Commit Graph

6884 Commits

Author SHA1 Message Date
Viktor Szakats
61759a9843
pytest: bind to localhost
Pointed out by CodeQL

Fixes https://github.com/curl/curl/security/code-scanning/298

Closes #18506
2025-09-10 00:55:07 +02:00
Viktor Szakats
ec9cb618a0
spacecheck: warn for 3+ empty lines in a row, fix fallouts
Closes #18478
2025-09-04 20:37:51 +02:00
Viktor Szakats
49145249be
tidy-up: drop stray "unused" comments
Closes #18453
2025-09-03 16:31:16 +02:00
Stefan Eissing
24badd29f5
multi: limit-rate revisited
Tweaks around handling of --limit-rate:

* tracing: trace outstanding timeouts by name
* multi: do not mark transfer as dirty that have
  an EXPIRE_TOOFAST set
* multi: have one static function to asses speed limits
* multi: when setting EXPIRE_TOOFAST remove the transfers
  from the dirty set
* progress: rename vars and comment on how speed limit
  timeouts are calculated, for clarity
* transfer: when speed limiting, exit the receive loop
  after a quarter of the limit has been received, not
  on the first chunk received.
* cf-ip-happy.c: clear EXPIRE_HAPPY_EYEBALLS on connect
* scorecard: add --limit-rate parameter to test with
  speed limits in effect

Closes #18454
2025-09-03 15:53:41 +02:00
Daniel Stenberg
de86c2483f
test763: verify IDN hostname with zero width characters only
Bonus: fix memory leak in exit path from 967a626af4

Closes #18465
2025-09-03 15:49:54 +02:00
Daniel Stenberg
71c9706959
tests: remove the 'none' server
Only actually needed servers should be listed and none is then implied
if no servers are listed.

Outputs a warning if "none" is still set as a server.

Closes #18466
2025-09-03 14:30:10 +02:00
Stefan Eissing
9f1102cf74
pytest: add tests for getting a non-existing ftp file
Check that return code is 78.

Closes #18463
2025-09-03 12:51:00 +02:00
Daniel Stenberg
765b5ab0cd
tool_getparam: warn on more unicode prefixes
If a string argument is expected and the first two bytes are 0xe2 ex80
and the third has the 7th bit set, that's enough for curl to warn.

Previously we tried to detect and warn only for the unicode double
quote, but users might use single quotes, other quotes or even lead the
argument with one of the "zero widths" characters. This is an attempt to
detect many of those. Without triggering for "normal" IDN hostnames.

Closes #18459
2025-09-03 11:35:10 +02:00
Stefan Eissing
4d040c71d7
Curl_http(), decomplexify
Split out adding of individual request headers into a switch. Check
the connection http version only on fresh connections, use separate
methods.

Add TE: header directly without allocation. Add bit for indicating
Connection: header has been added and custom headers should not do
that again.

Closes #18444
2025-09-02 07:54:46 +02:00
Stefan Eissing
e65dc7fa23
aws-lc: do not use large buffer
test_10_08, uploading larger files for a h2 proxy, sporadically fails
with a decrpytion error on received data in AWS-LC. The frequency can
be increased by simulated network receive blocks.

Not setting a 4 * TLS record sized buffer, leaving AWS-LC at its
default buffer size seems to mitigate this problem.

Closes #18434
2025-09-01 23:27:11 +02:00
Daniel Stenberg
54f1ef05d6
tool_filetime: accept setting negative filetime
This allows --remote-time to set dates before 1970.

Due to a minor omission in the API, it will still avoid setting the time
if it is indeed exactly epoch 0 (jan 1 1970).

