Commit Graph

36035 Commits

Author SHA1 Message Date
Viktor Szakats
aa8a44ecfa
GHA: fix and tweak installed packages for http3-linux and Windows-cross
- explicitly install `libldap-dev` to not rely on test-specific packages
  installing it implicitly, to have the same `curl -V` output for each
  TLS backend build pair.
  Follow-up to 0455d8772a #18509

- install `libev-dev` for tests. It's a runtime dependency for
  the local build of `nghttpx`. Missing it made pytest skip 178 tests.
  Also skewing the 'Gain' time. I estimate it to account for 3 minutes,
  making the total gain ~20 minutes.
  Follow-up to 0455d8772a #18509
  (It may be a better solution to disable libev for the local nghttp2
  build, to avoid this hidden dependency.)

- fix quiche jobs to use the local build of `libnghttp2`.

- stop installing the `clang` package for Windows-cross. `clang` and
  `clang-tidy` tools are preinstalled on the Ubuntu 24.04 runner.

Closes #18519
2025-09-11 12:53:54 +02:00
renovate[bot]
39c2d4b543
GHA: update github/codeql-action digest to 192325c
Closes #18516
2025-09-11 08:40:57 +02:00
renovate[bot]
7417f14b93
GHA: update rojopolis/spellcheck-github-actions digest to 739a1e3
Closes #18515
2025-09-11 08:40:09 +02:00
Viktor Szakats
0455d8772a
GHA: minimize installed packages in http3-linux and Windows cross-builds
In the last couple of months some jobs started taking a lot of time and
often timing out due to slow `apt install` from the Azure Ubuntu mirror.

The jobs affected were those that installed large packages:
GHA/http3-linux and the 3 cross-build jobs in GHA/windows.

This patch reduces the installed packaged to the minimum required
to complete the jobs. Saving a minute+ for each http3-linux job (a total
of 20+ minutes for the workflow.) Also saving bandwidth and reducing
the chance for long downloads or timeouts with slow Azure repos.

Details:
- http3: delete redundant packages from the `build-cache` job.
- http3: install gnutls dependencies for gnutls jobs only.
- http3: do not install test dependencies in jobs not running tests.
- http3: drop redundant packages from the curl jobs.
- Windows-cross: replace `mingw-w64` with `gcc-mingw-w64-x86-64-win32`
  for the 3 Windows cross-build job. Dropping C++, 32-bit, and 64-bit
  POSIX-threaded parts. Saving time and significant bandwidth for each
  of the 3 jobs:
  Download size: 277 MB -> 65 MB (installed: 1300 MB -> 400 MB)
- Windows-cross: restore previous job time limit of 15m (from 45m)
  Follow-up to ff5140a25f #18163

Before:
https://github.com/curl/curl/actions/runs/17611514207 (http3)
https://github.com/curl/curl/actions/runs/17611514185/job/50034354923 (Windows cross)

After:
https://github.com/curl/curl/actions/runs/17628406362?pr=18509 (http3)
https://github.com/curl/curl/actions/runs/17627562551/job/50088055529?pr=18509 (Windows cross)

http3 job           |    Bef. |    Aft. |
:------------------ | ------: | ------: |
Build caches (hot)  |     10s |     12s |
AM awslc            |  3m  0s |  1m 54s |
CM awslc            |  4m 32s |  3m  4s |
AM boringssl        |  3m  9s |  1m 48s |
CM boringssl        |  3m 43s |  3m  2s |
AM gnutls           |  3m  9s |  2m 18s |
CM gnutls           |  4m 19s |  2m 55s |
AM libressl         |  2m 14s |  1m 24s |
CM libressl         |  5m 30s |  2m 57s |
AM openssl          |  5m 16s |  4m 17s |
CM openssl          |  1m 50s |  1m 47s |
AM openssl-quic     |  2m 58s |  1m  7s |
CM openssl-quic     |  4m 16s |  2m 43s |
AM quiche           |  2m 54s |  1m 34s |
CM quiche           |  5m  0s |  3m 15s |
AM quictls          |  2m 34s |  1m 13s |
CM quictls          |  4m 20s |  3m 17s |
AM wolfssl          |  2m 48s |  1m 30s |
CM wolfssl          |  4m 49s |  3m 22s |
Total:              | 66m 21s | 43m 27s |
Gain:               |         | 22m 54s |

