diff options
| -rw-r--r-- | CHANGES | 2378 | ||||
| -rw-r--r-- | CHANGES.0 | 2379 |
2 files changed, 2382 insertions, 2375 deletions
@@ -6,2378 +6,10 @@ Changelog -Kamil Dudka (17 June 2010) -- Improve test575 in order to not fail with threaded DNS resolver. +This file no longer holds the changelog. Now you can generate it yourself +like this: -Version 7.21.0 (16 June 2010) - -Daniel Stenberg (5 June 2010) -- Constantine Sapuntzakis fixed a case of spurious SSL connection aborts using - libcurl and OpenSSL. "I tracked it down to uncleared error state on the - OpenSSL error stack - patch attached deals with that." - -Daniel Stenberg (5 June 2010) -- Frank Meier added CURLINFO_PRIMARY_PORT, CURLINFO_LOCAL_IP and - CURLINFO_LOCAL_PORT to curl_easy_getinfo(). - -Yang Tse (4 June 2010) -- Enabled OpenLDAP support for cygwin builds. This support was disabled back - in 2008 due to incompatibilities between OpenSSL and OpenLDAP headers. - cygwin's OpenSSL 0.9.8l and OpenLDAP 2.3.43 versions on cygwin 1.5.25 - allow building an OpenLDAP enabled libcurl supporting back to Windows 95. - - Removed the non-functional CURL_LDAP_HYBRID code and references. - -Daniel Stenberg (2 June 2010) -- Jason McDonald posted bug report #3006786 when he found that the SFTP code - didn't timeout properly in several places in the code even if a timeout was - set properly. - - Based on his suggested patch, I wrote a different implementation that I - think addressed the issue better and also uses the connect timeout for the - initial part of the SSH/SFTP done during the "protocol connect" phase. - - (http://curl.haxx.se/bug/view.cgi?id=3006786) - -Yang Tse (2 June 2010) -- Added missing new libcurl files to non-configure targets. Adjusted - libcurl standard internal header inclusions in new files. Fixed an - SPNEGO related memory leak. Fixed several LDAP related compilation - issues, and fixed some compiler warnings. - -Daniel Stenberg (1 June 2010) -- Igor Novoseltsev reported a problem with the multi socket API and using - timeouts and timers. It boiled down to a problem with libcurl's use of - GetTickCount() interally to figure out the current time, while Igor's own - application code used another function call. - - It made his app call the socket API timeout function a bit _before_ libcurl - would consider the timeout to trigger, and that could easily lead to - timeouts or stalls in the app. It seems GetTickCount() in general often has - no better resolution than 16ms and switching to the alternative function - QueryPerformanceCounter has its share of problems: - http://www.virtualdub.org/blog/pivot/entry.php?id=106 - - We address this problem by simply having libcurl treat timers that already - has occured or will occur within 40ms subject for treatment. I'm confident - that there are other implementations and operating systems with similarly in - accurate timer functions so it makes sense to have applied generically and I - don't believe we sacrifice much by adding a 40ms inaccuracy on these - timeouts. - -Kamil Dudka (27 May 2010) -- added a new test for CRL support (test313) - -- Tor Arntsen changed the alternative definition of bool to use enum instead - of unsigned char. - -Daniel Stenberg (25 May 2010) -- Julien Chaffraix fixed the warning seen when compiling lib/rtmp.c: one - unused variables, several unused arguments and some missing #include. - -- Julien Chaffraix fixed 2 OOM errors: a missing NULL-check in - lib/http_negociate.c and a potential NULL dereferencing in lib/splay.c - -- Howard Chu brought a patch that makes the LDAP code much cleaner, nicer and - in general being a better libcurl citizen. If a new enough OpenLDAP version - is detect, the new and shiny lib/openldap.c code is then used instead of the - old cruft. - -Daniel Stenberg (21 May 2010) -- Eric Mertens posted bug #3003705: when we made TFTP use the correct timeout - option when sent to the server (fixed May 18th 2010) it became obvious that - libcurl used invalid timeout values (300 by default while the RFC allows - nothing above 255). While of course it is obvious that as TFTP has worked - thus far without being able to set timeout at all, just removing the setting - wouldn't make any difference in behavior. I decided to still keep it (but - fix the problem) as it now actually allows for easier (future) customization - of the timeout. - - (http://curl.haxx.se/bug/view.cgi?id=3003705) - -- Douglas Kilpatrick filed bug report #3004787 and pointed out that the TFTP - code didn't handle block id wraps correctly. His suggested fix inspired the - fix I committed. - - (http://curl.haxx.se/bug/view.cgi?id=3004787) - -Daniel Stenberg (20 May 2010) -- Tanguy Fautre brought a fix to allow curl to build with Microsoft VC10. - -Daniel Stenberg (18 May 2010) -- Eric Mertens posted bug report #3003005 pointing out that the libcurl TFTP - code was not sending the timeout option properly to the server, and - suggested a fix. - - (http://curl.haxx.se/bug/view.cgi?id=3003005) - -Kamil Dudka (16 May 2010) -- Pavel Raiskup introduced a new option CURLOPT_FNMATCH_DATA in order to pass - a custom data pointer to the callback specified by CURLOPT_FNMATCH_FUNCTION. - -Daniel Stenberg (14 May 2010) -- John-Mark Bell filed bug #3000052 that identified a problem (with an - associated patch) with the OpenSSL handshake state machine when the multi - interface is used: - - Performing an https request using a curl multi handle and using select or - epoll to wait for events results in a hang. It appears that the cause is the - fix for bug #2958179, which makes ossl_connect_common unconditionally return - from the step 2 loop when fetching from a multi handle. - - When ossl_connect_step2 has completed, it updates connssl->connecting_state - to ssl_connect_3. ossl_connect_common will then return to the caller, as a - multi handle is in use. Eventually, the client code will call - curl_multi_fdset to obtain an updated fdset to select or epoll on. For https - requests, curl_multi_fdset will cause https_getsock to be called. - https_getsock will only return a socket handle if the connecting_state is - ssl_connect_2_reading or ssl_connect_2_writing. Therefore, the client will - never obtain a valid fdset, and thus not drive the multi handle, resulting - in a hang. - - (http://curl.haxx.se/bug/view.cgi?id=3000052) - -- Sebastian V reported bug #3000056 identifying a problem with redirect - following. It showed that when curl followed redirects it didn't properly - ignore the response body of the 30X response if that response was using - compressed Content-Encoding! - - (http://curl.haxx.se/bug/view.cgi?id=3000056) - -Daniel Stenberg (12 May 2010) -- Howard Chu brought support for RTMP. This is powered by the underlying - librtmp library. It supports a range of variations and "sub-protocols" - within the RTMP family. - -- Pavel Raiskup brought support for FTP directory wildcard matching to allow - selective downloading. To provide that, a set of new options were added: - - CURLOPT_WILDCARDMATCH - CURLOPT_CHUNK_BGN_FUNCTION - CURLOPT_CHUNK_END_FUNCTION - CURLOPT_CHUNK_DATA - CURLOPT_FNMATCH_FUNCTION - - There were also a set of new tests added (574 - 577) to verify this. - -Kamil Dudka (11 May 2010) -- CRL support in libcurl-NSS has been completely broken. Now it works. Original - bug report: https://bugzilla.redhat.com/581926 - -Daniel Stenberg (7 May 2010) -- Dirk Manske reported a regression. When connecting with the multi interface, - there were situations where libcurl wouldn't store connect time correctly as - it used to (and is documented to) do. - - Using his fine sample program we could repeat it, and I wrote up test case - 573 using that code. The problem does not easily show itself using the local - test suite though. - - The fix, also as suggested by Dirk, is a bit on the ugly side as it adds yet - another call to Curl_verboseconnect() and setting the TIMER_CONNECT time. - That situation is subject for some closer inspection in the future. - -- Howard Chu split the I/O handling functions into private handlers. - - Howard Chu brought the bulk work of this patch that properly moves out the - sending and recving of data to the parts of the code that are properly - responsible for the various ways of doing so. - - Daniel Stenberg assisted with polishing a few bits and fixed some minor - flaws in the original patch. - - Another upside of this patch is that we now abuse CURLcodes less with the - "magic" -1 return codes and instead use CURLE_AGAIN more consistently. - -Daniel Stenberg (5 May 2010) -- Hoi-Ho Chan introduced support for using the PolarSSL library. You control - this with the new configure option --with-polarssl. - -Daniel Stenberg (29 Apr 2010) -- Ben Greear made telnet a lot better/easier to use by an application: - - The main change is to allow input from user-specified methods, when they are - specified with CURLOPT_READFUNCTION. All calls to fflush(stdout) in - telnet.c were removed, which makes using 'curl telnet://foo.com' painful - since prompts and other data are not always returned to the user promptly. - Use 'curl --no-buffer telnet://foo.com' instead. In general, the user - should have their CURLOPT_WRITEFUNCTION do a fflush for interactive use. - - Also fix assumption that reading from stdin never returns < 0. - Old code could crash in that case. - - Call progress functions in telnet main loop. - -Daniel Stenberg (26 Apr 2010) -- Make use of the libssh2_init/exit functions that libssh2 added in version - 1.2.5. Using them will improve how libcurl works in threaded situations when - SCP and SFTP are transfered. - -Daniel Stenberg (25 Apr 2010) -- Based on work by Kamil Dudka, I've introduced the new configure option - --enable-threaded-resolver. When used, the configure script will check for - pthreads and if around, it will build libcurl to use pthreads to do name - resolving in a threaded manner. Note that this is just a fix to offer an - option that can enable the code that already included. The threader resolver - code was mostly added on Jan 26 2010. - -Daniel Stenberg (24 Apr 2010) -- Alex Bligh introduced the --proto and -proto-redir options that limit what - protocols curl accepts for the requests and when following redirects. - -Kamil Dudka (24 Apr 2010) -- Fixed test536 in order to not fail with threaded DNS resolver and tweaked - comments in certain examples using curl_multi_fdset(). - -- Fixed SSL handshake timeout underflow in libcurl-NSS, which caused test405 - to hang on a slow machine. - -Daniel Stenberg (21 Apr 2010) -- The -O option caused curl to crash on windows and DOS due to the tool - writing out of boundary memory. - -Yang Tse (20 Apr 2010) -- Ruslan Gazizov detected that MSVC makefiles were using wsock32.lib instead - of ws2_32.lib, this generated linking issues on MSVC IPv6 enabled builds - that were done using those makefiles. - -Daniel Stenberg (19 Apr 2010) -- -J/--remote-header-name didn't strip trailing carriage returns or linefeeds - properly, so they could be used in the file name. - -Daniel Stenberg (16 Apr 2010) -- Jerome Vouillon made the GnuTLS SSL handshake phase non-blocking. - -- The recent overhaul of the SSL recv function made the GnuTLS specific code - treat a zero returned from gnutls_record_recv() as an error, and this caused - our HTTPS test cases to fail. We leave it to upper layer code to detect if - an EOF is a problem or not. - -- I reverted the resolver fix from yesterday and instead removed all uses of - AI_CANONNAME all over libcurl and made the only user of that info (krb5.c) - use the host name from the URL instead. No reverse resolving is a good - thing. - -- Paul Howarth made configure properly detect GSS "on ancient Linux distros" - by editing in which order we use headers to detect GSS. - -Daniel Stenberg (15 Apr 2010) -- Rainer Canavan filed bug report #2987196 that identified libcurl doing - unnecesary reverse name lookups in many cases when built to use IPv4 and - getaddrinfo(). The logic for ipv6 is now used for ipv4 too. - - (http://curl.haxx.se/bug/view.cgi?id=2963679) - -Version 7.20.1 (14 April 2010) - -Daniel Stenberg (9 Apr 2010) -- Prefixing the FTP quote commands with an asterisk really only worked for the - postquote actions. This is now fixed and test case 227 has been extended to - verify. - -Kamil Dudka (4 Apr 2010) -- Eliminated a race condition in Curl_resolv_timeout(). - -- Refactorized interface of Curl_ssl_recv()/Curl_ssl_send(). - -- libcurl-NSS now provides more accurate messages and error codes in case of - client certificate problem. Either during connection, or transfer phase. - -Daniel Stenberg (1 Apr 2010) -- Matt Wixson found and fixed a bug in the SCP/SFTP area where the code - treated a 0 return code from libssh2 to be the same as EAGAIN while in - reality it isn't. The problem caused a hang in SFTP transfers from a - MessageWay server. - -Daniel Stenberg (28 Mar 2010) -- Ben Greear: If you pass a URL to pop3 that does not contain a message ID as - part of the URL, it would previously ask for 'INBOX' which just causes the - pop3 server to return an error. - - Now libcurl treats en empty message ID as a request for LIST (list of pop3 - message IDs). User's code could then parse this and download individual - messages as desired. - -Daniel Stenberg (27 Mar 2010) -- Ben Greear brought a patch that from now on allows all protocols to specify - name and user within the URL, in the same manner HTTP and FTP have been - allowed to in the past - although far from all of the libcurl supported - protocls actually have that feature in their URL definition spec. - -Daniel Stenberg (26 Mar 2010) -- Ben Greear brought code that makes the rate limiting code for the easy - interface a bit smoother as it introduces sub-second sleeps during it and it - also takes the buffer sizes into account. - -Daniel Stenberg (24 Mar 2010) -- Bob Richmond: There's an annoying situation where libcurl will read new HTTP - response data from a socket, then check if it's a timeout if one is set. If - the last packet received constitutes the end of the response body, libcurl - still treats it as a timeout condition and reports a message like: - - "Operation timed out after 3000 milliseconds with 876 out of 876 bytes - received" - - It should only a timeout if the timer lapsed and we DIDN'T receive the end - of the response body yet. - -- Christopher Conroy fixed a problem with RTSP and GET_PARAMETER reported - to us by Massimo Callegari. There's a new test case 572 that verifies this - now. - -- The 'ares' subtree has been removed from the source repository. It was - always a separate project that sort of piggybacked on the curl project since - the dawn of times and now the time has come for it to go stand on its own - legs and continue living its own life. All details on c-ares and its new - source code repository is found at http://c-ares.haxx.se/ - -Daniel Stenberg (23 Mar 2010) -- Kenny To filed the bug report #2963679 with patch to fix a problem he - experienced with doing multi interface HTTP POST over a proxy using - PROXYTUNNEL. He found a case where it would connect fine but bits.tcpconnect - was not set correct so libcurl didn't work properly. - - (http://curl.haxx.se/bug/view.cgi?id=2963679) - -- Akos Pasztory filed debian bug report #572276 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572276 mentioning a problem - with a resource that returns chunked-encoded _and_ with a Content-Length - and libcurl failed to properly ignore the latter information. - -- Hauke Duden provided an example program that made the multi interface crash. - His example simply used the multi interface and did first one FTP transfer - and after completion it used a second easy handle and did another FTP - transfer on the same FTP server. - - This triggered a bug in the "delayed easy handle kill" system that curl - uses: when an FTP connection is left alive it must keep an easy handle - around internally - only for the purpose of having an easy handle when it - later disconnects it. The code assumed that when the easy handle was removed - and an internal reference was made, that version could be killed later on - when a new easy handle came using the same connection. This was wrong as - Hauke's example showed that the removed handle wasn't killed for real until - later. This caused a double close attempt => segfault. - -Daniel Stenberg (22 Mar 2010) -- Thomas Lopatic fixed the alarm()-based DNS timeout: - - Looking at the code of Curl_resolv_timeout() in hostip.c, I think that in - case of a timeout, the signal handler for SIGALRM never gets removed. I - think that in my case it gets executed at some point later on when execution - has long left Curl_resolv_timeout() or even the cURL library. - - The code that is jumped to with siglongjmp() simply sets the error message - to "name lookup timed out" and then returns with CURLRESOLV_ERROR. I guess - that instead of simply returning without cleaning up, the code should have a - goto that jumps to the spot right after the call to Curl_resolv(). - -Kamil Dudka (22 Mar 2010) -- Douglas Steinwand contributed a patch fixing insufficient initialization in - Curl_clone_ssl_config() - -Daniel Stenberg (21 Mar 2010) -- Ben Greear improved TFTP: the error code returning and the treatment - of TSIZE == 0 when uploading. - -- We've switched from CVS to git. See http://curl.haxx.se/source.html - -Kamil Dudka (19 Mar 2010) -- Improved Curl_read() to not ignore the error returned from Curl_ssl_recv(). - -Daniel Stenberg (15 Mar 2010) -- Constantine Sapuntzakis brought a patch: - - The problem mentioned on Dec 10 2009 - (http://curl.haxx.se/bug/view.cgi?id=2905220) was only partially fixed. - Partially because an easy handle can be associated with many connections in - the cache (e.g. if there is a redirect during the lifetime of the easy - handle). The previous patch only cleaned up the first one. The new fix now - removes the easy handle from all connections, not just the first one. - -Daniel Stenberg (6 Mar 2010) -- Ben Greear brought a patch that fixed the rate limiting logic for TFTP when - the easy interface was used. - -Daniel Stenberg (5 Mar 2010) -- Daniel Johnson provided fixes for building curl with the clang compiler. - -Yang Tse (5 Mar 2010) -- Constantine Sapuntzakis detected and fixed a double free in builds done - with threaded resolver enabled (Windows default configuration) that would - get triggered when a curl handle is closed while doing DNS resolution. - -Daniel Stenberg (2 Mar 2010) -- [Daniel Johnson] I've been trying to build libcurl with clang on Darwin and - ran into some issues with the GSSAPI tests in configure.ac. The tests first - try to determine the include dirs and libs and set CPPFLAGS and LIBS - accordingly. It then checks for the headers and finally sets LIBS a second - time, causing the libs to be included twice. The first setting of LIBS seems - redundant and should be left out, since the first part is otherwise just - about finding headers. - - My second issue is that 'krb5-config --libs gssapi' on Darwin is less than - useless and returns junk that, while it happens to work with gcc, causes - clang to choke. For example, --libs returns $CFLAGS along with the libs, - which is really retarded. Simply setting 'LIBS="$LIBS -lgssapi_krb5 - -lresolv"' on Darwin is sufficient. - -- Based on patch provided by Jacob Moshenko, the transfer logic now properly - makes sure that when using sub-second timeouts, there's no final bad 1000ms - wait. Previously, a sub-second timeout would often make the elapsed time end - up the time rounded up to the nearest second (e.g. 1s for 200ms timeout) - -- Andrei Benea filed bug report #2956698 and pointed out that the - CURLOPT_CERTINFO feature leaked memory due to a missing OpenSSL function - call. He provided the patch to fix it too. - - http://curl.haxx.se/bug/view.cgi?id=2956698 - -- Markus Duft pointed out in bug #2961796 that even though Interix has a - poll() function it doesn't quite work the way we want it so we must disable - it, and he also provided a patch for it. - - http://curl.haxx.se/bug/view.cgi?id=2961796 - -- Made the pingpong timeout code properly deal with the response timeout AND - the global timeout if set. Also, as was reported in the bug report #2956437 - by Ryan Chan, the time stamp to use as basis for the per command timeout was - not set properly in the DONE phase for FTP (and not for SMTP) so I fixed - that just now. This was a regression compared to 7.19.7 due to the - conversion of FTP code over to the generic pingpong concepts. - - http://curl.haxx.se/bug/view.cgi?id=2956437 - -Daniel Stenberg (1 Mar 2010) -- Ben Greear provided an update for TFTP that fixes upload. - -- Wesley Miaw reported bug #2958179 which identified a case of looping during - OpenSSL based SSL handshaking even though the multi interface was used and - there was no good reason for it. - - http://curl.haxx.se/bug/view.cgi?id=2958179 - -Daniel Stenberg (26 Feb 2010) -- Pat Ray in bug #2958474 pointed out an off-by-one case when receiving a - chunked-encoding trailer. - - http://curl.haxx.se/bug/view.cgi?id=2958474 - -Daniel Fandrich (25 Feb 2010) -- Fixed a couple of out of memory leaks and a segfault in the SMTP & IMAP code. - -Yang Tse (25 Feb 2010) -- I fixed bug report #2958074 indicating - (http://curl.haxx.se/bug/view.cgi?id=2958074) that curl on Windows with - option --trace-time did not use local time when timestamping trace lines. - This could also happen on other systems depending on time souurce. - -Patrick Monnerat (22 Feb 2010) -- Proper handling of STARTTLS on SMTP, taking CURLUSESSL_TRY into account. -- SMTP falls back to RFC821 HELO when EHLO fails (and SSL is not required). -- Use of true local host name (i.e.: via gethostname()) when available, as - default argument to SMTP HELO/EHLO. -- Test case 804 for HELO fallback. - -Daniel Stenberg (20 Feb 2010) -- Fixed the SMTP compliance by making sure RCPT TO addresses are specified - properly in angle brackets. Recipients provided with CURLOPT_MAIL_RCPT now - get angle bracket wrapping automatically by libcurl unless the recipient - starts with an angle bracket as then the app is assumed to deal with that - properly on its own. - -- I made the SMTP code expect a 250 response back from the server after the - full DATA has been sent, and I modified the test SMTP server to also send - that response. As usual, the DONE operation that is made after a completed - transfer is still not doable in a non-blocking way so this waiting for 250 - is unfortunately made blockingly. - -Yang Tse (14 Feb 2010) -- Overhauled test suite getpart() function. Fixing potential out of bounds - stack and memory overwrites triggered with huge test case definitions. - -Daniel Stenberg (13 Feb 2010) -- Martin Hager reported and fixed a problem with a missing quote in libcurl.m4 - - (http://curl.haxx.se/bug/view.cgi?id=2951319) - -- Tom Donovan fixed the CURL_FORMAT_* defines when building with cmake. - - (http://curl.haxx.se/bug/view.cgi?id=2951269) - -Daniel Stenberg (12 Feb 2010) -- Jack Zhang reported a problem with SMTP: we wrongly used multiple addresses - in the same RCPT TO line, when they should be sent in separate single - commands. I updated test case 802 to verify this. - -- I also fixed a bad use of my_setopt_str() of CURLOPT_MAIL_RCPT in the curl - tool which made it try to output it as string for the --libcurl feature - which could lead to crashes. - -Yang Tse (11 Feb 2010) -- Steven M. Schweda fixed VMS builder bad behavior when used in a batch job, - removed obsolete batch_compile.com and defines.com and updated VMS readme. - -Version 7.20.0 (9 February 2010) - -Daniel Stenberg (9 Feb 2010) -- When downloading compressed content over HTTP and the app asked libcurl to - automatically uncompress it with the CURLOPT_ENCODING option, libcurl could - wrongly provide the callback with more data than the maximum documented - amount. An application could thus get tricked into badness if the maximum - limit was trusted to be enforced by libcurl itself (as it is documented). - - This is further detailed and explained in the libcurl security advisory - 20100209 at - - http://curl.haxx.se/docs/adv_20100209.html - -Daniel Fandrich (3 Feb 2010) -- Changed the Watcom makefiles to make them easier to keep in sync with - Makefile.inc since that can't be included directly. - -Yang Tse (2 Feb 2010) -- Symbol CURL_FORMAT_OFF_T now obsoleted, will be removed in a future release, - symbol will not be available when building with CURL_NO_OLDIES defined. Use - of CURL_FORMAT_CURL_OFF_T is preferred since 7.19.0 - -Daniel Stenberg (1 Feb 2010) -- Using the multi_socket API, it turns out at times it seemed to "forget" - connections (which caused a hang). It turned out to be an existing (7.19.7) - bug in libcurl (that's been around for a long time) and it happened like - this: - - The app calls curl_multi_add_handle() to add a new easy handle, libcurl will - then set it to timeout in 1 millisecond so libcurl will tell the app about - it. - - The app's timeout fires off that there's a timeout, the app calls libcurl as - we so often document it: - - do { - res = curl_multi_socket_action(... TIMEOUT ...); - } while(CURLM_CALL_MULTI_PERFORM == res); - - And this is the problem number one: - - When curl_multi_socket_action() is called with no specific handle, but only - a timeout-action, it will *only* perform actions within libcurl that are - marked to run at this time. In this case, the request would go from INIT to - CONNECT and return CURLM_CALL_MULTI_PERFORM. When the app then calls libcurl - again, there's no timer set for this handle so it remains in the CONNECT - state. The CONNECT state is a transitional state in libcurl so it reports no - sockets there, and thus libcurl never tells the app anything more about that - easy handle/connection. - - libcurl _does_ set a 1ms timeout for the handle at the end of - multi_runsingle() if it returns CURLM_CALL_MULTI_PERFORM, but since the loop - is instant the new job is not ready to run at that point (and there's no - code that makes libcurl call the app to update the timout for this new - timeout). It will simply rely on that some other timeout will trigger later - on or that something else will update the timeout callback. This makes the - bug fairly hard to repeat. - - The fix made to adress this issue: - - We introduce a loop in lib/multi.c around all calls to multi_runsingle() and - simply check for CURLM_CALL_MULTI_PERFORM internally. This has the added - benefit that this goes in line with my long-term wishes to get rid of the - CURLM_CALL_MULTI_PERFORM all together from the public API. - - The downside of this fix, is that the counter we return in 'running_handles' - in several of our public functions then gets a slightly new and possibly - confusing behavior during times: - - If an app adds a handle that fails to connect (very quickly) it may just - as well never appear as a 'running_handle' with this fix. Previously it - would first bump the counter only to get it decreased again at next call. - Even I have used that change in handle counter to signal "end of a - transfer". The only *good* way to find the end of a individual transfer - is calling curl_multi_info_read() to see if it returns one. - - Of course, if the app previously did the looping before it checked the - counter, it really shouldn't be any new effect. - -Yang Tse (26 Jan 2010) -- Constantine Sapuntzakis' and Joshua Kwan's work done in the last four months - relative to the asynchronous DNS lookups, along with with some integration - adjustments I have done are finally committed to CVS. - - Currently these enhancements will benefit builds done using c-ares on any - platform as well as Windows builds using the default threaded