From f524cd1947c865f6d9844bf8220db6cf1b65022b Mon Sep 17 00:00:00 2001
From: ns-ylambert <ylambert@netskope.com>
Date: Wed, 30 Sep 2026 15:46:13 +0200
Subject: [PATCH] curl-sys: define CURL_ENABLE_NTLM when the ntlm feature is on

libcurl 8.20 (released 2026-04-29) flipped NTLM to opt-in behind
`CURL_ENABLE_NTLM` (curl/curl#20698, commit [`cc0c83c5f853`]).
In `lib/curl_setup.h`:

    /* Single point where USE_NTLM definition might be defined */
   -#ifndef CURL_DISABLE_NTLM
   +#ifdef CURL_ENABLE_NTLM

The change was security-driven (weak auth, no HTTP/2/3 support). Same PR also
removed every reference to `CURL_DISABLE_NTLM` from libcurl's source, docs,
CMake, and configure logic. **The old opt-out symbol was retired entirely**.

curl-sys did not propagate the change downstream: the `ntlm` cargo feature
(alexcrichton/curl-rust#428, commit [`f0bbf37241e2`]) still only compiles NTLM
source files. Else-branch defines `CURL_DISABLE_NTLM`, which is now dead code.
The `.define("CURL_ENABLE_NTLM", None)` that the opt-in contract now requires
was never added.

Result: from curl-sys 0.4.90+curl-8.20.0 onward (released 2026-05-01),
`--features curl-sys/ntlm` compiles the NTLM sources but exports zero NTLM
symbols, so the feature does nothing.

Two edits, cross-platform (whoever activates `curl-sys/ntlm` opts in on any
platform):

- Add `.define("CURL_ENABLE_NTLM", None)` alongside the existing NTLM
  `.file(...)` calls so the feature does what it advertises again.

- Drop the now-dead `else { cfg.define("CURL_DISABLE_NTLM", None); }` branch.

Plus, a regression test in `src/lib.rs`'s `mod tests` asserting that
`Version::feature_ntlm()` is `true` when the `ntlm` feature is enabled.

[`cc0c83c5f853`]: https://github.com/curl/curl/commit/cc0c83c5f853
[`f0bbf37241e2`]: https://github.com/alexcrichton/curl-rust/commit/f0bbf37241e2
---
 curl-sys/build.rs |  5 ++---
 src/lib.rs        | 10 ++++++++++
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/curl-sys/build.rs b/curl-sys/build.rs
index 7d028d410..82348e251 100644
--- a/curl-sys/build.rs
+++ b/curl-sys/build.rs
@@ -304,15 +304,14 @@ fn main() {
         .warnings(false);
 
     if cfg!(feature = "ntlm") {
-        cfg.file("curl/lib/curl_endian.c")
+        cfg.define("CURL_ENABLE_NTLM", None)
+            .file("curl/lib/curl_endian.c")
             .file("curl/lib/curl_gethostname.c")
             .file("curl/lib/curl_ntlm_core.c")
             .file("curl/lib/http_ntlm.c")
             .file("curl/lib/md4.c")
             .file("curl/lib/vauth/ntlm.c")
             .file("curl/lib/vauth/ntlm_sspi.c");
-    } else {
-        cfg.define("CURL_DISABLE_NTLM", None);
     }
 
     if cfg!(feature = "protocol-ftp") {
diff --git a/src/lib.rs b/src/lib.rs
index 2965e2bed..09aa757dc 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -181,4 +181,14 @@ mod tests {
     fn is_initialized_before_main() {
         assert!(INITIALIZED.load(std::sync::atomic::Ordering::SeqCst));
     }
+
+    /// Regression test for the libcurl 8.20 `CURL_ENABLE_NTLM` opt-in flip.
+    #[cfg(feature = "ntlm")]
+    #[test]
+    fn is_ntlm_support_activated() {
+        assert!(
+            Version::get().feature_ntlm(),
+            "`CURL_ENABLE_NTLM` may not be defined"
+        );
+    }
 }