docs/examples: constify variables.
- runtests/servers: enclose unknown parameter between quotes.
- scripts/perlcheck.sh: drop redundant grep `-E` option.
- THANKS: move names from comments to THANKS.
- sync `--depth` option style across scripts.
- sync git repo URL ending between some scripts.
- BINDINGS.md: drop protocol from archive.org URL path.
- whitespace, indent, unfold lines.

Closes #19565
2025-11-17 13:32:43 +01:00
Viktor Szakats
8a968095df
mk-ca-bundle.pl: default to SHA256 fingerprints with -t option
Replacing previous default: MD5.

You can use the existing `-s` option to override the default.

Also bump version to 1.30.

Closes #19359
2025-11-15 03:06:33 +01:00
Daniel Stenberg
42098d1ee6
checksrc: verify close brace indent level
Closes #19512
2025-11-13 17:27:48 +01:00
Viktor Szakats
6384e2aca0
checksrc: disallow atoi and atol globally
No longer used in core and test code.

Also: allowlist in docs/examples.

Closes #19508
2025-11-13 14:28:25 +01:00
Viktor Szakats
4841e4290d
badwords: re-sync with curl-www, fix issues found
Also:
- replace `manpage` with `man page`, add to `badwords.txt`.
- badwords.pl: import `-w` feature from curl-www, syncing the two
  scripts fully.
- badwords.txt: import missing items from curl-www, syncing the two
  files fully.
- pyspelling.words: drop `cURL` allowed word.

Closes #19468
2025-11-12 00:53:44 +01:00
Viktor Szakats
d499aa5238
mk-ca-bundle.pl: use open() with argument list to replace backticks
On Windows this requires Perl 5.22 from year 2015.

Also:
- mdlinkcheck: delete redundant error handling logic.
  Follow-up to 77be4a7ab2 #19437

Closes #19461
2025-11-12 00:53:43 +01:00
Viktor Szakats
6aab1dc263
scripts: use end-of-options marker in find -exec commands
Closes #19450
2025-11-10 18:52:29 +01:00
Viktor Szakats
a8e46c5ab1
verify-release: update to avoid shellcheck warning SC2034
```
SC2034: dl appears unused
```

Also to shorten the code.

Closes #19449
2025-11-10 16:06:48 +01:00
Viktor Szakats
77be4a7ab2
mdlinkcheck: pass curl arguments to open() as list
To prevent misinterpreting quotes or other special characters.

Requires Perl 5.22+ (2015-Jun-01) on Windows.

Ref: https://perldoc.perl.org/functions/open

Closes #19437
2025-11-10 14:21:35 +01:00
Samuel Henrique
79d3e1d7d4
wcurl: import v2025.11.09
Closes #19430
2025-11-10 08:52:55 +01:00
Daniel Stenberg
6d7e924e80
checksrc.pl: detect assign followed by more than one space
And fix some code previously doing this.

Closes #19375
2025-11-05 15:18:28 +01:00
Samuel Henrique
913c1f28c9
wcurl: import v2025.11.04
Closes #19353
2025-11-04 14:15:46 +01:00
Daniel Stenberg
bc99770217
singleuse.pl: fix string warning
"Use of uninitialized value $unittests in concatenation on line 170"

Closes #19266
2025-10-28 11:34:19 +01:00
Samuel Henrique
fb0c014e30
wcurl: sync to +dev snapshot
Closes #19247
2025-10-27 08:09:58 +01:00
Viktor Szakats
da06621d61
firefox-db2pem.sh: add macOS support, tidy-ups
Cherry-picked from #19076
Closes #19086
2025-10-16 20:53:28 +02:00
Viktor Szakats
c8aaa5d2f2
scripts: pass -- before passing xargs
Also:
- GHA/checkdocs: escape `.` in -E regex expression.

