ci: update dependency awslabs/aws-lc to v1.28.0

Closes #13770

tests: test_17_ssl_use.py clarify mbedtls TLSv1.3 support

Closes #13779

http: write last header line late

- HEADERFUNCTIONS might inspect response properties like
CURLINFO_CONTENT_LENGTH_DOWNLOAD_T on seeing the last header line. If
the line is being

http: write last header line late

- HEADERFUNCTIONS might inspect response properties like
CURLINFO_CONTENT_LENGTH_DOWNLOAD_T on seeing the last header line. If
the line is being written before this is initialized, values are not
available.

- write the last header line late when analyzing a HTTP response so that
all information is available at the time of the writing.

- add test1485 to verify that CURLINFO_CONTENT_LENGTH_DOWNLOAD_T works
on seeing the last header.

Fixes #13752
Reported-by: Harry Sintonen
Closes #13757

show more ...

tests: use exec when spawning nghttpx

This stops keeping perl and shell processes around that are no longer
needed, plus it eliminates an unneeded shell message when the server is
la

tests: use exec when spawning nghttpx

This stops keeping perl and shell processes around that are no longer
needed, plus it eliminates an unneeded shell message when the server is
later terminated.

Closes #13772

show more ...

GHA: ignore flaky test 3017 (MQTT) on OpenBSD

```
TESTFAIL: These test cases failed: 3017
```
Ref: https://github.com/curl/curl/actions/runs/9223543272/job/25376999226?pr=13759#s

GHA: ignore flaky test 3017 (MQTT) on OpenBSD

```
TESTFAIL: These test cases failed: 3017
```
Ref: https://github.com/curl/curl/actions/runs/9223543272/job/25376999226?pr=13759#step:3:16326
Ref: https://github.com/curl/curl/actions/runs/9230183764/job/25397883193?pr=13766#step:3:16345

Ref: https://github.com/curl/curl/pull/13583#issuecomment-2119376898

show more ...

build: add more supported attributes to the IAR compiler

Closes #13744

cmake: fix test 1013 with websockets enabled and no TLS

test 1013 is 'Compare curl --version with curl-config --protocols'.

Ref: https://github.com/curl/curl/actions/runs/9228363859

cmake: fix test 1013 with websockets enabled and no TLS

test 1013 is 'Compare curl --version with curl-config --protocols'.

Ref: https://github.com/curl/curl/actions/runs/9228363859/job/25392251955

Closes #13769

show more ...

GHA: stop deleting curl in non-native workflows

We do it in Cirrus CI, but for some platforms it's not possible to
delete it and tests work anyway.

The test runner also runs `..

GHA: stop deleting curl in non-native workflows

We do it in Cirrus CI, but for some platforms it's not possible to
delete it and tests work anyway.

The test runner also runs `../src/curl` by default, which is always the
one freshly built. The runner may also need the system curl to talk to
APIs when needed.

Also:
- stop setting `CURL` env. This isn't picked up by the runners,
and works out of the box anyway.
- quote an option just in case.

Follow-up to 90e644f944969bb11c6448bf50c6d441b5c0b1e6 #13583
Closes #13765

show more ...

openssl: stop duplicate ssl key logging for legacy OpenSSL

- Don't call the keylog function if it has already logged the key.

For old OpenSSL versions and its forks that do not have

openssl: stop duplicate ssl key logging for legacy OpenSSL

- Don't call the keylog function if it has already logged the key.

For old OpenSSL versions and its forks that do not have support for
OpenSSL's keylog callback, libcurl has its own legacy key logging
function that logs the TLS 1.2 (and earlier) key (client random + master
key) on a single line.

Prior to this change, since e7de80e8 (precedes 8.8.0), the legacy key
logging function could write the same key line more than once (usually
twice) due to some incorrect logic.

Closes https://github.com/curl/curl/pull/13683

show more ...

transfer: remove curl_upload_refill_watermark, no longer used

the define applied to upload buffers which we removed

Closes #13764

RELEASE-NOTES: synced

cmake: fix brotli lib order

Fix root cause that caused missing symbols when linking brotli
statically with e.g. binutils `ld` (and any other "picky" linker,
or "traditional" linker a

cmake: fix brotli lib order

Fix root cause that caused missing symbols when linking brotli
statically with e.g. binutils `ld` (and any other "picky" linker,
or "traditional" linker as CMake now calls them).

