Commit Graph

6676 Commits

Author SHA1 Message Date
Viktor Szakats
fdc588dc10
cmake: deprecate winbuild, add migration guide from legacy build methods
We recommend migrating to CMake from winbuild and Visual Studio project
files. winbuild is deprecated and will be dropped in September 2025.

CMake supports all the features and options, with new ones added
promptly. It supports out-of-tree, unity and documentation builds.

- deprecate winbuild method in favour of CMake by September 2025.
- add migration guide from winbuild to CMake.
- add migration guide from Visual Studio Project Files to CMake.
- add deprecation message to winbuild.
  Need to ack with `WINBUILD_ACKNOWLEDGE_DEPRECATED=yes`
  Authored-by: Jay Satiro
- mention `CMAKE_BUILD_TYPE` option in `INSTALL-CMAKE`.
- document missing `SSH_PATH` winbuild option.

Closes #15920
2025-01-10 18:20:52 +01:00
Viktor Szakats
a19b79ce87
tidy-up: delete stray references from autotools, docs
- autotools: delete stray `VC14_LIB*` references.
- autotools: delete (now) empty `CLEANFILES`.
- autotools: delete no longer used lib/src .inc includes in root makefile.
- autotools: delete stray `cygwinbin` target.
- autotools: delete stray `pkgadd` target (Solaris).
- lib, src: delete stray files from `.gitignore`.
- INSTALL.md: delete reference to non-existing `src/config-win32.h`.
- lib/config-win32ce.h: whitespace.
- lib/config-win32ce.h: sync comments with `config-win32.h`.

Closes #15944
2025-01-09 02:12:53 +01:00
Daniel Stenberg
115ea7633e
DEPRECATE: remove msh3 in six months
The msh3 backed for QUIC and HTTP/3 was introduced in April 2022 but has
never been made to work properly. It has seen no visible traction or
developer activity from the msh3 main author (or anyone else seemingly
interested) in two years. As a non-functional backend, it only adds
friction and "weight" to the development and maintenance.

Meanwhile, we have a fully working backend in the ngtcp2 one and we have
two fully working backends in OpenSSL-QUIC and quiche well on their way
of ending their experimental status in a future.

We remove msh3 support from the curl source tree in July 2025.

Closes #15931
2025-01-08 23:57:36 +01:00
Stefan Eissing
515a21f350
vtls: feature ssls-export for SSL session im-/export
Adds the experimental feature `ssls-export` to libcurl and curl for
importing and exporting SSL sessions from/to a file.

* add functions to libcurl API
* add command line option `--ssl-sessions <filename>` to curl
* add documenation
* add support in configure
* add support in cmake
+ add pytest case

Closes #15924
2025-01-08 23:32:07 +01:00
Yedaya Katsman
e602f7f119
docs/examples/checksrc: don't allow snprintf specifically
This isn't needed anymore after https://github.com/curl/curl/pull/15835,
since banned functions are just allowed in general in
`docs/examples/.checksrc`, and emits a warning when running make
checksrc:

`invalid warning specified in .checksrc: "SNPRINTF"`

Closes #15916
2025-01-06 13:49:21 +01:00
Daniel Stenberg
893e57e84c
INFRASTRUCTURE.md: project infra
Closes #15906
2025-01-05 11:25:06 +01:00
Daniel Stenberg
abf8062449
CURLOPT_SEEKFUNCTION.md: used for FTP, HTTP and SFTP (only)
The same goes for *SEEKDATA.

Closes #15903
2025-01-02 22:31:11 +01:00
Daniel Stenberg
3eb57d6ba7
docs: use lowercase curl and libcurl
Adjusted badwords to find them.

Plus: make badwords run on all markdown files in the repo and update
markdowns previously unchecked

Closes #15898
2025-01-02 17:15:54 +01:00
Daniel Stenberg
e694c8284a
docs/libcurl/opts: clarify the return values
Expand a little.

- mention the type name of the return code
- avoid stating which exact return codes that might be returned, as that
  varies over time, builds and conditions
- avoid stating some always return OK
- refer to the manpage documenting all the return codes

Closes #15900
2025-01-02 17:13:33 +01:00
Daniel Stenberg
e256d9df6d
docs/cmdline-opts/_ENVIRONMENT.md: minor language fix
Closes #15897
2025-01-02 17:02:26 +01:00
Daniel Stenberg
4501b7e28d
docs/libcurl: return value overhall
Unified, extended, clarified the return values for numerous functions

Closes #15899
2025-01-02 16:58:05 +01:00
Viktor Szakats
27b9e76706
cmake: make system libraries dl, m, pthread customizable
via `DL_LIBRARY`, `MATH_LIBRARY`, `PTHREAD_LIBRARY` variables.

They are used in Rustls, wolfSSL Find modules.

Also:
- always use `NAMES` keyword in `find_library()` calls.
- respect `find_library()` results for `dl`, `m`, `pthread`.
- formatting.

Closes #15892
2025-01-02 12:55:50 +01:00
Daniel Stenberg
91587522a1
docs/HTTP-COOKIES.md: link to more information
Closes #15891
2025-01-01 22:45:48 +01:00
Jakub Jelen
999cc818c5
openssl: add support to use keys and certificates from PKCS#11 provider
In OpenSSL < 3.0, the modularity was provided by mechanism called
"engines". This is supported in curl, but the engines got deprecated
with OpenSSL 3.0 in favor of more versatile providers.

This adds a support for OpenSSL Providers, to use PKCS#11 keys, namely
through the pkcs11 provider. This is done using similar approach as the
engines and this is automatically built in when the OpenSSL 3 and newer
is used.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>

Closes #15587
2025-01-01 14:47:31 +01:00
Jay Satiro
6c70ec16c7 http: ignore invalid Retry-After times
- Treat negative Retry-After date-based times as 0.

- Treat Retry-After times greater than 6 hours as 6 hours.

Prior to this change Retry-After did not have a limited range and the
server could have set a time greater than 6 hours or a date in the past
that would result in a negative time, either of which may be unexpected
by the user.

