To remove a build difference between mingw-w64 and MSVC builds (where
mingw-w64 has it, while MSVC does not). Also to simplify and save the
cost of detection/verification in CI.
`gettimeofday()` was used in `curl_threads.c` in codepath practically
unreachable in Windows builds, and in `tool_writeout.c` that falls back
to `time()` for targets without it.
Ref: #22593Closes#22594
`opendir()` was used previously with mingw-w64 for `file://` directory
listing support. This was replaced by a native Win32 solution on all
Windows platforms, leaving `opendir()` no longer used. Drop related
feature detections.
Follow-up to c7c42afab9#22577Closes#22588
- drop redundant casts for `CURL_UNCONST()` pointers (Windows).
- GHA/linux: delete redundant/dupe `-g` C flag in memory sanitizer job.
Spotted-by: Daniel Stenberg
- examples/http2-upload: drop local macro.
- examples/http2-upload: drop leading underscore from union name.
- examples/http2-upload: drop interim macro.
- tests/server/util: reapply patch lost in a rebase.
- sync `main()` declarations across the codebase.
Closes#22559
`pccritic` is available on the latest macOS runner revision (not every
job runs get it yet), Cygwin, MSYS2/mingw-w64 (one job, others will
follow on the next msys2/setup-msys2 Action bump). It will be
automatically used on BSDs, once they start offering it. Missing from
Linux jobs.
Also:
- GHA/windows: convert `libcurl.pc` to Unix newlines to bump score
96 to 100 in mingw-w64 jobs.
CMake-specific fix pending in: #22556
- GHA: verify with minimum `pccritic` score 94 to 100 (depending on CI
job).
- build: fill `Maintainer:` `libcurl.pc` property when run curl CI.
Issues remaining:
macOS:
```
[info ] Cflags adds an include path already on the default search path (pkgconf strips it): -I/usr/local/include (cflags/PC031)
[info ] Libs adds a library path already on the default search path (pkgconf strips it): -L/usr/local/lib (libs/PC040)
[minor ] Libs.private contains an unexpected flag: /Applications/Xcode_26.6.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX26.5.sdk/System/Library/Frameworks/GSS.framework (libs/PC041)
```
Windows:
```
[minor ] file uses CRLF line endings (style/PC061)
```
Ref: #22556
Follow-up to b9254da617#22548
Follow-up to 852f5d34da#22553
Follow-up to 4d9ba9fef4#22545
Follow-up to 6c7993d4d9#22536
Follow-up to 3f1c033afe#22519Closes#22543
To keep it tidy and to support properties in the template that only
appear in the generated `libcurl.pc` when filled.
E.g. `Required.private` may remain empty after #22548.
Also:
- GHA/windows: dump `libcurl.pc` to log in every job
- tidy up a pre-existing regex in the updated command.
2c22d3069a#22544
Ref: b9254da617#22548
Cherry-picked from #22543Closes#22553
Before this patch static-only libcurl builds stored the list of module
dependencies in both `Require` and `Require.private`. The new `pccritic`
tool flagged this as an issue. Having (or not) a duplicate in
`Require.private` does not change the output created by `pkgconf` and
`pkg-config`, as tested with both with and without `--static` option.
Thus, fix by deleting the private copy.
Fixing:
```
$ pccritic libcurl.pc
bld/libcurl.pc
score: 63/100 grade: D (0 critical, 0 major, 9 minor, 1 info)
[minor ] 'libssh2' appears in both Requires and Requires.private (requires/PC051)
[minor ] 'libidn2' appears in both Requires and Requires.private (requires/PC051)
[minor ] 'openssl' appears in both Requires and Requires.private (requires/PC051)
[...]
