diff --git a/RepositoryExternal.mk b/RepositoryExternal.mk index fe68e006919b..45ac4f26b476 100644 --- a/RepositoryExternal.mk +++ b/RepositoryExternal.mk @@ -2885,7 +2885,7 @@ $(call gb_LinkTarget_set_include,$(1),\ ifeq ($(COM),MSC) $(call gb_LinkTarget_add_libs,$(1),\ - $(gb_UnpackedTarball_workdir)/curl/builds/libcurl-vc12-$(gb_MSBUILD_PLATFORM)-$(gb_MSBUILD_CONFIG)-dll-zlib-static-ipv6-sspi-schannel/lib/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).lib \ + $(gb_UnpackedTarball_workdir)/curl/lib/$(if $(MSVC_USE_DEBUG_RUNTIME),Debug,Release)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),-d)_imp.lib \ ) else $(call gb_LinkTarget_add_libs,$(1),\ diff --git a/config_host.mk.in b/config_host.mk.in index 7b798cbb70b9..d3358e88abaa 100644 --- a/config_host.mk.in +++ b/config_host.mk.in @@ -77,6 +77,7 @@ export CLUCENE_CFLAGS=$(gb_SPACE)@CLUCENE_CFLAGS@ export CLUCENE_LIBS=$(gb_SPACE)@CLUCENE_LIBS@ export LIBCMIS_CFLAGS=$(gb_SPACE)@LIBCMIS_CFLAGS@ export LIBCMIS_LIBS=$(gb_SPACE)@LIBCMIS_LIBS@ +CMAKE=@CMAKE@ export COM=@COM@ export COMPATH=@COMPATH@ export COMPILER_PLUGINS=@COMPILER_PLUGINS@ diff --git a/configure.ac b/configure.ac index d8dea084890b..8977abf0716c 100644 --- a/configure.ac +++ b/configure.ac @@ -4589,6 +4589,7 @@ test_cl_exe() SOLARINC= MSBUILD_PATH= DEVENV= +CMAKE= if test "$_os" = "WINNT"; then AC_MSG_CHECKING([Visual C++]) find_msvc "$with_visual_studio" @@ -4667,6 +4668,10 @@ if test "$_os" = "WINNT"; then AC_MSG_ERROR([MSBuild.exe location not found]) fi + # Find the cmake.exe in Visual Studio Extensions + PathFormat "$VC_PRODUCT_DIR/../Common7/IDE/CommonExtensions/Microsoft/CMake/CMake/bin/cmake.exe" + CMAKE="$formatted_path" + # Find the version of devenv.exe PathFormat "$VC_PRODUCT_DIR/../Common7/IDE/devenv.exe" DEVENV="$formatted_path" @@ -4775,6 +4780,7 @@ if test "$_os" = "WINNT"; then fi AC_SUBST(VCVER) AC_SUBST(VCTOOLSET) +AC_SUBST(CMAKE) AC_SUBST(DEVENV) AC_SUBST(MSVC_CXX) diff --git a/download.lst b/download.lst index cc022135c91e..2af4700179dd 100644 --- a/download.lst +++ b/download.lst @@ -80,8 +80,8 @@ CPPUNIT_TARBALL := cppunit-1.15.1.tar.gz # three static lines # so that git cherry-pick # will not run into conflicts -CURL_SHA256SUM := f4619a1e2474c4bbfedc88a7c2191209c8334b48fa1f4e53fd584cc12e9120dd -CURL_TARBALL := curl-8.14.1.tar.xz +CURL_SHA256SUM := aa1b66a70eace83dc624508745646c08ae561de512ab403adffb93ac87fc72e6 +CURL_TARBALL := curl-8.21.0.tar.xz # three static lines # so that git cherry-pick # will not run into conflicts diff --git a/external/curl/0001-const-up-readonly-H2_NON_FIELD.patch.1 b/external/curl/0001-const-up-readonly-H2_NON_FIELD.patch.1 deleted file mode 100644 index 6d7104bfea77..000000000000 --- a/external/curl/0001-const-up-readonly-H2_NON_FIELD.patch.1 +++ /dev/null @@ -1,25 +0,0 @@ -From df1f9619ac00091b309a479a166fe861f935779c Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= -Date: Tue, 22 Jul 2025 14:48:26 +0100 -Subject: [PATCH] const up readonly H2_NON_FIELD - ---- - lib/http.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/http.c b/lib/http.c -index e5a069627..9a844301f 100644 ---- a/lib/http.c -+++ b/lib/http.c -@@ -4569,7 +4569,7 @@ struct name_const { - }; - - /* keep them sorted by length! */ --static struct name_const H2_NON_FIELD[] = { -+static const struct name_const H2_NON_FIELD[] = { - { STRCONST("Host") }, - { STRCONST("Upgrade") }, - { STRCONST("Connection") }, --- -2.49.0 - diff --git a/external/curl/0001-cookie-don-t-treat-the-leading-slash-as-trailing.patch b/external/curl/0001-cookie-don-t-treat-the-leading-slash-as-trailing.patch deleted file mode 100644 index 45fba1f8af4e..000000000000 --- a/external/curl/0001-cookie-don-t-treat-the-leading-slash-as-trailing.patch +++ /dev/null @@ -1,54 +0,0 @@ -From c6ae07c6a541e0e96d0040afb62b45dd37711300 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Mon, 11 Aug 2025 20:23:05 +0200 -Subject: [PATCH] cookie: don't treat the leading slash as trailing - -If there is only a leading slash in the path, keep that. Also add an -assert to make sure the path is never blank. - -Reported-by: Google Big Sleep -Closes #18266 ---- - lib/cookie.c | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - -diff --git a/lib/cookie.c b/lib/cookie.c -index 914a4aca1..b72dd99bc 100644 ---- a/lib/cookie.c -+++ b/lib/cookie.c -@@ -296,9 +296,9 @@ static char *sanitize_cookie_path(const char *cookie_path) - /* Let cookie-path be the default-path. */ - return strdup("/"); - -- /* remove trailing slash */ -+ /* remove trailing slash when path is non-empty */ - /* convert /hoge/ to /hoge */ -- if(len && cookie_path[len - 1] == '/') -+ if(len > 1 && cookie_path[len - 1] == '/') - len--; - - return Curl_memdup0(cookie_path, len); -@@ -965,7 +965,7 @@ replace_existing(struct Curl_easy *data, - clist->spath && co->spath && /* both have paths */ - clist->secure && !co->secure && !secure) { - size_t cllen; -- const char *sep; -+ const char *sep = NULL; - - /* - * A non-secure cookie may not overlay an existing secure cookie. -@@ -974,8 +974,9 @@ replace_existing(struct Curl_easy *data, - * "/loginhelper" is ok. - */ - -- sep = strchr(clist->spath + 1, '/'); -- -+ DEBUGASSERT(clist->spath[0]); -+ if(clist->spath[0]) -+ sep = strchr(clist->spath + 1, '/'); - if(sep) - cllen = sep - clist->spath; - else --- -2.39.5 - diff --git a/external/curl/0001-digest-flush-state-on-origin-or-credential-change.patch b/external/curl/0001-digest-flush-state-on-origin-or-credential-change.patch deleted file mode 100644 index 22277f3a18c8..000000000000 --- a/external/curl/0001-digest-flush-state-on-origin-or-credential-change.patch +++ /dev/null @@ -1,338 +0,0 @@ -From 595b3830680595c9d375896e8b92f5356f558a53 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Wed, 10 Jun 2026 10:27:50 +0200 -Subject: [PATCH] digest: flush state on origin or credential change - -Verified by test 1686 - -Closes #21944 - -(cherry picked from commit 5c6b4880357ab3e72967c1c45cae0f96ffabc535) ---- - lib/http_digest.c | 34 +++++++++++++ - lib/urldata.h | 7 +++ - lib/vauth/digest.c | 3 ++ - lib/vauth/digest_sspi.c | 5 ++ - tests/data/Makefile.am | 2 +- - tests/data/test1686 | 83 ++++++++++++++++++++++++++++++ - tests/libtest/Makefile.inc | 4 ++ - tests/libtest/lib1686.c | 102 +++++++++++++++++++++++++++++++++++++ - 8 files changed, 239 insertions(+), 1 deletion(-) - create mode 100644 tests/data/test1686 - create mode 100644 tests/libtest/lib1686.c - -diff --git a/lib/http_digest.c b/lib/http_digest.c -index 651bb83403..40137f4391 100644 ---- a/lib/http_digest.c -+++ b/lib/http_digest.c -@@ -104,6 +104,36 @@ CURLcode Curl_output_digest(struct Curl_easy *data, - #endif - } - else { -+ bool flush = FALSE; -+ const char *curorigin = data->conn ? data->conn->destination : NULL; -+ const char *curuser = data->state.aptr.user ? -+ data->state.aptr.user : ""; -+ const char *curpasswd = data->state.aptr.passwd ? -+ data->state.aptr.passwd : ""; -+ -+ if(data->state.digest.origin && curorigin && -+ strcmp(data->state.digest.origin, curorigin)) -+ flush = TRUE; -+ else if(data->state.digest.creduser && -+ (strcmp(data->state.digest.creduser, curuser) || -+ strcmp(data->state.digest.credpasswd ? -+ data->state.digest.credpasswd : "", curpasswd))) -+ flush = TRUE; -+ -+ if(flush) -+ /* flush host Digest state */ -+ Curl_auth_digest_cleanup(&data->state.digest); -+ -+ /* remember the origin and credentials this host Digest state is for */ -+ if(curorigin) { -+ Curl_safefree(data->state.digest.origin); -+ data->state.digest.origin = strdup(curorigin); -+ } -+ Curl_safefree(data->state.digest.creduser); -+ data->state.digest.creduser = strdup(curuser); -+ Curl_safefree(data->state.digest.credpasswd); -+ data->state.digest.credpasswd = strdup(curpasswd); -+ - digest = &data->state.digest; - allocuserpwd = &data->state.aptr.userpwd; - userp = data->state.aptr.user; -diff --git a/lib/urldata.h b/lib/urldata.h -index 45052e84b1..8655e8186a 100644 ---- a/lib/urldata.h -+++ b/lib/urldata.h -@@ -318,6 +318,9 @@ struct ssl_general_config { - #ifndef CURL_DISABLE_DIGEST_AUTH - /* Struct used for Digest challenge-response authentication */ - struct digestdata { -+ char *origin; -+ char *creduser; -+ char *credpasswd; - #if defined(USE_WINDOWS_SSPI) - BYTE *input_token; - size_t input_token_len; -diff --git a/lib/vauth/digest.c b/lib/vauth/digest.c -index ec4e82256c..225e993e72 100644 ---- a/lib/vauth/digest.c -+++ b/lib/vauth/digest.c -@@ -998,6 +998,9 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data, - */ - void Curl_auth_digest_cleanup(struct digestdata *digest) - { -+ Curl_safefree(digest->origin); -+ Curl_safefree(digest->creduser); -+ Curl_safefree(digest->credpasswd); - Curl_safefree(digest->nonce); - Curl_safefree(digest->cnonce); - Curl_safefree(digest->realm); -diff --git a/lib/vauth/digest_sspi.c b/lib/vauth/digest_sspi.c -index 2761c59965..428ffd6916 100644 ---- a/lib/vauth/digest_sspi.c -+++ b/lib/vauth/digest_sspi.c -@@ -678,6 +678,11 @@ void Curl_auth_digest_cleanup(struct digestdata *digest) - /* Free the copy of user/passwd used to make the identity for http_context */ - Curl_safefree(digest->user); - Curl_safefree(digest->passwd); -+ -+ /* Free the origin/credentials tracked for host Digest state flushing */ -+ Curl_safefree(digest->origin); -+ Curl_safefree(digest->creduser); -+ Curl_safefree(digest->credpasswd); - } - - #endif /* USE_WINDOWS_SSPI && !CURL_DISABLE_DIGEST_AUTH */ -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index 1ef85cd3a2..b6a212763f 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -225,7 +225,7 @@ test1660 test1661 test1662 test1663 test1664 \ - \ - test1670 test1671 \ - \ --test1680 test1681 test1682 test1683 \ -+test1680 test1681 test1682 test1683 test1686 \ - \ - test1700 test1701 test1702 test1703 test1704 test1705 test1706 test1707 \ - test1708 test1709 test1710 \ -diff --git a/tests/data/test1686 b/tests/data/test1686 -new file mode 100644 -index 0000000000..a9413a6c4f ---- /dev/null -+++ b/tests/data/test1686 -@@ -0,0 +1,83 @@ -+ -+ -+ -+ -+HTTP -+Digest -+ -+ -+ -+ -+ -+HTTP/1.1 401 Authorization Required -+Server: Apache/1.3.27 (Darwin) PHP/4.1.2 -+WWW-Authenticate: Digest realm="my-backyard", nonce="314156295" -+Content-Length: 26 -+ -+This is not the real page -+ -+ -+# This is supposed to be returned when the server gets a -+# Authorization: Digest line passed-in from the client -+ -+HTTP/1.1 200 OK -+Server: Apache/1.3.27 (Darwin) PHP/4.1.2 -+Content-Type: text/html; charset=iso-8859-1 -+Content-Length: 23 -+ -+This IS the real page! -+ -+ -+ -+ -+ -+ -+!SSPI -+crypto -+ -+ -+http -+ -+ -+HTTP Digest to different origins and switching credentials -+ -+ -+lib%TESTNUMBER -+ -+ -+%HOSTIP %HTTPPORT -+ -+ -+ -+ -+ -+GET /api HTTP/1.1 -+Host: first.test:%HTTPPORT -+Accept: */* -+ -+GET /api HTTP/1.1 -+Host: first.test:%HTTPPORT -+Authorization: Digest username="alice", realm="my-backyard", nonce="314156295", uri="/api", response="4ecc00e567c37a9d537727890c2e5b32" -+Accept: */* -+ -+GET /hook HTTP/1.1 -+Host: second.test:%HTTPPORT -+Accept: */* -+ -+GET /hook HTTP/1.1 -+Host: second.test:%HTTPPORT -+Authorization: Digest username="alice", realm="my-backyard", nonce="314156295", uri="/hook", response="d3a7738fb6a23f5543fb8dacc0f0f253" -+Accept: */* -+ -+GET /hook HTTP/1.1 -+Host: second.test:%HTTPPORT -+Accept: */* -+ -+GET /hook HTTP/1.1 -+Host: second.test:%HTTPPORT -+Authorization: Digest username="bob", realm="my-backyard", nonce="314156295", uri="/hook", response="777e68eddb77294d9cbd6134973cbbab" -+Accept: */* -+ -+ -+ -+ -diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc -index d130d5158d..1dcd51434f 100644 ---- a/tests/libtest/Makefile.inc -+++ b/tests/libtest/Makefile.inc -@@ -68,6 +68,7 @@ LIBTESTPROGS = libauthretry libntlmconnect libprereq \ - \ - lib1647 \ - lib1662 \ -+ lib1686 \ - \ - lib1900 lib1901 \ - lib1903 lib1905 lib1906 lib1907 lib1908 lib1910 lib1911 lib1912 lib1913 \ -@@ -566,6 +568,8 @@ lib1598_LDADD = $(TESTUTIL_LIBS) - lib1662_SOURCES = lib1662.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) - lib1662_LDADD = $(TESTUTIL_LIBS) - -+lib1686_SOURCES = lib1686.c $(SUPPORTFILES) -+ - lib1900_SOURCES = lib1900.c $(SUPPORTFILES) - - lib1901_SOURCES = lib1901.c $(SUPPORTFILES) -diff --git a/tests/libtest/lib1686.c b/tests/libtest/lib1686.c -new file mode 100644 -index 0000000000..fd1ed4ed9c ---- /dev/null -+++ b/tests/libtest/lib1686.c -@@ -0,0 +1,98 @@ -+/*************************************************************************** -+ * _ _ ____ _ -+ * Project ___| | | | _ \| | -+ * / __| | | | |_) | | -+ * | (__| |_| | _ <| |___ -+ * \___|\___/|_| \_\_____| -+ * -+ * Copyright (C) Daniel Stenberg, , et al. -+ * -+ * This software is licensed as described in the file COPYING, which -+ * you should have received as part of this distribution. The terms -+ * are also available at https://curl.se/docs/copyright.html. -+ * -+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell -+ * copies of the Software, and permit persons to whom the Software is -+ * furnished to do so, under the terms of the COPYING file. -+ * -+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY -+ * KIND, either express or implied. -+ * -+ * SPDX-License-Identifier: curl -+ * -+ ***************************************************************************/ -+#include "test.h" -+ -+#include "memdebug.h" -+ -+static size_t devnull_1686(char *p, size_t s, size_t n, void *u) -+{ -+ (void)p; -+ (void)u; -+ return s * n; -+} -+ -+#define FIRSTHOST "first.test" -+#define SECONDHOST "second.test" -+ -+CURLcode test(const char *hostip) -+{ -+ CURL *curl = NULL; -+ CURLcode result = CURLE_OK; -+ const char *httpport = libtest_arg2; -+ char firsturl[100]; -+ char secondurl[100]; -+ char firstres[100]; -+ char secondres[100]; -+ struct curl_slist *host = NULL; -+ struct curl_slist *host2 = NULL; -+ -+ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) { -+ curl_mfprintf(stderr, "curl_global_init() failed\n"); -+ return TEST_ERR_MAJOR_BAD; -+ } -+ -+ /* create strings for CURLOPT_RESOLVE */ -+ curl_msnprintf(firstres, sizeof(firstres), "%s:%s:%s", -+ FIRSTHOST, httpport, hostip); -+ curl_msnprintf(secondres, sizeof(secondres), "%s:%s:%s", -+ SECONDHOST, httpport, hostip); -+ -+ /* create URLs */ -+ curl_msnprintf(firsturl, sizeof(firsturl), "http://%s:%s/api", -+ FIRSTHOST, httpport); -+ curl_msnprintf(secondurl, sizeof(secondurl), "http://%s:%s/hook", -+ SECONDHOST, httpport); -+ -+ host = curl_slist_append(NULL, firstres); -+ if(!host) -+ goto test_cleanup; -+ host2 = curl_slist_append(host, secondres); -+ if(!host2) -+ goto test_cleanup; -+ host = host2; -+ -+ curl = curl_easy_init(); -+ if(curl) { -+ easy_setopt(curl, CURLOPT_RESOLVE, host); -+ easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_DIGEST); -+ easy_setopt(curl, CURLOPT_USERPWD, "alice:bond"); -+ easy_setopt(curl, CURLOPT_WRITEFUNCTION, devnull_1686); -+ -+ easy_setopt(curl, CURLOPT_URL, firsturl); -+ result = curl_easy_perform(curl); -+ -+ easy_setopt(curl, CURLOPT_URL, secondurl); -+ result = curl_easy_perform(curl); -+ -+ easy_setopt(curl, CURLOPT_USERPWD, "bob:secret"); -+ easy_setopt(curl, CURLOPT_URL, secondurl); -+ result = curl_easy_perform(curl); -+ } -+ -+test_cleanup: -+ curl_easy_cleanup(curl); -+ curl_global_cleanup(); -+ curl_slist_free_all(host); -+ return result; -+} --- -2.54.0 - diff --git a/external/curl/0001-http-clear-the-proxy-credentials-as-well-on-port-or-.patch b/external/curl/0001-http-clear-the-proxy-credentials-as-well-on-port-or-.patch deleted file mode 100644 index a136165a28b9..000000000000 --- a/external/curl/0001-http-clear-the-proxy-credentials-as-well-on-port-or-.patch +++ /dev/null @@ -1,382 +0,0 @@ -From 188c2f166a20fa97c2325b2da7d0e5cecc13725f Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Mon, 13 Apr 2026 17:17:23 +0200 -Subject: [PATCH] http: clear the proxy credentials as well on port or scheme - change - -Add tests 2009-2011 to verify switching between proxies with credentials -when the switch is driven by a redirect - -Reported-by: Dwij Mehta - -Closes #21304 ---- - lib/http.c | 12 +++++++ - lib/transfer.c | 51 +++++++++++++++++++++--------- - lib/transfer.h | 2 ++ - tests/data/Makefile.am | 2 +- - tests/data/test2009 | 70 +++++++++++++++++++++++++++++++++++++++++ - tests/data/test2010 | 71 ++++++++++++++++++++++++++++++++++++++++++ - tests/data/test2011 | 70 +++++++++++++++++++++++++++++++++++++++++ - 7 files changed, 262 insertions(+), 16 deletions(-) - create mode 100644 tests/data/test2009 - create mode 100644 tests/data/test2010 - create mode 100644 tests/data/test2011 - -diff --git a/lib/http.c b/lib/http.c -index a1e58e886c..f976987111 100644 ---- a/lib/http.c -+++ b/lib/http.c -@@ -1278,12 +1278,24 @@ CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl, - free(scheme); - } - if(clear) { -+ CURLcode result = Curl_reset_userpwd(data); -+ if(result) { -+ free(follow_url); -+ return result; -+ } - Curl_safefree(data->state.aptr.user); - Curl_safefree(data->state.aptr.passwd); - } - } - } - DEBUGASSERT(follow_url); -+ { -+ CURLcode result = Curl_reset_proxypwd(data); -+ if(result) { -+ free(follow_url); -+ return result; -+ } -+ } - - if(type == FOLLOW_FAKE) { - /* we are only figuring out the new URL if we would have followed locations -diff --git a/lib/transfer.c b/lib/transfer.c -index dd4e16b7f5..a2fce9331b 100644 ---- a/lib/transfer.c -+++ b/lib/transfer.c -@@ -438,6 +438,40 @@ void Curl_init_CONNECT(struct Curl_easy *data) - data->state.upload = (data->state.httpreq == HTTPREQ_PUT); - } - -+/* -+ * Restore the user credentials to those set in options. -+ */ -+CURLcode Curl_reset_userpwd(struct Curl_easy *data) -+{ -+ CURLcode result; -+ if(data->set.str[STRING_USERNAME] || data->set.str[STRING_PASSWORD]) -+ data->state.creds_from = CREDS_OPTION; -+ result = Curl_setstropt(&data->state.aptr.user, -+ data->set.str[STRING_USERNAME]); -+ if(!result) -+ result = Curl_setstropt(&data->state.aptr.passwd, -+ data->set.str[STRING_PASSWORD]); -+ return result; -+} -+ -+/* -+ * Restore the proxy credentials to those set in options. -+ */ -+CURLcode Curl_reset_proxypwd(struct Curl_easy *data) -+{ -+#ifndef CURL_DISABLE_PROXY -+ CURLcode result = Curl_setstropt(&data->state.aptr.proxyuser, -+ data->set.str[STRING_PROXYUSERNAME]); -+ if(!result) -+ result = Curl_setstropt(&data->state.aptr.proxypasswd, -+ data->set.str[STRING_PROXYPASSWORD]); -+ return result; -+#else -+ (void)data; -+ return CURLE_OK; -+#endif -+} -+ - /* - * Curl_pretransfer() is called immediately before a transfer starts, and only - * once for one transfer no matter if it has redirects or do multi-pass -@@ -586,23 +620,10 @@ CURLcode Curl_pretransfer(struct Curl_easy *data) - return CURLE_OUT_OF_MEMORY; - } - -- if(data->set.str[STRING_USERNAME] || -- data->set.str[STRING_PASSWORD]) -- data->state.creds_from = CREDS_OPTION; - if(!result) -- result = Curl_setstropt(&data->state.aptr.user, -- data->set.str[STRING_USERNAME]); -+ result = Curl_reset_userpwd(data); - if(!result) -- result = Curl_setstropt(&data->state.aptr.passwd, -- data->set.str[STRING_PASSWORD]); --#ifndef CURL_DISABLE_PROXY -- if(!result) -- result = Curl_setstropt(&data->state.aptr.proxyuser, -- data->set.str[STRING_PROXYUSERNAME]); -- if(!result) -- result = Curl_setstropt(&data->state.aptr.proxypasswd, -- data->set.str[STRING_PROXYPASSWORD]); --#endif -+ result = Curl_reset_proxypwd(data); - - data->req.headerbytecount = 0; - Curl_headers_cleanup(data); -diff --git a/lib/transfer.h b/lib/transfer.h -index 41ec0357f6..b29e70b9ec 100644 ---- a/lib/transfer.h -+++ b/lib/transfer.h -@@ -31,6 +31,8 @@ char *Curl_checkheaders(const struct Curl_easy *data, - - void Curl_init_CONNECT(struct Curl_easy *data); - -+CURLcode Curl_reset_userpwd(struct Curl_easy *data); -+CURLcode Curl_reset_proxypwd(struct Curl_easy *data); - CURLcode Curl_pretransfer(struct Curl_easy *data); - - CURLcode Curl_sendrecv(struct Curl_easy *data, struct curltime *nowp); -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index 44ff75668f..3003dce03b 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -244,6 +244,7 @@ test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \ - test1978 test1979 test1980 \ - \ - test2000 test2001 test2002 test2003 test2004 test2005 test2006 \ -+test2009 test2010 test2011 \ - \ - test2023 \ - test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \ -diff --git a/tests/data/test2009 b/tests/data/test2009 -new file mode 100644 -index 0000000000..d2fd79e0d6 ---- /dev/null -+++ b/tests/data/test2009 -@@ -0,0 +1,70 @@ -+ -+ -+ -+ -+HTTP -+HTTP proxy -+http_proxy -+ -+ -+# Server-side -+ -+ -+HTTP/1.1 407 Denied -+ -+ -+ -+HTTP/1.1 301 redirect -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Content-Length: 4 -+Content-Type: text/html -+Location: https://another.example/%TESTNUMBER0002 -+ -+boo -+ -+ -+ -+# Client-side -+ -+ -+proxy -+ -+ -+http -+https -+ -+ -+proxy credentials via env variables, redirect from http to https -+ -+ -+ -+http_proxy=http://user:secret@%HOSTIP:%HTTPPORT -+https_proxy=https://%HOSTIP:%HTTPSPORT/ -+ -+ -+http://somewhere.example/ --follow --proxy-insecure -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+GET http://somewhere.example/ HTTP/1.1 -+Host: somewhere.example -+Proxy-Authorization: Basic %b64[user:secret]b64% -+User-Agent: curl/%VERSION -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+CONNECT another.example:443 HTTP/1.1 -+Host: another.example:443 -+User-Agent: curl/%VERSION -+Proxy-Connection: Keep-Alive -+ -+ -+ -+7 -+ -+ -+ -diff --git a/tests/data/test2010 b/tests/data/test2010 -new file mode 100644 -index 0000000000..443ae9d2f9 ---- /dev/null -+++ b/tests/data/test2010 -@@ -0,0 +1,71 @@ -+ -+ -+ -+ -+HTTP -+HTTP proxy -+http_proxy -+ -+ -+# Server-side -+ -+ -+HTTP/1.1 407 Denied -+ -+ -+ -+HTTP/1.1 301 redirect -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Content-Length: 4 -+Content-Type: text/html -+Location: https://another.example/%TESTNUMBER0002 -+ -+boo -+ -+ -+ -+# Client-side -+ -+ -+proxy -+ -+ -+http -+https -+ -+ -+proxy credentials via options for two proxies, redirect from http to https -+ -+ -+ -+http_proxy=http://%HOSTIP:%HTTPPORT -+https_proxy=https://%HOSTIP:%HTTPSPORT/ -+ -+ -+--proxy-user batman:robin http://somewhere.example/ --follow --proxy-insecure -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+GET http://somewhere.example/ HTTP/1.1 -+Host: somewhere.example -+Proxy-Authorization: Basic %b64[batman:robin]b64% -+User-Agent: curl/%VERSION -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+CONNECT another.example:443 HTTP/1.1 -+Host: another.example:443 -+Proxy-Authorization: Basic %b64[batman:robin]b64% -+User-Agent: curl/%VERSION -+Proxy-Connection: Keep-Alive -+ -+ -+ -+7 -+ -+ -+ -diff --git a/tests/data/test2011 b/tests/data/test2011 -new file mode 100644 -index 0000000000..dd4e534248 ---- /dev/null -+++ b/tests/data/test2011 -@@ -0,0 +1,70 @@ -+ -+ -+ -+ -+HTTP -+HTTP proxy -+http_proxy -+ -+ -+# Server-side -+ -+ -+HTTP/1.1 407 Denied -+ -+ -+ -+HTTP/1.1 301 redirect -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Content-Length: 4 -+Content-Type: text/html -+Location: https://another.example/%TESTNUMBER0002 -+ -+boo -+ -+ -+ -+# Client-side -+ -+ -+proxy -+ -+ -+http -+https -+ -+ -+proxy creds via env, cross-scheme redirect, --location-trusted -+ -+ -+ -+http_proxy=http://user:secret@%HOSTIP:%HTTPPORT -+https_proxy=https://%HOSTIP:%HTTPSPORT/ -+ -+ -+http://somewhere.example/ --location-trusted --proxy-insecure -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+GET http://somewhere.example/ HTTP/1.1 -+Host: somewhere.example -+Proxy-Authorization: Basic %b64[user:secret]b64% -+User-Agent: curl/%VERSION -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+CONNECT another.example:443 HTTP/1.1 -+Host: another.example:443 -+User-Agent: curl/%VERSION -+Proxy-Connection: Keep-Alive -+ -+ -+ -+7 -+ -+ -+ --- -2.54.0 - diff --git a/external/curl/0001-http-only-send-bearer-if-auth-is-allowed.patch b/external/curl/0001-http-only-send-bearer-if-auth-is-allowed.patch deleted file mode 100644 index 2c397dd192ba..000000000000 --- a/external/curl/0001-http-only-send-bearer-if-auth-is-allowed.patch +++ /dev/null @@ -1,147 +0,0 @@ -From e3d7401a32a46516c9e5ee877e613e62ed35bddc Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Fri, 6 Mar 2026 23:13:07 +0100 -Subject: [PATCH] http: only send bearer if auth is allowed - -Verify with test 2006 - -Closes #20843 ---- - lib/http.c | 1 + - tests/data/Makefile.am | 2 +- - tests/data/test2006 | 98 ++++++++++++++++++++++++++++++++++++++++++ - 3 files changed, 100 insertions(+), 1 deletion(-) - create mode 100644 tests/data/test2006 - -diff --git a/lib/http.c b/lib/http.c -index d2f85fc5bf..d61edbd0cd 100644 ---- a/lib/http.c -+++ b/lib/http.c -@@ -705,6 +705,7 @@ static CURLcode output_auth_headers(struct Curl_easy *data, - if(authstatus->picked == CURLAUTH_BEARER) { - /* Bearer */ - if((!proxy && data->set.str[STRING_BEARER] && -+ Curl_auth_allowed_to_host(data) && - !Curl_checkheaders(data, STRCONST("Authorization")))) { - auth = "Bearer"; - result = http_output_bearer(data); -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index f39568d3b8..6c8be18b32 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -243,7 +243,7 @@ test1955 test1956 test1957 test1958 test1959 test1960 test1964 \ - test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \ - test1978 test1979 test1980 \ - \ --test2000 test2001 test2002 test2003 test2004 test2005 \ -+test2000 test2001 test2002 test2003 test2004 test2005 test2006 \ - \ - test2023 \ - test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \ -diff --git a/tests/data/test2006 b/tests/data/test2006 -new file mode 100644 -index 0000000000..200d30a7ce ---- /dev/null -+++ b/tests/data/test2006 -@@ -0,0 +1,98 @@ -+ -+ -+ -+ -+netrc -+HTTP -+ -+ -+# Server-side -+ -+ -+HTTP/1.1 301 Follow this you fool -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT -+ETag: "21025-dc7-39462498" -+Accept-Ranges: bytes -+Content-Length: 6 -+Connection: close -+Location: http://b.com/%TESTNUMBER0002 -+ -+-foo- -+ -+ -+ -+HTTP/1.1 200 OK -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT -+ETag: "21025-dc7-39462498" -+Accept-Ranges: bytes -+Content-Length: 7 -+Connection: close -+ -+target -+ -+ -+ -+HTTP/1.1 301 Follow this you fool -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT -+ETag: "21025-dc7-39462498" -+Accept-Ranges: bytes -+Content-Length: 6 -+Connection: close -+Location: http://b.com/%TESTNUMBER0002 -+ -+HTTP/1.1 200 OK -+Date: Tue, 09 Nov 2010 14:49:00 GMT -+Server: test-server/fake -+Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT -+ETag: "21025-dc7-39462498" -+Accept-Ranges: bytes -+Content-Length: 7 -+Connection: close -+ -+target -+ -+ -+ -+# Client-side -+ -+ -+http -+ -+ -+proxy -+ -+ -+.netrc default with redirect plus oauth2-bearer -+ -+ -+--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER --oauth2-bearer SECRET_TOKEN -L -x http://%HOSTIP:%HTTPPORT/ http://a.com/ -+ -+ -+default login testuser password testpass -+ -+ -+ -+ -+ -+GET http://a.com/ HTTP/1.1 -+Host: a.com -+Authorization: Bearer SECRET_TOKEN -+User-Agent: curl/%VERSION -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+GET http://b.com/%TESTNUMBER0002 HTTP/1.1 -+Host: b.com -+User-Agent: curl/%VERSION -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+ -+ -+ --- -2.53.0 - diff --git a/external/curl/0001-proxy-auth-additional-tests.patch b/external/curl/0001-proxy-auth-additional-tests.patch deleted file mode 100644 index 237aefb61819..000000000000 --- a/external/curl/0001-proxy-auth-additional-tests.patch +++ /dev/null @@ -1,162 +0,0 @@ -From 5f13a7645e565c5c1a06f3ef86e97afb856fb364 Mon Sep 17 00:00:00 2001 -From: Stefan Eissing -Date: Fri, 6 Mar 2026 14:54:09 +0100 -Subject: [PATCH] proxy-auth: additional tests - -Also eliminate the special handling for socks proxy match. - -Closes #20837 ---- - lib/url.c | 28 +++++++--------------------- - tests/http/test_13_proxy_auth.py | 20 ++++++++++++++++++++ - tests/http/testenv/curl.py | 18 +++++++++++++++--- - 3 files changed, 42 insertions(+), 24 deletions(-) - -diff --git a/lib/url.c b/lib/url.c -index eabeb776ab..bdc183b45b 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -590,30 +590,15 @@ static bool proxy_info_matches(const struct