TLS: add support for ECH (Encrypted Client Hello)

An EXPERIMENTAL feature used with CURLOPT_ECH and --ech.

Closes #11922

build: prefer `USE_IPV6` macro internally (was: `ENABLE_IPV6`)

Before this patch, two macros were used to guard IPv6 features in curl
sources: `ENABLE_IPV6` and `USE_IPV6`. This patch ma

build: prefer `USE_IPV6` macro internally (was: `ENABLE_IPV6`)

Before this patch, two macros were used to guard IPv6 features in curl
sources: `ENABLE_IPV6` and `USE_IPV6`. This patch makes the source use
the latter for consistency with other similar switches.

`-DENABLE_IPV6` remains accepted for compatibility as a synonym for
`-DUSE_IPV6`, when passed to the compiler.

`ENABLE_IPV6` also remains the name of the CMake and `Makefile.vc`
options to control this feature.

Closes #13349

show more ...

file: add support for getting basic directory listings

Not supported on Windows (yet)

Closes #13137

build: remove MacOSX-Framework script

I don't think this is much used these days.

Also remove the libcurl.plist file used (only) by this script

Closes #13313

NTLM_WB: drop support

The feature has not worked for months and has been marked as DEPRECATED
for six+ months.

Closes #13249

configure: make --disable-docs imply --disable-manual

Because when the docs is not built, the necesary curl.txt file is not
present so then the manual cannot get built.

Reported

configure: make --disable-docs imply --disable-manual

Because when the docs is not built, the necesary curl.txt file is not
present so then the manual cannot get built.

Reported-by: Harry Sintonen
Closes #13191

show more ...

docs: ascii version of manpage without nroff

Create ASCII version of manpage without nroff

- build src/tool_hugegelp.c from the ascii manpage
- move the the manpage and the as

docs: ascii version of manpage without nroff

Create ASCII version of manpage without nroff

- build src/tool_hugegelp.c from the ascii manpage
- move the the manpage and the ascii version build to docs/cmdline-opts
- remove all use of nroff from the build process
- should make the build entirely reproducible (by avoiding nroff)

- partly reverts 2620aa9 to build libcurl option man pages one by one
in cmake because the appveyor builds got all crazy until I did

The ASCII version of the manpage

- is built with gen.pl, just like the manpage is
- has a right-justified column making the appearance similar to the previous
version
- uses a 4-space indent per level (instead of the old version's 7)
- does not do hyphenation of words (which nroff does)

History

We first made the curl build use nroff for building the hugehelp file in
December 1998, for curl 5.2.

Closes #13047

show more ...

configure: build & install shell completions when enabled

The --with-fish-functions-dir and --with-zsh-functions-dir options
currently have no effect on a normal build because the script

configure: build & install shell completions when enabled

The --with-fish-functions-dir and --with-zsh-functions-dir options
currently have no effect on a normal build because the scripts/ directory
where they're used is not built. Add scripts/ to a normal build and
change the completion options to default to off to preserve the existing
behaviour.

Closes: #12906

show more ...

configure.ac: find libpsl with pkg-config

Find libpsl with pkg-config to avoid static build failures.

Ref: http://autobuild.buildroot.org/results/1fb15e1a99472c403d0d3b1a688902f32e7

configure.ac: find libpsl with pkg-config

Find libpsl with pkg-config to avoid static build failures.

Ref: http://autobuild.buildroot.org/results/1fb15e1a99472c403d0d3b1a688902f32e78d002

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Closes #12947

show more ...

configure: add warning for using TLS libraries without 1.3 support

Closes #12900

configure: do not link with nghttp3 unless necessary

Fixes #12833
Closes #12864
Reported-by: Ryan Carsten Schmidt

configure: add --disable-docs flag

Building man pages from curldown sources now requires perl. Add a
--disable-docs flag to configure to enable building and installing
without docume

configure: add --disable-docs flag

Building man pages from curldown sources now requires perl. Add a
--disable-docs flag to configure to enable building and installing
without documentation where perl is not available or man pages are not
required. This is selected automatically (with a warning) when perl is
not found by configure.