resolver. - - This release does not make generally available POSIX threaded DNS lookups - yet. There is no configure option to enable this feature yet. It is possible - to experimantally try this feature running configure with compiler flags that - make simultaneous definition of preprocessor symbols USE_THREADS_POSIX and - HAVE_PTHREAD_H, as well as whatever reentrancy compiler flags and linker ones - are required to link and properly use pthread_* functions on each platform. - -Daniel Stenberg (26 Jan 2010) -- Mike Crowe made libcurl return CURLE_COULDNT_RESOLVE_PROXY when it is the - proxy that cannot be resolved when using c-ares. This matches the behaviour - when not using c-ares. - -Björn Stenberg (23 Jan 2010) -- Added a new flag: -J/--remote-header-name. This option tells the - -O/--remote-name option to use the server-specified Content-Disposition - filename instead of extracting a filename from the URL. - -Daniel Stenberg (21 Jan 2010) -- Chris Conroy brought support for RTSP transfers, and with it comes 8(!) new - libcurl options for controlling what to get and how to receive posssibly - interleaved RTP data. - -Daniel Stenberg (20 Jan 2010) -- As was pointed out on the http-state mailing list, the order of cookies in a - HTTP Cookie: header _needs_ to be sorted on the path length in the cases - where two cookies using the same name are set more than once using - (overlapping) paths. Realizing this, identically named cookies must be - sorted correctly. But detecting only identically named cookies and take care - of them individually is harder than just to blindly and unconditionally sort - all cookies based on their path lengths. All major browsers also already do - this, so this makes our behavior one step closer to them in the cookie area. - - Test case 8 was the only one that broke due to this change and I updated it - accordingly. - -Daniel Stenberg (19 Jan 2010) -- David McCreedy brought a fix and a new test case (129) to make libcurl work - again when downloading files over FTP using ASCII and it turns out that the - final size of the file is not the same as the initial size the server - reported. This is very common since servers don't take the newline - conversions into account. - -Kamil Dudka (14 Jan 2010) -- Suppressed side effect of OpenSSL configure checks, which prevented NSS from - being properly detected under certain circumstances. It had been caused by - strange behavior of pkg-config when handling PKG_CONFIG_LIBDIR. pkg-config - distinguishes among empty and non-existent environment variable in that case. - -Daniel Stenberg (12 Jan 2010) -- Gil Weber reported a peculiar flaw with the multi interface when doing SFTP - transfers: curl_multi_fdset() would return -1 and not set and file - descriptors several times during a transfer of a single file. It turned out - to be due to two different flaws now fixed. Gil's excellent recipe helped me - nail this. - -Daniel Stenberg (11 Jan 2010) -- Made sure that the progress callback is repeatedly called at a regular - interval even during very slow connects. - -- The tests/runtests.pl script now checks to see if the test case that runs is - present in the tests/data/Makefile.am and outputs a notice message on the - screen if not. Each test file has to be included in that Makefile.am to get - included in release archives and forgetting to add files there is a common - mistake. This is an attempt to make it harder to forget. - -Daniel Stenberg (9 Jan 2010) -- Johan van Selst found and fixed a OpenSSL session ref count leak: - - ossl_connect_step3() increments an SSL session handle reference counter on - each call. When sessions are re-used this reference counter may be - incremented many times, but it will be decremented only once when done (by - Curl_ossl_session_free()); and the internal OpenSSL data will not be freed - if this reference count remains positive. When a session is re-used the - reference counter should be corrected by explicitly calling - SSL_SESSION_free() after each consecutive SSL_get1_session() to avoid - introducing a memory leak. - - (http://curl.haxx.se/bug/view.cgi?id=2926284) - -Daniel Stenberg (7 Jan 2010) -- Make sure the progress callback is called repeatedly even during very slow - name resolves when c-ares is used for resolving. - -Claes Jakobsson (6 Jan 2010) -- Julien Chaffraix fixed so that the fragment part in an URL is not sent - to the server anymore. - -Kamil Dudka (3 Jan 2010) -- Julien Chaffraix eliminated a duplicated initialization in singlesocket(). - -Daniel Stenberg (2 Jan 2010) -- Make curl support --ssl and --ssl-reqd instead of the previous FTP-specific - versions --ftp-ssl and --ftp-ssl-reqd as these options are now used to - control SSL/TLS for IMAP, POP3 and SMTP as well in addition to FTP. The old - option names are still working but the new ones are the ones listed and - documented. - -Daniel Stenberg (1 Jan 2010) -- Ingmar Runge enhanced libcurl's FTP engine to support the PRET command. This - command is a special "hack" used by the drftpd server, but even though it is - a custom extension I've deemed it fine to add to libcurl since this server - seems to survive and people keep using it and want libcurl to support - it. The new libcurl option is named CURLOPT_FTP_USE_PRET, and it is also - usable from the curl tool with --ftp-pret. Using this option on a server - that doesn't support this command will make libcurl fail. - - I added test cases 1107 and 1108 to verify the functionality. - - The PRET command is documented at - http://www.drftpd.org/index.php/Distributed_PASV - -Yang Tse (30 Dec 2009) -- Steven M. Schweda improved VMS build system, and Craig A. Berry helped - with the patch and testing. - -Daniel Stenberg (26 Dec 2009) -- Renato Botelho and Peter Pentchev brought a patch that makes the libcurl - headers work correctly even on FreeBSD systems before v8. - - (http://curl.haxx.se/bug/view.cgi?id=2916915) - -Daniel Stenberg (17 Dec 2009) -- David Byron fixed Curl_ossl_cleanup to actually call ENGINE_cleanup when - available. - -- Follow-up fix for the proxy fix I did for Jon Nelson's bug. It turned out I - was a bit too quick and broke test case 1101 with that change. The order of - some of the setups is sensitive. I now changed it slightly again to make - sure we do them in this order: - - 1 - parse URL and figure out what protocol is used in the URL - 2 - prepend protocol:// to URL if missing - 3 - parse name+password off URL, which needs to know what protocol is used - (since only some allows for name+password in the URL) - 4 - figure out if a proxy should be used set by an option - 5 - if no proxy option, check proxy environment variables - 6 - run the protocol-specific setup function, which needs to have the proxy - already set - -Daniel Stenberg (15 Dec 2009) -- Jon Nelson found a regression that turned out to be a flaw in how libcurl - detects and uses proxies based on the environment variables. If the proxy - was given as an explicit option it worked, but due to the setup order - mistake proxies would not be used fine for a few protocols when picked up - from '[protocol]_proxy'. Obviously this broke after 7.19.4. I now also added - test case 1106 that verifies this functionality. - - (http://curl.haxx.se/bug/view.cgi?id=2913886) - -Daniel Stenberg (12 Dec 2009) -- IMAP, POP3 and SMTP support and their TLS versions (including IMAPS, POP3S - and SMTPS) are now supported. The current state may not yet be solid, but - the foundation is in place and the test suite has some initial support for - these protocols. Work will now persue to make them nice libcurl citizens - until release. - - The work with supporting these new protocols was sponsored by - networking4all.com - thanks! - -Daniel Stenberg (10 Dec 2009) -- Siegfried Gyuricsko found out that the curl manual said --retry would retry - on FTP errors in the transient 5xx range. Transient FTP errors are in the - 4xx range. The code itself only tried on 5xx errors that occured _at login_. - Now the retry code retries on all FTP transfer failures that ended with a - 4xx response. - - (http://curl.haxx.se/bug/view.cgi?id=2911279) - -- Constantine Sapuntzakis figured out a case which would lead to libcurl - accessing alredy freed memory and thus crash when using HTTPS (with - OpenSSL), multi interface and the CURLOPT_DEBUGFUNCTION and a certain order - of cleaning things up. I fixed it. - - (http://curl.haxx.se/bug/view.cgi?id=2905220) - -Daniel Stenberg (7 Dec 2009) -- Martin Storsjo made libcurl use the Expect: 100-continue header for posts - with unknown size. Previously it was only used for posts with a known size - larger than 1024 bytes. - -Daniel Stenberg (1 Dec 2009) -- If the Expect: 100-continue header has been set by the application through - curl_easy_setopt with CURLOPT_HTTPHEADER, the library should set - data->state.expect100header accordingly - the current code (in 7.19.7 at - least) doesn't handle this properly. Martin Storsjo provided the fix! - -Yang Tse (28 Nov 2009) -- Added Diffie-Hellman parameters to several test harness certificate files in - PEM format. Required by several stunnel versions used by our test harness. - -Daniel Stenberg (28 Nov 2009) -- Markus Koetter provided a polished and updated version of Chad Monroe's TFTP - rework patch that now integrates TFTP properly into libcurl so that it can - be used non-blocking with the multi interface and more. BLKSIZE also works. - - The --tftp-blksize option was added to allow setting the TFTP BLKSIZE from - the command line. - -Daniel Stenberg (26 Nov 2009) -- Extended and fixed the change I did on Dec 11 for the the progress - meter/callback during FTP command/response sequences. It turned out it was - really lame before and now the progress meter SHOULD get called at least - once per second. - -Daniel Stenberg (23 Nov 2009) -- Bjorn Augustsson reported a bug which made curl not report any problems even - though it failed to write a very small download to disk (done in a single - fwrite call). It turned out to be because fwrite() returned success, but - there was insufficient error-checking for the fclose() call which tricked - curl to believe things were fine. - -Yang Tse (23 Nov 2009) -- David Byron modified Makefile.dist vc8 and vc9 targets in order to allow - finer granularity control when generating src and lib makefiles. - -Yang Tse (22 Nov 2009) -- I modified configure to force removal of the curlbuild.h file included in - distribution tarballs for use by non-configure systems. As intended, this - would get overwriten when doing in-tree builds. But VPATH builds would end - having two curlbuild.h files, one in the source tree and another in the - build tree. With the modification I introduced 5 Nov 2009 this could become - an issue when running libcurl's test suite. - -Daniel Stenberg (20 Nov 2009) -- Constantine Sapuntzakis identified a write after close, as the sockets were - closed by libcurl before the SSL lib were shutdown and they may write to its - socket. Detected to at least happen with OpenSSL builds. - -- Jad Chamcham pointed out a bug with connection re-use. If a connection had - CURLOPT_HTTPPROXYTUNNEL enabled over a proxy, a subsequent request using the - same proxy with the tunnel option disabled would still wrongly re-use that - previous connection and the outcome would only be badness. - -Yang Tse (18 Nov 2009) -- I modified the memory tracking system to make it intolerant with zero sized - malloc(), calloc() and realloc() function calls. - -Daniel Stenberg (17 Nov 2009) -- Constantine Sapuntzakis provided another fix for the DNS cache that could - end up with entries that wouldn't time-out: - - 1. Set up a first web server that redirects (307) to a http://server:port - that's down - 2. Have curl connect to the first web server using curl multi - - After the curl_easy_cleanup call, there will be curl dns entries hanging - around with in_use != 0. - - (http://curl.haxx.se/bug/view.cgi?id=2891591) - -- Marc Kleine-Budde fixed: curl saved the LDFLAGS set during configure into - its pkg-config file. So -Wl stuff ended up in the .pc file, which is really - bad, and breaks if there are multiple -Wl in our LDFLAGS (which are in - PTXdist). bug #2893592 (http://curl.haxx.se/bug/view.cgi?id=2893592) - -Kamil Dudka (15 Nov 2009) -- David Byron improved the configure script to use pkg-config to find OpenSSL - (and in particular the list of required libraries) even if a path is given - as argument to --with-ssl - -Yang Tse (15 Nov 2009) -- I removed enable-thread / disable-thread configure option. These were only - placebo options. The library is always built as thread safe as possible on - every system. - -Claes Jakobsson (14 Nov 2009) -- curl-config now accepts '--configure' to see what arguments was - passed to the configure script when building curl. - -Daniel Stenberg (14 Nov 2009) -- Claes Jakobsson restored the configure functionality to detect NSS when - --with-nss is set but not "yes". - - I think we can still improve that to check for pkg-config in that path etc, - but at least this patch brings back the same functionality we had before. - -- Camille Moncelier added support for the file type SSL_FILETYPE_ENGINE for - the client certificate. It also disable the key name test as some engines - can select a private key/cert automatically (When there is only one key - and/or certificate on the hardware device used by the engine) - -Yang Tse (14 Nov 2009) -- Constantine Sapuntzakis provided the fix that ensures that an SSL connection - won't be reused unless protection level for peer and host verification match. - - I refactored how preprocessor symbol _THREAD_SAFE definition is done. - -Kamil Dudka (12 Nov 2009) -- Kevin Baughman provided a fix preventing libcurl-NSS from crash on doubly - closed NSPR descriptor. The issue was hard to find, reported several times - before and always closed unresolved. More info at the RH bug: - https://bugzilla.redhat.com/534176 - -- libcurl-NSS now tries to reconnect with TLS disabled in case it detects - a broken TLS server. However it does not happen if SSL version is selected - manually. The approach was originally taken from PSM. Kaspar Brand helped me - to complete the patch. Original bug reports: - https://bugzilla.redhat.com/525496 - https://bugzilla.redhat.com/527771 - -Yang Tse (12 Nov 2009) -- I modified configure script to make the getaddrinfo function check also - verify if the function is thread safe. - -Yang Tse (11 Nov 2009) -- Marco Maggi reported that compilation failed when configured --with-gssapi - and GNU GSS installed due to a missing mutual exclusion of header files in - the Kerberos 5 code path. He also verified that my patch worked for him. - -Daniel Stenberg (11 Nov 2009) -- Constantine Sapuntzakis posted bug #2891595 - (http://curl.haxx.se/bug/view.cgi?id=2891595) which identified how an entry - in the DNS cache would linger too long if the request that added it was in - use that long. He also provided the patch that now makes libcurl capable of - still doing a request while the DNS hash entry may get timed out. - -- Christian Schmitz noticed that the progress meter/callback was not properly - used during the FTP connection phase (after the actual TCP connect), while - it of course should be. I also made the speed check get called correctly so - that really slow servers will trigger that properly too. - -Kamil Dudka (5 Nov 2009) -- Dropped misleading timeouts in libcurl-NSS and made sure the SSL socket works - in non-blocking mode. - -Yang Tse (5 Nov 2009) -- I removed leading 'curl' path on the 'curlbuild.h' include statement in - curl.h, adjusting auto-makefiles include path, to enhance portability to - OS's without an orthogonal directory tree structure such as OS/400. - -Daniel Stenberg (4 Nov 2009) -- I fixed several problems with the transfer progress meter. It showed the - wrong percentage for small files, most notable for <1000 bytes and could - easily end up showing more than 100% at the end. It also didn't show any - percentage, transfer size or estimated transfer times when transferring - less than 100 bytes. - -Version 7.19.7 (4 November 2009) - -Daniel Stenberg (2 Nov 2009) -- As reported independent by both Stan van de Burgt and Didier Brisebourg, - CURLINFO_SIZE_DOWNLOAD (the -w variable size_download) didn't work when - getting data from ldap! - -Daniel Stenberg (31 Oct 2009) -- Gabriel Kuri reported a problem with CURLINFO_CONTENT_LENGTH_DOWNLOAD if the - download was 0 bytes, as libcurl would then return the size as unknown (-1) - and not 0. I wrote a fix and test case 566 to verify it. - -Daniel Stenberg (30 Oct 2009) -- Liza Alenchery mentioned a problem with re-used SCP connection when a bad - auth is used, as it caused a crash. I failed to repeat the issue, but still - made a change that now forces the TCP connection used for a freed SCP - session to get closed and not be re-used. - -- "Tom" posted a bug report that mentioned how libcurl did wrong when doing a - POST using a read callback, with Digest authentication and - "Transfer-Encoding: chunked" enforced. I would then cause the first request - to be wrongly sent and then basically hang until the server closed the - connection. I fixed the problem and added test case 565 to verify it. - -Daniel Stenberg (25 Oct 2009) -- Dima Barsky made the curl cookie parser accept cookies even with blank or - unparsable expiry dates and then treat them as session cookies - previously - libcurl would reject cookies with a date format it couldn't parse. Research - shows that the major browser treat such cookies as session cookies. I - modified test 8 and 31 to verify this. - -Daniel Stenberg (21 Oct 2009) -- Attempt to use pkg-config for finding out libssh2 installation details - during configure. - -- A patch in bug report #2883177 (http://curl.haxx.se/bug/view.cgi?id=2883177) - by Johan van Selst introduced the --crlfile option to curl, which makes curl - tell libcurl about a file with CRL (certificate revocation list) data to - read. - -Daniel Stenberg (18 Oct 2009) -- Ray Dassen provided a patch in Debian's bug tracker (bug number #551461) - that now makes curl_getdate(3) actually handles RFC 822 formatted dates that - use the "single letter military timezones". - http://www.rfc-ref.org/RFC-TEXTS/822/chapter5.html has the details. - -- Fixed memory leak in the SCP/SFTP code as it never freed the knownhosts - data! - -- John Dennis filed bug report #2873666 - (http://curl.haxx.se/bug/view.cgi?id=2873666) which identified a problem - which made libcurl loop infinitely when given incorrect credentials when - using HTTP GSS negotiate authentication. He also provided a small and simple - patch for it. - -- Kevin Baughman found a double close() problem with libcurl-NSS, as when - libcurl called NSS to close the SSL "session" it also closed the actual - socket. - -Yang Tse (17 Oct 2009) -- Bug report #2866724 indicated - (http://curl.haxx.se/bug/view.cgi?id=2866724) that curl on Windows failed - when writing files whose file names originally contained characters which - are not valid for file names on Windows. Dan Fandrich provided an initial - patch and another revised one to fix this issue. - -Daniel Stenberg (1 Oct 2009) -- Tom Mueller correctly reported in bug report #2870221 - (http://curl.haxx.se/bug/view.cgi?id=2870221) that libcurl returned an - incorrect return code from the internal trynextip() function which caused - him grief. This is a regression that was introduced in 7.19.1 and I find it - strange it hasn't hit us harder, but I won't persue into figuring out - exactly why. - -- Constantine Sapuntzakis: The current implementation will always set - SO_SNDBUF to CURL_WRITE_SIZE even if the SO_SNDBUF starts out larger. The - patch doesn't do a setsockopt if SO_SNDBUF is already greater than - CURL_WRITE_SIZE. This should help folks who have set up their computer with - large send buffers. - -Daniel Stenberg (27 Sep 2009) -- I introduced a maximum limit for received HTTP headers. It is controlled by - the define CURL_MAX_HTTP_HEADER which is even exposed in the public header - file to allow for users to fairly easy rebuild libcurl with a modified - limit. The rationale for a fixed limit is that libcurl is realloc()ing a - buffer to be able to put a full header into it, so that it can call the - header callback with the entire header, but that also risk getting it into - trouble if a server by mistake or willingly sends a header that is more or - less without an end. The limit is set to 100K. - -Daniel Stenberg (26 Sep 2009) -- John P. McCaskey posted a bug report that showed how libcurl did wrong when - saving received cookies with no given path, if the path in the request had a - query part. That is means a question mark (?) and characters on the right - side of that. I wrote test case 1105 and fixed this problem. - -Kamil Dudka (26 Sep 2009) -- Implemented a protocol independent way to specify blocking direction, used by - transfer.c for blocking. It is currently used only by SCP and SFTP protocols. - This enhancement resolves an issue with 100% CPU usage during SFTP upload, - reported by Vourhey. - -Daniel Stenberg (25 Sep 2009) -- Chris Mumford filed bug report #2861587 - (http://curl.haxx.se/bug/view.cgi?id=2861587) identifying that libcurl used - the OpenSSL function X509_load_crl_file() wrongly and failed if it would - load a CRL file with more than one certificate within. This is now fixed. - -Daniel Stenberg (16 Sep 2009) -- Sven Anders reported that we introduced a cert verfication flaw for OpenSSL- - powered libcurl in 7.19.6. If there was a X509v3 Subject Alternative Name - field in the certficate it had to match and so even if non-DNS and non-IP - entry was present it caused the verification to fail. - -Daniel Fandrich (15 Sep 2009) -- Moved the libssh2 checks after the SSL library checks. This helps when - statically linking since libssh2 needs the SSL library link flags to be - set up already to satisfy its dependencies. This wouldn't be necessary if - the libssh2 configure check was changed to use pkg-config since the - --static flag would add the dependencies automatically. - -Yang Tse (14 Sep 2009) -- Revert Joshua Kwan's patch committed 11 Sep 2009. - - Some systems poll function sets POLLHUP in revents without setting - POLLIN, and sets POLLERR without setting POLLIN and POLLOUT. In some - libcurl code execution paths this could trigger busy wait loops with - high CPU usage until a timeout condition aborted the loop. - - The reverted patch addressed the above issue for a very specific case, - when awaiting c-ares to resolve. A libcurl-wide fix for Curl_poll now - superceeds this one. - -Guenter Knauf (11 Sep 2009) -- Joshua Kwan provided a patch to pass POLLERR / POLLHUP back to c-ares. - This fixes a loop problem with high CPU usage. - -Daniel Stenberg (10 Sep 2009) -- Claes Jakobsson fixed a problem with cookie expiry dates at exctly the epoch - start second "Thu Jan 1 00:00:00 GMT 1970" as the date parser then returns 0 - which internally then is treated as a session cookie. That particular date - is now made to get the value of 1. - -Daniel Stenberg (2 Sep 2009) -- Daniel Johnson found a flaw in the code converting sftp-errors to libcurl - errors. - -Daniel Stenberg (1 Sep 2009) -- Peter Sylvester made a debug feature for Curl_resolv() that now will force - libcurl to resolve 'localhost' whatever name you use in the URL *if* you set - the --interface option to (exactly) "LocalHost". This will enable us to - write tests for custom hosts names but still use a local host server. - -- configure now tries to use pkg-config for a number of sub-dependencies even - when cross-compiling. The key to success is then you properly setup - PKG_CONFIG_PATH before invoking configure. - - I also improved how NSS is detected by trying nss-config if pkg-config isn't - present, and as a last resort just use the lib name and force the user to - setup the LIBS/LDFLAGS/CFLAGS etc properly. The previous last resort would - add a range of various libs that would almost never be quite correct. - -Daniel Stenberg (31 Aug 2009) -- When using the multi interface with FTP and you asked for NOBODY, you did no - QUOTE commands and the request used the same path as the connection had - already changed to, it would decide that no commands would be necessary for - the "DO" action and that was not handled properly but libcurl would instead - hang. - -Kamil Dudka (28 Aug 2009) -- Improved error message for not matching certificate subject name in - libcurl-NSS. Originally reported at: - https://bugzilla.redhat.com/show_bug.cgi?id=516056#c9 - -Patrick Monnerat (24 Aug 2009) -- Introduced a SYST-based test to properly set-up name format when dealing - with the OS/400 FTP server. - -- Fixed an ftp_readresp() bug preventing detection of failing control socket - and causing FTP client to loop forever. - -Daniel Stenberg (24 Aug 2009) -- Marc de Bruin pointed out that configure --with-gnutls=PATH didn't work - properly and provided a fix. http://curl.haxx.se/bug/view.cgi?id=2843008 - -- Eric Wong introduced support for the new option -T. (dot) that makes curl - read stdin in a non-blocking fashion. This also brings back -T- (minus) to - the previous blocking behavior since it could break stuff for people at - times. - -Michal Marek (21 Aug 2009) -- With CURLOPT_PROXY_TRANSFER_MODE, avoid sending invalid URLs like - ftp://example.com;type=i if the user specified ftp://example.com without the - slash. - -Daniel Stenberg (21 Aug 2009) -- Andre Guibert de Bruet pointed out a missing return code check for a - strdup() that could lead to segfault if it returned NULL. I extended his - suggest patch to now have Curl_retry_request() return a regular return code - and better check that. - -- Lots of good work by Krister Johansen, mostly related to pipelining: - - Fix SIGSEGV on free'd easy_conn when pipe unexpectedly breaks - Fix data corruption issue with re-connected transfers - Fix use after free if we're completed but easy_conn not NULL - -Kamil Dudka (13 Aug 2009) -- Changed NSS code to not ignore the value of ssl.verifyhost and produce more - verbose error messages. Originally reported at: - https://bugzilla.redhat.com/show_bug.cgi?id=516056 - -Daniel Stenberg (12 Aug 2009) -- Karl Moerder fixed the Makefile.vc* makefiles to include the new file - nonblock.c so that they work fine again - -- I expanded test 517 with a bunch of more dates that originate from the - Chrome browser test suite. It turns out most of them get parsed the same - way. - -Version 7.19.6 (12 August 2009) - -Daniel Stenberg (12 Aug 2009) -- Carsten Lange reported a bug and provided a patch for TFTP upload and the - sending of the TSIZE option. I don't like fixing bugs just hours before - a release, but since it was broken and the patch fixes this for him I decided - to get it in anyway. - -Daniel Stenberg (11 Aug 2009) -- Peter Sylvester made the HTTPS test server use specific certificates for - each test, so that the test suite can now be used to actually test the - verification of cert names etc. This made an error show up in the OpenSSL- - specific code where it would attempt to match the CN field even if a - subjectAltName exists that doesn't match. This is now fixed and verified - in test 311. - -- Benbuck Nason posted the bug report #2835196 - (http://curl.haxx.se/bug/view.cgi?id=2835196), fixing a few compiler - warnings when mixing ints and bools. - -Daniel Fandrich (10 Aug 2009) -- Fixed a memory leak in the FTP code and an off-by-one heap buffer overflow. - -Daniel Fandrich (9 Aug 2009) -- Fixed some memory leaks in the command-line tool that caused most of the - torture tests to fail. - -Daniel Stenberg (2 Aug 2009) -- Curt Bogmine reported a problem with SNI enabled on a particular server. We - should introduce an option to disable SNI, but as we're in feature freeze - now I've addressed the obvious bug here (pointed out by Peter Sylvester): we - shouldn't try to enable SNI when SSLv2 or SSLv3 is explicitly selected. - Code for OpenSSL and GnuTLS was fixed. NSS doesn't seem to have a particular - option for SNI, or are we simply not using it? - -Daniel Stenberg (1 Aug 2009) -- Scott Cantor posted the bug report #2829955 - (http://curl.haxx.se/bug/view.cgi?id=2829955) mentioning the recent SSL cert - verification flaw found and exploited by Moxie Marlinspike. The presentation - he did at Black Hat is available here: - https://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Marlinspike - - Apparently at least one CA allowed a subjectAltName or CN that contain a - zero byte, and thus clients that assumed they would never have zero bytes - were exploited to OK a certificate that didn't actually match the site. Like - if the name in the cert was "example.com\0theatualsite.com", libcurl would - happily verify that cert for example.com. - - libcurl now better uses the length of the extracted name, not using the zero - termination for getting the string length. - - This fixing only made and needed in OpenSSL interfacing code. - -- Tanguy Fautre pointed out that OpenSSL's function RAND_screen() (present - only in some OpenSSL installs - like on Windows) isn't thread-safe and we - agreed that moving it to the global_init() function is a decent way to deal - with this situation. - -- Alexander Beedie provided the patch for a noproxy problem: If I have set - CURLOPT_NOPROXY to "*", or to a host that should not use a proxy, I actually - could still end up using a proxy if a proxy environment variable was set. - -Daniel Stenberg (27 Jul 2009) -- All the quote options (CURLOPT_QUOTE, CURLOPT_POSTQUOTE and - CURLOPT_PREQUOTE) now accept a preceeding asterisk before the command to - send when using FTP, as a sign that libcurl shall simply ignore the response - from the server instead of treating it as an error. Not treating a 400+ FTP - response code as an error means that failed commands will not abort the - chain of commands, nor will they cause the connection to get disconnected. - -Daniel Stenberg (26 Jul 2009) -- Johan van Selst posted bug report #2825989 - (http://curl.haxx.se/bug/view.cgi?id=2825989) pointing out that - OpenSSL-powered libcurl didn't support the SHA-2 digest algorithm, and - provided the solution too: to use OpenSSL_add_all_algorithms() in addition - to the older SSLeay_* alternative. OpenSSL_add_all_algorithms was added in - OpenSSL 0.9.5 - -Daniel Stenberg (23 Jul 2009) -- Added CURLOPT_SSH_KNOWNHOSTS, CURLOPT_SSH_KEYFUNCTION, CURLOPT_SSH_KEYDATA. - They introduce known_host support for SSH keys to libcurl. See docs for - details. Note that this feature depends on a new enough libssh2 version, to - be supported in libssh2 1.2 and later (or current git repo at this time). - -Michal Marek (22 Jul 2009) -- David Binderman found a memory and fd leak in lib/gtls.c:load_file() - (https://bugzilla.novell.com/523919). When looking at the code, I found that - also the ptr pointer can leak. - -Kamil Dudka (20 Jul 2009) -- Claes Jakobsson improved the support for client certificates handling in - NSS-powered libcurl. Now the client certificates can be selected - automatically by a NSS built-in hook. Additionally pre-login to all PKCS11 - slots is no more performed. It used to cause problems with HW tokens. - -- Fixed reference counting for NSS client certificates. Now the PEM reader - module should be always properly unloaded on Curl_nss_cleanup(). If the - unload fails though, libcurl will try to reuse the already loaded instance. - -Daniel Fandrich (15 Jul 2009) -- Added nonblock.c to the non-automake makefiles (note that the dependencies - in the Watcom makefiles aren't quite correct). - -Michal Marek (15 Jul 2009) -- Changed the description of CURLINFO_OS_ERRNO to make it clear that the - errno is not reset on success. - -Guenter Knauf (14 Jul 2009) -- renamed generated config.h to curl_config.h to avoid any future clashes - with config.h from other projects. - -Daniel Stenberg (9 Jul 2009) -- Eric Wong introduced curlx_nonblock() that the curl tool now (re-)uses for - setting a file descriptor non-blocking. Used by the functionality Eric - himself brough on June 15th. - -Daniel Stenberg (8 Jul 2009) -- Constantine Sapuntzakis posted bug report #2813123 - (http://curl.haxx.se/bug/view.cgi?id=2813123) and an a patch that fixes the - problem: - - Url A is accessed using auth. Url A redirects to Url B (on a different - server0. Url B reuses a persistent connection. Url B has auth, even though - it's on a different server. - - Note: if Url B does not reuse a persistent connection, auth is not sent. - - reason: - - data->state.first_host is not initialized becuase Curl_http_connect is not - called when a connection is reused. - - Solution: - - move initialization of data->state.first_host to Curl_http. No code before - Curl_http uses data->state.first_host anyway. - -Guenter Knauf (4 Jul 2009) -- Markus Koetter provided a patch to avoid getnameinfo() usage which broke a - couple of both IPv4 and IPv6 autobuilds. - -Daniel Stenberg (29 Jun 2009) -- Markus Koetter made CURLOPT_FTPPORT (and curl's -P/--ftpport) support a port - range if given colon-separated after the host name/address part. Like - "192.168.0.1:2000-10000" - -- Modified the separators used for CURLOPT_CERTINFO in multi-part outputs. I - don't know how they got wrong in the first place, but using this output - format makes it possible to quite easily separate the string into an array - of multiple items. - -Daniel Fandrich (16 June 2009) -- Added a few more compiler warning options for gcc. - -Daniel Stenberg (16 Jun 2009) -- Reuven Wachtfogel made curl -o - properly produce a binary output on windows - (no newline translations). Use -B/--use-ascii if you rather get the ascii - approach. - -Michal Marek (16 Jun 2009) -- When doing non-anonymous ftp via http proxies and the password is not - provided in the url, add it there (squid needs this). - -Daniel Stenberg (15 Jun 2009) -- Eric Wong's patch: - - This allows curl(1) to be used as a client-side tunnel for arbitrary stream - protocols by abusing chunked transfer encoding in both the HTTP request and - HTTP response. This requires server support for sending a response while a - request is still being read, of course. - - If attempting to read from stdin returns EAGAIN, then we pause our sender. - This leaves curl to attempt to read from the socket while reading from stdin - (and thus sending) is paused. - - This change was needed to allow successfully tunneling the git protocol over - HTTP (--no-buffer is needed, as well). - -Patrick Monnerat (15 Jun 2009) -- Replaced use of standard C library rand()/srand() by our own pseudo-random - number generator. - -Yang Tse (11 Jun 2009) -- I adapted testcurl script to allow building test harness programs when - cross-compiling for a *-*-mingw* host. - -Daniel Stenberg (10 Jun 2009) -- Fabian Keil ran clang on the (lib)curl code, found a bunch of warnings and - contributed a range of patches to fix them. - -Yang Tse (10 Jun 2009) -- I introduced configure script option --enable-curldebug which now allows - the decoupled enabling or disabling of the curl debug memory tracking - feature from the --enable-debug option which no longer controls this. - - curl --version will list 'Debug' feature for debug enabled builds, and - will list 'TrackMemory' feature for curl debug memory tracking capable - builds. These features are independent and can be controlled when running - the configure script. When --enable-debug is given both features will be - enabled, unless some restriction prevents memory tracking from being used. - - Internally, definition of preprocessor symbol DEBUGBUILD restricts code - which is only compiled for debug enabled builds. And symbol CURLDEBUG is - used to differentiate code which is _only_ used for memory tracking. - -Yang Tse (9 Jun 2009) -- Daniel Steinberg pointed out that Curl_FormInit() in formdata.c was not - initializing the fread callback pointer and this triggered a compiler - warning, also provided a friendly suggestion on how to fix it. - -Daniel Stenberg (8 Jun 2009) -- Claes Jakobsson provided a patch for libcurl-NSS that fixed a bad refcount - issue with client certs that caused issues like segfaults. - http://curl.haxx.se/mail/lib-2009-05/0316.html - -- Triggered by bug report #2798852 and the patch in there, I fixed configure - to detect gnutls build options with pkg-config only and not libgnutls-config - anymore since GnuTLS has stopped distributing that tool. If an explicit path - is given to configure, we will instead guess on how to link and use that - lib. I did not use the patch from the bug report. - -Yang Tse (8 Jun 2009) -- Igor Novoseltsev adjusted Makefile.vxworks to get sources and headers - included from Makefile.inc, and provided docs\INSTALL VxWorks section. - -- I removed buildconf.bat from release and daily snapshot archives. This - file is only for CVS tree checkout builds. - -Daniel Stenberg (8 Jun 2009) -- Eric Wong fixed --no-buffer to actually switch off output buffering. Been - broken since 7.19.0 - -Bill Hoffman (6 Jun 2009) -- Added some cmake docs and fixed socklen_t in the build. - -Yang Tse (5 Jun 2009) -- John E. Malmberg provided VMS specific patch: "This fixes an existing bug - in urlglob.c where it was not converting the Curl Unix exit code to a VMS - DCL compatible exit code. This fix required the enhancement described next. - This also adds an enhancement to main.c so that when curl is run under a - Unix shell like Bash on VMS, it will return the standard Unix exit codes - and messages." And another patch for docs/examples. - - I introduced os-specific.c and os-specific.h for use in curl tool code - and adjusted John E. Malmberg's patch placement to use these new files - as an effort to prevent main.c from growing ad infinitum. Code already - existing in main.c which is OS specific should be moved into these files. - -Daniel Stenberg (4 June 2009) -- Setting the Content-Length: header from your app when you do a POST or PUT - is almost always a VERY BAD IDEA. Yet there are still apps out there doing - this, and now recently it triggered a bug/side-effect in libcurl as when - libcurl sends a POST or PUT with NTLM, it sends an empty post first when it - knows it will just get a 401/407 back. If the app then replaced the - Content-Length header, it caused the server to wait for input that libcurl - wouldn't send. Aaron Oneal reported this problem in bug report #2799008 - (http://curl.haxx.se/bug/view.cgi?id=2799008) and helped us verify the fix. - -Yang Tse (4 Jun 2009) -- Igor Novoseltsev provided patches and information, that after some - adjustments to better fit curl's way of doing things, have resulted - in the posibility of building libcurl for VxWorks. - -Daniel Fandrich (2 June 2009) -- Checked in a Google Android make file. To use it, you must first - create a config.h file by running configure in the Android environment, - which doesn't seem to be easy to do. If no easy way can be found, a - static config-android.h may need to be created and checked in to the - libcurl source tree. - -Daniel Stenberg (1 June 2009) -- Claes Jakobsson fixed the configure script to better find and use NSS - without pkg-config. - -Yang Tse (1 Jun 2009) -- John E. Malmberg provided a VMS specific clean-up for curl.h, and pointed - out that the configure script was failing to detect the timeval struct on - VMS when building with _XOPEN_SOURCE_EXTENDED undefined due to definition - taking place in socket.h instead of time.h. I have adjusted configure - script to also include this header when checking struct timeval. - -Daniel Stenberg (27 May 2009) -- Frank McGeough provided a small OpenSSL #include fix to make libcurl compile - fine with Nokia 5th edition 1.0 SDK for Symbian. - -- Andre Guibert de Bruet found a call to a OpenSSL function that didn't check - for a failure properly. - -- Mike Crowe pointed out that setting CURLOPT_USERPWD to NULL used to clear - the auth credentials back in 7.19.0 and earlier while now you have to set "" - to get the same effect. His patch brings back the ability to use NULL. - -- Claes Jakobsson fixed libcurl-NSS to build fine even without the - PK11_CreateGenericObject() function. - -Daniel Stenberg (25 May 2009) -- bug report #2796358 (http://curl.haxx.se/bug/view.cgi?id=2796358) pointed - out that the cookie parser would leak memory when it parses cookies that are - received with domain, path etc set multiple times in the same header. While - such a cookie is questionable, they occur in the wild and libcurl no longer - leaks memory for them. I added such a header to test case 8. - -Daniel Fandrich (22 May 2009) -- Removed some obsolete digest code that caused a valgrind error in test 551. - -Daniel Fandrich (20 May 2009) -- Added "non-existing host" test keywords to make it easy to skip those - tests on machines that have broken DNS configurations (such as - those configured to use OpenDNS). - -Daniel Stenberg (19 May 2009) -- Kamil Dudka brought the patch from the Redhat bug entry - https://bugzilla.redhat.com/show_bug.cgi?id=427966 which was libcurl closing - a bad file descriptor when closing down the FTP data connection. Caolan - McNamara seems to be the original author of it. - -Version 7.19.5 (18 May 2009) - -Daniel Stenberg (17 May 2009) -- James Bursa posted a patch to the mailing list that fixed a problem with - no_proxy which made it not skip the proxy if the URL entered contained a - user name. I added test case 1101 to verify. - -Daniel Stenberg (11 May 2009) -- Balint Szilakszi reported a memory leak when libcurl did gzip decompression - of streams that had some parts (legitimately) missing. We now provide and use - a proper cleanup function for the content encoding submodule. - http://curl.haxx.se/mail/lib-2009-05/0092.html - -- Kamil Dudka provided a fix for libcurl-NSS reported by Michael Cronenworth - at https://bugzilla.redhat.com/show_bug.cgi?id=453612#c12 - - If an incorrect password is given while loading a private key, libcurl ends - up in an infinite loop consuming memory. The bug is critical. - -- I fixed the problem with doing NTLM, POST and then following a 302 redirect, - as reported by Ebenezer Ikonne (on curl-users) and Laurent Rabret (on - curl-library). The transfer was mistakenly marked to get more data to send - but since it didn't actually have that, it just hung there... - -Daniel Stenberg (10 May 2009) -- Andre Guibert de Bruet correctly pointed out an over-alloc with one wasted - byte in the digest code. - -Yang Tse (9 May 2009) -- Removed DOS and TPF package's subdirectory Makefile.am, it was only used - to include some files in the distribution tarball serving no other purpose. - Files from the DOS and TPF subdirectories are now included in the EXTRA_DIST - of the Makefile in the parent subdirectory. - -Yang Tse (8 May 2009) -- Changed host name literal in several tests to one under the haxx.se domain. - -- Renamed vc6 workspace and project files to avoid filename clash when used - for conversion to later VS versions. - -Daniel Stenberg (8 May 2009) -- Constantine Sapuntzakis fixed bug report #2784055 - (http://curl.haxx.se/bug/view.cgi?id=2784055) identifying a problem to - connect to SOCKS proxies when using the multi interface. It turned out to - almost not work at all previously. We need to wait for the TCP connect to - be properly verified before doing the SOCKS magic. - - There's still a flaw in the FTP code for this. - -Daniel Stenberg (7 May 2009) -- Made the SO_SNDBUF setting for the data connection socket for ftp uploads as - well. See change 28 Apr 2009. - -Yang Tse (7 May 2009) -- Fixed an issue affecting FTP transfers, introduced with the transfer.c - patch committed May 4. - -Daniel Stenberg (7 May 2009) -- Man page *roff problems fixed thanks to input from Colin Watson. Problems - reported in the Debian package. - -- Vijay G filed bug report #2723236 - (http://curl.haxx.se/bug/view.cgi?id=2723236) identifying a problem with - libcurl's TFTP code and its lack of dealing with the OACK packet. - -Yang Tse (5 May 2009) -- Fixed the --ftp-port address of test #251 to the CLIENTIP address, and - reverted the change affecting test suite harness committed 4 May. - -Daniel Stenberg (5 May 2009) -- Inspired by Michael Smith's session id fix for OpenSSL, I did the - corresponding fix in the GnuTLS code: make sure to store the new session id - in case the previous re-used one is rejected. - -Daniel Stenberg (4 May 2009) -- Michael Smith posted bug report #2786255 - (http://curl.haxx.se/bug/view.cgi?id=2786255) with a patch, identifying how - libcurl did not deal with SSL session ids properly if the server rejected a - re-use of one. Starting now, it will forget the rejected one and remember - the new. This change was for OpenSSL only, it is likely that other SSL lib - code needs similar fixes. - -Yang Tse (4 May 2009) -- Applied David McCreedy's "transfer.c fixes for CURL_DO_LINEEND_CONV and - non-ASCII platform HTTP requests" patch addressing two HTTP PUT problems: - 1) On non-ASCII platforms not all of the protocol portions of the PUT are - being translated to ASCII. 2) On all platforms the line endings of part of - the protocol portions are mangled from CRLF to CRCRLF if data->set.crlf or - data->set.prefer_ascii are set (depending on CURL_DO_LINEEND_CONV). - -- Applied David McCreedy's patch to fix test suite harness to allow test FTP - server and client on different machines, providing FTP client address when - running the FTP test server. - -Daniel Fandrich (3 May 2009) -- Added and disabled test case 563 which shows KNOWN_BUGS #59. The bug - report failed to mention that a proxy must be used to reproduce it. - -Yang Tse (2 May 2009) -- Use a build-time configured curl_socklen_t data type instead of socklen_t. - -Yang Tse (1 May 2009) -- Applied David McCreedy's patches "TPF-platform specific changes to various - files" and "http.c fix to Curl_proxyCONNECT for non-ASCII platforms", the - former with minor edits. - -Daniel Stenberg (30 Apr 2009) -- I was going to fix issue #59 in KNOWN_BUGS - - If the CURLOPT_PORT option is used on an FTP URL like - "ftp://example.com/file;type=A" the ";type=A" is stripped off. - - I added test case 562 to verify, only to find out that I couldn't repeat - this bug so I hereby consider it not a bug anymore! - -Daniel Stenberg (29 Apr 2009) -- Based on bug report #2723219 (http://curl.haxx.se/bug/view.cgi?id=2723219) - I've now made TFTP "connections" not being kept for re-use within libcurl. - TFTP is UDP-based so the benefit was really low (if even existing) to begin - with so instead of tracking down to fix this problem we instead removed the - re-use. I also enabled test case 1099 that I wrote a few days ago to verify - that this change fixes the reported problem. - -Daniel Stenberg (28 Apr 2009) -- Constantine Sapuntzakis filed bug report #2783090 - (http://curl.haxx.se/bug/view.cgi?id=2783090) pointing out that on windows - we need to grow the SO_SNDBUF buffer somewhat to get really good upload - speeds. http://support.microsoft.com/kb/823764 has the details. Friends - confirmed that simply adding 32 to CURL_MAX_WRITE_SIZE is enough. - -- Bug report #2709004 (http://curl.haxx.se/bug/view.cgi?id=2709004) by Tim - Chen pointed out how curl couldn't upload with resume when reading from a - pipe. - - This ended up with the introduction of a new return code for the - CURLOPT_SEEKFUNCTION callback that basically says that the seek failed but - that libcurl may try to resolve the situation anyway. In our case this means - libcurl will attempt to instead read that much data from the stream instead - of seeking and that way curl can now upload with resume when data is read - from a stream! - -Daniel Stenberg (26 Apr 2009) -- Bug report #2779733 (http://curl.haxx.se/bug/view.cgi?id=2779733) by Sven - Wegener pointed out that CURLINFO_APPCONNECT_TIME didn't work with the multi - interface and provided a patch that fixed the problem! - -Daniel Stenberg (24 Apr 2009) -- Kamil Dudka fixed another NSS-related leak when client certs were used. - -- Bug report #2779245 (http://curl.haxx.se/bug/view.cgi?id=2779245) by Rainer - Koenig pointed out that the man page didn't tell that the *_proxy - environment variables can be specified lower case or UPPER CASE and the - lower case takes precedence, - -Daniel Fandrich (21 Apr 2009) -- Added new libcurl source files to Amiga, RiscOS and VC6 build files. - -Yang Tse (21 Apr 2009) -- Moved potential inclusion of system's malloc.h and memory.h header files to - setup_once.h. Inclusion of each header file is based on the definition of - NEED_MALLOC_H and NEED_MEMORY_H respectively. - - Renamed libcurl's memory.h to curl_memory.h - -Daniel Stenberg (20 Apr 2009) -- Leanic Lefever reported a crash and did some detailed research on why and - how it occurs (http://curl.haxx.se/mail/lib-2009-04/0289.html). The - conclusion was that if an error is detected and Curl_done() is called for - the connection, ftp_done() could at times return another error code that - then would take precedence and that new code confused existing logic that - works for the first error code (CURLE_SEND_ERROR) only. - -- Gisle Vanem noticed that --libtool would produce bogus strings at times for - OBJECTPOINT options. Now we've introduced a new function - my_setopt_str - - within the app for setting plain string options to avoid the risk of this - mistake happening. - -Daniel Stenberg (17 Apr 2009) -- Pramod Sharma reported and tracked down a bug when doing FTP over a HTTP - proxy. libcurl would then wrongly close the connection after each - request. In his case it had the weird side-effect that it killed NTLM auth - for the proxy causing an inifinite loop! - - I added test case 1098 to verify this fix. The test case does however not - properly verify that the transfers are done persistently - as I couldn't - think of a clever way to achieve it right now - but you need to read the - stderr output after a test run to see that it truly did the right thing. - -Daniel Stenberg (13 Apr 2009) -- bug report #2727981 (http://curl.haxx.se/bug/view.cgi?id=2727981) by Martin - Storsjö pointed out how setting CURLOPT_NOBODY to 0 could be downright - confusing as it set the method to either GET or HEAD. The example he showed - looked like: - - curl_easy_setopt(curl, CURLOPT_PUT, 1); - curl_easy_setopt(curl, CURLOPT_NOBODY, 0); - - The new way doesn't alter the method until the request is about to start. If - CURLOPT_NOBODY is then 1 the HTTP request will be HEAD. If CURLOPT_NOBODY is - 0 and the request happens to have been set to HEAD, it will then instead be - set to GET. I believe this will be less surprising to users, and hopefully - not hit any existing users badly. - -- Toshio Kuratomi reported a memory leak problem with libcurl+NSS that turned - out to be leaking cacerts. Kamil Dudka helped me complete the fix. The issue - is found in Redhat's bug tracker: - https://bugzilla.redhat.com/show_bug.cgi?id=453612 - - There are still memory leaks present, but they seem to have other reasons. - -Daniel Fandrich (11 Apr 2009) -- Added new libcurl source files to Symbian OS build files. -- Improved Symbian support for SSL. - -Yang Tse (10 Apr 2009) -- Daniel Johnson improved the MacOSX-Framework shell script to now perform all - the steps required to build a Mac OS X four way fat ppc/i386/ppc64/x86_64 - libcurl.framework. Four way fat framework requires OS X 10.5 SDK or later. - -Yang Tse (8 Apr 2009) -- Removed Sun compilers preprocessor block from curlbuild.h.dist, this also - removes it from the curlbuild.h file originally distributed by the cURL - project as this file is intended for systems not capable of running the - configure script. For those who have been building curl out of the source - code curl distribution tarball provided by curl.haxx.se the change implies - nothing. Previous change in this area committed 2 Apr becomes irrelevant. - -Daniel Stenberg (6 Apr 2009) -- I clarified in the docs that CURLOPT_SEEKFUNCTION should return 0 on success - and 1 on fatal errors. Previously it only mentioned non-zero on fatal - errors. This is a slight change in meaning, but it follows what we've done - elsewhere before and it opens up for LOTS of more useful return codes - whenever we can think of them... - -Yang Tse (2 Apr 2009) -- Fix curl_off_t definition for builds done using Sun compilers and a - non-configured libcurl. In this case curl_off_t data type was gated - to the off_t data type which depends on the _FILE_OFFSET_BITS. This - configuration is exactly the unwanted configuration for our curl_off_t - data type which must not depend on such setting. This breaks ABI for - libcurl libraries built with Sun compilers which were built without - having run the configure script with _FILE_OFFSET_BITS different than - 64 and using the ILP32 data model. - -Daniel Stenberg (1 Apr 2009) -- Andre Guibert de Bruet fixed a NULL pointer use in an infof() call if a - strdup() call failed. - -Daniel Fandrich (31 Mar 2009) -- Properly return an error code in curl_easy_recv (reported by Jim Freeman). - -Daniel Stenberg (18 Mar 2009) -- Kamil Dudka brought a patch that enables 6 additional crypto algorithms when - NSS is used. These ciphers were added in NSS 3.4 and require to be enabled - explicitly. - -Daniel Stenberg (13 Mar 2009) -- Use libssh2_version() to present the libssh2 version in case the libssh2 - library is found to support it. - -Yang Tse (12 Mar 2009) -- Added missing Curl_read() return code checking in TELNET transfers. - -- Pierre Brico found and fixed TELNET transfers not being aborted upon - a write callback failure. - -Daniel Stenberg (11 Mar 2009) -- Kamil Dudka made the curl tool properly call curl_global_init() before any - other libcurl function. - -Yang Tse (11 Mar 2009) -- Added missing TELNET timeout support for Windows builds. This issue was - reported by Pierre Brico. - -Daniel Stenberg (9 Mar 2009) -- Frank Hempel found out a bug and provided the fix: - - curl_easy_duphandle did not necessarily duplicate the CURLOPT_COOKIEFILE - option. It only enabled the cookie engine in the destination handle if - data->cookies is not NULL (where data is the source handle). In case of a - newly initialized handle which just had the cookie support enabled by a - curl_easy_setopt(handle, CURL_COOKIEFILE, "")-call, handle->cookies was - still NULL because the setopt-call only appends the value to - data->change.cookielist, hence duplicating this handle would not have the - cookie engine switched on. - - We also concluded that the slist-functionality would be suitable for being - put in its own module rather than simply hanging out in lib/sendf.c so I - created lib/slist.