client: sort-dns: skip AAAA results when ipv6 is disable

.gitignore

@@ -65,3 +65,4 @@ doc
 /bb1/
 /bb3/
 /bin/
+/scratch

.sai.json

@@ -10,6 +10,13 @@
                                 "cd build && SAI_CPACK=\"-G RPM\" ${cpack}"
                         ]
 		},
+		"rocky9-ca/aarch64-a72a55-rk3588/clang": {
+			"default": false,
+                        "build": [
+                                "mkdir -p build destdir; cd build; CCACHE_DISABLE=1 LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib cmake .. ${cmake}",
+                                "cd build && scan-build -o ./scan-results make -j$SAI_PARALLEL"
+                        ]
+		},
 		"netbsd-OSX-bigsur/x86_64-intel-i3/llvm": {
                         "build": [
 				"mkdir -p build destdir; cd build; CCACHE_DISABLE=1 LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib MACOSX_DEPLOYMENT_TARGET=15.7 cmake .. -DCMAKE_MAKE_PROGRAM=/usr/bin/make -DLWS_GNUTLS_INCLUDE_DIRS=/usr/local/include -DLWS_GNUTLS_LIBRARIES=/usr/local/lib/libgnutls.dylib ${cmake}",
@@ -58,14 +65,14 @@
                                 "cd build && SAI_CPACK=\"-G DEB\" ${cpack}"
 			]
 		},
-                "netbsd/aarch64BE-bcm2837-a53/gcc": {
-                        "default": false,
-                        "build": [
-				"mkdir -p build destdir; cd build; CCACHE_DISABLE=1 LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib cmake .. ${cmake}",
-                                "cd build && make -j$SAI_PARALLEL && rm -rf ../destdir && make -j$SAI_PARALLEL DESTDIR=../destdir install",
-				"cd build && LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib /usr/pkg/bin/ctest -j$SAI_PARALLEL --output-on-failure --repeat until-pass:3"
-			]
-                },
+#                "netbsd/aarch64BE-bcm2837-a53/gcc": {
+#                        "default": false,
+#                        "build": [
+#				"mkdir -p build destdir; cd build; CCACHE_DISABLE=1 LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib cmake .. ${cmake}",
+#                                "cd build && make -j$SAI_PARALLEL && rm -rf ../destdir && make -j$SAI_PARALLEL DESTDIR=../destdir install",
+#				"cd build && LD_LIBRARY_PATH=../destdir/usr/local/share/libwebsockets-test-server/plugins:../destdir/usr/local/lib /usr/pkg/bin/ctest -j$SAI_PARALLEL --output-on-failure --repeat until-pass:3"
+#			]
+#                },
 		"freebsd/aarch64/llvm": {
                         "default": false,
                         "build": [
@@ -99,6 +106,7 @@
 				". /opt/esp/esp-idf/export.sh && pwd && cd ebuild/${cpack}/build && /usr/local/bin/sai-device ${cpack} ESPPORT=0 ctest --output-on-failure"
 			]
 		},
+
 		"coverity/x86_64/gcc": {
 			"default": false,
                         "build": [
@@ -112,7 +120,7 @@
 	"configurations": {
 		"default": {
 			"cmake":	"",
-			"platforms":	"w11/x86_64-amd/msvc-schannel,netbsd/aarch64BE-bcm2837-a53/gcc,freebsd/aarch64/llvm"
+			"platforms":	"w11/x86_64-amd/msvc-schannel,freebsd/aarch64/llvm"
 		},
 		"default-noh3": {
 			"cmake":	"-DLWS_WITH_HTTP3=0",
@@ -127,13 +135,13 @@
 		},
 		"default-dht": {
 			"cmake":	"-DLWS_WITH_DHT=1",
-			"platforms":	"w11/x86_64-amd/msvc,netbsd/aarch64BE-bcm2837-a53/gcc,freebsd/aarch64/llvm"
+			"platforms":	"w11/x86_64-amd/msvc,freebsd/aarch64/llvm"
 		},
 		"fault-injection": {
 			"cmake":	"-DLWS_WITH_SYS_FAULT_INJECTION=1 -DLWS_WITH_MINIMAL_EXAMPLES=1 -DLWS_WITH_CBOR=1"
 		},
 		"esp32-heltec": {
-                        "cmake":        "-DLWS_IPV6=1",
+                        "cmake":        "-DLWS_WITH_JPEG=0 -DLWS_WITH_UPNG=0 -DLWS_WITH_DLO=0 -DLWS_WITH_LHP=0 -DLWS_WITH_GZINFLATE=0 -DLWS_WITH_STUB=0 ",
                         "cpack":        "esp-heltec-wb32",
                         "platforms":    "none, freertos-espidf/xl6-esp32/gcc"
                 },
@@ -165,9 +173,13 @@
 			"cmake":	"-DLWS_ROLE_QUIC=1 -DLWS_WITH_WOLFSSL=1 -DLWS_WOLFSSL_INCLUDE_DIRS=/usr/local/include -DLWS_WOLFSSL_LIBRARIES=/usr/local/lib/libwolfssl.so -DLWS_WITH_MINIMAL_EXAMPLES=0",
 			"platforms":	"none, rocky9/aarch64-a72a55-rk3588/gcc"
 		},
+                "openhitls": {
+                        "cmake":        "-DLWS_WITH_OPENHITLS=1 -DOPENHITLS_INCLUDE_DIRS=/opt/openhitls/include -DOPENHITLS_LIBRARIES='/opt/openhitls/build/libhitls_tls.so;/opt/openhitls/build/libhitls_pki.so;/opt/openhitls/build/libhitls_crypto.so;/opt/openhitls/build/libhitls_bsl.so;/opt/openhitls/build/libhitls_auth.so'",
+			"platforms":	"none, rocky9/aarch64-a72a55-rk3588/gcc"
+		},
 		"default-noexamples": {
 			"cmake":	"-DLWS_WITH_MINIMAL_EXAMPLES=0",
-			"platforms":	"netbsd/aarch64BE-bcm2837-a53/gcc,freebsd/aarch64/llvm"
+			"platforms":	"freebsd/aarch64/llvm"
 		},
 		"tls-sess-off": {
 			"cmake":	"-DLWS_WITH_MINIMAL_EXAMPLES=1 -DLWS_WITH_TLS_SESSIONS=0"
@@ -194,7 +206,7 @@
 