```
Ref: https://github.com/curl/curl/actions/runs/31495008715/job/93790403026#step:10:210 (macOS, CM clang OpenSSL torture)
Ref: https://github.com/curl/curl/actions/runs/31495008825/job/93790433646#step:9:216 (mingw, AM ucrt-x86_64 wolfssl c-ares U)
Follow-up to f057de5a1a#13911
Follow-up to 98e5904165#5373
Cherry-picked from #22543Closes#22548
To prevent creating a curl-development (aka debug-enabled, aka
`-DENABLE_DEBUG=ON`, `--enable-debug` or `DEBUGBUILD`) build without
`assert()`s. Since it may break expectations by missing to catch error
cases. Also to make it less likely to build an inherently insecure
development build by accident.
- in CMake, for non-Multi-Config builds, show this error unless Debug
configuration is set at configure-time:
```
CMake Error at CMakeLists.txt:263 (message):
Debug-enabled (aka development mode) curl requires the Debug configuration
```
Ref: https://github.com/curl/curl/actions/runs/31159065911/job/92805128331?pr=22513#step:6:56
The other 3 predefined configs (`Release`, `RelWithDebInfo`,
`MinSizeRel`) set `NDEBUG` automatically.
- or this message in other cases, e.g. when using CMake Multi-Config
with non-Debug, e.g. `--config Release`, or passed `NDEBUG` manually
with either build tools:
```
curl_setup.h(1062): fatal error C1189: #error:
"Debug-enabled builds cannot be combined with NDEBUG"
```
Ref: https://github.com/curl/curl/actions/runs/31159628749/job/92807878479#step:9:28
Also:
- INSTALL-CMAKE.md: document.
- GHA/windows: adjust CI jobs to meet the above requirement, where
missing.
Reported-by Stefan Eissing
Bug: https://github.com/curl/curl/pull/22484#discussion_r3730045572
Ref: ea98445680#13592Fixes#22481Fixes#22484Closes#22513
- Change --enable-debug help text to say it is for developing curl.
- Warn when --enable-debug is used.
This change copies the help text and warning from cmake ENABLE_DEBUG.
Also, it shortens the "for debugging curl itself" to just say "for
debugging curl".
Now it looks like this:
--enable-debug Enable curl debug features (for developing
curl)
--disable-debug Disable curl debug features
Ref: https://github.com/curl/curl/issues/22481#issuecomment-5207220359
Reported-by: Viktor Szakats
Closes https://github.com/curl/curl/pull/22512
The necessary cryptography API is provided by nettle 3.1+, via its
'hogweed' library. The minimum GnuTLS version required by curl is 3.6.5,
which requires nettle 3.4.1+, so the API is always available.
Also:
- autotools: detect and use nettle's hogweed library.
- cmake/FindNettle: add support for the hogweed library.
- GHA/http3-linux: enable in the autotools/cmake GnuTLS jobs.
Ref: 4353ea025aCloses#22456
Show a warning and force-disable HTTPSIG when the TLS backend is not
OpenSSL or wolfSSL. Before this patch this resulted in a mismatched
feature list in configure and `curl -V`.
Also enable HTTPSIG in more CI jobs to cover unsupported ones, Windows
compilers, clang-tidy, cmake.
Follow-up to a55731050e#22386#21239
Cherry-picked from #22437Closes#22439
- Switch the Windows SSPI identity struct to SEC_WINNT_AUTH_IDENTITY_EX
to use !ntlm in PackageList to prevent NTLM from being offered.
- For GSS filter out NTLMSSP OID, and restrict via gss_set_neg_mechs()
to prevent NTLM from being offered.
- Extend the GSS-API debug stub layer to support the NTLM blocking logic
without a real Kerberos environment.
- Update test 2057 to check that negotiate auth is silently skipped with
no Authorization header when only NTLM stub credentials are available.
- Add SPNEGO NTLM blocking test 2093 which verifies that Kerberos
credentials still succeed when NTLM is blocked within SPNEGO.
- Suppress tests valgrind leak for MIT krb5 gss_display_status, since
the leak is in the library and not in curl.