Out of curiousity, build times as seen in the http3 build-cache job:
- TLS backends:
  - openssl: 2m25s
  - libressl: 27s
  - aws-lc: 41s
  - boringssl: 1m8s
  - quictls: 1m46s
  - gnutls: 6m30s
  - wolfssl: 51s
  - quiche + boringssl: 1m9s
- ng* libs (not yet optimized for build speed):
  - nghttp3: 13s
  - ngtcp2: 52s (with 6 backends, 3 runs)
  - ngtcp2: 19s (boringssl)
  - nghttp2: 21s
Ref: https://github.com/curl/curl/actions/runs/17626120054/job/50083344805

A similar effort in curl-for-win, affecting 2 GHA/curl-for-win Windows
jobs (though they use the default Debian repo, with no issues):
- with llvm/clang:
  Download size: 648 MB -> 430 MB (installed: 3344 MB -> 2333 MB)
- with gcc:
  Download size: 550 MB -> 328 MB (installed: 2815 MB -> 1804 MB)
Ref: e19665d948
Ref: 6b14c3946a

Bug: https://github.com/curl/curl/pull/18502#issuecomment-3270259744

Closes #18509
2025-09-11 03:07:19 +02:00
Viktor Szakats
3ba74c4395
curl_mem_undef.h: limit to CURLDEBUG for non-memalloc overrides
To fix non-`CURLDEBUG` builds on 32-bit AIX, where `fopen` is a system
macro.

Ref: #18502
Ref: 793a375ce3

Follow-up to 3bb5e58c10 #17827
Reported-by: Andrew Kirillov
Fixes #18510
Closes #18514
2025-09-10 13:08:54 +02:00
Daniel Stenberg
31f0f0a060
RELEASE-NOTES: synced
and bump include/curl/curlver.h
2025-09-10 12:54:59 +02:00
Stefan Eissing
a782867c9f
curl_easy_getinfo: error code on NULL arg
When passing an address to curl_easy_getinfo to retrieve a value and the
address is NULL, return CURLE_BAD_FUNCTION_ARGUMENT instead of
CURLE_UNKNOWN_OPTION.

Closes #18512
2025-09-10 12:44:25 +02:00
Stefan Eissing
80ac5fb2ec
easy_getinfo: check magic, Curl_close safety
Check the easy handles magic in calls to curl_easy_getinfo().
In Curl_close() clear the magic after DNS shutdown since we'd
like to see tracing for this.
When clearing the magic, also clear the verbose flag so we
no longer call DEBUGFUNCTION on such a handle.

Closes #18511
2025-09-10 12:06:16 +02:00
Ethan Everett
f4758cd524
quic: ignore EMSGSIZE on receive
Some OSes (Linux, macOS, more?) will generate an EMSGSIZE socket error
on the next recv all after receiving an ICMP Packet Too Big on an
unconnected UDP socket.

These can be safely ignored as QUIC's DPLPMTUD uses MTU probes that do
not rely on receiving ICMP packets.

Closes #18505
2025-09-10 11:51:25 +02:00
Daniel Stenberg
11b991232f
RELEASE-NOTES: synced
curl 8.16.0 release
2025-09-10 07:43:09 +02:00
Daniel Stenberg
bee4ee6141
VERSIONS: update past versions 2025-09-10 07:43:09 +02:00
Daniel Stenberg
85ba1b8067
THANKS: names from the 8.16.0 cycle 2025-09-10 07:41:00 +02:00
Viktor Szakats
61759a9843
pytest: bind to localhost
Pointed out by CodeQL

Fixes https://github.com/curl/curl/security/code-scanning/298

Closes #18506
2025-09-10 00:55:07 +02:00
renovate[bot]
82449d4d91
GHA: update github/codeql-action digest to d3678e2
Closes #18507
2025-09-09 23:47:41 +02:00
Viktor Szakats
c70f7b7a7c
GHA/codeql: scan GHA workflows and Python
Closes #18504
2025-09-09 21:51:09 +02:00
renovate[bot]
522c991336
Dockerfile: update debian:bookworm-slim Docker digest to df52e55
Closes #18499
2025-09-09 15:28:00 +02:00
Viktor Szakats
9863599d69
lib: introduce CURL_ACCEPT()
To avoid overriding the system symbol `accept`, which is a macro on some
systems (AIX), and thus can't be called via the `(function)` PP trick.

It's also problematic to reset such macro to its original value.