Verified by test 762

Fixes #18424
Reported-by: Terence Eden
Closes #18443
2025-09-01 08:51:36 +02:00
Daniel Stenberg
a5798a51f0
test500: accept 81 allocations
In some configs they happen

Closes #18441
2025-08-31 23:25:37 +02:00
Daniel Stenberg
4a3ed6fc16
urlglob: only accept 255 globs
- using {} with single entries makes little sense
- when using {} sets with two entry lists, there can only be 64 to reach
  maximum number of URLs

Verify the max check in test 761
2025-08-30 22:27:28 +02:00
Stefan Eissing
fa3baabbd8
websocket: improve handling of 0-len frames
Write out 9-length frames to client's WRITEFUNCTION
Read 0-length frames from READFUNCTION *if* the function
started a new frame via `curl_ws_start_frame()`.

Fixes #18286
Closes #18332
Reported-by: Andriy Druk
2025-08-28 11:00:02 +02:00
Daniel Stenberg
d77a23c263
tests: remove the QUIT filters
Once added in cd4aee156f to work around connection shutdown
issues.

Closes #18405
2025-08-27 08:03:59 +02:00
Daniel Stenberg
98c78b2f14
runtests: remove warning message
Every time we first run runtests with -j and then again *without* -j,
this message was shown:

  "Warning: $runnerid: cleardir(log) failed"

Not anymore.

Closes #18404
2025-08-26 23:33:13 +02:00
Daniel Stenberg
ebff00f1af
tool_getparam: let --trace-config override -v
If --trace-config is used to set a level before -v is used, don't reset
the state on first -v (to "-all") as it otherwise does. This way,
--trace-config can be used to set specific trace items before -v on the
command line and it still works.

Previously, the first -v use would otherwise reset and undo the earlier
--trace-config items.

Fixes #18346
Closes #18361
2025-08-26 14:59:59 +02:00
Viktor Szakats
d65436d9a0
openssl: BoringSSL / AWS-LC tidy-ups
- schannel: apply BoringSSL workaround to AWS-LC too.
  Affects Schannel + AWS-LC MultiSSL builds. (not tested in CI)
  Ref: 274940d743 #2643 #2634

- curl_ntlm_core: deduplicate macro defines.

- curl_ntlm_core: document version thresholds for an AWS-LC-specific
  workaround.
  It was necessary between v1.2.0 2022-09-01 and v1.30.1 2024-06-21.
  No longer necessary since v1.31.0 2024-07-01:
  ba94617d99
  Follow-up to 34ef4fab22 #10320

- lib758: drop redundant OpenSSL version guards.
  `OPENSSL_VERSION_NUMBER > 3` automatically guards against LibreSSL,
  BoringSSL and AWS-LC.
  Ref: 6ddd8f2c0b
  Follow-up to a5f0ab7995 #18288

- dllmain, curl_sha512_256: formatting.

Closes #18387
2025-08-24 00:30:06 +02:00
Viktor Szakats
cff4c16b83
pytest: fix test_17_09_ssl_min_max for BoringSSL
Ref: https://github.com/curl/curl/actions/runs/17179514833/job/48740057095

Also fix indent.

Cherry-picked from #18384
Closes #18385
2025-08-23 23:04:02 +02:00
Daniel Stenberg
29e4a124a3
tool_operate: bail out better on no URL
To avoid NULL derferences with many outputs and --next.

Follow-up to 034612cd51

Add test 760 to verify

Reported-by: BobodevMm on github
Fixes #18375
Closes #18376
2025-08-23 13:43:46 +02:00
Viktor Szakats
4f0e530c77
tidy-up: formatting
Closes #18373
2025-08-23 01:12:27 +02:00
Daniel Stenberg
844c385812
typecheck-gcc: add type checks for curl_multi_setopt()
Test 745 verifies that all options are tested.

Closes #18357
2025-08-22 17:12:58 +02:00
Daniel Stenberg
b3570b36d7
runtests: show still running tests when nothing has happened for a while
... even if there are tests still pending. To help visualize tests that
might be hanging.

Attempts to set the limit at 10 seconds of silence.