The 6 hour limit is purposely not documented so that it can be changed
in the future if necessary.

Closes https://github.com/curl/curl/pull/15833
2024-12-31 03:19:22 -05:00
Viktor Szakats
1e14e1682c
examples/block-ip: drop redundant memory.h include
Not used elsewhere in the repo.
2024-12-31 00:35:57 +01:00
Daniel Stenberg
c2d37463b9
curl/var: change byte offset syntax for assignments
Follow-up to 40c264db61 after discussions on IRC.

The new style is

  name[0-99]=contents

and

  name[0-99]@filename

A) This does not cause the same problems with old curl versions trying
the new syntax as this way will cause old curls just fail with syntax
error and not risk using the wrong file.

B) Adds the same byte range support for "normal" assigns, which the
previous syntax did not. Thus lets a user get a partial content of a
variable etc.

Added test 790 and 791 to verify non-file assigns with ranges.

Closes #15862
2024-12-30 15:55:54 +01:00
Daniel Stenberg
53fcac438a
TheArtOfHttpScripting.md: rewrite double 'that'
Closes #15863
2024-12-30 14:02:37 +01:00
Stefan Eissing
a2622cdbd5
mbedtls: fix handling of blocked sends
mbedtls is picky when a mbedtls_ssl_write) was previously blocked. It
requires to be called with the same amount of bytes again, or it will
lose bytes, e.g. reporting all was sent but they were not. Remember the
blocked length and use that when set.

Reported-by: Tamás Bálint Misius
Fixes #15801
Closes #15846
2024-12-30 10:20:27 +01:00
Daniel Stenberg
c445b7426a
checksrc: introduce 'banfunc' to ban specific functions
Use 'banfunc' and 'allowfunc' in .checksrc to specify which functions to
ban or allow to be used. This saves us from having to edit the script
going forward when we want to ban or allow specific functions.

This replaces a set of previous rules and all banned functions are now
checked with the BANNEDFUNC rule.

There is a set of default banned functions, shown by invoking
./checksrc.

Also, -a and -b options are added to specify allowed or banned functions
on the command line.

Closes #15835
2024-12-30 08:25:56 +01:00
Daniel Stenberg
66e5351e0a
urlapi: fix redirect to a new fragment or query (only)
The redirect logic was broken when the redirect-to URL was a relative
URL only as a fragment or query (starting with '#' or '?').

Extended test 1560 to reproduce, then verify.

Reported-by: Jeroen Ooms
Fixes #15836
Closes #15848
2024-12-30 08:23:26 +01:00
Christopher Dannemiller
c78044c07e multi: fix curl_multi_waitfds reporting of fd_count
- Make curl_multi_waitfds consistent with the documentation.

Issue Addressed:

 - The documentation of curl_multi_waitfds indicates that users should
   be able to call curl_multi_waitfds with a NULL ufds. However, before
   this change, the function would return CURLM_BAD_FUNCTION_ARGUMENT.
 - Additionally, the documentation suggests that users can use this
   function to determine the number of file descriptors (fds) needed.
   However, the function would stop counting fds if the supplied fds
   were exhausted.

Changes Made:

 - NULL ufds Handling: curl_multi_waitfds can now accept a NULL ufds if
   size is also zero.
 - Counting File Descriptors: If curl_multi_waitfds is passed a NULL
   ufds, or the size of ufds is insufficient, the output parameter
   fd_count will return the number of fds needed. This value may be
   higher than actually needed but never lower.

Testing:

 - Test 2405 has been updated to cover the usage scenarios described
   above.

Fixes https://github.com/curl/curl/issues/15146
Closes https://github.com/curl/curl/pull/15155
2024-12-29 01:05:09 -05:00
Jay Satiro
39e21794a7 cookie: fix crash in netscape cookie parsing
- Parse the input string without modifying it.

Prior to this change a segfault could occur if the input string was
const because the tokenizer modified the input string. For example if
the user set CURLOPT_COOKIELIST to a const string then libcurl would
likely cause a crash when modifying that string. Even if the string was
not const or a crash did not occur there was still the incorrect and
unexpected modification of the user's input string.

This issue was caused by 30da1f59 (precedes 8.11.0) which refactored
some options parsing and eliminated the copy of the input string. Also,
an earlier commit f88cc654 incorrectly cast the input pointer when
passing it to strtok.

Co-authored-by: Daniel Stenberg

Closes https://github.com/curl/curl/pull/15826
2024-12-27 13:16:08 -05:00
Viktor Szakats
fabfa8e402
clang-tidy: add to CI, add cmake support, fix fallouts
build:
- autotools: fix to build generated sources for the `tidy` target.
- autotools: allow passing custom clang-tidy options via
  `CURL_CLANG_TIDYFLAGS` env.
- cmake: add `CURL_CLANG_TIDY` option to configure for `clang-tidy`.
  Also add:
  - `CLANG_TIDY` variable to customize the `clang-tidy` tool.
  - `CURL_CLANG_TIDYFLAGS` to pass custom options to `clang-tidy`.
- apply `--enable-werror` and `-DCURL_WERROR=ON` to `clang-tidy`.

CI/GHA:
- add clang-tidy job for Linux, using autotools and clang-tidy v18.
  This one needs to disable `clang-analyzer-valist.Uninitialized`
  to avoid false positives:
  https://github.com/llvm/llvm-project/issues/40656
  Duration: 5.5 minutes
- add clang-tidy job for macOS, using cmake and clang-tidy v19.
  This one also covers tests and examples, and doesn't hit the false
  positives seen with llvm v18 and earlier.
  Duration: 4.5 minutes
- Linux/macOS: skip installing test dependencies when not building or
  running tests.

fix fallouts reported by `clang-tidy`:
- lib:
  - cf-h2-proxy: unused assignment in non-debug builds.
  - cf-socket: silence warning.
    FIXME: https://github.com/curl/curl/pull/15825#issuecomment-2561867769
  - ftp: NULL passed to `strncmp()`.
  - http2: NULL-ptr deref.
  - mprintf: silence warning.
- src/tool_writeout: NULL passed to `fputs()`.
- examples:
  - invalid file pointers.
  - missing `fclose()`.
- tests:
  - http/clients/hx-download: memory leaks on error.
  - http/clients/hx-download: memory leak on repeat `-r` option.
  - server: double `fclose()`.
    https://www.man7.org/linux/man-pages/man3/fclose.3.html
  - server: invalid file pointer/handle.
  - server/getpart: unused assignments.
  - server/mqttd: leak on failed `realloc()`.
  - server/tftpd: NULL passed to `strcmp()`.

