From 8a9e4e8631f8b80d9d7013dbcd7e4fe3693bb2f6 Mon Sep 17 00:00:00 2001 From: Xisco Fauli Date: Mon, 16 Mar 2026 17:10:51 +0100 Subject: [PATCH] curl: upgrade to 8.19.0 --with-secure-transport was dropped in curl 8.15, so replace it with --with-openssl --with-apple-sectrust, which was added in curl 8.17 Remove all patches fixed upstream Downloaded from https://curl.se/download/curl-8.19.0.tar.xz Change-Id: Ic93d8e3ef637d2adf84454c4e0375d1bf4620870 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201850 Reviewed-by: Xisco Fauli Tested-by: Jenkins Reviewed-by: Patrick Luby --- download.lst | 4 +- ...001-const-up-readonly-H2_NON_FIELD.patch.1 | 25 --- ...-treat-the-leading-slash-as-trailing.patch | 54 ------ ...-only-send-bearer-if-auth-is-allowed.patch | 147 ---------------- .../0001-proxy-auth-additional-tests.patch | 162 ------------------ ...nd-paste-url_match_auth_nego-mistake.patch | 28 --- ...-of-connections-using-HTTP-Negotiate.patch | 137 --------------- ...new-mask-for-each-new-outgoing-frame.patch | 61 ------- external/curl/ExternalProject_curl.mk | 8 +- external/curl/UnpackedTarball_curl.mk | 7 - external/curl/zlib.patch.0 | 19 +- include/systools/curlinit.hxx | 2 +- 12 files changed, 15 insertions(+), 639 deletions(-) delete mode 100644 external/curl/0001-const-up-readonly-H2_NON_FIELD.patch.1 delete mode 100644 external/curl/0001-cookie-don-t-treat-the-leading-slash-as-trailing.patch delete mode 100644 external/curl/0001-http-only-send-bearer-if-auth-is-allowed.patch delete mode 100644 external/curl/0001-proxy-auth-additional-tests.patch delete mode 100644 external/curl/0001-url-fix-copy-and-paste-url_match_auth_nego-mistake.patch delete mode 100644 external/curl/0001-url-fix-reuse-of-connections-using-HTTP-Negotiate.patch delete mode 100644 external/curl/0001-ws-get-a-new-mask-for-each-new-outgoing-frame.patch diff --git a/download.lst b/download.lst index 4a01706fa670..e27479cea085 100644 --- a/download.lst +++ b/download.lst @@ -80,8 +80,8 @@ CPPUNIT_TARBALL := cppunit-1.15.1.tar.gz # three static lines # so that git cherry-pick # will not run into conflicts -CURL_SHA256SUM := f4619a1e2474c4bbfedc88a7c2191209c8334b48fa1f4e53fd584cc12e9120dd -CURL_TARBALL := curl-8.14.1.tar.xz +CURL_SHA256SUM := 4eb41489790d19e190d7ac7e18e82857cdd68af8f4e66b292ced562d333f11df +CURL_TARBALL := curl-8.19.0.tar.xz # three static lines # so that git cherry-pick # will not run into conflicts diff --git a/external/curl/0001-const-up-readonly-H2_NON_FIELD.patch.1 b/external/curl/0001-const-up-readonly-H2_NON_FIELD.patch.1 deleted file mode 100644 index 6d7104bfea77..000000000000 --- a/external/curl/0001-const-up-readonly-H2_NON_FIELD.patch.1 +++ /dev/null @@ -1,25 +0,0 @@ -From df1f9619ac00091b309a479a166fe861f935779c Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= -Date: Tue, 22 Jul 2025 14:48:26 +0100 -Subject: [PATCH] const up readonly H2_NON_FIELD - ---- - lib/http.