Also drop existing workaround that added brotli libs twice to the lib
list.

```
x86_64-w64-mingw32-ld: .../curl/brotli/_bld/usr/lib/libbrotlidec.a(decode.c.obj):decode.c:(.text$ProcessCommands[ProcessCommands]+0xbb5): undefined reference to `BrotliTransformDictionaryWord'
x86_64-w64-mingw32-ld: .../curl/brotli/_bld/usr/lib/libbrotlidec.a(decode.c.obj):decode.c:(.text$SafeProcessCommands[SafeProcessCommands]+0xe8a): undefined reference to `BrotliTransformDictionaryWord'
x86_64-w64-mingw32-ld: .../curl/brotli/_bld/usr/lib/libbrotlidec.a(decode.c.obj):decode.c:(.rdata$.refptr._kBrotliContextLookupTable[.refptr._kBrotliContextLookupTable]+0x0): undefined reference to `_kBrotliContextLookupTable'
x86_64-w64-mingw32-ld: .../curl/brotli/_bld/usr/lib/libbrotlidec.a(decode.c.obj):decode.c:(.rdata$.refptr._kBrotliPrefixCodeRanges[.refptr._kBrotliPrefixCodeRanges]+0x0): undefined reference to `_kBrotliPrefixCodeRanges'
x86_64-w64-mingw32-ld: .../curl/brotli/_bld/usr/lib/libbrotlidec.a(state.c.obj):state.c:(.text$BrotliDecoderStateInit[BrotliDecoderStateInit]+0x21): undefined reference to `BrotliDefaultAllocFunc'
x86_64-w64-mingw32-ld: .../curl/brotli/_bld/usr/lib/libbrotlidec.a(state.c.obj):state.c:(.text$BrotliDecoderStateInit[BrotliDecoderStateInit]+0x2f): undefined reference to `BrotliDefaultFreeFunc'
x86_64-w64-mingw32-ld: .../curl/brotli/_bld/usr/lib/libbrotlidec.a(state.c.obj):state.c:(.text$BrotliDecoderStateInit[BrotliDecoderStateInit]+0x10e): undefined reference to `BrotliSharedDictionaryCreateInstance'
x86_64-w64-mingw32-ld: .../curl/brotli/_bld/usr/lib/libbrotlidec.a(state.c.obj):state.c:(.text$BrotliDecoderStateCleanup[BrotliDecoderStateCleanup]+0xf4): undefined reference to `BrotliSharedDictionaryDestroyInstance'
collect2: error: ld returned 1 exit status
```

Breakage reproducible with curl-for-win config "`win-gcc`" and deleting
the `LDFLAGS+=' -Wl,--start-group'` line from its `curl.sh` script.
(Above line still required for some non-brotli cases, e.g. libssh2 and
zlib.)

Assisted-by: Kai Pastor
Ref: https://github.com/curl/curl/pull/10857#discussion_r1611714989
Follow-up to 1e3319a167d2f32d295603167486e9e88af9bb4e #10857
Closes #13761

show more ...

cmake: fix building in unity mode

- Fix sha256 and sha512 duplicate macro names (eg function-like macro Ch
is now Sha256_Ch and Sha512_Ch).

- Avoid defining short defines like

cmake: fix building in unity mode

- Fix sha256 and sha512 duplicate macro names (eg function-like macro Ch
is now Sha256_Ch and Sha512_Ch).

- Avoid defining short defines like R, S. (eg S is now Sha256_S).

Closes https://github.com/curl/curl/pull/13751

show more ...

winbuild: remove outdated WIN32 defines

- Remove all instances in the makefile of compiler option /DWIN32.

This is a follow-up to e9a7d4a1 which replaced all defined(WIN32) checks

winbuild: remove outdated WIN32 defines

- Remove all instances in the makefile of compiler option /DWIN32.

This is a follow-up to e9a7d4a1 which replaced all defined(WIN32) checks
with defined(_WIN32) in the codebase, since only the latter is
automatically defined by all compilers for Windows builds.

