libcurl: update to 8.0.1

1 files changed, 1592 insertions, 1900 deletions

diff --git a/libs/libcurl/docs/CHANGES b/libs/libcurl/docs/CHANGES
index 4a84f08c70..a9e2dcf620 100644
--- a/libs/libcurl/docs/CHANGES
+++ b/libs/libcurl/docs/CHANGES
@@ -6,6 +6,1598 @@
 

                                   Changelog

 

+Version 8.0.1 (20 Mar 2023)

+

+Daniel Stenberg (20 Mar 2023)

+

+- RELEASE-NOTES: synced

+

+  curl 8.0.1

+

+- Revert "multi: remove PENDING + MSGSENT handles from the main linked list"

+

+  This reverts commit f6d6f3ce01e377932f1ce7c24ee34d45a36950b8.

+

+  The commits caused issues in the 8.0.0 release. Needs a retake.

+

+  Reported-by: Kamil Dudka

+  Closes #10795

+

+- include/curl/curlver.h: bump to 8.0.1

+

+Version 8.0.0 (20 Mar 2023)

+

+Daniel Stenberg (20 Mar 2023)

+

+- RELEASE-NOTES: synced

+

+  The curl 8.0.0 release

+

+- THANKS: from the 8.0.0 release

+

+- scripts/delta: fix "ambiguous argument" when used in branches

+

+- SECURITY-PROCESS.md: Busy-loops are not security problems

+

+  Closes #10790

+

+Stefan Eissing (17 Mar 2023)

+

+- tests/http: do not save files for downloads in scorecard testing

+

+  Closes #10788

+

+Daniel Stenberg (17 Mar 2023)

+

+- cf-socket: use port 80 when resolving name for local bind

+

+  It turns out c-ares returns an error when asked to resolve a host name with

+  ares_getaddrinfo using port number 0.

+

+  Reported as a c-ares bug here: https://github.com/c-ares/c-ares/issues/517

+

+  The work-around is to simply use port 80 instead, as the number typically doe

+  s

+  not make a difference and a non-zero number works for c-ares.

+

+  Fixes #10759

+  Reported-by: Matt Jolly

+  Closes #10789

+

+- curl.h: require gcc 12.1 for the deprecation magic

+

+  Reported-by: kchow-FTNT on github

+  Fixes #10726

+  Closes #10784

+

+- Revert "rtsp: use dynbuf instead of custom reallocs"

+

+  This reverts commit 1b9ea3239d22147e00d8 because of OSS-fuzz reports.

+  I'll do another take after the pending release.

+

+  Closes #10785

+

+- test422: verify --next used without a prior URL

+

+  Closes #10782

+

+- tool_getparam: error if --next is used without a prior URL

+

+  Reported-by: 積丹尼 Dan Jacobson

+  Ref: https://github.com/curl/curl/pull/10769#discussion_r1137895629

+

+  Closes #10782

+

+- libssh: use dynbuf instead of realloc

+

+  When building lines to show for SFTP directory listings.

+

+  Closes #10778

+

+- lib2305: deal with CURLE_AGAIN

+

+  The test does a slightly ugly busy-loop for this case but should be

+  managable due to it likely being a very short moment.

+

+  Mention CURLE_AGAIN in curl_ws_recv.3

+

+  Fixes #10760

+  Reported-by: Jay Satiro

+  Closes #10781

+

+- rtsp: use dynbuf instead of custom reallocs

+

+  For the RTP buffering.

+

+  Closes #10776

+

+- libssh2: remove unused variable from libssh2's struct

+

+  Closes #10777

+

+- RELEASE-NOTES: synced

+

+- multi: remove PENDING + MSGSENT handles from the main linked list

+

+  As they are not driving transfers or any socket activity, the main loop

+  does not need to iterate over these handles. A performance improvement.

+

+  They are instead only held in their own separate lists.

+

+  Assisted-by: Stefan Eissing

+  Ref: #10743

+  Closes #10762

+

+- multi: turn link/unlinking easy handles into dedicated functions

+

+- http_aws_sigv4: fix scan-build "value stored to 'ret' is never read"

+

+  Follow-up to 495d09810aa9a

+

+  Closes #10766

+

+- lib: skip Curl_llist_destroy calls

+

+  Linked lists themselves do not carry any allocations, so for the lists

+  that do not have have a set destructor we can just skip the

+  Curl_llist_destroy() call and save CPU time.

+

+  Closes #10764

+

+- lib643: LIB644 is never defined, this is dead code

+

+  Closes #10765

+

+- libtest/Makefile.inc: remove superfluous variables

+

+  Rely on the defaults when possible.

+

+  Closes #10765

+

+- tests/http: remove year ranges from copyrights

+

+  Closes #10763

+

+Casey Bodley (14 Mar 2023)

+

+- aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3

+

+  all s3 requests default to UNSIGNED-PAYLOAD and add the required

+  x-amz-content-sha256 header. this allows CURLAUTH_AWS_SIGV4 to correctly

+  sign s3 requests to amazon with no additional configuration

+

+  Signed-off-by: Casey Bodley <cbodley@redhat.com>

+

+  Closes #9995

+

+Viktor Szakats (14 Mar 2023)

+

+- wolfssl: add quic/ngtcp2 detection in cmake, and fix builds

+

+  - add QUIC/ngtcp2 detection in CMake with wolfSSL.

+

+    Because wolfSSL uses zlib if available, move compression detection

+    before TLS detection. (OpenSSL might also need this in the future.)

+

+  - wolfSSL 5.5.0 started using C99 types in its `quic.h` header, but it

+    doesn't #include the necessary C99 header itself, breaking builds

+    (unless another dependency pulled it by chance.) Add local workaround

+    for it. For this to work with all build tools, we had to fix our

+    header detection first. Ref: #10745

+

+    Ref: https://github.com/curl/curl-for-win/commit/6ad5f6ecc15620c15625fc4434

+  76b3a1ecef4f3f

+

+  Closes #10739

+

+Stefan Eissing (14 Mar 2023)

+

+- secure-transport: fix recv return code handling

+

+  Return code handling of recv calls were not always correct when an error

+  occured or the connection was closed.

+

+  Closes #10717

+

+- http2: Use KEEP_SEND_HOLD for flow control in HTTP/2

+

+  - use the defined, but so far not used, KEEP_SEND_HOLD bit for flow

+    control based suspend of sending in transfers.

+

+  Prior to this change KEEP_SEND_PAUSE bit was used instead, but that can

+  interfere with pausing streams from the user side via curl_easy_pause.

+

+  Fixes https://github.com/curl/curl/issues/10751

+  Closes https://github.com/curl/curl/pull/10753

+

+Dan Fandrich (13 Mar 2023)

+

+- tests: fix control code that hid some text in runtests.1

+

+- tests: sync option lists in runtests.pl & its man page

+

+Daniel Stenberg (13 Mar 2023)

+

+- multi: make multi_perform ignore/unignore signals less often

+

+  For improved performance

+

+  Reported-by: Jerome St-Louis

+  Ref: #10743

+  Closes #10750

+

+Viktor Szakats (13 Mar 2023)

+

+- cmake: delete unused HAVE__STRTOI64

+

+  Also delete obsolete surrounding comments.

+

+  Reviewed-by: Daniel Stenberg

+  Closes #10756

+

+- CI: fix copyright header

+

+  Follow-up to 395b9175b7422d699fa93643973295c106cdf147

+

+Daniel Stenberg (13 Mar 2023)

+

+- RELEASE-PROCEDURE.md: update coming release dates

+

+Stefan Eissing (13 Mar 2023)

+

+- tests/http: add pytest to GHA and improve tests

+

+  - added to: ngtcp2-quictls, ngtcp2-gnutls and the linux varians

+    quiche, bearssl, libressl, mbedtls, openssl3, rustls

+  - added disabled in ngtcp2-wolfssl due to weird SSL_connect() errors

+    not reproducable locally

+

+  Improvements on pytest:

+

+  -  handling of systems with nghttpx in $PATH

+     - configure will seach $PATH got nghttpx used in pytest

+     - pytest fixes for managing nghttpx without h3 support

+     - ngtcp2-wolfssl: use a fully enabled wolfssl build

+

+  - lower parallel count for http/1.1 tests, since we do not

+     want to test excessive connections.

+  - check built curl for HTTPS-proxy support in proxy tests

+  - bearssl does not like one of our critical cert extensions, making

+    it non-critical now

+  - bearssl is too slow for test_12, skipping

+  - making sure we do h3 tests only when curl and server support is there

+

+  Closes #10699

+

+Marcel Raad (13 Mar 2023)

+

+- tool_operate: silence unused parameter warning

+

+  `global` is only used in the `my_setopt` macro version without

+  `CURL_DISABLE_LIBCURL_OPTION` since commit 4774decf10a.

+

+  Closes https://github.com/curl/curl/pull/10752

+

+Viktor Szakats (13 Mar 2023)

+

+- build: fix stdint/inttypes detection with non-autotools

+

+  Fix `stdint.h` and `inttypes.h` detection with non-autotools builds on

+  Windows. (autotools already auto-detected them accurately.)

+

+  `lib/config-win32.h` builds (e.g. `Makefile.mk`):

+  - set `HAVE_STDINT_H` where supported.

+  - set `HAVE_INTTYPES_H` for MinGW.

+

+  CMake:

+  - auto-detect them on Windows. (They were both force-disabled.)

+  - delete unused `CURL_PULL_STDINT_H`.

+  - delete unused `CURL_PULL_INTTYPES_H`.

+  - stop detecting `HAVE_STDINT_H` twice.

+    Present since the initial CMake commit: 4c5307b45655ba75ab066564afdc0c111a8

+  b9291

+

+  curl doesn't use these C99 headers, we need them now to workaround

+  broken wolfSSL builds. Ref: #10739

+

+  Once that clears up, we can delete these detections and macros (unless

+  we want to keep them for future us.)

+

+  Reviewed-by: Daniel Stenberg

+  Closes #10745

+

+Daniel Stenberg (13 Mar 2023)

+

+- RELEASE-NOTES: synced

+

+- ftp: add more conditions for connection reuse

+

+  Reported-by: Harry Sintonen

+  Closes #10730

+

+Dan Fandrich (12 Mar 2023)

+

+- tests: make first.c the same for both lib tests and unit tests

+

+  The only difference used to be global variable used in unittest tests.

+  After cb7ed5a removed individual flag overrides for the unittests, first.c

+  was no longer recompiled for unit tests to include the flag, so whether it

+  worked or gave a link error depended on whether it was compiled in

+  libtest or unittest first. This way also speeds up the build by

+  eliminating 40 identical compile invocations.

+

+  Fixes #10749

+

+- tests: use AM_CPPFILES to modify flags in unit tests

+

+  Using CPPFLAGS sometimes caused odd compile issues when building tests

+  with parallel make and AM_CPPFILES is the right flag, anyway.

+

+  Follow-up to cb7ed5a

+

+  Ref #10749

+

+Viktor Szakats (13 Mar 2023)

+

+- Makefile.mk: fix -g option in debug mode [ci skip]

+

+  Add it to `CFLAGS` (was: `LDFLAGS`).

+

+  Closes #10747

+

+Jay Satiro (12 Mar 2023)

+

+- tool: improve --stderr handling

+

+  - freopen stderr with the user-specified file (--stderr file) instead of

+    using a separate 'errors' stream.

+

+  - In tool_setup.h override stdio.h's stderr macro as global variable

+    tool_stderr.

+

+  Both freopen and overriding the stderr macro are necessary because if

+  the user-specified filename is "-" then stdout is assigned to

+  tool_stderr and no freopen takes place. See the PR for more information.

+

+  Ref: https://github.com/curl/curl/issues/10491

+

+  Closes https://github.com/curl/curl/pull/10673

+

+Dan Fandrich (11 Mar 2023)

+

+- CI: don't run CI jobs if only another CI was changed

+

+  Also skip builds on non-Windows platforms when only Windows build files

+  have changed.

+

+  This should reduce the number of useless builds and the associated

+  waiting time and chance of spurious failures, freeing resources for

+  new PRs.

+

+  Closes #10742

+

+- http: don't send 100-continue for short PUT requests

+

+  This is already how curl is documented to behave in Everything curl, but

+  in actuality only short POSTs skip this. This should knock 30 seconds

+  off a full run of the test suite since the 100-continue timeout will no

+  longer be hit.

+

+  Closes #10740

+

+- tests: add DELAY keyword to more tests using waits

+

+- tests: hack to build most unit tests under cmake

+

+  These are only built when a libcurl static library is available, since

+  we're not building a special libcurlu library yet and these tests rely

+  on private symbols that aren't available in the shared library. A few

+  unit tests do require libcurlu, so those are not built.

+

+  Closes #10722

+

+- tests: fix MSVC unreachable code warnings in unit tests

+

+  Switch unit1654 to use the proper test macros as well.

+

+- tests: make CPPFLAGS common to all unit tests

+

+  There's no need to specify them individually.

+

+- tests: keep cmake unit tests names in sync

+

+  Put only the test names into Makefile.inc so they can be used by both

+  cmake and automake. This will prevent the list of tests from becoming

+  out of date when they are also built under cmake.

+

+Viktor Szakats (11 Mar 2023)

+

+- src: silence wmain() warning for all build methods

+

+  llvm/clang and gcc doesn't recognize the wmain() function in Unicode

+  Windows builds:

+

+  llvm/clang:

+  ```

+  ../../src/tool_main.c:239:5: warning: no previous prototype for function 'wma

+  in' [-Wmissing-prototypes]

+  int wmain(int argc, wchar_t *argv[])

+      ^

+  1 warning generated.

