url: allow non-HTTPS HSTS-matching for debug builds

Closes #9728

test1275: remove the check of stderr

To avoid the mysterious test failures on Windows, instead rely on the
error code returned on failure.

Fixes #9716
Closes #9723

lib: set more flags in config-win32.h

The goal is to add any flag that affect the created binary, to get in
sync with the ones built with CMake and autotools.

I took these flags

lib: set more flags in config-win32.h

The goal is to add any flag that affect the created binary, to get in
sync with the ones built with CMake and autotools.

I took these flags from curl-for-win [0], where they've been tested with
mingw-w64 and proven to work well.

This patch brings them to curl as follows:

- Enable unconditionally those force-enabled via
`CMake/WindowsCache.cmake`:

- `HAVE_SETJMP_H`
- `HAVE_STRING_H`
- `HAVE_SIGNAL` (CMake equivalent is `HAVE_SIGNAL_FUNC`)

- Expand existing guards with mingw-w64:

- `HAVE_STDBOOL_H`
- `HAVE_BOOL_T`

- Enable Win32 API functions for Windows Vista and later:

- `HAVE_INET_NTOP`
- `HAVE_INET_PTON`

- Set sizes, if not already set:

- `SIZEOF_OFF_T = 8`
- `_FILE_OFFSET_BITS = 64` when `USE_WIN32_LARGE_FILES` is set,
and using mingw-w64.

- Add the remaining for mingw-w64 only. Feel free to expand as desired:

- `HAVE_LIBGEN_H`
- `HAVE_FTRUNCATE`
- `HAVE_BASENAME`
- `HAVE_STRTOK_R`

Future TODO:

- `HAVE_SIGNAL` has a different meaning in CMake. It's enabled when both
the `signal()` function and the `SIGALRM` macro are found. In
autotools and this header, it means the function only. For the
function alone, CMake uses `HAVE_SIGNAL_FUNC`.

[0] https://github.com/curl/curl-for-win/blob/c9b9a5f273c94c73d2b565ee892c4dff0ca97a8c/curl-m32.sh#L53-L58

Reviewed-by: Daniel Stenberg

Closes #9712

show more ...

tests: add tests/markdown-uppercase.pl to dist tarball

Follow-up to aafb06c5928183d

Closes #9722

tool_paramhelp: asserts verify maximum sizes for string loading

The two defines MAX_FILE2MEMORY and MAX_FILE2STRING define the largest
strings accepted when loading files into memory, bu

tool_paramhelp: asserts verify maximum sizes for string loading

The two defines MAX_FILE2MEMORY and MAX_FILE2STRING define the largest
strings accepted when loading files into memory, but as the size is
later used as input to functions that take the size as 'int' as
argument, the sizes must not be larger than INT_MAX.

These two new assert()s make the code error out if someone would bump
the sizes without this consideration.

Reported-by Trail of Bits

Closes #9719

show more ...

http: try parsing Retry-After: as a number first

Since the date parser allows YYYYMMDD as a date format (due to it being
a bit too generic for parsing this particular header), a large in

http: try parsing Retry-After: as a number first

Since the date parser allows YYYYMMDD as a date format (due to it being
a bit too generic for parsing this particular header), a large integer
number could wrongly match that pattern and cause the parser to generate
a wrong value.

No date format accepted for this header starts with a decimal number, so
by reversing the check and trying a number first we can deduct that if
that works, it was not a date.

Reported-by Trail of Bits

Closes #9718

show more ...

doc: fix deprecation versions inconsistencies

Ref: https://curl.se/mail/lib-2022-10/0026.html

Closes #9711

http_aws_sigv4: fix strlen() check

The check was off-by-one leading to buffer overflow.

Follow-up to 29c4aa00a16872

Detected by OSS-Fuzz

Closes #9714

curl/main_checkfds: check the fcntl return code better

fcntl() can (in theory) return a non-zero number for success, so a
better test for error is checking for -1 explicitly.

Fo

curl/main_checkfds: check the fcntl return code better

fcntl() can (in theory) return a non-zero number for success, so a
better test for error is checking for -1 explicitly.

Follow-up to 41e1b30ea1b77e9ff

Mentioned-by: Dominik Klemba

Closes #9708

show more ...

tidy-up: delete unused HAVE_STRUCT_POLLFD

It was only defined in `lib/config-win32.h`, when building for Vista.

It was only used in `select.h`, in a condition that also included a

tidy-up: delete unused HAVE_STRUCT_POLLFD

It was only defined in `lib/config-win32.h`, when building for Vista.

It was only used in `select.h`, in a condition that also included a
check for `POLLIN` which is a superior choice for this detection and
which was already used by cmake and autotools builds.

