Openssl needs an additional call into its API at just the right time to
*really* enable early data use. Add checks after handshake if early data
was really successful, more stringent than we used before.
test_02_32: enable early data test wiht more backends and platforms to
see how CI now copes with it.
Fixes#22649Closes#22657
Reported-by: Rarylson Freitas
HTTP Negotiate can create and send a Kerberos token before receiving a
server challenge. The SSPI backend only supplied Schannel endpoint
bindings when a challenge token was present, causing IIS with EPA
enabled to reject preemptive Kerberos authentication with
STATUS_BAD_BINDINGS.
Build the SSPI input descriptor independently of the challenge token so
Schannel endpoint bindings are included on both initial and subsequent
InitializeSecurityContext calls.
Assisted-by: martin-fzi@users.noreply.github.com
Fixes https://github.com/curl/curl/issues/22466
Closes https://github.com/curl/curl/pull/22537
Iterating unit test 1627 50,000 times show the new version to be 31%
faster on my machine.
- unit1627: add more test strings, In particular three, five and six letter
non-existing schemes.
- remove scripts/schemetable.c, not used anymore
Closes#22658
Seen in the 'curl-for-win / Windows gcc zlib-classic (x64)' CI job,
after it got an upstream upgrade from gcc-15 to gcc-16:
```
lib/http.c:206:6: error: 'out.str' may be used uninitialized [-Werror=maybe-uninitialized]
206 | if(header_has_value(&header, &out)) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/api.h:188:3: error: 'guard.data' may be used uninitialized [-Werror=maybe-uninitialized]
188 | Curl_mapi_enter((g), (m), CURL_MAPI_FN_##fn, (r)) && (m)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/multi.c:1695:6: note: in expansion of macro 'CURL_MAPI_ENTER'
1695 | if(CURL_MAPI_ENTER(&guard, m, multi_poll, &mresult)) {
| ^~~~~~~~~~~~~~~
```
Ref: https://github.com/curl/curl/actions/runs/32626356576/job/97162205296#step:3:4906Closes#22651
Correct grammar and spelling in documentation and source comments. Also
fix the Aspell configuration key and one user-facing OpenSSL error
message.
Closes#22647
The added code to avoid loading PSL cookies from files from PR #22500
(c041895, not shipped in a release), calls psl_is_public_suffix(),
returns TRUE also for "localhost" (!).
We now allow cookies again for localhost. Added test 320 to verify.
Reported-by: Athos Ribeiro
Fixes#22645Closes#22646
verify-examples.pl invokes 'gcc', which on macOS is clang. With
-Wall -Wextra... -Werror -pedantic, clang rejects two patterns that
GNU gcc accepts:
- passing a char * to %p without a cast (-Wformat-pedantic): the C
standard says %p expects void *, so cast explicitly in the
CURLOPT_PROGRESSDATA, CURLOPT_PROGRESSFUNCTION, CURLOPT_XFERINFODATA
and CURLOPT_XFERINFOFUNCTION examples
- returning CURLcode result from main() when curl_easy_init() returned
NULL leaves it uninitialized (-Wsometimes-uninitialized) in the
CURLINFO_TLS_SSL_PTR example: initialize it to CURLE_OK like other
man pages already do
Closes#22638
While they are not curl releases done by the Open Source project or
provided openly, these version numbers might appear in the wild so let's
document them in this separate list.
Closes#22636
When websocket writes out data thought the registered write callback and
that returns an error, clear the write buffers, so a sub-sequent flush
will not attempt another write. The transfer is failed at that point and
should no longer invoke the callback.
Fixes#22627
Reported-by: Scott Talbert
Closes#22634
`zizmor` keeps being confused by non-"well-known" shell designators
`msys2 {0}`, `<path>\bash.exe '{0}'`, `cpa.sh {0}`, while `actionlint`
silently skips checking such shell code. Though it's all POSIX/bash.
Replace the unrecognized shell designators with `bash` before running
the linters, to remove these blind spots.
zizmor pedantic persona:
Before: `No findings to report. Good job! (1 ignored, 61 suppressed)`
After: `No findings to report. Good job! (1 ignored)`
zizmor auditor persona:
Before: `No findings to report. Good job! (62 ignored)`
After: `No findings to report. Good job! (1 ignored)`
Closes#22626
The previous 4 entries were exhausted on simple command lines, depending
on environment/build. Grow the initial size to 8 to avoid early allocs.
Closes#22633
Change the storage of easy handle option strings from an array sized for
all possible options to a hash set to reduce memory footprint.