Bug: https://github.com/curl/curl/pull/13739#issuecomment-2123937859
Reported-by: Viktor Szakats

Closes https://github.com/curl/curl/pull/13742

show more ...

ci: update github/codeql-action digest to 9fdb3e4

Closes #13726

asyn-thread: avoid using GetAddrInfoExW with impersonation

Multiple reports suggest that GetAddrInfoExW fails when impersonation is
used. This PR checks if thread is impersonating and av

asyn-thread: avoid using GetAddrInfoExW with impersonation

Multiple reports suggest that GetAddrInfoExW fails when impersonation is
used. This PR checks if thread is impersonating and avoids using
GetAddrInfoExW api.

Reported-by: Keerthi Timmaraju
Assisted-by: edmcln on github
Fixes #13612
Closes #13738

show more ...

transfer: conn close on paused upload

- add 2 variations on test_07_42 which PAUSEs uploads
and response connections terminating either right away
or after the 100-continue respo

transfer: conn close on paused upload

- add 2 variations on test_07_42 which PAUSEs uploads
and response connections terminating either right away
or after the 100-continue response
- when detecting the connection being closed in transfer.c
readwrite_data(), clear ALL send bits in data->req.keepon.
It no longer makes send to wait for a KEEP_SEND_PAUSE or HOLD.
- in the protocol client writer add the check for incomplete
response bodies. When an EOS is seen and the length is known,
check that and fail if bytes are missing.

Reported-by: Sergey Bronnikov
Fixes #13740
Closes #13750

show more ...

CI GHA: add vsftpd to ngtcp2-linux runs

- not using HTTP/3, but gnutls does not seem to run
somewhere else right now

Closes #13760

GHA: increase timeout for Cygwin autotools build tests step

Apparently 10 minutes are not (always) enough:
https://github.com/curl/curl/actions/runs/9197003907/job/25296439556#step:8:193

GHA: increase timeout for Cygwin autotools build tests step

Apparently 10 minutes are not (always) enough:
https://github.com/curl/curl/actions/runs/9197003907/job/25296439556#step:8:1936

Closes #13753

show more ...

mbedtls: send close-notify on close

- send the TLS close notify message when cloding down
the mbedtls connection filter
- this is a "least" effort version and, as other TLS filters

mbedtls: send close-notify on close

- send the TLS close notify message when cloding down
the mbedtls connection filter
- this is a "least" effort version and, as other TLS filters,
is lacking a graceful send/receive/timeout for a really
clean shutdown.

Closes #13745

show more ...

mbedtls: check version for cipher id

mbedtls_ssl_get_ciphersuite_id_from_ssl() seems to have been added in
mbedtls 3.2.0. Check for that version.

Closes #13749

cmake: fix building with both md4 and md5 in unity mode

Macro and static function names were colliding between
`lib/md4.c` and
`lib/md5.c`.

Fix it by namespacing these symbo

cmake: fix building with both md4 and md5 in unity mode

Macro and static function names were colliding between
`lib/md4.c` and
`lib/md5.c`.

Fix it by namespacing these symbols.

Seen with a basic macOS build using these options:
`-DCMAKE_UNITY_BUILD=ON -DCURL_USE_SECTRANSP=ON`

Closes #13737

show more ...

docs/Makefile.am: make curl-config.1 install

on "make install" like it should

Follow-up to 60971d665b9b1df87082

Closes #13741

GHA: bump actions/checkout from 4.1.4 to 4.1.6

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.4 to 4.1.6.
- [Release notes](https://github.com/actions/checkout/re

GHA: bump actions/checkout from 4.1.4 to 4.1.6

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.4 to 4.1.6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/0ad4b8fadaa221de15dcec353f45205ec38ea70b...a5ac7e51b41094c92402da3b24376905380afc29)

---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Closes #13720

show more ...

pytest: add ftp upload tests

- refs #13556
- allow anon uploads on vsftpd test server
- add test_30_05 for plain upload of 1k, 100k, 1m
- add test_31_05 for SSL upload of 1k, 100

pytest: add ftp upload tests

- refs #13556
- allow anon uploads on vsftpd test server
- add test_30_05 for plain upload of 1k, 100k, 1m
- add test_31_05 for SSL upload of 1k, 100k, 1m
- verify file size and contents

Closes #13734

show more ...