Stable 26.8 - Bump to latest

.gitmodules

@@ -332,7 +332,7 @@
 	url = https://github.com/ClickHouse/mongo-cxx-driver.git
 [submodule "contrib/mongo-c-driver"]
 	path = contrib/mongo-c-driver
-	url = https://github.com/ClickHouse/mongo-c-driver.git
+	url = https://github.com/ClickHouse/mongo-c-driver
 [submodule "contrib/sz3"]
 	path = contrib/sz3
 	url = https://github.com/ClickHouse/SZ3.git
@@ -365,7 +365,7 @@
 	url = https://github.com/ClickHouse/ai-sdk-cpp
 [submodule "contrib/nlohmann-json"]
 	path = contrib/nlohmann-json
-	url = https://github.com/nlohmann/json.git
+	url = https://github.com/ClickHouse/json
 [submodule "contrib/crc32c"]
 	path = contrib/crc32c
 	url = https://github.com/ClickHouse/crc32c
@@ -416,7 +416,7 @@
 	url = https://github.com/ClickHouse/geometry.hpp
 [submodule "contrib/zxc"]
 	path = contrib/zxc
-	url = https://github.com/ClickHouse/zxc
+	url = https://github.com/hellobertrand/zxc
 [submodule "contrib/libucontext"]
 	path = contrib/libucontext
 	url = https://github.com/kaniini/libucontext

CMakeLists.txt

@@ -173,7 +173,8 @@ if (OS_LINUX)
 
     if (LINKER_NAME MATCHES "lld" AND NOT SANITIZE AND NOT SANITIZE_COVERAGE AND NOT WITH_COVERAGE)
         # Fold identical code and data sections to reduce binary size.
-        set (CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--icf=all")
+        # `safe` keeps address-taken functions distinct, as C and C++ require.
+        set (CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--icf=safe")
     endif ()
 
     # In Release builds, strip residual debug sections that may come from contrib
@@ -345,7 +346,7 @@ if (NOT SANITIZE AND NOT SANITIZE_COVERAGE AND NOT WITH_COVERAGE)
     set(COMPILER_FLAGS "${COMPILER_FLAGS} -ffunction-sections -fdata-sections")
     # -faddrsig emits an address-significance table that lets lld's ICF
     # distinguish address-taken symbols from non-address-taken ones.
-    # Only useful on Linux where we use lld with --icf=all; Darwin's ld64
+    # Only useful on Linux where we use lld with --icf=safe; Darwin's ld64
     # does not consume these sections.
     if (OS_LINUX)
         set(COMPILER_FLAGS "${COMPILER_FLAGS} -faddrsig")

base/poco/NetSSL_OpenSSL/include/Poco/Net/SecureSocketImpl.h

@@ -149,6 +149,10 @@ namespace Net
         /// The object is normally guarded by the socket's mutex; a caller that uses it
         /// directly must ensure the socket is not accessed concurrently.
 
+        void markFatalError();
+        /// Records that an external operation on the underlying `SSL` object failed fatally.
+        /// An orderly SSL shutdown must not be attempted afterwards.
+
         X509 * peerCertificate() const;
         /// Returns the peer's certificate.
 
@@ -233,7 +237,7 @@ namespace Net
         /// Returns true iff the given host name is the local host
         /// (either "localhost" or "127.0.0.1").
 
-        bool mustRetry(int rc, Poco::Timespan & remaining_time);
+        bool mustRetry(int rc, int sslError, int socketError, Poco::Timespan & remaining_time);
         /// Returns true if the last operation should be retried,
         /// otherwise false.
         ///
@@ -247,7 +251,7 @@ namespace Net
         /// not become readable or writable within the sockets
         /// receive or send timeout.
 
-        int handleError(int rc);
+        int handleError(int rc, int sslError, int socketError, unsigned long errorCode);
         /// Handles an SSL error by throwing an appropriate exception.
 
         void reset();
@@ -281,6 +285,10 @@ namespace Net
         Poco::AutoPtr<SocketImpl> _pSocket;
         Context::Ptr _pContext;
         bool _needHandshake;
+        bool _fatalError;
+        bool _pendingWrite = false;
+        /// Whether the last `SSL_write` returned `SSL_ERROR_WANT_WRITE`. OpenSSL keeps that record pending
+        /// until `SSL_write` is retried, even after other operations change what `SSL_get_error` reports.
         std::string _peerHostName;
         Session::Ptr _pSession;
         const BIO_METHOD * _bioMethod = nullptr;

base/poco/NetSSL_OpenSSL/include/Poco/Net/SecureStreamSocketImpl.h

@@ -183,6 +183,9 @@ namespace Net
         /// Returns the underlying OpenSSL SSL object, or null if the SSL handshake
         /// has not been performed yet.
 
+        void markFatalError();
+        /// Records that an external operation on the underlying `SSL` object failed fatally.
+
         void setLazyHandshake(bool flag = true);
         /// Enable lazy SSL handshake. If enabled, the SSL handshake
         /// will be performed the first time date is sent or
@@ -301,6 +304,12 @@ namespace Net
     }
 
 
+    inline void SecureStreamSocketImpl::markFatalError()
+    {
+        _impl.markFatalError();
+    }
+
+
     inline Session::Ptr SecureStreamSocketImpl::currentSession()
     {
         return _impl.currentSession();

base/poco/NetSSL_OpenSSL/src/SSLManager.cpp

@@ -340,9 +340,7 @@ void SSLManager::initDefaultContext(bool server)
 	{
 		_ptrDefaultClientContext->enableSessionCache(cacheSessions);
 	}
-	/// Only an outbound connection has a requested host name to check: on an accepted socket this
-	/// would run against the client's address, which a client certificate does not name.
-	bool extendedVerification = config.getBool(prefix + CFG_EXTENDED_VERIFICATION, !server);
+	bool extendedVerification = config.getBool(prefix + CFG_EXTENDED_VERIFICATION, false);
 	if (server)
 		_ptrDefaultServerContext->enableExtendedCertificateVerification(extendedVerification);
 	else