Follow-up to 3bb5e58c10 #17827
Reported-by: Andrew Kirillov
Fixes #18500
Closes #18501
Closes #18502
2025-09-09 15:17:34 +02:00
Daniel Stenberg
f8ff233cdf
_ENVIRONMENT.md: document NETRC
Follow-up to 378713deb2

Closes #18497
2025-09-08 22:45:30 +02:00
Daniel Stenberg
32909591d2
docs: put <> within backticks in titles
To render better markdown. Make managen warn if present "unticked" and
unescaped.

Closes #18498
2025-09-08 22:42:53 +02:00
Stefan Eissing
e3c06ccc66
vquic: replace assert
Replace the hard assert in case not all data is send on UDP
(which should never happen), with an error return.

Closes #18495
2025-09-08 16:05:27 +02:00
Daniel Stenberg
84db7a9eae
ws: get a new mask for each new outgoing frame
Reported-by: Calvin Ruocco
Closes #18496
2025-09-08 16:04:16 +02:00
Andrew
7c9878ff0c
curl_setup.h: include limits.h before testing for #ifndef SSIZE_MAX
Ref: 93f333c18f #18426 #18406
Fixes #18493
Closes #18494
2025-09-08 14:52:55 +02:00
Daniel Stenberg
07a688135d
KNOWN_BUGS: OpenSSL-QUIC problems on google.com
Closes #18336
Closes #18492
2025-09-08 11:45:33 +02:00
Daniel Stenberg
34fd7e8d2d
RELEASE-PROCEDURE.md: drop the _newslog edit mention
Because that file has now been removed from the website repository
2025-09-08 11:12:47 +02:00
Daniel Stenberg
455afa1de5
RELEASE-PROCEDURE.md: remove some old release dates, add some new 2025-09-08 10:14:12 +02:00
Daniel Stenberg
3b2cfa55a0
mailmap: unify on James 2025-09-08 09:26:22 +02:00
Viktor Szakats
93bc523541
GHA/linux: run on .md file changes
To execute runtests on Markdown files. E.g. test 1275.

Bug: https://github.com/curl/curl/pull/18486#issuecomment-3263681032

Closes #18487
2025-09-07 22:21:04 +02:00
Viktor Szakats
7f7db9e372
lib: fix broken link in comment 2025-09-07 19:19:05 +02:00
Viktor Szakats
10e9d512e5
BINDINGS: point a link to archive.org
The original website is hosting different content now.

Closes #18489
2025-09-07 18:59:11 +02:00
Viktor Szakats
ce62f0f9a1
VULN-DISCLOSURE-POLICY: make it pass test 1275
```
test 1275...[Verify capital letters after period in markdown files]
 ../../docs/VULN-DISCLOSURE-POLICY.md:426:55:error: lowercase daily after period
 * regular communication from communication leader (ex. daily update)
```
Ref: https://github.com/curl/curl/actions/runs/17527331816/job/49779555753?pr=18485

Also: add ending slashes to 2 URLs.

Follow-up to 6905370df5 #18483
Closes #18486
2025-09-07 12:39:44 +02:00
Viktor Szakats
b85cb8cb4e
openldap: fix -Wtentative-definition-compat
It's a `-Weverything` warning that appeared in llvm/clang 21.

```
lib/openldap.c:1297:19: warning: duplicate declaration of 'ldapsb_tls' is invalid in C++ [-Wtentative-definition-compat]
 1297 | static Sockbuf_IO ldapsb_tls =
      |                   ^
lib/openldap.c:499:19: note: previous declaration is here
  499 | static Sockbuf_IO ldapsb_tls;
      |                   ^
```

Reported-by: correctmost on github
Fixes #18470
Cherry-picked from #18477
Closes #18485
2025-09-07 12:36:44 +02:00
Jim Fuller
6905370df5
docs: add major incident section to vuln disclosure policy
Closes #18483
2025-09-06 12:20:45 +02:00
Daniel Stenberg
6420c52294
RELEASE-NOTES: synced 2025-09-06 12:12:55 +02:00
Stefan Eissing
0b09132877
websocket: handling of PONG frames
The auto PONG frames were inserted into the connection at the time
a PING had been decoded, irregardless if an upstream frame was just
in the middle of being assembled.

Add PONG frames only to the buffer if there is no frame currently
assemebled and, if it is, set the control frame aside. This control
frame is then added on the first opportunity of a "clean" send buffer.

There is only a single control frame set aside at a time. This means
a double PING will, when the PONG cannot be sent right away, only
send the last PONG.