Closes #18349
2025-08-22 16:28:03 +02:00
Daniel Stenberg
33572b851e
tool_urlglob: handle a zero length glob piece
Follow-up to 034612cd51

Add test 759 to verify

Reported-by: Stanislav Osipov
Fixes #18352
Closes #18353
2025-08-22 16:22:07 +02:00
Viktor Szakats
3298a43133
spelling: file system
Closes #18348
2025-08-22 15:53:41 +02:00
Viktor Szakats
f6c2907172
test1557: pass long type to multi_setopt()
A wrong type here has seen to manifest in CI failures with gcc-12 macOS.

Ref: https://github.com/curl/curl/pull/18348#issuecomment-3213881790
Ref: https://github.com/curl/curl/actions/runs/17153761944/job/48665734013?pr=18349

Follow-up to b63cce7fee #18339
Follow-up to 88fc6c491f #18263

Closes #18355
2025-08-22 14:16:45 +02:00
Viktor Szakats
7956a2a756
gnutls: fix building with older supported GnuTLS versions
Also:
- GHA/linux-old: switch jobs from OpenSSL 1.0.2 to GnuTLS 3.5.8.

Ref: https://gitlab.com/gnutls/gnutls/blob/master/NEWS
Follow-up to fa0ccd9f1f #15774
Follow-up to 68bd759c2b #15667
Cherry-picked from #18330
Closes #18335
2025-08-21 18:04:25 +02:00
Viktor Szakats
696150b752
runtests: replace --ci with --buidinfo, show OS/Perl version again
I figure OS/Perl version may be useful to see in local runs,
and also in CI runs where `--ci` was not set:
https://curl.se/dev/log.cgi?id=20250820041228-707387#prob1

Also, only show a message if the `diff` tool is missing.

Follow-up to 985f39c0ce #18147
Closes #18329
2025-08-21 13:11:32 +02:00
Viktor Szakats
8f9d73bcaf
tests: drop unused BLANK envs, unset CURL_NOT_SET
Closes #18328
2025-08-21 13:11:32 +02:00
Viktor Szakats
8fac255fc1
test: add cygwin feature and use it (test 1056, 1517)
To replace custom checks with the same effect.

Closes #18327
2025-08-21 13:11:32 +02:00
Stefan Eissing
88fc6c491f
threaded-resolver: fix shutdown
Changed strategy to start up and terminate resolver thread.

When starting up:

Start the thread with mutex acquired, wait for signal from thread that
it started and has incremented the ref counter. Thread set
pthread_cancel() to disabled before that and only enables cancelling
during resolving itself. This assure that the ref counter is correct and
the unlinking of the resolve context always happens.

When shutting down resolving:

If ref counting shows thread has finished, join it, free everything. If
thread has not finished, try pthread_cancel() (non Windows), but keep
the thread handle around.

When destroying resolving:

Shutdown first, then, if the thread is still there and 'quick_exit' is
not set, join it and free everything. This might occur a delay if
getaddrinfo() hangs and cannot be interrupted by pthread_cancel().

Destroying resolving happens when another resolve is started on an
easy handle or when the easy handle is closed.

Add test795 to check that connect timeout triggers correctly
when resolving is delayed. Add debug env var `CURL_DNS_DELAY_MS`
to simulate delays in resolving.

Fix test1557 to set `quick_exit` and use `xxx.invalid` as domain
instead of `nothing` that was leading to hangers in CI.

Closes #18263
2025-08-21 09:26:49 +02:00
Viktor Szakats
2b2d8b7756
tests: delete unused commands
`runtests.pl` defaults to `-` if a command is not set, since
c43ad0f972.

Also:
- drop a stray `</file>`.
- replace a `nothing` with a guaranteed invalid hostname.
  Ref: 4334033b43
- replace unused URLs with `-`.