Closes #15825
2024-12-27 13:42:32 +01:00
Viktor Szakats
421e592db2
cmake: add librtmp Find module
The new detection method also allows to enable librtmp without using
OpenSSL as a curl TLS backend at the same time.

Also:
- implement manual version detection for librtmp.
  Version info is in hex. With CMake 3.13 and newer, extract it as a hex
  number. With earlier CMake version, just strip the leading zeroes.
  Doing more here seems overkill because librtmp has been standing
  at 2.3/2.4 for a decade now. Bumping into hex digits seems unlikely
  before deprecating CMake 3.13 support.
  librtmp advertises v2.4 via its `pkg-config` module, and v2.3 via
  its public header. The latter shows up in `curl -V` and either can
  be shown at configure-time depending on detection method.
  This isn't a curl bug.
- GHA/macos: enable rtmp in a job.
- apply the "half-detection" fix to the Find module.
  `librtmp` is also affected (in CI too), because it depends on libssl and
  libcrypto.

Closes #15832
2024-12-27 12:52:23 +01:00
Jay Satiro
5e1700d167 curl_ws_recv.md: fix typo 2024-12-27 00:37:53 -05:00
Viktor Szakats
7a70b46481
tidy-up: misc
- lib1531: fix to use `curl_off_t`.
- src/tool_doswin: merge `_WIN32` guards.
- src/tool_doswin: limit `S_ISCHR()` to MS-DOS.
- src: dedupe `CURL_O_BINARY` macro into `tool_setup.h`.
- CMake/CurlTests.c: cleanup/formatting `HAVE_FILE_OFFSET_BITS` test.
- examples/httpput-postfields: delete unused include.
- spelling: MultiSSL.
- whitespace.

Ref: #15652
Closes #15799
2024-12-24 01:27:26 +01:00
Daniel Stenberg
822971170c
curl_url_set.md: adjust the added-in to 7.62.0
Reported-by: Jeroen Ooms
Fixes #15822
Closes #15823
2024-12-24 00:42:38 +01:00
Daniel Stenberg
9d5ecc9613
getinfo: provide info which auth was used for HTTP and proxy
CURLINFO_HTTPAUTH_USED and CURLINFO_PROXYAUTH_USED

Tested in 590 and 694

Ref: #12668
Idea-by: Ganesh Viswanathan
Closes #15450
2024-12-23 23:03:54 +01:00
Daniel Stenberg
0ebd286aa3
CURLOPT_PROXY.md: clarify the crendential support in proxy URLs
Ref: #15802
Closes #15805
2024-12-23 11:52:42 +01:00
Jay Satiro
a9d881c725 examples/block-ip: show how to block IP addresses
- Show how CURLOPT_OPENSOCKETFUNCTION can be used to block IP addresses.

This is a new example that demonstrates IP blocking.

Ref: https://github.com/curl/curl/discussions/15710#discussioncomment-11534877

Closes https://github.com/curl/curl/pull/15748
2024-12-22 03:11:19 -05:00
Daniel Stenberg
31c6b50cb2
curl: make --etag-save acknowledge --create-dirs
Add test 693 to verify

Fixes #15730
Suggested-by: Tamir Duberstein
Closes #15732
2024-12-21 14:12:16 +01:00
Daniel Stenberg
33ea71ea3a
TODO: sending only part of --data is now possible
Since 40c264db61

Closes #15794
2024-12-21 12:30:39 +01:00
Stefan Eissing
b06b35154f
getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
Let CURLINFO_QUEUE_TIME_T count only the time a transfer spends queued,
including possible redirect requests.

Add var 'time_queue' for reporting the time in write outs.

Add test for verifying correct reporting.

Closes #15512
2024-12-21 12:04:48 +01:00
Daniel Stenberg
40c264db61
curl: add byte range support to --variable reading from file
Allowing --variable read a portion of provided files, makes curl work on
partial files for any options that accepts strings. Like --data and others.

The byte offset is provided within brackets, with a semicolon separator
like: --variable name@file;[100-200]"

Inspired by #14479
Assisted-by: Manuel Einfalt

Test 784 - 789. Documentation update provided.

Closes #15739
2024-12-21 11:46:27 +01:00
Daniel Stenberg
fc3e1cbc50
hyper: drop support
lib : remove all hyper code
configure: stop detecting hyper
docs: no more mention of hyper
tests: mo more special-handling of hyper builds
CI: no jobs using hyper

Closes #15120
2024-12-21 11:33:05 +01:00
Viktor Szakats
46093d9e0e
examples: make them compile with compatibility functions disabled (Windows)
For MinGW this is `-DNO_OLDNAMES`, with MSVC it is
`-D_CRT_DECLARE_NONSTDC_NAMES=0`.

There have been some support for this before this patch.
After this patch this is extended to all examples.

(And also the standalone http/client programs, if here.)

Cherry-picked from #15652
Closes #15789
2024-12-20 17:56:40 +01:00
Viktor Szakats
37fb50a858
examples/complicated: fix warnings, bump deprecated callback, tidy up
Also: make them C89, add consts.

