quic: make eyeballers connect retries stop at weird replies

- when a connect immediately goes into DRAINING state, do
not attempt retries in the QUIC connection filter. Instead,

quic: make eyeballers connect retries stop at weird replies

- when a connect immediately goes into DRAINING state, do
not attempt retries in the QUIC connection filter. Instead,
return CURLE_WEIRD_SERVER_REPLY
- When eyeballing, interpret CURLE_WEIRD_SERVER_REPLY as an
inconclusive answer. When all addresses have been attempted,
rewind the address list once on an inconclusive answer.
- refs #11832 where connects were retried indefinitely until
the overall timeout fired

Closes #12400

show more ...

CI: verify libcurl function SYNPOSIS sections

With the .github/scripits/verify-synopsis.pl script

Closes #12402

docs/libcurl: SYNSOPSIS cleanup

- use the correct include file
- make sure they are declared as in the header file
- fix minor nroff syntax mistakes (missing .fi)

These are

docs/libcurl: SYNSOPSIS cleanup

- use the correct include file
- make sure they are declared as in the header file
- fix minor nroff syntax mistakes (missing .fi)

These are verified by verify-synopsis.pl, which extracts the SYNPOSIS
code and runs it through gcc.

Closes #12402

show more ...

sendf: fix comment typo

fopen: allocate the dir after fopen

Move the allocation of the directory name down to after the fopen() call
to allow that shortcut code path to avoid a superfluous malloc+free
cycle

fopen: allocate the dir after fopen

Move the allocation of the directory name down to after the fopen() call
to allow that shortcut code path to avoid a superfluous malloc+free
cycle.

Follow-up to 73b65e94f35311

Closes #12398

show more ...

transfer: cleanup done+excess handling

- add `SingleRequest->download_done` as indicator that
all download bytes have been received
- remove `stop_reading` bool from readwrite func

transfer: cleanup done+excess handling

- add `SingleRequest->download_done` as indicator that
all download bytes have been received
- remove `stop_reading` bool from readwrite functions
- move excess body handling into client download writer

Closes #12371

show more ...

fopen: create new file using old file's mode

Because the function renames the temp file to the target name as a last
step, if the file was previously owned by a different user, not ORing

fopen: create new file using old file's mode

Because the function renames the temp file to the target name as a last
step, if the file was previously owned by a different user, not ORing
the old mode could otherwise end up creating a file that was no longer
readable by the original owner after save.

Reported-by: Loïc Yhuel
Fixes #12299
Closes #12395

show more ...

test1476: require proxy

Follow-up from 323df4261c3542

Closes #12394

fopen: create short(er) temporary file name

Only using random letters in the name plus a ".tmp" extension. Not by
appending characters to the final file name.

Reported-by: Maksy

fopen: create short(er) temporary file name

Only using random letters in the name plus a ".tmp" extension. Not by
appending characters to the final file name.

Reported-by: Maksymilian Arciemowicz

Closes #12388

show more ...

tests: git ignore generated second-hsts.txt file

File is generated in test lib1900

Follow-up to 7cb03229d9e9c5

Closes #12393

openssl: enable `infof_certstack` for 1.1 and LibreSSL 3.6

Lower the barrier to enable `infof_certstack()` from OpenSSL 3 to
OpenSSL 1.1.x, and LibreSSL 3.6 or upper.

With the c

openssl: enable `infof_certstack` for 1.1 and LibreSSL 3.6

Lower the barrier to enable `infof_certstack()` from OpenSSL 3 to
OpenSSL 1.1.x, and LibreSSL 3.6 or upper.

With the caveat, that "group name" and "type name" are missing from
the log output with these TLS backends.

Follow-up to b6e6d4ff8f253c8b8055bab9d4d6a10f9be109f3 #12030

Reviewed-by: Daniel Stenberg
Closes #12385

show more ...

urldata: fix typo in comment

CI: codespell

The list of words to ignore is in the file
.github/scripts/codespell-ignore.txt

Closes #12390

lib: fix comment typos

Five separate ones, found by codespell

Closes #12390

test1476: verify cookie PSL mixed case

cookie: lowercase the domain names before PSL checks

Reported-by: Harry Sintonen

Closes #12387

openssl: fix building with v3 `no-deprecated` + add CI test

- build quictls with `no-deprecated` in CI to have test coverage for
this OpenSSL 3 configuration.

- don't call `Op

openssl: fix building with v3 `no-deprecated` + add CI test

- build quictls with `no-deprecated` in CI to have test coverage for
this OpenSSL 3 configuration.