Closes #18319
2025-08-20 15:31:22 +02:00
Daniel Stenberg
b9e3ea4edb
ftp: store dir components as start+len instead of memdup'ing
- Avoids allocating every path segment separately
- Improved directory handling in connection reuse

Closes #18312
2025-08-19 07:59:50 +02:00
Viktor Szakats
2388b0e587
processhelp.pm: use Win32::Process* perl modules if available
`Win32::Process::List` and `Win32::Process`.

To replace external calls to `tasklist.exe` and `taskkill.exe`.

The perl modules are wrappers/binding to Win32 API calls. They avoid
launching external processes with a command shell (including MSYS2),
the external tool, and creating command-lines and parsing tool output.

According to local tests and the CI, one test session calls
`tasklist.exe` 350-400 times. `taskkill.exe` is rarely called:
https://github.com/curl/curl/actions/runs/17012376726?pr=18296

It's hard to predict any possible side-effect of dynamically loading
the two necessary, module DLLs into the Perl process. The MSYS2 runtime
if prone to fail when doing this in fork operations, as seen earlier
with the Win32.DLL module. But, is looks like a symptom, not the root
cause for these failures, because the failures are present with or
without perl.exe loading the Win32.DLL.
Ref: be01b60ce5 #18287

Cherry-picked from #18296
Closes #18308
2025-08-18 23:46:56 +02:00
Viktor Szakats
a19bd43210
cmake: honor CMAKE_C_FLAGS in test 1119 and 1167
`CMAKE_C_FLAGS` is not set by curl, but may contain custom options
required for a successful compiler run, when invoked by these tests.

One such case is when configuring Visual Studio or clang-cl via compiler
options, instead of envs.

Cherry-picked from #18301
Closes #18307
2025-08-18 11:08:53 +02:00
Daniel Stenberg
0ba8e7f9db
test1549: verify CURLOPT_COOKIEFILE after expired cookies
Verifies #18299 (de89b86046)
Closes #18303
2025-08-17 22:52:18 +02:00
Stefan Eissing
a5f0ab7995
openssl: auto-pause on verify callback retry
When an application install its own OpenSSL verify callback and that
callback invokes `SSL_set_retry_verify()`, the transfer is automatically
paused and does not progress the connect attempt any further until
unpaused via `curl_easy_pause().

Added test758 to verify.

Ref: #18284
Original PR by @Natris
Bug: https://curl.se/mail/lib-2025-08/0012.html
Closes #18288
2025-08-15 13:50:28 +02:00
Daniel Stenberg
c5f76b8096
sendf: getting less data than "max allowed" is okay
Easily triggered when doing an FTP ranged download with the end range
larger than the file size.

A regression since 30de937bda (shipped in curl 8.9.0)

Add test 2307 to verify.

Reported-by: kupavcevdenis on github
Fixes #18283
Closes #18295
2025-08-15 13:35:04 +02:00
Viktor Szakats
be01b60ce5
runtests: assume Time::HiRes, drop Perl Win32 dependency
`Time::HiRes` was already used unconditionally before this patch in
`servers.pm`. This package, and functions used by runtests (`sleep` and
`gettimeofday`) are supported by the minimum Perl version required for
curl:

https://perldoc.perl.org/5.8.0/Time::HiRes

- Drop the `portable_sleep()` wrapper in favor of `Time::HiRes::sleep()`.
- Use `Time::HiRes` unconditionally in `serverhelp.pm`.
- Stop using the `Win32` package where available. It was included
  to provide a Windows fallback for `Time::HiRes::sleep()`. It was never
  actually called, but the dependency may have loaded `Win32.dll`, which
  often appears in failed fork operations in GHA logs.
  Ref: a6fed41f6f #5054 #5034
  Ref: https://github.com/curl/curl/discussions/14854

Closes #18287
2025-08-14 16:34:06 +02:00
Viktor Szakats
c24d4be057
processhelp.pm: fix to use the correct null device on Windows
To not create a file named `nul` in the `tests` directory when running
tests with MSYS2/Cygwin Perl (the only supported Perl for Windows).