+  ```

+

+  gcc:

+  ```

+  ../../src/tool_main.c:239:5: warning: no previous prototype for 'wmain' [-Wmi

+  ssing-prototypes]

+    239 | int wmain(int argc, wchar_t *argv[])

+        |     ^~~~~

+  ```

+

+  Before this patch, we already silenced it with CMake. This patch moves

+  the silencing to the source, so that it applies to all build tools.

+

+  Bug: https://github.com/curl/curl/issues/7229#issuecomment-1464806651

+

+  Reviewed-by: Marcel Raad

+  Closes #10744

+

+Dan Fandrich (10 Mar 2023)

+

+- CI: fix retrying on brew failures

+

+  The previous attempt didn't consider that the shell would exit

+  immediately after the false statement in the retry case.

+

+  Follow-up to dc141a37

+

+Stefan Eissing (10 Mar 2023)

+

+- http2: fix error handling during parallel operations

+

+  RST and connection close were not handled correctly during parallel

+  transfers, leading to aborted response bodies being reported complete.

+

+  Closes #10715

+

+Daniel Stenberg (10 Mar 2023)

+

+- url: only reuse connections with same GSS delegation

+

+  Reported-by: Harry Sintonen

+  Closes #10731

+

+Viktor Szakats (10 Mar 2023)

+

+- lib: silence clang/gcc -Wvla warnings in brotli headers

+

+  brotli v1.0.0 throughout current latest v1.0.9 and latest master [1]

+  trigger this warning.

+

+  It happened with CMake and GNU Make. autotools builds avoid it with

+  the `convert -I options to -isystem` macro.

+

+  llvm/clang:

+  ```

+  In file included from ./curl/lib/content_encoding.c:36:

+  ./brotli/x64-ucrt/usr/include/brotli/decode.h:204:34: warning: variable lengt

+  h array used [-Wvla]

+      const uint8_t encoded_buffer[BROTLI_ARRAY_PARAM(encoded_size)],

+                                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+  ./brotli/x64-ucrt/usr/include/brotli/port.h:253:34: note: expanded from macro

+   'BROTLI_ARRAY_PARAM'

+                                   ^~~~~~

+  In file included from ./curl/lib/content_encoding.c:36:

+  ./brotli/x64-ucrt/usr/include/brotli/decode.h:206:48: warning: variable lengt

+  h array used [-Wvla]

+      uint8_t decoded_buffer[BROTLI_ARRAY_PARAM(*decoded_size)]);

+                             ~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~

+  ./brotli/x64-ucrt/usr/include/brotli/port.h:253:35: note: expanded from macro

+   'BROTLI_ARRAY_PARAM'

+                                   ~^~~~~

+  ```

+

+  gcc:

+  ```

+  In file included from ./curl/lib/content_encoding.c:36:

+  ./brotli/x64-ucrt/usr/include/brotli/decode.h:204:5: warning: ISO C90 forbids

+   variable length array 'encoded_buffer' [-Wvla]

+    204 |     const uint8_t encoded_buffer[BROTLI_ARRAY_PARAM(encoded_size)],

+        |     ^~~~~

+  ./brotli/x64-ucrt/usr/include/brotli/decode.h:206:5: warning: ISO C90 forbids

+   variable length array 'decoded_buffer' [-Wvla]

+    206 |     uint8_t decoded_buffer[BROTLI_ARRAY_PARAM(*decoded_size)]);

+        |     ^~~~~~~

+  ```

+

+  [1] https://github.com/google/brotli/commit/ed1995b6bda19244070ab5d331111f16f

+  67c8054

+

+  Reviewed-by: Daniel Stenberg

+  Reviewed-by: Marcel Raad

+  Closes #10738

+

+Daniel Stenberg (10 Mar 2023)

+

+- curl_path: create the new path with dynbuf

+

+  Closes #10729

+

+- url: remove dummy protocol handler

+

+  Just two added checks were needed saves a whole handler struct.

+

+  Closes #10727

+

+Dan Fandrich (10 Mar 2023)

+

+- CI: retry a failed brew update too, not just brew install

+

+  Also, make sure an eventual failure ends up returning a failure code so

+  the job stops.

+

+Daniel Stenberg (10 Mar 2023)

+

+- url: fix the SSH connection reuse check

+

+  Reported-by: Harry Sintonen

+  Closes #10735

+

+- CURLOPT_PROXY.3: curl+NSS does not handle HTTPS over unix domain socket

+

+  It results in error "NSS error -5985 (PR_ADDRESS_NOT_SUPPORTED_ERROR)"

+

+  Disabled test 1470 for NSS builds and documented the restriction.

+

+  Reported-by: Dan Fandrich

+  Fixes #10723

+  Closes #10734

+

+- CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe

+

+  Reported-by: Hiroki Kurosawa

+  Closes #10732

+

+- telnet: only accept option arguments in ascii

+

+  To avoid embedded telnet negotiation commands etc.

+

+  Reported-by: Harry Sintonen

+  Closes #10728

+

+- test1903: test use of COOKIEFILE - reset - COOKIEFILE

+

+  This also tests for the memory leak bug fixed by parent commit b559ef6f.

+

+  Ref: #10694

+

+  Closes https://github.com/curl/curl/pull/10712

+

+Jay Satiro (10 Mar 2023)

+

+- url: fix cookielist memleak when curl_easy_reset

+

+  - Free set.cookelist in Curl_freeset instead of Curl_close.

+

+  Prior to this change the cookielist linked list wasn't freed by

+  curl_easy_reset which calls Curl_freeset to free all set.

+

+  Bug: https://github.com/curl/curl/issues/10694#issuecomment-1458619157

+  Reported-by: Sergey Ryabinin

+

+  Closes https://github.com/curl/curl/pull/10709

+

+Dan Fandrich (10 Mar 2023)

+

+- tests: fix some keywords and unused sections

+

+- tests: fix test1301 to call the right binary

+

+  It was refactored in commit 480ac6e5 but this step was missed.

+

+- tests: add timeout, SLOWDOWN and DELAY keywords to tests

+

+  These are tests that are testing timing and end up being quite slow.

+

+Daniel Stenberg (10 Mar 2023)

+

+- RELEASE-NOTES: synced

+

+Stefan Eissing (10 Mar 2023)

+

+- wolfSSL: ressurect the BIO `io_result`

+

+  In pytest'ing the situation occored that wolfSSL reported an

+  IO error when the underlying BIO operation was returning an

+  CURLE_AGAIN condition.

+

+  Readding the `io_result` filter context member to detect such

+  situations.

+

+  Also, making sure that the returned CURLcode is initialized

+  on all recv operations outcome.

+

+  Closes #10716

+

+- gssapi: align global `gss_OID_desc` vars to silence ld warnings on macOS vent

+  ura

+

+  Refs #9975 which first reported this.

+

+  Closes #10718

+

+Daniel Stenberg (10 Mar 2023)

+

+- libssh2: only set the memory callbacks when debugging

+

+  This makes us debug libssh2 less and libcurl more when for example

+  running torture tests that otherwise will spend a lot of time in libssh2

+  functions.

+

+  We leave libssh2 to test libssh2.

+

+  Closes #10721

+

+- docs/SECURITY-PROCESS.md: updates

+

+  - allow Low+Medium issues to be managed through plain PRs

+  - update the bug-bounty part to reflect current reality

+

+  Closes #10719

+

+Dan Fandrich (9 Mar 2023)

+

+- tests: fix tag markup issues in some tests

+

+Marcel Raad (9 Mar 2023)

+

+- tests: add `cookies` features

+

+  These tests don't work with `--disable-cookies`.

+

+  Closes https://github.com/curl/curl/pull/10713

+

+- test420: add cookies keyword

+

+  It fails with `--disable-cookies`.

+

+  Closes https://github.com/curl/curl/pull/10713

+

+Dan Fandrich (8 Mar 2023)

+

+- CI: Add more labeler match patterns

+

+  Also, add the  CI, tests or libcurl API tags in conjunction with any

+  others that might also apply.

+

+Andy Alt (9 Mar 2023)

+

+- GHA: minor improvements to spellcheck

+

+  Closes #10640

+

+Daniel Stenberg (9 Mar 2023)

+

+- test1671: fix after fix

+

+- test421: -w %{header_json} test with multiple same header names

+

+  To reproduce the issue in #10704

+

+- tool_writeout_json. fix the output for duplicate header names

+

+  Header entries with index != 0 are handled at the index 0 level so they

+  should then be skipped when iterated over.

+

+  Reported-by: Boris Okunskiy

+  Fixes #10704

+  Closes #10707

+

+- headers: make curl_easy_header and nextheader return different buffers

+

+  By letting curl_easy_header() and curl_easy_nextheader() store the

+  header data in their own struct storage when they return a pointer to

+  it, it makes it possible for applications to use them both in a loop.

+  Like the curl tool does.

+

+  Reported-by: Boris Okunskiy

+  Fixes #10704

+  Closes #10707

+

+rcombs (8 Mar 2023)

+

+- urlapi: take const args in _dup and _get functions

+

+  Closes #10708

+

+- urlapi: avoid mutating internals in getter routine

+

+  This was not intended.

+

+  Closes #10708

+

+Daniel Stenberg (8 Mar 2023)

+

+- urlapi: '%' is illegal in host names

+

+  Update test 1560 to verify

+

+  Ref: #10708

+  Closes #10711

+

+- ftp: make the 'ftpauth' a more normal 'char *'-array

+

+  Closes #10703

+

+Evgeny Grin (Karlson2k) (8 Mar 2023)

+

+- doc: fix compiler warning in libcurl.m4

+

+  Current test for curl_free() may produce warnings with strict compiler

+  flags or even with default compiler flags with upcoming versions.

+  These warning could turned into errors by -Werror or similar flags.

+  Such warnings/errors are avoided by this patch.

+

+  Closes #10710

+

+Viktor Szakats (8 Mar 2023)

+

+- misc: fix typos

+

+  Closes #10706

+

+Stefan Eissing (7 Mar 2023)

+

+- ftp: active mode with SSL, add the damn filter

+

+  - since 7.87.0 we lost adding the SSL filter for an active

+    FTP connection that uses SSL. This leads to hangers and timeouts

+    as reported in #10666.

+

+  Reported-by: SandakovMM on github

+  Fixes #10666

+  Closes #10669

+

+Daniel Stenberg (7 Mar 2023)

+

+- docs: extend the URL API descriptions

+

+  Closes #10701

+

+Stefan Eissing (7 Mar 2023)

+

+- url: fix logic in connection reuse to deny reuse on "unclean" connections

+

+  - add parameter to `conn_is_alive()` cfilter method that returns

+    if there is input data waiting on the connection

+  - refrain from re-using connnection from the cache that have

+    input pending

+  - adapt http/2 and http/3 alive checks to digest pending input

+    to check the connection state

+  - remove check_cxn method from openssl as that was just doing

+    what the socket filter now does.

+  - add tests for connection reuse with special server configs

+

+  Closes #10690

+

+Daniel Stenberg (6 Mar 2023)

+

+- x509asn1: use plain %x, not %lx, when the arg is an int

+

+  Pointed out by Coverity.

+

+  Closes #10689

+

+Stefan Eissing (6 Mar 2023)

+

+- http2: fix handling of RST and GOAWAY to recognize partial transfers

+

+  - a reset transfer (HTTP/2 RST) did not always lead to the proper

+    error message on receiving its response, leading to wrong reports

+    of a successful transfer

+  - test_05_02 was able to trigger this condition with increased transfer

+    count. The simulated response errors did not carry a 'Content-Length'

+    so only proper RST handling could detect the abort

+  - When doing such transfers in parallel, a connection could enter the

+    state where

+    a) it had been closed (GOAWAY received)

+    b) the RST had not been "seen" for the transfer yet

+    or c) the GOAWAY announced an error and the last successful

+    stream id was not checked against ongoing transfers

+

+  Closes #10693

+

+- tests: use dynamic ports numbers in pytest suite

+

+  - necessary ports are bound at start of test suite and then

+    given to server fixtures for use.

+  - this make parallel use of pytest (in separate directories),

+    practically safe for use as OS tend to not reuse such port numbers

+    for a while

+

+  Closes #10692

+

+- connect: fix time_connect and time_appconnect timer statistics

+

+  - time_connect was not updated when the overall connection failed,

+    e.g. when SSL verification was unsuccessful, refs #10670

+  - rework gather those values to interrogate involved filters,

+    also from all eyeballing attempts, to report the maximum of

+    those values.

+  - added 3 test cases in test_06 to check reported values on

+    successful, partially failed and totally failed connections.

+

+  Reported-by: Master Inspire

+  Fixes #10670

+  Closes #10671

+

+Daniel Stenberg (6 Mar 2023)

+

+- test1905: update output cookie order

+

+  After the #10685 update

+

+- test420: verify expiring cookies

+

+  Cookies that are loaded fine from a jar but then are expired in headers.

+

+- cookie: don't load cookies again when flushing

+

+  Reported-by: Sergio Mijatovic

+  Fixes #10677

+  Closes #10685

+

+- RELEASE-NOTES: synced

+

+Andy Alt (6 Mar 2023)

+

+- docs: note '--data-urlencode' option

+

+  Closes #10687

+

+Daniel Stenberg (6 Mar 2023)

+

+- DEPRECATE: the original legacy mingw version 1

+

+  Remove completely in September 2023

+

+  Closes #10667

+

+Harry Sintonen (6 Mar 2023)

+

+- rand: use arc4random as fallback when available

+

+  Normally curl uses cryptographically strong random provided by the

+  selected SSL backend. If compiled without SSL support, a naive built-in

+  function was used instead.

+

+  Generally this was okay, but it will result in some downsides for non-

+  SSL builds, such as predictable temporary file names.

+

+  This change ensures that arc4random will be used instead, if available.