Closes #19076
2025-10-16 20:45:28 +02:00
Viktor Szakats
497b3f022e
checksrc: allow disabling warnings on FIXME/TODO comments
Follow-up to 71ace9f3c1

Closes #19048
2025-10-13 16:11:10 +02:00
Viktor Szakats
5e74b2df34
REUSE: move copyright headers to .checksrc
To make it simpler to move them around, create and delete them without
syncing with `REUSE.toml`.

Also:
- checksrc: allow empty lines in `.checksrc`.
- comment on why curl printfs are disallowed in examples.

Closes #19024
2025-10-13 11:54:22 +02:00
Stefan Eissing
357808f4ad
multi: add notifications API
Add infrastructure to colled and dispatch notifications for transfers
and the multi handle in general. Applications can register a callback
and en-/disable notification type the are interested in.

Without a callback installed, notifications are not collected. Same when
a notification type has not been enabled.

Memory allocation failures on adding notifications lead to a general
multi failure state and result in CURLM_OUT_OF_MEMORY returned from
curl_multi_perform() and curl_multi_socket*() invocations.

Closes #18432
2025-10-07 10:55:31 +02:00
Daniel Stenberg
71b5e02590
mdlinkcheck: reject URLs containing quotes
Those would be illegal anyway and would make the script misbehave

Reported-by: Stanislav Fort
Closes #18889
2025-10-06 23:38:41 +02:00
Daniel Stenberg
3b18aeb8bd
managen: verify the options used in example lines
Also fix the --knownhosts typo

Follow-up to aae18c4bdc

Reported-by: Daniel Terhorst-North
URL: https://mas.to/@tastapod/115327102344617386
Closes #18884
2025-10-06 23:17:33 +02:00
Viktor Szakats
b12da22db1
lib: stop overriding system printf symbols
After this patch, the codebase no longer overrides system printf
functions. Instead it explicitly calls either the curl printf functions
`curl_m*printf()` or the system ones using their original names.

Also:
- drop unused `curl_printf.h` includes.
- checksrc: ban system printf functions, allow where necessary.

Follow-up to db98daab05 #18844
Follow-up to 4deea9396b #18814

Closes #18866
2025-10-06 20:57:59 +02:00
Viktor Szakats
13f10add17
REUSE: bump reuse to v6, add more fences to fix issues
Closes #18895
Closes #18897
2025-10-06 20:54:26 +02:00
Viktor Szakats
34ad78da89
curlx: move Curl_strerror, use in src and tests, ban strerror globally
Also:
- tests/server: replace local `sstrerror()` with `curlx_strerror()`.
- tests/server: show the error code next to the string, where missing.
- curlx: use `curl_msnprintf()` when building for src and tests.
  (units was already using it.)
- lib: drop unused includes found along the way.
- curlx_strerror(): avoid compiler warning (and another similar one):
  ```
  In file included from servers.c:14:
  ../../lib/../../lib/curlx/strerr.c: In function ‘curlx_strerror’:
  ../../lib/../../lib/curlx/strerr.c:328:32: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
    328 |       SNPRINTF(buf, buflen, "%s", msg);
        |                                ^
  ../../lib/../../lib/curlx/strerr.c:47:18: note: ‘snprintf’ output 1 or more bytes (assuming 2) into a destination of size 1
     47 | #define SNPRINTF snprintf
        |                  ^
  ../../lib/../../lib/curlx/strerr.c:328:7: note: in expansion of macro ‘SNPRINTF’
    328 |       SNPRINTF(buf, buflen, "%s", msg);
        |       ^~~~~~~~
  ```

Follow-up to 45438c8d6f #18823

Closes #18840
2025-10-06 09:44:23 +02:00
Viktor Szakats
c7fb5858a5
checksrc: fix possible endless loops/errors in the banned function logic
By quoting the search expression to be replaced. This avoid the issue
when the code leading up to a banned function contained regex characters
that the script did not explicitly handle, e.g. `+`.