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/http.c b/lib/http.c -index e5a069627..9a844301f 100644 ---- a/lib/http.c -+++ b/lib/http.c -@@ -4569,7 +4569,7 @@ struct name_const { - }; - - /* keep them sorted by length! */ --static struct name_const H2_NON_FIELD[] = { -+static const struct name_const H2_NON_FIELD[] = { - { STRCONST("Host") }, - { STRCONST("Upgrade") }, - { STRCONST("Connection") }, --- -2.49.0 - diff --git a/external/curl/0001-cookie-don-t-treat-the-leading-slash-as-trailing.patch b/external/curl/0001-cookie-don-t-treat-the-leading-slash-as-trailing.patch deleted file mode 100644 index 45fba1f8af4e..000000000000 --- a/external/curl/0001-cookie-don-t-treat-the-leading-slash-as-trailing.patch +++ /dev/null @@ -1,54 +0,0 @@ -From c6ae07c6a541e0e96d0040afb62b45dd37711300 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Mon, 11 Aug 2025 20:23:05 +0200 -Subject: [PATCH] cookie: don't treat the leading slash as trailing - -If there is only a leading slash in the path, keep that. Also add an -assert to make sure the path is never blank. - -Reported-by: Google Big Sleep -Closes #18266 ---- - lib/cookie.c | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - -diff --git a/lib/cookie.c b/lib/cookie.c -index 914a4aca1..b72dd99bc 100644 ---- a/lib/cookie.c -+++ b/lib/cookie.c -@@ -296,9 +296,9 @@ static char *sanitize_cookie_path(const char *cookie_path) - /* Let cookie-path be the default-path. */ - return strdup("/"); - -- /* remove trailing slash */ -+ /* remove trailing slash when path is non-empty */ - /* convert /hoge/ to /hoge */ -- if(len && cookie_path[len - 1] == '/') -+ if(len > 1 && cookie_path[len - 1] == '/') - len--; - - return Curl_memdup0(cookie_path, len); -@@ -965,7 +965,7 @@ replace_existing(struct Curl_easy *data, - clist->spath && co->spath && /* both have paths */ - clist->secure && !co->secure && !secure) { - size_t cllen; -- const char *sep; -+ const char *sep = NULL; - - /* - * A non-secure cookie may not overlay an existing secure cookie. -@@ -974,8 +974,9 @@ replace_existing(struct Curl_easy *data, - * "/loginhelper" is ok. - */ - -- sep = strchr(clist->spath + 1, '/'); -- -+ DEBUGASSERT(clist->spath[0]); -+ if(clist->spath[0]) -+ sep = strchr(clist->spath + 1, '/'); - if(sep) - cllen = sep - clist->spath; - else --- -2.39.5 - diff --git a/external/curl/0001-http-only-send-bearer-if-auth-is-allowed.patch b/external/curl/0001-http-only-send-bearer-if-auth-is-allowed.patch deleted file mode 100644 index 2c397dd192ba..000000000000 --- a/external/curl/0001-http-only-send-bearer-if-auth-is-allowed.patch +++ /dev/null @@ -1,147 +0,0 @@ -From e3d7401a32a46516c9e5ee877e613e62ed35bddc Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Fri, 6 Mar 2026 23:13:07 +0100 -Subject: [PATCH] http: only send bearer if auth is allowed - -Verify with test 2006 - -Closes #20843 ---- - lib/http.c | 1 + - tests/data/Makefile.am | 2 +- - tests/data/test2006 | 98 ++++++++++++++++++++++++++++++++++++++++++ - 3 files changed, 100 insertions(+), 1 deletion(-) - create mode 100644 tests/data/test2006 - -diff --git a/lib/http.c b/lib/http.c -index d2f85fc5bf..d61edbd0cd 100644 ---- a/lib/http.c -+++ b/lib/http.c -@@ -705,6 +705,7 @@ static CURLcode output_auth_headers(struct Curl_easy *data, - if(authstatus->picked == CURLAUTH_BEARER) { - /* Bearer */ - if((!proxy && data->set.str[STRING_BEARER] && -+ Curl_auth_allowed_to_host(data) && - !Curl_checkheaders(data, STRCONST("Authorization")))) { - auth = "Bearer"; - result = http_output_bearer(data); -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index f39568d3b8..6c8be18b32 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -243,7 +243,7 @@ test1955 test1956 test1957 test1958 test1959 test1960 test1964 \ - test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \ - test1978 test1979 test1980 \ - \ --test2000 test2001 