[ch] for them. - -- Andreas Farber made the 'buildconf' script check for the presence of m4 - scripts to make it detect a bad checkout earlier. People with older - checkouts who don't do cvs update with the -d option won't get the new dirs - and then will get funny outputs that can be a bit hard to understand and - fix. - -Daniel Stenberg (8 Mar 2009) -- Andre Guibert de Bruet found and fixed a code segment in ssluse.c where the - allocation of the memory BIO was not being properly checked. - -- Andre Guibert de Bruet fixed the gnutls-using code: There are a few places - in the gnutls code where we were checking for negative values for errors, - when the man pages state that GNUTLS_E_SUCCESS is returned on success and - other values indicate error conditions. - -- Bill Egert pointed out (http://curl.haxx.se/bug/view.cgi?id=2671602) that - curl didn't use sprintf() in a way that is documented to work in POSIX but - since we use our own printf() code (from libcurl) that shouldn't be a - problem. Nonetheless I modified the code to not rely on such particular - features and to not cause further raised eyebrowse with no good reason. - -Daniel Fandrich (5 Mar 2009) -- Expanded the security section of the libcurl-tutorial man page to cover - more issues for authors to consider when writing robust libcurl-using - applications. - -Yang Tse (5 Mar 2009) -- Fixed NTLM authentication memory leak on SSPI enabled Windows builds. This - issue was noticed by Chris Deidun. - -Daniel Fandrich (4 Mar 2009) -- Fixed a problem with m4 quoting in the OpenSSL configure check reported - by Daniel Johnson. - -Daniel Stenberg (3 Mar 2009) -- David James brought a patch that make libcurl close (all) dead connections - whenever you attempt to open a new connection. - - 1. After cleaning up a dead connection, "continue" instead of - returning FALSE. This ensures that we clean up all dead connections, - rather than just cleaning up the first dead connection. - 2. Move up the cleanup for dead connections so that it occurs for - all connections, rather than just the connections which have the same - preferences as our current new connection. - -Version 7.19.4 (3 March 2009) - -Daniel Stenberg (3 Mar 2009) -- David Kierznowski notified us about a security flaw - (http://curl.haxx.se/docs/adv_20090303.html also known as CVE-2009-0037) in - which previous libcurl versions (by design) can be tricked to access an - arbitrary local/different file instead of a remote one when - CURLOPT_FOLLOWLOCATION is enabled. This flaw is now fixed in this release - together this the addition of two new setopt options for controlling this - new behavior: - - o CURLOPT_REDIR_PROTOCOLS controls what protocols libcurl is allowed to - follow to when CURLOPT_FOLLOWLOCATION is enabled. By default, this option - excludes the FILE and SCP protocols and thus you nee to explicitly allow - them in your app if you really want that behavior. - - o CURLOPT_PROTOCOLS controls what protocol(s) libcurl is allowed to fetch - using the primary URL option. This is useful if you want to allow a user or - other outsiders control what URL to pass to libcurl and yet not allow all - protocols libcurl may have been built to support. - -Daniel Stenberg (27 Feb 2009) -- Senthil Raja Velu reported a problem when CURLOPT_INTERFACE and - CURLOPT_LOCALPORT were used together (the local port bind failed), and - Markus Koetter provided the fix! - -Daniel Stenberg (25 Feb 2009) -- As Daniel Fandrich figured out, we must do the GnuTLS initing in the - curl_global_init() function to properly maintain the performing functions - thread-safe. We've previously (28 April 2007) moved the init to a later time - just to avoid it to fail very early when libgcrypt dislikes the situation, - but that move was bad and the fix should rather be in libgcrypt or - elsewhere. - -Daniel Stenberg (24 Feb 2009) -- Brian J. Murrell found out that Negotiate proxy authentication didn't work. - It happened because the code used the struct for server-based auth all the - time for both proxy and server auth which of course was wrong. - -Daniel Stenberg (23 Feb 2009) -- After a bug reported by James Cheng I've made curl_easy_getinfo() for - CURLINFO_CONTENT_LENGTH_DOWNLOAD and CURLINFO_CONTENT_LENGTH_UPLOAD return - -1 if the sizes aren't know. Previously these returned 0, make it impossible - to detect the difference between actually zero and unknown. - -Yang Tse (23 Feb 2009) -- Daniel Johnson provided a shell script that will perform all the steps needed - to build a Mac OS X fat ppc/i386 or ppc64/x86_64 libcurl.framework - -Daniel Stenberg (23 Feb 2009) -- I renamed everything in the windows builds files that used the name 'curllib' - to the proper 'libcurl' as clearly this caused confusion. - -Yang Tse (20 Feb 2009) -- Do not halt compilation when using VS2008 to build a Windows 2000 target. - -Daniel Stenberg (20 Feb 2009) -- Linus Nielsen Feltzing reported and helped me repeat and fix a problem with - FTP with the multi interface: when a transfer fails, like when aborted by a - write callback, the control connection was wrongly closed and thus not - re-used properly. - - This change is also an attempt to cleanup the code somewhat in this area, as - now the FTP code attempts to keep (better) track on pending responses - necessary to get read in ftp_done(). - -Daniel Stenberg (19 Feb 2009) -- Patrik Thunstrom reported a problem and helped me repeat it. It turned out - libcurl did a superfluous 1000ms wait when doing SFTP downloads! - - We read data with libssh2 while doing the "DO" operation for SFTP and then - when we were about to start getting data for the actual file part, the - "TRANSFER" part, we waited for socket action (in 1000ms) before doing a - libssh2-read. But in this case libssh2 had already read and buffered the - data so we ended up always just waiting 1000ms before we get working on the - data! - -Patrick Monnerat (18 Feb 2009) -- FTP downloads (i.e.: RETR) ending with code 550 now return error - CURLE_REMOTE_FILE_NOT_FOUND instead of CURLE_FTP_COULDNT_RETR_FILE. - -Daniel Stenberg (17 Feb 2009) -- Kamil Dudka made NSS-powered builds compile and run again! - -- A second follow-up change by Andre Guibert de Bruet to fix a related memory - leak like that fixed on the 14th. When zlib returns failure, we need to - cleanup properly before returning error. - -- CURLOPT_FTP_CREATE_MISSING_DIRS can now be set to 2 in addition to 1 for - plain FTP connections, and it will then allow MKD to fail once and retry the - CWD afterwards. This is especially useful if you're doing many simultanoes - connections against the same server and they all have this option enabled, - as then CWD may first fail but then another connection does MKD before this - connection and thus MKD fails but trying CWD works! The numbers can - (should?) now be set with the convenience enums now called - CURLFTP_CREATE_DIR and CURLFTP_CREATE_DIR_RETRY. - - Tests has proven that if you're making an application that uploads a set of - files to an ftp server, you will get a noticable gain in speed if you're - using multiple connections and this option will be then be very useful. - -Daniel Stenberg (14 Feb 2009) -- Andre Guibert de Bruet found and fixed a memory leak in the content encoding - code, which could happen on libz errors. - -Daniel Fandrich (12 Feb 2009) -- Added support for Digest and NTLM authentication using GnuTLS. - -Daniel Stenberg (11 Feb 2009) -- CURLINFO_CONDITION_UNMET was added to allow an application to get to know if - the condition in the previous request was unmet. This is typically a time - condition set with CURLOPT_TIMECONDITION and was previously not possible to - reliably figure out. From bug report #2565128 - (http://curl.haxx.se/bug/view.cgi?id=2565128) filed by Jocelyn Jaubert. - -Daniel Fandrich (4 Feb 2009) -- Don't add the standard /usr/lib or /usr/include paths to LDFLAGS and CPPFLAGS - (respectively) when --with-ssl=/usr is used (patch based on FreeBSD). - -- Added an explicit buffer limit check in msdosify() (patch based on FreeBSD). - This couldn't ever overflow in curl, but might if the code were used - elsewhere or under different conditions. - -Daniel Stenberg (3 Feb 2009) -- Hidemoto Nakada provided a small fix that makes it possible to get the - CURLINFO_CONTENT_LENGTH_DOWNLOAD size from file:// "transfers" with - CURLOPT_NOBODY set true. - -Daniel Stenberg (2 Feb 2009) -- Patrick Scott found a rather large memory leak when using the multi - interface and setting CURLMOPT_MAXCONNECTS to something less than the number - of handles you add to the multi handle. All the connections that didn't fit - in the cache would not be properly disconnected nor freed! - -- Craig A West brought us: libcurl now defaults to do CONNECT with HTTP - version 1.1 instead of 1.0 like before. This change also introduces the new - proxy type for libcurl called 'CURLPROXY_HTTP_1_0' that then allows apps to - switch (back) to CONNECT 1.0 requests. The curl tool also got a --proxy1.0 - option that works exactly like --proxy but sets CURLPROXY_HTTP_1_0. - - I updated all test cases cases that use CONNECT and I tried to do some using - --proxy1.0 and some updated to do CONNECT 1.1 to get both versions run. - -Daniel Stenberg (31 Jan 2009) -- When building with c-ares 1.6.1 (not yet released) or later and IPv6 support - enabled, we can now take advantage of its brand new AF_UNSPEC support in - ares_gethostbyname(). This makes test case 241 finally run fine for me with - this setup since it now parses the "::1 ip6-localhost" line fine in my - /etc/hosts file! - -Daniel Stenberg (30 Jan 2009) -- Scott Cantor filed bug report #2550061 - (http://curl.haxx.se/bug/view.cgi?id=2550061) mentioning that I failed to - properly make sure that the VC9 makefiles got included in the latest - release. I've now fixed the release script and verified it so next release - will hopefully include them properly! - -Daniel Fandrich (30 Jan 2009) -- Fixed --disable-proxy for FTP and SOCKS. Thanks to Daniel Egger for - reporting. - -Yang Tse (29 Jan 2009) -- Introduced curl_sspi.c and curl_sspi.h for the implementation of functions - Curl_sspi_global_init() and Curl_sspi_global_cleanup() which previously were - named Curl_ntlm_global_init() and Curl_ntlm_global_cleanup() in http_ntlm.c - Also adjusted socks_sspi.c to remove the link-time dependency on the Windows - SSPI library using it now in the same way as it was done in http_ntlm.c. - -Daniel Stenberg (28 Jan 2009) -- Markus Moeller introduced two new options to libcurl: - CURLOPT_SOCKS5_GSSAPI_SERVICE and CURLOPT_SOCKS5_GSSAPI_NEC to allow libcurl - to do GSS-style authentication with SOCKS5 proxies. The curl tool got the - options called --socks5-gssapi-service and --socks5-gssapi-nec to enable - these. - -Daniel Stenberg (26 Jan 2009) -- Chad Monroe provided the new CURLOPT_TFTP_BLKSIZE option that allows an app - to set desired block size to use for TFTP transfers instead of the default - 512 bytes. - -- The "-no_ticket" option was introduced in Openssl0.9.8j. It's a flag to - disable "rfc4507bis session ticket support". rfc4507bis was later turned - into the proper RFC5077 it seems: http://tools.ietf.org/html/rfc5077 - - The enabled extension concerns the session management. I wonder how often - libcurl stops a connection and then resumes a TLS session. also, sending the - session data is some overhead. .I suggest that you just use your proposed - patch (which explicitly disables TICKET). - - If someone writes an application with libcurl and openssl who wants to - enable the feature, one can do this in the SSL callback. - - Sharad Gupta brought this to my attention. Peter Sylvester helped me decide - on the proper action. - -- Alexey Borzov filed bug report #2535504 - (http://curl.haxx.se/bug/view.cgi?id=2535504) pointing out that realms with - quoted quotation marks in HTTP Digest headers didn't work. I've now added - test case 1095 that verifies my fix. - -- Craig A West brought CURLOPT_NOPROXY and the corresponding --noproxy option. - They basically offer the same thing the NO_PROXY environment variable only - offered previously: list a set of host names that shall not use the proxy - even if one is specified. - -Daniel Fandrich (20 Jan 2009) -- Call setlocale() for libtest tests to test the effects of locale-induced - libc changes on libcurl. - -- Fixed a couple more locale-dependent toupper conversions, mainly for - clarity. This does fix one problem that causes ;type=i FTP URLs - to fail in the Turkish locale when CURLOPT_PROXY_TRANSFER_MODE is - used (test case 561) - -- Added tests 561 and 1091 through 1094 to test various combinations - of ;type= and ;mode= URLs that could potentially fail in the Turkish - locale. - -Daniel Stenberg (20 Jan 2009) -- Lisa Xu pointed out that the ssh.obj file was missing from the - lib/Makefile.vc6 file (and thus from the vc8 and vc9 ones too). - -Version 7.19.3 (19 January 2009) - -Daniel Stenberg (16 Jan 2009) -- Andrew de los Reyes fixed curlbuild.h for "generic" gcc builds on PPC, both - 32 bit and 64 bit. - -Daniel Stenberg (15 Jan 2009) -- Tim Ansell fixed a compiler warning in lib/cookie.c - -Daniel Stenberg (14 Jan 2009) -- Grant Erickson fixed timeouts for TFTP such that specifying a - connect-timeout, a max-time or both options work correctly and as expected - by passing the correct boolean value to Curl_timeleft via the - 'duringconnect' parameter. - - With this small change, curl TFTP now behaves as expected (and likely as - originally-designed): - - 1) For non-existent or unreachable dotted IP addresses: - - a) With no options, follows the default curl 300s timeout... - b) With --connect-timeout only, follows that value... - c) With --max-time only, follows that value... - d) With both --connect-timeout and --max-time, follows the smaller value... - - and times out with a "curl: (7) Couldn't connect to server" error. - - 2) For transfers to/from a valid host: - - a) With no options, follows default curl 300s timeout for the - first XRQ/DATA/ACK transaction and the default TFTP 3600s - timeout for the remainder of the transfer... - - b) With --connect-time only, follows that value for the - first XRQ/DATA/ACK transaction and the default TFTP 3600s - timeout for the remainder of the transfer... - - c) With --max-time only, follows that value for the first - XRQ/DATA/ACK transaction and for the remainder of the - transfer... - - d) With both --connect-timeout and --max-time, follows the former - for the first XRQ/DATA/ACK transaction and the latter for the - remainder of the transfer... - - and times out with a "curl: (28) Timeout was reached" error as - appropriate. - -Daniel Stenberg (13 Jan 2009) -- Michael Wallner fixed a NULL pointer deref when calling - curl_easy_setup(curl, CURLOPT_COOKIELIST, "SESS") on a CURL handle with no - cookies data. - -- Stefan Teleman brought a patch to fix the default curlbuild.h file for the - SunPro compilers. - -Daniel Stenberg (12 Jan 2009) -- Based on bug report #2498665 (http://curl.haxx.se/bug/view.cgi?id=2498665) - by Daniel Black, I've now added magic to the configure script that makes it - use pkg-config to detect gnutls details as well if the existing method - (using libgnutls-config) fails. While doing this, I cleaned up and unified - the pkg-config usage when detecting openssl and nss as well. - -Daniel Stenberg (11 Jan 2009) -- Karl Moerder brought the patch that creates vc9 Makefiles, and I made - 'maketgz' now use the actual makefile targets to do the VC8 and VC9 - makefiles. - -Daniel Stenberg (10 Jan 2009) -- Emil Romanus fixed: - - When using the multi interface over HTTP and the server returns a Location - header, the running easy handle will get stuck in the CURLM_STATE_PERFORM - state, leaving the external event loop stuck waiting for data from the - ingoing socket (when using the curl_multi_socket_action stuff). While this - bug was pretty hard to find, it seems to require only a one-line fix. The - break statement on line 1374 in multi.c caused the function to skip the call - to multistate(). - - How to reproduce this bug? Well, that's another question. evhiperfifo.c in - the examples directory chokes on this bug only _sometimes_, probably - depending on how fast the URLs are added. One way of testing the bug out is - writing to hiper.fifo from more than one source at the same time. - -Daniel Fandrich (7 Jan 2009) -- Unified much of the SessionHandle initialization done in Curl_open() and - curl_easy_reset() by creating Curl_init_userdefined(). This had the side - effect of fixing curl_easy_reset() so it now also resets - CURLOPT_FTP_FILEMETHOD and CURLOPT_SSL_SESSIONID_CACHE - -Daniel Stenberg (7 Jan 2009) -- Rob Crittenden did once again provide an NSS update: - - I have to jump through a few hoops now with the NSS library initialization - since another part of an application may have already initialized NSS by the - time Curl gets invoked. This patch is more careful to only shutdown the NSS - library if Curl did the initialization. - - It also adds in a bit of code to set the default ciphers if the app that - call NSS_Init* did not call NSS_SetDomesticPolicy() or set specific - ciphers. One might argue that this lets other application developers get - lazy and/or they aren't using the NSS API correctly, and you'd be right. - But still, this will avoid terribly difficult-to-trace crashes and is - generally helpful. - -Daniel Stenberg (1 Jan 2009) -- 'reconf' is removed since we rather have users use 'buildconf' - -Daniel Stenberg (31 Dec 2008) -- Bas Mevissen reported http://curl.haxx.se/bug/view.cgi?id=2479030 pointing - out that 'reconf' didn't properly point out the m4 subdirectory when running - aclocal. - -Daniel Stenberg (29 Dec 2008) - - Phil Lisiecki filed bug report #2413067 - (http://curl.haxx.se/bug/view.cgi?id=2413067) that identified a problem that - would cause libcurl to mark a DNS cache entry "in use" eternally if the - subsequence TCP connect failed. It would thus never get pruned and refreshed - as it should've been. - - Phil provided his own patch to this problem that while it seemed to work - wasn't complete and thus I wrote my own fix to the problem. - -Daniel Stenberg (28 Dec 2008) -- Peter Korsgaard fixed building libcurl with "configure --with-ssl - --disable-verbose". - -- Anthony Bryan fixed more language and spelling flaws in man pages. - -Daniel Stenberg (22 Dec 2008) -- Given a recent enough libssh2, libcurl can now seek/resume with SFTP even - on file indexes beyond 2 or 4GB. - -- Anthony Bryan provided a set of patches that cleaned up manual language, - corrected spellings and more. - -Daniel Stenberg (20 Dec 2008) -- Igor Novoseltsev fixed a bad situation for the multi_socket() API when doing - pipelining, as libcurl could then easily get confused and A) work on the - handle that was not "first in queue" on a pipeline, or even B) tell the app - to REMOVE a socket while it was in use by a second handle in a pipeline. Both - errors caused hanging or stalling applications. - -Daniel Stenberg (19 Dec 2008) -- curl_multi_timeout() could return a timeout value of 0 even though nothing - was actually ready to get done, as the internal time resolution is higher - than the returned millisecond timer. Therefore it could cause applications - running on fast processors to do short bursts of busy-loops. - curl_multi_timeout() will now only return 0 if the timeout is actually - alreay triggered. - -- Using the libssh2 0.19 function libssh2_session_block_directions(), libcurl - now has an improved ability to do right when the multi interface (both - "regular" and multi_socket) is used for SCP and SFTP transfers. This should - result in (much) less busy-loop situations and thus less CPU usage with no - speed loss. - -Daniel Stenberg (17 Dec 2008) -- SCP and SFTP with the multi interface had the same flaw: the 'DONE' - operation didn't complete properly if the EAGAIN equivalent was returned but - libcurl would simply continue with a half-completed close operation - performed. This ruined persistent connection re-use and cause some - SSH-protocol errors in general. The correction is unfortunately adding a - blocking function - doing it entirely non-blocking should be considered for - a better fix. - -Gisle Vanem (16 Dec 2008) -- Added the possibility to use the Watt-32 tcp/ip stack under Windows. - The change simply involved adding a USE_WATT32 section in the - config-win32.h files (under ./lib and ./src). This section disables - the use of any Winsock headers. - -Daniel Stenberg (16 Dec 2008) -- libssh2_sftp_last_error() was wrongly used at some places in libcurl which - made libcurl sometimes not properly abort problematic SFTP transfers. - -Daniel Stenberg (12 Dec 2008) -- More work with Igor Novoseltsev to first fix the remaining stuff for - removing easy handles from multi handles when the easy handle is/was within - a HTTP pipeline. His bug report #2351653 - (http://curl.haxx.se/bug/view.cgi?id=2351653) was also related and was - eventually fixed by a patch by Igor himself. - -Yang Tse (12 Dec 2008) -- Patrick Monnerat fixed a build regression, introduced in 7.19.2, affecting - OS/400 compilations with IPv6 enabled. - -Daniel Stenberg (12 Dec 2008) -- Mark Karpeles filed bug report #2416182 titled "crash in ConnectionExists - when using duphandle+curl_mutli" - (http://curl.haxx.se/bug/view.cgi?id=2416182) which showed that - curl_easy_duphandle() wrongly also copied the pointer to the connection - cache, which was plain wrong and caused a segfault if the handle would be - used in a different multi handle than the handle it was duplicated from. - -Daniel Stenberg (11 Dec 2008) -- Keshav Krity found out that libcurl failed to deal with dotted IPv6 - addresses if they were very long (>39 letters) due to a too strict address - validity parser. It now accepts addresses up to 45 bytes long. - -Daniel Stenberg (11 Dec 2008) -- Internet Explorer had a broken HTTP digest authentication before v7 and - there are servers "out there" that relies on the client doing this broken - Digest authentication. Apache even comes with an option to work with such - broken clients. - - The difference is only for URLs that contain a query-part (a '?'-letter and - text to the right of it). - - libcurl now supports this quirk, and you enable it by setting the - CURLAUTH_DIGEST_IE bit in the bitmask you pass to the CURLOPT_HTTPAUTH or - CURLOPT_PROXYAUTH options. They are thus individually controlled to server - and proxy. - - (note that there's no way to activate this with the curl tool yet) - -Daniel Fandrich (9 Dec 2008) -- Added test cases 1089 and 1090 to test --write-out after a redirect to - test a report that the size didn't work, but these test cases pass. - -- Documented CURLOPT_CONNECT_ONLY as being useful only on HTTP URLs. - -Daniel Stenberg (9 Dec 2008) -- Ken Hirsch simplified how libcurl does FTPS: now it doesn't assume any - particular state for the control connection like it did before for implicit - FTPS (libcurl assumed such control connections to be encrypted while some - FTPS servers such as FileZilla assumes such connections to be clear - mode). Use the CURLOPT_USE_SSL option to set your desired level. - -Daniel Stenberg (8 Dec 2008) -- Fred Machado posted about a weird FTP problem on the curl-users list and when - researching it, it turned out he got a 550 response back from a SIZE command - and then I fell over the text in RFC3659 that says: - - The presence of the 550 error response to a SIZE command MUST NOT be taken - by the client as an indication that the file cannot be transferred in the - current MODE and TYPE. - - In other words: the change I did on September 30th 2008 and that has been - included in the last two releases were a regression and a bad idea. We MUST - NOT take a 550 response from SIZE as a hint that the file doesn't exist. - -- Christian Krause filed bug #2221237 - (http://curl.haxx.se/bug/view.cgi?id=2221237) that identified an infinite - loop during GSS authentication given some specific conditions. With his - patience and great feedback I managed to narrow down the problem and - eventually fix it although I can't test any of this myself! - -Daniel Fandrich (3 Dec 2008) -- Fixed the getifaddrs version of Curl_if2ip to work on systems without IPv6 - support (e.g. Minix) - -Daniel Stenberg (3 Dec 2008) -- Igor Novoseltsev filed bug #2351645 - (http://curl.haxx.se/bug/view.cgi?id=2351645) that identified a problem with - the multi interface that occured if you removed an easy handle while in - progress and the handle was used in a HTTP pipeline. - -- Pawel Kierski pointed out a mistake in the cookie code that could lead to a - bad fclose() after a fatal error had occured. - (http://curl.haxx.se/bug/view.cgi?id=2382219) - -Daniel Fandrich (25 Nov 2008) -- If a HTTP request is Basic and num is already >=1000, the HTTP test - server adds 1 to num to get the data section to return. This allows - testing authentication negotiations using the Basic authentication - method. - -- Added tests 1087 and 1088 to test Basic authentication on a redirect - with and without --location-trusted - -Daniel Stenberg (24 Nov 2008) -- Based on a patch by Vlad Grachov, libcurl now uses a new libssh2 0.19 - function when built to support SCP and SFTP that helps the library to know - in which direction a particular libssh2 operation would return EAGAIN so - that libcurl knows what socket conditions to wait for before trying the - function call again. Previously (and still when using libssh2 0.18 or - earlier), libcurl will busy-loop in this situation when the easy interface - is used! - -Daniel Fandrich (20 Nov 2008) -- Automatically detect OpenBSD's CA cert bundle. - -Daniel Stenberg (19 Nov 2008) -- I removed the default use of "Pragma: no-cache" from libcurl when a proxy is - used. It has been used since forever but it was never a good idea to use - unless explicitly asked for. - -- Josef Wolf's extension that allows a $TESTDIR/gdbinit$testnum file that when - you use runtests.pl -g, will be sourced by gdb to allow additional fancy or - whatever you see fit - -- Christian Krause reported and fixed a memory leak that would occur with HTTP - GSS/kerberos authentication (http://curl.haxx.se/bug/view.cgi?id=2284386) - -- Andreas Wurf and Markus Koetter helped me analyze a problem that Andreas got - when uploading files to a single FTP server using multiple easy handle - handles with the multi interface. Occasionally a handle would stall in - mysterious ways. - - The problem turned out to be a side-effect of the ConnectionExists() - function's eagerness to re-use a handle for HTTP pipelining so it would - select it even if already being in use, due to an inadequate check for its - chances of being used for pipelnining. - -Daniel Fandrich (17 Nov 2008) -- Added more compiler warning options for gcc 4.3 - -Yang Tse (17 Nov 2008) -- Fix a remaining problem in the inet_pton() runtime configure check. And - fix internal Curl_inet_pton() failures to reject certain malformed literals. - -- Make configure script check if ioctl with the SIOCGIFADDR command can be - used, and define HAVE_IOCTL_SIOCGIFADDR if appropriate. - -Daniel Stenberg (16 Nov 2008) -- Christian Krause fixed a build failure when building with gss support - enabled and FTP disabled. - -- Added check for NULL returns from strdup() in src/main.c and lib/formdata.c - - reported by Jim Meyering also prevent buffer overflow on MSDOS when you do - for example -O on a url with a file name part longer than PATH_MAX letters - -- lib/nss.c fixes based on the report by Jim Meyering: I went over and added - checks for return codes for all calls to malloc and strdup that were - missing. I also changed a few malloc(13) to use arrays on the stack and a - few malloc(PATH_MAX) to instead use aprintf() to lower memory use. - -- I fixed a memory leak in Curl_nss_connect() when CURLOPT_ISSUERCERT is - in use. - -Daniel Fandrich (14 Nov 2008) -- Added .xml as one of the few common file extensions known by the multipart - form generator. - -- Added some #ifdefs around header files and change the EAGAIN test to - fix compilation on Cell (reported by Jeff Curley). - -Yang Tse (14 Nov 2008) -- Fixed several configure script issues affecting checks for inet_ntoa_r(), - inet_ntop(), inet_pton(), getifaddrs(), fcntl() and getaddrinfo(). - -Yang Tse (13 Nov 2008) -- Refactored configure script detection of functions used to set sockets into - non-blocking mode, and decouple function detection from function capability. +$ git log --pretty=fuller --no-color --date=short --decorate=full | \ + ./log2changes.pl +The older, manually edited, changelog