+

+  Closes #10672

+

+Grisha Levit (6 Mar 2023)

+

+- tool: dump headers even if file is write-only

+

+  The fixes in #10079 brought a (seemingly unrelated) change of open mode

+  from `wb`/`ab` to `wb+`/`ab+` for the headerfile. This makes it no

+  longer possible to write the header file to e.g. a pipe, like:

+

+      curl -D >(grep ...) file:///dev/null

+

+  Which presently results in `Warning: Failed to open /dev/fd/63`

+

+  See #10079

+  Closes #10675

+

+Jay Satiro (6 Mar 2023)

+

+- tests: fix gnutls-serv check

+

+  - If gnutls-serv doesn't exist then don't try to execute it.

+

+  Follow-up to 2fdc1d81.

+

+  Closes https://github.com/curl/curl/pull/10688

+

+Daniel Stenberg (6 Mar 2023)

+

+- lib1560: fix enumerated type mixed with another type

+

+  Follow-up to c84c0f9aa3bb006

+

+  Closes #10684

+

+Viktor Szakats (5 Mar 2023)

+

+- cmake: fix enabling LDAPS on Windows

+

+  Before this patch, enabling LDAPS required a manual C flag:

+  https://github.com/curl/curl-for-win/blob/c1cfc31cfc04f24f7a4f946564d6f0e1b4d

+  7dd36/curl-cmake.sh#L105

+

+  Fix this and enable LDAPS automatically when using `wldap32` (and

+  when not explicitly disabled). This matches autotools and `Makefile.mk`

+  behavior. Also remove issue from KNOWN_BUGS.

+

+  Add workaround for MSVS 2010 warning triggered by LDAPS now enabled

+  in more CI tests:

+  `ldap.c(360): warning C4306: 'type cast' : conversion from 'int' to 'void *' 

+  of greater size`

+  Ref: https://ci.appveyor.com/project/curlorg/curl/builds/46408284/job/v8mwl9y

+  fbmoeqwlr#L312

+

+  Reported-by: JackBoosY on github

+  Reviewed-by: Jay Satiro

+  Reviewed-by: Marcel Raad

+  Fixes #6284

+  Closes #10674

+

+- Makefile.mk: delete redundant `HAVE_LDAP_SSL` macro [ci skip]

+

+  Since abebb2b8939c6b3e0f951eb2d9ec3729b569aa2c, we set this macro for

+  all Windows `wldap32` builds using `Makefile.mk`.

+

+  For OpenLDAP builds this macro is not enough to enable LDAPS, and

+  OpenLDAP is not an option in `Makefile.mk`. For Novell LDAP it might

+  have helped, but it's also not an option anymore in `Makefile.mk`.

+

+  The future for LDAPS is that we should enable it by default without

+  extra build knobs.

+

+  Reviewed-by: Marcel Raad

+  Closes #10681

+

+- cmake: skip CA-path/bundle auto-detection in cross-builds

+

+  Also remove issue from KNOWN_BUGS.

+

+  Reported-by: Cristian Morales Vega

+  Reviewed-by: Marcel Raad

+  Fixes #6178

+  Closes #10676

+

+Daniel Stenberg (3 Mar 2023)

+

+- schannel: loop over the algos to pick the selected one

+

+  Avoid using the funny macro and the extra buffer copy.

+

+  Closes #10647

+

+- wildcard: remove files and move functions into ftplistparser.c

+

+- ftp: allocate the wildcard struct on demand

+

+  The feature is rarely used so this frees up data for the vast majority

+  of easy handles that don't use it.

+

+  Rename "protdata" to "ftpwc" since it is always an FTP wildcard struct

+  pointer. Made the state struct field an unsigned char to save space.

+

+  Closes #10639

+

+- lib1560: test parsing URLs with ridiculously large fields

+

+  In the order of 120K.

+

+  Closes #10665

+

+Brad Spencer (3 Mar 2023)

+

+- urlapi: parse IPv6 literals without ENABLE_IPV6

+

+  This makes the URL parser API stable and working the same way

+  independently of libcurl supporting IPv6 transfers or not.

+

+  Closes #10660

+

+Jan Engelhardt (3 Mar 2023)

+

+- build: drop the use of XC_AMEND_DISTCLEAN

+

+  Because automake used to delete depdirs at once (.deps) and there was an issu

+  e

+  with portability, curl's XC_AMEND_DISTCLEAN greps the Makefiles in an attempt

+  to build a list of all depfiles and delete them individually instead.

+

+  Since commit 08849db866b44510f6b8fd49e313c91a43a3dfd3, automake switched from

+  deleting directories to individual files. curl's custom logic now finds a lot

+  more results with the grep (the filtering of these results isn't great), whic

+  h

+  causes a massive bloating of the Makefile in the order of O(n^2).

+

+  Also remove now-unused XC_AMEND_DISTCLEAN macro group

+

+  References: https://github.com/curl/curl/issues/9843

+  References: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=59288

+

+  Reported-by: Ilmari Lauhakangas

+  Fixes #9843

+  Closes #10661

+

+Balakrishnan Balasubramanian (3 Mar 2023)

+

+- test1470: test socks proxy using unix sockets and connect to https

+

+  Similar to test1468 except using https instead of http

+

+  Closes #10662

+

+Daniel Stenberg (3 Mar 2023)

+

+- test1960: verify CURL_SOCKOPT_ALREADY_CONNECTED

+

+  When returned from the CURLOPT_SOCKOPTFUNCTION, like when we have a

+  custom socket connected in the app, passed in to libcurl.

+

+  Verifies the fix in #10648

+

+  Closes #10651

+

+Stefan Eissing (2 Mar 2023)

+

+- tests: rename tests/tests-httpd to tests/http

+

+   - httpd is only one server we test with

+   - the suite coveres the HTTP protocol in general where

+     the default test cases need a more beefy environment

+

+  Closes #10654

+

+- socket: detect "dead" connections better, e.g. not fit for reuse

+

+  - refs #10646 where reuse was attempted on closed connections in the

+    cache, leading to an exhaustion of retries on a transfer

+  - the mistake was that poll events like POLLHUP, POLLERR, etc

+    were regarded as "not dead".

+  - change cf-socket filter check to regard such events as inidication

+    of corpsiness.

+  - vtls filter checks: fixed interpretation of backend check result

+    when inconclusive to interrogate status further down the filter

+    chain.

+

+  Reported-by: SendSonS on github

+  Fixes #10646

+  Closes #10652

+

+- lib: give source files cf-http.* better fitting names

+

+  Closes #10656

+

+- http2: fix code indent

+

+  Closes https://github.com/curl/curl/pull/10655

+

+Shankar Jadhavar (1 Mar 2023)

+

+- cf-socket: if socket is already connected, return CURLE_OK

+

+  In 7.87.0, if callback method for CURLOPT_SOCKOPTFUNCTION returns

+  CURL_SOCKOPT_ALREADY_CONNECTED then curl library used to return

+  CURLE_OK.  n 7.88.0, now even if callback returns

+  CURL_SOCKOPT_ALREADY_CONNECTED, curl library still tries to connect to

+  socket by invoking method do_connect().

+

+  This is regression caused by commit

+  https://github.com/curl/curl/commit/71b7e0161032927cdfb

+

+  Fix: Check if we are already connected and return CURLE_OK.

+

+  Fixes #10626

+  Closes #10648

+

+Jay Satiro (1 Mar 2023)

+

+- DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure

+

+  This is the existing behavior and it has been widely assumed in the

+  codebase.

+

+  Closes https://github.com/curl/curl/pull/10645

+

+Stefan Eissing (1 Mar 2023)

+

+- http2: fix upload busy loop

+

+  - Set KEEP_SEND_PAUSE when exhausting remote HTTP/2 window size of a

+    stream.

+

+  - Clear KEEP_SEND_PAUSE when receiving HTTP/2 window updates on a paused

+    stream.

+

+  - Also fix http2 send compiler warnings reported in #10449.

+

+  Prior to this change, starting in 71b7e016 which precedes 7.88.0,

+  libcurl may eat CPU during HTTP/2 upload.

+

+  Reported-by: Jay Satiro

+

+  Fixes https://github.com/curl/curl/issues/10449

+  Fixes https://github.com/curl/curl/issues/10618

+  Closes https://github.com/curl/curl/pull/10627

+

+Daniel Stenberg (1 Mar 2023)

+

+- sectransp: make read_cert() use a dynbuf when loading

+

+  Closes #10632

+

+Jay Satiro (1 Mar 2023)

+

+- transfer: limit Windows SO_SNDBUF updates to once a second

+

+  - Change readwrite_upload() to call win_update_buffer_size() no more

+    than once a second to update SO_SNDBUF (send buffer limit).

+

+  Prior to this change during an upload readwrite_upload() could call

+  win_update_buffer_size() anywhere from hundreds of times per second to

+  an extreme test case of 100k per second (which is likely due to a bug,

+  see #10618). In the latter case WPA profiler showed

+  win_update_buffer_size was the highest capture count in

+  readwrite_upload. In any case the calls were excessive and unnecessary.

+

+  Ref: https://github.com/curl/curl/pull/2762

+

+  Closes https://github.com/curl/curl/pull/10611

+

+Daniel Stenberg (28 Feb 2023)

+

+- RELEASE-NOTES: synced

+

+Stefan Eissing (28 Feb 2023)

+

+- http2: fix for http2-prior-knowledge when reusing connections

+

+  - refs #10634 where errors in the HTTP/2 framing layer are observed.

+  - the bug was that on connection reuse, the code attempted to switch

+    in yet another layer of HTTP/2 handling instead of detecting that

+    this was already in place.

+  - added pytest testcase reproducing the issue.

+

+  Reported-by: rwmjones on github

+  Fixes #10634

+  Closes #10643

+

+- cf-socket: fix handling of remote addr for accepted tcp sockets

+

+  - do not try to determine the remote address of a listen socket. There

+    is none.

+  - Update remote address of an accepted socket by getpeername() if

+    available.

+

+  Reported-by: Harry Sintonen

+  Fixes #10622

+  Closes #10642

+

+- http: fix unix domain socket use in https connects

+

+  - when h2/h3 eyeballing was involved, unix domain socket

+    configurations were not honoured

+  - configuring --unix-socket will disable HTTP/3 as candidate for eyeballing

+  - combinatino of --unix-socket and --http3-only will fail during initialisati

+  on

+  - adding pytest test_11 to reproduce

+

+  Reported-by: Jelle van der Waa

+  Fixes #10633

+  Closes #10641

+

+Daniel Stenberg (28 Feb 2023)

+

+- setopt: move the CURLOPT_CHUNK_DATA pointer to the set struct

+

+  To make duphandle work etc

+

+  Closes #10635

+

+Viktor Szakats (28 Feb 2023)

+

+- quic/schannel: fix compiler warnings

+

+  Fixes #10603

+  Closes #10616

+

+Daniel Stenberg (28 Feb 2023)

+

+- page-footer: add explanation for three missing exit codes

+

+  Added in 7.73.0, 7.77.0 and 7.84.0

+

+  Closes #10630

+

+積丹尼 Dan Jacobson (28 Feb 2023)

+

+- rate.c: single URLs make no sense in --rate example

+

+  Here somehow you need to put more than one URL in these examples, else

+  they will make no sense, as --rate only affects the second and beyond

+  URLs. The first URL will always finish the same time no matter what

+  --rate is given.

+

+  Closes #10638

+

+Daniel Stenberg (28 Feb 2023)

+

+- libcurl-errors.3: add the CURLHcode errors from curl_easy_header.3

+

+  Closes #10629

+

+- mqtt: on send error, return error

+

+  Reported-by: Maciej Domanski

+

+  Closes #10623

+

+- ws: keep the socket non-blocking

+

+  Reported-by: marski on github

+  Fixes #10615

+  Closes #10625

+

+- hostip: avoid sscanf and extra buffer copies

+

+  Also made create_hostcache_id() return the id length.

+

+  Closes #10601

+

+- PARALLEL-TRANSFERS.md: not "early days" for this anymore

+

+  Refresh the language as the support is now over three years old

+

+  Closes #10624

+

+- easy: remove infof() debug leftover from curl_easy_recv

+

+  It said "reached [path]/easy.c:1231"

+

+  Closes #10628

+

+- idn: return error if the conversion ends up with a blank host

+

+  Some IDN sequences are converted into "" (nothing), which can make this

+  function end up with a zero length host name and we cannot consider that

+  a valid host to continue with.

+

+  Reported-by: Maciej Domanski

+  Closes #10617

+

+- examples/http3.c: use CURL_HTTP_VERSION_3

+

+  and update the comment

+

+  Closes #10619

+

+- x509asn1.c: use correct format specifier for infof() call

+

+  Detected by Coverity

+

+  Closes #10614

+

+- Revert "GHA: add Microsoft C++ Code Analysis"

+

+  This reverts commit e0db842b2a082dffad4a9fbe31321e9a75c74041.

+

+  This tool seems very restricted in how often it might be used by a

+  project and thus very quickly start to report fails simply because it

+  refuses to run when "there are more runs than allowed".

+

+  Closes #10613

+

+Patrick Monnerat (25 Feb 2023)

+

+- tests: test secure mail protocols with explicit SSL requests

+

+  New tests 987, 988 and 989, disabled for rustls (hanging).