test2002 test2003 test2004 test2005 \ -+test2000 test2001 test2002 test2003 test2004 test2005 test2006 \ - \ - test2023 \ - test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \ -diff --git a/tests/data/test2006 b/tests/data/test2006 -new file mode 100644 -index 0000000000..200d30a7ce ---- /dev/null -+++ b/tests/data/test2006 -@@ -0,0 +1,98 @@ -+ -+ -+ -+ -+netrc -+HTTP -+ -+ -+# Server-side -+ -+ -+HTTP/1.1 301 Follow this you fool -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT -+ETag: "21025-dc7-39462498" -+Accept-Ranges: bytes -+Content-Length: 6 -+Connection: close -+Location: http://b.com/%TESTNUMBER0002 -+ -+-foo- -+ -+ -+ -+HTTP/1.1 200 OK -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT -+ETag: "21025-dc7-39462498" -+Accept-Ranges: bytes -+Content-Length: 7 -+Connection: close -+ -+target -+ -+ -+ -+HTTP/1.1 301 Follow this you fool -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT -+ETag: "21025-dc7-39462498" -+Accept-Ranges: bytes -+Content-Length: 6 -+Connection: close -+Location: http://b.com/%TESTNUMBER0002 -+ -+HTTP/1.1 200 OK -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT -+ETag: "21025-dc7-39462498" -+Accept-Ranges: bytes -+Content-Length: 7 -+Connection: close -+ -+target -+ -+ -+ -+# Client-side -+ -+ -+http -+ -+ -+proxy -+ -+ -+.netrc default with redirect plus oauth2-bearer -+ -+ -+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER --oauth2-bearer SECRET_TOKEN -L -x http://%HOSTIP:%HTTPPORT/ http://a.com/ -+ -+ -+default login testuser password testpass -+ -+ -+ -+ -+ -+GET http://a.com/ HTTP/1.1 -+Host: a.com -+Authorization: Bearer SECRET_TOKEN -+User-Agent: curl/%VERSION -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+GET http://b.com/%TESTNUMBER0002 HTTP/1.1 -+Host: b.com -+User-Agent: curl/%VERSION -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+ -+ -+ --- -2.53.0 - diff --git a/external/curl/0001-proxy-auth-additional-tests.patch b/external/curl/0001-proxy-auth-additional-tests.patch deleted file mode 100644 index 237aefb61819..000000000000 --- a/external/curl/0001-proxy-auth-additional-tests.patch +++ /dev/null @@ -1,162 +0,0 @@ -From 5f13a7645e565c5c1a06f3ef86e97afb856fb364 Mon Sep 17 00:00:00 2001 -From: Stefan Eissing -Date: Fri, 6 Mar 2026 14:54:09 +0100 -Subject: [PATCH] proxy-auth: additional tests - -Also eliminate the special handling for socks proxy match. - -Closes #20837 ---- - lib/url.c | 28 +++++++--------------------- - tests/http/test_13_proxy_auth.py | 20 ++++++++++++++++++++ - tests/http/testenv/curl.py | 18 +++++++++++++++--- - 3 files changed, 42 insertions(+), 24 deletions(-) - -diff --git a/lib/url.c b/lib/url.c -index eabeb776ab..bdc183b45b 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -590,30 +590,15 @@ static bool proxy_info_matches(const struct proxy_info *data, - { - if((data->proxytype == needle->proxytype) && - (data->port == needle->port) && -- strcasecompare(data->host.name, needle->host.name)) -- return TRUE; -+ strcasecompare(data->host.name, needle->host.name)) { - -+ if(Curl_timestrcmp(data->user, needle->user) || -+ Curl_timestrcmp(data->passwd, needle->passwd)) -+ return FALSE; -+ return TRUE; -+ } - return FALSE; - } -- --static bool --socks_proxy_info_matches(const struct proxy_info *data, -- const struct proxy_info *needle) --{ -- if(!proxy_info_matches(data, needle)) -- return FALSE; -- -- /* the user