proxy_info *data, - { - if((data->proxytype == needle->proxytype) && - (data->port == needle->port) && -- strcasecompare(data->host.name, needle->host.name)) -- return TRUE; -+ strcasecompare(data->host.name, needle->host.name)) { - -+ if(Curl_timestrcmp(data->user, needle->user) || -+ Curl_timestrcmp(data->passwd, needle->passwd)) -+ return FALSE; -+ return TRUE; -+ } - return FALSE; - } -- --static bool --socks_proxy_info_matches(const struct proxy_info *data, -- const struct proxy_info *needle) --{ -- if(!proxy_info_matches(data, needle)) -- return FALSE; -- -- /* the user information is case-sensitive -- or at least it is not defined as case-insensitive -- see https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.1 */ -- -- /* curl_strequal does a case insensitive comparison, -- so do not use it here! */ -- if(Curl_timestrcmp(data->user, needle->user) || -- Curl_timestrcmp(data->passwd, needle->passwd)) -- return FALSE; -- return TRUE; --} - #else - /* disabled, will not get called */ - #define proxy_info_matches(x,y) FALSE -@@ -923,8 +909,7 @@ static bool url_match_proxy_use(struct connectdata *conn, - return FALSE; - - if(m->needle->bits.socksproxy && -- !socks_proxy_info_matches(&m->needle->socks_proxy, -- &conn->socks_proxy)) -+ !proxy_info_matches(&m->needle->socks_proxy, &conn->socks_proxy)) - return FALSE; - - if(m->needle->bits.httpproxy) { -diff --git a/tests/http/test_13_proxy_auth.py b/tests/http/test_13_proxy_auth.py -index 080adef187..33fb211e99 100644 ---- a/tests/http/test_13_proxy_auth.py -+++ b/tests/http/test_13_proxy_auth.py -@@ -169,3 +169,23 @@ class TestProxyAuth: - '--negotiate', '--proxy-user', 'proxy:proxy' - ]) - r1.check_response(count=1, http_status=200) -+ -+ def test_13_10_tunnels_mixed_auth(self, env: Env, httpd, configures_httpd): -+ self.httpd_configure(env, httpd) -+ curl = CurlClient(env=env) -+ url1 = f'http://localhost:{env.http_port}/data.json?1' -+ url2 = f'http://localhost:{env.http_port}/data.json?2' -+ url3 = f'http://localhost:{env.http_port}/data.json?3' -+ xargs1 = curl.get_proxy_args(proxys=False, tunnel=True) -+ xargs1.extend(['--proxy-user', 'proxy:proxy']) # good auth -+ xargs2 = curl.get_proxy_args(proxys=False, tunnel=True) -+ xargs2.extend(['--proxy-user', 'ungood:ungood']) # bad auth -+ xargs3 = curl.get_proxy_args(proxys=False, tunnel=True) -+ # no auth -+ r = curl.http_download(urls=[url1, url2, url3], alpn_proto='http/1.1', with_stats=True, -+ url_options={url1: xargs1, url2: xargs2, url3: xargs3}) -+ # only url1 succeeds, others fail, no connection reuse -+ assert r.stats[0]['http_code'] == 200, f'{r.dump_logs()}' -+ assert r.stats[1]['http_code'] == 0, f'{r.dump_logs()}' -+ assert r.stats[2]['http_code'] == 0, f'{r.dump_logs()}' -+ assert r.total_connects == 3, f'{r.dump_logs()}' -diff --git a/tests/http/testenv/curl.py b/tests/http/testenv/curl.py -index 4fc11c7923..1f812a1c2e 100644 ---- a/tests/http/testenv/curl.py -+++ b/tests/http/testenv/curl.py -@@ -543,7 +543,8 @@ class CurlClient: - with_profile: bool = False, - with_tcpdump: bool = False, - no_save: bool = False, -- extra_args: Optional[List[str]] = None): -+ extra_args: Optional[List[str]] = None, -+ url_options: Optional[Dict[str,List[str]]] = None): - if extra_args is None: - extra_args = [] - if no_save: -@@ -563,6 +564,7 @@ class CurlClient: - ]) - return self._raw(urls, alpn_proto=alpn_proto, options=extra_args, - with_stats=with_stats, -+ url_options=url_options, - with_headers=with_headers, - with_profile=with_profile, - with_tcpdump=with_tcpdump) -@@ -1083,6 +1085,7 @@ class CurlClient: - - def _raw(self, urls, intext='', timeout=None, options=None, insecure=False, - alpn_proto: Optional[str] = None, -+ url_options=None, - force_resolve=True, - with_stats=False, - with_headers=True, -@@ -1092,7 +1095,8 @@ class CurlClient: - args = self._complete_args( - urls=urls, timeout=timeout, options=options, insecure=insecure, - alpn_proto=alpn_proto, force_resolve=force_resolve, -- with_headers=with_headers, def_tracing=def_tracing) -+ with_headers=with_headers, def_tracing=def_tracing, -+ url_options=url_options) - r = self._run(args, intext=intext, with_stats=with_stats, - with_profile=with_profile, with_tcpdump=with_tcpdump) - if r.exit_code == 0 and with_headers: -@@ -1102,8 +1106,10 @@ class CurlClient: - def _complete_args(self, urls, timeout=None, options=None, - insecure=False, force_resolve=True, - alpn_proto: Optional[str] = None, -+ url_options=None, - with_headers: bool = True, - def_tracing: bool = True): -+ url_sep = [] - if not isinstance(urls, list): - urls = [urls] - -@@ -1129,7 +1135,13 @@ class CurlClient: - active_options = options[options.index('--next') + 1:] - - for url in urls: -- u = urlparse(urls[0]) -+ args.extend(url_sep) -+ if url_options is not None: -+ url_sep = ['--next'] -+ -+ u = urlparse(url) -+ if url_options is not None and url in url_options: -+ args.extend(url_options[url]) - if options: - args.extend(options) - if alpn_proto is not None: --- -2.53.0 - diff --git a/external/curl/0001-setopt-clear-proxy-auth-properties-when-switching.patch b/external/curl/0001-setopt-clear-proxy-auth-properties-when-switching.patch deleted file mode 100644 index f8d4ba7c0d03..000000000000 --- a/external/curl/0001-setopt-clear-proxy-auth-properties-when-switching.patch +++ /dev/null @@ -1,373 +0,0 @@ -From c1cfdf59acbaf9504c4578d4cf56cdd7c8594507 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Mon, 27 Apr 2026 09:14:51 +0200 -Subject: [PATCH] setopt: clear proxy auth properties when switching - -Verify with test 1588 - -Closes #21453 ---- - lib/setopt.c | 17 ++++- - lib/vauth/vauth.h | 1 + - tests/data/Makefile.am | 1 + - tests/data/test1588 | 106 ++++++++++++++++++++++++++ - tests/libtest/Makefile.inc | 2 +- - tests/libtest/lib1588.c | 150 +++++++++++++++++++++++++++++++++++++ - 6 files changed, 275 insertions(+), 2 deletions(-) - create mode 100644 tests/data/test1588 - create mode 100644 tests/libtest/lib1588.c - -diff --git a/lib/setopt.c b/lib/setopt.c -index e832ef1afd..22d32b64a4 100644 ---- a/lib/setopt.c -+++ b/lib/setopt.c -@@ -49,6 +49,8 @@ - #include "tftp.h" - #include "strdup.h" - #include "escape.h" -+ -+#include "vauth/vauth.h" - - /* The last 3 #include files should be in this order */ - #include "curl_printf.h" -@@ -1622,6 +1623,22 @@ static CURLcode cookiefile(struct Curl_easy *data, const char *ptr) - return result; - } - -+#ifndef CURL_DISABLE_PROXY -+ -+static CURLcode setproxy(struct Curl_easy *data, const char *proxy) -+{ -+ if((data->set.str[STRING_PROXY] && proxy) && -+ /* there was one set, is this a new one? */ -+ !strcmp(data->set.str[STRING_PROXY], proxy)) -+ return CURLE_OK; /* same one as before */ -+ -+ Curl_auth_digest_cleanup(&data->state.proxydigest); -+ memset(&data->state.authproxy, 0, sizeof(data->state.authproxy)); -+ return Curl_setstropt(&data->set.str[STRING_PROXY], proxy); -+} -+ -+#endif /* CURL_DISABLE_PROXY */ -+ - static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option, - char *ptr) - { -@@ -1717,7 +1732,7 @@ static CURLcode setopt_cptr_proxy(struct Curl_easy *data, CURLoption option, - * Setting it to NULL, means no proxy but allows the environment variables - * to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL). - */ -- return Curl_setstropt(&data->set.str[STRING_PROXY], ptr); -+ return setproxy(data, ptr); - - case CURLOPT_PRE_PROXY: - /* -diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h -index b5ff31414f..279da60be2 100644 ---- a/lib/vauth/vauth.h -+++ b/lib/vauth/vauth.h -@@ -117,6 +117,8 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data, - - /* This is used to clean up the digest specific data */ - void Curl_auth_digest_cleanup(struct digestdata *digest); -+#else -+#define Curl_auth_digest_cleanup(x) - #endif /* !CURL_DISABLE_DIGEST_AUTH */ - - #ifdef USE_GSASL -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index dc0d8311ec..00d3e4166e 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -209,6 +209,7 @@ test1556 test1557 test1558 test1559 test1560 test1561 test1562 test1563 \ - test1566 test1567 test1568 test1569 test1570 test1571 test1572 test1573 \ - test1574 test1575 test1576 test1577 test1578 test1579 test1580 test1581 \ - \ -+test1588 \ - test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \ - test1598 \ - test1600 test1601 test1602 test1603 test1604 test1605 test1606 test1607 \ -diff --git a/tests/data/test1588 b/tests/data/test1588 -new file mode 100644 -index 0000000000..753e98cd6b ---- /dev/null -+++ b/tests/data/test1588 -@@ -0,0 +1,106 @@ -+ -+ -+ -+ -+HTTP -+HTTP GET -+HTTP proxy -+HTTP proxy Digest auth -+multi -+ -+ -+ -+# Server-side -+ -+ -+# this is returned first since we get no proxy-auth -+ -+HTTP/1.1 407 Authorization Required to proxy me my dear -+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" -+Content-Length: 33 -+ -+And you should ignore this data. -+ -+ -+# then this is returned when we get proxy-auth -+ -+HTTP/1.1 200 OK -+Content-Length: 21 -+Server: no -+ -+Nice proxy auth sir! -+ -+ -+ -+HTTP/1.1 407 Authorization Required to proxy me my dear -+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" -+Content-Length: 33 -+ -+HTTP/1.1 200 OK -+Content-Length: 21 -+Server: no -+ -+Nice proxy auth sir! -+HTTP/1.1 407 Authorization Required to proxy me my dear -+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" -+Content-Length: 33 -+ -+HTTP/1.1 200 OK -+Content-Length: 21 -+Server: no -+ -+Nice