+

+  Closes #10077

+

+- tests: support for imaps/pop3s/smtps protocols

+

+  Closes #10077

+

+- runtests: use a hash table for server port numbers

+

+  Closes #10077

+

+Andy Alt (25 Feb 2023)

+

+- INTERNALS.md: grammar

+

+  Closes #10607

+

+Daniel Stenberg (25 Feb 2023)

+

+- RELEASE-NOTES: synced

+

+Philip Heiduck (25 Feb 2023)

+

+- .cirrus.yml: Bump to FreeBSD 13.2

+

+  Closes #10270

+

+- ngtcp2-gnutls.yml: bump to gnutls 3.8.0

+

+  Closes #10507

+

+- CI: update ngtcp2 and nghttp2 for pytest

+

+  Follow-up: https://github.com/curl/curl/commit/5c9ee8cef4b351a085b440f8178500

+  124647f8e6

+

+  Closes #10508

+

+Andy Alt (25 Feb 2023)

+

+- GHA: use same flags for Slackbuild as Slack package

+

+  Closes #10526

+

+Daniel Stenberg (24 Feb 2023)

+

+- rtsp: avoid sscanf for parsing

+

+  Closes #10605

+

+- http_proxy: parse the status line without sscanf

+

+  Closes #10602

+

+- telnet: error correctly for WS set to "x[num]"

+

+  Follow-up to e4f93be9d587

+  Reported-by: Harry Sintonen

+  Closes #10606

+

+- krb5: avoid sscanf for parsing

+

+  Closes #10599

+

+- misc: remove support for curl_off_t < 8 bytes

+

+  Closes #10597

+

+- telnet: parse NEW_ENVIRON without sscanf

+

+  Closes #10596

+

+- telnet: parse the WS= argument without sscanf

+

+  Closes #10596

+

+- telnet: parse telnet options without sscanf

+

+  Closes #10596

+

+- ftp: replace sscanf for MDTM 213 response parsing

+

+  Closes #10590

+

+- ftp: replace sscanf for PASV parsing

+

+  Closes #10590

+

+- ftp: make the EPSV response parser not use sscanf

+

+  Closes #10590

+

+Stefan Eissing (24 Feb 2023)

+

+- ngtcp2: fix unwanted close of file descriptor 0

+

+  ... causing macOS to hand out 0 as next socket handle and failing on

+  further operations.

+

+  Reported-by: Sergey Fionov

+  Fixes #10593

+  Closes #10595

+

+Daniel Stenberg (23 Feb 2023)

+

+- select: stop treating POLLRDBAND as an error

+

+  POLLRDBAND does not seem to be an general error and on Windows the value

+  for POLLIN is 768 and the value for POLLRDBAND is 512.

+

+  Fixes #10501

+  Reported-by: opensslonzos-github on github

+  Closes #10592

+

+- test978: mark file as text mode

+

+  Follow-up to 4ea5702980cb

+

+  To fix test failures on Windows

+

+  Closes #10594

+

+- http: rewrite the status line parser without sscanf

+

+  Closes #10585

+

+- test978: verify that --stderr works for -w's stderr as well

+

+Jay Satiro (23 Feb 2023)

+

+- curl: make -w's %{stderr} use the file set with --stderr

+

+  Reported-by: u20221022 on github

+  Fixes #10491

+  Closes #10569

+

+- winbuild: fix makefile clean

+

+  - Fix and move 'clean' code that removes the output and obj directories

+    trees from MakefileBuild.vc to Makefile.vc.

+

+  Prior to this change the 'clean' code did not work right because the

+  variables containing the directory names were not fully initialized and

+  the rmdir syntax was sometimes incorrect (typos). DIRDIST for example

+  was set to ..\builds\ and not ..\builds\$(CONFIG_NAME_LIB)\ so it would

+  remove the former and not the latter. If WITH_PREFIX was set then that

+  directory was removed instead.

+

+  Also, DIRDIST (the output directory) even if initialized should not be

+  removed by MakefileBuild.vc because by that time it could be set to a

+  user directory that may contain other files if WITH_PREFIX is set (eg we

+  don't want rmdir /s /q C:\usr\local). Therefore we remove from

+  Makefile.vc before any of that happens. I added a comment in both

+  makefiles explaining this.

+

+  Closes https://github.com/curl/curl/pull/10576

+

+- sectransp: fix compiler warning c89 mixed code/declaration

+

+  Since cbf57176 the Cirrus CI 'macOS arm64 SecureTransport http2' has

+  been failing due to c89 warnings mixed code/declaration. That commit is

+  not the cause so I assume something has changed in the CI outside of our

+  configuration. Anyway, we don't mix code/declaration so this is the fix

+  for that.

+

+  Closes https://github.com/curl/curl/pull/10574

+

+Philipp Engel (22 Feb 2023)

+

+- BINDINGS: add Fortran binding

+

+  Closes #10589

+

+Stefan Eissing (22 Feb 2023)

+

+- test2600: detect when ALARM_TIMEOUT is in use and adjust

+

+  - use higher timeout values > 1s

+  - skip duration checks

+

+  Assisted-by: Marcel Raad

+  Closes #10513

+

+Daniel Stenberg (22 Feb 2023)

+

+- RELEASE-NOTES: synced

+

+- test686: verify return code for no URL after --next

+

+- tool_operate: propagate error codes for missing URL after --next

+

+  Fixes #10558

+  Reported-by: u20221022 on github

+  Closes #10580

+

+- test1278: verify that an extra --no-remote-name cause no warning

+

+- tool_getparam: don't add a new node for just --no-remote-name

+

+  Unless --remote-name-all is used.

+

+  Fixes #10564

+  Reported-by: u20221022 on github

+  Closes #10582

+

+- gen.pl: add '%GLOBALS' as a variable for mainpage

+

+  And use it in page-header to list all global command line options.

+

+- docs/cmdline-opts: mark all global options

+

+  gen.pl now outputs a generic explanations for them for each option

+

+  Fixes #10566

+  Reported-by: u20221022 on github

+  Closes #10584

+

+- GHA: add Microsoft C++ Code Analysis

+

+  Closes #10583

+

+- tool_progress: shut off progress meter for --silent in parallel

+

+  Reported-by: finkjsc on github

+  Fixes #10573

+  Closes #10579

+

+- lib1560: add a test using %25 in the userinfo in a URL

+

+  Closes #10578

+

+Stefan Eissing (21 Feb 2023)

+

+- CURLOPT_PIPEWAIT: allow waited reuse also for subsequent connections

+

+  As tested in test_02_07, when firing off 200 urls with --parallel, 199

+  wait for the first connection to be established. if that is multiuse,

+  urls are added up to its capacity.

+

+  The first url over capacity opens another connection. But subsequent

+  urls found the same situation and open a connection too. They should

+  have waited for the second connection to actually connect and make its

+  capacity known.

+

+  This change fixes that by

+

+  - setting `connkeep()` early in the HTTP setup handler. as otherwise

+    a new connection is marked as closeit by default and not considered

+    for multiuse at all

+  - checking the "connected" status for a candidate always and continuing

+    to PIPEWAIT if no alternative is found.

+

+  pytest:

+  - removed "skip" from test_02_07

+  - added test_02_07b to check that http/1.1 continues to work as before

+

+  Closes #10456

+

+Daniel Stenberg (21 Feb 2023)

+

+- test419: verify --dump-header to file that cannot be created

+

+  Closes #10571

+

+- tool_operate: avoid fclose(NULL) on bad header dump file

+

+  Fixes #10570

+  Reported-by: Jérémy Rabasco

+  Closes #10571

+

+- RELEASE-NOTES: synced

+

+  Starting the journey towards 8.0.0

+

+- cookie: parse without sscanf()

+

+  Saves us from using 2*4096 bytes buffers on stack, the extra copies and

+  more.

+

+  Closes #10550

+

+- lib517: verify time stamps without leading zeroes plus some more

+

+- parsedate: replace sscanf( for time stamp parsing

+

+  Closes #10547

+

+- parsedate: parse strings without using sscanf()

+

+  - sscanf is slow and complex, avoid it

+  - give up already if the string is 12 bytes or longer as no valid string

+    can be that long

+  - this can now be done without copy

+

+  Closes #10547

+

+Matt Jolly (20 Feb 2023)

+

+- tests: HTTP server fixups

+

+  - httpserver.pl -> http-server.pl for consistency

+  - add http3-server.pl to EXTRA_DIST; alphabetise for maintainability

+  - nghttpx proxy invocation scripts should not use getcwd

+

+  Closes #10568

+

 Version 7.88.1 (20 Feb 2023)

 

 Daniel Stenberg (20 Feb 2023)

@@ -8293,1903 +9885,3 @@ Daniel Stenberg (8 Sep 2022)
 - RELEASE-NOTES: synced

 

   And bump to 7.86.0 for the pending next release

-

-Michael Heimpold (7 Sep 2022)

-

-- ftp: ignore a 550 response to MDTM

-

-  The 550 is overused as a return code for multiple error case, e.g.

-  file not found and/or insufficient permissions to access the file.

-

-  So we cannot fail hard in this case.

-

-  Adjust test 511 since we now fail later.

-  Add new test 3027 which check that when MDTM failed, but the file could

-  actually be retrieved, that in this case no filetime is provided.

-

-  Reported-by: Michael Heimpold

-  Fixes #9357

-  Closes #9387

-

-Daniel Stenberg (7 Sep 2022)

-

-- urlapi: leaner with fewer allocs

-

-  Slightly faster with more robust code. Uses fewer and smaller mallocs.

-

-  - remove two fields from the URL handle struct

-  - reduce copies and allocs

-  - use dynbuf buffers more instead of custom malloc + copies

-  - uses dynbuf to build the host name in reduces serial alloc+free within

-    the same function.

-  - move dedotdotify into urlapi.c and make it static, not strdup the input

-    and optimize it by checking for . and / before using strncmp

-  - remove a few strlen() calls

-  - add Curl_dyn_setlen() that can "trim" an existing dynbuf

-

-  Closes #9408

-

-Jay Satiro (7 Sep 2022)

-

-- setup-win32: no longer define UNICODE/_UNICODE implicitly

-

-  - If UNICODE or _UNICODE is defined but the other isn't then error

-    instead of implicitly defining it.

-

-  As Marcel pointed out it is too late at this point to make such a define

-  because Windows headers may already be included, so likely it never

-  worked. We never noticed because build systems that can make Windows

-  Unicode builds always define both. If one is defined but not the other

-  then something went wrong during the build configuration.

-

-  Bug: https://github.com/curl/curl/pull/9375#discussion_r956545272

-  Reported-by: Marcel Raad

-

-  Closes https://github.com/curl/curl/pull/9384

-

-Dan Fandrich (6 Sep 2022)

-

-- tests: fix tag syntax errors in test files

-

-Marc Hoersken (6 Sep 2022)

-

-- lib: add required Win32 setup definitions in setup-win32.h

-

-  Assisted-by: Jay Satiro

-  Reviewed-by: Marcel Raad

-

-  Follow up to #9312

-  Closes #9375

-

-Daniel Stenberg (6 Sep 2022)

-

-- pingpong: extend the response reading error with errno

-

-  To help diagnosing the cause of the problem.

-

-  See #9380

-  Closes #9443

-

-- curl-compilers.m4: use -O2 as default optimize for clang

-

-  Not -Os

-

-  Closes #9444

-

-- tool_operate: fix msnprintfing the error message

-

-  Follow-up to 7be53774c41c59b47075fba

-

-  Coverity CID 1513717 pointed out that we cannot use sizeof() on the

-  error buffer anymore.

-

-  Closes #9440

-

-Emanuele Torre (6 Sep 2022)

-

-- curl_ctype: add space around <= operator in ISSPACE macro

-

-  Follow-up to f65f750

-

-  Closes #9441

-

-Daniel Stenberg (6 Sep 2022)

-

-- CURLOPT_PROXY_SSLCERT_BLOB.3: this is for HTTPS proxies

-

-  The 'protocols' listed were previously wrong.

-

-  Reported-by: ProceduralMan on github

-  Fixes #9434

-  Closes #9435

-

-- curl_ctype: convert to macros-only

-

-  This no longer provide functions, only macros. Runs faster and produces

-  smaller output.

-

-  The biggest precaution this change brings:

-

-  DO NOT use post/pre-increments when passing arguments to the macros.

-

-  Closes #9429

-

-- misc: ISSPACE() => ISBLANK()

-

-  Instances of ISSPACE() use that should rather use ISBLANK(). I think

-  somewhat carelessly used because it sounds as if it checks for space or

-  whitespace, but also includes %0a to %0d.

-

-  For parsing purposes, we should only accept what we must and not be

-  overly liberal. It leads to surprises and surprises lead to bad things.

-

-  Closes #9432

-

-- ctype: remove all use of <ctype.h>, use our own versions

-

-  Except in the test servers.

-

-  Closes #9433

-

-Marc Hoersken (5 Sep 2022)

-

-- cmake: skip superfluous hex2dec conversion using math expr

-

-  CMake seems to be able to compare two hex values just fine.

-  Also make sure CURL_TARGET_WINDOWS_VERSION is respected.

-

-  Assisted-by: Marcel Raad

-  Reviewed-by: Viktor Szakats

-  Reported-by: Keitagit-kun on github

-

-  Follow up to #9312

-  Fixes #9406

-  Closes #9411

-

-Daniel Stenberg (5 Sep 2022)

-

-- curl_easy_pause.3: unpausing is as fast as possible

-

-  Reported-by: ssdbest on github

-  Fixes #9410

-  Closes #9430

-

-- CURLOPT_DNS_INTERFACE.3: mention it works for almost all protocols

-

-  Except file.

-

-  Reported-by: ProceduralMan on github

-  Fixes #9427

-  Closes #9428

-

-- NPN: remove support for and use of

-

-  Next Protocol Negotiation is a TLS extension that was created and used

-  for agreeing to use the SPDY protocol (the precursor to HTTP/2) for

-  HTTPS. In the early days of HTTP/2, before the spec was finalized and

-  shipped, the protocol could be enabled using this extension with some

-  servers.