I imagine this may cause issues when being written in parallel. Also
`nul` is a reserved filename on Windows.

Closes #18282
2025-08-14 12:25:15 +02:00
Stefan Eissing
37cecfc7b9
websocket: support CURLOPT_READFUNCTION
Add support for CURLOPT_READFUNCTION with WebSocket urls when *not* in
connect-only mode, e.g. when using curl_multi_perform.

Install the callback function and set CURLOPT_UPLOAD. Return
CURL_READFUNC_PAUSE when having nothing more to send and unpause the
transfer when more data is ready.

This will send the read bytes in a WebSocket BINARY frame.

Add support for this mode in the pytest "ws_data" client and have all
tests run in 'curl_ws_send/recv' and 'peform' mode as well.

Add `curl_ws_start_frame()`. Document, cover in libcurl-ws.md and
explain the READFUNCTION mode for websockets.

Add example `websocket-updown` for this.

Closes #17683
2025-08-11 23:28:54 +02:00
Viktor Szakats
626051cd8b
test436: fix running on Windows with _curlrc present
in the user home directory.

Before this patch, the curl tool found the system curlrc first, ignoring
the custom one set by the test via `CURL_HOME`.

Closes #18242
2025-08-10 00:33:45 +02:00
Viktor Szakats
7fd7d561c4
cmake: set CURL_DIRSUFFIX automatically in multi-config builds
To make it easier to run tests when using the Visual Studio generator,
also perhaps Xcode.

Also drop manual settings from CI.

Closes #18241
2025-08-10 00:33:45 +02:00
Daniel Stenberg
b823966d66
tool_parsecfg: use dynbuf for quoted arguments
Instead of doing malloc/free every time and "manual" buffer population.
This reuses the dynbuf for this purpose for the duration of parsing the
file.

Closes #18230
2025-08-08 18:27:03 +02:00
Daniel Stenberg
3b40128b0f
curl: make global truly global
The GlobalConfig only exists in a single instance and it has worked like
this since the dawn of time. It is about time we stop passing around
pointers to what was already essentially a global object and instead
just use a... global.

It simplifies things.

Closes #18213
2025-08-07 10:43:06 +02:00
Viktor Szakats
17bf8809ef
cmake: ExternalProject test tidy-ups
Follow-up to b8296d367a #18208

Closes #18214
2025-08-07 10:37:10 +02:00
Viktor Szakats
b8296d367a
cmake: make the ExternalProject test work
By micromanaging the project dependency and its inclusion into the test
project. It feels like an awkward construct, but perhaps better than
nothing.

It's also fragile because it's a static build with no assistance from
the external project (curl in this case). Mitigated in test by disabling
all dependencies and some features.

Since there is no special core cmake logic to be tested here, in CI
the test is tested really. To keep CI jobs at minimum, only add 3 of
them, taking 42s in total. (All 6 would take 270s.)

Follow-up to e2a23d5d0d #17203

Closes #18208
2025-08-07 09:07:46 +02:00
Oxan van Leeuwen
a93113b5b4
libcurl: reset rewind flag in curl_easy_reset()
curl_easy_reset() did not reset the `rewind_read` flag. This caused any
handles that previously had a CURLE_SEND_FAIL_REWIND error to get stuck
with that error, failing any subsequent requests, even if they didn't
have any body at all.

Verified in test 3034

Fixes #18206
Closes #18207
2025-08-06 17:58:21 +02:00
Viktor Szakats
4e5459c8e1
tests/ech_tests.sh: indent, if/for style, inline ifs
Sync with rest of shell scripts.

Follow-up to 2485a2d100 #17001
Closes #18187
2025-08-06 15:07:04 +02:00
Daniel Stenberg
3689ef21bd
multi: change prefix for the network change bits to CURLMNWC_
Because "CURLM_" is used for curl multi error codes and it is convenient
to use the prefix to identify the number family.

Closes #18176
2025-08-05 13:05:59 +02:00