proxy auth sir! -+ -+ -+ -+# Client-side -+ -+ -+http -+ -+# tool is what to use instead of 'curl' -+ -+lib%TESTNUMBER -+ -+ -+!SSPI -+crypto -+proxy -+digest -+ -+ -+HTTP proxy auth Digest, then change proxy and do it again -+ -+ -+http://test.remote.example.com/path/%TESTNUMBER %HOSTIP %HTTPPORT silly:person custom.set.host.name -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+GET http://test.remote.example.com/path/1588 HTTP/1.1 -+Host: test.remote.example.com -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+GET http://test.remote.example.com/path/1588 HTTP/1.1 -+Host: test.remote.example.com -+Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a" -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+GET http://test.remote.example.com/path/1588 HTTP/1.1 -+Host: test.remote.example.com -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+GET http://test.remote.example.com/path/1588 HTTP/1.1 -+Host: test.remote.example.com -+Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a" -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+ -+ -+ -diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc -index 10be282c17..724636464a 100644 ---- a/tests/libtest/Makefile.inc -+++ b/tests/libtest/Makefile.inc -@@ -96,7 +96,7 @@ TESTS_C = \ - lib1540 lib1541 lib1542 lib1543 lib1545 \ - lib1550 lib1551 lib1552 lib1553 lib1554 lib1555 lib1556 lib1557 \ - lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 lib1571 \ -- lib1576 lib1578 \ -+ lib1576 lib1578 lib1588 \ - lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \ - \ - lib1662 \ -diff --git a/tests/libtest/lib1588.c b/tests/libtest/lib1588.c -new file mode 100644 -index 0000000000..9b12f36bfe ---- /dev/null -+++ b/tests/libtest/lib1588.c -@@ -0,0 +1,150 @@ -+/*************************************************************************** -+ * _ _ ____ _ -+ * Project ___| | | | _ \| | -+ * / __| | | | |_) | | -+ * | (__| |_| | _ <| |___ -+ * \___|\___/|_| \_\_____| -+ * -+ * Copyright (C) Daniel Stenberg, , et al. -+ * -+ * This software is licensed as described in the file COPYING, which -+ * you should have received as part of this distribution. The terms -+ * are also available at https://curl.se/docs/copyright.html. -+ * -+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell -+ * copies of the Software, and permit persons to whom the Software is -+ * furnished to do so, under the terms of the COPYING file. -+ * -+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY -+ * KIND, either express or implied. -+ * -+ * SPDX-License-Identifier: curl -+ * -+ ***************************************************************************/ -+/* -+ * argv1 = URL -+ * argv2 = proxy host -+ * argv3 = proxy port -+ * argv4 = proxyuser:password -+ */ -+ -+#include "first.h" -+ -+static CURLcode init1588(CURL *curl, const char *url, -+ const char *userpwd, const char *proxy) -+{ -+ CURLcode result = CURLE_OK; -+ -+ res_easy_setopt(curl, CURLOPT_URL, url); -+ if(result) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_PROXY, proxy); -+ if(result) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd); -+ if(result) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST); -+ if(result) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L); -+ if(result) -+ goto init_failed; -+#if 0 -+ res_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L); -+ if(result) -+ goto init_failed; -+#endif -+ -+ res_easy_setopt(curl, CURLOPT_HEADER, 1L); -+ if(result) -+ goto init_failed; -+ -+ return CURLE_OK; /* success */ -+ -+init_failed: -+ return result; /* failure */ -+} -+ -+static CURLcode run1588(CURL *curl, const char *url, const char *userpwd, -+ const char *proxy) -+{ -+ CURLcode result = CURLE_OK; -+ -+ result = init1588(curl, url, userpwd, proxy); -+ if(result) -+ return result; -+ -+ return curl_easy_perform(curl); -+} -+ -+static CURLcode test_lib1588(const char *URL) -+{ -+ CURLcode result = CURLE_OK; -+ CURL *curl = NULL; -+ const char *proxyuserpws = libtest_arg4; -+ struct curl_slist *host = NULL; -+ struct curl_slist *host2 = NULL; -+ char proxy1_resolve[128]; -+ char proxy2_resolve[128]; -+ char proxy1_connect[128]; -+ char proxy2_connect[128]; -+ -+ if(test_argc < 3) -+ return TEST_ERR_MAJOR_BAD; -+ -+ curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve), -+ "firstproxy:%s:%s", libtest_arg3, libtest_arg2); -+ curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve), -+ "secondproxy:%s:%s", libtest_arg3, libtest_arg2); -+ -+ /* we connect to the fake host name but the right port number */ -+ curl_msnprintf(proxy1_connect, sizeof(proxy1_connect), -+ "firstproxy:%s", libtest_arg3); -+ curl_msnprintf(proxy2_connect, sizeof(proxy2_connect), -+ "secondproxy:%s", libtest_arg3); -+ -+ res_global_init(CURL_GLOBAL_ALL); -+ if(result) -+ return result; -+ -+ curl = curl_easy_init(); -+ if(!curl) { -+ curl_mfprintf(stderr, "curl_easy_init() failed\n"); -+ curl_global_cleanup(); -+ return TEST_ERR_MAJOR_BAD; -+ } -+ -+ host = curl_slist_append(NULL, proxy1_resolve); -+ if(!host) -+ goto test_cleanup; -+ host2 = curl_slist_append(host, proxy2_resolve); -+ if(!host2) -+ goto test_cleanup; -+ host = host2; -+ -+ start_test_timing(); -+ -+ easy_setopt(curl, CURLOPT_RESOLVE, host); -+ -+ result = run1588(curl, URL, proxyuserpws, proxy1_connect); -+ if(result) -+ goto test_cleanup; -+ -+ curl_mfprintf(stderr, "lib1588: now we do the request again\n"); -+ -+ result = run1588(curl, URL, proxyuserpws, proxy2_connect); -+ -+test_cleanup: -+ -+ /* proper cleanup sequence - type PB */ -+ -+ curl_easy_cleanup(curl); -+ curl_global_cleanup(); -+ curl_slist_free_all(host); -+ return result; -+} --- -2.54.0 - diff --git a/external/curl/0001-url-detect-proxy-changes-read-from-environment.patch b/external/curl/0001-url-detect-proxy-changes-read-from-environment.patch deleted file mode 100644 index 6a02682f2d0b..000000000000 --- a/external/curl/0001-url-detect-proxy-changes-read-from-environment.patch +++ /dev/null @@ -1,334 +0,0 @@ -From 5c225384b8d52c67ce8259c6e4203bc57aacb567 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Mon, 18 May 2026 23:47:11 +0200 -Subject: [PATCH] url: detect proxy changes read from environment - -When a proxy is set from an environment variable, detect if that proxy -is not the same as previously and flush state. - -Verified by test1647: verify changing proxy with env variables and make -sure Digest state is flushed in the second use - -Closes #21666 ---- - lib/url.c | 11 ++++ - lib/urldata.h | 1 + - tests/data/Makefile.am | 8 +-- - tests/data/test1647 | 103 +++++++++++++++++++++++++++++++ - tests/libtest/Makefile.inc | 1 + - tests/libtest/lib1647.c | 120 +++++++++++++++++++++++++++++++++++++ - 6 files changed, 239 insertions(+), 5 deletions(-) - create mode 100644 tests/data/test1647 - create mode 100644 tests/libtest/lib1647.c - -diff --git a/lib/url.c b/lib/url.c -index a569c3e4bc..31f5d948d8 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -93,6 +93,7 @@ - #include "cfilters.h" - #include "curl_krb5.h" - #include "idn.h" -+#include "vauth/vauth.h" - - /* And now for the protocols */ - #include "ftp.h" -@@ -305,6 +305,9 @@ CURLcode Curl_close(struct Curl_easy **datap) - Curl_freeset(data); - Curl_headers_cleanup(data); - Curl_netrc_cleanup(&data->state.netrc); -+#ifndef CURL_DISABLE_DIGEST_AUTH -+ Curl_safefree(data->state.envproxy); -+#endif - free(data); - return CURLE_OK; - } -@@ -2007,6 +2010,14 @@ static CURLcode url_set_conn_proxies(struct Curl_easy *data, - result = CURLE_UNSUPPORTED_PROTOCOL; - goto out; - #else -+#ifndef CURL_DISABLE_DIGEST_AUTH -+ if(!Curl_safecmp(data->state.envproxy, proxy)) { -+ /* proxy changed */ -+ Curl_auth_digest_cleanup(&data->state.proxydigest); -+ Curl_safefree(data->state.envproxy); -+ data->state.envproxy = strdup(proxy); -+ } -+#endif - /* force this connection's protocol to become HTTP if compatible */ - if(!(conn->handler->protocol & PROTO_FAMILY_HTTP)) { - if((conn->handler->flags & PROTOPT_PROXY_AS_HTTP) && -diff --git a/lib/urldata.h b/lib/urldata.h -index 8b85c674a9..85630b05b7 100644 ---- a/lib/urldata.h -+++ b/lib/urldata.h -@@ -671,6 +671,7 @@ struct UrlState { - void (*prev_signal)(int sig); - #endif - #ifndef CURL_DISABLE_DIGEST_AUTH -+ char *envproxy; /* last proxy string used for proxy-related state */ - struct digestdata digest; /* state data for host Digest auth */ - struct digestdata proxydigest; /* state data for proxy Digest auth */ - #endif -diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am -index b330af3b90..a3778bdad1 100644 ---- a/tests/data/Makefile.am -+++ b/tests/data/Makefile.am -@@ -214,6 +214,7 @@ test1596 test1597 test1598 test1599 test1600 test1601 test1602 test1603 \ - test1620 test1621 \ - \ - test1630 test1631 test1632 test1633 test1634 test1635 \ -+test1647 \ - \ - test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \ - test1658 \ -diff --git a/tests/data/test1647 b/tests/data/test1647 -new file mode 100644 -index 0000000000..a87487fa9f ---- /dev/null -+++ b/tests/data/test1647 -@@ -0,0 +1,103 @@ -+ -+ -+ -+ -+HTTP -+HTTP GET -+HTTP proxy -+HTTP proxy Digest auth -+multi -+ -+ -+ -+# Server-side -+ -+ -+# this is returned first since we get no proxy-auth -+ -+HTTP/1.1 407 Authorization Required to proxy me my dear -+Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" -+Content-Length: 33 -+ -+And you should ignore this data. -+ -+ -+# then this is returned when we get proxy-auth -+ -+HTTP/1.1 200 OK -+Content-Length: 