-

-  curl supports the NPN extension with some TLS backends since then, with

-  a command line option `--npn` and in libcurl with

-  `CURLOPT_SSL_ENABLE_NPN`.

-

-  HTTP/2 proper is made to use the ALPN (Application-Layer Protocol

-  Negotiation) extension and the NPN extension has no purposes

-  anymore. The HTTP/2 spec was published in May 2015.

-

-  Today, use of NPN in the wild should be extremely rare and most likely

-  totally extinct. Chrome removed NPN support in Chrome 51, shipped in

-  June 2016. Removed in Firefox 53, April 2017.

-

-  Closes #9307

-

-- RELEASE-NOTES: synced

-

-  and bump the tentative next release version to 7.85.1

-

-Samuel Henrique (4 Sep 2022)

-

-- configure: fail if '--without-ssl' + explicit parameter for an ssl lib

-

-  A side effect of a previous change to configure (576e507c78bdd2ec88)

-  exposed a non-critical issue that can happen if configure is called with

-  both '--without-ssl' and some parameter setting the use of a ssl library

-  (e.g. --with-gnutls). The configure script would end up assuming this is

-  a MultiSSL build, due to the way the case statement is written.

-

-  I have changed the order of the variables in the string concatenation

-  for the case statement and also tweaked the options so that

-  --without-ssl never turns the build into a MultiSSL one and also clearly

-  stating that there are conflicting parameters if the user sets it like

-  described above.

-

-  Closes #9414

-

-Daniel Stenberg (4 Sep 2022)

-

-- tests/certs/scripts: insert standard curl source headers

-

-  ... including the SPDX-License-Identifier.

-

-  These omissions were not detected by the RUEUSE CI job nor the copyright.pl

-  scanners because we have a general wildcard in .reuse/dep5 for

-  "tests/certs/*".

-

-  Reported-by: Samuel Henrique

-  Fixes #9417

-  Closes #9420

-

-Samuel Henrique (2 Sep 2022)

-

-- docs: remove mentions of deprecated '--without-openssl' config parameter

-

-  Closes #9415

-

-- manpages: Fix spelling of "allows to" -> "allows one to"

-

-   References:

-   https://salsa.debian.org/lintian/lintian/-/blob/master/tags/t/typo-in-manual

-  -page.tag

-   https://english.stackexchange.com/questions/60271/grammatical-complements-fo

-  r-allow/60285#60285

-

-  Closes #9419

-

-- CURLOPT_WILDCARDMATCH.3: Fix backslash escaping under single quotes

-

-   Lintian (on Debian) has been complaining about this for a while but

-   I didn't bother initially as the groff parser that we use is not

-   affected by this.

-

-   But I have now noticed that the online manpage is affected by it:

-   https://curl.se/libcurl/c/CURLOPT_WILDCARDMATCH.html

-

-   (I'm using double quotes for quoting-only down below)

-

-   The section that should be parsed as "'\'" ends up being parsed as

-   "'´".

-

-   This is due to roffit not parsing "'\\'" correctly, which is fine

-   as the "correct" way of writing "'\'" is "'\e'" instead.

-

-   Note that this fix is not enough to fix the online manpage at

-   curl's website, as roffit seems to parse it wrongly either way.

-

-   My intent is to at least fix the manpage so that roffit can

-   be changed to parse "'\e'" correctly (although I suggest making

-   roffit parse both ways correctly, since that's what groff does).

-

-   More details at:

-   https://bugs.debian.org/966803

-   https://salsa.debian.org/lintian/lintian/-/blob/930b18e4b28b7540253f458ef42a

-  884cca7965c3/tags/a/acute-accent-in-manual-page.tag

-

-  Closes #9418

-

-Daniel Stenberg (1 Sep 2022)

-

-- tool_operate: reduce errorbuffer allocs

-

-  - parallel transfers: only alloc and keep errorbuffers in memory for

-    actual "live" transfers and not for the ones in the pending queue

-

-  - serial transfers: reuse the same fixed buffer for all transfers, not

-    allocated at all.

-

-  Closes #9394

-

-Viktor Szakats (31 Aug 2022)

-

-- misc: spelling fixes

-

-  Found using codespell 2.2.1.

-

-  Also delete the redundant protocol designator from an archive.org URL.

-

-  Reviewed-by: Daniel Stenberg

-  Closes #9403

-

-Daniel Stenberg (31 Aug 2022)

-

-- tool_progress: remove 'Qd' from the parallel progress bar

-

-  The "queued" value is no longer showing anything useful to the user. It

-  is an internal number of transfers waiting at that moment.

-

-  Closes #9389

-

-- tool_operate: prevent over-queuing in parallel mode

-

-  When doing a huge amount of parallel transfers, we must not add them to

-  the per_transfer list frivolously since they all use memory after all.

-  This was previous done without really considering millions or billions

-  of transfers. Massive parallelism would use a lot of memory for no good

-  purpose.

-

-  The queue is now limited to twice the paralleism number.

-

-  This makes the 'Qd' value in the parallel progress meter mostly useless

-  for users, but works for now for us as a debug display.

-

-  Reported-by: justchen1369 on github

-  Fixes #8933

-  Closes #9389

-

-Viktor Szakats (31 Aug 2022)

-

-- cmake: fix original MinGW builds

-

-  1. Re-enable `HAVE_GETADDRINFO` detection on Windows

-

-     Commit d08ee3c83d6bd416aef62ff844c98e47c4682429 (in 2013) added logic

-     that automatically assumed `getaddrinfo()` to be present for builds

-     with IPv6 enabled. As it turns out, certain toolchains (e.g. original

-     MinGW) by default target older Windows versions, and thus do not

-     support `getaddrinfo()` out of the box. The issue was masked for

-     a while by CMake builds forcing a newer Windows version, but that

-     logic got deleted in commit 8ba22ffb2030ed91312fc8634e29516cdf0a9761.

-     Since then, some CI builds started failing due to IPv6 enabled,

-     `HAVE_GETADDRINFO` set, but `getaddrinfo()` in fact missing.

-

-     It also turns out that IPv6 works without `getaddrinfo()` since commit

-     67a08dca27a6a07b36c7f97252e284ca957ff1a5 (from 2019, via #4662). So,

-     to resolve all this, we can now revert the initial commit, thus

-     restoring `getaddrinfo()` detection and support IPv6 regardless of its

-     outcome.

-

-     Reported-by: Daniel Stenberg

-

-  2. Omit `bcrypt` with original MinGW

-

-     Original (aka legacy/old) MinGW versions do not support `bcrypt`

-     (introduced with Vista). We already have logic to handle that in

-     `lib/rand.c` and autotools builds, where we do not call the

-     unsupported API and do not link `bcrypt`, respectively, when using

-     original MinGW.

-

-     This patch ports that logic to CMake, fixing the link error:

-     `c:/mingw/bin/../lib/gcc/mingw32/9.2.0/../../../../mingw32/bin/ld.exe: can

-  not find -lbcrypt`

-

-     Ref: https://ci.appveyor.com/project/curlorg/curl/builds/44624888/job/40vl

-  e84cn4vle7s0#L508

-     Regression since 76172511e7adcf720f4c77bd91f49278300ec97e

-

-  Fixes #9214

-  Fixes #9393

-  Fixes #9395

-  Closes #9396

-

-Version 7.85.0 (31 Aug 2022)

-

-Daniel Stenberg (31 Aug 2022)

-

-- RELEASE-NOTES: synced

-

-  curl 7.85.0 release

-

-- THANKS: add contributors from the 7.85.0 release

-

-- getparam: correctly clean args

-

-  Follow-up to bf7e887b2442783ab52

-

-  The previous fix for #9128 was incomplete and caused #9397.

-

-  Fixes #9397

-  Closes #9399

-

-- zuul: remove the clang-tidy job

-

-  Turns out we don't see the warnings, but the warnings right now are

-  plain ridiculous and unhelpful so we can just as well just kill this

-  job.

-

-  Closes #9390

-

-- cmake: set feature PSL if present

-

-  ... make test 1014 pass when libpsl is used.

-

-  Closes #9391

-

-- lib530: simplify realloc failure exit path

-

-  To make code analyzers happier

-

-  Closes #9392

-

-Orgad Shaneh (29 Aug 2022)

-

-- tests: add tests for netrc login/password combinations

-

-  Covers the following PRs:

-

-  - #9066

-  - #9247

-  - #9248

-

-  Closes #9256

-

-- url: really use the user provided in the url when netrc entry exists

-

-  If the user is specified as part of the URL, and the same user exists

-  in .netrc, Authorization header was not sent at all.

-

-  The user and password fields were assigned in conn->user and password

-  but the user was not assigned to data->state.aptr, which is the field

-  that is used in output_auth_headers and friends.

-

-  Fix by assigning the user also to aptr.

-

-  Amends commit d1237ac906ae7e3cd7a22c3a2d3a135a97edfbf5.

-

-  Fixes #9243

-

-- netrc: Use the password from lines without login

-

-  If netrc entry has password with empty login, use it for any username.

-

-  Example:

-  .netrc:

-  machine example.com password 123456

-

-  curl -vn http://user@example.com/

-

-  Fix it by initializing state_our_login to TRUE, and reset it only when

-  finding an entry with the same host and different login.

-

-  Closes #9248

-

-Jay Satiro (29 Aug 2022)

-

-- url: treat missing usernames in netrc as empty

-

-  - If, after parsing netrc, there is a password with no username then

-    set a blank username.

-

-  This used to be the case prior to 7d600ad (precedes 7.82). Note

-  parseurlandfillconn already does the same thing for URLs.

-

-  Reported-by: Raivis <standsed@users.noreply.github.com>

-  Testing-by: Domen Kožar

-

-  Fixes https://github.com/curl/curl/issues/8653

-  Closes #9334

-  Closes #9066

-

-Daniel Stenberg (29 Aug 2022)

-

-- test8: verify that "ctrl-byte cookies" are ignored

-

-- cookie: reject cookies with "control bytes"

-

-  Rejects 0x01 - 0x1f (except 0x09) plus 0x7f

-

-  Reported-by: Axel Chong

-

-  Bug: https://curl.se/docs/CVE-2022-35252.html

-

-  CVE-2022-35252

-

-  Closes #9381

-

-- libssh: ignore deprecation warnings

-

-  libssh 0.10.0 marks all SCP functions as "deprecated" which causes

-  compiler warnings and errors in our CI jobs and elsewhere. Ignore

-  deprecation warnings if 0.10.0 or later is found in the build.

-

-  If they actually remove the functions at a later point, then someone can

-  deal with that pain and functionality break then.

-

-  Fixes #9382

-  Closes #9383

-

-- Revert "schannel: when importing PFX, disable key persistence"

-

-  This reverts commit 70d010d285315e5f1cad6bdb4953e167b069b692.

-

-  Due to further reports in #9300 that indicate this commit might

-  introduce problems.

-

-- multi: use larger dns hash table for multi interface

-

-  Have curl_multi_init() use a much larger DNS hash table than used for

-  the easy interface to scale and perform better when used with _many_

-  host names.

-

-  curl_share_init() sets an in-between size.

-

-  Inspired-by: Ivan Tsybulin

-  See #9340

-  Closes #9376

-

-Marc Hoersken (28 Aug 2022)

-

-- CI/runtests.pl: add param for dedicated curl to talk to APIs

-

-  This should make it possible to also report test failures

-  if our freshly build curl binary is not fully functional.

-

-  Reviewed-by: Daniel Stenberg

-  Closes #9360

-

-Jacob Tolar (27 Aug 2022)

-

-- openssl: add cert path in error message

-

-  Closes #9349

-

-- cert.d: clarify that escape character works for file paths

-

-  Closes #9349

-

-Daniel Stenberg (27 Aug 2022)

-

-- gha: move over ngtcp2-gnutls CI job from zuul

-

-  Closes #9331

-

-Marc Hoersken (26 Aug 2022)

-

-- cmake: add detection of threadsafe feature

-

-  Avoids failing test 1014 by replicating configure checks

-  for HAVE_ATOMIC and _WIN32_WINNT with custom CMake tests.

-

-  Reviewed-by: Marcel Raad

-

-  Follow up to #8680

-  Closes #9312

-

-Daniel Stenberg (26 Aug 2022)

-

-- RELEASE-NOTES: synced

-

-Marc Hoersken (26 Aug 2022)

-

-- CI/azure: align torture shallowness with GHA

-

-  There 25 is used with FTP tests skipped, and 20 for FTP tests.

-  This should make torture tests stay within the 60min timeout.

-

-  Reviewed-by: Daniel Stenberg

-  Closes #9371

-

-- multi_wait: fix and improve Curl_poll error handling on Windows

-

-  First check for errors and return CURLM_UNRECOVERABLE_POLL

-  before moving forward and waiting on socket readiness events.

-

-  Reviewed-by: Jay Satiro

-  Reviewed-by: Marcel Raad

-

-  Reported-by: Daniel Stenberg

-  Ref: #9361

-

-  Follow up to #8961

-  Closes #9372

-

-- multi_wait: fix skipping to populate revents for extra_fds

-

-  On Windows revents was not populated for extra_fds if

-  multi_wait had to wait due to the Curl_poll pre-check

-  not signalling any readiness. This commit fixes that.

-

-  Reviewed-by: Marcel Raad

-  Reviewed-by: Jay Satiro

-

-  Closes #9361

-

-- CI/appveyor: disable TLS in msys2-native autotools builds

-

-  Schannel cannot be used from msys2-native Linux-emulated builds.