I imagine this is fine. We want to prevent the endless buffering of
PONG frames on a connection where the server sends but does no receives.

Reported-by: Calvin Ruocco
Fixes #16706
Closes #18479
2025-09-05 13:17:39 +02:00
renovate[bot]
4c0da28231 gha: Update actions/labeler action to v6 2025-09-04 13:03:47 -07:00
Viktor Szakats
ec9cb618a0
spacecheck: warn for 3+ empty lines in a row, fix fallouts
Closes #18478
2025-09-04 20:37:51 +02:00
Stefan Eissing
5fa4fb0c13
websocket: reset upload_done when sending data
Sending websocket data did not clear the "upload_done" flag of
the initial HTTP Upgrade request, leading to KEEP_SEND never be
cleared. This caused the socket to be polled for INOUT after all
the websocket data had been sent. A busy loop.

Closes #18476
2025-09-04 14:47:15 +02:00
Daniel Stenberg
f333a73892
top-complexity: set threshold to 70
Closes #18475
2025-09-04 10:06:13 +02:00
Daniel Stenberg
1edead4360
rtsp: split out a subfunction from rtsp_do
Takes complexity down from 71 to 52.

Closes #18471
2025-09-04 08:31:27 +02:00
Daniel Stenberg
31659b4a7a
http_add_connection_hd: respect previous error
Pointed out by CodeSonar

Closes #18472
2025-09-04 08:26:17 +02:00
Viktor Szakats
5ef4451f7b
cmake: fix setting LTO properties on the wrong targets
Follow-up to ae1a861bd6 #17043

Closes #18469
2025-09-03 18:35:31 +02:00
Viktor Szakats
0b0f3d937c
lib: drop UNUSED_PARAM macro
Added in 2011, but has seen little use in the code. The necessary
compiler feature is missing in some compilers (e.g. MSVC), thus in most
places the portable `(void)` cast is used in addition.

Also:
- vtls/rustls: silence unused argument warning with `(void)`.
  Necessary for MSVC, for example.

Ref: ee4ed46128

Closes #18455
2025-09-03 16:33:05 +02:00
Viktor Szakats
49145249be
tidy-up: drop stray "unused" comments
Closes #18453
2025-09-03 16:31:16 +02:00
Stefan Eissing
24badd29f5
multi: limit-rate revisited
Tweaks around handling of --limit-rate:

* tracing: trace outstanding timeouts by name
* multi: do not mark transfer as dirty that have
  an EXPIRE_TOOFAST set
* multi: have one static function to asses speed limits
* multi: when setting EXPIRE_TOOFAST remove the transfers
  from the dirty set
* progress: rename vars and comment on how speed limit
  timeouts are calculated, for clarity
* transfer: when speed limiting, exit the receive loop
  after a quarter of the limit has been received, not
  on the first chunk received.
* cf-ip-happy.c: clear EXPIRE_HAPPY_EYEBALLS on connect
* scorecard: add --limit-rate parameter to test with
  speed limits in effect

Closes #18454
2025-09-03 15:53:41 +02:00
renovate[bot]
2ebb966e08
GHA: update nghttp2/nghttp2 to v1.67.0
Closes #18456
2025-09-03 15:51:43 +02:00
Daniel Stenberg
de86c2483f
test763: verify IDN hostname with zero width characters only
Bonus: fix memory leak in exit path from 967a626af4

Closes #18465
2025-09-03 15:49:54 +02:00
Daniel Stenberg
71c9706959
tests: remove the 'none' server
Only actually needed servers should be listed and none is then implied
if no servers are listed.

Outputs a warning if "none" is still set as a server.

Closes #18466
2025-09-03 14:30:10 +02:00
David Zhuang
c278c508e2
http: do the cookie list access under lock
A previous refactor of cookie logic changed Curl_cookie_getlist to no
longer return a list of copied cookies, but instead return a linked list
pointing to existing cookies. The returned linked list is accessed
outside of the scope of the cookie share lock in http_cookies, which
leads to issues if the shared cookie list is modified at the same time.
This is the relevant commit: be39ed1

Closes #18457
2025-09-03 12:54:31 +02:00
renovate[bot]
5e6bc73570
GHA: Update cloudflare/quiche to v0.24.6
Closes #18464
2025-09-03 12:52:04 +02:00
Stefan Eissing
9f1102cf74
pytest: add tests for getting a non-existing ftp file
Check that return code is 78.

Closes #18463
2025-09-03 12:51:00 +02:00