21 -+Server: no -+ -+Nice proxy auth sir! -+ -+ -+ -+HTTP/1.1 401 OK -+Content-Length: 21 -+Server: no -+ -+Denied access. Leave -+ -+ -+ -+ -+# Client-side -+ -+ -+http -+https-proxy -+https -+ -+# tool is what to use instead of 'curl' -+ -+lib%TESTNUMBER -+ -+ -+!SSPI -+crypto -+proxy -+digest -+Debug -+ -+ -+http_proxy=%HOSTIP:%HTTPPORT -+https_proxy=https://%HOSTIP:%HTTPSPROXYPORT -+CURL_ENTROPY=99376 -+ -+ -+HTTP proxy auth Digest, then change proxy with env var and do it again -+ -+ -+http://test.remote.example.com/path/%TESTNUMBER https://another.example.com:%HTTPSPORT/ daniel:monkey123 another:bump456 -+ -+ -+ -+# Verify data after the test has been "shot" -+ -+ -+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1 -+Host: test.remote.example.com -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1 -+Host: test.remote.example.com -+Proxy-Authorization: Digest username="daniel", realm="weirdorealm", nonce="12345", uri="/path/%TESTNUMBER", response="7a1672891aff03248887b1a6674b8096" -+Accept: */* -+Proxy-Connection: Keep-Alive -+ -+ -+ -+ -+CONNECT another.example.com:%HTTPSPORT HTTP/1.1 -+Host: another.example.com:%HTTPSPORT -+Proxy-Connection: Keep-Alive -+ -+ -+ -+# CONNECT fails -+ -+7 -+ -+ -+ -diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc -index 734e7f30e9..586db5a2c9 100644 ---- a/tests/libtest/Makefile.inc -+++ b/tests/libtest/Makefile.inc -@@ -99,6 +99,7 @@ TESTS_C = \ - lib1576 lib1578 lib1588 \ - lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \ - \ -+ lib1647 \ - lib1662 \ - \ - lib1900 lib1901 \ -diff --git a/tests/libtest/lib1647.c b/tests/libtest/lib1647.c -new file mode 100644 -index 0000000000..8060e1bfe9 ---- /dev/null -+++ b/tests/libtest/lib1647.c -@@ -0,0 +1,120 @@ -+/*************************************************************************** -+ * _ _ ____ _ -+ * Project ___| | | | _ \| | -+ * / __| | | | |_) | | -+ * | (__| |_| | _ <| |___ -+ * \___|\___/|_| \_\_____| -+ * -+ * Copyright (C) Daniel Stenberg, , et al. -+ * -+ * This software is licensed as described in the file COPYING, which -+ * you should have received as part of this distribution. The terms -+ * are also available at https://curl.se/docs/copyright.html. -+ * -+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell -+ * copies of the Software, and permit persons to whom the Software is -+ * furnished to do so, under the terms of the COPYING file. -+ * -+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY -+ * KIND, either express or implied. -+ * -+ * SPDX-License-Identifier: curl -+ * -+ ***************************************************************************/ -+/* -+ * argv1 = the first URL -+ * argv2 = URL2 -+ * argv3 = credentials 1 -+ * argv4 = credentials 2 -+ */ -+ -+#include "first.h" -+ -+/* this is meant to pick up the proxy from the environment variable */ -+static CURLcode init1647(CURL *curl, const char *url, const char *userpwd) -+{ -+ CURLcode result = CURLE_OK; -+ -+ res_easy_setopt(curl, CURLOPT_URL, url); -+ if(result) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd); -+ if(result) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST); -+ if(result) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); -+ if(result) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); -+ if(result) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 0L); -+ if(result) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 0L); -+ if(result) -+ goto init_failed; -+ -+ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L); -+ if(result) -+ goto init_failed; -+ -+ return CURLE_OK; /* success */ -+ -+init_failed: -+ return result; /* failure */ -+} -+ -+static CURLcode run1647(CURL *curl, const char *url, const char *userpwd) -+{ -+ CURLcode result = CURLE_OK; -+ -+ result = init1647(curl, url, userpwd); -+ if(result) -+ return result; -+ -+ return curl_easy_perform(curl); -+} -+ -+static CURLcode test_lib1647(const char *URL) -+{ -+ CURLcode result = CURLE_OK; -+ CURL *curl = NULL; -+ -+ res_global_init(CURL_GLOBAL_ALL); -+ if(result) -+ return result; -+ -+ curl = curl_easy_init(); -+ if(!curl) { -+ curl_mfprintf(stderr, "curl_easy_init() failed\n"); -+ curl_global_cleanup(); -+ return TEST_ERR_MAJOR_BAD; -+ } -+ -+ start_test_timing(); -+ -+ curl_mprintf("--- First get '%s'\n", URL); -+ result = run1647(curl, URL, libtest_arg3); -+ if(result) -+ goto test_cleanup; -+ -+ curl_mprintf("--- Then get '%s'\n", libtest_arg2); -+ result = run1647(curl, libtest_arg2, libtest_arg4); -+ -+test_cleanup: -+ -+ /* proper cleanup sequence - type PB */ -+ -+ curl_easy_cleanup(curl); -+ curl_global_cleanup(); -+ return result; -+} --- -2.54.0 - diff --git a/external/curl/0001-url-fix-copy-and-paste-url_match_auth_nego-mistake.patch b/external/curl/0001-url-fix-copy-and-paste-url_match_auth_nego-mistake.patch deleted file mode 100644 index 15fc817ccd66..000000000000 --- a/external/curl/0001-url-fix-copy-and-paste-url_match_auth_nego-mistake.patch +++ /dev/null @@ -1,28 +0,0 @@ -From f1a39f221d57354990e3eeeddc3404aede2aff70 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Sat, 21 Feb 2026 18:11:41 +0100 -Subject: [PATCH] url: fix copy and paste url_match_auth_nego mistake - -Follow-up to 34fa034 -Reported-by: dahmono on github -Closes #20662 ---- - lib/url.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/url.c b/lib/url.c -index c879a85e92..8b42aebade 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -1217,7 +1217,7 @@ static bool url_match_auth_nego(struct connectdata *conn, - return FALSE; - } - #endif -- if(m->want_ntlm_http || m->want_proxy_ntlm_http) { -+ if(m->want_nego_http || m->want_proxy_nego_http) { - /* Credentials are already checked, we may use this connection. We MUST - * use a connection where it has already been fully negotiated. If it has - * not, we keep on looking for a better one. */ --- -2.53.0 - diff --git a/external/curl/0001-url-fix-reuse-of-connections-using-HTTP-Negotiate.patch b/external/curl/0001-url-fix-reuse-of-connections-using-HTTP-Negotiate.patch deleted file mode 100644 index 44f490e25154..000000000000 --- a/external/curl/0001-url-fix-reuse-of-connections-using-HTTP-Negotiate.patch +++ /dev/null @@ -1,137 +0,0 @@ -From 34fa034d9a390c4bd65e2d05262755ec8646ac12 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Thu, 5 Feb 2026 08:34:21 +0100 -Subject: [PATCH] url: fix reuse of connections using HTTP Negotiate - -Assume Negotiate means connection-based - -Reported-by: Zhicheng Chen -Closes #20534 ---- - lib/url.c | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++---- - 1 file changed, 82 insertions(+), 5 deletions(-) - -diff --git a/lib/url.c b/lib/url.c -index fac8cea732..cfe398de8b 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -764,6 +764,8 @@ struct url_conn_match { - BIT(may_multiplex); - BIT(want_ntlm_http); - BIT(want_proxy_ntlm_http); -+ BIT(want_nego_http); -+ BIT(want_proxy_nego_http); - - BIT(wait_pipe); - BIT(force_reuse); -@@ -1185,6 +1187,63 @@ static bool url_match_auth_ntlm(struct connectdata *conn, - #define url_match_auth_ntlm(c,m) ((void)c, (void)m, TRUE) - #endif - -+#ifdef USE_SPNEGO -+static bool url_match_auth_nego(struct connectdata *conn, -+ struct url_conn_match *m) -+{ -+ /* If we are looking for an HTTP+Negotiate connection, check if this is -+ already authenticating with the right credentials. If not, keep looking -+ so that we can reuse Negotiate connections if possible. */ -+ if(m->want_nego_http) { -+ if(Curl_timestrcmp(m->needle->user, conn->user) || -+ Curl_timestrcmp(m->needle->passwd, conn->passwd)) -+ return FALSE; -+ } -+ else if(conn->http_negotiate_state != GSS_AUTHNONE) { -+ /* Connection is using Negotiate auth but we do not want Negotiate */ -+ return FALSE; -+ } -+ -+#ifndef CURL_DISABLE_PROXY -+ /* Same for Proxy Negotiate authentication */ -+ if(m->want_proxy_nego_http) { -+ /* Both conn->http_proxy.user and conn->http_proxy.passwd can be -+ * NULL */ -+ if(!conn->http_proxy.user || !conn->http_proxy.passwd) -+ return FALSE; -+ -+ if(Curl_timestrcmp(m->needle->http_proxy.user, -+ conn->http_proxy.user) || -+ Curl_timestrcmp(m->needle->http_proxy.passwd, -+ conn->http_proxy.passwd)) -+ return FALSE; -+ } -+ else if(conn->proxy_negotiate_state != GSS_AUTHNONE) { -+ /* Proxy connection is using Negotiate auth but we do not want Negotiate */ -+ return FALSE; -+ } -+#endif -+ if(m->want_ntlm_http || m->want_proxy_ntlm_http) { -+ /* Credentials are already checked, we may use this connection. We MUST -+ * use a connection where it has already been fully negotiated. If it has -+ * not, we keep on looking for a better one. */ -+ m->found = conn; -+ if((m->want_nego_http && -+ (conn->http_negotiate_state != GSS_AUTHNONE)) || -+ (m->want_proxy_nego_http && -+ (conn->proxy_negotiate_state != GSS_AUTHNONE))) { -+ /* We must use this connection, no other */ -+ m->force_reuse = TRUE; -+ return TRUE; -+ } -+ return FALSE; /* get another */ -+ } -+ return TRUE; -+} -+#else -+#define url_match_auth_nego(c, m) ((void)c, (void)m, TRUE) -+#endif -+ - static bool url_match_conn(struct connectdata *conn, void *userdata) - { - struct url_conn_match *m = userdata; -@@ -1228,6 +1287,11 @@ static bool url_match_conn(struct connectdata *conn, void *userdata) - else if(m->force_reuse) - return TRUE; - -+ if(!url_match_auth_nego(conn, m)) -+ return FALSE; -+ else if(m->force_reuse) -+ return TRUE; -+ - if(!url_match_multiplex_limits(conn, m)) - return FALSE; - -@@ -1290,13 +1354,26 @@ static bool url_attach_existing(struct Curl_easy *data, - match.may_multiplex = xfer_may_multiplex(data, needle); - - #ifdef USE_NTLM -- match.want_ntlm_http = ((data->state.authhost.want & CURLAUTH_NTLM) && -- (needle->handler->protocol & PROTO_FAMILY_HTTP)); -+ match.want_ntlm_http = -+ (data->state.authhost.want & CURLAUTH_NTLM) && -+ (needle->handler->protocol & PROTO_FAMILY_HTTP); - #ifndef CURL_DISABLE_PROXY - match.want_proxy_ntlm_http = -- (needle->bits.proxy_user_passwd && -- (data->state.authproxy.want & CURLAUTH_NTLM) && -- (needle->handler->protocol & PROTO_FAMILY_HTTP)); -+ needle->bits.proxy_user_passwd && -+ (data->state.authproxy.want & CURLAUTH_NTLM) && -+ (needle->handler->protocol & PROTO_FAMILY_HTTP); -+#endif -+#endif -+ -+#if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO) -+ match.want_nego_http = -+ (data->state.authhost.want & CURLAUTH_NEGOTIATE) && -+ (needle->handler->protocol & PROTO_FAMILY_HTTP); -+#ifndef CURL_DISABLE_PROXY -+ match.want_proxy_nego_http = -+ needle->bits.proxy_user_passwd && -+ (data->state.authproxy.want & CURLAUTH_NEGOTIATE) && -+ (needle->handler->protocol & PROTO_FAMILY_HTTP); - #endif - #endif - --- -2.53.0 - diff --git a/external/curl/0001-url-improve-connection-reuse-on-negotiate.patch b/external/curl/0001-url-improve-connection-reuse-on-negotiate.patch deleted file mode 100644 index 45ea04b8c10a..000000000000 --- a/external/curl/0001-url-improve-connection-reuse-on-negotiate.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 33e43985b8f3b9e66691d06e70be0395849856cd Mon Sep 17 00:00:00 2001 -From: Stefan Eissing -Date: Thu, 2 Apr 2026 11:33:39 +0200 -Subject: [PATCH] url: improve connection reuse on negotiate - -Check state of negotiate to allow proper connection reuse. - -Closes #21203 ---- - lib/url.c | 12 +++++++++--- - 1 file changed, 9 insertions(+), 3 deletions(-) - -diff --git a/lib/url.c b/lib/url.c -index c377f0733b..c61c89c39d 100644 ---- a/lib/url.c -+++ b/lib/url.c -@@ -1085,11 +1085,17 @@ static bool url_match_auth_ntlm(struct connectdata *conn, - if(m->want_ntlm_http) { - if(Curl_timestrcmp(m->needle->user, conn->user) || - Curl_timestrcmp(m->needle->passwd, conn->passwd)) { -- - /* we prefer a credential match, but this is at least a connection -- that can be reused and "upgraded" to NTLM */ -- if(conn->http_ntlm_state == NTLMSTATE_NONE) -+ that can be reused and "upgraded" to NTLM if it does -+ not have any auth ongoing. */ -+#ifdef USE_SPNEGO -+ if((conn->http_ntlm_state == NTLMSTATE_NONE) -+ && (conn->http_negotiate_state == GSS_AUTHNONE)) { -+#else -+ if(conn->http_ntlm_state == NTLMSTATE_NONE) { -+#endif - m->found = conn; -+ } - return FALSE; - } - } --- -2.54.0 - diff --git a/external/curl/0001-ws-get-a-new-mask-for-each-new-outgoing-frame.patch b/external/curl/0001-ws-get-a-new-mask-for-each-new-outgoing-frame.patch deleted file mode 100644 index 99f497d26726..000000000000 --- a/external/curl/0001-ws-get-a-new-mask-for-each-new-outgoing-frame.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 84db7a9eae8468c0445b15aa806fa7fa806fa0f2 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Mon, 8 Sep 2025 14:14:15 +0200 -Subject: [PATCH] ws: get a new mask for each new outgoing frame - -Reported-by: Calvin Ruocco -Closes #18496 ---- - lib/ws.c | 28 +++++++++++++--------------- - 1 file changed, 13 insertions(+), 15 deletions(-) - -diff --git a/lib/ws.c b/lib/ws.c -index e973409b6..3b6542816 100644 ---- a/lib/ws.c -+++ b/lib/ws.c -@@ -875,6 +875,19 @@ static CURLcode ws_enc_add_frame(struct Curl_easy *data, - enc->payload_remain = enc->payload_len = payload_len; - ws_enc_info(enc, data, "sending"); - -+ /* 4 bytes random */ -+ -+ CURLcode result = -+ Curl_rand(data, (unsigned char *)&enc->mask, sizeof(enc->mask)); -+ if(result) -+ return result; -+ -+#ifdef DEBUGBUILD -+ if(getenv("CURL_WS_FORCE_ZERO_MASK")) -+ /* force the bit mask to 0x00000000, effectively disabling masking */ -+ memset(&enc->mask, 0, sizeof(enc->mask)); -+#endif -+ - /* add 4 bytes mask */ - memcpy(&head[hlen], &enc->mask, 4); - hlen += 4; -@@ -1335,21 +1347,7 @@ CURLcode Curl_ws_accept(struct Curl_easy *data, - subprotocol not requested by the client), the client MUST Fail - the WebSocket Connection. */ - -- /* 4 bytes random */ -- -- result = Curl_rand(data, (unsigned char *)&ws->enc.mask, -- sizeof(ws->enc.mask)); -- if(result) -- return result; -- --#ifdef DEBUGBUILD -- if(getenv("CURL_WS_FORCE_ZERO_MASK")) -- /* force the bit mask to 0x00000000, effectively disabling masking */ -- memset(ws->enc.mask, 0, sizeof(ws->enc.mask)); --#endif -- -- infof(data, "[WS] Received 101, switch to WebSocket; mask %02x%02x%02x%02x", -- ws->enc.mask[0], ws->enc.mask[1], ws->enc.mask[2], ws->enc.mask[3]); -+ infof(data, "[WS] Received 101, switch to WebSocket"); - - /* Install our client writer that decodes WS frames payload */ - result = Curl_cwriter_create(&ws_dec_writer, data, &ws_cw_decode, --- -2.39.5 - diff --git a/external/curl/ExternalPackage_curl.mk b/external/curl/ExternalPackage_curl.mk index e9be1e9aa705..3cb38400b63f 100644 --- a/external/curl/ExternalPackage_curl.mk +++ b/external/curl/ExternalPackage_curl.mk @@ -14,7 +14,7 @@ $(eval $(call gb_ExternalPackage_use_external_project,curl,curl)) ifneq ($(DISABLE_DYNLOADING),TRUE) ifeq ($(COM),MSC) -$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll,builds/libcurl-vc12-$(gb_MSBUILD_PLATFORM)-$(gb_MSBUILD_CONFIG)-dll-zlib-static-ipv6-sspi-schannel/bin/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll)) +$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),-d).dll,lib/$(if $(MSVC_USE_DEBUG_RUNTIME),Debug,Release)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),-d).dll)) else ifeq ($(OS),MACOSX) $(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.4.dylib,lib/.libs/libcurl.4.dylib)) else diff --git a/external/curl/ExternalProject_curl.mk b/external/curl/ExternalProject_curl.mk index 81eb9c8651e5..f31c671bbb23 100644 --- a/external/curl/ExternalProject_curl.mk +++ b/external/curl/ExternalProject_curl.mk @@ -34,29 +34,25 @@ curl_LDFLAGS += -L$(SYSBASE)/usr/lib endif endif -# use --with-secure-transport on macOS >10.5 and iOS to get a native UI for SSL certs for CMIS usage -# use --with-openssl only on platforms other than macOS and iOS +# use --with-openssl on all platforms $(call gb_ExternalProject_get_state_target,curl,build): $(call gb_Trace_StartRange,curl,EXTERNAL) $(call gb_ExternalProject_run,build,\ $(gb_RUN_CONFIGURE) ./configure \ - --without-amissl --without-bearssl --without-gnutls \ - --without-mbedtls --without-rustls --without-wolfssl \ --disable-ftp --enable-http --enable-ipv6 \ --without-libidn2 --without-libpsl --without-librtmp \ --without-libssh2 --without-nghttp2 \ --without-libssh --without-brotli \ --without-ngtcp2 --without-quiche \ - --without-zstd --without-hyper --without-libgsasl \ + --without-zstd --without-libgsasl \ $(if $(WITH_GSSAPI),--with-gssapi,--without-gssapi) \ --disable-ipfs --disable-mqtt --disable-ares \ --disable-dict --disable-file --disable-gopher --disable-imap \ --disable-ldap --disable-ldaps --disable-manual --disable-pop3 \ --disable-rtsp --disable-smb --disable-smtp --disable-telnet \ --disable-tftp \ - $(if $(filter iOS MACOSX,$(OS)),\ - --with-secure-transport,\ - $(if $(ENABLE_OPENSSL),--with-openssl$(if $(SYSTEM_OPENSSL),,="$(gb_UnpackedTarball_workdir)/openssl"))) \ + $(if $(ENABLE_OPENSSL),--with-openssl$(if $(SYSTEM_OPENSSL),,="$(gb_UnpackedTarball_workdir)/openssl")) \ + $(if $(filter iOS MACOSX,$(OS)),--with-apple-sectrust) \ $(if $(filter LINUX,$(OS)),--without-ca-bundle --without-ca-path) \ $(gb_CONFIGURE_PLATFORMS) \ $(if $(filter TRUE,$(DISABLE_DYNLOADING)),--disable-shared,--disable-static) \ @@ -78,24 +74,38 @@ $(call gb_ExternalProject_get_state_target,curl,build): else ifeq ($(COM),MSC) -$(eval $(call gb_ExternalProject_use_nmake,curl,build)) - $(call gb_ExternalProject_get_state_target,curl,build): $(call gb_Trace_StartRange,curl,EXTERNAL) $(call gb_ExternalProject_run,build,\ - nmake -f Makefile.vc \ - mode=dll \ - VC=12 \ - MACHINE=$(gb_MSBUILD_PLATFORM) \ - GEN_PDB=$(if $(call gb_Module__symbols_enabled,curl),yes,no) \ - $(if $(call gb_Module__symbols_enabled,curl),CFLAGS_PDB_VALUE="$(gb_DEBUGINFO_FLAGS)") \ - DEBUG=$(if $(MSVC_USE_DEBUG_RUNTIME),yes,no) \ - ENABLE_IPV6=yes \ - ENABLE_SSPI=yes \ - ENABLE_WINSSL=yes \ - WINBUILD_ACKNOWLEDGE_DEPRECATED=yes \ - WITH_ZLIB=static \ - ,winbuild) + $(CMAKE) . \ + $(if $(filter 17.%,$(VCVER)),-G "Visual Studio 17 2022") \ + $(if $(filter 18.