Assisted-by: Daniel Stenberg

Ref: https://perldoc.perl.org/functions/quotemeta
Follow-up to dd37d6970c #18775

Closes #18845
2025-10-04 17:49:21 +02:00
Viktor Szakats
45438c8d6f
checksrc: reduce directory-specific exceptions
By making them defaults, then fixing and/or reshuffling remaining
exceptions as necessary.

- checksrc: ban by default: `snprintf`, `vsnprintf`, `sscanf`, `strtol`.
- examples: replace `strtol` with `atoi` to avoid a checksrc exception.
- tests/libtest: replace `strtol` with `atol`.
- tests/server: replace most `strtol` with `atol`.
- tests/server: replace most `strtoul` with `atol`/`atoi`.
- tests/server: drop no longer used `util_ultous`.
- fix typo in checksrc rules: `vsnprint` -> `vsnprintf`.
- update local exceptions.

Also:
- examples: ban curl printf functions. They're discouraged in user code.
- examples: replace curl printf with system printf.
  Add `snprintf` workaround for <VS2015.
- examples/synctime: fix `-Wfloat-equal`.
- examples/synctime: exclude for non-Windows and non-UWP Windows.
- examples/synctime: build by default.

Closes #18823
2025-10-04 00:48:58 +02:00
Viktor Szakats
fff36a360e
checksrc: fix to handle ) predecing a banned function
Fixing:
```
Unmatched ) in regex; marked by <-- HERE in m/  \*buffer_len = \(ssize_t) <-- HERE
  strtol\(/ at /home/runner/work/curl/curl/scripts/checksrc.pl line 916, <$R> line 380.
```
Ref: https://github.com/curl/curl/actions/runs/18209824275/job/51848079550#step:3:5

Also add a test case.

Follow-up to 684f4cdd3e #18779
Cherry-picked from #18823
Closes #18836
2025-10-03 22:45:13 +02:00
Samuel Henrique
a5a17b8ddb
wcurl: import v2025.09.27
Closes #18754
2025-10-01 09:26:42 +02:00
Viktor Szakats
9678ff5b1b
build: avoid overriding system open and stat symbols
Replace them by `curlx_open()` and `curlx_stat()`.

To make it obvious in the source code what is being executed.

Also:
- tests/server: stop overriding `open()` for test servers.
  This is critical for the call made from the signal handler.
  For other calls, it's an option to use `curlx_open()`, but
  doesn't look important enough to do it, following the path
  taken with `fopen()`.

Follow-up to 10bac43b87 #18774
Follow-up to 20142f5d06 #18634
Follow-up to bf7375ecc5 #18503

Closes #18776
2025-09-30 16:30:09 +02:00
Viktor Szakats
684f4cdd3e
checksrc: catch banned functions when preceded by (
Also add a test case.

Closes #18779
2025-09-30 13:16:47 +02:00
Viktor Szakats
dd37d6970c
checksrc: fix possible endless loop when detecting BANNEDFUNC
If the source line had square brackets before the match, the stripping
of the banned function left the original line intact, and repeated the
check on it forever. E.g. with banned function `open` in `lib518.c`:
```c
t518_testfd[0] = open(DEV_NULL, O_RDONLY);
```

Closes #18775
2025-09-30 11:32:12 +02:00
Viktor Szakats
20142f5d06
build: avoid overriding system symbols for fopen functions
By introducing wrappers for them in the curlx namespace:
`curlx_fopen()`, `curlx_fdopen()`, `curlx_fclose()`.

The undefine/redefine/`(function)()` methods broke on systems
implementing these functions as macros. E.g. AIX 32-bit's `fopen()`.

Also:
- rename `lib/fopen.*` to `lib/curl_fopen.*` (for `Curl_fopen()`)
  to make room for the newly added `curlx/fopen.h`.
- curlx: move file-related functions from `multibyte.c` to `fopen.c`.
- tests/server: stop using the curl-specific `fopen()` implementation
  on Windows. Unicode isn't used by runtests, and it isn't critical to
  run tests on longs path. It can be re-enabled if this becomes
  necessary, or if the wrapper receives a feature that's critical for
  test servers.

