HTTP3: ngtcp2 builds are no longer experimental

The other HTTP/3 backends are still experimental.

Closes #12235

vtls: cleanup SSL config management

- remove `Curl_ssl_get_config()`, no longer needed

Closes #12204

libcurl-thread.3: simplify the TLS section

All TLS libraries curl can use are threadsafe since OpenSSL 1.1.x, August
2016.

Closes #12233

configure: better --disable-http

- disable HTTPS-proxy as well, since it can't work without HTTP

- curl_setup: when HTTP is disabled, also disable all features that are
HTTP-o

configure: better --disable-http

- disable HTTPS-proxy as well, since it can't work without HTTP

- curl_setup: when HTTP is disabled, also disable all features that are
HTTP-only

- version: HTTPS-proxy only exists if HTTP support exists

Closes #12223

show more ...

http: consider resume with CURLOPT_FAILONERRROR and 416 to be fine

Finding a 'Content-Range:' in the response changed the handling.

Add test case 1475 to verify -C - with 416 and Co

http: consider resume with CURLOPT_FAILONERRROR and 416 to be fine

Finding a 'Content-Range:' in the response changed the handling.

Add test case 1475 to verify -C - with 416 and Content-Range: header,
which is almost exactly like test 194 which instead uses a fixed -C
offset. Adjusted test 194 to also be considered fine.

Fixes #10521
Reported-by: Smackd0wn
Fixes #12174
Reported-by: Anubhav Rai
Closes #12176

show more ...

GHA: fix checkout of quictls repository to use correct branch name

Follow-up to c868b0e30f10cd0ac7

Closes #12232

docs/example/localport.c: show off CURLOPT_LOCALPORT

Closes #12230

docs/examples/interface.c: show CURLOPT_INTERFACE use

Although super simple.

Closes #12229

build: fix compiler warning with auths disabled

```
./curl/lib/http.c:979:12: warning: unused function 'is_valid_auth_separator' [-Wunused-function]
static int is_valid_auth_separato

build: fix compiler warning with auths disabled