is found in git named CHANGES.0 @@ -6,8 +6,2383 @@ Old Changelog -Changes done to curl and libcurl from 1997 to 2008. The most recent changes are -always kept in the CHANGES file. +Changes done to curl and libcurl from 1997 to 2010, edited manually. The most +recent changes are always generated into the CHANGES file straight from git. + +Kamil Dudka (17 June 2010) +- Improve test575 in order to not fail with threaded DNS resolver. + +Version 7.21.0 (16 June 2010) + +Daniel Stenberg (5 June 2010) +- Constantine Sapuntzakis fixed a case of spurious SSL connection aborts using + libcurl and OpenSSL. "I tracked it down to uncleared error state on the + OpenSSL error stack - patch attached deals with that." + +Daniel Stenberg (5 June 2010) +- Frank Meier added CURLINFO_PRIMARY_PORT, CURLINFO_LOCAL_IP and + CURLINFO_LOCAL_PORT to curl_easy_getinfo(). + +Yang Tse (4 June 2010) +- Enabled OpenLDAP support for cygwin builds. This support was disabled back + in 2008 due to incompatibilities between OpenSSL and OpenLDAP headers. + cygwin's OpenSSL 0.9.8l and OpenLDAP 2.3.43 versions on cygwin 1.5.25 + allow building an OpenLDAP enabled libcurl supporting back to Windows 95. + + Removed the non-functional CURL_LDAP_HYBRID code and references. + +Daniel Stenberg (2 June 2010) +- Jason McDonald posted bug report #3006786 when he found that the SFTP code + didn't timeout properly in several places in the code even if a timeout was + set properly. + + Based on his suggested patch, I wrote a different implementation that I + think addressed the issue better and also uses the connect timeout for the + initial part of the SSH/SFTP done during the "protocol connect" phase. + + (http://curl.haxx.se/bug/view.cgi?id=3006786) + +Yang Tse (2 June 2010) +- Added missing new libcurl files to non-configure targets. Adjusted + libcurl standard internal header inclusions in new files. Fixed an + SPNEGO related memory leak. Fixed several LDAP related compilation + issues, and fixed some compiler warnings. + +Daniel Stenberg (1 June 2010) +- Igor Novoseltsev reported a problem with the multi socket API and using + timeouts and timers. It boiled down to a problem with libcurl's use of + GetTickCount() interally to figure out the current time, while Igor's own + application code used another function call. + + It made his app call the socket API timeout function a bit _before_ libcurl + would consider the timeout to trigger, and that could easily lead to + timeouts or stalls in the app. It seems GetTickCount() in general often has + no better resolution than 16ms and switching to the alternative function + QueryPerformanceCounter has its share of problems: + http://www.virtualdub.org/blog/pivot/entry.php?id=106 + + We address this problem by simply having libcurl treat timers that already + has occured or will occur within 40ms subject for treatment. I'm confident + that there are other implementations and operating systems with similarly in + accurate timer functions so it makes sense to have applied generically and I + don't believe we sacrifice much by adding a 40ms inaccuracy on these + timeouts. + +Kamil Dudka (27 May 2010) +- added a new test for CRL support (test313) + +- Tor Arntsen changed the alternative definition of bool to use enum instead + of unsigned char. + +Daniel Stenberg (25 May 2010) +- Julien Chaffraix fixed the warning seen when compiling lib/rtmp.c: one + unused variables, several unused arguments and some missing #include. + +- Julien Chaffraix fixed 2 OOM errors: a missing NULL-check in + lib/http_negociate.c and a potential NULL dereferencing in lib/splay.c + +- Howard Chu brought a patch that makes the LDAP code much cleaner, nicer and + in general being a better libcurl citizen. If a new enough OpenLDAP version + is detect, the new and shiny lib/openldap.c code is then used instead of the + old cruft. + +Daniel Stenberg (21 May 2010) +- Eric Mertens posted bug #3003705: when we made TFTP use the correct timeout + option when sent to the server (fixed May 18th 2010) it became obvious that + libcurl used invalid timeout values (300 by default while the RFC allows + nothing above 255). While of course it is obvious that as TFTP has worked + thus far without being able to set timeout at all, just removing the setting + wouldn't make any difference in behavior. I decided to still keep it (but + fix the problem) as it now actually allows for easier (future) customization + of the timeout. + + (http://curl.haxx.se/bug/view.cgi?id=3003705) + +- Douglas Kilpatrick filed bug report #3004787 and pointed out that the TFTP + code didn't handle block id wraps correctly. His suggested fix inspired the + fix I committed. + + (http://curl.haxx.se/bug/view.cgi?id=3004787) + +Daniel Stenberg (20 May 2010) +- Tanguy Fautre brought a fix to allow curl to build with Microsoft VC10. + +Daniel Stenberg (18 May 2010) +- Eric Mertens posted bug report #3003005 pointing out that the libcurl TFTP + code was not sending the timeout option properly to the server, and + suggested a fix. + + (http://curl.haxx.se/bug/view.cgi?id=3003005) + +Kamil Dudka (16 May 2010) +- Pavel Raiskup introduced a new option CURLOPT_FNMATCH_DATA in order to pass + a custom data pointer to the callback specified by CURLOPT_FNMATCH_FUNCTION. + +Daniel Stenberg (14 May 2010) +- John-Mark Bell filed bug #3000052 that identified a problem (with an + associated patch) with the OpenSSL handshake state machine when the multi + interface is used: + + Performing an https request using a curl multi handle and using select or + epoll to wait for events results in a hang. It appears that the cause is the + fix for bug #2958179, which makes ossl_connect_common unconditionally return + from the step 2 loop when fetching from a multi handle. + + When ossl_connect_step2 has completed, it updates connssl->connecting_state + to ssl_connect_3. ossl_connect_common will then return to the caller, as a + multi handle is in use. Eventually, the client code will call + curl_multi_fdset to obtain an updated fdset to select or epoll on. For https + requests, curl_multi_fdset will cause https_getsock to be called. + https_getsock will only return a socket handle if the connecting_state is + ssl_connect_2_reading or ssl_connect_2_writing. Therefore, the client will + never obtain a valid fdset, and thus not drive the multi handle, resulting + in a hang. + + (http://curl.haxx.se/bug/view.cgi?id=3000052) + +- Sebastian V reported bug #3000056 identifying a problem with redirect + following. It showed that when curl followed redirects it didn't properly + ignore the response body of the 30X response if that response was using + compressed Content-Encoding! + + (http://curl.haxx.se/bug/view.cgi?id=3000056) + +Daniel Stenberg (12 May 2010) +- Howard Chu brought support for RTMP. This is powered by the underlying + librtmp library. It supports a range of variations and "sub-protocols" + within the RTMP family. + +- Pavel Raiskup brought support for FTP directory wildcard matching to allow + selective downloading. To provide that, a set of new options were added: + + CURLOPT_WILDCARDMATCH + CURLOPT_CHUNK_BGN_FUNCTION + CURLOPT_CHUNK_END_FUNCTION + CURLOPT_CHUNK_DATA + CURLOPT_FNMATCH_FUNCTION + + There were also a set of new tests added (574 - 577) to verify this. + +Kamil Dudka (11 May 2010) +- CRL support in libcurl-NSS has been completely broken. Now it works. Original + bug report: https://bugzilla.redhat.com/581926 + +Daniel Stenberg (7 May 2010) +- Dirk Manske reported a regression. When connecting with the multi interface, + there were situations where libcurl wouldn't store connect time correctly as + it used to (and is documented to) do. + + Using his fine sample program we could repeat it, and I wrote up test case + 573 using that code. The problem does not easily show itself using the local + test suite though. + + The fix, also as suggested by Dirk, is a bit on the ugly side as it adds yet + another call to Curl_verboseconnect() and setting the TIMER_CONNECT time. + That situation is subject for some closer inspection in the future. + +- Howard Chu split the I/O handling functions into private handlers. + + Howard Chu brought the bulk work of this patch that properly moves out the + sending and recving of data to the parts of the code that are properly + responsible for the various ways of doing so. + + Daniel Stenberg assisted with polishing a few bits and fixed some minor + flaws in the original patch. + + Another upside of this patch is that we now abuse CURLcodes less with the + "magic" -1 return codes and instead use CURLE_AGAIN more consistently. + +Daniel Stenberg (5 May 2010) +- Hoi-Ho Chan introduced support for using the PolarSSL library. You control + this with the new configure option --with-polarssl. + +Daniel Stenberg (29 Apr 2010) +- Ben Greear made telnet a lot better/easier to use by an application: + + The main change is to allow input from user-specified methods, when they are + specified with CURLOPT_READFUNCTION. All calls to fflush(stdout) in + telnet.c were removed, which makes using 'curl telnet://foo.com' painful + since prompts and other data are not always returned to the user promptly. + Use 'curl --no-buffer telnet://foo.com' instead. In general, the user + should have their CURLOPT_WRITEFUNCTION do a fflush for interactive use. + + Also fix assumption that reading from stdin never returns < 0. + Old code could crash in that case. + + Call progress functions in telnet main loop. + +Daniel Stenberg (26 Apr 2010) +- Make use of the libssh2_init/exit functions that libssh2 added in version + 1.2.5. Using them will improve how libcurl works in threaded situations when + SCP and SFTP are transfered. + +Daniel Stenberg (25 Apr 2010) +- Based on work by Kamil Dudka, I've introduced the new configure option + --enable-threaded-resolver. When used, the configure script will check for + pthreads and if around, it will build libcurl to use pthreads to do name + resolving in a threaded manner. Note that this is just a fix to offer an + option that can enable the code that already included. The threader resolver + code was mostly added on Jan 26 2010. + +Daniel Stenberg (24 Apr 2010) +- Alex Bligh introduced the --proto and -proto-redir options that limit what + protocols curl accepts for the requests and when following redirects. + +Kamil Dudka (24 Apr 2010) +- Fixed test536 in order to not fail with threaded DNS resolver and tweaked + comments in certain examples using curl_multi_fdset(). + +- Fixed SSL handshake timeout underflow in libcurl-NSS, which caused test405 + to hang on a slow machine. + +Daniel Stenberg (21 Apr 2010) +- The -O option caused curl to crash on windows and DOS due to the tool + writing out of boundary memory. + +Yang Tse (20 Apr 2010) +- Ruslan Gazizov detected that MSVC makefiles were using wsock32.lib instead + of ws2_32.lib, this generated linking issues on MSVC IPv6 enabled builds + that were done using those makefiles. + +Daniel Stenberg (19 Apr 2010) +- -J/--remote-header-name didn't strip trailing carriage returns or linefeeds + properly, so they could be used in the file name. + +Daniel Stenberg (16 Apr 2010) +- Jerome Vouillon made the GnuTLS SSL handshake phase non-blocking. + +- The recent overhaul of the SSL recv function made the GnuTLS specific code + treat a zero returned from gnutls_record_recv() as an error, and this caused + our HTTPS test cases to fail. We leave it to upper layer code to detect if + an EOF is a problem or not. + +- I reverted the resolver fix from yesterday and instead removed all uses of + AI_CANONNAME all over libcurl and made the only user of that info (krb5.c) + use the host name from the URL instead. No reverse resolving is a good + thing. + +- Paul Howarth made configure properly detect GSS "on ancient Linux distros" + by editing in which order we use headers to detect GSS. + +Daniel Stenberg (15 Apr 2010) +- Rainer Canavan filed bug report #2987196 that identified libcurl doing + unnecesary reverse name lookups in many cases when built to use IPv4 and + getaddrinfo(). The logic for ipv6 is now used for ipv4 too. + + (http://curl.haxx.se/bug/view.cgi?id=2963679) + +Version 7.20.1 (14 April 2010) + +Daniel Stenberg (9 Apr 2010) +- Prefixing the FTP quote commands with an asterisk really only worked for the + postquote actions. This is now fixed and test case 227 has been extended to + verify. + +Kamil Dudka (4 Apr 2010) +- Eliminated a race condition in Curl_resolv_timeout(). + +- Refactorized interface of Curl_ssl_recv()/Curl_ssl_send(). + +- libcurl-NSS now provides more accurate messages and error codes in case of + client certificate problem. Either during connection, or transfer phase. + +Daniel Stenberg (1 Apr 2010) +- Matt Wixson found and fixed a bug in the SCP/SFTP area where the code + treated a 0 return code from libssh2 to be the same as EAGAIN while in + reality it isn't. The problem caused a hang in SFTP transfers from a + MessageWay server. + +Daniel Stenberg (28 Mar 2010) +- Ben Greear: If you pass a URL to pop3 that does not contain a message ID as + part of the URL, it would previously ask for 'INBOX' which just causes the + pop3 server to return an error. + + Now libcurl treats en empty message ID as a request for LIST (list of pop3 + message IDs). User's code could then parse this and download individual + messages as desired. + +Daniel Stenberg (27 Mar 2010) +- Ben Greear brought a patch that from now on allows all protocols to specify + name and user within the URL, in the same manner HTTP and FTP have been + allowed to in the past - although far from all of the libcurl supported + protocls actually have that feature in their URL definition spec. + +Daniel Stenberg (26 Mar 2010) +- Ben Greear brought code that makes the rate limiting code for the easy + interface a bit smoother as it introduces sub-second sleeps during it and it + also takes the buffer sizes into account. + +Daniel Stenberg (24 Mar 2010) +- Bob Richmond: There's an annoying situation where libcurl will read new HTTP + response data from a socket, then check if it's a timeout if one is set. If + the last packet received constitutes the end of the response body, libcurl + still treats it as a timeout condition and reports a message like: + + "Operation timed out after 3000 milliseconds with 876 out of 876 bytes + received" + + It should only a timeout if the timer lapsed and we DIDN'T receive the end + of the response body yet. + +- Christopher Conroy fixed a problem with RTSP and GET_PARAMETER reported + to us by Massimo Callegari. There's a new test case 572 that verifies this + now. + +- The 'ares' subtree has been removed from the source repository. It was + always a separate project that sort of piggybacked on the curl project since + the dawn of times and now the time has come for it to go stand on its own + legs and continue living its own life. All details on c-ares and its new + source code repository is found at http://c-ares.haxx.se/ + +Daniel Stenberg (23 Mar 2010) +- Kenny To filed the bug report #2963679 with patch to fix a problem he + experienced with doing multi interface HTTP POST over a proxy using + PROXYTUNNEL. He found a case where it would connect fine but bits.tcpconnect + was not set correct so libcurl didn't work properly. + + (http://curl.haxx.se/bug/view.cgi?id=2963679) + +- Akos Pasztory filed debian bug report #572276 + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572276 mentioning a problem + with a resource that returns chunked-encoded _and_ with a Content-Length + and libcurl failed to properly ignore the latter information. + +- Hauke Duden provided an example program that made the multi interface crash. + His example simply used the multi interface and did first one FTP transfer + and after completion it used a second easy handle and did another FTP + transfer on the same FTP server. + + This triggered a bug in the "delayed easy handle kill" system that curl + uses: when an FTP connection is left alive it must keep an easy handle + around internally - only for the purpose of having an easy handle when it + later disconnects it. The code assumed that when the easy handle was removed + and an internal reference was made, that version could be killed later on + when a new easy handle came using the same connection. This was wrong as + Hauke's example showed that the removed handle wasn't killed for real until + later. This caused a double close attempt => segfault. + +Daniel Stenberg (22 Mar 2010) +- Thomas Lopatic fixed the alarm()-based DNS timeout: + + Looking at the code of Curl_resolv_timeout() in hostip.c, I think that in + case of a timeout, the signal handler for SIGALRM never gets removed. I + think that in my case it gets executed at some point later on when execution + has long left Curl_resolv_timeout() or even the cURL library. + + The code that is jumped to with siglongjmp() simply sets the error message + to "name lookup timed out" and then returns with CURLRESOLV_ERROR. I guess + that instead of simply returning without cleaning up, the code should have a + goto that jumps to the spot right after the call to Curl_resolv(). + +Kamil Dudka (22 Mar 2010) +- Douglas Steinwand contributed a patch fixing insufficient initialization in + Curl_clone_ssl_config() + +Daniel Stenberg (21 Mar 2010) +- Ben Greear improved TFTP: the error code returning and the treatment + of TSIZE == 0 when uploading. + +- We've switched from CVS to git. See http://curl.haxx.se/source.html + +Kamil Dudka (19 Mar 2010) +- Improved Curl_read() to not ignore the error returned from Curl_ssl_recv(). + +Daniel Stenberg (15 Mar 2010) +- Constantine Sapuntzakis brought a patch: + + The problem mentioned on Dec 10 2009 + (http://curl.haxx.se/bug/view.cgi?id=2905220) was only partially fixed. + Partially because an easy handle can be associated with many connections in + the cache (e.g. if there is a redirect during the lifetime of the easy + handle). The previous patch only cleaned up the first one. The new fix now + removes the easy handle from all connections, not just the first one. + +Daniel Stenberg (6 Mar 2010) +- Ben Greear brought a patch that fixed the rate limiting logic for TFTP when + the easy interface was used. + +Daniel Stenberg (5 Mar 2010) +- Daniel Johnson provided fixes for building curl with the clang compiler. + +Yang Tse (5 Mar 2010) +- Constantine Sapuntzakis detected and fixed a double free in builds done + with threaded resolver enabled (Windows default configuration) that would + get triggered when a curl handle is closed while doing DNS resolution. + +Daniel Stenberg (2 Mar 2010) +- [Daniel Johnson] I've been trying to build libcurl with clang on Darwin and + ran into some issues with the GSSAPI tests in configure.ac. The tests first + try to determine the include dirs and libs and set CPPFLAGS and LIBS + accordingly. It then checks for the headers and finally sets LIBS a second + time, causing the libs to be included twice. The first setting of LIBS seems + redundant and should be left out, since the first part is otherwise just + about finding headers. + + My second issue is that 'krb5-config --libs gssapi' on Darwin is less than + useless and returns junk that, while it happens to work with gcc, causes + clang to choke. For example, --libs returns $CFLAGS along with the libs, + which is really retarded. Simply setting 'LIBS="$LIBS -lgssapi_krb5 + -lresolv"' on Darwin is sufficient. + +- Based on patch provided by Jacob Moshenko, the transfer logic now properly + makes sure that when using sub-second timeouts, there's no final bad 1000ms + wait. Previously, a sub-second timeout would often make the elapsed time end + up the time rounded up to the nearest second (e.g. 1s for 200ms timeout) + +- Andrei Benea filed bug report #2956698 and pointed out that the + CURLOPT_CERTINFO feature leaked memory due to a missing OpenSSL function + call. He provided the patch to fix it too. + + http://curl.haxx.se/bug/view.cgi?id=2956698 + +- Markus Duft pointed out in bug #2961796 that even though Interix has a + poll() function it doesn't quite work the way we want it so we must disable + it, and he also provided a patch for it. + + http://curl.haxx.se/bug/view.cgi?id=2961796 + +- Made the pingpong timeout code properly deal with the response timeout AND + the global timeout if set. Also, as was reported in the bug report #2956437 + by Ryan Chan, the time stamp to use as basis for the per command timeout was + not set properly in the DONE phase for FTP (and not for SMTP) so I fixed + that just now. This was a regression compared to 7.19.7 due to the + conversion of FTP code over to the generic pingpong concepts. + + http://curl.haxx.se/bug/view.cgi?id=2956437 + +Daniel Stenberg (1 Mar 2010) +- Ben Greear provided an update for TFTP that fixes upload. + +- Wesley Miaw reported bug #2958179 which identified a case of looping during + OpenSSL based SSL handshaking even though the multi interface was used and + there was no good reason for it. + + http://curl.haxx.se/bug/view.cgi?id=2958179 + +Daniel Stenberg (26 Feb 2010) +- Pat Ray in bug #2958474 pointed out an off-by-one case when receiving a + chunked-encoding trailer. + + http://curl.haxx.se/bug/view.cgi?id=2958474 + +Daniel Fandrich (25 Feb 2010) +- Fixed a couple of out of memory leaks and a segfault in the SMTP & IMAP code. + +Yang Tse (25 Feb 2010) +- I fixed bug report #2958074 indicating + (http://curl.haxx.se/bug/view.cgi?id=2958074) that curl on Windows with + option --trace-time did not use local time when timestamping trace lines. + This could also happen on other systems depending on time souurce. + +Patrick Monnerat (22 Feb 2010) +- Proper handling of STARTTLS on SMTP, taking CURLUSESSL_TRY into account. +- SMTP falls back to RFC821 HELO when EHLO fails (and SSL is not required). +- Use of true local host name (i.e.: via gethostname()) when available, as + default argument to SMTP HELO/EHLO. +- Test case 804 for HELO fallback. + +Daniel Stenberg (20 Feb 2010) +- Fixed the SMTP compliance by making sure RCPT TO addresses are specified + properly in angle brackets. Recipients provided with CURLOPT_MAIL_RCPT now + get angle bracket wrapping automatically by libcurl unless the recipient + starts with an angle bracket as then the app is assumed to deal with that + properly on its own. + +- I made the SMTP code expect a 250 response back from the server after the + full DATA has been sent, and I modified the test SMTP server to also send + that response. As usual, the DONE operation that is made after a completed + transfer is still not doable in a non-blocking way so this waiting for 250 + is unfortunately made blockingly. + +Yang Tse (14 Feb 2010) +- Overhauled test suite getpart() function. Fixing potential out of bounds + stack and memory overwrites triggered with huge test case definitions. + +Daniel Stenberg (13 Feb 2010) +- Martin Hager reported and fixed a problem with a missing quote in libcurl.m4 + + (http://curl.haxx.se/bug/view.cgi?id=2951319) + +- Tom Donovan fixed the CURL_FORMAT_* defines when building with cmake. + + (http://curl.haxx.se/bug/view.cgi?id=2951269) + +Daniel Stenberg (12 Feb 2010) +- Jack Zhang reported a problem with SMTP: we wrongly used multiple addresses + in the same RCPT TO line, when they should be sent in separate single + commands. I updated test case 802 to verify this. + +- I also fixed a bad use of my_setopt_str() of CURLOPT_MAIL_RCPT in the curl + tool which made it try to output it as string for the --libcurl feature + which could lead to crashes. + +Yang Tse (11 Feb 2010) +- Steven M. Schweda fixed VMS builder bad behavior when used in a batch job, + removed obsolete batch_compile.com and defines.com and updated VMS readme. + +Version 7.20.0 (9 February 2010) + +Daniel Stenberg (9 Feb 2010) +- When downloading compressed content over HTTP and the app asked libcurl to + automatically uncompress it with the CURLOPT_ENCODING option, libcurl could + wrongly provide the callback with more data than the maximum documented + amount. An application could thus get tricked into badness if the maximum + limit was trusted to be enforced by libcurl itself (as it is documented). + + This is further detailed and explained in the libcurl security advisory + 20100209 at + + http://curl.haxx.se/docs/adv_20100209.html + +Daniel Fandrich (3 Feb 2010) +- Changed the Watcom makefiles to make them easier to keep in sync with + Makefile.inc since that can't be included directly. + +Yang Tse (2 Feb 2010) +- Symbol CURL_FORMAT_OFF_T now obsoleted, will be removed in a future release, + symbol will not be available when building with CURL_NO_OLDIES defined. Use + of CURL_FORMAT_CURL_OFF_T is preferred since 7.19.0 + +Daniel Stenberg (1 Feb 2010) +- Using the multi_socket API, it turns out at times it seemed to "forget" + connections (which caused a hang). It turned out to be an existing (7.19.7) + bug in libcurl (that's been around for a long time) and it happened like + this: + + The app calls curl_multi_add_handle() to add a new easy handle, libcurl will + then set it to timeout in 1 millisecond so libcurl will tell the app about + it. + + The app's timeout fires off that there's a timeout, the app calls libcurl as + we so often document it: + + do { + res = curl_multi_socket_action(... TIMEOUT ...); + } while(CURLM_CALL_MULTI_PERFORM == res); + + And this is the problem number one: + + When curl_multi_socket_action() is called with no specific handle, but only + a timeout-action, it will *only* perform actions within libcurl that are + marked to run at this time. In this case, the request would go from INIT to + CONNECT and return CURLM_CALL_MULTI_PERFORM. When the app then calls libcurl + again, there's no timer set for this handle so it remains in the CONNECT + state. The CONNECT state is a transitional state in libcurl so it reports no + sockets there, and thus libcurl never tells the app anything more about that + easy handle/connection. + + libcurl _does_ set a 1ms timeout for the handle at the end of + multi_runsingle() if it returns CURLM_CALL_MULTI_PERFORM, but since the loop + is instant the new job is not ready to run at that point (and there's no + code that makes libcurl call the app to update the timout for this new + timeout). It will simply rely on that some other timeout will trigger later + on or that something else will update the timeout callback. This makes the + bug fairly hard to repeat. + + The fix made to adress this issue: + + We introduce a loop in lib/multi.c around all calls to multi_runsingle() and + simply check for CURLM_CALL_MULTI_PERFORM internally. This has the added + benefit that this goes in line with my long-term wishes to get rid of the + CURLM_CALL_MULTI_PERFORM all together from the public API. + + The downside of this fix, is that the counter we return in 'running_handles' + in several of our public functions then gets a slightly new and possibly + confusing behavior during times: + + If an app adds a handle that fails to connect (very quickly) it may just + as well never appear as a 'running_handle' with this fix. Previously it + would first bump the counter only to get it decreased again at next call. + Even I have used that change in handle counter to signal "end of a + transfer". The only *good* way to find the end of a individual transfer + is calling curl_multi_info_read() to see if it returns one. + + Of course, if the app previously did the looping before it checked the + counter, it really shouldn't be any new effect. + +Yang Tse (26 Jan 2010) +- Constantine Sapuntzakis' and Joshua Kwan's work done in the last four months + relative to the asynchronous DNS lookups, along with with some integration + adjustments I have done are finally committed to CVS. + + Currently these enhancements will benefit