 		"secure-streams-off": {
 			"cmake":	"-DLWS_WITH_SECURE_STREAMS=0 -DLWS_WITH_MINIMAL_EXAMPLES=1",
-			"platforms":	"w11/x86_64-amd/msvc,netbsd/aarch64BE-bcm2837-a53/gcc"
+			"platforms":	"w11/x86_64-amd/msvc"
 		},
 		"secure-streams-proxy": {
 			"cmake":	"-DLWS_WITH_SECURE_STREAMS=1 -DLWS_WITH_SECURE_STREAMS_PROXY_API=1 -DLWS_WITH_MINIMAL_EXAMPLES=1 "
@@ -204,6 +216,7 @@
 		},
 		"distro_recommended": { # minimal examples also needed for ctest
 			"cmake":	"-DLWS_WITH_DISTRO_RECOMMENDED=1 -DLWS_WITH_MINIMAL_EXAMPLES=1",
+			"platforms":	"rocky9-ca/aarch64-a72a55-rk3588/clang",
 			"cpack":	"cpack $SAI_CPACK",
 			"artifacts":	"build/*.rpm, build/*.deb, build/*.zip"
 		},
@@ -286,7 +299,8 @@
 		},
 		"threadpool": {
 			"cmake":	"-DLWS_WITH_THREADPOOL=1 -DLWS_WITH_MINIMAL_EXAMPLES=1"
-		},
+		}
+		,
 
 		# only applies to the coverity builder, and on pushes to "coverity" branch
 
@@ -296,6 +310,7 @@
 			"cpack":	"export STAMP=`git log -1 --pretty=format:%h` && rm -f libwebsockets.tar.xz && tar cJvf libwebsockets.tar.xz cov-int && script -e -q -c \"cat /etc/coverity/secrets.sh | lws-minimal-http-client-post-form --h1 https://scan.coverity.com:443/builds?project=warmcat%2Flibwebsockets --form file=@libwebsockets.tar.xz --form version=${STAMP} --form 'description=lws qa'\" /dev/null",
 			"branches":	"coverity"
 		}
+
 #		,
 		# awkward, we also want to test mbedtls, but coverity blocks on SSL build needing manual intervention
 #		"coverity-mbedtls": {