To suppress the tests valgrind leak, the wildcard '...' bridges over an
anonymous frame inside libgssapi_krb5.so that valgrind reports as '???'.
Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Aided-by: Johannes Schindelin
Closes https://github.com/curl/curl/pull/21315
Closes https://github.com/curl/curl/pull/22410
Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.
New libcurl options:
- CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
- CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
- CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
- CURLOPT_HTTPSIG_HEADERS: space-separated components to sign
New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers
The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.
Verified by test 5000 to 5021
Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes#22386Closes#21239
- CMake/CurlTests.c: sync indent with rest of file and most of code.
- cmake: sync term in `_CURL_PREFILL` description with rest of code.
- curl_setup.h: document function relying on `_CRT_SECURE_NO_WARNINGS`.
- tests/http/scorecard.py: typo in message.
- 'Quiche' -> 'quiche'.
- fix comment and formatting nits.
Closes#22378
Add support for the native GSS Framework on Apple targets, which is
Apple's fork of Heimdal. This option allows to drop Apple's deprecated
MIT Kerberos compatibility shim "mit-krb5/1.7-prerelease".
Source code uses different headers, other than that no source changes
are necessary.
You can enable by configuring with:
autotools: `--enable-gssapi-apple`
CMake: `-DCURL_USE_GSSAPI=ON -DCURL_GSS_FLAVOR=Apple`
These options are experimental, and may receive breaking updates till
the GSS backend selection logic settles, for Apple and also for the GNU
and MIT implementation.
Version string:
```
curl 8.21.0-DEV (aarch64-apple-darwin25.4.0) libcurl/8.21.0-DEV
OpenSSL/3.6.2 zlib/1.2.12 AppleIDN AppleGSS OpenLDAP/2.4.28/Apple
```
Also:
- drop in-source deprecation warning suppressions when using AppleGSS.
- GHA/macos: enable Apple GSS in CI jobs.
Supported by:
iOS 5.0+, iPadOS 5.0+, Mac Catalyst 13.0+, macOS 10.14+, visionOS 1.0+
Ref: https://developer.apple.com/documentation/gss
Ref: #19109Closes#22052
It is traditionally defined by autotools to detect the presence of set
of standard C89 headers. autoconf 2.70 (2020-12-08) reduced the headers
covered to `stdlib.h`, `string.h`. After 2.59d (2006-06-05) obsoleting
it earlier. CMake replicated this detection, and curl included
`curl/stdcheaders.h` if standard headers were missing. However, such
condition could never happen because curl sources already assume all
checked standard headers (`stdarg.h`, `stdlib.h`, `string.h`) and
include them unconditionally.
Since this is an unused feature detection and an impossible fallback
path, drop them from CMake and curl's source. autotools continues to do
the detection by default, but its result is unused after this patch.
This leaves public `curl/stdcheaders.h` unused from within the codebase.
Refs:
f0c7c4255386c213d0e3
Follow-up to 65dae4ad80#22191
Follow-up to 4c5307b456
Ref: ae1912cb0dCloses#22206
- reduce log noise by showing 'Uninstalling' message only if the file
exists. (and a different message otherwise)
- replace cmake `rm` command with `file(REMOVE)`. For efficiency.
Show manual message if the file could not be deleted.
Ref: https://cmake.org/cmake/help/v3.18/command/file.html#remove
Follow-up to 6d008352c6#22193
- reduce log noise by showing 'Uninstalled' only if the deletion was
successful. (and a different message otherwise)
- display `DESTDIR` env value if set.
- drop checking, setting and showing `CMAKE_INSTALL_PREFIX`.
The value was never predefined, also not used, besides showing it,
and showing it is misleading because `--prefix` may override the
configure-time value, and also superfluous because the filenames
are showing the actual prefix anyway.