Reported-by: Andrew Kirillov
Bug: https://github.com/curl/curl/issues/18510#issuecomment-3274393640

Follow-up to bf7375ecc5 #18503
Follow-up to 9863599d69 #18502
Follow-up to 3bb5e58c10 #17827

Closes #18634
2025-09-30 01:10:36 +02:00
Viktor Szakats
8538856662
perlcheck: parallelize
Follow-up to 34b1e146e4 #18745

Closes #18750
2025-09-26 23:50:53 +02:00
Viktor Szakats
34b1e146e4
perlcheck: add script, run in CI, fix fallouts
Add script to run all Perl sources through `perl -c` to ensure no
issues, and run this script via GHA/checksrc in CI.

Fallouts:
- fix two repeated declarations.
- move `shell_quote()` from `testutil.pm` to `pathhelp.pm`, to
  avoid circular dependency in `globalconfig.pm`.

Closes #18745
2025-09-26 14:47:33 +02:00
Daniel Stenberg
b011e3fcfb
vssh: drop support for wolfSSH
The implementation was incomplete and lesser than the other backends. No
one ever reported a bug or requested enhancements for this, indicating
that this backend was never used.

Closes #18700
2025-09-24 22:59:33 +02:00
Viktor Szakats
c9eff26c17
tool_doswin: fix to use curl socket functions
Replace `WSASocketW()` with `CURL_SOCKET()`. Also replace a call
to `socketclose()` with `sclose()`. According to a comment,
`socketclose()` was chosen to silence test 1498 (and 2300) reporting
`MEMORY FAILURE`. These reports were accurate, and were caused by
calling `WSASocketW()` instead of `socket()` (now `CURL_SOCKET()`).

This also fixes the curl `sclose()` call on an error branch, which is
now correctly paired with a curl socket open. The mismatched open/close
calls caused an issue in TrackMemory-enabled (aka `CURLDEBUG`) builds.

Docs confirm that `socket()` is defaulting to overlapped I/O, matching
the replaced `WSASocketW()` call:
https://learn.microsoft.com/windows/win32/api/winsock2/nf-winsock2-socket#remarks

Also:
- checksrc: ban `WSASocket*()` functions.
- report `SOCKERRNO` instead of `GetLastError()` for socket calls,
  to match the rest of the codebase.

Follow-up to 9a2663322c #17572

Closes #18633
2025-09-22 10:11:30 +02:00
Daniel Stenberg
1f0f0bdb19
managen: strict protocol check
- protocols MUST match one in the accept-list
- protocols are typically all uppercase
- drop All
- use SCP and SFTP instead of SSH
- add Protocols: to some options previously missing one

Closes #18675
2025-09-22 09:06:00 +02:00
Viktor Szakats
bf7375ecc5
build: avoid overriding system symbols for socket functions
Before this patch `accept4()`, `socket()`, `socketpair()`, `send()` and
`recv()` system symbols were remapped via macros, using the same name,
to local curl debug wrappers. This patch replaces these overrides by
introducing curl-namespaced macros that map either to the system symbols
or to their curl debug wrappers in `CURLDEBUG` (TrackMemory) builds.

This follows a patch that implemented the same for `accept()`.

The old method required tricks to make these redefines work in unity
builds, and avoid them interfering with system headers. These tricks
did not work for system symbols implemented as macros.

The new method allows to setup these mappings once, without interfering
with system headers, upstream macros, or unity builds. It makes builds
more robust.

Also:
- checksrc: ban all mapped functions.
- docs/examples: tidy up checksrc rules.

Follow-up to 9863599d69 #18502
Follow-up to 3bb5e58c10 #17827

Closes #18503
2025-09-20 13:44:59 +02:00
Viktor Szakats
1429858bce
tidy-up: update MS links, allow long URLs via checksrc
- update Microsoft documentation links.
  (also drop language designator where present.)