Closes #15785
2024-12-20 17:56:35 +01:00
Stefan Eissing
fa0ccd9f1f
lib: TLS session ticket caching reworked
Described in detail in internal doc TLS-SESSIONS.md

Main points:
- use a new `ssl_peer_key` for cache lookups by connection filters
- recognize differences between TLSv1.3 and other tickets
  * TLSv1.3 tickets are single-use, cache can hold several of them for a peer
  * TLSv1.2 are reused, keep only a single one per peer
- differentiate between ticket BLOB to store (that could be persisted) and object instances
- use put/take/return pattern for cache access
- remember TLS version, ALPN protocol, time received and lifetime of ticket
- auto-expire tickets after their lifetime

Closes #15774
2024-12-20 14:59:23 +01:00
Daniel Stenberg
ed732e3596
examples/synctime.c: remove references to dead URLs and functionality
This example can use the Date: header of any server so there is no point
in linking to ancient URLs describeing a setup at NIST that no longer
exists.

Closes #15786
2024-12-20 13:39:12 +01:00
Daniel Stenberg
cfb97e1fcf
VULN-DISCLOSURE-POLICY.md: mention the not setting CVSS
Closes #15779
2024-12-19 22:59:54 +01:00
dwickr
c5052a0187 CURLOPT_RESOLVE.md: fix wording
(`*`) It's an asterisk, not an ampersand.

Closes https://github.com/curl/curl/pull/15770
2024-12-17 23:14:12 -05:00
Viktor Szakats
f2adb3b6d7
cmake: extend zlib's AUTO option to brotli, zstd and enable if found
- make `curl_dependency_option()` more generic.

- extend `CURL_BROTLI` and `CURL_ZSTD` options to accept
  `AUTO` in addition to existing `ON` and `OFF`.

- change `CURL_BROTLI` and `CURL_ZSTD` option default
  to `AUTO`. Was: `OFF`.
  It brings cmake behavior closer to `./configure`.
  Still different:
  - `./configure` defaults to `off` which means to check default
    locations. cmake checks more locations by default.
    (Also tried `NO_CMAKE_PATH`, but then it checked less locations.)
  - cmake returns both `brotlicommon` and `brotlidec` libs,
    while `./configure` only returns the latter.

- ci: drop explicit cmake options, that are now unnecessary.

- GHA/configure-vs-cmake: make adjustments to make tests pass.

Closes #15431
2024-12-17 04:06:45 +01:00
Viktor Szakats
290607f9d4
Revert: cmake: enable CURL_USE_PKGCONFIG for cross-MINGW
This reverts commit 39c06f7883 #15005.

Combined with most Find modules now supporting `pkg-config`
(39c741b7b0 #15408) this change made
mingw-cross builds fragile by picking up OS-native components. Also
adding `/usr/include` to the header path, confusing feature detection.
2024-12-17 03:21:22 +01:00
Viktor Szakats
a3585c9576
Makefile.mk: drop in favour of autotools and cmake (MS-DOS, AmigaOS3)
`Makefile.mk` supported MS-DOS and Amiga, but `./configure` also
supported them in a better tested and more flexible way.

This patch also adds CMake support for MS-DOS/DJGPP and Amiga OS 3.

`Makefile.mk` was not maintained. Delete it in favour of first-tier
build methods.

Also include some non-MS-DOS/AmigaOS-specific tidy-up, see details at
the end of this message.

Details:

- fix/silence all MS-DOS/DJGPP build warnings and issues.
- add MS-DOS support to cmake.
  - default to `ENABLE_THREADED_RESOLVER=OFF` for MS-DOS.
  - add support for `WATT_ROOT`.
  - use static libcurl with MS-DOS.
  - fixup default CMake suffixes/prefixes for DJGPP.
  - disable hidden symbols for MS-DOS. Not supported on MS-DOS.
  - opt-in MS-DOS into `USE_UNIX_SOCKETS`.
- improve MS-DOS support in autotools.
  - default to `--disable-threaded-resolver` for MS-DOS.
- make sure to use `close_s()` (from Watt-32) with autotools and cmake.
  `Makefile.mk` used it before this patch.
- GHA: add DJGPP cmake (~30s) and autotools (~60s) build jobs.
  Also build tests and examples with cmake.
- improve AmigaOS support in autotools:
  - configure: detect `CloseSocket()` when it's a macro.
  - configure: fix `IoctlSocket` detection on AmigaOS.
  - curl-amissl.m4: pass AmiSSL libs to tests/servers.
- add AmigaOS3 support to cmake:
  - cmake: fix `HAVE_IOCTLSOCKET_CAMEL` and
    `HAVE_IOCTLSOCKET_CAMEL_FIONBIO` detections.
  - set necessary system libs.
  - add AmiSSL support.
  - inet_ntop, inet_pton: fix using it for AmigaOS. cmake detects them,
    and they did not compile with AmigaOS.
  - cmake: better sync `gethostname` detection with autotools.
    Fixes detection for AmigaOS, where `gethostname` is a macro.
  - cmake: fix `sys/utime.h` detection on AmigaOS.
  - cmake: force-disable `getaddrinfo` for AmigaOS.
  - cmake: tweak threading and static/shared default for AmigaOS.
  - cmake: rely on manual variable `AMIGA` to enable the platform.
- GHA: add AmigaOS cmake and autotools (~45s) jobs.
  Also build tests and examples with cmake.
- INSTALL: update MS-DOS and AmigaOS build instructions.
- amigaos: fix `-Wpointer-sign` and
  `zero or negative size array '_args'` in `Printf()`.
- amigaos: fix `-Wpointer-sign`
- amigaos: fix `-Wredundant-decls` `errno` and `h_errno`.
- amigaos: brute-force silence `lseek()` size warnings.
- amigaos: server/resolve: silence `-Wdiscarded-qualifiers`.
- amigaos: server/resolve: fix `-Wpointer-sign`.
- amigaos: fix `CURL_SA_FAMILY_T` type.
- nonblock: prefer `HAVE_IOCTLSOCKET_CAMEL_FIONBIO` for AmigaOS.
  `ioctl` is also detected, but fails when used. Make the above override
  it for a successful build.
  Authored-by: Darren Banfi
  Fixes #15537
  Closes #15603
- tftpd: prefer `HAVE_IOCTLSOCKET_CAMEL_FIONBIO` for AmigaOS.
- tftpd: tidy-up conditional code.
- curl: set stack size to 16384 for AmigaOS3/4
  Overriding the default 4096.
  Suggested-by: Darren Banfi
  Ref: https://github.com/curl/curl/pull/15543#issuecomment-2498783123
  Ref: https://wiki.amigaos.net/wiki/Controlling_Application_Stack
- functypes.h: fix `SEND_QUAL_ARG2` for AmigaOS.
- tftp: add missing cast in sendto() call for AmigaOS.
- getinfo: fix warning with AmigaOS.
- tool_operate: silence warning with AmigaOS
- amigaos: fix building libtests due to missing `RLIMIT_NOFILE`.
- curl_gethostname: silence warning for AmigaOS.
- ftp: silence `-Wtype-limits` for AmigaOS.
- libtest: fix timeval initialization for AmigaOS.
- examples: fix `timeval` initialization for AmigaOS.
- examples: silence warning for AmigaOS.
- configure: fix IPv6 detection for cross-builds.
- netrc: fix to build with AmigaOS cleanly.
- buildinfo: detect and add `DOS` tag for MS-DOS builds.
- buildinfo: add `AMIGA` to buildinfo.txt in auttools.
- build: move `USE_WATT32` macro definition to cmake/configure.