Follow-up to 27e2a4733cCloses#22201
- INSTALL-CMAKE.md: document that `CMAKE_INSTALL_PREFIX`
may be set as environment (with CMake 3.29+)
Ref: https://cmake.org/cmake/help/v3.29/variable/CMAKE_INSTALL_PREFIX.html
- CurlTests: fix copy-paste typo in comment.
Spotted by GitHub Code Quality
- optimized out `_generated_dir` local variable.
- unfold a `@ONLY` to match rest of code.
Closes#22203
Also repurpose existing build-time feature checks into unit test 1961,
to verify.
Prior to this patch these functions were auto-detected with both
autotools and cmake. In case of autotools there was an extra
verification phase ensuring the functions work as expected. This step
required running the function, thus was limited to non-cross-builds. For
cross-builds and CMake it always used the system implementation if
present. On Windows it always used the local implementation, because
availability/use is complicated there.
After this patch all platforms, always use the local implementation,
which is known to be accurate. This makes curl behave more consistently,
and simplifies the build process, a fixes cross-builds and CMake
auto-detection differences.
Also:
- test1960: enable unconditionally.
- checksrc: disallow globally, allowlist in `block_ip.c` example.
- dnsd: verify ntop result for NULL before passing to printf.
Ref: https://github.com/curl/curl/pull/22137#issuecomment-4797440983
Ref: #22137
Ref: 8537a5b0bc#16577Closes#22170
- drop `generated` subdir, move these files to build root.
To move them next to CPack and other config files, and to avoid
a subdirectory for only 2 files.
Follow-up to 69328490fc#2849
- add 'Consumed variables' comment for `CMake/cmake_uninstall.in.cmake`.
- move generated `cmake_uninstall.cmake` to the build root directory
(from `CMake/`). To:
- avoid creating a `CMake` subdirectory within the build directory
with this single file in it.
- move it next to its `cmake_install.cmake` counterpart.
- move it next to `install_manifest.txt` which it relies on.
Follow-up to 27e2a4733c
- Use `PROJECT_SOURCE_DIR` for these files, replacing
`CMAKE_CURRENT_SOURCE_DIR`, to make it consistent with rest of CMake
sources, and to reduce ambiguity in `CMake/cmake_uninstall.in.cmake`
template.
Follow-up to 8198e388d3#22188
Follow-up to 4839029645#22187
Follow-up to 9126eb5a8a#15331Closes#22192
Use `PROJECT_SOURCE_DIR` for these files, replacing
`CMAKE_CURRENT_SOURCE_DIR`, to make it consistent with rest of CMake
sources and to reflect that the locations of these files are fixed and
do not depend on the CMake source location referencing them.
Exception: keep as-is before calling `project()`, which is where
`PROJECT_SOURCE_DIR` is initialized.
Ref: https://cmake.org/cmake/help/v3.18/command/project.html
Follow-up to #22187
Follow-up to 9126eb5a8a#15331Closes#22188
- GHA/windows: mention `IgnoreStandardErrorWarningFormat=true`
in comment.
- cmake: fix MIT/GNU GSS order in messages.
- drop some exclamation marks from messages.
- drop redundant ending newlines from messages.
- fold/unfold where possible.
- fix indent, whitespace, typos and other nits.
Closes#22185
Aka `HAVE_GETADDRINFO_THREADSAFE`.
- enable it for OpenBSD 5.4+ (2013-11-01).
Also adjust cmake pre-fill.
- explicitly opt-in DragonFly BSD, for 2.2.0+ (2009-02-17).
Assuming this commit implemented this feature:
21fcee4d6e (diff-498ff649e8770eb9a94e99a399a4b473fcea41ef58b033a2a2dae3809e17bb04)
Prior to this patch it was enabled in autotools by accident, because
its host ID misses `bsd` so the global BSD disable was not applied.
- autotools: fix to enable for Darwin 9+ / macOS 10.5+ (2007-10-26).
Prior to this patch it was Darwin 6 / macOS 10.2.