Give the hash set initially room for 4 strings, with first allocation
happening when it goes beyond that. Measurements without test suite
and a forced fail on growing the set gives:
Size Result
2 1261 tests out of 1951 reported OK: 64%
4 1792 tests out of 1951 reported OK: 91%
8 1944 tests out of 1951 reported OK: 99%
16 1949 tests out of 1951 reported OK: 99%
32 single fail of 3211, unit test for u8_strset
Add u8_strset that keeps the tuples (uint8_t id, char *str)
and allows set/unset by `id`. Add that as data->set.strings.
Define MACROS
* CURL_EASY_STR(data, id) for access
* CURL_EASY_STR_SET(data, id, s) for setting, making a copy
* CURL_EASY_STR_SETN(data, id, s) for setting, no copy
* CURL_EASY_STR_CLEAR(data, id) for unsetting
* CURL_EASY_STR_CLEAR0(data, id) for unsetting and zero-ing value
Add `data->set.str_copypostfields` to handle former `STRING_COPYPOSTFIELDS`
string that was not always a string and could carry NUL bytes.
Add unit tests to test3211.
Closes#22628
`ossl_chain_get_der()` allocates a DER encoding of each peer certificate
via `i2d_X509()`, but `Curl_vtls_apple_verify()` only copies it into a
CFData and never frees the original. This leaks per certificate, per
handshake, whenever USE_APPLE_SECTRUST is used with the
OpenSSL/LibreSSL/BoringSSL backend.
Fix frees the buffer inside openssl.c itself, so the GnuTLS backend
(which borrows rather than allocates) is unaffected.
Closes#22631
A value whose first byte is ':' or '<' is not a SAFE-INIT-CHAR per RFC
2849 and must be base64-encoded, but ldap_value_needs_base64() and the
inline check in oldap_recv() only encoded on a control byte or
leading/trailing blank. Such a value was emitted verbatim, producing
LDIF that strict parsers reject.
Closes#22339
Document observed behavior around connections reuse and socket
callbacks. When CURLOPT_CLOSESOCKETFUNCTION is copied and when it is
invoked.
Closes#20521
Until 8.17.0 the --silent check lived in voutf(), so it covered every
message type that went through it. 56450ce26f moved that check out to
the callers so that errorf() could honour --show-error, and warnf() and
errorf() got the check back, but notef() did not. Since then "Note:"
messages have been printed even with --silent, as long as tracing was
on.
Reported-by: Jace Laquerre
Fixes#22623Closes#22625
Line should already have been removed in 7103a93, but neither
humans nor clankers caught it. tststs...
Prior to this change it appears all reuse of empty cred connection was
blocked for ntlm instead of the intended behavior of allowing
reuse in the limited circumstance when it is the same connection used by
the transfer before.
Closes https://github.com/curl/curl/pull/22629
As documented and as it does for other methods.
Difficult to test since it needs a successful kerberos ticket.
Reported-by: sdgh179 on github
Fixes#22610Closes#22622
Move the two remaining fields into the state struct instead, within the
HTTP ifdef.
Also: make the AWS sigv4 code always rely on the http_host value. It
was previously conditionally trying to also work if it was not set, but
that logic was not creating an identical copy so it would fail.
Closes#22620
When the minimum comes from `CURL_TEST_MIN`, to improve the default
behavior. It may still need manual adjustment in cases.
Follow-up to e669179681#22616
Follow-up to 58cb1e2f1f#22618
Cherry-picked from #22617Closes#22619
Set the default to `CURL_TEST_MIN` if set, first. Then process the
command-line options to override it. Previously, the env took over if
the command-line explicitly tried to set it to zero.
Ref: #22617
Follow-up to 3f1cd809ee#19942Closes#22618
After telemetry data from Mozilla reported the P99 DNS resolution
differences between A and AAAA responses to by 21ms, reduce curl's
resolution delay to 25ms.
What could possibly go wrong?
Closes#22612
Eleven arguments are named one way in the header and another in the
definition. the compiler only checks types so nothing is broken, but the
header is what people read first, and then the name changes under them
in the source:
```
curl_dbg_malloc size -> wantedsize
curl_dbg_calloc n, size -> wanted_elements, wanted_size
curl_dbg_realloc size -> wantedsize
curl_dbg_strdup src -> source
r_freeaddrinfo res -> cahead
my_get_line fp, db -> input, buf
curl_slist_append_ccsid l -> list
curl_version_info_ccsid cid -> ccsid
curl_easy_setopt_ccsid curl -> easy
```
Follow-up to df6014894b#20794Closes#22550
Replace the QUERY filter methods for connect and appconnect time with a
new control CF_CTRL_REPORT_STATS that is triggered when a connect ends
(successful or not).
Filters in the connection can then report their statistics. Socket and
TLS filters do this only once. Subsequent CF_CTRL_REPORT_STATS will do
nothing.
This prevents timers to be reported twice in STARTTLS scenarios.
Fixes#22587 (again)
Closes#22596