- don't call `OpenSSL_add_all_algorithms()`, `OpenSSL_add_all_digests()`.
The caller code is meant for OpenSSL 3, while these two functions were
only necessary before OpenSSL 1.1.0. They are missing from OpenSSL 3
if built with option `no-deprecated`, causing build errors:
```
vtls/openssl.c:4097:3: error: call to undeclared function 'OpenSSL_add_all_algorithms'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
vtls/openssl.c:4098:3: error: call to undeclared function 'OpenSSL_add_all_digests'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
```
Ref: https://ci.appveyor.com/project/curlorg/curl-for-win/builds/48587418?fullLog=true#L7667

Regression from b6e6d4ff8f253c8b8055bab9d4d6a10f9be109f3 #12030
Bug: https://github.com/curl/curl/issues/12380#issuecomment-1822944669
Reviewed-by: Alex Bozarth

- vquic/curl_ngtcp2: fix using `SSL_get_peer_certificate` with
`no-deprecated` quictls 3 builds.
Do it by moving an existing solution for this from `vtls/openssl.c`
to `vtls/openssl.h` and adjusting caller code.
```
vquic/curl_ngtcp2.c:1950:19: error: implicit declaration of function 'SSL_get_peer_certificate'; did you mean 'SSL_get1_peer_certificate'? [-Wimplicit-function-declaration]
```
Ref: https://github.com/curl/curl/actions/runs/6960723097/job/18940818625#step:24:1178

- curl_ntlm_core: fix `-Wunused-parameter`, `-Wunused-variable` and
`-Wunused-function` when trying to build curl with NTLM enabled but
without the necessary TLS backend (with DES) support.

Closes #12384

show more ...

curl.h: delete Symbian OS references

curl deprecated Symbian OS in 3d64031fa7a80ac4ae3fd09a5939196268b92f81
via #5989. Delete references to it from public headers, because there
is n

curl.h: delete Symbian OS references

curl deprecated Symbian OS in 3d64031fa7a80ac4ae3fd09a5939196268b92f81
via #5989. Delete references to it from public headers, because there
is no fresh release to use those headers with.

Reviewed-by: Dan Fandrich
Reviewed-by: Jay Satiro
Closes #12378

show more ...

windows: use built-in `_WIN32` macro to detect Windows

Windows compilers define `_WIN32` automatically. Windows SDK headers
or build env defines `WIN32`, or we have to take care of it. T

windows: use built-in `_WIN32` macro to detect Windows

Windows compilers define `_WIN32` automatically. Windows SDK headers
or build env defines `WIN32`, or we have to take care of it. The
agreement seems to be that `_WIN32` is the preferred practice here.
Make the source code rely on that to detect we're building for Windows.

Public `curl.h` was using `WIN32`, `__WIN32__` and `CURL_WIN32` for
Windows detection, next to the official `_WIN32`. After this patch it
only uses `_WIN32` for this. Also, make it stop defining `CURL_WIN32`.

There is a slight chance these break compatibility with Windows
compilers that fail to define `_WIN32`. I'm not aware of any obsolete
or modern compiler affected, but in case there is one, one possible
solution is to define this macro manually.

grepping for `WIN32` remains useful to discover Windows-specific code.

Also:

- extend `checksrc` to ensure we're not using `WIN32` anymore.

- apply minor formatting here and there.

- delete unnecessary checks for `!MSDOS` when `_WIN32` is present.

Co-authored-by: Jay Satiro
Reviewed-by: Daniel Stenberg

Closes #12376

show more ...

url: ConnectionExists revisited

- have common pattern of `if not match, continue`
- revert pages long if()s to return early
- move dead connection check to later since it may
b

url: ConnectionExists revisited

- have common pattern of `if not match, continue`
- revert pages long if()s to return early
- move dead connection check to later since it may
be relatively expensive
- check multiuse also when NOT building with NGHTTP2
- for MULTIUSE bundles, verify that the inspected
connection indeed supports multiplexing when in use
(bundles may contain a mix of connection, afaict)

Closes #12373

show more ...

CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range

... or use the default value.

Also clarify the documentation language somewhat.

Closes #12382

urldata: make maxconnects a 32 bit value

"2^32 idle connections ought to be enough for anybody"

Closes #12375

FEATURES: update the URL phrasing

The URL is length limited since a while back so "no limit" simply is not
true anymore. Mention the URL RFC standard used instead.

Closes #12383

wolfssh: remove redundant static prototypes

vssh/wolfssh.c:346:18: error: redundant redeclaration of ‘wscp_recv’ [-Werror=redundant-decls]

Closes #12381

setopt: remove superfluous use of ternary expressions

Closes #12374