Source: https://github.com/python/cpython/issues/70112
Ref: https://en.wikipedia.org/wiki/MacOS_version_history
10.5 was the first one UNIX '03 certified, which requires this
feature. iOS and others were forked from this codebase, so they also
have support.
- cmake: add version numbers as comments.
Sadly the OS versions are not verified. This and the autotools logic
could possibly be implemented in `curl-setup.h` more accurately, for
all build systems, without duplicating logic.
Also:
- cmake: `BSD` variable requires CMake 3.25+, add fallback code where
missing.
Ref: https://cmake.org/cmake/help/v3.25/variable/BSD.html
- unix-cache.cmake: stop listing all BSDs for `HAVE_PIPE2`,
and fix generic BSD filter for CMake <3.25.
- unix-cache.cmake: stop listing all BSDs, since it's prefilled anyway
for those via `OtherTests.cmake`.
Ref: https://github.com/curl/curl/pull/22138#issuecomment-4773617195Closes#22148
- fix property name in comment.
- rename `INTERFACE_CURL_GSS_FLAVOUR` ->
`INTERFACE_CURL_GSS_FLAVOR` to match preferred usage.
Follow-up to 8aeefd0b35 (subcommit)
Follow-up to 16f073ef49#16973Closes#22013
Fix build issues:
- src: adjust `toolx_ftruncate()`.
- libtests/cli_ftp_upload: make `struct timeval` initialization portable.
- libtests/lib1960: do unconst in local `inet_pton()` macro.
- tests/server/dnsd: make it stub instead of failing the build.
- tests/server: make them link AmiSSL for `SocketBase`.
Also:
- bump AmiSSL to the latest release.
- add download hash checks and toolchain cache.
- sync restored code with local updates made since last year.
It takes 30 seconds per job, 1 minute in total.
Thanks-to: Bebbo
Thanks-to: Darren Banfi
Ref: https://github.com/curl/curl/pull/21989#issuecomment-4691380623
Follow-up to 7a14898264#17486Closes#21993
- drop more uses of the word "just". (not enforced here)
- drop some uses of the "will" word.
- "then" -> "than".
- tests/http/testenv/curl.py: fix copy-paste typo in error message.
- pytest: replace `shutdownh` with `shutdown` in test names.
Spotted by GitHub Code Quality.
- comment typos.
- whitespace and newlines fixes.
Closes#21830
This patch adds two major proxy capabilities to curl (ngtcp2 QUIC):
- HTTP/3 Proxy CONNECT: Tunnel HTTP/1.1 or HTTP/2 traffic through an
HTTPS proxy that speaks HTTP/3 (QUIC) using the standard CONNECT
method over an HTTP/3 connection.
- MASQUE CONNECT-UDP: Tunnel HTTP/3 (QUIC) traffic through an HTTP
proxy (speaking HTTP/1.1, HTTP/2, or HTTP/3) using the extended
CONNECT method with the CONNECT-UDP protocol (RFC9297 & RFC9298).
Public API additions:
- `CURLPROXY_HTTPS3`: new proxy type constant for HTTP/3 proxy
- `--proxy-http3`: new CLI flag to negotiate HTTP/3 with HTTPS proxy
The implementation adds two new filters:
- `H3-PROXY` - enables negotiating HTTP/3 (QUIC) to the proxy and
running CONNECT/CONNECT-UDP through that proxy transport.
- `CAPSULE` - dedicated filter inserted between QUIC transport and
HTTP-PROXY to handle datagram capsule encapsulation/decapsulation.