Non-MS-DOS/AmigeOS-specific tidy-ups:

- configure: sync `sa_family_t` detection with cmake.
- configure: sync `ADDRESS_FAMILY` detection signals with cmake.
- doh: use `CURL_SA_FAMILY_T`.
- lib: drop mingw-specific `CURL_SA_FAMILY_T` workaround.
- cmake: extend instead of override check-specific
  configurations/requirements.
  This allows to honor global requirements added earlier.
  Necessary for AmigaOS for example.
- cmake: omit warning on disabled IPv6 for MS-DOS and AmigaOS.
  No IPv6 support on these platforms. Also sync with autotools.
- lib1960: use libcurl `inet_pton()` wrapper.
- cmake: detect LibreSSL (to match autotools).
- cmake: say the specific OpenSSL flavour detected.
- hostip: add missing `HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID` guard.
- lib: simplify classic mac feature guards.

Follow-up to a8861b6ccd #9764

Closes #15543
2024-12-16 23:20:55 +01:00
Daniel Stenberg
607bec04d9
INSTALL.md: sync with my brag slide "104 operating systems"
Minoca, Nintendo 3DS and Maemo were missing.

Rename OS/400 to IBM I

Closes #15755
2024-12-16 23:09:11 +01:00
Viktor Szakats
39c06f7883
cmake: enable CURL_USE_PKGCONFIG for cross-MINGW
Enable `CURL_USE_PKGCONFIG` by default for MinGW cross-builds.

Note: This may cause fallouts in certain envs where `pkg-config` picks
up native packages.

Follow-up to e1ab01d1bd #14658
Follow-up to c555ab469d #14575

Closes #15005
2024-12-16 22:16:06 +01:00
Viktor Szakats
b9895b9d3f
cmake: namespace functions and macros
Prefix (or suffix) curl-defined macro and function names with `curl`.
To avoid collisions with non-curl CMake and to make them recognizable
as curl-specific calls.

Closes #15498
2024-12-16 21:55:00 +01:00
Viktor Szakats
b4aa93114c
cmake: replace unset(VAR) with set(VAR "") for init
Also add cleanup `unset()`s where missing.

Reported-by: Kai Pastor
Bug: https://github.com/curl/curl/pull/15255#issuecomment-2458659626
Follow-up to 8b09138083 #14610

Closes #15497
2024-12-16 21:12:51 +01:00
Daniel Stenberg
0af5ce162f
variable.md: mention --expand-variable for variables to variables
To assign a variable using contents from another variable.

Closes #15752
2024-12-16 08:17:22 +01:00
Daniel Stenberg
6eb86e428d
ws-docs: remove the outdated texts saying ws support is experimental
It stopped being experimental in 8.10.0

Fixes #15749
Reported-by: Mohammed Sadiq
Closes #15751
2024-12-15 18:14:52 +01:00
Daniel Stenberg
9294ca8916
variable.md: show function use with examples
Closes #15743
2024-12-14 17:00:23 +01:00
Daniel Stenberg
cd80716cb6
docs/BUGS.md: remove leading space from a link 2024-12-14 14:22:38 +01:00
Daniel Stenberg
7347ddc9e2
tool_operate: make --etag-compare always accept a non-existing file
Consider it a blank etag. It allows for more use cases when the file
just might not have been created yet.

Closes #15737
2024-12-13 15:48:27 +01:00
Daniel Stenberg
a300879b63
curl: return error if etag options are used with multiple URLs
And document it.

Add tests 484 and 485

Fixes #15729
Reported-by: Tamir Duberstein
Closes #15731
2024-12-13 10:11:26 +01:00
Daniel Stenberg
c2ac9ea1ee
checksrc: ban use of sscanf()
Using sscanf() is not a (security) problem in itself, but we strongly
discorage using it for parsing input since it is hard to use right, easy
to mess up and often makes for sloppy error checking.

Allow it in examples and tests

Closes #15687
2024-12-13 09:43:05 +01:00
Daniel Stenberg
d5c738c608
strparse: string parsing helper functions
Designed to aid converting off from sscanf parsers. sscanf is hard to
use right, easy to mess up and often makes for sloppy error checking.

The new parsers allow more exact and pedandic parsing.

This new set of functions should be possible to use (and extend) and
switch over other libcurl parser code to use going forward.

Adapts the following to use the new functions:

- altsvc.c
- hsts.c
- http_aws_sigv4.c

Bonus: fewer memory copies, fewer stack buffers.

Test: Unit test1664

Docs: docs/internals/STRPARSE.md

Closes #15692
2024-12-12 16:00:52 +01:00
Daniel Stenberg
98b30eda79
RELEASE-PROCEDURE.md: mention how to publish security advisories
As they are releated to the release procedure

Closes #15714
2024-12-11 11:11:32 +01:00
Daniel Stenberg
cff5a7b641
THANKS: contributors from 8.11.1 2024-12-11 08:05:13 +01:00
Daniel Stenberg
96ffb57040
docs: bring back ALTSVC.md and HSTS.md
This partly reverts 0e06603b23

These file formats are not properly documented elsewhere, plus the
website uses these files to populate the documentation pages to which
users end up via the URLs that are mentioned within the alt-svc and hsts
files.