AGENTS.md

@@ -2,26 +2,59 @@
 
 ## Overview
 
-Please make high quality, not lazy, implementation decisions, because the code will have to be
-maintained for a long time.  And everybody, LLM or person, is able to work better if we keep
-the code clean and to a high standard to start with.
+Please err on the side of high quality, not lazy, implementation decisions, because the code
+will have to be maintained for a long time.  And everybody, LLM or person, is able to work
+better if we keep the code clean and to a high standard to start with.
 
 Even if your instructions don't include specific admonishment about quality, it is always
 necessary.
 
 Our work should follow the existing usage of apis in the project as much as possible.
 
+## Interacting
+
+We will be working on the same sources, do not build into ./build since I will be using it; make
+your own ./build-agy or whatever.
+
+Use cmake .. --fresh in order to force the build dir to align with your options no matter what
+was in there before.
+
+While the idea is you should modify and test sources towards some goal, please do NOT modify the
+git state unless directly asked.
+
+Often although we are working on the same sources, they are being tested on devices you don't have
+access to.  So you must ask for access to data state on those remote machines; looking at the local
+machine you are running on for config or data state directly is of zero use in those circumstances.
+
+## Completeness
+
+If you are unable to complete something your coding partner expects from the interaction with you, you
+must clearly explain to the user which parts are incomplete and need further work.
+
+Often adding / modifying or removing features has a very strong expectation that you will
+also take responsibility about certain side-effects.  For example, adding a switch to a
+minimal example always means modifying the associated --help and the example's markdown
+accordingly.  If we add significant new code, it must also bring with it api-test or other
+example code to confirm it works properly.  These side-effects are expected to be taken
+care of in the same phase of work, not "later", and even if not explicitly requested.
+
 ## Coding
 
-We avoid things like `scanf` for carefully parsing with code, eg with `lws_tokenize` or similar.
+We are very concerned about security, architecturally and in the code.  We avoid using:
+
+ - things like `scanf` for carefully parsing with code, eg with `lws_tokenize` or similar.
+
+ - `FILE *` and use apis like open(), read().
 
-We avoid `FILE *` and use apis like open(), read().
+ - casual linked-lists and use `lws_dll2_t`.
 
-We avoid casual linked-lists and use `lws_dll2_t`.
+We consider using:
 
-We consider using lwsac instead of discrete allocations, if the pattern of allocations will benefit from it.
+ - lwsac instead of discrete allocations, if the pattern of allocations will benefit from it.
 
-We consider using lws_struct to convert between sqlite storage <-> structs <-> JSON
+ - lws_struct to convert between sqlite storage <-> structs <-> JSON
+
+We are very concerned about portability and all builds occur with -Werror -Wall -Wextra.
 
 ## Appropriate locality
 
@@ -31,10 +64,14 @@ makes sense it's possible.
 
 ## Security
 
-Please bear in mind what parts of the system are secrets and look after the security of them.
+Please bear in mind:
+
+ - which parts of the system are secrets, and look after the security of them.
+ - all external data is untrusted and should be assumed to be part of an attack until
+   we have validated it to be within a range and type we expect and can safely consume.
 
-In particular, all web pieces are made available on the internet with a strict CSP.  That means
-** no inline styles or scripts ** .  You can find the web pieces (JS, HTML, css) in ./assets/
+ - all web pieces are served with a strict CSP.  That means ** no inline styles or scripts ** .
+   You can usually find the web pieces (JS, HTML, css) in ./assets/
 
 ## Build testing
 
@@ -46,5 +83,8 @@ cross-platform, and not include shellscripts, instead use cmake / ctest commands
 commands for the platform.
 
 minimal-examples-lowlevel/http-client/minimal-http-client-post/CMakeLists.txt shows how to use the fixtures
-stuff to magic peers into being while being sensitive to parallel CI using `$ENV{SAI_INSTANCE_IDX}` to make
-unique ports.
+stuff to magic peers into being while being sensitive to parallel CI using a CMake unique socket allocator
+function to make unique ports.
+
+In the case you can build and run ctest meaningfully, please do confirm the build passes before completing
+work on your goal.