Fixes #12832
Closes #12857

show more ...

lib: error out on multissl + http3

Since the QUIC/h3 code has no knowledge or handling of multissl it might
bring unintended consequences if we allow it.

configure, cmake and cu

lib: error out on multissl + http3

Since the QUIC/h3 code has no knowledge or handling of multissl it might
bring unintended consequences if we allow it.

configure, cmake and curl_setup.h all now reject this combination.

Assisted-by: Viktor Szakats
Assisted-by: Gisle Vanem
Ref: #12806
Closes #12807

show more ...

configure: add libngtcp2_crypto_boringssl detection

If OpenSSL is found to be BoringSSL or AWS-LC, and ngtcp2 is requested,
try to detect libngtcp2_crypto_boringssl.

Reported-by

configure: add libngtcp2_crypto_boringssl detection

If OpenSSL is found to be BoringSSL or AWS-LC, and ngtcp2 is requested,
try to detect libngtcp2_crypto_boringssl.

Reported-by: ウさん
Fixes #12724
Closes #12769

show more ...

http3: initial support for OpenSSL 3.2 QUIC stack

- HTTP/3 for curl using OpenSSL's own QUIC stack together
with nghttp3
- configure with `--with-openssl-quic` to enable curl to

http3: initial support for OpenSSL 3.2 QUIC stack

- HTTP/3 for curl using OpenSSL's own QUIC stack together
with nghttp3
- configure with `--with-openssl-quic` to enable curl to
build this. This requires the nghttp3 library
- implementation with the following restrictions:
* macOS has to use an unconnected UDP socket due to an
issue in OpenSSL's datagram implementation
See https://github.com/openssl/openssl/issues/23251
This makes connections to non-reponsive servers hang.
* GET requests will send the indicator that they have
no body in a separate QUIC packet. This may result
in processing delays or Transfer-Encodings on proxied
requests
* uploads that encounter blocks will use 100% cpu as
detection of these flow control issue is not working
(we have not figured out to pry that from OpenSSL).

Closes #12734

show more ...

configure: when enabling QUIC, check that TLS supports QUIC

Most importantly perhaps is when using OpenSSL that the used
build/flavor has the QUIC API: the vanilla OpenSSL does not, only

configure: when enabling QUIC, check that TLS supports QUIC

Most importantly perhaps is when using OpenSSL that the used
build/flavor has the QUIC API: the vanilla OpenSSL does not, only
BoringSSL, libressl, AWS-LC and quictls do.

Ref: https://github.com/curl/curl/commit/5d044ad9480a9f556f4b6a252d7533b1ba7fe57e#r136780413

Closes #12683

show more ...

configure: make libpsl detection failure cause error

To force users to explictily disable it if they really don't want it
used and make it harder to accidentally miss it.

--with

configure: make libpsl detection failure cause error

To force users to explictily disable it if they really don't want it
used and make it harder to accidentally miss it.

--without-libpsl is the option to use if PSL is not wanted.

Closes #12661

show more ...

configure: fix no default int compile error in ipv6 detection

Closes #12607

windows: delete redundant headers

`winsock2.h` pulls in `windows.h`. `ws2tcpip.h` pulls in `winsock2.h`.
`winsock2.h` and `ws2tcpip.h` are also pulled by `curl/curl.h`.

Keep onl

windows: delete redundant headers

`winsock2.h` pulls in `windows.h`. `ws2tcpip.h` pulls in `winsock2.h`.
`winsock2.h` and `ws2tcpip.h` are also pulled by `curl/curl.h`.

Keep only those headers that are not already included, or the code under
it uses something from that specific header.

Closes #12539

show more ...

build: delete unused `HAVE_{GSSHEIMDAL,GSSMIT,HEIMDAL}`

Stop setting `HAVE_GSSHEIMDAL`, `HAVE_GSSMIT` and `HAVE_HEIMDAL`.
There was no place in the build system or source code that used

build: delete unused `HAVE_{GSSHEIMDAL,GSSMIT,HEIMDAL}`

Stop setting `HAVE_GSSHEIMDAL`, `HAVE_GSSMIT` and `HAVE_HEIMDAL`.
There was no place in the build system or source code that used them.