information is case-sensitive -- or at least it is not defined as case-insensitive -- see https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.1 */ -- -- /* curl_strequal does a case insensitive comparison, -- so do not use it here! */ -- if(Curl_timestrcmp(data->user, needle->user) || -- Curl_timestrcmp(data->passwd, needle->passwd)) -- return FALSE; -- return TRUE; --} - #else - /* disabled, will not get called */ - #define proxy_info_matches(x,y) FALSE -@@ -923,8 +909,7 @@ static bool url_match_proxy_use(struct connectdata *conn, - return FALSE; - - if(m->needle->bits.socksproxy && -- !socks_proxy_info_matches(&m->needle->socks_proxy, -- &conn->socks_proxy)) -+ !proxy_info_matches(&m->needle->socks_proxy, &conn->socks_proxy)) - return FALSE; - - if(m->needle->bits.httpproxy) { -diff --git a/tests/http/test_13_proxy_auth.py b/tests/http/test_13_proxy_auth.py -index 080adef187..33fb211e99 100644 ---- a/tests/http/test_13_proxy_auth.py -+++ b/tests/http/test_13_proxy_auth.py -@@ -169,3 +169,23 @@ class TestProxyAuth: - '--negotiate', '--proxy-user', 'proxy:proxy' - ]) - r1.check_response(count=1, http_status=200) -+ -+ def test_13_10_tunnels_mixed_auth(self, env: Env, httpd, configures_httpd): -+ self.httpd_configure(env, httpd) -+ curl = CurlClient(env=env) -+ url1 = f'http://localhost:{env.http_port}/data.json?1' -+ url2 = f'http://localhost:{env.http_port}/data.json?2' -+ url3 = f'http://localhost:{env.http_port}/data.json?3' -+ xargs1 = curl.get_proxy_args(proxys=False, tunnel=True) -+ xargs1.extend(['--proxy-user', 'proxy:proxy']) # good auth -+ xargs2 = curl.get_proxy_args(proxys=False, tunnel=True) -+ xargs2.extend(['--proxy-user', 'ungood:ungood']) # bad auth -+ xargs3 = curl.get_proxy_args(proxys=False, tunnel=True) -+ # no auth -+ r = curl.http_download(urls=[url1, url2, url3], alpn_proto='http/1.1', with_stats=True, -+ url_options={url1: xargs1, url2: xargs2, url3: xargs3}) -+ # only url1 succeeds, others fail, no connection reuse -+ assert r.stats[0]['http_code'] == 200, f'{r.dump_logs()}' -+ assert r.stats[1]['http_code'] == 0, f'{r.dump_logs()}' -+ assert r.stats[2]['http_code'] == 0, f'{r.dump_logs()}' -+ assert r.total_connects == 3, f'{r.dump_logs()}' -diff --git a/tests/http/testenv/curl.py b/tests/http/testenv/curl.py -index 4fc11c7923..1f812a1c2e 100644 ---- a/tests/http/testenv/curl.py -+++ b/tests/http/testenv/curl.py -@@ -543,7 +543,8 @@ class CurlClient: - with_profile: bool = False, - with_tcpdump: bool = False, - no_save: bool = False, -- extra_args: Optional[List[str]] = None): -+ extra_args: Optional[List[str]] = None, -+ url_options: Optional[Dict[str,List[str]]] = None): - if extra_args is None: - extra_args = [] - if no_save: -@@ -563,6 +564,7 @@ class CurlClient: - ]) - return self._raw(urls, alpn_proto=alpn_proto, options=extra_args, - with_stats=with_stats, -+ url_options=url_options, - with_headers=with_headers, - with_profile=with_profile, - with_tcpdump=with_tcpdump) -@@ -1083,6 +1085,7 @@ class CurlClient: - - def _raw(self, urls, intext='', timeout=None, options=None, insecure=False, - alpn_proto: Optional[str] = None, -+ url_options=None, - force_resolve=True, - with_stats=False, - with_headers=True, -@@ -1092,7 +1095,8 @@ class CurlClient: - args = self._complete_args( - urls=urls, timeout=timeout, options=options, insecure=insecure, - alpn_proto=alpn_proto, force_resolve=force_resolve, -- with_headers=with_headers, def_tracing=def_tracing) -+ with_headers=with_headers, def_tracing=def_tracing, -+ url_options=url_options) - r = self._run(args, intext=intext, with_stats=with_stats, - with_profile=with_profile, with_tcpdump=with_tcpdump) - if r.exit_code == 0 and with_headers: -@@ -1102,8 +1106,10 @@ class CurlClient: - def _complete_args(self, urls, timeout=None, options=None, - insecure=False, force_resolve=True, - alpn_proto: Optional[str] = None, -+ url_options=None, - with_headers: bool = True, - def_tracing: bool = True): -+ url_sep = [] - if not isinstance(urls, list): - urls = [urls] - -@@ -1129,7 +1135,13 @@ class CurlClient: - active_options = options[options.index('--next') + 1:] - - for url in urls: -- u = urlparse(urls[0]) -+ args.extend(url_sep) -+ if url_options is not None: -+ url_sep = ['--next'] -+ -+ u = urlparse(url) -+ if url_options is not None and url in url_options: -+ args.extend(url_options[url]) - if options: - args.extend(options) - if alpn_proto is not None: --- -2.53.0 - diff --git a/external/curl/0001-url-fix-copy-and-paste-url_match_auth_nego-mistake.patch b/external/curl/0001-url-fix-copy-and-paste-url_match_auth_nego-mistake.patch deleted file mode 100644 index 15fc817ccd66..000000000000 --- a/external/curl/0001-url-fix-copy-and-paste-url_match_auth_nego-mistake.patch +++ /dev/null @@ -1,28 +0,0 @@ -From f1a39f221d57354990e3eeeddc3404aede2aff70 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Sat, 21 Feb 2026 18:11:41 +0100 -Subject: [PATCH] url: fix copy and paste url_match_auth_nego mistake - -Follow-up to 34fa034 -Reported-by: dahmono on github -Closes #20662 ---- - lib/url.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/url.c b/lib/url.c -index c879a85e92..8b42aebade 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -1217,7 +1217,7 @@ static bool url_match_auth_nego(struct connectdata *conn, - return FALSE; - } - #endif -- if(m->want_ntlm_http || m->want_proxy_ntlm_http) { -+ if(m->want_nego_http || m->want_proxy_nego_http) { - /* Credentials are already checked, we may use this connection. We MUST - * use a connection where it has already been fully negotiated. If it has - * not, we keep on looking for a better one. */ --- -2.53.0 - diff --git a/external/curl/0001-url-fix-reuse-of-connections-using-HTTP-Negotiate.patch b/external/curl/0001-url-fix-reuse-of-connections-using-HTTP-Negotiate.patch deleted file mode 100644 index 44f490e25154..000000000000 --- a/external/curl/0001-url-fix-reuse-of-connections-using-HTTP-Negotiate.patch +++ /dev/null @@ -1,137 +0,0 @@ -From 34fa034d9a390c4bd65e2d05262755ec8646ac12 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Thu, 5 Feb 2026 08:34:21 +0100 -Subject: [PATCH] url: fix reuse of connections using HTTP Negotiate - -Assume Negotiate means connection-based - -Reported-by: Zhicheng Chen -Closes #20534 ---- - lib/url.c | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++---- - 1 file changed, 82 insertions(+), 5 deletions(-) - -diff --git a/lib/url.c b/lib/url.c -index fac8cea732..cfe398de8b 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -764,6 +764,8 @@ struct url_conn_match { - BIT(may_multiplex); - BIT(want_ntlm_http); - BIT(want_proxy_ntlm_http); -+ BIT(want_nego_http); -+ BIT(want_proxy_nego_http); - - BIT(wait_pipe); - BIT(force_reuse); -@@ -1185,6 +1187,63 @@ static bool url_match_auth_ntlm(struct