-

-  Reviewed-by: Marcel Raad

-  Reviewed-by: Daniel Stenberg

-

-  Follow up to #9367

-  Closes #9370

-

-Jay Satiro (25 Aug 2022)

-

-- tests: fix http2 tests to use CRLF headers

-

-  Prior to this change some tests that rely on nghttpx proxy did not use

-  CRLF headers everywhere. A recent change in nghttp2, which updated its

-  version of llhttp (HTTP parser), requires curl's HTTP/1.1 test server to

-  use CRLF headers.

-

-  Ref: https://github.com/nghttp2/nghttp2/commit/9d389e8

-

-  Fixes https://github.com/curl/curl/issues/9364

-  Closes https://github.com/curl/curl/pull/9365

-

-rcombs (25 Aug 2022)

-

-- multi: use a pipe instead of a socketpair on apple platforms

-

-  Sockets may be shut down by the kernel when the app is moved to the

-  background, but pipes are not.

-

-  Removed from KNOWN_BUGS

-

-  Fixes #6132

-  Closes #9368

-

-Somnath Kundu (25 Aug 2022)

-

-- libssh2: provide symlink name in SFTP dir listing

-

-  When reading the symbolic link name for a file, we need to add the file

-  name to base path name.

-

-  Closes #9369

-

-Daniel Stenberg (25 Aug 2022)

-

-- configure: if asked to use TLS, fail if no TLS lib was detected

-

-  Previously the configure script would just warn about this fact and

-  continue with TLS disabled build which is not always helpful. TLS should

-  be explicitly disabled if that is what the user wants.

-

-  Closes #9367

-

-Dustin Howett (25 Aug 2022)

-

-- schannel: when importing PFX, disable key persistence

-

-  By default, the PFXImportCertStore API persists the key in the user's

-  key store (as though the certificate was being imported for permanent,

-  ongoing use.)

-

-  The documentation specifies that keys that are not to be persisted

-  should be imported with the flag `PKCS12_NO_PERSIST_KEY`.

-  NOTE: this flag is only supported on versions of Windows newer than XP

-  and Server 2003.

-

-  Fixes #9300

-  Closes #9363

-

-Daniel Stenberg (23 Aug 2022)

-

-- unit1303: four tests should have TRUE for 'connecting'

-

-  To match the comments.

-

-  Reported-by: Wu Zheng

-

-  See #9355

-  Closes #9356

-

-- CURLOPT_BUFFERSIZE.3: add upload buffersize to see also

-

-  Closes #9354

-

-Fabian Fischer (23 Aug 2022)

-

-- HTTP3.md: add missing autoreconf command for building with wolfssl

-

-  Closes #9353

-

-Daniel Stenberg (23 Aug 2022)

-

-- RELEASE-NOTES: synced

-

-- multi: have curl_multi_remove_handle close CONNECT_ONLY transfer

-

-  Ẃhen it has been used in the multi interface, it is otherwise left in

-  the connection cache, can't be reused and nothing will close them since

-  the easy handle loses the association with the multi handle and thus the

-  connection cache - until the multi handle is closed or it gets pruned

-  because the cache is full.

-

-  Reported-by: Dominik Thalhammer

-  Fixes #9335

-  Closes #9342

-

-- docs/cmdline-opts: remove \& escapes from all .d files

-

-  gen.pl escapes them itself now

-

-- docs/cmdline-opts/gen.pl: encode leading single and double quotes

-

-  As "(aq" and "(dq" to prevent them from implying a meaning in the nroff

-  output. This removes the need for using \& escapes in the .d files'

-  description parts.

-

-  Closes #9352

-

-Marc Hoersken (23 Aug 2022)

-

-- tests/server/sockfilt.c: avoid race condition without a mutex

-

-  Avoid loosing any triggered handles by first aborting and joining

-  the waiting threads before evaluating the individual signal state.

-

-  This removes the race condition and therefore need for a mutex.

-

-  Closes #9023

-

-Emil Engler (22 Aug 2022)

-

-- url: output the maximum when rejecting a url

-

-  This commit changes the failf message to output the maximum length, when

-  curl refuses to process a URL because it is too long.

-

-  See: #9317

-  Closes: #9327

-

-Chris Paulson-Ellis (22 Aug 2022)

-

-- configure: fix broken m4 syntax in TLS options

-

-  Commit b589696f added lines to some shell within AC_ARG_WITH macros, but

-  inadvertently failed to move the final closing ).

-

-  Quote the script section using braces.

-

-  So, if these problems have been around for a while, how did I find them?

-  Only because I did a configure including these options:

-

-      $ ./configure --with-openssl --without-rustls

-        SSL:              enabled (OpenSSL)

-

-  Closes #9344

-

-Daniel Stenberg (18 Aug 2022)

-

-- tests/data/CMakeLists: remove making the 'show' makefile target

-

-  It is not used by runtests since 3c0f462

-

-  Closes #9333

-

-- tests/data/Makefile: remove 'filecheck' target

-

-  No practical use anymore since 3c0f4622cdfd6

-

-  Closes #9332

-

-- libssh2: make atime/mtime date overflow return error

-

-  Closes #9328

-

-- libssh: make atime/mtime date overflow return error

-

-  Closes #9328

-

-- examples/curlx.c: remove

-

-  This example is a bit convoluted to use as an example, combined with the

-  special license for it makes it unsuitable.

-

-  Closes #9330

-

-Tobias Nygren (17 Aug 2022)

-

-- curl.h: include <sys/select.h> on SunOS

-

-  It is needed for fd_set to be visible to downstream consumers that use

-  <curl/multi.h>. Header is known to exist at least as far back as Solaris

-  2.6.

-

-  Closes #9329

-

-Daniel Stenberg (17 Aug 2022)

-

-- DEPRECATE.md: push the NSS deprecation date forward one year to 2023

-

-  URL: https://curl.se/mail/lib-2022-08/0016.html

-

-- libssh2: setting atime or mtime >32bit on 4-bytes-long systems

-

-  Since the libssh2 API uses 'long' to store the timestamp, it cannot

-  transfer >32bit times on Windows and 32bit architecture builds.

-

-  Avoid nasty surprises by instead not setting such time.

-

-  Spotted by Coverity

-

-  Closes #9325

-

-- libssh: setting atime or mtime > 32bit is now just skipped

-

-  The libssh API used caps the time to an unsigned 32bit variable. Avoid

-  nasty surprises by instead not setting such time.

-

-  Spotted by Coverity.

-

-  Closes #9324

-

-Jay Satiro (16 Aug 2022)

-

-- KNOWN_BUGS: Windows Unicode builds use homedir in current locale

-

-  Bug: https://github.com/curl/curl/pull/7252

-  Reported-by: dEajL3kA@users.noreply.github.com

-

-  Ref: https://github.com/curl/curl/pull/7281

-

-  Closes https://github.com/curl/curl/pull/9305

-

-Daniel Stenberg (16 Aug 2022)

-

-- test399: switch it to use a config file instead

-

-  ... as using a 65535 bytes host name in a URL does not fit on the

-  command line on some systems - like Windows.

-

-  Reported-by: Marcel Raad

-  Fixes #9321

-  Closes #9322

-

-- RELEASE-NOTES: synced

-

-- asyn-ares: make a single alloc out of hostname + async data

-

-  This saves one alloc per name resolve and simplifies the exit path.

-

-  Closes #9310

-

-- Curl_close: call Curl_resolver_cancel to avoid memory-leak

-

-  There might be a pending (c-ares) resolve that isn't free'd up yet.

-

-  Closes #9310

-

-- asyn-thread: fix socket leak on OOM

-

-  Closes #9310

-

-- GHA: mv CI torture test from Zuul

-

-  Closes #9310

-

-- ngtcp2-wolfssl.yml: add GHA to build ngtcp2 + wolfSSL

-

-  Closes #9318

-

-- test399: verify check of too long host name

-

-- url: reject URLs with hostnames longer than 65535 bytes

-

-  It *probably* causes other problems too since DNS can't resolve such

-  long names, but the SNI field in TLS is limited to 16 bits length.

-

-  Closes #9317

-

-- curl_multi_perform.3: minor language fix

-

-  Closes #9316

-

-- ngtcp2: fix picky compiler warnings with wolfSSL for QUIC

-

-  Follow-up to 8a13be227eede2

-

-  Closes #9315

-

-- ngtcp2: remove leftover variable

-

-  Mistake leftover from my edit before push.

-

-  Follow-up from 8a13be227eede2601c2b3b

-  Reported-by: Viktor Szakats

-  Bug: https://github.com/curl/curl/pull/9290#issuecomment-1214569167

-

-Viktor Szakats (15 Aug 2022)

-

-- Makefile.m32: allow -nghttp3/-ngtcp2 without -ssl [ci skip]

-

-  Before this patch `-nghttp3`/`-ngtcp2` had an effect only when `-ssl`

-  was also enabled. `-ssl` meaning OpenSSL (and its forks). After

-  8a13be227eede2601c2b3b1c63e08b3dc9b35dd5 nghttp3/ngtcp2 can also be

-  used together with wolfSSL. This patch adds the ability to enable

-  `-nghttp3`/`-ngtcp2` independently from `-ssl` (OpenSSL), allowing to

-  use it with wolfSSL or other, future TLS backends.

-

-  Before this patch, it was fine to enable `-nghttp3`/`-ngtcp2`

-  unconditionally. After this patch, this is no longer the case, and now

-  it's the user's responsibility to enable `-nghttp3`/`-ngtcp2` only

-  together with a compatible TLS backend.

-

-  When using a TLS backend other than OpenSSL, the TLS-specific ngtcp2

-  library must be configured manually, e.g.:

-    `export CURL_LDFLAG_EXTRAS=-lngtcp2_crypto_wolfssl`

-

-  (or via `NGTCP2_LIBS`)

-

-  Closes #9314

-

-Stefan Eissing (15 Aug 2022)

-

-- quic: add support via wolfSSL

-

-  - based on ngtcp2 PR https://github.com/ngtcp2/ngtcp2/pull/505

-  - configure adapted to build against ngtcp2 wolfssl crypto lib

-  - quic code added for creation of WOLFSSL* instances

-

-  Closes #9290

-

-David Carlier (14 Aug 2022)

-

-- memdebug: add annotation attributes

-

-  memory debug tracking annotates whether the returned pointer does not

-  `alias`, hints where the size required is, for Windows to be better

-  debugged via Visual Studio.

-

-  Closes https://github.com/curl/curl/pull/9306

-

-Daniel Stenberg (14 Aug 2022)

-

-- GHA: move libressl CI from zuul to GitHub

-

-  Closes #9309

-

-- KNOWN_BUGS: FTPS directory listing hangs on Windows with Schannel

-

-  Closes #9161

-

-- KNOWN_BUGS: CURLOPT_CERTINFO results in CURLE_OUT_OF_MEMORY with Schannel

-

-  Closes #8741

-

-- KNOWN_BUGS: libssh blocking and infinite loop problem

-

-  Closes #8632

-

-- RELEASE-NOTES: synced

-

-- msh3: fix the QUIC disconnect function

-

-  And free request related memory better in 'done'. Fixes a memory-leak.

-

-  Reported-by: Gisle Vanem

-  Fixes #8915

-  Closes #9304

-

-- connect: close the happy eyeballs loser connection when using QUIC

-

-  Reviewed-by: Nick Banks

-

-  Closes #9303

-

-Emil Engler (12 Aug 2022)

-

-- refactor: split resolve_server() into functions

-

-  This commit splits the branch-heavy resolve_server() function into

-  various sub-functions, in order to reduce the amount of nested

-  if/else-statements.

-

-  Beside this, it also removes many else-sequences, by returning in the

-  previous if-statement.

-

-  Closes #9283

-

-Daniel Stenberg (12 Aug 2022)

-

-- schannel: re-indent to use curl style better

-

-  Only white space changes

-

-  Closes #9301

-

-Emanuele Torre (12 Aug 2022)

-

-- docs/cmdline-opts: fix example and categories for --form-escape

-

-  The example was missing a "--form" argument

-  I also replaced "--form" with "-F" to shorten the line a bit since it

-  was already very long.

-

-  And I also moved --form-escape from the "post" category to the "upload"

-  category (this is what I originally wanted to fix, before also noticing

-  the mistake in the example).

-

-  Closes #9298

-

-Nick Banks (11 Aug 2022)

-

-- HTTP3.md: update to msh3 v0.4.0

-

-  Closes #9297

-

-Daniel Stenberg (11 Aug 2022)

-

-- hostip: resolve *.localhost to 127.0.0.1/::1

-

-  Following the footsteps of other clients like Firefox/Chrome.  RFC 6761

-  says clients SHOULD do this.

-

-  Add test 389 to verify.

-

-  Reported-by: TheKnarf on github

-  Fixes #9192

-  Closes #9296

-

-Jay Satiro (11 Aug 2022)

-

-- KNOWN_BUGS: long paths are not fully supported on Windows

-

-  Bug: https://github.com/curl/curl/issues/8361

-  Reported-by: Gisle Vanem

-

-  Closes https://github.com/curl/curl/pull/9288

-

-Daniel Stenberg (11 Aug 2022)

-

-- config: remove the check for and use of SIZEOF_SHORT

-

-  shorts are 2 bytes on all platforms curl runs and have ever run on.

-

-  Closes #9291

-

-- configure: introduce CURL_SIZEOF

-

-  This is a rewrite of the previously used GPLv3+exception licensed

-  file. With this change, there is no more reference to GPL so we can

-  remove that from LICENSES/.

-

-  Ref: #9220

-  Closes #9291

-

-Sean McArthur (10 Aug 2022)

-

-- hyper: customize test1274 to how hyper unfolds headers

-

-  Closes #9217

-

-Orgad Shaneh (10 Aug 2022)

-

-- curl-config: quote directories with potential space

-

-  On Windows (at least with CMake), the default prefix is

-  C:/Program Files (x86)/CURL.