Reviewed-by: Daniel Stenberg
Closes #12506

show more ...

build: remove redundant `CURL_PULL_*` settings

These macros were not propagated to the source code from CMake.

autotools set only one of them (`CURL_PULL_SYS_POLL_H`), initially to

build: remove redundant `CURL_PULL_*` settings

These macros were not propagated to the source code from CMake.

autotools set only one of them (`CURL_PULL_SYS_POLL_H`), initially to
address an AIX issue [1]. This later broke when introducing `system.h`
[2] without the logic it enabled. A subsequent fix [3] re-added the
logic, and also enabled it for AIX before its use, directly in
`system.h`.

[1] 2012-11-23: 665adcd4b7bcdb7deb638cdc499fbe71f8d777f2
[2] 2017-03-29: 9506d01ee50d5908138ebad0fd9fbd39b66bd64d #1373
[3] 2017-08-25: 8a84fcc4b59e8b78d2acc6febf44a43d6bc81b59 #1828 #1833

Reviewed-by: Daniel Stenberg
Closes #12502

show more ...

windows: simplify detecting and using system headers

- autotools, cmake: assume that if we detect Windows, `windows.h`,
`winsock2.h` and `ws2tcpip.h` do exist.
- lib: fix 3 outlier

windows: simplify detecting and using system headers

- autotools, cmake: assume that if we detect Windows, `windows.h`,
`winsock2.h` and `ws2tcpip.h` do exist.
- lib: fix 3 outlier `#if` conditions to use `USE_WINSOCK` instead of
looking for `winsock2.h`.
- autotools: merge 3 Windows check methods into one.
- move Watt-32 and lwIP socket support to `setup-win32.h` from
`config-win32.h`. It opens up using these with all build tools. Also
merge logic with Windows Sockets.
- fix to assume Windows sockets with the mingw32ce toolchain.
Follow-up to: 2748c64d605b19fb419ae56810ad8da36487a2d4
- cmake: delete unused variable `signature_call_conv` since
eb33ccd5332435fa50f1758e5debb869c6942b7f.
- autotools: simplify `CURL_CHECK_WIN32_LARGEFILE` detection.
- examples/externalsocket: fix header order.
- cmake/OtherTests.cmake: delete Windows-specific `_source_epilogue`
that wasn't used anymore.
- cmake/OtherTests.cmake: set `WIN32_LEAN_AND_MEAN` for test
`SIZEOF_STRUCT_SOCKADDR_STORAGE`.

After this patch curl universally uses `_WIN32` to guard
Windows-specific logic. It guards Windows Sockets-specific logic with
`USE_WINSOCK` (this might need further work).

Reviewed-by: Jay Satiro
Closes #12495

show more ...

curl: show ipfs and ipns as supported "protocols"

They are accepted schemes in URLs passed to curl (the tool, not the
library).

Also makes curl-config show the same list.

curl: show ipfs and ipns as supported "protocols"

They are accepted schemes in URLs passed to curl (the tool, not the
library).

Also makes curl-config show the same list.

Co-Authored-by: Jay Satiro
Reported-by: Chara White
Bug: https://curl.se/mail/archive-2023-12/0026.html
Closes #12508

show more ...

build: fix Windows ADDRESS_FAMILY detection

- Include winsock2.h for Windows ADDRESS_FAMILY detection.

Prior to this change cmake detection didn't work because it included
ws2de

build: fix Windows ADDRESS_FAMILY detection

- Include winsock2.h for Windows ADDRESS_FAMILY detection.

Prior to this change cmake detection didn't work because it included
ws2def.h by itself, which is missing needed types from winsock2.h.

Prior to this change autotools detection didn't work because it did not
include any Windows header.

In both cases libcurl would fall back on unsigned short as the address
family type, which is the same as ADDRESS_FAMILY.

Co-authored-by: Viktor Szakats

Closes https://github.com/curl/curl/pull/12441

show more ...

fopen: create new file using old file's mode

Because the function renames the temp file to the target name as a last
step, if the file was previously owned by a different user, not ORing

fopen: create new file using old file's mode

Because the function renames the temp file to the target name as a last
step, if the file was previously owned by a different user, not ORing
the old mode could otherwise end up creating a file that was no longer
readable by the original owner after save.

Reported-by: Loïc Yhuel
Fixes #12299
Closes #12395

show more ...