builds done using c-ares on any + platform as well as Windows builds using the default threaded resolver. + + This release does not make generally available POSIX threaded DNS lookups + yet. There is no configure option to enable this feature yet. It is possible + to experimantally try this feature running configure with compiler flags that + make simultaneous definition of preprocessor symbols USE_THREADS_POSIX and + HAVE_PTHREAD_H, as well as whatever reentrancy compiler flags and linker ones + are required to link and properly use pthread_* functions on each platform. + +Daniel Stenberg (26 Jan 2010) +- Mike Crowe made libcurl return CURLE_COULDNT_RESOLVE_PROXY when it is the + proxy that cannot be resolved when using c-ares. This matches the behaviour + when not using c-ares. + +Björn Stenberg (23 Jan 2010) +- Added a new flag: -J/--remote-header-name. This option tells the + -O/--remote-name option to use the server-specified Content-Disposition + filename instead of extracting a filename from the URL. + +Daniel Stenberg (21 Jan 2010) +- Chris Conroy brought support for RTSP transfers, and with it comes 8(!) new + libcurl options for controlling what to get and how to receive posssibly + interleaved RTP data. + +Daniel Stenberg (20 Jan 2010) +- As was pointed out on the http-state mailing list, the order of cookies in a + HTTP Cookie: header _needs_ to be sorted on the path length in the cases + where two cookies using the same name are set more than once using + (overlapping) paths. Realizing this, identically named cookies must be + sorted correctly. But detecting only identically named cookies and take care + of them individually is harder than just to blindly and unconditionally sort + all cookies based on their path lengths. All major browsers also already do + this, so this makes our behavior one step closer to them in the cookie area. + + Test case 8 was the only one that broke due to this change and I updated it + accordingly. + +Daniel Stenberg (19 Jan 2010) +- David McCreedy brought a fix and a new test case (129) to make libcurl work + again when downloading files over FTP using ASCII and it turns out that the + final size of the file is not the same as the initial size the server + reported. This is very common since servers don't take the newline + conversions into account. + +Kamil Dudka (14 Jan 2010) +- Suppressed side effect of OpenSSL configure checks, which prevented NSS from + being properly detected under certain circumstances. It had been caused by + strange behavior of pkg-config when handling PKG_CONFIG_LIBDIR. pkg-config + distinguishes among empty and non-existent environment variable in that case. + +Daniel Stenberg (12 Jan 2010) +- Gil Weber reported a peculiar flaw with the multi interface when doing SFTP + transfers: curl_multi_fdset() would return -1 and not set and file + descriptors several times during a transfer of a single file. It turned out + to be due to two different flaws now fixed. Gil's excellent recipe helped me + nail this. + +Daniel Stenberg (11 Jan 2010) +- Made sure that the progress callback is repeatedly called at a regular + interval even during very slow connects. + +- The tests/runtests.pl script now checks to see if the test case that runs is + present in the tests/data/Makefile.am and outputs a notice message on the + screen if not. Each test file has to be included in that Makefile.am to get + included in release archives and forgetting to add files there is a common + mistake. This is an attempt to make it harder to forget. + +Daniel Stenberg (9 Jan 2010) +- Johan van Selst found and fixed a OpenSSL session ref count leak: + + ossl_connect_step3() increments an SSL session handle reference counter on + each call. When sessions are re-used this reference counter may be + incremented many times, but it will be decremented only once when done (by + Curl_ossl_session_free()); and the internal OpenSSL data will not be freed + if this reference count remains positive. When a session is re-used the + reference counter should be corrected by explicitly calling + SSL_SESSION_free() after each consecutive SSL_get1_session() to avoid + introducing a memory leak. + + (http://curl.haxx.se/bug/view.cgi?id=2926284) + +Daniel Stenberg (7 Jan 2010) +- Make sure the progress callback is called repeatedly even during very slow + name resolves when c-ares is used for resolving. + +Claes Jakobsson (6 Jan 2010) +- Julien Chaffraix fixed so that the fragment part in an URL is not sent + to the server anymore. + +Kamil Dudka (3 Jan 2010) +- Julien Chaffraix eliminated a duplicated initialization in singlesocket(). + +Daniel Stenberg (2 Jan 2010) +- Make curl support --ssl and --ssl-reqd instead of the previous FTP-specific + versions --ftp-ssl and --ftp-ssl-reqd as these options are now used to + control SSL/TLS for IMAP, POP3 and SMTP as well in addition to FTP. The old + option names are still working but the new ones are the ones listed and + documented. + +Daniel Stenberg (1 Jan 2010) +- Ingmar Runge enhanced libcurl's FTP engine to support the PRET command. This + command is a special "hack" used by the drftpd server, but even though it is + a custom extension I've deemed it fine to add to libcurl since this server + seems to survive and people keep using it and want libcurl to support + it. The new libcurl option is named CURLOPT_FTP_USE_PRET, and it is also + usable from the curl tool with --ftp-pret. Using this option on a server + that doesn't support this command will make libcurl fail. + + I added test cases 1107 and 1108 to verify the functionality. + + The PRET command is documented at + http://www.drftpd.org/index.php/Distributed_PASV + +Yang Tse (30 Dec 2009) +- Steven M. Schweda improved VMS build system, and Craig A. Berry helped + with the patch and testing. + +Daniel Stenberg (26 Dec 2009) +- Renato Botelho and Peter Pentchev brought a patch that makes the libcurl + headers work correctly even on FreeBSD systems before v8. + + (http://curl.haxx.se/bug/view.cgi?id=2916915) + +Daniel Stenberg (17 Dec 2009) +- David Byron fixed Curl_ossl_cleanup to actually call ENGINE_cleanup when + available. + +- Follow-up fix for the proxy fix I did for Jon Nelson's bug. It turned out I + was a bit too quick and broke test case 1101 with that change. The order of + some of the setups is sensitive. I now changed it slightly again to make + sure we do them in this order: + + 1 - parse URL and figure out what protocol is used in the URL + 2 - prepend protocol:// to URL if missing + 3 - parse name+password off URL, which needs to know what protocol is used + (since only some allows for name+password in the URL) + 4 - figure out if a proxy should be used set by an option + 5 - if no proxy option, check proxy environment variables + 6 - run the protocol-specific setup function, which needs to have the proxy + already set + +Daniel Stenberg (15 Dec 2009) +- Jon Nelson found a regression that turned out to be a flaw in how libcurl + detects and uses proxies based on the environment variables. If the proxy + was given as an explicit option it worked, but due to the setup order + mistake proxies would not be used fine for a few protocols when picked up + from '[protocol]_proxy'. Obviously this broke after 7.19.4. I now also added + test case 1106 that verifies this functionality. + + (http://curl.haxx.se/bug/view.cgi?id=2913886) + +Daniel Stenberg (12 Dec 2009) +- IMAP, POP3 and SMTP support and their TLS versions (including IMAPS, POP3S + and SMTPS) are now supported. The current state may not yet be solid, but + the foundation is in place and the test suite has some initial support for + these protocols. Work will now persue to make them nice libcurl citizens + until release. + + The work with supporting these new protocols was sponsored by + networking4all.com - thanks! + +Daniel Stenberg (10 Dec 2009) +- Siegfried Gyuricsko found out that the curl manual said --retry would retry + on FTP errors in the transient 5xx range. Transient FTP errors are in the + 4xx range. The code itself only tried on 5xx errors that occured _at login_. + Now the retry code retries on all FTP transfer failures that ended with a + 4xx response. + + (http://curl.haxx.se/bug/view.cgi?id=2911279) + +- Constantine Sapuntzakis figured out a case which would lead to libcurl + accessing alredy freed memory and thus crash when using HTTPS (with + OpenSSL), multi interface and the CURLOPT_DEBUGFUNCTION and a certain order + of cleaning things up. I fixed it. + + (http://curl.haxx.se/bug/view.cgi?id=2905220) + +Daniel Stenberg (7 Dec 2009) +- Martin Storsjo made libcurl use the Expect: 100-continue header for posts + with unknown size. Previously it was only used for posts with a known size + larger than 1024 bytes. + +Daniel Stenberg (1 Dec 2009) +- If the Expect: 100-continue header has been set by the application through + curl_easy_setopt with CURLOPT_HTTPHEADER, the library should set + data->state.expect100header accordingly - the current code (in 7.19.7 at + least) doesn't handle this properly. Martin Storsjo provided the fix! + +Yang Tse (28 Nov 2009) +- Added Diffie-Hellman parameters to several test harness certificate files in + PEM format. Required by several stunnel versions used by our test harness. + +Daniel Stenberg (28 Nov 2009) +- Markus Koetter provided a polished and updated version of Chad Monroe's TFTP + rework patch that now integrates TFTP properly into libcurl so that it can + be used non-blocking with the multi interface and more. BLKSIZE also works. + + The --tftp-blksize option was added to allow setting the TFTP BLKSIZE from + the command line. + +Daniel Stenberg (26 Nov 2009) +- Extended and fixed the change I did on Dec 11 for the the progress + meter/callback during FTP command/response sequences. It turned out it was + really lame before and now the progress meter SHOULD get called at least + once per second. + +Daniel Stenberg (23 Nov 2009) +- Bjorn Augustsson reported a bug which made curl not report any problems even + though it failed to write a very small download to disk (done in a single + fwrite call). It turned out to be because fwrite() returned success, but + there was insufficient error-checking for the fclose() call which tricked + curl to believe things were fine. + +Yang Tse (23 Nov 2009) +- David Byron modified Makefile.dist vc8 and vc9 targets in order to allow + finer granularity control when generating src and lib makefiles. + +Yang Tse (22 Nov 2009) +- I modified configure to force removal of the curlbuild.h file included in + distribution tarballs for use by non-configure systems. As intended, this + would get overwriten when doing in-tree builds. But VPATH builds would end + having two curlbuild.h files, one in the source tree and another in the + build tree. With the modification I introduced 5 Nov 2009 this could become + an issue when running libcurl's test suite. + +Daniel Stenberg (20 Nov 2009) +- Constantine Sapuntzakis identified a write after close, as the sockets were + closed by libcurl before the SSL lib were shutdown and they may write to its + socket. Detected to at least happen with OpenSSL builds. + +- Jad Chamcham pointed out a bug with connection re-use. If a connection had + CURLOPT_HTTPPROXYTUNNEL enabled over a proxy, a subsequent request using the + same proxy with the tunnel option disabled would still wrongly re-use that + previous connection and the outcome would only be badness. + +Yang Tse (18 Nov 2009) +- I modified the memory tracking system to make it intolerant with zero sized + malloc(), calloc() and realloc() function calls. + +Daniel Stenberg (17 Nov 2009) +- Constantine Sapuntzakis provided another fix for the DNS cache that could + end up with entries that wouldn't time-out: + + 1. Set up a first web server that redirects (307) to a http://server:port + that's down + 2. Have curl connect to the first web server using curl multi + + After the curl_easy_cleanup call, there will be curl dns entries hanging + around with in_use != 0. + + (http://curl.haxx.se/bug/view.cgi?id=2891591) + +- Marc Kleine-Budde fixed: curl saved the LDFLAGS set during configure into + its pkg-config file. So -Wl stuff ended up in the .pc file, which is really + bad, and breaks if there are multiple -Wl in our LDFLAGS (which are in + PTXdist). bug #2893592 (http://curl.haxx.se/bug/view.cgi?id=2893592) + +Kamil Dudka (15 Nov 2009) +- David Byron improved the configure script to use pkg-config to find OpenSSL + (and in particular the list of required libraries) even if a path is given + as argument to --with-ssl + +Yang Tse (15 Nov 2009) +- I removed enable-thread / disable-thread configure option. These were only + placebo options. The library is always built as thread safe as possible on + every system. + +Claes Jakobsson (14 Nov 2009) +- curl-config now accepts '--configure' to see what arguments was + passed to the configure script when building curl. + +Daniel Stenberg (14 Nov 2009) +- Claes Jakobsson restored the configure functionality to detect NSS when + --with-nss is set but not "yes". + + I think we can still improve that to check for pkg-config in that path etc, + but at least this patch brings back the same functionality we had before. + +- Camille Moncelier added support for the file type SSL_FILETYPE_ENGINE for + the client certificate. It also disable the key name test as some engines + can select a private key/cert automatically (When there is only one key + and/or certificate on the hardware device used by the engine) + +Yang Tse (14 Nov 2009) +- Constantine Sapuntzakis provided the fix that ensures that an SSL connection + won't be reused unless protection level for peer and host verification match. + + I refactored how preprocessor symbol _THREAD_SAFE definition is done. + +Kamil Dudka (12 Nov 2009) +- Kevin Baughman provided a fix preventing libcurl-NSS from crash on doubly + closed NSPR descriptor. The issue was hard to find, reported several times + before and always closed unresolved. More info at the RH bug: + https://bugzilla.redhat.com/534176 + +- libcurl-NSS now tries to reconnect with TLS disabled in case it detects + a broken TLS server. However it does not happen if SSL version is selected + manually. The approach was originally taken from PSM. Kaspar Brand helped me + to complete the patch. Original bug reports: + https://bugzilla.redhat.com/525496 + https://bugzilla.redhat.com/527771 + +Yang Tse (12 Nov 2009) +- I modified configure script to make the getaddrinfo function check also + verify if the function is thread safe. + +Yang Tse (11 Nov 2009) +- Marco Maggi reported that compilation failed when configured --with-gssapi + and GNU GSS installed due to a missing mutual exclusion of header files in + the Kerberos 5 code path. He also verified that my patch worked for him. + +Daniel Stenberg (11 Nov 2009) +- Constantine Sapuntzakis posted bug #2891595 + (http://curl.haxx.se/bug/view.cgi?id=2891595) which identified how an entry + in the DNS cache would linger too long if the request that added it was in + use that long. He also provided the patch that now makes libcurl capable of + still doing a request while the DNS hash entry may get timed out. + +- Christian Schmitz noticed that the progress meter/callback was not properly + used during the FTP connection phase (after the actual TCP connect), while + it of course should be. I also made the speed check get called correctly so + that really slow servers will trigger that properly too. + +Kamil Dudka (5 Nov 2009) +- Dropped misleading timeouts in libcurl-NSS and made sure the SSL socket works + in non-blocking mode. + +Yang Tse (5 Nov 2009) +- I removed leading 'curl' path on the 'curlbuild.h' include statement in + curl.h, adjusting auto-makefiles include path, to enhance portability to + OS's without an orthogonal directory tree structure such as OS/400. + +Daniel Stenberg (4 Nov 2009) +- I fixed several problems with the transfer progress meter. It showed the + wrong percentage for small files, most notable for <1000 bytes and could + easily end up showing more than 100% at the end. It also didn't show any + percentage, transfer size or estimated transfer times when transferring + less than 100 bytes. + +Version 7.19.7 (4 November 2009) + +Daniel Stenberg (2 Nov 2009) +- As reported independent by both Stan van de Burgt and Didier Brisebourg, + CURLINFO_SIZE_DOWNLOAD (the -w variable size_download) didn't work when + getting data from ldap! + +Daniel Stenberg (31 Oct 2009) +- Gabriel Kuri reported a problem with CURLINFO_CONTENT_LENGTH_DOWNLOAD if the + download was 0 bytes, as libcurl would then return the size as unknown (-1) + and not 0. I wrote a fix and test case 566 to verify it. + +Daniel Stenberg (30 Oct 2009) +- Liza Alenchery mentioned a problem with re-used SCP connection when a bad + auth is used, as it caused a crash. I failed to repeat the issue, but still + made a change that now forces the TCP connection used for a freed SCP + session to get closed and not be re-used. + +- "Tom" posted a bug report that mentioned how libcurl did wrong when doing a + POST using a read callback, with Digest authentication and + "Transfer-Encoding: chunked" enforced. I would then cause the first request + to be wrongly sent and then basically hang until the server closed the + connection. I fixed the problem and added test case 565 to verify it. + +Daniel Stenberg (25 Oct 2009) +- Dima Barsky made the curl cookie parser accept cookies even with blank or + unparsable expiry dates and then treat them as session cookies - previously + libcurl would reject cookies with a date format it couldn't parse. Research + shows that the major browser treat such cookies as session cookies. I + modified test 8 and 31 to verify this. + +Daniel Stenberg (21 Oct 2009) +- Attempt to use pkg-config for finding out libssh2 installation details + during configure. + +- A patch in bug report #2883177 (http://curl.haxx.se/bug/view.cgi?id=2883177) + by Johan van Selst introduced the --crlfile option to curl, which makes curl + tell libcurl about a file with CRL (certificate revocation list) data to + read. + +Daniel Stenberg (18 Oct 2009) +- Ray Dassen provided a patch in Debian's bug tracker (bug number #551461) + that now makes curl_getdate(3) actually handles RFC 822 formatted dates that + use the "single letter military timezones". + http://www.rfc-ref.org/RFC-TEXTS/822/chapter5.html has the details. + +- Fixed memory leak in the SCP/SFTP code as it never freed the knownhosts + data! + +- John Dennis filed bug report #2873666 + (http://curl.haxx.se/bug/view.cgi?id=2873666) which identified a problem + which made libcurl loop infinitely when given incorrect credentials when + using HTTP GSS negotiate authentication. He also provided a small and simple + patch for it. + +- Kevin Baughman found a double close() problem with libcurl-NSS, as when + libcurl called NSS to close the SSL "session" it also closed the actual + socket. + +Yang Tse (17 Oct 2009) +- Bug report #2866724 indicated + (http://curl.haxx.se/bug/view.cgi?id=2866724) that curl on Windows failed + when writing files whose file names originally contained characters which + are not valid for file names on Windows. Dan Fandrich provided an initial + patch and another revised one to fix this issue. + +Daniel Stenberg (1 Oct 2009) +- Tom Mueller correctly reported in bug report #2870221 + (http://curl.haxx.se/bug/view.cgi?id=2870221) that libcurl returned an + incorrect return code from the internal trynextip() function which caused + him grief. This is a regression that was introduced in 7.19.1 and I find it + strange it hasn't hit us harder, but I won't persue into figuring out + exactly why. + +- Constantine Sapuntzakis: The current implementation will always set + SO_SNDBUF to CURL_WRITE_SIZE even if the SO_SNDBUF starts out larger. The + patch doesn't do a setsockopt if SO_SNDBUF is already greater than + CURL_WRITE_SIZE. This should help folks who have set up their computer with + large send buffers. + +Daniel Stenberg (27 Sep 2009) +- I introduced a maximum limit for received HTTP headers. It is controlled by + the define CURL_MAX_HTTP_HEADER which is even exposed in the public header + file to allow for users to fairly easy rebuild libcurl with a modified + limit. The rationale for a fixed limit is that libcurl is realloc()ing a + buffer to be able to put a full header into it, so that it can call the + header callback with the entire header, but that also risk getting it into + trouble if a server by mistake or willingly sends a header that is more or + less without an end. The limit is set to 100K. + +Daniel Stenberg (26 Sep 2009) +- John P. McCaskey posted a bug report that showed how libcurl did wrong when + saving received cookies with no given path, if the path in the request had a + query part. That is means a question mark (?) and characters on the right + side of that. I wrote test case 1105 and fixed this problem. + +Kamil Dudka (26 Sep 2009) +- Implemented a protocol independent way to specify blocking direction, used by + transfer.c for blocking. It is currently used only by SCP and SFTP protocols. + This enhancement resolves an issue with 100% CPU usage during SFTP upload, + reported by Vourhey. + +Daniel Stenberg (25 Sep 2009) +- Chris Mumford filed bug report #2861587 + (http://curl.haxx.se/bug/view.cgi?id=2861587) identifying that libcurl used + the OpenSSL function X509_load_crl_file() wrongly and failed if it would + load a CRL file with more than one certificate within. This is now fixed. + +Daniel Stenberg (16 Sep 2009) +- Sven Anders reported that we introduced a cert verfication flaw for OpenSSL- + powered libcurl in 7.19.6. If there was a X509v3 Subject Alternative Name + field in the certficate it had to match and so even if non-DNS and non-IP + entry was present it caused the verification to fail. + +Daniel Fandrich (15 Sep 2009) +- Moved the libssh2 checks after the SSL library checks. This helps when + statically linking since libssh2 needs the SSL library link flags to be + set up already to satisfy its dependencies. This wouldn't be necessary if + the libssh2 configure check was changed to use pkg-config since the + --static flag would add the dependencies automatically. + +Yang Tse (14 Sep 2009) +- Revert Joshua Kwan's patch committed 11 Sep 2009. + + Some systems poll function sets POLLHUP in revents without setting + POLLIN, and sets POLLERR without setting POLLIN and POLLOUT. In some + libcurl code execution paths this could trigger busy wait loops with + high CPU usage until a timeout condition aborted the loop. + + The reverted patch addressed the above issue for a very specific case, + when awaiting c-ares to resolve. A libcurl-wide fix for Curl_poll now + superceeds this one. + +Guenter Knauf (11 Sep 2009) +- Joshua Kwan provided a patch to pass POLLERR / POLLHUP back to c-ares. + This fixes a loop problem with high CPU usage. + +Daniel Stenberg (10 Sep 2009) +- Claes Jakobsson fixed a problem with cookie expiry dates at exctly the epoch + start second "Thu Jan 1 00:00:00 GMT 1970" as the date parser then returns 0 + which internally then is treated as a session cookie. That particular date + is now made to get the value of 1. + +Daniel Stenberg (2 Sep 2009) +- Daniel Johnson found a flaw in the code converting sftp-errors to libcurl + errors. + +Daniel Stenberg (1 Sep 2009) +- Peter Sylvester made a debug feature for Curl_resolv() that now will force + libcurl to resolve 'localhost' whatever name you use in the URL *if* you set + the --interface option to (exactly) "LocalHost". This will enable us to + write tests for custom hosts names but still use a local host server. + +- configure now tries to use pkg-config for a number of sub-dependencies even + when cross-compiling. The key to success is then you properly setup + PKG_CONFIG_PATH before invoking configure. + + I also improved how NSS is detected by trying nss-config if pkg-config isn't + present, and as a last resort just use the lib name and force the user to + setup the LIBS/LDFLAGS/CFLAGS etc properly. The previous last resort would + add a range of various libs that would almost never be quite correct. + +Daniel Stenberg (31 Aug 2009) +- When using the multi interface with FTP and you asked for NOBODY, you did no + QUOTE commands and the request used the same path as the connection had + already changed to, it would decide that no commands would be necessary for + the "DO" action and that was not handled properly but libcurl would instead + hang. + +Kamil Dudka (28 Aug 2009) +- Improved error message for not matching certificate subject name in + libcurl-NSS. Originally reported at: + https://bugzilla.redhat.com/show_bug.cgi?id=516056#c9 + +Patrick Monnerat (24 Aug 2009) +- Introduced a SYST-based test to properly set-up name format when dealing + with the OS/400 FTP server. + +- Fixed an ftp_readresp() bug preventing detection of failing control socket + and causing FTP client to loop forever. + +Daniel Stenberg (24 Aug 2009) +- Marc de Bruin pointed out that configure --with-gnutls=PATH didn't work + properly and provided a fix. http://curl.haxx.se/bug/view.cgi?id=2843008 + +- Eric Wong introduced support for the new option -T. (dot) that makes curl + read stdin in a non-blocking fashion. This also brings back -T- (minus) to + the previous blocking behavior since it could break stuff for people at + times. + +Michal Marek (21 Aug 2009) +- With CURLOPT_PROXY_TRANSFER_MODE, avoid sending invalid URLs like + ftp://example.com;type=i if the user specified ftp://example.com without the + slash. + +Daniel Stenberg (21 Aug 2009) +- Andre Guibert de Bruet pointed out a missing return code check for a + strdup() that could lead to segfault if it returned NULL. I extended his + suggest patch to now have Curl_retry_request() return a regular return code + and better check that. + +- Lots of good work by Krister Johansen, mostly related to pipelining: + + Fix SIGSEGV on free'd easy_conn when pipe unexpectedly breaks + Fix data corruption issue with re-connected transfers + Fix use after free if we're completed but easy_conn not NULL + +Kamil Dudka (13 Aug 2009) +- Changed NSS code to not ignore the value of ssl.verifyhost and produce more + verbose error messages. Originally reported at: + https://bugzilla.redhat.com/show_bug.cgi?id=516056 + +Daniel Stenberg (12 Aug 2009) +- Karl Moerder fixed the Makefile.vc* makefiles to include the new file + nonblock.c so that they work fine again + +- I expanded test 517 with a bunch of more dates that originate from the + Chrome browser test suite. It turns out most of them get parsed the same + way. + +Version 7.19.6 (12 August 2009) + +Daniel Stenberg (12 Aug 2009) +- Carsten Lange reported a bug and provided a patch for TFTP upload and the + sending of the TSIZE option. I don't like fixing bugs just hours before + a release, but since it was broken and the patch fixes this for him I decided + to get it in anyway. + +Daniel Stenberg (11 Aug 2009) +- Peter Sylvester made the HTTPS test server use specific certificates for + each test, so that the test suite can now be used to actually test the + verification of cert names etc. This made an error show up in the OpenSSL- + specific code where it would attempt to match the CN field even if a + subjectAltName exists that doesn't match. This is now fixed and verified + in test 311. + +- Benbuck Nason posted the bug report #2835196 + (http://curl.haxx.se/bug/view.cgi?id=2835196), fixing a few compiler + warnings when mixing ints and bools. + +Daniel Fandrich (10 Aug 2009) +- Fixed a memory leak in the FTP code and an off-by-one heap buffer overflow. + +Daniel Fandrich (9 Aug 2009) +- Fixed some memory leaks in the command-line tool that caused most of the + torture tests to fail. + +Daniel