Fixes #15705
Reported-by: Jeffrey Bosboom
Closes #15706
2024-12-09 09:32:19 +01:00
Daniel Stenberg
3856e10445
KNOWN_BUGS: setting a disabled option should return CURLE_NOT_BUILT_IN
Reported-by: Jeroen Ooms
Closes #15472
Closes #15675
2024-12-04 07:07:43 +01:00
Daniel Stenberg
90d937def9
RELEASE-NOTES: synced 2024-12-03 17:21:42 +01:00
Daniel Stenberg
0169b80e5c
curl: --continue-at is mutually exclusive with --remove-on-error
Test 482 verifies

Fixes #15645
Reported-by: Harry Sintonen
Closes #15668
2024-12-02 21:22:57 +01:00
Daniel Stenberg
ffbcde0022
curl: --continue-at is mutually exclusive with --no-clobber
Test 481 verifies

Fixes #15645
Reported-by: Harry Sintonen
Closes #15668
2024-12-02 21:22:47 +01:00
Daniel Stenberg
fcb59534e3
curl: --continue-at is mutually exclusive with --range
Allowing both just creates a transfer with behaviors no user can
properly anticipate so better just deny the combo.

Fixes #15646
Reported-by: Harry Sintonen
Closes #15666
2024-12-02 15:36:44 +01:00
Daniel Stenberg
fa1a8e0215
docs: suggest --ssl-reqd instead of --ftp-ssl
Reported-by: SuperStormer on github
Fixes #15658
Closes #15660
2024-12-02 09:07:50 +01:00
Dan Fandrich
c121f19601 DISTROS: update Alt Linux links 2024-11-29 00:54:47 -08:00
Viktor Szakats
a72b479dec
build: fix MSVC UWP builds
The MSVC UWP job in CI did not actually enable UWP. Fix this and
the fallouts discovered after enabling it.

- GHA/windows: make sure to enable UWP in MSVC vcpkg UWP job.
  Use the CMake options and C flags already used for mingw-w64, but use
  `WINAPI_FAMILY_PC_APP` instead of the deprecated `WINAPI_FAMILY_APP`.
  (The former is not supported by mingw-w64, so leave it there as-is.)
  Follow-up to cb22cfca69 #14077

- GHA/windows: by default the MSVC UWP job became 2x-3x slower than
  others after actually enabling UWP. Most of it is caused by
  CMake/MSBuild automatically building full APPX containers for each
  `.exe` target. This includes 21 CMake feature detections. Each
  detection app is built into a 15MB APPX project, with code signing,
  logos, etc. Example:
    https://github.com/curl/curl/actions/runs/12056968170/job/33620610958
  Disable this overhead for curl build targets via custom
  `CMAKE_VS_GLOBALS` options. I've found no way to apply them to feature
  detection targets, so those remain slow.

- cmake: automatically enable Unicode for UWP builds. It's required.
  Also stop enabling it manually in the existing CI job.

- tests: fix `getpid()` use for Windows UWP:
  ```
  tests\server\util.c(281,21): warning C4013: 'getpid' undefined; assuming extern returning int
  ```
  Ref: https://github.com/curl/curl/actions/runs/12061215311/job/33632904249#step:11:38

- src/tool_doswin: disable `GetLoadedModulePaths()` for UWP.
  mingw-w64 UWP was okay with this, but MS SDK headers are not.
  This makes `--dump-module-paths` return empty for UWP builds.
  ```
  src\tool_doswin.c(620,3): error C2065: 'MODULEENTRY32': undeclared identifier
  src\tool_doswin.c(626,11): warning C4013: 'CreateToolhelp32Snapshot' undefined; assuming extern returning int
  src\tool_doswin.c(626,36): error C2065: 'TH32CS_SNAPMODULE': undeclared identifier
  src\tool_doswin.c(632,7): warning C4013: 'Module32First' undefined; assuming extern returning int
  ```
  Ref: https://github.com/curl/curl/actions/runs/12055081933/job/33614629930#step:9:35

- examples: fix `websocket.c` to include `winsock2.h` before `windows.h`
  to make it build with MSVC UWP:
  ```
  include\curl\curl.h(143,16): error C2061: syntax error: identifier 'curl_socket_t'
  include\curl\curl.h(143,16): error C2059: syntax error: ';'
  include\curl\curl.h(417,52): error C2146: syntax error: missing ')' before identifier 'curlfd'
  include\curl\curl.h(417,38): error C2081: 'curl_socket_t': name in formal parameter list illegal
  ```
  Ref: https://github.com/curl/curl/actions/runs/12055317910/job/33615644427#step:14:126

- GHA/windows: silence linker warning with MSVC UWP builds:
  ```
  LINK : warning LNK4075: ignoring '/INCREMENTAL' due to '/OPT:ICF' specification
  ```
  Ref: https://github.com/curl/curl/actions/runs/12055696808/job/33616629610#step:11:38

- GHA/windows: set `/INCREMENTAL:NO` for all MSVC jobs to improve
  performance a little.

- cmake: show `UWP` platform flag.

Ref: #15652
Closes #15657
2024-11-28 14:24:03 +01:00
Viktor Szakats
2f03242316
build: fix ECH to always enable HTTPS RR
The ECH feature cannot be built without HTTPS RR.

ECH automatically implied HTTPS RR in `./configure` but not in CMake,
winbuild, documentation.

Also update documentation and CI configs.

Follow-up to a362962b72 #11922
Closes #15648
2024-11-28 11:55:05 +01:00
Wyatt O'Day
6238888ca7 schannel: remove TLS 1.3 ciphersuite-list support
Drop TLS 1.3 ciphersuite-list support from SChannel because of the
number of bugs in SChannel itself (a closed-source TLS library). TLS 1.3
with SChannel still works, however the ciphersuite negotiation is left
entirely to SChannel.