-

-  Closes #9253

-

-Oliver Roberts (10 Aug 2022)

-

-- amigaos: fix threaded resolver on AmigaOS 4.x

-

-  Replace ip4 resolution function on AmigaOS 4.x, as it requires runtime

-  feature detection and extra code to make it thread safe.

-

-  Closes #9265

-

-Emil Engler (10 Aug 2022)

-

-- imap: use ISALNUM() for alphanumeric checks

-

-  This commit replaces a self-made character check for alphanumeric

-  characters within imap_is_bchar() with the ISALNUM() macro, as it is

-  reduces the size of the code and makes the performance better, due to

-  ASCII arithmetic.

-

-  Closes #9289

-

-Daniel Stenberg (10 Aug 2022)

-

-- RELEASE-NOTES: synced

-

-Cering on github (10 Aug 2022)

-

-- connect: add quic connection information

-

-  Fixes #9286

-  Closes #9287

-

-Philip Heiduck (8 Aug 2022)

-

-- cirrus/freebsd-ci: bootstrap the pip installer

-

-  Signed-off-by: Philip H <47042125+pheiduck@users.noreply.github.com>

-

-  Closes #9213

-

-Daniel Stenberg (8 Aug 2022)

-

-- urldata: move smaller fields down in connectdata struct

-

-  By (almost) sorting the struct fields in connectdata in a decending size

-  order, having the single char ones last, we reduce the number of holes

-  in the struct and thus the amount of storage needed.

-

-  Closes #9280

-

-- ldap: adapt to conn->port now being an 'int'

-

-  Remove typecasts. Fix printf() formats.

-

-  Follow-up from 764c6bd3bf.

-  Pointed out by Coverity CID 1507858.

-

-  Closes #9281

-

-- KNOWN_BUGS: Negotiate authentication against Hadoop HDFS

-

-  Closes #8264

-

-Oliver Roberts (8 Aug 2022)

-

-- file: add handling of native AmigaOS paths

-

-  On AmigaOS 4.x, handle native absolute paths, whilst blocking relative

-  paths. Also allow unix style paths if feature enabled at link time.

-

-  Inspiration-from: Michael Trebilcock

-

-  Closes #9259

-

-Daniel Stenberg (8 Aug 2022)

-

-- KNOWN_BUGS: cmake build is not thread-safe

-

-  The cmake build does not check for and verify presence of a working

-  Atomic type, which then makes curl_global_init() to not build

-  thread-safe on non-Windows platforms.

-

-  Closes https://github.com/curl/curl/issues/8973

-  Closes https://github.com/curl/curl/pull/8982

-

-Oliver Roberts (8 Aug 2022)

-

-- configure: fixup bsdsocket detection code for AmigaOS 4.x

-

-  The code that detects bsdsocket.library for AmigaOS did not work

-  for AmigaOS 4.x. This has been fixed and also cleaned up a little

-  to reduce duplication. Wasn't technically necessary before, but is

-  required when building with AmiSSL instead of OpenSSL.

-

-  Closes #9268

-

-- tool: reintroduce set file comment code for AmigaOS

-

-  Amiga specific code which put the URL in the file comment was perhaps

-  accidentally removed in b88940850002a3f1c25bc6488b95ad30eb80d696 having

-  originally been added in 5c215bdbdfde8b2350cdcbac82aae0c914da5314.

-  Reworked to fit the code changes and added it back in.

-

-  Reported-by: Michael Trebilcock

-  Originally-added-by: Chris Young

-

-  Closes #9258

-

-Daniel Stenberg (8 Aug 2022)

-

-- urldata: make 'negnpn' use less storage

-

-  The connectdata struct field 'negnpn' never holds a value larger than

-  30, so an unsigned char saves 3 bytes struct space.

-

-  Closes #9279

-

-- urldata: make three *_proto struct fields smaller

-

-  Use 'unsigned char' for storage instead of the enum, for three GSSAPI

-  related fields in the connectdata struct.

-

-  Closes #9278

-

-- connect: set socktype/protocol correctly

-

-  So that an address used from the DNS cache that was previously used for

-  QUIC can be reused for TCP and vice versa.

-

-  To make this possible, set conn->transport to "unix" for unix domain

-  connections ... and store the transport struct field in an unsigned char

-  to use less space.

-

-  Reported-by: ウさん

-  Fixes #9274

-  Closes #9276

-

-Oliver Roberts (8 Aug 2022)

-

-- amissl: allow AmiSSL to be used with AmigaOS 4.x builds

-

-  Enable AmiSSL to be used instead of static OpenSSL link libraries.

-  for AmigaOS 4.x, as it already is in the AmigaOS 3.x build.

-

-  Closes #9269

-

-opensignature on github (8 Aug 2022)

-

-- openssl: add details to "unable to set client certificate" error

-

-  from: "curl: (58) unable to set client certificate"

-

-  to: curl: (58) unable to set client certificate [error:0A00018F:SSL

-  routines::ee key too small]

-

-  Closes #9228

-

-Oliver Roberts (8 Aug 2022)

-

-- amissl: make AmiSSL v5 a minimum requirement

-

-  AmiSSL v5 is the latest version, featuring a port of OpenSSL 3.0.

-  Support for previous OpenSSL 1.1.x versions has been dropped, so

-  makes sense to enforce v5 as the minimum requirement. This also

-  allows all the AmiSSL stub workarounds to be removed as they are

-  now provided in a link library in the AmiSSL SDK.

-

-  Closes #9267

-

-- configure: -pthread not available on AmigaOS 4.x

-

-  The most recent GCC builds for AmigaOS 4.x do not allow -pthread and

-  exit with an error. Instead, need to explictly specify -lpthread.

-

-  Closes #9266

-

-Daniel Stenberg (8 Aug 2022)

-

-- digest: pass over leading spaces in qop values

-

-  When parsing the "qop=" parameter of the digest authentication, and the

-  value is provided within quotes, the list of values can have leading

-  white space which the parser previously did not handle correctly.

-

-  Add test case 388 to verify.

-

-  Reported-by: vlubart on github

-  Fixes #9264

-  Closes #9270

-

-Evgeny Grin (Karlson2k) (7 Aug 2022)

-

-- digest: reject broken header with session protocol but without qop

-

-  Closes #9077

-

-Daniel Stenberg (7 Aug 2022)

-

-- CURLINFO_SPEED_UPLOAD/DOWNLOAD.3: fix examples

-

-  Reported-by: jvvprasad78 on github

-  Assisted-by: Jay Satiro

-  Fixes #9239

-  Closes #9241

-

-Fabian Keil (7 Aug 2022)

-

-- test44[2-4]: add '--resolve' to the keywords

-

-  ... so the tests can be automatically skipped when

-  using an external proxy like Privoxy.

-

-  Closes #9250

-

-Daniel Stenberg (7 Aug 2022)

-

-- RELEASE-NOTES: synced

-

-- CURLOPT_CONNECT_ONLY.3: clarify multi API use

-

-  Reported-by: Maxim Ivanov

-  Fixes #9244

-  Closes #9262

-

-Andrew Lambert (6 Aug 2022)

-

-- curl_easy_header: Add CURLH_PSEUDO to sanity check

-

-  Fixes #9235

-  Closes #9236

-

-Emil Engler (6 Aug 2022)

-

-- docs: add dns category to --resolve

-

-  This commit adds the dns category to the --resolve command line option,

-  because it can be interpreted as both: a low-level connection option and

-  an option related to the resolving of a hostname.

-

-  It is also not common for dns options to belong to the connection

-  category and vice versa.  --ipv4 and --ipv6 are both good examples.

-

-  Closes #9229

-

-Wyatt O'Day (2 Aug 2022)

-

-- schannel: Add TLS 1.3 support

-

-  - Support TLS 1.3 as the default max TLS version for Windows Server 2022

-    and Windows 11.

-

-  - Support specifying TLS 1.3 ciphers via existing option

-    CURLOPT_TLS13_CIPHERS (tool: --tls13-ciphers).

-

-  Closes https://github.com/curl/curl/pull/8419

-

-Emil Engler (2 Aug 2022)

-

-- cmdline-opts/gen.pl: improve performance

-

-  On some systems, the gen.pl script takes nearly two minutes for the

-  generation of the main-page, which is a completely unacceptable time.

-

-  The slow performance has two causes:

-  1. Use of a regex locale operator

-  2. Useless invokations of loops

-

-  The commit addresses the first issue by replacing the "\W" wiht

-  [^a-zA-Z0-9_], which is, according to regex101.com, functionally

-  equivalent to the previous operation, except that it is obviously

-  limited to ASCII only, which is fine, as the curl project is

-  English-only anyway.

-

-  The second issue is being addressed by only running the loop if the line

-  contains a "--" in it. The loop may be completeley removed in the

-  future.

-

-  Co-authored-by: Emanuele Torre <torreemanuele6@gmail.com>

-

-  See #8299

-  Fixes #9230

-  Closes #9232

-

-Daniel Stenberg (2 Aug 2022)

-

-- docs/cmdline: mark fail and fail-with-body as mutually exclusive

-

-  Reported-by: Andreas Sommer

-  Fixes #9221

-  Closes #9222

-

-Nao Yonashiro (2 Aug 2022)

-

-- quiche: fix build failure

-

-  Reviewed-by: Alessandro Ghedini

-  Closes #9223

-

-Viktor Szakats (2 Aug 2022)

-

-- configure.ac: drop references to deleted functions

-

-  follow-up from 4d73854462f30948acab12984b611e9e33ee41e6

-

-  Reported-by: Oliver Roberts

-  Fixes #9238

-  Closes #9240

-

-Sean McArthur (28 Jul 2022)

-

-- hyper: enable obs-folded multiline headers

-

-  Closes #9216

-

-Daniel Stenberg (28 Jul 2022)

-

-- connect: revert the use of IP*_RECVERR

-

-  The options were added in #6341 and d13179d, but cause problems: Lots of

-  POLLIN event occurs but recvfrom read nothing.

-

-  Reported-by: Tatsuhiro Tsujikawa

-  Fixes #9209

-  Closes #9215

-

-Marco Kamner (27 Jul 2022)

-

-- docs: remove him/her/he/she from documentation

-

-  Closes #9208

-

-Daniel Stenberg (27 Jul 2022)

-

-- RELEASE-NOTES: synced

-

-- tool_getparam: make --doh-url "" switch it off

-

-  A possible future addition could be to parse the URL first too to verify

-  that it is valid before trying to use it.

-

-  Assisted-by: Jay Satiro

-  Closes #9207

-

-- mailmap: add rzrymiak on github

-

-Jay Satiro (26 Jul 2022)

-

-- ngtcp2: Fix build error due to change in nghttp3 prototypes

-

-  ngtcp2/nghttp3@4a066b2 changed nghttp3_conn_block_stream and

-  nghttp3_conn_shutdown_stream_write return from int to void.

-

-  Reported-by: jurisuk@users.noreply.github.com

-

-  Fixes https://github.com/curl/curl/issues/9204

-  Closes https://github.com/curl/curl/pull/9200

-

-rzrymiak on github (26 Jul 2022)

-

-- BUGS.md: improve language

-

-  Closes #9205

-

-Philip Heiduck (26 Jul 2022)

-

-- cirrus.yml: replace py38-pip with py39-pip

-

-  Reported-by: Jay Satiro

-  Fixes #9201

-  Closes #9202

-

-Daniel Stenberg (25 Jul 2022)

-

-- tool_getparam: fix cleanarg() for unicode builds

-

-  Use the correct type, and make cleanarg an empty macro if the cleaning

-  ability is absent.

-

-  Fixes #9195

-  Closes #9196

-

-  Reviewed-by: Jay Satiro

-  Reviewed-by: Marcel Raad

-

-Marc Hoersken (25 Jul 2022)

-

-- test3026: add support for Windows using native Win32 threads

-

-  Reviewed-by: Viktor Szakats

-  Reviewed-by: Jay Satiro

-  Reviewed-by: Daniel Stenberg

-

-  Follow up to 7ade9c50b35d95d47a43880c3097bebab7a7e690

-  Closes #9012

-

-Evgeny Grin (Karlson2k) (25 Jul 2022)

-

-- digest: fix memory leak, fix not quoted 'opaque'

-

-  Fix leak regression introduced by 3a6fe0c.

-

-  Closes https://github.com/curl/curl/pull/9199

-

-Daniel Stenberg (23 Jul 2022)

-

-- tests: several enumerated type cleanups

-

-  To please icc

-

-  Closes #9179

-

-- tool_paramhlp: fix "enumerated type mixed with another type"

-

-  Warning by icc

-

-  Closes #9179

-

-- tool_writeout: fix enumerated type mixed with another type

-

-  Closes #9179

-

-- tool_cfgable: make 'synthetic_error' a plain bool

-

-  The specific reason was not used.

-

-  Closes #9179

-

-- tool_paramhlp: make check_protocol return ParameterError

-

-  "enumerated type mixed with another type"

-

-  Closes #9179

-

-- tool_formparse: fix variable may be used before its value is set

-

-  Warning by icc

-

-  Closes #9179

-

-- sendf: skip storing HTTP headers if HTTP disabled

-

-  Closes #9179

-

-- url: enumerated type mixed with another type

-

-  Follow-up to 1c58e7ae99ce2030213f28b

-

-  Closes #9179

-

-- urldata: change second proxytype field to unsigned char to match

-

-  To avoid "enumerated type mixed with another type"

-

-  Closes #9179

-

-- http: typecast the httpreq assignment to avoid icc compiler warning

-

-   error #188: enumerated type mixed with another type

-

-  Closes #9179

-

-- urldata: make state.httpreq an unsigned char

-

-  To match set.method used for the same purpose.