%,$(VCVER)),-G "Visual Studio 18 2026") \ + -A $(gb_MSBUILD_PLATFORM) \ + -DBUILD_SHARED_LIBS=ON \ + -DENABLE_IPV6=ON \ + -DCURL_WINDOWS_SSPI=ON \ + -DCURL_USE_SCHANNEL=ON \ + -DCURL_USE_LIBPSL=OFF \ + -DCURL_ZLIB=ON \ + -DZLIB_INCLUDE_DIR=$(gb_UnpackedTarball_workdir)/zlib/ \ + -DZLIB_LIBRARY=$(gb_StaticLibrary_WORKDIR)/zlib.lib \ + -DCURL_DISABLE_DICT=ON \ + -DCURL_DISABLE_FILE=ON \ + -DCURL_DISABLE_FTP=ON \ + -DCURL_DISABLE_GOPHER=ON \ + -DCURL_DISABLE_IMAP=ON \ + -DCURL_DISABLE_IPFS=ON \ + -DCURL_DISABLE_LDAP=ON \ + -DCURL_DISABLE_LDAPS=ON \ + -DCURL_DISABLE_MQTT=ON \ + -DCURL_DISABLE_POP3=ON \ + -DCURL_DISABLE_RTSP=ON \ + -DCURL_DISABLE_SMB=ON \ + -DCURL_DISABLE_SMTP=ON \ + -DCURL_DISABLE_TELNET=ON \ + -DCURL_DISABLE_TFTP=ON \ + && $(CMAKE) --build . --config $(if $(MSVC_USE_DEBUG_RUNTIME),Debug,Release) \ + ) $(call gb_Trace_EndRange,curl,EXTERNAL) endif diff --git a/external/curl/UnpackedTarball_curl.mk b/external/curl/UnpackedTarball_curl.mk index 6a2f0a435f06..8bb9119ff65f 100644 --- a/external/curl/UnpackedTarball_curl.mk +++ b/external/curl/UnpackedTarball_curl.mk @@ -13,40 +13,14 @@ $(eval $(call gb_UnpackedTarball_set_tarball,curl,$(CURL_TARBALL),,curl)) $(eval $(call gb_UnpackedTarball_update_autoconf_configs,curl)) -$(eval $(call gb_UnpackedTarball_fix_end_of_line,curl,\ - winbuild/MakefileBuild.vc \ -)) - # 0001-const-up-readonly-H2_NON_FIELD.patch # upstream effort as: # https://github.com/curl/curl/pull/17996 $(eval $(call gb_UnpackedTarball_add_patches,curl,\ - external/curl/curl-msvc.patch.1 \ - external/curl/curl-msvc-zlib.patch.1 \ - external/curl/curl-msvc-disable-protocols.patch.1 \ external/curl/zlib.patch.0 \ - external/curl/configurable-z-option.patch.0 \ - external/curl/0001-const-up-readonly-H2_NON_FIELD.patch.1 \ - external/curl/0001-cookie-don-t-treat-the-leading-slash-as-trailing.patch \ - external/curl/0001-ws-get-a-new-mask-for-each-new-outgoing-frame.patch \ - external/curl/0001-url-fix-reuse-of-connections-using-HTTP-Negotiate.patch \ - external/curl/0001-url-fix-copy-and-paste-url_match_auth_nego-mistake.patch \ - external/curl/0001-http-only-send-bearer-if-auth-is-allowed.patch \ - external/curl/0001-proxy-auth-additional-tests.patch \ - external/curl/0001-url-improve-connection-reuse-on-negotiate.patch \ - external/curl/0001-setopt-clear-proxy-auth-properties-when-switching.patch \ - external/curl/0001-http-clear-the-proxy-credentials-as-well-on-port-or-.patch \ - external/curl/0001-url-detect-proxy-changes-read-from-environment.patch \ - external/curl/0001-digest-flush-state-on-origin-or-credential-change.patch \ )) -ifeq ($(OS)-$(COM_IS_CLANG),WNT-TRUE) -$(eval $(call gb_UnpackedTarball_add_patches,curl, \ - external/curl/clang-cl.patch.0 \ -)) -endif - ifeq ($(ENABLE_EMSCRIPTEN_PROXY_POSIX_SOCKETS),TRUE) $(eval $(call gb_UnpackedTarball_add_patches,curl, \ external/curl/emscripten-proxy-poll.patch.0 \ diff --git a/external/curl/clang-cl.patch.0 b/external/curl/clang-cl.patch.0 deleted file mode 100644 index 5dfb19d5ba59..000000000000 --- a/external/curl/clang-cl.patch.0 +++ /dev/null @@ -1,11 +0,0 @@ ---- winbuild/MakefileBuild.vc -+++ winbuild/MakefileBuild.vc -@@ -52,7 +52,7 @@ - !ELSE - CC_NODEBUG = $(CC) /O2 /DNDEBUG - CC_DEBUG = $(CC) /Od /D_DEBUG /RTC1 /Z7 /LDd --CFLAGS = /I. /I ../lib /I../include /nologo /W4 /EHsc /DWIN32 /FD /c /DBUILDING_LIBCURL $(SOLARINC) -+CFLAGS = /I. /I ../lib /I../include /nologo /W4 /EHsc /DWIN32 /c /DBUILDING_LIBCURL $(SOLARINC) - !ENDIF - - LFLAGS = /nologo /machine:$(MACHINE) diff --git a/external/curl/configurable-z-option.patch.0 b/external/curl/configurable-z-option.patch.0 deleted file mode 100644 index 5be2445e28c1..000000000000 --- a/external/curl/configurable-z-option.patch.0 +++ /dev/null @@ -1,20 +0,0 @@ ---- winbuild/MakefileBuild.vc.sav 2021-11-13 11:43:40.756226600 +0000 -+++ winbuild/MakefileBuild.vc 2021-11-13 11:52:08.921692300 +0000 -@@ -47,7 +47,7 @@ - - !IF "$(VC)"=="6" - CC_NODEBUG = $(CC) /O2 /DNDEBUG --CC_DEBUG = $(CC) /Od /Gm /Zi /D_DEBUG /GZ -+CC_DEBUG = $(CC) /Od /Gm $(DEBUG_FLAGS_VALUE) /D_DEBUG /GZ - CFLAGS = /I. /I../lib /I../include /nologo /W4 /GX /YX /FD /c /DBUILDING_LIBCURL - !ELSE - CC_NODEBUG = $(CC) /O2 /DNDEBUG -@@ -64,7 +64,7 @@ - # Instead of id: just create an archive, that contains all objects - LNKLIB = lib.exe - --CFLAGS_PDB = /Zi -+CFLAGS_PDB = $(DEBUG_FLAGS_VALUE) - LFLAGS_PDB = /incremental:no /opt:ref,icf /DEBUG - - CFLAGS_LIBCURL_STATIC = /DCURL_STATICLIB diff --git a/external/curl/curl-msvc-disable-protocols.patch.1 b/external/curl/curl-msvc-disable-protocols.patch.1 deleted file mode 100644 index 5ad8834820ce..000000000000 --- a/external/curl/curl-msvc-disable-protocols.patch.1 +++ /dev/null @@ -1,39 +0,0 @@ -disable protocols nobody needs in MSVC build - ---- curl/lib/config-win32.h.orig 2017-08-09 16:43:29.464000000 +0200 -+++ curl/lib/config-win32.h 2017-08-09 16:47:38.549200000 +0200 -@@ -500,6 +500,23 @@ - # endif /* UNDER_CE */ - #endif /* !CURL_OS */ - -+#define CURL_DISABLE_DICT 1 -+#define CURL_DISABLE_FILE 1 -+#define CURL_DISABLE_FTP 1 -+#define CURL_DISABLE_GOPHER 1 -+#undef CURL_DISABLE_HTTP -+#define CURL_DISABLE_IMAP 1 -+#define CURL_DISABLE_IPFS 1 -+#define CURL_DISABLE_LDAP 1 -+#define CURL_DISABLE_LDAPS 1 -+#define CURL_DISABLE_MQTT 1 -+#define CURL_DISABLE_POP3 1 -+#define CURL_DISABLE_RTSP 1 -+#define CURL_DISABLE_SMB 1 -+#define CURL_DISABLE_SMTP 1 -+#define CURL_DISABLE_TELNET 1 -+#define CURL_DISABLE_TFTP 1 -+ - /* ---------------------------------------------------------------- */ - /* Windows CE */ - /* ---------------------------------------------------------------- */ ---- curl/winbuild/MakefileBuild.vc.orig 2017-10-23 23:41:21.393200000 +0200 -+++ curl/winbuild/MakefileBuild.vc 2017-10-23 23:34:16.028000000 +0200 -@@ -562,7 +562,7 @@ - - EXE_OBJS = $(CURL_OBJS) $(CURL_DIROBJ)\curl.res - --all : $(TARGET) $(PROGRAM_NAME) -+all : $(TARGET) - - package: $(TARGET) - @cd $(DIRDIST) diff --git a/external/curl/curl-msvc-zlib.patch.1 b/external/curl/curl-msvc-zlib.patch.1 deleted file mode 100644 index a9ee0013d50b..000000000000 --- a/external/curl/curl-msvc-zlib.patch.1 +++ /dev/null @@ -1,16 +0,0 @@ -find internal zlib in nmake buildsystem - ---- curl/winbuild/MakefileBuild.vc.orig2 2021-10-27 20:44:48.685237000 +0200 -+++ curl/winbuild/MakefileBuild.vc 2021-10-27 20:47:23.792407400 +0200 -@@ -244,8 +244,9 @@ - ZLIB_LIB_DIR = $(ZLIB_PATH)\lib - ZLIB_LFLAGS = $(ZLIB_LFLAGS) "/LIBPATH:$(ZLIB_LIB_DIR)" - !ELSE --ZLIB_INC_DIR = $(DEVEL_INCLUDE) --ZLIB_LIB_DIR = $(DEVEL_LIB) -+ZLIB_INC_DIR = $(WORKDIR)/UnpackedTarball/zlib -+ZLIB_LIB_DIR = $(WORKDIR)/LinkTarget/StaticLibrary -+ZLIB_LFLAGS = $(ZLIB_LFLAGS) "/LIBPATH:$(ZLIB_LIB_DIR)" - !ENDIF - - # Depending on how zlib is built the libraries have different names, we diff --git a/external/curl/curl-msvc.patch.1 b/external/curl/curl-msvc.patch.1 deleted file mode 100644 index 2295b1b53ecf..000000000000 --- a/external/curl/curl-msvc.patch.1 +++ /dev/null @@ -1,27 +0,0 @@ -MSVC: using SOLARINC - ---- curl/winbuild/MakefileBuild.vc.orig 2017-10-23 16:36:07.713550851 +0200 -+++ curl/winbuild/MakefileBuild.vc 2017-10-23 16:38:19.301547594 +0200 -@@ -52,7 +52,7 @@ - !ELSE - CC_NODEBUG = $(CC) /O2 /DNDEBUG - CC_DEBUG = $(CC) /Od /D_DEBUG /RTC1 /Z7 /LDd --CFLAGS = /I. /I ../lib /I../include /nologo /W4 /EHsc /FD /c /DBUILDING_LIBCURL -+CFLAGS = /I. /I ../lib /I../include /nologo /W4 /EHsc /FD /c /DBUILDING_LIBCURL $(SOLARINC) - !ENDIF - - LFLAGS = /nologo /machine:$(MACHINE) -@@ -428,11 +428,11 @@ - # CURL_XX macros are for the curl.exe command - - !IF "$(DEBUG)"=="yes" --RC_FLAGS = /d_DEBUG /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc -+RC_FLAGS = $(SOLARINC) /d_DEBUG /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc - CURL_CC = $(CC_DEBUG) $(RTLIB_DEBUG) - CURL_RC_FLAGS = $(CURL_RC_FLAGS) /i../include /d_DEBUG /Fo $@ $(CURL_SRC_DIR)\curl.rc - !ELSE --RC_FLAGS = /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc -+RC_FLAGS = $(SOLARINC) /Fo $@ $(LIBCURL_SRC_DIR)\libcurl.rc - CURL_CC = $(CC_NODEBUG) $(RTLIB) - CURL_RC_FLAGS = $(CURL_RC_FLAGS) /i../include /Fo $@ $(CURL_SRC_DIR)\curl.rc - !ENDIF diff --git a/external/curl/zlib.patch.0 b/external/curl/zlib.patch.0 index 83993fe8a56f..400f01d54f40 100644 --- a/external/curl/zlib.patch.0 +++ b/external/curl/zlib.patch.0 @@ -8,15 +8,15 @@ # Check whether --with-zlib was given. if test ${with_zlib+y} -@@ -23609,12 +23609,28 @@ +@@ -23922,12 +23922,28 @@ - if test "$OPT_ZLIB" = "no"; then + if test "x$OPT_ZLIB" = "xno"; then + ZLIB_LIBS="" { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: zlib disabled" >&5 printf "%s\n" "$as_me: WARNING: zlib disabled" >&2;} else - if test "$OPT_ZLIB" = "yes"; then + if test "x$OPT_ZLIB" = "xyes"; then OPT_ZLIB="" fi + @@ -36,33 +36,32 @@ + ZLIB_LIBS="" if test -z "$OPT_ZLIB"; then - -@@ -23903,6 +23903,7 @@ - LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE zlib" + +@@ -24777,6 +24777,7 @@ + fi curl_zlib_msg="enabled" fi + fi fi - if test x"$AMFIXLIB" = x1; then + if test "$AMFIXLIB" = "1"; then --- configure.ac +++ configure.ac -@@ -1302,19 +1302,31 @@ +@@ -1392,19 +1392,30 @@ clean_CPPFLAGS=$CPPFLAGS clean_LDFLAGS=$LDFLAGS clean_LIBS=$LIBS -ZLIB_LIBS="" -+ AC_ARG_WITH(zlib, AS_HELP_STRING([--with-zlib=PATH],[search for zlib in PATH]) AS_HELP_STRING([--without-zlib],[disable use of zlib]), [OPT_ZLIB="$withval"]) - if test "$OPT_ZLIB" = "no"; then + if test "x$OPT_ZLIB" = "xno"; then + ZLIB_LIBS="" AC_MSG_WARN([zlib disabled]) else - if test "$OPT_ZLIB" = "yes"; then + if test "x$OPT_ZLIB" = "xyes"; then OPT_ZLIB="" fi @@ -80,8 +79,8 @@ if test -z "$OPT_ZLIB"; then CURL_CHECK_PKGCONFIG(zlib) -@@ -1395,6 +1395,7 @@ - LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE zlib" +@@ -1571,6 +1571,7 @@ + fi curl_zlib_msg="enabled" fi + fi diff --git a/include/systools/curlinit.hxx b/include/systools/curlinit.hxx index 7d842a8e4c01..7f0824e797c2 100644 --- a/include/systools/curlinit.hxx +++ b/include/systools/curlinit.hxx @@ -13,7 +13,7 @@ #include -// curl is built with --with-secure-transport on macOS and iOS so doesn't need these +// curl is built with --with-apple-sectrust on macOS and iOS so doesn't need these // certs. Windows doesn't need them either, but let's assume everything else does #if !defined(SYSTEM_OPENSSL) && !defined(_WIN32) && !defined(MACOSX) && !defined(IOS) #include