- checksrc: allow longer than 78 character lines if they
  contain a https URL. To make these links easier to use and parse.

- merge links that were split into two lines.

Closes #18626
2025-09-20 11:49:23 +02:00
Viktor Szakats
ad26a6cb99
tidy-up: avoid using the reserved macro namespace
To avoid hitting `-Wreserved-macro-identifier` where possible.

- amigaos: introduce local macro instead of reusing `__request()`.
- easy_lock: avoid redefining `__has_builtin()`.
  Follow-up to 33fd57b8ff #9062
- rand: drop interim macro `_random()`.
- windows: rename local macro `_tcsdup()` to `Curl_tcsdup()`.
  To avoid using the reserved macro namespace and to avoid
  colliding with `_tcsdup()` as defined by Windows headers.
- checksrc: ban `_tcsdup()` in favor of `Curl_tcsdup()`.
- tool_doswin: avoid redefining `_use_lfn()` (MS-DOS).
- tool_findfile: limit `__NO_NET_API` hack to AmigaOS.
  Syncing this pattern with `lib/netrc.c`.
  Follow-up to 784a8ec2c1 #16279
- examples/http2-upload: avoid reserved namespace for local macro.

More cases will be removed when dropping WinCE support via #17927.

Cases remain when defining external macros out of curl's control.

Ref: #18477
Closes #18482
2025-09-20 02:27:06 +02:00
Daniel Stenberg
dbe4e28d57
managen: render better manpage references/links
- When an option name is used in text, this script no longer outputs the
  short plus long version in the manpage output. It makes the text much
  more readable.

  This always showing both verions was previously done primarily to make
  sure roffit would linkify it correctly, but since roffit 0.17 it
  should link both long or short names correctly.

- When managen outputs generic text about options at the end of the
  description it now highlights them properly so that they too get
  linkified correctly in the HTML version. For consistency.

Closes #18580
2025-09-17 15:49:15 +02:00
Daniel Stenberg
0a27a506b1
managen: ignore version mentions < 7.66.0
Only mention version specific details for versions from within the last
six years.

Closes #18583
2025-09-17 15:47:34 +02:00
Viktor Szakats
a4196e2249
tidy-up: whitespace
Closes #18553
2025-09-15 15:00:11 +02:00
Daniel Stenberg
839b22863e
ssl-sessions.md: mark option experimental
Also make managen output the experimental text with the correct
prefix/margin for the ascii version.

Closes #18523
2025-09-11 17:01:07 +02:00
Daniel Stenberg
32909591d2
docs: put <> within backticks in titles
To render better markdown. Make managen warn if present "unticked" and
unescaped.

Closes #18498
2025-09-08 22:42:53 +02:00
Daniel Stenberg
f333a73892
top-complexity: set threshold to 70
Closes #18475
2025-09-04 10:06:13 +02:00
Stefan Eissing
24badd29f5
multi: limit-rate revisited
Tweaks around handling of --limit-rate:

* tracing: trace outstanding timeouts by name
* multi: do not mark transfer as dirty that have
  an EXPIRE_TOOFAST set
* multi: have one static function to asses speed limits
* multi: when setting EXPIRE_TOOFAST remove the transfers
  from the dirty set
* progress: rename vars and comment on how speed limit
  timeouts are calculated, for clarity
* transfer: when speed limiting, exit the receive loop
  after a quarter of the limit has been received, not
  on the first chunk received.
* cf-ip-happy.c: clear EXPIRE_HAPPY_EYEBALLS on connect
* scorecard: add --limit-rate parameter to test with
  speed limits in effect

Closes #18454
2025-09-03 15:53:41 +02:00
Daniel Stenberg
aa4596a97e
mdlinkcheck: handle links with a leading slash properly
Ref: #18372
Closes #18382
2025-08-23 23:07:13 +02:00
Daniel Stenberg
f5ee566dbc
top-complexity: maximum accepted set to 72
Down from 80. Show all functions above 60.