CMakeLists-implied-options.txt

@@ -357,6 +357,10 @@ if (LWS_PLAT_FREERTOS)
  set(LWS_HAVE_GETIFADDRS 1)
  set(LWS_WITH_CUSTOM_HEADERS 0)
  set(LWS_WITH_STUB 0)
+ # FreeRTOS can't fork/exec; STUB defaults ON and implies SPAWN above before
+ # this point disables it, leaving SPAWN (and its siginfo_t typedef) on. Force
+ # it off here - there's no spawn support on FreeRTOS anyway.
+ set(LWS_WITH_SPAWN 0)
 endif()
 
 if (LWS_WITHOUT_TESTAPPS)

CMakeLists.txt

@@ -1,7 +1,7 @@
 #
 # libwebsockets - small server side websockets and web server implementation
 #
-# Copyright (C) 2010 - 2022 Andy Green <andy@warmcat.com>
+# Copyright (C) 2010 - 2026 Andy Green <andy@warmcat.com>
 #
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the "Software"), to
@@ -46,7 +46,15 @@ set(LWS_WITH_POLL 1)
 if (ESP_PLATFORM AND NOT (DEFINED IDF_TARGET AND IDF_TARGET STREQUAL "linux"))
 	set(LWS_ESP_PLATFORM 1)
 	#set(CMAKE_TOOLCHAIN_FILE contrib/cross-esp32.cmake)
-	set(LWIP_PROVIDE_ERRNO 1)
+	# IDF v6 (picolibc + mbedtls 4) makes errno thread-local and its lwip does
+	# not provide an errno of its own. Forcing LWIP_PROVIDE_ERRNO here bakes a
+	# non-TLS `extern int errno` into lws_config_private.h, which then fails to
+	# link against picolibc's TLS errno ("TLS definition ... mismatches non-TLS
+	# reference"). Only force it on older IDF (newlib), detected via the absence
+	# of mbedtls 4.
+	if (NOT LWS_HAVE_MBEDTLS_V4)
+		set(LWIP_PROVIDE_ERRNO 1)
+	endif()
 endif()
 
 # it's at this point any toolchain file is brought in
@@ -243,18 +251,22 @@ option(LWS_CTEST_INTERNET_AVAILABLE "CTest will performs tests that need the Int
 # TLS library options... all except mbedTLS are basically OpenSSL variants.
 #
 option(LWS_WITH_SSL "Include SSL support (defaults to OpenSSL or similar, mbedTLS if LWS_WITH_MBEDTLS is set)" ON)
-option(LWS_WITH_MBEDTLS "Use mbedTLS (>=2.0) replacement for OpenSSL. When setting this, you also may need to specify LWS_MBEDTLS_LIBRARIES and LWS_MBEDTLS_INCLUDE_DIRS" OFF)
+set(LWS_MBEDTLS_DEFAULT OFF)
+if (ESP_PLATFORM)
+	set(LWS_MBEDTLS_DEFAULT ON)
+endif()
+option(LWS_WITH_MBEDTLS "Use mbedTLS (>=2.0) replacement for OpenSSL. When setting this, you also may need to specify LWS_MBEDTLS_LIBRARIES and LWS_MBEDTLS_INCLUDE_DIRS" ${LWS_MBEDTLS_DEFAULT})
 option(LWS_WITH_BEARSSL "Use BearSSL replacement for OpenSSL. When setting this, you also may need to specify LWS_BEARSSL_LIBRARIES and LWS_BEARSSL_INCLUDE_DIRS" OFF)
 set(LWS_BEARSSL_PROFILE "full" CACHE STRING "BearSSL profile to use (e.g. full, client, minimal)")
 option(LWS_WITH_BORINGSSL "Use BoringSSL replacement for OpenSSL" OFF)
 option(LWS_WITH_AWSLC "Use AWSLC replacement for OpenSSL" OFF)
+option(LWS_WITH_OPENHITLS "Use openHITLS replacement for OpenSSL. When setting this, you also may need to specify OPENHITLS_LIBRARIES and OPENHITLS_INCLUDE_DIRS" OFF)
 option(LWS_WITH_CYASSL "Use CyaSSL replacement for OpenSSL. When setting this, you also need to specify LWS_CYASSL_LIBRARIES and LWS_CYASSL_INCLUDE_DIRS" OFF)
 option(LWS_WITH_WOLFSSL "Use wolfSSL replacement for OpenSSL. When setting this, you also may need to specify LWS_WOLFSSL_LIBRARIES and LWS_WOLFSSL_INCLUDE_DIRS" OFF)
 