-

-  Closes #9179

-

-- splay: avoid using -1 in unsigned variable

-

-  To fix icc compiler warning integer conversion resulted in a change of sign

-

-  Closes #9179

-

-- sendf: store the header type in an usigned char to avoid icc warnings

-

-  Closes #9179

-

-- multi: fix the return code from Curl_pgrsDone()

-

-  It does not return a CURLcode. Detected by the icc compiler warning

-  "enumerated type mixed with another type"

-

-  Closes #9179

-

-- sendf: make Curl_debug a void function

-

-  As virtually no called checked the return code, and those that did

-  wrongly treated it as a CURLcode. Detected by the icc compiler warning:

-  enumerated type mixed with another type

-

-  Closes #9179

-

-- http_chunks: remove an assign + typecast

-

-  As it caused icc to complain: "pointer cast involving 64-bit pointed-to

-  type"

-

-  Closes #9179

-

-- vtls: make Curl_ssl_backend() return the enum type curl_sslbackend

-

-  To fix the icc warning enumerated type mixed with another type

-

-  Closes #9179

-

-- curl-compilers.m4: make icc use -diag* options and disable two warnings

-

-  -wd and -we are deprecated and are now -diag-disable and -diag-error

-

-  Disable warning 1024 and 2259

-

-  Closes #9179

-

-Matthew Thompson (23 Jul 2022)

-

-- GHA: add two Intel compiler CI jobs

-

-  Closes #9179

-

-Daniel Katz (21 Jul 2022)

-

-- curl-functions.m4: check whether atomics can link rather than just compile

-

-  Some build toolchains support C11 atomics (i.e., _Atomic types), but

-  will not link the associated atomics runtime unless a flag is passed. In

-  such an environment, linking an application with libcurl.a can fail due

-  to undefined symbols for atomic load/store functions.

-

-  I encountered this behavior when upgrading curl to 7.84.0 and attempting

-  to build with Solaris Studio 12.6. Solaris provides the flag

-  -xatomic=[gcc | studio], allowing users to link to one of two atomics

-  runtime implementations. However, if the user does not provide this

-  flag, then neither runtime is linked. This led to builds failing in CI.

-

-  Closes #9190

-

-Rosen Penev (20 Jul 2022)

-

-- curl-wolfssl.m4: add options header when building test code

-

-  Needed for certain configurations of wolfSSL. Otherwise, missing header

-  error may occur.

-

-  Tested with OpenWrt.

-

-  Closes #9187

-

-Daniel Stenberg (20 Jul 2022)

-

-- ftp: use a correct expire ID for timer expiry

-

-  This was an accurate error pointed out by the icc warning: enumerated

-  type mixed with another type

-

-  Ref: #9179

-  Closes #9184

-

-- sendf: fix paused header writes since after the header API

-

-  Regression since d1e4a67

-

-  Reported-by: Sergey Ogryzkov

-  Fixes #9180

-  Closes #9182

-

-- mprintf: fix *dyn_vprintf() when out-of-memory

-

-  Follow-up to 0e48ac1f99a. Torture-testing 1455 would lead to a memory

-  leak otherwise.

-

-  Closes #9185

-

-- curl-confopts: remove leftover AC_REQUIREs

-

-  configure.ac:3488: warning: CURL_CHECK_FUNC_IOCTL is m4_require'd but not m4_

-  defun'd

-  configure.ac:3488: warning: CURL_CHECK_FUNC_SETSOCKOPT is m4_require'd but no

-  t m4_defun'd

-

-  follow-up from 4d73854462f30

-

-  Closes #9183

-

-- file: fix icc enumerated type mixed with another type warning

-

-  Ref: #9179

-  Closes #9181

-

-Viktor Szakats (19 Jul 2022)

-

-- tidy-up: delete unused build configuration macros

-

-  Most of them feature guards:

-

-  - `CURL_INCLUDES_SYS_UIO` [1]

-  - `HAVE_ALLOCA_H` [2]

-  - `HAVE_CRYPTO_CLEANUP_ALL_EX_DATA` (unused since de71e68000c8624ea13f90b136f

-  8734dd0fb1bdc)

-  - `HAVE_DLFCN_H`

-  - `HAVE_DLOPEN`

-  - `HAVE_DOPRNT`

-  - `HAVE_FCNTL`

-  - `HAVE_GETHOSTBYNAME` [3]

-  - `HAVE_GETOPT_H`

-  - `HAVE_GETPASS`

-  - `HAVE_GETPROTOBYNAME`

-  - `HAVE_GETSERVBYNAME`

-  - `HAVE_IDN_FREE*`

-  - `HAVE_INET_ADDR`

-  - `HAVE_IOCTL`

-  - `HAVE_KRB4`

-  - `HAVE_KRB_GET_OUR_IP_FOR_REALM`

-  - `HAVE_KRB_H`

-  - `HAVE_LDAPSSL_H`

-  - `HAVE_LDAP_INIT_FD`

-  - `HAVE_LIBDL`

-  - `HAVE_LIBNSL`

-  - `HAVE_LIBRESOLV*`

-  - `HAVE_LIBUCB`

-  - `HAVE_LL`

-  - `HAVE_LOCALTIME_R`

-  - `HAVE_MALLOC_H`

-  - `HAVE_MEMCPY`

-  - `HAVE_MEMORY_H`

-  - `HAVE_NETINET_IF_ETHER_H`

-  - `HAVE_NI_WITHSCOPEID`

-  - `HAVE_OPENSSL_CRYPTO_H`

-  - `HAVE_OPENSSL_ERR_H`

-  - `HAVE_OPENSSL_PEM_H`

-  - `HAVE_OPENSSL_PKCS12_H`

-  - `HAVE_OPENSSL_RAND_H`

-  - `HAVE_OPENSSL_RSA_H`

-  - `HAVE_OPENSSL_SSL_H`

-  - `HAVE_OPENSSL_X509_H`

-  - `HAVE_PEM_H`

-  - `HAVE_POLL`

-  - `HAVE_RAND_SCREEN`

-  - `HAVE_RAND_STATUS`

-  - `HAVE_RECVFROM`

-  - `HAVE_SETSOCKOPT`

-  - `HAVE_SETVBUF`

-  - `HAVE_SIZEOF_LONG_DOUBLE`

-  - `HAVE_SOCKIO_H`

-  - `HAVE_SOCK_OPTS`

-  - `HAVE_STDIO_H`

-  - `HAVE_STRCASESTR`

-  - `HAVE_STRFTIME`

-  - `HAVE_STRLCAT`

-  - `HAVE_STRNCMPI`

-  - `HAVE_STRNICMP`

-  - `HAVE_STRSTR`

-  - `HAVE_STRUCT_IN6_ADDR`

-  - `HAVE_TLD_H`

-  - `HAVE_TLD_STRERROR`

-  - `HAVE_UNAME`

-  - `HAVE_USLEEP`

-  - `HAVE_WINBER_H`

-  - `HAVE_WRITEV`

-  - `HAVE_X509_H`

-  - `LT_OBJDIR`

-  - `NEED_BASENAME_PROTO`

-  - `NOT_NEED_LIBNSL`

-  - `OPENSSL_NO_KRB5`

-  - `RECVFROM_TYPE*`

-  - `SIZEOF_LONG_DOUBLE`

-  - `STRERROR_R_TYPE_ARG3`

-  - `USE_YASSLEMUL`

-  - `_USRDLL` (from CMake) [4]

-

-  [1] Related parts in `m4/curl-functions.m4` and `configure.ac` might

-      also be deleted.

-

-  [2] Related comment can possibly be deleted in

-      `packages/vms/generate_config_vms_h_curl.com`.

-

-  [3] There are more instances of this in autotools, but I did not dare to

-      touch those. Looked like it's used to detect socket support.

-

-  [4] This is necessary for MFC (Microsoft Foundation Class) DLLs to

-      force linking MFC components statically to the DLL. `libcurl.dll`

-      does not use MFC, so we can delete this define.

-      Ref: https://docs.microsoft.com/cpp/build/regular-dlls-statically-linked-

-  to-mfc

-

-  Script that can help finding unused settings like above:

-  ```shell

-

-  autoheader configure.ac  # generate lib/curl_config.h.in

-

-  {

-    grep -o -E    'set\([A-Z][A-Z0-9_]{3,}'          CMake/Platforms/WindowsCac

-  he.cmake | sed -E 's|set\(||g'

-    grep -o -E -h '#define +[A-Z][A-Z0-9_]{3,}'      lib/config-*.h            

-           | sed -E 's|#define +||g'

-    grep -o -E    '#cmakedefine +[A-Z][A-Z0-9_]{3,}' lib/curl_config.h.cmake   

-           | sed -E 's|#cmakedefine +||g'

-    grep -o -E    '#undef +[A-Z][A-Z0-9_]{3,}'       lib/curl_config.h.in      

-           | sed -E 's|#undef +||g'

-  } | sort -u | grep -v -F 'HEADER_CURL_' | while read -r def; do

-    c="$(git grep -w -F "${def}" | grep -v -E -c '(/libcurl\.tmpl|^lib/config-|

-  ^lib/curl_config\.h\.cmake|^CMakeLists\.txt|^CMake/Platforms/WindowsCache\.cm

-  ake|^packages/vms/config_h\.com|^m4/curl-functions\.m4|^acinclude\.m4|^config

-  ure\.ac)')"

-    if [ "${c}" = '0' ]; then

-      echo "${def}"

-    fi

-  done

-  ```

-

-  Reviewed-by: Daniel Stenberg

-  Closes #9044

-

-Daniel Stenberg (19 Jul 2022)

-

-- RELEASE-NOTES: synced

-

-- cookie: treat a blank domain in Set-Cookie: as non-existing

-

-  This matches what RFC 6265 section 5.2.3 says.

-

-  Extended test 31 to verify.

-

-  Fixes #9164

-  Reported-by: Gwen Shapira

-  Closes #9177

-

-Patrick Monnerat (19 Jul 2022)

-

-- base64: base64url encoding has no padding

-

-  See RFC4648 section 5 and RFC7540 section 3.2.1.

-

-  Suppress generation of '=' padding of base64url encoding. This is

-  accomplished by considering the string beginning at offset 64 in the

-  character table as the padding: this is "=" for base64, "" for base64url.

-

-  Also use strchr() to replace character search loops where possible.

-

-  Suppress erroneous comments about empty encoding results.

-

-  Adjust unit test 1302 to unpadded base64url encoding and add tests for

-  empty results.

-

-  Closes #9139

-

-Daniel Stenberg (19 Jul 2022)

-

-- easyoptions: fix icc warning

-

-      easyoptions.c(360): error #188: enumerated type mixed with another type

-

-  Ref: #9156

-  Reported-by: Matthew Thompson

-  Closes #9176

-

-lwthiker (19 Jul 2022)

-

-- h2h3: fix overriding the 'TE: Trailers' header

-

-  A 'TE: Trailers' header is explicitly replaced by 'te: trailers'

-  (lowercase) in Curl_pseudo_headers() when building the list of HTTP/2 or

-  HTTP/3 headers. However, this is then replaced again by the original

-  value due to a bug, resulting in the uppercased version being sent. Some

-  HTTP/2 servers reject the whole HTTP/2 stream when this is the case.

-

-  Closes #9170

-

-Daniel Stenberg (18 Jul 2022)

-

-- lib3026: reduce the number of threads to 100

-

-  Down from 1000, to make it run and work in more systems.

-

-  Fixes #9172

-  Reported-by: Érico Nogueira Rolim

-  Closes #9173

-

-- doh: move doh related struct definitions to doh.h

-

-  and make 'dnstype' in 'struct dnsprobe' use the DNStype to fix the icc compil

-  er warning:

-

-    doh.c(924): error #188: enumerated type mixed with another type

-

-  Reported-by: Matthew Thompson

-  Ref #9156

-  Closes #9174

-

-Viktor Szakats (17 Jul 2022)

-

-- Makefile.m32: stop trying to build libcares.a [ci skip]

-

-  Before this patch, `lib/Makefile.m32` had a rule to build `libcares.a` in

-  `-cares`-enabled builds, via c-ares's own `Makefile.m32`. Committed in

-  2007 [1]. The commit message doesn't specifically address this particular

-  change. This logic comes from the times when c-ares was part of the curl

-  source tree, hence the special treatment.

-

-  This feature creates problems when building c-ares first, using CMake

-  and pointing `LIBCARES_PATH` to its install prefix, where `Makefile.m32`

-  is missing in such case. A sub-build for c-ares is undesired also when

-  c-ares had already been build via its own `Makefile.m32`.

-

-  To avoid the sub-build, this patch deletes its Makefile rule. After this

-  patch `libcares.a` needs to be manually built before using it in

-  `Makefile.m32`. Aligning it with the rest of dependencies.

-

-  [1] 46c92c0b806da041d7a5c6fb64dbcdc474d99b31

-

-  Reviewed-by: Daniel Stenberg

-  Closes #9169

-

-Daniel Stenberg (17 Jul 2022)

-

-- curl: writeout: fix repeated header outputs

-

-  The function stored a terminating zero into the buffer for convenience,

-  but when on repeated calls that would cause problems. Starting now, the

-  passed in buffer is not modified.

-

-  Reported-by: highmtworks on github

-  Fixes #9150

-  Closes #9152

-

-- curl_multi_timeout.3: clarify usage

-

-  Fixes #9155

-  Closes #9157

-  Reported-by: jvvprasad78 on github

-

-- mprintf: make dprintf_formatf never return negative

-

-  This function no longer returns a negative value if the formatting

-  string is bad since the return value would sometimes be propagated as a

-  return code from the mprintf* functions and they are documented to

-  return the length of the output. Which cannot be negative.

-

-  Fixes #9149

-  Closes #9151

-  Reported-by: yiyuaner on github