Stenberg (2 Aug 2009) +- Curt Bogmine reported a problem with SNI enabled on a particular server. We + should introduce an option to disable SNI, but as we're in feature freeze + now I've addressed the obvious bug here (pointed out by Peter Sylvester): we + shouldn't try to enable SNI when SSLv2 or SSLv3 is explicitly selected. + Code for OpenSSL and GnuTLS was fixed. NSS doesn't seem to have a particular + option for SNI, or are we simply not using it? + +Daniel Stenberg (1 Aug 2009) +- Scott Cantor posted the bug report #2829955 + (http://curl.haxx.se/bug/view.cgi?id=2829955) mentioning the recent SSL cert + verification flaw found and exploited by Moxie Marlinspike. The presentation + he did at Black Hat is available here: + https://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Marlinspike + + Apparently at least one CA allowed a subjectAltName or CN that contain a + zero byte, and thus clients that assumed they would never have zero bytes + were exploited to OK a certificate that didn't actually match the site. Like + if the name in the cert was "example.com\0theatualsite.com", libcurl would + happily verify that cert for example.com. + + libcurl now better uses the length of the extracted name, not using the zero + termination for getting the string length. + + This fixing only made and needed in OpenSSL interfacing code. + +- Tanguy Fautre pointed out that OpenSSL's function RAND_screen() (present + only in some OpenSSL installs - like on Windows) isn't thread-safe and we + agreed that moving it to the global_init() function is a decent way to deal + with this situation. + +- Alexander Beedie provided the patch for a noproxy problem: If I have set + CURLOPT_NOPROXY to "*", or to a host that should not use a proxy, I actually + could still end up using a proxy if a proxy environment variable was set. + +Daniel Stenberg (27 Jul 2009) +- All the quote options (CURLOPT_QUOTE, CURLOPT_POSTQUOTE and + CURLOPT_PREQUOTE) now accept a preceeding asterisk before the command to + send when using FTP, as a sign that libcurl shall simply ignore the response + from the server instead of treating it as an error. Not treating a 400+ FTP + response code as an error means that failed commands will not abort the + chain of commands, nor will they cause the connection to get disconnected. + +Daniel Stenberg (26 Jul 2009) +- Johan van Selst posted bug report #2825989 + (http://curl.haxx.se/bug/view.cgi?id=2825989) pointing out that + OpenSSL-powered libcurl didn't support the SHA-2 digest algorithm, and + provided the solution too: to use OpenSSL_add_all_algorithms() in addition + to the older SSLeay_* alternative. OpenSSL_add_all_algorithms was added in + OpenSSL 0.9.5 + +Daniel Stenberg (23 Jul 2009) +- Added CURLOPT_SSH_KNOWNHOSTS, CURLOPT_SSH_KEYFUNCTION, CURLOPT_SSH_KEYDATA. + They introduce known_host support for SSH keys to libcurl. See docs for + details. Note that this feature depends on a new enough libssh2 version, to + be supported in libssh2 1.2 and later (or current git repo at this time). + +Michal Marek (22 Jul 2009) +- David Binderman found a memory and fd leak in lib/gtls.c:load_file() + (https://bugzilla.novell.com/523919). When looking at the code, I found that + also the ptr pointer can leak. + +Kamil Dudka (20 Jul 2009) +- Claes Jakobsson improved the support for client certificates handling in + NSS-powered libcurl. Now the client certificates can be selected + automatically by a NSS built-in hook. Additionally pre-login to all PKCS11 + slots is no more performed. It used to cause problems with HW tokens. + +- Fixed reference counting for NSS client certificates. Now the PEM reader + module should be always properly unloaded on Curl_nss_cleanup(). If the + unload fails though, libcurl will try to reuse the already loaded instance. + +Daniel Fandrich (15 Jul 2009) +- Added nonblock.c to the non-automake makefiles (note that the dependencies + in the Watcom makefiles aren't quite correct). + +Michal Marek (15 Jul 2009) +- Changed the description of CURLINFO_OS_ERRNO to make it clear that the + errno is not reset on success. + +Guenter Knauf (14 Jul 2009) +- renamed generated config.h to curl_config.h to avoid any future clashes + with config.h from other projects. + +Daniel Stenberg (9 Jul 2009) +- Eric Wong introduced curlx_nonblock() that the curl tool now (re-)uses for + setting a file descriptor non-blocking. Used by the functionality Eric + himself brough on June 15th. + +Daniel Stenberg (8 Jul 2009) +- Constantine Sapuntzakis posted bug report #2813123 + (http://curl.haxx.se/bug/view.cgi?id=2813123) and an a patch that fixes the + problem: + + Url A is accessed using auth. Url A redirects to Url B (on a different + server0. Url B reuses a persistent connection. Url B has auth, even though + it's on a different server. + + Note: if Url B does not reuse a persistent connection, auth is not sent. + + reason: + + data->state.first_host is not initialized becuase Curl_http_connect is not + called when a connection is reused. + + Solution: + + move initialization of data->state.first_host to Curl_http. No code before + Curl_http uses data->state.first_host anyway. + +Guenter Knauf (4 Jul 2009) +- Markus Koetter provided a patch to avoid getnameinfo() usage which broke a + couple of both IPv4 and IPv6 autobuilds. + +Daniel Stenberg (29 Jun 2009) +- Markus Koetter made CURLOPT_FTPPORT (and curl's -P/--ftpport) support a port + range if given colon-separated after the host name/address part. Like + "192.168.0.1:2000-10000" + +- Modified the separators used for CURLOPT_CERTINFO in multi-part outputs. I + don't know how they got wrong in the first place, but using this output + format makes it possible to quite easily separate the string into an array + of multiple items. + +Daniel Fandrich (16 June 2009) +- Added a few more compiler warning options for gcc. + +Daniel Stenberg (16 Jun 2009) +- Reuven Wachtfogel made curl -o - properly produce a binary output on windows + (no newline translations). Use -B/--use-ascii if you rather get the ascii + approach. + +Michal Marek (16 Jun 2009) +- When doing non-anonymous ftp via http proxies and the password is not + provided in the url, add it there (squid needs this). + +Daniel Stenberg (15 Jun 2009) +- Eric Wong's patch: + + This allows curl(1) to be used as a client-side tunnel for arbitrary stream + protocols by abusing chunked transfer encoding in both the HTTP request and + HTTP response. This requires server support for sending a response while a + request is still being read, of course. + + If attempting to read from stdin returns EAGAIN, then we pause our sender. + This leaves curl to attempt to read from the socket while reading from stdin + (and thus sending) is paused. + + This change was needed to allow successfully tunneling the git protocol over + HTTP (--no-buffer is needed, as well). + +Patrick Monnerat (15 Jun 2009) +- Replaced use of standard C library rand()/srand() by our own pseudo-random + number generator. + +Yang Tse (11 Jun 2009) +- I adapted testcurl script to allow building test harness programs when + cross-compiling for a *-*-mingw* host. + +Daniel Stenberg (10 Jun 2009) +- Fabian Keil ran clang on the (lib)curl code, found a bunch of warnings and + contributed a range of patches to fix them. + +Yang Tse (10 Jun 2009) +- I introduced configure script option --enable-curldebug which now allows + the decoupled enabling or disabling of the curl debug memory tracking + feature from the --enable-debug option which no longer controls this. + + curl --version will list 'Debug' feature for debug enabled builds, and + will list 'TrackMemory' feature for curl debug memory tracking capable + builds. These features are independent and can be controlled when running + the configure script. When --enable-debug is given both features will be + enabled, unless some restriction prevents memory tracking from being used. + + Internally, definition of preprocessor symbol DEBUGBUILD restricts code + which is only compiled for debug enabled builds. And symbol CURLDEBUG is + used to differentiate code which is _only_ used for memory tracking. + +Yang Tse (9 Jun 2009) +- Daniel Steinberg pointed out that Curl_FormInit() in formdata.c was not + initializing the fread callback pointer and this triggered a compiler + warning, also provided a friendly suggestion on how to fix it. + +Daniel Stenberg (8 Jun 2009) +- Claes Jakobsson provided a patch for libcurl-NSS that fixed a bad refcount + issue with client certs that caused issues like segfaults. + http://curl.haxx.se/mail/lib-2009-05/0316.html + +- Triggered by bug report #2798852 and the patch in there, I fixed configure + to detect gnutls build options with pkg-config only and not libgnutls-config + anymore since GnuTLS has stopped distributing that tool. If an explicit path + is given to configure, we will instead guess on how to link and use that + lib. I did not use the patch from the bug report. + +Yang Tse (8 Jun 2009) +- Igor Novoseltsev adjusted Makefile.vxworks to get sources and headers + included from Makefile.inc, and provided docs\INSTALL VxWorks section. + +- I removed buildconf.bat from release and daily snapshot archives. This + file is only for CVS tree checkout builds. + +Daniel Stenberg (8 Jun 2009) +- Eric Wong fixed --no-buffer to actually switch off output buffering. Been + broken since 7.19.0 + +Bill Hoffman (6 Jun 2009) +- Added some cmake docs and fixed socklen_t in the build. + +Yang Tse (5 Jun 2009) +- John E. Malmberg provided VMS specific patch: "This fixes an existing bug + in urlglob.c where it was not converting the Curl Unix exit code to a VMS + DCL compatible exit code. This fix required the enhancement described next. + This also adds an enhancement to main.c so that when curl is run under a + Unix shell like Bash on VMS, it will return the standard Unix exit codes + and messages." And another patch for docs/examples. + + I introduced os-specific.c and os-specific.h for use in curl tool code + and adjusted John E. Malmberg's patch placement to use these new files + as an effort to prevent main.c from growing ad infinitum. Code already + existing in main.c which is OS specific should be moved into these files. + +Daniel Stenberg (4 June 2009) +- Setting the Content-Length: header from your app when you do a POST or PUT + is almost always a VERY BAD IDEA. Yet there are still apps out there doing + this, and now recently it triggered a bug/side-effect in libcurl as when + libcurl sends a POST or PUT with NTLM, it sends an empty post first when it + knows it will just get a 401/407 back. If the app then replaced the + Content-Length header, it caused the server to wait for input that libcurl + wouldn't send. Aaron Oneal reported this problem in bug report #2799008 + (http://curl.haxx.se/bug/view.cgi?id=2799008) and helped us verify the fix. + +Yang Tse (4 Jun 2009) +- Igor Novoseltsev provided patches and information, that after some + adjustments to better fit curl's way of doing things, have resulted + in the posibility of building libcurl for VxWorks. + +Daniel Fandrich (2 June 2009) +- Checked in a Google Android make file. To use it, you must first + create a config.h file by running configure in the Android environment, + which doesn't seem to be easy to do. If no easy way can be found, a + static config-android.h may need to be created and checked in to the + libcurl source tree. + +Daniel Stenberg (1 June 2009) +- Claes Jakobsson fixed the configure script to better find and use NSS + without pkg-config. + +Yang Tse (1 Jun 2009) +- John E. Malmberg provided a VMS specific clean-up for curl.h, and pointed + out that the configure script was failing to detect the timeval struct on + VMS when building with _XOPEN_SOURCE_EXTENDED undefined due to definition + taking place in socket.h instead of time.h. I have adjusted configure + script to also include this header when checking struct timeval. + +Daniel Stenberg (27 May 2009) +- Frank McGeough provided a small OpenSSL #include fix to make libcurl compile + fine with Nokia 5th edition 1.0 SDK for Symbian. + +- Andre Guibert de Bruet found a call to a OpenSSL function that didn't check + for a failure properly. + +- Mike Crowe pointed out that setting CURLOPT_USERPWD to NULL used to clear + the auth credentials back in 7.19.0 and earlier while now you have to set "" + to get the same effect. His patch brings back the ability to use NULL. + +- Claes Jakobsson fixed libcurl-NSS to build fine even without the + PK11_CreateGenericObject() function. + +Daniel Stenberg (25 May 2009) +- bug report #2796358 (http://curl.haxx.se/bug/view.cgi?id=2796358) pointed + out that the cookie parser would leak memory when it parses cookies that are + received with domain, path etc set multiple times in the same header. While + such a cookie is questionable, they occur in the wild and libcurl no longer + leaks memory for them. I added such a header to test case 8. + +Daniel Fandrich (22 May 2009) +- Removed some obsolete digest code that caused a valgrind error in test 551. + +Daniel Fandrich (20 May 2009) +- Added "non-existing host" test keywords to make it easy to skip those + tests on machines that have broken DNS configurations (such as + those configured to use OpenDNS). + +Daniel Stenberg (19 May 2009) +- Kamil Dudka brought the patch from the Redhat bug entry + https://bugzilla.redhat.com/show_bug.cgi?id=427966 which was libcurl closing + a bad file descriptor when closing down the FTP data connection. Caolan + McNamara seems to be the original author of it. + +Version 7.19.5 (18 May 2009) + +Daniel Stenberg (17 May 2009) +- James Bursa posted a patch to the mailing list that fixed a problem with + no_proxy which made it not skip the proxy if the URL entered contained a + user name. I added test case 1101 to verify. + +Daniel Stenberg (11 May 2009) +- Balint Szilakszi reported a memory leak when libcurl did gzip decompression + of streams that had some parts (legitimately) missing. We now provide and use + a proper cleanup function for the content encoding submodule. + http://curl.haxx.se/mail/lib-2009-05/0092.html + +- Kamil Dudka provided a fix for libcurl-NSS reported by Michael Cronenworth + at https://bugzilla.redhat.com/show_bug.cgi?id=453612#c12 + + If an incorrect password is given while loading a private key, libcurl ends + up in an infinite loop consuming memory. The bug is critical. + +- I fixed the problem with doing NTLM, POST and then following a 302 redirect, + as reported by Ebenezer Ikonne (on curl-users) and Laurent Rabret (on + curl-library). The transfer was mistakenly marked to get more data to send + but since it didn't actually have that, it just hung there... + +Daniel Stenberg (10 May 2009) +- Andre Guibert de Bruet correctly pointed out an over-alloc with one wasted + byte in the digest code. + +Yang Tse (9 May 2009) +- Removed DOS and TPF package's subdirectory Makefile.am, it was only used + to include some files in the distribution tarball serving no other purpose. + Files from the DOS and TPF subdirectories are now included in the EXTRA_DIST + of the Makefile in the parent subdirectory. + +Yang Tse (8 May 2009) +- Changed host name literal in several tests to one under the haxx.se domain. + +- Renamed vc6 workspace and project files to avoid filename clash when used + for conversion to later VS versions. + +Daniel Stenberg (8 May 2009) +- Constantine Sapuntzakis fixed bug report #2784055 + (http://curl.haxx.se/bug/view.cgi?id=2784055) identifying a problem to + connect to SOCKS proxies when using the multi interface. It turned out to + almost not work at all previously. We need to wait for the TCP connect to + be properly verified before doing the SOCKS magic. + + There's still a flaw in the FTP code for this. + +Daniel Stenberg (7 May 2009) +- Made the SO_SNDBUF setting for the data connection socket for ftp uploads as + well. See change 28 Apr 2009. + +Yang Tse (7 May 2009) +- Fixed an issue affecting FTP transfers, introduced with the transfer.c + patch committed May 4. + +Daniel Stenberg (7 May 2009) +- Man page *roff problems fixed thanks to input from Colin Watson. Problems + reported in the Debian package. + +- Vijay G filed bug report #2723236 + (http://curl.haxx.se/bug/view.cgi?id=2723236) identifying a problem with + libcurl's TFTP code and its lack of dealing with the OACK packet. + +Yang Tse (5 May 2009) +- Fixed the --ftp-port address of test #251 to the CLIENTIP address, and + reverted the change affecting test suite harness committed 4 May. + +Daniel Stenberg (5 May 2009) +- Inspired by Michael Smith's session id fix for OpenSSL, I did the + corresponding fix in the GnuTLS code: make sure to store the new session id + in case the previous re-used one is rejected. + +Daniel Stenberg (4 May 2009) +- Michael Smith posted bug report #2786255 + (http://curl.haxx.se/bug/view.cgi?id=2786255) with a patch, identifying how + libcurl did not deal with SSL session ids properly if the server rejected a + re-use of one. Starting now, it will forget the rejected one and remember + the new. This change was for OpenSSL only, it is likely that other SSL lib + code needs similar fixes. + +Yang Tse (4 May 2009) +- Applied David McCreedy's "transfer.c fixes for CURL_DO_LINEEND_CONV and + non-ASCII platform HTTP requests" patch addressing two HTTP PUT problems: + 1) On non-ASCII platforms not all of the protocol portions of the PUT are + being translated to ASCII. 2) On all platforms the line endings of part of + the protocol portions are mangled from CRLF to CRCRLF if data->set.crlf or + data->set.prefer_ascii are set (depending on CURL_DO_LINEEND_CONV). + +- Applied David McCreedy's patch to fix test suite harness to allow test FTP + server and client on different machines, providing FTP client address when + running the FTP test server. + +Daniel Fandrich (3 May 2009) +- Added and disabled test case 563 which shows KNOWN_BUGS #59. The bug + report failed to mention that a proxy must be used to reproduce it. + +Yang Tse (2 May 2009) +- Use a build-time configured curl_socklen_t data type instead of socklen_t. + +Yang Tse (1 May 2009) +- Applied David McCreedy's patches "TPF-platform specific changes to various + files" and "http.c fix to Curl_proxyCONNECT for non-ASCII platforms", the + former with minor edits. + +Daniel Stenberg (30 Apr 2009) +- I was going to fix issue #59 in KNOWN_BUGS + + If the CURLOPT_PORT option is used on an FTP URL like + "ftp://example.com/file;type=A" the ";type=A" is stripped off. + + I added test case 562 to verify, only to find out that I couldn't repeat + this bug so I hereby consider it not a bug anymore! + +Daniel Stenberg (29 Apr 2009) +- Based on bug report #2723219 (http://curl.haxx.se/bug/view.cgi?id=2723219) + I've now made TFTP "connections" not being kept for re-use within libcurl. + TFTP is UDP-based so the benefit was really low (if even existing) to begin + with so instead of tracking down to fix this problem we instead removed the + re-use. I also enabled test case 1099 that I wrote a few days ago to verify + that this change fixes the reported problem. + +Daniel Stenberg (28 Apr 2009) +- Constantine Sapuntzakis filed bug report #2783090 + (http://curl.haxx.se/bug/view.cgi?id=2783090) pointing out that on windows + we need to grow the SO_SNDBUF buffer somewhat to get really good upload + speeds. http://support.microsoft.com/kb/823764 has the details. Friends + confirmed that simply adding 32 to CURL_MAX_WRITE_SIZE is enough. + +- Bug report #2709004 (http://curl.haxx.se/bug/view.cgi?id=2709004) by Tim + Chen pointed out how curl couldn't upload with resume when reading from a + pipe. + + This ended up with the introduction of a new return code for the + CURLOPT_SEEKFUNCTION callback that basically says that the seek failed but + that libcurl may try to resolve the situation anyway. In our case this means + libcurl will attempt to instead read that much data from the stream instead + of seeking and that way curl can now upload with resume when data is read + from a stream! + +Daniel Stenberg (26 Apr 2009) +- Bug report #2779733 (http://curl.haxx.se/bug/view.cgi?id=2779733) by Sven + Wegener pointed out that CURLINFO_APPCONNECT_TIME didn't work with the multi + interface and provided a patch that fixed the problem! + +Daniel Stenberg (24 Apr 2009) +- Kamil Dudka fixed another NSS-related leak when client certs were used. + +- Bug report #2779245 (http://curl.haxx.se/bug/view.cgi?id=2779245) by Rainer + Koenig pointed out that the man page didn't tell that the *_proxy + environment variables can be specified lower case or UPPER CASE and the + lower case takes precedence, + +Daniel Fandrich (21 Apr 2009) +- Added new libcurl source files to Amiga, RiscOS and VC6 build files. + +Yang Tse (21 Apr 2009) +- Moved potential inclusion of system's malloc.h and memory.h header files to + setup_once.h. Inclusion of each header file is based on the definition of + NEED_MALLOC_H and NEED_MEMORY_H respectively. + + Renamed libcurl's memory.h to curl_memory.h + +Daniel Stenberg (20 Apr 2009) +- Leanic Lefever reported a crash and did some detailed research on why and + how it occurs (http://curl.haxx.se/mail/lib-2009-04/0289.html). The + conclusion was that if an error is detected and Curl_done() is called for + the connection, ftp_done() could at times return another error code that + then would take precedence and that new code confused existing logic that + works for the first error code (CURLE_SEND_ERROR) only. + +- Gisle Vanem noticed that --libtool would produce bogus strings at times for + OBJECTPOINT options. Now we've introduced a new function - my_setopt_str - + within the app for setting plain string options to avoid the risk of this + mistake happening. + +Daniel Stenberg (17 Apr 2009) +- Pramod Sharma reported and tracked down a bug when doing FTP over a HTTP + proxy. libcurl would then wrongly close the connection after each + request. In his case it had the weird side-effect that it killed NTLM auth + for the proxy causing an inifinite loop! + + I added test case 1098 to verify this fix. The test case does however not + properly verify that the transfers are done persistently - as I couldn't + think of a clever way to achieve it right now - but you need to read the + stderr output after a test run to see that it truly did the right thing. + +Daniel Stenberg (13 Apr 2009) +- bug report #2727981 (http://curl.haxx.se/bug/view.cgi?id=2727981) by Martin + Storsjö pointed out how setting CURLOPT_NOBODY to 0 could be downright + confusing as it set the method to either GET or HEAD. The example he showed + looked like: + + curl_easy_setopt(curl, CURLOPT_PUT, 1); + curl_easy_setopt(curl, CURLOPT_NOBODY, 0); + + The new way doesn't alter the method until the request is about to start. If + CURLOPT_NOBODY is then 1 the HTTP request will be HEAD. If CURLOPT_NOBODY is + 0 and the request happens to have been set to HEAD, it will then instead be + set to GET. I believe this will be less surprising to users, and hopefully + not hit any existing users badly. + +- Toshio Kuratomi reported a memory leak problem with libcurl+NSS that turned + out to be leaking cacerts. Kamil Dudka helped me complete the fix. The issue + is found in Redhat's bug tracker: + https://bugzilla.redhat.com/show_bug.cgi?id=453612 + + There are still memory leaks present, but they seem to have other reasons. + +Daniel Fandrich (11 Apr 2009) +- Added new libcurl source files to Symbian OS build files. +- Improved Symbian support for SSL. + +Yang Tse (10 Apr 2009) +- Daniel Johnson improved the MacOSX-Framework shell script to now perform all + the steps required to build a Mac OS X four way fat ppc/i386/ppc64/x86_64 + libcurl.framework. Four way fat framework requires OS X 10.5 SDK or later. + +Yang Tse (8 Apr 2009) +- Removed Sun compilers preprocessor block from curlbuild.h.dist, this also + removes it from the curlbuild.h file originally distributed by the cURL + project as this file is intended for systems not capable of running the + configure script. For those who have been building curl out of the source + code curl distribution tarball provided by curl.haxx.se the change implies + nothing. Previous change in this area committed 2 Apr becomes irrelevant. + +Daniel Stenberg (6 Apr 2009) +- I clarified in the docs that CURLOPT_SEEKFUNCTION should return 0 on success + and 1 on fatal errors. Previously it only mentioned non-zero on fatal + errors. This is a slight change in meaning, but it follows what we've done + elsewhere before and it opens up for LOTS of more useful return codes + whenever we can think of them... + +Yang Tse (2 Apr 2009) +- Fix curl_off_t definition for builds done using Sun compilers and a + non-configured libcurl. In this case curl_off_t data type was gated + to the off_t data type which depends on the _FILE_OFFSET_BITS. This + configuration is exactly the unwanted configuration for our curl_off_t + data type which must not depend on such setting. This breaks ABI for + libcurl libraries built with Sun compilers which were built without + having run the configure script with _FILE_OFFSET_BITS different than + 64 and using the ILP32 data model. + +Daniel Stenberg (1 Apr 2009) +- Andre Guibert de Bruet fixed a NULL pointer use in an infof() call if a + strdup() call failed. + +Daniel Fandrich (31 Mar 2009) +- Properly return an error code in curl_easy_recv (reported by Jim Freeman). + +Daniel Stenberg (18 Mar 2009) +- Kamil Dudka brought a patch that enables 6 additional crypto algorithms when + NSS is used. These ciphers were added in NSS 3.4 and require to be enabled + explicitly. + +Daniel Stenberg (13 Mar 2009) +- Use libssh2_version() to present the libssh2 version in case the libssh2 + library is found to support it. + +Yang Tse (12 Mar 2009) +- Added missing Curl_read() return code checking in TELNET transfers. + +- Pierre Brico found and fixed TELNET transfers not being aborted upon + a write callback failure. + +Daniel Stenberg (11 Mar 2009) +- Kamil Dudka made the curl tool properly call curl_global_init() before any + other libcurl function. + +Yang Tse (11 Mar 2009) +- Added missing TELNET timeout support for Windows builds. This issue was + reported by Pierre Brico. + +Daniel Stenberg (9 Mar 2009) +- Frank Hempel found out a bug and provided the fix: + + curl_easy_duphandle did not necessarily duplicate the CURLOPT_COOKIEFILE + option. It only enabled the cookie engine in the destination handle if + data->cookies is not NULL (where data is the source handle). In case of a + newly initialized handle which just had the cookie support enabled by a + curl_easy_setopt(handle, CURL_COOKIEFILE, "")-call, handle->cookies was + still NULL because the setopt-call only appends the value to + data->change.cookielist, hence duplicating this handle would not have the + cookie engine switched on. + + We also concluded that the slist-functionality would be suitable for being + put in its own module rather than simply hanging out in lib/sendf.c so I + created lib/slist.