```
./curl/lib/http.c:979:12: warning: unused function 'is_valid_auth_separator' [-Wunused-function]
static int is_valid_auth_separator(char ch)
^
5 warnings generated.
```

Follow-up to e92edfbef64448ef461117769881f3ed776dec4e #11490

Closes #12227

show more ...

build: require Windows XP or newer

After this patch we assume availability of `getaddrinfo` and
`freeaddrinfo`, first introduced in Windows XP. Meaning curl
now requires building for

build: require Windows XP or newer

After this patch we assume availability of `getaddrinfo` and
`freeaddrinfo`, first introduced in Windows XP. Meaning curl
now requires building for Windows XP as a minimum.

TODO: assume these also in autotools.

Ref: https://github.com/curl/curl/pull/12221#issuecomment-1783761806
Closes #12225

show more ...

appveyor: bump one job to OpenSSL 3.1 (was 1.1.1)

Use 3.1 with the modern runner image.

We still use 1.1.1 in 8 jobs.

1.1.1 is EOL since 2023-09-11:
https://www.openssl

appveyor: bump one job to OpenSSL 3.1 (was 1.1.1)

Use 3.1 with the modern runner image.

We still use 1.1.1 in 8 jobs.

1.1.1 is EOL since 2023-09-11:
https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/

Also:
- add missing SSL-backend to job descriptions.
- tidy up CPU in job descriptions.

Closes #12226

show more ...

RELEASE-NOTES: synced

GHA: bump ngtcp2, nghttp3, nghttp2 and quictls versions

ngtcp2 1.0.1
nghttp3 1.0.0
nghttp2 1.58.0
quictls 3.1.4+quic

also sync HTTP3.md with these changes

Close

GHA: bump ngtcp2, nghttp3, nghttp2 and quictls versions

ngtcp2 1.0.1
nghttp3 1.0.0
nghttp2 1.58.0
quictls 3.1.4+quic

also sync HTTP3.md with these changes

Closes #12132

show more ...

wolfssl: add default case for wolfssl_connect_step1 switch

Closes #12218

curl_setup: disallow Windows IPv6 builds missing getaddrinfo

- On Windows if IPv6 is enabled but getaddrinfo is missing then #error
the build.

curl can be built with IPv6 supp

curl_setup: disallow Windows IPv6 builds missing getaddrinfo

- On Windows if IPv6 is enabled but getaddrinfo is missing then #error
the build.

curl can be built with IPv6 support (ENABLE_IPV6) but without the
ability to resolve hosts to IPv6 addresses (HAVE_GETADDRINFO). On
Windows this is highly unlikely and should be considered a bad build
configuration.

Such a bad configuration has already given us a bug that was hard to
diagnose. See #12134 and #12136 for discussion.

Ref: https://github.com/curl/curl/issues/12134
Ref: https://github.com/curl/curl/pull/12136

Closes https://github.com/curl/curl/pull/12221

show more ...

openssl: make CURLSSLOPT_NATIVE_CA import Windows intermediate CAs

- If CURLSSLOPT_NATIVE_CA on Windows then import from intermediate CA
"CA" store after importing from root CA "ROOT"

openssl: make CURLSSLOPT_NATIVE_CA import Windows intermediate CAs

- If CURLSSLOPT_NATIVE_CA on Windows then import from intermediate CA
"CA" store after importing from root CA "ROOT" store.

This change allows curl to work in situations where a server does not
send all intermediate certs and they are present in the "CA" store (the
store with intermediate CAs). This is already allowed by the Schannel
backend.

Also this change makes partial chain verification possible for those
certs since we allow partial chain verification by default for OpenSSL
(unless CURLSSLOPT_NO_PARTIALCHAIN). This is not allowed by the Schannel
backend.

Prior to this change CURLSSLOPT_NATIVE_CA only imported "ROOT" certs.

Fixes https://github.com/curl/curl/issues/12155
Closes https://github.com/curl/curl/pull/12185

show more ...

Makefile.mk: fix `-rtmp` option for non-Windows [ci skip]

asyn-ares: handle no connection in the addrinfo callback

To avoid crashing.

Follow-up from 56a4db2
Closes #12219

hostip6: fix DEBUG_ADDRINFO builds

- Removed unused and incorrect parameter from dump_addrinfo().

Bug: https://github.com/curl/curl/commit/56a4db2e#commitcomment-131050442
Repor

hostip6: fix DEBUG_ADDRINFO builds

- Removed unused and incorrect parameter from dump_addrinfo().

Bug: https://github.com/curl/curl/commit/56a4db2e#commitcomment-131050442
Reported-by: Gisle Vanem

Closes https://github.com/curl/curl/pull/12212

show more ...

Makefile.mk: restore `_mingw.h` for default `_WIN32_WINNT`

In 8.4.0 we deleted `_mingw.h` as part of purging old-mingw support.
Turns out `_mingw.h` had the side-effect of setting a defa

Makefile.mk: restore `_mingw.h` for default `_WIN32_WINNT`

In 8.4.0 we deleted `_mingw.h` as part of purging old-mingw support.
Turns out `_mingw.h` had the side-effect of setting a default
`_WIN32_WINNT` value expected by `lib/config-win32.h` to enable
`getaddrinfo` support in `Makefile.mk` mingw-w64 builds. This caused
disabling support for this unless specifying the value manually.

Restore this header and update its comment to tell why we continue
to need it.

This triggered a regression in official Windows curl builds starting
with 8.4.0_1. Fixed in 8.4.0_6. (8.5.0 will be using CMake.)

Regression from 38029101e2d78ba125732b3bab6ec267b80a0e72 #11625

Reported-by: zhengqwe on github
Helped-by: Nico Rieck
Fixes #12134
Fixes #12136
Closes #12217

show more ...

hostip: silence compiler warning `-Wparentheses-equality`

Seen with LLVM 17.

```
hostip.c:1336:22: warning: equality comparison with extraneous parentheses [-Wparentheses-equali

hostip: silence compiler warning `-Wparentheses-equality`

Seen with LLVM 17.

```
hostip.c:1336:22: warning: equality comparison with extraneous parentheses [-Wparentheses-equality]
1336 | (a->ai_family == PF_INET)) {
| ~~~~~~~~~~~~~^~~~~~~~~~
hostip.c:1336:22: note: remove extraneous parentheses around the comparison to silence this warning
1336 | (a->ai_family == PF_INET)) {
| ~ ^ ~
hostip.c:1336:22: note: use '=' to turn this equality comparison into an assignment
1336 | (a->ai_family == PF_INET)) {
| ^~
| =
1 warning generated.
```

Follow-up to b651aba0962bb31353f55de4dc35f745952a1b10 #12145

Reviewed-by: Daniel Stenberg
Closes #12215

show more ...

doh: use PIPEWAIT when HTTP/2 is attempted

Closes #12214

setopt: remove outdated cookie comment

Closes #12206

cfilter: provide call to tell connection to forget a socket

- fixed libssh.c workaround for a socket being closed by
the library
- eliminate the terrible hack in cf-socket.c to gue

cfilter: provide call to tell connection to forget a socket

- fixed libssh.c workaround for a socket being closed by
the library
- eliminate the terrible hack in cf-socket.c to guess when
this happened and try not closing the socket again.
- fixes race in eyeballing when socket could have failed to
be closed for a discarded connect attempt

Closes #12207

show more ...

url: protocol handler lookup tidy-up

- rename lookup to what it does
- use ARRAYSIZE instead of NULL check for end
- offer alternate lookup for 0-terminated strings

Closes #

url: protocol handler lookup tidy-up

- rename lookup to what it does
- use ARRAYSIZE instead of NULL check for end
- offer alternate lookup for 0-terminated strings

Closes #12216

show more ...