Delete both instances of this macro.

Closes #9707

show more ...

test1275: verify upercase after period in markdown

Script based on the #9474 pull-request logic, but implemented in perl.

Updated docs/URL-SYNTAX.md accordingly.

Suggested-

test1275: verify upercase after period in markdown

Script based on the #9474 pull-request logic, but implemented in perl.

Updated docs/URL-SYNTAX.md accordingly.

Suggested-by: Dan Fandrich

Closes #9697

show more ...

misc: nitpick grammar in comments/docs

because the 'u' in URL is actually a consonant *sound* it is only
correct to write "a URL"

sorry this is a bit nitpicky :P

https:

misc: nitpick grammar in comments/docs

because the 'u' in URL is actually a consonant *sound* it is only
correct to write "a URL"

sorry this is a bit nitpicky :P

https://english.stackexchange.com/questions/152/when-should-i-use-a-vs-an
https://www.techtarget.com/whatis/feature/Which-is-correct-a-URL-or-an-URL

Closes #9699

show more ...

Makefile.m32: drop CROSSPREFIX and our CC/AR defaults [ci skip]

This patch aimed to fix a regression [0], where `CC` initialization
moved beyond its first use. But, on closer inspection

Makefile.m32: drop CROSSPREFIX and our CC/AR defaults [ci skip]

This patch aimed to fix a regression [0], where `CC` initialization
moved beyond its first use. But, on closer inspection it turned out that
the `CC` initialization does not work as expected due to GNU Make
filling it with `cc` by default. So unless implicit values were
explicitly disabled via a GNU Make option, the default value of
`$CROSSPREFIX` + `gcc` was never used. At the same time the implicit
value `cc` maps to `gcc` in (most/all?) MinGW envs.

`AR` has the same issue, with a default value of `ar`.

We could reintroduce a separate variable to fix this without ill
effects, but for simplicity and flexibility, it seems better to drop
support for `CROSSPREFIX`, along with our own `CC`/`AR` init logic, and
require the caller to initialize `CC`, `AR` and `RC` to the full
(prefixed if necessary) names of these tools, as desired.

We keep `RC ?= windres` because `RC` is empty by default.

Also fix grammar in a comment.

[0] 10fbd8b4e3f83b967fd9ad9a41ab484c0e7e7ca3

Closes #9698

show more ...

smb: replace CURL_WIN32 with WIN32

PR #9255 aimed to fix a Cygwin/MSYS issue (#8220). It used the
`CURL_WIN32` macro, but that one is not defined here, while compiling
curl itself. T

smb: replace CURL_WIN32 with WIN32

PR #9255 aimed to fix a Cygwin/MSYS issue (#8220). It used the
`CURL_WIN32` macro, but that one is not defined here, while compiling
curl itself. This patch changes this to `WIN32`, assuming this was the
original intent.

Regression from 1c52e8a3795ccdf8ec9c308f4f8f19cf10ea1f1a

Reviewed-by: Marcel Raad

Closes #9701

show more ...

aws_sigv4: fix header computation

Handle canonical headers and signed headers creation as explained here:
https://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.htm

aws_sigv4: fix header computation

Handle canonical headers and signed headers creation as explained here:
https://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html

The algo tells that signed and canonical must contain at last host and
x-amz-date.

So we check whatever thoses are present in the curl http headers list.
If they are, we use the one enter by curl user, otherwise we generate
them. then we to lower, and remove space from each http headers plus
host and x-amz-date, then sort them all by alphabetical order.

This patch also fix a bug with host header, which was ignoring the port.

Closes #7966

show more ...

README.md: link the curl logo to the website

- Link the curl:// image to https://curl.se/

Closes https://github.com/curl/curl/pull/9675

schannel: when importing PFX, disable key persistence

By default, the PFXImportCertStore API persists the key in the user's
key store (as though the certificate was being imported for pe

schannel: when importing PFX, disable key persistence

By default, the PFXImportCertStore API persists the key in the user's
key store (as though the certificate was being imported for permanent,
ongoing use.)

The documentation specifies that keys that are not to be persisted
should be imported with the flag PKCS12_NO_PERSIST_KEY.
NOTE: this flag is only supported on versions of Windows newer than XP
and Server 2003.

--

This is take 2 of the original fix. It extends the lifetime of the
client certificate store to that of the credential handle. The original
fix which landed in 70d010d and was later reverted in aec8d30 failed to
work properly because it did not do that.

Minor changes were made to the schannel credential context to support
closing the client certificate store handle at the end of an SSL session.