Here is how the curl filter chaining looks in different scenarios:
- HTTP/3 Proxy CONNECT (tunneling TCP protocols over QUIC proxy):
conn -> HTTP/1.1 or HTTP/2 -> SSL -> HTTP-PROXY ->
H3-PROXY -> HAPPY-EYEBALLS -> UDP
- MASQUE CONNECT-UDP (tunneling QUIC over any proxy):
conn -> HTTP/3 -> CAPSULE -> HTTP-PROXY -> H3-PROXY ->
HAPPY-EYEBALLS -> UDP
conn -> HTTP/3 -> CAPSULE -> HTTP-PROXY -> H1-PROXY or H2-PROXY ->
SSL -> HAPPY-EYEBALLS -> TCP
- Both features currently require the ngtcp2 QUIC backend.
- Both features are experimental (disabled by default). Enable with
`--enable-proxy-http3`(autotools) or `-DUSE_PROXY_HTTP3=ON`(CMake).
Tests:
- tests/unit/unit3400.c: Unit tests for capsule protocol encode/decode
- tests/http/test_60_h3_proxy.py: Comprehensive pytest integration suite
- tests/http/testenv/h2o.py: Managing h2o instances with HTTP/1.1, HTTP/2,
and HTTP/3 (QUIC) listeners, proxy.connect and proxy.connect-udp enabled.
References:
RFC 9297 - HTTP Datagrams and the Capsule Protocol
RFC 9298 - Proxying UDP in HTTP
RFC 9000 §16 — Variable-Length Integer Encoding
Signed-off-by: Aritra Basu <aritrbas+gh@cisco.com>
Closes#21153
In both autotools and cmake builds, because Android does not offer
a `zlib.pc`.
Also:
- GHA/non-native: dump config files, to verify.
Reported-by: sfan5 on github
Fixes#21647Closes#21648
Exporting the component name as passed in is somewhat boring. OTOH it is
convenient for reuse.
- FindNGTCP2: export crypto backend in `NGTCP2_CRYPTO_BACKEND`.
- pass `COMPONENTS` `NGTCP2_CRYPTO_BACKEND` in `curl-config.cmake`.
- FindNGTCP2: fix to skip Config detection when optional `COMPONENTS` is
not passed.
Co-authored-by: Viktor Szakats
Reported-by: x-xiang on github
Fixes#21523
Follow-up to 8fce3e17e6#20814Closes#21540
To avoid (mis-)detecting it via the internal Apple library
`/usr/lib/system/libsystem_sim_kernel.dylib` when targeting iPhone
Simulator (seen with iPhoneSimulator26.4.sdk).
Reported-by: Ian Spence
Fixes#21236Closes#21271
Pass build options directly via `COMPILE_DEFINTIONS` and
`LINK_LIBRARIES`, instead of "tunneling" them through `CMAKE_FLAGS`.
The latter method breaks when passing `Threads::Threads` as library via
`CMAKE_REQUIRED_LIBRARIES`, while also being complex and fragile.
Example:
```
-- Performing Test HAVE_FSETXATTR_5
CMake Error at bld/CMakeFiles/CMakeTmp/CMakeLists.txt:27 (target_link_libraries):
Target "cmTC_3386e" links to:
Threads::Threads
but the target was not found. Possible reasons include:
* There is a typo in the target name.
* A find_package call is missing for an IMPORTED target.
* An ALIAS target is missing.
CMake Error at CMake/Macros.cmake:51 (try_compile):
Failed to generate test project build system.
Call Stack (most recent call first):
CMakeLists.txt:1684 (curl_internal_test)
```
Ref: https://github.com/curl/curl/actions/runs/23792043930/job/69329796592?pr=21168#step:38:318
Note: a side-effect is no longer passing C compiler flags (e.g.
`CMAKE_REQUIRED_FLAGS`) to the _linker_. This should not be an issue,
though CMake is passing them during its built-in detections.
Ref: https://cmake.org/cmake/help/v3.18/command/try_compile.htmlCloses#21176
Seen on macOS:
```
CMake Warning at CMakeLists.txt:2158 (message):
Bad lib in library list: Threads::Threads
```
Follow-up to 2d546d239e#21163Closes#21170