Closes #18354
2025-08-22 16:22:36 +02:00
Viktor Szakats
3298a43133
spelling: file system
Closes #18348
2025-08-22 15:53:41 +02:00
Stefan Eissing
88fc6c491f
threaded-resolver: fix shutdown
Changed strategy to start up and terminate resolver thread.

When starting up:

Start the thread with mutex acquired, wait for signal from thread that
it started and has incremented the ref counter. Thread set
pthread_cancel() to disabled before that and only enables cancelling
during resolving itself. This assure that the ref counter is correct and
the unlinking of the resolve context always happens.

When shutting down resolving:

If ref counting shows thread has finished, join it, free everything. If
thread has not finished, try pthread_cancel() (non Windows), but keep
the thread handle around.

When destroying resolving:

Shutdown first, then, if the thread is still there and 'quick_exit' is
not set, join it and free everything. This might occur a delay if
getaddrinfo() hangs and cannot be interrupted by pthread_cancel().

Destroying resolving happens when another resolve is started on an
easy handle or when the easy handle is closed.

Add test795 to check that connect timeout triggers correctly
when resolving is delayed. Add debug env var `CURL_DNS_DELAY_MS`
to simulate delays in resolving.

Fix test1557 to set `quick_exit` and use `xxx.invalid` as domain
instead of `nothing` that was leading to hangers in CI.

Closes #18263
2025-08-21 09:26:49 +02:00
Stefan Eissing
37cecfc7b9
websocket: support CURLOPT_READFUNCTION
Add support for CURLOPT_READFUNCTION with WebSocket urls when *not* in
connect-only mode, e.g. when using curl_multi_perform.

Install the callback function and set CURLOPT_UPLOAD. Return
CURL_READFUNC_PAUSE when having nothing more to send and unpause the
transfer when more data is ready.

This will send the read bytes in a WebSocket BINARY frame.

Add support for this mode in the pytest "ws_data" client and have all
tests run in 'curl_ws_send/recv' and 'peform' mode as well.

Add `curl_ws_start_frame()`. Document, cover in libcurl-ws.md and
explain the READFUNCTION mode for websockets.

Add example `websocket-updown` for this.

Closes #17683
2025-08-11 23:28:54 +02:00
Stefan Eissing
1ad2009ad6
multi: add new information extraction method
Adds `curl_off_t curl_multi_get_offt(CURLM *multi_handle, CURLMinfo_offt
info)` to the multi interface with enums:

* CURLMINFO_XFERS_CURRENT: current number of transfers
* CURLMINFO_XFERS_RUNNING: number of running transfers
* CURLMINFO_XFERS_PENDING: number of pending transfers
* CURLMINFO_XFERS_DONE: number of finished transfers to read
* CURLMINFO_XFERS_ADDED: total number of transfers added, ever

Add documentation for functions and info enums.

Add use in the curl command line tool to replace two static
variables counting the same "from the outside".

refs #17870
Closes #17992
2025-08-04 23:48:57 +02:00
Viktor Szakats
1644a49ab8
configure: if no perl, disable unity and shell completion, related tidy ups
Also:
- GHA/linux, macos: test `install` with autotools too.
- GHA/linux, macos: enable fish and zsh completion in an autotools job.
- scripts: drop dynamic perl checks redundant after this patch.
- scripts: drop two interim variables.
- autotools: make `build-certs` target check perl first.
- autotools: replace `$(PERL)` with `@PERL@` to match the pattern used
  in most automake scripts. For consistency. This makes `PERL` be
  defined at configure-time, as opposed to make-time, for these cases
  now.

Closes #18141
2025-08-04 14:55:10 +02:00
Daniel Stenberg
18e00c8ed0
managen: reset text mode at end of table marker
It previously mostly ignored it which lead to bad format after a table
has ended with "##".

Closes #18139
2025-08-01 23:24:32 +02:00