Bug: https://hackerone.com/reports/2792484
Reported-by: newfunction on hackerone

Fixes https://github.com/curl/curl/issues/15482
Closes https://github.com/curl/curl/pull/15621
2024-11-21 17:09:24 -05:00
Jay Satiro
cb2ae6e8a8 curl_multi_socket_all.md: soften the deprecation warning
- Instead of saying "do not use", explain that the function was
  deprecated for performance reasons.

Some users may have a legitimate use of this function even though we
deprecated it. Since there are no plans to remove it from the API get
rid of the "do not use" warning.

Bug: https://curl.se/mail/lib-2024-11/0029.html
Reported-by: Jacob Champion

Closes https://github.com/curl/curl/pull/15576
2024-11-18 14:17:14 -05:00
Brendon Smith
dada880fc5
docs: document default User-Agent
curl offers a `--user-agent` option for modifying the `User-Agent`
header supplied in its requests.

The man page section for this option explains how to use the
`--user-agent` option, but does not explain which `User-Agent` curl uses
by default.

By default, curl uses curl/VERSION, such as `User-Agent: curl/8.11.0`.

Note that this appears to be different from the libcurl default (no
User-Agent header).

This commit documents the default `User-Agent` in the man page section
for the `--user-agent` option, as well as on the "Art of Scripting"
page.

The `%VERSION` placeholder will be used to insert the current version
as described in the man page generator docs.

Closes #15608
2024-11-18 00:03:10 +01:00
Daniel Stenberg
ca6d3d2e9b
show-headers.md: clarify the headers are saved with the data
Fixes #15605
Reported-by: tkzv on github
Closes #15606
2024-11-17 22:06:21 +01:00
Daniel Stenberg
bc34ebc87b
curl.h: mark two error codes as obsolete
Not used by libcurl since many years

Closes #15538
2024-11-16 23:39:04 +01:00
Logan Buth
c14a9c8124
CURLOPT_PREREQFUNCTION.md: add result code on failure
Closes #15542
2024-11-15 23:56:21 +01:00
Viktor Szakats
1cd745a581
ECH: enable support for the AWS-LC backend
Extend existing ECH support for BoringSSL to its AWS-LC fork.

Also enable ECH in AWS-LC CI jobs.

```
curl 8.11.0-DEV (x86_64-pc-linux-gnu) libcurl/8.11.0-DEV AWS-LC/1.37.0 zlib/1.3 brotli/1.1.0 zstd/1.5.5 libpsl/0.21.2
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli ECH HSTS HTTPS-proxy IPv6 Largefile libz NTLM PSL SSL threadsafe UnixSockets zstd
```

Closes #15499
2024-11-08 13:59:39 +01:00
Daniel Stenberg
995db17484
RELEASE-PROCEDURE.md: adjust release dates
Due to the calendar tweak with the pending patch release on December 11.
2024-11-08 11:02:39 +01:00
Daniel Stenberg
a3b4ffd429
TODO: consider OCSP stapling by default
Suggested-by: Nicolas F.
Closes #15483
Closes #15521
2024-11-08 08:57:45 +01:00
Daniel Stenberg
f4ee7bafda
cmdline/ech.md: formatting cleanups
Reported-by: Samuel Henrique
Fixes #15506
Closes #15517
2024-11-07 23:47:17 +01:00
Daniel Stenberg
62020546cc
THANKS: contributors from the 8.11.0 release 2024-11-06 08:05:56 +01:00
Viktor Szakats
fb711b5098
build: fix clang-cl builds, add CI job
- appveyor: add build-only job for clang-cl.

- cmake: `-pedantic-errors` enables `-Werror,-Wlanguage-extension-token`
  automatically, which makes `__int64` detection fail.
  Explictly disable this compiler warning for clang-cl to make the
  feature detection work and to accept `__int64` in the source code.

- cmake: disable `-Wlanguage-extension-token` warning for clang-cl
  to fix these when encountering `__int64`:
  ```
  lib/formdata.c(797,29): error : extension used [-Werror,-Wlanguage-extension-token]
  lib/warnless.c(117,33): error : extension used [-Werror,-Wlanguage-extension-token]
  lib/warnless.c(60,28): message : expanded from macro 'CURL_MASK_SCOFFT'
  lib/warnless.c(59,38): message : expanded from macro 'CURL_MASK_UCOFFT'
  include\curl/system.h(352,40): message : expanded from macro 'CURL_TYPEOF_CURL_OFF_T'
  ```

- make `__GNUC__` warning suppressions apply to `__clang__` too.
  Necessary for clang-cl, which defines the latter, but not the former.
  (Regular clang defines both.)

- examples: fix clang-cl compiler warning in `http2-upload.c`.
  ```
  docs\examples\http2-upload.c(56,5): error : no previous prototype for function 'my_gettimeofday' [-Werror,-Wmissing-prototypes]
  docs\examples\http2-upload.c(56,1): message : declare 'static' if the function is not intended to be used outside of this translation unit
  ```

- unit2604: add missing `#pragma GCC diagnostic pop`.
  Follow-up to e53523fef0 #14859

- unit1652: limit compiler warning suppression to GCC.
  They do not affect clang builds.
  Follow-up to 71cf0d1fca #14772

Closes #15449
2024-10-30 23:15:32 +01:00
Viktor Szakats
9acecc923d
tidy-up: whitespace, fix CI spacecheck for docs
Also: fixup CI spacecheck to apply to docs again.

Closes #15423
2024-10-30 23:15:28 +01:00
Daniel Stenberg
c0d2b9bee7
MQTT: remove trailing newline 2024-10-30 14:04:08 +01:00
Marwan Yassini
e4aa07b526
mqtt: fix mqtt.md wording and add clearer explanation
Some of the wording in the mqtt.md confused me as to how the commands
were used and what they did, so I cleared up some of the wording to
better explain what each command does.

Closes #15451
2024-10-30 08:44:05 +01:00
Viktor Szakats
1db9af2b9e
cmake: tweaks around debug mode and hidden symbols
- emit warning for `ENABLE_DEBUG` builds.