connectdata *conn, - #define url_match_auth_ntlm(c,m) ((void)c, (void)m, TRUE) - #endif - -+#ifdef USE_SPNEGO -+static bool url_match_auth_nego(struct connectdata *conn, -+ struct url_conn_match *m) -+{ -+ /* If we are looking for an HTTP+Negotiate connection, check if this is -+ already authenticating with the right credentials. If not, keep looking -+ so that we can reuse Negotiate connections if possible. */ -+ if(m->want_nego_http) { -+ if(Curl_timestrcmp(m->needle->user, conn->user) || -+ Curl_timestrcmp(m->needle->passwd, conn->passwd)) -+ return FALSE; -+ } -+ else if(conn->http_negotiate_state != GSS_AUTHNONE) { -+ /* Connection is using Negotiate auth but we do not want Negotiate */ -+ return FALSE; -+ } -+ -+#ifndef CURL_DISABLE_PROXY -+ /* Same for Proxy Negotiate authentication */ -+ if(m->want_proxy_nego_http) { -+ /* Both conn->http_proxy.user and conn->http_proxy.passwd can be -+ * NULL */ -+ if(!conn->http_proxy.user || !conn->http_proxy.passwd) -+ return FALSE; -+ -+ if(Curl_timestrcmp(m->needle->http_proxy.user, -+ conn->http_proxy.user) || -+ Curl_timestrcmp(m->needle->http_proxy.passwd, -+ conn->http_proxy.passwd)) -+ return FALSE; -+ } -+ else if(conn->proxy_negotiate_state != GSS_AUTHNONE) { -+ /* Proxy connection is using Negotiate auth but we do not want Negotiate */ -+ return FALSE; -+ } -+#endif -+ if(m->want_ntlm_http || m->want_proxy_ntlm_http) { -+ /* Credentials are already checked, we may use this connection. We MUST -+ * use a connection where it has already been fully negotiated. If it has -+ * not, we keep on looking for a better one. */ -+ m->found = conn; -+ if((m->want_nego_http && -+ (conn->http_negotiate_state != GSS_AUTHNONE)) || -+ (m->want_proxy_nego_http && -+ (conn->proxy_negotiate_state != GSS_AUTHNONE))) { -+ /* We must use this connection, no other */ -+ m->force_reuse = TRUE; -+ return TRUE; -+ } -+ return FALSE; /* get another */ -+ } -+ return TRUE; -+} -+#else -+#define url_match_auth_nego(c, m) ((void)c, (void)m, TRUE) -+#endif -+ - static bool url_match_conn(struct connectdata *conn, void *userdata) - { - struct url_conn_match *m = userdata; -@@ -1228,6 +1287,11 @@ static bool url_match_conn(struct connectdata *conn, void *userdata) - else if(m->force_reuse) - return TRUE; - -+ if(!url_match_auth_nego(conn, m)) -+ return FALSE; -+ else if(m->force_reuse) -+ return TRUE; -+ - if(!url_match_multiplex_limits(conn, m)) - return FALSE; - -@@ -1290,13 +1354,26 @@ static bool url_attach_existing(struct Curl_easy *data, - match.may_multiplex = xfer_may_multiplex(data, needle); - - #ifdef USE_NTLM -- match.want_ntlm_http = ((data->state.authhost.want & CURLAUTH_NTLM) && -- (needle->handler->protocol & PROTO_FAMILY_HTTP)); -+ match.want_ntlm_http = -+ (data->state.authhost.want & CURLAUTH_NTLM) && -+ (needle->handler->protocol & PROTO_FAMILY_HTTP); - #ifndef CURL_DISABLE_PROXY - match.want_proxy_ntlm_http = -- (needle->bits.proxy_user_passwd && -- (data->state.authproxy.want & CURLAUTH_NTLM) && -- (needle->handler->protocol & PROTO_FAMILY_HTTP)); -+ needle->bits.proxy_user_passwd && -+ (data->state.authproxy.want & CURLAUTH_NTLM) && -+ (needle->handler->protocol & PROTO_FAMILY_HTTP); -+#endif -+#endif -+ -+#if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO) -+ match.want_nego_http = -+ (data->state.authhost.want & CURLAUTH_NEGOTIATE) && -+ (needle->handler->protocol & PROTO_FAMILY_HTTP); -+#ifndef