-if (LWS_WITH_HTTP3 AND NOT (LWS_WITH_BORINGSSL OR LWS_WITH_AWSLC OR LWS_WITH_MBEDTLS OR LWS_WITH_WOLFSSL OR LWS_WITH_CYASSL OR LWS_WITH_BEARSSL OR LWS_WITH_SCHANNEL OR ESP_PLATFORM OR LWS_WITH_ESP32))
-       option(LWS_WITH_GNUTLS "Use GnuTLS for SSL" ON)
-else()
-       set(LWS_WITH_GNUTLS OFF CACHE BOOL "Use GnuTLS for SSL" FORCE)
+option(LWS_WITH_GNUTLS "Use GnuTLS for SSL" OFF)
+if (LWS_WITH_HTTP3 AND LWS_WITH_SSL AND NOT (LWS_WITH_BORINGSSL OR LWS_WITH_AWSLC OR LWS_WITH_MBEDTLS OR LWS_WITH_WOLFSSL OR LWS_WITH_CYASSL OR LWS_WITH_BEARSSL OR LWS_WITH_SCHANNEL OR ESP_PLATFORM OR LWS_WITH_ESP32 OR LWS_WITH_OPENHITLS))
+       set(LWS_WITH_GNUTLS ON CACHE BOOL "Use GnuTLS for SSL" FORCE)
 endif()
 
 if (LWS_WITH_BEARSSL)
@@ -267,7 +279,7 @@ if (NOT (LWS_WITH_BORINGSSL OR LWS_WITH_AWSLC OR LWS_WITH_MBEDTLS OR LWS_WITH_WO
     set(LWS_WITH_HTTP3 0)
 endif()
 
-if (WIN32 AND NOT (LWS_WITH_BORINGSSL OR LWS_WITH_AWSLC OR LWS_WITH_MBEDTLS OR LWS_WITH_WOLFSSL OR LWS_WITH_CYASSL OR LWS_WITH_BEARSSL OR LWS_WITH_GNUTLS))
+if (WIN32 AND NOT (LWS_WITH_BORINGSSL OR LWS_WITH_AWSLC OR LWS_WITH_MBEDTLS OR LWS_WITH_WOLFSSL OR LWS_WITH_CYASSL OR LWS_WITH_BEARSSL OR LWS_WITH_GNUTLS OR LWS_WITH_OPENHITLS))
 	set(LWS_SCHANNEL_DEFAULT ON)
 else()
 	set(LWS_SCHANNEL_DEFAULT OFF)
@@ -280,6 +292,18 @@ option(LWS_TLS_LOG_PLAINTEXT_RX "For debugging log the received plaintext as soo
 option(LWS_TLS_LOG_PLAINTEXT_TX "For debugging log the transmitted plaintext just before encryption" OFF)
 option(LWS_WITH_TLS_SESSIONS "Enable persistent, resumable TLS sessions" ON)
 option(LWS_WITH_TLS_JIT_TRUST "Enable dynamically computing which trusted TLS CA is needed to be instantiated" OFF)
+if (LWS_WITH_SSL AND (LWS_ROLE_H1 OR LWS_WITH_HTTP2 OR LWS_ROLE_WS OR LWS_ROLE_MQTT))
+	set(DEFAULT_TCP_TLS ON)
+else()
+	set(DEFAULT_TCP_TLS OFF)
+endif()
+option(LWS_WITH_TCP_TLS "Compile TCP TLS specific files" ${DEFAULT_TCP_TLS})
+
+if (LWS_WITH_OPENHITLS)
+	set(LWS_WITH_SSL ON)
+endif()
+
+
 