[ch] for them. + +- Andreas Farber made the 'buildconf' script check for the presence of m4 + scripts to make it detect a bad checkout earlier. People with older + checkouts who don't do cvs update with the -d option won't get the new dirs + and then will get funny outputs that can be a bit hard to understand and + fix. + +Daniel Stenberg (8 Mar 2009) +- Andre Guibert de Bruet found and fixed a code segment in ssluse.c where the + allocation of the memory BIO was not being properly checked. + +- Andre Guibert de Bruet fixed the gnutls-using code: There are a few places + in the gnutls code where we were checking for negative values for errors, + when the man pages state that GNUTLS_E_SUCCESS is returned on success and + other values indicate error conditions. + +- Bill Egert pointed out (http://curl.haxx.se/bug/view.cgi?id=2671602) that + curl didn't use sprintf() in a way that is documented to work in POSIX but + since we use our own printf() code (from libcurl) that shouldn't be a + problem. Nonetheless I modified the code to not rely on such particular + features and to not cause further raised eyebrowse with no good reason. + +Daniel Fandrich (5 Mar 2009) +- Expanded the security section of the libcurl-tutorial man page to cover + more issues for authors to consider when writing robust libcurl-using + applications. + +Yang Tse (5 Mar 2009) +- Fixed NTLM authentication memory leak on SSPI enabled Windows builds. This + issue was noticed by Chris Deidun. + +Daniel Fandrich (4 Mar 2009) +- Fixed a problem with m4 quoting in the OpenSSL configure check reported + by Daniel Johnson. + +Daniel Stenberg (3 Mar 2009) +- David James brought a patch that make libcurl close (all) dead connections + whenever you attempt to open a new connection. + + 1. After cleaning up a dead connection, "continue" instead of + returning FALSE. This ensures that we clean up all dead connections, + rather than just cleaning up the first dead connection. + 2. Move up the cleanup for dead connections so that it occurs for + all connections, rather than just the connections which have the same + preferences as our current new connection. + +Version 7.19.4 (3 March 2009) + +Daniel Stenberg (3 Mar 2009) +- David Kierznowski notified us about a security flaw + (http://curl.haxx.se/docs/adv_20090303.html also known as CVE-2009-0037) in + which previous libcurl versions (by design) can be tricked to access an + arbitrary local/different file instead of a remote one when + CURLOPT_FOLLOWLOCATION is enabled. This flaw is now fixed in this release + together this the addition of two new setopt options for controlling this + new behavior: + + o CURLOPT_REDIR_PROTOCOLS controls what protocols libcurl is allowed to + follow to when CURLOPT_FOLLOWLOCATION is enabled. By default, this option + excludes the FILE and SCP protocols and thus you nee to explicitly allow + them in your app if you really want that behavior. + + o CURLOPT_PROTOCOLS controls what protocol(s) libcurl is allowed to fetch + using the primary URL option. This is useful if you want to allow a user or + other outsiders control what URL to pass to libcurl and yet not allow all + protocols libcurl may have been built to support. + +Daniel Stenberg (27 Feb 2009) +- Senthil Raja Velu reported a problem when CURLOPT_INTERFACE and + CURLOPT_LOCALPORT were used together (the local port bind failed), and + Markus Koetter provided the fix! + +Daniel Stenberg (25 Feb 2009) +- As Daniel Fandrich figured out, we must do the GnuTLS initing in the + curl_global_init() function to properly maintain the performing functions + thread-safe. We've previously (28 April 2007) moved the init to a later time + just to avoid it to fail very early when libgcrypt dislikes the situation, + but that move was bad and the fix should rather be in libgcrypt or + elsewhere. + +Daniel Stenberg (24 Feb 2009) +- Brian J. Murrell found out that Negotiate proxy authentication didn't work. + It happened because the code used the struct for server-based auth all the + time for both proxy and server auth which of course was wrong. + +Daniel Stenberg (23 Feb 2009) +- After a bug reported by James Cheng I've made curl_easy_getinfo() for + CURLINFO_CONTENT_LENGTH_DOWNLOAD and CURLINFO_CONTENT_LENGTH_UPLOAD return + -1 if the sizes aren't know. Previously these returned 0, make it impossible + to detect the difference between actually zero and unknown. + +Yang Tse (23 Feb 2009) +- Daniel Johnson provided a shell script that will perform all the steps needed + to build a Mac OS X fat ppc/i386 or ppc64/x86_64 libcurl.framework + +Daniel Stenberg (23 Feb 2009) +- I renamed everything in the windows builds files that used the name 'curllib' + to the proper 'libcurl' as clearly this caused confusion. + +Yang Tse (20 Feb 2009) +- Do not halt compilation when using VS2008 to build a Windows 2000 target. + +Daniel Stenberg (20 Feb 2009) +- Linus Nielsen Feltzing reported and helped me repeat and fix a problem with + FTP with the multi interface: when a transfer fails, like when aborted by a + write callback, the control connection was wrongly closed and thus not + re-used properly. + + This change is also an attempt to cleanup the code somewhat in this area, as + now the FTP code attempts to keep (better) track on pending responses + necessary to get read in ftp_done(). + +Daniel Stenberg (19 Feb 2009) +- Patrik Thunstrom reported a problem and helped me repeat it. It turned out + libcurl did a superfluous 1000ms wait when doing SFTP downloads! + + We read data with libssh2 while doing the "DO" operation for SFTP and then + when we were about to start getting data for the actual file part, the + "TRANSFER" part, we waited for socket action (in 1000ms) before doing a + libssh2-read. But in this case libssh2 had already read and buffered the + data so we ended up always just waiting 1000ms before we get working on the + data! + +Patrick Monnerat (18 Feb 2009) +- FTP downloads (i.e.: RETR) ending with code 550 now return error + CURLE_REMOTE_FILE_NOT_FOUND instead of CURLE_FTP_COULDNT_RETR_FILE. + +Daniel Stenberg (17 Feb 2009) +- Kamil Dudka made NSS-powered builds compile and run again! + +- A second follow-up change by Andre Guibert de Bruet to fix a related memory + leak like that fixed on the 14th. When zlib returns failure, we need to + cleanup properly before returning error. + +- CURLOPT_FTP_CREATE_MISSING_DIRS can now be set to 2 in addition to 1 for + plain FTP connections, and it will then allow MKD to fail once and retry the + CWD afterwards. This is especially useful if you're doing many simultanoes + connections against the same server and they all have this option enabled, + as then CWD may first fail but then another connection does MKD before this + connection and thus MKD fails but trying CWD works! The numbers can + (should?) now be set with the convenience enums now called + CURLFTP_CREATE_DIR and CURLFTP_CREATE_DIR_RETRY. + + Tests has proven that if you're making an application that uploads a set of + files to an ftp server, you will get a noticable gain in speed if you're + using multiple connections and this option will be then be very useful. + +Daniel Stenberg (14 Feb 2009) +- Andre Guibert de Bruet found and fixed a memory leak in the content encoding + code, which could happen on libz errors. + +Daniel Fandrich (12 Feb 2009) +- Added support for Digest and NTLM authentication using GnuTLS. + +Daniel Stenberg (11 Feb 2009) +- CURLINFO_CONDITION_UNMET was added to allow an application to get to know if + the condition in the previous request was unmet. This is typically a time + condition set with CURLOPT_TIMECONDITION and was previously not possible to + reliably figure out. From bug report #2565128 + (http://curl.haxx.se/bug/view.cgi?id=2565128) filed by Jocelyn Jaubert. + +Daniel Fandrich (4 Feb 2009) +- Don't add the standard /usr/lib or /usr/include paths to LDFLAGS and CPPFLAGS + (respectively) when --with-ssl=/usr is used (patch based on FreeBSD). + +- Added an explicit buffer limit check in msdosify() (patch based on FreeBSD). + This couldn't ever overflow in curl, but might if the code were used + elsewhere or under different conditions. + +Daniel Stenberg (3 Feb 2009) +- Hidemoto Nakada provided a small fix that makes it possible to get the + CURLINFO_CONTENT_LENGTH_DOWNLOAD size from file:// "transfers" with + CURLOPT_NOBODY set true. + +Daniel Stenberg (2 Feb 2009) +- Patrick Scott found a rather large memory leak when using the multi + interface and setting CURLMOPT_MAXCONNECTS to something less than the number + of handles you add to the multi handle. All the connections that didn't fit + in the cache would not be properly disconnected nor freed! + +- Craig A West brought us: libcurl now defaults to do CONNECT with HTTP + version 1.1 instead of 1.0 like before. This change also introduces the new + proxy type for libcurl called 'CURLPROXY_HTTP_1_0' that then allows apps to + switch (back) to CONNECT 1.0 requests. The curl tool also got a --proxy1.0 + option that works exactly like --proxy but sets CURLPROXY_HTTP_1_0. + + I updated all test cases cases that use CONNECT and I tried to do some using + --proxy1.0 and some updated to do CONNECT 1.1 to get both versions run. + +Daniel Stenberg (31 Jan 2009) +- When building with c-ares 1.6.1 (not yet released) or later and IPv6 support + enabled, we can now take advantage of its brand new AF_UNSPEC support in + ares_gethostbyname(). This makes test case 241 finally run fine for me with + this setup since it now parses the "::1 ip6-localhost" line fine in my + /etc/hosts file! + +Daniel Stenberg (30 Jan 2009) +- Scott Cantor filed bug report #2550061 + (http://curl.haxx.se/bug/view.cgi?id=2550061) mentioning that I failed to + properly make sure that the VC9 makefiles got included in the latest + release. I've now fixed the release script and verified it so next release + will hopefully include them properly! + +Daniel Fandrich (30 Jan 2009) +- Fixed --disable-proxy for FTP and SOCKS. Thanks to Daniel Egger for + reporting. + +Yang Tse (29 Jan 2009) +- Introduced curl_sspi.c and curl_sspi.h for the implementation of functions + Curl_sspi_global_init() and Curl_sspi_global_cleanup() which previously were + named Curl_ntlm_global_init() and Curl_ntlm_global_cleanup() in http_ntlm.c + Also adjusted socks_sspi.c to remove the link-time dependency on the Windows + SSPI library using it now in the same way as it was done in http_ntlm.c. + +Daniel Stenberg (28 Jan 2009) +- Markus Moeller introduced two new options to libcurl: + CURLOPT_SOCKS5_GSSAPI_SERVICE and CURLOPT_SOCKS5_GSSAPI_NEC to allow libcurl + to do GSS-style authentication with SOCKS5 proxies. The curl tool got the + options called --socks5-gssapi-service and --socks5-gssapi-nec to enable + these. + +Daniel Stenberg (26 Jan 2009) +- Chad Monroe provided the new CURLOPT_TFTP_BLKSIZE option that allows an app + to set desired block size to use for TFTP transfers instead of the default + 512 bytes. + +- The "-no_ticket" option was introduced in Openssl0.9.8j. It's a flag to + disable "rfc4507bis session ticket support". rfc4507bis was later turned + into the proper RFC5077 it seems: http://tools.ietf.org/html/rfc5077 + + The enabled extension concerns the session management. I wonder how often + libcurl stops a connection and then resumes a TLS session. also, sending the + session data is some overhead. .I suggest that you just use your proposed + patch (which explicitly disables TICKET). + + If someone writes an application with libcurl and openssl who wants to + enable the feature, one can do this in the SSL callback. + + Sharad Gupta brought this to my attention. Peter Sylvester helped me decide + on the proper action. + +- Alexey Borzov filed bug report #2535504 + (http://curl.haxx.se/bug/view.cgi?id=2535504) pointing out that realms with + quoted quotation marks in HTTP Digest headers didn't work. I've now added + test case 1095 that verifies my fix. + +- Craig A West brought CURLOPT_NOPROXY and the corresponding --noproxy option. + They basically offer the same thing the NO_PROXY environment variable only + offered previously: list a set of host names that shall not use the proxy + even if one is specified. + +Daniel Fandrich (20 Jan 2009) +- Call setlocale() for libtest tests to test the effects of locale-induced + libc changes on libcurl. + +- Fixed a couple more locale-dependent toupper conversions, mainly for + clarity. This does fix one problem that causes ;type=i FTP URLs + to fail in the Turkish locale when CURLOPT_PROXY_TRANSFER_MODE is + used (test case 561) + +- Added tests 561 and 1091 through 1094 to test various combinations + of ;type= and ;mode= URLs that could potentially fail in the Turkish + locale. + +Daniel Stenberg (20 Jan 2009) +- Lisa Xu pointed out that the ssh.obj file was missing from the + lib/Makefile.vc6 file (and thus from the vc8 and vc9 ones too). + +Version 7.19.3 (19 January 2009) + +Daniel Stenberg (16 Jan 2009) +- Andrew de los Reyes fixed curlbuild.h for "generic" gcc builds on PPC, both + 32 bit and 64 bit. + +Daniel Stenberg (15 Jan 2009) +- Tim Ansell fixed a compiler warning in lib/cookie.c + +Daniel Stenberg (14 Jan 2009) +- Grant Erickson fixed timeouts for TFTP such that specifying a + connect-timeout, a max-time or both options work correctly and as expected + by passing the correct boolean value to Curl_timeleft via the + 'duringconnect' parameter. + + With this small change, curl TFTP now behaves as expected (and likely as + originally-designed): + + 1) For non-existent or unreachable dotted IP addresses: + + a) With no options, follows the default curl 300s timeout... + b) With --connect-timeout only, follows that value... + c) With --max-time only, follows that value... + d) With both --connect-timeout and --max-time, follows the smaller value... + + and times out with a "curl: (7) Couldn't connect to server" error. + + 2) For transfers to/from a valid host: + + a) With no options, follows default curl 300s timeout for the + first XRQ/DATA/ACK transaction and the default TFTP 3600s + timeout for the remainder of the transfer... + + b) With --connect-time only, follows that value for the + first XRQ/DATA/ACK transaction and the default TFTP 3600s + timeout for the remainder of the transfer... + + c) With --max-time only, follows that value for the first + XRQ/DATA/ACK transaction and for the remainder of the + transfer... + + d) With both --connect-timeout and --max-time, follows the former + for the first XRQ/DATA/ACK transaction and the latter for the + remainder of the transfer... + + and times out with a "curl: (28) Timeout was reached" error as + appropriate. + +Daniel Stenberg (13 Jan 2009) +- Michael Wallner fixed a NULL pointer deref when calling + curl_easy_setup(curl, CURLOPT_COOKIELIST, "SESS") on a CURL handle with no + cookies data. + +- Stefan Teleman brought a patch to fix the default curlbuild.h file for the + SunPro compilers. + +Daniel Stenberg (12 Jan 2009) +- Based on bug report #2498665 (http://curl.haxx.se/bug/view.cgi?id=2498665) + by Daniel Black, I've now added magic to the configure script that makes it + use pkg-config to detect gnutls details as well if the existing method + (using libgnutls-config) fails. While doing this, I cleaned up and unified + the pkg-config usage when detecting openssl and nss as well. + +Daniel Stenberg (11 Jan 2009) +- Karl Moerder brought the patch that creates vc9 Makefiles, and I made + 'maketgz' now use the actual makefile targets to do the VC8 and VC9 + makefiles. + +Daniel Stenberg (10 Jan 2009) +- Emil Romanus fixed: + + When using the multi interface over HTTP and the server returns a Location + header, the running easy handle will get stuck in the CURLM_STATE_PERFORM + state, leaving the external event loop stuck waiting for data from the + ingoing socket (when using the curl_multi_socket_action stuff). While this + bug was pretty hard to find, it seems to require only a one-line fix. The + break statement on line 1374 in multi.c caused the function to skip the call + to multistate(). + + How to reproduce this bug? Well, that's another question. evhiperfifo.c in + the examples directory chokes on this bug only _sometimes_, probably + depending on how fast the URLs are added. One way of testing the bug out is + writing to hiper.fifo from more than one source at the same time. + +Daniel Fandrich (7 Jan 2009) +- Unified much of the SessionHandle initialization done in Curl_open() and + curl_easy_reset() by creating Curl_init_userdefined(). This had the side + effect of fixing curl_easy_reset() so it now also resets + CURLOPT_FTP_FILEMETHOD and CURLOPT_SSL_SESSIONID_CACHE + +Daniel Stenberg (7 Jan 2009) +- Rob Crittenden did once again provide an NSS update: + + I have to jump through a few hoops now with the NSS library initialization + since another part of an application may have already initialized NSS by the + time Curl gets invoked. This patch is more careful to only shutdown the NSS + library if Curl did the initialization. + + It also adds in a bit of code to set the default ciphers if the app that + call NSS_Init* did not call NSS_SetDomesticPolicy() or set specific + ciphers. One might argue that this lets other application developers get + lazy and/or they aren't using the NSS API correctly, and you'd be right. + But still, this will avoid terribly difficult-to-trace crashes and is + generally helpful. + +Daniel Stenberg (1 Jan 2009) +- 'reconf' is removed since we rather have users use 'buildconf' + +Daniel Stenberg (31 Dec 2008) +- Bas Mevissen reported http://curl.haxx.se/bug/view.cgi?id=2479030 pointing + out that 'reconf' didn't properly point out the m4 subdirectory when running + aclocal. + +Daniel Stenberg (29 Dec 2008) + - Phil Lisiecki filed bug report #2413067 + (http://curl.haxx.se/bug/view.cgi?id=2413067) that identified a problem that + would cause libcurl to mark a DNS cache entry "in use" eternally if the + subsequence TCP connect failed. It would thus never get pruned and refreshed + as it should've been. + + Phil provided his own patch to this problem that while it seemed to work + wasn't complete and thus I wrote my own fix to the problem. + +Daniel Stenberg (28 Dec 2008) +- Peter Korsgaard fixed building libcurl with "configure --with-ssl + --disable-verbose". + +- Anthony Bryan fixed more language and spelling flaws in man pages. + +Daniel Stenberg (22 Dec 2008) +- Given a recent enough libssh2, libcurl can now seek/resume with SFTP even + on file indexes beyond 2 or 4GB. + +- Anthony Bryan provided a set of patches that cleaned up manual language, + corrected spellings and more. + +Daniel Stenberg (20 Dec 2008) +- Igor Novoseltsev fixed a bad situation for the multi_socket() API when doing + pipelining, as libcurl could then easily get confused and A) work on the + handle that was not "first in queue" on a pipeline, or even B) tell the app + to REMOVE a socket while it was in use by a second handle in a pipeline. Both + errors caused hanging or stalling applications. + +Daniel Stenberg (19 Dec 2008) +- curl_multi_timeout() could return a timeout value of 0 even though nothing + was actually ready to get done, as the internal time resolution is higher + than the returned millisecond timer. Therefore it could cause applications + running on fast processors to do short bursts of busy-loops. + curl_multi_timeout() will now only return 0 if the timeout is actually + alreay triggered. + +- Using the libssh2 0.19 function libssh2_session_block_directions(), libcurl + now has an improved ability to do right when the multi interface (both + "regular" and multi_socket) is used for SCP and SFTP transfers. This should + result in (much) less busy-loop situations and thus less CPU usage with no + speed loss. + +Daniel Stenberg (17 Dec 2008) +- SCP and SFTP with the multi interface had the same flaw: the 'DONE' + operation didn't complete properly if the EAGAIN equivalent was returned but + libcurl would simply continue with a half-completed close operation + performed. This ruined persistent connection re-use and cause some + SSH-protocol errors in general. The correction is unfortunately adding a + blocking function - doing it entirely non-blocking should be considered for + a better fix. + +Gisle Vanem (16 Dec 2008) +- Added the possibility to use the Watt-32 tcp/ip stack under Windows. + The change simply involved adding a USE_WATT32 section in the + config-win32.h files (under ./lib and ./src). This section disables + the use of any Winsock headers. + +Daniel Stenberg (16 Dec 2008) +- libssh2_sftp_last_error() was wrongly used at some places in libcurl which + made libcurl sometimes not properly abort problematic SFTP transfers. + +Daniel Stenberg (12 Dec 2008) +- More work with Igor Novoseltsev to first fix the remaining stuff for + removing easy handles from multi handles when the easy handle is/was within + a HTTP pipeline. His bug report #2351653 + (http://curl.haxx.se/bug/view.cgi?id=2351653) was also related and was + eventually fixed by a patch by Igor himself. + +Yang Tse (12 Dec 2008) +- Patrick Monnerat fixed a build regression, introduced in 7.19.2, affecting + OS/400 compilations with IPv6 enabled. + +Daniel Stenberg (12 Dec 2008) +- Mark Karpeles filed bug report #2416182 titled "crash in ConnectionExists + when using duphandle+curl_mutli" + (http://curl.haxx.se/bug/view.cgi?id=2416182) which showed that + curl_easy_duphandle() wrongly also copied the pointer to the connection + cache, which was plain wrong and caused a segfault if the handle would be + used in a different multi handle than the handle it was duplicated from. + +Daniel Stenberg (11 Dec 2008) +- Keshav Krity found out that libcurl failed to deal with dotted IPv6 + addresses if they were very long (>39 letters) due to a too strict address + validity parser. It now accepts addresses up to 45 bytes long. + +Daniel Stenberg (11 Dec 2008) +- Internet Explorer had a broken HTTP digest authentication before v7 and + there are servers "out there" that relies on the client doing this broken + Digest authentication. Apache even comes with an option to work with such + broken clients. + + The difference is only for URLs that contain a query-part (a '?'-letter and + text to the right of it). + + libcurl now supports this quirk, and you enable it by setting the + CURLAUTH_DIGEST_IE bit in the bitmask you pass to the CURLOPT_HTTPAUTH or + CURLOPT_PROXYAUTH options. They are thus individually controlled to server + and proxy. + + (note that there's no way to activate this with the curl tool yet) + +Daniel Fandrich (9 Dec 2008) +- Added test cases 1089 and 1090 to test --write-out after a redirect to + test a report that the size didn't work, but these test cases pass. + +- Documented CURLOPT_CONNECT_ONLY as being useful only on HTTP URLs. + +Daniel Stenberg (9 Dec 2008) +- Ken Hirsch simplified how libcurl does FTPS: now it doesn't assume any + particular state for the control connection like it did before for implicit + FTPS (libcurl assumed such control connections to be encrypted while some + FTPS servers such as FileZilla assumes such connections to be clear + mode). Use the CURLOPT_USE_SSL option to set your desired level. + +Daniel Stenberg (8 Dec 2008) +- Fred Machado posted about a weird FTP problem on the curl-users list and when + researching it, it turned out he got a 550 response back from a SIZE command + and then I fell over the text in RFC3659 that says: + + The presence of the 550 error response to a SIZE command MUST NOT be taken + by the client as an indication that the file cannot be transferred in the + current MODE and TYPE. + + In other words: the change I did on September 30th 2008 and that has been + included in the last two releases were a regression and a bad idea. We MUST + NOT take a 550 response from SIZE as a hint that the file doesn't exist. + +- Christian Krause filed bug #2221237 + (http://curl.haxx.se/bug/view.cgi?id=2221237) that identified an infinite + loop during GSS authentication given some specific conditions. With his + patience and great feedback I managed to narrow down the problem and + eventually fix it although I can't test any of this myself! + +Daniel Fandrich (3 Dec 2008) +- Fixed the getifaddrs version of Curl_if2ip to work on systems without IPv6 + support (e.g. Minix) + +Daniel Stenberg (3 Dec 2008) +- Igor Novoseltsev filed bug #2351645 + (http://curl.haxx.se/bug/view.cgi?id=2351645) that identified a problem with + the multi interface that occured if you removed an easy handle while in + progress and the handle was used in a HTTP pipeline. + +- Pawel Kierski pointed out a mistake in the cookie code that could lead to a + bad fclose() after a fatal error had occured. + (http://curl.haxx.se/bug/view.cgi?id=2382219) + +Daniel Fandrich (25 Nov 2008) +- If a HTTP request is Basic and num is already >=1000, the HTTP test + server adds 1 to num to get the data section to return. This allows + testing authentication negotiations using the Basic authentication + method. + +- Added tests 1087 and 1088 to test Basic authentication on a redirect + with and without --location-trusted + +Daniel Stenberg (24 Nov 2008) +- Based on a patch by Vlad Grachov, libcurl now uses a new libssh2 0.19 + function when built to support SCP and SFTP that helps the library to know + in which direction a particular libssh2 operation would return EAGAIN so + that libcurl knows what socket conditions to wait for before trying the + function call again. Previously (and still when using libssh2 0.18 or + earlier), libcurl will busy-loop in this situation when the easy interface + is used! + +Daniel Fandrich (20 Nov 2008) +- Automatically detect OpenBSD's CA cert bundle. + +Daniel Stenberg (19 Nov 2008) +- I removed the default use of "Pragma: no-cache" from libcurl when a proxy is + used. It has been used since forever but it was never a good idea to use + unless explicitly asked for. + +- Josef Wolf's extension that allows a $TESTDIR/gdbinit$testnum file that when + you use runtests.pl -g, will be sourced by gdb to allow additional fancy or + whatever you see fit + +- Christian Krause reported and fixed a memory leak that would occur with HTTP + GSS/kerberos authentication (http://curl.haxx.se/bug/view.cgi?id=2284386) + +- Andreas Wurf and Markus Koetter helped me analyze a problem that Andreas got + when uploading files to a single FTP server using multiple easy handle + handles with the multi interface. Occasionally a handle would stall in + mysterious ways. + + The problem turned out to be a side-effect of the ConnectionExists() + function's eagerness to re-use a handle for HTTP pipelining so it would + select it even if already being in use, due to an inadequate check for its + chances of being used for pipelnining. + +Daniel Fandrich (17 Nov 2008) +- Added more compiler warning options for gcc 4.3 + +Yang Tse (17 Nov 2008) +- Fix a remaining problem in the inet_pton() runtime configure check. And + fix internal Curl_inet_pton() failures to reject certain malformed literals. + +- Make configure script check if ioctl with the SIOCGIFADDR command can be + used, and define HAVE_IOCTL_SIOCGIFADDR if appropriate. + +Daniel Stenberg (16 Nov 2008) +- Christian Krause fixed a build failure when building with gss support + enabled and FTP disabled. + +- Added check for NULL returns from strdup() in src/main.c and lib/formdata.c + - reported by Jim Meyering also prevent buffer overflow on MSDOS when you do + for example -O on a url with a file name part longer than PATH_MAX letters + +- lib/nss.c fixes based on the report by Jim Meyering: I went over and added + checks for return codes for all calls to malloc and strdup that were + missing. I also changed a few malloc(13) to use arrays on the stack and a + few malloc(PATH_MAX) to instead use aprintf() to lower memory use. + +- I fixed a memory leak in Curl_nss_connect() when CURLOPT_ISSUERCERT is + in use. + +Daniel Fandrich (14 Nov 2008) +- Added .xml as one of the few common file extensions known by the multipart + form generator. + +- Added some #ifdefs around header files and change the EAGAIN test to + fix compilation on Cell (reported by Jeff Curley). + +Yang Tse (14 Nov 2008) +- Fixed several configure script issues affecting checks for inet_ntoa_r(), + inet_ntop(), inet_pton(), getifaddrs(), fcntl() and getaddrinfo(). + +Yang Tse (13 Nov 2008) +- Refactored configure script detection of functions used to set sockets into + non-blocking mode, and decouple function detection from function capability. Version 7.19.2 (13 November 2008) |