--

Reported-by: ShadowZzj@users.noreply.github.com

Fixes https://github.com/curl/curl/issues/9300
Supersedes https://github.com/curl/curl/pull/9363
Closes https://github.com/curl/curl/pull/9460

show more ...

Makefile.m32: support more options [ci skip]

- Add support for these options:
`-wolfssl`, `-wolfssh`, `-mbedtls`, `-libssh`, `-psl`

Caveats:
- `-wolfssh` requires `-wo

Makefile.m32: support more options [ci skip]

- Add support for these options:
`-wolfssl`, `-wolfssh`, `-mbedtls`, `-libssh`, `-psl`

Caveats:
- `-wolfssh` requires `-wolfssl`.
- `-wolfssl` cannot be used with OpenSSL backends in parallel.
- `-libssh` has build issues with BoringSSL and LibreSSL, and also
what looks like a world-writable-config vulnerability on Windows.
Consider it experimental.
- `-psl` requires `-idn2` and extra libs passed via
`LIBS=-liconv -lunistring`.

- Detect BoringSSL/wolfSSL and set ngtcp2 crypto lib accordingly.
- Generalize MultiSSL detection.
- Use else-if syntax. Requires GNU Make 3.81 (2006-04-01).
- Document more customization options.

This brings over some configuration logic from `curl-for-win`.

Closes #9680

show more ...

cmake: enable more detection on Windows

Enable `HAVE_UNISTD_H`, `HAVE_STRTOK_R` and `HAVE_STRCASECMP` detection
on Windows, instead of having predefined values.

With these featu

cmake: enable more detection on Windows

Enable `HAVE_UNISTD_H`, `HAVE_STRTOK_R` and `HAVE_STRCASECMP` detection
on Windows, instead of having predefined values.

With these features detected correctly, CMake Windows builds get closer
to the autotools and `config-win32.h` ones.

This also fixes detecting `HAVE_FTRUNCATE` correctly, which required
`unistd.h`.

Fixing `ftruncate()` in turn causes a build warning/error with legacy
MinGW/MSYS1 due to an offset type size mismatch. This env misses to
detect `HAVE_FILE_OFFSET_BITS`, which may be a reason. This patch
force-disables `HAVE_FTRUNCATE` for this platform.

Reviewed-by: Daniel Stenberg

Closes #9687

show more ...

autotools: allow unix sockets on Windows

Fixes: https://github.com/curl/curl-for-win/blob/73a070d96fd906fdee929e2f1f00a9149fb39239/curl-autotools.sh#L44-L47

On Windows this feature

autotools: allow unix sockets on Windows

Fixes: https://github.com/curl/curl-for-win/blob/73a070d96fd906fdee929e2f1f00a9149fb39239/curl-autotools.sh#L44-L47

On Windows this feature is present, but not the header used in the
detection logic. It also requires an elaborate enabler logic
(as seen in `lib/curl_setup.h`). Let's always allow it and let the
lib code deal with the details.

Closes #9688

show more ...

cmake: add missing inet_ntop check

This adds the missing half of the check, next to the other half
already present in `lib/curl_config.h.cmake`.

Force disable `HAVE_INET_NTOP` f

cmake: add missing inet_ntop check

This adds the missing half of the check, next to the other half
already present in `lib/curl_config.h.cmake`.

Force disable `HAVE_INET_NTOP` for old MSVC where it caused compiler
warnings.

Reviewed-by: Daniel Stenberg

Closes #9689

show more ...

RELEASE-NOTES: synced

asyn-ares: set hint flags when calling ares_getaddrinfo

The hint flag is ARES_AI_NUMERICSERV, and it will save a call to
getservbyname or getservbyname_r to set it.

Closes #9694

header.d: add category smtp and imap

They were previously (erroneously) added manually to tool_listhelp.c
which would make them get removed again when the file is updated next
time,

header.d: add category smtp and imap

They were previously (erroneously) added manually to tool_listhelp.c
which would make them get removed again when the file is updated next
time, unless added correctly here in header.d

Follow-up to 2437fac01

Closes #9690

show more ...

curl/get_url_file_name: use libcurl URL parser

To avoid URL tricks, use the URL parser for this.

This update changes curl's behavior slightly in that it will ignore the
possible

curl/get_url_file_name: use libcurl URL parser

To avoid URL tricks, use the URL parser for this.

This update changes curl's behavior slightly in that it will ignore the
possible query part from the URL and only use the file name from the
actual path from the URL. I consider it a bugfix.

"curl -O localhost/name?giveme-giveme" will now save the output in the
local file named 'name'

Updated test 1210 to verify

Assisted-by: Jay Satiro

Closes #9684

show more ...