CURL_DISABLE_PROXY -+ match.want_proxy_nego_http = -+ needle->bits.proxy_user_passwd && -+ (data->state.authproxy.want & CURLAUTH_NEGOTIATE) && -+ (needle->handler->protocol & PROTO_FAMILY_HTTP); - #endif - #endif - --- -2.53.0 - diff --git a/external/curl/0001-ws-get-a-new-mask-for-each-new-outgoing-frame.patch b/external/curl/0001-ws-get-a-new-mask-for-each-new-outgoing-frame.patch deleted file mode 100644 index 99f497d26726..000000000000 --- a/external/curl/0001-ws-get-a-new-mask-for-each-new-outgoing-frame.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 84db7a9eae8468c0445b15aa806fa7fa806fa0f2 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Mon, 8 Sep 2025 14:14:15 +0200 -Subject: [PATCH] ws: get a new mask for each new outgoing frame - -Reported-by: Calvin Ruocco -Closes #18496 ---- - lib/ws.c | 28 +++++++++++++--------------- - 1 file changed, 13 insertions(+), 15 deletions(-) - -diff --git a/lib/ws.c b/lib/ws.c -index e973409b6..3b6542816 100644 ---- a/lib/ws.c -+++ b/lib/ws.c -@@ -875,6 +875,19 @@ static CURLcode ws_enc_add_frame(struct Curl_easy *data, - enc->payload_remain = enc->payload_len = payload_len; - ws_enc_info(enc, data, "sending"); - -+ /* 4 bytes random */ -+ -+ CURLcode result = -+ Curl_rand(data, (unsigned char *)&enc->mask, sizeof(enc->mask)); -+ if(result) -+ return result; -+ -+#ifdef DEBUGBUILD -+ if(getenv("CURL_WS_FORCE_ZERO_MASK")) -+ /* force the bit mask to 0x00000000, effectively disabling masking */ -+ memset(&enc->mask, 0, sizeof(enc->mask)); -+#endif -+ - /* add 4 bytes mask */ - memcpy(&head[hlen], &enc->mask, 4); - hlen += 4; -@@ -1335,21 +1347,7 @@ CURLcode Curl_ws_accept(struct Curl_easy *data, - subprotocol not requested by the client), the client MUST Fail - the WebSocket Connection. */ - -- /* 4 bytes random */ -- -- result = Curl_rand(data, (unsigned char *)&ws->enc.mask, -- sizeof(ws->enc.mask)); -- if(result) -- return result; -- --#ifdef DEBUGBUILD -- if(getenv("CURL_WS_FORCE_ZERO_MASK")) -- /* force the bit mask to 0x00000000, effectively disabling masking */ -- memset(ws->enc.mask, 0, sizeof(ws->enc.mask)); --#endif -- -- infof(data, "[WS] Received 101, switch to WebSocket; mask %02x%02x%02x%02x", -- ws->enc.mask[0], ws->enc.mask[1], ws->enc.mask[2], ws->enc.mask[3]); -+ infof(data, "[WS] Received 101, switch to WebSocket"); - - /* Install our client writer that decodes WS frames payload */ - result = Curl_cwriter_create(&ws_dec_writer, data, &ws_cw_decode, --- -2.39.5 - diff --git a/external/curl/ExternalProject_curl.mk b/external/curl/ExternalProject_curl.mk index 652cc30021a3..f31c671bbb23 100644 --- a/external/curl/ExternalProject_curl.mk +++ b/external/curl/ExternalProject_curl.mk @@ -34,8 +34,7 @@ curl_LDFLAGS += -L$(SYSBASE)/usr/lib endif endif -# use --with-secure-transport on macOS >10.5 and iOS to get a native UI for SSL certs for CMIS usage -# use --with-openssl only on platforms other than macOS and iOS +# use --with-openssl on all platforms $(call gb_ExternalProject_get_state_target,curl,build): $(call gb_Trace_StartRange,curl,EXTERNAL) $(call gb_ExternalProject_run,build,\ @@ -52,9 +51,8 @@ $(call gb_ExternalProject_get_state_target,curl,build): --disable-ldap --disable-ldaps --disable-manual --disable-pop3 \ --disable-rtsp --disable-smb --disable-smtp --disable-telnet \ --disable-tftp \ - $(if $(filter iOS MACOSX,$(OS)),\ - --with-secure-transport,\ - $(if $(ENABLE_OPENSSL),--with-openssl$(if $(SYSTEM_OPENSSL),,="$(gb_UnpackedTarball_workdir)/openssl"))) \ + $(if $(ENABLE_OPENSSL),--with-openssl$(if $(SYSTEM_OPENSSL),,="$(gb_UnpackedTarball_workdir)/openssl")) \ + $(if $(filter iOS MACOSX,$(OS)),--with-apple-sectrust) \ $(if $(filter LINUX,$(OS)),--without-ca-bundle --without-ca-path) \ $(gb_CONFIGURE_PLATFORMS) \ $(if $(filter TRUE,$(DISABLE_DYNLOADING)),--disable-shared,--disable-static) \ diff --git a/external/curl/UnpackedTarball_curl.mk b/external/curl/UnpackedTarball_curl.mk index 29f1dc43860e..8bb9119ff65f 100644 --- a/external/curl/UnpackedTarball_curl.mk +++ b/external/curl/UnpackedTarball_curl.mk @@ -19,13 +19,6 @@ $(eval $(call gb_UnpackedTarball_update_autoconf_configs,curl)) $(eval $(call gb_UnpackedTarball_add_patches,curl,\ external/curl/zlib.patch.0 \ - external/curl/0001-const-up-readonly-H2_NON_FIELD.patch.1 \ - external/curl/0001-cookie-don-t-treat-the-leading-slash-as-trailing.patch \ - external/curl/0001-ws-get-a-new-mask-for-each-new-outgoing-frame.patch \ - external/curl/0001-url-fix-reuse-of-connections-using-HTTP-Negotiate.patch \ - external/curl/0001-url-fix-copy-and-paste-url_match_auth_nego-mistake.patch \ - external/curl/0001-http-only-send-bearer-if-auth-is-allowed.patch \ - external/curl/0001-proxy-auth-additional-tests.patch \ )) ifeq ($(ENABLE_EMSCRIPTEN_PROXY_POSIX_SOCKETS),TRUE) diff --git a/external/curl/zlib.patch.0 b/external/curl/zlib.patch.0 index 83993fe8a56f..c334d6de452b 100644 --- a/external/curl/zlib.patch.0 +++ b/external/curl/zlib.patch.0 @@ -8,15 +8,15 @@ # Check whether --with-zlib was given. if test ${with_zlib+y} -@@ -23609,12 +23609,28 @@ +@@ -23922,12 +23922,28 @@ - if test "$OPT_ZLIB" = "no"; then + if test "x$OPT_ZLIB" = "xno"; then + ZLIB_LIBS="" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: zlib disabled" >&5 printf "%s\n" "$as_me: WARNING: zlib disabled" >&2;} else - if test "$OPT_ZLIB" = "yes"; then + if test "x$OPT_ZLIB" = "xyes"; then OPT_ZLIB="" fi + @@ -36,33 +36,32 @@ + ZLIB_LIBS="" if test -z "$OPT_ZLIB"; then - -@@ -23903,6 +23903,7 @@ + +@@ -24232,6 +24248,7 @@ LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE zlib" curl_zlib_msg="enabled" fi + fi fi - if test x"$AMFIXLIB" = x1; then + if test "$AMFIXLIB" = "1"; then --- configure.ac +++ configure.ac -@@ -1302,19 +1302,31 @@ +@@ -1392,19 +1392,30 @@ clean_CPPFLAGS=$CPPFLAGS clean_LDFLAGS=$LDFLAGS clean_LIBS=$LIBS -ZLIB_LIBS="" -+ AC_ARG_WITH(zlib, AS_HELP_STRING([--with-zlib=PATH],[search for zlib in PATH]) AS_HELP_STRING([--without-zlib],[disable use of zlib]), [OPT_ZLIB="$withval"]) - if test "$OPT_ZLIB" = "no"; then + if test "x$OPT_ZLIB" = "xno"; then + ZLIB_LIBS="" AC_MSG_WARN([zlib disabled]) else - if test "$OPT_ZLIB" = "yes"; then + if test "x$OPT_ZLIB" = "xyes"; then OPT_ZLIB="" fi diff --git a/include/systools/curlinit.hxx b/include/systools/curlinit.hxx index 85cd22bd470a..d97f84a80f8f 100644 --- a/include/systools/curlinit.hxx +++ b/include/systools/curlinit.hxx @@ -13,7 +13,7 @@ #include -// curl is built with --with-secure-transport on macOS and iOS so doesn't need these +// curl is built with --with-apple-sectrust on macOS and iOS so doesn't need these // certs. Windows doesn't need them either, but let's assume everything else does #if !defined(SYSTEM_OPENSSL) && !defined(_WIN32) && !defined(MACOSX) && !defined(IOS) #include