 #
 # Event library options (may select multiple, or none for default poll()
@@ -1083,8 +1107,10 @@ if (CMAKE_COMPILER_IS_GNUCC OR CMAKE_COMPILER_IS_GNUCXX OR COMPILER_IS_CLANG)
 	# always warn all and generate debug info
 	if (UNIX AND NOT LWS_PLAT_FREERTOS)
 		set(CMAKE_C_FLAGS "-Wall -Wextra -Wno-unused-parameter -Wconversion -Wsign-compare -Wstrict-aliasing ${VISIBILITY_FLAG} -Wundef ${GCOV_FLAGS} ${CMAKE_C_FLAGS} ${ASAN_FLAGS}" )
+		set(CMAKE_CXX_FLAGS "-Wall -Wextra -Wno-unused-parameter -Wconversion -Wsign-compare -Wstrict-aliasing ${VISIBILITY_FLAG} -Wundef ${GCOV_FLAGS} ${CMAKE_CXX_FLAGS} ${ASAN_FLAGS}" )
 	else()
 		set(CMAKE_C_FLAGS "-Wall -Wsign-compare ${VISIBILITY_FLAG} ${GCOV_FLAGS} ${CMAKE_C_FLAGS}" )
+		set(CMAKE_CXX_FLAGS "-Wall -Wsign-compare ${VISIBILITY_FLAG} ${GCOV_FLAGS} ${CMAKE_CXX_FLAGS} ${ASAN_FLAGS}" )
 	endif()
 
 	if (PICO_SDK_PATH)
@@ -1101,8 +1127,10 @@ if (CMAKE_COMPILER_IS_GNUCC OR CMAKE_COMPILER_IS_GNUCXX OR COMPILER_IS_CLANG)
 
 	if (LWS_SUPPRESS_DEPRECATED_API_WARNINGS)
 		set(CMAKE_C_FLAGS "-Wno-deprecated ${CMAKE_C_FLAGS}")
+		set(CMAKE_CXX_FLAGS "-Wno-deprecated ${CMAKE_CXX_FLAGS}")
 		if (LWS_GCC_HAS_NO_DEPRECATED_DECLARATIONS)
 			set(CMAKE_C_FLAGS "-Wno-deprecated-declarations ${CMAKE_C_FLAGS}")
+			set(CMAKE_CXX_FLAGS "-Wno-deprecated-declarations ${CMAKE_CXX_FLAGS}")
 		endif()
 	endif()
 endif ()
@@ -1122,9 +1150,15 @@ if (COMPILER_IS_CLANG)
 	set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-deprecated-declarations" )
 	if (UNIX AND LWS_HAVE_PTHREAD_H)
 		set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -pthread -Wno-error=unused-command-line-argument" )
+		set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -pthread -Wno-error=unused-command-line-argument" )
 	endif()
 endif()
 
+if (LWS_WITH_ASAN)
+	set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} ${ASAN_FLAGS}")
+	set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} ${ASAN_FLAGS}")
+endif()
+
 if (${CMAKE_SYSTEM_NAME} MATCHES "SunOS")
 		list(APPEND LIB_LIST_AT_END -lsocket)
 		if ((CMAKE_COMPILER_IS_GNUCC OR CMAKE_COMPILER_IS_GNUCXX))
@@ -1141,8 +1175,13 @@ endif()
 if (MSVC)
 	# Turn off pointless microsoft security warnings.
 	add_definitions(-D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE)
-	# Fail the build if any warnings
-	add_compile_options(/W3 /WX)
+	# Fail the build if any warnings, unless DISABLE_WERROR is set (mirrors
+	# the GCC/Clang -Werror gating above).
+	if ("${DISABLE_WERROR}" STREQUAL "OFF")
+		add_compile_options(/W3 /WX)
+	else()
+		add_compile_options(/W3)
+	endif()
 	# Unbreak MSVC broken preprocessor __VA_ARGS__ behaviour
 	if (MSVC_VERSION GREATER 1925)
 		add_compile_options(/Zc:preprocessor /wd5105)