- add words to clarify that `ENABLE_DEBUG` is meant for developing curl
  itself.

- add comment saying `CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS=ON`
  CMake option may export extra, non-curl symbols.
  Ref: https://github.com/microsoft/vcpkg/issues/41761
  Unexplained exports seen also in curl CI:
  ```
  [ 742] _tcschr
  [ 743] _tcsncmp
  [ 744] _tcsncpy
  [ 745] _tcspbrk
  ```
  https://ci.appveyor.com/project/curlorg/curl/builds/50864041/job/lolledrg4h7hu6e4?fullLog=true#L2160
  CMake extracts these symbols from `.obj` files:
  https://gitlab.kitware.com/cmake/cmake/-/issues/22092#note_943718
  I have not found any new MSVC option that helps fixing this without
  decorating all functions in-source or maintaining a manual list of
  internal function names used for tests:
  https://learn.microsoft.com/cpp/build/reference/wholearchive-include-all-library-object-files

Closes #15414
2024-10-27 14:26:45 +01:00
Daniel Stenberg
1160380e50
docs: clarify FTP over HTTP proxy functionality somewhat
Reported-by: newfunction

Closes #15417
2024-10-26 23:45:32 +02:00
Viktor Szakats
b8c12634fc
INSTALL-CMAKE: fix punctuation and a typo [ci skip] 2024-10-24 23:21:00 +02:00
Viktor Szakats
f66af623cf
cmake: document -D and env build options
Extend `INSTALL-CMAKE` document with the list of available options,
a short description and default values.

The list may not be 100% complete.

There are no component boundaries in CMake, so the line is blurry
between curl options, CMake options, CMake Find modules options.
I included certain CMake options that seemed useful, and/or have
dedicated use withing curl's CMake source. But, all CMake built-in
options are usable, as documented upstream in CMake.

The naming of the options has a heritage and the inconsistencies with
it, including a lack of clear namespace. This may be subject to future
updates, also after figuring out which name has special meaning within
CMake and/or CMake projects out of unwritten convention or something
more tangible.

CMake allows to initialize any internal variable via `-D`. This may be
useful to pre-initialize/override feature check results. The list
doesn't contain these, and they remain officially undocumented.

Also:
- make adjustments to keep the spellchecker happy.
- retrofit description changes to the cmake sources.
- stop documenting deprecated `Find*` variables.

Reported-by: Daniel Stenberg
Fixes https://github.com/curl/curl/discussions/14885
Closes #15388
2024-10-24 23:06:40 +02:00
Viktor Szakats
ec68fb5a6c
cmake: drop obsolete items from TODO and INSTALL-CMAKE
- INSTALL-CMAKE: delete `Current flaws in the curl CMake build` section.
  #1123 was fixed in 7e93637acd #2443

- TODO: delete item 3.2.
  Follow-up to 1cb4f5d6e8 #1879

Closes #15405
2024-10-24 19:13:10 +02:00
Daniel Stenberg
02ac5547c7
docs/libcurl/opts/Makefile.inc: alphasort the options list 2024-10-24 16:20:36 +02:00
Daniel Stenberg
1056889f91
url.md: clarify
- the specified URL can also get data sent to it
- rephrase the scheme guessing part
- mention target options for each URL for saving data
- mention --remote-name-all
- remove "warning" and make it into normal text

Closes #15396
2024-10-24 14:32:13 +02:00
Viktor Szakats
9126eb5a8a
cmake: replace CURL_*_DIR with {PROJECT,CMAKE_CURRENT}_*_DIR
It reduces the number of synonym variables in the code.
Makes it easier to grok and grep.

- replace `CURL_SOURCE_DIR`
  with `PROJECT_SOURCE_DIR`.

- replace `CURL_BINARY_DIR`
  with `PROJECT_BINARY_DIR` or `CMAKE_CURRENT_BINARY_DIR`.

- replace a single use of `CMAKE_BINARY_DIR`
  with `PROJECT_BINARY_DIR`.

- replace `CMAKE_CURRENT_*_DIR`
  with `PROJECT_*_DIR` where it makes the code more uniform.

- quote an argument (formatting).

Closes #15331
2024-10-22 19:13:08 +02:00
Daniel Stenberg
51724c43e3
curl_ws_recv.md: the 'meta' pointer is only returned on success
Reported-by: Dylam De La Torre
Fixes #15340
Closes #15343
2024-10-20 22:58:27 +02:00
Jay Satiro
547d600476 curl_multi_perform.md: fix typo
Reported-by: Dylam De La Torre

Fixes https://github.com/curl/curl/issues/15339
2024-10-19 12:34:27 -04:00
Dan Fandrich
6847733191 docs: fix a typo in some cipher options 2024-10-18 14:42:34 -07:00
Daniel Stenberg
b4e162566f
KNOWN_BUGS: LDFLAGS passed too late
Makes linking fail on some (ancient) platforms.

Closes #14893
Closes #15306
2024-10-18 11:52:30 +02:00
Daniel Stenberg
288cfcbe38
RELEASE-NOTES: synced 2024-10-18 10:13:38 +02:00
Daniel Stenberg
29faa7919b
libcurl/opts: improve phrasing for connection cap related options
Unify, clarify.

Closes #15324
2024-10-17 23:06:33 +02:00
Daniel Stenberg
d1323839be
DISTROS: avoid use of "very" 2024-10-17 13:36:33 +02:00
Viktor Szakats
3040971d12
GHA: silence proselint warnings and an error
Fix new issues found by `proselint`.

Also:
- silence this technical warning:
  ```
  :0: DeprecationWarning: /home/runner/.proselintrc was found instead of a JSON file. Rename to /home/runner/.proselintrc.json.
  ```
- fix an input filename.
  `proselints` fails now if an input file is missing.

Reported-by: Jay Satiro
Bug: https://github.com/curl/curl/pull/15291#issuecomment-2410505100
Closes #15293
2024-10-15 16:44:17 +02:00